Spyware / Malware / Virus Removal

JS:Agent-EDB infection [Solved]

20 min read

Looking for the outcome? Ask AI

terryfelter

Post #16January 10, 2018, 6:36 PM UTC

Yes, let me know how to disable it.

Satchfan

Post #17January 10, 2018, 10:23 PM UTC

Run Farbar Recovery Scan Tool

right-click FRST/FRST64 and select ‘Run as administrator’
highlight the contents of the code box below, then press Ctrl+c):

Start::
CloseProcesses:
HKU\S-1-5-21-2249576302-3863294968-408106873-1001\…\Run: [GUDelayStartup] => C:\Program Files (x86)\Glary Utilities 5\StartupManager.exe [44016 2018-01-07] (Glarysoft Ltd)
R1 GUBootStartup; C:\Windows\System32\drivers\GUBootStartup.sys [20160 2015-04-29] (Glarysoft Ltd)
Task: {67A6EB0F-1D86-4EBB-95C3-2131F38BF1DD} - System32\Tasks\GU5SkipUAC => C:\Program Files (x86)\Glary Utilities 5\Integrator.exe [2018-01-07] (Glarysoft Ltd)
Task: {EC556780-F15F-4DC1-8D41-B69A0CABB40C} - System32\Tasks\GlaryInitialize 5 => C:\Program Files (x86)\Glary Utilities 5\Initialize.exe [2018-01-07] (Glarysoft Ltd)
EmptyTemp:
End::

NOTE: This script was written specifically for this user, for use on that particular machine. Running this on another machine may cause damage to your operating system

in the FRST window, press the ‘Fix’ button once and wait
please reboot the computer if requested
it will create a log on your desktop, (Fixlog.txt); please post it to your reply.

================================================

Run Security Analysis

Download Security Analysis by Rocket Grannie from here

save it to your Desktop
close your security software to avoid potential conflicts
double-click RGSA.exe
click OK on the copyright-disclaimer
when finished, a Notepad window will open with the results of the scan
the log named SALog.txt can also be found on the Desktop or, in the same folder from where the tool is run if installed elsewhere
please copy and paste the contents of that log in the next post.

Note: If you get a Warning from Windows about running the program, click on More info and then click Run Anyway to run it even though Windows says it might put your PC at risk.

Logs to include with the next post:

New Fixlog.txt
SALog.txt

Satchfan

terryfelter

Post #18January 10, 2018, 11:12 PM UTC

Fix result of Farbar Recovery Scan Tool (x64) Version: 02.01.2018
Ran by [removed] (10-01-2018 17:05:43) Run:2
Running from C:\Users\[removed]\Desktop
[removed] Boot Mode: Normal
==============================================

fixlist content:
*****************
CloseProcesses:
HKU\S-1-5-21-2249576302-3863294968-408106873-1001\…\Run: [GUDelayStartup] => C:\Program Files (x86)\Glary Utilities 5\StartupManager.exe [44016 2018-01-07] (Glarysoft Ltd)
R1 GUBootStartup; C:\Windows\System32\drivers\GUBootStartup.sys [20160 2015-04-29] (Glarysoft Ltd)
Task: {67A6EB0F-1D86-4EBB-95C3-2131F38BF1DD} - System32\Tasks\GU5SkipUAC => C:\Program Files (x86)\Glary Utilities 5\Integrator.exe [2018-01-07] (Glarysoft Ltd)
Task: {EC556780-F15F-4DC1-8D41-B69A0CABB40C} - System32\Tasks\GlaryInitialize 5 => C:\Program Files (x86)\Glary Utilities 5\Initialize.exe [2018-01-07] (Glarysoft Ltd)
EmptyTemp:

*****************

Processes closed successfully.
"HKU\S-1-5-21-2249576302-3863294968-408106873-1001\Software\Microsoft\Windows\CurrentVersion\Run\\GUDelayStartup" => removed successfully
GUBootStartup => Service stopped successfully.
"HKLM\System\CurrentControlSet\Services\GUBootStartup" => removed successfully
GUBootStartup => service removed successfully
HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Plain\{67A6EB0F-1D86-4EBB-95C3-2131F38BF1DD} => could not remove key. ErrorCode1: 0x00000002
"HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\{67A6EB0F-1D86-4EBB-95C3-2131F38BF1DD}" => removed successfully
C:\Windows\System32\Tasks\GU5SkipUAC => moved successfully
"HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tree\GU5SkipUAC" => removed successfully
"HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Logon\{EC556780-F15F-4DC1-8D41-B69A0CABB40C}" => removed successfully
"HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\{EC556780-F15F-4DC1-8D41-B69A0CABB40C}" => removed successfully
C:\Windows\System32\Tasks\GlaryInitialize 5 => moved successfully
"HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tree\GlaryInitialize 5" => removed successfully

=========== EmptyTemp: ==========

BITS transfer queue => 8388608 B
DOMStore, IE Recovery, AppCache, Feeds Cache, Thumbcache, IconCache => 31069726 B
Java, Flash, Steam htmlcache => 1066 B
Windows/system/drivers => 20648179 B
Edge => 0 B
Chrome => 0 B
Firefox => 0 B
Opera => 0 B

Temp, IE cache, history, cookies, recent:
Users => 0 B
Default => 0 B
Public => 0 B
ProgramData => 0 B
systemprofile => 128 B
systemprofile32 => 0 B
LocalService => 0 B
NetworkService => 0 B
TerryF => 274040792 B
Administrator => 0 B

RecycleBin => 0 B
EmptyTemp: => 318.7 MB temporary data Removed.

================================

The system needed a reboot.

==== End of Fixlog 17:05:53 ====

ï»¿Result of Security Analysis by Rocket Grannie (x86) Updated: 29th December, 2017
Running from:C:\Users\TerryF\Downloads (17:10:55 - 01/10/2018)
***———————————————————***
Microsoft Windows 7 Home Premium X64 Service Pack 1
UAC is Enabled
Internet Explorer 11
Default Browser: Internet Explorer
***————Antivirus - Antispyware - Firewall———–***
Avast Antivirus (Enabled - up to Date)
Malwarebytes (Enabled - up to Date)
Malwarebytes (Enabled - up to Date)
Windows Defender (Disabled - up to Date)
Avast Antivirus (Enabled - up to Date)
Windows Firewall (Enabled)
No other Firewall Installed
***——-Security Programs - Browsers - Miscellaneous——***
Adobe Flash Player NPAPI is not installed
CCleaner (4.16) ==> is out of Date
Malwarebytes (3.3.1.2183)
Mozilla Firefox (56.0) ==> is out of Date

***—————-Analysis Complete————————-***

Satchfan

Post #19January 10, 2018, 11:24 PM UTC

All looks good.

Let's give it 24 hours and see if all is still well.

terryfelter

Post #20January 11, 2018, 12:03 AM UTC

Thanks again

terryfelter

Post #21January 11, 2018, 12:16 AM UTC

Actually I do have one more request, so I don't screw up the works

Scan result of Farbar Recovery Scan Tool (FRST) (x64) Version: 02.01.2018
Ran by [removed] (administrator) on TERRYFELTER-PC (10-01-2018 17:26:46)
Running from C:\Users\[removed]\Desktop
[removed] Platform: Windows 7 Home Premium Service Pack 1 (X64) Language: English (United States)
Internet Explorer Version 11 (Default browser: IE)
Boot Mode: Normal
Tutorial for Farbar Recovery Scan Tool: http://www.geekstogo.com/forum/topic/335081-frst-tutorial-how-to-use-farbar-recovery-scan-tool/

==================== Processes (Whitelisted) =================

(If an entry is included in the fixlist, the process will be closed. The file will not be moved.)

(Microsoft Corporation) C:\Program Files\Microsoft Security Client\MsMpEng.exe
(IDT, Inc.) C:\Program Files\IDT\WDM\stacsv64.exe
(Microsoft Corporation) C:\Windows\System32\wlanext.exe
(Cisco WebEx LLC) C:\Windows\SysWOW64\atashost.exe
(Broadcom Corporation) C:\Program Files\Broadcom\MgmtAgent\BrcmMgmtAgent.exe
(Byte Technologies LLC) C:\Program Files\ByteFence\ByteFenceService.exe
(Storage Appliance Corp.) C:\ProgramData\OfficeGuardianV2\UACProxy.exe
(RealNetworks, Inc.) C:\Program Files (x86)\Real\RealPlayer\RPDS\Bin\rpdsvc.exe
() C:\Program Files\ByteFence\rtop\bin\rtop_svc.exe
(Safer-Networking Ltd.) C:\Program Files (x86)\Spybot - Search & Destroy 2\SDFSSvc.exe
(Safer-Networking Ltd.) C:\Program Files (x86)\Spybot - Search & Destroy 2\SDUpdSvc.exe
(Safer-Networking Ltd.) C:\Program Files (x86)\Spybot - Search & Destroy 2\SDWSCSvc.exe
(Microsoft Corporation) C:\Program Files\Microsoft Security Client\NisSrv.exe
() C:\Program Files\ByteFence\rtop\bin\rtop_bg.exe
(Alps Electric Co., Ltd.) C:\Program Files\DellTPad\Apoint.exe
(Microsoft Corporation) C:\Program Files\Microsoft Security Client\msseces.exe
(IDT, Inc.) C:\Program Files\IDT\WDM\sttray64.exe
(SAC) C:\ProgramData\OfficeGuardianV2\reminder\SacReminder.exe
(Alps Electric Co., Ltd.) C:\Program Files\DellTPad\ApMsgFwd.exe
() C:\Program Files (x86)\Microsoft Office\Office97\Office\FINDFAST.EXE
(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) USB 3.0 eXtensible Host Controller Driver\Application\iusb3mon.exe
(Alps Electric Co., Ltd.) C:\Program Files\DellTPad\hidfind.exe
(Alps Electric Co., Ltd.) C:\Program Files\DellTPad\ApntEx.exe
(RealNetworks, Inc.) C:\Program Files (x86)\Real\RealPlayer\RPDS\Bin\rpsystray.exe
(Sonic Solutions) C:\Program Files (x86)\Common Files\Roxio Shared\9.0\SharedCOM\RoxWatchTray9.exe
(Sonic Solutions) C:\Program Files (x86)\Common Files\Roxio Shared\9.0\SharedCOM\CPSHelpRunner.exe
(Byte Technologies LLC) C:\Program Files\ByteFence\ByteFence.exe
(Macrovision Corporation) C:\Program Files (x86)\Common Files\InstallShield\UpdateService\issch.exe
(Safer-Networking Ltd.) C:\Program Files (x86)\Spybot - Search & Destroy 2\SDTray.exe
(RealNetworks, Inc.) C:\Program Files (x86)\Real\RealPlayer\Update\realsched.exe
() C:\Program Files (x86)\Real\RealDownloader\downloader2.exe
(RealNetworks, Inc.) C:\Program Files (x86)\Real\RealDownloader\realdownloader264.exe
(Glarysoft Ltd) C:\Program Files (x86)\Glary Utilities 5\Integrator.exe
() C:\Program Files\ByteFence\rsLggr.exe
(Microsoft Corporation) C:\Program Files\Internet Explorer\iexplore.exe
(RealNetworks, Inc.) C:\Program Files (x86)\Real\RealDownloader\recordingmanager.exe
(Adobe Systems Incorporated) C:\Windows\System32\Macromed\Flash\FlashUtil64_28_0_0_137_ActiveX.exe
(Microsoft Corporation) C:\Program Files (x86)\Microsoft Office\Office12\EXCEL.EXE
(Microsoft Corporation) C:\Windows\splwow64.exe
(Microsoft Corporation) C:\Program Files (x86)\Microsoft Office\Office12\MSACCESS.EXE
() C:\Program Files (x86)\Simple Sudoku\simplesudoku.exe
(2GK) C:\Program Files\Medved Trader\MT.exe
(Microsoft Corporation) C:\Windows\System32\wscript.exe
(Microsoft Corporation) C:\Windows\System32\MsSpellCheckingFacility.exe
(Microsoft Corporation) C:\Windows\System32\taskmgr.exe
(Helios Software Solutions) C:\Program Files (x86)\TextPad 4\TextPad.exe
(TradeStation Technologies, Inc.) C:\Program Files (x86)\TradeStation 9.5\Program\TradeStationAgentForms.exe
(Macrovision Corporation) C:\Program Files (x86)\Common Files\InstallShield\UpdateService\ISUSPM.exe
(Macrovision Corporation) C:\Program Files (x86)\Common Files\InstallShield\UpdateService\agent.exe
(TradeStation Technologies, Inc.) C:\Program Files (x86)\TradeStation 9.5\Program\ELIS.exe
(TradeStation Technologies, Inc.) C:\Program Files (x86)\TradeStation 9.5\Program\WHServer.exe
(Worden Brothers Inc.) C:\Worden\TeleChart\TeleChart.exe
(Microsoft Corporation) C:\Windows\regedit.exe

==================== Registry (Whitelisted) ===========================

(If an entry is included in the fixlist, the registry item will be restored to default or removed. The file will not be moved.)

HKLM\…\Run: [Apoint] => C:\Program Files\DellTPad\Apoint.exe [736552 2015-05-29] (Alps Electric Co., Ltd.)
HKLM\…\Run: [MSC] => c:\Program Files\Microsoft Security Client\msseces.exe [1353680 2016-11-14] (Microsoft Corporation)
HKLM\…\Run: [SysTrayApp] => C:\Program Files\IDT\WDM\sttray64.exe [1703424 2013-08-16] (IDT, Inc.)
HKLM-x32\…\Run: [IMSS] => C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\IMSS\PIconStartup.exe [134616 2013-11-13] (Intel Corporation)
HKLM-x32\…\Run: [USB3MON] => C:\Program Files (x86)\Intel\Intel(R) USB 3.0 eXtensible Host Controller Driver\Application\iusb3mon.exe [292088 2013-02-22] (Intel Corporation)
HKLM-x32\…\Run: [] => [X]
HKLM-x32\…\Run: [RoxWatchTray] => C:\Program Files (x86)\Common Files\Roxio Shared\9.0\SharedCOM\RoxWatchTray9.exe [221184 2006-10-27] (Sonic Solutions)
HKLM-x32\…\Run: [ISUSPM Startup] => C:\Program Files (x86)\Common Files\InstallShield\UpdateService\ISUSPM.exe [221184 2006-08-25] (Macrovision Corporation)
HKLM-x32\…\Run: [ISUSScheduler] => C:\Program Files (x86)\Common Files\InstallShield\UpdateService\issch.exe [81920 2006-08-25] (Macrovision Corporation)
HKLM-x32\…\Run: [APSDaemon] => C:\Program Files (x86)\Common Files\Apple\Apple Application Support\APSDaemon.exe [59720 2013-09-13] (Apple Inc.)
HKLM-x32\…\Run: [SDTray] => C:\Program Files (x86)\Spybot - Search & Destroy 2\SDTray.exe [4101576 2014-06-24] (Safer-Networking Ltd.)
HKLM-x32\…\Run: [TkBellExe] => c:\program files (x86)\real\realplayer\Update\realsched.exe [353104 2017-09-18] (RealNetworks, Inc.)
HKLM-x32\…\Run: [RealDownloader] => C:\program files (x86)\real\RealDownloader\downloader2.exe [1259704 2017-08-17] ()
HKLM-x32\…\Winlogon: [Userinit] <$SYSDIR>\userinit.exe,
Winlogon\Notify\SDWinLogon-x32: SDWinLogon.dll [X]
HKU\S-1-5-21-2367635994-1441107805-3879806124-1000\…\Run: [GUDelayStartup] => C:\Program Files (x86)\Glary Utilities 5\StartupManager.exe [44016 2018-01-07] (Glarysoft Ltd)
HKU\S-1-5-21-2367635994-1441107805-3879806124-1000\…\Run: [Chromium] => c:\users\terry felter\appdata\local\chromium\application\chrome.exe [1068544 2016-03-18] (The Chromium Authors)
HKU\S-1-5-21-2367635994-1441107805-3879806124-1000\…\Run: [DellSystemDetect] => C:\Users\Terry Felter\AppData\Local\Apps\2.0\0R4EQAGX.Z5E\4QXKKBOM.0ZB\dell..tion_6d0a76327dca4869_0007.000b_df227eeaae3cac0d\DellSystemDetect.exe [310728 2016-12-29] (Dell)
HKU\S-1-5-21-2367635994-1441107805-3879806124-1000\…\Run: [SpybotPostWindows10UpgradeReInstall] => C:\Program Files\Common Files\AV\Spybot - Search and Destroy\Test.exe [1011200 2015-07-28] (Safer-Networking Ltd.)
HKU\S-1-5-21-2367635994-1441107805-3879806124-1000\…\Run: [SacReminderHDDV2] => C:\ProgramData\OfficeGuardianV2\reminder\SacReminder.exe [464752 2012-06-28] (SAC)
HKU\S-1-5-21-2367635994-1441107805-3879806124-1000\…\MountPoints2: {7b3f3c3d-fce9-11e6-992e-f01faf01a6d9} - E:\win\setup.exe -phs
HKU\S-1-5-21-2367635994-1441107805-3879806124-1000\…\MountPoints2: {ec19e8f8-b2aa-11e6-9b3d-f01faf01a6d9} - E:\StartClickFreeBackup.exe
HKU\S-1-5-21-2367635994-1441107805-3879806124-1000\Control Panel\Desktop\\SCRNSAVE.EXE -> C:\Windows\system32\scrnsave.scr [11264 2009-07-13] (Microsoft Corporation)
HKU\S-1-5-18\…\RunOnce: [SPReview] => "C:\Windows\System32\SPReview\SPReview.exe" /sp:1 /errorfwlink:"hxxp://go.microsoft.com/fwlink/?LinkID=122915" /build:7601
Startup: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\AutorunsDisabled [2016-11-25] ()
Startup: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\Microsoft Find Fast.lnk [2016-11-24]
ShortcutTarget: Microsoft Find Fast.lnk -> C:\Program Files (x86)\Microsoft Office\Office97\Office\FINDFAST.EXE ()
Startup: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\RealTimes.lnk [2017-09-18]
ShortcutTarget: RealTimes.lnk -> C:\Program Files (x86)\Real\RealPlayer\RPDS\Bin\rpsystray.exe (RealNetworks, Inc.)
BootExecute: autocheck autochk *

==================== Internet (Whitelisted) ====================

(If an item is included in the fixlist, if it is a registry item it will be removed or restored to default.)

Hosts: There are more than one entry in Hosts. See Hosts section of Addition.txt
Tcpip\Parameters: [DhcpNameServer] 75.75.75.75 75.75.76.76
Tcpip\..\Interfaces\{40C3FB48-7144-4278-80E9-D08F9B0A32E7}: [DhcpNameServer] 192.168.1.1
Tcpip\..\Interfaces\{45F66900-7B34-48B9-B4B7-659E8804DBA8}: [DhcpNameServer] 75.75.75.75 75.75.76.76
Tcpip\..\Interfaces\{73DDFA2D-603C-4D3B-BBB8-E3ADCBB82CC8}: [DhcpNameServer] 75.75.75.75 75.75.76.76

Internet Explorer:
==================
HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = hxxps://us.search.yahoo.com/yhs/web?hspart=iry&hsimp=yhs-fullyhosted_003&type=wbf_chtengin_16_48¶m1=1¶m2=f%3D1%26b%3DIE%26cc%3Dus%26pa%3Dwincy%26cd%3D2XzuyEtN2Y1L1Qzu0FtDtC0F0A0FtDtC0AyC0Dzy0FyC0AzztN0D0Tzu0StCyBzyzytN1L2XzutAtFtByDtFtCtFyDtBtN1L1Czu1StN1L1G1B1V1N2Y1L1Qzu2StDyD0C0AzztBtCyDtGyCyE0AyDtGzytBtCzztGyC0D0AyBtG0F0B0FtCtAtC0CtD0BtA0B0A2QtN1M1F1B2Z1V1N2Y1L1Qzu2SyCzyyBtCtAtByEtBtG0E0C0EtAtGyEzztDyBtGzyyC0DzytGtDtBzytC0A0A0FyCtC0D0ByB2QtN0A0LzutB%26cr%3D559116199%26a%3Dwbf_chtengin_16_48%26os_ver%3D6.1%26os%3DWindows%2B7%2BHome%2BPremium
HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Start Page = hxxps://us.search.yahoo.com/yhs/web?hspart=iry&hsimp=yhs-fullyhosted_003&type=wbf_chtengin_16_48¶m1=1¶m2=f%3D1%26b%3DIE%26cc%3Dus%26pa%3Dwincy%26cd%3D2XzuyEtN2Y1L1Qzu0FtDtC0F0A0FtDtC0AyC0Dzy0FyC0AzztN0D0Tzu0StCyBzyzytN1L2XzutAtFtByDtFtCtFyDtBtN1L1Czu1StN1L1G1B1V1N2Y1L1Qzu2StDyD0C0AzztBtCyDtGyCyE0AyDtGzytBtCzztGyC0D0AyBtG0F0B0FtCtAtC0CtD0BtA0B0A2QtN1M1F1B2Z1V1N2Y1L1Qzu2SyCzyyBtCtAtByEtBtG0E0C0EtAtGyEzztDyBtGzyyC0DzytGtDtBzytC0A0A0FyCtC0D0ByB2QtN0A0LzutB%26cr%3D559116199%26a%3Dwbf_chtengin_16_48%26os_ver%3D6.1%26os%3DWindows%2B7%2BHome%2BPremium
SearchScopes: HKLM -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = hxxps://us.search.yahoo.com/yhs/search?hspart=iry&hsimp=yhs-fullyhosted_003&type=wbf_chtengin_16_48¶m1=1¶m2=f%3D4%26b%3DIE%26cc%3Dus%26pa%3Dwincy%26cd%3D2XzuyEtN2Y1L1Qzu0FtDtC0F0A0FtDtC0AyC0Dzy0FyC0AzztN0D0Tzu0StCyBzyzytN1L2XzutAtFtByDtFtCtFyDtBtN1L1Czu1StN1L1G1B1V1N2Y1L1Qzu2StDyD0C0AzztBtCyDtGyCyE0AyDtGzytBtCzztGyC0D0AyBtG0F0B0FtCtAtC0CtD0BtA0B0A2QtN1M1F1B2Z1V1N2Y1L1Qzu2SyCzyyBtCtAtByEtBtG0E0C0EtAtGyEzztDyBtGzyyC0DzytGtDtBzytC0A0A0FyCtC0D0ByB2QtN0A0LzutB%26cr%3D559116199%26a%3Dwbf_chtengin_16_48%26os_ver%3D6.1%26os%3DWindows%2B7%2BHome%2BPremium&p={searchTerms}
SearchScopes: HKLM -> {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = hxxps://us.search.yahoo.com/yhs/search?hspart=iry&hsimp=yhs-fullyhosted_003&type=wbf_chtengin_16_48¶m1=1¶m2=f%3D4%26b%3DIE%26cc%3Dus%26pa%3Dwincy%26cd%3D2XzuyEtN2Y1L1Qzu0FtDtC0F0A0FtDtC0AyC0Dzy0FyC0AzztN0D0Tzu0StCyBzyzytN1L2XzutAtFtByDtFtCtFyDtBtN1L1Czu1StN1L1G1B1V1N2Y1L1Qzu2StDyD0C0AzztBtCyDtGyCyE0AyDtGzytBtCzztGyC0D0AyBtG0F0B0FtCtAtC0CtD0BtA0B0A2QtN1M1F1B2Z1V1N2Y1L1Qzu2SyCzyyBtCtAtByEtBtG0E0C0EtAtGyEzztDyBtGzyyC0DzytGtDtBzytC0A0A0FyCtC0D0ByB2QtN0A0LzutB%26cr%3D559116199%26a%3Dwbf_chtengin_16_48%26os_ver%3D6.1%26os%3DWindows%2B7%2BHome%2BPremium&p={searchTerms}
SearchScopes: HKLM-x32 -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = hxxps://us.search.yahoo.com/yhs/search?hspart=iry&hsimp=yhs-fullyhosted_003&type=wbf_chtengin_16_48¶m1=1¶m2=f%3D4%26b%3DIE%26cc%3Dus%26pa%3Dwincy%26cd%3D2XzuyEtN2Y1L1Qzu0FtDtC0F0A0FtDtC0AyC0Dzy0FyC0AzztN0D0Tzu0StCyBzyzytN1L2XzutAtFtByDtFtCtFyDtBtN1L1Czu1StN1L1G1B1V1N2Y1L1Qzu2StDyD0C0AzztBtCyDtGyCyE0AyDtGzytBtCzztGyC0D0AyBtG0F0B0FtCtAtC0CtD0BtA0B0A2QtN1M1F1B2Z1V1N2Y1L1Qzu2SyCzyyBtCtAtByEtBtG0E0C0EtAtGyEzztDyBtGzyyC0DzytGtDtBzytC0A0A0FyCtC0D0ByB2QtN0A0LzutB%26cr%3D559116199%26a%3Dwbf_chtengin_16_48%26os_ver%3D6.1%26os%3DWindows%2B7%2BHome%2BPremium&p={searchTerms}
SearchScopes: HKLM-x32 -> {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = hxxps://us.search.yahoo.com/yhs/search?hspart=iry&hsimp=yhs-fullyhosted_003&type=wbf_chtengin_16_48¶m1=1¶m2=f%3D4%26b%3DIE%26cc%3Dus%26pa%3Dwincy%26cd%3D2XzuyEtN2Y1L1Qzu0FtDtC0F0A0FtDtC0AyC0Dzy0FyC0AzztN0D0Tzu0StCyBzyzytN1L2XzutAtFtByDtFtCtFyDtBtN1L1Czu1StN1L1G1B1V1N2Y1L1Qzu2StDyD0C0AzztBtCyDtGyCyE0AyDtGzytBtCzztGyC0D0AyBtG0F0B0FtCtAtC0CtD0BtA0B0A2QtN1M1F1B2Z1V1N2Y1L1Qzu2SyCzyyBtCtAtByEtBtG0E0C0EtAtGyEzztDyBtGzyyC0DzytGtDtBzytC0A0A0FyCtC0D0ByB2QtN0A0LzutB%26cr%3D559116199%26a%3Dwbf_chtengin_16_48%26os_ver%3D6.1%26os%3DWindows%2B7%2BHome%2BPremium&p={searchTerms}
BHO: RealNetworks Download and Record Plugin for Internet Explorer -> {3049C3E9-B461-4BC5-8870-4C09146192CA} -> C:\program files (x86)\real\RealDownloader\BrowserPlugins\IE\rndlbrowserrecordplugin64.dll [2017-08-17] (RealDownloader)
BHO-x32: RealNetworks Download and Record Plugin for Internet Explorer -> {3049C3E9-B461-4BC5-8870-4C09146192CA} -> C:\program files (x86)\real\RealDownloader\BrowserPlugins\IE\rndlbrowserrecordplugin.dll [2017-08-17] (RealDownloader)
DPF: HKLM-x32 {E06E2E99-0AA1-11D4-ABA6-0060082AA75C} hxxps://tradestation.webex.com/client/T31L/support/ieatgpc1.cab
Handler-x32: http - {E1D2BF42-A96B-11D1-9C6B-0000F875AC61} - C:\PROGRA~2\COMMON~1\System\OLEDB~1\MSDAIPP.DLL [1999-02-03] (Microsoft Corporation)
Handler-x32: http - {E1D2BF40-A96B-11D1-9C6B-0000F875AC61} - C:\PROGRA~2\COMMON~1\System\OLEDB~1\MSDAIPP.DLL [1999-02-03] (Microsoft Corporation)
Handler-x32: https - {E1D2BF42-A96B-11D1-9C6B-0000F875AC61} - C:\PROGRA~2\COMMON~1\System\OLEDB~1\MSDAIPP.DLL [1999-02-03] (Microsoft Corporation)
Handler-x32: https - {E1D2BF40-A96B-11D1-9C6B-0000F875AC61} - C:\PROGRA~2\COMMON~1\System\OLEDB~1\MSDAIPP.DLL [1999-02-03] (Microsoft Corporation)
Handler-x32: ipp - {E1D2BF42-A96B-11D1-9C6B-0000F875AC61} - C:\PROGRA~2\COMMON~1\System\OLEDB~1\MSDAIPP.DLL [1999-02-03] (Microsoft Corporation)
Handler-x32: msdaipp - {E1D2BF42-A96B-11D1-9C6B-0000F875AC61} - C:\PROGRA~2\COMMON~1\System\OLEDB~1\MSDAIPP.DLL [1999-02-03] (Microsoft Corporation)
Handler-x32: msdaipp - {E1D2BF40-A96B-11D1-9C6B-0000F875AC61} - C:\PROGRA~2\COMMON~1\System\OLEDB~1\MSDAIPP.DLL [1999-02-03] (Microsoft Corporation)
StartMenuInternet: IEXPLORE.EXE -

FireFox:
========
FF DefaultProfile: po0agpgk.default
FF ProfilePath: C:\Users\Terry Felter\AppData\Roaming\Mozilla\Firefox\Profiles\po0agpgk.default [2018-01-09]
FF Homepage: Mozilla\Firefox\Profiles\po0agpgk.default -> www.msn.com
FF NewTab: Mozilla\Firefox\Profiles\po0agpgk.default -> about:newtab
FF Extension: (Bing Search) - C:\Users\Terry Felter\AppData\Roaming\Mozilla\Firefox\Profiles\po0agpgk.default\Extensions\[removed] [2016-11-25] [Legacy]
FF Extension: (Disable JavaScript Shared Memory) - C:\Users\Terry Felter\AppData\Roaming\Mozilla\Firefox\Profiles\po0agpgk.default\features\{1fd245ec-2c2b-4ac1-96f0-7c54a4c4c515}\[removed] [2018-01-09] [Legacy]
FF SearchPlugin: C:\Users\Terry Felter\AppData\Roaming\Mozilla\Firefox\Profiles\po0agpgk.default\searchplugins\bing-.xml [2016-11-25]
FF SearchPlugin: C:\Users\Terry Felter\AppData\Roaming\Mozilla\Firefox\Profiles\po0agpgk.default\searchplugins\yahoo! powered.xml [2016-12-04]
FF Plugin: @microsoft.com/GENUINE -> disabled [No File]
FF Plugin: @Microsoft.com/NpCtrl,version=1.0 -> c:\Program Files\Microsoft Silverlight\5.1.50907.0\npctrl.dll [2017-05-03] ( Microsoft Corporation)
FF Plugin-x32: @intel-webapi.intel.com/Intel WebAPI ipt;version=4.0.5 -> C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\IPT\npIntelWebAPIIPT.dll [2013-11-13] (Intel Corporation)
FF Plugin-x32: @intel-webapi.intel.com/Intel WebAPI updater -> C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\IPT\npIntelWebAPIUpdater.dll [2013-11-13] (Intel Corporation)
FF Plugin-x32: @microsoft.com/GENUINE -> disabled [No File]
FF Plugin-x32: @Microsoft.com/NpCtrl,version=1.0 -> c:\Program Files (x86)\Microsoft Silverlight\5.1.50907.0\npctrl.dll [2017-05-03] ( Microsoft Corporation)
FF Plugin-x32: @real.com/nppl3260;version=18.1.9.106 -> c:\program files (x86)\real\realplayer\Netscape6\nppl3260.dll [2017-09-18] (RealNetworks, Inc.)
FF Plugin-x32: @real.com/nprpplugin;version=18.1.9.106 -> c:\program files (x86)\real\realplayer\Netscape6\nprpplugin.dll [2017-09-18] (RealPlayer)
FF Plugin-x32: @videolan.org/vlc,version=2.2.4 -> C:\Program Files (x86)\VideoLAN\VLC\npvlc.dll [2016-06-01] (VideoLAN)
FF Plugin-x32: Adobe Reader -> C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AIR\nppdf32.dll [2017-11-27] (Adobe Systems Inc.)
FF Plugin HKU\S-1-5-21-2367635994-1441107805-3879806124-1000: @zoom.us/ZoomVideoPlugin -> C:\Users\Terry Felter\AppData\Roaming\Zoom\bin\npzoomplugin.dll [2017-09-09] (Zoom Video Communications, Inc.)
FF Plugin HKU\S-1-5-21-2367635994-1441107805-3879806124-1000: jpl.nasa.gov/NASAEyes -> C:\Users\Terry Felter\AppData\Roaming\JPL-NASA-Caltech\NASA's Eyes\npNASAEyes.dll [2017-12-13] (Jet Propulsion Laboratory)
FF Plugin HKU\S-1-5-21-2367635994-1441107805-3879806124-1000: tdameritrade.com/thinkorswim -> C:\Program Files\thinkorswim\npthinkorswim.dll [2017-07-14] (TD Ameritrade)
FF Plugin HKU\S-1-5-21-2367635994-1441107805-3879806124-1000: tdameritrade.com/tossc -> C:\Program Files\thinkorswim\nptossc.dll [2017-07-14] (TD Ameritrade)

==================== Services (Whitelisted) ====================

(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)

S4 ApHidMonitorService; C:\Program Files\DellTPad\HidMonitorSvc.exe [96000 2015-09-25] (Alps Electric Co., Ltd.)
R2 BrcmMgmtAgent; C:\Program Files\Broadcom\MgmtAgent\BrcmMgmtAgent.exe [163840 2011-11-30] (Broadcom Corporation) [File not signed]
R2 ByteFenceService; C:\Program Files\ByteFence\ByteFenceService.exe [145888 2017-07-19] (Byte Technologies LLC)
S3 IDriverT; C:\Program Files (x86)\Common Files\InstallShield\Driver\1050\Intel 32\IDriverT.exe [73728 2004-10-22] (Macrovision Corporation) [File not signed]
S4 igfxCUIService1.0.0.0; C:\Windows\system32\igfxCUIService.exe [319096 2016-06-15] (Intel Corporation)
S4 Intel(R) Capability Licensing Service Interface; C:\Program Files\Intel\iCLS Client\HeciServer.exe [747520 2013-08-27] (Intel(R) Corporation) [File not signed]
S4 Intel(R) Capability Licensing Service TCP IP Interface; C:\Program Files\Intel\iCLS Client\SocketHeciServer.exe [828376 2013-08-27] (Intel(R) Corporation)
S4 jhi_service; C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\DAL\jhi_service.exe [169432 2013-11-13] (Intel Corporation)
R2 MsMpSvc; c:\Program Files\Microsoft Security Client\MsMpEng.exe [119864 2016-11-14] (Microsoft Corporation)
R3 NisSrv; c:\Program Files\Microsoft Security Client\NisSrv.exe [361816 2016-11-14] (Microsoft Corporation)
S4 RealPlayerUpdateSvc; C:\program files (x86)\real\UpdateService\RealPlayerUpdateSvc.exe [37104 2017-08-17] (RealNetworks, Inc.)
R2 RealTimes Desktop Service; c:\program files (x86)\real\realplayer\RPDS\Bin\rpdsvc.exe [989912 2017-09-18] (RealNetworks, Inc.)
S3 Roxio UPnP Renderer 9; C:\Program Files (x86)\Roxio\Digital Home 9\RoxioUPnPRenderer9.exe [57344 2006-10-26] (Sonic Solutions) [File not signed]
S2 Roxio Upnp Server 9; C:\Program Files (x86)\Roxio\Digital Home 9\RoxioUpnpService9.exe [294912 2006-10-26] (Sonic Solutions) [File not signed]
S2 RoxLiveShare9; C:\Program Files (x86)\Common Files\Roxio Shared\9.0\SharedCOM\RoxLiveShare9.exe [303104 2006-10-27] (Sonic Solutions) [File not signed]
S3 RoxMediaDB9; C:\Program Files (x86)\Common Files\Roxio Shared\9.0\SharedCOM\RoxMediaDB9.exe [880640 2006-10-27] (Sonic Solutions) [File not signed]
S2 RoxWatch9; C:\Program Files (x86)\Common Files\Roxio Shared\9.0\SharedCOM\RoxWatch9.exe [159744 2006-10-27] (Sonic Solutions) [File not signed]
R2 rtop; C:\Program Files\ByteFence\rtop\bin\rtop_svc.exe [302920 2017-08-22] ()
R2 SDScannerService; C:\Program Files (x86)\Spybot - Search & Destroy 2\SDFSSvc.exe [1738168 2014-06-24] (Safer-Networking Ltd.)
R2 SDUpdateService; C:\Program Files (x86)\Spybot - Search & Destroy 2\SDUpdSvc.exe [4088608 2016-09-21] (Safer-Networking Ltd.) [File not signed]
R2 SDWSCService; C:\Program Files (x86)\Spybot - Search & Destroy 2\SDWSCSvc.exe [235984 2016-11-24] (Safer-Networking Ltd.) [File not signed]
S3 WinDefend; C:\Program Files\Windows Defender\mpsvc.dll [1011712 2013-05-26] (Microsoft Corporation)
S4 wltrysvc; C:\Program Files\Dell\DW WLAN Card\bcmwltry.exe [6177280 2014-01-14] (Dell Inc.) [File not signed]
R2 CFUACProxy_officeguardianv2; "C:\ProgramData\OfficeGuardianV2\UACProxy.exe" -s "-pC:\ProgramData\OfficeGuardianV2"

===================== Drivers (Whitelisted) ======================

(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)

S3 dg_ssudbus; C:\Windows\System32\DRIVERS\ssudbus.sys [131712 2016-09-05] (Samsung Electronics Co., Ltd.)
R1 GUBootStartup; C:\Windows\System32\drivers\GUBootStartup.sys [20160 2016-11-27] (Glarysoft Ltd)
R3 MEIx64; C:\Windows\System32\DRIVERS\TeeDriverx64.sys [99288 2013-11-13] (Intel Corporation)
R0 MpFilter; C:\Windows\System32\DRIVERS\MpFilter.sys [295000 2016-08-25] (Microsoft Corporation)
R3 NisDrv; C:\Windows\System32\DRIVERS\NisDrvWFP.sys [135928 2016-08-25] (Microsoft Corporation)
S1 RxFilter; C:\Windows\System32\DRIVERS\RxFilter.sys [58880 2006-10-27] (Sonic Solutions) [File not signed]
S1 RxFilter; C:\Windows\SysWOW64\DRIVERS\RxFilter.sys [58880 2006-10-27] (Sonic Solutions) [File not signed]
R3 ST_ACCEL; C:\Windows\System32\DRIVERS\ST_Accel.sys [89312 2013-03-27] (STMicroelectronics)
S3 swHSnet00; C:\Windows\System32\DRIVERS\swHSnet00.sys [376264 2012-12-19] (Sierra Wireless Incorporated)
S3 swHSser00; C:\Windows\System32\DRIVERS\swHSser00.sys [269512 2012-12-19] (Sierra Wireless Incorporated)
S3 swiwdmbx; C:\Windows\System32\DRIVERS\swiwdmbx.sys [114424 2012-12-19] (Sierra Wireless Inc.)
S3 swiwdmbxhs; C:\Windows\System32\DRIVERS\swiwdmbxhs.sys [114424 2012-12-19] (Sierra Wireless Inc.)
S3 NAVENG; \??\C:\Program Files (x86)\Norton Security\NortonData\22.7.0.76\Definitions\SDSDefs\20170918.019\ENG64.SYS [X]
S3 NAVEX15; \??\C:\Program Files (x86)\Norton Security\NortonData\22.7.0.76\Definitions\SDSDefs\20170918.019\EX64.SYS [X]

==================== NetSvcs (Whitelisted) ===================

(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)

==================== One Month Created files and folders ========

(If an entry is included in the fixlist, the file/folder will be moved.)

2018-01-10 17:26 - 2018-01-10 17:28 - 000023512 _____ C:\Users\Terry Felter\Desktop\FRST.txt
2018-01-10 17:25 - 2018-01-10 17:26 - 000000000 ____D C:\FRST
2018-01-10 17:24 - 2018-01-10 17:24 - 002393088 _____ (Farbar) C:\Users\Terry Felter\Desktop\FRST64.exe
2018-01-10 11:03 - 2018-01-10 11:03 - 000000000 ____D C:\Users\Terry Felter\AppData\Local\GoTo Opener
2018-01-08 06:16 - 2017-12-31 20:21 - 005581544 _____ (Microsoft Corporation) C:\Windows\system32\ntoskrnl.exe
2018-01-08 06:16 - 2017-12-31 20:21 - 001680616 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\ntfs.sys
2018-01-08 06:16 - 2017-12-31 20:21 - 000948968 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\ndis.sys
2018-01-08 06:16 - 2017-12-31 20:21 - 000708328 _____ (Microsoft Corporation) C:\Windows\system32\winload.efi
2018-01-08 06:16 - 2017-12-31 20:21 - 000288488 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\fltMgr.sys
2018-01-08 06:16 - 2017-12-31 20:21 - 000262376 _____ (Microsoft Corporation) C:\Windows\system32\hal.dll
2018-01-08 06:16 - 2017-12-31 20:21 - 000213736 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\rdyboost.sys
2018-01-08 06:16 - 2017-12-31 20:21 - 000154856 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\ksecpkg.sys
2018-01-08 06:16 - 2017-12-31 20:21 - 000114408 _____ (Microsoft Corporation) C:\Windows\system32\consent.exe
2018-01-08 06:16 - 2017-12-31 20:21 - 000095464 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\ksecdd.sys
2018-01-08 06:16 - 2017-12-31 20:19 - 001665384 _____ (Microsoft Corporation) C:\Windows\system32\ntdll.dll
2018-01-08 06:16 - 2017-12-31 20:18 - 014183936 _____ (Microsoft Corporation) C:\Windows\system32\shell32.dll
2018-01-08 06:16 - 2017-12-31 20:18 - 002066432 _____ (Microsoft Corporation) C:\Windows\system32\ole32.dll
2018-01-08 06:16 - 2017-12-31 20:18 - 002004480 _____ (Microsoft Corporation) C:\Windows\system32\msxml6.dll
2018-01-08 06:16 - 2017-12-31 20:18 - 001942016 _____ (Microsoft Corporation) C:\Windows\system32\authui.dll
2018-01-08 06:16 - 2017-12-31 20:18 - 001867776 _____ (Microsoft Corporation) C:\Windows\system32\ExplorerFrame.dll
2018-01-08 06:16 - 2017-12-31 20:18 - 001741312 _____ (Microsoft Corporation) C:\Windows\system32\sysmain.dll
2018-01-08 06:16 - 2017-12-31 20:18 - 001460736 _____ (Microsoft Corporation) C:\Windows\system32\lsasrv.dll
2018-01-08 06:16 - 2017-12-31 20:18 - 001212928 _____ (Microsoft Corporation) C:\Windows\system32\rpcrt4.dll
2018-01-08 06:16 - 2017-12-31 20:18 - 001163264 _____ (Microsoft Corporation) C:\Windows\system32\kernel32.dll
2018-01-08 06:16 - 2017-12-31 20:18 - 001110528 _____ (Microsoft Corporation) C:\Windows\system32\schedsvc.dll
2018-01-08 06:16 - 2017-12-31 20:18 - 000977408 _____ (Microsoft Corporation) C:\Windows\system32\inetcomm.dll
2018-01-08 06:16 - 2017-12-31 20:18 - 000961024 _____ (Microsoft Corporation) C:\Windows\system32\actxprxy.dll
2018-01-08 06:16 - 2017-12-31 20:18 - 000880640 _____ (Microsoft Corporation) C:\Windows\system32\advapi32.dll
2018-01-08 06:16 - 2017-12-31 20:18 - 000863232 _____ (Microsoft Corporation) C:\Windows\system32\IKEEXT.DLL
2018-01-08 06:16 - 2017-12-31 20:18 - 000842752 _____ (Microsoft Corporation) C:\Windows\system32\nshwfp.dll
2018-01-08 06:16 - 2017-12-31 20:18 - 000828928 _____ (Microsoft Corporation) C:\Windows\system32\MPSSVC.dll
2018-01-08 06:16 - 2017-12-31 20:18 - 000749568 _____ (Microsoft Corporation) C:\Windows\system32\FirewallAPI.dll
2018-01-08 06:16 - 2017-12-31 20:18 - 000705024 _____ (Microsoft Corporation) C:\Windows\system32\BFE.DLL
2018-01-08 06:16 - 2017-12-31 20:18 - 000512000 _____ (Microsoft Corporation) C:\Windows\system32\rpcss.dll
2018-01-08 06:16 - 2017-12-31 20:18 - 000503808 _____ (Microsoft Corporation) C:\Windows\system32\srcore.dll
2018-01-08 06:16 - 2017-12-31 20:18 - 000473600 _____ (Microsoft Corporation) C:\Windows\system32\taskcomp.dll
2018-01-08 06:16 - 2017-12-31 20:18 - 000463872 _____ (Microsoft Corporation) C:\Windows\system32\certcli.dll
2018-01-08 06:16 - 2017-12-31 20:18 - 000444928 _____ (Microsoft Corporation) C:\Windows\system32\winhttp.dll
2018-01-08 06:16 - 2017-12-31 20:18 - 000439296 _____ (Microsoft Corporation) C:\Windows\system32\p2psvc.dll
2018-01-08 06:16 - 2017-12-31 20:18 - 000419840 _____ (Microsoft Corporation) C:\Windows\system32\KernelBase.dll
2018-01-08 06:16 - 2017-12-31 20:18 - 000366592 _____ (Microsoft Corporation) C:\Windows\system32\wcncsvc.dll
2018-01-08 06:16 - 2017-12-31 20:18 - 000361984 _____ (Microsoft Corporation) C:\Windows\system32\wow64win.dll
2018-01-08 06:16 - 2017-12-31 20:18 - 000327168 _____ (Microsoft Corporation) C:\Windows\system32\pnrpsvc.dll
2018-01-08 06:16 - 2017-12-31 20:18 - 000324096 _____ (Microsoft Corporation) C:\Windows\system32\FWPUCLNT.DLL
2018-01-08 06:16 - 2017-12-31 20:18 - 000303104 _____ (Microsoft Corporation) C:\Windows\system32\nlasvc.dll
2018-01-08 06:16 - 2017-12-31 20:18 - 000264704 _____ (Microsoft Corporation) C:\Windows\system32\P2P.dll
2018-01-08 06:16 - 2017-12-31 20:18 - 000243712 _____ (Microsoft Corporation) C:\Windows\system32\wow64.dll
2018-01-08 06:16 - 2017-12-31 20:18 - 000223232 _____ (Microsoft Corporation) C:\Windows\system32\ncsi.dll
2018-01-08 06:16 - 2017-12-31 20:18 - 000120320 _____ (Microsoft Corporation) C:\Windows\system32\WcnApi.dll
2018-01-08 06:16 - 2017-12-31 20:18 - 000108544 _____ (Microsoft Corporation) C:\Windows\system32\icfupgd.dll
2018-01-08 06:16 - 2017-12-31 20:18 - 000101376 _____ (Microsoft Corporation) C:\Windows\system32\fdWCN.dll
2018-01-08 06:16 - 2017-12-31 20:18 - 000095744 _____ (Microsoft Corporation) C:\Windows\system32\rascfg.dll
2018-01-08 06:16 - 2017-12-31 20:18 - 000076288 _____ (Microsoft Corporation) C:\Windows\system32\rasdiag.dll
2018-01-08 06:16 - 2017-12-31 20:18 - 000070656 _____ (Microsoft Corporation) C:\Windows\system32\nlaapi.dll
2018-01-08 06:16 - 2017-12-31 20:18 - 000070144 _____ (Microsoft Corporation) C:\Windows\system32\appinfo.dll
2018-01-08 06:16 - 2017-12-31 20:18 - 000060928 _____ (Microsoft Corporation) C:\Windows\system32\ndptsp.tsp
2018-01-08 06:16 - 2017-12-31 20:18 - 000047104 _____ (Microsoft Corporation) C:\Windows\system32\kmddsp.tsp
2018-01-08 06:16 - 2017-12-31 20:18 - 000044032 _____ (Microsoft Corporation) C:\Windows\system32\csrsrv.dll
2018-01-08 06:16 - 2017-12-31 20:18 - 000041472 _____ (Microsoft Corporation) C:\Windows\system32\rasmxs.dll
2018-01-08 06:16 - 2017-12-31 20:18 - 000039424 _____ (Microsoft Corporation) C:\Windows\system32\traffic.dll
2018-01-08 06:16 - 2017-12-31 20:18 - 000029696 _____ (Microsoft Corporation) C:\Windows\system32\rasser.dll
2018-01-08 06:16 - 2017-12-31 20:18 - 000024576 _____ (Microsoft Corporation) C:\Windows\system32\WcnEapPeerProxy.dll
2018-01-08 06:16 - 2017-12-31 20:18 - 000024064 _____ (Microsoft Corporation) C:\Windows\system32\WcnEapAuthProxy.dll
2018-01-08 06:16 - 2017-12-31 20:18 - 000022528 _____ (Microsoft Corporation) C:\Windows\system32\wfapigp.dll
2018-01-08 06:16 - 2017-12-31 20:18 - 000016896 _____ (Microsoft Corporation) C:\Windows\system32\wshqos.dll
2018-01-08 06:16 - 2017-12-31 20:13 - 000631680 _____ (Microsoft Corporation) C:\Windows\system32\winresume.efi
2018-01-08 06:16 - 2017-12-31 20:04 - 000559616 _____ (Microsoft Corporation) C:\Windows\system32\spoolsv.exe
2018-01-08 06:16 - 2017-12-31 20:02 - 001314112 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ntdll.dll
2018-01-08 06:16 - 2017-12-31 20:00 - 012880384 _____ (Microsoft Corporation) C:\Windows\SysWOW64\shell32.dll
2018-01-08 06:16 - 2017-12-31 20:00 - 001499648 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ExplorerFrame.dll
2018-01-08 06:16 - 2017-12-31 20:00 - 001417728 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ole32.dll
2018-01-08 06:16 - 2017-12-31 20:00 - 001390080 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msxml6.dll
2018-01-08 06:16 - 2017-12-31 20:00 - 001114112 _____ (Microsoft Corporation) C:\Windows\SysWOW64\kernel32.dll
2018-01-08 06:16 - 2017-12-31 20:00 - 000741888 _____ (Microsoft Corporation) C:\Windows\SysWOW64\inetcomm.dll
2018-01-08 06:16 - 2017-12-31 20:00 - 000666624 _____ (Microsoft Corporation) C:\Windows\SysWOW64\nshwfp.dll
2018-01-08 06:16 - 2017-12-31 20:00 - 000666112 _____ (Microsoft Corporation) C:\Windows\SysWOW64\rpcrt4.dll
2018-01-08 06:16 - 2017-12-31 20:00 - 000554496 _____ (Microsoft Corporation) C:\Windows\SysWOW64\kerberos.dll
2018-01-08 06:16 - 2017-12-31 20:00 - 000463360 _____ (Microsoft Corporation) C:\Windows\SysWOW64\FirewallAPI.dll
2018-01-08 06:16 - 2017-12-31 20:00 - 000351744 _____ (Microsoft Corporation) C:\Windows\SysWOW64\winhttp.dll
2018-01-08 06:16 - 2017-12-31 20:00 - 000304640 _____ (Microsoft Corporation) C:\Windows\SysWOW64\taskcomp.dll
2018-01-08 06:16 - 2017-12-31 20:00 - 000276992 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wcncsvc.dll
2018-01-08 06:16 - 2017-12-31 20:00 - 000275456 _____ (Microsoft Corporation) C:\Windows\SysWOW64\KernelBase.dll
2018-01-08 06:16 - 2017-12-31 20:00 - 000261120 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msv1_0.dll
2018-01-08 06:16 - 2017-12-31 20:00 - 000217600 _____ (Microsoft Corporation) C:\Windows\SysWOW64\P2P.dll
2018-01-08 06:16 - 2017-12-31 20:00 - 000216576 _____ (Microsoft Corporation) C:\Windows\SysWOW64\FWPUCLNT.DLL
2018-01-08 06:16 - 2017-12-31 20:00 - 000162304 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ncsi.dll
2018-01-08 06:16 - 2017-12-31 20:00 - 000141312 _____ (Microsoft Corporation) C:\Windows\SysWOW64\rpchttp.dll
2018-01-08 06:16 - 2017-12-31 20:00 - 000096768 _____ (Microsoft Corporation) C:\Windows\SysWOW64\sspicli.dll
2018-01-08 06:16 - 2017-12-31 20:00 - 000081920 _____ (Microsoft Corporation) C:\Windows\SysWOW64\fdWCN.dll
2018-01-08 06:16 - 2017-12-31 20:00 - 000081408 _____ (Microsoft Corporation) C:\Windows\SysWOW64\rascfg.dll
2018-01-08 06:16 - 2017-12-31 20:00 - 000061952 _____ (Microsoft Corporation) C:\Windows\SysWOW64\rasdiag.dll
2018-01-08 06:16 - 2017-12-31 20:00 - 000052224 _____ (Microsoft Corporation) C:\Windows\SysWOW64\nlaapi.dll
2018-01-08 06:16 - 2017-12-31 20:00 - 000050688 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ndptsp.tsp
2018-01-08 06:16 - 2017-12-31 20:00 - 000033280 _____ (Microsoft Corporation) C:\Windows\SysWOW64\traffic.dll
2018-01-08 06:16 - 2017-12-31 19:59 - 001806848 _____ (Microsoft Corporation) C:\Windows\SysWOW64\authui.dll
2018-01-08 06:16 - 2017-12-31 19:59 - 000644096 _____ (Microsoft Corporation) C:\Windows\SysWOW64\advapi32.dll
2018-01-08 06:16 - 2017-12-31 19:59 - 000342528 _____ (Microsoft Corporation) C:\Windows\SysWOW64\certcli.dll
2018-01-08 06:16 - 2017-12-31 19:59 - 000309760 _____ (Microsoft Corporation) C:\Windows\SysWOW64\actxprxy.dll
2018-01-08 06:16 - 2017-12-31 19:55 - 000131584 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\pacer.sys
2018-01-08 06:16 - 2017-12-31 19:55 - 000088576 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\wanarp.sys
2018-01-08 06:16 - 2017-12-31 19:55 - 000058368 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\ndproxy.sys
2018-01-08 06:16 - 2017-12-31 19:55 - 000045056 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\netbios.sys
2018-01-08 06:16 - 2017-12-31 19:55 - 000024064 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\ndistapi.sys
2018-01-08 06:16 - 2017-12-31 19:54 - 004013800 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ntkrnlpa.exe
2018-01-08 06:16 - 2017-12-31 19:54 - 003959016 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ntoskrnl.exe
2018-01-08 06:16 - 2017-12-31 19:54 - 000077312 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\mpsdrv.sys
2018-01-08 06:16 - 2017-12-31 19:50 - 000455680 _____ (Microsoft Corporation) C:\Windows\system32\winlogon.exe
2018-01-08 06:16 - 2017-12-31 19:49 - 000062464 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\appid.sys
2018-01-08 06:16 - 2017-12-31 19:43 - 000086528 _____ (Microsoft Corporation) C:\Windows\SysWOW64\WcnApi.dll
2018-01-08 06:16 - 2017-12-31 19:43 - 000038912 _____ (Microsoft Corporation) C:\Windows\SysWOW64\kmddsp.tsp
2018-01-08 06:16 - 2017-12-31 19:43 - 000033280 _____ (Microsoft Corporation) C:\Windows\SysWOW64\rasmxs.dll
2018-01-08 06:16 - 2017-12-31 19:43 - 000022528 _____ (Microsoft Corporation) C:\Windows\SysWOW64\rasser.dll
2018-01-08 06:16 - 2017-12-31 19:43 - 000018944 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wfapigp.dll
2018-01-08 06:16 - 2017-12-31 19:42 - 000460288 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\srv.sys
2018-01-08 06:16 - 2017-12-31 19:42 - 000406016 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\srv2.sys
2018-01-08 06:16 - 2017-12-31 19:42 - 000168448 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\srvnet.sys
2018-01-08 06:16 - 2017-12-31 19:42 - 000159744 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\mrxsmb.sys
2018-01-08 06:16 - 2017-12-31 19:41 - 000754176 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\http.sys
2018-01-08 06:16 - 2017-12-31 19:41 - 000291328 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\mrxsmb10.sys
2018-01-08 06:16 - 2017-12-31 19:41 - 000106496 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\dfsc.sys
2018-01-08 06:16 - 2017-12-31 19:36 - 000025600 _____ (Microsoft Corporation) C:\Windows\SysWOW64\setup16.exe
2018-01-08 06:16 - 2017-12-30 01:29 - 000395968 _____ (Microsoft Corporation) C:\Windows\system32\iedkcs32.dll
2018-01-08 06:16 - 2017-12-30 00:42 - 000347328 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iedkcs32.dll
2018-01-08 06:16 - 2017-12-29 12:39 - 020274688 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.dll
2018-01-08 06:16 - 2017-12-29 12:13 - 000499712 _____ (Microsoft Corporation) C:\Windows\SysWOW64\vbscript.dll
2018-01-08 06:16 - 2017-12-29 12:12 - 000341504 _____ (Microsoft Corporation) C:\Windows\SysWOW64\html.iec
2018-01-08 06:16 - 2017-12-29 12:09 - 002294272 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iertutil.dll
2018-01-08 06:16 - 2017-12-29 12:04 - 000476160 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieui.dll
2018-01-08 06:16 - 2017-12-29 12:03 - 000662528 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript.dll
2018-01-08 06:16 - 2017-12-29 11:55 - 000416256 _____ (Microsoft Corporation) C:\Windows\SysWOW64\dxtmsft.dll
2018-01-08 06:16 - 2017-12-29 11:47 - 000168960 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msrating.dll
2018-01-08 06:16 - 2017-12-29 11:46 - 000279040 _____ (Microsoft Corporation) C:\Windows\SysWOW64\dxtrans.dll
2018-01-08 06:16 - 2017-12-29 11:45 - 004508160 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript9.dll
2018-01-08 06:16 - 2017-12-29 11:39 - 000230400 _____ (Microsoft Corporation) C:\Windows\SysWOW64\webcheck.dll
2018-01-08 06:16 - 2017-12-29 11:38 - 013680128 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieframe.dll
2018-01-08 06:16 - 2017-12-29 11:38 - 000694272 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msfeeds.dll
2018-01-08 06:16 - 2017-12-29 11:37 - 002058752 _____ (Microsoft Corporation) C:\Windows\SysWOW64\inetcpl.cpl
2018-01-08 06:16 - 2017-12-29 11:36 - 001155072 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtmlmedia.dll
2018-01-08 06:16 - 2017-12-29 11:19 - 002767872 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wininet.dll
2018-01-08 06:16 - 2017-12-29 11:15 - 001313792 _____ (Microsoft Corporation) C:\Windows\SysWOW64\urlmon.dll
2018-01-08 06:16 - 2017-12-29 11:13 - 000710144 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieapfltr.dll
2018-01-08 06:16 - 2017-12-29 03:15 - 025737728 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.dll
2018-01-08 06:16 - 2017-12-29 02:52 - 002900480 _____ (Microsoft Corporation) C:\Windows\system32\iertutil.dll
2018-01-08 06:16 - 2017-12-29 02:51 - 005796352 _____ (Microsoft Corporation) C:\Windows\system32\jscript9.dll
2018-01-08 06:16 - 2017-12-29 02:50 - 000577024 _____ (Microsoft Corporation) C:\Windows\system32\vbscript.dll
2018-01-08 06:16 - 2017-12-29 02:50 - 000417280 _____ (Microsoft Corporation) C:\Windows\system32\html.iec
2018-01-08 06:16 - 2017-12-29 02:40 - 000615936 _____ (Microsoft Corporation) C:\Windows\system32\ieui.dll
2018-01-08 06:16 - 2017-12-29 02:39 - 000817152 _____ (Microsoft Corporation) C:\Windows\system32\jscript.dll
2018-01-08 06:16 - 2017-12-29 02:39 - 000814080 _____ (Microsoft Corporation) C:\Windows\system32\jscript9diag.dll
2018-01-08 06:16 - 2017-12-29 02:39 - 000116224 _____ (Microsoft Corporation) C:\Windows\system32\ieetwcollector.exe
2018-01-08 06:16 - 2017-12-29 02:32 - 000969216 _____ (Microsoft Corporation) C:\Windows\system32\MsSpellCheckingFacility.exe
2018-01-08 06:16 - 2017-12-29 02:28 - 000489984 _____ (Microsoft Corporation) C:\Windows\system32\dxtmsft.dll
2018-01-08 06:16 - 2017-12-29 02:18 - 000199680 _____ (Microsoft Corporation) C:\Windows\system32\msrating.dll
2018-01-08 06:16 - 2017-12-29 02:16 - 000315392 _____ (Microsoft Corporation) C:\Windows\system32\dxtrans.dll
2018-01-08 06:16 - 2017-12-29 02:05 - 000262144 _____ (Microsoft Corporation) C:\Windows\system32\webcheck.dll
2018-01-08 06:16 - 2017-12-29 02:04 - 015284224 _____ (Microsoft Corporation) C:\Windows\system32\ieframe.dll
2018-01-08 06:16 - 2017-12-29 02:03 - 000807936 _____ (Microsoft Corporation) C:\Windows\system32\msfeeds.dll
2018-01-08 06:16 - 2017-12-29 02:03 - 000726528 _____ (Microsoft Corporation) C:\Windows\system32\ie4uinit.exe
2018-01-08 06:16 - 2017-12-29 02:01 - 002134528 _____ (Microsoft Corporation) C:\Windows\system32\inetcpl.cpl
2018-01-08 06:16 - 2017-12-29 02:01 - 001359360 _____ (Microsoft Corporation) C:\Windows\system32\mshtmlmedia.dll
2018-01-08 06:16 - 2017-12-29 01:50 - 003241472 _____ (Microsoft Corporation) C:\Windows\system32\wininet.dll
2018-01-08 06:16 - 2017-12-29 01:39 - 001545728 _____ (Microsoft Corporation) C:\Windows\system32\urlmon.dll
2018-01-08 06:16 - 2017-12-29 01:27 - 000800768 _____ (Microsoft Corporation) C:\Windows\system32\ieapfltr.dll
2018-01-08 06:16 - 2017-12-21 00:27 - 000634312 _____ (Microsoft Corporation) C:\Windows\system32\winload.exe
2018-01-08 06:16 - 2017-12-13 10:31 - 000383720 _____ (Adobe Systems Incorporated) C:\Windows\system32\atmfd.dll
2018-01-08 06:16 - 2017-12-13 10:27 - 000100864 _____ (Microsoft Corporation) C:\Windows\system32\fontsub.dll
2018-01-08 06:16 - 2017-12-13 10:15 - 000309480 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\atmfd.dll
2018-01-08 06:16 - 2017-12-13 10:11 - 000071168 _____ (Microsoft Corporation) C:\Windows\SysWOW64\fontsub.dll
2018-01-08 06:16 - 2017-12-13 09:50 - 000034304 _____ (Adobe Systems) C:\Windows\SysWOW64\atmlib.dll
2018-01-08 06:16 - 2017-12-05 11:36 - 000625664 _____ (Microsoft Corporation) C:\Windows\system32\mscms.dll
2018-01-08 06:16 - 2017-12-05 11:36 - 000250880 _____ (Microsoft Corporation) C:\Windows\system32\icm32.dll
2018-01-08 06:16 - 2017-12-05 11:08 - 000481792 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mscms.dll
2018-01-08 06:16 - 2017-12-05 11:08 - 000215040 _____ (Microsoft Corporation) C:\Windows\SysWOW64\icm32.dll
2018-01-08 06:15 - 2017-12-31 20:18 - 000731648 _____ (Microsoft Corporation) C:\Windows\system32\kerberos.dll
2018-01-08 06:15 - 2017-12-31 20:18 - 000690688 _____ (Microsoft Corporation) C:\Windows\system32\adtschema.dll
2018-01-08 06:15 - 2017-12-31 20:18 - 000345600 _____ (Microsoft Corporation) C:\Windows\system32\schannel.dll
2018-01-08 06:15 - 2017-12-31 20:18 - 000316928 _____ (Microsoft Corporation) C:\Windows\system32\msv1_0.dll
2018-01-08 06:15 - 2017-12-31 20:18 - 000312320 _____ (Microsoft Corporation) C:\Windows\system32\ncrypt.dll
2018-01-08 06:15 - 2017-12-31 20:18 - 000215552 _____ (Microsoft Corporation) C:\Windows\system32\winsrv.dll
2018-01-08 06:15 - 2017-12-31 20:18 - 000210432 _____ (Microsoft Corporation) C:\Windows\system32\wdigest.dll
2018-01-08 06:15 - 2017-12-31 20:18 - 000190464 _____ (Microsoft Corporation) C:\Windows\system32\rpchttp.dll
2018-01-08 06:15 - 2017-12-31 20:18 - 000146432 _____ (Microsoft Corporation) C:\Windows\system32\msaudite.dll
2018-01-08 06:15 - 2017-12-31 20:18 - 000135680 _____ (Microsoft Corporation) C:\Windows\system32\sspicli.dll
2018-01-08 06:15 - 2017-12-31 20:18 - 000123904 _____ (Microsoft Corporation) C:\Windows\system32\bcrypt.dll
2018-01-08 06:15 - 2017-12-31 20:18 - 000086528 _____ (Microsoft Corporation) C:\Windows\system32\TSpkg.dll
2018-01-08 06:15 - 2017-12-31 20:18 - 000084480 _____ (Microsoft Corporation) C:\Windows\system32\INETRES.dll
2018-01-08 06:15 - 2017-12-31 20:18 - 000063488 _____ (Microsoft Corporation) C:\Windows\system32\setbcdlocale.dll
2018-01-08 06:15 - 2017-12-31 20:18 - 000060416 _____ (Microsoft Corporation) C:\Windows\system32\msobjs.dll
2018-01-08 06:15 - 2017-12-31 20:18 - 000059904 _____ (Microsoft Corporation) C:\Windows\system32\appidapi.dll
2018-01-08 06:15 - 2017-12-31 20:18 - 000050176 _____ (Microsoft Corporation) C:\Windows\system32\srclient.dll
2018-01-08 06:15 - 2017-12-31 20:18 - 000043520 _____ (Microsoft Corporation) C:\Windows\system32\cryptbase.dll
2018-01-08 06:15 - 2017-12-31 20:18 - 000034816 _____ (Microsoft Corporation) C:\Windows\system32\appidsvc.dll
2018-01-08 06:15 - 2017-12-31 20:18 - 000028672 _____ (Microsoft Corporation) C:\Windows\system32\sspisrv.dll
2018-01-08 06:15 - 2017-12-31 20:18 - 000028160 _____ (Microsoft Corporation) C:\Windows\system32\secur32.dll
2018-01-08 06:15 - 2017-12-31 20:18 - 000026112 _____ (Microsoft Corporation) C:\Windows\system32\oleres.dll
2018-01-08 06:15 - 2017-12-31 20:18 - 000022016 _____ (Microsoft Corporation) C:\Windows\system32\credssp.dll
2018-01-08 06:15 - 2017-12-31 20:18 - 000016384 _____ (Microsoft Corporation) C:\Windows\system32\ntvdm64.dll
2018-01-08 06:15 - 2017-12-31 20:18 - 000013312 _____ (Microsoft Corporation) C:\Windows\system32\wshnetbs.dll
2018-01-08 06:15 - 2017-12-31 20:18 - 000013312 _____ (Microsoft Corporation) C:\Windows\system32\wow64cpu.dll
2018-01-08 06:15 - 2017-12-31 20:18 - 000008704 _____ (Microsoft Corporation) C:\Windows\system32\comcat.dll
2018-01-08 06:15 - 2017-12-31 20:18 - 000006656 _____ (Microsoft Corporation) C:\Windows\system32\apisetschema.dll
2018-01-08 06:15 - 2017-12-31 20:18 - 000006144 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-security-base-l1-1-0.dll
2018-01-08 06:15 - 2017-12-31 20:18 - 000005120 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-file-l1-1-0.dll
2018-01-08 06:15 - 2017-12-31 20:18 - 000004608 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-threadpool-l1-1-0.dll
2018-01-08 06:15 - 2017-12-31 20:18 - 000004608 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-processthreads-l1-1-0.dll
2018-01-08 06:15 - 2017-12-31 20:18 - 000004096 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-sysinfo-l1-1-0.dll
2018-01-08 06:15 - 2017-12-31 20:18 - 000004096 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-synch-l1-1-0.dll
2018-01-08 06:15 - 2017-12-31 20:18 - 000004096 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-localregistry-l1-1-0.dll
2018-01-08 06:15 - 2017-12-31 20:18 - 000004096 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-localization-l1-1-0.dll
2018-01-08 06:15 - 2017-12-31 20:18 - 000003584 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-rtlsupport-l1-1-0.dll
2018-01-08 06:15 - 2017-12-31 20:18 - 000003584 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-processenvironment-l1-1-0.dll
2018-01-08 06:15 - 2017-12-31 20:18 - 000003584 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-namedpipe-l1-1-0.dll
2018-01-08 06:15 - 2017-12-31 20:18 - 000003584 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-misc-l1-1-0.dll
2018-01-08 06:15 - 2017-12-31 20:18 - 000003584 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-memory-l1-1-0.dll
2018-01-08 06:15 - 2017-12-31 20:18 - 000003584 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-libraryloader-l1-1-0.dll
2018-01-08 06:15 - 2017-12-31 20:18 - 000003584 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-heap-l1-1-0.dll
2018-01-08 06:15 - 2017-12-31 20:18 - 000003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-xstate-l1-1-0.dll
2018-01-08 06:15 - 2017-12-31 20:18 - 000003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-util-l1-1-0.dll
2018-01-08 06:15 - 2017-12-31 20:18 - 000003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-string-l1-1-0.dll
2018-01-08 06:15 - 2017-12-31 20:18 - 000003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-profile-l1-1-0.dll
2018-01-08 06:15 - 2017-12-31 20:18 - 000003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-io-l1-1-0.dll
2018-01-08 06:15 - 2017-12-31 20:18 - 000003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-interlocked-l1-1-0.dll
2018-01-08 06:15 - 2017-12-31 20:18 - 000003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-handle-l1-1-0.dll
2018-01-08 06:15 - 2017-12-31 20:18 - 000003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-fibers-l1-1-0.dll
2018-01-08 06:15 - 2017-12-31 20:18 - 000003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-errorhandling-l1-1-0.dll
2018-01-08 06:15 - 2017-12-31 20:18 - 000003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-delayload-l1-1-0.dll
2018-01-08 06:15 - 2017-12-31 20:18 - 000003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-debug-l1-1-0.dll
2018-01-08 06:15 - 2017-12-31 20:18 - 000003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-datetime-l1-1-0.dll
2018-01-08 06:15 - 2017-12-31 20:18 - 000003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-console-l1-1-0.dll
2018-01-08 06:15 - 2017-12-31 20:18 - 000002048 _____ (Microsoft Corporation) C:\Windows\system32\msxml6r.dll
2018-01-08 06:15 - 2017-12-31 20:00 - 000254464 _____ (Microsoft Corporation) C:\Windows\SysWOW64\schannel.dll
2018-01-08 06:15 - 2017-12-31 20:00 - 000223232 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ncrypt.dll
2018-01-08 06:15 - 2017-12-31 20:00 - 000172032 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wdigest.dll
2018-01-08 06:15 - 2017-12-31 20:00 - 000146432 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msaudite.dll
2018-01-08 06:15 - 2017-12-31 20:00 - 000084480 _____ (Microsoft Corporation) C:\Windows\SysWOW64\INETRES.dll
2018-01-08 06:15 - 2017-12-31 20:00 - 000082944 _____ (Microsoft Corporation) C:\Windows\SysWOW64\bcrypt.dll
2018-01-08 06:15 - 2017-12-31 20:00 - 000065536 _____ (Microsoft Corporation) C:\Windows\SysWOW64\TSpkg.dll
2018-01-08 06:15 - 2017-12-31 20:00 - 000060416 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msobjs.dll
2018-01-08 06:15 - 2017-12-31 20:00 - 000043008 _____ (Microsoft Corporation) C:\Windows\SysWOW64\srclient.dll
2018-01-08 06:15 - 2017-12-31 20:00 - 000026112 _____ (Microsoft Corporation) C:\Windows\SysWOW64\oleres.dll
2018-01-08 06:15 - 2017-12-31 20:00 - 000022016 _____ (Microsoft Corporation) C:\Windows\SysWOW64\secur32.dll
2018-01-08 06:15 - 2017-12-31 20:00 - 000017408 _____ (Microsoft Corporation) C:\Windows\SysWOW64\credssp.dll
2018-01-08 06:15 - 2017-12-31 20:00 - 000005120 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wow32.dll
2018-01-08 06:15 - 2017-12-31 20:00 - 000002048 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msxml6r.dll
2018-01-08 06:15 - 2017-12-31 19:59 - 000690688 _____ (Microsoft Corporation) C:\Windows\SysWOW64\adtschema.dll
2018-01-08 06:15 - 2017-12-31 19:59 - 000050688 _____ (Microsoft Corporation) C:\Windows\SysWOW64\appidapi.dll
2018-01-08 06:15 - 2017-12-31 19:59 - 000006656 _____ (Microsoft Corporation) C:\Windows\SysWOW64\apisetschema.dll
2018-01-08 06:15 - 2017-12-31 19:59 - 000005120 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-file-l1-1-0.dll
2018-01-08 06:15 - 2017-12-31 19:59 - 000004608 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-processthreads-l1-1-0.dll
2018-01-08 06:15 - 2017-12-31 19:59 - 000004096 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-sysinfo-l1-1-0.dll
2018-01-08 06:15 - 2017-12-31 19:59 - 000004096 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-synch-l1-1-0.dll
2018-01-08 06:15 - 2017-12-31 19:59 - 000004096 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-misc-l1-1-0.dll
2018-01-08 06:15 - 2017-12-31 19:59 - 000004096 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-localregistry-l1-1-0.dll
2018-01-08 06:15 - 2017-12-31 19:59 - 000004096 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-localization-l1-1-0.dll
2018-01-08 06:15 - 2017-12-31 19:59 - 000003584 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-processenvironment-l1-1-0.dll
2018-01-08 06:15 - 2017-12-31 19:59 - 000003584 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-namedpipe-l1-1-0.dll
2018-01-08 06:15 - 2017-12-31 19:59 - 000003584 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-memory-l1-1-0.dll
2018-01-08 06:15 - 2017-12-31 19:59 - 000003584 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-libraryloader-l1-1-0.dll
2018-01-08 06:15 - 2017-12-31 19:59 - 000003584 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-interlocked-l1-1-0.dll
2018-01-08 06:15 - 2017-12-31 19:59 - 000003584 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-heap-l1-1-0.dll
2018-01-08 06:15 - 2017-12-31 19:59 - 000003072 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-string-l1-1-0.dll
2018-01-08 06:15 - 2017-12-31 19:59 - 000003072 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-rtlsupport-l1-1-0.dll
2018-01-08 06:15 - 2017-12-31 19:59 - 000003072 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-profile-l1-1-0.dll
2018-01-08 06:15 - 2017-12-31 19:59 - 000003072 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-io-l1-1-0.dll
2018-01-08 06:15 - 2017-12-31 19:59 - 000003072 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-handle-l1-1-0.dll
2018-01-08 06:15 - 2017-12-31 19:59 - 000003072 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-fibers-l1-1-0.dll
2018-01-08 06:15 - 2017-12-31 19:59 - 000003072 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-errorhandling-l1-1-0.dll
2018-01-08 06:15 - 2017-12-31 19:59 - 000003072 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-delayload-l1-1-0.dll
2018-01-08 06:15 - 2017-12-31 19:59 - 000003072 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-debug-l1-1-0.dll
2018-01-08 06:15 - 2017-12-31 19:59 - 000003072 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-datetime-l1-1-0.dll
2018-01-08 06:15 - 2017-12-31 19:59 - 000003072 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-console-l1-1-0.dll
2018-01-08 06:15 - 2017-12-31 19:49 - 000148480 _____ (Microsoft Corporation) C:\Windows\system32\appidpolicyconverter.exe
2018-01-08 06:15 - 2017-12-31 19:49 - 000064000 _____ (Microsoft Corporation) C:\Windows\system32\auditpol.exe
2018-01-08 06:15 - 2017-12-31 19:49 - 000017920 _____ (Microsoft Corporation) C:\Windows\system32\appidcertstorecheck.exe
2018-01-08 06:15 - 2017-12-31 19:46 - 000338432 _____ (Microsoft Corporation) C:\Windows\system32\conhost.exe
2018-01-08 06:15 - 2017-12-31 19:45 - 000296960 _____ (Microsoft Corporation) C:\Windows\system32\rstrui.exe
2018-01-08 06:15 - 2017-12-31 19:43 - 000020480 _____ (Microsoft Corporation) C:\Windows\SysWOW64\WcnEapPeerProxy.dll
2018-01-08 06:15 - 2017-12-31 19:43 - 000019968 _____ (Microsoft Corporation) C:\Windows\SysWOW64\WcnEapAuthProxy.dll
2018-01-08 06:15 - 2017-12-31 19:43 - 000013824 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wshqos.dll
2018-01-08 06:15 - 2017-12-31 19:41 - 000129536 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\mrxsmb20.sys
2018-01-08 06:15 - 2017-12-31 19:41 - 000112640 _____ (Microsoft Corporation) C:\Windows\system32\smss.exe
2018-01-08 06:15 - 2017-12-31 19:41 - 000030720 _____ (Microsoft Corporation) C:\Windows\system32\lsass.exe
2018-01-08 06:15 - 2017-12-31 19:41 - 000007168 _____ (Microsoft Corporation) C:\Windows\SysWOW64\comcat.dll
2018-01-08 06:15 - 2017-12-31 19:39 - 000050176 _____ (Microsoft Corporation) C:\Windows\SysWOW64\auditpol.exe
2018-01-08 06:15 - 2017-12-31 19:36 - 000014336 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ntvdm64.dll
2018-01-08 06:15 - 2017-12-31 19:36 - 000007680 _____ (Microsoft Corporation) C:\Windows\SysWOW64\instnm.exe
2018-01-08 06:15 - 2017-12-31 19:36 - 000002048 _____ (Microsoft Corporation) C:\Windows\SysWOW64\user.exe
2018-01-08 06:15 - 2017-12-31 19:35 - 000036352 _____ (Microsoft Corporation) C:\Windows\SysWOW64\cryptbase.dll
2018-01-08 06:15 - 2017-12-31 19:35 - 000006144 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-security-base-l1-1-0.dll
2018-01-08 06:15 - 2017-12-31 19:35 - 000004608 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-threadpool-l1-1-0.dll
2018-01-08 06:15 - 2017-12-31 19:35 - 000003584 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-xstate-l1-1-0.dll
2018-01-08 06:15 - 2017-12-31 19:35 - 000003072 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-util-l1-1-0.dll
2018-01-08 06:15 - 2017-12-29 12:24 - 002724864 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.tlb
2018-01-08 06:15 - 2017-12-29 12:13 - 000062464 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iesetup.dll
2018-01-08 06:15 - 2017-12-29 12:12 - 000047616 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieetwproxystub.dll
2018-01-08 06:15 - 2017-12-29 12:11 - 000064000 _____ (Microsoft Corporation) C:\Windows\SysWOW64\MshtmlDac.dll
2018-01-08 06:15 - 2017-12-29 12:06 - 000047104 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jsproxy.dll
2018-01-08 06:15 - 2017-12-29 12:06 - 000030720 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iernonce.dll
2018-01-08 06:15 - 2017-12-29 12:03 - 000620032 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript9diag.dll
2018-01-08 06:15 - 2017-12-29 12:03 - 000115712 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieUnatt.exe
2018-01-08 06:15 - 2017-12-29 11:51 - 000060416 _____ (Microsoft Corporation) C:\Windows\SysWOW64\JavaScriptCollectionAgent.dll
2018-01-08 06:15 - 2017-12-29 11:50 - 000091136 _____ (Microsoft Corporation) C:\Windows\SysWOW64\inseng.dll
2018-01-08 06:15 - 2017-12-29 11:50 - 000073216 _____ (Microsoft Corporation) C:\Windows\SysWOW64\tdc.ocx
2018-01-08 06:15 - 2017-12-29 11:47 - 000076288 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtmled.dll
2018-01-08 06:15 - 2017-12-29 11:44 - 000130048 _____ (Microsoft Corporation) C:\Windows\SysWOW64\occache.dll
2018-01-08 06:15 - 2017-12-29 03:04 - 002724864 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.tlb
2018-01-08 06:15 - 2017-12-29 03:04 - 000004096 _____ (Microsoft Corporation) C:\Windows\system32\ieetwcollectorres.dll
2018-01-08 06:15 - 2017-12-29 02:51 - 000066560 _____ (Microsoft Corporation) C:\Windows\system32\iesetup.dll
2018-01-08 06:15 - 2017-12-29 02:50 - 000088064 _____ (Microsoft Corporation) C:\Windows\system32\MshtmlDac.dll
2018-01-08 06:15 - 2017-12-29 02:50 - 000048640 _____ (Microsoft Corporation) C:\Windows\system32\ieetwproxystub.dll
2018-01-08 06:15 - 2017-12-29 02:44 - 000054784 _____ (Microsoft Corporation) C:\Windows\system32\jsproxy.dll
2018-01-08 06:15 - 2017-12-29 02:43 - 000034304 _____ (Microsoft Corporation) C:\Windows\system32\iernonce.dll
2018-01-08 06:15 - 2017-12-29 02:39 - 000144384 _____ (Microsoft Corporation) C:\Windows\system32\ieUnatt.exe
2018-01-08 06:15 - 2017-12-29 02:22 - 000087552 _____ (Microsoft Corporation) C:\Windows\system32\tdc.ocx
2018-01-08 06:15 - 2017-12-29 02:22 - 000077824 _____ (Microsoft Corporation) C:\Windows\system32\JavaScriptCollectionAgent.dll
2018-01-08 06:15 - 2017-12-29 02:21 - 000107520 _____ (Microsoft Corporation) C:\Windows\system32\inseng.dll
2018-01-08 06:15 - 2017-12-29 02:18 - 000092160 _____ (Microsoft Corporation) C:\Windows\system32\mshtmled.dll
2018-01-08 06:15 - 2017-12-29 02:14 - 000152064 _____ (Microsoft Corporation) C:\Windows\system32\occache.dll
2018-01-08 06:15 - 2017-12-13 10:27 - 000046080 _____ (Adobe Systems) C:\Windows\system32\atmlib.dll
2018-01-08 06:15 - 2017-12-13 10:27 - 000041472 _____ (Microsoft Corporation) C:\Windows\system32\lpk.dll
2018-01-08 06:15 - 2017-12-13 10:27 - 000014336 _____ (Microsoft Corporation) C:\Windows\system32\dciman32.dll
2018-01-08 06:15 - 2017-12-13 10:11 - 000025600 _____ (Microsoft Corporation) C:\Windows\SysWOW64\lpk.dll
2018-01-08 06:15 - 2017-12-13 10:11 - 000010240 _____ (Microsoft Corporation) C:\Windows\SysWOW64\dciman32.dll
2018-01-08 06:15 - 2017-12-05 11:36 - 000040960 _____ (Microsoft Corporation) C:\Windows\system32\WcsPlugInService.dll
2018-01-08 06:15 - 2017-12-05 09:59 - 003222528 _____ (Microsoft Corporation) C:\Windows\system32\win32k.sys
2018-01-08 06:15 - 2017-12-05 09:49 - 000032768 _____ (Microsoft Corporation) C:\Windows\SysWOW64\WcsPlugInService.dll
2018-01-08 05:26 - 2018-01-08 05:26 - 000003338 _____ C:\Windows\System32\Tasks\GlaryInitialize 5
2018-01-07 07:23 - 2018-01-07 07:23 - 000644236 _____ C:\Users\Terry Felter\Downloads\weekly-thoughs-1-8-2018.pdf
2017-12-21 06:53 - 2017-11-07 10:31 - 000002048 _____ (Microsoft Corporation) C:\Windows\system32\tzres.dll
2017-12-21 06:53 - 2017-11-07 10:13 - 000002048 _____ (Microsoft Corporation) C:\Windows\SysWOW64\tzres.dll
2017-12-21 06:53 - 2017-11-04 09:31 - 000194048 _____ (Microsoft Corporation) C:\Windows\system32\itircl.dll
2017-12-21 06:53 - 2017-11-04 09:31 - 000170496 _____ (Microsoft Corporation) C:\Windows\system32\itss.dll
2017-12-21 06:53 - 2017-11-04 09:10 - 000158720 _____ (Microsoft Corporation) C:\Windows\SysWOW64\itircl.dll
2017-12-21 06:53 - 2017-11-04 09:10 - 000142336 _____ (Microsoft Corporation) C:\Windows\SysWOW64\itss.dll
2017-12-21 06:53 - 2017-11-02 10:55 - 000281600 _____ (Microsoft Corporation) C:\Windows\system32\iprtrmgr.dll
2017-12-21 06:53 - 2017-11-02 10:55 - 000138240 _____ (Microsoft Corporation) C:\Windows\system32\rtm.dll
2017-12-21 06:53 - 2017-11-02 10:55 - 000097792 _____ (Microsoft Corporation) C:\Windows\system32\mprdim.dll
2017-12-21 06:53 - 2017-11-02 10:55 - 000009728 _____ (Microsoft Corporation) C:\Windows\system32\iprtprio.dll
2017-12-21 06:53 - 2017-11-02 09:11 - 000271360 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iprtrmgr.dll
2017-12-21 06:53 - 2017-11-02 09:11 - 000115200 _____ (Microsoft Corporation) C:\Windows\SysWOW64\rtm.dll
2017-12-21 06:53 - 2017-11-02 09:11 - 000075264 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mprdim.dll
2017-12-21 06:53 - 2017-11-02 08:56 - 000008192 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iprtprio.dll
2017-12-21 06:53 - 2017-10-17 20:06 - 000344064 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\usbhub.sys
2017-12-21 06:53 - 2017-10-17 20:06 - 000327168 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\usbport.sys
2017-12-21 06:53 - 2017-10-17 20:06 - 000099840 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\usbccgp.sys
2017-12-21 06:53 - 2017-10-17 20:06 - 000056320 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\usbehci.sys
2017-12-21 06:53 - 2017-10-17 20:06 - 000030720 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\usbuhci.sys
2017-12-21 06:53 - 2017-10-17 20:06 - 000025600 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\usbohci.sys
2017-12-21 06:53 - 2017-10-17 20:06 - 000007808 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\usbd.sys
2017-12-21 06:53 - 2017-10-16 17:04 - 001001984 _____ (Microsoft Corporation) C:\Windows\system32\gpedit.dll
2017-12-21 06:53 - 2017-10-16 16:46 - 000953344 _____ (Microsoft Corporation) C:\Windows\SysWOW64\gpedit.dll
2017-12-21 06:53 - 2017-10-16 15:55 - 000339968 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msexcl40.dll
2017-12-21 06:53 - 2017-10-11 18:55 - 014635008 _____ (Microsoft Corporation) C:\Windows\system32\wmp.dll
2017-12-21 06:53 - 2017-10-11 18:55 - 012574720 _____ (Microsoft Corporation) C:\Windows\system32\wmploc.DLL
2017-12-21 06:53 - 2017-10-11 18:55 - 002319872 _____ (Microsoft Corporation) C:\Windows\system32\tquery.dll
2017-12-21 06:53 - 2017-10-11 18:55 - 002222080 _____ (Microsoft Corporation) C:\Windows\system32\mssrch.dll
2017-12-21 06:53 - 2017-10-11 18:55 - 002058240 _____ (Microsoft Corporation) C:\Windows\system32\Query.dll
2017-12-21 06:53 - 2017-10-11 18:55 - 000778240 _____ (Microsoft Corporation) C:\Windows\system32\mssvp.dll
2017-12-21 06:53 - 2017-10-11 18:55 - 000491520 _____ (Microsoft Corporation) C:\Windows\system32\mssph.dll
2017-12-21 06:53 - 2017-10-11 18:55 - 000288256 _____ (Microsoft Corporation) C:\Windows\system32\mssphtb.dll
2017-12-21 06:53 - 2017-10-11 18:55 - 000151552 _____ (Microsoft Corporation) C:\Windows\system32\t2embed.dll
2017-12-21 06:53 - 2017-10-11 18:55 - 000115200 _____ (Microsoft Corporation) C:\Windows\system32\mssitlb.dll
2017-12-21 06:53 - 2017-10-11 18:55 - 000099840 _____ (Microsoft Corporation) C:\Windows\system32\mssprxy.dll
2017-12-21 06:53 - 2017-10-11 18:55 - 000075264 _____ (Microsoft Corporation) C:\Windows\system32\msscntrs.dll
2017-12-21 06:53 - 2017-10-11 18:55 - 000014336 _____ (Microsoft Corporation) C:\Windows\system32\msshooks.dll
2017-12-21 06:53 - 2017-10-11 18:55 - 000009728 _____ (Microsoft Corporation) C:\Windows\system32\spwmp.dll
2017-12-21 06:53 - 2017-10-11 18:55 - 000005120 _____ (Microsoft Corporation) C:\Windows\system32\msdxm.ocx
2017-12-21 06:53 - 2017-10-11 18:55 - 000005120 _____ (Microsoft Corporation) C:\Windows\system32\dxmasf.dll
2017-12-21 06:53 - 2017-10-11 18:39 - 000591872 _____ (Microsoft Corporation) C:\Windows\system32\SearchIndexer.exe
2017-12-21 06:53 - 2017-10-11 18:38 - 000249856 _____ (Microsoft Corporation) C:\Windows\system32\SearchProtocolHost.exe
2017-12-21 06:53 - 2017-10-11 18:38 - 000113664 _____ (Microsoft Corporation) C:\Windows\system32\SearchFilterHost.exe
2017-12-21 06:53 - 2017-10-11 18:37 - 012574208 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wmploc.DLL
2017-12-21 06:53 - 2017-10-11 18:37 - 011410944 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wmp.dll
2017-12-21 06:53 - 2017-10-11 18:37 - 001549824 _____ (Microsoft Corporation) C:\Windows\SysWOW64\tquery.dll
2017-12-21 06:53 - 2017-10-11 18:37 - 001400320 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mssrch.dll
2017-12-21 06:53 - 2017-10-11 18:37 - 001363968 _____ (Microsoft Corporation) C:\Windows\SysWOW64\Query.dll
2017-12-21 06:53 - 2017-10-11 18:37 - 000666624 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mssvp.dll
2017-12-21 06:53 - 2017-10-11 18:37 - 000337408 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mssph.dll
2017-12-21 06:53 - 2017-10-11 18:37 - 000197120 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mssphtb.dll
2017-12-21 06:53 - 2017-10-11 18:37 - 000111104 _____ (Microsoft Corporation) C:\Windows\SysWOW64\t2embed.dll
2017-12-21 06:53 - 2017-10-11 18:37 - 000104448 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mssitlb.dll
2017-12-21 06:53 - 2017-10-11 18:37 - 000059392 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msscntrs.dll
2017-12-21 06:53 - 2017-10-11 18:37 - 000034816 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mssprxy.dll
2017-12-21 06:53 - 2017-10-11 18:26 - 000427520 _____ (Microsoft Corporation) C:\Windows\SysWOW64\SearchIndexer.exe
2017-12-21 06:53 - 2017-10-11 18:26 - 000164352 _____ (Microsoft Corporation) C:\Windows\SysWOW64\SearchProtocolHost.exe
2017-12-21 06:53 - 2017-10-11 18:25 - 000086528 _____ (Microsoft Corporation) C:\Windows\SysWOW64\SearchFilterHost.exe
2017-12-21 06:53 - 2017-10-11 18:25 - 000009728 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msshooks.dll
2017-12-21 06:53 - 2017-10-11 18:24 - 000008192 _____ (Microsoft Corporation) C:\Windows\SysWOW64\spwmp.dll
2017-12-21 06:53 - 2017-10-11 18:24 - 000004096 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msdxm.ocx
2017-12-21 06:53 - 2017-10-11 18:24 - 000004096 _____ (Microsoft Corporation) C:\Windows\SysWOW64\dxmasf.dll
2017-12-21 06:53 - 2017-10-11 18:20 - 000317440 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\rdbss.sys
2017-12-21 06:53 - 2017-10-11 18:20 - 000113152 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\luafv.sys

==================== One Month Modified files and folders ========

(If an entry is included in the fixlist, the file/folder will be moved.)

2018-01-10 17:27 - 2016-12-03 20:53 - 000000000 ____D C:\Users\Terry Felter\AppData\Roaming\Simple Sudoku
2018-01-10 17:26 - 2016-12-04 11:32 - 000000000 ____D C:\Program Files\ByteFence
2018-01-10 17:17 - 2016-11-24 17:48 - 000000000 ____D C:\Users\Terry Felter\Documents\Stock Info
2018-01-10 16:35 - 2016-11-30 11:37 - 000000576 _____ C:\Windows\Tasks\G2MUpdateTask-S-1-5-21-2367635994-1441107805-3879806124-1000.job
2018-01-10 16:14 - 2016-11-30 11:37 - 000000672 _____ C:\Windows\Tasks\G2MUploadTask-S-1-5-21-2367635994-1441107805-3879806124-1000.job
2018-01-10 11:03 - 2016-11-24 16:22 - 000000000 ____D C:\Users\Terry Felter
2018-01-10 06:45 - 2016-11-27 16:36 - 000004364 _____ C:\ProgramData\keystore.xml
2018-01-10 05:29 - 2009-07-13 22:45 - 000019968 ____H C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0
2018-01-10 05:29 - 2009-07-13 22:45 - 000019968 ____H C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0
2018-01-10 05:16 - 2009-07-13 23:13 - 000743360 _____ C:\Windows\system32\PerfStringBackup.INI
2018-01-10 05:16 - 2009-07-13 21:20 - 000000000 ____D C:\Windows\inf
2018-01-10 05:10 - 2016-11-27 16:54 - 000000000 ____D C:\Program Files (x86)\Glary Utilities 5
2018-01-10 05:08 - 2009-07-13 23:08 - 000000006 ____H C:\Windows\Tasks\SA.DAT
2018-01-09 21:44 - 2017-01-10 12:35 - 000000000 ____D C:\Users\Terry Felter\AppData\LocalLow\Mozilla
2018-01-09 21:21 - 2014-03-30 14:56 - 000000000 ____D C:\Trazere
2018-01-09 10:51 - 2016-12-01 07:36 - 000000000 ____D C:\Users\Terry Felter\AppData\Local\CrashDumps
2018-01-09 09:14 - 2017-03-17 04:16 - 000004324 _____ C:\Windows\System32\Tasks\Adobe Flash Player Updater
2018-01-09 09:14 - 2016-11-25 07:57 - 000803328 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerApp.exe
2018-01-09 09:14 - 2016-11-25 07:57 - 000144896 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerCPLApp.cpl
2018-01-09 09:14 - 2016-11-25 07:57 - 000000000 ____D C:\Windows\system32\Macromed
2018-01-09 09:14 - 2016-11-25 07:56 - 000000000 ____D C:\Windows\SysWOW64\Macromed
2018-01-09 05:22 - 2016-11-24 22:12 - 000000000 ____D C:\Program Files (x86)\Mozilla Maintenance Service
2018-01-08 21:43 - 2016-11-24 22:12 - 000000000 ____D C:\Program Files (x86)\Mozilla Firefox
2018-01-08 15:35 - 2009-07-13 21:20 - 000000000 ____D C:\Windows\rescache
2018-01-08 06:38 - 2009-07-13 22:45 - 000464896 _____ C:\Windows\system32\FNTCACHE.DAT
2018-01-08 05:27 - 2016-11-27 16:54 - 000002998 _____ C:\Windows\System32\Tasks\GU5SkipUAC
2018-01-08 05:27 - 2016-11-27 16:54 - 000001102 _____ C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Glary Utilities 5.lnk
2018-01-08 05:27 - 2016-11-27 16:54 - 000001090 _____ C:\Users\Public\Desktop\Glary Utilities 5.lnk
2018-01-06 22:03 - 2017-07-28 17:54 - 000000616 _____ C:\Windows\Tasks\TradeStation Backup - Monthly.job
2018-01-06 21:37 - 2016-11-25 15:54 - 000000000 ____D C:\Program Files (x86)\TradeStation Archives
2018-01-06 19:45 - 2017-07-28 17:54 - 000000612 _____ C:\Windows\Tasks\TradeStation Backup - Weekly.job
2018-01-04 14:35 - 2017-07-08 17:01 - 000000000 ____D C:\Users\Terry Felter\AppData\Local\GoToMeeting
2018-01-02 14:57 - 2017-07-28 17:54 - 000003530 _____ C:\Windows\System32\Tasks\TradeStation Backup - Monthly
2018-01-02 14:57 - 2017-07-28 17:54 - 000003526 _____ C:\Windows\System32\Tasks\TradeStation Backup - Weekly
2018-01-02 13:17 - 2016-11-24 17:27 - 000005325 _____ C:\Users\Terry Felter\Documents\Finder.txt
2017-12-22 07:20 - 2016-12-02 08:22 - 000000843 _____ C:\Users\Public\Desktop\Medved Trader.lnk
2017-12-22 07:20 - 2016-12-02 08:22 - 000000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Medved Trader
2017-12-22 07:20 - 2016-12-02 08:21 - 000000000 ____D C:\Program Files\Medved Trader
2017-12-21 12:28 - 2016-11-30 11:37 - 000003724 _____ C:\Windows\System32\Tasks\G2MUploadTask-S-1-5-21-2367635994-1441107805-3879806124-1000
2017-12-21 12:28 - 2016-11-30 11:37 - 000003628 _____ C:\Windows\System32\Tasks\G2MUpdateTask-S-1-5-21-2367635994-1441107805-3879806124-1000
2017-12-21 09:29 - 2016-11-24 17:39 - 000000000 ____D C:\Users\Terry Felter\Documents\Snagit
2017-12-21 08:01 - 2009-07-13 21:20 - 000000000 ____D C:\Windows\SysWOW64\Setup
2017-12-21 08:00 - 2009-07-13 21:20 - 000000000 ____D C:\Windows\system32\Setup
2017-12-21 07:47 - 2016-11-24 20:24 - 000000000 ____D C:\Windows\system32\MRT
2017-12-21 07:40 - 2017-10-12 04:40 - 133326408 ____C (Microsoft Corporation) C:\Windows\system32\MRT-KB890830.exe
2017-12-21 07:39 - 2016-11-24 20:24 - 133326408 ____C (Microsoft Corporation) C:\Windows\system32\MRT.exe
2017-12-20 22:12 - 2016-11-24 17:19 - 000000000 ____D C:\Users\Terry Felter\AppData\Roaming\Mozilla
2017-12-18 12:10 - 2016-11-24 17:28 - 000089088 _____ C:\Users\Terry Felter\Documents\Glucose.xls
2017-12-17 14:58 - 2016-11-25 07:26 - 000004476 _____ C:\Windows\System32\Tasks\Adobe Acrobat Update Task
2017-12-17 14:53 - 2016-11-25 07:25 - 000002441 _____ C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Acrobat Reader DC.lnk

==================== Files in the root of some directories =======

2017-08-11 11:48 - 2017-08-11 11:48 - 000000320 _____ () C:\Users\Terry Felter\AppData\Roaming\SEC629985.trad
2016-11-25 07:20 - 1997-07-11 00:00 - 000000002 _____ () C:\Users\Terry Felter\AppData\Roaming\Microsoft\ArtGalry.cag
2017-07-12 16:34 - 2017-09-14 12:05 - 000007598 _____ () C:\Users\Terry Felter\AppData\Local\Resmon.ResmonCfg

Some files in TEMP:
====================
2017-09-22 06:45 - 2017-09-22 06:45 - 000012800 _____ () C:\Users\Terry Felter\AppData\Local\Temp\15ybke51.dll
2017-09-07 06:42 - 2017-09-07 06:42 - 000014848 _____ () C:\Users\Terry Felter\AppData\Local\Temp\4dwh3xyj.dll
2013-01-08 20:18 - 2013-01-08 20:18 - 001052192 _____ () C:\Users\Terry Felter\AppData\Local\Temp\AC770S_ATT_BUILD3695.EXE
2017-09-15 14:12 - 2017-10-20 18:55 - 004150696 _____ () C:\Users\Terry Felter\AppData\Local\Temp\clean20.dll
2017-01-04 08:14 - 2017-09-20 10:18 - 000223064 _____ () C:\Users\Terry Felter\AppData\Local\Temp\EyesLauncher.exe
2017-07-14 07:01 - 2017-07-14 07:01 - 000009216 _____ () C:\Users\Terry Felter\AppData\Local\Temp\ezqhttj1.dll
2017-09-15 14:12 - 2017-10-20 18:55 - 000023400 _____ (TradeStation Technologies) C:\Users\Terry Felter\AppData\Local\Temp\GACInstaller.dll
2017-09-15 14:12 - 2017-10-20 18:55 - 003538848 _____ () C:\Users\Terry Felter\AppData\Local\Temp\instutil.dll
2017-03-17 20:28 - 2017-09-05 13:52 - 000186224 _____ (RealNetworks, Inc.) C:\Users\Terry Felter\AppData\Local\Temp\lowproc.exe
2017-10-17 05:45 - 2017-10-17 05:45 - 000016896 _____ () C:\Users\Terry Felter\AppData\Local\Temp\omkqhr3s.dll
2017-09-15 14:12 - 2017-10-20 18:55 - 000016696 _____ (TradeStation) C:\Users\Terry Felter\AppData\Local\Temp\RegistASM.exe
2017-03-27 03:49 - 2017-03-27 03:49 - 001190832 _____ (RealNetworks, Inc.) C:\Users\Terry Felter\AppData\Local\Temp\rnsetup0.exe
2017-06-15 04:42 - 2017-06-15 04:42 - 001019312 _____ (RealNetworks, Inc.) C:\Users\Terry Felter\AppData\Local\Temp\rnsetup1.exe
2017-09-18 20:00 - 2017-09-18 20:00 - 001019312 _____ (RealNetworks, Inc.) C:\Users\Terry Felter\AppData\Local\Temp\rnsetup2.exe
2017-03-17 20:28 - 2017-09-05 13:52 - 000096440 _____ (RealNetworks, Inc.) C:\Users\Terry Felter\AppData\Local\Temp\stubhelper.dll
2017-08-29 11:03 - 2017-12-20 06:38 - 036925048 _____ () C:\Users\Terry Felter\AppData\Local\Temp\temp-installer.exe
2017-09-15 14:12 - 2017-10-20 18:55 - 002266952 _____ (TradeStation Technologies, Inc.) C:\Users\Terry Felter\AppData\Local\Temp\TSInst10.exe
2017-08-11 10:49 - 2017-10-20 18:55 - 000101304 _____ (TradeStation) C:\Users\Terry Felter\AppData\Local\Temp\TSInstallCAUtils.dll
2017-02-02 07:53 - 2017-02-02 07:53 - 000009728 _____ () C:\Users\Terry Felter\AppData\Local\Temp\v0jthfi1.dll
2017-08-07 04:27 - 2017-08-07 04:27 - 000003584 _____ () C:\Users\Terry Felter\AppData\Local\Temp\yubm6-s-.dll

==================== Bamital & volsnap ======================

(There is no automatic fix for files that do not pass verification.)

C:\Windows\system32\winlogon.exe => File is digitally signed
C:\Windows\system32\wininit.exe => File is digitally signed
C:\Windows\SysWOW64\wininit.exe => File is digitally signed
C:\Windows\explorer.exe => File is digitally signed
C:\Windows\SysWOW64\explorer.exe => File is digitally signed
C:\Windows\system32\svchost.exe => File is digitally signed
C:\Windows\SysWOW64\svchost.exe => File is digitally signed
C:\Windows\system32\services.exe => File is digitally signed
C:\Windows\system32\User32.dll => File is digitally signed
C:\Windows\SysWOW64\User32.dll => File is digitally signed
C:\Windows\system32\userinit.exe => File is digitally signed
C:\Windows\SysWOW64\userinit.exe => File is digitally signed
C:\Windows\system32\rpcss.dll => File is digitally signed
C:\Windows\system32\dnsapi.dll => File is digitally signed
C:\Windows\SysWOW64\dnsapi.dll => File is digitally signed
C:\Windows\system32\Drivers\volsnap.sys => File is digitally signed

LastRegBack: 2018-01-08 15:30

==================== End of FRST.txt ============================

This is on another pc

I would like to disable Glary here as well as ByteFence, as I have been unable to delete/uninstall it.

Satchfan

Post #22January 11, 2018, 8:41 AM UTC last edited January 11, 2018, 9:21 AM UTC

Note: Please run these in the order given in the instructions.

===================================================

Download and run AdwCleaner

Download AdwCleaner from here and save it to your desktop.

run AdwCleaner by clicking on Scan
when it has finished, leave everything that was found checked, (ticked), then click on Clean
if it asks to reboot, allow the reboot
on reboot a log will be produced; please attach the content of the log to your next reply.

===================================================

Run Malwarebytes Anti-Malware

Please download Malwarebytes Anti-Malware to your desktop.

double-click mbam-setup- mb3-setup-consumer-3.0.4.exe and follow the prompts to install the program
at the end, be sure a checkmark is placed next to the following
- Launch Malwarebytes Anti-Malware
- a 14 day trial of the Premium features is pre-selected: deselect this if you don’t want it, (it won’t diminish the scanning and removal capabilities of the program).
click Finish.
on the Dashboard, click Update Now
after the update completes, click the Scan Now' button.
if an update is available, clicking the Update Now button will update it
a Threat Scan will begin.
when the scan is complete, if malware has been detected, click Apply Actions to allow MBAM to clean what was found
when the prompt to restart the computer appears, click Yes.
after the restart once you are back at your desktop, open MBAM once more
click on the “History” tab, the “Application Logs”
double-click on the scan log which shows the date and time of the scan just performed.
click Copy to Clipboard
please paste the contents of the clipboard into your reply.

===================================================

Please run FRST again and make sure there is a checkmark next to ‘Addition.txt’ before you hit Scan.

Logs to include with next post:

AdwCleaner log
Mbam.txt
New Frst.txt
New Addition.txt

Thanks

Satchfan

terryfelter

Post #23January 11, 2018, 1:36 PM UTC last edited January 11, 2018, 2:54 PM UTC

Let me emphasis that this machine isn't infected to my knowledge, but performed scans as requested.

Again I wanted to disable both Glary and ByteFence.

# AdwCleaner 7.0.6.0 - Logfile created on Thu Jan 11 12:44:05 2018
# Updated on 2017/21/12 by Malwarebytes
# Running on Windows 7 Home Premium (X64)
# Mode: clean
# Support: https://www.malwarebytes.com/support

***** [ Services ] *****

Deleted: ByteFenceService
Deleted: rtop

***** [ Folders ] *****

Deleted: C:\ProgramData\ByteFence
Deleted: C:\ProgramData\Application Data\ByteFence
Deleted: C:\Program Files\ByteFence
Deleted: C:\Users\All Users\ByteFence
Deleted: C:\Users\Terry Felter\AppData\Roaming\Microsoft\Windows\Start Menu\ByteFence

***** [ Files ] *****

Deleted: C:\Users\Terry Felter\daemonprocess.txt
Deleted: C:\Users\Terry Felter\Documents\uninstaller.exe
Deleted: C:\Users\Terry Felter\AppData\Roaming\Mozilla\Firefox\Profiles\po0agpgk.default\searchplugins\yahoo! powered.xml
Deleted: C:\Users\Terry Felter\AppData\Roaming\Mozilla\Firefox\Profiles\po0agpgk.default\SEARCHPLUGINS\YAHOO! POWERED.XML
Deleted: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\HowToRemove.html.lnk

***** [ DLL ] *****

No malicious DLLs cleaned.

***** [ WMI ] *****

No malicious WMI cleaned.

***** [ Shortcuts ] *****

No malicious shortcuts cleaned.

***** [ Tasks ] *****

Deleted: ByteFence Scan
Deleted: ByteFence

***** [ Registry ] *****

Deleted: [Key] - HKU\S-1-5-21-2367635994-1441107805-3879806124-1000\Software\APN PIP
Deleted: [Key] - HKCU\Software\APN PIP
Deleted: [Key] - HKU\S-1-5-21-2367635994-1441107805-3879806124-1000\Software\darwendlm
Deleted: [Key] - HKCU\Software\darwendlm
Deleted: [Key] - HKLM\SOFTWARE\Classes\*\shell\ByteFence File Scan
Deleted: [Key] - HKLM\SOFTWARE\Classes\Directory\shell\ByteFence Folder Scan
Deleted: [Key] - HKLM\SOFTWARE\ByteFence
Deleted: [Key] - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\ByteFence
Deleted: [Key] - HKU\.DEFAULT\Software\ByteFence
Deleted: [Key] - HKU\S-1-5-21-2367635994-1441107805-3879806124-1000\Software\ByteFence
Deleted: [Key] - HKU\S-1-5-18\Software\ByteFence
Deleted: [Key] - HKCU\Software\ByteFence
Deleted: [Key] - HKLM\SYSTEM\CurrentControlSet\Services\EventLog\Application
Deleted: [Key] - HKLM\SYSTEM\CurrentControlSet\Services\Eventlog\Application
Deleted: [Value] - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_BROWSER_EMULATION|ByteFence.exe
Deleted: [Key] - HKLM\SYSTEM\CurrentControlSet\Services\EventLog\Reason\ReasonByteFence
Deleted: [Key] - HKU\S-1-5-21-2367635994-1441107805-3879806124-1000\Software\csastats
Deleted: [Key] - HKCU\Software\csastats
Deleted: [Key] - HKU\S-1-5-21-2367635994-1441107805-3879806124-1000\Software\PRODUCTSETUP
Deleted: [Key] - HKCU\Software\PRODUCTSETUP

***** [ Firefox (and derivatives) ] *****

No malicious Firefox entries deleted.

***** [ Chromium (and derivatives) ] *****

No malicious Chromium entries deleted.

*************************

::Tracing keys deleted
::Winsock settings cleared
::Additional Actions: 0

*************************

C:/AdwCleaner/AdwCleaner[C1].txt - [1736 B] - [2016/7/15 2:37:17]
C:/AdwCleaner/AdwCleaner[S1].txt - [3602 B] - [2016/7/15 2:33:17]

########## EOF - C:\AdwCleaner\AdwCleaner[C1].txt ##########

Malwarebytes
www.malwarebytes.com

-Log Details-
Scan Date: 1/11/18
Scan Time: 6:52 AM
Log File: 5613f484-f6ce-11e7-847a-f01faf01a6d9.json
Administrator: Yes

-Software Information-
Version: 3.3.1.2183
Components Version: 1.0.262
Update Package Version: 1.0.3675
License: Free

-System Information-
OS: Windows 7 Service Pack 1
CPU: x64
File System: NTFS
User: TerryFelter-PC\Terry Felter

-Scan Summary-
Scan Type: Threat Scan
Result: Completed
Objects Scanned: 282864
Threats Detected: 42
Threats Quarantined: 42
Time Elapsed: 15 min, 21 sec

-Scan Options-
Memory: Enabled
Startup: Enabled
Filesystem: Enabled
Archives: Enabled
Rootkits: Disabled
Heuristics: Enabled
PUP: Detect
PUM: Detect

-Scan Details-
Process: 0
(No malicious items detected)

Module: 0
(No malicious items detected)

Registry Key: 4
PUP.Optional.WinYahoo, HKU\S-1-5-21-2367635994-1441107805-3879806124-1000\SOFTWARE\MICROSOFT\INTERNET EXPLORER\SEARCHSCOPES\{0633EE93-D776-472F-A0FF-E1416B8B2E3A}, Quarantined, [57], [182758],1.0.3675
PUP.Optional.WinYahoo, HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\INTERNET EXPLORER\SEARCHSCOPES\{0633EE93-D776-472F-A0FF-E1416B8B2E3A}, Quarantined, [57], [182758],1.0.3675
PUP.Optional.WinYahoo, HKLM\SOFTWARE\MICROSOFT\INTERNET EXPLORER\SEARCHSCOPES\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}, Quarantined, [57], [182758],1.0.3675
PUP.Optional.WinYahoo, HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\WINDOWS\CURRENTVERSION\UNINSTALL\{1C97F457-4C17-25D7-FD97-55572D1786D7}, Quarantined, [57], [302717],1.0.3675

Registry Value: 3
PUP.Optional.NotChromeRun, HKU\S-1-5-21-2367635994-1441107805-3879806124-1000\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\RUN|CHROMIUM, Quarantined, [1344], [391151],1.0.3675
PUP.Optional.WinYahoo, HKLM\SOFTWARE\MICROSOFT\INTERNET EXPLORER\SEARCHSCOPES\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}|URL, Quarantined, [57], [182758],1.0.3675
PUP.Optional.WinYahoo, HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\INTERNET EXPLORER\SEARCHSCOPES\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}|URL, Quarantined, [57], [182758],1.0.3675

Registry Data: 2
PUP.Optional.WinYahoo, HKLM\SOFTWARE\MICROSOFT\INTERNET EXPLORER\MAIN|START PAGE, Replaced, [57], [293461],1.0.3675
PUP.Optional.WinYahoo, HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\INTERNET EXPLORER\MAIN|START PAGE, Replaced, [57], [293461],1.0.3675

Data Stream: 0
(No malicious items detected)

Folder: 2
PUP.Optional.WinYahoo, C:\Users\Terry Felter\AppData\Local\{A8029E5E-8CAA-F2E6-E132-D70EC55A2B96}\HowToRemove, Quarantined, [57], [302717],1.0.3675
PUP.Optional.WinYahoo, C:\USERS\TERRY FELTER\APPDATA\LOCAL\{A8029E5E-8CAA-F2E6-E132-D70EC55A2B96}, Quarantined, [57], [302717],1.0.3675

File: 31
PUP.Optional.WinYahoo, C:\USERS\TERRY FELTER\APPDATA\LOCAL\{A8029E5E-8CAA-F2E6-E132-D70EC55A2B96}\HOWTOREMOVE\HOWTOREMOVE.HTML, Quarantined, [57], [302717],1.0.3675
PUP.Optional.WinYahoo, C:\Users\Terry Felter\AppData\Local\{A8029E5E-8CAA-F2E6-E132-D70EC55A2B96}\HowToRemove\chromium-min.jpg, Quarantined, [57], [302717],1.0.3675
PUP.Optional.WinYahoo, C:\Users\Terry Felter\AppData\Local\{A8029E5E-8CAA-F2E6-E132-D70EC55A2B96}\HowToRemove\control panel-min-min.JPG, Quarantined, [57], [302717],1.0.3675
PUP.Optional.WinYahoo, C:\Users\Terry Felter\AppData\Local\{A8029E5E-8CAA-F2E6-E132-D70EC55A2B96}\HowToRemove\down.png, Quarantined, [57], [302717],1.0.3675
PUP.Optional.WinYahoo, C:\Users\Terry Felter\AppData\Local\{A8029E5E-8CAA-F2E6-E132-D70EC55A2B96}\HowToRemove\ff menu.JPG, Quarantined, [57], [302717],1.0.3675
PUP.Optional.WinYahoo, C:\Users\Terry Felter\AppData\Local\{A8029E5E-8CAA-F2E6-E132-D70EC55A2B96}\HowToRemove\ff search engine-min.png, Quarantined, [57], [302717],1.0.3675
PUP.Optional.WinYahoo, C:\Users\Terry Felter\AppData\Local\{A8029E5E-8CAA-F2E6-E132-D70EC55A2B96}\HowToRemove\hp-min ff.png, Quarantined, [57], [302717],1.0.3675
PUP.Optional.WinYahoo, C:\Users\Terry Felter\AppData\Local\{A8029E5E-8CAA-F2E6-E132-D70EC55A2B96}\HowToRemove\hp-min ie.png, Quarantined, [57], [302717],1.0.3675
PUP.Optional.WinYahoo, C:\Users\Terry Felter\AppData\Local\{A8029E5E-8CAA-F2E6-E132-D70EC55A2B96}\HowToRemove\search engine.gif, Quarantined, [57], [302717],1.0.3675
PUP.Optional.WinYahoo, C:\Users\Terry Felter\AppData\Local\{A8029E5E-8CAA-F2E6-E132-D70EC55A2B96}\HowToRemove\setup pages.gif, Quarantined, [57], [302717],1.0.3675
PUP.Optional.WinYahoo, C:\Users\Terry Felter\AppData\Local\{A8029E5E-8CAA-F2E6-E132-D70EC55A2B96}\HowToRemove\sp-min.png, Quarantined, [57], [302717],1.0.3675
PUP.Optional.WinYahoo, C:\Users\Terry Felter\AppData\Local\{A8029E5E-8CAA-F2E6-E132-D70EC55A2B96}\HowToRemove\start-min.jpg, Quarantined, [57], [302717],1.0.3675
PUP.Optional.WinYahoo, C:\Users\Terry Felter\AppData\Local\{A8029E5E-8CAA-F2E6-E132-D70EC55A2B96}\HowToRemove\up.png, Quarantined, [57], [302717],1.0.3675
PUP.Optional.WinYahoo, C:\Users\Terry Felter\AppData\Local\{A8029E5E-8CAA-F2E6-E132-D70EC55A2B96}\bapi_chmm.dat, Quarantined, [57], [302717],1.0.3675
PUP.Optional.WinYahoo, C:\Users\Terry Felter\AppData\Local\{A8029E5E-8CAA-F2E6-E132-D70EC55A2B96}\bapi_ff.dat, Quarantined, [57], [302717],1.0.3675
PUP.Optional.WinYahoo, C:\Users\Terry Felter\AppData\Local\{A8029E5E-8CAA-F2E6-E132-D70EC55A2B96}\bapi_ie.dat, Quarantined, [57], [302717],1.0.3675
PUP.Optional.WinYahoo, C:\Users\Terry Felter\AppData\Local\{A8029E5E-8CAA-F2E6-E132-D70EC55A2B96}\ceda, Quarantined, [57], [302717],1.0.3675
PUP.Optional.WinYahoo, C:\Users\Terry Felter\AppData\Local\{A8029E5E-8CAA-F2E6-E132-D70EC55A2B96}\install.log, Quarantined, [57], [302717],1.0.3675
PUP.Optional.WinYahoo, C:\Users\Terry Felter\AppData\Local\{A8029E5E-8CAA-F2E6-E132-D70EC55A2B96}\lota.dat, Quarantined, [57], [302717],1.0.3675
PUP.Optional.WinYahoo, C:\Users\Terry Felter\AppData\Local\{A8029E5E-8CAA-F2E6-E132-D70EC55A2B96}\more, Quarantined, [57], [302717],1.0.3675
PUP.Optional.WinYahoo, C:\Users\Terry Felter\AppData\Local\{A8029E5E-8CAA-F2E6-E132-D70EC55A2B96}\nire, Quarantined, [57], [302717],1.0.3675
PUP.Optional.WinYahoo, C:\Users\Terry Felter\AppData\Local\{A8029E5E-8CAA-F2E6-E132-D70EC55A2B96}\rote.cfg, Quarantined, [57], [302717],1.0.3675
PUP.Optional.WinYahoo, C:\Users\Terry Felter\AppData\Local\{A8029E5E-8CAA-F2E6-E132-D70EC55A2B96}\sesa, Quarantined, [57], [302717],1.0.3675
PUP.Optional.WinYahoo, C:\Users\Terry Felter\AppData\Local\{A8029E5E-8CAA-F2E6-E132-D70EC55A2B96}\Sqlite3.dll, Quarantined, [57], [302717],1.0.3675
PUP.Optional.WinYahoo, C:\Users\Terry Felter\AppData\Local\{A8029E5E-8CAA-F2E6-E132-D70EC55A2B96}\uninst.dat, Quarantined, [57], [302717],1.0.3675
PUP.Optional.WinYahoo, C:\Users\Terry Felter\AppData\Local\{A8029E5E-8CAA-F2E6-E132-D70EC55A2B96}\uninst.exe, Quarantined, [57], [302717],1.0.3675
PUP.Optional.WinYahoo, C:\Users\Terry Felter\AppData\Local\{A8029E5E-8CAA-F2E6-E132-D70EC55A2B96}\uninstp.dat, Quarantined, [57], [302717],1.0.3675
PUP.Optional.GameHack, C:\PROGRAM FILES (X86)\CHEAT ENGINE 6.6\STANDALONEPHASE1.DAT, Quarantined, [662], [393793],1.0.3675
PUP.Optional.GameHack, C:\PROGRAM FILES (X86)\CHEAT ENGINE 6.3\STANDALONEPHASE1.DAT, Quarantined, [662], [393793],1.0.3675
PUP.Optional.ByteFence, C:\WINDOWS\TEMP\BF_UPDATER_INSTALLER.EXE, Quarantined, [591], [389016],1.0.3675
PUP.Optional.InstallCore, C:\USERS\TERRY FELTER\DOWNLOADS\TEAMVIEWER SETUP.EXE, Quarantined, [2], [300868],1.0.3675

Physical Sector: 0
(No malicious items detected)

(end)

Scan result of Farbar Recovery Scan Tool (FRST) (x64) Version: 02.01.2018
Ran by [removed] (administrator) on TERRYFELTER-PC (11-01-2018 07:15:05)
Running from C:\Users\[removed]\Desktop
[removed] Platform: Windows 7 Home Premium Service Pack 1 (X64) Language: English (United States)
Internet Explorer Version 11 (Default browser: IE)
Boot Mode: Normal
Tutorial for Farbar Recovery Scan Tool: http://www.geekstogo.com/forum/topic/335081-frst-tutorial-how-to-use-farbar-recovery-scan-tool/

==================== Processes (Whitelisted) =================

(If an entry is included in the fixlist, the process will be closed. The file will not be moved.)

==================== Registry (Whitelisted) ===========================

(If an entry is included in the fixlist, the registry item will be restored to default or removed. The file will not be moved.)

HKLM\…\Run: [Apoint] => C:\Program Files\DellTPad\Apoint.exe [736552 2015-05-29] (Alps Electric Co., Ltd.)
HKLM\…\Run: [MSC] => c:\Program Files\Microsoft Security Client\msseces.exe [1353680 2016-11-14] (Microsoft Corporation)
HKLM\…\Run: [SysTrayApp] => C:\Program Files\IDT\WDM\sttray64.exe [1703424 2013-08-16] (IDT, Inc.)
HKLM-x32\…\Run: [IMSS] => C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\IMSS\PIconStartup.exe [134616 2013-11-13] (Intel Corporation)
HKLM-x32\…\Run: [USB3MON] => C:\Program Files (x86)\Intel\Intel(R) USB 3.0 eXtensible Host Controller Driver\Application\iusb3mon.exe [292088 2013-02-22] (Intel Corporation)
HKLM-x32\…\Run: [] => [X]
HKLM-x32\…\Run: [RoxWatchTray] => C:\Program Files (x86)\Common Files\Roxio Shared\9.0\SharedCOM\RoxWatchTray9.exe [221184 2006-10-27] (Sonic Solutions)
HKLM-x32\…\Run: [ISUSPM Startup] => C:\Program Files (x86)\Common Files\InstallShield\UpdateService\ISUSPM.exe [221184 2006-08-25] (Macrovision Corporation)
HKLM-x32\…\Run: [ISUSScheduler] => C:\Program Files (x86)\Common Files\InstallShield\UpdateService\issch.exe [81920 2006-08-25] (Macrovision Corporation)
HKLM-x32\…\Run: [APSDaemon] => C:\Program Files (x86)\Common Files\Apple\Apple Application Support\APSDaemon.exe [59720 2013-09-13] (Apple Inc.)
HKLM-x32\…\Run: [SDTray] => C:\Program Files (x86)\Spybot - Search & Destroy 2\SDTray.exe [4101576 2014-06-24] (Safer-Networking Ltd.)
HKLM-x32\…\Run: [TkBellExe] => c:\program files (x86)\real\realplayer\Update\realsched.exe [353104 2017-09-18] (RealNetworks, Inc.)
HKLM-x32\…\Run: [RealDownloader] => C:\program files (x86)\real\RealDownloader\downloader2.exe [1259704 2017-08-17] ()
HKLM-x32\…\Winlogon: [Userinit] <$SYSDIR>\userinit.exe,
Winlogon\Notify\SDWinLogon-x32: SDWinLogon.dll [X]
HKU\S-1-5-21-2367635994-1441107805-3879806124-1000\…\Run: [GUDelayStartup] => C:\Program Files (x86)\Glary Utilities 5\StartupManager.exe [44016 2018-01-07] (Glarysoft Ltd)
HKU\S-1-5-21-2367635994-1441107805-3879806124-1000\…\Run: [DellSystemDetect] => C:\Users\Terry Felter\AppData\Local\Apps\2.0\0R4EQAGX.Z5E\4QXKKBOM.0ZB\dell..tion_6d0a76327dca4869_0007.000b_df227eeaae3cac0d\DellSystemDetect.exe [310728 2016-12-29] (Dell)
HKU\S-1-5-21-2367635994-1441107805-3879806124-1000\…\Run: [SpybotPostWindows10UpgradeReInstall] => C:\Program Files\Common Files\AV\Spybot - Search and Destroy\Test.exe [1011200 2015-07-28] (Safer-Networking Ltd.)
HKU\S-1-5-21-2367635994-1441107805-3879806124-1000\…\Run: [SacReminderHDDV2] => C:\ProgramData\OfficeGuardianV2\reminder\SacReminder.exe [464752 2012-06-28] (SAC)
HKU\S-1-5-21-2367635994-1441107805-3879806124-1000\…\MountPoints2: {7b3f3c3d-fce9-11e6-992e-f01faf01a6d9} - E:\win\setup.exe -phs
HKU\S-1-5-21-2367635994-1441107805-3879806124-1000\…\MountPoints2: {ec19e8f8-b2aa-11e6-9b3d-f01faf01a6d9} - E:\StartClickFreeBackup.exe
HKU\S-1-5-21-2367635994-1441107805-3879806124-1000\Control Panel\Desktop\\SCRNSAVE.EXE -> C:\Windows\system32\scrnsave.scr [11264 2009-07-13] (Microsoft Corporation)
HKU\S-1-5-18\…\RunOnce: [SPReview] => "C:\Windows\System32\SPReview\SPReview.exe" /sp:1 /errorfwlink:"hxxp://go.microsoft.com/fwlink/?LinkID=122915" /build:7601
Startup: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\AutorunsDisabled [2016-11-25] ()
Startup: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\Microsoft Find Fast.lnk [2016-11-24]
ShortcutTarget: Microsoft Find Fast.lnk -> C:\Program Files (x86)\Microsoft Office\Office97\Office\FINDFAST.EXE ()
Startup: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\RealTimes.lnk [2017-09-18]
ShortcutTarget: RealTimes.lnk -> C:\Program Files (x86)\Real\RealPlayer\RPDS\Bin\rpsystray.exe (RealNetworks, Inc.)
BootExecute: autocheck autochk *

==================== Internet (Whitelisted) ====================

(If an item is included in the fixlist, if it is a registry item it will be removed or restored to default.)

Internet Explorer:
==================
HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = www.google.com
HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Start Page = www.google.com
SearchScopes: HKLM -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL =
SearchScopes: HKLM-x32 -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL =
SearchScopes: HKU\S-1-5-21-2367635994-1441107805-3879806124-1000 -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL =
BHO: RealNetworks Download and Record Plugin for Internet Explorer -> {3049C3E9-B461-4BC5-8870-4C09146192CA} -> C:\program files (x86)\real\RealDownloader\BrowserPlugins\IE\rndlbrowserrecordplugin64.dll [2017-08-17] (RealDownloader)
BHO-x32: RealNetworks Download and Record Plugin for Internet Explorer -> {3049C3E9-B461-4BC5-8870-4C09146192CA} -> C:\program files (x86)\real\RealDownloader\BrowserPlugins\IE\rndlbrowserrecordplugin.dll [2017-08-17] (RealDownloader)
DPF: HKLM-x32 {E06E2E99-0AA1-11D4-ABA6-0060082AA75C} hxxps://tradestation.webex.com/client/T31L/support/ieatgpc1.cab
Handler-x32: http - {E1D2BF42-A96B-11D1-9C6B-0000F875AC61} - C:\PROGRA~2\COMMON~1\System\OLEDB~1\MSDAIPP.DLL [1999-02-03] (Microsoft Corporation)
Handler-x32: http - {E1D2BF40-A96B-11D1-9C6B-0000F875AC61} - C:\PROGRA~2\COMMON~1\System\OLEDB~1\MSDAIPP.DLL [1999-02-03] (Microsoft Corporation)
Handler-x32: https - {E1D2BF42-A96B-11D1-9C6B-0000F875AC61} - C:\PROGRA~2\COMMON~1\System\OLEDB~1\MSDAIPP.DLL [1999-02-03] (Microsoft Corporation)
Handler-x32: https - {E1D2BF40-A96B-11D1-9C6B-0000F875AC61} - C:\PROGRA~2\COMMON~1\System\OLEDB~1\MSDAIPP.DLL [1999-02-03] (Microsoft Corporation)
Handler-x32: ipp - {E1D2BF42-A96B-11D1-9C6B-0000F875AC61} - C:\PROGRA~2\COMMON~1\System\OLEDB~1\MSDAIPP.DLL [1999-02-03] (Microsoft Corporation)
Handler-x32: msdaipp - {E1D2BF42-A96B-11D1-9C6B-0000F875AC61} - C:\PROGRA~2\COMMON~1\System\OLEDB~1\MSDAIPP.DLL [1999-02-03] (Microsoft Corporation)
Handler-x32: msdaipp - {E1D2BF40-A96B-11D1-9C6B-0000F875AC61} - C:\PROGRA~2\COMMON~1\System\OLEDB~1\MSDAIPP.DLL [1999-02-03] (Microsoft Corporation)
StartMenuInternet: IEXPLORE.EXE -

FireFox:
========
FF DefaultProfile: po0agpgk.default
FF ProfilePath: C:\Users\Terry Felter\AppData\Roaming\Mozilla\Firefox\Profiles\po0agpgk.default [2018-01-09]
FF Homepage: Mozilla\Firefox\Profiles\po0agpgk.default -> www.msn.com
FF NewTab: Mozilla\Firefox\Profiles\po0agpgk.default -> about:newtab
FF Extension: (Bing Search) - C:\Users\Terry Felter\AppData\Roaming\Mozilla\Firefox\Profiles\po0agpgk.default\Extensions\[removed] [2016-11-25] [Legacy]
FF Extension: (Disable JavaScript Shared Memory) - C:\Users\Terry Felter\AppData\Roaming\Mozilla\Firefox\Profiles\po0agpgk.default\features\{1fd245ec-2c2b-4ac1-96f0-7c54a4c4c515}\[removed] [2018-01-09] [Legacy]
FF SearchPlugin: C:\Users\Terry Felter\AppData\Roaming\Mozilla\Firefox\Profiles\po0agpgk.default\searchplugins\bing-.xml [2016-11-25]
FF Plugin: @microsoft.com/GENUINE -> disabled [No File]
FF Plugin: @Microsoft.com/NpCtrl,version=1.0 -> c:\Program Files\Microsoft Silverlight\5.1.50907.0\npctrl.dll [2017-05-03] ( Microsoft Corporation)
FF Plugin-x32: @intel-webapi.intel.com/Intel WebAPI ipt;version=4.0.5 -> C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\IPT\npIntelWebAPIIPT.dll [2013-11-13] (Intel Corporation)
FF Plugin-x32: @intel-webapi.intel.com/Intel WebAPI updater -> C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\IPT\npIntelWebAPIUpdater.dll [2013-11-13] (Intel Corporation)
FF Plugin-x32: @microsoft.com/GENUINE -> disabled [No File]
FF Plugin-x32: @Microsoft.com/NpCtrl,version=1.0 -> c:\Program Files (x86)\Microsoft Silverlight\5.1.50907.0\npctrl.dll [2017-05-03] ( Microsoft Corporation)
FF Plugin-x32: @real.com/nppl3260;version=18.1.9.106 -> c:\program files (x86)\real\realplayer\Netscape6\nppl3260.dll [2017-09-18] (RealNetworks, Inc.)
FF Plugin-x32: @real.com/nprpplugin;version=18.1.9.106 -> c:\program files (x86)\real\realplayer\Netscape6\nprpplugin.dll [2017-09-18] (RealPlayer)
FF Plugin-x32: @videolan.org/vlc,version=2.2.4 -> C:\Program Files (x86)\VideoLAN\VLC\npvlc.dll [2016-06-01] (VideoLAN)
FF Plugin-x32: Adobe Reader -> C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AIR\nppdf32.dll [2017-11-27] (Adobe Systems Inc.)
FF Plugin HKU\S-1-5-21-2367635994-1441107805-3879806124-1000: @zoom.us/ZoomVideoPlugin -> C:\Users\Terry Felter\AppData\Roaming\Zoom\bin\npzoomplugin.dll [2017-09-09] (Zoom Video Communications, Inc.)
FF Plugin HKU\S-1-5-21-2367635994-1441107805-3879806124-1000: jpl.nasa.gov/NASAEyes -> C:\Users\Terry Felter\AppData\Roaming\JPL-NASA-Caltech\NASA's Eyes\npNASAEyes.dll [2017-12-13] (Jet Propulsion Laboratory)
FF Plugin HKU\S-1-5-21-2367635994-1441107805-3879806124-1000: tdameritrade.com/thinkorswim -> C:\Program Files\thinkorswim\npthinkorswim.dll [2017-07-14] (TD Ameritrade)
FF Plugin HKU\S-1-5-21-2367635994-1441107805-3879806124-1000: tdameritrade.com/tossc -> C:\Program Files\thinkorswim\nptossc.dll [2017-07-14] (TD Ameritrade)

==================== Services (Whitelisted) ====================

(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)

S4 ApHidMonitorService; C:\Program Files\DellTPad\HidMonitorSvc.exe [96000 2015-09-25] (Alps Electric Co., Ltd.)
R2 BrcmMgmtAgent; C:\Program Files\Broadcom\MgmtAgent\BrcmMgmtAgent.exe [163840 2011-11-30] (Broadcom Corporation) [File not signed]
S3 IDriverT; C:\Program Files (x86)\Common Files\InstallShield\Driver\1050\Intel 32\IDriverT.exe [73728 2004-10-22] (Macrovision Corporation) [File not signed]
S4 igfxCUIService1.0.0.0; C:\Windows\system32\igfxCUIService.exe [319096 2016-06-15] (Intel Corporation)
S4 Intel(R) Capability Licensing Service Interface; C:\Program Files\Intel\iCLS Client\HeciServer.exe [747520 2013-08-27] (Intel(R) Corporation) [File not signed]
S4 Intel(R) Capability Licensing Service TCP IP Interface; C:\Program Files\Intel\iCLS Client\SocketHeciServer.exe [828376 2013-08-27] (Intel(R) Corporation)
S4 jhi_service; C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\DAL\jhi_service.exe [169432 2013-11-13] (Intel Corporation)
R2 MBAMService; C:\Program Files\Malwarebytes\Anti-Malware\mbamservice.exe [6234056 2017-11-01] (Malwarebytes)
R2 MsMpSvc; c:\Program Files\Microsoft Security Client\MsMpEng.exe [119864 2016-11-14] (Microsoft Corporation)
R3 NisSrv; c:\Program Files\Microsoft Security Client\NisSrv.exe [361816 2016-11-14] (Microsoft Corporation)
S4 RealPlayerUpdateSvc; C:\program files (x86)\real\UpdateService\RealPlayerUpdateSvc.exe [37104 2017-08-17] (RealNetworks, Inc.)
R2 RealTimes Desktop Service; c:\program files (x86)\real\realplayer\RPDS\Bin\rpdsvc.exe [989912 2017-09-18] (RealNetworks, Inc.)
S3 Roxio UPnP Renderer 9; C:\Program Files (x86)\Roxio\Digital Home 9\RoxioUPnPRenderer9.exe [57344 2006-10-26] (Sonic Solutions) [File not signed]
S2 Roxio Upnp Server 9; C:\Program Files (x86)\Roxio\Digital Home 9\RoxioUpnpService9.exe [294912 2006-10-26] (Sonic Solutions) [File not signed]
S2 RoxLiveShare9; C:\Program Files (x86)\Common Files\Roxio Shared\9.0\SharedCOM\RoxLiveShare9.exe [303104 2006-10-27] (Sonic Solutions) [File not signed]
S3 RoxMediaDB9; C:\Program Files (x86)\Common Files\Roxio Shared\9.0\SharedCOM\RoxMediaDB9.exe [880640 2006-10-27] (Sonic Solutions) [File not signed]
S2 RoxWatch9; C:\Program Files (x86)\Common Files\Roxio Shared\9.0\SharedCOM\RoxWatch9.exe [159744 2006-10-27] (Sonic Solutions) [File not signed]
R2 SDScannerService; C:\Program Files (x86)\Spybot - Search & Destroy 2\SDFSSvc.exe [1738168 2014-06-24] (Safer-Networking Ltd.)
R2 SDUpdateService; C:\Program Files (x86)\Spybot - Search & Destroy 2\SDUpdSvc.exe [4088608 2016-09-21] (Safer-Networking Ltd.) [File not signed]
R2 SDWSCService; C:\Program Files (x86)\Spybot - Search & Destroy 2\SDWSCSvc.exe [235984 2016-11-24] (Safer-Networking Ltd.) [File not signed]
S3 WinDefend; C:\Program Files\Windows Defender\mpsvc.dll [1011712 2013-05-26] (Microsoft Corporation)
S4 wltrysvc; C:\Program Files\Dell\DW WLAN Card\bcmwltry.exe [6177280 2014-01-14] (Dell Inc.) [File not signed]
R2 CFUACProxy_officeguardianv2; "C:\ProgramData\OfficeGuardianV2\UACProxy.exe" -s "-pC:\ProgramData\OfficeGuardianV2"

===================== Drivers (Whitelisted) ======================

(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)

S3 dg_ssudbus; C:\Windows\System32\DRIVERS\ssudbus.sys [131712 2016-09-05] (Samsung Electronics Co., Ltd.)
R1 GUBootStartup; C:\Windows\System32\drivers\GUBootStartup.sys [20160 2016-11-27] (Glarysoft Ltd)
R0 MBAMSwissArmy; C:\Windows\System32\Drivers\mbamswissarmy.sys [253880 2018-01-11] (Malwarebytes)
R3 MEIx64; C:\Windows\System32\DRIVERS\TeeDriverx64.sys [99288 2013-11-13] (Intel Corporation)
R0 MpFilter; C:\Windows\System32\DRIVERS\MpFilter.sys [295000 2016-08-25] (Microsoft Corporation)
R3 NisDrv; C:\Windows\System32\DRIVERS\NisDrvWFP.sys [135928 2016-08-25] (Microsoft Corporation)
S1 RxFilter; C:\Windows\System32\DRIVERS\RxFilter.sys [58880 2006-10-27] (Sonic Solutions) [File not signed]
S1 RxFilter; C:\Windows\SysWOW64\DRIVERS\RxFilter.sys [58880 2006-10-27] (Sonic Solutions) [File not signed]
R3 ST_ACCEL; C:\Windows\System32\DRIVERS\ST_Accel.sys [89312 2013-03-27] (STMicroelectronics)
S3 swHSnet00; C:\Windows\System32\DRIVERS\swHSnet00.sys [376264 2012-12-19] (Sierra Wireless Incorporated)
S3 swHSser00; C:\Windows\System32\DRIVERS\swHSser00.sys [269512 2012-12-19] (Sierra Wireless Incorporated)
S3 swiwdmbx; C:\Windows\System32\DRIVERS\swiwdmbx.sys [114424 2012-12-19] (Sierra Wireless Inc.)
S3 swiwdmbxhs; C:\Windows\System32\DRIVERS\swiwdmbxhs.sys [114424 2012-12-19] (Sierra Wireless Inc.)
S3 NAVENG; \??\C:\Program Files (x86)\Norton Security\NortonData\22.7.0.76\Definitions\SDSDefs\20170918.019\ENG64.SYS [X]
S3 NAVEX15; \??\C:\Program Files (x86)\Norton Security\NortonData\22.7.0.76\Definitions\SDSDefs\20170918.019\EX64.SYS [X]

==================== NetSvcs (Whitelisted) ===================

(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)

==================== One Month Created files and folders ========

(If an entry is included in the fixlist, the file/folder will be moved.)

2018-01-11 06:52 - 2018-01-11 06:52 - 000253880 _____ (Malwarebytes) C:\Windows\system32\Drivers\mbamswissarmy.sys
2018-01-11 06:51 - 2018-01-11 06:51 - 000001873 _____ C:\Users\Public\Desktop\Malwarebytes.lnk
2018-01-11 06:51 - 2018-01-11 06:51 - 000000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Malwarebytes
2018-01-11 06:51 - 2018-01-11 06:51 - 000000000 ____D C:\ProgramData\MB2Migration
2018-01-11 06:51 - 2018-01-11 06:51 - 000000000 ____D C:\Program Files\Malwarebytes
2018-01-11 06:51 - 2017-11-29 09:11 - 000077432 _____ C:\Windows\system32\Drivers\mbae64.sys
2018-01-11 06:30 - 2018-01-11 06:31 - 008198432 _____ (Malwarebytes) C:\Users\Terry Felter\Desktop\adwcleaner_7.0.6.0.exe
2018-01-10 17:29 - 2018-01-10 17:30 - 000054919 _____ C:\Users\Terry Felter\Desktop\Addition.txt
2018-01-10 17:26 - 2018-01-11 07:17 - 000018451 _____ C:\Users\Terry Felter\Desktop\FRST.txt
2018-01-10 17:25 - 2018-01-11 07:15 - 000000000 ____D C:\FRST
2018-01-10 17:24 - 2018-01-10 17:24 - 002393088 _____ (Farbar) C:\Users\Terry Felter\Desktop\FRST64.exe
2018-01-10 11:03 - 2018-01-10 11:03 - 000000000 ____D C:\Users\Terry Felter\AppData\Local\GoTo Opener
2018-01-08 06:16 - 2017-12-31 20:21 - 005581544 _____ (Microsoft Corporation) C:\Windows\system32\ntoskrnl.exe
2018-01-08 06:16 - 2017-12-31 20:21 - 001680616 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\ntfs.sys
2018-01-08 06:16 - 2017-12-31 20:21 - 000948968 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\ndis.sys
2018-01-08 06:16 - 2017-12-31 20:21 - 000708328 _____ (Microsoft Corporation) C:\Windows\system32\winload.efi
2018-01-08 06:16 - 2017-12-31 20:21 - 000288488 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\fltMgr.sys
2018-01-08 06:16 - 2017-12-31 20:21 - 000262376 _____ (Microsoft Corporation) C:\Windows\system32\hal.dll
2018-01-08 06:16 - 2017-12-31 20:21 - 000213736 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\rdyboost.sys
2018-01-08 06:16 - 2017-12-31 20:21 - 000154856 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\ksecpkg.sys
2018-01-08 06:16 - 2017-12-31 20:21 - 000114408 _____ (Microsoft Corporation) C:\Windows\system32\consent.exe
2018-01-08 06:16 - 2017-12-31 20:21 - 000095464 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\ksecdd.sys
2018-01-08 06:16 - 2017-12-31 20:19 - 001665384 _____ (Microsoft Corporation) C:\Windows\system32\ntdll.dll
2018-01-08 06:16 - 2017-12-31 20:18 - 014183936 _____ (Microsoft Corporation) C:\Windows\system32\shell32.dll
2018-01-08 06:16 - 2017-12-31 20:18 - 002066432 _____ (Microsoft Corporation) C:\Windows\system32\ole32.dll
2018-01-08 06:16 - 2017-12-31 20:18 - 002004480 _____ (Microsoft Corporation) C:\Windows\system32\msxml6.dll
2018-01-08 06:16 - 2017-12-31 20:18 - 001942016 _____ (Microsoft Corporation) C:\Windows\system32\authui.dll
2018-01-08 06:16 - 2017-12-31 20:18 - 001867776 _____ (Microsoft Corporation) C:\Windows\system32\ExplorerFrame.dll
2018-01-08 06:16 - 2017-12-31 20:18 - 001741312 _____ (Microsoft Corporation) C:\Windows\system32\sysmain.dll
2018-01-08 06:16 - 2017-12-31 20:18 - 001460736 _____ (Microsoft Corporation) C:\Windows\system32\lsasrv.dll
2018-01-08 06:16 - 2017-12-31 20:18 - 001212928 _____ (Microsoft Corporation) C:\Windows\system32\rpcrt4.dll
2018-01-08 06:16 - 2017-12-31 20:18 - 001163264 _____ (Microsoft Corporation) C:\Windows\system32\kernel32.dll
2018-01-08 06:16 - 2017-12-31 20:18 - 001110528 _____ (Microsoft Corporation) C:\Windows\system32\schedsvc.dll
2018-01-08 06:16 - 2017-12-31 20:18 - 000977408 _____ (Microsoft Corporation) C:\Windows\system32\inetcomm.dll
2018-01-08 06:16 - 2017-12-31 20:18 - 000961024 _____ (Microsoft Corporation) C:\Windows\system32\actxprxy.dll
2018-01-08 06:16 - 2017-12-31 20:18 - 000880640 _____ (Microsoft Corporation) C:\Windows\system32\advapi32.dll
2018-01-08 06:16 - 2017-12-31 20:18 - 000863232 _____ (Microsoft Corporation) C:\Windows\system32\IKEEXT.DLL
2018-01-08 06:16 - 2017-12-31 20:18 - 000842752 _____ (Microsoft Corporation) C:\Windows\system32\nshwfp.dll
2018-01-08 06:16 - 2017-12-31 20:18 - 000828928 _____ (Microsoft Corporation) C:\Windows\system32\MPSSVC.dll
2018-01-08 06:16 - 2017-12-31 20:18 - 000749568 _____ (Microsoft Corporation) C:\Windows\system32\FirewallAPI.dll
2018-01-08 06:16 - 2017-12-31 20:18 - 000705024 _____ (Microsoft Corporation) C:\Windows\system32\BFE.DLL
2018-01-08 06:16 - 2017-12-31 20:18 - 000512000 _____ (Microsoft Corporation) C:\Windows\system32\rpcss.dll
2018-01-08 06:16 - 2017-12-31 20:18 - 000503808 _____ (Microsoft Corporation) C:\Windows\system32\srcore.dll
2018-01-08 06:16 - 2017-12-31 20:18 - 000473600 _____ (Microsoft Corporation) C:\Windows\system32\taskcomp.dll
2018-01-08 06:16 - 2017-12-31 20:18 - 000463872 _____ (Microsoft Corporation) C:\Windows\system32\certcli.dll
2018-01-08 06:16 - 2017-12-31 20:18 - 000444928 _____ (Microsoft Corporation) C:\Windows\system32\winhttp.dll
2018-01-08 06:16 - 2017-12-31 20:18 - 000439296 _____ (Microsoft Corporation) C:\Windows\system32\p2psvc.dll
2018-01-08 06:16 - 2017-12-31 20:18 - 000419840 _____ (Microsoft Corporation) C:\Windows\system32\KernelBase.dll
2018-01-08 06:16 - 2017-12-31 20:18 - 000366592 _____ (Microsoft Corporation) C:\Windows\system32\wcncsvc.dll
2018-01-08 06:16 - 2017-12-31 20:18 - 000361984 _____ (Microsoft Corporation) C:\Windows\system32\wow64win.dll
2018-01-08 06:16 - 2017-12-31 20:18 - 000327168 _____ (Microsoft Corporation) C:\Windows\system32\pnrpsvc.dll
2018-01-08 06:16 - 2017-12-31 20:18 - 000324096 _____ (Microsoft Corporation) C:\Windows\system32\FWPUCLNT.DLL
2018-01-08 06:16 - 2017-12-31 20:18 - 000303104 _____ (Microsoft Corporation) C:\Windows\system32\nlasvc.dll
2018-01-08 06:16 - 2017-12-31 20:18 - 000264704 _____ (Microsoft Corporation) C:\Windows\system32\P2P.dll
2018-01-08 06:16 - 2017-12-31 20:18 - 000243712 _____ (Microsoft Corporation) C:\Windows\system32\wow64.dll
2018-01-08 06:16 - 2017-12-31 20:18 - 000223232 _____ (Microsoft Corporation) C:\Windows\system32\ncsi.dll
2018-01-08 06:16 - 2017-12-31 20:18 - 000120320 _____ (Microsoft Corporation) C:\Windows\system32\WcnApi.dll
2018-01-08 06:16 - 2017-12-31 20:18 - 000108544 _____ (Microsoft Corporation) C:\Windows\system32\icfupgd.dll
2018-01-08 06:16 - 2017-12-31 20:18 - 000101376 _____ (Microsoft Corporation) C:\Windows\system32\fdWCN.dll
2018-01-08 06:16 - 2017-12-31 20:18 - 000095744 _____ (Microsoft Corporation) C:\Windows\system32\rascfg.dll
2018-01-08 06:16 - 2017-12-31 20:18 - 000076288 _____ (Microsoft Corporation) C:\Windows\system32\rasdiag.dll
2018-01-08 06:16 - 2017-12-31 20:18 - 000070656 _____ (Microsoft Corporation) C:\Windows\system32\nlaapi.dll
2018-01-08 06:16 - 2017-12-31 20:18 - 000070144 _____ (Microsoft Corporation) C:\Windows\system32\appinfo.dll
2018-01-08 06:16 - 2017-12-31 20:18 - 000060928 _____ (Microsoft Corporation) C:\Windows\system32\ndptsp.tsp
2018-01-08 06:16 - 2017-12-31 20:18 - 000047104 _____ (Microsoft Corporation) C:\Windows\system32\kmddsp.tsp
2018-01-08 06:16 - 2017-12-31 20:18 - 000044032 _____ (Microsoft Corporation) C:\Windows\system32\csrsrv.dll
2018-01-08 06:16 - 2017-12-31 20:18 - 000041472 _____ (Microsoft Corporation) C:\Windows\system32\rasmxs.dll
2018-01-08 06:16 - 2017-12-31 20:18 - 000039424 _____ (Microsoft Corporation) C:\Windows\system32\traffic.dll
2018-01-08 06:16 - 2017-12-31 20:18 - 000029696 _____ (Microsoft Corporation) C:\Windows\system32\rasser.dll
2018-01-08 06:16 - 2017-12-31 20:18 - 000024576 _____ (Microsoft Corporation) C:\Windows\system32\WcnEapPeerProxy.dll
2018-01-08 06:16 - 2017-12-31 20:18 - 000024064 _____ (Microsoft Corporation) C:\Windows\system32\WcnEapAuthProxy.dll
2018-01-08 06:16 - 2017-12-31 20:18 - 000022528 _____ (Microsoft Corporation) C:\Windows\system32\wfapigp.dll
2018-01-08 06:16 - 2017-12-31 20:18 - 000016896 _____ (Microsoft Corporation) C:\Windows\system32\wshqos.dll
2018-01-08 06:16 - 2017-12-31 20:13 - 000631680 _____ (Microsoft Corporation) C:\Windows\system32\winresume.efi
2018-01-08 06:16 - 2017-12-31 20:04 - 000559616 _____ (Microsoft Corporation) C:\Windows\system32\spoolsv.exe
2018-01-08 06:16 - 2017-12-31 20:02 - 001314112 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ntdll.dll
2018-01-08 06:16 - 2017-12-31 20:00 - 012880384 _____ (Microsoft Corporation) C:\Windows\SysWOW64\shell32.dll
2018-01-08 06:16 - 2017-12-31 20:00 - 001499648 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ExplorerFrame.dll
2018-01-08 06:16 - 2017-12-31 20:00 - 001417728 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ole32.dll
2018-01-08 06:16 - 2017-12-31 20:00 - 001390080 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msxml6.dll
2018-01-08 06:16 - 2017-12-31 20:00 - 001114112 _____ (Microsoft Corporation) C:\Windows\SysWOW64\kernel32.dll
2018-01-08 06:16 - 2017-12-31 20:00 - 000741888 _____ (Microsoft Corporation) C:\Windows\SysWOW64\inetcomm.dll
2018-01-08 06:16 - 2017-12-31 20:00 - 000666624 _____ (Microsoft Corporation) C:\Windows\SysWOW64\nshwfp.dll
2018-01-08 06:16 - 2017-12-31 20:00 - 000666112 _____ (Microsoft Corporation) C:\Windows\SysWOW64\rpcrt4.dll
2018-01-08 06:16 - 2017-12-31 20:00 - 000554496 _____ (Microsoft Corporation) C:\Windows\SysWOW64\kerberos.dll
2018-01-08 06:16 - 2017-12-31 20:00 - 000463360 _____ (Microsoft Corporation) C:\Windows\SysWOW64\FirewallAPI.dll
2018-01-08 06:16 - 2017-12-31 20:00 - 000351744 _____ (Microsoft Corporation) C:\Windows\SysWOW64\winhttp.dll
2018-01-08 06:16 - 2017-12-31 20:00 - 000304640 _____ (Microsoft Corporation) C:\Windows\SysWOW64\taskcomp.dll
2018-01-08 06:16 - 2017-12-31 20:00 - 000276992 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wcncsvc.dll
2018-01-08 06:16 - 2017-12-31 20:00 - 000275456 _____ (Microsoft Corporation) C:\Windows\SysWOW64\KernelBase.dll
2018-01-08 06:16 - 2017-12-31 20:00 - 000261120 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msv1_0.dll
2018-01-08 06:16 - 2017-12-31 20:00 - 000217600 _____ (Microsoft Corporation) C:\Windows\SysWOW64\P2P.dll
2018-01-08 06:16 - 2017-12-31 20:00 - 000216576 _____ (Microsoft Corporation) C:\Windows\SysWOW64\FWPUCLNT.DLL
2018-01-08 06:16 - 2017-12-31 20:00 - 000162304 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ncsi.dll
2018-01-08 06:16 - 2017-12-31 20:00 - 000141312 _____ (Microsoft Corporation) C:\Windows\SysWOW64\rpchttp.dll
2018-01-08 06:16 - 2017-12-31 20:00 - 000096768 _____ (Microsoft Corporation) C:\Windows\SysWOW64\sspicli.dll
2018-01-08 06:16 - 2017-12-31 20:00 - 000081920 _____ (Microsoft Corporation) C:\Windows\SysWOW64\fdWCN.dll
2018-01-08 06:16 - 2017-12-31 20:00 - 000081408 _____ (Microsoft Corporation) C:\Windows\SysWOW64\rascfg.dll
2018-01-08 06:16 - 2017-12-31 20:00 - 000061952 _____ (Microsoft Corporation) C:\Windows\SysWOW64\rasdiag.dll
2018-01-08 06:16 - 2017-12-31 20:00 - 000052224 _____ (Microsoft Corporation) C:\Windows\SysWOW64\nlaapi.dll
2018-01-08 06:16 - 2017-12-31 20:00 - 000050688 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ndptsp.tsp
2018-01-08 06:16 - 2017-12-31 20:00 - 000033280 _____ (Microsoft Corporation) C:\Windows\SysWOW64\traffic.dll
2018-01-08 06:16 - 2017-12-31 19:59 - 001806848 _____ (Microsoft Corporation) C:\Windows\SysWOW64\authui.dll
2018-01-08 06:16 - 2017-12-31 19:59 - 000644096 _____ (Microsoft Corporation) C:\Windows\SysWOW64\advapi32.dll
2018-01-08 06:16 - 2017-12-31 19:59 - 000342528 _____ (Microsoft Corporation) C:\Windows\SysWOW64\certcli.dll
2018-01-08 06:16 - 2017-12-31 19:59 - 000309760 _____ (Microsoft Corporation) C:\Windows\SysWOW64\actxprxy.dll
2018-01-08 06:16 - 2017-12-31 19:55 - 000131584 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\pacer.sys
2018-01-08 06:16 - 2017-12-31 19:55 - 000088576 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\wanarp.sys
2018-01-08 06:16 - 2017-12-31 19:55 - 000058368 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\ndproxy.sys
2018-01-08 06:16 - 2017-12-31 19:55 - 000045056 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\netbios.sys
2018-01-08 06:16 - 2017-12-31 19:55 - 000024064 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\ndistapi.sys
2018-01-08 06:16 - 2017-12-31 19:54 - 004013800 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ntkrnlpa.exe
2018-01-08 06:16 - 2017-12-31 19:54 - 003959016 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ntoskrnl.exe
2018-01-08 06:16 - 2017-12-31 19:54 - 000077312 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\mpsdrv.sys
2018-01-08 06:16 - 2017-12-31 19:50 - 000455680 _____ (Microsoft Corporation) C:\Windows\system32\winlogon.exe
2018-01-08 06:16 - 2017-12-31 19:49 - 000062464 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\appid.sys
2018-01-08 06:16 - 2017-12-31 19:43 - 000086528 _____ (Microsoft Corporation) C:\Windows\SysWOW64\WcnApi.dll
2018-01-08 06:16 - 2017-12-31 19:43 - 000038912 _____ (Microsoft Corporation) C:\Windows\SysWOW64\kmddsp.tsp
2018-01-08 06:16 - 2017-12-31 19:43 - 000033280 _____ (Microsoft Corporation) C:\Windows\SysWOW64\rasmxs.dll
2018-01-08 06:16 - 2017-12-31 19:43 - 000022528 _____ (Microsoft Corporation) C:\Windows\SysWOW64\rasser.dll
2018-01-08 06:16 - 2017-12-31 19:43 - 000018944 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wfapigp.dll
2018-01-08 06:16 - 2017-12-31 19:42 - 000460288 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\srv.sys
2018-01-08 06:16 - 2017-12-31 19:42 - 000406016 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\srv2.sys
2018-01-08 06:16 - 2017-12-31 19:42 - 000168448 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\srvnet.sys
2018-01-08 06:16 - 2017-12-31 19:42 - 000159744 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\mrxsmb.sys
2018-01-08 06:16 - 2017-12-31 19:41 - 000754176 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\http.sys
2018-01-08 06:16 - 2017-12-31 19:41 - 000291328 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\mrxsmb10.sys
2018-01-08 06:16 - 2017-12-31 19:41 - 000106496 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\dfsc.sys
2018-01-08 06:16 - 2017-12-31 19:36 - 000025600 _____ (Microsoft Corporation) C:\Windows\SysWOW64\setup16.exe
2018-01-08 06:16 - 2017-12-30 01:29 - 000395968 _____ (Microsoft Corporation) C:\Windows\system32\iedkcs32.dll
2018-01-08 06:16 - 2017-12-30 00:42 - 000347328 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iedkcs32.dll
2018-01-08 06:16 - 2017-12-29 12:39 - 020274688 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.dll
2018-01-08 06:16 - 2017-12-29 12:13 - 000499712 _____ (Microsoft Corporation) C:\Windows\SysWOW64\vbscript.dll
2018-01-08 06:16 - 2017-12-29 12:12 - 000341504 _____ (Microsoft Corporation) C:\Windows\SysWOW64\html.iec
2018-01-08 06:16 - 2017-12-29 12:09 - 002294272 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iertutil.dll
2018-01-08 06:16 - 2017-12-29 12:04 - 000476160 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieui.dll
2018-01-08 06:16 - 2017-12-29 12:03 - 000662528 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript.dll
2018-01-08 06:16 - 2017-12-29 11:55 - 000416256 _____ (Microsoft Corporation) C:\Windows\SysWOW64\dxtmsft.dll
2018-01-08 06:16 - 2017-12-29 11:47 - 000168960 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msrating.dll
2018-01-08 06:16 - 2017-12-29 11:46 - 000279040 _____ (Microsoft Corporation) C:\Windows\SysWOW64\dxtrans.dll
2018-01-08 06:16 - 2017-12-29 11:45 - 004508160 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript9.dll
2018-01-08 06:16 - 2017-12-29 11:39 - 000230400 _____ (Microsoft Corporation) C:\Windows\SysWOW64\webcheck.dll
2018-01-08 06:16 - 2017-12-29 11:38 - 013680128 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieframe.dll
2018-01-08 06:16 - 2017-12-29 11:38 - 000694272 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msfeeds.dll
2018-01-08 06:16 - 2017-12-29 11:37 - 002058752 _____ (Microsoft Corporation) C:\Windows\SysWOW64\inetcpl.cpl
2018-01-08 06:16 - 2017-12-29 11:36 - 001155072 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtmlmedia.dll
2018-01-08 06:16 - 2017-12-29 11:19 - 002767872 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wininet.dll
2018-01-08 06:16 - 2017-12-29 11:15 - 001313792 _____ (Microsoft Corporation) C:\Windows\SysWOW64\urlmon.dll
2018-01-08 06:16 - 2017-12-29 11:13 - 000710144 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieapfltr.dll
2018-01-08 06:16 - 2017-12-29 03:15 - 025737728 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.dll
2018-01-08 06:16 - 2017-12-29 02:52 - 002900480 _____ (Microsoft Corporation) C:\Windows\system32\iertutil.dll
2018-01-08 06:16 - 2017-12-29 02:51 - 005796352 _____ (Microsoft Corporation) C:\Windows\system32\jscript9.dll
2018-01-08 06:16 - 2017-12-29 02:50 - 000577024 _____ (Microsoft Corporation) C:\Windows\system32\vbscript.dll
2018-01-08 06:16 - 2017-12-29 02:50 - 000417280 _____ (Microsoft Corporation) C:\Windows\system32\html.iec
2018-01-08 06:16 - 2017-12-29 02:40 - 000615936 _____ (Microsoft Corporation) C:\Windows\system32\ieui.dll
2018-01-08 06:16 - 2017-12-29 02:39 - 000817152 _____ (Microsoft Corporation) C:\Windows\system32\jscript.dll
2018-01-08 06:16 - 2017-12-29 02:39 - 000814080 _____ (Microsoft Corporation) C:\Windows\system32\jscript9diag.dll
2018-01-08 06:16 - 2017-12-29 02:39 - 000116224 _____ (Microsoft Corporation) C:\Windows\system32\ieetwcollector.exe
2018-01-08 06:16 - 2017-12-29 02:32 - 000969216 _____ (Microsoft Corporation) C:\Windows\system32\MsSpellCheckingFacility.exe
2018-01-08 06:16 - 2017-12-29 02:28 - 000489984 _____ (Microsoft Corporation) C:\Windows\system32\dxtmsft.dll
2018-01-08 06:16 - 2017-12-29 02:18 - 000199680 _____ (Microsoft Corporation) C:\Windows\system32\msrating.dll
2018-01-08 06:16 - 2017-12-29 02:16 - 000315392 _____ (Microsoft Corporation) C:\Windows\system32\dxtrans.dll
2018-01-08 06:16 - 2017-12-29 02:05 - 000262144 _____ (Microsoft Corporation) C:\Windows\system32\webcheck.dll
2018-01-08 06:16 - 2017-12-29 02:04 - 015284224 _____ (Microsoft Corporation) C:\Windows\system32\ieframe.dll
2018-01-08 06:16 - 2017-12-29 02:03 - 000807936 _____ (Microsoft Corporation) C:\Windows\system32\msfeeds.dll
2018-01-08 06:16 - 2017-12-29 02:03 - 000726528 _____ (Microsoft Corporation) C:\Windows\system32\ie4uinit.exe
2018-01-08 06:16 - 2017-12-29 02:01 - 002134528 _____ (Microsoft Corporation) C:\Windows\system32\inetcpl.cpl
2018-01-08 06:16 - 2017-12-29 02:01 - 001359360 _____ (Microsoft Corporation) C:\Windows\system32\mshtmlmedia.dll
2018-01-08 06:16 - 2017-12-29 01:50 - 003241472 _____ (Microsoft Corporation) C:\Windows\system32\wininet.dll
2018-01-08 06:16 - 2017-12-29 01:39 - 001545728 _____ (Microsoft Corporation) C:\Windows\system32\urlmon.dll
2018-01-08 06:16 - 2017-12-29 01:27 - 000800768 _____ (Microsoft Corporation) C:\Windows\system32\ieapfltr.dll
2018-01-08 06:16 - 2017-12-21 00:27 - 000634312 _____ (Microsoft Corporation) C:\Windows\system32\winload.exe
2018-01-08 06:16 - 2017-12-13 10:31 - 000383720 _____ (Adobe Systems Incorporated) C:\Windows\system32\atmfd.dll
2018-01-08 06:16 - 2017-12-13 10:27 - 000100864 _____ (Microsoft Corporation) C:\Windows\system32\fontsub.dll
2018-01-08 06:16 - 2017-12-13 10:15 - 000309480 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\atmfd.dll
2018-01-08 06:16 - 2017-12-13 10:11 - 000071168 _____ (Microsoft Corporation) C:\Windows\SysWOW64\fontsub.dll
2018-01-08 06:16 - 2017-12-13 09:50 - 000034304 _____ (Adobe Systems) C:\Windows\SysWOW64\atmlib.dll
2018-01-08 06:16 - 2017-12-05 11:36 - 000625664 _____ (Microsoft Corporation) C:\Windows\system32\mscms.dll
2018-01-08 06:16 - 2017-12-05 11:36 - 000250880 _____ (Microsoft Corporation) C:\Windows\system32\icm32.dll
2018-01-08 06:16 - 2017-12-05 11:08 - 000481792 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mscms.dll
2018-01-08 06:16 - 2017-12-05 11:08 - 000215040 _____ (Microsoft Corporation) C:\Windows\SysWOW64\icm32.dll
2018-01-08 06:15 - 2017-12-31 20:18 - 000731648 _____ (Microsoft Corporation) C:\Windows\system32\kerberos.dll
2018-01-08 06:15 - 2017-12-31 20:18 - 000690688 _____ (Microsoft Corporation) C:\Windows\system32\adtschema.dll
2018-01-08 06:15 - 2017-12-31 20:18 - 000345600 _____ (Microsoft Corporation) C:\Windows\system32\schannel.dll
2018-01-08 06:15 - 2017-12-31 20:18 - 000316928 _____ (Microsoft Corporation) C:\Windows\system32\msv1_0.dll
2018-01-08 06:15 - 2017-12-31 20:18 - 000312320 _____ (Microsoft Corporation) C:\Windows\system32\ncrypt.dll
2018-01-08 06:15 - 2017-12-31 20:18 - 000215552 _____ (Microsoft Corporation) C:\Windows\system32\winsrv.dll
2018-01-08 06:15 - 2017-12-31 20:18 - 000210432 _____ (Microsoft Corporation) C:\Windows\system32\wdigest.dll
2018-01-08 06:15 - 2017-12-31 20:18 - 000190464 _____ (Microsoft Corporation) C:\Windows\system32\rpchttp.dll
2018-01-08 06:15 - 2017-12-31 20:18 - 000146432 _____ (Microsoft Corporation) C:\Windows\system32\msaudite.dll
2018-01-08 06:15 - 2017-12-31 20:18 - 000135680 _____ (Microsoft Corporation) C:\Windows\system32\sspicli.dll
2018-01-08 06:15 - 2017-12-31 20:18 - 000123904 _____ (Microsoft Corporation) C:\Windows\system32\bcrypt.dll
2018-01-08 06:15 - 2017-12-31 20:18 - 000086528 _____ (Microsoft Corporation) C:\Windows\system32\TSpkg.dll
2018-01-08 06:15 - 2017-12-31 20:18 - 000084480 _____ (Microsoft Corporation) C:\Windows\system32\INETRES.dll
2018-01-08 06:15 - 2017-12-31 20:18 - 000063488 _____ (Microsoft Corporation) C:\Windows\system32\setbcdlocale.dll
2018-01-08 06:15 - 2017-12-31 20:18 - 000060416 _____ (Microsoft Corporation) C:\Windows\system32\msobjs.dll
2018-01-08 06:15 - 2017-12-31 20:18 - 000059904 _____ (Microsoft Corporation) C:\Windows\system32\appidapi.dll
2018-01-08 06:15 - 2017-12-31 20:18 - 000050176 _____ (Microsoft Corporation) C:\Windows\system32\srclient.dll
2018-01-08 06:15 - 2017-12-31 20:18 - 000043520 _____ (Microsoft Corporation) C:\Windows\system32\cryptbase.dll
2018-01-08 06:15 - 2017-12-31 20:18 - 000034816 _____ (Microsoft Corporation) C:\Windows\system32\appidsvc.dll
2018-01-08 06:15 - 2017-12-31 20:18 - 000028672 _____ (Microsoft Corporation) C:\Windows\system32\sspisrv.dll
2018-01-08 06:15 - 2017-12-31 20:18 - 000028160 _____ (Microsoft Corporation) C:\Windows\system32\secur32.dll
2018-01-08 06:15 - 2017-12-31 20:18 - 000026112 _____ (Microsoft Corporation) C:\Windows\system32\oleres.dll
2018-01-08 06:15 - 2017-12-31 20:18 - 000022016 _____ (Microsoft Corporation) C:\Windows\system32\credssp.dll
2018-01-08 06:15 - 2017-12-31 20:18 - 000016384 _____ (Microsoft Corporation) C:\Windows\system32\ntvdm64.dll
2018-01-08 06:15 - 2017-12-31 20:18 - 000013312 _____ (Microsoft Corporation) C:\Windows\system32\wshnetbs.dll
2018-01-08 06:15 - 2017-12-31 20:18 - 000013312 _____ (Microsoft Corporation) C:\Windows\system32\wow64cpu.dll
2018-01-08 06:15 - 2017-12-31 20:18 - 000008704 _____ (Microsoft Corporation) C:\Windows\system32\comcat.dll
2018-01-08 06:15 - 2017-12-31 20:18 - 000006656 _____ (Microsoft Corporation) C:\Windows\system32\apisetschema.dll
2018-01-08 06:15 - 2017-12-31 20:18 - 000006144 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-security-base-l1-1-0.dll
2018-01-08 06:15 - 2017-12-31 20:18 - 000005120 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-file-l1-1-0.dll
2018-01-08 06:15 - 2017-12-31 20:18 - 000004608 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-threadpool-l1-1-0.dll
2018-01-08 06:15 - 2017-12-31 20:18 - 000004608 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-processthreads-l1-1-0.dll
2018-01-08 06:15 - 2017-12-31 20:18 - 000004096 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-sysinfo-l1-1-0.dll
2018-01-08 06:15 - 2017-12-31 20:18 - 000004096 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-synch-l1-1-0.dll
2018-01-08 06:15 - 2017-12-31 20:18 - 000004096 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-localregistry-l1-1-0.dll
2018-01-08 06:15 - 2017-12-31 20:18 - 000004096 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-localization-l1-1-0.dll
2018-01-08 06:15 - 2017-12-31 20:18 - 000003584 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-rtlsupport-l1-1-0.dll
2018-01-08 06:15 - 2017-12-31 20:18 - 000003584 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-processenvironment-l1-1-0.dll
2018-01-08 06:15 - 2017-12-31 20:18 - 000003584 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-namedpipe-l1-1-0.dll
2018-01-08 06:15 - 2017-12-31 20:18 - 000003584 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-misc-l1-1-0.dll
2018-01-08 06:15 - 2017-12-31 20:18 - 000003584 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-memory-l1-1-0.dll
2018-01-08 06:15 - 2017-12-31 20:18 - 000003584 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-libraryloader-l1-1-0.dll
2018-01-08 06:15 - 2017-12-31 20:18 - 000003584 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-heap-l1-1-0.dll
2018-01-08 06:15 - 2017-12-31 20:18 - 000003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-xstate-l1-1-0.dll
2018-01-08 06:15 - 2017-12-31 20:18 - 000003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-util-l1-1-0.dll
2018-01-08 06:15 - 2017-12-31 20:18 - 000003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-string-l1-1-0.dll
2018-01-08 06:15 - 2017-12-31 20:18 - 000003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-profile-l1-1-0.dll
2018-01-08 06:15 - 2017-12-31 20:18 - 000003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-io-l1-1-0.dll
2018-01-08 06:15 - 2017-12-31 20:18 - 000003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-interlocked-l1-1-0.dll
2018-01-08 06:15 - 2017-12-31 20:18 - 000003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-handle-l1-1-0.dll
2018-01-08 06:15 - 2017-12-31 20:18 - 000003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-fibers-l1-1-0.dll
2018-01-08 06:15 - 2017-12-31 20:18 - 000003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-errorhandling-l1-1-0.dll
2018-01-08 06:15 - 2017-12-31 20:18 - 000003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-delayload-l1-1-0.dll
2018-01-08 06:15 - 2017-12-31 20:18 - 000003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-debug-l1-1-0.dll
2018-01-08 06:15 - 2017-12-31 20:18 - 000003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-datetime-l1-1-0.dll
2018-01-08 06:15 - 2017-12-31 20:18 - 000003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-console-l1-1-0.dll
2018-01-08 06:15 - 2017-12-31 20:18 - 000002048 _____ (Microsoft Corporation) C:\Windows\system32\msxml6r.dll
2018-01-08 06:15 - 2017-12-31 20:00 - 000254464 _____ (Microsoft Corporation) C:\Windows\SysWOW64\schannel.dll
2018-01-08 06:15 - 2017-12-31 20:00 - 000223232 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ncrypt.dll
2018-01-08 06:15 - 2017-12-31 20:00 - 000172032 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wdigest.dll
2018-01-08 06:15 - 2017-12-31 20:00 - 000146432 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msaudite.dll
2018-01-08 06:15 - 2017-12-31 20:00 - 000084480 _____ (Microsoft Corporation) C:\Windows\SysWOW64\INETRES.dll
2018-01-08 06:15 - 2017-12-31 20:00 - 000082944 _____ (Microsoft Corporation) C:\Windows\SysWOW64\bcrypt.dll
2018-01-08 06:15 - 2017-12-31 20:00 - 000065536 _____ (Microsoft Corporation) C:\Windows\SysWOW64\TSpkg.dll
2018-01-08 06:15 - 2017-12-31 20:00 - 000060416 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msobjs.dll
2018-01-08 06:15 - 2017-12-31 20:00 - 000043008 _____ (Microsoft Corporation) C:\Windows\SysWOW64\srclient.dll
2018-01-08 06:15 - 2017-12-31 20:00 - 000026112 _____ (Microsoft Corporation) C:\Windows\SysWOW64\oleres.dll
2018-01-08 06:15 - 2017-12-31 20:00 - 000022016 _____ (Microsoft Corporation) C:\Windows\SysWOW64\secur32.dll
2018-01-08 06:15 - 2017-12-31 20:00 - 000017408 _____ (Microsoft Corporation) C:\Windows\SysWOW64\credssp.dll
2018-01-08 06:15 - 2017-12-31 20:00 - 000005120 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wow32.dll
2018-01-08 06:15 - 2017-12-31 20:00 - 000002048 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msxml6r.dll
2018-01-08 06:15 - 2017-12-31 19:59 - 000690688 _____ (Microsoft Corporation) C:\Windows\SysWOW64\adtschema.dll
2018-01-08 06:15 - 2017-12-31 19:59 - 000050688 _____ (Microsoft Corporation) C:\Windows\SysWOW64\appidapi.dll
2018-01-08 06:15 - 2017-12-31 19:59 - 000006656 _____ (Microsoft Corporation) C:\Windows\SysWOW64\apisetschema.dll
2018-01-08 06:15 - 2017-12-31 19:59 - 000005120 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-file-l1-1-0.dll
2018-01-08 06:15 - 2017-12-31 19:59 - 000004608 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-processthreads-l1-1-0.dll
2018-01-08 06:15 - 2017-12-31 19:59 - 000004096 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-sysinfo-l1-1-0.dll
2018-01-08 06:15 - 2017-12-31 19:59 - 000004096 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-synch-l1-1-0.dll
2018-01-08 06:15 - 2017-12-31 19:59 - 000004096 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-misc-l1-1-0.dll
2018-01-08 06:15 - 2017-12-31 19:59 - 000004096 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-localregistry-l1-1-0.dll
2018-01-08 06:15 - 2017-12-31 19:59 - 000004096 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-localization-l1-1-0.dll
2018-01-08 06:15 - 2017-12-31 19:59 - 000003584 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-processenvironment-l1-1-0.dll
2018-01-08 06:15 - 2017-12-31 19:59 - 000003584 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-namedpipe-l1-1-0.dll
2018-01-08 06:15 - 2017-12-31 19:59 - 000003584 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-memory-l1-1-0.dll
2018-01-08 06:15 - 2017-12-31 19:59 - 000003584 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-libraryloader-l1-1-0.dll
2018-01-08 06:15 - 2017-12-31 19:59 - 000003584 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-interlocked-l1-1-0.dll
2018-01-08 06:15 - 2017-12-31 19:59 - 000003584 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-heap-l1-1-0.dll
2018-01-08 06:15 - 2017-12-31 19:59 - 000003072 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-string-l1-1-0.dll
2018-01-08 06:15 - 2017-12-31 19:59 - 000003072 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-rtlsupport-l1-1-0.dll
2018-01-08 06:15 - 2017-12-31 19:59 - 000003072 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-profile-l1-1-0.dll
2018-01-08 06:15 - 2017-12-31 19:59 - 000003072 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-io-l1-1-0.dll
2018-01-08 06:15 - 2017-12-31 19:59 - 000003072 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-handle-l1-1-0.dll
2018-01-08 06:15 - 2017-12-31 19:59 - 000003072 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-fibers-l1-1-0.dll
2018-01-08 06:15 - 2017-12-31 19:59 - 000003072 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-errorhandling-l1-1-0.dll
2018-01-08 06:15 - 2017-12-31 19:59 - 000003072 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-delayload-l1-1-0.dll
2018-01-08 06:15 - 2017-12-31 19:59 - 000003072 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-debug-l1-1-0.dll
2018-01-08 06:15 - 2017-12-31 19:59 - 000003072 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-datetime-l1-1-0.dll
2018-01-08 06:15 - 2017-12-31 19:59 - 000003072 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-console-l1-1-0.dll
2018-01-08 06:15 - 2017-12-31 19:49 - 000148480 _____ (Microsoft Corporation) C:\Windows\system32\appidpolicyconverter.exe
2018-01-08 06:15 - 2017-12-31 19:49 - 000064000 _____ (Microsoft Corporation) C:\Windows\system32\auditpol.exe
2018-01-08 06:15 - 2017-12-31 19:49 - 000017920 _____ (Microsoft Corporation) C:\Windows\system32\appidcertstorecheck.exe
2018-01-08 06:15 - 2017-12-31 19:46 - 000338432 _____ (Microsoft Corporation) C:\Windows\system32\conhost.exe
2018-01-08 06:15 - 2017-12-31 19:45 - 000296960 _____ (Microsoft Corporation) C:\Windows\system32\rstrui.exe
2018-01-08 06:15 - 2017-12-31 19:43 - 000020480 _____ (Microsoft Corporation) C:\Windows\SysWOW64\WcnEapPeerProxy.dll
2018-01-08 06:15 - 2017-12-31 19:43 - 000019968 _____ (Microsoft Corporation) C:\Windows\SysWOW64\WcnEapAuthProxy.dll
2018-01-08 06:15 - 2017-12-31 19:43 - 000013824 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wshqos.dll
2018-01-08 06:15 - 2017-12-31 19:41 - 000129536 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\mrxsmb20.sys
2018-01-08 06:15 - 2017-12-31 19:41 - 000112640 _____ (Microsoft Corporation) C:\Windows\system32\smss.exe
2018-01-08 06:15 - 2017-12-31 19:41 - 000030720 _____ (Microsoft Corporation) C:\Windows\system32\lsass.exe
2018-01-08 06:15 - 2017-12-31 19:41 - 000007168 _____ (Microsoft Corporation) C:\Windows\SysWOW64\comcat.dll
2018-01-08 06:15 - 2017-12-31 19:39 - 000050176 _____ (Microsoft Corporation) C:\Windows\SysWOW64\auditpol.exe
2018-01-08 06:15 - 2017-12-31 19:36 - 000014336 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ntvdm64.dll
2018-01-08 06:15 - 2017-12-31 19:36 - 000007680 _____ (Microsoft Corporation) C:\Windows\SysWOW64\instnm.exe
2018-01-08 06:15 - 2017-12-31 19:36 - 000002048 _____ (Microsoft Corporation) C:\Windows\SysWOW64\user.exe
2018-01-08 06:15 - 2017-12-31 19:35 - 000036352 _____ (Microsoft Corporation) C:\Windows\SysWOW64\cryptbase.dll
2018-01-08 06:15 - 2017-12-31 19:35 - 000006144 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-security-base-l1-1-0.dll
2018-01-08 06:15 - 2017-12-31 19:35 - 000004608 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-threadpool-l1-1-0.dll
2018-01-08 06:15 - 2017-12-31 19:35 - 000003584 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-xstate-l1-1-0.dll
2018-01-08 06:15 - 2017-12-31 19:35 - 000003072 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-util-l1-1-0.dll
2018-01-08 06:15 - 2017-12-29 12:24 - 002724864 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.tlb
2018-01-08 06:15 - 2017-12-29 12:13 - 000062464 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iesetup.dll
2018-01-08 06:15 - 2017-12-29 12:12 - 000047616 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieetwproxystub.dll
2018-01-08 06:15 - 2017-12-29 12:11 - 000064000 _____ (Microsoft Corporation) C:\Windows\SysWOW64\MshtmlDac.dll
2018-01-08 06:15 - 2017-12-29 12:06 - 000047104 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jsproxy.dll
2018-01-08 06:15 - 2017-12-29 12:06 - 000030720 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iernonce.dll
2018-01-08 06:15 - 2017-12-29 12:03 - 000620032 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript9diag.dll
2018-01-08 06:15 - 2017-12-29 12:03 - 000115712 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieUnatt.exe
2018-01-08 06:15 - 2017-12-29 11:51 - 000060416 _____ (Microsoft Corporation) C:\Windows\SysWOW64\JavaScriptCollectionAgent.dll
2018-01-08 06:15 - 2017-12-29 11:50 - 000091136 _____ (Microsoft Corporation) C:\Windows\SysWOW64\inseng.dll
2018-01-08 06:15 - 2017-12-29 11:50 - 000073216 _____ (Microsoft Corporation) C:\Windows\SysWOW64\tdc.ocx
2018-01-08 06:15 - 2017-12-29 11:47 - 000076288 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtmled.dll
2018-01-08 06:15 - 2017-12-29 11:44 - 000130048 _____ (Microsoft Corporation) C:\Windows\SysWOW64\occache.dll
2018-01-08 06:15 - 2017-12-29 03:04 - 002724864 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.tlb
2018-01-08 06:15 - 2017-12-29 03:04 - 000004096 _____ (Microsoft Corporation) C:\Windows\system32\ieetwcollectorres.dll
2018-01-08 06:15 - 2017-12-29 02:51 - 000066560 _____ (Microsoft Corporation) C:\Windows\system32\iesetup.dll
2018-01-08 06:15 - 2017-12-29 02:50 - 000088064 _____ (Microsoft Corporation) C:\Windows\system32\MshtmlDac.dll
2018-01-08 06:15 - 2017-12-29 02:50 - 000048640 _____ (Microsoft Corporation) C:\Windows\system32\ieetwproxystub.dll
2018-01-08 06:15 - 2017-12-29 02:44 - 000054784 _____ (Microsoft Corporation) C:\Windows\system32\jsproxy.dll
2018-01-08 06:15 - 2017-12-29 02:43 - 000034304 _____ (Microsoft Corporation) C:\Windows\system32\iernonce.dll
2018-01-08 06:15 - 2017-12-29 02:39 - 000144384 _____ (Microsoft Corporation) C:\Windows\system32\ieUnatt.exe
2018-01-08 06:15 - 2017-12-29 02:22 - 000087552 _____ (Microsoft Corporation) C:\Windows\system32\tdc.ocx
2018-01-08 06:15 - 2017-12-29 02:22 - 000077824 _____ (Microsoft Corporation) C:\Windows\system32\JavaScriptCollectionAgent.dll
2018-01-08 06:15 - 2017-12-29 02:21 - 000107520 _____ (Microsoft Corporation) C:\Windows\system32\inseng.dll
2018-01-08 06:15 - 2017-12-29 02:18 - 000092160 _____ (Microsoft Corporation) C:\Windows\system32\mshtmled.dll
2018-01-08 06:15 - 2017-12-29 02:14 - 000152064 _____ (Microsoft Corporation) C:\Windows\system32\occache.dll
2018-01-08 06:15 - 2017-12-13 10:27 - 000046080 _____ (Adobe Systems) C:\Windows\system32\atmlib.dll
2018-01-08 06:15 - 2017-12-13 10:27 - 000041472 _____ (Microsoft Corporation) C:\Windows\system32\lpk.dll
2018-01-08 06:15 - 2017-12-13 10:27 - 000014336 _____ (Microsoft Corporation) C:\Windows\system32\dciman32.dll
2018-01-08 06:15 - 2017-12-13 10:11 - 000025600 _____ (Microsoft Corporation) C:\Windows\SysWOW64\lpk.dll
2018-01-08 06:15 - 2017-12-13 10:11 - 000010240 _____ (Microsoft Corporation) C:\Windows\SysWOW64\dciman32.dll
2018-01-08 06:15 - 2017-12-05 11:36 - 000040960 _____ (Microsoft Corporation) C:\Windows\system32\WcsPlugInService.dll
2018-01-08 06:15 - 2017-12-05 09:59 - 003222528 _____ (Microsoft Corporation) C:\Windows\system32\win32k.sys
2018-01-08 06:15 - 2017-12-05 09:49 - 000032768 _____ (Microsoft Corporation) C:\Windows\SysWOW64\WcsPlugInService.dll
2018-01-08 05:26 - 2018-01-08 05:26 - 000003338 _____ C:\Windows\System32\Tasks\GlaryInitialize 5
2018-01-07 07:23 - 2018-01-07 07:23 - 000644236 _____ C:\Users\Terry Felter\Downloads\weekly-thoughs-1-8-2018.pdf
2017-12-21 06:53 - 2017-11-07 10:31 - 000002048 _____ (Microsoft Corporation) C:\Windows\system32\tzres.dll
2017-12-21 06:53 - 2017-11-07 10:13 - 000002048 _____ (Microsoft Corporation) C:\Windows\SysWOW64\tzres.dll
2017-12-21 06:53 - 2017-11-04 09:31 - 000194048 _____ (Microsoft Corporation) C:\Windows\system32\itircl.dll
2017-12-21 06:53 - 2017-11-04 09:31 - 000170496 _____ (Microsoft Corporation) C:\Windows\system32\itss.dll
2017-12-21 06:53 - 2017-11-04 09:10 - 000158720 _____ (Microsoft Corporation) C:\Windows\SysWOW64\itircl.dll
2017-12-21 06:53 - 2017-11-04 09:10 - 000142336 _____ (Microsoft Corporation) C:\Windows\SysWOW64\itss.dll
2017-12-21 06:53 - 2017-11-02 10:55 - 000281600 _____ (Microsoft Corporation) C:\Windows\system32\iprtrmgr.dll
2017-12-21 06:53 - 2017-11-02 10:55 - 000138240 _____ (Microsoft Corporation) C:\Windows\system32\rtm.dll
2017-12-21 06:53 - 2017-11-02 10:55 - 000097792 _____ (Microsoft Corporation) C:\Windows\system32\mprdim.dll
2017-12-21 06:53 - 2017-11-02 10:55 - 000009728 _____ (Microsoft Corporation) C:\Windows\system32\iprtprio.dll
2017-12-21 06:53 - 2017-11-02 09:11 - 000271360 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iprtrmgr.dll
2017-12-21 06:53 - 2017-11-02 09:11 - 000115200 _____ (Microsoft Corporation) C:\Windows\SysWOW64\rtm.dll
2017-12-21 06:53 - 2017-11-02 09:11 - 000075264 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mprdim.dll
2017-12-21 06:53 - 2017-11-02 08:56 - 000008192 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iprtprio.dll
2017-12-21 06:53 - 2017-10-17 20:06 - 000344064 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\usbhub.sys
2017-12-21 06:53 - 2017-10-17 20:06 - 000327168 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\usbport.sys
2017-12-21 06:53 - 2017-10-17 20:06 - 000099840 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\usbccgp.sys
2017-12-21 06:53 - 2017-10-17 20:06 - 000056320 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\usbehci.sys
2017-12-21 06:53 - 2017-10-17 20:06 - 000030720 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\usbuhci.sys
2017-12-21 06:53 - 2017-10-17 20:06 - 000025600 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\usbohci.sys
2017-12-21 06:53 - 2017-10-17 20:06 - 000007808 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\usbd.sys
2017-12-21 06:53 - 2017-10-16 17:04 - 001001984 _____ (Microsoft Corporation) C:\Windows\system32\gpedit.dll
2017-12-21 06:53 - 2017-10-16 16:46 - 000953344 _____ (Microsoft Corporation) C:\Windows\SysWOW64\gpedit.dll
2017-12-21 06:53 - 2017-10-16 15:55 - 000339968 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msexcl40.dll
2017-12-21 06:53 - 2017-10-11 18:55 - 014635008 _____ (Microsoft Corporation) C:\Windows\system32\wmp.dll
2017-12-21 06:53 - 2017-10-11 18:55 - 012574720 _____ (Microsoft Corporation) C:\Windows\system32\wmploc.DLL
2017-12-21 06:53 - 2017-10-11 18:55 - 002319872 _____ (Microsoft Corporation) C:\Windows\system32\tquery.dll
2017-12-21 06:53 - 2017-10-11 18:55 - 002222080 _____ (Microsoft Corporation) C:\Windows\system32\mssrch.dll
2017-12-21 06:53 - 2017-10-11 18:55 - 002058240 _____ (Microsoft Corporation) C:\Windows\system32\Query.dll
2017-12-21 06:53 - 2017-10-11 18:55 - 000778240 _____ (Microsoft Corporation) C:\Windows\system32\mssvp.dll
2017-12-21 06:53 - 2017-10-11 18:55 - 000491520 _____ (Microsoft Corporation) C:\Windows\system32\mssph.dll
2017-12-21 06:53 - 2017-10-11 18:55 - 000288256 _____ (Microsoft Corporation) C:\Windows\system32\mssphtb.dll
2017-12-21 06:53 - 2017-10-11 18:55 - 000151552 _____ (Microsoft Corporation) C:\Windows\system32\t2embed.dll
2017-12-21 06:53 - 2017-10-11 18:55 - 000115200 _____ (Microsoft Corporation) C:\Windows\system32\mssitlb.dll
2017-12-21 06:53 - 2017-10-11 18:55 - 000099840 _____ (Microsoft Corporation) C:\Windows\system32\mssprxy.dll
2017-12-21 06:53 - 2017-10-11 18:55 - 000075264 _____ (Microsoft Corporation) C:\Windows\system32\msscntrs.dll
2017-12-21 06:53 - 2017-10-11 18:55 - 000014336 _____ (Microsoft Corporation) C:\Windows\system32\msshooks.dll
2017-12-21 06:53 - 2017-10-11 18:55 - 000009728 _____ (Microsoft Corporation) C:\Windows\system32\spwmp.dll
2017-12-21 06:53 - 2017-10-11 18:55 - 000005120 _____ (Microsoft Corporation) C:\Windows\system32\msdxm.ocx
2017-12-21 06:53 - 2017-10-11 18:55 - 000005120 _____ (Microsoft Corporation) C:\Windows\system32\dxmasf.dll
2017-12-21 06:53 - 2017-10-11 18:39 - 000591872 _____ (Microsoft Corporation) C:\Windows\system32\SearchIndexer.exe
2017-12-21 06:53 - 2017-10-11 18:38 - 000249856 _____ (Microsoft Corporation) C:\Windows\system32\SearchProtocolHost.exe
2017-12-21 06:53 - 2017-10-11 18:38 - 000113664 _____ (Microsoft Corporation) C:\Windows\system32\SearchFilterHost.exe
2017-12-21 06:53 - 2017-10-11 18:37 - 012574208 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wmploc.DLL
2017-12-21 06:53 - 2017-10-11 18:37 - 011410944 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wmp.dll
2017-12-21 06:53 - 2017-10-11 18:37 - 001549824 _____ (Microsoft Corporation) C:\Windows\SysWOW64\tquery.dll
2017-12-21 06:53 - 2017-10-11 18:37 - 001400320 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mssrch.dll
2017-12-21 06:53 - 2017-10-11 18:37 - 001363968 _____ (Microsoft Corporation) C:\Windows\SysWOW64\Query.dll
2017-12-21 06:53 - 2017-10-11 18:37 - 000666624 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mssvp.dll
2017-12-21 06:53 - 2017-10-11 18:37 - 000337408 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mssph.dll
2017-12-21 06:53 - 2017-10-11 18:37 - 000197120 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mssphtb.dll
2017-12-21 06:53 - 2017-10-11 18:37 - 000111104 _____ (Microsoft Corporation) C:\Windows\SysWOW64\t2embed.dll
2017-12-21 06:53 - 2017-10-11 18:37 - 000104448 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mssitlb.dll
2017-12-21 06:53 - 2017-10-11 18:37 - 000059392 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msscntrs.dll
2017-12-21 06:53 - 2017-10-11 18:37 - 000034816 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mssprxy.dll
2017-12-21 06:53 - 2017-10-11 18:26 - 000427520 _____ (Microsoft Corporation) C:\Windows\SysWOW64\SearchIndexer.exe
2017-12-21 06:53 - 2017-10-11 18:26 - 000164352 _____ (Microsoft Corporation) C:\Windows\SysWOW64\SearchProtocolHost.exe
2017-12-21 06:53 - 2017-10-11 18:25 - 000086528 _____ (Microsoft Corporation) C:\Windows\SysWOW64\SearchFilterHost.exe
2017-12-21 06:53 - 2017-10-11 18:25 - 000009728 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msshooks.dll
2017-12-21 06:53 - 2017-10-11 18:24 - 000008192 _____ (Microsoft Corporation) C:\Windows\SysWOW64\spwmp.dll
2017-12-21 06:53 - 2017-10-11 18:24 - 000004096 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msdxm.ocx
2017-12-21 06:53 - 2017-10-11 18:24 - 000004096 _____ (Microsoft Corporation) C:\Windows\SysWOW64\dxmasf.dll
2017-12-21 06:53 - 2017-10-11 18:20 - 000317440 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\rdbss.sys
2017-12-21 06:53 - 2017-10-11 18:20 - 000113152 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\luafv.sys

==================== One Month Modified files and folders ========

(If an entry is included in the fixlist, the file/folder will be moved.)

2018-01-11 07:14 - 2016-11-27 16:54 - 000000000 ____D C:\Program Files (x86)\Glary Utilities 5
2018-01-11 07:11 - 2009-07-13 23:08 - 000000006 ____H C:\Windows\Tasks\SA.DAT
2018-01-11 06:55 - 2009-07-13 22:45 - 000019968 ____H C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0
2018-01-11 06:55 - 2009-07-13 22:45 - 000019968 ____H C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0
2018-01-11 06:53 - 2009-07-13 23:13 - 000743360 _____ C:\Windows\system32\PerfStringBackup.INI
2018-01-11 06:53 - 2009-07-13 21:20 - 000000000 ____D C:\Windows\inf
2018-01-11 06:52 - 2016-12-01 07:36 - 000000000 ____D C:\Users\Terry Felter\AppData\Local\CrashDumps
2018-01-11 06:51 - 2016-12-04 07:02 - 000000000 ____D C:\ProgramData\Malwarebytes
2018-01-11 06:44 - 2016-11-24 16:22 - 000000000 ____D C:\Users\Terry Felter
2018-01-11 06:35 - 2016-11-30 11:37 - 000000576 _____ C:\Windows\Tasks\G2MUpdateTask-S-1-5-21-2367635994-1441107805-3879806124-1000.job
2018-01-11 06:31 - 2016-07-14 20:32 - 000000000 ____D C:\AdwCleaner
2018-01-11 06:14 - 2016-11-30 11:37 - 000000672 _____ C:\Windows\Tasks\G2MUploadTask-S-1-5-21-2367635994-1441107805-3879806124-1000.job
2018-01-10 22:12 - 2016-11-24 17:48 - 000000000 ____D C:\Users\Terry Felter\Documents\Stock Info
2018-01-10 17:42 - 2016-12-03 20:53 - 000000000 ____D C:\Users\Terry Felter\AppData\Roaming\Simple Sudoku
2018-01-10 06:45 - 2016-11-27 16:36 - 000004364 _____ C:\ProgramData\keystore.xml
2018-01-09 21:44 - 2017-01-10 12:35 - 000000000 ____D C:\Users\Terry Felter\AppData\LocalLow\Mozilla
2018-01-09 21:21 - 2014-03-30 14:56 - 000000000 ____D C:\Trazere
2018-01-09 09:14 - 2017-03-17 04:16 - 000004324 _____ C:\Windows\System32\Tasks\Adobe Flash Player Updater
2018-01-09 09:14 - 2016-11-25 07:57 - 000803328 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerApp.exe
2018-01-09 09:14 - 2016-11-25 07:57 - 000144896 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerCPLApp.cpl
2018-01-09 09:14 - 2016-11-25 07:57 - 000000000 ____D C:\Windows\system32\Macromed
2018-01-09 09:14 - 2016-11-25 07:56 - 000000000 ____D C:\Windows\SysWOW64\Macromed
2018-01-09 05:22 - 2016-11-24 22:12 - 000000000 ____D C:\Program Files (x86)\Mozilla Maintenance Service
2018-01-08 21:43 - 2016-11-24 22:12 - 000000000 ____D C:\Program Files (x86)\Mozilla Firefox
2018-01-08 15:35 - 2009-07-13 21:20 - 000000000 ____D C:\Windows\rescache
2018-01-08 06:38 - 2009-07-13 22:45 - 000464896 _____ C:\Windows\system32\FNTCACHE.DAT
2018-01-08 05:27 - 2016-11-27 16:54 - 000002998 _____ C:\Windows\System32\Tasks\GU5SkipUAC
2018-01-08 05:27 - 2016-11-27 16:54 - 000001102 _____ C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Glary Utilities 5.lnk
2018-01-08 05:27 - 2016-11-27 16:54 - 000001090 _____ C:\Users\Public\Desktop\Glary Utilities 5.lnk
2018-01-06 22:03 - 2017-07-28 17:54 - 000000616 _____ C:\Windows\Tasks\TradeStation Backup - Monthly.job
2018-01-06 21:37 - 2016-11-25 15:54 - 000000000 ____D C:\Program Files (x86)\TradeStation Archives
2018-01-06 19:45 - 2017-07-28 17:54 - 000000612 _____ C:\Windows\Tasks\TradeStation Backup - Weekly.job
2018-01-04 14:35 - 2017-07-08 17:01 - 000000000 ____D C:\Users\Terry Felter\AppData\Local\GoToMeeting
2018-01-02 14:57 - 2017-07-28 17:54 - 000003530 _____ C:\Windows\System32\Tasks\TradeStation Backup - Monthly
2018-01-02 14:57 - 2017-07-28 17:54 - 000003526 _____ C:\Windows\System32\Tasks\TradeStation Backup - Weekly
2018-01-02 13:17 - 2016-11-24 17:27 - 000005325 _____ C:\Users\Terry Felter\Documents\Finder.txt
2017-12-22 07:20 - 2016-12-02 08:22 - 000000843 _____ C:\Users\Public\Desktop\Medved Trader.lnk
2017-12-22 07:20 - 2016-12-02 08:22 - 000000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Medved Trader
2017-12-22 07:20 - 2016-12-02 08:21 - 000000000 ____D C:\Program Files\Medved Trader
2017-12-21 12:28 - 2016-11-30 11:37 - 000003724 _____ C:\Windows\System32\Tasks\G2MUploadTask-S-1-5-21-2367635994-1441107805-3879806124-1000
2017-12-21 12:28 - 2016-11-30 11:37 - 000003628 _____ C:\Windows\System32\Tasks\G2MUpdateTask-S-1-5-21-2367635994-1441107805-3879806124-1000
2017-12-21 09:29 - 2016-11-24 17:39 - 000000000 ____D C:\Users\Terry Felter\Documents\Snagit
2017-12-21 08:01 - 2009-07-13 21:20 - 000000000 ____D C:\Windows\SysWOW64\Setup
2017-12-21 08:00 - 2009-07-13 21:20 - 000000000 ____D C:\Windows\system32\Setup
2017-12-21 07:47 - 2016-11-24 20:24 - 000000000 ____D C:\Windows\system32\MRT
2017-12-21 07:40 - 2017-10-12 04:40 - 133326408 ____C (Microsoft Corporation) C:\Windows\system32\MRT-KB890830.exe
2017-12-21 07:39 - 2016-11-24 20:24 - 133326408 ____C (Microsoft Corporation) C:\Windows\system32\MRT.exe
2017-12-20 22:12 - 2016-11-24 17:19 - 000000000 ____D C:\Users\Terry Felter\AppData\Roaming\Mozilla
2017-12-18 12:10 - 2016-11-24 17:28 - 000089088 _____ C:\Users\Terry Felter\Documents\Glucose.xls
2017-12-17 14:58 - 2016-11-25 07:26 - 000004476 _____ C:\Windows\System32\Tasks\Adobe Acrobat Update Task
2017-12-17 14:53 - 2016-11-25 07:25 - 000002441 _____ C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Acrobat Reader DC.lnk

==================== Files in the root of some directories =======

==================== Bamital & volsnap ======================

(There is no automatic fix for files that do not pass verification.)

LastRegBack: 2018-01-08 15:30

==================== End of FRST.txt ============================

Additional scan result of Farbar Recovery Scan Tool (x64) Version: 02.01.2018
Ran by [removed] (11-01-2018 07:18:41)
Running from C:\Users\[removed]\Desktop
Windows 7 Home Premium Service Pack 1 (X64) (2016-11-24 22:22:42)
Boot Mode: Normal
==========================================================

==================== Accounts: =============================

Administrator (S-1-5-21-2367635994-1441107805-3879806124-500 - Administrator - Disabled)
Guest (S-1-5-21-2367635994-1441107805-3879806124-501 - Limited - Disabled)
Terry Felter (S-1-5-21-2367635994-1441107805-3879806124-1000 - Administrator - Enabled) => C:\Users\Terry Felter

==================== Security Center ========================

(If an entry is included in the fixlist, it will be removed.)

AV: Microsoft Security Essentials (Enabled - Up to date) {71A27EC9-3DA6-45FC-60A7-004F623C6189}
AS: Spybot - Search and Destroy (Enabled - Out of date) {A16C3F68-9280-E053-1818-342707FECF4D}
AS: Microsoft Security Essentials (Enabled - Up to date) {CAC39F2D-1B9C-4A72-5A17-3B3D19BB2B34}
AS: Windows Defender (Disabled - Up to date) {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}

==================== Installed Programs ======================

(Only the adware programs with "Hidden" flag could be added to the fixlist to unhide them. The adware programs should be uninstalled manually.)

2007 Microsoft Office Suite Service Pack 3 (SP3) (HKLM-x32\…\{90120000-0015-0409-0000-0000000FF1CE}_PROR_{AAA19365-932B-49BD-8138-BE28CEE9C4B4}) (Version: - Microsoft) Hidden
2007 Microsoft Office Suite Service Pack 3 (SP3) (HKLM-x32\…\{90120000-0016-0409-0000-0000000FF1CE}_PROR_{AAA19365-932B-49BD-8138-BE28CEE9C4B4}) (Version: - Microsoft) Hidden
2007 Microsoft Office Suite Service Pack 3 (SP3) (HKLM-x32\…\{90120000-0018-0409-0000-0000000FF1CE}_PROR_{AAA19365-932B-49BD-8138-BE28CEE9C4B4}) (Version: - Microsoft) Hidden
2007 Microsoft Office Suite Service Pack 3 (SP3) (HKLM-x32\…\{90120000-0019-0409-0000-0000000FF1CE}_PROR_{AAA19365-932B-49BD-8138-BE28CEE9C4B4}) (Version: - Microsoft) Hidden
2007 Microsoft Office Suite Service Pack 3 (SP3) (HKLM-x32\…\{90120000-001A-0409-0000-0000000FF1CE}_PROR_{AAA19365-932B-49BD-8138-BE28CEE9C4B4}) (Version: - Microsoft) Hidden
2007 Microsoft Office Suite Service Pack 3 (SP3) (HKLM-x32\…\{90120000-001B-0409-0000-0000000FF1CE}_PROR_{AAA19365-932B-49BD-8138-BE28CEE9C4B4}) (Version: - Microsoft) Hidden
2007 Microsoft Office Suite Service Pack 3 (SP3) (HKLM-x32\…\{90120000-001F-0409-0000-0000000FF1CE}_PROR_{1FF96026-A04A-4C3E-B50A-BB7022654D0F}) (Version: - Microsoft) Hidden
2007 Microsoft Office Suite Service Pack 3 (SP3) (HKLM-x32\…\{90120000-001F-040C-0000-0000000FF1CE}_PROR_{71F055E8-E2C6-4214-BB3D-BFE03561B89E}) (Version: - Microsoft) Hidden
2007 Microsoft Office Suite Service Pack 3 (SP3) (HKLM-x32\…\{90120000-001F-0C0A-0000-0000000FF1CE}_PROR_{2314F9A1-126F-45CC-8A5E-DFAF866F3FBC}) (Version: - Microsoft) Hidden
2007 Microsoft Office Suite Service Pack 3 (SP3) (HKLM-x32\…\{90120000-002A-0000-1000-0000000FF1CE}_PROR_{664655D8-B9BB-455D-8A58-7EAF7B0B2862}) (Version: - Microsoft) Hidden
2007 Microsoft Office Suite Service Pack 3 (SP3) (HKLM-x32\…\{90120000-002A-0409-1000-0000000FF1CE}_PROR_{98333358-268C-4164-B6D4-C96DF5153727}) (Version: - Microsoft) Hidden
2007 Microsoft Office Suite Service Pack 3 (SP3) (HKLM-x32\…\{90120000-006E-0409-0000-0000000FF1CE}_PROR_{98333358-268C-4164-B6D4-C96DF5153727}) (Version: - Microsoft) Hidden
2007 Microsoft Office Suite Service Pack 3 (SP3) (HKLM-x32\…\{90120000-0115-0409-0000-0000000FF1CE}_PROR_{98333358-268C-4164-B6D4-C96DF5153727}) (Version: - Microsoft) Hidden
2007 Microsoft Office Suite Service Pack 3 (SP3) (HKLM-x32\…\{90120000-0116-0409-1000-0000000FF1CE}_PROR_{98333358-268C-4164-B6D4-C96DF5153727}) (Version: - Microsoft) Hidden
2007 Microsoft Office Suite Service Pack 3 (SP3) (HKLM-x32\…\{90120000-0117-0409-0000-0000000FF1CE}_PROR_{AAA19365-932B-49BD-8138-BE28CEE9C4B4}) (Version: - Microsoft) Hidden
2007 Microsoft Office Suite Service Pack 3 (SP3) (HKLM-x32\…\{91120000-0014-0000-0000-0000000FF1CE}_PROR_{6E107EB7-8B55-48BF-ACCB-199F86A2CD93}) (Version: - Microsoft)
Adobe Acrobat Reader DC (HKLM-x32\…\{AC76BA86-7AD7-1033-7B44-AC0F074E4100}) (Version: 18.009.20050 - Adobe Systems Incorporated)
Adobe Flash Player 28 ActiveX (HKLM-x32\…\Adobe Flash Player ActiveX) (Version: 28.0.0.137 - Adobe Systems Incorporated)
Apple Application Support (HKLM-x32\…\{46F044A5-CE8B-4196-984E-5BD6525E361D}) (Version: 2.3.6 - Apple Inc.)
Apple Software Update (HKLM-x32\…\{56EC47AA-5813-4FF6-8E75-544026FBEA83}) (Version: 2.2.0.150 - Apple Inc.)
AutoUpdate (HKLM-x32\…\{18D10072035C4515918F7E37EAFAACFC}) (Version: 1.1 - )
Broadcom NetXtreme-I Netlink Driver and Management Installer (HKLM\…\{9B34CC4C-E7FF-4AC8-B771-1D09612D6430}) (Version: 15.0.8.5 - Broadcom Corporation)
CCleaner (HKLM\…\CCleaner) (Version: 4.16 - Piriform)
Cheat Engine 6.3 (HKLM-x32\…\Cheat Engine 6.3_is1) (Version: - Cheat Engine)
Cheat Engine 6.6 (HKLM-x32\…\Cheat Engine 6.6_is1) (Version: - Cheat Engine)
Cisco EAP-FAST Module (HKLM-x32\…\{64BF0187-F3D2-498B-99EA-163AF9AE6EC9}) (Version: 2.2.14 - Cisco Systems, Inc.) Hidden
Cisco LEAP Module (HKLM-x32\…\{51C7AD07-C3F6-4635-8E8A-231306D810FE}) (Version: 1.0.19 - Cisco Systems, Inc.) Hidden
Cisco PEAP Module (HKLM-x32\…\{ED5776D5-59B4-46B7-AF81-5F2D94D7C640}) (Version: 1.1.6 - Cisco Systems, Inc.) Hidden
Cisco WebEx Meetings (HKLM-x32\…\ActiveTouchMeetingClient) (Version: - Cisco WebEx LLC)
Dell System Detect (HKU\S-1-5-21-2367635994-1441107805-3879806124-1000\…\58d94f3ce2c27db0) (Version: 7.11.0.6 - Dell)
Dell Touchpad (HKLM\…\{9F72EF8B-AEC9-4CA5-B483-143980AFD6FD}) (Version: 10.1207.101.109 - ALPS ELECTRIC CO., LTD.)
DivX (HKLM-x32\…\{7B63B2922B174135AFC0E1377DD81EC2}) (Version: 6.0 - DivXNetworks, Inc.)
DW WLAN Card Utility (HKLM\…\DW WLAN Card Utility) (Version: 6.30.223.215 - Dell Inc.)
eSignal (HKLM-x32\…\{988ACB3F-EF50-43B9-97A4-90E816660122}) (Version: 10.6.4063.1258 - eSignal) Hidden
eSignal 10.6 (HKLM-x32\…\eSignal) (Version: 10.6.4063.1258 - eSignal)
Frhed 1.7.1 (HKLM-x32\…\Frhed) (Version: 1.7.1 - Raihan Kibria)
Glary Utilities 5.91 (HKLM-x32\…\Glary Utilities 5) (Version: 5.91.0.112 - Glarysoft Ltd)
GOM Player (HKLM-x32\…\GOM Player) (Version: 2.1.40.5106 - Gretech Corporation)
GoTo Opener (HKLM-x32\…\{1F803452-798F-49FB-A5DD-9F527F7017E4}) (Version: 1.0.473 - LogMeIn, Inc.)
GoToMeeting 8.19.0.8126 (HKU\S-1-5-21-2367635994-1441107805-3879806124-1000\…\GoToMeeting) (Version: 8.19.0.8126 - LogMeIn, Inc.)
Heroes of Might and Magic V - Tribes of the East (HKLM-x32\…\{66FF4C48-0083-4E60-8556-B883AB200092}) (Version: - )
Heroes of Might and Magic® III (HKLM-x32\…\Heroes of Might and Magic® III) (Version: - )
IDT Audio (HKLM-x32\…\{E3A5A8AB-58F6-45FF-AFCB-C9AE18C05001}) (Version: 1.0.6491.0 - IDT)
Intel(R) Management Engine Components (HKLM-x32\…\{65153EA5-8B6E-43B6-857B-C6E4FC25798A}) (Version: 9.5.15.1730 - Intel Corporation)
Intel(R) Processor Graphics (HKLM-x32\…\{F0E3AD40-2BBD-4360-9C76-B9AC9A5886EA}) (Version: 10.18.10.4425 - Intel Corporation)
Intel(R) USB 3.0 eXtensible Host Controller Driver (HKLM-x32\…\{240C3DDD-C5E9-4029-9DF7-95650D040CF2}) (Version: 1.0.8.251 - Intel Corporation)
IZArc 4.2 (HKLM-x32\…\{97C82B44-D408-4F14-9252-47FC1636D23E}_is1) (Version: 4.2 - Ivan Zahariev)
Malwarebytes version 3.3.1.2183 (HKLM\…\{35065F43-4BB2-439A-BFF7-0F1014F2E0CD}_is1) (Version: 3.3.1.2183 - Malwarebytes)
Medved Trader version 1.1.7000.2033 (HKLM\…\{528BD475-95CE-47B6-B40A-1136FED0D462}_is1) (Version: 1.1.7000.2033 - 2GK, Inc.)
Microsoft .NET Framework 4.7 (HKLM\…\{92FB6C44-E685-45AD-9B20-CADF4CABA132} - 1033) (Version: 4.7.02053 - Microsoft Corporation)
Microsoft Office File Validation Add-In (HKLM-x32\…\{90140000-2005-0000-0000-0000000FF1CE}) (Version: 14.0.5130.5003 - Microsoft Corporation)
Microsoft Office Professional 2007 (HKLM-x32\…\PROR) (Version: 12.0.6612.1000 - Microsoft Corporation)
Microsoft Security Essentials (HKLM\…\Microsoft Security Client) (Version: 4.10.209.0 - Microsoft Corporation)
Microsoft Silverlight (HKLM\…\{89F4137D-6C26-4A84-BDB8-2E5A4BB71E00}) (Version: 5.1.50907.0 - Microsoft Corporation)
Microsoft Visual C++ 2005 Redistributable (HKLM-x32\…\{710f4c1c-cc18-4c49-8cbf-51240c89a1a2}) (Version: 8.0.61187 - Microsoft Corporation)
Microsoft Visual C++ 2005 Redistributable (x64) (HKLM\…\{ad8a2fa1-06e7-4b0d-927d-6e54b3d31028}) (Version: 8.0.61186 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.7523 (HKLM\…\{5FCE6D76-F5DC-37AB-B2B8-22AB8CEDB1D4}) (Version: 9.0.30729.7523 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.7523 (HKLM-x32\…\{9BE518E6-ECC6-35A9-88E4-87755C07200F}) (Version: 9.0.30729.7523 - Microsoft Corporation)
Microsoft Visual C++ 2010 x64 Redistributable - 10.0.40219.473 (HKLM\…\{1D8E6291-B0D5-35EC-8441-6616F567A0F7}) (Version: 10.0.40219.473 - Microsoft Corporation)
Microsoft Visual C++ 2010 x86 Redistributable - 10.0.40219.473 (HKLM-x32\…\{F0C3E5D1-1ADE-321E-8167-68EF0DE699A5}) (Version: 10.0.40219.473 - Microsoft Corporation)
Microsoft Visual C++ 2012 x64 Additional Runtime - 11.0.61135 (HKLM\…\{37B8F9C7-03FB-3253-8781-2517C99D7C00}) (Version: 11.0.61135 - Microsoft Corporation)
Microsoft Visual C++ 2012 x64 Minimum Runtime - 11.0.61135 (HKLM\…\{CF2BEA3C-26EA-32F8-AA9B-331F7E34BA97}) (Version: 11.0.61135 - Microsoft Corporation)
Microsoft Visual C++ 2012 x86 Additional Runtime - 11.0.61135 (HKLM-x32\…\{B175520C-86A2-35A7-8619-86DC379688B9}) (Version: 11.0.61135 - Microsoft Corporation)
Microsoft Visual C++ 2012 x86 Minimum Runtime - 11.0.61135 (HKLM-x32\…\{BD95A8CD-1D9F-35AD-981A-3E7925026EBB}) (Version: 11.0.61135 - Microsoft Corporation)
Microsoft Visual C++ 2013 x64 Additional Runtime - 12.0.40660 (HKLM\…\{5740BD44-B58D-321A-AFC0-6D3D4556DD6C}) (Version: 12.0.40660 - Microsoft Corporation)
Microsoft Visual C++ 2013 x64 Minimum Runtime - 12.0.40660 (HKLM\…\{CB0836EC-B072-368D-82B2-D3470BF95707}) (Version: 12.0.40660 - Microsoft Corporation)
Microsoft Visual C++ 2013 x86 Additional Runtime - 12.0.40660 (HKLM-x32\…\{7DAD0258-515C-3DD4-8964-BD714199E0F7}) (Version: 12.0.40660 - Microsoft Corporation)
Microsoft Visual C++ 2013 x86 Minimum Runtime - 12.0.40660 (HKLM-x32\…\{E30D8B21-D82D-3211-82CC-0F0A5D1495E8}) (Version: 12.0.40660 - Microsoft Corporation)
Microsoft Visual C++ 2015 Redistributable (x64) - 14.0.23026 (HKLM-x32\…\{e46eca4f-393b-40df-9f49-076faf788d83}) (Version: 14.0.23026.0 - Microsoft Corporation)
Microsoft Visual C++ 2015 Redistributable (x86) - 14.0.23026 (HKLM-x32\…\{74d0e5db-b326-4dae-a6b2-445b9de1836e}) (Version: 14.0.23026.0 - Microsoft Corporation)
Microsoft Visual C++ 2017 x64 Additional Runtime - 14.11.25325 (HKLM\…\{B13B3E11-1555-353F-A63A-8933EE104FBD}) (Version: 14.11.25325 - Microsoft Corporation)
Microsoft Visual C++ 2017 x64 Minimum Runtime - 14.11.25325 (HKLM\…\{B0037450-526D-3448-A370-CACBD87769A0}) (Version: 14.11.25325 - Microsoft Corporation)
Microsoft Visual C++ 2017 x86 Additional Runtime - 14.11.25325 (HKLM-x32\…\{568CD07E-0824-3EEB-AEC1-8FD51F3C85CF}) (Version: 14.11.25325 - Microsoft Corporation)
Microsoft Visual C++ 2017 x86 Minimum Runtime - 14.11.25325 (HKLM-x32\…\{029DA848-1A80-34D3-BFC1-A6447BFC8E7F}) (Version: 14.11.25325 - Microsoft Corporation)
Mozilla Firefox 57.0.4 (x64 en-US) (HKLM\…\Mozilla Firefox 57.0.4 (x64 en-US)) (Version: 57.0.4 - Mozilla)
Mozilla Maintenance Service (HKLM-x32\…\MozillaMaintenanceService) (Version: 57.0.4.6577 - Mozilla)
MSXML 4.0 SP2 (KB954430) (HKLM-x32\…\{86493ADD-824D-4B8E-BD72-8C5DCDC52A71}) (Version: 4.20.9870.0 - Microsoft Corporation)
MSXML 4.0 SP2 (KB973688) (HKLM-x32\…\{F662A8E6-F4DC-41A2-901E-8C11F044BDEC}) (Version: 4.20.9876.0 - Microsoft Corporation)
PhotoRazor (HKLM-x32\…\PhotoRazor) (Version: - )
QuickTime 7 (HKLM-x32\…\{FF59BD75-466A-4D5A-AD23-AAD87C5FD44C}) (Version: 7.79.80.95 - Apple Inc.)
RealDownloader (HKLM-x32\…\{2275115D-1431-4A62-A98F-2F0393815327}) (Version: 18.1.9.106 - RealNetworks, Inc.) Hidden
RealDownloader (HKLM-x32\…\{45bcec97-14a2-4e10-a129-58d2d0b34398}) (Version: 18.1.9.106 - RealNetworks) Hidden
RealDownloader (HKLM-x32\…\{85584A8B-8989-42AA-81A0-80ABF61EFAF1}) (Version: 18.1.9.106 - RealNetworks) Hidden
RealNetworks - Microsoft Visual C++ 2008 Runtime (HKLM-x32\…\{7770E71B-2D43-4800-9CB3-5B6CAAEBEBEA}) (Version: 9.0 - RealNetworks, Inc) Hidden
RealNetworks - Microsoft Visual C++ 2010 Runtime (HKLM-x32\…\{AAECF7BA-E83B-4A10-87EA-DE0B333F8734}) (Version: 10.0 - RealNetworks, Inc) Hidden
RealPlayer (RealTimes) (HKLM-x32\…\RealPlayer 18.1) (Version: 18.1.9 - RealNetworks)
RealUpgrade 1.1 (HKLM-x32\…\{28C2DED6-325B-4CC7-983A-1777C8F7FBAB}) (Version: 1.1.0 - RealNetworks, Inc.) Hidden
Roxio Easy Media Creator 9 Suite (HKLM-x32\…\{70272964-C468-4C5F-8246-AA2CABA75941}) (Version: 9.0.136 - Roxio, Inc.)
ScottradeELITE v5 (HKLM-x32\…\{7E94DCE4-F1F3-47AF-A2D4-8A81008D9B1F}) (Version: 5.3.0.0 - Scottrade Inc.)
Simple Sudoku 4.2 (HKLM-x32\…\Simple Sudoku_is1) (Version: - )
Snagit 11 (HKLM-x32\…\{90D0FC4B-D653-4F49-BB97-A48C74A52E71}) (Version: 11.4.3 - TechSmith Corporation)
Spybot - Search & Destroy (HKLM-x32\…\{B4092C6D-E886-4CB2-BA68-FE5A99D31DE7}_is1) (Version: 2.4.40 - Safer-Networking Ltd.)
ST Microelectronics 3 Axis Digital Accelerometer Solution (HKLM-x32\…\{9C24F411-9CA7-4A8A-91F3-F08A4A38EB31}) (Version: 4.10.0046 - ST Microelectronics)
TeamViewer 9 (HKLM-x32\…\TeamViewer 9) (Version: 9.0.41110 - TeamViewer)
TeleChart 2007 (HKLM-x32\…\{8F899627-1EA1-484D-91EA-7B22C05358DB}) (Version: 6.00.0000 - Worden Brothers Inc)
TextPad 4 (HKLM-x32\…\TextPad 4) (Version: - )
thinkorswim (HKLM\…\9968-4488-2169-7623) (Version: desktop - thinkorswim, Inc)
TradeStation 9.5 (HKLM-x32\…\{E02A3EE0-1193-454C-8E59-BDFCE6EC7B22}) (Version: 9.05.01.3258 - TradeStation Technologies)
Update for 2007 Microsoft Office System (KB967642) (HKLM-x32\…\{91120000-0014-0000-0000-0000000FF1CE}_PROR_{C444285D-5E4F-48A4-91DD-47AAAA68E92D}) (Version: - Microsoft)
UpdateService (HKLM-x32\…\{E3AE96D6-E196-45B4-AF62-2B41998B9E37}) (Version: 1.0.0 - RealNetworks, Inc.) Hidden
vc2012_redist (HKLM-x32\…\{9402AEF2-5981-4097-8BE2-6501DAC4DBFD}) (Version: 1.0.0.0 - Realnetworks) Hidden
VD64Inst (HKLM\…\{22ABA92B-6C1B-46D8-AC2B-C48EEAE172A9}) (Version: 1.00.0000 - Roxio, Inc.) Hidden
Video Downloader (HKLM-x32\…\{4C68AE5C-915A-492A-AFCD-B630ECB9522D}) (Version: 18.1.9 - RealNetworks) Hidden
VLC media player (HKLM-x32\…\VLC media player) (Version: 2.2.4 - VideoLAN)
vs2015_redist x86 (HKLM-x32\…\{BD46163A-0331-4A61-B65A-7B66D7C93F8E}) (Version: 1.0.0.0 - Realnetworks) Hidden
WinHex (HKLM-x32\…\WinHex) (Version: - )
Wizardry 8 (HKLM-x32\…\Wizardry 8) (Version: - )
Zoom (HKU\S-1-5-21-2367635994-1441107805-3879806124-1000\…\ZoomUMX) (Version: 4.0 - Zoom Video Communications, Inc.)

==================== Custom CLSID (Whitelisted): ==========================

(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)

CustomCLSID: HKU\S-1-5-21-2367635994-1441107805-3879806124-1000_Classes\CLSID\{820D63D5-8CFF-46DE-86AF-4997DEDD6DB5}\localserver32 -> C:\Windows\system32\igfxEM.exe (Intel Corporation)
CustomCLSID: HKU\S-1-5-21-2367635994-1441107805-3879806124-1000_Classes\CLSID\{84B5A313-CD5D-4904-8BA2-AFDC81C1B309}\InprocServer32 -> C:\Users\Terry Felter\AppData\Local\GoToMeeting\8126\G2MOutlookAddin64.dll (LogMeIn, Inc.)
ContextMenuHandlers1: [EPP] -> {09A47860-11B0-4DA5-AFA5-26D86198A780} => c:\Program Files\Microsoft Security Client\shellext.dll [2016-11-14] (Microsoft Corporation)
ContextMenuHandlers1: [Glary Utilities] -> {B3C418F8-922B-4faf-915E-59BC14448CF7} => C:\Program Files (x86)\Glary Utilities 5\x64\ContextHandler.dll [2016-06-22] (Glarysoft Ltd)
ContextMenuHandlers1: [RXDCExtSvr] -> {0FB82570-BB2D-23D3-8D3B-AC2F34F1FA3C} => C:\Program Files\Roxio\Easy CD creator 8\Virtual Drive\DC_ShellExt64.dll [2006-10-26] (Sonic Solutions)
ContextMenuHandlers1: [SDECon32] -> {44176360-2BBF-4EC1-93CE-384B8681A0BC} => C:\Program Files (x86)\Spybot - Search & Destroy 2\SDECon64.dll [2014-06-24] (Safer-Networking Ltd.)
ContextMenuHandlers1: [SDECon64] -> {44176360-2BBF-4EC1-93CE-384B8681A0BC} => C:\Program Files (x86)\Spybot - Search & Destroy 2\SDECon64.dll [2014-06-24] (Safer-Networking Ltd.)
ContextMenuHandlers1: [SnagItMainShellExt] -> {CF74B903-3389-469c-B3B6-0204D204FCBD} => C:\Program Files (x86)\TechSmith\Snagit 11\DLLx64\SnagitShellExt64.dll [2014-04-18] (TechSmith Corporation)
ContextMenuHandlers2: [EPP] -> {09A47860-11B0-4DA5-AFA5-26D86198A780} => c:\Program Files\Microsoft Security Client\shellext.dll [2016-11-14] (Microsoft Corporation)
ContextMenuHandlers2: [Glary Utilities] -> {B3C418F8-922B-4faf-915E-59BC14448CF7} => C:\Program Files (x86)\Glary Utilities 5\x64\ContextHandler.dll [2016-06-22] (Glarysoft Ltd)
ContextMenuHandlers2: [RXDCExtSvr] -> {0FB82570-BB2D-23D3-8D3B-AC2F34F1FA3C} => C:\Program Files\Roxio\Easy CD creator 8\Virtual Drive\DC_ShellExt64.dll [2006-10-26] (Sonic Solutions)
ContextMenuHandlers3: [MBAMShlExt] -> {57CE581A-0CB6-4266-9CA0-19364C90A0B3} => C:\Program Files\Malwarebytes\Anti-Malware\mbshlext.dll [2017-11-01] (Malwarebytes)
ContextMenuHandlers3: [{4A7C4306-57E0-4C0C-83A9-78C1528F618C}] -> {4A7C4306-57E0-4C0C-83A9-78C1528F618C} => c:\program files (x86)\real\realplayer\RPDS\Bin64\rpcontextmenu.dll [2017-09-18] (RealNetworks, Inc.)
ContextMenuHandlers4: [EPP] -> {09A47860-11B0-4DA5-AFA5-26D86198A780} => c:\Program Files\Microsoft Security Client\shellext.dll [2016-11-14] (Microsoft Corporation)
ContextMenuHandlers4: [SnagItMainShellExt] -> {CF74B903-3389-469c-B3B6-0204D204FCBD} => C:\Program Files (x86)\TechSmith\Snagit 11\DLLx64\SnagitShellExt64.dll [2014-04-18] (TechSmith Corporation)
ContextMenuHandlers5: [igfxcui] -> {3AB1675A-CCFF-11D2-8B20-00A0C93CB1F4} => -> No File
ContextMenuHandlers5: [igfxDTCM] -> {9B5F5829-A529-4B12-814A-E81BCB8D93FC} => C:\Windows\system32\igfxDTCM.dll [2016-06-15] (Intel Corporation)
ContextMenuHandlers6: [Glary Utilities] -> {B3C418F8-922B-4faf-915E-59BC14448CF7} => C:\Program Files (x86)\Glary Utilities 5\x64\ContextHandler.dll [2016-06-22] (Glarysoft Ltd)
ContextMenuHandlers6: [MBAMShlExt] -> {57CE581A-0CB6-4266-9CA0-19364C90A0B3} => C:\Program Files\Malwarebytes\Anti-Malware\mbshlext.dll [2017-11-01] (Malwarebytes)
ContextMenuHandlers6: [RXDCExtSvr] -> {0FB82570-BB2D-23D3-8D3B-AC2F34F1FA3C} => C:\Program Files\Roxio\Easy CD creator 8\Virtual Drive\DC_ShellExt64.dll [2006-10-26] (Sonic Solutions)
ContextMenuHandlers6: [SDECon32] -> {44176360-2BBF-4EC1-93CE-384B8681A0BC} => C:\Program Files (x86)\Spybot - Search & Destroy 2\SDECon64.dll [2014-06-24] (Safer-Networking Ltd.)
ContextMenuHandlers6: [SDECon64] -> {44176360-2BBF-4EC1-93CE-384B8681A0BC} => C:\Program Files (x86)\Spybot - Search & Destroy 2\SDECon64.dll [2014-06-24] (Safer-Networking Ltd.)

==================== Scheduled Tasks (Whitelisted) =============

(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)

Task: {075A5949-CAFD-4660-A639-723DF4845B4F} - System32\Tasks\RealDownloaderRealUpgradeLogonTaskS-1-5-21-2367635994-1441107805-3879806124-1000 => C:\program files (x86)\real\RealDownloader\RealUpgrade.exe [2017-08-17] (RealNetworks, Inc.)
Task: {170906E0-7358-493C-8CF0-C02CB5C6C952} - System32\Tasks\TradeStation Backup - Weekly => C:\Program Files (x86)\TradeStation 9.5\Program\TSBackupRestore.exe [2017-08-03] (TradeStation Technologies, Inc.)
Task: {186E8F3F-9C67-41B7-88E6-F6C2D26CFA9B} - System32\Tasks\TradeStation Backup - Monthly => C:\Program Files (x86)\TradeStation 9.5\Program\TSBackupRestore.exe [2017-08-03] (TradeStation Technologies, Inc.)
Task: {3ABFC59F-03AE-4F5A-803D-FC97102B6779} - System32\Tasks\Games\UpdateCheck_S-1-5-21-2367635994-1441107805-3879806124-1000
Task: {3DC45861-BD38-4286-A655-F19E22D24959} - System32\Tasks\Safer-Networking\Spybot - Search and Destroy\Scan the system => C:\Program Files (x86)\Spybot - Search & Destroy 2\SDScan.exe [2016-03-21] (Safer-Networking Ltd.)
Task: {5F57B0C4-EA21-49DC-ADE9-12ADC9DEA4F2} - System32\Tasks\Adobe Acrobat Update Task => C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe [2017-09-27] (Adobe Systems Incorporated)
Task: {6091D538-8881-47FE-8E22-F442FD763B4D} - System32\Tasks\{EF8C83D9-3C53-473E-813C-98689ED9E038} => C:\Windows\system32\pcalua.exe -a "C:\Program Files (x86)\Microsoft Office\Office97\Office\Setup\Acme.exe" -c /w Off97Pro.STF
Task: {6C10B7BE-DF79-4710-A875-ECC355B4383E} - System32\Tasks\Safer-Networking\Spybot - Search and Destroy\Refresh immunization => C:\Program Files (x86)\Spybot - Search & Destroy 2\SDImmunize.exe [2016-03-21] (Safer-Networking Ltd.)
Task: {8B8AB466-C86B-4F0A-8A22-01E961DC5D63} - System32\Tasks\G2MUpdateTask-S-1-5-21-2367635994-1441107805-3879806124-1000 => C:\Users\Terry Felter\AppData\Local\GoToMeeting\8126\g2mupdate.exe [2017-12-21] (LogMeIn, Inc.)
Task: {90AAE941-F55F-40E8-B0F7-598D6624BBC2} - System32\Tasks\CCleanerSkipUAC => C:\Program Files\CCleaner\CCleaner.exe [2014-07-23] (Piriform Ltd)
Task: {917A7F84-EB13-4448-AA42-13817A4F0060} - System32\Tasks\{91783E60-1194-4502-9BAA-133A86C52494} => C:\Windows\system32\pcalua.exe -a E:\EliteInstallerBeta.exe -d E:\
Task: {9876D896-4F92-4051-B6D2-6C767D96B736} - System32\Tasks\GlaryInitialize 5 => C:\Program Files (x86)\Glary Utilities 5\Initialize.exe [2018-01-07] (Glarysoft Ltd)
Task: {B1CE90FE-B942-418D-A5FA-272138690016} - System32\Tasks\RealDownloaderRealUpgradeScheduledTaskS-1-5-21-2367635994-1441107805-3879806124-1000 => C:\program files (x86)\real\RealDownloader\RealUpgrade.exe [2017-08-17] (RealNetworks, Inc.)
Task: {B3B71BEC-6C77-4EC7-8505-0D507AB819EF} - System32\Tasks\Microsoft\Microsoft Antimalware\Microsoft Antimalware Scheduled Scan => c:\Program Files\Microsoft Security Client\\MpCmdRun.exe [2016-11-14] (Microsoft Corporation)
Task: {BE7A1227-B861-4AF4-8DE5-0CD732E95226} - System32\Tasks\Apple\AppleSoftwareUpdate => C:\Program Files (x86)\Apple Software Update\SoftwareUpdate.exe [2016-02-23] (Apple Inc.)
Task: {BFAAFAC3-A956-4D4A-8A8E-BFEF387347FC} - System32\Tasks\Adobe Flash Player Updater => C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe [2018-01-09] (Adobe Systems Incorporated)
Task: {C13DF9E2-CA9C-47DA-81BA-73F58F0EDF75} - System32\Tasks\RealDownloader Update Check => C:\program files (x86)\real\realplayer\RealDownloader\downloader2.exe
Task: {C391A76D-EFC1-4280-B119-7627629FD0D8} - System32\Tasks\GU5SkipUAC => C:\Program Files (x86)\Glary Utilities 5\Integrator.exe [2018-01-07] (Glarysoft Ltd)
Task: {C6DA39C6-AB3C-4FEE-BB51-25942B1F6C0E} - System32\Tasks\G2MUploadTask-S-1-5-21-2367635994-1441107805-3879806124-1000 => C:\Users\Terry Felter\AppData\Local\GoToMeeting\8126\g2mupload.exe [2017-12-21] (LogMeIn, Inc.)
Task: {E8B3BC43-C96F-4C64-A658-27AC7E5E638C} - System32\Tasks\TechSmith Updater => C:\Program Files (x86)\Common Files\TechSmith Shared\Updater\TSCUpdClt.exe [2013-10-04] (TechSmith Corporation)
Task: {F1E0327C-FF69-4D7B-90F8-D9288AA0ED35} - System32\Tasks\Safer-Networking\Spybot - Search and Destroy\Check for updates => C:\Program Files (x86)\Spybot - Search & Destroy 2\SDUpdate.exe [2014-06-27] (Safer-Networking Ltd.)

(If an entry is included in the fixlist, the task (.job) file will be moved. The file which is running by the task will not be moved.)

Task: C:\Windows\Tasks\G2MUpdateTask-S-1-5-21-2367635994-1441107805-3879806124-1000.job => C:\Users\Terry Felter\AppData\Local\GoToMeeting\8126\g2mupdate.exe
Task: C:\Windows\Tasks\G2MUploadTask-S-1-5-21-2367635994-1441107805-3879806124-1000.job => C:\Users\Terry Felter\AppData\Local\GoToMeeting\8126\g2mupload.exe
Task: C:\Windows\Tasks\TradeStation Backup - Monthly.job => C:\Program Files (x86)\TradeStation 9.5\Program\TSBackupRestore.exeM/Backup C:\Program Files (x86)\TradeStation 9.5\Templates\Backup\Monthly.tsb
Task: C:\Windows\Tasks\TradeStation Backup - Weekly.job => C:\Program Files (x86)\TradeStation 9.5\Program\TSBackupRestore.exeL/Backup C:\Program Files (x86)\TradeStation 9.5\Templates\Backup\Weekly.tsb

==================== Shortcuts & WMI ========================

(The entries could be listed to be restored or removed.)

==================== Loaded Modules (Whitelisted) ==============

2018-01-11 06:51 - 2017-11-29 09:11 - 002301384 _____ () C:\PROGRAM FILES\MALWAREBYTES\ANTI-MALWARE\SelfProtectionSdk.dll
1997-07-11 00:00 - 1997-07-11 00:00 - 000122880 _____ () C:\Program Files (x86)\Microsoft Office\Office97\Office\FINDFAST.EXE
2017-08-17 14:21 - 2017-08-17 14:21 - 001259704 _____ () C:\Program Files (x86)\Real\RealDownloader\downloader2.exe
2016-12-11 09:48 - 2014-05-13 12:04 - 000109400 _____ () C:\Program Files (x86)\Spybot - Search & Destroy 2\snlThirdParty150.bpl
2016-12-11 09:48 - 2014-05-13 12:04 - 000416600 _____ () C:\Program Files (x86)\Spybot - Search & Destroy 2\DEC150.bpl
2016-12-11 09:48 - 2014-05-13 12:04 - 000167768 _____ () C:\Program Files (x86)\Spybot - Search & Destroy 2\snlFileFormats150.bpl
2016-12-11 09:48 - 2012-08-23 10:38 - 000574840 _____ () C:\Program Files (x86)\Spybot - Search & Destroy 2\sqlite3.dll
2016-12-11 09:48 - 2012-04-03 17:06 - 000565640 _____ () C:\Program Files (x86)\Spybot - Search & Destroy 2\av\BDSmartDB.dll
1998-06-01 00:00 - 1998-06-01 00:00 - 003792896 _____ () C:\Program Files (x86)\Microsoft Office\Office97\Office\MSO97.DLL
2006-10-27 08:17 - 2006-10-27 08:17 - 000516096 _____ () C:\Program Files (x86)\Common Files\Roxio Shared\9.0\DLLShared\LayoutDll9.dll
2006-10-27 08:13 - 2006-10-27 08:13 - 004587520 ____R () C:\Program Files (x86)\Common Files\Roxio Shared\9.0\DLLShared\ROXIPP41.dll
2018-01-07 20:15 - 2018-01-07 20:15 - 000087024 _____ () C:\Program Files (x86)\Glary Utilities 5\zlib1.dll
1997-07-11 00:00 - 1997-07-11 00:00 - 000036864 _____ () C:\Windows\SysWow64\docobj.dll

==================== Alternate Data Streams (Whitelisted) =========

(If an entry is included in the fixlist, only the ADS will be removed.)

AlternateDataStreams: C:\Users\Terry Felter\Documents\080105House.JPG:Roxio EMC Stream [38]
AlternateDataStreams: C:\Users\Terry Felter\Documents\Flappi~1.gif:Roxio EMC Stream [38]
AlternateDataStreams: C:\Users\Terry Felter\Documents\Image.jpg:Roxio EMC Stream [38]
AlternateDataStreams: C:\Users\Terry Felter\Documents\Image1.jpg:Roxio EMC Stream [38]
AlternateDataStreams: C:\Users\Terry Felter\Documents\remotecontrol.jpg:Roxio EMC Stream [38]
AlternateDataStreams: C:\Users\Terry Felter\Documents\SANDWICH.PNG:Roxio EMC Stream [38]
AlternateDataStreams: C:\Users\Terry Felter\Documents\Ugly Blue Pants.bmp:Roxio EMC Stream [38]
AlternateDataStreams: C:\Users\Terry Felter\Documents\Work.jpg:Roxio EMC Stream [38]

==================== Safe Mode (Whitelisted) ===================

(If an entry is included in the fixlist, it will be removed from the registry. The "AlternateShell" will be restored.)

HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\MBAMService => ""="Service"
HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\Wdf01000.sys => ""="Driver"
HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\atashost => ""="Service"
HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\MBAMService => ""="Service"
HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\Wdf01000.sys => ""="Driver"

==================== Association (Whitelisted) ===============

(If an entry is included in the fixlist, the registry item will be restored to default or removed.)

==================== Internet Explorer trusted/restricted ===============

(If an entry is included in the fixlist, it will be removed from the registry.)

IE trusted site: HKU\S-1-5-21-2367635994-1441107805-3879806124-1000\…\asstr.org -> hxxp://assm1.asstr.org
IE trusted site: HKU\S-1-5-21-2367635994-1441107805-3879806124-1000\…\dell.com -> dell.com

==================== Hosts content: ==========================

(If needed Hosts: directive could be included in the fixlist to reset Hosts.)

2009-07-13 20:34 - 2018-01-11 06:01 - 000002103 _____ C:\Windows\system32\Drivers\etc\hosts

0.0.0.0 0.0.0.0 # fix for traceroute and netstat display anomaly
0.0.0.0 tracking.opencandy.com.s3.amazonaws.com
0.0.0.0 media.opencandy.com
0.0.0.0 cdn.opencandy.com
0.0.0.0 tracking.opencandy.com
0.0.0.0 api.opencandy.com
0.0.0.0 api.recommendedsw.com
0.0.0.0 rp.yefeneri2.com
0.0.0.0 os.yefeneri2.com
0.0.0.0 os2.yefeneri2.com
0.0.0.0 installer.betterinstaller.com
0.0.0.0 installer.filebulldog.com
0.0.0.0 d3oxtn1x3b8d7i.cloudfront.net
0.0.0.0 inno.bisrv.com
0.0.0.0 nsis.bisrv.com
0.0.0.0 cdn.file2desktop.com
0.0.0.0 cdn.goateastcach.us
0.0.0.0 cdn.guttastatdk.us
0.0.0.0 cdn.inskinmedia.com
0.0.0.0 cdn.insta.oibundles2.com
0.0.0.0 cdn.insta.playbryte.com
0.0.0.0 cdn.llogetfastcach.us
0.0.0.0 cdn.montiera.com
0.0.0.0 cdn.msdwnld.com
0.0.0.0 cdn.mypcbackup.com
0.0.0.0 cdn.ppdownload.com
0.0.0.0 cdn.riceateastcach.us
0.0.0.0 cdn.shyapotato.us
0.0.0.0 cdn.solimba.com
0.0.0.0 cdn.tuto4pc.com

==================== Other Areas ============================

(Currently there is no automatic fix for this section.)

HKU\S-1-5-21-2367635994-1441107805-3879806124-1000\Control Panel\Desktop\\Wallpaper -> C:\Users\Terry Felter\AppData\Roaming\Microsoft\Windows\Themes\TranscodedWallpaper.jpg
DNS Servers: 75.75.75.75 - 75.75.76.76
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System => (ConsentPromptBehaviorAdmin: 5) (ConsentPromptBehaviorUser: 3) (EnableLUA: 1)
Windows Firewall is enabled.

==================== MSCONFIG/TASK MANAGER disabled items ==

MSCONFIG\Services: ApHidMonitorService => 2
MSCONFIG\Services: cphs => 3
MSCONFIG\Services: ICCS => 3
MSCONFIG\Services: igfxCUIService1.0.0.0 => 2
MSCONFIG\Services: Intel(R) Capability Licensing Service Interface => 2
MSCONFIG\Services: Intel(R) Capability Licensing Service TCP IP Interface => 3
MSCONFIG\Services: jhi_service => 2
MSCONFIG\Services: LMS => 2
MSCONFIG\Services: MozillaMaintenance => 3
MSCONFIG\Services: RealPlayerUpdateSvc => 2
MSCONFIG\Services: TeamViewer9 => 2
MSCONFIG\Services: wltrysvc => 2
MSCONFIG\startupfolder: C:^ProgramData^Microsoft^Windows^Start Menu^Programs^Startup^Snagit 11.lnk => C:\Windows\pss\Snagit 11.lnk.CommonStartup
MSCONFIG\startupreg: Broadcom Wireless Manager UI => C:\Program Files\Dell\DW WLAN Card\WLTRAY.exe

==================== FirewallRules (Whitelisted) ===============

(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)

FirewallRules: [{C9709DAF-1E8C-4055-BC02-87C77A1C0656}] => (Allow) C:\Program Files (x86)\Mozilla Firefox\firefox.exe
FirewallRules: [{EE36DD2A-0741-44B7-B1C6-2E2A6B71DDF8}] => (Allow) C:\Program Files (x86)\Mozilla Firefox\firefox.exe
FirewallRules: [TCP Query User{9C8B4D1F-FA10-4FBB-8DB1-F42B65E8D2CA}C:\program files (x86)\esignal\winros.exe] => (Allow) C:\program files (x86)\esignal\winros.exe
FirewallRules: [UDP Query User{A270DBC1-095D-415E-8C03-557AE874F14E}C:\program files (x86)\esignal\winros.exe] => (Allow) C:\program files (x86)\esignal\winros.exe
FirewallRules: [{334EDA36-233E-414B-ABA7-4B7610D17FEF}] => (Allow) LPort=8298
FirewallRules: [{3365DD31-9AB4-4707-977A-F62DDC25675E}] => (Allow) C:\Program Files (x86)\Common Files\Apple\Apple Application Support\WebKit2WebProcess.exe
FirewallRules: [{155D4B1D-92F2-40C7-85AE-F888C2B486E3}] => (Allow) C:\Users\Terry Felter\AppData\Local\Chromium\Application\chrome.exe
FirewallRules: [{3F4704C4-7161-4F1F-8ADC-02907F064308}] => (Allow) C:\Program Files (x86)\TeamViewer\Version9\TeamViewer.exe
FirewallRules: [{E1E4F2E6-720F-4F92-B4F7-60664CE9A0B2}] => (Allow) C:\Program Files (x86)\TeamViewer\Version9\TeamViewer.exe
FirewallRules: [{6DB04191-9661-4B16-A335-0E333434DC62}] => (Allow) C:\Program Files (x86)\TeamViewer\Version9\TeamViewer_Service.exe
FirewallRules: [{96B6C630-76BB-432B-A8D9-19AC830DDC1C}] => (Allow) C:\Program Files (x86)\TeamViewer\Version9\TeamViewer_Service.exe
FirewallRules: [{3C685D88-5D1D-44FF-B1D2-959D857439C4}] => (Allow) C:\Program Files (x86)\TradeStation 9.5\Program\ORCAL.exe
FirewallRules: [{FFBD1CAD-903B-4D84-BACA-2FAB57A83271}] => (Allow) C:\Program Files (x86)\TradeStation 9.5\Program\ORCAL.exe
FirewallRules: [{B26F8249-D450-4919-8193-90170BA19071}] => (Allow) C:\Program Files (x86)\TradeStation 9.5\Program\ORCAL.exe
FirewallRules: [{8F861C9A-9715-4D04-9E19-F8D9A52715C0}] => (Allow) C:\Program Files (x86)\TradeStation 9.5\Program\ORCAL.exe
FirewallRules: [{BACB0AFB-87DA-4176-B343-9905E359749D}] => (Allow) C:\Program Files (x86)\TradeStation 9.5\Program\orchart.exe
FirewallRules: [{3A52071E-BA73-4B10-A3B6-A4F777CFEA39}] => (Allow) C:\Program Files (x86)\TradeStation 9.5\Program\orchart.exe
FirewallRules: [{DA246B85-DAFC-4614-90FE-CC13856E57AB}] => (Allow) C:\Program Files (x86)\TradeStation 9.5\Program\orchart.exe
FirewallRules: [{82275915-B817-407C-97FC-BDADF6DADE84}] => (Allow) C:\Program Files (x86)\TradeStation 9.5\Program\orchart.exe
FirewallRules: [{A332A558-7071-46AD-B6A9-6EA30CFEDFDB}] => (Allow) C:\Program Files (x86)\TradeStation 9.5\Program\ORCLPrxy.exe
FirewallRules: [{AFECF886-576F-444F-A716-0FA3119C2FAE}] => (Allow) C:\Program Files (x86)\TradeStation 9.5\Program\ORCLPrxy.exe
FirewallRules: [{65658C21-F4BB-4535-B5E6-116474DCF529}] => (Allow) C:\Program Files (x86)\TradeStation 9.5\Program\ORCLPrxy.exe
FirewallRules: [{FBA327B9-0FCB-4C51-A80A-344104FE4871}] => (Allow) C:\Program Files (x86)\TradeStation 9.5\Program\ORCLPrxy.exe
FirewallRules: [{973DC363-4029-49DA-ABCD-1D60E256F944}] => (Allow) C:\Program Files (x86)\TradeStation 9.5\Program\ORDllHst.exe
FirewallRules: [{8B52DCE6-39E7-47AA-BA3C-2C210641E8A8}] => (Allow) C:\Program Files (x86)\TradeStation 9.5\Program\ORDllHst.exe
FirewallRules: [{51DE9854-6B23-4D7E-A183-CDF74A87699D}] => (Allow) C:\Program Files (x86)\TradeStation 9.5\Program\ORDllHst.exe
FirewallRules: [{C0572C51-6833-4456-B9B2-50BDA44A4509}] => (Allow) C:\Program Files (x86)\TradeStation 9.5\Program\ORDllHst.exe
FirewallRules: [{FF07DE1E-8176-405A-BB53-E3B8F9DC9393}] => (Allow) C:\Program Files (x86)\TradeStation 9.5\Program\ORPlat.exe
FirewallRules: [{8F05E034-1550-4F91-A243-062F3E6D4943}] => (Allow) C:\Program Files (x86)\TradeStation 9.5\Program\ORPlat.exe
FirewallRules: [{4D82D3DA-0C80-4DCF-BA07-A7724DEAC9CF}] => (Allow) C:\Program Files (x86)\TradeStation 9.5\Program\ORPlat.exe
FirewallRules: [{FC4A087B-3401-4DE8-B134-AD041A6E3C9D}] => (Allow) C:\Program Files (x86)\TradeStation 9.5\Program\ORPlat.exe
FirewallRules: [{D82A36E4-955B-41FA-97E6-BE15C9F89204}] => (Allow) C:\Program Files (x86)\TradeStation 9.5\Program\PatchDownloader.exe
FirewallRules: [{26F911BD-27E0-4843-8E63-9BB2A2139E34}] => (Allow) C:\Program Files (x86)\TradeStation 9.5\Program\PatchDownloader.exe
FirewallRules: [{4465B587-505B-40A3-ABCB-EBD924E5E563}] => (Allow) C:\Program Files (x86)\TradeStation 9.5\Program\PatchDownloader.exe
FirewallRules: [{029D83F7-ED7F-4C6D-8BEA-D216EC6B2780}] => (Allow) C:\Program Files (x86)\TradeStation 9.5\Program\PatchDownloader.exe
FirewallRules: [{192AEAC7-3F7F-4E4F-89FD-3DA1DD4FA986}] => (Allow) C:\Program Files (x86)\TradeStation 9.5\Program\PatchInstaller.exe
FirewallRules: [{0167EC42-B0C5-4F45-BF68-89C1AE13A2C7}] => (Allow) C:\Program Files (x86)\TradeStation 9.5\Program\PatchInstaller.exe
FirewallRules: [{2B74ACC1-73B4-4F0B-AB8C-08428F392404}] => (Allow) C:\Program Files (x86)\TradeStation 9.5\Program\PatchInstaller.exe
FirewallRules: [{CF43A87B-3FA4-4913-B003-FF4AED510D07}] => (Allow) C:\Program Files (x86)\TradeStation 9.5\Program\PatchInstaller.exe
FirewallRules: [{5111A6C3-3E60-460E-AD8B-8436CD5822C3}] => (Allow) C:\Program Files (x86)\TradeStation 9.5\Program\TradeStationAgentForms.exe
FirewallRules: [{85B16C5E-469C-4405-B600-4B1D16AAD13A}] => (Allow) C:\Program Files (x86)\TradeStation 9.5\Program\TradeStationAgentForms.exe
FirewallRules: [{1DA49D94-D9A3-413B-9175-685A4A515B52}] => (Allow) C:\Program Files (x86)\TradeStation 9.5\Program\TradeStationAgentForms.exe
FirewallRules: [{DB00E3DA-72E2-4FA3-9710-34BD1C2F4933}] => (Allow) C:\Program Files (x86)\TradeStation 9.5\Program\TradeStationAgentForms.exe
FirewallRules: [{5D67326C-33C1-4990-A78A-2E66763131A8}] => (Allow) C:\Program Files (x86)\TradeStation 9.5\Program\TSBackupRestore.exe
FirewallRules: [{3C242750-CE6C-47B5-A738-F51AE5DE631F}] => (Allow) C:\Program Files (x86)\TradeStation 9.5\Program\TSBackupRestore.exe
FirewallRules: [{100A7D8F-BBDD-464D-9152-BF30F0D8105A}] => (Allow) C:\Program Files (x86)\TradeStation 9.5\Program\TSBackupRestore.exe
FirewallRules: [{A4EEBD36-BFB5-4934-80DC-F740972A4D02}] => (Allow) C:\Program Files (x86)\TradeStation 9.5\Program\TSBackupRestore.exe
FirewallRules: [{88C31A58-CA32-4ECE-B105-54116A76501A}] => (Allow) C:\Program Files (x86)\TradeStation 9.5\Program\TSBrowse.exe
FirewallRules: [{83375C26-1C82-4C95-9860-722711B6CB6A}] => (Allow) C:\Program Files (x86)\TradeStation 9.5\Program\TSBrowse.exe
FirewallRules: [{6FAC8B1C-A1FD-4DCE-9C7B-BC8486CD6059}] => (Allow) C:\Program Files (x86)\TradeStation 9.5\Program\TSBrowse.exe
FirewallRules: [{E1F84374-E971-4607-B585-9B63E5111BF2}] => (Allow) C:\Program Files (x86)\TradeStation 9.5\Program\TSBrowse.exe
FirewallRules: [{83FBDB5F-C20E-4255-AB15-E96D3BAC8D7A}] => (Allow) C:\Program Files (x86)\TradeStation 9.5\Program\TSDev.exe
FirewallRules: [{9E97DB24-3046-4525-9BEE-064624E24420}] => (Allow) C:\Program Files (x86)\TradeStation 9.5\Program\TSDev.exe
FirewallRules: [{3ACD2065-397D-4BD8-86B8-F4258F4DFD1F}] => (Allow) C:\Program Files (x86)\TradeStation 9.5\Program\TSDev.exe
FirewallRules: [{83392770-3C81-4FCD-A71B-598A4C2585B1}] => (Allow) C:\Program Files (x86)\TradeStation 9.5\Program\TSDev.exe
FirewallRules: [{26D8B27F-8D4A-4EA9-85FF-379C13F9B1A2}] => (Allow) C:\Program Files (x86)\TradeStation 9.5\Program\tsospro.EXE
FirewallRules: [{1627FE6B-C90B-43B7-9A56-F61BB1FF0B9D}] => (Allow) C:\Program Files (x86)\TradeStation 9.5\Program\tsospro.EXE
FirewallRules: [{2BC588A3-58B7-484B-AADF-4B7E6DF89AA3}] => (Allow) C:\Program Files (x86)\TradeStation 9.5\Program\tsospro.EXE
FirewallRules: [{A5F7D647-C415-4BC4-AE72-380FC35D977F}] => (Allow) C:\Program Files (x86)\TradeStation 9.5\Program\tsospro.EXE
FirewallRules: [{63173D05-97D7-46C6-AE40-D6D28376FECE}] => (Allow) C:\Program Files (x86)\TradeStation 9.5\Program\TSQuote.exe
FirewallRules: [{FBD6C314-7001-4ACD-85A7-E4D392CBD897}] => (Allow) C:\Program Files (x86)\TradeStation 9.5\Program\TSQuote.exe
FirewallRules: [{93EC28A9-AF08-43E8-A955-EFFF25B64579}] => (Allow) C:\Program Files (x86)\TradeStation 9.5\Program\TSQuote.exe
FirewallRules: [{60A0C751-D92B-4727-9FA2-2BBEF4722294}] => (Allow) C:\Program Files (x86)\TradeStation 9.5\Program\TSQuote.exe
FirewallRules: [{4CD10C82-3BC9-4730-81A4-064ECA21C509}] => (Allow) C:\Program Files (x86)\TradeStation 9.5\Program\TSRPTS.exe
FirewallRules: [{A1A24D1E-D2A7-47BD-866B-119B9B522C63}] => (Allow) C:\Program Files (x86)\TradeStation 9.5\Program\TSRPTS.exe
FirewallRules: [{16FF3A9D-4F54-44E5-A8DE-A3D907A1D959}] => (Allow) C:\Program Files (x86)\TradeStation 9.5\Program\TSRPTS.exe
FirewallRules: [{1D7E59C3-C96C-4D9F-BF51-451533E4B93C}] => (Allow) C:\Program Files (x86)\TradeStation 9.5\Program\TSRPTS.exe
FirewallRules: [{DB2A5382-AD54-496F-A2DC-E74F0AB94B20}] => (Allow) C:\Program Files (x86)\TradeStation 9.5\Program\TSScanner.exe
FirewallRules: [{5DD0D51D-C22F-4625-A4B5-1E9708929A5C}] => (Allow) C:\Program Files (x86)\TradeStation 9.5\Program\TSScanner.exe
FirewallRules: [{FB9D9512-F47C-4F05-A0A6-B46F94920BA3}] => (Allow) C:\Program Files (x86)\TradeStation 9.5\Program\TSScanner.exe
FirewallRules: [{D7A59B4A-8E54-460A-9138-46E04FF95025}] => (Allow) C:\Program Files (x86)\TradeStation 9.5\Program\TSScanner.exe
FirewallRules: [{8A0D6C82-BC47-4F59-9F2E-5E2CF9D256AF}] => (Allow) C:\Program Files (x86)\TradeStation 9.5\Program\TSSupp.exe
FirewallRules: [{D17DC4B6-E981-411A-A134-656DDB580418}] => (Allow) C:\Program Files (x86)\TradeStation 9.5\Program\TSSupp.exe
FirewallRules: [{25DE5CE2-EFB1-4CB7-9E00-565D50B94428}] => (Allow) C:\Program Files (x86)\TradeStation 9.5\Program\TSSupp.exe
FirewallRules: [{6114042D-7393-465A-B0AB-F75304814FB6}] => (Allow) C:\Program Files (x86)\TradeStation 9.5\Program\TSSupp.exe
FirewallRules: [{F52CF7DA-7226-4DA9-B424-9FECA2A1C38F}] => (Allow) C:\Program Files (x86)\TradeStation 9.5\Program\WFO.exe
FirewallRules: [{14E861B9-5D9F-46CD-9F83-4AFB65B415B8}] => (Allow) C:\Program Files (x86)\TradeStation 9.5\Program\WFO.exe
FirewallRules: [{1C78C9D3-979C-4AF1-BCC8-0B5F9D30F56B}] => (Allow) C:\Program Files (x86)\TradeStation 9.5\Program\WFO.exe
FirewallRules: [{6385F76B-B9A7-4C0C-A9C3-FF257E34EAE4}] => (Allow) C:\Program Files (x86)\TradeStation 9.5\Program\WFO.exe
FirewallRules: [{EAE07467-B4E4-4817-A110-F89BE7D46E12}] => (Allow) C:\Program Files (x86)\TradeStation 9.5\Program\WHServer.exe
FirewallRules: [{16478E35-E855-47FD-B65A-11FB87CB048F}] => (Allow) C:\Program Files (x86)\TradeStation 9.5\Program\WHServer.exe
FirewallRules: [{10EAA9DE-CB78-4107-A0F3-AF87704CFFEA}] => (Allow) C:\Program Files (x86)\TradeStation 9.5\Program\WHServer.exe
FirewallRules: [{D542CBF2-A03C-4F69-B272-0CA097A5C7DE}] => (Allow) C:\Program Files (x86)\TradeStation 9.5\Program\WHServer.exe
FirewallRules: [{5FA0D6FA-4C25-4806-BC1F-5A733E70F083}] => (Allow) c:\program files (x86)\real\realplayer\RPDS\Bin\rpdsvc.exe
FirewallRules: [TCP Query User{055B33F6-E336-4A84-8D07-B28858060C5C}C:\program files (x86)\mozilla firefox\firefox.exe] => (Allow) C:\program files (x86)\mozilla firefox\firefox.exe
FirewallRules: [UDP Query User{56424532-0EB5-4D9A-8C40-E2206B9E28C0}C:\program files (x86)\mozilla firefox\firefox.exe] => (Allow) C:\program files (x86)\mozilla firefox\firefox.exe
StandardProfile\AuthorizedApplications: [C:\Program Files (x86)\Spybot - Search & Destroy 2\SDTray.exe] => Enabled:Spybot - Search & Destroy tray access
StandardProfile\AuthorizedApplications: [C:\Program Files (x86)\Spybot - Search & Destroy 2\SDFSSvc.exe] => Enabled:Spybot-S&D; 2 Scanner Service
StandardProfile\AuthorizedApplications: [C:\Program Files (x86)\Spybot - Search & Destroy 2\SDUpdate.exe] => Enabled:Spybot-S&D; 2 Updater
StandardProfile\AuthorizedApplications: [C:\Program Files (x86)\Spybot - Search & Destroy 2\SDUpdSvc.exe] => Enabled:Spybot-S&D; 2 Background update service

==================== Restore Points =========================

04-01-2018 05:27:24 Windows Update
08-01-2018 05:25:10 Windows Update
08-01-2018 06:17:57 Windows Update

==================== Faulty Device Manager Devices =============

==================== Event log errors: =========================

Application errors:
==================
Error: (01/11/2018 07:12:24 AM) (Source: Windows Search Service) (EventID: 10021) (User: )
Description: Could not get performance counter registry info for WSearchIdxPi for instance due to the following error: The operation completed successfully. 0x0.

Error: (01/11/2018 07:11:59 AM) (Source: Windows Search Service) (EventID: 3007) (User: )
Description: Performance monitoring cannot be initialized for the gatherer object, because the counters are not loaded or the shared memory object cannot be opened. This only affects availability of the perfmon counters. Restart the computer.

Context: Application, SystemIndex Catalog

Error: (01/11/2018 07:11:58 AM) (Source: Windows Search Service) (EventID: 3006) (User: )
Description: Performance monitoring cannot be initialized for the gatherer service, because the counters are not loaded or the shared memory object cannot be opened. This only affects availability of the perfmon counters. Restart the computer.

Error: (01/11/2018 06:52:16 AM) (Source: Application Error) (EventID: 1000) (User: )
Description: Faulting application name: mbamtray.exe, version: 3.0.0.1284, time stamp: 0x5a15a98e
Faulting module name: Qt5Core.dll, version: 5.6.2.0, time stamp: 0x59a63e00
Exception code: 0xc0000005
Fault offset: 0x001aa3b6
Faulting process id: 0x9f0
Faulting application start time: 0x01d38adafe6acba2
Faulting application path: C:\Program Files\Malwarebytes\Anti-Malware\mbamtray.exe
Faulting module path: C:\Program Files\Malwarebytes\Anti-Malware\Qt5Core.dll
Report Id: 403376bb-f6ce-11e7-83d4-f01faf01a6d9

Error: (01/11/2018 06:52:12 AM) (Source: Application Error) (EventID: 1000) (User: )
Description: Faulting application name: mbamservice.exe, version: 3.1.0.595, time stamp: 0x59f745cb
Faulting module name: ScanControllerImpl.dll, version: 3.0.0.777, time stamp: 0x5a0c6f34
Exception code: 0xc0000005
Fault offset: 0x00000000000068e4
Faulting process id: 0x8fc
Faulting application start time: 0x01d38adaf87c1db3
Faulting application path: C:\Program Files\Malwarebytes\Anti-Malware\mbamservice.exe
Faulting module path: C:\PROGRAM FILES\MALWAREBYTES\ANTI-MALWARE\ScanControllerImpl.dll
Report Id: 3d7a038b-f6ce-11e7-83d4-f01faf01a6d9

Error: (01/11/2018 06:47:33 AM) (Source: Windows Search Service) (EventID: 10021) (User: )
Description: Could not get performance counter registry info for WSearchIdxPi for instance due to the following error: The operation completed successfully. 0x0.

Error: (01/11/2018 06:47:15 AM) (Source: Windows Search Service) (EventID: 3007) (User: )
Description: Performance monitoring cannot be initialized for the gatherer object, because the counters are not loaded or the shared memory object cannot be opened. This only affects availability of the perfmon counters. Restart the computer.

Context: Application, SystemIndex Catalog

Error: (01/11/2018 06:47:14 AM) (Source: Windows Search Service) (EventID: 3006) (User: )
Description: Performance monitoring cannot be initialized for the gatherer service, because the counters are not loaded or the shared memory object cannot be opened. This only affects availability of the perfmon counters. Restart the computer.

Error: (01/11/2018 06:03:19 AM) (Source: usbperf) (EventID: 2001) (User: )
Description: Unable to read the "First Counter" value under the usbperf\Performance Key. Status codes returned in data.

Error: (01/11/2018 06:02:10 AM) (Source: Windows Search Service) (EventID: 10021) (User: )
Description: Could not get performance counter registry info for WSearchIdxPi for instance due to the following error: The operation completed successfully. 0x0.

System errors:
=============
Error: (01/11/2018 07:11:58 AM) (Source: Service Control Manager) (EventID: 7026) (User: )
Description: The following boot-start or system-start driver(s) failed to load:
RxFilter

Error: (01/11/2018 06:52:21 AM) (Source: Service Control Manager) (EventID: 7032) (User: )
Description: The Service Control Manager tried to take a corrective action (Restart the service) after the unexpected termination of the Malwarebytes Service service, but this action failed with the following error:
An instance of the service is already running.

Error: (01/11/2018 06:52:16 AM) (Source: Service Control Manager) (EventID: 7031) (User: )
Description: The Malwarebytes Service service terminated unexpectedly. It has done this 1 time(s). The following corrective action will be taken in 5000 milliseconds: Restart the service.

Error: (01/11/2018 06:47:13 AM) (Source: Service Control Manager) (EventID: 7026) (User: )
Description: The following boot-start or system-start driver(s) failed to load:
RxFilter

Error: (01/11/2018 06:44:40 AM) (Source: Microsoft-Windows-WLAN-AutoConfig) (EventID: 10003) (User: NT AUTHORITY)
Description: WLAN Extensibility Module has stopped unexpectedly.

Module Path: C:\Windows\System32\bcmihvsrv64.dll

Error: (01/11/2018 06:44:40 AM) (Source: Microsoft-Windows-WLAN-AutoConfig) (EventID: 10003) (User: NT AUTHORITY)
Description: WLAN Extensibility Module has stopped unexpectedly.

Module Path: C:\Windows\System32\bcmihvsrv64.dll

Error: (01/11/2018 06:44:16 AM) (Source: Microsoft-Windows-WLAN-AutoConfig) (EventID: 10003) (User: NT AUTHORITY)
Description: WLAN Extensibility Module has stopped unexpectedly.

Module Path: C:\Windows\System32\bcmihvsrv64.dll

Error: (01/11/2018 06:44:05 AM) (Source: Schannel) (EventID: 4119) (User: NT AUTHORITY)
Description: The following fatal alert was received: 70.

Error: (01/11/2018 06:33:53 AM) (Source: Service Control Manager) (EventID: 7034) (User: )
Description: The rtop service terminated unexpectedly. It has done this 1 time(s).

CodeIntegrity:
===================================
Date: 2018-01-11 07:11:13.151
Description: Windows is unable to verify the image integrity of the file \Device\HarddiskVolume1\Windows\System32\drivers\RxFilter.sys because file hash could not be found on the system. A recent hardware or software change might have installed a file that is signed incorrectly or damaged, or that might be malicious software from an unknown source.

Date: 2018-01-11 07:11:13.010
Description: Windows is unable to verify the image integrity of the file \Device\HarddiskVolume1\Windows\System32\drivers\RxFilter.sys because file hash could not be found on the system. A recent hardware or software change might have installed a file that is signed incorrectly or damaged, or that might be malicious software from an unknown source.

Date: 2018-01-11 06:46:31.071
Description: Windows is unable to verify the image integrity of the file \Device\HarddiskVolume1\Windows\System32\drivers\RxFilter.sys because file hash could not be found on the system. A recent hardware or software change might have installed a file that is signed incorrectly or damaged, or that might be malicious software from an unknown source.

Date: 2018-01-11 06:46:30.931
Description: Windows is unable to verify the image integrity of the file \Device\HarddiskVolume1\Windows\System32\drivers\RxFilter.sys because file hash could not be found on the system. A recent hardware or software change might have installed a file that is signed incorrectly or damaged, or that might be malicious software from an unknown source.

Date: 2018-01-11 06:01:04.071
Description: Windows is unable to verify the image integrity of the file \Device\HarddiskVolume1\Windows\System32\drivers\RxFilter.sys because file hash could not be found on the system. A recent hardware or software change might have installed a file that is signed incorrectly or damaged, or that might be malicious software from an unknown source.

Date: 2018-01-11 06:01:03.931
Description: Windows is unable to verify the image integrity of the file \Device\HarddiskVolume1\Windows\System32\drivers\RxFilter.sys because file hash could not be found on the system. A recent hardware or software change might have installed a file that is signed incorrectly or damaged, or that might be malicious software from an unknown source.

Date: 2018-01-10 05:08:21.675
Description: Windows is unable to verify the image integrity of the file \Device\HarddiskVolume1\Windows\System32\drivers\RxFilter.sys because file hash could not be found on the system. A recent hardware or software change might have installed a file that is signed incorrectly or damaged, or that might be malicious software from an unknown source.

Date: 2018-01-10 05:08:21.534
Description: Windows is unable to verify the image integrity of the file \Device\HarddiskVolume1\Windows\System32\drivers\RxFilter.sys because file hash could not be found on the system. A recent hardware or software change might have installed a file that is signed incorrectly or damaged, or that might be malicious software from an unknown source.

Date: 2018-01-09 05:22:11.938
Description: Windows is unable to verify the image integrity of the file \Device\HarddiskVolume1\Windows\System32\drivers\RxFilter.sys because file hash could not be found on the system. A recent hardware or software change might have installed a file that is signed incorrectly or damaged, or that might be malicious software from an unknown source.

Date: 2018-01-09 05:22:11.782
Description: Windows is unable to verify the image integrity of the file \Device\HarddiskVolume1\Windows\System32\drivers\RxFilter.sys because file hash could not be found on the system. A recent hardware or software change might have installed a file that is signed incorrectly or damaged, or that might be malicious software from an unknown source.

==================== Memory info ===========================

Processor: Intel(R) Core(TM) i7-3540M CPU @ 3.00GHz
Percentage of memory in use: 37%
Total physical RAM: 8096.88 MB
Available physical RAM: 5087.54 MB
Total Virtual: 16191.92 MB
Available Virtual: 13438.96 MB

==================== Drives ================================

Drive c: (OSDisk) (Fixed) (Total:284.42 GB) (Free:78.46 GB) NTFS

==================== MBR & Partition Table ==================

========================================================
Disk: 0 (MBR Code: Windows 7 or 8) (Size: 298.1 GB) (Disk ID: 6A243D62)
Partition 1: (Not Active) - (Size=284.4 GB) - (Type=07 NTFS)
Partition 2: (Active) - (Size=13.7 GB) - (Type=07 NTFS)

==================== End of Addition.txt ============================

Satchfan

Post #24January 11, 2018, 3:01 PM UTC

There was a lot cleaned up there so they were worth running.

I see that you have Spybot Search & Destroy. We no longer recommend this product because of the poor testing results. I recommend uninstalling this program.

If you don't want to uninstall the program then you must at least disable Tea Timer while performing any of my instructions. You can re-enable it when we are finished.

Instructions for that are here.

If you do decide to uninstall the program, first Undo your immunisation before uninstalling. You can do that by clicking the Undo button with Spybot S&D and then remove from Add/Remove programs.

================================================

Run Farbar Recovery Scan Tool

right-click FRST/FRST64 and select ‘Run as administrator’
highlight the contents of the code box below, then press Ctrl+c):

Start::
CloseProcesses:
HKLM-x32\…\Winlogon: [Userinit] <$SYSDIR>\userinit.exe,
Winlogon\Notify\SDWinLogon-x32: SDWinLogon.dll [X]
HKU\S-1-5-21-2367635994-1441107805-3879806124-1000\…\Run: [GUDelayStartup] => C:\Program Files (x86)\Glary Utilities 5\StartupManager.exe [44016 2018-01-07] (Glarysoft Ltd)
HKU\S-1-5-21-2367635994-1441107805-3879806124-1000\…\MountPoints2: {7b3f3c3d-fce9-11e6-992e-f01faf01a6d9} - E:\win\setup.exe -phs
HKU\S-1-5-21-2367635994-1441107805-3879806124-1000\…\MountPoints2: {ec19e8f8-b2aa-11e6-9b3d-f01faf01a6d9} - E:\StartClickFreeBackup.exe
HKU\S-1-5-18\…\RunOnce: [SPReview] => "C:\Windows\System32\SPReview\SPReview.exe" /sp:1 /errorfwlink:"hxxp://go.microsoft.com/fwlink/?LinkID=122915" /build:7601
R1 GUBootStartup; C:\Windows\System32\drivers\GUBootStartup.sys [20160 2016-11-27] (Glarysoft Ltd)
S3 NAVENG; \??\C:\Program Files (x86)\Norton Security\NortonData\22.7.0.76\Definitions\SDSDefs\20170918.019\ENG64.SYS [X]
S3 NAVEX15; \??\C:\Program Files (x86)\Norton Security\NortonData\22.7.0.76\Definitions\SDSDefs\20170918.019\EX64.SYS [X]
2018-01-08 05:26 - 2018-01-08 05:26 - 000003338 _____ C:\Windows\System32\Tasks\GlaryInitialize 5
2017-09-22 06:45 - 2017-09-22 06:45 - 000012800 _____ () C:\Users\Terry Felter\AppData\Local\Temp\15ybke51.dll
2017-09-07 06:42 - 2017-09-07 06:42 - 000014848 _____ () C:\Users\Terry Felter\AppData\Local\Temp\4dwh3xyj.dll
2013-01-08 20:18 - 2013-01-08 20:18 - 001052192 _____ () C:\Users\Terry Felter\AppData\Local\Temp\AC770S_ATT_BUILD3695.EXE
2017-09-15 14:12 - 2017-10-20 18:55 - 004150696 _____ () C:\Users\Terry Felter\AppData\Local\Temp\clean20.dll
2017-01-04 08:14 - 2017-09-20 10:18 - 000223064 _____ () C:\Users\Terry Felter\AppData\Local\Temp\EyesLauncher.exe
2017-07-14 07:01 - 2017-07-14 07:01 - 000009216 _____ () C:\Users\Terry Felter\AppData\Local\Temp\ezqhttj1.dll
2017-09-15 14:12 - 2017-10-20 18:55 - 000023400 _____ (TradeStation Technologies) C:\Users\Terry Felter\AppData\Local\Temp\GACInstaller.dll
2017-09-15 14:12 - 2017-10-20 18:55 - 003538848 _____ () C:\Users\Terry Felter\AppData\Local\Temp\instutil.dll
2017-03-17 20:28 - 2017-09-05 13:52 - 000186224 _____ (RealNetworks, Inc.) C:\Users\Terry Felter\AppData\Local\Temp\lowproc.exe
2017-10-17 05:45 - 2017-10-17 05:45 - 000016896 _____ () C:\Users\Terry Felter\AppData\Local\Temp\omkqhr3s.dll
2017-09-15 14:12 - 2017-10-20 18:55 - 000016696 _____ (TradeStation) C:\Users\Terry Felter\AppData\Local\Temp\RegistASM.exe
2017-03-27 03:49 - 2017-03-27 03:49 - 001190832 _____ (RealNetworks, Inc.) C:\Users\Terry Felter\AppData\Local\Temp\rnsetup0.exe
2017-06-15 04:42 - 2017-06-15 04:42 - 001019312 _____ (RealNetworks, Inc.) C:\Users\Terry Felter\AppData\Local\Temp\rnsetup1.exe
2017-09-18 20:00 - 2017-09-18 20:00 - 001019312 _____ (RealNetworks, Inc.) C:\Users\Terry Felter\AppData\Local\Temp\rnsetup2.exe
2017-03-17 20:28 - 2017-09-05 13:52 - 000096440 _____ (RealNetworks, Inc.) C:\Users\Terry Felter\AppData\Local\Temp\stubhelper.dll
2017-08-29 11:03 - 2017-12-20 06:38 - 036925048 _____ () C:\Users\Terry Felter\AppData\Local\Temp\temp-installer.exe
2017-09-15 14:12 - 2017-10-20 18:55 - 002266952 _____ (TradeStation Technologies, Inc.) C:\Users\Terry Felter\AppData\Local\Temp\TSInst10.exe
2017-08-11 10:49 - 2017-10-20 18:55 - 000101304 _____ (TradeStation) C:\Users\Terry Felter\AppData\Local\Temp\TSInstallCAUtils.dll
2017-02-02 07:53 - 2017-02-02 07:53 - 000009728 _____ () C:\Users\Terry Felter\AppData\Local\Temp\v0jthfi1.dll
2017-08-07 04:27 - 2017-08-07 04:27 - 000003584 _____ () C:\Users\Terry Felter\AppData\Local\Temp\yubm6-s-.dll
ContextMenuHandlers5: [igfxcui] -> {3AB1675A-CCFF-11D2-8B20-00A0C93CB1F4} =>  -> No File
Task: {917A7F84-EB13-4448-AA42-13817A4F0060} - System32\Tasks\{91783E60-1194-4502-9BAA-133A86C52494} => C:\Windows\system32\pcalua.exe -a E:\EliteInstallerBeta.exe -d E:\
Task: {9876D896-4F92-4051-B6D2-6C767D96B736} - System32\Tasks\GlaryInitialize 5 => C:\Program Files (x86)\Glary Utilities 5\Initialize.exe [2018-01-07] (Glarysoft Ltd)
Task: {C391A76D-EFC1-4280-B119-7627629FD0D8} - System32\Tasks\GU5SkipUAC => C:\Program Files (x86)\Glary Utilities 5\Integrator.exe [2018-01-07] (Glarysoft Ltd)
2018-01-07 20:15 - 2018-01-07 20:15 - 000087024 _____ () C:\Program Files (x86)\Glary Utilities 5\zlib1.dll
1997-07-11 00:00 - 1997-07-11 00:00 - 000036864 _____ () C:\Windows\SysWow64\docobj.dll
EmptyTemp:
End::

NOTE: This script was written specifically for this user, for use on that particular machine. Running this on another machine may cause damage to your operating system

in the FRST window, press the ‘Fix’ button once and wait
please reboot the computer if requested
it will create a log on your desktop, (Fixlog.txt); please post it to your reply.

Thanks

Satchfan

terryfelter

Post #25January 11, 2018, 3:06 PM UTC

I have a question on these two:

2017-09-15 14:12 - 2017-10-20 18:55 - 002266952 _____ (TradeStation Technologies, Inc.) C:\Users\Terry Felter\AppData\Local\Temp\TSInst10.exe 2017-08-11 10:49 - 2017-10-20 18:55 - 000101304 _____ (TradeStation) C:\Users\Terry Felter\AppData\Local\Temp\TSInstallCAUtils.dll

I use this program daily, will this affect how it opens/runs/updates?

Thanks

Satchfan

Post #26January 11, 2018, 3:13 PM UTC

Anything in the Temp folder can be deleted. The programmes should delete all their temporary files when they close but some fail to do so. Deleting them will not affect the programmes.

terryfelter

Post #27January 11, 2018, 3:44 PM UTC

Here ya go:

Fix result of Farbar Recovery Scan Tool (x64) Version: 02.01.2018
Ran by [removed] (11-01-2018 09:25:12) Run:1
Running from C:\Users\[removed]\Desktop
[removed] Boot Mode: Normal
==============================================

fixlist content:
*****************
CloseProcesses:
HKLM-x32\…\Winlogon: [Userinit] <$SYSDIR>\userinit.exe,
Winlogon\Notify\SDWinLogon-x32: SDWinLogon.dll [X]
HKU\S-1-5-21-2367635994-1441107805-3879806124-1000\…\Run: [GUDelayStartup] => C:\Program Files (x86)\Glary Utilities 5\StartupManager.exe [44016 2018-01-07] (Glarysoft Ltd)
HKU\S-1-5-21-2367635994-1441107805-3879806124-1000\…\MountPoints2: {7b3f3c3d-fce9-11e6-992e-f01faf01a6d9} - E:\win\setup.exe -phs
HKU\S-1-5-21-2367635994-1441107805-3879806124-1000\…\MountPoints2: {ec19e8f8-b2aa-11e6-9b3d-f01faf01a6d9} - E:\StartClickFreeBackup.exe
HKU\S-1-5-18\…\RunOnce: [SPReview] => "C:\Windows\System32\SPReview\SPReview.exe" /sp:1 /errorfwlink:"hxxp://go.microsoft.com/fwlink/?LinkID=122915" /build:7601
R1 GUBootStartup; C:\Windows\System32\drivers\GUBootStartup.sys [20160 2016-11-27] (Glarysoft Ltd)
S3 NAVENG; \??\C:\Program Files (x86)\Norton Security\NortonData\22.7.0.76\Definitions\SDSDefs\20170918.019\ENG64.SYS [X]
S3 NAVEX15; \??\C:\Program Files (x86)\Norton Security\NortonData\22.7.0.76\Definitions\SDSDefs\20170918.019\EX64.SYS [X]
2018-01-08 05:26 - 2018-01-08 05:26 - 000003338 _____ C:\Windows\System32\Tasks\GlaryInitialize 5
2017-09-22 06:45 - 2017-09-22 06:45 - 000012800 _____ () C:\Users\Terry Felter\AppData\Local\Temp\15ybke51.dll
2017-09-07 06:42 - 2017-09-07 06:42 - 000014848 _____ () C:\Users\Terry Felter\AppData\Local\Temp\4dwh3xyj.dll
2013-01-08 20:18 - 2013-01-08 20:18 - 001052192 _____ () C:\Users\Terry Felter\AppData\Local\Temp\AC770S_ATT_BUILD3695.EXE
2017-09-15 14:12 - 2017-10-20 18:55 - 004150696 _____ () C:\Users\Terry Felter\AppData\Local\Temp\clean20.dll
2017-01-04 08:14 - 2017-09-20 10:18 - 000223064 _____ () C:\Users\Terry Felter\AppData\Local\Temp\EyesLauncher.exe
2017-07-14 07:01 - 2017-07-14 07:01 - 000009216 _____ () C:\Users\Terry Felter\AppData\Local\Temp\ezqhttj1.dll
2017-09-15 14:12 - 2017-10-20 18:55 - 000023400 _____ (TradeStation Technologies) C:\Users\Terry Felter\AppData\Local\Temp\GACInstaller.dll
2017-09-15 14:12 - 2017-10-20 18:55 - 003538848 _____ () C:\Users\Terry Felter\AppData\Local\Temp\instutil.dll
2017-03-17 20:28 - 2017-09-05 13:52 - 000186224 _____ (RealNetworks, Inc.) C:\Users\Terry Felter\AppData\Local\Temp\lowproc.exe
2017-10-17 05:45 - 2017-10-17 05:45 - 000016896 _____ () C:\Users\Terry Felter\AppData\Local\Temp\omkqhr3s.dll
2017-09-15 14:12 - 2017-10-20 18:55 - 000016696 _____ (TradeStation) C:\Users\Terry Felter\AppData\Local\Temp\RegistASM.exe
2017-03-27 03:49 - 2017-03-27 03:49 - 001190832 _____ (RealNetworks, Inc.) C:\Users\Terry Felter\AppData\Local\Temp\rnsetup0.exe
2017-06-15 04:42 - 2017-06-15 04:42 - 001019312 _____ (RealNetworks, Inc.) C:\Users\Terry Felter\AppData\Local\Temp\rnsetup1.exe
2017-09-18 20:00 - 2017-09-18 20:00 - 001019312 _____ (RealNetworks, Inc.) C:\Users\Terry Felter\AppData\Local\Temp\rnsetup2.exe
2017-03-17 20:28 - 2017-09-05 13:52 - 000096440 _____ (RealNetworks, Inc.) C:\Users\Terry Felter\AppData\Local\Temp\stubhelper.dll
2017-08-29 11:03 - 2017-12-20 06:38 - 036925048 _____ () C:\Users\Terry Felter\AppData\Local\Temp\temp-installer.exe
2017-09-15 14:12 - 2017-10-20 18:55 - 002266952 _____ (TradeStation Technologies, Inc.) C:\Users\Terry Felter\AppData\Local\Temp\TSInst10.exe
2017-08-11 10:49 - 2017-10-20 18:55 - 000101304 _____ (TradeStation) C:\Users\Terry Felter\AppData\Local\Temp\TSInstallCAUtils.dll
2017-02-02 07:53 - 2017-02-02 07:53 - 000009728 _____ () C:\Users\Terry Felter\AppData\Local\Temp\v0jthfi1.dll
2017-08-07 04:27 - 2017-08-07 04:27 - 000003584 _____ () C:\Users\Terry Felter\AppData\Local\Temp\yubm6-s-.dll
ContextMenuHandlers5: [igfxcui] -> {3AB1675A-CCFF-11D2-8B20-00A0C93CB1F4} => -> No File
Task: {917A7F84-EB13-4448-AA42-13817A4F0060} - System32\Tasks\{91783E60-1194-4502-9BAA-133A86C52494} => C:\Windows\system32\pcalua.exe -a E:\EliteInstallerBeta.exe -d E:\
Task: {9876D896-4F92-4051-B6D2-6C767D96B736} - System32\Tasks\GlaryInitialize 5 => C:\Program Files (x86)\Glary Utilities 5\Initialize.exe [2018-01-07] (Glarysoft Ltd)
Task: {C391A76D-EFC1-4280-B119-7627629FD0D8} - System32\Tasks\GU5SkipUAC => C:\Program Files (x86)\Glary Utilities 5\Integrator.exe [2018-01-07] (Glarysoft Ltd)
2018-01-07 20:15 - 2018-01-07 20:15 - 000087024 _____ () C:\Program Files (x86)\Glary Utilities 5\zlib1.dll
1997-07-11 00:00 - 1997-07-11 00:00 - 000036864 _____ () C:\Windows\SysWow64\docobj.dll
EmptyTemp:

*****************

Processes closed successfully.
HKLM\Software\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\\Userinit => value restored successfully
"HKLM\Software\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\SDWinLogon" => removed successfully
"HKU\S-1-5-21-2367635994-1441107805-3879806124-1000\Software\Microsoft\Windows\CurrentVersion\Run\\GUDelayStartup" => removed successfully
"HKU\S-1-5-21-2367635994-1441107805-3879806124-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{7b3f3c3d-fce9-11e6-992e-f01faf01a6d9}" => removed successfully
HKLM\Software\Classes\CLSID\{7b3f3c3d-fce9-11e6-992e-f01faf01a6d9} => key not found
"HKU\S-1-5-21-2367635994-1441107805-3879806124-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{ec19e8f8-b2aa-11e6-9b3d-f01faf01a6d9}" => removed successfully
HKLM\Software\Classes\CLSID\{ec19e8f8-b2aa-11e6-9b3d-f01faf01a6d9} => key not found
"HKU\S-1-5-18\Software\Microsoft\Windows\CurrentVersion\RunOnce\\SPReview" => removed successfully
GUBootStartup => Service stopped successfully.
"HKLM\System\CurrentControlSet\Services\GUBootStartup" => removed successfully
GUBootStartup => service removed successfully
"HKLM\System\CurrentControlSet\Services\NAVENG" => removed successfully
NAVENG => service removed successfully
"HKLM\System\CurrentControlSet\Services\NAVEX15" => removed successfully
NAVEX15 => service removed successfully
C:\Windows\System32\Tasks\GlaryInitialize 5 => moved successfully
C:\Users\Terry Felter\AppData\Local\Temp\15ybke51.dll => moved successfully
C:\Users\Terry Felter\AppData\Local\Temp\4dwh3xyj.dll => moved successfully
C:\Users\Terry Felter\AppData\Local\Temp\AC770S_ATT_BUILD3695.EXE => moved successfully
C:\Users\Terry Felter\AppData\Local\Temp\clean20.dll => moved successfully
C:\Users\Terry Felter\AppData\Local\Temp\EyesLauncher.exe => moved successfully
C:\Users\Terry Felter\AppData\Local\Temp\ezqhttj1.dll => moved successfully
C:\Users\Terry Felter\AppData\Local\Temp\GACInstaller.dll => moved successfully
C:\Users\Terry Felter\AppData\Local\Temp\instutil.dll => moved successfully
C:\Users\Terry Felter\AppData\Local\Temp\lowproc.exe => moved successfully
C:\Users\Terry Felter\AppData\Local\Temp\omkqhr3s.dll => moved successfully
C:\Users\Terry Felter\AppData\Local\Temp\RegistASM.exe => moved successfully
C:\Users\Terry Felter\AppData\Local\Temp\rnsetup0.exe => moved successfully
C:\Users\Terry Felter\AppData\Local\Temp\rnsetup1.exe => moved successfully
C:\Users\Terry Felter\AppData\Local\Temp\rnsetup2.exe => moved successfully
C:\Users\Terry Felter\AppData\Local\Temp\stubhelper.dll => moved successfully
C:\Users\Terry Felter\AppData\Local\Temp\temp-installer.exe => moved successfully
C:\Users\Terry Felter\AppData\Local\Temp\TSInst10.exe => moved successfully
C:\Users\Terry Felter\AppData\Local\Temp\TSInstallCAUtils.dll => moved successfully
C:\Users\Terry Felter\AppData\Local\Temp\v0jthfi1.dll => moved successfully
C:\Users\Terry Felter\AppData\Local\Temp\yubm6-s-.dll => moved successfully
"HKLM\Software\Classes\Directory\Background\ShellEx\ContextMenuHandlers\igfxcui" => removed successfully
HKLM\Software\Classes\CLSID\{3AB1675A-CCFF-11D2-8B20-00A0C93CB1F4} => key not found
HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Plain\{917A7F84-EB13-4448-AA42-13817A4F0060} => could not remove key. ErrorCode1: 0x00000002
"HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\{917A7F84-EB13-4448-AA42-13817A4F0060}" => removed successfully
C:\Windows\System32\Tasks\{91783E60-1194-4502-9BAA-133A86C52494} => moved successfully
"HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tree\{91783E60-1194-4502-9BAA-133A86C52494}" => removed successfully
"HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Logon\{9876D896-4F92-4051-B6D2-6C767D96B736}" => removed successfully
"HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\{9876D896-4F92-4051-B6D2-6C767D96B736}" => removed successfully
"C:\Windows\System32\Tasks\GlaryInitialize 5" => not found
"HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tree\GlaryInitialize 5" => removed successfully
"HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Plain\{C391A76D-EFC1-4280-B119-7627629FD0D8}" => removed successfully
"HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\{C391A76D-EFC1-4280-B119-7627629FD0D8}" => removed successfully
C:\Windows\System32\Tasks\GU5SkipUAC => moved successfully
"HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tree\GU5SkipUAC" => removed successfully
C:\Program Files (x86)\Glary Utilities 5\zlib1.dll => moved successfully
C:\Windows\SysWow64\docobj.dll => moved successfully

=========== EmptyTemp: ==========

BITS transfer queue => 8388608 B
DOMStore, IE Recovery, AppCache, Feeds Cache, Thumbcache, IconCache => 14945001 B
Java, Flash, Steam htmlcache => 35173 B
Windows/system/drivers => 435859038 B
Edge => 0 B
Chrome => 0 B
Firefox => 30050302 B
Opera => 0 B

Temp, IE cache, history, cookies, recent:
Users => 0 B
Default => 0 B
Public => 0 B
ProgramData => 0 B
systemprofile => 118199 B
systemprofile32 => 66788 B
LocalService => 66228 B
NetworkService => 26522504 B
Terry Felter => 1055229149 B

RecycleBin => 15918673227 B
EmptyTemp: => 16.3 GB temporary data Removed.

================================

The system needed a reboot.

==== End of Fixlog 09:27:31 ====

Satchfan

Post #28January 11, 2018, 4:24 PM UTC

That cleared up what you wanted and gave you back some extra space:

16.3 GB temporary data Removed

Everything else OK?

terryfelter

Post #29January 11, 2018, 4:36 PM UTC last edited January 11, 2018, 4:37 PM UTC

Yes, seems to be working fine, other than I had to restore Tradestation all of the charts had a broken link to them.

Thanks again.

Satchfan

Post #30January 11, 2018, 4:39 PM UTC

You're welcome.

Please follow these steps to remove the tools we’ve used – this applies to both computers:

Uninstall AdwCleaner

double click on adwcleaner.exe to run the tool
click on Uninstall
confirm with Yes.

===================================================

Download & run Delfix

download Delfix from here to remove many of the tools we've used during the cleaning process.
ensure “Remove disinfection tools” is checked.

Also place a checkmark next to:

o Create registry backup
o Purge system restore

click the Run button.

You can delete all other logs and programs we’ve used that are on your desktop. Just click on them and press Delete.

===================================================

I would recommend that you update and run Malwarebytes. This really is an excellent program that you should run on a regular basis, probably weekly.

I will keep this open for 24 hours in case you have any problems, after which I’ll close the topic.

Safe computing

Satchfan

Ask AI

AI can make mistakes. Check the cited posts. Archived advice can be out-of-date

Don't include personal information. Questions and selected public posts go to OpenAI. About Ask AI

JS:Agent-EDB infection [Solved]

✨ Ask AI

Ask AI