Spyware / Malware / Virus Removal

JS:Agent-EDB infection [Solved]

20 min read

Looking for the outcome? Ask AI

terryfelter Topic Starter

Post #1January 9, 2018, 2:27 PM UTC

I am using a free version of Avast and I keep getting a pop-up that indicates I am infected with JS:Agent-EDB, but when scanning for threats this does not appear in the list.

Here is my HiJack file

Logfile of Trend Micro HijackThis v2.0.4
Scan saved at 8:23:52 AM, on 1/9/2018
Platform: Windows 7 SP1 (WinNT 6.00.3505)
MSIE: Internet Explorer v11.0 (11.00.9600.18894)
Boot mode: Normal

Running processes:
C:\Program Files (x86)\NVIDIA Corporation\Update Core\NvBackend.exe
C:\Program Files\AVAST Software\Avast\AvastUI.exe
C:\Program Files (x86)\Microsoft Office\Office97\Office\FINDFAST.EXE
C:\Program Files (x86)\Microsoft Office\Office97\Office\OSA.EXE
C:\Program Files (x86)\Intel\Intel(R) USB 3.0 eXtensible Host Controller Driver\Application\iusb3mon.exe
C:\Program Files\Alienware\Command Center\AlienwareAlienFXController.exe
C:\Program Files (x86)\Yahoo!\Messenger\ymsgr_tray.exe
C:\Program Files\Alienware\Command Center\AWCCApplicationWatcher32.exe
C:\Program Files (x86)\Alienware Customer Surveys\AlienSurvey.exe
C:\Program Files\Intel\Intel(R) Rapid Storage Technology\IAStorIcon.exe
C:\Program Files\Alienware\Command Center\AlienFusionController.exe
C:\Program Files\AVAST Software\Avast\AvastUI.exe
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
C:\Program Files (x86)\eSignal\WinSig.exe
C:\Program Files (x86)\eSignal\winros.exe
C:\Users\TerryF\AppData\Local\ScottradeElite\ScottradeElite.exe
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
C:\Users\TerryF\Downloads\HiJackThis.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://dell13.msn.com/?pc=DCJB
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/p/?LinkId=255141
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/p/?LinkId=255141
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant =
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch =
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Local Page = C:\Windows\SysWOW64\blank.htm
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,AutoConfigURL = http://access-quick.com/wpad.dat?e924402e70027ab7006c8bc7e654272a36290340
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName =
F2 - REG:system.ini: UserInit=userinit.exe
O2 - BHO: (no name) - {02478D38-C3F9-4efb-9B51-7695ECA05670} - (no file)
O2 - BHO: avast! Online Security - {8E5E2654-AD2D-48bf-AC2D-D17F00898D06} - C:\Program Files\AVAST Software\Avast\aswWebRepIE.dll
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - C:\Program Files (x86)\Google\Google Toolbar\GoogleToolbar_32.dll
O3 - Toolbar: Google Toolbar - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - C:\Program Files (x86)\Google\Google Toolbar\GoogleToolbar_32.dll
O4 - HKLM\..\Run: [Alienware Survey] c:\Program Files (x86)\Alienware Customer Surveys\AlienSurvey.exe /boot
O4 - HKLM\..\Run: [Dolby Home Theater v4] "C:\Program Files (x86)\Dolby Home Theater v4\pcee4.exe" -autostart
O4 - HKLM\..\Run: [USB3MON] "C:\Program Files (x86)\Intel\Intel(R) USB 3.0 eXtensible Host Controller Driver\Application\iusb3mon.exe"
O4 - HKLM\..\Run: [AlienwareOn-ScreenDisplay] C:\Program Files (x86)\Alienware On-Screen Display\AlienwareOn-ScreenDisplay.exe
O4 - HKCU\..\Run: [GUDelayStartup] "C:\Program Files (x86)\Glary Utilities 5\StartupManager.exe" -delayrun
O4 - HKCU\..\Run: [Messenger (Yahoo!)] "C:\PROGRA~2\Yahoo!\Messenger\YahooMessenger.exe" -quiet
O4 - HKCU\..\Run: [DellSystemDetect] C:\Users\TerryF\AppData\Local\Apps\2.0\857OOCAD.RLB\GLBEMZC7.J2H\dell..tion_831211ca63b981c5_0008.0005_9a48d74816d64e41\DellSystemDetect.exe 4zZn5oeQk9WMM5ZBt7fsYA==
O4 - HKLM\..\Policies\Explorer\Run: [BtvStack] "C:\Program Files (x86)\Bluetooth Suite\BtvStack.exe"
O4 - Global Startup: Microsoft Find Fast.lnk = C:\Program Files (x86)\Microsoft Office\Office97\Office\FINDFAST.EXE
O4 - Global Startup: Office Startup.lnk = C:\Program Files (x86)\Microsoft Office\Office97\Office\OSA.EXE
O4 - Global Startup: Symantec Fax Starter Edition Port.lnk = C:\Program Files (x86)\Microsoft Office\Office2K\Office\1033\OLFSNT40.EXE
O10 - Unknown file in Winsock LSP: c:\windows\system32\lavasofttcpservice.dll
O10 - Unknown file in Winsock LSP: c:\windows\system32\lavasofttcpservice.dll
O10 - Unknown file in Winsock LSP: c:\windows\system32\lavasofttcpservice.dll
O10 - Unknown file in Winsock LSP: c:\windows\system32\lavasofttcpservice.dll
O10 - Unknown file in Winsock LSP: c:\windows\system32\lavasofttcpservice.dll
O11 - Options group: [ACCELERATED_GRAPHICS] Accelerated graphics
O15 - Trusted Zone: http://www.cboe.com
O15 - Trusted Zone: *.dell.com
O15 - Trusted Zone: http://*.webcompanion.com
O16 - DPF: {E06E2E99-0AA1-11D4-ABA6-0060082AA75C} (GpcContainer Class) - https://akamaicdn.webex.com/client/WBXclient-T29L10NSP13EP2-10118/support/ieatgpc1.cab
O20 - AppInit_DLLs: C:\Windows\SysWOW64\nvinit.dll
O23 - Service: Adobe Acrobat Update Service (AdobeARMservice) - Adobe Systems Incorporated - C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe
O23 - Service: Adobe Flash Player Update Service (AdobeFlashPlayerUpdateSvc) - Adobe Systems Incorporated - C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe
O23 - Service: Andrea RT Filters Service (AERTFilters) - Andrea Electronics Corporation - C:\Program Files\Realtek\Audio\HDA\AERTSr64.exe
O23 - Service: @%SystemRoot%\system32\Alg.exe,-112 (ALG) - Unknown owner - C:\Windows\System32\alg.exe (file missing)
O23 - Service: Alienware Fusion Service (AlienFusionService) - Alienware - C:\Program Files\Alienware\Command Center\AlienFusionService.exe
O23 - Service: aswbIDSAgent - AVAST Software - C:\Program Files\AVAST Software\Avast\x64\aswidsagenta.exe
O23 - Service: WebEx Service Host for Support Center (atashost) - Cisco WebEx LLC - C:\Windows\SysWOW64\atashost.exe
O23 - Service: AtherosSvc - Windows (R) Win 7 DDK provider - C:\Program Files (x86)\Bluetooth Suite\adminservice.exe
O23 - Service: Avast Antivirus (avast! Antivirus) - AVAST Software - C:\Program Files\AVAST Software\Avast\AvastSvc.exe
O23 - Service: AvastVBox COM Service (AvastVBoxSvc) - Unknown owner - C:\Program Files\AVAST Software\Avast\ng\vbox\AvastVBoxSVC.exe (file missing)
O23 - Service: Intel(R) Content Protection HECI Service (cphs) - Intel Corporation - C:\Windows\SysWow64\IntelCpHeciSvc.exe
O23 - Service: Dell Data Vault Service API (DDVCollectorSvcApi) - Dell Inc. - C:\Program Files\Dell\DellDataVault\DDVCollectorSvcApi.exe
O23 - Service: Dell Data Vault Collector (DDVDataCollector) - Dell Inc. - C:\Program Files\Dell\DellDataVault\DDVDataCollector.exe
O23 - Service: Dell Data Vault Processor (DDVRulesProcessor) - Dell Inc. - C:\Program Files\Dell\DellDataVault\DDVRulesProcessor.exe
O23 - Service: @%SystemRoot%\system32\efssvc.dll,-100 (EFS) - Unknown owner - C:\Windows\System32\lsass.exe (file missing)
O23 - Service: @%systemroot%\system32\fxsresm.dll,-118 (Fax) - Unknown owner - C:\Windows\system32\fxssvc.exe (file missing)
O23 - Service: NVIDIA GeForce Experience Service (GfExperienceService) - NVIDIA Corporation - C:\Program Files\NVIDIA Corporation\GeForce Experience Service\GfExperienceService.exe
O23 - Service: GoToAssist Corporate (GoToAssist) - Citrix Systems, Inc. - C:\Program Files (x86)\Citrix\GoToAssist Corporate\1165\G2AC_Service.exe
O23 - Service: Google Update Service (gupdate) (gupdate) - Google Inc. - C:\Program Files (x86)\Google\Update\GoogleUpdate.exe
O23 - Service: Google Update Service (gupdatem) (gupdatem) - Google Inc. - C:\Program Files (x86)\Google\Update\GoogleUpdate.exe
O23 - Service: Google Software Updater (gusvc) - Google - C:\Program Files (x86)\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: Intel(R) Rapid Storage Technology (IAStorDataMgrSvc) - Intel Corporation - C:\Program Files\Intel\Intel(R) Rapid Storage Technology\IAStorDataMgrSvc.exe
O23 - Service: IconMan_R - Realsil Microelectronics Inc. - C:\Program Files (x86)\Realtek\Realtek PCIE Card Reader\RIconMan.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files (x86)\Common Files\InstallShield\Driver\1050\Intel 32\IDriverT.exe
O23 - Service: @%SystemRoot%\system32\ieetwcollectorres.dll,-1000 (IEEtwCollectorService) - Unknown owner - C:\Windows\system32\IEEtwCollector.exe (file missing)
O23 - Service: Intel(R) HD Graphics Control Panel Service (igfxCUIService1.0.0.0) - Unknown owner - C:\Windows\system32\igfxCUIService.exe (file missing)
O23 - Service: Intel(R) Capability Licensing Service Interface - Intel(R) Corporation - c:\Program Files\Intel\iCLS Client\HeciServer.exe
O23 - Service: Intel(R) Capability Licensing Service TCP IP Interface - Intel(R) Corporation - c:\Program Files\Intel\iCLS Client\SocketHeciServer.exe
O23 - Service: ioloEnergyBooster - iolo technologies, LLC - C:\Program Files\Alienware\Command Center\ioloEnergyBooster.exe
O23 - Service: Intel(R) Dynamic Application Loader Host Interface Service (jhi_service) - Intel Corporation - C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\DAL\jhi_service.exe
O23 - Service: @keyiso.dll,-100 (KeyIso) - Unknown owner - C:\Windows\system32\lsass.exe (file missing)
O23 - Service: Intel(R) Management and Security Application Local Management Service (LMS) - Intel Corporation - C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\LMS\LMS.exe
O23 - Service: Mozilla Maintenance Service (MozillaMaintenance) - Mozilla Foundation - C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
O23 - Service: @comres.dll,-2797 (MSDTC) - Unknown owner - C:\Windows\System32\msdtc.exe (file missing)
O23 - Service: @%SystemRoot%\System32\netlogon.dll,-102 (Netlogon) - Unknown owner - C:\Windows\system32\lsass.exe (file missing)
O23 - Service: NVIDIA Network Service (NvNetworkService) - NVIDIA Corporation - C:\Program Files (x86)\NVIDIA Corporation\NetService\NvNetworkService.exe
O23 - Service: NVIDIA Streamer Service (NvStreamSvc) - NVIDIA Corporation - C:\Program Files\NVIDIA Corporation\NvStreamSrv\nvstreamsvc.exe
O23 - Service: NVIDIA Display Driver Service (nvsvc) - Unknown owner - C:\Windows\system32\nvvsvc.exe (file missing)
O23 - Service: @%systemroot%\system32\psbase.dll,-300 (ProtectedStorage) - Unknown owner - C:\Windows\system32\lsass.exe (file missing)
O23 - Service: @%systemroot%\system32\Locator.exe,-2 (RpcLocator) - Unknown owner - C:\Windows\system32\locator.exe (file missing)
O23 - Service: Realtek Audio Service (RtkAudioService) - Realtek Semiconductor - C:\Program Files\Realtek\Audio\HDA\RtkAudioService64.exe
O23 - Service: @%SystemRoot%\system32\samsrv.dll,-1 (SamSs) - Unknown owner - C:\Windows\system32\lsass.exe (file missing)
O23 - Service: SoftThinks Agent Service (SftService) - SoftThinks SAS - C:\Program Files (x86)\AlienRespawn\sftservice.exe
O23 - Service: @%SystemRoot%\system32\snmptrap.exe,-3 (SNMPTRAP) - Unknown owner - C:\Windows\System32\snmptrap.exe (file missing)
O23 - Service: @%systemroot%\system32\spoolsv.exe,-1 (Spooler) - Unknown owner - C:\Windows\System32\spoolsv.exe (file missing)
O23 - Service: @%SystemRoot%\system32\sppsvc.exe,-101 (sppsvc) - Unknown owner - C:\Windows\system32\sppsvc.exe (file missing)
O23 - Service: NVIDIA Stereoscopic 3D Driver Service (Stereo Service) - NVIDIA Corporation - C:\Program Files (x86)\NVIDIA Corporation\3D Vision\nvSCPAPISvr.exe
O23 - Service: Dell SupportAssist Agent (SupportAssistAgent) - Dell Inc. - C:\Program Files\Dell\SupportAssistAgent\bin\SupportAssistAgent.exe
O23 - Service: @%SystemRoot%\system32\ui0detect.exe,-101 (UI0Detect) - Unknown owner - C:\Windows\system32\UI0Detect.exe (file missing)
O23 - Service: @%SystemRoot%\system32\vaultsvc.dll,-1003 (VaultSvc) - Unknown owner - C:\Windows\system32\lsass.exe (file missing)
O23 - Service: @%SystemRoot%\system32\vds.exe,-100 (vds) - Unknown owner - C:\Windows\System32\vds.exe (file missing)
O23 - Service: @%systemroot%\system32\vssvc.exe,-102 (VSS) - Unknown owner - C:\Windows\system32\vssvc.exe (file missing)
O23 - Service: @%SystemRoot%\system32\Wat\WatUX.exe,-601 (WatAdminSvc) - Unknown owner - C:\Windows\system32\Wat\WatAdminSvc.exe (file missing)
O23 - Service: @%systemroot%\system32\wbengine.exe,-104 (wbengine) - Unknown owner - C:\Windows\system32\wbengine.exe (file missing)
O23 - Service: @%Systemroot%\system32\wbem\wmiapsrv.exe,-110 (wmiApSrv) - Unknown owner - C:\Windows\system32\wbem\WmiApSrv.exe (file missing)
O23 - Service: @%PROGRAMFILES%\Windows Media Player\wmpnetwk.exe,-101 (WMPNetworkSvc) - Unknown owner - C:\Program Files (x86)\Windows Media Player\wmpnetwk.exe (file missing)
O23 - Service: Yahoo! Updater (YahooAUService) - Yahoo! Inc. - C:\Program Files (x86)\Yahoo!\SoftwareUpdate\YahooAUService.exe

–
End of file - 13209 bytes

Satchfan

Post #2January 9, 2018, 3:00 PM UTC

Hello terryfelter and welcome to the WTT forum.

My name is Satchfan and I would be glad to help you with your computer problem.

Please read the following guidelines which will help to make cleaning your machine easier:

please follow all instructions in the order posted
please continue to review my answers until I tell you your machine appears to be clear. Absence of symptoms does not mean that everything is clear
all logs/reports, etc. must be posted in Notepad. Please ensure that word wrap is unchecked. In Notepad click Format, uncheck Word wrap if it is checked
if you don't understand something, please don't hesitate to ask for clarification before proceeding
the fixes are specific to your problem and should only be used for this issue on this machine.
please reply within 3 days. If you do not reply within this period I will post a reminder but topics with no reply in 4 days will be closed!

IMPORTANT:

Please DO NOT install/uninstall any programs unless asked to.
Please DO NOT run any scans other than those requested

===================================================

Note: Please run these in the order given in the instructions.

===================================================

Download and run AdwCleaner

Download AdwCleaner from here and save it to your desktop.

run AdwCleaner by clicking on Scan
when it has finished, leave everything that was found checked, (ticked), then click on Clean
if it asks to reboot, allow the reboot
on reboot a log will be produced; please attach the content of the log to your next reply.

===================================================

Run Farbar Recovery Scan Tool

Please download Farbar Recovery Scan Tool and save it to your Desktop.

Note: You need to run the version compatible with your system. If you are not sure which version applies to your system download both of them and try to run them. Only one of them will run on your system, that will be the right version.

right click to run as administrator, (XP users click run after receipt of Windows Security Warning - Open File). When the tool opens click Yes to disclaimer
press Scan button
it will produce a log called Frst.txt in the same directory the tool is run from
please copy and paste log back here
the first time the tool is run it generates another log (Addition.txt - also located in the same directory as FRST.exe/FRST64.exe). Please also paste that along with the Frst.txt into your reply.

Logs to include with next post:

AdwCleaner log
Frst.txt
Addition.txt

Thanks

Satchfan

terryfelter

Post #3January 9, 2018, 3:28 PM UTC

Here is the Adware file.

# AdwCleaner 7.0.6.0 - Logfile created on Tue Jan 09 15:26:32 2018
# Updated on 2017/21/12 by Malwarebytes
# Database: 01-08-2018.1
# Running on Windows 7 Home Premium (X64)
# Mode: scan
# Support: https://www.malwarebytes.com/support

***** [ Services ] *****

PUP.Optional.Legacy, YahooAUService

***** [ Folders ] *****

PUP.Optional.OneSystemCare, C:\Users\TerryF\AppData\Roaming\One System Care
PUP.Optional.WebBar, C:\Program Files\WebDiscoverBrowser
PUP.Optional.WebCompanion, C:\Windows\System32\config\systemprofile\AppData\Local\LavasoftTcpService
PUP.Optional.WebCompanion, C:\Windows\SysWOW64\config\systemprofile\AppData\Local\LavasoftTcpService

***** [ Files ] *****

PUP.Optional.Legacy, C:\Users\TerryF\Documents\uninstaller.exe
PUP.Optional.Legacy, C:\Windows\System32\lavasofttcpservice.dll
PUP.Optional.Legacy, C:\Windows\SysWOW64\lavasofttcpservice.dll
PUP.Optional.Legacy, C:\Windows\System32\LavasoftTcpServiceOff.ini
PUP.Optional.Legacy, C:\Windows\SysNative\LavasoftTcpServiceOff.ini
PUP.Optional.Legacy, C:\Windows\SysWOW64\LavasoftTcpServiceOff.ini
PUP.Optional.Legacy, C:\Windows\SysNative\LavasoftTcpService64.dll

***** [ DLL ] *****

No malicious DLLs found.

***** [ WMI ] *****

No malicious WMI found.

***** [ Shortcuts ] *****

No malicious shortcuts found.

***** [ Tasks ] *****

No malicious tasks found.

***** [ Registry ] *****

PUP.Optional.Legacy, [Key] - HKCU\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage\ak.staticimgfarm.com
PUP.Optional.Legacy, [Key] - HKCU\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage\ask.com
PUP.Optional.Legacy, [Key] - HKCU\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage\cloudfront.net
PUP.Optional.Legacy, [Key] - HKCU\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage\d3l3lkinz3f56t.cloudfront.net
PUP.Optional.Legacy, [Key] - HKCU\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage\dotomi.com
PUP.Optional.Legacy, [Key] - HKCU\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage\fromdoctopdf.dl.tb.ask.com
PUP.Optional.Legacy, [Key] - HKCU\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage\passwordlogic.dl.tb.ask.com
PUP.Optional.Legacy, [Key] - HKCU\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage\plarium.com
PUP.Optional.Legacy, [Key] - HKCU\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage\searchformsonline.dl.tb.ask.com
PUP.Optional.Legacy, [Key] - HKCU\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage\staticimgfarm.com
PUP.Optional.Legacy, [Key] - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Setup Support for Consumer Input
PUP.Optional.Legacy, [Key] - HKLM\SOFTWARE\WebDiscoverBrowser
PUP.Optional.Legacy, [Key] - HKU\S-1-5-21-2249576302-3863294968-408106873-1001\Software\WebDiscoverBrowser
PUP.Optional.Legacy, [Key] - HKCU\Software\WebDiscoverBrowser
PUP.Optional.Legacy, [Key] - HKLM\SOFTWARE\Yahoo\Companion
PUP.Optional.Legacy, [Key] - HKU\S-1-5-21-2249576302-3863294968-408106873-1001\Software\Yahoo\Companion
PUP.Optional.Legacy, [Key] - HKU\S-1-5-21-2249576302-3863294968-408106873-1001\Software\AppDataLow\Software\Yahoo\Companion
PUP.Optional.Legacy, [Key] - HKCU\Software\Yahoo\Companion
PUP.Optional.Legacy, [Key] - HKCU\Software\AppDataLow\Software\Yahoo\Companion
PUP.Optional.Legacy, [Key] - HKU\S-1-5-21-2249576302-3863294968-408106873-1001\Software\Yahoo\YFriendsBar
PUP.Optional.Legacy, [Key] - HKCU\Software\Yahoo\YFriendsBar
PUP.Optional.Legacy, [Key] - HKU\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{B49699FC-1665-4414-A1CB-C4A2A4A13EEC}
PUP.Optional.Legacy, [Key] - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\PreApproved\{EF99BD32-C1FB-11D2-892F-0090271D4F88}
PUP.Optional.Legacy, [Key] - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{02478D38-C3F9-4EFB-9B51-7695ECA05670}
PUP.Optional.Legacy, [Key] - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\PreApproved\{02478D38-C3F9-4EFB-9B51-7695ECA05670}
PUP.Optional.Legacy, [Key] - HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{02478D38-C3F9-4EFB-9B51-7695ECA05670}
PUP.Optional.Legacy, [Key] - HKLM\SOFTWARE\Classes\CLSID\{F83D1872-D9FF-47F8-B5A0-49CC51E24EE8}
PUP.Optional.Legacy, [Key] - HKLM\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{7D87094D-49E1-4C72-8C9E-3D937A119BE5}
PUP.Optional.Legacy, [Key] - HKLM\SOFTWARE\Classes\AppID\{7375D127-3955-4654-8E7D-1949A7A9C902}
PUP.Optional.Legacy, [Key] - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\Domains\webcompanion.com
PUP.Optional.ConsumerInput, [Key] - HKU\.DEFAULT\Software\AppDataLow\Software\Compete
PUP.Optional.ConsumerInput, [Key] - HKU\S-1-5-18\Software\AppDataLow\Software\Compete
PUP.Optional.ConsumerInput, [Key] - HKLM\SOFTWARE\CompeteInc
PUP.Optional.SofTonicAssistant, [Key] - HKCU\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage\better-ds3.en.softonic.com
PUP.Optional.SofTonicAssistant, [Key] - HKCU\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage\en.softonic.com
PUP.Optional.SofTonicAssistant, [Key] - HKCU\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage\softonic.com
PUP.Optional.DriverAgent, [Key] - HKCU\Software\Microsoft\Internet Explorer\DOMStorage\driversupport.com
PUP.Optional.WeDownLoadManager, [Key] - HKU\S-1-5-21-2249576302-3863294968-408106873-1001\Software\WEDLMNGR
PUP.Optional.WeDownLoadManager, [Key] - HKCU\Software\WEDLMNGR
PUP.Optional.WebCompanion, [Key] - HKLM\SOFTWARE\Classes\AppID\{2CE0F1DC-C504-4B7B-A385-D94A2531DFFB}
PUP.Optional.WebCompanion, [Key] - HKLM\SOFTWARE\Classes\AppID\LavasoftTcpService.exe

***** [ Firefox (and derivatives) ] *****

No malicious Firefox entries.

***** [ Chromium (and derivatives) ] *****

No malicious Chromium entries.

*************************

########## EOF - C:\AdwCleaner\AdwCleaner[S0].txt ##########

Satchfan

Post #4January 9, 2018, 3:47 PM UTC

You didn't follow the instructions.

Please run AdwCleaner again and leave everything that was found checked, (ticked), then click on Clean.

terryfelter

Post #5January 9, 2018, 4:03 PM UTC

My apologies:

# AdwCleaner 7.0.6.0 - Logfile created on Tue Jan 09 16:01:52 2018
# Updated on 2017/21/12 by Malwarebytes
# Running on Windows 7 Home Premium (X64)
# Mode: clean
# Support: https://www.malwarebytes.com/support

***** [ Services ] *****

No malicious services deleted.

***** [ Folders ] *****

No malicious folders deleted.

***** [ Files ] *****

Deleted: C:\Windows\System32\lavasofttcpservice.dll
Deleted: C:\Windows\SysWOW64\lavasofttcpservice.dll
Deleted: C:\Windows\SysNative\LavasoftTcpService64.dll

***** [ DLL ] *****

No malicious DLLs cleaned.

***** [ WMI ] *****

No malicious WMI cleaned.

***** [ Shortcuts ] *****

No malicious shortcuts cleaned.

***** [ Tasks ] *****

No malicious tasks deleted.

***** [ Registry ] *****

Deleted: [Key] - HKLM\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{7D87094D-49E1-4C72-8C9E-3D937A119BE5}

***** [ Firefox (and derivatives) ] *****

No malicious Firefox entries deleted.

***** [ Chromium (and derivatives) ] *****

No malicious Chromium entries deleted.

*************************

::Tracing keys deleted
::Winsock settings cleared
::Additional Actions: 0

*************************

C:/AdwCleaner/AdwCleaner[S0].txt - [5995 B] - [2018/1/9 15:26:32]
C:/AdwCleaner/AdwCleaner[S1].txt - [1294 B] - [2018/1/9 16:1:40]

########## EOF - C:\AdwCleaner\AdwCleaner[C0].txt ##########

Satchfan

Post #6January 9, 2018, 4:11 PM UTC last edited January 9, 2018, 4:12 PM UTC

That's good. Now please run FRST and send both logs.

If you ran it before cleaning what was found with AdwCleaner, please run it again and make sure there is a checkmark next to ‘Addition.txt’ before you hit Scan.

Thanks

terryfelter

Post #7January 9, 2018, 4:18 PM UTC

FRST:

Scan result of Farbar Recovery Scan Tool (FRST) (x64) Version: 02.01.2018
Ran by [removed] (administrator) on TERRYF-PC (09-01-2018 10:16:44)
Running from C:\Users\[removed]\Downloads
[removed] Platform: Windows 7 Home Premium Service Pack 1 (X64) Language: English (United States)
Internet Explorer Version 11 (Default browser: IE)
Boot Mode: Normal
Tutorial for Farbar Recovery Scan Tool: http://www.geekstogo.com/forum/topic/335081-frst-tutorial-how-to-use-farbar-recovery-scan-tool/

==================== Processes (Whitelisted) =================

(If an entry is included in the fixlist, the process will be closed. The file will not be moved.)

(NVIDIA Corporation) C:\Windows\System32\nvvsvc.exe
(NVIDIA Corporation) C:\Program Files (x86)\NVIDIA Corporation\3D Vision\nvSCPAPISvr.exe
(Intel Corporation) C:\Windows\System32\igfxCUIService.exe
(Realtek Semiconductor) C:\Program Files\Realtek\Audio\HDA\RtkAudioService64.exe
(Realtek Semiconductor) C:\Program Files\Realtek\Audio\HDA\RAVBg64.exe
(AVAST Software) C:\Program Files\AVAST Software\Avast\AvastSvc.exe
(NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\Display\nvxdsync.exe
(NVIDIA Corporation) C:\Windows\System32\nvvsvc.exe
(Andrea Electronics Corporation) C:\Program Files\Realtek\Audio\HDA\AERTSr64.exe
(Cisco WebEx LLC) C:\Windows\SysWOW64\atashost.exe
(Windows (R) Win 7 DDK provider) C:\Program Files (x86)\Bluetooth Suite\AdminService.exe
(NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\GeForce Experience Service\GfExperienceService.exe
(Realsil Microelectronics Inc.) C:\Program Files (x86)\Realtek\Realtek PCIE Card Reader\RIconMan.exe
(Intel(R) Corporation) C:\Program Files\Intel\iCLS Client\HeciServer.exe
(NVIDIA Corporation) C:\Program Files (x86)\NVIDIA Corporation\NetService\NvNetworkService.exe
(NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\NvStreamSrv\nvstreamsvc.exe
(NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\NvStreamSrv\nvstreamsvc.exe
(AVAST Software) C:\Program Files\AVAST Software\Avast\x64\aswidsagenta.exe
(NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\NvStreamSrv\nvstreamsvc.exe
(Realtek Semiconductor) C:\Program Files\Realtek\Audio\HDA\RAVBg64.exe
(Realtek Semiconductor) C:\Program Files\Realtek\Audio\HDA\RAVBg64.exe
(Microsoft Corporation) C:\Windows\Microsoft.NET\Framework64\v3.0\WPF\PresentationFontCache.exe
(Realtek Semiconductor) C:\Program Files\Realtek\Audio\HDA\RAVBg64.exe
(Microsoft Corporation) C:\Program Files\Microsoft Mouse and Keyboard Center\ipoint.exe
(Microsoft Corporation) C:\Program Files\Microsoft Mouse and Keyboard Center\itype.exe
(NVIDIA Corporation) C:\Program Files (x86)\NVIDIA Corporation\Update Core\NvBackend.exe
(Intel Corporation) C:\Windows\System32\igfxHK.exe
(Qualcomm®Atheros®) C:\Program Files (x86)\Bluetooth Suite\BtvStack.exe
(Realtek Semiconductor) C:\Program Files\Realtek\Audio\HDA\RtkNGUI64.exe
(Realtek Semiconductor) C:\Program Files\Realtek\Audio\HDA\RAVBg64.exe
(Realtek Semiconductor) C:\Program Files\Realtek\Audio\HDA\RAVBg64.exe
(Synaptics Incorporated) C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
(AVAST Software) C:\Program Files\AVAST Software\Avast\AvastUI.exe
(Alienware) C:\Program Files\Alienware\Command Center\AWCCServiceController.exe
(Dell) C:\Users\TerryF\AppData\Local\Apps\2.0\857OOCAD.RLB\GLBEMZC7.J2H\dell..tion_831211ca63b981c5_0008.0005_9a48d74816d64e41\DellSystemDetect.exe
() C:\Program Files (x86)\Microsoft Office\Office97\Office\FINDFAST.EXE
(Synaptics Incorporated) C:\Program Files\Synaptics\SynTP\SynTPHelper.exe
() C:\Program Files (x86)\Microsoft Office\Office97\Office\OSA.EXE
(Helios Software Solutions) C:\Program Files (x86)\TextPad 4\TextPad.exe
(NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\Display\nvtray.exe
(Alienware) C:\Program Files\Alienware\Command Center\AlienwareAlienFXController.exe
(Dolby Laboratories Inc.) C:\Program Files (x86)\Dolby Home Theater v4\pcee4.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) USB 3.0 eXtensible Host Controller Driver\Application\iusb3mon.exe
(Yahoo! Inc.) C:\Program Files (x86)\Yahoo!\Messenger\Ymsgr_tray.exe
(Alienware) C:\Program Files\Alienware\Command Center\AWCCApplicationWatcher32.exe
(Alienware) C:\Program Files\Alienware\Command Center\AWCCApplicationWatcher64.exe
() C:\Program Files (x86)\Alienware On-Screen Display\AlienwareOn-ScreenDisplay.exe
(Microsoft Corporation) C:\Program Files\Internet Explorer\iexplore.exe
(Alienware) C:\Program Files\Alienware\Command Center\AlienwareTactXMacroController.exe
(Glarysoft Ltd) C:\Program Files (x86)\Glary Utilities 5\Integrator.exe
(Adobe Systems Incorporated) C:\Windows\System32\Macromed\Flash\FlashUtil64_28_0_0_137_ActiveX.exe
(Microsoft Corporation) C:\Windows\System32\MsSpellCheckingFacility.exe
(Alienware, Inc.) C:\Program Files (x86)\Alienware Customer Surveys\AlienSurvey.exe
(Intel Corporation) C:\Program Files\Intel\Intel(R) Rapid Storage Technology\IAStorIcon.exe
(AVAST Software) C:\Program Files\AVAST Software\Avast\AvastUI.exe
(Alienware) C:\Program Files\Alienware\Command Center\AlienFusionService.exe
(Dell Inc.) C:\Program Files\Dell\DellDataVault\DDVRulesProcessor.exe
(Alienware) C:\Program Files\Alienware\Command Center\AlienFusionController.exe
(Intel Corporation) C:\Program Files\Intel\Intel(R) Rapid Storage Technology\IAStorDataMgrSvc.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\DAL\Jhi_service.exe
(SoftThinks SAS) C:\Program Files (x86)\AlienRespawn\SftService.exe
(Dell Inc.) C:\Program Files\Dell\SupportAssistAgent\bin\SupportAssistAgent.exe
(Dell Inc.) C:\Program Files\Dell\DellDataVault\DDVDataCollector.exe
(Dell Inc.) C:\Program Files\Dell\DellDataVault\DDVCollectorSvcApi.exe
(Dell Inc.) C:\Program Files\Dell\DellDataVault\nvapiw.exe
(SoftThinks - Dell) C:\Program Files (x86)\AlienRespawn\Components\DBRUpdate\DBRUpd.exe
(SoftThinks - Dell) C:\Program Files (x86)\AlienRespawn\Toaster.exe
() C:\Program Files (x86)\AlienRespawn\Components\Shell\DBRCrawler.exe

==================== Registry (Whitelisted) ===========================

(If an entry is included in the fixlist, the registry item will be restored to default or removed. The file will not be moved.)

HKLM\…\Run: [RTHDVCPL] => C:\Program Files\Realtek\Audio\HDA\RtkNGUI64.exe [7174728 2013-03-29] (Realtek Semiconductor)
HKLM\…\Run: [RtHDVBg_Dolby] => C:\Program Files\Realtek\Audio\HDA\RAVBg64.exe [1278024 2013-03-08] (Realtek Semiconductor)
HKLM\…\Run: [RtHDVBg_PushButton] => C:\Program Files\Realtek\Audio\HDA\RAVBg64.exe [1278024 2013-03-08] (Realtek Semiconductor)
HKLM\…\Run: [SynTPEnh] => C:\Program Files\Synaptics\SynTP\SynTPEnh.exe [3011312 2013-04-08] (Synaptics Incorporated)
HKLM\…\Run: [IAStorIcon] => C:\Program Files\Intel\Intel(R) Rapid Storage Technology\IAStorIcon.exe [286192 2013-04-10] (Intel Corporation)
HKLM\…\Run: [] => [X]
HKLM\…\Run: [Command Center Controllers] => C:\Program Files\Alienware\Command Center\AWCCStartupOrchestrator.exe [13840 2013-11-04] (Alienware)
HKLM\…\Run: [NvBackend] => C:\Program Files (x86)\NVIDIA Corporation\Update Core\NvBackend.exe [2463552 2014-10-04] (NVIDIA Corporation)
HKLM\…\Run: [ShadowPlay] => C:\Windows\system32\rundll32.exe C:\Windows\system32\nvspcap64.dll,ShadowPlayOnSystemStart
HKLM\…\Run: [AvastUI.exe] => C:\Program Files\AVAST Software\Avast\AvLaunch.exe [246120 2018-01-02] (AVAST Software)
HKLM-x32\…\Run: [Alienware Survey] => c:\Program Files (x86)\Alienware Customer Surveys\AlienSurvey.exe [7396920 2013-04-23] (Alienware, Inc.)
HKLM-x32\…\Run: [Dolby Home Theater v4] => C:\Program Files (x86)\Dolby Home Theater v4\pcee4.exe [508656 2012-08-31] (Dolby Laboratories Inc.)
HKLM-x32\…\Run: [USB3MON] => C:\Program Files (x86)\Intel\Intel(R) USB 3.0 eXtensible Host Controller Driver\Application\iusb3mon.exe [292848 2013-04-11] (Intel Corporation)
HKLM-x32\…\Run: [AlienwareOn-ScreenDisplay] => C:\Program Files (x86)\Alienware On-Screen Display\AlienwareOn-ScreenDisplay.exe [4593968 2013-11-15] ()
Winlogon\Notify\GoToAssist: C:\Program Files (x86)\Citrix\GoToAssist Corporate\1165\G2AWinLogon_x64.dll (Citrix Systems, Inc.)
Winlogon\Notify\igfxcui: igfxdev.dll [X]
HKLM\…\Policies\Explorer\Run: [BtvStack] => C:\Program Files (x86)\Bluetooth Suite\BtvStack.exe [132736 2013-09-25] (Qualcomm®Atheros®)
HKLM\SOFTWARE\Policies\Microsoft\Windows Defender: Restriction <==== ATTENTION
HKU\S-1-5-21-2249576302-3863294968-408106873-1001\…\Run: [GUDelayStartup] => C:\Program Files (x86)\Glary Utilities 5\StartupManager.exe [44016 2018-01-07] (Glarysoft Ltd)
HKU\S-1-5-21-2249576302-3863294968-408106873-1001\…\Run: [Messenger (Yahoo!)] => C:\Program Files (x86)\Yahoo!\Messenger\YahooMessenger.exe [6595928 2012-05-25] (Yahoo! Inc.)
HKU\S-1-5-21-2249576302-3863294968-408106873-1001\…\Run: [DellSystemDetect] => C:\Users\TerryF\AppData\Local\Apps\2.0\857OOCAD.RLB\GLBEMZC7.J2H\dell..tion_831211ca63b981c5_0008.0005_9a48d74816d64e41\DellSystemDetect.exe [313264 2017-08-11] (Dell)
HKU\S-1-5-21-2249576302-3863294968-408106873-1001\Control Panel\Desktop\\SCRNSAVE.EXE -> C:\Windows\system32\scrnsave.scr [11264 2009-07-13] (Microsoft Corporation)
AppInit_DLLs: C:\Windows\system32\nvinitx.dll => C:\Windows\system32\nvinitx.dll [174856 2014-09-13] (NVIDIA Corporation)
AppInit_DLLs-x32: C:\Windows\SysWOW64\nvinit.dll => C:\Windows\SysWOW64\nvinit.dll [156840 2014-09-13] (NVIDIA Corporation)
Startup: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\Microsoft Find Fast.lnk [2016-12-08]
ShortcutTarget: Microsoft Find Fast.lnk -> C:\Program Files (x86)\Microsoft Office\Office97\Office\FINDFAST.EXE ()
Startup: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\Office Startup.lnk [2016-12-08]
ShortcutTarget: Office Startup.lnk -> C:\Program Files (x86)\Microsoft Office\Office97\Office\OSA.EXE ()
Startup: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\Symantec Fax Starter Edition Port.lnk [2014-05-22]
ShortcutTarget: Symantec Fax Starter Edition Port.lnk -> C:\Program Files (x86)\Microsoft Office\Office2K\Office\1033\OLFSNT40.EXE (Microsoft Corporation)
BootExecute: autocheck autochk *

==================== Internet (Whitelisted) ====================

(If an item is included in the fixlist, if it is a registry item it will be removed or restored to default.)

AutoConfigURL: [S-1-5-21-2249576302-3863294968-408106873-1001] => hxxp://access-quick.com/wpad.dat?e924402e70027ab7006c8bc7e654272a36290340
Tcpip\Parameters: [DhcpNameServer] 75.75.75.75 75.75.76.76
Tcpip\..\Interfaces\{AA1A4CE6-F32D-4864-ABA6-BC256E01840F}: [DhcpNameServer] 75.75.75.75 75.75.76.76
ManualProxies: 0hxxp://access-quick.com/wpad.dat?e924402e70027ab7006c8bc7e654272a36290340

Internet Explorer:
==================
HKU\S-1-5-21-2249576302-3863294968-408106873-1001\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://www.msn.com/
HKU\S-1-5-21-2249576302-3863294968-408106873-1001\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = hxxp://dell13.msn.com/?pc=DCJB
SearchScopes: HKLM -> {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL =
SearchScopes: HKLM-x32 -> {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL =
SearchScopes: HKU\S-1-5-21-2249576302-3863294968-408106873-1001 -> DefaultScope {7000C63E-9CED-4D8F-8F70-54C5CB8AD6E0} URL =
SearchScopes: HKU\S-1-5-21-2249576302-3863294968-408106873-1001 -> {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = hxxp://www.bing.com/search?pc=COSP&ptag;=D062615-A6EC39D5B4CB74905A0F&form;=CONBDF&conlogo;=CT3332023&q;={searchTerms}
SearchScopes: HKU\S-1-5-21-2249576302-3863294968-408106873-1001 -> {7000C63E-9CED-4D8F-8F70-54C5CB8AD6E0} URL =
BHO: avast! Online Security -> {8E5E2654-AD2D-48bf-AC2D-D17F00898D06} -> C:\Program Files\AVAST Software\Avast\aswWebRepIE64.dll [2017-12-18] (AVAST Software)
BHO: Google Toolbar Helper -> {AA58ED58-01DD-4d91-8333-CF10577473F7} -> C:\Program Files (x86)\Google\Google Toolbar\GoogleToolbar_64.dll [2016-04-26] (Google Inc.)
BHO-x32: avast! Online Security -> {8E5E2654-AD2D-48bf-AC2D-D17F00898D06} -> C:\Program Files\AVAST Software\Avast\aswWebRepIE.dll [2017-12-18] (AVAST Software)
BHO-x32: Google Toolbar Helper -> {AA58ED58-01DD-4d91-8333-CF10577473F7} -> C:\Program Files (x86)\Google\Google Toolbar\GoogleToolbar_32.dll [2016-04-26] (Google Inc.)
Toolbar: HKLM - avast! WebRep - {318A227B-5E9F-45bd-8999-7F8F10CA4CF5} - No File
Toolbar: HKLM - Google Toolbar - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - C:\Program Files (x86)\Google\Google Toolbar\GoogleToolbar_64.dll [2016-04-26] (Google Inc.)
Toolbar: HKLM-x32 - Google Toolbar - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - C:\Program Files (x86)\Google\Google Toolbar\GoogleToolbar_32.dll [2016-04-26] (Google Inc.)
DPF: HKLM-x32 {E06E2E99-0AA1-11D4-ABA6-0060082AA75C} hxxps://akamaicdn.webex.com/client/WBXclient-T29L10NSP13EP2-10118/support/ieatgpc1.cab
Handler-x32: http - {E1D2BF42-A96B-11D1-9C6B-0000F875AC61} - C:\PROGRA~2\COMMON~1\System\OLEDB~1\MSDAIPP.DLL [1999-02-03] (Microsoft Corporation)
Handler-x32: http - {E1D2BF40-A96B-11D1-9C6B-0000F875AC61} - C:\PROGRA~2\COMMON~1\System\OLEDB~1\MSDAIPP.DLL [1999-02-03] (Microsoft Corporation)
Handler-x32: https - {E1D2BF42-A96B-11D1-9C6B-0000F875AC61} - C:\PROGRA~2\COMMON~1\System\OLEDB~1\MSDAIPP.DLL [1999-02-03] (Microsoft Corporation)
Handler-x32: https - {E1D2BF40-A96B-11D1-9C6B-0000F875AC61} - C:\PROGRA~2\COMMON~1\System\OLEDB~1\MSDAIPP.DLL [1999-02-03] (Microsoft Corporation)
Handler-x32: ipp - {E1D2BF42-A96B-11D1-9C6B-0000F875AC61} - C:\PROGRA~2\COMMON~1\System\OLEDB~1\MSDAIPP.DLL [1999-02-03] (Microsoft Corporation)
Handler-x32: msdaipp - {E1D2BF42-A96B-11D1-9C6B-0000F875AC61} - C:\PROGRA~2\COMMON~1\System\OLEDB~1\MSDAIPP.DLL [1999-02-03] (Microsoft Corporation)
Handler-x32: msdaipp - {E1D2BF40-A96B-11D1-9C6B-0000F875AC61} - C:\PROGRA~2\COMMON~1\System\OLEDB~1\MSDAIPP.DLL [1999-02-03] (Microsoft Corporation)

FireFox:
========
FF ProfilePath: C:\Users\TerryF\AppData\Roaming\Mozilla\Firefox\Profiles\ncpo29pi.default [2018-01-06]
FF Homepage: Mozilla\Firefox\Profiles\ncpo29pi.default -> hxxp://www.msn.com
FF NewTab: Mozilla\Firefox\Profiles\ncpo29pi.default -> hxxp://www.msn.com
FF Extension: (Avast SafePrice) - C:\Users\TerryF\AppData\Roaming\Mozilla\Firefox\Profiles\ncpo29pi.default\Extensions\[removed] [2017-08-29]
FF Extension: (Avast Online Security) - C:\Users\TerryF\AppData\Roaming\Mozilla\Firefox\Profiles\ncpo29pi.default\Extensions\[removed] [2017-12-18]
FF Plugin: @microsoft.com/GENUINE -> disabled [No File]
FF Plugin-x32: @intel-webapi.intel.com/Intel WebAPI ipt;version=3.0.72 -> C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\IPT\npIntelWebAPIIPT.dll [2013-03-12] (Intel Corporation)
FF Plugin-x32: @intel-webapi.intel.com/Intel WebAPI updater -> C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\IPT\npIntelWebAPIUpdater.dll [2013-03-12] (Intel Corporation)
FF Plugin-x32: @messenger.yahoo.com/YahooMessengerStatePlugin;version=1.0.0.6 -> C:\Program Files (x86)\Yahoo!\Shared\npYState.dll [2012-05-25] (Yahoo! Inc.)
FF Plugin-x32: @microsoft.com/GENUINE -> disabled [No File]
FF Plugin-x32: @nvidia.com/3DVision -> C:\Program Files (x86)\NVIDIA Corporation\3D Vision\npnv3dv.dll [2014-09-13] (NVIDIA Corporation)
FF Plugin-x32: @nvidia.com/3DVisionStreaming -> C:\Program Files (x86)\NVIDIA Corporation\3D Vision\npnv3dvstreaming.dll [2014-09-13] (NVIDIA Corporation)
FF Plugin-x32: @real.com/nppl3260;version=6.0.11.2852 -> C:\Program Files (x86)\Real Alternative\browser\plugins\nppl3260.dll [2008-04-27] (RealNetworks, Inc.)
FF Plugin-x32: @real.com/nppl3260;version=6.0.12.46 -> C:\Program Files (x86)\Real Alternative\browser\plugins\nppl3260.dll [2008-04-27] (RealNetworks, Inc.)
FF Plugin-x32: @real.com/nprpjplug;version=6.0.12.1662 -> C:\Program Files (x86)\Real Alternative\browser\plugins\nprpjplug.dll [2008-04-27] (RealNetworks, Inc.)
FF Plugin-x32: @real.com/nprpjplug;version=6.0.12.46 -> C:\Program Files (x86)\Real Alternative\browser\plugins\nprpjplug.dll [2008-04-27] (RealNetworks, Inc.)
FF Plugin-x32: @tools.google.com/Google Update;version=3 -> C:\Program Files (x86)\Google\Update\1.3.33.7\npGoogleUpdate3.dll [2017-12-18] (Google Inc.)
FF Plugin-x32: @tools.google.com/Google Update;version=9 -> C:\Program Files (x86)\Google\Update\1.3.33.7\npGoogleUpdate3.dll [2017-12-18] (Google Inc.)
FF Plugin-x32: Adobe Reader -> C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AIR\nppdf32.dll [2017-11-27] (Adobe Systems Inc.)
FF Plugin HKU\S-1-5-21-2249576302-3863294968-408106873-1001: jpl.nasa.gov/NASAEyes -> C:\Users\TerryF\AppData\Roaming\JPL-NASA-Caltech\NASA's Eyes\npNASAEyes.dll [2017-12-13] (Jet Propulsion Laboratory)
FF Plugin HKU\S-1-5-21-2249576302-3863294968-408106873-1001: tdameritrade.com/thinkorswim -> C:\Program Files\thinkorswim\npthinkorswim.dll [2018-01-09] (TD Ameritrade)
FF Plugin HKU\S-1-5-21-2249576302-3863294968-408106873-1001: tdameritrade.com/tossc -> C:\Program Files\thinkorswim\nptossc.dll [2018-01-09] (TD Ameritrade)
FF Plugin HKU\S-1-5-21-2249576302-3863294968-408106873-1001: ubisoft.com/uplaypc -> C:\Program Files (x86)\Ubisoft\Ubisoft Game Launcher\npuplaypc.dll [2015-01-03] ()
FF ExtraCheck: C:\Program Files (x86)\mozilla firefox\defaults\pref\5497506.js [2017-10-24] <==== ATTENTION (Points to *.cfg file)
FF ExtraCheck: C:\Program Files (x86)\mozilla firefox\5497506.cfg [2017-10-24] <==== ATTENTION

==================== Services (Whitelisted) ====================

(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)

R3 aswbIDSAgent; C:\Program Files\AVAST Software\Avast\x64\aswidsagenta.exe [7538536 2018-01-02] (AVAST Software)
R2 AtherosSvc; C:\Program Files (x86)\Bluetooth Suite\adminservice.exe [312448 2013-09-25] (Windows (R) Win 7 DDK provider) [File not signed]
R2 avast! Antivirus; C:\Program Files\AVAST Software\Avast\AvastSvc.exe [301168 2018-01-02] (AVAST Software)
R2 DDVCollectorSvcApi; C:\Program Files\Dell\DellDataVault\DDVCollectorSvcApi.exe [208760 2017-07-27] (Dell Inc.)
R2 DDVDataCollector; C:\Program Files\Dell\DellDataVault\DDVDataCollector.exe [3294584 2017-07-27] (Dell Inc.)
R2 DDVRulesProcessor; C:\Program Files\Dell\DellDataVault\DDVRulesProcessor.exe [217464 2017-07-27] (Dell Inc.)
R2 GfExperienceService; C:\Program Files\NVIDIA Corporation\GeForce Experience Service\GfExperienceService.exe [1149760 2014-10-04] (NVIDIA Corporation)
S3 GoToAssist; C:\Program Files (x86)\Citrix\GoToAssist Corporate\1165\G2AC_Service.exe [309720 2016-05-25] (Citrix Systems, Inc.)
R2 IAStorDataMgrSvc; C:\Program Files\Intel\Intel(R) Rapid Storage Technology\IAStorDataMgrSvc.exe [15344 2013-04-10] (Intel Corporation)
S3 IDriverT; C:\Program Files (x86)\Common Files\InstallShield\Driver\1050\Intel 32\IDriverT.exe [73728 2004-10-22] (Macrovision Corporation) [File not signed]
R2 igfxCUIService1.0.0.0; C:\Windows\system32\igfxCUIService.exe [354280 2016-07-11] (Intel Corporation)
R2 Intel(R) Capability Licensing Service Interface; c:\Program Files\Intel\iCLS Client\HeciServer.exe [731648 2013-02-13] (Intel(R) Corporation) [File not signed]
S3 Intel(R) Capability Licensing Service TCP IP Interface; c:\Program Files\Intel\iCLS Client\SocketHeciServer.exe [820184 2013-02-13] (Intel(R) Corporation)
S3 ioloEnergyBooster; C:\Program Files\Alienware\Command Center\ioloEnergyBooster.exe [6145872 2012-11-01] (iolo technologies, LLC)
R2 jhi_service; C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\DAL\jhi_service.exe [169432 2013-03-12] (Intel Corporation)
R2 NvNetworkService; C:\Program Files (x86)\NVIDIA Corporation\NetService\NvNetworkService.exe [1796928 2014-10-04] (NVIDIA Corporation)
R2 NvStreamSvc; C:\Program Files\NVIDIA Corporation\NvStreamSrv\nvstreamsvc.exe [19440960 2014-10-04] (NVIDIA Corporation)
R2 RtkAudioService; C:\Program Files\Realtek\Audio\HDA\RtkAudioService64.exe [239176 2013-02-19] (Realtek Semiconductor)
R2 SupportAssistAgent; C:\Program Files\Dell\SupportAssistAgent\bin\SupportAssistAgent.exe [53208 2017-09-22] (Dell Inc.)
S3 WinDefend; C:\Program Files\Windows Defender\mpsvc.dll [1011712 2014-02-21] (Microsoft Corporation)
S3 AvastVBoxSvc; "C:\Program Files\AVAST Software\Avast\ng\vbox\AvastVBoxSVC.exe" [X]

===================== Drivers (Whitelisted) ======================

(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)

R3 Ak27x64; C:\Windows\System32\DRIVERS\Ak27x64.sys [4057808 2013-09-04] (Qualcomm Atheros, Inc.)
R1 aswArPot; C:\Windows\System32\drivers\aswArPot.sys [185096 2018-01-02] (AVAST Software)
R1 aswbidsdriver; C:\Windows\System32\drivers\aswbidsdrivera.sys [321512 2018-01-02] (AVAST Software)
R0 aswbidsh; C:\Windows\System32\drivers\aswbidsha.sys [199448 2018-01-02] (AVAST Software)
R0 aswblog; C:\Windows\System32\drivers\aswbloga.sys [343768 2018-01-02] (AVAST Software)
R0 aswbuniv; C:\Windows\System32\drivers\aswbuniva.sys [57696 2018-01-02] (AVAST Software)
R1 aswHdsKe; C:\Windows\System32\drivers\aswHdsKe.sys [149344 2018-01-02] (AVAST Software)
S3 aswHwid; C:\Windows\System32\drivers\aswHwid.sys [46976 2018-01-02] (AVAST Software)
R1 aswKbd; C:\Windows\system32\drivers\aswKbd.sys [41832 2017-09-07] (AVAST Software)
R2 aswMonFlt; C:\Windows\System32\drivers\aswMonFlt.sys [146664 2018-01-02] (AVAST Software)
R1 aswRdr; C:\Windows\System32\drivers\aswRdr2.sys [110336 2018-01-02] (AVAST Software)
R0 aswRvrt; C:\Windows\System32\drivers\aswRvrt.sys [84384 2018-01-02] (AVAST Software)
R1 aswSnx; C:\Windows\System32\drivers\aswSnx.sys [1025176 2018-01-02] (AVAST Software)
R1 aswSP; C:\Windows\System32\drivers\aswSP.sys [457400 2018-01-02] (AVAST Software)
R2 aswStm; C:\Windows\System32\drivers\aswStm.sys [204456 2018-01-02] (AVAST Software)
R0 aswVmm; C:\Windows\System32\drivers\aswVmm.sys [358672 2018-01-02] (AVAST Software)
R3 BTATH_LWFLT; C:\Windows\System32\DRIVERS\btath_lwflt.sys [77464 2013-11-28] (Qualcomm Atheros)
R3 DDDriver; C:\Windows\System32\drivers\DDDriver64Dcsa.sys [32960 2017-04-11] (Dell Inc.)
R3 DellProf; C:\Windows\System32\drivers\DellProf.sys [32568 2017-04-11] (Dell Computer Corporation)
R1 GUBootStartup; C:\Windows\System32\drivers\GUBootStartup.sys [20160 2015-04-29] (Glarysoft Ltd)
R0 iaStorF; C:\Windows\System32\drivers\iaStorF.sys [28656 2013-04-05] (Intel Corporation)
R3 MotioninJoyXFilter; C:\Windows\System32\DRIVERS\MijXfilt.sys [121416 2014-04-16] (MotioninJoy) [File not signed]
R1 nvkflt; C:\Windows\System32\DRIVERS\nvkflt.sys [299152 2014-09-13] (NVIDIA Corporation)
R3 NvStreamKms; C:\Program Files\NVIDIA Corporation\NvStreamSrv\NvStreamKms.sys [20288 2014-10-04] (NVIDIA Corporation)
R3 nvvad_WaveExtensible; C:\Windows\System32\drivers\nvvad64v.sys [38048 2014-09-04] (NVIDIA Corporation)
S4 secdrv; C:\Windows\SysWow64\Drivers\secdrv.sys [28624 2016-01-24] () [File not signed]
R3 SmbDrvI; C:\Windows\System32\DRIVERS\Smb_driver_Intel.sys [32496 2013-04-08] (Synaptics Incorporated)
R3 ST_ACCEL; C:\Windows\System32\DRIVERS\ST_Accel.sys [87776 2013-04-11] (STMicroelectronics)
R3 XtuAcpiDriver; C:\Windows\System32\DRIVERS\XtuAcpiDriver.sys [54168 2017-04-18] (Intel Corporation)
S2 VBoxAswDrv; \??\C:\Program Files\AVAST Software\Avast\ng\vbox\VBoxAswDrv.sys [X]

==================== NetSvcs (Whitelisted) ===================

(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)

==================== One Month Created files and folders ========

(If an entry is included in the fixlist, the file/folder will be moved.)

2018-01-09 10:16 - 2018-01-09 10:16 - 000023857 _____ C:\Users\TerryF\Downloads\FRST.txt
2018-01-09 10:15 - 2018-01-09 10:16 - 000000000 ____D C:\FRST
2018-01-09 10:15 - 2018-01-09 10:15 - 002393088 _____ (Farbar) C:\Users\TerryF\Downloads\FRST64.exe
2018-01-09 10:03 - 2018-01-09 10:03 - 000000000 ___RD C:\Users\TerryF\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\BT Devices
2018-01-09 10:02 - 2018-01-09 10:02 - 000000000 ____D C:\ProgramData\SWCUTemp
2018-01-09 09:25 - 2018-01-09 09:25 - 008198432 _____ (Malwarebytes) C:\Users\TerryF\Downloads\adwcleaner_7.0.6.0.exe
2018-01-09 09:23 - 2018-01-09 10:01 - 000000000 ____D C:\AdwCleaner
2018-01-09 08:57 - 2018-01-09 08:57 - 000000000 ____D C:\Users\TerryF\Downloads\backups
2018-01-09 08:17 - 2018-01-09 08:17 - 000388608 _____ (Trend Micro Inc.) C:\Users\TerryF\Downloads\HiJackThis.exe
2018-01-08 19:35 - 2017-12-31 20:21 - 005581544 _____ (Microsoft Corporation) C:\Windows\system32\ntoskrnl.exe
2018-01-08 19:35 - 2017-12-31 20:21 - 001680616 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\ntfs.sys
2018-01-08 19:35 - 2017-12-31 20:21 - 000708328 _____ (Microsoft Corporation) C:\Windows\system32\winload.efi
2018-01-08 19:35 - 2017-12-31 20:21 - 000288488 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\fltMgr.sys
2018-01-08 19:35 - 2017-12-31 20:19 - 001665384 _____ (Microsoft Corporation) C:\Windows\system32\ntdll.dll
2018-01-08 19:35 - 2017-12-31 20:18 - 014183936 _____ (Microsoft Corporation) C:\Windows\system32\shell32.dll
2018-01-08 19:35 - 2017-12-31 20:18 - 002066432 _____ (Microsoft Corporation) C:\Windows\system32\ole32.dll
2018-01-08 19:35 - 2017-12-31 20:18 - 002004480 _____ (Microsoft Corporation) C:\Windows\system32\msxml6.dll
2018-01-08 19:35 - 2017-12-31 20:18 - 001867776 _____ (Microsoft Corporation) C:\Windows\system32\ExplorerFrame.dll
2018-01-08 19:35 - 2017-12-31 20:18 - 001460736 _____ (Microsoft Corporation) C:\Windows\system32\lsasrv.dll
2018-01-08 19:35 - 2017-12-31 20:18 - 001212928 _____ (Microsoft Corporation) C:\Windows\system32\rpcrt4.dll
2018-01-08 19:35 - 2017-12-31 20:13 - 000631680 _____ (Microsoft Corporation) C:\Windows\system32\winresume.efi
2018-01-08 19:35 - 2017-12-31 20:02 - 001314112 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ntdll.dll
2018-01-08 19:35 - 2017-12-31 20:00 - 012880384 _____ (Microsoft Corporation) C:\Windows\SysWOW64\shell32.dll
2018-01-08 19:35 - 2017-12-31 20:00 - 000554496 _____ (Microsoft Corporation) C:\Windows\SysWOW64\kerberos.dll
2018-01-08 19:35 - 2017-12-31 19:54 - 004013800 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ntkrnlpa.exe
2018-01-08 19:35 - 2017-12-31 19:54 - 003959016 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ntoskrnl.exe
2018-01-08 19:35 - 2017-12-31 19:50 - 000455680 _____ (Microsoft Corporation) C:\Windows\system32\winlogon.exe
2018-01-08 19:35 - 2017-12-31 19:42 - 000460288 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\srv.sys
2018-01-08 19:35 - 2017-12-31 19:42 - 000406016 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\srv2.sys
2018-01-08 19:35 - 2017-12-29 12:39 - 020274688 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.dll
2018-01-08 19:35 - 2017-12-29 12:13 - 000499712 _____ (Microsoft Corporation) C:\Windows\SysWOW64\vbscript.dll
2018-01-08 19:35 - 2017-12-29 12:09 - 002294272 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iertutil.dll
2018-01-08 19:35 - 2017-12-29 12:04 - 000476160 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieui.dll
2018-01-08 19:35 - 2017-12-29 12:03 - 000662528 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript.dll
2018-01-08 19:35 - 2017-12-29 11:45 - 004508160 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript9.dll
2018-01-08 19:35 - 2017-12-29 11:38 - 013680128 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieframe.dll
2018-01-08 19:35 - 2017-12-29 11:19 - 002767872 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wininet.dll
2018-01-08 19:35 - 2017-12-29 11:15 - 001313792 _____ (Microsoft Corporation) C:\Windows\SysWOW64\urlmon.dll
2018-01-08 19:35 - 2017-12-29 03:15 - 025737728 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.dll
2018-01-08 19:35 - 2017-12-29 02:52 - 002900480 _____ (Microsoft Corporation) C:\Windows\system32\iertutil.dll
2018-01-08 19:35 - 2017-12-29 02:51 - 005796352 _____ (Microsoft Corporation) C:\Windows\system32\jscript9.dll
2018-01-08 19:35 - 2017-12-29 02:50 - 000417280 _____ (Microsoft Corporation) C:\Windows\system32\html.iec
2018-01-08 19:35 - 2017-12-29 02:40 - 000615936 _____ (Microsoft Corporation) C:\Windows\system32\ieui.dll
2018-01-08 19:35 - 2017-12-29 02:39 - 000817152 _____ (Microsoft Corporation) C:\Windows\system32\jscript.dll
2018-01-08 19:35 - 2017-12-29 02:39 - 000814080 _____ (Microsoft Corporation) C:\Windows\system32\jscript9diag.dll
2018-01-08 19:35 - 2017-12-29 02:32 - 000969216 _____ (Microsoft Corporation) C:\Windows\system32\MsSpellCheckingFacility.exe
2018-01-08 19:35 - 2017-12-29 02:04 - 015284224 _____ (Microsoft Corporation) C:\Windows\system32\ieframe.dll
2018-01-08 19:35 - 2017-12-29 02:03 - 000807936 _____ (Microsoft Corporation) C:\Windows\system32\msfeeds.dll
2018-01-08 19:35 - 2017-12-29 02:01 - 002134528 _____ (Microsoft Corporation) C:\Windows\system32\inetcpl.cpl
2018-01-08 19:35 - 2017-12-29 02:01 - 001359360 _____ (Microsoft Corporation) C:\Windows\system32\mshtmlmedia.dll
2018-01-08 19:35 - 2017-12-29 01:50 - 003241472 _____ (Microsoft Corporation) C:\Windows\system32\wininet.dll
2018-01-08 19:35 - 2017-12-29 01:39 - 001545728 _____ (Microsoft Corporation) C:\Windows\system32\urlmon.dll
2018-01-08 19:35 - 2017-12-29 01:27 - 000800768 _____ (Microsoft Corporation) C:\Windows\system32\ieapfltr.dll
2018-01-08 19:35 - 2017-12-21 00:27 - 000634312 _____ (Microsoft Corporation) C:\Windows\system32\winload.exe
2018-01-08 19:35 - 2017-12-13 10:31 - 000383720 _____ (Adobe Systems Incorporated) C:\Windows\system32\atmfd.dll
2018-01-08 19:34 - 2017-12-31 20:21 - 000948968 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\ndis.sys
2018-01-08 19:34 - 2017-12-31 20:21 - 000262376 _____ (Microsoft Corporation) C:\Windows\system32\hal.dll
2018-01-08 19:34 - 2017-12-31 20:21 - 000213736 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\rdyboost.sys
2018-01-08 19:34 - 2017-12-31 20:21 - 000154856 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\ksecpkg.sys
2018-01-08 19:34 - 2017-12-31 20:21 - 000114408 _____ (Microsoft Corporation) C:\Windows\system32\consent.exe
2018-01-08 19:34 - 2017-12-31 20:21 - 000095464 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\ksecdd.sys
2018-01-08 19:34 - 2017-12-31 20:18 - 001942016 _____ (Microsoft Corporation) C:\Windows\system32\authui.dll
2018-01-08 19:34 - 2017-12-31 20:18 - 001741312 _____ (Microsoft Corporation) C:\Windows\system32\sysmain.dll
2018-01-08 19:34 - 2017-12-31 20:18 - 001163264 _____ (Microsoft Corporation) C:\Windows\system32\kernel32.dll
2018-01-08 19:34 - 2017-12-31 20:18 - 001110528 _____ (Microsoft Corporation) C:\Windows\system32\schedsvc.dll
2018-01-08 19:34 - 2017-12-31 20:18 - 000977408 _____ (Microsoft Corporation) C:\Windows\system32\inetcomm.dll
2018-01-08 19:34 - 2017-12-31 20:18 - 000961024 _____ (Microsoft Corporation) C:\Windows\system32\actxprxy.dll
2018-01-08 19:34 - 2017-12-31 20:18 - 000880640 _____ (Microsoft Corporation) C:\Windows\system32\advapi32.dll
2018-01-08 19:34 - 2017-12-31 20:18 - 000863232 _____ (Microsoft Corporation) C:\Windows\system32\IKEEXT.DLL
2018-01-08 19:34 - 2017-12-31 20:18 - 000842752 _____ (Microsoft Corporation) C:\Windows\system32\nshwfp.dll
2018-01-08 19:34 - 2017-12-31 20:18 - 000828928 _____ (Microsoft Corporation) C:\Windows\system32\MPSSVC.dll
2018-01-08 19:34 - 2017-12-31 20:18 - 000749568 _____ (Microsoft Corporation) C:\Windows\system32\FirewallAPI.dll
2018-01-08 19:34 - 2017-12-31 20:18 - 000731648 _____ (Microsoft Corporation) C:\Windows\system32\kerberos.dll
2018-01-08 19:34 - 2017-12-31 20:18 - 000705024 _____ (Microsoft Corporation) C:\Windows\system32\BFE.DLL
2018-01-08 19:34 - 2017-12-31 20:18 - 000690688 _____ (Microsoft Corporation) C:\Windows\system32\adtschema.dll
2018-01-08 19:34 - 2017-12-31 20:18 - 000512000 _____ (Microsoft Corporation) C:\Windows\system32\rpcss.dll
2018-01-08 19:34 - 2017-12-31 20:18 - 000503808 _____ (Microsoft Corporation) C:\Windows\system32\srcore.dll
2018-01-08 19:34 - 2017-12-31 20:18 - 000473600 _____ (Microsoft Corporation) C:\Windows\system32\taskcomp.dll
2018-01-08 19:34 - 2017-12-31 20:18 - 000463872 _____ (Microsoft Corporation) C:\Windows\system32\certcli.dll
2018-01-08 19:34 - 2017-12-31 20:18 - 000444928 _____ (Microsoft Corporation) C:\Windows\system32\winhttp.dll
2018-01-08 19:34 - 2017-12-31 20:18 - 000439296 _____ (Microsoft Corporation) C:\Windows\system32\p2psvc.dll
2018-01-08 19:34 - 2017-12-31 20:18 - 000419840 _____ (Microsoft Corporation) C:\Windows\system32\KernelBase.dll
2018-01-08 19:34 - 2017-12-31 20:18 - 000366592 _____ (Microsoft Corporation) C:\Windows\system32\wcncsvc.dll
2018-01-08 19:34 - 2017-12-31 20:18 - 000361984 _____ (Microsoft Corporation) C:\Windows\system32\wow64win.dll
2018-01-08 19:34 - 2017-12-31 20:18 - 000345600 _____ (Microsoft Corporation) C:\Windows\system32\schannel.dll
2018-01-08 19:34 - 2017-12-31 20:18 - 000327168 _____ (Microsoft Corporation) C:\Windows\system32\pnrpsvc.dll
2018-01-08 19:34 - 2017-12-31 20:18 - 000324096 _____ (Microsoft Corporation) C:\Windows\system32\FWPUCLNT.DLL
2018-01-08 19:34 - 2017-12-31 20:18 - 000316928 _____ (Microsoft Corporation) C:\Windows\system32\msv1_0.dll
2018-01-08 19:34 - 2017-12-31 20:18 - 000312320 _____ (Microsoft Corporation) C:\Windows\system32\ncrypt.dll
2018-01-08 19:34 - 2017-12-31 20:18 - 000303104 _____ (Microsoft Corporation) C:\Windows\system32\nlasvc.dll
2018-01-08 19:34 - 2017-12-31 20:18 - 000264704 _____ (Microsoft Corporation) C:\Windows\system32\P2P.dll
2018-01-08 19:34 - 2017-12-31 20:18 - 000243712 _____ (Microsoft Corporation) C:\Windows\system32\wow64.dll
2018-01-08 19:34 - 2017-12-31 20:18 - 000223232 _____ (Microsoft Corporation) C:\Windows\system32\ncsi.dll
2018-01-08 19:34 - 2017-12-31 20:18 - 000215552 _____ (Microsoft Corporation) C:\Windows\system32\winsrv.dll
2018-01-08 19:34 - 2017-12-31 20:18 - 000210432 _____ (Microsoft Corporation) C:\Windows\system32\wdigest.dll
2018-01-08 19:34 - 2017-12-31 20:18 - 000190464 _____ (Microsoft Corporation) C:\Windows\system32\rpchttp.dll
2018-01-08 19:34 - 2017-12-31 20:18 - 000146432 _____ (Microsoft Corporation) C:\Windows\system32\msaudite.dll
2018-01-08 19:34 - 2017-12-31 20:18 - 000135680 _____ (Microsoft Corporation) C:\Windows\system32\sspicli.dll
2018-01-08 19:34 - 2017-12-31 20:18 - 000123904 _____ (Microsoft Corporation) C:\Windows\system32\bcrypt.dll
2018-01-08 19:34 - 2017-12-31 20:18 - 000120320 _____ (Microsoft Corporation) C:\Windows\system32\WcnApi.dll
2018-01-08 19:34 - 2017-12-31 20:18 - 000108544 _____ (Microsoft Corporation) C:\Windows\system32\icfupgd.dll
2018-01-08 19:34 - 2017-12-31 20:18 - 000101376 _____ (Microsoft Corporation) C:\Windows\system32\fdWCN.dll
2018-01-08 19:34 - 2017-12-31 20:18 - 000095744 _____ (Microsoft Corporation) C:\Windows\system32\rascfg.dll
2018-01-08 19:34 - 2017-12-31 20:18 - 000086528 _____ (Microsoft Corporation) C:\Windows\system32\TSpkg.dll
2018-01-08 19:34 - 2017-12-31 20:18 - 000084480 _____ (Microsoft Corporation) C:\Windows\system32\INETRES.dll
2018-01-08 19:34 - 2017-12-31 20:18 - 000076288 _____ (Microsoft Corporation) C:\Windows\system32\rasdiag.dll
2018-01-08 19:34 - 2017-12-31 20:18 - 000070656 _____ (Microsoft Corporation) C:\Windows\system32\nlaapi.dll
2018-01-08 19:34 - 2017-12-31 20:18 - 000070144 _____ (Microsoft Corporation) C:\Windows\system32\appinfo.dll
2018-01-08 19:34 - 2017-12-31 20:18 - 000063488 _____ (Microsoft Corporation) C:\Windows\system32\setbcdlocale.dll
2018-01-08 19:34 - 2017-12-31 20:18 - 000060928 _____ (Microsoft Corporation) C:\Windows\system32\ndptsp.tsp
2018-01-08 19:34 - 2017-12-31 20:18 - 000060416 _____ (Microsoft Corporation) C:\Windows\system32\msobjs.dll
2018-01-08 19:34 - 2017-12-31 20:18 - 000059904 _____ (Microsoft Corporation) C:\Windows\system32\appidapi.dll
2018-01-08 19:34 - 2017-12-31 20:18 - 000050176 _____ (Microsoft Corporation) C:\Windows\system32\srclient.dll
2018-01-08 19:34 - 2017-12-31 20:18 - 000047104 _____ (Microsoft Corporation) C:\Windows\system32\kmddsp.tsp
2018-01-08 19:34 - 2017-12-31 20:18 - 000044032 _____ (Microsoft Corporation) C:\Windows\system32\csrsrv.dll
2018-01-08 19:34 - 2017-12-31 20:18 - 000043520 _____ (Microsoft Corporation) C:\Windows\system32\cryptbase.dll
2018-01-08 19:34 - 2017-12-31 20:18 - 000041472 _____ (Microsoft Corporation) C:\Windows\system32\rasmxs.dll
2018-01-08 19:34 - 2017-12-31 20:18 - 000039424 _____ (Microsoft Corporation) C:\Windows\system32\traffic.dll
2018-01-08 19:34 - 2017-12-31 20:18 - 000034816 _____ (Microsoft Corporation) C:\Windows\system32\appidsvc.dll
2018-01-08 19:34 - 2017-12-31 20:18 - 000029696 _____ (Microsoft Corporation) C:\Windows\system32\rasser.dll
2018-01-08 19:34 - 2017-12-31 20:18 - 000028672 _____ (Microsoft Corporation) C:\Windows\system32\sspisrv.dll
2018-01-08 19:34 - 2017-12-31 20:18 - 000028160 _____ (Microsoft Corporation) C:\Windows\system32\secur32.dll
2018-01-08 19:34 - 2017-12-31 20:18 - 000026112 _____ (Microsoft Corporation) C:\Windows\system32\oleres.dll
2018-01-08 19:34 - 2017-12-31 20:18 - 000024576 _____ (Microsoft Corporation) C:\Windows\system32\WcnEapPeerProxy.dll
2018-01-08 19:34 - 2017-12-31 20:18 - 000024064 _____ (Microsoft Corporation) C:\Windows\system32\WcnEapAuthProxy.dll
2018-01-08 19:34 - 2017-12-31 20:18 - 000022528 _____ (Microsoft Corporation) C:\Windows\system32\wfapigp.dll
2018-01-08 19:34 - 2017-12-31 20:18 - 000022016 _____ (Microsoft Corporation) C:\Windows\system32\credssp.dll
2018-01-08 19:34 - 2017-12-31 20:18 - 000016896 _____ (Microsoft Corporation) C:\Windows\system32\wshqos.dll
2018-01-08 19:34 - 2017-12-31 20:18 - 000016384 _____ (Microsoft Corporation) C:\Windows\system32\ntvdm64.dll
2018-01-08 19:34 - 2017-12-31 20:18 - 000013312 _____ (Microsoft Corporation) C:\Windows\system32\wshnetbs.dll
2018-01-08 19:34 - 2017-12-31 20:18 - 000013312 _____ (Microsoft Corporation) C:\Windows\system32\wow64cpu.dll
2018-01-08 19:34 - 2017-12-31 20:18 - 000008704 _____ (Microsoft Corporation) C:\Windows\system32\comcat.dll
2018-01-08 19:34 - 2017-12-31 20:18 - 000006656 _____ (Microsoft Corporation) C:\Windows\system32\apisetschema.dll
2018-01-08 19:34 - 2017-12-31 20:18 - 000006144 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-security-base-l1-1-0.dll
2018-01-08 19:34 - 2017-12-31 20:18 - 000005120 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-file-l1-1-0.dll
2018-01-08 19:34 - 2017-12-31 20:18 - 000004608 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-threadpool-l1-1-0.dll
2018-01-08 19:34 - 2017-12-31 20:18 - 000004608 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-processthreads-l1-1-0.dll
2018-01-08 19:34 - 2017-12-31 20:18 - 000004096 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-sysinfo-l1-1-0.dll
2018-01-08 19:34 - 2017-12-31 20:18 - 000004096 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-synch-l1-1-0.dll
2018-01-08 19:34 - 2017-12-31 20:18 - 000004096 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-localregistry-l1-1-0.dll
2018-01-08 19:34 - 2017-12-31 20:18 - 000004096 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-localization-l1-1-0.dll
2018-01-08 19:34 - 2017-12-31 20:18 - 000003584 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-rtlsupport-l1-1-0.dll
2018-01-08 19:34 - 2017-12-31 20:18 - 000003584 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-processenvironment-l1-1-0.dll
2018-01-08 19:34 - 2017-12-31 20:18 - 000003584 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-namedpipe-l1-1-0.dll
2018-01-08 19:34 - 2017-12-31 20:18 - 000003584 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-misc-l1-1-0.dll
2018-01-08 19:34 - 2017-12-31 20:18 - 000003584 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-memory-l1-1-0.dll
2018-01-08 19:34 - 2017-12-31 20:18 - 000003584 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-libraryloader-l1-1-0.dll
2018-01-08 19:34 - 2017-12-31 20:18 - 000003584 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-heap-l1-1-0.dll
2018-01-08 19:34 - 2017-12-31 20:18 - 000003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-xstate-l1-1-0.dll
2018-01-08 19:34 - 2017-12-31 20:18 - 000003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-util-l1-1-0.dll
2018-01-08 19:34 - 2017-12-31 20:18 - 000003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-string-l1-1-0.dll
2018-01-08 19:34 - 2017-12-31 20:18 - 000003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-profile-l1-1-0.dll
2018-01-08 19:34 - 2017-12-31 20:18 - 000003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-io-l1-1-0.dll
2018-01-08 19:34 - 2017-12-31 20:18 - 000003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-interlocked-l1-1-0.dll
2018-01-08 19:34 - 2017-12-31 20:18 - 000003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-handle-l1-1-0.dll
2018-01-08 19:34 - 2017-12-31 20:18 - 000003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-fibers-l1-1-0.dll
2018-01-08 19:34 - 2017-12-31 20:18 - 000003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-errorhandling-l1-1-0.dll
2018-01-08 19:34 - 2017-12-31 20:18 - 000003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-delayload-l1-1-0.dll
2018-01-08 19:34 - 2017-12-31 20:18 - 000003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-debug-l1-1-0.dll
2018-01-08 19:34 - 2017-12-31 20:18 - 000003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-datetime-l1-1-0.dll
2018-01-08 19:34 - 2017-12-31 20:18 - 000003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-console-l1-1-0.dll
2018-01-08 19:34 - 2017-12-31 20:18 - 000002048 _____ (Microsoft Corporation) C:\Windows\system32\msxml6r.dll
2018-01-08 19:34 - 2017-12-31 20:04 - 000559616 _____ (Microsoft Corporation) C:\Windows\system32\spoolsv.exe
2018-01-08 19:34 - 2017-12-31 20:00 - 001499648 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ExplorerFrame.dll
2018-01-08 19:34 - 2017-12-31 20:00 - 001417728 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ole32.dll
2018-01-08 19:34 - 2017-12-31 20:00 - 001390080 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msxml6.dll
2018-01-08 19:34 - 2017-12-31 20:00 - 001114112 _____ (Microsoft Corporation) C:\Windows\SysWOW64\kernel32.dll
2018-01-08 19:34 - 2017-12-31 20:00 - 000741888 _____ (Microsoft Corporation) C:\Windows\SysWOW64\inetcomm.dll
2018-01-08 19:34 - 2017-12-31 20:00 - 000666624 _____ (Microsoft Corporation) C:\Windows\SysWOW64\nshwfp.dll
2018-01-08 19:34 - 2017-12-31 20:00 - 000666112 _____ (Microsoft Corporation) C:\Windows\SysWOW64\rpcrt4.dll
2018-01-08 19:34 - 2017-12-31 20:00 - 000463360 _____ (Microsoft Corporation) C:\Windows\SysWOW64\FirewallAPI.dll
2018-01-08 19:34 - 2017-12-31 20:00 - 000351744 _____ (Microsoft Corporation) C:\Windows\SysWOW64\winhttp.dll
2018-01-08 19:34 - 2017-12-31 20:00 - 000304640 _____ (Microsoft Corporation) C:\Windows\SysWOW64\taskcomp.dll
2018-01-08 19:34 - 2017-12-31 20:00 - 000276992 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wcncsvc.dll
2018-01-08 19:34 - 2017-12-31 20:00 - 000275456 _____ (Microsoft Corporation) C:\Windows\SysWOW64\KernelBase.dll
2018-01-08 19:34 - 2017-12-31 20:00 - 000261120 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msv1_0.dll
2018-01-08 19:34 - 2017-12-31 20:00 - 000254464 _____ (Microsoft Corporation) C:\Windows\SysWOW64\schannel.dll
2018-01-08 19:34 - 2017-12-31 20:00 - 000223232 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ncrypt.dll
2018-01-08 19:34 - 2017-12-31 20:00 - 000217600 _____ (Microsoft Corporation) C:\Windows\SysWOW64\P2P.dll
2018-01-08 19:34 - 2017-12-31 20:00 - 000216576 _____ (Microsoft Corporation) C:\Windows\SysWOW64\FWPUCLNT.DLL
2018-01-08 19:34 - 2017-12-31 20:00 - 000172032 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wdigest.dll
2018-01-08 19:34 - 2017-12-31 20:00 - 000162304 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ncsi.dll
2018-01-08 19:34 - 2017-12-31 20:00 - 000146432 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msaudite.dll
2018-01-08 19:34 - 2017-12-31 20:00 - 000141312 _____ (Microsoft Corporation) C:\Windows\SysWOW64\rpchttp.dll
2018-01-08 19:34 - 2017-12-31 20:00 - 000096768 _____ (Microsoft Corporation) C:\Windows\SysWOW64\sspicli.dll
2018-01-08 19:34 - 2017-12-31 20:00 - 000084480 _____ (Microsoft Corporation) C:\Windows\SysWOW64\INETRES.dll
2018-01-08 19:34 - 2017-12-31 20:00 - 000082944 _____ (Microsoft Corporation) C:\Windows\SysWOW64\bcrypt.dll
2018-01-08 19:34 - 2017-12-31 20:00 - 000081920 _____ (Microsoft Corporation) C:\Windows\SysWOW64\fdWCN.dll
2018-01-08 19:34 - 2017-12-31 20:00 - 000081408 _____ (Microsoft Corporation) C:\Windows\SysWOW64\rascfg.dll
2018-01-08 19:34 - 2017-12-31 20:00 - 000065536 _____ (Microsoft Corporation) C:\Windows\SysWOW64\TSpkg.dll
2018-01-08 19:34 - 2017-12-31 20:00 - 000061952 _____ (Microsoft Corporation) C:\Windows\SysWOW64\rasdiag.dll
2018-01-08 19:34 - 2017-12-31 20:00 - 000060416 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msobjs.dll
2018-01-08 19:34 - 2017-12-31 20:00 - 000052224 _____ (Microsoft Corporation) C:\Windows\SysWOW64\nlaapi.dll
2018-01-08 19:34 - 2017-12-31 20:00 - 000050688 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ndptsp.tsp
2018-01-08 19:34 - 2017-12-31 20:00 - 000043008 _____ (Microsoft Corporation) C:\Windows\SysWOW64\srclient.dll
2018-01-08 19:34 - 2017-12-31 20:00 - 000033280 _____ (Microsoft Corporation) C:\Windows\SysWOW64\traffic.dll
2018-01-08 19:34 - 2017-12-31 20:00 - 000026112 _____ (Microsoft Corporation) C:\Windows\SysWOW64\oleres.dll
2018-01-08 19:34 - 2017-12-31 20:00 - 000022016 _____ (Microsoft Corporation) C:\Windows\SysWOW64\secur32.dll
2018-01-08 19:34 - 2017-12-31 20:00 - 000017408 _____ (Microsoft Corporation) C:\Windows\SysWOW64\credssp.dll
2018-01-08 19:34 - 2017-12-31 20:00 - 000005120 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wow32.dll
2018-01-08 19:34 - 2017-12-31 20:00 - 000002048 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msxml6r.dll
2018-01-08 19:34 - 2017-12-31 19:59 - 001806848 _____ (Microsoft Corporation) C:\Windows\SysWOW64\authui.dll
2018-01-08 19:34 - 2017-12-31 19:59 - 000690688 _____ (Microsoft Corporation) C:\Windows\SysWOW64\adtschema.dll
2018-01-08 19:34 - 2017-12-31 19:59 - 000644096 _____ (Microsoft Corporation) C:\Windows\SysWOW64\advapi32.dll
2018-01-08 19:34 - 2017-12-31 19:59 - 000342528 _____ (Microsoft Corporation) C:\Windows\SysWOW64\certcli.dll
2018-01-08 19:34 - 2017-12-31 19:59 - 000309760 _____ (Microsoft Corporation) C:\Windows\SysWOW64\actxprxy.dll
2018-01-08 19:34 - 2017-12-31 19:59 - 000050688 _____ (Microsoft Corporation) C:\Windows\SysWOW64\appidapi.dll
2018-01-08 19:34 - 2017-12-31 19:59 - 000006656 _____ (Microsoft Corporation) C:\Windows\SysWOW64\apisetschema.dll
2018-01-08 19:34 - 2017-12-31 19:59 - 000005120 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-file-l1-1-0.dll
2018-01-08 19:34 - 2017-12-31 19:59 - 000004608 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-processthreads-l1-1-0.dll
2018-01-08 19:34 - 2017-12-31 19:59 - 000004096 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-sysinfo-l1-1-0.dll
2018-01-08 19:34 - 2017-12-31 19:59 - 000004096 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-synch-l1-1-0.dll
2018-01-08 19:34 - 2017-12-31 19:59 - 000004096 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-misc-l1-1-0.dll
2018-01-08 19:34 - 2017-12-31 19:59 - 000004096 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-localregistry-l1-1-0.dll
2018-01-08 19:34 - 2017-12-31 19:59 - 000004096 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-localization-l1-1-0.dll
2018-01-08 19:34 - 2017-12-31 19:59 - 000003584 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-processenvironment-l1-1-0.dll
2018-01-08 19:34 - 2017-12-31 19:59 - 000003584 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-namedpipe-l1-1-0.dll
2018-01-08 19:34 - 2017-12-31 19:59 - 000003584 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-memory-l1-1-0.dll
2018-01-08 19:34 - 2017-12-31 19:59 - 000003584 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-libraryloader-l1-1-0.dll
2018-01-08 19:34 - 2017-12-31 19:59 - 000003584 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-interlocked-l1-1-0.dll
2018-01-08 19:34 - 2017-12-31 19:59 - 000003584 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-heap-l1-1-0.dll
2018-01-08 19:34 - 2017-12-31 19:59 - 000003072 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-string-l1-1-0.dll
2018-01-08 19:34 - 2017-12-31 19:59 - 000003072 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-rtlsupport-l1-1-0.dll
2018-01-08 19:34 - 2017-12-31 19:59 - 000003072 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-profile-l1-1-0.dll
2018-01-08 19:34 - 2017-12-31 19:59 - 000003072 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-io-l1-1-0.dll
2018-01-08 19:34 - 2017-12-31 19:59 - 000003072 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-handle-l1-1-0.dll
2018-01-08 19:34 - 2017-12-31 19:59 - 000003072 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-fibers-l1-1-0.dll
2018-01-08 19:34 - 2017-12-31 19:59 - 000003072 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-errorhandling-l1-1-0.dll
2018-01-08 19:34 - 2017-12-31 19:59 - 000003072 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-delayload-l1-1-0.dll
2018-01-08 19:34 - 2017-12-31 19:59 - 000003072 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-debug-l1-1-0.dll
2018-01-08 19:34 - 2017-12-31 19:59 - 000003072 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-datetime-l1-1-0.dll
2018-01-08 19:34 - 2017-12-31 19:59 - 000003072 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-console-l1-1-0.dll
2018-01-08 19:34 - 2017-12-31 19:55 - 000131584 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\pacer.sys
2018-01-08 19:34 - 2017-12-31 19:55 - 000088576 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\wanarp.sys
2018-01-08 19:34 - 2017-12-31 19:55 - 000058368 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\ndproxy.sys
2018-01-08 19:34 - 2017-12-31 19:55 - 000045056 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\netbios.sys
2018-01-08 19:34 - 2017-12-31 19:55 - 000024064 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\ndistapi.sys
2018-01-08 19:34 - 2017-12-31 19:54 - 000077312 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\mpsdrv.sys
2018-01-08 19:34 - 2017-12-31 19:49 - 000148480 _____ (Microsoft Corporation) C:\Windows\system32\appidpolicyconverter.exe
2018-01-08 19:34 - 2017-12-31 19:49 - 000064000 _____ (Microsoft Corporation) C:\Windows\system32\auditpol.exe
2018-01-08 19:34 - 2017-12-31 19:49 - 000062464 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\appid.sys
2018-01-08 19:34 - 2017-12-31 19:49 - 000017920 _____ (Microsoft Corporation) C:\Windows\system32\appidcertstorecheck.exe
2018-01-08 19:34 - 2017-12-31 19:46 - 000338432 _____ (Microsoft Corporation) C:\Windows\system32\conhost.exe
2018-01-08 19:34 - 2017-12-31 19:45 - 000296960 _____ (Microsoft Corporation) C:\Windows\system32\rstrui.exe
2018-01-08 19:34 - 2017-12-31 19:43 - 000086528 _____ (Microsoft Corporation) C:\Windows\SysWOW64\WcnApi.dll
2018-01-08 19:34 - 2017-12-31 19:43 - 000038912 _____ (Microsoft Corporation) C:\Windows\SysWOW64\kmddsp.tsp
2018-01-08 19:34 - 2017-12-31 19:43 - 000033280 _____ (Microsoft Corporation) C:\Windows\SysWOW64\rasmxs.dll
2018-01-08 19:34 - 2017-12-31 19:43 - 000022528 _____ (Microsoft Corporation) C:\Windows\SysWOW64\rasser.dll
2018-01-08 19:34 - 2017-12-31 19:43 - 000020480 _____ (Microsoft Corporation) C:\Windows\SysWOW64\WcnEapPeerProxy.dll
2018-01-08 19:34 - 2017-12-31 19:43 - 000019968 _____ (Microsoft Corporation) C:\Windows\SysWOW64\WcnEapAuthProxy.dll
2018-01-08 19:34 - 2017-12-31 19:43 - 000018944 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wfapigp.dll
2018-01-08 19:34 - 2017-12-31 19:43 - 000013824 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wshqos.dll
2018-01-08 19:34 - 2017-12-31 19:42 - 000168448 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\srvnet.sys
2018-01-08 19:34 - 2017-12-31 19:42 - 000159744 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\mrxsmb.sys
2018-01-08 19:34 - 2017-12-31 19:41 - 000754176 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\http.sys
2018-01-08 19:34 - 2017-12-31 19:41 - 000291328 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\mrxsmb10.sys
2018-01-08 19:34 - 2017-12-31 19:41 - 000129536 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\mrxsmb20.sys
2018-01-08 19:34 - 2017-12-31 19:41 - 000112640 _____ (Microsoft Corporation) C:\Windows\system32\smss.exe
2018-01-08 19:34 - 2017-12-31 19:41 - 000106496 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\dfsc.sys
2018-01-08 19:34 - 2017-12-31 19:41 - 000030720 _____ (Microsoft Corporation) C:\Windows\system32\lsass.exe
2018-01-08 19:34 - 2017-12-31 19:41 - 000007168 _____ (Microsoft Corporation) C:\Windows\SysWOW64\comcat.dll
2018-01-08 19:34 - 2017-12-31 19:39 - 000050176 _____ (Microsoft Corporation) C:\Windows\SysWOW64\auditpol.exe
2018-01-08 19:34 - 2017-12-31 19:36 - 000025600 _____ (Microsoft Corporation) C:\Windows\SysWOW64\setup16.exe
2018-01-08 19:34 - 2017-12-31 19:36 - 000014336 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ntvdm64.dll
2018-01-08 19:34 - 2017-12-31 19:36 - 000007680 _____ (Microsoft Corporation) C:\Windows\SysWOW64\instnm.exe
2018-01-08 19:34 - 2017-12-31 19:36 - 000002048 _____ (Microsoft Corporation) C:\Windows\SysWOW64\user.exe
2018-01-08 19:34 - 2017-12-31 19:35 - 000036352 _____ (Microsoft Corporation) C:\Windows\SysWOW64\cryptbase.dll
2018-01-08 19:34 - 2017-12-31 19:35 - 000006144 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-security-base-l1-1-0.dll
2018-01-08 19:34 - 2017-12-31 19:35 - 000004608 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-threadpool-l1-1-0.dll
2018-01-08 19:34 - 2017-12-31 19:35 - 000003584 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-xstate-l1-1-0.dll
2018-01-08 19:34 - 2017-12-31 19:35 - 000003072 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-util-l1-1-0.dll
2018-01-08 19:34 - 2017-12-30 01:29 - 000395968 _____ (Microsoft Corporation) C:\Windows\system32\iedkcs32.dll
2018-01-08 19:34 - 2017-12-30 00:42 - 000347328 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iedkcs32.dll
2018-01-08 19:34 - 2017-12-29 12:24 - 002724864 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.tlb
2018-01-08 19:34 - 2017-12-29 12:13 - 000062464 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iesetup.dll
2018-01-08 19:34 - 2017-12-29 12:12 - 000341504 _____ (Microsoft Corporation) C:\Windows\SysWOW64\html.iec
2018-01-08 19:34 - 2017-12-29 12:12 - 000047616 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieetwproxystub.dll
2018-01-08 19:34 - 2017-12-29 12:11 - 000064000 _____ (Microsoft Corporation) C:\Windows\SysWOW64\MshtmlDac.dll
2018-01-08 19:34 - 2017-12-29 12:06 - 000047104 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jsproxy.dll
2018-01-08 19:34 - 2017-12-29 12:06 - 000030720 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iernonce.dll
2018-01-08 19:34 - 2017-12-29 12:03 - 000620032 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript9diag.dll
2018-01-08 19:34 - 2017-12-29 12:03 - 000115712 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieUnatt.exe
2018-01-08 19:34 - 2017-12-29 11:55 - 000416256 _____ (Microsoft Corporation) C:\Windows\SysWOW64\dxtmsft.dll
2018-01-08 19:34 - 2017-12-29 11:51 - 000060416 _____ (Microsoft Corporation) C:\Windows\SysWOW64\JavaScriptCollectionAgent.dll
2018-01-08 19:34 - 2017-12-29 11:50 - 000091136 _____ (Microsoft Corporation) C:\Windows\SysWOW64\inseng.dll
2018-01-08 19:34 - 2017-12-29 11:50 - 000073216 _____ (Microsoft Corporation) C:\Windows\SysWOW64\tdc.ocx
2018-01-08 19:34 - 2017-12-29 11:47 - 000168960 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msrating.dll
2018-01-08 19:34 - 2017-12-29 11:47 - 000076288 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtmled.dll
2018-01-08 19:34 - 2017-12-29 11:46 - 000279040 _____ (Microsoft Corporation) C:\Windows\SysWOW64\dxtrans.dll
2018-01-08 19:34 - 2017-12-29 11:44 - 000130048 _____ (Microsoft Corporation) C:\Windows\SysWOW64\occache.dll
2018-01-08 19:34 - 2017-12-29 11:39 - 000230400 _____ (Microsoft Corporation) C:\Windows\SysWOW64\webcheck.dll
2018-01-08 19:34 - 2017-12-29 11:38 - 000694272 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msfeeds.dll
2018-01-08 19:34 - 2017-12-29 11:37 - 002058752 _____ (Microsoft Corporation) C:\Windows\SysWOW64\inetcpl.cpl
2018-01-08 19:34 - 2017-12-29 11:36 - 001155072 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtmlmedia.dll
2018-01-08 19:34 - 2017-12-29 11:13 - 000710144 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieapfltr.dll
2018-01-08 19:34 - 2017-12-29 03:04 - 002724864 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.tlb
2018-01-08 19:34 - 2017-12-29 03:04 - 000004096 _____ (Microsoft Corporation) C:\Windows\system32\ieetwcollectorres.dll
2018-01-08 19:34 - 2017-12-29 02:51 - 000066560 _____ (Microsoft Corporation) C:\Windows\system32\iesetup.dll
2018-01-08 19:34 - 2017-12-29 02:50 - 000577024 _____ (Microsoft Corporation) C:\Windows\system32\vbscript.dll
2018-01-08 19:34 - 2017-12-29 02:50 - 000088064 _____ (Microsoft Corporation) C:\Windows\system32\MshtmlDac.dll
2018-01-08 19:34 - 2017-12-29 02:50 - 000048640 _____ (Microsoft Corporation) C:\Windows\system32\ieetwproxystub.dll
2018-01-08 19:34 - 2017-12-29 02:44 - 000054784 _____ (Microsoft Corporation) C:\Windows\system32\jsproxy.dll
2018-01-08 19:34 - 2017-12-29 02:43 - 000034304 _____ (Microsoft Corporation) C:\Windows\system32\iernonce.dll
2018-01-08 19:34 - 2017-12-29 02:39 - 000144384 _____ (Microsoft Corporation) C:\Windows\system32\ieUnatt.exe
2018-01-08 19:34 - 2017-12-29 02:39 - 000116224 _____ (Microsoft Corporation) C:\Windows\system32\ieetwcollector.exe
2018-01-08 19:34 - 2017-12-29 02:28 - 000489984 _____ (Microsoft Corporation) C:\Windows\system32\dxtmsft.dll
2018-01-08 19:34 - 2017-12-29 02:22 - 000087552 _____ (Microsoft Corporation) C:\Windows\system32\tdc.ocx
2018-01-08 19:34 - 2017-12-29 02:22 - 000077824 _____ (Microsoft Corporation) C:\Windows\system32\JavaScriptCollectionAgent.dll
2018-01-08 19:34 - 2017-12-29 02:21 - 000107520 _____ (Microsoft Corporation) C:\Windows\system32\inseng.dll
2018-01-08 19:34 - 2017-12-29 02:18 - 000199680 _____ (Microsoft Corporation) C:\Windows\system32\msrating.dll
2018-01-08 19:34 - 2017-12-29 02:18 - 000092160 _____ (Microsoft Corporation) C:\Windows\system32\mshtmled.dll
2018-01-08 19:34 - 2017-12-29 02:16 - 000315392 _____ (Microsoft Corporation) C:\Windows\system32\dxtrans.dll
2018-01-08 19:34 - 2017-12-29 02:14 - 000152064 _____ (Microsoft Corporation) C:\Windows\system32\occache.dll
2018-01-08 19:34 - 2017-12-29 02:05 - 000262144 _____ (Microsoft Corporation) C:\Windows\system32\webcheck.dll
2018-01-08 19:34 - 2017-12-29 02:03 - 000726528 _____ (Microsoft Corporation) C:\Windows\system32\ie4uinit.exe
2018-01-08 19:34 - 2017-12-13 10:27 - 000100864 _____ (Microsoft Corporation) C:\Windows\system32\fontsub.dll
2018-01-08 19:34 - 2017-12-13 10:27 - 000046080 _____ (Adobe Systems) C:\Windows\system32\atmlib.dll
2018-01-08 19:34 - 2017-12-13 10:27 - 000041472 _____ (Microsoft Corporation) C:\Windows\system32\lpk.dll
2018-01-08 19:34 - 2017-12-13 10:27 - 000014336 _____ (Microsoft Corporation) C:\Windows\system32\dciman32.dll
2018-01-08 19:34 - 2017-12-13 10:15 - 000309480 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\atmfd.dll
2018-01-08 19:34 - 2017-12-13 10:11 - 000071168 _____ (Microsoft Corporation) C:\Windows\SysWOW64\fontsub.dll
2018-01-08 19:34 - 2017-12-13 10:11 - 000025600 _____ (Microsoft Corporation) C:\Windows\SysWOW64\lpk.dll
2018-01-08 19:34 - 2017-12-13 10:11 - 000010240 _____ (Microsoft Corporation) C:\Windows\SysWOW64\dciman32.dll
2018-01-08 19:34 - 2017-12-13 09:50 - 000034304 _____ (Adobe Systems) C:\Windows\SysWOW64\atmlib.dll
2018-01-08 19:34 - 2017-12-05 11:36 - 000625664 _____ (Microsoft Corporation) C:\Windows\system32\mscms.dll
2018-01-08 19:34 - 2017-12-05 11:36 - 000250880 _____ (Microsoft Corporation) C:\Windows\system32\icm32.dll
2018-01-08 19:34 - 2017-12-05 11:36 - 000040960 _____ (Microsoft Corporation) C:\Windows\system32\WcsPlugInService.dll
2018-01-08 19:34 - 2017-12-05 11:08 - 000481792 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mscms.dll
2018-01-08 19:34 - 2017-12-05 11:08 - 000215040 _____ (Microsoft Corporation) C:\Windows\SysWOW64\icm32.dll
2018-01-08 19:34 - 2017-12-05 09:59 - 003222528 _____ (Microsoft Corporation) C:\Windows\system32\win32k.sys
2018-01-08 19:34 - 2017-12-05 09:49 - 000032768 _____ (Microsoft Corporation) C:\Windows\SysWOW64\WcsPlugInService.dll
2018-01-02 07:19 - 2018-01-02 07:19 - 000365680 _____ (AVAST Software) C:\Windows\system32\aswBoot.exe
2018-01-02 07:19 - 2018-01-02 07:19 - 000045704 _____ () C:\Windows\system32\Drivers\staport.sys
2018-01-02 07:19 - 2018-01-02 07:18 - 000149344 _____ (AVAST Software) C:\Windows\system32\Drivers\aswHdsKe.sys
2018-01-02 07:17 - 2018-01-02 07:18 - 000150080 _____ C:\Users\TerryF\Documents\cc_20180102_071738.reg
2017-12-18 07:40 - 2018-01-02 07:19 - 000185096 _____ (AVAST Software) C:\Windows\system32\Drivers\aswArPot.sys
2017-12-18 07:34 - 2017-11-07 10:31 - 000002048 _____ (Microsoft Corporation) C:\Windows\system32\tzres.dll
2017-12-18 07:34 - 2017-11-07 10:13 - 000002048 _____ (Microsoft Corporation) C:\Windows\SysWOW64\tzres.dll
2017-12-18 07:34 - 2017-11-04 09:31 - 000194048 _____ (Microsoft Corporation) C:\Windows\system32\itircl.dll
2017-12-18 07:34 - 2017-11-04 09:31 - 000170496 _____ (Microsoft Corporation) C:\Windows\system32\itss.dll
2017-12-18 07:34 - 2017-11-04 09:10 - 000158720 _____ (Microsoft Corporation) C:\Windows\SysWOW64\itircl.dll
2017-12-18 07:34 - 2017-11-04 09:10 - 000142336 _____ (Microsoft Corporation) C:\Windows\SysWOW64\itss.dll
2017-12-18 07:34 - 2017-11-02 10:55 - 000281600 _____ (Microsoft Corporation) C:\Windows\system32\iprtrmgr.dll
2017-12-18 07:34 - 2017-11-02 10:55 - 000138240 _____ (Microsoft Corporation) C:\Windows\system32\rtm.dll
2017-12-18 07:34 - 2017-11-02 10:55 - 000097792 _____ (Microsoft Corporation) C:\Windows\system32\mprdim.dll
2017-12-18 07:34 - 2017-11-02 10:55 - 000009728 _____ (Microsoft Corporation) C:\Windows\system32\iprtprio.dll
2017-12-18 07:34 - 2017-11-02 09:11 - 000271360 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iprtrmgr.dll
2017-12-18 07:34 - 2017-11-02 09:11 - 000115200 _____ (Microsoft Corporation) C:\Windows\SysWOW64\rtm.dll
2017-12-18 07:34 - 2017-11-02 09:11 - 000075264 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mprdim.dll
2017-12-18 07:34 - 2017-11-02 08:56 - 000008192 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iprtprio.dll
2017-12-18 07:34 - 2017-10-17 20:06 - 000344064 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\usbhub.sys
2017-12-18 07:34 - 2017-10-17 20:06 - 000327168 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\usbport.sys
2017-12-18 07:34 - 2017-10-17 20:06 - 000099840 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\usbccgp.sys
2017-12-18 07:34 - 2017-10-17 20:06 - 000056320 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\usbehci.sys
2017-12-18 07:34 - 2017-10-17 20:06 - 000030720 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\usbuhci.sys
2017-12-18 07:34 - 2017-10-17 20:06 - 000025600 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\usbohci.sys
2017-12-18 07:34 - 2017-10-17 20:06 - 000007808 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\usbd.sys
2017-12-18 07:34 - 2017-10-16 17:04 - 001001984 _____ (Microsoft Corporation) C:\Windows\system32\gpedit.dll
2017-12-18 07:34 - 2017-10-16 16:46 - 000953344 _____ (Microsoft Corporation) C:\Windows\SysWOW64\gpedit.dll
2017-12-18 07:34 - 2017-10-16 15:55 - 000339968 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msexcl40.dll
2017-12-18 07:34 - 2017-10-11 18:55 - 014635008 _____ (Microsoft Corporation) C:\Windows\system32\wmp.dll
2017-12-18 07:34 - 2017-10-11 18:55 - 012574720 _____ (Microsoft Corporation) C:\Windows\system32\wmploc.DLL
2017-12-18 07:34 - 2017-10-11 18:55 - 002319872 _____ (Microsoft Corporation) C:\Windows\system32\tquery.dll
2017-12-18 07:34 - 2017-10-11 18:55 - 002222080 _____ (Microsoft Corporation) C:\Windows\system32\mssrch.dll
2017-12-18 07:34 - 2017-10-11 18:55 - 002058240 _____ (Microsoft Corporation) C:\Windows\system32\Query.dll
2017-12-18 07:34 - 2017-10-11 18:55 - 000778240 _____ (Microsoft Corporation) C:\Windows\system32\mssvp.dll
2017-12-18 07:34 - 2017-10-11 18:55 - 000491520 _____ (Microsoft Corporation) C:\Windows\system32\mssph.dll
2017-12-18 07:34 - 2017-10-11 18:55 - 000288256 _____ (Microsoft Corporation) C:\Windows\system32\mssphtb.dll
2017-12-18 07:34 - 2017-10-11 18:55 - 000151552 _____ (Microsoft Corporation) C:\Windows\system32\t2embed.dll
2017-12-18 07:34 - 2017-10-11 18:55 - 000115200 _____ (Microsoft Corporation) C:\Windows\system32\mssitlb.dll
2017-12-18 07:34 - 2017-10-11 18:55 - 000099840 _____ (Microsoft Corporation) C:\Windows\system32\mssprxy.dll
2017-12-18 07:34 - 2017-10-11 18:55 - 000075264 _____ (Microsoft Corporation) C:\Windows\system32\msscntrs.dll
2017-12-18 07:34 - 2017-10-11 18:55 - 000014336 _____ (Microsoft Corporation) C:\Windows\system32\msshooks.dll
2017-12-18 07:34 - 2017-10-11 18:55 - 000009728 _____ (Microsoft Corporation) C:\Windows\system32\spwmp.dll
2017-12-18 07:34 - 2017-10-11 18:55 - 000005120 _____ (Microsoft Corporation) C:\Windows\system32\msdxm.ocx
2017-12-18 07:34 - 2017-10-11 18:55 - 000005120 _____ (Microsoft Corporation) C:\Windows\system32\dxmasf.dll
2017-12-18 07:34 - 2017-10-11 18:39 - 000591872 _____ (Microsoft Corporation) C:\Windows\system32\SearchIndexer.exe
2017-12-18 07:34 - 2017-10-11 18:38 - 000249856 _____ (Microsoft Corporation) C:\Windows\system32\SearchProtocolHost.exe
2017-12-18 07:34 - 2017-10-11 18:38 - 000113664 _____ (Microsoft Corporation) C:\Windows\system32\SearchFilterHost.exe
2017-12-18 07:34 - 2017-10-11 18:37 - 012574208 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wmploc.DLL
2017-12-18 07:34 - 2017-10-11 18:37 - 011410944 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wmp.dll
2017-12-18 07:34 - 2017-10-11 18:37 - 001549824 _____ (Microsoft Corporation) C:\Windows\SysWOW64\tquery.dll
2017-12-18 07:34 - 2017-10-11 18:37 - 001400320 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mssrch.dll
2017-12-18 07:34 - 2017-10-11 18:37 - 001363968 _____ (Microsoft Corporation) C:\Windows\SysWOW64\Query.dll
2017-12-18 07:34 - 2017-10-11 18:37 - 000666624 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mssvp.dll
2017-12-18 07:34 - 2017-10-11 18:37 - 000337408 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mssph.dll
2017-12-18 07:34 - 2017-10-11 18:37 - 000197120 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mssphtb.dll
2017-12-18 07:34 - 2017-10-11 18:37 - 000111104 _____ (Microsoft Corporation) C:\Windows\SysWOW64\t2embed.dll
2017-12-18 07:34 - 2017-10-11 18:37 - 000104448 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mssitlb.dll
2017-12-18 07:34 - 2017-10-11 18:37 - 000059392 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msscntrs.dll
2017-12-18 07:34 - 2017-10-11 18:37 - 000034816 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mssprxy.dll
2017-12-18 07:34 - 2017-10-11 18:26 - 000427520 _____ (Microsoft Corporation) C:\Windows\SysWOW64\SearchIndexer.exe
2017-12-18 07:34 - 2017-10-11 18:26 - 000164352 _____ (Microsoft Corporation) C:\Windows\SysWOW64\SearchProtocolHost.exe
2017-12-18 07:34 - 2017-10-11 18:25 - 000086528 _____ (Microsoft Corporation) C:\Windows\SysWOW64\SearchFilterHost.exe
2017-12-18 07:34 - 2017-10-11 18:25 - 000009728 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msshooks.dll
2017-12-18 07:34 - 2017-10-11 18:24 - 000008192 _____ (Microsoft Corporation) C:\Windows\SysWOW64\spwmp.dll
2017-12-18 07:34 - 2017-10-11 18:24 - 000004096 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msdxm.ocx
2017-12-18 07:34 - 2017-10-11 18:24 - 000004096 _____ (Microsoft Corporation) C:\Windows\SysWOW64\dxmasf.dll
2017-12-18 07:34 - 2017-10-11 18:20 - 000317440 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\rdbss.sys
2017-12-18 07:34 - 2017-10-11 18:20 - 000113152 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\luafv.sys
2017-12-18 07:33 - 2017-12-18 07:33 - 000000000 ____D C:\Program Files\Common Files\avast software

==================== One Month Modified files and folders ========

(If an entry is included in the fixlist, the file/folder will be moved.)

2018-01-09 10:14 - 2017-06-21 11:03 - 000000540 _____ C:\Windows\Tasks\G2MUpdateTask-S-1-5-21-2249576302-3863294968-408106873-1001.job
2018-01-09 10:10 - 2009-07-13 22:45 - 000028352 ____H C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0
2018-01-09 10:10 - 2009-07-13 22:45 - 000028352 ____H C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0
2018-01-09 10:09 - 2014-05-15 18:39 - 000000000 ____D C:\Program Files (x86)\AlienRespawn
2018-01-09 10:09 - 2009-07-13 23:13 - 000783114 _____ C:\Windows\system32\PerfStringBackup.INI
2018-01-09 10:09 - 2009-07-13 21:20 - 000000000 ____D C:\Windows\inf
2018-01-09 10:03 - 2014-05-22 19:06 - 000000000 ____D C:\Program Files (x86)\Glary Utilities 5
2018-01-09 10:02 - 2014-05-15 18:36 - 000000000 ____D C:\ProgramData\NVIDIA
2018-01-09 10:02 - 2009-07-13 23:08 - 000000006 ____H C:\Windows\Tasks\SA.DAT
2018-01-09 09:33 - 2016-07-22 13:28 - 000003504 _____ C:\Windows\System32\Tasks\PCDEventLauncherTask
2018-01-09 09:30 - 2016-08-08 17:09 - 000000000 ____D C:\Users\TerryF\.thinkorswim
2018-01-09 09:22 - 2017-06-21 11:03 - 000000636 _____ C:\Windows\Tasks\G2MUploadTask-S-1-5-21-2249576302-3863294968-408106873-1001.job
2018-01-09 08:13 - 2014-05-27 09:38 - 000000000 ____D C:\Users\TerryF\AppData\Local\CrashDumps
2018-01-09 07:44 - 2016-08-08 17:09 - 000000000 ____D C:\Program Files\thinkorswim
2018-01-09 07:43 - 2015-07-09 07:43 - 005293056 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerInstaller.exe
2018-01-09 07:43 - 2014-05-15 18:23 - 000803328 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerApp.exe
2018-01-09 07:43 - 2014-05-15 18:23 - 000144896 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerCPLApp.cpl
2018-01-09 07:43 - 2014-05-15 18:23 - 000004312 _____ C:\Windows\System32\Tasks\Adobe Flash Player Updater
2018-01-09 07:43 - 2014-05-15 18:23 - 000000000 ____D C:\Windows\SysWOW64\Macromed
2018-01-09 07:43 - 2014-05-15 18:23 - 000000000 ____D C:\Windows\system32\Macromed
2018-01-09 07:31 - 2014-05-22 18:47 - 000000000 ____D C:\ProgramData\performance
2018-01-09 07:31 - 2014-05-22 16:07 - 000000000 ____D C:\Users\TerryF\AppData\Local\VirtualStore
2018-01-08 21:45 - 2009-07-13 22:45 - 000304584 _____ C:\Windows\system32\FNTCACHE.DAT
2018-01-08 15:09 - 2014-11-17 05:51 - 000004364 _____ C:\ProgramData\keystore.xml
2018-01-08 07:28 - 2014-05-22 19:06 - 000003316 _____ C:\Windows\System32\Tasks\GlaryInitialize 5
2018-01-08 07:28 - 2014-05-22 19:06 - 000002976 _____ C:\Windows\System32\Tasks\GU5SkipUAC
2018-01-08 07:28 - 2014-05-22 19:06 - 000001094 _____ C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Glary Utilities 5.lnk
2018-01-08 07:28 - 2014-05-22 19:06 - 000001082 _____ C:\Users\Public\Desktop\Glary Utilities 5.lnk
2018-01-08 07:24 - 2017-08-11 10:17 - 000000000 __SHD C:\Users\TerryF\IntelGraphicsProfiles
2018-01-06 19:42 - 2017-07-28 17:00 - 000000604 _____ C:\Windows\Tasks\TradeStation Backup - Monthly.job
2018-01-06 19:42 - 2017-07-28 17:00 - 000000600 _____ C:\Windows\Tasks\TradeStation Backup - Weekly.job
2018-01-06 18:17 - 2014-05-22 19:03 - 000000000 ____D C:\Program Files (x86)\TradeStation Archives
2018-01-05 22:07 - 2014-05-22 16:06 - 000000000 ____D C:\Users\TerryF
2018-01-04 07:14 - 2017-07-08 17:32 - 000000000 ____D C:\Users\TerryF\AppData\Local\GoToMeeting
2018-01-02 07:19 - 2017-03-17 18:51 - 000003914 _____ C:\Windows\System32\Tasks\Avast Emergency Update
2018-01-02 07:19 - 2014-07-03 07:07 - 000204456 _____ (AVAST Software) C:\Windows\system32\Drivers\aswStm.sys
2018-01-02 07:19 - 2014-07-03 07:07 - 000046976 _____ (AVAST Software) C:\Windows\system32\Drivers\aswHwid.sys
2018-01-02 07:19 - 2014-07-03 06:56 - 000358672 _____ (AVAST Software) C:\Windows\system32\Drivers\aswVmm.sys
2018-01-02 07:19 - 2014-07-03 06:56 - 000110336 _____ (AVAST Software) C:\Windows\system32\Drivers\aswRdr2.sys
2018-01-02 07:19 - 2014-07-03 06:56 - 000084384 _____ (AVAST Software) C:\Windows\system32\Drivers\aswRvrt.sys
2018-01-02 07:19 - 2014-07-03 04:58 - 000457400 _____ (AVAST Software) C:\Windows\system32\Drivers\aswSP.sys
2018-01-02 07:19 - 2014-07-03 04:58 - 000146664 _____ (AVAST Software) C:\Windows\system32\Drivers\aswMonFlt.sys
2018-01-02 07:18 - 2017-03-17 18:50 - 000343768 _____ (AVAST Software) C:\Windows\system32\Drivers\aswbloga.sys
2018-01-02 07:18 - 2017-03-17 18:50 - 000321512 _____ (AVAST Software) C:\Windows\system32\Drivers\aswbidsdrivera.sys
2018-01-02 07:18 - 2017-03-17 18:50 - 000199448 _____ (AVAST Software) C:\Windows\system32\Drivers\aswbidsha.sys
2018-01-02 07:18 - 2017-03-17 18:50 - 000057696 _____ (AVAST Software) C:\Windows\system32\Drivers\aswbuniva.sys
2018-01-02 07:18 - 2014-07-03 04:58 - 001025176 _____ (AVAST Software) C:\Windows\system32\Drivers\aswSnx.sys
2018-01-02 07:15 - 2011-02-10 08:02 - 000000000 ____D C:\Windows\panther
2017-12-22 07:20 - 2016-09-21 06:16 - 000000799 _____ C:\Users\Public\Desktop\Medved Trader.lnk
2017-12-22 07:20 - 2016-09-21 06:16 - 000000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Medved Trader
2017-12-22 07:20 - 2016-09-21 06:16 - 000000000 ____D C:\Program Files\Medved Trader
2017-12-21 11:22 - 2017-06-21 11:03 - 000003666 _____ C:\Windows\System32\Tasks\G2MUploadTask-S-1-5-21-2249576302-3863294968-408106873-1001
2017-12-21 11:22 - 2017-06-21 11:03 - 000003570 _____ C:\Windows\System32\Tasks\G2MUpdateTask-S-1-5-21-2249576302-3863294968-408106873-1001
2017-12-20 17:04 - 2009-07-13 21:20 - 000000000 ____D C:\Windows\rescache
2017-12-18 22:49 - 2009-07-13 21:20 - 000000000 ____D C:\Windows\SysWOW64\Setup
2017-12-18 22:49 - 2009-07-13 21:20 - 000000000 ____D C:\Windows\system32\Setup
2017-12-18 22:46 - 2014-05-22 20:02 - 000000000 ____D C:\Windows\system32\MRT
2017-12-18 22:44 - 2017-10-12 21:01 - 133326408 ____C (Microsoft Corporation) C:\Windows\system32\MRT-KB890830.exe
2017-12-18 22:44 - 2014-05-22 20:02 - 133326408 ____C (Microsoft Corporation) C:\Windows\system32\MRT.exe
2017-12-18 07:39 - 2014-07-03 04:58 - 000455384 _____ (AVAST Software) C:\Windows\system32\Drivers\aswSP.sys.151360443398504
2017-12-18 07:38 - 2016-01-09 21:54 - 000002441 _____ C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Acrobat Reader DC.lnk
2017-12-18 07:38 - 2015-05-19 06:01 - 000004476 _____ C:\Windows\System32\Tasks\Adobe Acrobat Update Task
2017-12-18 07:33 - 2015-12-03 16:34 - 000000000 ____D C:\Windows\System32\Tasks\AVAST Software
2017-12-18 07:27 - 2016-01-09 21:51 - 000003330 _____ C:\Windows\System32\Tasks\GoogleUpdateTaskMachineUA
2017-12-18 07:27 - 2016-01-09 21:50 - 000003202 _____ C:\Windows\System32\Tasks\GoogleUpdateTaskMachineCore

==================== Files in the root of some directories =======

2014-05-22 22:01 - 2007-01-24 16:22 - 000594432 ____N () C:\Users\TerryF\zsnesw.exe
1998-12-08 20:53 - 1998-12-08 20:53 - 000099840 _____ (Symantec Corp.) C:\Program Files (x86)\Common Files\IRAABOUT.DLL
1998-12-08 20:53 - 1998-12-08 20:53 - 000048640 _____ (Symantec Corp., Peter Norton Computing Group) C:\Program Files (x86)\Common Files\IRALPTTR.DLL
1998-12-08 20:53 - 1998-12-08 20:53 - 000070144 _____ (Symantec Corp., Peter Norton Computing Group) C:\Program Files (x86)\Common Files\IRAMDMTR.DLL
1998-12-08 20:53 - 1998-12-08 20:53 - 000186368 _____ (Symantec Corp., Peter Norton Computing Group) C:\Program Files (x86)\Common Files\IRAREG.DLL
1998-12-08 20:53 - 1998-12-08 20:53 - 000017920 _____ (Symantec Corp.) C:\Program Files (x86)\Common Files\IRASRIAL.DLL
1998-12-08 20:53 - 1998-12-08 20:53 - 000031744 _____ (Symantec Corp., Peter Norton Computing Group) C:\Program Files (x86)\Common Files\IRAWEBTR.DLL
2017-07-28 16:48 - 2017-07-28 16:48 - 000000320 _____ () C:\Users\TerryF\AppData\Roaming\SEC629985.trad
2014-05-22 18:50 - 1997-07-10 23:00 - 000000002 _____ () C:\Users\TerryF\AppData\Roaming\Microsoft\ArtGalry.cag
2016-05-25 10:14 - 2017-08-11 10:11 - 000000000 _____ () C:\Users\TerryF\AppData\Local\BluetoothPresent.flag
2012-05-03 05:12 - 2012-05-03 05:12 - 000000532 _____ () C:\Users\TerryF\AppData\Local\datos.txt
2016-05-25 10:14 - 2017-08-11 10:11 - 000000000 _____ () C:\Users\TerryF\AppData\Local\Driver_Jupiter_01Present.flag
2016-05-25 10:14 - 2017-08-11 10:11 - 000000000 _____ () C:\Users\TerryF\AppData\Local\Driver_LOM_8161Present.flag
2014-02-05 14:08 - 2014-02-05 14:08 - 000193744 _____ () C:\Users\TerryF\AppData\Local\lateral1.bmp
2010-11-12 03:10 - 2010-11-12 03:10 - 000193744 _____ () C:\Users\TerryF\AppData\Local\lateral2.bmp
2014-02-05 14:10 - 2014-02-05 14:10 - 000195108 _____ () C:\Users\TerryF\AppData\Local\lateral3.bmp
2014-02-05 15:50 - 2014-02-05 15:50 - 000043976 _____ () C:\Users\TerryF\AppData\Local\save_en.bmp
2014-02-05 15:49 - 2014-02-05 15:49 - 000043976 _____ () C:\Users\TerryF\AppData\Local\save_es.bmp

==================== Bamital & volsnap ======================

(There is no automatic fix for files that do not pass verification.)

C:\Windows\system32\winlogon.exe => File is digitally signed
C:\Windows\system32\wininit.exe => File is digitally signed
C:\Windows\SysWOW64\wininit.exe => File is digitally signed
C:\Windows\explorer.exe => File is digitally signed
C:\Windows\SysWOW64\explorer.exe => File is digitally signed
C:\Windows\system32\svchost.exe => File is digitally signed
C:\Windows\SysWOW64\svchost.exe => File is digitally signed
C:\Windows\system32\services.exe => File is digitally signed
C:\Windows\system32\User32.dll => File is digitally signed
C:\Windows\SysWOW64\User32.dll => File is digitally signed
C:\Windows\system32\userinit.exe => File is digitally signed
C:\Windows\SysWOW64\userinit.exe => File is digitally signed
C:\Windows\system32\rpcss.dll => File is digitally signed
C:\Windows\system32\dnsapi.dll => File is digitally signed
C:\Windows\SysWOW64\dnsapi.dll => File is digitally signed
C:\Windows\system32\Drivers\volsnap.sys => File is digitally signed

LastRegBack: 2018-01-08 08:16

==================== End of FRST.txt ============================

Addition:

Additional scan result of Farbar Recovery Scan Tool (x64) Version: 02.01.2018
Ran by [removed] (09-01-2018 10:17:07)
Running from C:\Users\[removed]\Downloads
Windows 7 Home Premium Service Pack 1 (X64) (2014-05-22 22:06:03)
Boot Mode: Normal
==========================================================

==================== Accounts: =============================

Administrator (S-1-5-21-2249576302-3863294968-408106873-500 - Administrator - Disabled) => C:\Users\Administrator
Guest (S-1-5-21-2249576302-3863294968-408106873-501 - Limited - Disabled)
HomeGroupUser$ (S-1-5-21-2249576302-3863294968-408106873-1002 - Limited - Enabled)
TerryF (S-1-5-21-2249576302-3863294968-408106873-1001 - Administrator - Enabled) => C:\Users\TerryF

==================== Security Center ========================

(If an entry is included in the fixlist, it will be removed.)

AV: Avast Antivirus (Enabled - Up to date) {8EA8924E-BC81-DC44-8BB0-8BAE75D86EBF}
AS: Windows Defender (Disabled - Up to date) {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
AS: Avast Antivirus (Enabled - Up to date) {35C973AA-9ABB-D3CA-B100-B0DC0E5F2402}

==================== Installed Programs ======================

(Only the adware programs with "Hidden" flag could be added to the fixlist to unhide them. The adware programs should be uninstalled manually.)

Accidental Damage Services Agreement (HKLM-x32\…\{330B7AAD-B2FE-4989-B02A-DDA5A174FCDF}) (Version: 2.0.0 - Dell Inc.)
Adobe Acrobat Reader DC (HKLM-x32\…\{AC76BA86-7AD7-1033-7B44-AC0F074E4100}) (Version: 18.009.20050 - Adobe Systems Incorporated)
Adobe Flash Player 28 ActiveX (HKLM-x32\…\Adobe Flash Player ActiveX) (Version: 28.0.0.137 - Adobe Systems Incorporated)
AlienRespawn - Support Software (HKLM-x32\…\{A9668246-FB70-4103-A1E3-66C9BC2EFB49}) (Version: 1.7.1.2 - Alienware)
AlienRespawn (HKLM-x32\…\{0ED7EE95-6A97-47AA-AD73-152C08A15B04}) (Version: 1.7.1.2 - Alienware)
Alienware Command Center (HKLM\…\{D4CE21D4-27E5-46DB-9FFE-553A90AD4B9F}) (Version: 3.5.14.0 - Alienware Corp.) Hidden
Alienware Command Center (HKLM-x32\…\InstallShield_{D4CE21D4-27E5-46DB-9FFE-553A90AD4B9F}) (Version: 3.5.14.0 - Alienware Corp.)
Alienware Customer Surveys (HKLM-x32\…\{9AAA35D1-B21D-4610-BBAE-18FE2D00C3E0}) (Version: 1.11.4124 - Dell Inc.)
Alienware On-Screen Display (HKLM-x32\…\{0D69462F-99CC-4F8D-942E-666E21CE59F8}) (Version: 0.33.0.11C - ) Hidden
Alienware On-Screen Display (HKLM-x32\…\InstallShield_{0D69462F-99CC-4F8D-942E-666E21CE59F8}) (Version: 0.33.0.11C - )
Avast Free Antivirus (HKLM-x32\…\Avast Antivirus) (Version: 17.9.2322 - AVAST Software)
Banctec Service Agreement (HKLM-x32\…\{BD4B02C1-0271-4D7D-A850-19DE2E5CDF83}) (Version: 2.0.0 - Dell Inc.)
CCleaner (HKLM\…\CCleaner) (Version: 4.16 - Piriform)
Cheat Engine 6.3 (HKLM-x32\…\Cheat Engine 6.3_is1) (Version: - Cheat Engine)
Cheat Engine 6.4 (HKLM-x32\…\Cheat Engine 6.4_is1) (Version: - Cheat Engine)
Cheat Engine 6.5 (HKLM-x32\…\Cheat Engine 6.5_is1) (Version: - Cheat Engine)
Cisco WebEx Meetings (HKU\S-1-5-21-2249576302-3863294968-408106873-1001\…\ActiveTouchMeetingClient) (Version: - Cisco WebEx LLC)
CompleteCare Business Service Agreement (HKLM-x32\…\{83E499FA-E6AA-47F9-80F2-1E0109E49397}) (Version: 2.0.0 - Dell Inc.)
Dell InHome Service Agreement (HKLM-x32\…\{41AA8F20-FD30-4878-9080-6D5BE575FD41}) (Version: 2.0.0 - Dell Inc.)
Dell SupportAssist (HKLM\…\PC-Doctor for Windows) (Version: 2.0.6875.668 - Dell)
Dell SupportAssistAgent (HKLM\…\{18EF001B-B005-46CB-917B-112BA69ED85E}) (Version: 2.0.3.10 - Dell)
Dell System Detect (HKU\S-1-5-21-2249576302-3863294968-408106873-1001\…\d24084d039586cae) (Version: 8.5.0.4 - Dell)
DHS Service Agreement (HKLM-x32\…\{BE7FC743-CC74-4977-82DD-CD4FC7EF74B6}) (Version: 2.0.0 - Dell Inc.)
Dolby Home Theater v4 (HKLM-x32\…\{B26438B4-BF51-49C3-9567-7F14A5E40CB9}) (Version: 7.2.8000.17 - Dolby Laboratories Inc)
EMSC (HKLM-x32\…\{FEF06E73-A519-4510-8CF3-B66041B91D8A}) (Version: 0.0.0.25 - Compal Electronics, Inc.) Hidden
eSignal (HKLM-x32\…\{988ACB3F-EF50-43B9-97A4-90E816660122}) (Version: 10.6.4063.1258 - eSignal) Hidden
eSignal 10.6 (HKLM-x32\…\eSignal) (Version: 10.6.4063.1258 - eSignal)
Frhed 1.7.1 (HKLM-x32\…\Frhed) (Version: 1.7.1 - Raihan Kibria)
Glary Utilities 5.91 (HKLM-x32\…\Glary Utilities 5) (Version: 5.91.0.112 - Glarysoft Ltd)
GOM Player (HKLM-x32\…\GOM Player) (Version: 2.2.69.5227 - Gretech Corporation)
Google Toolbar for Internet Explorer (HKLM-x32\…\{18455581-E099-4BA8-BC6B-F34B2F06600C}) (Version: 1.0.0 - Google Inc.) Hidden
Google Toolbar for Internet Explorer (HKLM-x32\…\{2318C2B1-4965-11d4-9B18-009027A5CD4F}) (Version: 7.5.8231.2252 - Google Inc.)
Google Update Helper (HKLM-x32\…\{60EC980A-BDA2-4CB6-A427-B07A5498B4CA}) (Version: 1.3.33.7 - Google Inc.) Hidden
GoTo Opener (HKLM-x32\…\{8B2D47CC-1558-4939-B27F-41E30530072A}) (Version: 1.0.467 - LogMeIn, Inc.)
GoToAssist Corporate (HKLM-x32\…\GoToAssist) (Version: 11.5.0.1165 - Citrix Systems, Inc.)
GoToMeeting 8.19.0.8126 (HKU\S-1-5-21-2249576302-3863294968-408106873-1001\…\GoToMeeting) (Version: 8.19.0.8126 - LogMeIn, Inc.)
Heroes of Might and Magic V - Tribes of the East (HKLM-x32\…\{66FF4C48-0083-4E60-8556-B883AB200092}) (Version: - )
Heroes of Might and Magic® III (HKLM-x32\…\Heroes of Might and Magic® III) (Version: - )
Intel(R) Management Engine Components (HKLM-x32\…\{65153EA5-8B6E-43B6-857B-C6E4FC25798A}) (Version: 9.0.0.1323 - Intel Corporation)
Intel(R) Processor Graphics (HKLM-x32\…\{F0E3AD40-2BBD-4360-9C76-B9AC9A5886EA}) (Version: 10.18.14.4414 - Intel Corporation)
Intel(R) Rapid Storage Technology (HKLM\…\{409CB30E-E457-4008-9B1A-ED1B9EA21140}) (Version: 12.0.7.1002 - Intel Corporation)
Intel(R) USB 3.0 eXtensible Host Controller Driver (HKLM-x32\…\{240C3DDD-C5E9-4029-9DF7-95650D040CF2}) (Version: 2.0.0.102 - Intel Corporation)
IZArc 4.1.8 (HKLM-x32\…\{97C82B44-D408-4F14-9252-47FC1636D23E}_is1) (Version: 4.1.8 - Ivan Zahariev)
Mastering Visual Basic 5 Fundamentals (HKLM-x32\…\Mastering Visual Basic 5 Fundamentals) (Version: - )
Medved Trader version 1.1.7000.2033 (HKLM\…\{528BD475-95CE-47B6-B40A-1136FED0D462}_is1) (Version: 1.1.7000.2033 - 2GK, Inc.)
Microsoft .NET Framework 4.7 (HKLM\…\{92FB6C44-E685-45AD-9B20-CADF4CABA132} - 1033) (Version: 4.7.02053 - Microsoft Corporation)
Microsoft Mouse and Keyboard Center (HKLM\…\Microsoft Mouse and Keyboard Center) (Version: 2.5.166.0 - Microsoft Corporation)
Microsoft Office 2000 Professional (HKLM-x32\…\{00010409-78E1-11D2-B60F-006097C998E7}) (Version: 9.00.2720 - Microsoft Corporation)
Microsoft Office 97, Professional Edition (HKLM-x32\…\Office8.0) (Version: - )
Microsoft SQL Server Compact 4.0 x64 ENU (HKLM\…\{8424B163-D1E0-48B7-88A2-C7A61767B3D7}) (Version: 4.0.8482.1 - Microsoft Corporation)
Microsoft Visual C++ 2005 Redistributable (HKLM-x32\…\{710f4c1c-cc18-4c49-8cbf-51240c89a1a2}) (Version: 8.0.61001 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17 (HKLM-x32\…\{9A25302D-30C0-39D9-BD6F-21E6EC160475}) (Version: 9.0.30729 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.4148 (HKLM-x32\…\{1F1C2DFC-2D24-3E06-BCB8-725134ADF989}) (Version: 9.0.30729.4148 - Microsoft Corporation)
Microsoft Visual C++ 2010 x64 Redistributable - 10.0.40219 (HKLM\…\{1D8E6291-B0D5-35EC-8441-6616F567A0F7}) (Version: 10.0.40219 - Microsoft Corporation)
Microsoft Visual C++ 2010 x86 Redistributable - 10.0.40219 (HKLM-x32\…\{F0C3E5D1-1ADE-321E-8167-68EF0DE699A5}) (Version: 10.0.40219 - Microsoft Corporation)
Microsoft Visual C++ 2012 Redistributable (x64) - 11.0.50727 (HKLM-x32\…\{15134cb0-b767-4960-a911-f2d16ae54797}) (Version: 11.0.50727.1 - Microsoft Corporation)
Microsoft Visual C++ 2012 Redistributable (x86) - 11.0.50727 (HKLM-x32\…\{22154f09-719a-4619-bb71-5b3356999fbf}) (Version: 11.0.50727.1 - Microsoft Corporation)
Microsoft Visual C++ 2015 Redistributable (x64) - 14.0.24123 (HKLM-x32\…\{2cbcedbb-f38c-48a3-a3e1-6c6fd821a7f4}) (Version: 14.0.24123.0 - Microsoft Corporation)
Microsoft Visual C++ 2015 Redistributable (x86) - 14.0.24212 (HKLM-x32\…\{462f63a8-6347-4894-a1b3-dbfe3a4c981d}) (Version: 14.0.24212.0 - Microsoft Corporation)
Might & Magic Heroes VI (HKLM-x32\…\{745D37C2-26F4-4B65-BA13-F9840EBFA75B}) (Version: 1.8 - Ubisoft)
Mozilla Firefox 56.0 (x86 en-US) (HKLM-x32\…\Mozilla Firefox 56.0 (x86 en-US)) (Version: 56.0 - Mozilla)
Mozilla Maintenance Service (HKLM-x32\…\MozillaMaintenanceService) (Version: 56.0.0.6478 - Mozilla)
NVIDIA 3D Vision Driver 344.11 (HKLM\…\{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_Display.3DVision) (Version: 344.11 - NVIDIA Corporation)
NVIDIA GeForce Experience 2.1.3 (HKLM\…\{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_Display.GFExperience) (Version: 2.1.3 - NVIDIA Corporation)
NVIDIA Graphics Driver 344.11 (HKLM\…\{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_Display.Driver) (Version: 344.11 - NVIDIA Corporation)
NVIDIA HD Audio Driver 1.3.32.1 (HKLM\…\{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_HDAudio.Driver) (Version: 1.3.32.1 - NVIDIA Corporation)
NVIDIA PhysX System Software 9.14.0702 (HKLM\…\{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_Display.PhysX) (Version: 9.14.0702 - NVIDIA Corporation)
PhotoRazor (HKLM-x32\…\PhotoRazor) (Version: - )
Premium Service Agreement (HKLM-x32\…\{A74168E5-C3F7-4809-85D3-145C64A4CFCC}) (Version: 2.0.0 - Dell Inc.)
Qualcomm Atheros Bluetooth Suite (64) (HKLM\…\{A84A4FB1-D703-48DB-89E0-68B6499D2801}) (Version: 8.0.1.306 - Qualcomm Atheros Communications) Hidden
Qualcomm Atheros Killer Wireless-N Drivers (HKLM\…\{74CF9417-86F5-47F2-A0A1-1BEFD7E57D07}) (Version: 1.0.36.1067 - Qualcomm Atheros) Hidden
Qualcomm Atheros Wireless Drivers (HKLM-x32\…\{500D8B44-4ADB-4710-9512-959E65859998}) (Version: 1.0.36.1067 - Qualcomm Atheros)
QualxServ Service Agreement (HKLM-x32\…\{18401E1E-1E44-461A-A4B2-E48B1A727818}) (Version: 2.0.0 - Dell Inc.)
QuoteTracker (HKLM-x32\…\QuoteTracker_is1) (Version: - T2 API Technologies, LLC)
Real Alternative 1.8.0 (HKLM-x32\…\RealAlt_is1) (Version: 1.8.0 - )
Realtek High Definition Audio Driver (HKLM-x32\…\{F132AF7F-7BCA-4EDE-8A7C-958108FE7DBC}) (Version: 6.0.1.6876 - Realtek Semiconductor Corp.)
Realtek PCIE Card Reader (HKLM-x32\…\{0D61A55C-3ADC-409F-BF5B-A1766D1F5944}) (Version: 6.2.9200.28134 - Realtek Semiconductor Corp.)
SafeZone Stable 4.58.2552.909 (HKLM-x32\…\SafeZone 4.58.2552.909) (Version: 4.58.2552.909 - Avast Software) Hidden
ScottradeELITE 2013 (HKLM-x32\…\{5D292E0F-F1DB-4606-97A1-0B020621A139}) (Version: 5.2.3.0 - Scottrader)
SHIELD Streaming (HKLM\…\{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_GFExperience.NvStreamSrv) (Version: 3.1.1000 - NVIDIA Corporation) Hidden
SHIELD Wireless Controller Driver (HKLM\…\{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_ShieldWirelessController) (Version: 16.13.56 - NVIDIA Corporation) Hidden
Simple Sudoku 4.2 (HKLM-x32\…\Simple Sudoku_is1) (Version: - )
Snagit 11 (HKLM-x32\…\{5EAF9FAA-C4B6-4741-81B4-74CD81759EAA}) (Version: 11.4.0 - TechSmith Corporation)
ST Microelectronics 3 Axis Digital Accelerometer Solution (HKLM-x32\…\{9C24F411-9CA7-4A8A-91F3-F08A4A38EB31}) (Version: 4.12.0040 - ST Microelectronics)
SuDoKu-Cracker (HKU\S-1-5-21-2249576302-3863294968-408106873-1001\…\SuDoKu-Cracker) (Version: - )
Synaptics Pointing Device Driver (HKLM\…\SynTPDeinstKey) (Version: 16.3.8.62 - Synaptics Incorporated)
TeleChart 2007 (HKLM-x32\…\{8F899627-1EA1-484D-91EA-7B22C05358DB}) (Version: 6.00.0000 - Worden Brothers Inc)
TextPad 4 (HKLM-x32\…\TextPad 4) (Version: - )
thinkorswim (HKLM\…\9968-4488-2169-7623) (Version: desktop - thinkorswim, Inc)
TradeStation 9.1 (HKLM-x32\…\{B948B39D-214F-486E-BCD9-8AB691F8762A}) (Version: 9.01.00.12793 - TradeStation Technologies)
TradeStation 9.5 (HKLM-x32\…\{E02A3EE0-1193-454C-8E59-BDFCE6EC7B22}) (Version: 9.05.01.3258 - TradeStation Technologies)
Ubisoft Game Launcher (HKLM-x32\…\{888F1505-C2B3-4FDE-835D-36353EBD4754}) (Version: 1.0.0.0 - UBISOFT)
Visual Studio 2012 x64 Redistributables (HKLM\…\{8C775E70-A791-4DA8-BCC3-6AB7136F4484}) (Version: 14.0.0.1 - AVG Technologies)
Visual Studio 2012 x86 Redistributables (HKLM-x32\…\{98EFF19A-30AB-4E4B-B943-F06B1C63EBF8}) (Version: 14.0.0.1 - AVG Technologies CZ, s.r.o.)
Wizardry 8 (HKLM-x32\…\Wizardry 8) (Version: - )
Yahoo! Messenger (HKLM-x32\…\Yahoo! Messenger) (Version: - Yahoo! Inc.)
Yahoo! Software Update (HKLM-x32\…\Yahoo! Software Update) (Version: - )

==================== Custom CLSID (Whitelisted): ==========================

(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)

CustomCLSID: HKU\S-1-5-21-2249576302-3863294968-408106873-1001_Classes\CLSID\{820D63D5-8CFF-46DE-86AF-4997DEDD6DB5}\localserver32 -> C:\Windows\system32\igfxEM.exe (Intel Corporation)
CustomCLSID: HKU\S-1-5-21-2249576302-3863294968-408106873-1001_Classes\CLSID\{84B5A313-CD5D-4904-8BA2-AFDC81C1B309}\InprocServer32 -> C:\Users\TerryF\AppData\Local\GoToMeeting\7759\G2MOutlookAddin64.dll (LogMeIn, Inc.)
ShellIconOverlayIdentifiers: [00asw] -> {472083B0-C522-11CF-8763-00608CC02F24} => C:\Program Files\AVAST Software\Avast\ashShA64.dll [2018-01-02] (AVAST Software)
ShellIconOverlayIdentifiers: [00avast] -> {472083B0-C522-11CF-8763-00608CC02F24} => C:\Program Files\AVAST Software\Avast\ashShA64.dll [2018-01-02] (AVAST Software)
ShellIconOverlayIdentifiers: [DBARFileBackuped] -> {831cebdd-6baf-4432-be76-9e0989c14aef} => C:\Windows\system32\mscoree.dll [2010-11-20] (Microsoft Corporation)
ShellIconOverlayIdentifiers: [DBARFileNotBackuped] -> {275e4fd7-21ef-45cf-a836-832e5d2cc1b3} => C:\Windows\system32\mscoree.dll [2010-11-20] (Microsoft Corporation)
ContextMenuHandlers1: [Atheros] -> {B8952421-0E55-400B-94A6-FA858FC0A39F} => C:\Program Files (x86)\Bluetooth Suite\BtvAppExt.dll [2013-09-25] (Qualcomm®Atheros®)
ContextMenuHandlers1: [avast] -> {472083B0-C522-11CF-8763-00608CC02F24} => C:\Program Files\AVAST Software\Avast\ashShA64.dll [2018-01-02] (AVAST Software)
ContextMenuHandlers1: [Glary Utilities] -> {B3C418F8-922B-4faf-915E-59BC14448CF7} => C:\Program Files (x86)\Glary Utilities 5\x64\ContextHandler.dll [2015-12-21] (Glarysoft Ltd)
ContextMenuHandlers1: [IZArcCM] -> {BC593DF5-466F-44EC-8FFD-C4DBC603B917} => C:\Program Files (x86)\IZArc\IZArcCM64.dll [2012-07-20] ()
ContextMenuHandlers1: [SnagItMainShellExt] -> {CF74B903-3389-469c-B3B6-0204D204FCBD} => C:\Program Files (x86)\TechSmith\Snagit 11\DLLx64\SnagitShellExt64.dll [2013-12-18] (TechSmith Corporation)
ContextMenuHandlers2: [Glary Utilities] -> {B3C418F8-922B-4faf-915E-59BC14448CF7} => C:\Program Files (x86)\Glary Utilities 5\x64\ContextHandler.dll [2015-12-21] (Glarysoft Ltd)
ContextMenuHandlers3: [00asw] -> {472083B0-C522-11CF-8763-00608CC02F24} => C:\Program Files\AVAST Software\Avast\ashShA64.dll [2018-01-02] (AVAST Software)
ContextMenuHandlers3: [FTShellContext] -> {AFF81F7B-6942-40c4-AADA-7214EF7B6DD1} => C:\Program Files (x86)\Bluetooth Suite\ShellContextExt.dll [2013-09-25] (Qualcomm®Atheros®)
ContextMenuHandlers4: [IZArcCM] -> {BC593DF5-466F-44EC-8FFD-C4DBC603B917} => C:\Program Files (x86)\IZArc\IZArcCM64.dll [2012-07-20] ()
ContextMenuHandlers4: [SnagItMainShellExt] -> {CF74B903-3389-469c-B3B6-0204D204FCBD} => C:\Program Files (x86)\TechSmith\Snagit 11\DLLx64\SnagitShellExt64.dll [2013-12-18] (TechSmith Corporation)
ContextMenuHandlers5: [igfxcui] -> {3AB1675A-CCFF-11D2-8B20-00A0C93CB1F4} => -> No File
ContextMenuHandlers5: [igfxDTCM] -> {9B5F5829-A529-4B12-814A-E81BCB8D93FC} => C:\Windows\system32\igfxDTCM.dll [2016-07-11] (Intel Corporation)
ContextMenuHandlers5: [igfxOSP] -> {FA507C3F-30C6-4DCA-9EE5-2656072EEC14} => C:\Windows\system32\igfxOSP.dll [2016-07-11] (Intel Corporation)
ContextMenuHandlers5: [NvCplDesktopContext] -> {3D1975AF-48C6-4f8e-A182-BE0E08FA86A9} => C:\Windows\system32\nvshext.dll [2014-09-13] (NVIDIA Corporation)
ContextMenuHandlers6: [avast] -> {472083B0-C522-11CF-8763-00608CC02F24} => C:\Program Files\AVAST Software\Avast\ashShA64.dll [2018-01-02] (AVAST Software)
ContextMenuHandlers6: [Glary Utilities] -> {B3C418F8-922B-4faf-915E-59BC14448CF7} => C:\Program Files (x86)\Glary Utilities 5\x64\ContextHandler.dll [2015-12-21] (Glarysoft Ltd)

==================== Scheduled Tasks (Whitelisted) =============

(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)

Task: {087030D4-DE3E-4B88-BD81-1213FD856046} - System32\Tasks\Dell SupportAssistAgent AutoUpdate => C:\Program Files\Dell\SupportAssistAgent\bin\SupportAssist.exe [2017-09-22] (Dell Inc.)
Task: {18700323-7C92-443E-A9B4-D9F91FF84970} - System32\Tasks\Microsoft_Hardware_Launch_ipoint_exe => c:\Program Files\Microsoft Mouse and Keyboard Center\ipoint.exe [2015-07-08] (Microsoft Corporation)
Task: {1EAC4932-3564-4DE1-AD39-43045C3CCB08} - System32\Tasks\Games\UpdateCheck_S-1-5-21-2249576302-3863294968-408106873-1001
Task: {3C43B4F2-8FEB-42AB-9A40-DA6D2D691AD9} - System32\Tasks\GoogleUpdateTaskMachineUA => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe [2016-01-09] (Google Inc.)
Task: {3DAB61F9-3ABF-4FA4-9CAE-9856BF091A5B} - System32\Tasks\Microsoft_Hardware_Launch_itype_exe => c:\Program Files\Microsoft Mouse and Keyboard Center\itype.exe [2015-07-08] (Microsoft Corporation)
Task: {43DE27BC-EBA8-4E82-B26E-E1DDF4DEEB63} - System32\Tasks\AVAST Software\Avast settings backup => C:\Program Files\Common Files\AV\avast! Antivirus\backup.exe
Task: {49E4DA52-EF44-4EF5-ADAD-3A0DA1ECDFF7} - System32\Tasks\TradeStation Backup - Monthly => C:\Program Files (x86)\TradeStation 9.5\Program\TSBackupRestore.exe [2017-08-03] (TradeStation Technologies, Inc.)
Task: {5B5AAF5D-2818-4710-9E6C-0543637947C0} - System32\Tasks\Adobe Acrobat Update Task => C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe [2017-09-27] (Adobe Systems Incorporated)
Task: {63DF7CE7-99EB-449B-B747-D7DE8308CE75} - System32\Tasks\Dell\Alienware Survey (Administrator) => C:\Program Files (x86)\Alienware Customer Surveys\AlienSurvey.exe [2013-04-23] (Alienware, Inc.)
Task: {659D0794-CEC1-4D86-BD2B-D20385386596} - System32\Tasks\Microsoft_Hardware_Launch_mousekeyboardcenter_exe => c:\Program Files\Microsoft Mouse and Keyboard Center\mousekeyboardcenter.exe [2015-07-08] (Microsoft)
Task: {67A6EB0F-1D86-4EBB-95C3-2131F38BF1DD} - System32\Tasks\GU5SkipUAC => C:\Program Files (x86)\Glary Utilities 5\Integrator.exe [2018-01-07] (Glarysoft Ltd)
Task: {73FE9BD3-4FCA-4C82-9AA6-51C2825147AD} - System32\Tasks\TechSmith Updater => C:\Program Files (x86)\Common Files\TechSmith Shared\Updater\TSCUpdClt.exe [2013-10-04] (TechSmith Corporation)
Task: {78543A36-B8B4-4CDB-B5F9-522EBDA096B1} - System32\Tasks\Microsoft_MKC_Logon_Task_itype.exe => c:\Program Files\Microsoft Mouse and Keyboard Center\itype.exe [2015-07-08] (Microsoft Corporation)
Task: {807798C1-F21C-4C30-A6FD-D46089097A6F} - System32\Tasks\GoogleUpdateTaskMachineCore => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe [2016-01-09] (Google Inc.)
Task: {977E2DD4-2993-43E1-AFEC-74A10F08EDCE} - System32\Tasks\CCleanerSkipUAC => C:\Program Files\CCleaner\CCleaner.exe [2014-07-23] (Piriform Ltd)
Task: {A30ED38C-C2E9-4A23-8758-CFC60AFB78E9} - System32\Tasks\Adobe Flash Player Updater => C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe [2018-01-09] (Adobe Systems Incorporated)
Task: {A99B3C8A-D51F-4223-A404-BE1B2110AF47} - System32\Tasks\PCDEventLauncherTask => C:\Program Files\Alienware\SupportAssist\sessionchecker.exe [2017-09-14] (PC-Doctor, Inc.)
Task: {B50257EA-A2E3-4E45-A2AA-8F7CDC2F55D5} - System32\Tasks\SafeZone scheduled Autoupdate 1458686145 => C:\Program Files\AVAST Software\SZBrowser\launcher.exe [2017-08-04] (Avast Software)
Task: {BEFE78E8-1694-4BF8-BC12-0544CAA486E7} - System32\Tasks\G2MUpdateTask-S-1-5-21-2249576302-3863294968-408106873-1001 => C:\Users\TerryF\AppData\Local\GoToMeeting\8126\g2mupdate.exe [2017-12-21] (LogMeIn, Inc.)
Task: {C10BF895-4BA4-41F4-A70D-88782FF959E3} - System32\Tasks\Microsoft_MKC_Logon_Task_ipoint.exe => c:\Program Files\Microsoft Mouse and Keyboard Center\ipoint.exe [2015-07-08] (Microsoft Corporation)
Task: {C337DBB4-83A5-4C83-844C-E7ED5C147FCD} - System32\Tasks\Avast Emergency Update => C:\Program Files\AVAST Software\Avast\AvEmUpdate.exe [2018-01-02] (AVAST Software)
Task: {D23B005B-67F2-4036-94C8-83CAB28A13B8} - System32\Tasks\G2MUploadTask-S-1-5-21-2249576302-3863294968-408106873-1001 => C:\Users\TerryF\AppData\Local\GoToMeeting\8126\g2mupload.exe [2017-12-21] (LogMeIn, Inc.)
Task: {D29CE2B5-9859-4675-95C7-D6518B2644F9} - System32\Tasks\Dell\Alienware Survey (TerryF) => C:\Program Files (x86)\Alienware Customer Surveys\AlienSurvey.exe [2013-04-23] (Alienware, Inc.)
Task: {DA8CFA27-7800-4EF6-AFE9-987DA9AB0C24} - System32\Tasks\Avast Software\Overseer => C:\Program Files\Common Files\avast software\overseer\overseer.exe [2018-01-08] (AVAST Software)
Task: {DEEA3C86-33B8-459D-A50D-B70FA60E4FA0} - System32\Tasks\TradeStation Backup - Weekly => C:\Program Files (x86)\TradeStation 9.5\Program\TSBackupRestore.exe [2017-08-03] (TradeStation Technologies, Inc.)
Task: {E3131052-9D99-47E0-9884-8F78560660E7} - System32\Tasks\PCDoctorBackgroundMonitorTask => C:\Program Files\Alienware\SupportAssist\uaclauncher.exe [2017-09-14] (PC-Doctor, Inc.)
Task: {E4B10902-79FE-41AB-902A-C1F4C0D1122D} - System32\Tasks\SystemToolsDailyTest => uaclauncher.exe
Task: {EC556780-F15F-4DC1-8D41-B69A0CABB40C} - System32\Tasks\GlaryInitialize 5 => C:\Program Files (x86)\Glary Utilities 5\Initialize.exe [2018-01-07] (Glarysoft Ltd)
Task: {F81BF9B4-6A42-4CDE-92B3-88866F927334} - System32\Tasks\PCDDataUploadTask => uaclauncher.exe

(If an entry is included in the fixlist, the task (.job) file will be moved. The file which is running by the task will not be moved.)

Task: C:\Windows\Tasks\G2MUpdateTask-S-1-5-21-2249576302-3863294968-408106873-1001.job => C:\Users\TerryF\AppData\Local\GoToMeeting\8126\g2mupdate.exe
Task: C:\Windows\Tasks\G2MUploadTask-S-1-5-21-2249576302-3863294968-408106873-1001.job => C:\Users\TerryF\AppData\Local\GoToMeeting\8126\g2mupload.exe
Task: C:\Windows\Tasks\TradeStation Backup - Monthly.job => C:\Program Files (x86)\TradeStation 9.5\Program\TSBackupRestore.exeM/Backup C:\Program Files (x86)\TradeStation 9.5\Templates\Backup\Monthly.tsb
Task: C:\Windows\Tasks\TradeStation Backup - Weekly.job => C:\Program Files (x86)\TradeStation 9.5\Program\TSBackupRestore.exeL/Backup C:\Program Files (x86)\TradeStation 9.5\Templates\Backup\Weekly.tsb

==================== Shortcuts & WMI ========================

(The entries could be listed to be restored or removed.)

==================== Loaded Modules (Whitelisted) ==============

2014-05-15 18:35 - 2014-09-13 17:48 - 000013120 _____ () C:\Program Files\NVIDIA Corporation\CoProcManager\detoured.dll
2014-05-15 18:35 - 2014-09-13 15:53 - 000116880 _____ () C:\Program Files\NVIDIA Corporation\Display\NvSmartMax64.dll
2018-01-02 07:18 - 2018-01-02 07:18 - 000067920 _____ () c:\Program Files\AVAST Software\Avast\x64\module_lifetime.dll
2018-01-02 07:18 - 2018-01-02 07:18 - 000067984 _____ () C:\Program Files\AVAST Software\Avast\x64\dll_loader.dll
2018-01-02 07:18 - 2018-01-02 07:18 - 000236840 _____ () c:\Program Files\AVAST Software\Avast\x64\vaarclient.dll
2018-01-02 07:18 - 2018-01-02 07:18 - 000902824 _____ () C:\Program Files\AVAST Software\Avast\x64\ffl2.dll
2018-01-02 07:18 - 2018-01-02 07:18 - 000349568 _____ () c:\Program Files\AVAST Software\Avast\x64\StreamBack.dll
2013-09-25 02:01 - 2013-09-25 02:01 - 000086016 _____ () C:\Program Files (x86)\Bluetooth Suite\Modules\Map\MAP.dll
1997-07-10 23:00 - 1997-07-10 23:00 - 000122880 _____ () C:\Program Files (x86)\Microsoft Office\Office97\Office\FINDFAST.EXE
1997-07-10 23:00 - 1997-07-10 23:00 - 000061440 _____ () C:\Program Files (x86)\Microsoft Office\Office97\Office\OSA.EXE
2013-11-15 16:17 - 2013-11-15 16:17 - 004593968 _____ () C:\Program Files (x86)\Alienware On-Screen Display\AlienwareOn-ScreenDisplay.exe
2014-05-15 18:39 - 2014-04-30 11:35 - 000486880 _____ () C:\Program Files (x86)\AlienRespawn\Components\Shell\DBRCrawler.exe
2018-01-02 07:18 - 2018-01-02 07:18 - 000058016 _____ () C:\Program Files\AVAST Software\Avast\module_lifetime.dll
2018-01-02 07:18 - 2018-01-02 07:18 - 000057504 _____ () C:\Program Files\AVAST Software\Avast\dll_loader.dll
2018-01-02 07:18 - 2018-01-02 07:18 - 000206152 _____ () C:\Program Files\AVAST Software\Avast\JsonRpcServer.dll
2018-01-02 07:18 - 2018-01-02 07:18 - 000289272 _____ () C:\Program Files\AVAST Software\Avast\tasks_core.dll
2018-01-02 07:18 - 2018-01-02 07:18 - 000196248 _____ () C:\Program Files\AVAST Software\Avast\network_notifications.dll
2018-01-09 07:12 - 2018-01-09 07:12 - 005768336 _____ () C:\Program Files\AVAST Software\Avast\defs\18010900\algo.dll
2018-01-02 07:18 - 2018-01-02 07:18 - 000745408 _____ () C:\Program Files\AVAST Software\Avast\ffl2.dll
2018-01-02 07:18 - 2018-01-02 07:18 - 000148936 _____ () C:\Program Files\AVAST Software\Avast\hns_tools.dll
2018-01-02 07:18 - 2018-01-02 07:18 - 000293944 _____ () C:\Program Files\AVAST Software\Avast\streamback.dll
2014-05-15 18:35 - 2014-09-13 17:48 - 000012104 _____ () C:\Program Files (x86)\NVIDIA Corporation\CoProcManager\detoured.dll
2017-07-03 06:45 - 2017-07-03 06:45 - 067109376 _____ () C:\Program Files\AVAST Software\Avast\libcef.dll
2018-01-02 07:18 - 2018-01-02 07:18 - 000282560 _____ () C:\Program Files\AVAST Software\Avast\gaming_mode_ui.dll
1998-05-31 23:00 - 1998-05-31 23:00 - 003792896 _____ () C:\Program Files (x86)\Microsoft Office\Office97\Office\MSO97.DLL
2014-06-03 15:07 - 2012-05-25 03:25 - 000921600 _____ () C:\Program Files (x86)\Yahoo!\Messenger\yui.dll
2009-12-18 10:07 - 2009-12-18 10:07 - 000577536 _____ () C:\Program Files (x86)\Alienware On-Screen Display\EMSC.dll
1997-07-10 23:00 - 1997-07-10 23:00 - 000036864 _____ () C:\Windows\SysWow64\docobj.dll
1997-07-10 23:00 - 1997-07-10 23:00 - 000032768 _____ () C:\Windows\SysWow64\hlinkprx.dll
2018-01-07 20:15 - 2018-01-07 20:15 - 000087024 _____ () C:\Program Files (x86)\Glary Utilities 5\zlib1.dll
2014-05-02 09:44 - 2013-12-17 18:47 - 001904928 _____ () C:\Program Files (x86)\AlienRespawn\Components\Restore\STRestoreAPI.dll
2014-05-15 18:39 - 2012-11-25 21:20 - 001153384 _____ () C:\Program Files (x86)\AlienRespawn\Components\Restore\libxml2.dll
2014-05-15 18:39 - 2012-11-25 21:20 - 000117608 _____ () C:\Program Files (x86)\AlienRespawn\Components\Restore\zlib1.dll

==================== Alternate Data Streams (Whitelisted) =========

(If an entry is included in the fixlist, only the ADS will be removed.)

==================== Safe Mode (Whitelisted) ===================

(If an entry is included in the fixlist, it will be removed from the registry. The "AlternateShell" will be restored.)

HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\atashost => ""="Service"
HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\GoToAssist => ""="Service"

==================== Association (Whitelisted) ===============

(If an entry is included in the fixlist, the registry item will be restored to default or removed.)

==================== Internet Explorer trusted/restricted ===============

(If an entry is included in the fixlist, it will be removed from the registry.)

IE trusted site: HKU\S-1-5-21-2249576302-3863294968-408106873-1001\…\cboe.com -> hxxp://www.cboe.com
IE trusted site: HKU\S-1-5-21-2249576302-3863294968-408106873-1001\…\dell.com -> dell.com
IE trusted site: HKU\S-1-5-21-2249576302-3863294968-408106873-1001\…\google.com -> hxxps://www.google.com
IE trusted site: HKU\S-1-5-21-2249576302-3863294968-408106873-1001\…\localhost -> localhost

==================== Hosts content: ===============================

(If needed Hosts: directive could be included in the fixlist to reset Hosts.)

2009-07-13 20:34 - 2009-06-10 15:00 - 000000824 _____ C:\Windows\system32\Drivers\etc\hosts

==================== Other Areas ============================

(Currently there is no automatic fix for this section.)

HKU\S-1-5-21-2249576302-3863294968-408106873-1001\Control Panel\Desktop\\Wallpaper -> C:\Users\TerryF\AppData\Roaming\Microsoft\Windows\Themes\TranscodedWallpaper.jpg
DNS Servers: 75.75.75.75 - 75.75.76.76
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System => (ConsentPromptBehaviorAdmin: 5) (ConsentPromptBehaviorUser: 3) (EnableLUA: 1)
Windows Firewall is enabled.

==================== MSCONFIG/TASK MANAGER disabled items ==

==================== FirewallRules (Whitelisted) ===============

(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)

FirewallRules: [{16B619B3-1DA4-4BF0-9CFC-3DD566705FC3}] => (Allow) C:\Program Files (x86)\NVIDIA Corporation\NetService\NvNetworkService.exe
FirewallRules: [{614850F8-D2F0-486A-A3CA-4F159CB4177E}] => (Allow) C:\Program Files (x86)\NVIDIA Corporation\NetService\NvNetworkService.exe
FirewallRules: [{ECE0888B-F09C-46ED-9A28-66DACC94AA83}] => (Allow) C:\Program Files\NVIDIA Corporation\NvStreamSrv\nvstreamsvc.exe
FirewallRules: [{BB7946F0-0838-415A-8678-7550CC424E1A}] => (Allow) C:\Program Files\NVIDIA Corporation\NvStreamSrv\nvstreamsvc.exe
FirewallRules: [{88394730-B36B-4FAD-8D3D-74259A3FBC50}] => (Allow) C:\Program Files\NVIDIA Corporation\NvStreamSrv\nvstreamer.exe
FirewallRules: [{BEB97F3B-C1A5-4951-9E34-C6A70B2A6240}] => (Allow) C:\Program Files\NVIDIA Corporation\NvStreamSrv\nvstreamer.exe
FirewallRules: [TCP Query User{DD959091-2AE8-429D-8ABB-21E9BC41E3AF}C:\program files (x86)\esignal\winros.exe] => (Allow) C:\program files (x86)\esignal\winros.exe
FirewallRules: [UDP Query User{F9F394FB-F637-4826-B9E6-CDF92FA770A1}C:\program files (x86)\esignal\winros.exe] => (Allow) C:\program files (x86)\esignal\winros.exe
FirewallRules: [{CD880C54-1777-467F-BA69-ADBBF3F3F069}] => (Allow) LPort=8298
FirewallRules: [{CCD4D379-5D12-4F04-9DDA-8E4DF3D151D5}] => (Allow) C:\Program Files (x86)\Ubisoft\Ubisoft Game Launcher\UbisoftGameLauncher.exe
FirewallRules: [{1DCC2531-6DBF-4DA9-9DB6-88948FBFA891}] => (Allow) C:\Program Files (x86)\Ubisoft\Ubisoft Game Launcher\UbisoftGameLauncher.exe
FirewallRules: [{7C95ABF5-0D71-4E15-8201-74835DAE10AC}] => (Allow) C:\Program Files (x86)\Ubisoft\Might & Magic Heroes VI\Might & Magic Heroes VI.exe
FirewallRules: [{DFB58980-CE10-406F-A4D6-FEDA45F9BB77}] => (Allow) C:\Program Files (x86)\Ubisoft\Might & Magic Heroes VI\Might & Magic Heroes VI.exe
FirewallRules: [{638A3B0F-EC22-4D30-9291-7723DF426013}] => (Allow) C:\Program Files (x86)\Yahoo!\Messenger\YahooMessenger.exe
FirewallRules: [{6DF8396C-66FD-41E2-8704-CB18F0090237}] => (Allow) C:\Program Files (x86)\Yahoo!\Messenger\YahooMessenger.exe
FirewallRules: [TCP Query User{95710FF6-0F86-48F0-B93F-C1519FDBCAFE}C:\program files (x86)\ubisoft\might & magic heroes vi\might & magic heroes vi.exe] => (Allow) C:\program files (x86)\ubisoft\might & magic heroes vi\might & magic heroes vi.exe
FirewallRules: [UDP Query User{02CBEE5C-63FF-484A-9031-1290F6121BEA}C:\program files (x86)\ubisoft\might & magic heroes vi\might & magic heroes vi.exe] => (Allow) C:\program files (x86)\ubisoft\might & magic heroes vi\might & magic heroes vi.exe
FirewallRules: [TCP Query User{306C23CE-FE1D-4F10-84C0-7C0F754FDB9C}C:\program files (x86)\esignal\winros.exe] => (Allow) C:\program files (x86)\esignal\winros.exe
FirewallRules: [UDP Query User{5EA4340E-7B3A-4925-9C31-C9CEE85E2B7E}C:\program files (x86)\esignal\winros.exe] => (Allow) C:\program files (x86)\esignal\winros.exe
FirewallRules: [{0D9B8E46-8C08-402D-8FA0-3FCCBEC90359}] => (Allow) C:\Program Files (x86)\Mozilla Firefox\firefox.exe
FirewallRules: [{623C4FA0-83FF-4401-BFBA-19C594407822}] => (Allow) C:\Program Files (x86)\Mozilla Firefox\firefox.exe
FirewallRules: [{715B670C-902C-4D97-AC51-D638411D3BFE}] => (Allow) C:\Program Files\AVAST Software\SZBrowser\4.58.2552.909\SZBrowser.exe
FirewallRules: [{18DF2E36-F965-42EB-ACD0-A9510B417BDB}] => (Allow) C:\Program Files\AVAST Software\SZBrowser\4.58.2552.909_0\SZBrowser.exe

==================== Restore Points =========================

30-12-2017 13:45:08 Scheduled Checkpoint
02-01-2018 07:24:24 Removed Microsoft Office
08-01-2018 21:42:09 Windows Update

==================== Faulty Device Manager Devices =============

Name: Ethernet Controller
Description: Ethernet Controller
Class Guid:
Manufacturer:
Service:
Problem: : The drivers for this device are not installed. (Code 28)
Resolution: To install the drivers for this device, click "Update Driver", which starts the Hardware Update wizard.

==================== Event log errors: =========================

Application errors:
==================
Error: (01/09/2018 10:02:39 AM) (Source: WinMgmt) (EventID: 10) (User: )
Description: Event filter with query "SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 99" could not be reactivated in namespace "//./root/CIMV2" because of error 0x80041003. Events cannot be delivered through this filter until the problem is corrected.

Error: (01/09/2018 10:00:38 AM) (Source: Application Hang) (EventID: 1002) (User: )
Description: The program adwcleaner_7.0.6.0.exe version 7.0.6.0 stopped interacting with Windows and was closed. To see if more information about the problem is available, check the problem history in the Action Center control panel.

Process ID: 2704

Start Time: 01d3895e117b6a1d

Termination Time: 0

Application Path: C:\Users\TerryF\Downloads\adwcleaner_7.0.6.0.exe

Report Id: 39cf30bf-f556-11e7-9d85-c03896603694

Error: (01/09/2018 08:13:03 AM) (Source: Application Error) (EventID: 1000) (User: )
Description: Faulting application name: IEXPLORE.EXE, version: 11.0.9600.18894, time stamp: 0x5a467703
Faulting module name: KERNELBASE.dll, version: 6.1.7601.24000, time stamp: 0x5a4996d4
Exception code: 0x80004005
Fault offset: 0x0000c54f
Faulting process id: 0x250c
Faulting application start time: 0x01d389516be39c5d
Faulting application path: C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
Faulting module path: C:\Windows\syswow64\KERNELBASE.dll
Report Id: 343dc48e-f547-11e7-9d85-c03896603694

Error: (01/09/2018 07:34:04 AM) (Source: Application Error) (EventID: 1000) (User: )
Description: Faulting application name: DDVDataCollector.exe, version: 5.2.3.62, time stamp: 0x597a184e
Faulting module name: RPCRT4.dll, version: 6.1.7601.24000, time stamp: 0x5a499a7d
Exception code: 0xc0000005
Fault offset: 0x0000000000035926
Faulting process id: 0x2204
Faulting application start time: 0x01d3894ba4ec64d6
Faulting application path: C:\Program Files\Dell\DellDataVault\DDVDataCollector.exe
Faulting module path: C:\Windows\system32\RPCRT4.dll
Report Id: c1c063fa-f541-11e7-9d85-c03896603694

Error: (01/09/2018 07:11:11 AM) (Source: WinMgmt) (EventID: 10) (User: )
Description: Event filter with query "SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 99" could not be reactivated in namespace "//./root/CIMV2" because of error 0x80041003. Events cannot be delivered through this filter until the problem is corrected.

Error: (01/08/2018 09:45:58 PM) (Source: WinMgmt) (EventID: 10) (User: )
Description: Event filter with query "SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 99" could not be reactivated in namespace "//./root/CIMV2" because of error 0x80041003. Events cannot be delivered through this filter until the problem is corrected.

Error: (01/08/2018 07:24:19 AM) (Source: WinMgmt) (EventID: 10) (User: )
Description: Event filter with query "SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 99" could not be reactivated in namespace "//./root/CIMV2" because of error 0x80041003. Events cannot be delivered through this filter until the problem is corrected.

Error: (01/06/2018 08:01:26 AM) (Source: Application Error) (EventID: 1000) (User: )
Description: Faulting application name: DDVDataCollector.exe, version: 5.2.3.62, time stamp: 0x597a184e
Faulting module name: ntdll.dll, version: 6.1.7601.23915, time stamp: 0x59b94ee4
Exception code: 0xc0000374
Fault offset: 0x00000000000bf3e2
Faulting process id: 0x1510
Faulting application start time: 0x01d386f421793733
Faulting application path: C:\Program Files\Dell\DellDataVault\DDVDataCollector.exe
Faulting module path: C:\Windows\SYSTEM32\ntdll.dll
Report Id: 15510a90-f2ea-11e7-9650-c03896603694

Error: (01/06/2018 07:39:50 AM) (Source: WinMgmt) (EventID: 10) (User: )
Description: Event filter with query "SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 99" could not be reactivated in namespace "//./root/CIMV2" because of error 0x80041003. Events cannot be delivered through this filter until the problem is corrected.

Error: (01/05/2018 06:35:05 AM) (Source: WinMgmt) (EventID: 10) (User: )
Description: Event filter with query "SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 99" could not be reactivated in namespace "//./root/CIMV2" because of error 0x80041003. Events cannot be delivered through this filter until the problem is corrected.

System errors:
=============
Error: (01/09/2018 10:02:40 AM) (Source: Microsoft-Windows-WHEA-Logger) (EventID: 18) (User: NT AUTHORITY)
Description: A fatal hardware error has occurred.

Reported by component: Processor Core
Error Source: 3
Error Type: 9
Processor ID: 0

The details view of this entry contains further information.

Error: (01/09/2018 10:02:40 AM) (Source: Microsoft-Windows-WHEA-Logger) (EventID: 18) (User: NT AUTHORITY)
Description: A fatal hardware error has occurred.

Reported by component: Processor Core
Error Source: 3
Error Type: 9
Processor ID: 0

The details view of this entry contains further information.

Error: (01/09/2018 10:02:39 AM) (Source: Service Control Manager) (EventID: 7000) (User: )
Description: The VBoxAsw Support Driver service failed to start due to the following error:
The system cannot find the path specified.

Error: (01/09/2018 10:01:52 AM) (Source: Schannel) (EventID: 4119) (User: NT AUTHORITY)
Description: The following fatal alert was received: 70.

Error: (01/09/2018 10:01:51 AM) (Source: Service Control Manager) (EventID: 7031) (User: )
Description: The Windows Media Player Network Sharing Service service terminated unexpectedly. It has done this 2 time(s). The following corrective action will be taken in 30000 milliseconds: Restart the service.

Error: (01/09/2018 10:01:51 AM) (Source: Service Control Manager) (EventID: 7031) (User: )
Description: The IconMan_R service terminated unexpectedly. It has done this 2 time(s). The following corrective action will be taken in 60000 milliseconds: Restart the service.

Error: (01/09/2018 10:01:51 AM) (Source: Service Control Manager) (EventID: 7034) (User: )
Description: The Windows Presentation Foundation Font Cache 3.0.0.0 service terminated unexpectedly. It has done this 2 time(s).

Error: (01/09/2018 10:01:51 AM) (Source: Service Control Manager) (EventID: 7031) (User: )
Description: The Intel(R) Capability Licensing Service Interface service terminated unexpectedly. It has done this 1 time(s). The following corrective action will be taken in 0 milliseconds: Restart the service.

Error: (01/09/2018 10:01:40 AM) (Source: Schannel) (EventID: 4119) (User: NT AUTHORITY)
Description: The following fatal alert was received: 70.

CodeIntegrity:
===================================
Date: 2016-08-22 05:49:59.008
Description: Code Integrity is unable to verify the image integrity of the file \Device\HarddiskVolume3\Program Files\NVIDIA Corporation\NvStreamSrv\NvStreamKms.sys because the set of per-page image hashes could not be found on the system.

Date: 2016-08-22 05:49:35.682
Description: Code Integrity is unable to verify the image integrity of the file \Device\HarddiskVolume3\Windows\System32\drivers\aswKbd.sys because the set of per-page image hashes could not be found on the system.

Date: 2016-08-22 05:49:35.635
Description: Code Integrity is unable to verify the image integrity of the file \Device\HarddiskVolume3\Windows\System32\drivers\aswSnx.sys because the set of per-page image hashes could not be found on the system.

Date: 2016-08-20 16:21:16.406
Description: Code Integrity is unable to verify the image integrity of the file \Device\HarddiskVolume3\Program Files\NVIDIA Corporation\NvStreamSrv\NvStreamKms.sys because the set of per-page image hashes could not be found on the system.

Date: 2016-08-20 16:20:37.479
Description: Code Integrity is unable to verify the image integrity of the file \Device\HarddiskVolume3\Windows\System32\drivers\aswKbd.sys because the set of per-page image hashes could not be found on the system.

Date: 2016-08-20 16:20:37.370
Description: Code Integrity is unable to verify the image integrity of the file \Device\HarddiskVolume3\Windows\System32\drivers\aswSnx.sys because the set of per-page image hashes could not be found on the system.

Date: 2016-08-19 19:11:39.212
Description: Code Integrity is unable to verify the image integrity of the file \Device\HarddiskVolume3\Windows\System32\drivers\aswKbd.sys because the set of per-page image hashes could not be found on the system.

Date: 2016-08-19 19:11:39.134
Description: Code Integrity is unable to verify the image integrity of the file \Device\HarddiskVolume3\Windows\System32\drivers\aswSnx.sys because the set of per-page image hashes could not be found on the system.

Date: 2016-08-19 06:52:36.448
Description: Code Integrity is unable to verify the image integrity of the file \Device\HarddiskVolume3\Program Files\NVIDIA Corporation\NvStreamSrv\NvStreamKms.sys because the set of per-page image hashes could not be found on the system.

Date: 2016-08-19 06:51:57.524
Description: Code Integrity is unable to verify the image integrity of the file \Device\HarddiskVolume3\Windows\System32\drivers\aswKbd.sys because the set of per-page image hashes could not be found on the system.

==================== Memory info ===========================

Processor: Intel(R) Core(TM) i7-4710MQ CPU @ 2.50GHz
Percentage of memory in use: 48%
Total physical RAM: 8077.06 MB
Available physical RAM: 4191.29 MB
Total Virtual: 16152.29 MB
Available Virtual: 11583.64 MB

==================== Drives ================================

Drive c: (OS) (Fixed) (Total:921.27 GB) (Free:706.75 GB) NTFS
Drive d: (DATAPART1) (Fixed) (Total:10.53 GB) (Free:10.43 GB) NTFS
Drive y: (RECOVERY) (Fixed) (Total:10.2 GB) (Free:2.14 GB) NTFS ==>[system with boot components (obtained from drive)]

==================== MBR & Partition Table ==================

========================================================
Disk: 0 (MBR Code: Windows 7 or Vista) (Size: 931.5 GB) (Disk ID: E4B4B8E8)
Partition 1: (Not Active) - (Size=39 MB) - (Type=DE)
Partition 2: (Active) - (Size=10.2 GB) - (Type=07 NTFS)
Partition 3: (Not Active) - (Size=921.3 GB) - (Type=07 NTFS)

========================================================
Disk: 1 (MBR Code: Windows 7 or 8) (Size: 10.5 GB) (Disk ID: E4B487C8)
Partition 1: (Not Active) - (Size=10.5 GB) - (Type=07 NTFS)

==================== End of Addition.txt ============================

Satchfan

Post #8January 9, 2018, 4:35 PM UTC

Thanks for the logs.

I have to pop out fr a while now but will check them and reply as soon as I can.

Satchfan

Post #9January 9, 2018, 10:24 PM UTC

Can you tell me why some of the entries in the original Adware entries were not included in the ‘clean’ process.

You need to move Farbar Recovery Scan Tool to your desktop otherwise fixes will not work.

go to your Downloads folder and locate Farbar Recovery Scan Tool
right click and select Cut
go to an empty spot on your desktop, right click and select Paste

Farbar Recovery Scan Tool should now be on your desktop.

================================================

Run Farbar Recovery Scan Tool

right-click FRST/FRST64 and select ‘Run as administrator’
highlight the contents of the code box below, then press Ctrl+c):

Start::
CloseProcesses:
AutoConfigURL: [S-1-5-21-2249576302-3863294968-408106873-1001] => hxxp://access-quick.com/wpad.dat?e924402e70027ab7006c8bc7e654272a36290340
ManualProxies: 0hxxp://access-quick.com/wpad.dat?e924402e70027ab7006c8bc7e654272a36290340
SearchScopes: HKU\S-1-5-21-2249576302-3863294968-408106873-1001 -> {7000C63E-9CED-4D8F-8F70-54C5CB8AD6E0} URL =
Toolbar: HKLM - avast! WebRep - {318A227B-5E9F-45bd-8999-7F8F10CA4CF5} -  No File
FF ExtraCheck: C:\Program Files (x86)\mozilla firefox\defaults\pref\5497506.js [2017-10-24] <==== ATTENTION (Points to *.cfg file)
FF ExtraCheck: C:\Program Files (x86)\mozilla firefox\5497506.cfg [2017-10-24] <==== ATTENTION
S3 AvastVBoxSvc; "C:\Program Files\AVAST Software\Avast\ng\vbox\AvastVBoxSVC.exe" [X]
S2 VBoxAswDrv; \??\C:\Program Files\AVAST Software\Avast\ng\vbox\VBoxAswDrv.sys [X]
Hosts:
EmptyTemp:
End::

NOTE: This script was written specifically for this user, for use on that particular machine. Running this on another machine may cause damage to your operating system

in the FRST window, press the ‘Fix’ button once and wait
please reboot the computer if requested
it will create a log on your desktop, (Fixlog.txt); please post it to your reply.

================================================

Run Malwarebytes Anti-Malware

Please download Malwarebytes Anti-Malware to your desktop.

double-click mbam-setup- mb3-setup-consumer-3.0.4.exe and follow the prompts to install the program
at the end, be sure a checkmark is placed next to the following
- Launch Malwarebytes Anti-Malware
- a 14 day trial of the Premium features is pre-selected: deselect this if you don’t want it, (it won’t diminish the scanning and removal capabilities of the program).
click Finish.
on the Dashboard, click Update Now
after the update completes, click the Scan Now' button.
if an update is available, clicking the Update Now button will update it
a Threat Scan will begin.
when the scan is complete, if malware has been detected, click Apply Actions to allow MBAM to clean what was found
when the prompt to restart the computer appears, click Yes.
after the restart once you are back at your desktop, open MBAM once more
click on the “History” tab, the “Application Logs”
double-click on the scan log which shows the date and time of the scan just performed.
click Copy to Clipboard
please paste the contents of the clipboard into your reply.

Can you tell me if there are any outstanding problems.

Satchfan

Logs to include with next post:

Fixlog.txt
Mbam.txt

Thanks

Satchfan

terryfelter

Post #10January 9, 2018, 11:52 PM UTC last edited January 9, 2018, 11:54 PM UTC

Fix result of Farbar Recovery Scan Tool (x64) Version: 02.01.2018
Ran by [removed] (09-01-2018 17:34:11) Run:1
Running from C:\Users\[removed]\Desktop
[removed] Boot Mode: Normal
==============================================

fixlist content:
*****************
CloseProcesses:
AutoConfigURL: [S-1-5-21-2249576302-3863294968-408106873-1001] => hxxp://access-quick.com/wpad.dat?e924402e70027ab7006c8bc7e654272a36290340
ManualProxies: 0hxxp://access-quick.com/wpad.dat?e924402e70027ab7006c8bc7e654272a36290340
SearchScopes: HKU\S-1-5-21-2249576302-3863294968-408106873-1001 -> {7000C63E-9CED-4D8F-8F70-54C5CB8AD6E0} URL =
Toolbar: HKLM - avast! WebRep - {318A227B-5E9F-45bd-8999-7F8F10CA4CF5} - No File
FF ExtraCheck: C:\Program Files (x86)\mozilla firefox\defaults\pref\5497506.js [2017-10-24] <==== ATTENTION (Points to *.cfg file)
FF ExtraCheck: C:\Program Files (x86)\mozilla firefox\5497506.cfg [2017-10-24] <==== ATTENTION
S3 AvastVBoxSvc; "C:\Program Files\AVAST Software\Avast\ng\vbox\AvastVBoxSVC.exe" [X]
S2 VBoxAswDrv; \??\C:\Program Files\AVAST Software\Avast\ng\vbox\VBoxAswDrv.sys [X]
Hosts:
EmptyTemp:

*****************

Processes closed successfully.
"HKU\S-1-5-21-2249576302-3863294968-408106873-1001\Software\Microsoft\Windows\CurrentVersion\Internet Settings\\AutoConfigURL" => removed successfully
"HKLM\SYSTEM\CurrentControlSet\services\NlaSvc\Parameters\Internet\ManualProxies\\" => removed successfully
"HKU\S-1-5-21-2249576302-3863294968-408106873-1001\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{7000C63E-9CED-4D8F-8F70-54C5CB8AD6E0}" => removed successfully
HKLM\Software\Classes\CLSID\{7000C63E-9CED-4D8F-8F70-54C5CB8AD6E0} => key not found
"HKLM\SOFTWARE\Microsoft\Internet Explorer\Toolbar\\{318A227B-5E9F-45bd-8999-7F8F10CA4CF5}" => removed successfully
"HKLM\Software\Classes\CLSID\{318A227B-5E9F-45bd-8999-7F8F10CA4CF5}" => removed successfully
C:\Program Files (x86)\mozilla firefox\defaults\pref\5497506.js => moved successfully
C:\Program Files (x86)\mozilla firefox\5497506.cfg => moved successfully
HKLM\System\CurrentControlSet\Services\AvastVBoxSvc => key could not remove, key could be protected
HKLM\System\CurrentControlSet\Services\VBoxAswDrv => key could not remove, key could be protected
C:\Windows\System32\Drivers\etc\hosts => moved successfully
Hosts restored successfully.

=========== EmptyTemp: ==========

BITS transfer queue => 8388608 B
DOMStore, IE Recovery, AppCache, Feeds Cache, Thumbcache, IconCache => 69678729 B
Java, Flash, Steam htmlcache => 1528 B
Windows/system/drivers => 10805141 B
Edge => 0 B
Chrome => 0 B
Firefox => 22516627 B
Opera => 0 B

Temp, IE cache, history, cookies, recent:
Users => 0 B
Default => 0 B
Public => 0 B
ProgramData => 0 B
systemprofile => 16802 B
systemprofile32 => 66660 B
LocalService => 0 B
NetworkService => 0 B
TerryF => 473849019 B
Administrator => 2214943 B

RecycleBin => 1667656615 B
EmptyTemp: => 2.1 GB temporary data Removed.

================================

Result of scheduled files to move (Boot Mode: Normal) (Date&Time: 09-01-2018 17:36:01)

Result of scheduled keys to remove after reboot:

HKLM\System\CurrentControlSet\Services\AvastVBoxSvc => key could not remove, key could be protected
HKLM\System\CurrentControlSet\Services\VBoxAswDrv => key could not remove, key could be protected

==== End of Fixlog 17:36:01 ====

There is no Apply Actions to click on Malware

Satchfan

Post #11January 10, 2018, 9:00 AM UTC

There is no Apply Actions to click on Malware

These programmes change as they are frequently updated.

If malware was found when you ran the scan, was there an option to "Remove selected"? If so, please run it again and do that.

terryfelter

Post #12January 10, 2018, 1:42 PM UTC

They were Quarantined:

Malwarebytes
www.malwarebytes.com

-Log Details-
Scan Date: 1/10/18
Scan Time: 7:32 AM
Log File: c511d835-f60a-11e7-8ca5-c03896603694.json
Administrator: Yes

-Software Information-
Version: 3.3.1.2183
Components Version: 1.0.262
Update Package Version: 1.0.3667
License: Trial

-System Information-
OS: Windows 7 Service Pack 1
CPU: x64
File System: NTFS
User: TerryF-PC\TerryF

-Scan Summary-
Scan Type: Threat Scan
Result: Completed
Objects Scanned: 282261
Threats Detected: 24
Threats Quarantined: 24
Time Elapsed: 2 min, 12 sec

-Scan Options-
Memory: Enabled
Startup: Enabled
Filesystem: Enabled
Archives: Enabled
Rootkits: Disabled
Heuristics: Enabled
PUP: Detect
PUM: Detect

-Scan Details-
Process: 0
(No malicious items detected)

Module: 0
(No malicious items detected)

Registry Key: 3
PUP.Optional.Conduit, HKU\S-1-5-21-2249576302-3863294968-408106873-1001\SOFTWARE\MICROSOFT\INTERNET EXPLORER\SEARCHSCOPES\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}, Quarantined, [535], [236865],1.0.3667
PUP.Optional.ConsumerInput, HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\WINDOWS\CURRENTVERSION\APP PATHS\SOFTWARE SERVICE, Quarantined, [169], [253739],1.0.3667
PUP.Optional.ConsumerInput, HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\APP PATHS\SOFTWARE SERVICE, Quarantined, [169], [253739],1.0.3667

Registry Value: 3
PUP.Optional.Conduit, HKU\S-1-5-21-2249576302-3863294968-408106873-1001\SOFTWARE\MICROSOFT\INTERNET EXPLORER\SEARCHSCOPES\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}|URL, Quarantined, [535], [236865],1.0.3667
PUP.Optional.ConsumerInput, HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\WINDOWS\CURRENTVERSION\APP PATHS\SOFTWARE SERVICE|, Quarantined, [169], [253739],1.0.3667
PUP.Optional.ConsumerInput, HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\APP PATHS\SOFTWARE SERVICE|, Quarantined, [169], [253739],1.0.3667

Registry Data: 0
(No malicious items detected)

Data Stream: 0
(No malicious items detected)

Folder: 1
PUP.Optional.ConsumerInput, C:\PROGRAM FILES (X86)\Setup Support for Consumer Input, Quarantined, [169], [181902],1.0.3667

File: 17
PUP.Optional.ConsumerInput, C:\compete-header-long2.bmp, Quarantined, [169], [464144],1.0.3667
PUP.Optional.ConsumerInput, C:\Program Files (x86)\Setup Support for Consumer Input\uninst.exe, Quarantined, [169], [181902],1.0.3667
Trojan.MalPack, C:\USERS\TERRYF\DOCUMENTS\DOWNLOADS\MMH_+6_TRAINER.RAR, Quarantined, [34], [83800],1.0.3667
PUP.Optional.PCCleaners, C:\USERS\TERRYF\DOCUMENTS\DOWNLOADS\PC_CLEANER_PRO_INSTALLER_APP3.EXE, Quarantined, [6013], [72561],1.0.3667
PUP.Optional.IBryte, C:\USERS\TERRYF\DOCUMENTS\DOWNLOADS\HEROES_OF_MIGHT_AND_MAGIC_III_COMPLETE.EXE, Quarantined, [3160], [8225],1.0.3667
PUP.Optional.GameHack, C:\PROGRAM FILES (X86)\CHEAT ENGINE 6.4\STANDALONEPHASE1.DAT, Quarantined, [661], [393793],1.0.3667
Adware.Solimba, C:\USERS\TERRYF\DOCUMENTS\DOWNLOADS\SNES9X.EXE, Quarantined, [4029], [378334],1.0.3667
PUP.Optional.GameHack, C:\PROGRAM FILES (X86)\CHEAT ENGINE 6.3\STANDALONEPHASE1.DAT, Quarantined, [661], [393793],1.0.3667
PUP.Optional.GameHack, C:\PROGRAM FILES (X86)\CHEAT ENGINE 6.5\STANDALONEPHASE1.DAT, Quarantined, [661], [393793],1.0.3667
PUP.Optional.OpenCandy, C:\USERS\TERRYF\DOWNLOADS\CHEATENGINE66.EXE, Quarantined, [485], [101648],1.0.3667
PUP.Optional.BundleInstaller, C:\USERS\TERRYF\DOWNLOADS\GLARY UTILITIES SETUP (1).EXE, Quarantined, [19], [299070],1.0.3667
PUP.Optional.InstallIQ, C:\USERS\TERRYF\DOCUMENTS\DOWNLOADS\INSTACODECS.EXE, Quarantined, [2950], [76847],1.0.3667
PUP.Optional.OpenCandy, C:\USERS\TERRYF\DOWNLOADS\CHEATENGINE65.EXE, Quarantined, [485], [101648],1.0.3667
PUP.Optional.OpenCandy, C:\USERS\TERRYF\DOWNLOADS\CHEATENGINE64.EXE, Quarantined, [485], [70383],1.0.3667
PUP.Optional.OpenCandy, C:\USERS\TERRYF\DOWNLOADS\MOTIONINJOY-0-7-1001-40897-EN-SETUP.EXE, Quarantined, [485], [297667],1.0.3667
PUP.Optional.DownloadAssistant, C:\USERS\TERRYF\DOWNLOADS\CHEAT ENGINE SETUP.EXE, Quarantined, [655], [104822],1.0.3667
PUP.Optional.WirelessNetworkTool, C:\USERS\TERRYF\DOWNLOADS\WIRELESSNETVIEW_SETUP.EXE, Quarantined, [14598], [299476],1.0.3667

Physical Sector: 0
(No malicious items detected)

(end)

Satchfan

Post #13January 10, 2018, 3:14 PM UTC

That got rid of a lot but we'll run another scan to see if there is anything the previous scans missed.

Run Zemana AntiMalware

Download Zemana AntiMalware:

open the program and without changing any options, press Scan
after the scan is finished, if threats are detected press Next to remove them

Note: If restart is required to finish the cleaning process, you should click Reboot. If reboot isn't required, please restart your computer manually.

open Zemana AntiMalware again and locate the report
please paste the contents into your reply.

Can you tell me how the computer is now.

Satchfan

terryfelter

Post #14January 10, 2018, 4:03 PM UTC

I don't see where to print a report but this was quarantined:

Adware:Win32/BuildHeur.3f36db!Ep From Glary Utilities setup.exe.

I haven't had a pop-up this morning, so possibly all that was accomplished yesterday did the trick, Thanks

Satchfan

Post #15January 10, 2018, 5:30 PM UTC

Glary Utilities has some half-decent uses but not something that is needed to run all the time. Any Registry Cleaning should be totally avoided.

Registry cleaners are extremely powerful applications that can damage the registry by using aggressive cleaning routines and cause your computer to become unbootable.

Personally, I don't use a program like that but it’s your choice. I would still still recommend disabling the task that runs it all the time. You can still run it if and when you want to.

If you need help disabling the task let me know.

I think it’s best to leave this open for 24 hours to be sure that everything is still OK after which, if all is well, I’ll send instructions to tidy up.

Satchfan

Ask AI

AI can make mistakes. Check the cited posts. Archived advice can be out-of-date

Don't include personal information. Questions and selected public posts go to OpenAI. About Ask AI

JS:Agent-EDB infection [Solved]

✨ Ask AI

Ask AI