What the Tech?! Free tech support Archive
This is a read-only archive. No new posts or registrations. Privacy Page
Spyware / Malware / Virus Removal

2 laptops infected.

9 min read

This thread's last reply is from . Advice, software, and links below may be out of date — treat specific steps and download links with caution.

Looking for the outcome? Ask AI

Post #1

Hi,

 

I have 2 laptops that are running very slowly. Should I have a separate thread for each? I subscribe to both Avast and Malwarebytes.

 

The first is a 2 year old HP Pavilion running Windows 10 and is so slow and generally unresponsive that I can't even open the web browser.

 

The second (this one) is a new HP Pavilion with Windows 10 and is also slow but functioning reasonably well.

 

I have noticed that the web protection in Malwarebytes intermittently goes off and I have to reboot to put it on although this doesn't always work and I have to reinstall the program. Laptop 1 has the fan running constantly and this laptop occasionally does the same and shows the resource meters near 100%.

 

On this laptop I have run the Malwarebytes scan and it showed no issues and I ran the Avast scan which got to the end but then Windows rebooted before I could see if it found anything.

 

I tried to run the aswMBR scan on this laptop twice but both times it went into a Windows reboot. I have run the Farbar scan and the results are pasted below.

 

Scan result of Farbar Recovery Scan Tool (FRST) (x64) Version: 27.01.2018
Ran by [removed] (administrator) on LAPTOP-34BKJT79 (28-01-2018 10:25:04)
Running from C:\Users\[removed]\OneDrive\Desktop
[removed] Platform: Windows 10 Home Version 1709 16299.192 (X64) Language: English (United Kingdom)
Internet Explorer Version 11 (Default browser: FF)
Boot Mode: Normal
Tutorial for Farbar Recovery Scan Tool: http://www.geekstogo.com/forum/topic/335081-frst-tutorial-how-to-use-farbar-recovery-scan-tool/

==================== Processes (Whitelisted) =================

(If an entry is included in the fixlist, the process will be closed. The file will not be moved.)

(Intel Corporation) C:\Windows\System32\DriverStore\FileRepository\ki124757.inf_amd64_b607c305e0c4e0a1\igfxCUIService.exe
(Realtek Semiconductor) C:\Program Files\Realtek\Audio\HDA\RtkAudioService64.exe
(AVAST Software) C:\Program Files\AVAST Software\Avast\AvastSvc.exe
(Microsoft Corporation) C:\Windows\System32\wlanext.exe
(AVAST Software) C:\Program Files\AVAST Software\Avast\afwServ.exe
(Intel Corporation) C:\Windows\System32\DriverStore\FileRepository\ki124757.inf_amd64_b607c305e0c4e0a1\IntelCpHDCPSvc.exe
(Intel Corporation) C:\Windows\System32\ibtsiva.exe
(HP Inc.) C:\Program Files (x86)\HP\HP System Event\HPWMISVC.exe
(Intel Corporation) C:\Windows\System32\Intel\DPTF\esif_uf.exe
(Synaptics Incorporated) C:\Program Files\Synaptics\SynTP\SynTPEnhService.exe
(Intel(R) Corporation) C:\Program Files\Common Files\Intel\WirelessCommon\RegSrvc.exe
(Microsoft Corporation) C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeClickToRun.exe
() C:\Program Files (x86)\WildTangent Games\Integration\WildTangentHelperService.exe
(Intel® Corporation) C:\Program Files\Intel\WiFi\bin\ZeroConfigService.exe
(Intel(R) Corporation) C:\Program Files\Intel\WiFi\bin\EvtEng.exe
(IBM Corp.) C:\Program Files (x86)\Trusteer\Rapport\bin\RapportMgmtService.exe
(Malwarebytes) C:\Program Files\Malwarebytes\Anti-Malware\MBAMService.exe
(Intel Corporation) C:\Windows\System32\DriverStore\FileRepository\ki124757.inf_amd64_b607c305e0c4e0a1\IntelCpHeciSvc.exe
(AVAST Software) C:\Program Files\AVAST Software\Avast\x64\aswidsagenta.exe
(Malwarebytes) C:\Program Files\Malwarebytes\Anti-Malware\mbamtray.exe
(Intel Corporation) C:\Windows\System32\Intel\DPTF\dptf_helper.exe
() C:\Program Files (x86)\HP\HP JumpStart Launch\HPJumpStartLaunch.exe
(Microsoft Corporation) C:\Windows\Microsoft.NET\Framework64\v3.0\WPF\PresentationFontCache.exe
(Synaptics Incorporated) C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
(Intel Corporation) C:\Windows\System32\DriverStore\FileRepository\ki124757.inf_amd64_b607c305e0c4e0a1\igfxEM.exe
(Synaptics Incorporated) C:\Program Files\Synaptics\SynTP\SynTPHelper.exe
(IBM Corp.) C:\Program Files (x86)\Trusteer\Rapport\bin\RapportService.exe
() C:\Program Files\WindowsApps\Microsoft.SkypeApp_12.13.274.0_x64__kzf8qxf38zg5c\SkypeHost.exe
(Microsoft Corporation) C:\Windows\System32\smartscreen.exe
(Microsoft Corporation) C:\Program Files\Windows Defender\MSASCuiL.exe
(Realtek Semiconductor) C:\Program Files\Realtek\Audio\HDA\RtkNGUI64.exe
(AVAST Software) C:\Program Files\AVAST Software\Avast\AvastUI.exe
(Samsung Electronics Co. Ltd.) C:\Program Files (x86)\Samsung\Samsung Magician\SamsungMagician.exe
(Piriform Ltd) C:\Program Files\CCleaner\CCleaner64.exe
(HP Inc.) C:\Program Files (x86)\HP\HP System Event\HPMSGSVC.exe
(Microsoft Corporation) C:\Windows\SysWOW64\wbem\WmiPrvSE.exe
(Mozilla Corporation) C:\Program Files\Mozilla Firefox\firefox.exe
(Mozilla Corporation) C:\Program Files\Mozilla Firefox\firefox.exe
(Mozilla Corporation) C:\Program Files\Mozilla Firefox\firefox.exe
(Mozilla Corporation) C:\Program Files\Mozilla Firefox\firefox.exe
(HP Inc.) C:\Program Files (x86)\HP\HPAudioSwitch\HPAudioSwitch.exe
(HP Inc.) C:\Program Files\HPCommRecovery\HPCommRecovery.exe
(HP Inc.) C:\Program Files (x86)\HP\HP JumpStart Bridge\HPJumpStartBridge.exe
(HP Inc.) C:\Program Files (x86)\Hewlett-Packard\HP Support Solutions\HPSupportSolutionsFrameworkService.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\DAL\jhi_service.exe
(Mozilla Corporation) C:\Program Files\Mozilla Firefox\firefox.exe
(Microsoft Corporation) C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.16299.188_none_16c3dcde323064d9\TiWorker.exe

==================== Registry (Whitelisted) ===========================

(If an entry is included in the fixlist, the registry item will be restored to default or removed. The file will not be moved.)

HKLM\…\Run: [SecurityHealth] => C:\Program Files\Windows Defender\MSASCuiL.exe [630168 2017-09-29] (Microsoft Corporation)
HKLM\…\Run: [RTHDVCPL] => C:\Program Files\Realtek\Audio\HDA\RtkNGUI64.exe [9235944 2018-01-23] (Realtek Semiconductor)
HKLM\…\Run: [AvastUI.exe] => C:\Program Files\AVAST Software\Avast\AvLaunch.exe [246120 2017-12-24] (AVAST Software)
HKLM-x32\…\Run: [HPMessageService] => C:\Program Files (x86)\HP\HP System Event\HPMSGSVC.exe [701984 2017-07-13] (HP Inc.)
HKLM-x32\…\Run: [HPRadioMgr] => C:\Program Files (x86)\HP\HP Wireless Button Driver\HPRadioMgr64.exe
HKLM Group Policy restriction on software: %systemroot%\system32\mrt.exe <==== ATTENTION
HKU\S-1-5-21-557160917-1767100916-191111700-1001\…\Run: [CCleaner Monitoring] => C:\Program Files\CCleaner\CCleaner64.exe [10257872 2018-01-09] (Piriform Ltd)

==================== Internet (Whitelisted) ====================

(If an item is included in the fixlist, if it is a registry item it will be removed or restored to default.)

Tcpip\Parameters: [DhcpNameServer] 192.168.1.1
Tcpip\..\Interfaces\{f1d5008a-b110-4241-bb47-65ac4ae917fd}: [DhcpNameServer] 192.168.1.1

Internet Explorer:
==================
HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://hp17win10.msn.com/?pc=HCTE
HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = hxxp://hp17win10.msn.com/?pc=HCTE
HKU\S-1-5-21-557160917-1767100916-191111700-1001\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://hp17win10.msn.com/?pc=HCTE
HKU\S-1-5-21-557160917-1767100916-191111700-1001\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = hxxp://hp17win10.msn.com/?pc=HCTE
SearchScopes: HKLM -> {88ACD6BA-082C-4DD3-92E5-38E8DA05F95C} URL = hxxp://www.amazon.co.uk/s/ref=azs_osd_ieauk?ie=UTF-8&tag;=hp-uk1-vsb-21&link;%5Fcode=qs&index;=aps&field-keywords;={searchTerms}
SearchScopes: HKLM-x32 -> {88ACD6BA-082C-4DD3-92E5-38E8DA05F95C} URL = hxxp://www.amazon.co.uk/s/ref=azs_osd_ieauk?ie=UTF-8&tag;=hp-uk1-vsb-21&link;%5Fcode=qs&index;=aps&field-keywords;={searchTerms}
SearchScopes: HKU\S-1-5-21-557160917-1767100916-191111700-1001 -> {88ACD6BA-082C-4DD3-92E5-38E8DA05F95C} URL = hxxp://www.amazon.co.uk/s/ref=azs_osd_ieauk?ie=UTF-8&tag;=hp-uk1-vsb-21&link;%5Fcode=qs&index;=aps&field-keywords;={searchTerms}
BHO: Lync Browser Helper -> {31D09BA0-12F5-4CCE-BE8A-2923E76605DA} -> C:\Program Files (x86)\Microsoft Office\root\VFS\ProgramFilesX64\Microsoft Office\Office16\OCHelper.dll [2018-01-20] (Microsoft Corporation)
BHO: HP Network Check Helper -> {E76FD755-C1BA-4DCB-9F13-99BD91223ADE} -> C:\Program Files (x86)\Hewlett-Packard\HP Support Framework\Resources\HPNetworkCheck\HPNetworkCheckPluginx64.dll [2017-04-07] (HP Inc.)
BHO-x32: Lync Browser Helper -> {31D09BA0-12F5-4CCE-BE8A-2923E76605DA} -> C:\Program Files (x86)\Microsoft Office\root\Office16\OCHelper.dll [2018-01-20] (Microsoft Corporation)
BHO-x32: HP Network Check Helper -> {E76FD755-C1BA-4DCB-9F13-99BD91223ADE} -> C:\Program Files (x86)\Hewlett-Packard\HP Support Framework\Resources\HPNetworkCheck\HPNetworkCheckPlugin.dll [2017-04-07] (HP Inc.)
Handler-x32: mso-minsb-roaming.16 - {83C25742-A9F7-49FB-9138-434302C88D07} - C:\Program Files (x86)\Microsoft Office\root\Office16\MSOSB.DLL [2018-01-20] (Microsoft Corporation)
Handler-x32: mso-minsb.16 - {42089D2D-912D-4018-9087-2B87803E93FB} - C:\Program Files (x86)\Microsoft Office\root\Office16\MSOSB.DLL [2018-01-20] (Microsoft Corporation)
Handler-x32: osf-roaming.16 - {42089D2D-912D-4018-9087-2B87803E93FB} - C:\Program Files (x86)\Microsoft Office\root\Office16\MSOSB.DLL [2018-01-20] (Microsoft Corporation)
Handler-x32: osf.16 - {5504BE45-A83B-4808-900A-3A5C36E7F77A} - C:\Program Files (x86)\Microsoft Office\root\Office16\MSOSB.DLL [2018-01-20] (Microsoft Corporation)

FireFox:
========
FF DefaultProfile: m30hujkv.default
FF ProfilePath: C:\Users\desen\AppData\Roaming\Mozilla\Firefox\Profiles\m30hujkv.default [2018-01-28]
FF Homepage: Mozilla\Firefox\Profiles\m30hujkv.default -> hxxps://mail.google.com/mail/u/0/?tab=wm#inbox
FF Extension: (IBM Security Rapport) - C:\Users\desen\AppData\Roaming\Mozilla\Extensions\{ec8030f7-c20a-464f-9b0e-13a3a9e97384}\[removed] [2018-01-24]
FF Extension: (EverSync - Sync bookmarks, backup favorites) - C:\Users\desen\AppData\Roaming\Mozilla\Firefox\Profiles\m30hujkv.default\Extensions\[removed] [2017-12-24]
FF Extension: (Avast Passwords) - C:\Users\desen\AppData\Roaming\Mozilla\Firefox\Profiles\m30hujkv.default\Extensions\[removed] [2018-01-16]
FF Extension: (Avast Online Security) - C:\Users\desen\AppData\Roaming\Mozilla\Firefox\Profiles\m30hujkv.default\Extensions\[removed] [2017-12-24]
FF Plugin-x32: @microsoft.com/Lync,version=15.0 -> C:\Program Files (x86)\Microsoft Office\root\VFS\ProgramFilesX86\Mozilla Firefox\plugins\npmeetingjoinpluginoc.dll [2018-01-20] (Microsoft Corporation)
FF Plugin-x32: @microsoft.com/SharePoint,version=14.0 -> C:\Program Files (x86)\Microsoft Office\root\Office16\NPSPWRAP.DLL [2018-01-20] (Microsoft Corporation)
FF Plugin-x32: @tools.google.com/Google Update;version=3 -> C:\Program Files (x86)\Google\Update\1.3.33.7\npGoogleUpdate3.dll [2017-12-24] (Google Inc.)
FF Plugin-x32: @tools.google.com/Google Update;version=9 -> C:\Program Files (x86)\Google\Update\1.3.33.7\npGoogleUpdate3.dll [2017-12-24] (Google Inc.)
FF Plugin HKU\S-1-5-21-557160917-1767100916-191111700-1001: SkypeForBusinessPlugin-16.2 -> C:\Users\desen\AppData\Local\Microsoft\SkypeForBusinessPlugin\16.2.0.194\npGatewayNpapi.dll [2017-05-19] (Microsoft Corporation)
FF Plugin HKU\S-1-5-21-557160917-1767100916-191111700-1001: SkypeForBusinessPlugin64-16.2 -> C:\Users\desen\AppData\Local\Microsoft\SkypeForBusinessPlugin\16.2.0.194\npGatewayNpapi-x64.dll [2017-05-19] (Microsoft Corporation)

Chrome:
=======
CHR HomePage: Default -> hxxp://www.google.com
CHR Profile: C:\Users\desen\AppData\Local\Google\Chrome\User Data\Default [2018-01-27]
CHR Extension: (Slides) - C:\Users\desen\AppData\Local\Google\Chrome\User Data\Default\Extensions\aapocclcgogkmnckokdopfmhonfmgoek [2017-12-24]
CHR Extension: (Docs) - C:\Users\desen\AppData\Local\Google\Chrome\User Data\Default\Extensions\aohghmighlieiainnegkcijnfilokake [2017-12-24]
CHR Extension: (Google Drive) - C:\Users\desen\AppData\Local\Google\Chrome\User Data\Default\Extensions\apdfllckaahabafndbhieahigkjlhalf [2017-12-24]
CHR Extension: (YouTube) - C:\Users\desen\AppData\Local\Google\Chrome\User Data\Default\Extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo [2017-12-24]
CHR Extension: (Sheets) - C:\Users\desen\AppData\Local\Google\Chrome\User Data\Default\Extensions\felcaaldnbdncclmgdcncolpebgiejap [2017-12-24]
CHR Extension: (Google Docs Offline) - C:\Users\desen\AppData\Local\Google\Chrome\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi [2017-12-24]
CHR Extension: (Chrome Web Store Payments) - C:\Users\desen\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda [2017-12-24]
CHR Extension: (Gmail) - C:\Users\desen\AppData\Local\Google\Chrome\User Data\Default\Extensions\pjkljhegncpnkpknbcohdijeoejaedia [2017-12-24]
CHR Extension: (Chrome Media Router) - C:\Users\desen\AppData\Local\Google\Chrome\User Data\Default\Extensions\pkedcjkdefgpdelpbcmbmeomcjbeemfm [2017-12-24]
CHR HKU\S-1-5-21-557160917-1767100916-191111700-1001\SOFTWARE\Google\Chrome\Extensions\…\Chrome\Extension: [bbjllphbppobebmjpjcijfbakobcheof] - hxxps://clients2.google.com/service/update2/crx
CHR HKLM-x32\…\Chrome\Extension: [eofcbnmajmjmplflapaojjnihcjkigck] - hxxps://clients2.google.com/service/update2/crx
CHR HKLM-x32\…\Chrome\Extension: [gomekmidlodglbbmalcneegieacbdmki] - hxxps://clients2.google.com/service/update2/crx

==================== Services (Whitelisted) ====================

(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)

R3 aswbIDSAgent; C:\Program Files\AVAST Software\Avast\x64\aswidsagenta.exe [7538536 2017-12-24] (AVAST Software)
R2 avast! Antivirus; C:\Program Files\AVAST Software\Avast\AvastSvc.exe [301168 2017-12-24] (AVAST Software)
R2 avast! Firewall; C:\Program Files\AVAST Software\Avast\afwServ.exe [351552 2017-12-24] (AVAST Software)
R2 ClickToRunSvc; C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe [7780528 2018-01-15] (Microsoft Corporation)
R2 esifsvc; C:\WINDOWS\system32\Intel\DPTF\esif_uf.exe [1701480 2018-01-23] (Intel Corporation)
R2 HP Comm Recover; C:\Program Files\HPCommRecovery\HPCommRecovery.exe [1327400 2017-09-05] (HP Inc.)
R2 HPJumpStartBridge; c:\Program Files (x86)\HP\HP JumpStart Bridge\HPJumpStartBridge.exe [471040 2017-05-23] (HP Inc.)
S3 hpqcaslwmiex; C:\Program Files (x86)\HP\Shared\hpqwmiex.exe [1031704 2016-06-03] (HP)
R2 HPSupportSolutionsFrameworkService; C:\Program Files (x86)\Hewlett-Packard\HP Support Solutions\HPSupportSolutionsFrameworkService.exe [332144 2017-11-21] (HP Inc.)
R2 HPWMISVC; C:\Program Files (x86)\HP\HP System Event\HPWMISVC.exe [628768 2017-07-13] (HP Inc.)
R2 ibtsiva; C:\WINDOWS\system32\ibtsiva.exe [542392 2017-10-18] (Intel Corporation)
S3 Intel(R) Capability Licensing Service TCP IP Interface; C:\Program Files\Intel\iCLS Client\SocketHeciServer.exe [742704 2017-09-21] (Intel(R) Corporation)
S2 Intel(R) TPM Provisioning Service; C:\Program Files\Intel\iCLS Client\TPMProvisioningService.exe [668472 2017-09-21] (Intel(R) Corporation)
R2 jhi_service; C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\DAL\jhi_service.exe [197264 2017-09-25] (Intel Corporation)
R2 MBAMService; C:\Program Files\Malwarebytes\Anti-Malware\mbamservice.exe [6234056 2017-11-01] (Malwarebytes)
S3 MyWiFiDHCPDNS; C:\Program Files\Intel\WiFi\bin\PanDhcpDns.exe [269480 2017-08-07] ()
R2 RapportMgmtService; C:\Program Files (x86)\Trusteer\Rapport\bin\RapportMgmtService.exe [5249008 2018-01-09] (IBM Corp.)
R2 RtkAudioService; C:\Program Files\Realtek\Audio\HDA\RtkAudioService64.exe [324584 2018-01-23] (Realtek Semiconductor)
R2 SynTPEnhService; C:\Program Files\Synaptics\SynTP\SynTPEnhService.exe [269912 2017-08-24] (Synaptics Incorporated)
S3 WdNisSvc; C:\Program Files\Windows Defender\NisSrv.exe [355304 2017-09-29] (Microsoft Corporation)
R2 WildTangentHelper; C:\Program Files (x86)\WildTangent Games\Integration\WildTangentHelperService.exe [1549160 2017-09-22] ()
S3 WinDefend; C:\Program Files\Windows Defender\MsMpEng.exe [105944 2017-09-29] (Microsoft Corporation)
R2 ZeroConfigService; C:\Program Files\Intel\WiFi\bin\ZeroConfigService.exe [3756200 2017-08-07] (Intel® Corporation)

===================== Drivers (Whitelisted) ======================

(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)

R1 aswArPot; C:\WINDOWS\System32\drivers\aswArPot.sys [185096 2017-12-24] (AVAST Software)
R1 aswbidsdriver; C:\WINDOWS\System32\drivers\aswbidsdrivera.sys [321512 2017-12-24] (AVAST Software)
R0 aswbidsh; C:\WINDOWS\System32\drivers\aswbidsha.sys [199448 2017-12-24] (AVAST Software)
R0 aswblog; C:\WINDOWS\System32\drivers\aswbloga.sys [343768 2017-12-24] (AVAST Software)
R0 aswbuniv; C:\WINDOWS\System32\drivers\aswbuniva.sys [57696 2017-12-24] (AVAST Software)
S3 aswHwid; C:\WINDOWS\System32\drivers\aswHwid.sys [46976 2017-12-24] (AVAST Software)
R2 aswMonFlt; C:\WINDOWS\System32\drivers\aswMonFlt.sys [146648 2018-01-11] (AVAST Software)
R1 aswNetSec; C:\WINDOWS\System32\drivers\aswNetSec.sys [580480 2017-12-24] (AVAST Software)
R1 aswRdr; C:\WINDOWS\System32\drivers\aswRdr2.sys [110336 2017-12-24] (AVAST Software)
R0 aswRvrt; C:\WINDOWS\System32\drivers\aswRvrt.sys [84384 2017-12-24] (AVAST Software)
R1 aswSnx; C:\WINDOWS\System32\drivers\aswSnx.sys [1025176 2017-12-24] (AVAST Software)
R1 aswSP; C:\WINDOWS\System32\drivers\aswSP.sys [457896 2018-01-11] (AVAST Software)
R2 aswStm; C:\WINDOWS\System32\drivers\aswStm.sys [204456 2017-12-24] (AVAST Software)
R0 aswVmm; C:\WINDOWS\System32\drivers\aswVmm.sys [358672 2017-12-24] (AVAST Software)
R3 dptf_cpu; C:\WINDOWS\System32\drivers\dptf_cpu.sys [69560 2018-01-23] (Intel Corporation)
R3 esif_lf; C:\WINDOWS\system32\DRIVERS\esif_lf.sys [382392 2018-01-23] (Intel Corporation)
R1 ESProtectionDriver; C:\windows\system32\drivers\mbae64.sys [77432 2017-11-29] ()
R3 ibtusb; C:\WINDOWS\system32\DRIVERS\ibtusb.sys [132104 2017-10-18] (Intel Corporation)
R2 MBAMChameleon; C:\WINDOWS\System32\Drivers\MbamChameleon.sys [193968 2017-12-24] (Malwarebytes)
R3 MBAMFarflt; C:\WINDOWS\system32\DRIVERS\farflt.sys [110016 2018-01-28] (Malwarebytes)
R3 MBAMProtection; C:\WINDOWS\system32\DRIVERS\mbam.sys [46008 2018-01-28] (Malwarebytes)
R3 MBAMSwissArmy; C:\WINDOWS\System32\Drivers\mbamswissarmy.sys [253880 2018-01-28] (Malwarebytes)
R3 MBAMWebProtection; C:\WINDOWS\system32\DRIVERS\mwac.sys [94144 2018-01-28] (Malwarebytes)
R3 Netwtw04; C:\WINDOWS\System32\drivers\Netwtw04.sys [7638536 2017-10-05] (Intel Corporation)
R1 RapportAegle64; C:\Program Files (x86)\Trusteer\Rapport\bin\x64\RapportAegle64.sys [491176 2018-01-09] (IBM Corp.)
R1 RapportCerberus_1908101; C:\ProgramData\Trusteer\Rapport\store\exts\RapportCerberus\baseline\RapportCerberus64_1908101.sys [1637352 2018-01-11] (IBM Corp.)
R1 RapportEI64; C:\Program Files (x86)\Trusteer\Rapport\bin\x64\RapportEI64.sys [704616 2018-01-09] (IBM Corp.)
R0 RapportHades64; C:\WINDOWS\System32\Drivers\RapportHades64.sys [339944 2018-01-09] (IBM Corp.)
R0 RapportKE64; C:\WINDOWS\System32\Drivers\RapportKE64.sys [599528 2018-01-09] (IBM Corp.)
R1 RapportPG64; C:\Program Files (x86)\Trusteer\Rapport\bin\x64\RapportPG64.sys [745136 2018-01-09] (IBM Corp.)
R3 rt640x64; C:\WINDOWS\System32\drivers\rt640x64.sys [1009128 2018-01-01] (Realtek )
S3 RTSUER; C:\WINDOWS\system32\Drivers\RtsUer.sys [420832 2017-04-27] (Realsil Semiconductor Corporation)
S3 SmbDrv; C:\WINDOWS\System32\drivers\Smb_driver_AMDASF.sys [45144 2017-08-24] (Synaptics Incorporated)
R3 SmbDrvI; C:\WINDOWS\system32\DRIVERS\Smb_driver_Intel.sys [46680 2017-08-24] (Synaptics Incorporated)
S3 WdBoot; C:\WINDOWS\system32\drivers\WdBoot.sys [44608 2017-09-29] (Microsoft Corporation)
S3 WdFilter; C:\WINDOWS\system32\drivers\WdFilter.sys [309144 2017-09-29] (Microsoft Corporation)
S3 WdNisDrv; C:\WINDOWS\System32\Drivers\WdNisDrv.sys [119192 2017-09-29] (Microsoft Corporation)
R3 WirelessButtonDriver64; C:\WINDOWS\System32\drivers\WirelessButtonDriver64.sys [30368 2017-06-21] (HP)

==================== NetSvcs (Whitelisted) ===================

(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)


==================== One Month Created files and folders ========

(If an entry is included in the fixlist, the file/folder will be moved.)

2018-01-28 10:23 - 2018-01-28 10:25 - 000000000 ____D C:\FRST
2018-01-28 10:18 - 2018-01-28 10:18 - 001218732 _____ C:\WINDOWS\Minidump\012818-6484-01.dmp
2018-01-28 10:14 - 2018-01-28 10:18 - 893423333 _____ C:\WINDOWS\MEMORY.DMP
2018-01-28 10:14 - 2018-01-28 10:14 - 001440436 _____ C:\WINDOWS\Minidump\012818-6796-01.dmp
2018-01-27 18:28 - 2018-01-28 10:18 - 000000000 ____D C:\WINDOWS\Minidump
2018-01-27 17:35 - 2018-01-27 17:35 - 000000000 ____D C:\ProgramData\SWCUTemp
2018-01-27 16:33 - 2018-01-27 16:33 - 000000000 ____D C:\WINDOWS\SysWOW64\store
2018-01-27 11:07 - 2018-01-27 11:07 - 000000000 ___HD C:\OneDriveTemp
2018-01-26 18:32 - 2018-01-01 17:15 - 000956416 _____ (Microsoft Corporation) C:\WINDOWS\system32\Spectrum.exe
2018-01-26 18:32 - 2018-01-01 12:54 - 000924648 _____ (Microsoft Corporation) C:\WINDOWS\system32\winresume.exe
2018-01-26 18:32 - 2018-01-01 12:53 - 001090984 _____ (Microsoft Corporation) C:\WINDOWS\system32\winresume.efi
2018-01-26 18:32 - 2018-01-01 12:52 - 000066712 _____ (Microsoft Corporation) C:\WINDOWS\system32\iumcrypt.dll
2018-01-26 18:32 - 2018-01-01 12:51 - 001414784 _____ (Microsoft Corporation) C:\WINDOWS\system32\winload.efi
2018-01-26 18:32 - 2018-01-01 12:51 - 001209240 _____ (Microsoft Corporation) C:\WINDOWS\system32\winload.exe
2018-01-26 18:32 - 2018-01-01 12:51 - 001055128 _____ (Microsoft Corporation) C:\WINDOWS\system32\hvax64.exe
2018-01-26 18:32 - 2018-01-01 12:51 - 000191816 _____ (Microsoft Corporation) C:\WINDOWS\system32\skci.dll
2018-01-26 18:32 - 2018-01-01 12:51 - 000059800 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\bam.sys
2018-01-26 18:32 - 2018-01-01 12:50 - 005905752 _____ (Microsoft Corporation) C:\WINDOWS\system32\StartTileData.dll
2018-01-26 18:32 - 2018-01-01 12:50 - 000780464 _____ (Microsoft Corporation) C:\WINDOWS\system32\fontdrvhost.exe
2018-01-26 18:32 - 2018-01-01 12:50 - 000479912 _____ (Microsoft Corporation) C:\WINDOWS\system32\ucrtbase_enclave.dll
2018-01-26 18:32 - 2018-01-01 12:50 - 000077208 _____ (Microsoft Corporation) C:\WINDOWS\system32\hvloader.dll
2018-01-26 18:32 - 2018-01-01 12:49 - 008605080 _____ (Microsoft Corporation) C:\WINDOWS\system32\ntoskrnl.exe
2018-01-26 18:32 - 2018-01-01 12:49 - 000599448 _____ (Microsoft Corporation) C:\WINDOWS\system32\securekernel.exe
2018-01-26 18:32 - 2018-01-01 12:49 - 000319352 _____ (Microsoft Corporation) C:\WINDOWS\system32\wow64.dll
2018-01-26 18:32 - 2018-01-01 12:49 - 000292376 _____ (Microsoft Corporation) C:\WINDOWS\system32\wscapi.dll
2018-01-26 18:32 - 2018-01-01 12:48 - 007831760 _____ (Microsoft Corporation) C:\WINDOWS\system32\d3d10warp.dll
2018-01-26 18:32 - 2018-01-01 12:48 - 001954048 _____ (Microsoft Corporation) C:\WINDOWS\system32\ntdll.dll
2018-01-26 18:32 - 2018-01-01 12:48 - 000382360 _____ (Adobe Systems Incorporated) C:\WINDOWS\system32\atmfd.dll
2018-01-26 18:32 - 2018-01-01 12:47 - 000649304 _____ (Microsoft Corporation) C:\WINDOWS\system32\advapi32.dll
2018-01-26 18:32 - 2018-01-01 12:47 - 000082840 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\volmgr.sys
2018-01-26 18:32 - 2018-01-01 12:46 - 002709704 _____ (Microsoft Corporation) C:\WINDOWS\system32\iertutil.dll
2018-01-26 18:32 - 2018-01-01 12:46 - 000898216 _____ (Microsoft Corporation) C:\WINDOWS\system32\CoreMessaging.dll
2018-01-26 18:32 - 2018-01-01 12:46 - 000733592 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\acpi.sys
2018-01-26 18:32 - 2018-01-01 12:46 - 000471960 _____ (Microsoft Corporation) C:\WINDOWS\system32\hal.dll
2018-01-26 18:32 - 2018-01-01 12:45 - 002395032 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\ntfs.sys
2018-01-26 18:32 - 2018-01-01 12:45 - 001277848 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\ndis.sys
2018-01-26 18:32 - 2018-01-01 12:45 - 000398744 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\fltMgr.sys
2018-01-26 18:32 - 2018-01-01 12:43 - 001173576 _____ (Microsoft Corporation) C:\WINDOWS\system32\rpcrt4.dll
2018-01-26 18:32 - 2018-01-01 12:43 - 000367336 _____ (Microsoft Corporation) C:\WINDOWS\system32\Windows.Storage.ApplicationData.dll
2018-01-26 18:32 - 2018-01-01 12:43 - 000062872 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\fsdepends.sys
2018-01-26 18:32 - 2018-01-01 12:42 - 001029016 _____ (Microsoft Corporation) C:\WINDOWS\system32\efscore.dll
2018-01-26 18:32 - 2018-01-01 12:42 - 000571288 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\spaceport.sys
2018-01-26 18:32 - 2018-01-01 12:42 - 000494488 _____ (Microsoft Corporation) C:\WINDOWS\system32\pcasvc.dll
2018-01-26 18:32 - 2018-01-01 12:42 - 000184984 _____ (Microsoft Corporation) C:\WINDOWS\system32\sspicli.dll
2018-01-26 18:32 - 2018-01-01 12:42 - 000109976 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\vmbus.sys
2018-01-26 18:32 - 2018-01-01 12:41 - 007676296 _____ (Microsoft Corporation) C:\WINDOWS\system32\windows.storage.dll
2018-01-26 18:32 - 2018-01-01 12:41 - 000559512 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\storport.sys
2018-01-26 18:32 - 2018-01-01 12:41 - 000549552 _____ (Microsoft Corporation) C:\WINDOWS\system32\WWanAPI.dll
2018-01-26 18:32 - 2018-01-01 12:40 - 001206680 _____ (Microsoft Corporation) C:\WINDOWS\system32\hvix64.exe
2018-01-26 18:32 - 2018-01-01 12:39 - 000902416 _____ (Microsoft Corporation) C:\WINDOWS\system32\winhttp.dll
2018-01-26 18:32 - 2018-01-01 12:39 - 000677784 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\cng.sys
2018-01-26 18:32 - 2018-01-01 12:39 - 000508264 _____ (Microsoft Corporation) C:\WINDOWS\system32\systemreset.exe
2018-01-26 18:32 - 2018-01-01 12:39 - 000362904 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\pci.sys
2018-01-26 18:32 - 2018-01-01 12:39 - 000129432 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\hvsocket.sys
2018-01-26 18:32 - 2018-01-01 12:38 - 003904808 _____ (Microsoft Corporation) C:\WINDOWS\explorer.exe
2018-01-26 18:32 - 2018-01-01 12:38 - 000727448 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\fvevol.sys
2018-01-26 18:32 - 2018-01-01 12:38 - 000519152 _____ (Microsoft Corporation) C:\WINDOWS\system32\SecurityHealthService.exe
2018-01-26 18:32 - 2018-01-01 12:38 - 000103320 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\stornvme.sys
2018-01-26 18:32 - 2018-01-01 12:38 - 000038808 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\Diskdump.sys
2018-01-26 18:32 - 2018-01-01 12:37 - 001426664 _____ (Microsoft Corporation) C:\WINDOWS\system32\AudioEng.dll
2018-01-26 18:32 - 2018-01-01 12:37 - 000461720 _____ (Microsoft Corporation) C:\WINDOWS\system32\wifitask.exe
2018-01-26 18:32 - 2018-01-01 12:36 - 000413888 _____ (Microsoft Corporation) C:\WINDOWS\system32\AUDIOKSE.dll
2018-01-26 18:32 - 2018-01-01 12:36 - 000374032 _____ (Microsoft Corporation) C:\WINDOWS\system32\vac.exe
2018-01-26 18:32 - 2018-01-01 12:36 - 000166296 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\partmgr.sys
2018-01-26 18:32 - 2018-01-01 12:36 - 000113560 _____ (Microsoft Corporation) C:\WINDOWS\system32\icfupgd.dll
2018-01-26 18:32 - 2018-01-01 12:36 - 000057752 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\netbios.sys
2018-01-26 18:32 - 2018-01-01 12:35 - 001170008 _____ (Microsoft Corporation) C:\WINDOWS\system32\AudioSes.dll
2018-01-26 18:32 - 2018-01-01 12:35 - 000075160 _____ (Microsoft Corporation) C:\WINDOWS\system32\SecurityHealthProxyStub.dll
2018-01-26 18:32 - 2018-01-01 12:34 - 007385088 _____ (Microsoft Corporation) C:\WINDOWS\system32\Windows.Media.Protection.PlayReady.dll
2018-01-26 18:32 - 2018-01-01 12:34 - 001336344 _____ (Microsoft Corporation) C:\WINDOWS\system32\ole32.dll
2018-01-26 18:32 - 2018-01-01 12:34 - 000260896 _____ (Microsoft Corporation) C:\WINDOWS\system32\mfps.dll
2018-01-26 18:32 - 2018-01-01 12:34 - 000087384 _____ (Microsoft Corporation) C:\WINDOWS\system32\remoteaudioendpoint.dll
2018-01-26 18:32 - 2018-01-01 12:33 - 002773400 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\tcpip.sys
2018-01-26 18:32 - 2018-01-01 12:33 - 000603920 _____ (Microsoft Corporation) C:\WINDOWS\system32\audiodg.exe
2018-01-26 18:32 - 2018-01-01 12:32 - 004481240 _____ (Microsoft Corporation) C:\WINDOWS\system32\mfcore.dll
2018-01-26 18:32 - 2018-01-01 12:32 - 000617304 _____ (Microsoft Corporation) C:\WINDOWS\system32\TextInputFramework.dll
2018-01-26 18:32 - 2018-01-01 12:27 - 000713624 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\vhdmp.sys
2018-01-26 18:32 - 2018-01-01 12:27 - 000163736 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\wfplwfs.sys
2018-01-26 18:32 - 2018-01-01 12:26 - 000428952 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\rdbss.sys
2018-01-26 18:32 - 2018-01-01 12:26 - 000081304 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\vmbkmcl.sys
2018-01-26 18:32 - 2018-01-01 12:25 - 000615768 _____ (Microsoft Corporation) C:\WINDOWS\system32\services.exe
2018-01-26 18:32 - 2018-01-01 12:25 - 000147864 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\wcifs.sys
2018-01-26 18:32 - 2018-01-01 12:23 - 021352144 _____ (Microsoft Corporation) C:\WINDOWS\system32\shell32.dll
2018-01-26 18:32 - 2018-01-01 12:21 - 001103768 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\http.sys
2018-01-26 18:32 - 2018-01-01 12:21 - 000614296 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\afd.sys
2018-01-26 18:32 - 2018-01-01 12:06 - 000311192 _____ (Adobe Systems Incorporated) C:\WINDOWS\SysWOW64\atmfd.dll
2018-01-26 18:32 - 2018-01-01 12:03 - 000777904 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\rpcrt4.dll
2018-01-26 18:32 - 2018-01-01 12:03 - 000650328 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\fontdrvhost.exe
2018-01-26 18:32 - 2018-01-01 12:03 - 000566664 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\CoreMessaging.dll
2018-01-26 18:32 - 2018-01-01 12:03 - 000123512 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\sspicli.dll
2018-01-26 18:32 - 2018-01-01 11:53 - 001615712 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\ntdll.dll
2018-01-26 18:32 - 2018-01-01 11:49 - 000481464 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\advapi32.dll
2018-01-26 18:32 - 2018-01-01 11:49 - 000258808 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\wscapi.dll
2018-01-26 18:32 - 2018-01-01 11:46 - 003485392 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\explorer.exe
2018-01-26 18:32 - 2018-01-01 11:46 - 000289816 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\Windows.Storage.ApplicationData.dll
2018-01-26 18:32 - 2018-01-01 11:45 - 006092152 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\windows.storage.dll
2018-01-26 18:32 - 2018-01-01 11:45 - 005615968 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\d3d10warp.dll
2018-01-26 18:32 - 2018-01-01 11:45 - 002192624 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\iertutil.dll
2018-01-26 18:32 - 2018-01-01 11:45 - 000450928 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\WWanAPI.dll
2018-01-26 18:32 - 2018-01-01 11:43 - 020286120 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\shell32.dll
2018-01-26 18:32 - 2018-01-01 11:42 - 006479552 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\Windows.Media.Protection.PlayReady.dll
2018-01-26 18:32 - 2018-01-01 11:42 - 004644912 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\mfcore.dll
2018-01-26 18:32 - 2018-01-01 11:42 - 001246432 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\AudioEng.dll
2018-01-26 18:32 - 2018-01-01 11:42 - 001003152 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\ole32.dll
2018-01-26 18:32 - 2018-01-01 11:42 - 000982528 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\AudioSes.dll
2018-01-26 18:32 - 2018-01-01 11:42 - 000386424 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\AUDIOKSE.dll
2018-01-26 18:32 - 2018-01-01 11:42 - 000129184 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\mfps.dll
2018-01-26 18:32 - 2018-01-01 11:42 - 000074992 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\remoteaudioendpoint.dll
2018-01-26 18:32 - 2018-01-01 11:37 - 025247232 _____ (Microsoft Corporation) C:\WINDOWS\system32\edgehtml.dll
2018-01-26 18:32 - 2018-01-01 11:34 - 000703568 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\winhttp.dll
2018-01-26 18:32 - 2018-01-01 11:25 - 002905600 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\win32kfull.sys
2018-01-26 18:32 - 2018-01-01 11:25 - 001008640 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\InstallService.dll
2018-01-26 18:32 - 2018-01-01 11:25 - 000475648 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\ieui.dll
2018-01-26 18:32 - 2018-01-01 11:25 - 000344576 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\edgeIso.dll
2018-01-26 18:32 - 2018-01-01 11:25 - 000097792 _____ C:\WINDOWS\system32\runexehelper.exe
2018-01-26 18:32 - 2018-01-01 11:24 - 003668480 _____ (Microsoft Corporation) C:\WINDOWS\system32\win32kfull.sys
2018-01-26 18:32 - 2018-01-01 11:24 - 000240640 _____ (Microsoft Corporation) C:\WINDOWS\system32\AboutSettingsHandlers.dll
2018-01-26 18:32 - 2018-01-01 11:24 - 000202240 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\AppxAllUserStore.dll
2018-01-26 18:32 - 2018-01-01 11:24 - 000096256 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\fontsub.dll
2018-01-26 18:32 - 2018-01-01 11:24 - 000038912 _____ (Adobe Systems) C:\WINDOWS\SysWOW64\atmlib.dll
2018-01-26 18:32 - 2018-01-01 11:23 - 001313792 _____ (Microsoft Corporation) C:\WINDOWS\system32\InstallService.dll
2018-01-26 18:32 - 2018-01-01 11:23 - 000561152 _____ (Microsoft Corporation) C:\WINDOWS\system32\ieui.dll
2018-01-26 18:32 - 2018-01-01 11:23 - 000536576 _____ (Microsoft Corporation) C:\WINDOWS\system32\edgeIso.dll
2018-01-26 18:32 - 2018-01-01 11:23 - 000385024 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\cldflt.sys
2018-01-26 18:32 - 2018-01-01 11:23 - 000250368 _____ (Microsoft Corporation) C:\WINDOWS\system32\AppxAllUserStore.dll
2018-01-26 18:32 - 2018-01-01 11:23 - 000232960 _____ (Microsoft Corporation) C:\WINDOWS\system32\convertvhd.exe
2018-01-26 18:32 - 2018-01-01 11:23 - 000121344 _____ (Microsoft Corporation) C:\WINDOWS\system32\fontsub.dll
2018-01-26 18:32 - 2018-01-01 11:23 - 000080384 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\vmbkmclr.sys
2018-01-26 18:32 - 2018-01-01 11:23 - 000047104 _____ (Adobe Systems) C:\WINDOWS\system32\atmlib.dll
2018-01-26 18:32 - 2018-01-01 11:22 - 000031744 _____ (Microsoft Corporation) C:\WINDOWS\system32\Windows.Management.Provisioning.ProxyStub.dll
2018-01-26 18:32 - 2018-01-01 11:22 - 000025600 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\Dumpstorport.sys
2018-01-26 18:32 - 2018-01-01 11:22 - 000017408 _____ (Microsoft Corporation) C:\WINDOWS\system32\VmApplicationHealthMonitorProxy.dll
2018-01-26 18:32 - 2018-01-01 11:21 - 000268288 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\dxtrans.dll
2018-01-26 18:32 - 2018-01-01 11:21 - 000233984 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\AppLockerCSP.dll
2018-01-26 18:32 - 2018-01-01 11:21 - 000192512 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\netvsc.sys
2018-01-26 18:32 - 2018-01-01 11:21 - 000133632 _____ (Microsoft Corporation) C:\WINDOWS\system32\wificonnapi.dll
2018-01-26 18:32 - 2018-01-01 11:21 - 000097280 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\WcnApi.dll
2018-01-26 18:32 - 2018-01-01 11:21 - 000097280 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\raspptp.sys
2018-01-26 18:32 - 2018-01-01 11:21 - 000080896 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\wanarp.sys
2018-01-26 18:32 - 2018-01-01 11:21 - 000062976 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\ndproxy.sys
2018-01-26 18:32 - 2018-01-01 11:20 - 019337216 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\mshtml.dll
2018-01-26 18:32 - 2018-01-01 11:20 - 018917888 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\edgehtml.dll
2018-01-26 18:32 - 2018-01-01 11:20 - 000524288 _____ (Microsoft Corporation) C:\WINDOWS\system32\daxexec.dll
2018-01-26 18:32 - 2018-01-01 11:20 - 000459776 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\webplatstorageserver.dll
2018-01-26 18:32 - 2018-01-01 11:20 - 000397824 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\dxtmsft.dll
2018-01-26 18:32 - 2018-01-01 11:20 - 000225792 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\winnat.sys
2018-01-26 18:32 - 2018-01-01 11:20 - 000215552 _____ (Microsoft Corporation) C:\WINDOWS\system32\fwpolicyiomgr.dll
2018-01-26 18:32 - 2018-01-01 11:20 - 000212992 _____ (Microsoft Corporation) C:\WINDOWS\system32\container.dll
2018-01-26 18:32 - 2018-01-01 11:20 - 000204288 _____ (Microsoft Corporation) C:\WINDOWS\system32\provisioningcsp.dll
2018-01-26 18:32 - 2018-01-01 11:20 - 000186368 _____ (Microsoft Corporation) C:\WINDOWS\system32\ACPBackgroundManagerPolicy.dll
2018-01-26 18:32 - 2018-01-01 11:20 - 000175616 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\fwpolicyiomgr.dll
2018-01-26 18:32 - 2018-01-01 11:20 - 000134656 _____ (Microsoft Corporation) C:\WINDOWS\system32\WcnApi.dll
2018-01-26 18:32 - 2018-01-01 11:20 - 000133632 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\iepeers.dll
2018-01-26 18:32 - 2018-01-01 11:20 - 000104960 _____ (Microsoft Corporation) C:\WINDOWS\system32\rasauto.dll
2018-01-26 18:32 - 2018-01-01 11:20 - 000082432 _____ (Microsoft Corporation) C:\WINDOWS\system32\SCardDlg.dll
2018-01-26 18:32 - 2018-01-01 11:20 - 000043008 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\RfxVmt.sys
2018-01-26 18:32 - 2018-01-01 11:20 - 000035328 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\nshhttp.dll
2018-01-26 18:32 - 2018-01-01 11:19 - 008014848 _____ (Microsoft Corporation) C:\WINDOWS\system32\Windows.Data.Pdf.dll
2018-01-26 18:32 - 2018-01-01 11:19 - 000795136 _____ (Microsoft Corporation) C:\WINDOWS\system32\NaturalAuth.dll
2018-01-26 18:32 - 2018-01-01 11:19 - 000675328 _____ (Microsoft Corporation) C:\WINDOWS\system32\webplatstorageserver.dll
2018-01-26 18:32 - 2018-01-01 11:19 - 000461312 _____ (Microsoft Corporation) C:\WINDOWS\system32\wlansec.dll
2018-01-26 18:32 - 2018-01-01 11:19 - 000450048 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\TileDataRepository.dll
2018-01-26 18:32 - 2018-01-01 11:19 - 000430080 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\Windows.Internal.Bluetooth.dll
2018-01-26 18:32 - 2018-01-01 11:19 - 000416768 _____ (Microsoft Corporation) C:\WINDOWS\system32\html.iec
2018-01-26 18:32 - 2018-01-01 11:19 - 000369152 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\msIso.dll
2018-01-26 18:32 - 2018-01-01 11:19 - 000366080 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\daxexec.dll
2018-01-26 18:32 - 2018-01-01 11:19 - 000365568 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\ieproxy.dll
2018-01-26 18:32 - 2018-01-01 11:19 - 000340480 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\html.iec
2018-01-26 18:32 - 2018-01-01 11:19 - 000334848 _____ (Microsoft Corporation) C:\WINDOWS\system32\dusmsvc.dll
2018-01-26 18:32 - 2018-01-01 11:19 - 000316928 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\netbt.sys
2018-01-26 18:32 - 2018-01-01 11:19 - 000188416 _____ (Microsoft Corporation) C:\WINDOWS\system32\PimIndexMaintenance.dll
2018-01-26 18:32 - 2018-01-01 11:19 - 000174592 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\P2P.dll
2018-01-26 18:32 - 2018-01-01 11:19 - 000149504 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\container.dll
2018-01-26 18:32 - 2018-01-01 11:19 - 000142848 _____ (Microsoft Corporation) C:\WINDOWS\system32\iepeers.dll
2018-01-26 18:32 - 2018-01-01 11:19 - 000097792 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\msoert2.dll
2018-01-26 18:32 - 2018-01-01 11:19 - 000093696 _____ (Microsoft Corporation) C:\WINDOWS\system32\mshtmled.dll
2018-01-26 18:32 - 2018-01-01 11:19 - 000079872 _____ (Microsoft Corporation) C:\WINDOWS\system32\nlaapi.dll
2018-01-26 18:32 - 2018-01-01 11:19 - 000073216 _____ (Microsoft Corporation) C:\WINDOWS\system32\provtool.exe
2018-01-26 18:32 - 2018-01-01 11:19 - 000063488 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\nlaapi.dll
2018-01-26 18:32 - 2018-01-01 11:19 - 000043008 _____ (Microsoft Corporation) C:\WINDOWS\system32\nshhttp.dll
2018-01-26 18:32 - 2018-01-01 11:18 - 000748032 _____ (Microsoft Corporation) C:\WINDOWS\system32\PhoneProviders.dll
2018-01-26 18:32 - 2018-01-01 11:18 - 000699904 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\CPFilters.dll
2018-01-26 18:32 - 2018-01-01 11:18 - 000588800 _____ (Microsoft Corporation) C:\WINDOWS\system32\SmsRouterSvc.dll
2018-01-26 18:32 - 2018-01-01 11:18 - 000465920 _____ (Microsoft Corporation) C:\WINDOWS\system32\wcncsvc.dll
2018-01-26 18:32 - 2018-01-01 11:18 - 000436224 _____ (Microsoft Corporation) C:\WINDOWS\system32\PsmServiceExtHost.dll
2018-01-26 18:32 - 2018-01-01 11:18 - 000432640 _____ (Microsoft Corporation) C:\WINDOWS\system32\provengine.dll
2018-01-26 18:32 - 2018-01-01 11:18 - 000431616 _____ (Microsoft Corporation) C:\WINDOWS\system32\msIso.dll
2018-01-26 18:32 - 2018-01-01 11:18 - 000427008 _____ (Microsoft Corporation) C:\WINDOWS\system32\provhandlers.dll
2018-01-26 18:32 - 2018-01-01 11:18 - 000425984 _____ (Microsoft Corporation) C:\WINDOWS\system32\vmrdvcore.dll
2018-01-26 18:32 - 2018-01-01 11:18 - 000391168 _____ (Microsoft Corporation) C:\WINDOWS\system32\iedkcs32.dll
2018-01-26 18:32 - 2018-01-01 11:18 - 000380928 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\EncDec.dll
2018-01-26 18:32 - 2018-01-01 11:18 - 000374784 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\FirewallAPI.dll
2018-01-26 18:32 - 2018-01-01 11:18 - 000369664 _____ (Microsoft Corporation) C:\WINDOWS\system32\APHostService.dll
2018-01-26 18:32 - 2018-01-01 11:18 - 000343040 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\iedkcs32.dll
2018-01-26 18:32 - 2018-01-01 11:18 - 000336896 _____ (Microsoft Corporation) C:\WINDOWS\system32\AppLockerCSP.dll
2018-01-26 18:32 - 2018-01-01 11:18 - 000276480 _____ (Microsoft Corporation) C:\WINDOWS\system32\dxtrans.dll
2018-01-26 18:32 - 2018-01-01 11:18 - 000261632 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\actxprxy.dll
2018-01-26 18:32 - 2018-01-01 11:18 - 000259072 _____ (Microsoft Corporation) C:\WINDOWS\system32\SCardSvr.dll
2018-01-26 18:32 - 2018-01-01 11:18 - 000210944 _____ (Microsoft Corporation) C:\WINDOWS\system32\P2P.dll
2018-01-26 18:32 - 2018-01-01 11:18 - 000144896 _____ (Microsoft Corporation) C:\WINDOWS\system32\appinfo.dll
2018-01-26 18:32 - 2018-01-01 11:18 - 000082944 _____ (Microsoft Corporation) C:\WINDOWS\system32\provdatastore.dll
2018-01-26 18:32 - 2018-01-01 11:17 - 011923968 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\ieframe.dll
2018-01-26 18:32 - 2018-01-01 11:17 - 006564864 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\Windows.Data.Pdf.dll
2018-01-26 18:32 - 2018-01-01 11:17 - 001485312 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\rdpserverbase.dll
2018-01-26 18:32 - 2018-01-01 11:17 - 000791552 _____ (Microsoft Corporation) C:\WINDOWS\system32\PhoneService.dll
2018-01-26 18:32 - 2018-01-01 11:17 - 000708096 _____ (Microsoft Corporation) C:\WINDOWS\system32\jscript9diag.dll
2018-01-26 18:32 - 2018-01-01 11:17 - 000616960 _____ (Microsoft Corporation) C:\WINDOWS\system32\Windows.Internal.Bluetooth.dll
2018-01-26 18:32 - 2018-01-01 11:17 - 000594432 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\Windows.Security.Authentication.Web.Core.dll
2018-01-26 18:32 - 2018-01-01 11:17 - 000568832 _____ (Microsoft Corporation) C:\WINDOWS\system32\TileDataRepository.dll
2018-01-26 18:32 - 2018-01-01 11:17 - 000559104 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\jscript9diag.dll
2018-01-26 18:32 - 2018-01-01 11:17 - 000555520 _____ (Microsoft Corporation) C:\WINDOWS\system32\SensorService.dll
2018-01-26 18:32 - 2018-01-01 11:17 - 000542208 _____ (Microsoft Corporation) C:\WINDOWS\system32\FirewallAPI.dll
2018-01-26 18:32 - 2018-01-01 11:17 - 000456704 _____ (Microsoft Corporation) C:\WINDOWS\system32\dxtmsft.dll
2018-01-26 18:32 - 2018-01-01 11:17 - 000423936 _____ (Microsoft Corporation) C:\WINDOWS\system32\p2psvc.dll
2018-01-26 18:32 - 2018-01-01 11:17 - 000341504 _____ (Microsoft Corporation) C:\WINDOWS\system32\pnrpsvc.dll
2018-01-26 18:32 - 2018-01-01 11:17 - 000228352 _____ (Microsoft Corporation) C:\WINDOWS\system32\ie4uinit.exe
2018-01-26 18:32 - 2018-01-01 11:17 - 000112640 _____ (Microsoft Corporation) C:\WINDOWS\system32\msoert2.dll
2018-01-26 18:32 - 2018-01-01 11:16 - 005833216 _____ (Microsoft Corporation) C:\WINDOWS\system32\dbgeng.dll
2018-01-26 18:32 - 2018-01-01 11:16 - 004839424 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\dbgeng.dll
2018-01-26 18:32 - 2018-01-01 11:16 - 003676672 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\jscript9.dll
2018-01-26 18:32 - 2018-01-01 11:16 - 000966656 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\Unistore.dll
2018-01-26 18:32 - 2018-01-01 11:16 - 000956928 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\rdpbase.dll
2018-01-26 18:32 - 2018-01-01 11:16 - 000831488 _____ (Microsoft Corporation) C:\WINDOWS\system32\Windows.Security.Authentication.Web.Core.dll
2018-01-26 18:32 - 2018-01-01 11:16 - 000815616 _____ (Microsoft Corporation) C:\WINDOWS\system32\ieproxy.dll
2018-01-26 18:32 - 2018-01-01 11:16 - 000812544 _____ (Microsoft Corporation) C:\WINDOWS\system32\bisrv.dll
2018-01-26 18:32 - 2018-01-01 11:16 - 000720896 _____ (Microsoft Corporation) C:\WINDOWS\system32\LogonController.dll
2018-01-26 18:32 - 2018-01-01 11:16 - 000668160 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\msfeeds.dll
2018-01-26 18:32 - 2018-01-01 11:16 - 000664576 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\jscript.dll
2018-01-26 18:32 - 2018-01-01 11:16 - 000624128 _____ (Microsoft Corporation) C:\WINDOWS\system32\SyncController.dll
2018-01-26 18:32 - 2018-01-01 11:16 - 000594944 _____ (Microsoft Corporation) C:\WINDOWS\system32\vbscript.dll
2018-01-26 18:32 - 2018-01-01 11:16 - 000463360 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\vbscript.dll
2018-01-26 18:32 - 2018-01-01 11:16 - 000401920 _____ (Microsoft Corporation) C:\WINDOWS\system32\ncsi.dll
2018-01-26 18:32 - 2018-01-01 11:16 - 000235008 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\webcheck.dll
2018-01-26 18:32 - 2018-01-01 11:16 - 000086528 _____ (Microsoft Corporation) C:\WINDOWS\system32\cldapi.dll
2018-01-26 18:32 - 2018-01-01 11:16 - 000076288 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\cldapi.dll
2018-01-26 18:32 - 2018-01-01 11:15 - 012687872 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\wmp.dll
2018-01-26 18:32 - 2018-01-01 11:15 - 006029312 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\Chakra.dll
2018-01-26 18:32 - 2018-01-01 11:15 - 002349568 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\InputService.dll
2018-01-26 18:32 - 2018-01-01 11:15 - 001657856 _____ (Microsoft Corporation) C:\WINDOWS\system32\rdpserverbase.dll
2018-01-26 18:32 - 2018-01-01 11:15 - 001245184 _____ (Microsoft Corporation) C:\WINDOWS\system32\Unistore.dll
2018-01-26 18:32 - 2018-01-01 11:15 - 000970240 _____ (Microsoft Corporation) C:\WINDOWS\system32\sysmain.dll
2018-01-26 18:32 - 2018-01-01 11:15 - 000951808 _____ (Microsoft Corporation) C:\WINDOWS\system32\usermgr.dll
2018-01-26 18:32 - 2018-01-01 11:15 - 000756736 _____ (Microsoft Corporation) C:\WINDOWS\system32\msfeeds.dll
2018-01-26 18:32 - 2018-01-01 11:15 - 000588800 _____ (Microsoft Corporation) C:\WINDOWS\system32\actxprxy.dll
2018-01-26 18:32 - 2018-01-01 11:15 - 000434176 _____ (Microsoft Corporation) C:\WINDOWS\system32\EncDec.dll
2018-01-26 18:32 - 2018-01-01 11:15 - 000366080 _____ (Microsoft Corporation) C:\WINDOWS\system32\nlasvc.dll
2018-01-26 18:32 - 2018-01-01 11:15 - 000258560 _____ (Microsoft Corporation) C:\WINDOWS\system32\webcheck.dll
2018-01-26 18:32 - 2018-01-01 11:14 - 023655936 _____ (Microsoft Corporation) C:\WINDOWS\system32\mshtml.dll
2018-01-26 18:32 - 2018-01-01 11:14 - 002465280 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\dwmcore.dll
2018-01-26 18:32 - 2018-01-01 11:14 - 001495040 _____ (Microsoft Corporation) C:\WINDOWS\system32\AppXDeploymentExtensions.desktop.dll
2018-01-26 18:32 - 2018-01-01 11:14 - 001097728 _____ (Microsoft Corporation) C:\WINDOWS\system32\rdpbase.dll
2018-01-26 18:32 - 2018-01-01 11:14 - 001003008 _____ (Microsoft Corporation) C:\WINDOWS\system32\modernexecserver.dll
2018-01-26 18:32 - 2018-01-01 11:14 - 000985600 _____ (Microsoft Corporation) C:\WINDOWS\system32\inetcomm.dll
2018-01-26 18:32 - 2018-01-01 11:14 - 000917504 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\TokenBroker.dll
2018-01-26 18:32 - 2018-01-01 11:14 - 000870912 _____ (Microsoft Corporation) C:\WINDOWS\system32\CPFilters.dll
2018-01-26 18:32 - 2018-01-01 11:13 - 013657600 _____ (Microsoft Corporation) C:\WINDOWS\system32\wmp.dll
2018-01-26 18:32 - 2018-01-01 11:13 - 012830208 _____ (Microsoft Corporation) C:\WINDOWS\system32\ieframe.dll
2018-01-26 18:32 - 2018-01-01 11:13 - 003121664 _____ (Microsoft Corporation) C:\WINDOWS\system32\Microsoft.Bluetooth.Profiles.Gatt.dll
2018-01-26 18:32 - 2018-01-01 11:13 - 002869760 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\wininet.dll
2018-01-26 18:32 - 2018-01-01 11:13 - 002013184 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\inetcpl.cpl
2018-01-26 18:32 - 2018-01-01 11:13 - 001559552 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\urlmon.dll
2018-01-26 18:32 - 2018-01-01 11:13 - 001474560 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\ieapfltr.dll
2018-01-26 18:32 - 2018-01-01 11:13 - 000897024 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\inetcomm.dll
2018-01-26 18:32 - 2018-01-01 11:12 - 002633216 _____ (Microsoft Corporation) C:\WINDOWS\system32\diagtrack.dll
2018-01-26 18:32 - 2018-01-01 11:12 - 002208768 _____ (Microsoft Corporation) C:\WINDOWS\system32\AppXDeploymentExtensions.onecore.dll
2018-01-26 18:32 - 2018-01-01 11:12 - 001573376 _____ (Microsoft Corporation) C:\WINDOWS\system32\UserDataService.dll
2018-01-26 18:32 - 2018-01-01 11:12 - 001547776 _____ (Microsoft Corporation) C:\WINDOWS\system32\lsasrv.dll
2018-01-26 18:32 - 2018-01-01 11:12 - 001424896 _____ (Microsoft Corporation) C:\WINDOWS\system32\wwansvc.dll
2018-01-26 18:32 - 2018-01-01 11:12 - 000760320 _____ (Microsoft Corporation) C:\WINDOWS\system32\spoolsv.exe
2018-01-26 18:32 - 2018-01-01 11:12 - 000464384 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\Windows.UI.Core.TextInput.dll
2018-01-26 18:32 - 2018-01-01 11:11 - 008108544 _____ (Microsoft Corporation) C:\WINDOWS\system32\Chakra.dll
2018-01-26 18:32 - 2018-01-01 11:11 - 004748288 _____ (Microsoft Corporation) C:\WINDOWS\system32\jscript9.dll
2018-01-26 18:32 - 2018-01-01 11:11 - 003334144 _____ (Microsoft Corporation) C:\WINDOWS\system32\wininet.dll
2018-01-26 18:32 - 2018-01-01 11:11 - 003165696 _____ (Microsoft Corporation) C:\WINDOWS\system32\AppXDeploymentServer.dll
2018-01-26 18:32 - 2018-01-01 11:11 - 002859520 _____ (Microsoft Corporation) C:\WINDOWS\system32\dwmcore.dll
2018-01-26 18:32 - 2018-01-01 11:11 - 002082304 _____ (Microsoft Corporation) C:\WINDOWS\system32\inetcpl.cpl
2018-01-26 18:32 - 2018-01-01 11:11 - 001822208 _____ (Microsoft Corporation) C:\WINDOWS\system32\urlmon.dll
2018-01-26 18:32 - 2018-01-01 11:11 - 001816576 _____ (Microsoft Corporation) C:\WINDOWS\system32\wevtsvc.dll
2018-01-26 18:32 - 2018-01-01 11:11 - 001597952 _____ (Microsoft Corporation) C:\WINDOWS\system32\ieapfltr.dll
2018-01-26 18:32 - 2018-01-01 11:11 - 001343488 _____ (Microsoft Corporation) C:\WINDOWS\system32\wifinetworkmanager.dll
2018-01-26 18:32 - 2018-01-01 11:11 - 001231872 _____ (Microsoft Corporation) C:\WINDOWS\system32\TokenBroker.dll
2018-01-26 18:32 - 2018-01-01 11:11 - 000880640 _____ (Microsoft Corporation) C:\WINDOWS\system32\schedsvc.dll
2018-01-26 18:32 - 2018-01-01 11:11 - 000812032 _____ (Microsoft Corporation) C:\WINDOWS\system32\jscript.dll
2018-01-26 18:32 - 2018-01-01 11:11 - 000715776 _____ (Microsoft Corporation) C:\WINDOWS\system32\winlogon.exe
2018-01-26 18:32 - 2018-01-01 11:10 - 003126272 _____ (Microsoft Corporation) C:\WINDOWS\system32\InputService.dll
2018-01-26 18:32 - 2018-01-01 11:10 - 002528256 _____ (Microsoft Corporation) C:\WINDOWS\system32\wlansvc.dll
2018-01-26 18:32 - 2018-01-01 11:10 - 000012800 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\wscproxystub.dll
2018-01-26 18:32 - 2018-01-01 11:09 - 001487872 _____ (Microsoft Corporation) C:\WINDOWS\system32\audiosrv.dll
2018-01-26 18:32 - 2018-01-01 11:09 - 000925184 _____ (Microsoft Corporation) C:\WINDOWS\system32\MPSSVC.dll
2018-01-26 18:32 - 2018-01-01 11:09 - 000666624 _____ (Microsoft Corporation) C:\WINDOWS\system32\DbgModel.dll
2018-01-26 18:32 - 2018-01-01 11:09 - 000599552 _____ (Microsoft Corporation) C:\WINDOWS\system32\Windows.UI.Core.TextInput.dll
2018-01-26 18:32 - 2018-01-01 11:08 - 000963072 _____ (Microsoft Corporation) C:\WINDOWS\system32\StorSvc.dll
2018-01-26 18:32 - 2018-01-01 11:08 - 000726016 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\srv2.sys
2018-01-26 18:32 - 2018-01-01 11:08 - 000685056 _____ (Microsoft Corporation) C:\WINDOWS\system32\AudioEndpointBuilder.dll
2018-01-26 18:32 - 2018-01-01 11:08 - 000505344 _____ (Microsoft Corporation) C:\WINDOWS\system32\taskcomp.dll
2018-01-26 18:32 - 2018-01-01 11:08 - 000424448 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\srv.sys
2018-01-26 18:32 - 2018-01-01 11:06 - 000018944 _____ (Microsoft Corporation) C:\WINDOWS\system32\wscproxystub.dll
2018-01-26 18:32 - 2018-01-01 11:05 - 002510848 _____ (Microsoft Corporation) C:\WINDOWS\system32\ResetEngine.dll
2018-01-26 18:32 - 2018-01-01 11:05 - 001160704 _____ (Microsoft Corporation) C:\WINDOWS\system32\reseteng.dll
2018-01-26 18:32 - 2018-01-01 11:05 - 000050176 _____ (Microsoft Corporation) C:\WINDOWS\system32\pcalua.exe
2018-01-25 17:59 - 2018-01-25 17:59 - 000000000 ____D C:\ProgramData\Microsoft OneDrive
2018-01-25 17:58 - 2018-01-25 17:58 - 000000000 ___HD C:\Users\desen\MicrosoftEdgeBackups
2018-01-25 17:56 - 2018-01-25 17:56 - 000000020 ___SH C:\Users\desen\ntuser.ini
2018-01-25 17:55 - 2018-01-28 10:18 - 000000006 ____H C:\WINDOWS\Tasks\SA.DAT
2018-01-25 17:55 - 2018-01-25 17:55 - 000003344 _____ C:\WINDOWS\System32\Tasks\GoogleUpdateTaskMachineUA
2018-01-25 17:55 - 2018-01-25 17:55 - 000003120 _____ C:\WINDOWS\System32\Tasks\GoogleUpdateTaskMachineCore
2018-01-25 17:55 - 2018-01-25 17:55 - 000003118 _____ C:\WINDOWS\System32\Tasks\Intel PTT EK Recertification
2018-01-25 17:55 - 2018-01-25 17:55 - 000002942 _____ C:\WINDOWS\System32\Tasks\Avast Emergency Update
2018-01-25 17:55 - 2018-01-25 17:55 - 000002886 _____ C:\WINDOWS\System32\Tasks\CCleaner Update
2018-01-25 17:55 - 2018-01-25 17:55 - 000002856 _____ C:\WINDOWS\System32\Tasks\HPJumpStartLaunch
2018-01-25 17:55 - 2018-01-25 17:55 - 000002852 _____ C:\WINDOWS\System32\Tasks\OneDrive Standalone Update Task-S-1-5-21-557160917-1767100916-191111700-1001
2018-01-25 17:55 - 2018-01-25 17:55 - 000002798 _____ C:\WINDOWS\System32\Tasks\HPCeeScheduleFordesen
2018-01-25 17:55 - 2018-01-25 17:55 - 000002766 _____ C:\WINDOWS\System32\Tasks\OneDrive Standalone Update Task v2
2018-01-25 17:55 - 2018-01-25 17:55 - 000002530 _____ C:\WINDOWS\System32\Tasks\SamsungMagician
2018-01-25 17:55 - 2018-01-25 17:55 - 000002498 _____ C:\WINDOWS\System32\Tasks\HPEA3JOBS
2018-01-25 17:55 - 2018-01-25 17:55 - 000002440 _____ C:\WINDOWS\System32\Tasks\HPAudioSwitch
2018-01-25 17:55 - 2018-01-25 17:55 - 000002280 _____ C:\WINDOWS\System32\Tasks\RTKCPL
2018-01-25 17:55 - 2018-01-25 17:55 - 000002216 _____ C:\WINDOWS\System32\Tasks\CCleanerSkipUAC
2018-01-25 17:55 - 2018-01-25 17:55 - 000000000 ____D C:\WINDOWS\System32\Tasks\Hewlett-Packard
2018-01-25 17:55 - 2018-01-25 17:55 - 000000000 ____D C:\WINDOWS\System32\Tasks\Avast Software
2018-01-25 17:55 - 2018-01-25 17:55 - 000000000 ____D C:\ProgramData\USOShared
2018-01-25 17:54 - 2018-01-25 17:54 - 000007623 _____ C:\WINDOWS\diagwrn.xml
2018-01-25 17:54 - 2018-01-25 17:54 - 000007623 _____ C:\WINDOWS\diagerr.xml
2018-01-25 17:53 - 2018-01-25 17:53 - 000022744 _____ C:\WINDOWS\system32\emptyregdb.dat
2018-01-25 17:51 - 2017-09-29 13:41 - 002241024 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\PrintConfig.dll
2018-01-25 17:50 - 2018-01-28 10:24 - 001023258 _____ C:\WINDOWS\system32\PerfStringBackup.INI
2018-01-25 17:50 - 2018-01-28 10:14 - 000000000 ____D C:\Users\desen
2018-01-25 17:50 - 2018-01-26 18:43 - 000000000 ____D C:\Users\desen\AppData\Local\Packages
2018-01-25 17:50 - 2018-01-25 17:50 - 000001519 _____ C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Windows Media Player.lnk
2018-01-25 17:49 - 2018-01-25 17:49 - 000002059 _____ C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Audio Control.lnk
2018-01-25 17:49 - 2018-01-23 19:16 - 000140280 _____ (Khronos Group) C:\WINDOWS\system32\OpenCL.DLL
2018-01-25 17:49 - 2018-01-23 19:16 - 000116728 _____ (Khronos Group) C:\WINDOWS\SysWOW64\OpenCL.DLL
2018-01-25 17:48 - 2018-01-28 10:18 - 000000000 ____D C:\WINDOWS\system32\SleepStudy
2018-01-25 17:48 - 2018-01-27 17:34 - 000482704 _____ C:\WINDOWS\system32\FNTCACHE.DAT
2018-01-25 17:46 - 2018-01-25 17:56 - 000000000 ____D C:\Windows.old
2018-01-25 17:44 - 2018-01-25 17:46 - 000000000 ____D C:\WINDOWS\system32\config\bbimigrate
2018-01-25 17:44 - 2018-01-25 17:44 - 000000000 ____D C:\WINDOWS\ServiceProfiles
2018-01-25 17:43 - 2018-01-25 17:43 - 006791472 _____ (Microsoft Corporation) C:\WINDOWS\system32\Windows.Media.dll
2018-01-25 17:43 - 2018-01-25 17:43 - 006015200 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\Windows.Media.dll
2018-01-25 17:43 - 2018-01-25 17:43 - 004814848 _____ (Microsoft Corporation) C:\WINDOWS\system32\MFMediaEngine.dll
2018-01-25 17:43 - 2018-01-25 17:43 - 004249600 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\MFMediaEngine.dll
2018-01-25 17:43 - 2018-01-25 17:43 - 002717392 _____ (Microsoft Corporation) C:\WINDOWS\system32\mfmp4srcsnk.dll
2018-01-25 17:43 - 2018-01-25 17:43 - 002465848 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\mfmp4srcsnk.dll
2018-01-25 17:43 - 2018-01-25 17:43 - 002269080 _____ (Microsoft Corporation) C:\WINDOWS\system32\mfsrcsnk.dll
2018-01-25 17:43 - 2018-01-25 17:43 - 001970520 _____ (Microsoft Corporation) C:\WINDOWS\system32\mfasfsrcsnk.dll
2018-01-25 17:43 - 2018-01-25 17:43 - 001776272 _____ (Microsoft Corporation) C:\WINDOWS\system32\mfplat.dll
2018-01-25 17:43 - 2018-01-25 17:43 - 001558856 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\winmde.dll
2018-01-25 17:43 - 2018-01-25 17:43 - 001522176 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\mfplat.dll
2018-01-25 17:43 - 2018-01-25 17:43 - 001507736 _____ (Microsoft Corporation) C:\WINDOWS\system32\mfmpeg2srcsnk.dll
2018-01-25 17:43 - 2018-01-25 17:43 - 001454568 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\mfsrcsnk.dll
2018-01-25 17:43 - 2018-01-25 17:43 - 001377080 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\mfasfsrcsnk.dll
2018-01-25 17:43 - 2018-01-25 17:43 - 001259344 _____ (Microsoft Corporation) C:\WINDOWS\system32\mfsvr.dll
2018-01-25 17:43 - 2018-01-25 17:43 - 001148216 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\mfsvr.dll
2018-01-25 17:43 - 2018-01-25 17:43 - 001057824 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\msvproc.dll
2018-01-25 17:43 - 2018-01-25 17:43 - 001054280 _____ (Microsoft Corporation) C:\WINDOWS\system32\msvproc.dll
2018-01-25 17:43 - 2018-01-25 17:43 - 001015008 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\mfmpeg2srcsnk.dll
2018-01-25 17:43 - 2018-01-25 17:43 - 000285696 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\mrxsmb10.sys
2018-01-25 17:43 - 2018-01-25 17:43 - 000008192 _____ C:\WINDOWS\system32\config\userdiff
2018-01-25 17:42 - 2018-01-25 17:42 - 021754368 _____ (Microsoft Corporation) C:\WINDOWS\system32\Hydrogen.dll
2018-01-25 17:42 - 2018-01-25 17:42 - 017159680 _____ (Microsoft Corporation) C:\WINDOWS\system32\Windows.UI.Xaml.dll
2018-01-25 17:42 - 2018-01-25 17:42 - 017084416 _____ (Microsoft Corporation) C:\WINDOWS\system32\HologramCompositor.dll
2018-01-25 17:42 - 2018-01-25 17:42 - 013703168 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\Windows.UI.Xaml.dll
2018-01-25 17:42 - 2018-01-25 17:42 - 007545344 _____ (Microsoft Corporation) C:\WINDOWS\system32\twinui.dll
2018-01-25 17:42 - 2018-01-25 17:42 - 006466048 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\twinui.dll
2018-01-25 17:42 - 2018-01-25 17:42 - 004772352 _____ (Microsoft Corporation) C:\WINDOWS\system32\ExplorerFrame.dll
2018-01-25 17:42 - 2018-01-25 17:42 - 004592640 _____ (Microsoft Corporation) C:\WINDOWS\system32\SystemSettingsThresholdAdminFlowUI.dll
2018-01-25 17:42 - 2018-01-25 17:42 - 004504456 _____ (Microsoft Corporation) C:\WINDOWS\system32\sppsvc.exe
2018-01-25 17:42 - 2018-01-25 17:42 - 004385280 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\ExplorerFrame.dll
2018-01-25 17:42 - 2018-01-25 17:42 - 003578368 _____ (Microsoft Corporation) C:\WINDOWS\system32\SRH.dll
2018-01-25 17:42 - 2018-01-25 17:42 - 003478016 _____ (Microsoft Corporation) C:\WINDOWS\system32\mispace.dll
2018-01-25 17:42 - 2018-01-25 17:42 - 003331520 _____ C:\WINDOWS\system32\Windows.Mirage.dll
2018-01-25 17:42 - 2018-01-25 17:42 - 003211776 _____ (Microsoft Corporation) C:\WINDOWS\system32\NetworkMobileSettings.dll
2018-01-25 17:42 - 2018-01-25 17:42 - 003186688 _____ (Microsoft Corporation) C:\WINDOWS\system32\Windows.CloudStore.dll
2018-01-25 17:42 - 2018-01-25 17:42 - 003010720 _____ (Microsoft Corporation) C:\WINDOWS\system32\d3d11.dll
2018-01-25 17:42 - 2018-01-25 17:42 - 002972672 _____ (Microsoft Corporation) C:\WINDOWS\system32\twinui.pcshell.dll
2018-01-25 17:42 - 2018-01-25 17:42 - 002890240 _____ (Microsoft Corporation) C:\WINDOWS\system32\Windows.UI.Xaml.Resources.dll
2018-01-25 17:42 - 2018-01-25 17:42 - 002864640 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\mispace.dll
2018-01-25 17:42 - 2018-01-25 17:42 - 002859520 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\SRH.dll
2018-01-25 17:42 - 2018-01-25 17:42 - 002783744 _____ (Microsoft Corporation) C:\WINDOWS\system32\wuaueng.dll
2018-01-25 17:42 - 2018-01-25 17:42 - 002666496 _____ (Microsoft Corporation) C:\WINDOWS\system32\storagewmi.dll
2018-01-25 17:42 - 2018-01-25 17:42 - 002596352 _____ (Microsoft Corporation) C:\WINDOWS\system32\smartscreen.exe
2018-01-25 17:42 - 2018-01-25 17:42 - 002573208 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\dxgkrnl.sys
2018-01-25 17:42 - 2018-01-25 17:42 - 002491112 _____ C:\WINDOWS\SysWOW64\Windows.Mirage.dll
2018-01-25 17:42 - 2018-01-25 17:42 - 002446744 _____ (Microsoft Corporation) C:\WINDOWS\system32\UpdateAgent.dll
2018-01-25 17:42 - 2018-01-25 17:42 - 002412168 _____ (Microsoft Corporation) C:\WINDOWS\system32\msxml6.dll
2018-01-25 17:42 - 2018-01-25 17:42 - 002393600 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\AcGenral.dll
2018-01-25 17:42 - 2018-01-25 17:42 - 002339296 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\d3d11.dll
2018-01-25 17:42 - 2018-01-25 17:42 - 002117632 _____ (Microsoft Corporation) C:\WINDOWS\system32\pnidui.dll
2018-01-25 17:42 - 2018-01-25 17:42 - 002105856 _____ (Microsoft Corporation) C:\WINDOWS\system32\win32kbase.sys
2018-01-25 17:42 - 2018-01-25 17:42 - 001990160 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\msxml6.dll
2018-01-25 17:42 - 2018-01-25 17:42 - 001980928 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\storagewmi.dll
2018-01-25 17:42 - 2018-01-25 17:42 - 001925296 _____ (Microsoft Corporation) C:\WINDOWS\system32\Windows.ApplicationModel.Store.dll
2018-01-25 17:42 - 2018-01-25 17:42 - 001806336 _____ (Microsoft Corporation) C:\WINDOWS\system32\Windows.Media.Speech.dll
2018-01-25 17:42 - 2018-01-25 17:42 - 001739264 _____ (Microsoft Corporation) C:\WINDOWS\system32\Windows.UI.Immersive.dll
2018-01-25 17:42 - 2018-01-25 17:42 - 001694224 _____ (Microsoft Corporation) C:\WINDOWS\system32\winmde.dll
2018-01-25 17:42 - 2018-01-25 17:42 - 001670656 _____ (Microsoft Corporation) C:\WINDOWS\system32\batmeter.dll
2018-01-25 17:42 - 2018-01-25 17:42 - 001666048 _____ (Microsoft Corporation) C:\WINDOWS\system32\Windows.UI.Input.Inking.dll
2018-01-25 17:42 - 2018-01-25 17:42 - 001664000 _____ (Microsoft Corporation) C:\WINDOWS\system32\GdiPlus.dll
2018-01-25 17:42 - 2018-01-25 17:42 - 001663488 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\batmeter.dll
2018-01-25 17:42 - 2018-01-25 17:42 - 001642520 _____ (Microsoft Corporation) C:\WINDOWS\system32\d3d9.dll
2018-01-25 17:42 - 2018-01-25 17:42 - 001636376 _____ (Microsoft Corporation) C:\WINDOWS\system32\gdi32full.dll
2018-01-25 17:42 - 2018-01-25 17:42 - 001634288 _____ (Microsoft Corporation) C:\WINDOWS\system32\user32.dll
2018-01-25 17:42 - 2018-01-25 17:42 - 001585376 _____ (Microsoft Corporation) C:\WINDOWS\system32\appraiser.dll
2018-01-25 17:42 - 2018-01-25 17:42 - 001570816 _____ (Microsoft Corporation) C:\WINDOWS\system32\RecoveryDrive.exe
2018-01-25 17:42 - 2018-01-25 17:42 - 001554216 _____ (Microsoft Corporation) C:\WINDOWS\system32\twinapi.appcore.dll
2018-01-25 17:42 - 2018-01-25 17:42 - 001528904 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\user32.dll
2018-01-25 17:42 - 2018-01-25 17:42 - 001509888 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\Windows.UI.Immersive.dll
2018-01-25 17:42 - 2018-01-25 17:42 - 001498112 _____ (Microsoft Corporation) C:\WINDOWS\system32\WebRuntimeManager.dll
2018-01-25 17:42 - 2018-01-25 17:42 - 001490328 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\Windows.ApplicationModel.Store.dll
2018-01-25 17:42 - 2018-01-25 17:42 - 001488792 _____ (Microsoft Corporation) C:\WINDOWS\system32\ContentDeliveryManager.Utilities.dll
2018-01-25 17:42 - 2018-01-25 17:42 - 001474680 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\d3d9.dll
2018-01-25 17:42 - 2018-01-25 17:42 - 001470976 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\GdiPlus.dll
2018-01-25 17:42 - 2018-01-25 17:42 - 001463856 _____ (Microsoft Corporation) C:\WINDOWS\system32\msctf.dll
2018-01-25 17:42 - 2018-01-25 17:42 - 001432816 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\gdi32full.dll
2018-01-25 17:42 - 2018-01-25 17:42 - 001425408 _____ (Microsoft Corporation) C:\WINDOWS\system32\SystemSettings.Handlers.dll
2018-01-25 17:42 - 2018-01-25 17:42 - 001353728 _____ (Microsoft Corporation) C:\WINDOWS\system32\usercpl.dll
2018-01-25 17:42 - 2018-01-25 17:42 - 001323840 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\msctf.dll
2018-01-25 17:42 - 2018-01-25 17:42 - 001321472 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\Windows.UI.Input.Inking.dll
2018-01-25 17:42 - 2018-01-25 17:42 - 001289216 _____ (Microsoft Corporation) C:\WINDOWS\system32\usocore.dll
2018-01-25 17:42 - 2018-01-25 17:42 - 001280000 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\Windows.Media.Speech.dll
2018-01-25 17:42 - 2018-01-25 17:42 - 001261864 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\twinapi.appcore.dll
2018-01-25 17:42 - 2018-01-25 17:42 - 001230848 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\usercpl.dll
2018-01-25 17:42 - 2018-01-25 17:42 - 001167360 _____ (Microsoft Corporation) C:\WINDOWS\system32\ISM.dll
2018-01-25 17:42 - 2018-01-25 17:42 - 001145104 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\ucrtbase.dll
2018-01-25 17:42 - 2018-01-25 17:42 - 001124760 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\ContentDeliveryManager.Utilities.dll
2018-01-25 17:42 - 2018-01-25 17:42 - 001058304 _____ (Microsoft Corporation) C:\WINDOWS\system32\comdlg32.dll
2018-01-25 17:42 - 2018-01-25 17:42 - 001054720 _____ (Microsoft Corporation) C:\WINDOWS\system32\wuapi.dll
2018-01-25 17:42 - 2018-01-25 17:42 - 001015296 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\bthport.sys
2018-01-25 17:42 - 2018-01-25 17:42 - 001012120 _____ (Microsoft Corporation) C:\WINDOWS\system32\Windows.Services.TargetedContent.dll
2018-01-25 17:42 - 2018-01-25 17:42 - 001003104 _____ (Microsoft Corporation) C:\WINDOWS\system32\ucrtbase.dll
2018-01-25 17:42 - 2018-01-25 17:42 - 000979352 _____ (Microsoft Corporation) C:\WINDOWS\system32\LicenseManager.dll
2018-01-25 17:42 - 2018-01-25 17:42 - 000975872 _____ C:\WINDOWS\system32\FaceProcessor.dll
2018-01-25 17:42 - 2018-01-25 17:42 - 000899584 _____ (Microsoft Corporation) C:\WINDOWS\system32\samsrv.dll
2018-01-25 17:42 - 2018-01-25 17:42 - 000891800 _____ (Microsoft Corporation) C:\WINDOWS\system32\WWAHost.exe
2018-01-25 17:42 - 2018-01-25 17:42 - 000887296 _____ (Microsoft Corporation) C:\WINDOWS\system32\Windows.Networking.dll
2018-01-25 17:42 - 2018-01-25 17:42 - 000882688 _____ (Microsoft Corporation) C:\WINDOWS\system32\Windows.Mirage.Internal.dll
2018-01-25 17:42 - 2018-01-25 17:42 - 000841728 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\comdlg32.dll
2018-01-25 17:42 - 2018-01-25 17:42 - 000840440 _____ (Microsoft Corporation) C:\WINDOWS\system32\Windows.Perception.Stub.dll
2018-01-25 17:42 - 2018-01-25 17:42 - 000830464 _____ (Microsoft Corporation) C:\WINDOWS\system32\d3d9on12.dll
2018-01-25 17:42 - 2018-01-25 17:42 - 000823808 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\wuapi.dll
2018-01-25 17:42 - 2018-01-25 17:42 - 000791960 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\WWAHost.exe
2018-01-25 17:42 - 2018-01-25 17:42 - 000770048 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\WdiWiFi.sys
2018-01-25 17:42 - 2018-01-25 17:42 - 000769096 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\msvcrt.dll
2018-01-25 17:42 - 2018-01-25 17:42 - 000768512 _____ (Microsoft Corporation) C:\WINDOWS\system32\PCPKsp.dll
2018-01-25 17:42 - 2018-01-25 17:42 - 000754688 _____ (Microsoft Corporation) C:\WINDOWS\system32\evr.dll
2018-01-25 17:42 - 2018-01-25 17:42 - 000749976 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\dxgmms2.sys
2018-01-25 17:42 - 2018-01-25 17:42 - 000747416 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\LicenseManager.dll
2018-01-25 17:42 - 2018-01-25 17:42 - 000746904 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\Windows.Services.TargetedContent.dll
2018-01-25 17:42 - 2018-01-25 17:42 - 000739696 _____ (Microsoft Corporation) C:\WINDOWS\system32\dnsapi.dll
2018-01-25 17:42 - 2018-01-25 17:42 - 000721592 _____ (Microsoft Corporation) C:\WINDOWS\system32\sppwinob.dll
2018-01-25 17:42 - 2018-01-25 17:42 - 000710912 _____ (Microsoft Corporation) C:\WINDOWS\system32\ci.dll
2018-01-25 17:42 - 2018-01-25 17:42 - 000708096 _____ (Microsoft Corporation) C:\WINDOWS\system32\SndVolSSO.dll
2018-01-25 17:42 - 2018-01-25 17:42 - 000705944 _____ (Microsoft Corporation) C:\WINDOWS\system32\wimgapi.dll
2018-01-25 17:42 - 2018-01-25 17:42 - 000703536 _____ (Microsoft Corporation) C:\WINDOWS\system32\dxgi.dll
2018-01-25 17:42 - 2018-01-25 17:42 - 000676352 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\SndVolSSO.dll
2018-01-25 17:42 - 2018-01-25 17:42 - 000666112 _____ (Microsoft Corporation) C:\WINDOWS\system32\DHolographicDisplay.dll
2018-01-25 17:42 - 2018-01-25 17:42 - 000665088 _____ (Microsoft Corporation) C:\WINDOWS\system32\TpmCoreProvisioning.dll
2018-01-25 17:42 - 2018-01-25 17:42 - 000661664 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\evr.dll
2018-01-25 17:42 - 2018-01-25 17:42 - 000660480 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\Windows.Networking.dll
2018-01-25 17:42 - 2018-01-25 17:42 - 000654848 _____ (Microsoft Corporation) C:\WINDOWS\system32\RDXService.dll
2018-01-25 17:42 - 2018-01-25 17:42 - 000654048 _____ (Microsoft Corporation) C:\WINDOWS\system32\generaltel.dll
2018-01-25 17:42 - 2018-01-25 17:42 - 000640512 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\mswstr10.dll
2018-01-25 17:42 - 2018-01-25 17:42 - 000630752 _____ (Microsoft Corporation) C:\WINDOWS\system32\msvcrt.dll
2018-01-25 17:42 - 2018-01-25 17:42 - 000618496 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\Windows.Mirage.Internal.dll
2018-01-25 17:42 - 2018-01-25 17:42 - 000614912 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\apphelp.dll
2018-01-25 17:42 - 2018-01-25 17:42 - 000612760 _____ (Microsoft Corporation) C:\WINDOWS\system32\aeinv.dll
2018-01-25 17:42 - 2018-01-25 17:42 - 000610712 _____ (Microsoft Corporation) C:\WINDOWS\system32\devinv.dll
2018-01-25 17:42 - 2018-01-25 17:42 - 000601088 _____ (Microsoft Corporation) C:\WINDOWS\system32\ipnathlp.dll
2018-01-25 17:42 - 2018-01-25 17:42 - 000597160 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\dnsapi.dll
2018-01-25 17:42 - 2018-01-25 17:42 - 000592280 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\wimgapi.dll
2018-01-25 17:42 - 2018-01-25 17:42 - 000591872 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\PCPKsp.dll
2018-01-25 17:42 - 2018-01-25 17:42 - 000590944 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\dxgi.dll
2018-01-25 17:42 - 2018-01-25 17:42 - 000566272 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\TpmCoreProvisioning.dll
2018-01-25 17:42 - 2018-01-25 17:42 - 000559616 _____ (Microsoft Corporation) C:\WINDOWS\system32\iprtrmgr.dll
2018-01-25 17:42 - 2018-01-25 17:42 - 000557056 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\d3d9on12.dll
2018-01-25 17:42 - 2018-01-25 17:42 - 000556544 _____ (Microsoft Corporation) C:\WINDOWS\system32\LockAppBroker.dll
2018-01-25 17:42 - 2018-01-25 17:42 - 000555416 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\USBHUB3.SYS
2018-01-25 17:42 - 2018-01-25 17:42 - 000539136 _____ (Microsoft Corporation) C:\WINDOWS\system32\HolographicExtensions.dll
2018-01-25 17:42 - 2018-01-25 17:42 - 000534528 _____ (Microsoft Corporation) C:\WINDOWS\system32\apphelp.dll
2018-01-25 17:42 - 2018-01-25 17:42 - 000529408 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\nwifi.sys
2018-01-25 17:42 - 2018-01-25 17:42 - 000525208 _____ (Microsoft Corporation) C:\WINDOWS\system32\wimserv.exe
2018-01-25 17:42 - 2018-01-25 17:42 - 000516096 _____ (Microsoft Corporation) C:\WINDOWS\system32\ActivationManager.dll
2018-01-25 17:42 - 2018-01-25 17:42 - 000514560 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\iprtrmgr.dll
2018-01-25 17:42 - 2018-01-25 17:42 - 000506256 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\Windows.Perception.Stub.dll
2018-01-25 17:42 - 2018-01-25 17:42 - 000496640 _____ (Microsoft Corporation) C:\WINDOWS\system32\sppcext.dll
2018-01-25 17:42 - 2018-01-25 17:42 - 000495000 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\mrxsmb.sys
2018-01-25 17:42 - 2018-01-25 17:42 - 000487424 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\AcSpecfc.dll
2018-01-25 17:42 - 2018-01-25 17:42 - 000481792 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\sppcext.dll
2018-01-25 17:42 - 2018-01-25 17:42 - 000479912 _____ (Microsoft Corporation) C:\WINDOWS\system32\wow64win.dll
2018-01-25 17:42 - 2018-01-25 17:42 - 000478208 _____ (Microsoft Corporation) C:\WINDOWS\system32\NgcCtnr.dll
2018-01-25 17:42 - 2018-01-25 17:42 - 000474112 _____ (Microsoft Corporation) C:\WINDOWS\system32\DictationManager.dll
2018-01-25 17:42 - 2018-01-25 17:42 - 000464408 _____ (Microsoft Corporation) C:\WINDOWS\system32\bcryptprimitives.dll
2018-01-25 17:42 - 2018-01-25 17:42 - 000462336 _____ (Microsoft Corporation) C:\WINDOWS\system32\wuuhext.dll
2018-01-25 17:42 - 2018-01-25 17:42 - 000456704 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\LockAppBroker.dll
2018-01-25 17:42 - 2018-01-25 17:42 - 000444928 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\ActivationManager.dll
2018-01-25 17:42 - 2018-01-25 17:42 - 000442880 _____ (Microsoft Corporation) C:\WINDOWS\system32\cryptngc.dll
2018-01-25 17:42 - 2018-01-25 17:42 - 000437144 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\USBXHCI.SYS
2018-01-25 17:42 - 2018-01-25 17:42 - 000436120 _____ (Microsoft Corporation) C:\WINDOWS\system32\CloudExperienceHostCommon.dll
2018-01-25 17:42 - 2018-01-25 17:42 - 000432640 _____ (Microsoft Corporation) C:\WINDOWS\system32\Windows.ApplicationModel.LockScreen.dll
2018-01-25 17:42 - 2018-01-25 17:42 - 000418712 _____ (Microsoft Corporation) C:\WINDOWS\system32\msv1_0.dll
2018-01-25 17:42 - 2018-01-25 17:42 - 000404888 _____ (Microsoft Corporation) C:\WINDOWS\system32\CloudExperienceHost.dll
2018-01-25 17:42 - 2018-01-25 17:42 - 000401304 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\volsnap.sys
2018-01-25 17:42 - 2018-01-25 17:42 - 000394752 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\ks.sys
2018-01-25 17:42 - 2018-01-25 17:42 - 000373656 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\clfs.sys
2018-01-25 17:42 - 2018-01-25 17:42 - 000372224 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\AcLayers.dll
2018-01-25 17:42 - 2018-01-25 17:42 - 000363008 _____ (Microsoft Corporation) C:\WINDOWS\system32\SettingsEnvironment.Desktop.dll
2018-01-25 17:42 - 2018-01-25 17:42 - 000362176 _____ (Microsoft Corporation) C:\WINDOWS\system32\BioIso.exe
2018-01-25 17:42 - 2018-01-25 17:42 - 000361984 _____ (Microsoft Corporation) C:\WINDOWS\system32\SpatializerApo.dll
2018-01-25 17:42 - 2018-01-25 17:42 - 000354304 _____ (Microsoft Corporation) C:\WINDOWS\system32\WwaApi.dll
2018-01-25 17:42 - 2018-01-25 17:42 - 000354200 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\CloudExperienceHostCommon.dll
2018-01-25 17:42 - 2018-01-25 17:42 - 000353848 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\bcryptprimitives.dll
2018-01-25 17:42 - 2018-01-25 17:42 - 000353688 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\msv1_0.dll
2018-01-25 17:42 - 2018-01-25 17:42 - 000351232 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\DictationManager.dll
2018-01-25 17:42 - 2018-01-25 17:42 - 000339968 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\msexcl40.dll
2018-01-25 17:42 - 2018-01-25 17:42 - 000336896 _____ (Microsoft Corporation) C:\WINDOWS\system32\HolographicRuntimes.dll
2018-01-25 17:42 - 2018-01-25 17:42 - 000329728 _____ (Microsoft Corporation) C:\WINDOWS\system32\AcGenral.dll
2018-01-25 17:42 - 2018-01-25 17:42 - 000327680 _____ (Microsoft Corporation) C:\WINDOWS\system32\MusNotification.exe
2018-01-25 17:42 - 2018-01-25 17:42 - 000326144 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\cryptngc.dll
2018-01-25 17:42 - 2018-01-25 17:42 - 000315392 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\Windows.ApplicationModel.LockScreen.dll
2018-01-25 17:42 - 2018-01-25 17:42 - 000308736 _____ (Microsoft Corporation) C:\WINDOWS\system32\Windows.ApplicationModel.Store.TestingFramework.dll
2018-01-25 17:42 - 2018-01-25 17:42 - 000306688 _____ (Microsoft Corporation) C:\WINDOWS\system32\FSClient.dll
2018-01-25 17:42 - 2018-01-25 17:42 - 000301056 _____ (Microsoft Corporation) C:\WINDOWS\system32\AcLayers.dll
2018-01-25 17:42 - 2018-01-25 17:42 - 000293888 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\WwaApi.dll
2018-01-25 17:42 - 2018-01-25 17:42 - 000292864 _____ (Microsoft Corporation) C:\WINDOWS\system32\ExecModelClient.dll
2018-01-25 17:42 - 2018-01-25 17:42 - 000285080 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\sdbus.sys
2018-01-25 17:42 - 2018-01-25 17:42 - 000271872 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\SpatializerApo.dll
2018-01-25 17:42 - 2018-01-25 17:42 - 000269696 _____ C:\WINDOWS\system32\FaceProcessorCore.dll
2018-01-25 17:42 - 2018-01-25 17:42 - 000266752 _____ (Microsoft Corporation) C:\WINDOWS\system32\SIHClient.exe
2018-01-25 17:42 - 2018-01-25 17:42 - 000264040 _____ (Microsoft Corporation) C:\WINDOWS\system32\MusNotifyIcon.exe
2018-01-25 17:42 - 2018-01-25 17:42 - 000259072 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\srvnet.sys
2018-01-25 17:42 - 2018-01-25 17:42 - 000254976 _____ (Microsoft Corporation) C:\WINDOWS\system32\PushToInstall.dll
2018-01-25 17:42 - 2018-01-25 17:42 - 000246272 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\Windows.ApplicationModel.Store.TestingFramework.dll
2018-01-25 17:42 - 2018-01-25 17:42 - 000246168 _____ (Microsoft Corporation) C:\WINDOWS\system32\browserbroker.dll
2018-01-25 17:42 - 2018-01-25 17:42 - 000242176 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\ExecModelClient.dll
2018-01-25 17:42 - 2018-01-25 17:42 - 000239104 _____ (Microsoft Corporation) C:\WINDOWS\system32\smartscreenps.dll
2018-01-25 17:42 - 2018-01-25 17:42 - 000238080 _____ (Microsoft Corporation) C:\WINDOWS\system32\DeviceSetupManager.dll
2018-01-25 17:42 - 2018-01-25 17:42 - 000235520 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\FSClient.dll
2018-01-25 17:42 - 2018-01-25 17:42 - 000230296 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\mrxsmb20.sys
2018-01-25 17:42 - 2018-01-25 17:42 - 000227328 _____ (Microsoft Corporation) C:\WINDOWS\system32\CapabilityAccessManager.dll
2018-01-25 17:42 - 2018-01-25 17:42 - 000222208 _____ (Microsoft Corporation) C:\WINDOWS\system32\scrobj.dll
2018-01-25 17:42 - 2018-01-25 17:42 - 000211456 _____ (Microsoft Corporation) C:\WINDOWS\system32\MusNotificationUx.exe
2018-01-25 17:42 - 2018-01-25 17:42 - 000206336 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\scrobj.dll
2018-01-25 17:42 - 2018-01-25 17:42 - 000198888 _____ (Microsoft Corporation) C:\WINDOWS\system32\acmigration.dll
2018-01-25 17:42 - 2018-01-25 17:42 - 000187288 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\dumpsd.sys
2018-01-25 17:42 - 2018-01-25 17:42 - 000175104 _____ (Microsoft Corporation) C:\WINDOWS\system32\t2embed.dll
2018-01-25 17:42 - 2018-01-25 17:42 - 000174080 _____ (Microsoft Corporation) C:\WINDOWS\system32\gamingtcui.dll
2018-01-25 17:42 - 2018-01-25 17:42 - 000172544 _____ (Microsoft Corporation) C:\WINDOWS\system32\itss.dll
2018-01-25 17:42 - 2018-01-25 17:42 - 000170496 _____ (Microsoft Corporation) C:\WINDOWS\system32\SettingsHandlers_ContentDeliveryManager.dll
2018-01-25 17:42 - 2018-01-25 17:42 - 000169472 _____ (Microsoft Corporation) C:\WINDOWS\system32\wuuhosdeployment.dll
2018-01-25 17:42 - 2018-01-25 17:42 - 000168448 _____ (Microsoft Corporation) C:\WINDOWS\system32\SettingsHandlers_SIUF.dll
2018-01-25 17:42 - 2018-01-25 17:42 - 000164864 _____ (Microsoft Corporation) C:\WINDOWS\system32\wscript.exe
2018-01-25 17:42 - 2018-01-25 17:42 - 000164864 _____ (Microsoft Corporation) C:\WINDOWS\system32\dmcertinst.exe
2018-01-25 17:42 - 2018-01-25 17:42 - 000164864 _____ (Microsoft Corporation) C:\WINDOWS\system32\cscript.exe
2018-01-25 17:42 - 2018-01-25 17:42 - 000160256 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\smartscreenps.dll
2018-01-25 17:42 - 2018-01-25 17:42 - 000151040 _____ (Microsoft Corporation) C:\WINDOWS\system32\umpo.dll
2018-01-25 17:42 - 2018-01-25 17:42 - 000150528 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\itss.dll
2018-01-25 17:42 - 2018-01-25 17:42 - 000149400 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\storahci.sys
2018-01-25 17:42 - 2018-01-25 17:42 - 000147456 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\wscript.exe
2018-01-25 17:42 - 2018-01-25 17:42 - 000143360 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\cscript.exe
2018-01-25 17:42 - 2018-01-25 17:42 - 000137544 _____ (Microsoft Corporation) C:\WINDOWS\system32\bcrypt.dll
2018-01-25 17:42 - 2018-01-25 17:42 - 000136704 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\gamingtcui.dll
2018-01-25 17:42 - 2018-01-25 17:42 - 000135168 _____ (Microsoft Corporation) C:\WINDOWS\system32\SettingsHandlers_CapabilityAccess.dll
2018-01-25 17:42 - 2018-01-25 17:42 - 000133632 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\t2embed.dll
2018-01-25 17:42 - 2018-01-25 17:42 - 000126464 _____ (Microsoft Corporation) C:\WINDOWS\system32\cryptcatsvc.dll
2018-01-25 17:42 - 2018-01-25 17:42 - 000124928 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\luafv.sys
2018-01-25 17:42 - 2018-01-25 17:42 - 000115200 _____ (Microsoft Corporation) C:\WINDOWS\system32\updatepolicy.dll
2018-01-25 17:42 - 2018-01-25 17:42 - 000114688 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\UcmCx.sys
2018-01-25 17:42 - 2018-01-25 17:42 - 000101376 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\msscript.ocx
2018-01-25 17:42 - 2018-01-25 17:42 - 000098304 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\updatepolicy.dll
2018-01-25 17:42 - 2018-01-25 17:42 - 000097144 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\bcrypt.dll
2018-01-25 17:42 - 2018-01-25 17:42 - 000095744 _____ (Microsoft Corporation) C:\WINDOWS\system32\CapabilityAccessManagerClient.dll
2018-01-25 17:42 - 2018-01-25 17:42 - 000092160 _____ (Microsoft Corporation) C:\WINDOWS\system32\usoapi.dll
2018-01-25 17:42 - 2018-01-25 17:42 - 000086016 _____ (Microsoft Corporation) C:\WINDOWS\system32\XblAuthTokenBrokerExt.dll
2018-01-25 17:42 - 2018-01-25 17:42 - 000085504 _____ (Microsoft Corporation) C:\WINDOWS\system32\hascsp.dll
2018-01-25 17:42 - 2018-01-25 17:42 - 000084992 _____ (Microsoft Corporation) C:\WINDOWS\system32\DeviceUpdateAgent.dll
2018-01-25 17:42 - 2018-01-25 17:42 - 000079360 _____ (Microsoft Corporation) C:\WINDOWS\system32\acppage.dll
2018-01-25 17:42 - 2018-01-25 17:42 - 000070656 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\XblAuthTokenBrokerExt.dll
2018-01-25 17:42 - 2018-01-25 17:42 - 000068096 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\acppage.dll
2018-01-25 17:42 - 2018-01-25 17:42 - 000065536 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\usoapi.dll
2018-01-25 17:42 - 2018-01-25 17:42 - 000064512 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\CapabilityAccessManagerClient.dll
2018-01-25 17:42 - 2018-01-25 17:42 - 000060824 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\urscx01000.sys
2018-01-25 17:42 - 2018-01-25 17:42 - 000059392 _____ (Microsoft Corporation) C:\WINDOWS\system32\aadjcsp.dll
2018-01-25 17:42 - 2018-01-25 17:42 - 000058880 _____ (Microsoft Corporation) C:\WINDOWS\system32\TpmTasks.dll
2018-01-25 17:42 - 2018-01-25 17:42 - 000057856 _____ (Microsoft Corporation) C:\WINDOWS\system32\wuautoappupdate.dll
2018-01-25 17:42 - 2018-01-25 17:42 - 000057344 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\UcmUcsi.sys
2018-01-25 17:42 - 2018-01-25 17:42 - 000056320 _____ (Microsoft Corporation) C:\WINDOWS\system32\AcSpecfc.dll
2018-01-25 17:42 - 2018-01-25 17:42 - 000048112 _____ (Microsoft Corporation) C:\WINDOWS\system32\wuauclt.exe
2018-01-25 17:42 - 2018-01-25 17:42 - 000046080 _____ (Microsoft Corporation) C:\WINDOWS\system32\rdrleakdiag.exe
2018-01-25 17:42 - 2018-01-25 17:42 - 000045464 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\storufs.sys
2018-01-25 17:42 - 2018-01-25 17:42 - 000041984 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\rdrleakdiag.exe
2018-01-25 17:42 - 2018-01-25 17:42 - 000041472 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\vwifimp.sys
2018-01-25 17:42 - 2018-01-25 17:42 - 000034816 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\BasicRender.sys
2018-01-25 17:42 - 2018-01-25 17:42 - 000022528 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\msdtcVSp1res.dll
2018-01-25 17:42 - 2018-01-25 17:42 - 000022528 _____ (Microsoft Corporation) C:\WINDOWS\system32\msdtcVSp1res.dll
2018-01-25 17:42 - 2018-01-25 17:42 - 000021504 _____ (Microsoft Corporation) C:\WINDOWS\system32\slcext.dll
2018-01-25 17:42 - 2018-01-25 17:42 - 000019456 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\slcext.dll
2018-01-25 17:42 - 2018-01-25 17:42 - 000008704 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\msjint40.dll
2018-01-25 17:42 - 2018-01-25 17:42 - 000002560 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\tzres.dll
2018-01-25 17:42 - 2018-01-25 17:42 - 000002560 _____ (Microsoft Corporation) C:\WINDOWS\system32\tzres.dll
2018-01-25 17:40 - 2018-01-25 17:40 - 001166520 _____ (Microsoft Corporation) C:\WINDOWS\system32\PresentationNative_v0300.dll
2018-01-25 17:40 - 2018-01-25 17:40 - 000778936 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\PresentationNative_v0300.dll
2018-01-25 17:40 - 2018-01-25 17:40 - 000124624 _____ (Microsoft Corporation) C:\WINDOWS\system32\PresentationCFFRasterizerNative_v0300.dll
2018-01-25 17:40 - 2018-01-25 17:40 - 000103120 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\PresentationCFFRasterizerNative_v0300.dll
2018-01-25 17:40 - 2018-01-25 17:40 - 000035456 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\TsWpfWrp.exe
2018-01-25 17:40 - 2018-01-25 17:40 - 000035456 _____ (Microsoft Corporation) C:\WINDOWS\system32\TsWpfWrp.exe
2018-01-25 17:40 - 2018-01-25 17:40 - 000000000 ____D C:\Program Files\Reference Assemblies
2018-01-25 17:40 - 2018-01-25 17:40 - 000000000 ____D C:\Program Files\MSBuild
2018-01-25 17:40 - 2018-01-25 17:40 - 000000000 ____D C:\Program Files (x86)\Reference Assemblies
2018-01-25 17:40 - 2018-01-25 17:40 - 000000000 ____D C:\Program Files (x86)\MSBuild
2018-01-25 17:40 - 2018-01-25 17:40 - 000000000 ____D C:\inetpub
2018-01-23 22:09 - 2018-01-23 22:09 - 000000000 ____D C:\Program Files\Common Files\Intel
2018-01-23 21:33 - 2018-01-23 21:33 - 072520712 _____ (Realtek Semiconductor Corp.) C:\WINDOWS\system32\RCoRes64.dat
2018-01-23 21:33 - 2018-01-23 21:33 - 013213369 _____ C:\WINDOWS\system32\Drivers\RTAIODAT.DAT
2018-01-23 21:33 - 2018-01-23 21:33 - 005899752 _____ (Realtek Semiconductor Corp.) C:\WINDOWS\system32\Drivers\RTKVHD64.sys
2018-01-23 21:33 - 2018-01-23 21:33 - 003677152 _____ (Realtek Semiconductor Corp.) C:\WINDOWS\system32\RTSnMg64.cpl
2018-01-23 21:33 - 2018-01-23 21:33 - 003517504 _____ (Realtek Semiconductor Corp.) C:\WINDOWS\system32\RltkAPO64.dll
2018-01-23 21:33 - 2018-01-23 21:33 - 003509200 _____ (Realtek Semiconductor Corp.) C:\WINDOWS\system32\RtkApi64.dll
2018-01-23 21:33 - 2018-01-23 21:33 - 003410840 _____ (DTS, Inc.) C:\WINDOWS\system32\slcnt64.dll
2018-01-23 21:33 - 2018-01-23 21:33 - 003205120 _____ (Realtek Semiconductor Corp.) C:\WINDOWS\system32\RtPgEx64.dll
2018-01-23 21:33 - 2018-01-23 21:33 - 003122656 _____ (DTS, Inc.) C:\WINDOWS\system32\sltech64.dll
2018-01-23 21:33 - 2018-01-23 21:33 - 002211304 _____ (Realtek Semiconductor Corp.) C:\WINDOWS\system32\RCoInstII64.dll
2018-01-23 21:33 - 2018-01-23 21:33 - 001616680 _____ (Conexant Systems Inc.) C:\WINDOWS\system32\CX64APO.dll
2018-01-23 21:33 - 2018-01-23 21:33 - 001529136 _____ (Conexant Systems Inc.) C:\WINDOWS\system32\CX64Proxy.dll
2018-01-23 21:33 - 2018-01-23 21:33 - 001435144 _____ (Synopsys, Inc.) C:\WINDOWS\system32\SRRPTR64.dll
2018-01-23 21:33 - 2018-01-23 21:33 - 001348168 _____ (Realtek Semiconductor Corp.) C:\WINDOWS\system32\RTCOM64.dll
2018-01-23 21:33 - 2018-01-23 21:33 - 001016928 _____ (Sound Research, Corp.) C:\WINDOWS\system32\SEHDHF64.dll
2018-01-23 21:33 - 2018-01-23 21:33 - 000984912 _____ (DTS, Inc.) C:\WINDOWS\system32\sl3apo64.dll
2018-01-23 21:33 - 2018-01-23 21:33 - 000877432 _____ (Sound Research, Corp.) C:\WINDOWS\SysWOW64\SEHDHF32.dll
2018-01-23 21:33 - 2018-01-23 21:33 - 000868176 _____ (Sound Research, Corp.) C:\WINDOWS\system32\SECOMN64.dll
2018-01-23 21:33 - 2018-01-23 21:33 - 000866640 _____ (Sound Research, Corp.) C:\WINDOWS\system32\SEHDRA64.dll
2018-01-23 21:33 - 2018-01-23 21:33 - 000737968 _____ (Sound Research, Corp.) C:\WINDOWS\SysWOW64\SECOMN32.dll
2018-01-23 21:33 - 2018-01-23 21:33 - 000691680 _____ (Realtek Semiconductor Corp.) C:\WINDOWS\system32\RtDataProc64.dll
2018-01-23 21:33 - 2018-01-23 21:33 - 000609392 _____ (Conexant Systems, Inc.) C:\WINDOWS\system32\CAF64APO2.dll
2018-01-23 21:33 - 2018-01-23 21:33 - 000532376 _____ (SRS Labs, Inc.) C:\WINDOWS\system32\SRSTSX64.dll
2018-01-23 21:33 - 2018-01-23 21:33 - 000526280 _____ (Sound Research, Corp.) C:\WINDOWS\system32\SEAPO64.dll
2018-01-23 21:33 - 2018-01-23 21:33 - 000467152 _____ (Synopsys, Inc.) C:\WINDOWS\system32\SRAPO64.dll
2018-01-23 21:33 - 2018-01-23 21:33 - 000387312 _____ (Dolby Laboratories, Inc.) C:\WINDOWS\system32\RTEEP64A.dll
2018-01-23 21:33 - 2018-01-23 21:33 - 000381408 _____ (Synopsys, Inc.) C:\WINDOWS\system32\SRCOM64.dll
2018-01-23 21:33 - 2018-01-23 21:33 - 000343704 _____ (Realtek Semiconductor Corp.) C:\WINDOWS\system32\RtlCPAPI64.dll
2018-01-23 21:33 - 2018-01-23 21:33 - 000341152 _____ (Synopsys, Inc.) C:\WINDOWS\SysWOW64\SRCOM.dll
2018-01-23 21:33 - 2018-01-23 21:33 - 000341152 _____ (Synopsys, Inc.) C:\WINDOWS\system32\SRCOM.dll
2018-01-23 21:33 - 2018-01-23 21:33 - 000321712 _____ (Dolby Laboratories, Inc.) C:\WINDOWS\system32\RP3DHT64.dll
2018-01-23 21:33 - 2018-01-23 21:33 - 000321712 _____ (Dolby Laboratories, Inc.) C:\WINDOWS\system32\RP3DAA64.dll
2018-01-23 21:33 - 2018-01-23 21:33 - 000258856 _____ (TODO: ) C:\WINDOWS\system32\slprp64.dll
2018-01-23 21:33 - 2018-01-23 21:33 - 000214824 _____ (Dolby Laboratories, Inc.) C:\WINDOWS\system32\RTEED64A.dll
2018-01-23 21:33 - 2018-01-23 21:33 - 000192976 _____ (Realtek Semiconductor Corp.) C:\WINDOWS\system32\RtkCfg64.dll
2018-01-23 21:33 - 2018-01-23 21:33 - 000166200 _____ (SRS Labs, Inc.) C:\WINDOWS\system32\SRSWOW64.dll
2018-01-23 21:33 - 2018-01-23 21:33 - 000122312 _____ (Real Sound Lab SIA) C:\WINDOWS\system32\CONEQMSAPOGUILibrary.dll
2018-01-23 21:33 - 2018-01-23 21:33 - 000115120 _____ (Conexant System, Inc.) C:\WINDOWS\system32\Caf64api.dll
2018-01-23 21:33 - 2018-01-23 21:33 - 000110984 _____ (Dolby Laboratories, Inc.) C:\WINDOWS\system32\RTEEL64A.dll
2018-01-23 21:33 - 2018-01-23 21:33 - 000088344 _____ (Dolby Laboratories, Inc.) C:\WINDOWS\system32\RTEEG64A.dll
2018-01-23 21:33 - 2018-01-23 21:33 - 000023688 _____ (Realtek Semiconductor Corp.) C:\WINDOWS\system32\RtkCoLDR64.dll
2018-01-23 21:33 - 2018-01-23 21:33 - 000005604 _____ C:\WINDOWS\system32\cxapo.lncs
2018-01-23 21:33 - 2018-01-23 21:33 - 000000864 _____ C:\WINDOWS\system32\cxapo.prop
2018-01-23 19:42 - 2018-01-27 19:05 - 000000000 ___DC C:\WINDOWS\Panther
2018-01-23 19:17 - 2018-01-23 19:17 - 000000000 ____D C:\Program Files (x86)\VulkanRT
2018-01-23 19:17 - 2017-07-20 17:21 - 000905504 _____ C:\WINDOWS\system32\vulkan-1.dll
2018-01-23 19:17 - 2017-07-20 17:21 - 000776992 _____ C:\WINDOWS\SysWOW64\vulkan-1.dll
2018-01-23 19:17 - 2017-07-20 17:21 - 000578848 _____ C:\WINDOWS\system32\vulkaninfo.exe
2018-01-23 19:17 - 2017-07-20 17:21 - 000477472 _____ C:\WINDOWS\SysWOW64\vulkaninfo.exe
2018-01-23 19:16 - 2018-01-23 19:16 - 000831008 _____ (Intel(R) Corporation) C:\WINDOWS\system32\Drivers\IntcDAud.sys
2018-01-23 19:16 - 2018-01-23 19:16 - 000756652 _____ C:\WINDOWS\system32\cp_resources.bin
2018-01-23 19:16 - 2018-01-23 19:16 - 000276984 _____ C:\WINDOWS\system32\igfxCPL.cpl
2018-01-23 19:16 - 2018-01-23 19:16 - 000140280 _____ (Khronos Group) C:\WINDOWS\system32\Intel_OpenCL_ICD64.dll
2018-01-23 19:16 - 2018-01-23 19:16 - 000116728 _____ (Khronos Group) C:\WINDOWS\SysWOW64\Intel_OpenCL_ICD32.dll
2018-01-23 18:47 - 2018-01-23 18:47 - 000382392 _____ (Intel Corporation) C:\WINDOWS\system32\Drivers\esif_lf.sys
2018-01-23 18:47 - 2018-01-23 18:47 - 000069560 _____ (Intel Corporation) C:\WINDOWS\system32\Drivers\dptf_cpu.sys
2018-01-16 16:23 - 2018-01-16 16:23 - 011205832 _____ (Piriform Ltd) C:\Users\desen\Downloads\ccsetup539.exe
2018-01-15 12:12 - 2018-01-15 12:12 - 000658929 _____ C:\Users\desen\Downloads\Registration Pack.pdf
2018-01-14 15:18 - 2018-01-15 14:12 - 000000000 ___RD C:\Users\desen\OneDrive\Documents\Scanned Documents
2018-01-14 15:18 - 2018-01-14 15:18 - 000000000 ____D C:\Users\desen\OneDrive\Documents\Fax
2018-01-14 11:16 - 2018-01-14 11:16 - 000002501 _____ C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Skype for Business 2016.lnk
2018-01-14 11:10 - 2018-01-14 11:11 - 004467992 _____ (Microsoft Corporation) C:\Users\desen\Downloads\Setup.x86.en-US_ProPlusRetail_VMWQ4-7NTWQ-YQ24C-TPVM7-RGDVC_TX_PR_.exe
2018-01-13 11:49 - 2018-01-13 11:49 - 000000031 _____ C:\WINDOWS\script.txt
2018-01-13 11:45 - 2018-01-13 11:45 - 000000000 ____D C:\Temp
2018-01-13 11:43 - 2018-01-25 17:44 - 000000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Samsung
2018-01-13 11:40 - 2018-01-13 11:40 - 039163904 _____ (Samsung) C:\Users\desen\Downloads\Samsung_Data_Migration_Setup.exe
2018-01-13 11:37 - 2018-01-25 17:46 - 000000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Samsung Magician
2018-01-13 11:36 - 2018-01-13 11:43 - 000000000 ____D C:\Program Files (x86)\Samsung
2018-01-13 11:36 - 2018-01-13 11:36 - 000000000 ____D C:\ProgramData\Samsung
2018-01-13 11:35 - 2018-01-13 11:35 - 014608752 _____ (Samsung Electronics ) C:\Users\desen\Downloads\Samsung_Magician_Installer.exe
2018-01-13 10:44 - 2018-01-13 10:44 - 000000000 ____D C:\Users\desen\AppData\Roaming\HP Active Health
2018-01-12 10:50 - 2018-01-12 10:50 - 000007601 _____ C:\Users\desen\AppData\Local\Resmon.ResmonCfg
2018-01-12 10:41 - 2018-01-19 17:31 - 000000000 ____D C:\Program Files\rempl
2018-01-11 07:51 - 2018-01-11 07:51 - 000000000 ____D C:\Users\Default\AppData\Roaming\Mozilla
2018-01-11 07:51 - 2018-01-11 07:51 - 000000000 ____D C:\Users\Default User\AppData\Roaming\Mozilla
2018-01-11 07:50 - 2018-01-11 07:50 - 000000000 ____D C:\Users\Default\AppData\Local\Trusteer
2018-01-11 07:50 - 2018-01-11 07:50 - 000000000 ____D C:\Users\Default User\AppData\Local\Trusteer
2018-01-08 16:20 - 2018-01-08 16:22 - 000000000 ____D C:\Users\desen\AppData\Local\Adobe
2018-01-04 16:35 - 2018-01-04 16:35 - 000231760 _____ C:\Users\desen\Downloads\CrucialUKScan.exe
2018-01-04 11:08 - 2018-01-27 17:35 - 000000000 ___RD C:\Users\desen\3D Objects
2018-01-03 19:22 - 2018-01-03 19:22 - 000000000 _____ C:\WINDOWS\system32\Drivers\Msft_User_WpdMtpDr_01_11_00.Wdf
2018-01-02 14:08 - 2018-01-02 14:08 - 000000000 ____D C:\Users\desen\AppData\Roaming\Skype
2018-01-02 14:05 - 2018-01-02 14:05 - 012034048 _____ C:\Users\desen\Downloads\SkypeMeetingsApp.msi
2018-01-02 13:57 - 2018-01-02 13:58 - 000297522 _____ C:\Users\desen\Downloads\Candidate Details Form version 1.8.pdf
2018-01-01 15:09 - 2018-01-01 15:04 - 001009128 _____ (Realtek ) C:\WINDOWS\system32\Drivers\rt640x64.sys

==================== One Month Modified files and folders ========

(If an entry is included in the fixlist, the file/folder will be moved.)

2018-01-28 10:19 - 2017-12-24 16:41 - 000000000 ____D C:\Users\desen\AppData\LocalLow\Mozilla
2018-01-28 10:19 - 2017-12-24 15:20 - 000000000 __SHD C:\Users\desen\IntelGraphicsProfiles
2018-01-28 10:18 - 2017-12-24 19:38 - 000253880 _____ (Malwarebytes) C:\WINDOWS\system32\Drivers\mbamswissarmy.sys
2018-01-28 10:18 - 2017-12-24 19:38 - 000110016 _____ (Malwarebytes) C:\WINDOWS\system32\Drivers\farflt.sys
2018-01-28 10:18 - 2017-12-24 19:38 - 000094144 _____ (Malwarebytes) C:\WINDOWS\system32\Drivers\mwac.sys
2018-01-28 10:18 - 2017-12-24 19:38 - 000046008 _____ (Malwarebytes) C:\WINDOWS\system32\Drivers\mbam.sys
2018-01-28 10:14 - 2017-09-29 13:46 - 000000000 ____D C:\WINDOWS\AppReadiness
2018-01-28 10:08 - 2017-09-29 13:46 - 000000000 ____D C:\WINDOWS\DeliveryOptimization
2018-01-28 10:07 - 2017-09-29 13:46 - 000000000 ___HD C:\Program Files\WindowsApps
2018-01-27 19:05 - 2017-09-29 13:44 - 000000000 ____D C:\WINDOWS\INF
2018-01-27 17:35 - 2017-03-18 03:53 - 000000000 __RHD C:\Users\Public\AccountPictures
2018-01-27 17:34 - 2017-09-29 08:45 - 000524288 _____ C:\WINDOWS\system32\config\BBI
2018-01-27 17:33 - 2017-09-29 13:46 - 000000000 ___SD C:\WINDOWS\SysWOW64\F12
2018-01-27 17:33 - 2017-09-29 13:46 - 000000000 ___SD C:\WINDOWS\system32\F12
2018-01-27 17:33 - 2017-09-29 13:46 - 000000000 ____D C:\WINDOWS\TextInput
2018-01-27 17:33 - 2017-09-29 13:46 - 000000000 ____D C:\WINDOWS\SysWOW64\Dism
2018-01-27 17:33 - 2017-09-29 13:46 - 000000000 ____D C:\WINDOWS\system32\oobe
2018-01-27 17:33 - 2017-09-29 13:46 - 000000000 ____D C:\WINDOWS\system32\migwiz
2018-01-27 17:33 - 2017-09-29 13:46 - 000000000 ____D C:\WINDOWS\system32\appraiser
2018-01-27 17:33 - 2017-09-29 13:46 - 000000000 ____D C:\WINDOWS\Provisioning
2018-01-27 17:33 - 2017-09-29 08:45 - 000000000 ____D C:\WINDOWS\system32\Dism
2018-01-27 16:39 - 2017-09-29 13:46 - 000000000 ____D C:\WINDOWS\LiveKernelReports
2018-01-27 16:35 - 2017-12-24 15:25 - 000000000 ___RD C:\Users\desen\OneDrive
2018-01-26 18:44 - 2017-09-29 13:37 - 000000000 ____D C:\WINDOWS\CbsTemp
2018-01-25 18:13 - 2017-09-29 13:46 - 000000000 ___RD C:\WINDOWS\PrintDialog
2018-01-25 17:59 - 2017-12-24 15:21 - 000000000 ____D C:\Users\desen\AppData\Local\PackageStaging
2018-01-25 17:57 - 2017-12-24 15:16 - 000000000 ____D C:\Users\desen\AppData\Local\TileDataLayer
2018-01-25 17:55 - 2017-09-29 13:46 - 000000000 ____D C:\ProgramData\USOPrivate
2018-01-25 17:55 - 2017-09-29 08:45 - 000032768 _____ C:\WINDOWS\system32\config\ELAM
2018-01-25 17:54 - 2017-12-24 18:15 - 000002275 _____ C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Google Chrome.lnk
2018-01-25 17:54 - 2017-09-29 13:46 - 000000000 ____D C:\WINDOWS\Registration
2018-01-25 17:53 - 2017-09-29 13:46 - 000000000 __RHD C:\Users\Public\Libraries
2018-01-25 17:50 - 2017-09-29 13:46 - 000000000 ___RD C:\WINDOWS\ImmersiveControlPanel
2018-01-25 17:50 - 2017-04-01 05:38 - 000936124 _____ C:\WINDOWS\SysWOW64\PerfStringBackup.INI
2018-01-25 17:49 - 2017-09-29 08:45 - 000000000 ____D C:\WINDOWS\system32\Sysprep
2018-01-25 17:49 - 2017-09-14 16:57 - 000000000 _____ C:\WINDOWS\system32\GfxValDisplayLog.bin
2018-01-25 17:49 - 2017-09-14 16:54 - 001944091 _____ C:\WINDOWS\system32\Drivers\rtkhdasetting.zip
2018-01-25 17:49 - 2017-09-14 16:54 - 000000000 ____D C:\WINDOWS\SysWOW64\RTCOM
2018-01-25 17:48 - 2017-09-29 13:46 - 000028672 _____ C:\WINDOWS\system32\config\BCD-Template
2018-01-25 17:46 - 2017-12-25 19:38 - 000000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Trusteer Endpoint Protection
2018-01-25 17:46 - 2017-12-24 19:52 - 000000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\CCleaner
2018-01-25 17:46 - 2017-12-24 19:37 - 000000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Malwarebytes
2018-01-25 17:46 - 2017-09-29 13:49 - 000000000 ____D C:\WINDOWS\Setup
2018-01-25 17:46 - 2017-09-29 13:46 - 000000000 ____D C:\WINDOWS\system32\WinBioDatabase
2018-01-25 17:46 - 2017-09-29 13:46 - 000000000 ____D C:\WINDOWS\system32\spool
2018-01-25 17:46 - 2017-09-29 13:46 - 000000000 ____D C:\WINDOWS\system32\NDF
2018-01-25 17:46 - 2017-09-29 13:46 - 000000000 ____D C:\ProgramData\regid.1991-06.com.microsoft
2018-01-25 17:46 - 2017-09-29 13:46 - 000000000 ____D C:\Program Files\Common Files\microsoft shared
2018-01-25 17:46 - 2017-09-14 17:16 - 000000000 ____D C:\WINDOWS\SysWOW64\WildTangent
2018-01-25 17:46 - 2017-09-14 17:06 - 000000000 ___RD C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Games
2018-01-25 17:46 - 2017-09-14 16:59 - 000000000 ___HD C:\WINDOWS\system32\WLANProfiles
2018-01-25 17:46 - 2017-09-14 16:59 - 000000000 ____D C:\WINDOWS\SysWOW64\sda
2018-01-25 17:46 - 2017-09-14 16:55 - 000000000 ____D C:\Program Files\Intel
2018-01-25 17:46 - 2017-06-30 07:57 - 000000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Microsoft Office 2016 Tools
2018-01-25 17:46 - 2017-06-30 07:54 - 000000000 ___RD C:\ProgramData\Microsoft\Windows\Start Menu\Programs\HP Help and Support
2018-01-25 17:46 - 2017-06-30 07:53 - 000000000 ____D C:\Program Files (x86)\HP
2018-01-25 17:46 - 2017-03-18 21:03 - 000000000 ____D C:\WINDOWS\system32\Tasks_Migrated
2018-01-25 17:45 - 2017-09-14 16:55 - 000000000 ____D C:\WINDOWS\system32\Intel
2018-01-25 17:45 - 2017-09-14 16:54 - 000000000 ____D C:\WINDOWS\system32\SRSLabs
2018-01-25 17:44 - 2017-09-29 13:46 - 000000000 ____D C:\WINDOWS\appcompat
2018-01-25 17:44 - 2017-09-14 17:00 - 000000000 ____D C:\Program Files\Synaptics
2018-01-25 17:44 - 2017-09-14 16:54 - 000000000 ____D C:\Program Files\Realtek
2018-01-25 17:43 - 2017-09-30 14:36 - 000000000 ____D C:\WINDOWS\SysWOW64\zu-ZA
2018-01-25 17:43 - 2017-09-30 14:36 - 000000000 ____D C:\WINDOWS\SysWOW64\yo-NG
2018-01-25 17:43 - 2017-09-30 14:36 - 000000000 ____D C:\WINDOWS\SysWOW64\xh-ZA
2018-01-25 17:43 - 2017-09-30 14:36 - 000000000 ____D C:\WINDOWS\SysWOW64\wo-SN
2018-01-25 17:43 - 2017-09-30 14:36 - 000000000 ____D C:\WINDOWS\SysWOW64\vi-VN
2018-01-25 17:43 - 2017-09-30 14:36 - 000000000 ____D C:\WINDOWS\SysWOW64\uz-Latn-UZ
2018-01-25 17:43 - 2017-09-30 14:36 - 000000000 ____D C:\WINDOWS\SysWOW64\ur-PK
2018-01-25 17:43 - 2017-09-30 14:36 - 000000000 ____D C:\WINDOWS\SysWOW64\ug-CN
2018-01-25 17:43 - 2017-09-30 14:36 - 000000000 ____D C:\WINDOWS\SysWOW64\tt-RU
2018-01-25 17:43 - 2017-09-30 14:36 - 000000000 ____D C:\WINDOWS\SysWOW64\tn-ZA
2018-01-25 17:43 - 2017-09-30 14:36 - 000000000 ____D C:\WINDOWS\SysWOW64\tk-TM
2018-01-25 17:43 - 2017-09-30 14:36 - 000000000 ____D C:\WINDOWS\SysWOW64\ti-ET
2018-01-25 17:43 - 2017-09-30 14:36 - 000000000 ____D C:\WINDOWS\SysWOW64\tg-Cyrl-TJ
2018-01-25 17:43 - 2017-09-30 14:36 - 000000000 ____D C:\WINDOWS\SysWOW64\te-IN
2018-01-25 17:43 - 2017-09-30 14:36 - 000000000 ____D C:\WINDOWS\SysWOW64\ta-IN
2018-01-25 17:43 - 2017-09-30 14:36 - 000000000 ____D C:\WINDOWS\SysWOW64\sw-KE
2018-01-25 17:43 - 2017-09-30 14:36 - 000000000 ____D C:\WINDOWS\SysWOW64\sr-Cyrl-RS
2018-01-25 17:43 - 2017-09-30 14:36 - 000000000 ____D C:\WINDOWS\SysWOW64\sr-Cyrl-BA
2018-01-25 17:43 - 2017-09-30 14:36 - 000000000 ____D C:\WINDOWS\SysWOW64\sq-AL
2018-01-25 17:43 - 2017-09-30 14:36 - 000000000 ____D C:\WINDOWS\SysWOW64\si-LK
2018-01-25 17:43 - 2017-09-30 14:36 - 000000000 ____D C:\WINDOWS\SysWOW64\sd-Arab-PK
2018-01-25 17:43 - 2017-09-30 14:36 - 000000000 ____D C:\WINDOWS\SysWOW64\rw-RW
2018-01-25 17:43 - 2017-09-30 14:36 - 000000000 ____D C:\WINDOWS\SysWOW64\quz-PE
2018-01-25 17:43 - 2017-09-30 14:36 - 000000000 ____D C:\WINDOWS\SysWOW64\quc-Latn-GT
2018-01-25 17:43 - 2017-09-30 14:36 - 000000000 ____D C:\WINDOWS\SysWOW64\prs-AF
2018-01-25 17:43 - 2017-09-30 14:36 - 000000000 ____D C:\WINDOWS\SysWOW64\pa-IN
2018-01-25 17:43 - 2017-09-30 14:36 - 000000000 ____D C:\WINDOWS\SysWOW64\pa-Arab-PK
2018-01-25 17:43 - 2017-09-30 14:36 - 000000000 ____D C:\WINDOWS\SysWOW64\or-IN
2018-01-25 17:43 - 2017-09-30 14:36 - 000000000 ____D C:\WINDOWS\SysWOW64\nso-ZA
2018-01-25 17:43 - 2017-09-30 14:36 - 000000000 ____D C:\WINDOWS\SysWOW64\nn-NO
2018-01-25 17:43 - 2017-09-30 14:36 - 000000000 ____D C:\WINDOWS\SysWOW64\ne-NP
2018-01-25 17:43 - 2017-09-30 14:36 - 000000000 ____D C:\WINDOWS\SysWOW64\mt-MT
2018-01-25 17:43 - 2017-09-30 14:36 - 000000000 ____D C:\WINDOWS\SysWOW64\mr-IN
2018-01-25 17:43 - 2017-09-30 14:36 - 000000000 ____D C:\WINDOWS\SysWOW64\mn-MN
2018-01-25 17:43 - 2017-09-30 14:36 - 000000000 ____D C:\WINDOWS\SysWOW64\ml-IN
2018-01-25 17:43 - 2017-09-30 14:36 - 000000000 ____D C:\WINDOWS\SysWOW64\mk-MK
2018-01-25 17:43 - 2017-09-30 14:36 - 000000000 ____D C:\WINDOWS\SysWOW64\mi-NZ
2018-01-25 17:43 - 2017-09-30 14:36 - 000000000 ____D C:\WINDOWS\SysWOW64\lo-LA
2018-01-25 17:43 - 2017-09-30 14:36 - 000000000 ____D C:\WINDOWS\SysWOW64\lb-LU
2018-01-25 17:43 - 2017-09-30 14:36 - 000000000 ____D C:\WINDOWS\SysWOW64\ky-KG
2018-01-25 17:43 - 2017-09-30 14:36 - 000000000 ____D C:\WINDOWS\SysWOW64\ku-Arab-IQ
2018-01-25 17:43 - 2017-09-30 14:36 - 000000000 ____D C:\WINDOWS\SysWOW64\kok-IN
2018-01-25 17:43 - 2017-09-30 14:36 - 000000000 ____D C:\WINDOWS\SysWOW64\kn-IN
2018-01-25 17:43 - 2017-09-30 14:36 - 000000000 ____D C:\WINDOWS\SysWOW64\km-KH
2018-01-25 17:43 - 2017-09-30 14:36 - 000000000 ____D C:\WINDOWS\SysWOW64\kk-KZ
2018-01-25 17:43 - 2017-09-30 14:36 - 000000000 ____D C:\WINDOWS\SysWOW64\ka-GE
2018-01-25 17:43 - 2017-09-30 14:36 - 000000000 ____D C:\WINDOWS\SysWOW64\is-IS
2018-01-25 17:43 - 2017-09-30 14:36 - 000000000 ____D C:\WINDOWS\SysWOW64\ig-NG
2018-01-25 17:43 - 2017-09-30 14:36 - 000000000 ____D C:\WINDOWS\SysWOW64\id-ID
2018-01-25 17:43 - 2017-09-30 14:36 - 000000000 ____D C:\WINDOWS\SysWOW64\hy-AM
2018-01-25 17:43 - 2017-09-30 14:36 - 000000000 ____D C:\WINDOWS\SysWOW64\ha-Latn-NG
2018-01-25 17:43 - 2017-09-30 14:36 - 000000000 ____D C:\WINDOWS\SysWOW64\gu-IN
2018-01-25 17:43 - 2017-09-30 14:36 - 000000000 ____D C:\WINDOWS\SysWOW64\gd-GB
2018-01-25 17:43 - 2017-09-30 14:36 - 000000000 ____D C:\WINDOWS\SysWOW64\ga-IE
2018-01-25 17:43 - 2017-09-30 14:36 - 000000000 ____D C:\WINDOWS\SysWOW64\fil-PH
2018-01-25 17:43 - 2017-09-30 14:36 - 000000000 ____D C:\WINDOWS\SysWOW64\fa-IR
2018-01-25 17:43 - 2017-09-30 14:36 - 000000000 ____D C:\WINDOWS\SysWOW64\cy-GB
2018-01-25 17:43 - 2017-09-30 14:36 - 000000000 ____D C:\WINDOWS\SysWOW64\chr-CHER-US
2018-01-25 17:43 - 2017-09-30 14:36 - 000000000 ____D C:\WINDOWS\SysWOW64\ca-ES-valencia
2018-01-25 17:43 - 2017-09-30 14:36 - 000000000 ____D C:\WINDOWS\SysWOW64\bs-Latn-BA
2018-01-25 17:43 - 2017-09-30 14:36 - 000000000 ____D C:\WINDOWS\SysWOW64\bn-IN
2018-01-25 17:43 - 2017-09-30 14:36 - 000000000 ____D C:\WINDOWS\SysWOW64\bn-BD
2018-01-25 17:43 - 2017-09-30 14:36 - 000000000 ____D C:\WINDOWS\SysWOW64\be-BY
2018-01-25 17:43 - 2017-09-30 14:36 - 000000000 ____D C:\WINDOWS\SysWOW64\az-Latn-AZ
2018-01-25 17:43 - 2017-09-30 14:36 - 000000000 ____D C:\WINDOWS\SysWOW64\as-IN
2018-01-25 17:43 - 2017-09-30 14:36 - 000000000 ____D C:\WINDOWS\SysWOW64\am-ET
2018-01-25 17:43 - 2017-09-30 14:36 - 000000000 ____D C:\WINDOWS\SysWOW64\af-ZA
2018-01-25 17:43 - 2017-09-30 14:36 - 000000000 ____D C:\WINDOWS\system32\zu-ZA
2018-01-25 17:43 - 2017-09-30 14:36 - 000000000 ____D C:\WINDOWS\system32\yo-NG
2018-01-25 17:43 - 2017-09-30 14:36 - 000000000 ____D C:\WINDOWS\system32\xh-ZA
2018-01-25 17:43 - 2017-09-30 14:36 - 000000000 ____D C:\WINDOWS\system32\wo-SN
2018-01-25 17:43 - 2017-09-30 14:36 - 000000000 ____D C:\WINDOWS\system32\vi-VN
2018-01-25 17:43 - 2017-09-30 14:36 - 000000000 ____D C:\WINDOWS\system32\uz-Latn-UZ
2018-01-25 17:43 - 2017-09-30 14:36 - 000000000 ____D C:\WINDOWS\system32\ur-PK
2018-01-25 17:43 - 2017-09-30 14:36 - 000000000 ____D C:\WINDOWS\system32\ug-CN
2018-01-25 17:43 - 2017-09-30 14:36 - 000000000 ____D C:\WINDOWS\system32\tt-RU
2018-01-25 17:43 - 2017-09-30 14:36 - 000000000 ____D C:\WINDOWS\system32\tn-ZA
2018-01-25 17:43 - 2017-09-30 14:36 - 000000000 ____D C:\WINDOWS\system32\tk-TM
2018-01-25 17:43 - 2017-09-30 14:36 - 000000000 ____D C:\WINDOWS\system32\ti-ET
2018-01-25 17:43 - 2017-09-30 14:36 - 000000000 ____D C:\WINDOWS\system32\tg-Cyrl-TJ
2018-01-25 17:43 - 2017-09-30 14:36 - 000000000 ____D C:\WINDOWS\system32\te-IN
2018-01-25 17:43 - 2017-09-30 14:36 - 000000000 ____D C:\WINDOWS\system32\ta-IN
2018-01-25 17:43 - 2017-09-30 14:36 - 000000000 ____D C:\WINDOWS\system32\sw-KE
2018-01-25 17:43 - 2017-09-30 14:36 - 000000000 ____D C:\WINDOWS\system32\sr-Cyrl-RS
2018-01-25 17:43 - 2017-09-30 14:36 - 000000000 ____D C:\WINDOWS\system32\sr-Cyrl-BA
2018-01-25 17:43 - 2017-09-30 14:36 - 000000000 ____D C:\WINDOWS\system32\sq-AL
2018-01-25 17:43 - 2017-09-30 14:36 - 000000000 ____D C:\WINDOWS\system32\si-LK
2018-01-25 17:43 - 2017-09-30 14:36 - 000000000 ____D C:\WINDOWS\system32\sd-Arab-PK
2018-01-25 17:43 - 2017-09-30 14:36 - 000000000 ____D C:\WINDOWS\system32\rw-RW
2018-01-25 17:43 - 2017-09-30 14:36 - 000000000 ____D C:\WINDOWS\system32\quz-PE
2018-01-25 17:43 - 2017-09-30 14:36 - 000000000 ____D C:\WINDOWS\system32\quc-Latn-GT
2018-01-25 17:43 - 2017-09-30 14:36 - 000000000 ____D C:\WINDOWS\system32\prs-AF
2018-01-25 17:43 - 2017-09-30 14:36 - 000000000 ____D C:\WINDOWS\system32\pa-IN
2018-01-25 17:43 - 2017-09-30 14:36 - 000000000 ____D C:\WINDOWS\system32\pa-Arab-PK
2018-01-25 17:43 - 2017-09-30 14:36 - 000000000 ____D C:\WINDOWS\system32\or-IN
2018-01-25 17:43 - 2017-09-30 14:36 - 000000000 ____D C:\WINDOWS\system32\nso-ZA
2018-01-25 17:43 - 2017-09-30 14:36 - 000000000 ____D C:\WINDOWS\system32\nn-NO
2018-01-25 17:43 - 2017-09-30 14:36 - 000000000 ____D C:\WINDOWS\system32\ne-NP
2018-01-25 17:43 - 2017-09-30 14:36 - 000000000 ____D C:\WINDOWS\system32\mt-MT
2018-01-25 17:43 - 2017-09-30 14:36 - 000000000 ____D C:\WINDOWS\system32\mr-IN
2018-01-25 17:43 - 2017-09-30 14:36 - 000000000 ____D C:\WINDOWS\system32\mn-MN
2018-01-25 17:43 - 2017-09-30 14:36 - 000000000 ____D C:\WINDOWS\system32\ml-IN
2018-01-25 17:43 - 2017-09-30 14:36 - 000000000 ____D C:\WINDOWS\system32\mk-MK
2018-01-25 17:43 - 2017-09-30 14:36 - 000000000 ____D C:\WINDOWS\system32\mi-NZ
2018-01-25 17:43 - 2017-09-30 14:36 - 000000000 ____D C:\WINDOWS\system32\lo-LA
2018-01-25 17:43 - 2017-09-30 14:36 - 000000000 ____D C:\WINDOWS\system32\lb-LU
2018-01-25 17:43 - 2017-09-30 14:36 - 000000000 ____D C:\WINDOWS\system32\ky-KG
2018-01-25 17:43 - 2017-09-30 14:36 - 000000000 ____D C:\WINDOWS\system32\ku-Arab-IQ
2018-01-25 17:43 - 2017-09-30 14:36 - 000000000 ____D C:\WINDOWS\system32\kok-IN
2018-01-25 17:43 - 2017-09-30 14:36 - 000000000 ____D C:\WINDOWS\system32\kn-IN
2018-01-25 17:43 - 2017-09-30 14:36 - 000000000 ____D C:\WINDOWS\system32\km-KH
2018-01-25 17:43 - 2017-09-30 14:36 - 000000000 ____D C:\WINDOWS\system32\kk-KZ
2018-01-25 17:43 - 2017-09-30 14:36 - 000000000 ____D C:\WINDOWS\system32\ka-GE
2018-01-25 17:43 - 2017-09-30 14:36 - 000000000 ____D C:\WINDOWS\system32\is-IS
2018-01-25 17:43 - 2017-09-30 14:36 - 000000000 ____D C:\WINDOWS\system32\ig-NG
2018-01-25 17:43 - 2017-09-30 14:36 - 000000000 ____D C:\WINDOWS\system32\id-ID
2018-01-25 17:43 - 2017-09-30 14:36 - 000000000 ____D C:\WINDOWS\system32\hy-AM
2018-01-25 17:43 - 2017-09-30 14:36 - 000000000 ____D C:\WINDOWS\system32\ha-Latn-NG
2018-01-25 17:43 - 2017-09-30 14:36 - 000000000 ____D C:\WINDOWS\system32\gu-IN
2018-01-25 17:43 - 2017-09-30 14:36 - 000000000 ____D C:\WINDOWS\system32\gd-GB
2018-01-25 17:43 - 2017-09-30 14:36 - 000000000 ____D C:\WINDOWS\system32\ga-IE
2018-01-25 17:43 - 2017-09-30 14:36 - 000000000 ____D C:\WINDOWS\system32\fil-PH
2018-01-25 17:43 - 2017-09-30 14:36 - 000000000 ____D C:\WINDOWS\system32\fa-IR
2018-01-25 17:43 - 2017-09-30 14:36 - 000000000 ____D C:\WINDOWS\system32\cy-GB
2018-01-25 17:43 - 2017-09-30 14:36 - 000000000 ____D C:\WINDOWS\system32\chr-CHER-US
2018-01-25 17:43 - 2017-09-30 14:36 - 000000000 ____D C:\WINDOWS\system32\ca-ES-valencia
2018-01-25 17:43 - 2017-09-30 14:36 - 000000000 ____D C:\WINDOWS\system32\bs-Latn-BA
2018-01-25 17:43 - 2017-09-30 14:36 - 000000000 ____D C:\WINDOWS\system32\bn-IN
2018-01-25 17:43 - 2017-09-30 14:36 - 000000000 ____D C:\WINDOWS\system32\bn-BD
2018-01-25 17:43 - 2017-09-30 14:36 - 000000000 ____D C:\WINDOWS\system32\be-BY
2018-01-25 17:43 - 2017-09-30 14:36 - 000000000 ____D C:\WINDOWS\system32\az-Latn-AZ
2018-01-25 17:43 - 2017-09-30 14:36 - 000000000 ____D C:\WINDOWS\system32\as-IN
2018-01-25 17:43 - 2017-09-30 14:36 - 000000000 ____D C:\WINDOWS\system32\am-ET
2018-01-25 17:43 - 2017-09-30 14:36 - 000000000 ____D C:\WINDOWS\system32\af-ZA
2018-01-25 17:43 - 2017-09-29 13:46 - 000000000 ____D C:\WINDOWS\SysWOW64\WinMetadata
2018-01-25 17:43 - 2017-09-29 13:46 - 000000000 ____D C:\WINDOWS\system32\WinMetadata
2018-01-25 17:43 - 2017-09-29 13:46 - 000000000 ____D C:\WINDOWS\system32\WinBioPlugIns
2018-01-25 17:43 - 2017-09-29 13:46 - 000000000 ____D C:\WINDOWS\system32\en-GB
2018-01-25 17:43 - 2017-09-29 13:46 - 000000000 ____D C:\WINDOWS\ShellExperiences
2018-01-25 17:43 - 2017-09-29 13:46 - 000000000 ____D C:\Program Files\Windows Defender
2018-01-25 17:43 - 2017-09-29 13:46 - 000000000 ____D C:\PerfLogs
2018-01-25 17:40 - 2017-09-30 14:36 - 000000000 ____D C:\WINDOWS\OCR
2018-01-25 17:40 - 2017-09-29 13:46 - 000000000 ____D C:\WINDOWS\SysWOW64\inetsrv
2018-01-25 17:40 - 2017-09-29 13:46 - 000000000 ____D C:\WINDOWS\system32\inetsrv
2018-01-24 18:01 - 2017-09-14 17:03 - 000019706 _____ C:\WINDOWS\system32\results.xml
2018-01-24 18:00 - 2017-12-25 10:35 - 000000364 _____ C:\WINDOWS\Tasks\HPCeeScheduleFordesen.job
2018-01-23 22:48 - 2017-06-30 16:30 - 000000000 ____D C:\SWSetup
2018-01-23 22:46 - 2017-06-30 07:56 - 000000000 ____D C:\Program Files\HPCommRecovery
2018-01-23 22:31 - 2017-09-14 16:55 - 000000000 ____D C:\Program Files (x86)\Intel
2018-01-23 22:10 - 2017-06-30 07:52 - 000000000 ____D C:\ProgramData\Package Cache
2018-01-23 22:09 - 2017-09-14 16:55 - 000000000 ____D C:\ProgramData\Intel
2018-01-23 21:34 - 2017-09-14 16:54 - 000000000 ___HD C:\Program Files (x86)\Temp
2018-01-23 21:33 - 2017-09-14 16:54 - 002839488 _____ (Realtek Semiconductor Corp.) C:\WINDOWS\RtlExUpd.dll
2018-01-23 19:28 - 2017-09-14 17:05 - 000000000 ____D C:\WINDOWS\HP
2018-01-23 18:45 - 2017-06-30 16:30 - 000014848 _____ (Hewlett-Packard) C:\WINDOWS\HPCUST2.exe
2018-01-20 10:19 - 2017-06-30 07:57 - 000000000 ____D C:\Program Files (x86)\Microsoft Office
2018-01-13 11:43 - 2017-06-30 07:54 - 000000000 ___HD C:\Program Files (x86)\InstallShield Installation Information
2018-01-11 07:55 - 2017-12-24 18:12 - 000457896 _____ (AVAST Software) C:\WINDOWS\system32\Drivers\aswSP.sys
2018-01-11 07:55 - 2017-12-24 18:12 - 000146648 _____ (AVAST Software) C:\WINDOWS\system32\Drivers\aswMonFlt.sys
2018-01-11 07:47 - 2017-12-24 16:41 - 000000000 ____D C:\Program Files\Mozilla Firefox
2018-01-11 07:47 - 2017-12-24 16:41 - 000000000 ____D C:\Program Files (x86)\Mozilla Maintenance Service
2018-01-10 12:59 - 2017-12-24 17:53 - 000000000 ____D C:\WINDOWS\system32\MRT
2018-01-10 12:45 - 2017-12-24 17:53 - 129365736 ____C (Microsoft Corporation) C:\WINDOWS\system32\MRT-KB890830.exe
2018-01-10 12:45 - 2017-12-24 17:53 - 129365736 ____C (Microsoft Corporation) C:\WINDOWS\system32\MRT.exe
2018-01-09 13:14 - 2017-12-25 19:40 - 000599528 _____ (IBM Corp.) C:\WINDOWS\system32\Drivers\RapportKE64.sys
2018-01-09 13:14 - 2017-12-25 19:40 - 000339944 _____ (IBM Corp.) C:\WINDOWS\system32\Drivers\RapportHades64.sys
2018-01-05 18:45 - 2017-12-24 16:41 - 000001012 _____ C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Mozilla Firefox.lnk
2018-01-01 15:09 - 2017-09-14 16:54 - 000000000 ____D C:\Program Files (x86)\Realtek
2017-12-29 11:15 - 2017-12-24 15:21 - 000000000 ____D C:\Users\desen\AppData\Local\Hewlett-Packard

==================== Files in the root of some directories =======

2018-01-12 10:50 - 2018-01-12 10:50 - 000007601 _____ () C:\Users\desen\AppData\Local\Resmon.ResmonCfg

==================== Bamital & volsnap ======================

(There is no automatic fix for files that do not pass verification.)

C:\WINDOWS\system32\winlogon.exe => File is digitally signed
C:\WINDOWS\system32\wininit.exe => File is digitally signed
C:\WINDOWS\explorer.exe => File is digitally signed
C:\WINDOWS\SysWOW64\explorer.exe => File is digitally signed
C:\WINDOWS\system32\svchost.exe => File is digitally signed
C:\WINDOWS\SysWOW64\svchost.exe => File is digitally signed
C:\WINDOWS\system32\services.exe => File is digitally signed
C:\WINDOWS\system32\User32.dll => File is digitally signed
C:\WINDOWS\SysWOW64\User32.dll => File is digitally signed
C:\WINDOWS\system32\userinit.exe => File is digitally signed
C:\WINDOWS\SysWOW64\userinit.exe => File is digitally signed
C:\WINDOWS\system32\rpcss.dll => File is digitally signed
C:\WINDOWS\system32\dnsapi.dll => File is digitally signed
C:\WINDOWS\SysWOW64\dnsapi.dll => File is digitally signed
C:\WINDOWS\system32\Drivers\volsnap.sys => File is digitally signed

LastRegBack: 2018-01-25 17:48

==================== End of FRST.txt ============================

 

Additional scan result of Farbar Recovery Scan Tool (x64) Version: 27.01.2018
Ran by [removed] (28-01-2018 10:25:53)
Running from C:\Users\[removed]\OneDrive\Desktop
Windows 10 Home Version 1709 16299.192 (X64) (2018-01-25 17:56:17)
Boot Mode: Normal
==========================================================


==================== Accounts: =============================

Administrator (S-1-5-21-557160917-1767100916-191111700-500 - Administrator - Disabled)
DefaultAccount (S-1-5-21-557160917-1767100916-191111700-503 - Limited - Disabled)
desen (S-1-5-21-557160917-1767100916-191111700-1001 - Administrator - Enabled) => C:\Users\desen
Guest (S-1-5-21-557160917-1767100916-191111700-501 - Limited - Disabled)
WDAGUtilityAccount (S-1-5-21-557160917-1767100916-191111700-504 - Limited - Disabled)

==================== Security Center ========================

(If an entry is included in the fixlist, it will be removed.)

AV: Avast Antivirus (Enabled - Up to date) {8EA8924E-BC81-DC44-8BB0-8BAE75D86EBF}
AV: Windows Defender (Disabled - Up to date) {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
AV: Malwarebytes (Enabled - Up to date) {23007AD3-69FE-687C-2629-D584AFFAF72B}
AS: Malwarebytes (Enabled - Up to date) {98619B37-4FC4-67F2-1C99-EEF6D47DBD96}
AS: Windows Defender (Disabled - Up to date) {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
AS: Avast Antivirus (Enabled - Up to date) {35C973AA-9ABB-D3CA-B100-B0DC0E5F2402}
FW: Avast Antivirus (Enabled) {B693136B-F6EE-DD1C-A0EF-229B8B0B29C4}

==================== Installed Programs ======================

(Only the adware programs with "Hidden" flag could be added to the fixlist to unhide them. The adware programs should be uninstalled manually.)

Avast Internet Security (HKLM-x32\…\Avast Antivirus) (Version: 17.9.2322 - AVAST Software)
CCleaner (HKLM\…\CCleaner) (Version: 5.39 - Piriform)
Energy Star (HKLM\…\{5CB22648-35F8-41BC-9C35-1E41FE6E12A5}) (Version: 1.1.1 - HP Inc.)
Google Chrome (HKLM-x32\…\Google Chrome) (Version: 63.0.3239.132 - Google Inc.)
Google Update Helper (HKLM-x32\…\{60EC980A-BDA2-4CB6-A427-B07A5498B4CA}) (Version: 1.3.33.7 - Google Inc.) Hidden
Google Update Helper (HKLM-x32\…\{A92DAB39-4E2C-4304-9AB6-BC44E68B55E2}) (Version: 1.3.21.123 - Google Inc.) Hidden
HP Audio Switch (HKLM-x32\…\{BC852AA8-58F6-4F07-ACB1-7377E52CA4F3}) (Version: 1.0.150.0 - HP Inc.)
HP Connection Optimizer (HKLM-x32\…\{6468C4A5-E47E-405F-B675-A70A70983EA6}) (Version: 2.0.9.0 - HP Inc.)
HP Documentation (HKLM\…\HP_Documentation) (Version: 1.0.0.1 - HP Inc.)
HP ePrint SW (HKLM-x32\…\{54da9769-2364-4bd3-8139-6400500778b3}) (Version: 5.3.22034 - HP Inc.)
HP JumpStart Apps (HKLM-x32\…\HP JumpStart Apps) (Version: 7.0.32 - HP Inc.)
HP JumpStart Bridge (HKLM-x32\…\{EB0912FF-C311-4E0F-A6B1-420FDD3C295E}) (Version: 1.3.0.407 - HP Inc.)
HP JumpStart Launch (HKLM-x32\…\{6A139049-EBB9-4076-8664-B468888E55A3}) (Version: 1.3.392.0 - HP Inc.)
HP Support Assistant (HKLM-x32\…\{05F81C27-62A5-4A0C-8519-60CB66CF87C6}) (Version: 8.5.37.19 - HP Inc.)
HP Support Solutions Framework (HKLM-x32\…\{183BD477-774B-4700-B40B-EE43886E74D2}) (Version: 12.8.47.1 - HP Inc.)
HP System Event Utility (HKLM-x32\…\{ABE95EB9-5EA1-42A3-8009-BA7602127ED6}) (Version: 1.4.25 - HP Inc.)
HP Wireless Button Driver (HKLM-x32\…\{2EC9AB64-3ACA-460D-B309-0A7052B0C8C0}) (Version: 1.1.21.1 - HP)
Intel(R) Chipset Device Software (HKLM-x32\…\{17408817-d415-4768-a160-ae6d46d6bdb0}) (Version: 10.1.1.44 - Intel(R) Corporation) Hidden
Intel(R) Dynamic Platform and Thermal Framework (HKLM-x32\…\{654EE65D-FAA4-4EA6-8C07-DC94E6A304D4}) (Version: 8.3.10205.4743 - Intel Corporation)
Intel(R) Management Engine Components (HKLM\…\{1CEAC85D-2590-4760-800F-8DE5E91F3700}) (Version: 11.7.0.1043 - Intel Corporation)
Intel(R) Processor Graphics (HKLM-x32\…\{F0E3AD40-2BBD-4360-9C76-B9AC9A5886EA}) (Version: 22.20.16.4815 - Intel Corporation)
Intel(R) Rapid Storage Technology (HKLM\…\{409CB30E-E457-4008-9B1A-ED1B9EA21140}) (Version: 15.7.0.1014 - Intel Corporation)
Intel(R) Trusted Connect Service Client x86 (HKLM-x32\…\{C9552825-7BF2-4344-BA91-D3CD46F4C441}) (Version: 1.47.715.0 - Intel Corporation) Hidden
Intel(R) Trusted Connect Services Client (HKLM-x32\…\{2b32b7d0-4f9f-47c8-adb7-807e6cb2fb75}) (Version: 1.47.715.0 - Intel Corporation) Hidden
Intel(R) Wireless Bluetooth(R) (HKLM-x32\…\{00000010-0200-1033-84C8-B8D95FA3C8C3}) (Version: 20.10.0 - Intel Corporation)
Intel® PROSet/Wireless Software (HKLM-x32\…\{8060a69f-ee27-444b-b126-775f861232ea}) (Version: 20.0.2 - Intel Corporation)
Malwarebytes version 3.3.1.2183 (HKLM\…\{35065F43-4BB2-439A-BFF7-0F1014F2E0CD}_is1) (Version: 3.3.1.2183 - Malwarebytes)
Microsoft Office 365 - en-us (HKLM\…\O365HomePremRetail - en-us) (Version: 16.0.8827.2148 - Microsoft Corporation)
Microsoft Office Professional Plus 2016 - en-us (HKLM\…\ProPlusRetail - en-us) (Version: 16.0.8827.2148 - Microsoft Corporation)
Microsoft OneDrive (HKU\S-1-5-21-557160917-1767100916-191111700-1001\…\OneDriveSetup.exe) (Version: 17.3.7131.1115 - Microsoft Corporation)
Microsoft Visual C++ 2005 Redistributable (HKLM-x32\…\{710f4c1c-cc18-4c49-8cbf-51240c89a1a2}) (Version: 8.0.61001 - Microsoft Corporation)
Microsoft Visual C++ 2005 Redistributable (x64) (HKLM\…\{ad8a2fa1-06e7-4b0d-927d-6e54b3d31028}) (Version: 8.0.61000 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.17 (HKLM\…\{8220EEFE-38CD-377E-8595-13398D740ACE}) (Version: 9.0.30729 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.6161 (HKLM\…\{5FCE6D76-F5DC-37AB-B2B8-22AB8CEDB1D4}) (Version: 9.0.30729.6161 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17 (HKLM-x32\…\{9A25302D-30C0-39D9-BD6F-21E6EC160475}) (Version: 9.0.30729 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.4148 (HKLM-x32\…\{1F1C2DFC-2D24-3E06-BCB8-725134ADF989}) (Version: 9.0.30729.4148 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161 (HKLM-x32\…\{9BE518E6-ECC6-35A9-88E4-87755C07200F}) (Version: 9.0.30729.6161 - Microsoft Corporation)
Microsoft Visual C++ 2010  x64 Redistributable - 10.0.40219 (HKLM\…\{1D8E6291-B0D5-35EC-8441-6616F567A0F7}) (Version: 10.0.40219 - Microsoft Corporation)
Microsoft Visual C++ 2010  x86 Redistributable - 10.0.40219 (HKLM-x32\…\{F0C3E5D1-1ADE-321E-8167-68EF0DE699A5}) (Version: 10.0.40219 - Microsoft Corporation)
Microsoft Visual C++ 2012 Redistributable (x64) - 11.0.61030 (HKLM-x32\…\{ca67548a-5ebe-413a-b50c-4b9ceb6d66c6}) (Version: 11.0.61030.0 - Microsoft Corporation)
Microsoft Visual C++ 2012 Redistributable (x86) - 11.0.61030 (HKLM-x32\…\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}) (Version: 11.0.61030.0 - Microsoft Corporation)
Microsoft Visual C++ 2013 Redistributable (x64) - 12.0.30501 (HKLM-x32\…\{050d4fc8-5d48-4b8f-8972-47c82c46020f}) (Version: 12.0.30501.0 - Microsoft Corporation)
Microsoft Visual C++ 2013 Redistributable (x86) - 12.0.30501 (HKLM-x32\…\{f65db027-aff3-4070-886a-0d87064aabb1}) (Version: 12.0.30501.0 - Microsoft Corporation)
Microsoft Visual C++ 2015 Redistributable (x64) - 14.0.24123 (HKLM-x32\…\{2cbcedbb-f38c-48a3-a3e1-6c6fd821a7f4}) (Version: 14.0.24123.0 - Microsoft Corporation)
Microsoft Visual C++ 2015 Redistributable (x86) - 14.0.24123 (HKLM-x32\…\{206898cc-4b41-4d98-ac28-9f9ae57f91fe}) (Version: 14.0.24123.0 - Microsoft Corporation)
Mozilla Firefox 57.0.4 (x64 en-GB) (HKLM\…\Mozilla Firefox 57.0.4 (x64 en-GB)) (Version: 57.0.4 - Mozilla)
Mozilla Maintenance Service (HKLM\…\MozillaMaintenanceService) (Version: 57.0.2 - Mozilla)
Office 16 Click-to-Run Extensibility Component (HKLM-x32\…\{90160000-008C-0000-0000-0000000FF1CE}) (Version: 16.0.8827.2148 - Microsoft Corporation) Hidden
Office 16 Click-to-Run Extensibility Component 64-bit Registration (HKLM\…\{90160000-00DD-0000-1000-0000000FF1CE}) (Version: 16.0.8827.2148 - Microsoft Corporation) Hidden
Office 16 Click-to-Run Licensing Component (HKLM\…\{90160000-008F-0000-1000-0000000FF1CE}) (Version: 16.0.8827.2148 - Microsoft Corporation) Hidden
Office 16 Click-to-Run Localization Component (HKLM-x32\…\{90160000-008C-0409-0000-0000000FF1CE}) (Version: 16.0.8827.2148 - Microsoft Corporation) Hidden
Rapport (HKLM-x32\…\{1DD81E7D-0D28-4CEB-87B2-C041A4FCB215}) (Version: 3.5.1908.134 - Trusteer) Hidden
Realtek Card Reader (HKLM-x32\…\{5BC2B5AB-80DE-4E83-B8CF-426902051D0A}) (Version: 10.0.15063.31235 - Realtek Semiconductor Corp.)
Realtek Ethernet Controller Driver (HKLM-x32\…\{8833FFB6-5B0C-4764-81AA-06DFEED9A476}) (Version: 10.21.811.2017 - Realtek)
Realtek High Definition Audio Driver (HKLM-x32\…\{F132AF7F-7BCA-4EDE-8A7C-958108FE7DBC}) (Version: 6.0.1.8233 - Realtek Semiconductor Corp.)
Samsung Data Migration (HKLM-x32\…\{3B304604-0BF5-488E-AB95-F2F2E31206F3}) (Version: 3.1 - Samsung)
Samsung Magician (HKLM-x32\…\{29AE3F9F-7158-4ca7-B1ED-28A73ECDB215}_is1) (Version: 5.1.0.1120 - Samsung Electronics)
Skype Meetings App (HKLM-x32\…\{E8E6D26B-382E-43C8-91BA-AB8DF2CD0C10}) (Version: 16.2.0.194 - Microsoft Corporation)
Synaptics Pointing Device Driver (HKLM\…\SynTPDeinstKey) (Version: 19.3.31.31 - Synaptics Incorporated)
Trusteer Endpoint Protection (HKLM-x32\…\Rapport_msi) (Version: 3.5.1908.134 - Trusteer)
Update for Windows 10 for x64-based Systems (KB4023057) (HKLM\…\{EC5A6438-850E-4AD1-9169-DD071C8EFFEF}) (Version: 2.10.0.0 - Microsoft Corporation)
Vulkan Run Time Libraries 1.0.54.1 (HKLM\…\VulkanRT1.0.54.1) (Version: 1.0.54.1 - LunarG, Inc.) Hidden
Vulkan Run Time Libraries 1.0.54.1 (HKLM\…\VulkanRT1.0.54.1-2) (Version: 1.0.54.1 - LunarG, Inc.) Hidden
WildTangent Games (HKLM-x32\…\WildTangent wildgames Master Uninstall) (Version: 1.1.1.9 - WildTangent)
WildTangent Helper (HKLM-x32\…\{A39303AB-4898-4F12-BAA0-0B8630F86DB4}) (Version: 1.0.0.224 - WildTangent) Hidden

==================== Custom CLSID (Whitelisted): ==========================

(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)

CustomCLSID: HKU\S-1-5-21-557160917-1767100916-191111700-1001_Classes\CLSID\{3E3AD4BD-346A-460A-80E8-90699B75C00B}\InprocServer32 -> C:\Users\desen\AppData\Local\Microsoft\SkypeForBusinessPlugin\16.2.0.194\GatewayActiveX-x64.dll (Microsoft Corporation)
ShellIconOverlayIdentifiers: [00asw] -> {472083B0-C522-11CF-8763-00608CC02F24} => C:\Program Files\AVAST Software\Avast\ashShA64.dll [2017-12-24] (AVAST Software)
ContextMenuHandlers1: [avast] -> {472083B0-C522-11CF-8763-00608CC02F24} => C:\Program Files\AVAST Software\Avast\ashShA64.dll [2017-12-24] (AVAST Software)
ContextMenuHandlers3: [00asw] -> {472083B0-C522-11CF-8763-00608CC02F24} => C:\Program Files\AVAST Software\Avast\ashShA64.dll [2017-12-24] (AVAST Software)
ContextMenuHandlers3: [MBAMShlExt] -> {57CE581A-0CB6-4266-9CA0-19364C90A0B3} => C:\Program Files\Malwarebytes\Anti-Malware\mbshlext.dll [2017-11-01] (Malwarebytes)
ContextMenuHandlers5: [igfxcui] -> {3AB1675A-CCFF-11D2-8B20-00A0C93CB1F4} =>  -> No File
ContextMenuHandlers5: [igfxDTCM] -> {9B5F5829-A529-4B12-814A-E81BCB8D93FC} => C:\WINDOWS\System32\DriverStore\FileRepository\ki124757.inf_amd64_b607c305e0c4e0a1\igfxDTCM.dll [2018-01-23] (Intel Corporation)
ContextMenuHandlers6: [avast] -> {472083B0-C522-11CF-8763-00608CC02F24} => C:\Program Files\AVAST Software\Avast\ashShA64.dll [2017-12-24] (AVAST Software)
ContextMenuHandlers6: [MBAMShlExt] -> {57CE581A-0CB6-4266-9CA0-19364C90A0B3} => C:\Program Files\Malwarebytes\Anti-Malware\mbshlext.dll [2017-11-01] (Malwarebytes)

==================== Scheduled Tasks (Whitelisted) =============

(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)

Task: {074DEA79-8BD0-43D4-B6A9-2B41C99F5EB6} - System32\Tasks\Hewlett-Packard\HP Support Assistant\HP Support Solutions Framework Report => C:\Program Files (x86)\Hewlett-Packard\HP Support Solutions\Modules\HPSFReport.exe [2017-06-22] (HP Inc.)
Task: {0D480DD5-8B09-4B52-8D0A-AC3236C4B1E8} - System32\Tasks\Avast Software\Overseer => C:\Program Files\Common Files\Avast Software\Overseer\overseer.exe [2018-01-10] (AVAST Software)
Task: {0E4245CA-D41B-4D8B-9026-FF4F3B322BB8} - System32\Tasks\HPEA3JOBS => C:\Program [Argument = Files\HP\HP ePrint\hpeprint.exe /CheckJobs]
Task: {125325BB-616D-4EA9-9FDA-B77D5FEFFBFF} - System32\Tasks\Avast Emergency Update => C:\Program Files\AVAST Software\Avast\AvEmUpdate.exe [2017-12-24] (AVAST Software)
Task: {24112DCB-9292-40D7-A2AB-EE9E72F73E68} - System32\Tasks\HPCeeScheduleFordesen => C:\Program Files (x86)\Hewlett-Packard\HP Ceement\HPCEE.exe [2016-06-24] (HP Inc.)
Task: {4F356145-59BB-4AD1-8DB5-0FAF5D51CCEB} - System32\Tasks\Hewlett-Packard\HP Support Assistant\WarrantyChecker_DeviceScan => C:\Program Files (x86)\Hewlett-Packard\HP Support Framework\Resources\HPWarrantyCheck\HPWarrantyChecker.exe [2017-11-08] (HP Inc.)
Task: {50EA34CE-FD3F-4F1B-9DBD-A431E2F3D0B2} - System32\Tasks\Hewlett-Packard\HP Active Health\HP Active Health Scan (HPSA) => C:\Program Files (x86)\Hewlett-Packard\HP Support Framework\Resources\HPActiveHealth\ActiveHealth.exe [2017-04-07] (HP Inc.)
Task: {58E607FE-AEDF-4933-BA83-8C4F3860AB9E} - System32\Tasks\Microsoft\Office\Office ClickToRun Service Monitor => C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeC2RClient.exe [2018-01-15] (Microsoft Corporation)
Task: {5C0F4512-E842-4B13-9BDE-1ECCC0DC0982} - System32\Tasks\GoogleUpdateTaskMachineUA => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe [2017-12-24] (Google Inc.)
Task: {62E93DC3-D89B-40BE-AD51-C10D0C56FE3D} - System32\Tasks\Hewlett-Packard\HP Support Assistant\HP Support Solutions Framework Updater => C:\Program Files (x86)\Hewlett-Packard\HP Support Solutions\Modules\HPSSFUpdater.exe [2017-09-20] (HP Inc.)
Task: {69F5A1AF-6951-45B1-BCBE-17EFBB9E04A6} - System32\Tasks\GoogleUpdateTaskMachineCore => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe [2017-12-24] (Google Inc.)
Task: {6BBB0838-1B09-4B50-ACDA-0C93E990C77B} - System32\Tasks\Hewlett-Packard\HP Support Assistant\Product Configurator => C:\Program Files (x86)\Hewlett-Packard\HP Support Framework\Resources\ProductConfig.exe [2018-01-10] (HP Inc.)
Task: {75B44C2A-9BDE-4345-940D-9B493DDD3605} - System32\Tasks\Intel PTT EK Recertification => C:\Program Files\Intel\iCLS Client\IntelPTTEKRecertification.exe [2017-09-21] (Intel(R) Corporation)
Task: {7E3C2059-3604-49C3-B07E-B02BB70304B0} - System32\Tasks\HPAudioSwitch => C:\Program Files (x86)\HP\HPAudioSwitch\HPAudioSwitch.exe [2017-02-02] (HP Inc.)
Task: {81BFBF21-EA2B-403B-8913-0911C19BE971} - System32\Tasks\RTKCPL => C:\Program Files\Realtek\Audio\HDA\RtkNGUI64.exe [2018-01-23] (Realtek Semiconductor)
Task: {8511B81A-FEBF-40AF-AAC8-31EE66604DDD} - System32\Tasks\Hewlett-Packard\HP Support Assistant\PC Health Analysis => C:\Program Files (x86)\Hewlett-Packard\HP Support Framework\HPSF.exe [2017-09-27] (HP Inc.)
Task: {936D1BA6-7CB6-4F0B-8E69-688057AB04F8} - System32\Tasks\SamsungMagician => C:\Program Files (x86)\Samsung\Samsung Magician\SamsungMagician.exe [2017-05-19] (Samsung Electronics Co. Ltd.)
Task: {955BC919-F4F6-4387-85A3-4D7EA0B3CB17} - System32\Tasks\Microsoft\Office\OfficeBackgroundTaskHandlerRegistration => C:\Program Files (x86)\Microsoft Office\root\Office16\officebackgroundtaskhandler.exe [2018-01-20] (Microsoft Corporation)
Task: {B018D9AE-AC3C-475C-A13B-531901423DC4} - System32\Tasks\Microsoft\Office\OfficeTelemetryAgentLogOn2016 => C:\Program Files (x86)\Microsoft Office\root\Office16\msoia.exe [2018-01-20] (Microsoft Corporation)
Task: {B11E889C-3FC5-4763-8417-F8A0FAAC2D08} - System32\Tasks\Hewlett-Packard\HP Support Assistant\HP Support Assistant Quick Start => C:\Program Files (x86)\Hewlett-Packard\HP Support Framework\HPSF.exe [2017-09-27] (HP Inc.)
Task: {BDE10EBB-20A8-4750-8A24-E4741A0ECBA6} - System32\Tasks\CCleanerSkipUAC => C:\Program Files\CCleaner\CCleaner.exe [2018-01-09] (Piriform Ltd)
Task: {C5692AB9-0CBC-4753-8703-8F0EF8C5DFFF} - System32\Tasks\Microsoft\Office\OfficeBackgroundTaskHandlerLogon => C:\Program Files (x86)\Microsoft Office\root\Office16\officebackgroundtaskhandler.exe [2018-01-20] (Microsoft Corporation)
Task: {CBC8E11C-D330-4A1B-966B-D12C8DCD7A55} - System32\Tasks\Hewlett-Packard\HP Support Assistant\WarrantyChecker => C:\Program Files (x86)\Hewlett-Packard\HP Support Framework\Resources\HPWarrantyCheck\HPWarrantyChecker.exe [2017-11-08] (HP Inc.)
Task: {D0AF246E-237A-46CF-A0BE-8933A41CF5E5} - System32\Tasks\HPJumpStartLaunch => C:\Program Files (x86)\HP\HP JumpStart Launch\HPJumpStartLaunch.exe [2017-05-12] ()
Task: {D29C1F28-4A4D-40D2-93FC-8CDADDF395F1} - System32\Tasks\CCleaner Update => C:\Program Files\CCleaner\CCUpdate.exe [2018-01-09] (Piriform Ltd)
Task: {EB44149F-8C88-4E38-B09D-0A50C9E833EC} - System32\Tasks\Microsoft\Office\OfficeTelemetryAgentFallBack2016 => C:\Program Files (x86)\Microsoft Office\root\Office16\msoia.exe [2018-01-20] (Microsoft Corporation)
Task: {F2F6290B-0250-4EE2-96FB-8BE42AD83871} - System32\Tasks\Microsoft\Office\Office Automatic Updates => C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeC2RClient.exe [2018-01-15] (Microsoft Corporation)

(If an entry is included in the fixlist, the task (.job) file will be moved. The file which is running by the task will not be moved.)

Task: C:\WINDOWS\Tasks\HPCeeScheduleFordesen.job => C:\Program Files (x86)\Hewlett-Packard\HP Ceement\HPCEE.exe

==================== Shortcuts & WMI ========================

(The entries could be listed to be restored or removed.)


==================== Loaded Modules (Whitelisted) ==============

2017-09-29 13:41 - 2017-09-29 13:41 - 000184432 _____ () C:\WINDOWS\SYSTEM32\inputhost.dll
2017-09-22 00:16 - 2017-09-22 00:16 - 001549160 _____ () C:\Program Files (x86)\WildTangent Games\Integration\WildTangentHelperService.exe
2017-12-24 19:37 - 2017-11-29 09:11 - 002358728 _____ () C:\PROGRAM FILES\MALWAREBYTES\ANTI-MALWARE\MwacLib.dll
2017-12-24 19:37 - 2017-11-29 09:11 - 002301384 _____ () C:\PROGRAM FILES\MALWAREBYTES\ANTI-MALWARE\SelfProtectionSdk.dll
2017-05-12 11:19 - 2017-05-12 11:19 - 000459680 _____ () C:\Program Files (x86)\HP\HP JumpStart Launch\HPJumpStartLaunch.exe
2018-01-25 17:42 - 2018-01-25 17:42 - 011044864 _____ () C:\Windows\SystemApps\Microsoft.Windows.Cortana_cw5n1h2txyewy\CortanaApi.dll
2018-01-25 17:42 - 2018-01-25 17:42 - 001804288 _____ () C:\Windows\SystemApps\Microsoft.Windows.Cortana_cw5n1h2txyewy\Cortana.Core.dll
2018-01-19 09:44 - 2018-01-19 09:45 - 000086528 _____ () C:\Program Files\WindowsApps\Microsoft.SkypeApp_12.13.274.0_x64__kzf8qxf38zg5c\SkypeHost.exe
2018-01-19 09:44 - 2018-01-19 09:45 - 000195072 _____ () C:\Program Files\WindowsApps\Microsoft.SkypeApp_12.13.274.0_x64__kzf8qxf38zg5c\SkypeBackgroundTasks.dll
2018-01-19 09:44 - 2018-01-19 09:45 - 024677376 _____ () C:\Program Files\WindowsApps\Microsoft.SkypeApp_12.13.274.0_x64__kzf8qxf38zg5c\SkyWrap.dll
2018-01-03 09:47 - 2018-01-03 09:49 - 002550272 _____ () C:\Program Files\WindowsApps\Microsoft.SkypeApp_12.13.274.0_x64__kzf8qxf38zg5c\skypert.dll
2018-01-19 09:44 - 2018-01-19 09:45 - 000667648 _____ () C:\Program Files\WindowsApps\Microsoft.SkypeApp_12.13.274.0_x64__kzf8qxf38zg5c\RtmMvrUap.dll
2017-12-24 18:11 - 2017-12-24 18:11 - 000067984 _____ () C:\Program Files\AVAST Software\Avast\x64\dll_loader.dll
2017-12-24 18:11 - 2017-12-24 18:11 - 000067920 _____ () C:\Program Files\AVAST Software\Avast\x64\module_lifetime.dll
2015-06-02 14:51 - 2015-06-02 14:51 - 000545792 _____ () C:\Program Files (x86)\Trusteer\Rapport\bin\js32.dll
2017-12-24 18:11 - 2017-12-24 18:11 - 000206152 _____ () C:\Program Files\AVAST Software\Avast\JsonRpcServer.dll
2017-12-24 18:11 - 2017-12-24 18:11 - 000058016 _____ () C:\Program Files\AVAST Software\Avast\module_lifetime.dll
2017-12-24 18:11 - 2017-12-24 18:11 - 000057504 _____ () C:\Program Files\AVAST Software\Avast\dll_loader.dll
2017-12-24 18:12 - 2017-12-24 18:12 - 067109376 _____ () C:\Program Files\AVAST Software\Avast\libcef.dll
2017-12-24 18:11 - 2017-12-24 18:11 - 000289272 _____ () C:\Program Files\AVAST Software\Avast\tasks_core.dll
2017-12-24 18:11 - 2017-12-24 18:11 - 000282560 _____ () C:\Program Files\AVAST Software\Avast\gaming_mode_ui.dll

==================== Alternate Data Streams (Whitelisted) =========

(If an entry is included in the fixlist, only the ADS will be removed.)


==================== Safe Mode (Whitelisted) ===================

(If an entry is included in the fixlist, it will be removed from the registry. The "AlternateShell" will be restored.)


==================== Association (Whitelisted) ===============

(If an entry is included in the fixlist, the registry item will be restored to default or removed.)


==================== Internet Explorer trusted/restricted ===============

(If an entry is included in the fixlist, it will be removed from the registry.)


==================== Hosts content: ===============================

(If needed Hosts: directive could be included in the fixlist to reset Hosts.)

2017-03-18 21:03 - 2017-03-18 21:01 - 000000824 _____ C:\WINDOWS\system32\Drivers\etc\hosts


==================== Other Areas ============================

(Currently there is no automatic fix for this section.)

HKU\S-1-5-21-557160917-1767100916-191111700-1001\Control Panel\Desktop\\Wallpaper -> C:\Users\desen\AppData\Roaming\Microsoft\Windows\Themes\TranscodedWallpaper
DNS Servers: 192.168.1.1
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System => (ConsentPromptBehaviorAdmin: 5) (ConsentPromptBehaviorUser: 3) (EnableLUA: 1)
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer => (SmartScreenEnabled: )
Windows Firewall is enabled.

==================== MSCONFIG/TASK MANAGER disabled items ==

HKLM\…\StartupApproved\Run32: => "HPRadioMgr"
HKU\S-1-5-21-557160917-1767100916-191111700-1001\…\StartupApproved\Run: => "OneDrive"

==================== FirewallRules (Whitelisted) ===============

(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)

FirewallRules: [{86F0B674-0F2B-4DF8-BFA6-D9F107D7C1F6}] => (Allow) C:\Program Files\Intel\WiFi\bin\PanDhcpDns.exe
FirewallRules: [{F6C9D766-6C73-497C-83FE-1E8820F05DC8}] => (Allow) C:\Program Files (x86)\Microsoft Office\root\Office16\UcMapi.exe
FirewallRules: [{8B88AF09-E16D-45E8-96E9-4E04A2CE5708}] => (Allow) C:\Program Files (x86)\Microsoft Office\root\Office16\UcMapi.exe
FirewallRules: [{9F0FA105-F62C-49D8-93F4-844651463340}] => (Allow) C:\Program Files (x86)\Microsoft Office\root\Office16\Lync.exe
FirewallRules: [{66315449-16D4-4ED6-B163-C860AFFA508F}] => (Allow) C:\Program Files (x86)\Microsoft Office\root\Office16\Lync.exe
FirewallRules: [{2E6F7437-CAB0-4C1B-9B3F-7A3E81E9825C}] => (Allow) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
FirewallRules: [{16BD01DC-94BD-4ECC-8F63-76A9CBE347FC}] => (Allow) C:\Program Files (x86)\Microsoft Office\root\Office16\outlook.exe
FirewallRules: [{A11C8125-FDC4-4AEF-A419-806748DF359C}] => (Allow) C:\Program Files\Mozilla Firefox\firefox.exe
FirewallRules: [{C2287AF1-6571-4D8B-971F-77EB913F6113}] => (Allow) C:\Program Files\Mozilla Firefox\firefox.exe

==================== Restore Points =========================

25-01-2018 17:57:08 Windows Update

==================== Faulty Device Manager Devices =============


==================== Event log errors: =========================

Application errors:
==================
Error: (01/28/2018 10:03:59 AM) (Source: HP Comm Recovery) (EventID: 0) (User: )
Description: Failed in handling the PowerEvent. The error that occurred was: System.IO.IOException: The process cannot access the file 'C:\Windows\Temp\signtool.exe' because it is being used by another process.
   at System.IO.__Error.WinIOError(Int32 errorCode, String maybeFullPath)
   at System.IO.FileStream.Init(String path, FileMode mode, FileAccess access, Int32 rights, Boolean useRights, FileShare share, Int32 bufferSize, FileOptions options, SECURITY_ATTRIBUTES secAttrs, String msgPath, Boolean bFromProxy, Boolean useLongPath, Boolean checkHost)
   at System.IO.FileStream..ctor(String path, FileMode mode, FileAccess access, FileShare share, Int32 bufferSize, FileOptions options, String msgPath, Boolean bFromProxy)
   at System.IO.FileStream..ctor(String path, FileMode mode)
   at _HPCommRecovery.Tools.Signtool.ExtractSignTool()
   at _HPCommRecovery.Tools.Signtool.Verify(String arg)
   at _HPCommRecovery.HPAHAgent.CallAgent()
   at _HPCommRecovery.AppSession..ctor(DateTime Current, String LogPath)
   at _HPCommRecovery.HPAHLogger.NewSession()
   at _HPCommRecovery…..

Error: (01/27/2018 06:59:23 PM) (Source: Perflib) (EventID: 1023) (User: )
Description: Windows cannot load the extensible counter DLL rdyboost. The first four bytes (DWORD) of the Data section contains the Windows error code.

Error: (01/27/2018 06:59:23 PM) (Source: Perflib) (EventID: 1017) (User: )
Description: Disabled performance counter data collection from the "ASP.NET_64_2.0.50727" service because the performance counter library for that service has generated one or more errors. The errors that forced this action have been written to the application event log. Correct the errors before enabling the performance counters for this service.

Error: (01/27/2018 06:59:23 PM) (Source: Perflib) (EventID: 1022) (User: )
Description: Windows cannot open the 64-bit extensible counter DLL ASP.NET_64_2.0.50727 in a 32-bit environment. Contact the file vendor to obtain a 32-bit version. Alternatively if you are running a 64-bit native environment, you can open the 64-bit extensible counter DLL by using the 64-bit version of Performance Monitor. To use this tool, open the Windows folder, open the System32 folder, and then start Perfmon.exe.

Error: (01/27/2018 06:52:25 PM) (Source: Application Error) (EventID: 1000) (User: )
Description: Faulting application name: HPCommRecovery.exe, version: 2.0.9.0, time stamp: 0x59ae543e
Faulting module name: ntdll.dll, version: 10.0.16299.192, time stamp: 0x6dead514
Exception code: 0xc00000fd
Fault offset: 0x00000000000a41c8
Faulting process ID: 0x2234
Faulting application start time: 0x01d3979cfc67174f
Faulting application path: C:\Program Files\HPCommRecovery\HPCommRecovery.exe
Faulting module path: C:\WINDOWS\SYSTEM32\ntdll.dll
Report ID: b169027d-48a7-4ff2-881a-0decbc7406ff
Faulting package full name:
Faulting package-relative application ID:

Error: (01/27/2018 06:50:42 PM) (Source: Application Error) (EventID: 1000) (User: )
Description: Faulting application name: dwm.exe, version: 10.0.16299.15, time stamp: 0x7f22d77c
Faulting module name: igc64.dll, version: 22.20.16.4815, time stamp: 0x59cad2a9
Exception code: 0xc0000005
Fault offset: 0x0000000000290630
Faulting process ID: 0x2a98
Faulting application start time: 0x01d3979faae691fa
Faulting application path: C:\WINDOWS\system32\dwm.exe
Faulting module path: C:\WINDOWS\System32\DriverStore\FileRepository\ki124757.inf_amd64_b607c305e0c4e0a1\igc64.dll
Report ID: 4415dac6-1774-4f4a-a5b9-354fb82056f8
Faulting package full name:
Faulting package-relative application ID:

Error: (01/27/2018 06:50:13 PM) (Source: Application Error) (EventID: 1000) (User: )
Description: Faulting application name: dwm.exe, version: 10.0.16299.15, time stamp: 0x7f22d77c
Faulting module name: udwm.dll, version: 10.0.16299.15, time stamp: 0xaef94f55
Exception code: 0xc00001ad
Fault offset: 0x0000000000053d94
Faulting process ID: 0x4a4
Faulting application start time: 0x01d3979cb2aab91b
Faulting application path: C:\WINDOWS\system32\dwm.exe
Faulting module path: C:\WINDOWS\SYSTEM32\udwm.dll
Report ID: 6522c847-dc47-408e-b2b7-f008979538b4
Faulting package full name:
Faulting package-relative application ID:

Error: (01/27/2018 05:39:58 PM) (Source: Perflib) (EventID: 1008) (User: )
Description: The Open Procedure for service "BITS" in DLL "C:\Windows\System32\bitsperf.dll" failed. Performance data for this service will not be available. The first four bytes (DWORD) of the Data section contains the error code.

Error: (01/27/2018 05:23:29 PM) (Source: ESENT) (EventID: 104) (User: )
Description: wuaueng.dll (3028,T,0) SUS20ClientDataStore: The database engine stopped the instance (0) with error (-1011).



Internal Timing Sequence:
[1] 0.000005 +J(0)
[2] 0.000042 +J(0) +M(C:0K, Fs:1, WS:4K # 0K, PF:0K # 0K, P:0K)
[3] 0.000006 +J(0) +M(C:0K, Fs:1, WS:4K # 0K, PF:0K # 0K, P:0K)
[4] 0.000003 +J(0)
[5] 0.000060 +J(0) +M(C:0K, Fs:2, WS:4K # 0K, PF:0K # 0K, P:0K)
[6] 0.000039 +J(0) +M(C:0K, Fs:1, WS:-12K # 0K, PF:-16K # 0K, P:-16K)
[7] -
[8] 0.000005 +J(0)
[9] 0.001542 +J(0) +M(C:0K, Fs:4, WS:-28K # 0K, PF:-44K # 0K, P:-44K)
[10] -
[11] 0.000348 +J(0) +M(C:0K, Fs:2, WS:8K # 0K, PF:0K # 0K, P:0K)
[12] -
[13] 0.000033 +J(0) +M(C:0K, Fs:0, WS:-4K # 0K, PF:-4K # 0K, P:-4K)
[14] 0.000734 +J(0)
[15] 0.000018 +J(0) +M(C:0K, Fs:1, WS:0K # 0K, PF:-12K # 0K, P:-12K)
[16] 0.000003 +J(0).

Error: (01/27/2018 04:40:18 PM) (Source: Application Hang) (EventID: 1002) (User: )
Description: The program svchost.exe version 10.0.16299.15 stopped interacting with Windows and was closed. To see if more information about the problem is available, check the problem history in the Security and Maintenance control panel.

Process ID: 834

Start Time: 01d3960533ee4ce7

Termination Time: 4294967295

Application Path: C:\Windows\System32\svchost.exe

Report Id: 3f925941-9724-4610-ba01-6d25f327695b

Faulting package full name:

Faulting package-relative application ID:


System errors:
=============
Error: (01/28/2018 10:19:06 AM) (Source: DCOM) (EventID: 10016) (User: NT AUTHORITY)
Description: The application-specific permission settings do not grant Local Activation permission for the COM Server application with CLSID
{6B3B8D23-FA8D-40B9-8DBD-B950333E2C52}
 and APPID
{4839DDB7-58C2-48F5-8283-E1D1807D0D7D}
 to the user NT AUTHORITY\LOCAL SERVICE SID (S-1-5-19) from address LocalHost (Using LRPC) running in the application container Unavailable SID (Unavailable). This security permission can be modified using the Component Services administrative tool.

Error: (01/28/2018 10:19:06 AM) (Source: DCOM) (EventID: 10016) (User: NT AUTHORITY)
Description: The application-specific permission settings do not grant Local Activation permission for the COM Server application with CLSID
{6B3B8D23-FA8D-40B9-8DBD-B950333E2C52}
 and APPID
{4839DDB7-58C2-48F5-8283-E1D1807D0D7D}
 to the user NT AUTHORITY\LOCAL SERVICE SID (S-1-5-19) from address LocalHost (Using LRPC) running in the application container Unavailable SID (Unavailable). This security permission can be modified using the Component Services administrative tool.

Error: (01/28/2018 10:19:06 AM) (Source: DCOM) (EventID: 10016) (User: NT AUTHORITY)
Description: The application-specific permission settings do not grant Local Activation permission for the COM Server application with CLSID
{6B3B8D23-FA8D-40B9-8DBD-B950333E2C52}
 and APPID
{4839DDB7-58C2-48F5-8283-E1D1807D0D7D}
 to the user NT AUTHORITY\LOCAL SERVICE SID (S-1-5-19) from address LocalHost (Using LRPC) running in the application container Unavailable SID (Unavailable). This security permission can be modified using the Component Services administrative tool.

Error: (01/28/2018 10:19:06 AM) (Source: DCOM) (EventID: 10016) (User: NT AUTHORITY)
Description: The application-specific permission settings do not grant Local Activation permission for the COM Server application with CLSID
{6B3B8D23-FA8D-40B9-8DBD-B950333E2C52}
 and APPID
{4839DDB7-58C2-48F5-8283-E1D1807D0D7D}
 to the user NT AUTHORITY\LOCAL SERVICE SID (S-1-5-19) from address LocalHost (Using LRPC) running in the application container Unavailable SID (Unavailable). This security permission can be modified using the Component Services administrative tool.

Error: (01/28/2018 10:19:06 AM) (Source: DCOM) (EventID: 10016) (User: NT AUTHORITY)
Description: The application-specific permission settings do not grant Local Activation permission for the COM Server application with CLSID
{6B3B8D23-FA8D-40B9-8DBD-B950333E2C52}
 and APPID
{4839DDB7-58C2-48F5-8283-E1D1807D0D7D}
 to the user NT AUTHORITY\LOCAL SERVICE SID (S-1-5-19) from address LocalHost (Using LRPC) running in the application container Unavailable SID (Unavailable). This security permission can be modified using the Component Services administrative tool.

Error: (01/28/2018 10:19:06 AM) (Source: DCOM) (EventID: 10016) (User: NT AUTHORITY)
Description: The application-specific permission settings do not grant Local Activation permission for the COM Server application with CLSID
{6B3B8D23-FA8D-40B9-8DBD-B950333E2C52}
 and APPID
{4839DDB7-58C2-48F5-8283-E1D1807D0D7D}
 to the user NT AUTHORITY\LOCAL SERVICE SID (S-1-5-19) from address LocalHost (Using LRPC) running in the application container Unavailable SID (Unavailable). This security permission can be modified using the Component Services administrative tool.

Error: (01/28/2018 10:18:29 AM) (Source: BugCheck) (EventID: 1001) (User: )
Description: The computer has rebooted from a bugcheck.  The bugcheck was: 0x000000d1 (0xffff80805d9ea010, 0x00000000000000ff, 0x0000000000000000, 0xfffff802170e95ae). A dump was saved in: C:\WINDOWS\MEMORY.DMP. Report Id: 66e72bc0-67e9-4135-ae56-a6777a13fce8.

Error: (01/28/2018 10:18:14 AM) (Source: EventLog) (EventID: 6008) (User: )
Description: The previous system shutdown at 10:14:29 on ‎28/‎01/‎2018 was unexpected.

Error: (01/28/2018 10:14:52 AM) (Source: DCOM) (EventID: 10016) (User: NT AUTHORITY)
Description: The application-specific permission settings do not grant Local Activation permission for the COM Server application with CLSID
{6B3B8D23-FA8D-40B9-8DBD-B950333E2C52}
 and APPID
{4839DDB7-58C2-48F5-8283-E1D1807D0D7D}
 to the user NT AUTHORITY\LOCAL SERVICE SID (S-1-5-19) from address LocalHost (Using LRPC) running in the application container Unavailable SID (Unavailable). This security permission can be modified using the Component Services administrative tool.

Error: (01/28/2018 10:14:52 AM) (Source: DCOM) (EventID: 10016) (User: NT AUTHORITY)
Description: The application-specific permission settings do not grant Local Activation permission for the COM Server application with CLSID
{6B3B8D23-FA8D-40B9-8DBD-B950333E2C52}
 and APPID
{4839DDB7-58C2-48F5-8283-E1D1807D0D7D}
 to the user NT AUTHORITY\LOCAL SERVICE SID (S-1-5-19) from address LocalHost (Using LRPC) running in the application container Unavailable SID (Unavailable). This security permission can be modified using the Component Services administrative tool.


CodeIntegrity:
===================================
  Date: 2018-01-25 17:58:04.562
  Description: Code Integrity determined that a process (\Device\HarddiskVolume9\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe) attempted to load \Device\HarddiskVolume9\Program Files\Malwarebytes\Anti-Malware\mbae64.dll that did not meet the Store signing level requirements.

  Date: 2018-01-25 17:58:04.077
  Description: Code Integrity determined that a process (\Device\HarddiskVolume9\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe) attempted to load \Device\HarddiskVolume9\Program Files\Malwarebytes\Anti-Malware\mbae64.dll that did not meet the Store signing level requirements.

  Date: 2018-01-25 17:57:51.686
  Description: Code Integrity determined that a process (\Device\HarddiskVolume9\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe) attempted to load \Device\HarddiskVolume9\Program Files\Malwarebytes\Anti-Malware\mbae64.dll that did not meet the Store signing level requirements.

  Date: 2018-01-25 17:57:51.220
  Description: Code Integrity determined that a process (\Device\HarddiskVolume9\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe) attempted to load \Device\HarddiskVolume9\Program Files\Malwarebytes\Anti-Malware\mbae64.dll that did not meet the Store signing level requirements.


==================== Memory info ===========================

Processor: Intel(R) Core(TM) i5-8250U CPU @ 1.60GHz
Percentage of memory in use: 40%
Total physical RAM: 8108.91 MB
Available physical RAM: 4835.24 MB
Total Virtual: 10028.91 MB
Available Virtual: 6897.72 MB

==================== Drives ================================

Drive c: (SSD) (Fixed) (Total:230.82 GB) (Free:165.92 GB) NTFS
Drive d: (RECOVERY) (Fixed) (Total:14.74 GB) (Free:1.74 GB) NTFS ==>[system with boot components (obtained from drive)]
Drive e: (HDD) (Fixed) (Total:915.54 GB) (Free:914.78 GB) NTFS

==================== MBR & Partition Table ==================

========================================================
Disk: 0 (Size: 931.5 GB) (Disk ID: 01B2999C)

Partition: GPT.

========================================================
Disk: 1 (Size: 232.9 GB) (Disk ID: 01B2999C)

Partition: GPT.

==================== End of Addition.txt ============================

 

St3liz

Post #2
Hi and welcome


Start Farbar Recovery Scan Tool with Administrator privileges
(Right click on the FRST icon and select Run as administrator)

highlight on the text below and select Copy.
beginning with Start:: and finishing with End::


Start::
CloseProcesses:
CreateRestorePoint:
HKLM Group Policy restriction on software: %systemroot%\system32\mrt.exe <==== ATTENTION
SearchScopes: HKLM -> {88ACD6BA-082C-4DD3-92E5-38E8DA05F95C} URL = hxxp://www.amazon.co.uk/s/ref=azs_osd_ieauk?ie=UTF-8&tag=hp-uk1-vsb-21&link%5Fcode=qs&index=aps&field-keywords={searchTerms}
SearchScopes: HKLM-x32 -> {88ACD6BA-082C-4DD3-92E5-38E8DA05F95C} URL = hxxp://www.amazon.co.uk/s/ref=azs_osd_ieauk?ie=UTF-8&tag=hp-uk1-vsb-21&link%5Fcode=qs&index=aps&field-keywords={searchTerms}
SearchScopes: HKU\S-1-5-21-557160917-1767100916-191111700-1001 -> {88ACD6BA-082C-4DD3-92E5-38E8DA05F95C} URL = hxxp://www.amazon.co.uk/s/ref=azs_osd_ieauk?ie=UTF-8&tag=hp-uk1-vsb-21&link%5Fcode=qs&index=aps&field-keywords={searchTerms}
ContextMenuHandlers5: [igfxcui] -> {3AB1675A-CCFF-11D2-8B20-00A0C93CB1F4} => -> No File
Emptytemp:
CMD: ipconfig /flushdns
CMD: netsh winsock reset all
CMD: netsh int ipv4 reset
CMD: netsh int ipv6 reset
CMD: bitsadmin /reset /allusers
End::


Press the Fix button.
If for some reason the tool needs a restart, please make sure you let the system restart normally. After that let the tool complete its run.
When finished FRST will generate a log on the Desktop (Fixlog.txt). Please post it to your reply.

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~`

[external image: RQKuhw1.png]RogueKiller
  • Download the right version of RogueKiller for your Windows version (32 or 64-bit)
  • Once done, move the executable file to your Desktop, right-click on it and select [external image: Spcusrh.png]Run as Administrator (for Windows Vista, 7, 8, 8.1 and 10 users)
  • Click on the Start Scan button in the right panel, which will bring you to another tab, and click on it again (this time it'll be in the bottom right corner)
  • Wait for the scan to complete
  • On completion, the results will be displayed
  • Check every single entry (threat found), and click on the Remove Selected button
  • On completion, the results will be displayed. Click on the Open Report button in the bottom left corner, followed by the Open TXT button (also in the bottom left corner)
  • This will open the report in Notepad. Copy/paste its content in your next reply
~~~~~~~~~~~~~~~~~~~~~~~~~~``
[external image: zcMPezJ.png]AdwCleaner
  • Download AdwCleaner and move it to your Desktop
  • Right-click on AdwCleaner.exe and select [external image: Spcusrh.png]Run as Administrator (for Windows Vista, 7, 8, 8.1 and 10 users)
  • Accept the EULA (I accept), then click on Scan
  • Let the scan complete. Once it's done, make sure that every item listed in the different tabs is checked and click on the Clean button. This will kill all active processes
    🖼Click to load external image (V7SD4El.png)
  • Once the cleaning process is complete, AdwCleaner will ask to restart your computer, do it
  • After the restart, a log will open when logging in. Please copy/paste the content of that log in your next reply
**
Please post
Fixlog.txt
RogueKiller log
AdwCleaner log
Post #3

Hi Juliet,

 

Thanks for helping me out. The logs are posted below.

 

Fix result of Farbar Recovery Scan Tool (x64) Version: 27.01.2018
Ran by [removed] (29-01-2018 18:01:04) Run:1
Running from C:\Users\[removed]\OneDrive\Desktop
[removed] Boot Mode: Normal
==============================================

fixlist content:
*****************
CloseProcesses:
CreateRestorePoint:
HKLM Group Policy restriction on software: %systemroot%\system32\mrt.exe <==== ATTENTION
SearchScopes: HKLM -> {88ACD6BA-082C-4DD3-92E5-38E8DA05F95C} URL = hxxp://www.amazon.co.uk/s/ref=azs_osd_ieauk?ie=UTF-8&tag=hp-uk1-vsb-21&link%5Fcode=qs&index=aps&field-keywords={searchTerms}
SearchScopes: HKLM-x32 -> {88ACD6BA-082C-4DD3-92E5-38E8DA05F95C} URL = hxxp://www.amazon.co.uk/s/ref=azs_osd_ieauk?ie=UTF-8&tag=hp-uk1-vsb-21&link%5Fcode=qs&index=aps&field-keywords={searchTerms}
SearchScopes: HKU\S-1-5-21-557160917-1767100916-191111700-1001 -> {88ACD6BA-082C-4DD3-92E5-38E8DA05F95C} URL = hxxp://www.amazon.co.uk/s/ref=azs_osd_ieauk?ie=UTF-8&tag=hp-uk1-vsb-21&link%5Fcode=qs&index=aps&field-keywords={searchTerms}
ContextMenuHandlers5: [igfxcui] -> {3AB1675A-CCFF-11D2-8B20-00A0C93CB1F4} => -> No File
Emptytemp:
CMD: ipconfig /flushdns
CMD: netsh winsock reset all
CMD: netsh int ipv4 reset
CMD: netsh int ipv6 reset
CMD: bitsadmin /reset /allusers

*****************

Processes closed successfully.
Restore point was successfully created.
HKLM Group Policy restriction on software: %systemroot%\system32\mrt.exe <==== ATTENTION => restored successfully
"HKLM\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{88ACD6BA-082C-4DD3-92E5-38E8DA05F95C}" => removed successfully
HKLM\Software\Classes\CLSID\{88ACD6BA-082C-4DD3-92E5-38E8DA05F95C} => key not found
"HKLM\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\SearchScopes\{88ACD6BA-082C-4DD3-92E5-38E8DA05F95C}" => removed successfully
HKLM\Software\Wow6432Node\Classes\CLSID\{88ACD6BA-082C-4DD3-92E5-38E8DA05F95C} => key not found
"HKU\S-1-5-21-557160917-1767100916-191111700-1001\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{88ACD6BA-082C-4DD3-92E5-38E8DA05F95C}" => removed successfully
HKLM\Software\Classes\CLSID\{88ACD6BA-082C-4DD3-92E5-38E8DA05F95C} => key not found
"HKLM\Software\Classes\Directory\Background\ShellEx\ContextMenuHandlers\igfxcui" => removed successfully
HKLM\Software\Classes\CLSID\{3AB1675A-CCFF-11D2-8B20-00A0C93CB1F4} => key not found

========= ipconfig /flushdns =========


Windows IP Configuration

Successfully flushed the DNS Resolver Cache.

========= End of CMD: =========


========= netsh winsock reset all =========


Sucessfully reset the Winsock Catalog.
You must restart the computer in order to complete the reset.


========= End of CMD: =========


========= netsh int ipv4 reset =========

Resetting Compartment Forwarding, OK!
Resetting Compartment, OK!
Resetting Control Protocol, OK!
Resetting Echo Sequence Request, OK!
Resetting Global, OK!
Resetting Interface, OK!
Resetting Anycast Address, OK!
Resetting Multicast Address, OK!
Resetting Unicast Address, OK!
Resetting Neighbor, OK!
Resetting Path, OK!
Resetting Potential, OK!
Resetting Prefix Policy, OK!
Resetting Proxy Neighbor, OK!
Resetting Route, OK!
Resetting Site Prefix, OK!
Resetting Subinterface, OK!
Resetting Wakeup Pattern, OK!
Resetting Resolve Neighbor, OK!
Resetting , OK!
Resetting , OK!
Resetting , OK!
Resetting , OK!
Resetting , failed.
Access is denied.

Resetting , OK!
Resetting , OK!
Resetting , OK!
Resetting , OK!
Resetting , OK!
Resetting , OK!
Resetting , OK!
Restart the computer to complete this action.


========= End of CMD: =========


========= netsh int ipv6 reset =========

Resetting Compartment Forwarding, OK!
Resetting Compartment, OK!
Resetting Control Protocol, OK!
Resetting Echo Sequence Request, OK!
Resetting Global, OK!
Resetting Interface, OK!
Resetting Anycast Address, OK!
Resetting Multicast Address, OK!
Resetting Unicast Address, OK!
Resetting Neighbor, OK!
Resetting Path, OK!
Resetting Potential, OK!
Resetting Prefix Policy, OK!
Resetting Proxy Neighbor, OK!
Resetting Route, OK!
Resetting Site Prefix, OK!
Resetting Subinterface, OK!
Resetting Wakeup Pattern, OK!
Resetting Resolve Neighbor, OK!
Resetting , OK!
Resetting , OK!
Resetting , OK!
Resetting , OK!
Resetting , failed.
Access is denied.

Resetting , OK!
Resetting , OK!
Resetting , OK!
Resetting , OK!
Resetting , OK!
Resetting , OK!
Resetting , OK!
Restart the computer to complete this action.


========= End of CMD: =========


========= bitsadmin /reset /allusers =========


BITSADMIN version 3.0
BITS administration utility.
(C) Copyright 2000-2006 Microsoft Corp.

BITSAdmin is deprecated and is not guaranteed to be available in future versions of Windows.
Administrative tools for the BITS service are now provided by BITS PowerShell cmdlets.

0 out of 0 jobs canceled.

========= End of CMD: =========


=========== EmptyTemp: ==========

BITS transfer queue => 6053888 B
DOMStore, IE Recovery, AppCache, Feeds Cache, Thumbcache, IconCache => 11578440 B
Java, Flash, Steam htmlcache => 506 B
Windows/system/drivers => 5459157 B
Edge => 13312 B
Chrome => 185381 B
Firefox => 384433320 B
Opera => 0 B

Temp, IE cache, history, cookies, recent:
Default => 0 B
Users => 0 B
ProgramData => 0 B
Public => 0 B
systemprofile => 0 B
systemprofile32 => 0 B
LocalService => 195216 B
NetworkService => 0 B
desen => 17575459 B

RecycleBin => 0 B
EmptyTemp: => 405.8 MB temporary data Removed.

================================


The system needed a reboot.

==== End of Fixlog 18:02:29 ====

 

# AdwCleaner 7.0.7.0 - Logfile created on Mon Jan 29 18:51:09 2018
# Updated on 2018/18/01 by Malwarebytes
# Database: 01-26-2018.4
# Running on Windows 10 Home (X64)
# Mode: scan
# Support: https://www.malwarebytes.com/support

***** [ Services ] *****

No malicious services found.

***** [ Folders ] *****

No malicious folders found.

***** [ Files ] *****

PUP.Optional.Legacy, C:\Users\desen\AppData\Roaming\Mozilla\Firefox\Profiles\m30hujkv.default\invalidprefs.js


***** [ DLL ] *****

No malicious DLLs found.

***** [ WMI ] *****

No malicious WMI found.

***** [ Shortcuts ] *****

No malicious shortcuts found.

***** [ Tasks ] *****

No malicious tasks found.

***** [ Registry ] *****

No malicious registry entries found.

***** [ Firefox (and derivatives) ] *****

No malicious Firefox entries.

***** [ Chromium (and derivatives) ] *****

No malicious Chromium entries.

*************************



########## EOF - C:\AdwCleaner\AdwCleaner[S0].txt ##########

Post #4

# AdwCleaner 7.0.7.0 - Logfile created on Mon Jan 29 18:53:36 2018
# Updated on 2018/18/01 by Malwarebytes
# Running on Windows 10 Home (X64)
# Mode: clean
# Support: https://www.malwarebytes.com/support

***** [ Services ] *****

No malicious services deleted.

***** [ Folders ] *****

No malicious folders deleted.

***** [ Files ] *****

Deleted: C:\Users\desen\AppData\Roaming\Mozilla\Firefox\Profiles\m30hujkv.default\invalidprefs.js


***** [ DLL ] *****

No malicious DLLs cleaned.

***** [ WMI ] *****

No malicious WMI cleaned.

***** [ Shortcuts ] *****

No malicious shortcuts cleaned.

***** [ Tasks ] *****

No malicious tasks deleted.

***** [ Registry ] *****

No malicious registry entries deleted.

***** [ Firefox (and derivatives) ] *****

No malicious Firefox entries deleted.

***** [ Chromium (and derivatives) ] *****

No malicious Chromium entries deleted.

*************************

::Tracing keys deleted
::Winsock settings cleared
::Additional Actions: 0



*************************

C:/AdwCleaner/AdwCleaner[S0].txt - [1031 B] - [2018/1/29 18:51:10]


########## EOF - C:\AdwCleaner\AdwCleaner[C0].txt ##########

Post #5

HI Juliet,

 

I've performed all the actions you have asked.

 

Considering this laptop is only 1 month old and I subscribe to Avast and MBytes are there any more steps I can take to prevent this stuff getting in?

 

My other laptop will need to go through the same process, shall I start another post or tag on to the end of this one, once complete?

 

Thanks

Post #6

HI Juliet,
 
I've performed all the actions you have asked.
 
Considering this laptop is only 1 month old and I subscribe to Avast and MBytes are there any more steps I can take to prevent this stuff getting in?
 
My other laptop will need to go through the same process, shall I start another post or tag on to the end of this one, once complete?
 
Thanks

By chance did you run RogueKiller?

Let's run an online scanner to check for remnants.

[external image: G0tu5D9.png]Emsisoft Emergency Kit
Follow the instructions below to run a scan using the Emsisoft Emergency Kit.
  • Download the Emsisoft Emergency Kit and execute it. From there, click on the Install button to extract the program in the EEK folder;
  • Once the extraction is complete, the EEK folder will open. Right-click on [external image: G0tu5D9.png]start emergency kit scanner.exe and select [external image: Spcusrh.png]Run as Administrator (for Windows Vista, 7, 8, 8.1 and 10 users);
  • EEK will suggest that you run an online update before using the program. Click on Yes to launch it.
  • After the update, click on Malware Scan under 2. Scan and accept to let EEK detect PUPs (click on Yes).
  • Once the scan is complete, make sure that every item in the list is checked, and click on the Quarantine selected button;
  • If it asks you for a reboot to delete some items, click on Ok to reboot automatically;
  • After the restart, open EEK again (in the C:\EEK folder);
  • This time, click on Logs;
  • From there, go under the Quarantine Log tab, and click on the Export button;
  • Save the log on your desktop, then open it, and copy/paste its content in your next reply;
  • created by Aura
After this scan please tell me what the computer is doing now.

~~

Afterwards, I can post information on how to help work at keeping a computer safe online.

The second computer can be worked on here but not until after we have finished the first one.
Post #7

Hi,

 

I did run Roguekiller which found about 7 PUMs which it took care of. I must have lost the log as the laptop rebooted several times during the various scans.

 

The Emsisoft scan didn't find anything.

 

The laptop is running well, no more issues to report.

 

Thanks

Post #8
Let's remove tools and quarantine folders for this one then we can start the next one.

DelFix
  • Please download DelFix or from Here and save the file to your Desktop.
  • Double-click DelFix.exe to run the programme.
  • Place a checkmark next to the following items:
  • Activate UAC
  • Remove disinfection tools
  • Click the Run button.
  • – This will remove the specialized tools we used to disinfect your system.
    Any leftover logs, files, folders or tools remaining on your Desktop which were not removed can be deleted manually (right-click the file + delete    ).
***********

On the next come please

[external image: xlK5Hdb.png]Farbar Recovery Scan Tool (FRST) Scan
  • Please download Farbar Recovery Scan Tool (x32) or Farbar Recovery Scan Tool (x64) and save the file to your Desktop.
  • Note: Download and run the version compatible with your system (32 or 64-bit). Download both if you're unsure; only one will run.
  • Right-Click FRST.exe / FRST64.exe and select [external image: AVOiBNU.jpg]Run as administrator to run the programme.
  • Click Yes to the disclaimer.
  • Ensure the Addition.txt box is checked.
  • Click the Scan button and let the programme run.
  • Upon completion, click OK, then OK on the Addition.txt pop up screen.
  • Two logs (FRST.txt & Addition.txt) will now be open on your Desktop. Copy the contents of both logs and paste in your next reply.

Post #9

OK, here we go with laptop 2.

 

Scan result of Farbar Recovery Scan Tool (FRST) (x64) Version: 27.01.2018
Ran by [removed] (administrator) on DESKTOP-NP808UC (31-01-2018 19:35:11)
Running from C:\Users\[removed]\Desktop
[removed]
Platform: Windows 10 Home Version 1709 16299.192 (X64) Language: English (United Kingdom)
Internet Explorer Version 11 (Default browser: Chrome)
Boot Mode: Normal
Tutorial for Farbar Recovery Scan Tool: http://www.geekstogo.com/forum/topic/335081-frst-tutorial-how-to-use-farbar-recovery-scan-tool/
 
==================== Processes (Whitelisted) =================
 
(If an entry is included in the fixlist, the process will be closed. The file will not be moved.)
 
(Intel Corporation) C:\Windows\System32\igfxCUIService.exe
(Realtek Semiconductor) C:\Program Files\Realtek\Audio\HDA\RtkAudioService64.exe
(AVAST Software) C:\Program Files\AVAST Software\Avast\AvastSvc.exe
(Microsoft Corporation) C:\Windows\System32\wlanext.exe
(AVAST Software) C:\Program Files\AVAST Software\Avast\afwServ.exe
(Hewlett-Packard Development Company, L.P.) C:\Program Files (x86)\Hewlett-Packard\HP System Event\HPWMISVC.exe
() C:\Program Files (x86)\Realtek\REALTEK Bluetooth\BTDevMgr.exe
(Malwarebytes) C:\Program Files\Malwarebytes\Anti-Malware\MBAMService.exe
(Intel Corporation) C:\Windows\SysWOW64\esif_uf.exe
(Digital Wave Ltd.) C:\Program Files (x86)\Common Files\DVDVideoSoft\lib\app_updater.exe
() C:\Program Files\CyberLink\Shared files\RichVideo64.exe
(Synaptics Incorporated) C:\Program Files\Synaptics\SynTP\SynTPEnhService.exe
(AVAST Software) C:\Program Files\AVAST Software\Avast\x64\aswidsagenta.exe
(Microsoft Corporation) C:\Windows\Microsoft.NET\Framework64\v3.0\WPF\PresentationFontCache.exe
(HP Inc.) C:\Program Files (x86)\Hewlett-Packard\HP Support Solutions\HPSupportSolutionsFrameworkService.exe
(HP Inc.) C:\Program Files\HP\HP Touchpoint Analytics Client\TouchpointAnalyticsClientService.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\DAL\jhi_service.exe
(Hewlett-Packard Company) C:\Program Files (x86)\Hewlett-Packard\Shared\hpqwmiex.exe
(Intel Corporation) C:\Windows\SysWOW64\IntelCpHeciSvc.exe
(Malwarebytes) C:\Program Files\Malwarebytes\Anti-Malware\mbamtray.exe
(Intel Corporation) C:\Windows\Temp\DPTF\esif_assist_64.exe
(Synaptics Incorporated) C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
(Realtek Semiconductor) C:\Program Files\Realtek\Audio\HDA\RAVBg64.exe
(Synaptics Incorporated) C:\Program Files\Synaptics\SynTP\SynTPHelper.exe
(Intel Corporation) C:\Windows\System32\igfxEM.exe
(Intel Corporation) C:\Windows\System32\igfxHK.exe
() C:\Program Files\WindowsApps\Microsoft.SkypeApp_12.1803.279.0_x64__kzf8qxf38zg5c\SkypeHost.exe
(Realtek Semiconductor Corporation) C:\Program Files (x86)\Realtek\REALTEK Bluetooth\BTServer.exe
(Microsoft Corporation) C:\Program Files\Windows Defender\MSASCuiL.exe
(Realtek Semiconductor) C:\Program Files\Realtek\Audio\HDA\RtkNGUI64.exe
(© 2015 Microsoft Corporation) C:\Users\Lizbeth\AppData\Local\Microsoft\BingSvc\BingSvc.exe
(AVAST Software) C:\Program Files\AVAST Software\Avast\AvastUI.exe
(Digital Wave Ltd) C:\Program Files (x86)\Common Files\DVDVideoSoft\lib\vidnotifier\vidnotifier.exe
(Skype Technologies S.A.) C:\Program Files (x86)\Skype\Phone\Skype.exe
(Piriform Ltd) C:\Program Files\CCleaner\CCleaner64.exe
(CyberLink Corp.) C:\Program Files (x86)\CyberLink\YouCam6\YouCamService6.exe
(Hewlett-Packard Development Company, L.P.) C:\Program Files (x86)\Hewlett-Packard\HP System Event\HPMSGSVC.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Microsoft Corporation) C:\Windows\System32\dllhost.exe
(Microsoft Corporation) C:\Windows\System32\smartscreen.exe
 
==================== Registry (Whitelisted) ===========================
 
(If an entry is included in the fixlist, the registry item will be restored to default or removed. The file will not be moved.)
 
HKLM\…\Run: [SecurityHealth] => C:\Program Files\Windows Defender\MSASCuiL.exe [630168 2017-09-29] (Microsoft Corporation)
HKLM\…\Run: [RTHDVCPL] => C:\Program Files\Realtek\Audio\HDA\RtkNGUI64.exe [8903176 2016-10-04] (Realtek Semiconductor)
HKLM\…\Run: [BtServer] => C:\Program Files (x86)\REALTEK\Realtek Bluetooth\BTServer.exe [228568 2015-06-25] (Realtek Semiconductor Corporation)
HKLM\…\Run: [AvastUI.exe] => C:\Program Files\AVAST Software\Avast\AvLaunch.exe [246120 2017-12-22] (AVAST Software)
HKLM-x32\…\Run: [HPMessageService] => C:\Program Files (x86)\Hewlett-Packard\HP System Event\HPMSGSVC.exe [654088 2015-02-17] (Hewlett-Packard Development Company, L.P.)
HKLM-x32\…\Run: [PowerDVD14Agent] => C:\Program Files (x86)\CyberLink\PowerDVD14\PowerDVD14Agent.exe [795336 2015-06-22] (CyberLink Corp.)
HKLM Group Policy restriction on software: %systemroot%\system32\mrt.exe <==== ATTENTION
HKU\S-1-5-21-3614098978-3433991885-866869194-1001\…\Run: [BingSvc] => C:\Users\Lizbeth\AppData\Local\Microsoft\BingSvc\BingSvc.exe [144008 2015-11-05] (© 2015 Microsoft Corporation)
HKU\S-1-5-21-3614098978-3433991885-866869194-1001\…\Run: [CCleaner Monitoring] => C:\Program Files\CCleaner\CCleaner64.exe [10021040 2017-10-18] (Piriform Ltd)
HKU\S-1-5-21-3614098978-3433991885-866869194-1001\…\Run: [vidnotifier.exe] => C:\Program Files (x86)\Common Files\DVDVideoSoft\lib\vidnotifier\vidnotifier.exe [1222632 2017-09-25] (Digital Wave Ltd)
HKU\S-1-5-21-3614098978-3433991885-866869194-1001\…\Run: [Skype] => C:\Program Files (x86)\Skype\Phone\Skype.exe [27832264 2017-10-06] (Skype Technologies S.A.)
HKU\S-1-5-21-3614098978-3433991885-866869194-1001\…\MountPoints2: {1e4dd81b-bf15-11e6-9c01-b05adacb21d3} - "F:\HiSuiteDownLoader.exe" 
 
==================== Internet (Whitelisted) ====================
 
(If an item is included in the fixlist, if it is a registry item it will be removed or restored to default.)
 
Tcpip\Parameters: [DhcpNameServer] 192.168.1.1
Tcpip\..\Interfaces\{0804d259-ad09-456d-b5a2-4c1729c34181}: [DhcpNameServer] 192.168.1.1
Tcpip\..\Interfaces\{6d6709d3-d574-4fd2-a307-e799f577c923}: [DhcpNameServer] 192.168.1.1
 
Internet Explorer:
==================
HKU\.DEFAULT\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://hp15-comm.msn.com/?pc=HRTE
HKU\.DEFAULT\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = hxxp://hp15-comm.msn.com/?pc=HRTE
HKU\S-1-5-21-3614098978-3433991885-866869194-1001\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://hp15-comm.msn.com/?pc=HRTE
HKU\S-1-5-21-3614098978-3433991885-866869194-1001\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = hxxp://hp15-comm.msn.com/?pc=HRTE
SearchScopes: HKLM-x32 -> {B1FE2882-2D02-46CE-B347-59DA923BE621} URL = hxxp://www.amazon.co.uk/s/ref=azs_osd_ieauk?ie=UTF-8&tag;=hp-uk1-vsb-21&link;%5Fcode=qs&index;=aps&field-keywords;={searchTerms}
SearchScopes: HKU\S-1-5-21-3614098978-3433991885-866869194-1001 -> {B1FE2882-2D02-46CE-B347-59DA923BE621} URL = hxxp://www.amazon.co.uk/s/ref=azs_osd_ieauk?ie=UTF-8&tag;=hp-uk1-vsb-21&link;%5Fcode=qs&index;=aps&field-keywords;={searchTerms}
BHO-x32: HP Network Check Helper -> {E76FD755-C1BA-4DCB-9F13-99BD91223ADE} -> C:\Program Files (x86)\Hewlett-Packard\HP Support Framework\Resources\HPNetworkCheck\HPNetworkCheckPlugin.dll [2016-07-21] (HP Inc.)
 
Edge: 
======
Edge HomeButtonPage: HKU\S-1-5-21-3614098978-3433991885-866869194-1001 -> hxxp://google.co.uk/
 
FireFox:
========
FF Plugin: @Microsoft.com/NpCtrl,version=1.0 -> c:\Program Files\Microsoft Silverlight\5.1.50907.0\npctrl.dll [2017-05-03] ( Microsoft Corporation)
FF Plugin-x32: @adobe.com/ShockwavePlayer -> C:\WINDOWS\SysWOW64\Adobe\Director\np32dsw_1231201.dll [2017-11-02] (Adobe Systems, Inc.)
FF Plugin-x32: @intel-webapi.intel.com/Intel WebAPI ipt;version=4.0.68 -> C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\IPT\npIntelWebAPIIPT.dll [2015-04-21] (Intel Corporation)
FF Plugin-x32: @intel-webapi.intel.com/Intel WebAPI updater -> C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\IPT\npIntelWebAPIUpdater.dll [2015-04-21] (Intel Corporation)
FF Plugin-x32: @Microsoft.com/NpCtrl,version=1.0 -> c:\Program Files (x86)\Microsoft Silverlight\5.1.50907.0\npctrl.dll [2017-05-03] ( Microsoft Corporation)
FF Plugin-x32: @tools.google.com/Google Update;version=3 -> C:\Program Files (x86)\Google\Update\1.3.33.7\npGoogleUpdate3.dll [2017-11-14] (Google Inc.)
FF Plugin-x32: @tools.google.com/Google Update;version=9 -> C:\Program Files (x86)\Google\Update\1.3.33.7\npGoogleUpdate3.dll [2017-11-14] (Google Inc.)
 
Chrome: 
=======
CHR HomePage: Default -> msn.com/?pc=__PARAM__&ocid;=__PARAM__DHP&osmkt;=en-us
CHR StartupUrls: Default -> "hxxps://www.google.co.uk/"
CHR DefaultSearchURL: Default -> hxxp://www.bing.com/search?FORM=__PARAM__DF&PC;=__PARAM__&q;={searchTerms}
CHR DefaultSearchKeyword: Default -> bing.com
CHR DefaultSuggestURL: Default -> hxxp://www.bing.com/osjson.aspx?FORM=__PARAM__DF&PC;=__PARAM__&query;={searchTerms}
CHR Profile: C:\Users\Lizbeth\AppData\Local\Google\Chrome\User Data\Default [2018-01-31]
CHR Extension: (Docs) - C:\Users\Lizbeth\AppData\Local\Google\Chrome\User Data\Default\Extensions\aohghmighlieiainnegkcijnfilokake [2017-10-12]
CHR Extension: (Google Drive) - C:\Users\Lizbeth\AppData\Local\Google\Chrome\User Data\Default\Extensions\apdfllckaahabafndbhieahigkjlhalf [2016-03-23]
CHR Extension: (YouTube) - C:\Users\Lizbeth\AppData\Local\Google\Chrome\User Data\Default\Extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo [2016-03-23]
CHR Extension: (Avast Passwords) - C:\Users\Lizbeth\AppData\Local\Google\Chrome\User Data\Default\Extensions\emhginjpijfggbofeediiojmdlmlkoik [2018-01-28]
CHR Extension: (Sheets) - C:\Users\Lizbeth\AppData\Local\Google\Chrome\User Data\Default\Extensions\felcaaldnbdncclmgdcncolpebgiejap [2017-10-12]
CHR Extension: (Google Docs Offline) - C:\Users\Lizbeth\AppData\Local\Google\Chrome\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi [2016-03-23]
CHR Extension: (Avast Online Security) - C:\Users\Lizbeth\AppData\Local\Google\Chrome\User Data\Default\Extensions\gomekmidlodglbbmalcneegieacbdmki [2017-10-13]
CHR Extension: (Chrome Web Store Payments) - C:\Users\Lizbeth\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda [2017-08-22]
CHR Extension: (Gmail) - C:\Users\Lizbeth\AppData\Local\Google\Chrome\User Data\Default\Extensions\pjkljhegncpnkpknbcohdijeoejaedia [2016-03-23]
CHR Extension: (Chrome Media Router) - C:\Users\Lizbeth\AppData\Local\Google\Chrome\User Data\Default\Extensions\pkedcjkdefgpdelpbcmbmeomcjbeemfm [2017-12-10]
CHR Profile: C:\Users\Lizbeth\AppData\Local\Google\Chrome\User Data\System Profile [2018-01-15]
CHR HKU\S-1-5-21-3614098978-3433991885-866869194-1001\SOFTWARE\Google\Chrome\Extensions\…\Chrome\Extension: [fcfenmboojpjinhpgggodefccipikbpd] - hxxps://clients2.google.com/service/update2/crx
CHR HKLM-x32\…\Chrome\Extension: [eofcbnmajmjmplflapaojjnihcjkigck] - hxxps://clients2.google.com/service/update2/crx
CHR HKLM-x32\…\Chrome\Extension: [gomekmidlodglbbmalcneegieacbdmki] - C:\Program Files\AVAST Software\Avast\WebRep\Chrome\aswWebRepChrome.crx
 
==================== Services (Whitelisted) ====================
 
(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)
 
R3 aswbIDSAgent; C:\Program Files\AVAST Software\Avast\x64\aswidsagenta.exe [7538536 2017-12-22] (AVAST Software)
R2 avast! Antivirus; C:\Program Files\AVAST Software\Avast\AvastSvc.exe [301168 2017-12-22] (AVAST Software)
R2 avast! Firewall; C:\Program Files\AVAST Software\Avast\afwServ.exe [351552 2017-12-30] (AVAST Software)
R2 BTDevManager; C:\Program Files (x86)\REALTEK\Realtek Bluetooth\BTDevMgr.exe [117976 2015-06-02] ()
R2 DigitalWave.Update.Service; C:\Program Files (x86)\Common Files\DVDVideoSoft\lib\app_updater.exe [440808 2017-09-25] (Digital Wave Ltd.)
R2 esifsvc; C:\WINDOWS\SysWOW64\esif_uf.exe [1385640 2015-07-13] (Intel Corporation)
R2 HPSupportSolutionsFrameworkService; c:\Program Files (x86)\Hewlett-Packard\HP Support Solutions\HPSupportSolutionsFrameworkService.exe [332144 2017-11-21] (HP Inc.)
R2 HPTouchpointAnalyticsService; C:\Program Files\HP\HP Touchpoint Analytics Client\TouchpointAnalyticsClientService.exe [332216 2017-11-23] (HP Inc.)
R2 HPWMISVC; c:\Program Files (x86)\Hewlett-Packard\HP System Event\HPWMISVC.exe [608520 2015-02-17] (Hewlett-Packard Development Company, L.P.)
R2 igfxCUIService2.0.0.0; C:\WINDOWS\system32\igfxCUIService.exe [373720 2017-01-13] (Intel Corporation)
S3 Intel(R) Capability Licensing Service TCP IP Interface; C:\Program Files\Intel\iCLS Client\SocketHeciServer.exe [881152 2015-05-22] (Intel(R) Corporation)
R2 jhi_service; C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\DAL\jhi_service.exe [223008 2015-07-06] (Intel Corporation)
R2 MBAMService; C:\Program Files\Malwarebytes\Anti-Malware\mbamservice.exe [6234056 2017-11-01] (Malwarebytes)
R2 RichVideo64; C:\Program Files\CyberLink\Shared files\RichVideo64.exe [389896 2014-04-14] ()
R2 RtkAudioService; C:\Program Files\Realtek\Audio\HDA\RtkAudioService64.exe [317960 2016-10-04] (Realtek Semiconductor)
R2 SynTPEnhService; C:\Program Files\Synaptics\SynTP\SynTPEnhService.exe [278616 2017-08-18] (Synaptics Incorporated)
S3 WdNisSvc; C:\Program Files\Windows Defender\NisSrv.exe [355304 2017-09-29] (Microsoft Corporation)
S3 WinDefend; C:\Program Files\Windows Defender\MsMpEng.exe [105944 2017-09-29] (Microsoft Corporation)
 
===================== Drivers (Whitelisted) ======================
 
(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)
 
R1 aswArPot; C:\WINDOWS\System32\drivers\aswArPot.sys [185096 2017-12-22] (AVAST Software)
R1 aswbidsdriver; C:\WINDOWS\System32\drivers\aswbidsdrivera.sys [321512 2017-12-22] (AVAST Software)
R0 aswbidsh; C:\WINDOWS\System32\drivers\aswbidsha.sys [199448 2017-12-22] (AVAST Software)
R0 aswblog; C:\WINDOWS\System32\drivers\aswbloga.sys [343768 2017-12-22] (AVAST Software)
R0 aswbuniv; C:\WINDOWS\System32\drivers\aswbuniva.sys [57696 2017-12-22] (AVAST Software)
S3 aswHwid; C:\WINDOWS\System32\drivers\aswHwid.sys [46976 2017-12-22] (AVAST Software)
R1 aswKbd; C:\WINDOWS\system32\drivers\aswKbd.sys [41832 2017-08-31] (AVAST Software)
R2 aswMonFlt; C:\WINDOWS\System32\drivers\aswMonFlt.sys [146648 2018-01-15] (AVAST Software)
R1 aswNetSec; C:\WINDOWS\System32\drivers\aswNetSec.sys [580480 2017-12-30] (AVAST Software)
R1 aswRdr; C:\WINDOWS\System32\drivers\aswRdr2.sys [110336 2017-12-22] (AVAST Software)
R0 aswRvrt; C:\WINDOWS\System32\drivers\aswRvrt.sys [84384 2017-12-22] (AVAST Software)
R1 aswSnx; C:\WINDOWS\System32\drivers\aswSnx.sys [1025176 2017-12-22] (AVAST Software)
R1 aswSP; C:\WINDOWS\System32\drivers\aswSP.sys [457896 2018-01-15] (AVAST Software)
R2 aswStm; C:\WINDOWS\System32\drivers\aswStm.sys [204456 2017-12-22] (AVAST Software)
R0 aswVmm; C:\WINDOWS\System32\drivers\aswVmm.sys [358672 2017-12-22] (AVAST Software)
R3 clwvd6; C:\WINDOWS\system32\DRIVERS\clwvd6.sys [41704 2013-10-29] (CyberLink Corporation)
R3 dptf_cpu; C:\WINDOWS\System32\drivers\dptf_cpu.sys [43512 2015-07-13] (Intel Corporation)
R3 dptf_pch; C:\WINDOWS\System32\drivers\dptf_pch.sys [41976 2015-07-13] (Intel Corporation)
R3 esif_lf; C:\WINDOWS\system32\DRIVERS\esif_lf.sys [251384 2015-07-13] (Intel Corporation)
R1 ESProtectionDriver; C:\WINDOWS\system32\drivers\mbae64.sys [77432 2018-01-28] ()
R2 MBAMChameleon; C:\WINDOWS\System32\Drivers\MbamChameleon.sys [193968 2018-01-28] (Malwarebytes)
R3 MBAMFarflt; C:\WINDOWS\system32\DRIVERS\farflt.sys [110016 2018-01-28] (Malwarebytes)
R3 MBAMProtection; C:\WINDOWS\system32\DRIVERS\mbam.sys [46008 2018-01-28] (Malwarebytes)
R3 MBAMSwissArmy; C:\WINDOWS\System32\Drivers\mbamswissarmy.sys [253880 2018-01-28] (Malwarebytes)
R3 MBAMWebProtection; C:\WINDOWS\system32\DRIVERS\mwac.sys [94144 2018-01-31] (Malwarebytes)
R3 rt640x64; C:\WINDOWS\System32\drivers\rt640x64.sys [895256 2015-06-18] (Realtek )
R3 RtkBtFilter; C:\WINDOWS\system32\DRIVERS\RtkBtfilter.sys [723920 2017-07-20] (Realtek Semiconductor Corporation)
S3 RTSUER; C:\WINDOWS\system32\Drivers\RtsUer.sys [411712 2015-05-21] (Realsil Semiconductor Corporation)
R3 RTWlanE; C:\WINDOWS\System32\drivers\rtwlane.sys [6895984 2017-08-17] (Realtek Semiconductor Corporation )
S3 SmbDrv; C:\WINDOWS\System32\drivers\Smb_driver_AMDASF.sys [33448 2015-07-13] (Synaptics Incorporated)
R3 SmbDrvI; C:\WINDOWS\system32\DRIVERS\Smb_driver_Intel.sys [55384 2017-08-18] (Synaptics Incorporated)
S3 WdBoot; C:\WINDOWS\system32\drivers\WdBoot.sys [44608 2017-09-29] (Microsoft Corporation)
S3 WdFilter; C:\WINDOWS\system32\drivers\WdFilter.sys [309144 2017-09-29] (Microsoft Corporation)
S3 WdNisDrv; C:\WINDOWS\System32\Drivers\WdNisDrv.sys [119192 2017-09-29] (Microsoft Corporation)
R3 WirelessButtonDriver64; C:\WINDOWS\System32\drivers\WirelessButtonDriver64.sys [30368 2017-06-21] (HP)
 
==================== NetSvcs (Whitelisted) ===================
 
(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)
 
 
==================== One Month Created files and folders ========
 
(If an entry is included in the fixlist, the file/folder will be moved.)
 
2018-01-31 19:35 - 2018-01-31 19:36 - 000017887 _____ C:\Users\Lizbeth\Desktop\FRST.txt
2018-01-31 19:32 - 2018-01-31 19:35 - 000000000 ____D C:\FRST
2018-01-31 19:32 - 2018-01-31 19:32 - 002393088 _____ (Farbar) C:\Users\Lizbeth\Downloads\FRST64 (1).exe
2018-01-31 19:32 - 2018-01-31 19:32 - 002393088 _____ (Farbar) C:\Users\Lizbeth\Desktop\FRST64.exe
2018-01-28 13:12 - 2018-01-28 14:52 - 000046008 _____ (Malwarebytes) C:\WINDOWS\system32\Drivers\mbam.sys
2018-01-28 13:12 - 2018-01-28 13:12 - 000193968 _____ (Malwarebytes) C:\WINDOWS\system32\Drivers\MbamChameleon.sys
2018-01-28 12:05 - 2018-01-29 13:25 - 000000000 ____D C:\WINDOWS\Minidump
2018-01-28 12:02 - 2018-01-28 12:02 - 005198336 _____ (AVAST Software) C:\Users\Lizbeth\Downloads\aswMBR.exe
2018-01-28 11:45 - 2018-01-28 11:45 - 000000000 ____D C:\Users\Lizbeth\AppData\Local\AVAST Software
2018-01-28 11:33 - 2017-12-22 16:55 - 000365680 _____ (AVAST Software) C:\WINDOWS\system32\aswBoot.exe
2018-01-15 11:07 - 2018-01-15 11:07 - 000000000 ____D C:\ProgramData\SWCUTemp
2018-01-09 10:49 - 2018-01-01 12:51 - 000059800 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\bam.sys
2018-01-09 10:49 - 2018-01-01 12:48 - 001954048 _____ (Microsoft Corporation) C:\WINDOWS\system32\ntdll.dll
2018-01-09 10:49 - 2018-01-01 12:47 - 000082840 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\volmgr.sys
2018-01-09 10:49 - 2018-01-01 12:46 - 000471960 _____ (Microsoft Corporation) C:\WINDOWS\system32\hal.dll
2018-01-09 10:49 - 2018-01-01 12:45 - 000398744 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\fltMgr.sys
2018-01-09 10:49 - 2018-01-01 12:39 - 000362904 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\pci.sys
2018-01-09 10:49 - 2018-01-01 12:36 - 000166296 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\partmgr.sys
2018-01-09 10:49 - 2018-01-01 12:34 - 007385088 _____ (Microsoft Corporation) C:\WINDOWS\system32\Windows.Media.Protection.PlayReady.dll
2018-01-09 10:49 - 2018-01-01 12:25 - 000147864 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\wcifs.sys
2018-01-09 10:49 - 2018-01-01 11:53 - 001615712 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\ntdll.dll
2018-01-09 10:49 - 2018-01-01 11:45 - 002192624 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\iertutil.dll
2018-01-09 10:49 - 2018-01-01 11:34 - 000703568 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\winhttp.dll
2018-01-09 10:49 - 2018-01-01 11:25 - 002905600 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\win32kfull.sys
2018-01-09 10:49 - 2018-01-01 11:25 - 000344576 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\edgeIso.dll
2018-01-09 10:49 - 2018-01-01 11:24 - 000202240 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\AppxAllUserStore.dll
2018-01-09 10:49 - 2018-01-01 11:20 - 019337216 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\mshtml.dll
2018-01-09 10:49 - 2018-01-01 11:20 - 018917888 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\edgehtml.dll
2018-01-09 10:49 - 2018-01-01 11:19 - 000369152 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\msIso.dll
2018-01-09 10:49 - 2018-01-01 11:19 - 000365568 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\ieproxy.dll
2018-01-09 10:49 - 2018-01-01 11:18 - 000374784 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\FirewallAPI.dll
2018-01-09 10:49 - 2018-01-01 11:18 - 000261632 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\actxprxy.dll
2018-01-09 10:49 - 2018-01-01 11:17 - 000559104 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\jscript9diag.dll
2018-01-09 10:49 - 2018-01-01 11:16 - 003676672 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\jscript9.dll
2018-01-09 10:49 - 2018-01-01 11:16 - 000815616 _____ (Microsoft Corporation) C:\WINDOWS\system32\ieproxy.dll
2018-01-09 10:49 - 2018-01-01 11:16 - 000664576 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\jscript.dll
2018-01-09 10:49 - 2018-01-01 11:16 - 000463360 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\vbscript.dll
2018-01-09 10:49 - 2018-01-01 11:15 - 000588800 _____ (Microsoft Corporation) C:\WINDOWS\system32\actxprxy.dll
2018-01-09 10:49 - 2018-01-01 11:09 - 001487872 _____ (Microsoft Corporation) C:\WINDOWS\system32\audiosrv.dll
2018-01-09 10:49 - 2018-01-01 11:08 - 000424448 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\srv.sys
2018-01-09 10:48 - 2018-01-01 17:15 - 000956416 _____ (Microsoft Corporation) C:\WINDOWS\system32\Spectrum.exe
2018-01-09 10:48 - 2018-01-01 12:54 - 000924648 _____ (Microsoft Corporation) C:\WINDOWS\system32\winresume.exe
2018-01-09 10:48 - 2018-01-01 12:53 - 001090984 _____ (Microsoft Corporation) C:\WINDOWS\system32\winresume.efi
2018-01-09 10:48 - 2018-01-01 12:51 - 001414784 _____ (Microsoft Corporation) C:\WINDOWS\system32\winload.efi
2018-01-09 10:48 - 2018-01-01 12:51 - 001209240 _____ (Microsoft Corporation) C:\WINDOWS\system32\winload.exe
2018-01-09 10:48 - 2018-01-01 12:51 - 001055128 _____ (Microsoft Corporation) C:\WINDOWS\system32\hvax64.exe
2018-01-09 10:48 - 2018-01-01 12:50 - 005905752 _____ (Microsoft Corporation) C:\WINDOWS\system32\StartTileData.dll
2018-01-09 10:48 - 2018-01-01 12:50 - 000780464 _____ (Microsoft Corporation) C:\WINDOWS\system32\fontdrvhost.exe
2018-01-09 10:48 - 2018-01-01 12:50 - 000479912 _____ (Microsoft Corporation) C:\WINDOWS\system32\ucrtbase_enclave.dll
2018-01-09 10:48 - 2018-01-01 12:49 - 008605080 _____ (Microsoft Corporation) C:\WINDOWS\system32\ntoskrnl.exe
2018-01-09 10:48 - 2018-01-01 12:49 - 000319352 _____ (Microsoft Corporation) C:\WINDOWS\system32\wow64.dll
2018-01-09 10:48 - 2018-01-01 12:48 - 007831760 _____ (Microsoft Corporation) C:\WINDOWS\system32\d3d10warp.dll
2018-01-09 10:48 - 2018-01-01 12:48 - 000382360 _____ (Adobe Systems Incorporated) C:\WINDOWS\system32\atmfd.dll
2018-01-09 10:48 - 2018-01-01 12:46 - 002709704 _____ (Microsoft Corporation) C:\WINDOWS\system32\iertutil.dll
2018-01-09 10:48 - 2018-01-01 12:46 - 000898216 _____ (Microsoft Corporation) C:\WINDOWS\system32\CoreMessaging.dll
2018-01-09 10:48 - 2018-01-01 12:45 - 002395032 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\ntfs.sys
2018-01-09 10:48 - 2018-01-01 12:45 - 001277848 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\ndis.sys
2018-01-09 10:48 - 2018-01-01 12:43 - 001173576 _____ (Microsoft Corporation) C:\WINDOWS\system32\rpcrt4.dll
2018-01-09 10:48 - 2018-01-01 12:42 - 000571288 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\spaceport.sys
2018-01-09 10:48 - 2018-01-01 12:42 - 000184984 _____ (Microsoft Corporation) C:\WINDOWS\system32\sspicli.dll
2018-01-09 10:48 - 2018-01-01 12:41 - 007676296 _____ (Microsoft Corporation) C:\WINDOWS\system32\windows.storage.dll
2018-01-09 10:48 - 2018-01-01 12:41 - 000559512 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\storport.sys
2018-01-09 10:48 - 2018-01-01 12:40 - 001206680 _____ (Microsoft Corporation) C:\WINDOWS\system32\hvix64.exe
2018-01-09 10:48 - 2018-01-01 12:39 - 000902416 _____ (Microsoft Corporation) C:\WINDOWS\system32\winhttp.dll
2018-01-09 10:48 - 2018-01-01 12:39 - 000677784 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\cng.sys
2018-01-09 10:48 - 2018-01-01 12:39 - 000129432 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\hvsocket.sys
2018-01-09 10:48 - 2018-01-01 12:38 - 003904808 _____ (Microsoft Corporation) C:\WINDOWS\explorer.exe
2018-01-09 10:48 - 2018-01-01 12:38 - 000519152 _____ (Microsoft Corporation) C:\WINDOWS\system32\SecurityHealthService.exe
2018-01-09 10:48 - 2018-01-01 12:37 - 001426664 _____ (Microsoft Corporation) C:\WINDOWS\system32\AudioEng.dll
2018-01-09 10:48 - 2018-01-01 12:37 - 000461720 _____ (Microsoft Corporation) C:\WINDOWS\system32\wifitask.exe
2018-01-09 10:48 - 2018-01-01 12:36 - 000374032 _____ (Microsoft Corporation) C:\WINDOWS\system32\vac.exe
2018-01-09 10:48 - 2018-01-01 12:35 - 001170008 _____ (Microsoft Corporation) C:\WINDOWS\system32\AudioSes.dll
2018-01-09 10:48 - 2018-01-01 12:34 - 001336344 _____ (Microsoft Corporation) C:\WINDOWS\system32\ole32.dll
2018-01-09 10:48 - 2018-01-01 12:33 - 002773400 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\tcpip.sys
2018-01-09 10:48 - 2018-01-01 12:33 - 000603920 _____ (Microsoft Corporation) C:\WINDOWS\system32\audiodg.exe
2018-01-09 10:48 - 2018-01-01 12:32 - 004481240 _____ (Microsoft Corporation) C:\WINDOWS\system32\mfcore.dll
2018-01-09 10:48 - 2018-01-01 12:27 - 000713624 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\vhdmp.sys
2018-01-09 10:48 - 2018-01-01 12:26 - 000428952 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\rdbss.sys
2018-01-09 10:48 - 2018-01-01 12:25 - 000615768 _____ (Microsoft Corporation) C:\WINDOWS\system32\services.exe
2018-01-09 10:48 - 2018-01-01 12:23 - 021352144 _____ (Microsoft Corporation) C:\WINDOWS\system32\shell32.dll
2018-01-09 10:48 - 2018-01-01 12:06 - 000311192 _____ (Adobe Systems Incorporated) C:\WINDOWS\SysWOW64\atmfd.dll
2018-01-09 10:48 - 2018-01-01 12:03 - 000650328 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\fontdrvhost.exe
2018-01-09 10:48 - 2018-01-01 12:03 - 000123512 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\sspicli.dll
2018-01-09 10:48 - 2018-01-01 11:46 - 003485392 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\explorer.exe
2018-01-09 10:48 - 2018-01-01 11:45 - 006092152 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\windows.storage.dll
2018-01-09 10:48 - 2018-01-01 11:45 - 005615968 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\d3d10warp.dll
2018-01-09 10:48 - 2018-01-01 11:43 - 020286120 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\shell32.dll
2018-01-09 10:48 - 2018-01-01 11:42 - 006479552 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\Windows.Media.Protection.PlayReady.dll
2018-01-09 10:48 - 2018-01-01 11:42 - 004644912 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\mfcore.dll
2018-01-09 10:48 - 2018-01-01 11:42 - 001246432 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\AudioEng.dll
2018-01-09 10:48 - 2018-01-01 11:42 - 001003152 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\ole32.dll
2018-01-09 10:48 - 2018-01-01 11:42 - 000982528 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\AudioSes.dll
2018-01-09 10:48 - 2018-01-01 11:37 - 025247232 _____ (Microsoft Corporation) C:\WINDOWS\system32\edgehtml.dll
2018-01-09 10:48 - 2018-01-01 11:25 - 001008640 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\InstallService.dll
2018-01-09 10:48 - 2018-01-01 11:25 - 000475648 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\ieui.dll
2018-01-09 10:48 - 2018-01-01 11:25 - 000097792 _____ C:\WINDOWS\system32\runexehelper.exe
2018-01-09 10:48 - 2018-01-01 11:24 - 003668480 _____ (Microsoft Corporation) C:\WINDOWS\system32\win32kfull.sys
2018-01-09 10:48 - 2018-01-01 11:23 - 001313792 _____ (Microsoft Corporation) C:\WINDOWS\system32\InstallService.dll
2018-01-09 10:48 - 2018-01-01 11:23 - 000561152 _____ (Microsoft Corporation) C:\WINDOWS\system32\ieui.dll
2018-01-09 10:48 - 2018-01-01 11:23 - 000536576 _____ (Microsoft Corporation) C:\WINDOWS\system32\edgeIso.dll
2018-01-09 10:48 - 2018-01-01 11:23 - 000250368 _____ (Microsoft Corporation) C:\WINDOWS\system32\AppxAllUserStore.dll
2018-01-09 10:48 - 2018-01-01 11:21 - 000192512 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\netvsc.sys
2018-01-09 10:48 - 2018-01-01 11:20 - 000524288 _____ (Microsoft Corporation) C:\WINDOWS\system32\daxexec.dll
2018-01-09 10:48 - 2018-01-01 11:20 - 000204288 _____ (Microsoft Corporation) C:\WINDOWS\system32\provisioningcsp.dll
2018-01-09 10:48 - 2018-01-01 11:19 - 008014848 _____ (Microsoft Corporation) C:\WINDOWS\system32\Windows.Data.Pdf.dll
2018-01-09 10:48 - 2018-01-01 11:19 - 000461312 _____ (Microsoft Corporation) C:\WINDOWS\system32\wlansec.dll
2018-01-09 10:48 - 2018-01-01 11:19 - 000450048 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\TileDataRepository.dll
2018-01-09 10:48 - 2018-01-01 11:19 - 000416768 _____ (Microsoft Corporation) C:\WINDOWS\system32\html.iec
2018-01-09 10:48 - 2018-01-01 11:19 - 000334848 _____ (Microsoft Corporation) C:\WINDOWS\system32\dusmsvc.dll
2018-01-09 10:48 - 2018-01-01 11:19 - 000073216 _____ (Microsoft Corporation) C:\WINDOWS\system32\provtool.exe
2018-01-09 10:48 - 2018-01-01 11:18 - 000699904 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\CPFilters.dll
2018-01-09 10:48 - 2018-01-01 11:18 - 000432640 _____ (Microsoft Corporation) C:\WINDOWS\system32\provengine.dll
2018-01-09 10:48 - 2018-01-01 11:18 - 000431616 _____ (Microsoft Corporation) C:\WINDOWS\system32\msIso.dll
2018-01-09 10:48 - 2018-01-01 11:18 - 000427008 _____ (Microsoft Corporation) C:\WINDOWS\system32\provhandlers.dll
2018-01-09 10:48 - 2018-01-01 11:18 - 000380928 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\EncDec.dll
2018-01-09 10:48 - 2018-01-01 11:17 - 011923968 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\ieframe.dll
2018-01-09 10:48 - 2018-01-01 11:17 - 006564864 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\Windows.Data.Pdf.dll
2018-01-09 10:48 - 2018-01-01 11:17 - 000708096 _____ (Microsoft Corporation) C:\WINDOWS\system32\jscript9diag.dll
2018-01-09 10:48 - 2018-01-01 11:17 - 000616960 _____ (Microsoft Corporation) C:\WINDOWS\system32\Windows.Internal.Bluetooth.dll
2018-01-09 10:48 - 2018-01-01 11:17 - 000568832 _____ (Microsoft Corporation) C:\WINDOWS\system32\TileDataRepository.dll
2018-01-09 10:48 - 2018-01-01 11:17 - 000542208 _____ (Microsoft Corporation) C:\WINDOWS\system32\FirewallAPI.dll
2018-01-09 10:48 - 2018-01-01 11:16 - 005833216 _____ (Microsoft Corporation) C:\WINDOWS\system32\dbgeng.dll
2018-01-09 10:48 - 2018-01-01 11:16 - 004839424 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\dbgeng.dll
2018-01-09 10:48 - 2018-01-01 11:16 - 000812544 _____ (Microsoft Corporation) C:\WINDOWS\system32\bisrv.dll
2018-01-09 10:48 - 2018-01-01 11:16 - 000720896 _____ (Microsoft Corporation) C:\WINDOWS\system32\LogonController.dll
2018-01-09 10:48 - 2018-01-01 11:16 - 000594944 _____ (Microsoft Corporation) C:\WINDOWS\system32\vbscript.dll
2018-01-09 10:48 - 2018-01-01 11:15 - 012687872 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\wmp.dll
2018-01-09 10:48 - 2018-01-01 11:15 - 006029312 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\Chakra.dll
2018-01-09 10:48 - 2018-01-01 11:15 - 002349568 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\InputService.dll
2018-01-09 10:48 - 2018-01-01 11:15 - 000951808 _____ (Microsoft Corporation) C:\WINDOWS\system32\usermgr.dll
2018-01-09 10:48 - 2018-01-01 11:15 - 000434176 _____ (Microsoft Corporation) C:\WINDOWS\system32\EncDec.dll
2018-01-09 10:48 - 2018-01-01 11:14 - 023655936 _____ (Microsoft Corporation) C:\WINDOWS\system32\mshtml.dll
2018-01-09 10:48 - 2018-01-01 11:14 - 002465280 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\dwmcore.dll
2018-01-09 10:48 - 2018-01-01 11:14 - 001495040 _____ (Microsoft Corporation) C:\WINDOWS\system32\AppXDeploymentExtensions.desktop.dll
2018-01-09 10:48 - 2018-01-01 11:14 - 000917504 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\TokenBroker.dll
2018-01-09 10:48 - 2018-01-01 11:14 - 000870912 _____ (Microsoft Corporation) C:\WINDOWS\system32\CPFilters.dll
2018-01-09 10:48 - 2018-01-01 11:13 - 013657600 _____ (Microsoft Corporation) C:\WINDOWS\system32\wmp.dll
2018-01-09 10:48 - 2018-01-01 11:13 - 012830208 _____ (Microsoft Corporation) C:\WINDOWS\system32\ieframe.dll
2018-01-09 10:48 - 2018-01-01 11:13 - 003121664 _____ (Microsoft Corporation) C:\WINDOWS\system32\Microsoft.Bluetooth.Profiles.Gatt.dll
2018-01-09 10:48 - 2018-01-01 11:13 - 002869760 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\wininet.dll
2018-01-09 10:48 - 2018-01-01 11:13 - 001559552 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\urlmon.dll
2018-01-09 10:48 - 2018-01-01 11:12 - 002633216 _____ (Microsoft Corporation) C:\WINDOWS\system32\diagtrack.dll
2018-01-09 10:48 - 2018-01-01 11:12 - 002208768 _____ (Microsoft Corporation) C:\WINDOWS\system32\AppXDeploymentExtensions.onecore.dll
2018-01-09 10:48 - 2018-01-01 11:12 - 001573376 _____ (Microsoft Corporation) C:\WINDOWS\system32\UserDataService.dll
2018-01-09 10:48 - 2018-01-01 11:12 - 001547776 _____ (Microsoft Corporation) C:\WINDOWS\system32\lsasrv.dll
2018-01-09 10:48 - 2018-01-01 11:12 - 001424896 _____ (Microsoft Corporation) C:\WINDOWS\system32\wwansvc.dll
2018-01-09 10:48 - 2018-01-01 11:11 - 008108544 _____ (Microsoft Corporation) C:\WINDOWS\system32\Chakra.dll
2018-01-09 10:48 - 2018-01-01 11:11 - 004748288 _____ (Microsoft Corporation) C:\WINDOWS\system32\jscript9.dll
2018-01-09 10:48 - 2018-01-01 11:11 - 003334144 _____ (Microsoft Corporation) C:\WINDOWS\system32\wininet.dll
2018-01-09 10:48 - 2018-01-01 11:11 - 003165696 _____ (Microsoft Corporation) C:\WINDOWS\system32\AppXDeploymentServer.dll
2018-01-09 10:48 - 2018-01-01 11:11 - 002859520 _____ (Microsoft Corporation) C:\WINDOWS\system32\dwmcore.dll
2018-01-09 10:48 - 2018-01-01 11:11 - 001822208 _____ (Microsoft Corporation) C:\WINDOWS\system32\urlmon.dll
2018-01-09 10:48 - 2018-01-01 11:11 - 001816576 _____ (Microsoft Corporation) C:\WINDOWS\system32\wevtsvc.dll
2018-01-09 10:48 - 2018-01-01 11:11 - 001343488 _____ (Microsoft Corporation) C:\WINDOWS\system32\wifinetworkmanager.dll
2018-01-09 10:48 - 2018-01-01 11:11 - 001231872 _____ (Microsoft Corporation) C:\WINDOWS\system32\TokenBroker.dll
2018-01-09 10:48 - 2018-01-01 11:11 - 000880640 _____ (Microsoft Corporation) C:\WINDOWS\system32\schedsvc.dll
2018-01-09 10:48 - 2018-01-01 11:11 - 000812032 _____ (Microsoft Corporation) C:\WINDOWS\system32\jscript.dll
2018-01-09 10:48 - 2018-01-01 11:11 - 000715776 _____ (Microsoft Corporation) C:\WINDOWS\system32\winlogon.exe
2018-01-09 10:48 - 2018-01-01 11:10 - 003126272 _____ (Microsoft Corporation) C:\WINDOWS\system32\InputService.dll
2018-01-09 10:48 - 2018-01-01 11:09 - 000925184 _____ (Microsoft Corporation) C:\WINDOWS\system32\MPSSVC.dll
2018-01-09 10:48 - 2018-01-01 11:09 - 000666624 _____ (Microsoft Corporation) C:\WINDOWS\system32\DbgModel.dll
2018-01-09 10:48 - 2018-01-01 11:09 - 000599552 _____ (Microsoft Corporation) C:\WINDOWS\system32\Windows.UI.Core.TextInput.dll
2018-01-09 10:48 - 2018-01-01 11:08 - 000963072 _____ (Microsoft Corporation) C:\WINDOWS\system32\StorSvc.dll
2018-01-09 10:48 - 2018-01-01 11:08 - 000726016 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\srv2.sys
2018-01-09 10:48 - 2018-01-01 11:08 - 000685056 _____ (Microsoft Corporation) C:\WINDOWS\system32\AudioEndpointBuilder.dll
2018-01-09 10:48 - 2018-01-01 11:05 - 002510848 _____ (Microsoft Corporation) C:\WINDOWS\system32\ResetEngine.dll
2018-01-09 10:48 - 2018-01-01 11:05 - 001160704 _____ (Microsoft Corporation) C:\WINDOWS\system32\reseteng.dll
2018-01-09 10:47 - 2018-01-01 12:52 - 000066712 _____ (Microsoft Corporation) C:\WINDOWS\system32\iumcrypt.dll
2018-01-09 10:47 - 2018-01-01 12:51 - 000191816 _____ (Microsoft Corporation) C:\WINDOWS\system32\skci.dll
2018-01-09 10:47 - 2018-01-01 12:50 - 000077208 _____ (Microsoft Corporation) C:\WINDOWS\system32\hvloader.dll
2018-01-09 10:47 - 2018-01-01 12:49 - 000599448 _____ (Microsoft Corporation) C:\WINDOWS\system32\securekernel.exe
2018-01-09 10:47 - 2018-01-01 12:49 - 000292376 _____ (Microsoft Corporation) C:\WINDOWS\system32\wscapi.dll
2018-01-09 10:47 - 2018-01-01 12:47 - 000649304 _____ (Microsoft Corporation) C:\WINDOWS\system32\advapi32.dll
2018-01-09 10:47 - 2018-01-01 12:46 - 000733592 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\acpi.sys
2018-01-09 10:47 - 2018-01-01 12:43 - 000367336 _____ (Microsoft Corporation) C:\WINDOWS\system32\Windows.Storage.ApplicationData.dll
2018-01-09 10:47 - 2018-01-01 12:43 - 000062872 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\fsdepends.sys
2018-01-09 10:47 - 2018-01-01 12:42 - 001029016 _____ (Microsoft Corporation) C:\WINDOWS\system32\efscore.dll
2018-01-09 10:47 - 2018-01-01 12:42 - 000494488 _____ (Microsoft Corporation) C:\WINDOWS\system32\pcasvc.dll
2018-01-09 10:47 - 2018-01-01 12:42 - 000109976 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\vmbus.sys
2018-01-09 10:47 - 2018-01-01 12:41 - 000549552 _____ (Microsoft Corporation) C:\WINDOWS\system32\WWanAPI.dll
2018-01-09 10:47 - 2018-01-01 12:39 - 000508264 _____ (Microsoft Corporation) C:\WINDOWS\system32\systemreset.exe
2018-01-09 10:47 - 2018-01-01 12:38 - 000727448 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\fvevol.sys
2018-01-09 10:47 - 2018-01-01 12:38 - 000103320 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\stornvme.sys
2018-01-09 10:47 - 2018-01-01 12:38 - 000038808 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\Diskdump.sys
2018-01-09 10:47 - 2018-01-01 12:36 - 000413888 _____ (Microsoft Corporation) C:\WINDOWS\system32\AUDIOKSE.dll
2018-01-09 10:47 - 2018-01-01 12:36 - 000113560 _____ (Microsoft Corporation) C:\WINDOWS\system32\icfupgd.dll
2018-01-09 10:47 - 2018-01-01 12:36 - 000057752 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\netbios.sys
2018-01-09 10:47 - 2018-01-01 12:35 - 000075160 _____ (Microsoft Corporation) C:\WINDOWS\system32\SecurityHealthProxyStub.dll
2018-01-09 10:47 - 2018-01-01 12:34 - 000260896 _____ (Microsoft Corporation) C:\WINDOWS\system32\mfps.dll
2018-01-09 10:47 - 2018-01-01 12:34 - 000087384 _____ (Microsoft Corporation) C:\WINDOWS\system32\remoteaudioendpoint.dll
2018-01-09 10:47 - 2018-01-01 12:32 - 000617304 _____ (Microsoft Corporation) C:\WINDOWS\system32\TextInputFramework.dll
2018-01-09 10:47 - 2018-01-01 12:27 - 000163736 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\wfplwfs.sys
2018-01-09 10:47 - 2018-01-01 12:26 - 000081304 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\vmbkmcl.sys
2018-01-09 10:47 - 2018-01-01 12:21 - 001103768 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\http.sys
2018-01-09 10:47 - 2018-01-01 12:21 - 000614296 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\afd.sys
2018-01-09 10:47 - 2018-01-01 12:03 - 000777904 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\rpcrt4.dll
2018-01-09 10:47 - 2018-01-01 12:03 - 000566664 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\CoreMessaging.dll
2018-01-09 10:47 - 2018-01-01 11:49 - 000481464 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\advapi32.dll
2018-01-09 10:47 - 2018-01-01 11:49 - 000258808 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\wscapi.dll
2018-01-09 10:47 - 2018-01-01 11:46 - 000289816 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\Windows.Storage.ApplicationData.dll
2018-01-09 10:47 - 2018-01-01 11:45 - 000450928 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\WWanAPI.dll
2018-01-09 10:47 - 2018-01-01 11:42 - 000386424 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\AUDIOKSE.dll
2018-01-09 10:47 - 2018-01-01 11:42 - 000129184 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\mfps.dll
2018-01-09 10:47 - 2018-01-01 11:42 - 000074992 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\remoteaudioendpoint.dll
2018-01-09 10:47 - 2018-01-01 11:24 - 000240640 _____ (Microsoft Corporation) C:\WINDOWS\system32\AboutSettingsHandlers.dll
2018-01-09 10:47 - 2018-01-01 11:24 - 000096256 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\fontsub.dll
2018-01-09 10:47 - 2018-01-01 11:24 - 000038912 _____ (Adobe Systems) C:\WINDOWS\SysWOW64\atmlib.dll
2018-01-09 10:47 - 2018-01-01 11:23 - 000385024 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\cldflt.sys
2018-01-09 10:47 - 2018-01-01 11:23 - 000232960 _____ (Microsoft Corporation) C:\WINDOWS\system32\convertvhd.exe
2018-01-09 10:47 - 2018-01-01 11:23 - 000121344 _____ (Microsoft Corporation) C:\WINDOWS\system32\fontsub.dll
2018-01-09 10:47 - 2018-01-01 11:23 - 000080384 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\vmbkmclr.sys
2018-01-09 10:47 - 2018-01-01 11:23 - 000047104 _____ (Adobe Systems) C:\WINDOWS\system32\atmlib.dll
2018-01-09 10:47 - 2018-01-01 11:22 - 000031744 _____ (Microsoft Corporation) C:\WINDOWS\system32\Windows.Management.Provisioning.ProxyStub.dll
2018-01-09 10:47 - 2018-01-01 11:22 - 000025600 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\Dumpstorport.sys
2018-01-09 10:47 - 2018-01-01 11:22 - 000017408 _____ (Microsoft Corporation) C:\WINDOWS\system32\VmApplicationHealthMonitorProxy.dll
2018-01-09 10:47 - 2018-01-01 11:21 - 000268288 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\dxtrans.dll
2018-01-09 10:47 - 2018-01-01 11:21 - 000233984 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\AppLockerCSP.dll
2018-01-09 10:47 - 2018-01-01 11:21 - 000133632 _____ (Microsoft Corporation) C:\WINDOWS\system32\wificonnapi.dll
2018-01-09 10:47 - 2018-01-01 11:21 - 000097280 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\WcnApi.dll
2018-01-09 10:47 - 2018-01-01 11:21 - 000097280 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\raspptp.sys
2018-01-09 10:47 - 2018-01-01 11:21 - 000080896 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\wanarp.sys
2018-01-09 10:47 - 2018-01-01 11:21 - 000062976 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\ndproxy.sys
2018-01-09 10:47 - 2018-01-01 11:20 - 000459776 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\webplatstorageserver.dll
2018-01-09 10:47 - 2018-01-01 11:20 - 000397824 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\dxtmsft.dll
2018-01-09 10:47 - 2018-01-01 11:20 - 000225792 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\winnat.sys
2018-01-09 10:47 - 2018-01-01 11:20 - 000215552 _____ (Microsoft Corporation) C:\WINDOWS\system32\fwpolicyiomgr.dll
2018-01-09 10:47 - 2018-01-01 11:20 - 000212992 _____ (Microsoft Corporation) C:\WINDOWS\system32\container.dll
2018-01-09 10:47 - 2018-01-01 11:20 - 000186368 _____ (Microsoft Corporation) C:\WINDOWS\system32\ACPBackgroundManagerPolicy.dll
2018-01-09 10:47 - 2018-01-01 11:20 - 000175616 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\fwpolicyiomgr.dll
2018-01-09 10:47 - 2018-01-01 11:20 - 000134656 _____ (Microsoft Corporation) C:\WINDOWS\system32\WcnApi.dll
2018-01-09 10:47 - 2018-01-01 11:20 - 000133632 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\iepeers.dll
2018-01-09 10:47 - 2018-01-01 11:20 - 000104960 _____ (Microsoft Corporation) C:\WINDOWS\system32\rasauto.dll
2018-01-09 10:47 - 2018-01-01 11:20 - 000082432 _____ (Microsoft Corporation) C:\WINDOWS\system32\SCardDlg.dll
2018-01-09 10:47 - 2018-01-01 11:20 - 000043008 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\RfxVmt.sys
2018-01-09 10:47 - 2018-01-01 11:20 - 000035328 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\nshhttp.dll
2018-01-09 10:47 - 2018-01-01 11:19 - 000795136 _____ (Microsoft Corporation) C:\WINDOWS\system32\NaturalAuth.dll
2018-01-09 10:47 - 2018-01-01 11:19 - 000675328 _____ (Microsoft Corporation) C:\WINDOWS\system32\webplatstorageserver.dll
2018-01-09 10:47 - 2018-01-01 11:19 - 000430080 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\Windows.Internal.Bluetooth.dll
2018-01-09 10:47 - 2018-01-01 11:19 - 000366080 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\daxexec.dll
2018-01-09 10:47 - 2018-01-01 11:19 - 000340480 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\html.iec
2018-01-09 10:47 - 2018-01-01 11:19 - 000316928 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\netbt.sys
2018-01-09 10:47 - 2018-01-01 11:19 - 000188416 _____ (Microsoft Corporation) C:\WINDOWS\system32\PimIndexMaintenance.dll
2018-01-09 10:47 - 2018-01-01 11:19 - 000174592 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\P2P.dll
2018-01-09 10:47 - 2018-01-01 11:19 - 000149504 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\container.dll
2018-01-09 10:47 - 2018-01-01 11:19 - 000142848 _____ (Microsoft Corporation) C:\WINDOWS\system32\iepeers.dll
2018-01-09 10:47 - 2018-01-01 11:19 - 000097792 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\msoert2.dll
2018-01-09 10:47 - 2018-01-01 11:19 - 000093696 _____ (Microsoft Corporation) C:\WINDOWS\system32\mshtmled.dll
2018-01-09 10:47 - 2018-01-01 11:19 - 000079872 _____ (Microsoft Corporation) C:\WINDOWS\system32\nlaapi.dll
2018-01-09 10:47 - 2018-01-01 11:19 - 000063488 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\nlaapi.dll
2018-01-09 10:47 - 2018-01-01 11:19 - 000043008 _____ (Microsoft Corporation) C:\WINDOWS\system32\nshhttp.dll
2018-01-09 10:47 - 2018-01-01 11:18 - 000748032 _____ (Microsoft Corporation) C:\WINDOWS\system32\PhoneProviders.dll
2018-01-09 10:47 - 2018-01-01 11:18 - 000588800 _____ (Microsoft Corporation) C:\WINDOWS\system32\SmsRouterSvc.dll
2018-01-09 10:47 - 2018-01-01 11:18 - 000465920 _____ (Microsoft Corporation) C:\WINDOWS\system32\wcncsvc.dll
2018-01-09 10:47 - 2018-01-01 11:18 - 000436224 _____ (Microsoft Corporation) C:\WINDOWS\system32\PsmServiceExtHost.dll
2018-01-09 10:47 - 2018-01-01 11:18 - 000425984 _____ (Microsoft Corporation) C:\WINDOWS\system32\vmrdvcore.dll
2018-01-09 10:47 - 2018-01-01 11:18 - 000391168 _____ (Microsoft Corporation) C:\WINDOWS\system32\iedkcs32.dll
2018-01-09 10:47 - 2018-01-01 11:18 - 000369664 _____ (Microsoft Corporation) C:\WINDOWS\system32\APHostService.dll
2018-01-09 10:47 - 2018-01-01 11:18 - 000343040 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\iedkcs32.dll
2018-01-09 10:47 - 2018-01-01 11:18 - 000336896 _____ (Microsoft Corporation) C:\WINDOWS\system32\AppLockerCSP.dll
2018-01-09 10:47 - 2018-01-01 11:18 - 000276480 _____ (Microsoft Corporation) C:\WINDOWS\system32\dxtrans.dll
2018-01-09 10:47 - 2018-01-01 11:18 - 000259072 _____ (Microsoft Corporation) C:\WINDOWS\system32\SCardSvr.dll
2018-01-09 10:47 - 2018-01-01 11:18 - 000210944 _____ (Microsoft Corporation) C:\WINDOWS\system32\P2P.dll
2018-01-09 10:47 - 2018-01-01 11:18 - 000144896 _____ (Microsoft Corporation) C:\WINDOWS\system32\appinfo.dll
2018-01-09 10:47 - 2018-01-01 11:18 - 000082944 _____ (Microsoft Corporation) C:\WINDOWS\system32\provdatastore.dll
2018-01-09 10:47 - 2018-01-01 11:17 - 001485312 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\rdpserverbase.dll
2018-01-09 10:47 - 2018-01-01 11:17 - 000791552 _____ (Microsoft Corporation) C:\WINDOWS\system32\PhoneService.dll
2018-01-09 10:47 - 2018-01-01 11:17 - 000594432 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\Windows.Security.Authentication.Web.Core.dll
2018-01-09 10:47 - 2018-01-01 11:17 - 000555520 _____ (Microsoft Corporation) C:\WINDOWS\system32\SensorService.dll
2018-01-09 10:47 - 2018-01-01 11:17 - 000456704 _____ (Microsoft Corporation) C:\WINDOWS\system32\dxtmsft.dll
2018-01-09 10:47 - 2018-01-01 11:17 - 000423936 _____ (Microsoft Corporation) C:\WINDOWS\system32\p2psvc.dll
2018-01-09 10:47 - 2018-01-01 11:17 - 000341504 _____ (Microsoft Corporation) C:\WINDOWS\system32\pnrpsvc.dll
2018-01-09 10:47 - 2018-01-01 11:17 - 000228352 _____ (Microsoft Corporation) C:\WINDOWS\system32\ie4uinit.exe
2018-01-09 10:47 - 2018-01-01 11:17 - 000112640 _____ (Microsoft Corporation) C:\WINDOWS\system32\msoert2.dll
2018-01-09 10:47 - 2018-01-01 11:16 - 000966656 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\Unistore.dll
2018-01-09 10:47 - 2018-01-01 11:16 - 000956928 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\rdpbase.dll
2018-01-09 10:47 - 2018-01-01 11:16 - 000831488 _____ (Microsoft Corporation) C:\WINDOWS\system32\Windows.Security.Authentication.Web.Core.dll
2018-01-09 10:47 - 2018-01-01 11:16 - 000668160 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\msfeeds.dll
2018-01-09 10:47 - 2018-01-01 11:16 - 000624128 _____ (Microsoft Corporation) C:\WINDOWS\system32\SyncController.dll
2018-01-09 10:47 - 2018-01-01 11:16 - 000401920 _____ (Microsoft Corporation) C:\WINDOWS\system32\ncsi.dll
2018-01-09 10:47 - 2018-01-01 11:16 - 000235008 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\webcheck.dll
2018-01-09 10:47 - 2018-01-01 11:16 - 000086528 _____ (Microsoft Corporation) C:\WINDOWS\system32\cldapi.dll
2018-01-09 10:47 - 2018-01-01 11:16 - 000076288 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\cldapi.dll
2018-01-09 10:47 - 2018-01-01 11:15 - 001657856 _____ (Microsoft Corporation) C:\WINDOWS\system32\rdpserverbase.dll
2018-01-09 10:47 - 2018-01-01 11:15 - 001245184 _____ (Microsoft Corporation) C:\WINDOWS\system32\Unistore.dll
2018-01-09 10:47 - 2018-01-01 11:15 - 000970240 _____ (Microsoft Corporation) C:\WINDOWS\system32\sysmain.dll
2018-01-09 10:47 - 2018-01-01 11:15 - 000756736 _____ (Microsoft Corporation) C:\WINDOWS\system32\msfeeds.dll
2018-01-09 10:47 - 2018-01-01 11:15 - 000366080 _____ (Microsoft Corporation) C:\WINDOWS\system32\nlasvc.dll
2018-01-09 10:47 - 2018-01-01 11:15 - 000258560 _____ (Microsoft Corporation) C:\WINDOWS\system32\webcheck.dll
2018-01-09 10:47 - 2018-01-01 11:14 - 001097728 _____ (Microsoft Corporation) C:\WINDOWS\system32\rdpbase.dll
2018-01-09 10:47 - 2018-01-01 11:14 - 001003008 _____ (Microsoft Corporation) C:\WINDOWS\system32\modernexecserver.dll
2018-01-09 10:47 - 2018-01-01 11:14 - 000985600 _____ (Microsoft Corporation) C:\WINDOWS\system32\inetcomm.dll
2018-01-09 10:47 - 2018-01-01 11:13 - 002013184 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\inetcpl.cpl
2018-01-09 10:47 - 2018-01-01 11:13 - 001474560 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\ieapfltr.dll
2018-01-09 10:47 - 2018-01-01 11:13 - 000897024 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\inetcomm.dll
2018-01-09 10:47 - 2018-01-01 11:12 - 000760320 _____ (Microsoft Corporation) C:\WINDOWS\system32\spoolsv.exe
2018-01-09 10:47 - 2018-01-01 11:12 - 000464384 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\Windows.UI.Core.TextInput.dll
2018-01-09 10:47 - 2018-01-01 11:11 - 002082304 _____ (Microsoft Corporation) C:\WINDOWS\system32\inetcpl.cpl
2018-01-09 10:47 - 2018-01-01 11:11 - 001597952 _____ (Microsoft Corporation) C:\WINDOWS\system32\ieapfltr.dll
2018-01-09 10:47 - 2018-01-01 11:10 - 002528256 _____ (Microsoft Corporation) C:\WINDOWS\system32\wlansvc.dll
2018-01-09 10:47 - 2018-01-01 11:10 - 000012800 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\wscproxystub.dll
2018-01-09 10:47 - 2018-01-01 11:08 - 000505344 _____ (Microsoft Corporation) C:\WINDOWS\system32\taskcomp.dll
2018-01-09 10:47 - 2018-01-01 11:06 - 000018944 _____ (Microsoft Corporation) C:\WINDOWS\system32\wscproxystub.dll
2018-01-09 10:47 - 2018-01-01 11:05 - 000050176 _____ (Microsoft Corporation) C:\WINDOWS\system32\pcalua.exe
 
==================== One Month Modified files and folders ========
 
(If an entry is included in the fixlist, the file/folder will be moved.)
 
2018-01-31 19:22 - 2016-03-23 17:13 - 000000000 ____D C:\Users\Lizbeth\Documents\YouCam
2018-01-31 19:21 - 2017-06-01 13:32 - 000000180 _____ C:\WINDOWS\system32\{A6D608F0-0BDE-491A-97AE-5C4B05D86E01}.bat
2018-01-31 19:21 - 2016-03-23 18:28 - 000000000 ____D C:\Users\Lizbeth\AppData\Roaming\Skype
2018-01-31 19:21 - 2016-03-23 17:12 - 000000000 __SHD C:\Users\Lizbeth\IntelGraphicsProfiles
2018-01-31 18:16 - 2017-12-02 09:17 - 000094144 _____ (Malwarebytes) C:\WINDOWS\system32\Drivers\mwac.sys
2018-01-31 18:14 - 2017-09-29 13:46 - 000000000 ____D C:\WINDOWS\AppReadiness
2018-01-30 22:31 - 2017-12-28 09:11 - 000003272 _____ C:\WINDOWS\System32\Tasks\HPCeeScheduleForLizbeth
2018-01-30 22:31 - 2017-12-28 09:11 - 000000372 _____ C:\WINDOWS\Tasks\HPCeeScheduleForLizbeth.job
2018-01-30 09:51 - 2017-11-11 11:28 - 000000000 ____D C:\WINDOWS\system32\SleepStudy
2018-01-30 08:44 - 2017-09-29 13:46 - 000000000 ____D C:\WINDOWS\DeliveryOptimization
2018-01-30 08:43 - 2017-09-29 13:46 - 000000000 ___HD C:\Program Files\WindowsApps
2018-01-28 23:20 - 2017-11-11 11:34 - 000000000 ____D C:\Users\Lizbeth
2018-01-28 14:52 - 2017-12-02 09:17 - 000253880 _____ (Malwarebytes) C:\WINDOWS\system32\Drivers\mbamswissarmy.sys
2018-01-28 14:52 - 2017-12-02 09:17 - 000110016 _____ (Malwarebytes) C:\WINDOWS\system32\Drivers\farflt.sys
2018-01-28 14:51 - 2017-11-11 11:54 - 000000006 ____H C:\WINDOWS\Tasks\SA.DAT
2018-01-28 13:11 - 2017-12-02 09:16 - 000077432 _____ C:\WINDOWS\system32\Drivers\mbae64.sys
2018-01-28 12:10 - 2017-09-29 13:46 - 000000000 ____D C:\WINDOWS\LiveKernelReports
2018-01-28 12:10 - 2017-09-29 13:44 - 000000000 ____D C:\WINDOWS\INF
2018-01-28 11:35 - 2017-12-30 13:56 - 000001986 _____ C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Avast Internet Security.lnk
2018-01-28 11:35 - 2017-11-09 18:45 - 000061304 _____ () C:\WINDOWS\system32\Drivers\lpsport.sys
2018-01-28 11:34 - 2017-11-11 11:54 - 000003994 _____ C:\WINDOWS\System32\Tasks\Avast Emergency Update
2018-01-25 18:01 - 2017-11-11 11:54 - 000003380 _____ C:\WINDOWS\System32\Tasks\OneDrive Standalone Update Task-S-1-5-21-3614098978-3433991885-866869194-1001
2018-01-25 18:01 - 2016-03-23 17:15 - 000002376 _____ C:\Users\Lizbeth\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\OneDrive.lnk
2018-01-25 18:01 - 2016-03-23 17:15 - 000000000 ___RD C:\Users\Lizbeth\OneDrive
2018-01-15 11:42 - 2016-03-23 19:53 - 000457896 _____ (AVAST Software) C:\WINDOWS\system32\Drivers\aswSP.sys
2018-01-15 11:42 - 2016-03-23 19:53 - 000146648 _____ (AVAST Software) C:\WINDOWS\system32\Drivers\aswMonFlt.sys
2018-01-15 11:05 - 2017-09-29 08:45 - 000524288 _____ C:\WINDOWS\system32\config\BBI
2018-01-14 09:58 - 2017-09-29 13:46 - 000000000 ____D C:\WINDOWS\rescache
2018-01-10 19:50 - 2016-03-24 18:58 - 000000000 ____D C:\WINDOWS\system32\MRT
2018-01-10 19:47 - 2017-10-11 09:14 - 129365736 ____C (Microsoft Corporation) C:\WINDOWS\system32\MRT-KB890830.exe
2018-01-10 19:47 - 2017-09-29 13:37 - 000000000 ____D C:\WINDOWS\CbsTemp
2018-01-10 19:47 - 2016-03-24 18:58 - 129365736 ____C (Microsoft Corporation) C:\WINDOWS\system32\MRT.exe
2018-01-10 09:57 - 2017-11-11 11:54 - 000004604 _____ C:\WINDOWS\System32\Tasks\Adobe Flash Player PPAPI Notifier
2018-01-10 09:56 - 2017-11-11 11:33 - 001023194 _____ C:\WINDOWS\system32\PerfStringBackup.INI
2018-01-10 09:56 - 2017-09-29 13:46 - 000000000 ____D C:\WINDOWS\SysWOW64\Macromed
2018-01-10 09:56 - 2017-09-29 13:46 - 000000000 ____D C:\WINDOWS\system32\Macromed
2018-01-09 21:06 - 2016-02-13 17:32 - 000000000 __RHD C:\Users\Public\AccountPictures
2018-01-09 21:05 - 2017-11-11 12:00 - 000000000 ___RD C:\Users\Lizbeth\3D Objects
2018-01-09 17:40 - 2017-11-11 11:28 - 000270712 _____ C:\WINDOWS\system32\FNTCACHE.DAT
2018-01-09 17:37 - 2017-09-29 13:46 - 000000000 ___SD C:\WINDOWS\SysWOW64\F12
2018-01-09 17:37 - 2017-09-29 13:46 - 000000000 ___SD C:\WINDOWS\system32\F12
2018-01-09 17:37 - 2017-09-29 13:46 - 000000000 ____D C:\WINDOWS\TextInput
2018-01-09 17:37 - 2017-09-29 13:46 - 000000000 ____D C:\WINDOWS\SysWOW64\Dism
2018-01-09 17:37 - 2017-09-29 13:46 - 000000000 ____D C:\WINDOWS\system32\oobe
2018-01-09 17:37 - 2017-09-29 13:46 - 000000000 ____D C:\WINDOWS\system32\migwiz
2018-01-09 17:37 - 2017-09-29 13:46 - 000000000 ____D C:\WINDOWS\system32\appraiser
2018-01-09 17:37 - 2017-09-29 13:46 - 000000000 ____D C:\WINDOWS\Provisioning
2018-01-09 17:37 - 2017-09-29 08:45 - 000000000 ____D C:\WINDOWS\system32\Dism
2018-01-09 11:55 - 2016-03-23 18:05 - 000002279 _____ C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Google Chrome.lnk
2018-01-09 10:55 - 2017-09-29 13:41 - 000403968 _____ (Microsoft Corporation) C:\WINDOWS\system32\WpAXHolder.dll
2018-01-09 10:54 - 2017-09-29 13:41 - 000140800 _____ (Microsoft Corporation) C:\WINDOWS\system32\Chakradiag.dll
2018-01-09 10:54 - 2017-09-29 13:41 - 000106496 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\Chakradiag.dll
 
==================== Files in the root of some directories =======
 
2016-03-23 17:12 - 2018-01-31 19:21 - 002281856 _____ () C:\Users\Lizbeth\AppData\Local\BTServer.log
 
==================== Bamital & volsnap ======================
 
(There is no automatic fix for files that do not pass verification.)
 
C:\WINDOWS\system32\winlogon.exe => File is digitally signed
C:\WINDOWS\system32\wininit.exe => File is digitally signed
C:\WINDOWS\explorer.exe => File is digitally signed
C:\WINDOWS\SysWOW64\explorer.exe => File is digitally signed
C:\WINDOWS\system32\svchost.exe => File is digitally signed
C:\WINDOWS\SysWOW64\svchost.exe => File is digitally signed
C:\WINDOWS\system32\services.exe => File is digitally signed
C:\WINDOWS\system32\User32.dll => File is digitally signed
C:\WINDOWS\SysWOW64\User32.dll => File is digitally signed
C:\WINDOWS\system32\userinit.exe => File is digitally signed
C:\WINDOWS\SysWOW64\userinit.exe => File is digitally signed
C:\WINDOWS\system32\rpcss.dll => File is digitally signed
C:\WINDOWS\system32\dnsapi.dll => File is digitally signed
C:\WINDOWS\SysWOW64\dnsapi.dll => File is digitally signed
C:\WINDOWS\system32\Drivers\volsnap.sys => File is digitally signed
 
LastRegBack: 2018-01-25 18:30
 
==================== End of FRST.txt ============================
 
Additional scan result of Farbar Recovery Scan Tool (x64) Version: 27.01.2018
Ran by [removed] (31-01-2018 19:37:47)
Running from C:\Users\[removed]\Desktop
Windows 10 Home Version 1709 16299.192 (X64) (2017-11-11 11:59:26)
Boot Mode: Normal
==========================================================
 
 
==================== Accounts: =============================
 
Administrator (S-1-5-21-3614098978-3433991885-866869194-500 - Administrator - Disabled)
DefaultAccount (S-1-5-21-3614098978-3433991885-866869194-503 - Limited - Disabled)
Guest (S-1-5-21-3614098978-3433991885-866869194-501 - Limited - Disabled)
Lizbeth (S-1-5-21-3614098978-3433991885-866869194-1001 - Administrator - Enabled) => C:\Users\Lizbeth
WDAGUtilityAccount (S-1-5-21-3614098978-3433991885-866869194-504 - Limited - Disabled)
 
==================== Security Center ========================
 
(If an entry is included in the fixlist, it will be removed.)
 
AV: Avast Antivirus (Enabled - Up to date) {8EA8924E-BC81-DC44-8BB0-8BAE75D86EBF}
AV: Windows Defender (Disabled - Up to date) {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
AV: Malwarebytes (Enabled - Up to date) {23007AD3-69FE-687C-2629-D584AFFAF72B}
AS: Malwarebytes (Enabled - Up to date) {98619B37-4FC4-67F2-1C99-EEF6D47DBD96}
AS: Windows Defender (Disabled - Up to date) {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
AS: Avast Antivirus (Enabled - Up to date) {35C973AA-9ABB-D3CA-B100-B0DC0E5F2402}
FW: Avast Antivirus (Enabled) {B693136B-F6EE-DD1C-A0EF-229B8B0B29C4}
 
==================== Installed Programs ======================
 
(Only the adware programs with "Hidden" flag could be added to the fixlist to unhide them. The adware programs should be uninstalled manually.)
 
Adobe Flash Player 28 PPAPI (HKLM-x32\…\Adobe Flash Player PPAPI) (Version: 28.0.0.137 - Adobe Systems Incorporated)
Adobe Shockwave Player 12.3 (HKLM-x32\…\Adobe Shockwave Player) (Version: 12.3.1.201 - Adobe Systems, Inc.)
Avast Internet Security (HKLM-x32\…\Avast Antivirus) (Version: 17.9.2322 - AVAST Software)
CCleaner (HKLM\…\CCleaner) (Version: 5.36 - Piriform)
Cisco EAP-FAST Module (HKLM-x32\…\{64BF0187-F3D2-498B-99EA-163AF9AE6EC9}) (Version: 2.2.14 - Cisco Systems, Inc.)
Cisco LEAP Module (HKLM-x32\…\{AF312B06-5C5C-468E-89B3-BE6DE2645722}) (Version: 1.0.19 - Cisco Systems, Inc.)
Cisco PEAP Module (HKLM-x32\…\{0A4EF0E6-A912-4CDE-A7F3-6E56E7C13A2F}) (Version: 1.1.6 - Cisco Systems, Inc.)
CyberLink PhotoDirector (HKLM\…\{5A454EC5-217A-42a5-8CE1-2DDEC4E70E01}) (Version: 5.0.5.6713 - CyberLink Corp.) Hidden
CyberLink PhotoDirector (HKLM-x32\…\InstallShield_{5A454EC5-217A-42a5-8CE1-2DDEC4E70E01}) (Version: 5.0.5.6713 - CyberLink Corp.)
CyberLink Power Media Player 14 (HKLM-x32\…\{32C8E300-BDB4-4398-92C2-E9B7D8A233DB}) (Version: 14.0.1.5418 - CyberLink Corp.)
CyberLink PowerDirector 12 (HKLM\…\{E1646825-D391-42A0-93AA-27FA810DA093}) (Version: 12.0.4.4301 - CyberLink Corp.) Hidden
CyberLink PowerDirector 12 (HKLM-x32\…\InstallShield_{E1646825-D391-42A0-93AA-27FA810DA093}) (Version: 12.0.4.4301 - CyberLink Corp.)
CyberLink YouCam (HKLM-x32\…\{A9CEDD6E-4792-493e-BB35-D86D2E188A5A}) (Version: 6.0.1.4301 - CyberLink Corp.)
DisableMSDefender (HKLM\…\{74FE39A0-FB76-47CD-84BA-91E2BBB17EF2}) (Version: 1.0.0 - Hewlett-Packard Company) Hidden
Discover HP Touchpoint Manager (HKLM-x32\…\{0B100034-B9FF-4F2E-8DF2-EC2E77FB2916}) (Version: 1.0.17.1 - Hewlett-Packard Company)
Energy Star (HKLM\…\{465CA2B6-98AF-4E77-BE22-A908C34BB9EC}) (Version: 1.0.9 - Hewlett-Packard Company)
Free YouTube To MP3 Converter (HKLM-x32\…\Free YouTube To MP3 Converter_is1) (Version: 4.1.59.922 - Digital Wave Ltd)
Google Chrome (HKLM-x32\…\Google Chrome) (Version: 63.0.3239.132 - Google Inc.)
Google Update Helper (HKLM-x32\…\{60EC980A-BDA2-4CB6-A427-B07A5498B4CA}) (Version: 1.3.33.7 - Google Inc.) Hidden
HP Documentation (HKLM\…\HP_Documentation) (Version:  - HP)
HP Registration Service (HKLM\…\{D1E8F2D7-7794-4245-B286-87ED86C1893C}) (Version: 1.2.8293.5264 - Hewlett-Packard)
HP Support Assistant (HKLM-x32\…\{61EB474B-67A6-47F4-B1B7-386851BAB3D0}) (Version: 8.5.37.19 - Hewlett-Packard Company)
HP Support Solutions Framework (HKLM-x32\…\{D7D5F438-26EF-45AB-AB89-C476FBCF8584}) (Version: 12.8.47.1 - Hewlett-Packard Company)
HP System Event Utility (HKLM-x32\…\{D17A3B70-B75E-4C49-83D6-C17DDF65B35F}) (Version: 1.3.4 - Hewlett-Packard Company)
HP Touchpoint Analytics Client (HKLM\…\{E5FB98E0-0784-44F0-8CEC-95CD4690C43F}) (Version: 4.0.2.1439 - HP Inc.)
HP Welcome (HKLM\…\HPWelcome) (Version: 1.0 - Hewlett-Packard Company)
HP Wireless Button Driver (HKLM-x32\…\{EFA01423-3857-468C-B7B6-F30AA08E50BC}) (Version: 1.1.5.1 - Hewlett-Packard)
Intel(R) Chipset Device Software (HKLM-x32\…\{a47edec4-fa11-4d02-b329-4424d0197af8}) (Version: 10.1.1.7 - Intel(R) Corporation) Hidden
Intel(R) Dynamic Platform and Thermal Framework (HKLM-x32\…\{654EE65D-FAA4-4EA6-8C07-DC94E6A304D4}) (Version: 8.1.10600.150 - Intel Corporation)
Intel(R) Management Engine Components (HKLM\…\{1CEAC85D-2590-4760-800F-8DE5E91F3700}) (Version: 11.0.0.1156 - Intel Corporation)
Intel(R) Processor Graphics (HKLM-x32\…\{F0E3AD40-2BBD-4360-9C76-B9AC9A5886EA}) (Version: 20.19.15.4549 - Intel Corporation)
Intel(R) Rapid Storage Technology (HKLM\…\{409CB30E-E457-4008-9B1A-ED1B9EA21140}) (Version: 14.5.2.1088 - Intel Corporation)
Malwarebytes version 3.3.1.2183 (HKLM\…\{35065F43-4BB2-439A-BFF7-0F1014F2E0CD}_is1) (Version: 3.3.1.2183 - Malwarebytes)
Microsoft Office (HKLM-x32\…\{90150000-0138-0409-0000-0000000FF1CE}) (Version: 15.0.4693.1005 - Microsoft Corporation)
Microsoft OneDrive (HKU\S-1-5-21-3614098978-3433991885-866869194-1001\…\OneDriveSetup.exe) (Version: 17.3.7294.0108 - Microsoft Corporation)
Microsoft Silverlight (HKLM\…\{89F4137D-6C26-4A84-BDB8-2E5A4BB71E00}) (Version: 5.1.50907.0 - Microsoft Corporation)
Microsoft Visual C++ 2005 Redistributable (HKLM-x32\…\{710f4c1c-cc18-4c49-8cbf-51240c89a1a2}) (Version: 8.0.61001 - Microsoft Corporation)
Microsoft Visual C++ 2005 Redistributable (HKLM-x32\…\{837b34e3-7c30-493c-8f6a-2b0f04e2912c}) (Version: 8.0.59193 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.17 (HKLM\…\{8220EEFE-38CD-377E-8595-13398D740ACE}) (Version: 9.0.30729 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.4148 (HKLM\…\{4B6C7001-C7D6-3710-913E-5BC23FCE91E6}) (Version: 9.0.30729.4148 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.6161 (HKLM\…\{5FCE6D76-F5DC-37AB-B2B8-22AB8CEDB1D4}) (Version: 9.0.30729.6161 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.4148 (HKLM-x32\…\{1F1C2DFC-2D24-3E06-BCB8-725134ADF989}) (Version: 9.0.30729.4148 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161 (HKLM-x32\…\{9BE518E6-ECC6-35A9-88E4-87755C07200F}) (Version: 9.0.30729.6161 - Microsoft Corporation)
Microsoft Visual C++ 2010  x64 Redistributable - 10.0.40219 (HKLM\…\{1D8E6291-B0D5-35EC-8441-6616F567A0F7}) (Version: 10.0.40219 - Microsoft Corporation)
Microsoft Visual C++ 2010  x86 Redistributable - 10.0.40219 (HKLM-x32\…\{F0C3E5D1-1ADE-321E-8167-68EF0DE699A5}) (Version: 10.0.40219 - Microsoft Corporation)
Microsoft Visual C++ 2012 Redistributable (x64) - 11.0.61030 (HKLM-x32\…\{ca67548a-5ebe-413a-b50c-4b9ceb6d66c6}) (Version: 11.0.61030.0 - Microsoft Corporation)
Microsoft Visual C++ 2012 Redistributable (x86) - 11.0.61030 (HKLM-x32\…\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}) (Version: 11.0.61030.0 - Microsoft Corporation)
Microsoft Visual C++ 2015 Redistributable (x64) - 14.0.23026 (HKLM-x32\…\{e46eca4f-393b-40df-9f49-076faf788d83}) (Version: 14.0.23026.0 - Microsoft Corporation)
Microsoft Visual C++ 2015 Redistributable (x86) - 14.0.24215 (HKLM-x32\…\{e2803110-78b3-4664-a479-3611a381656a}) (Version: 14.0.24215.1 - Microsoft Corporation)
OpenOffice 4.1.2 (HKLM-x32\…\{4E96CB8B-444E-4EA3-8EF4-26060B0B411F}) (Version: 4.12.9782 - Apache Software Foundation)
REALTEK Bluetooth Driver (HKLM-x32\…\{9D3D8C60-A5EF-4123-B2B9-172095903AB}) (Version: 1.0.0.41 - REALTEK Semiconductor Corp.)
Realtek Card Reader (HKLM-x32\…\{5BC2B5AB-80DE-4E83-B8CF-426902051D0A}) (Version: 6.3.9600.31213 - Realtek Semiconductor Corp.)
Realtek Ethernet Controller Driver (HKLM-x32\…\{8833FFB6-5B0C-4764-81AA-06DFEED9A476}) (Version: 10.1.505.2015 - Realtek)
Realtek High Definition Audio Driver (HKLM-x32\…\{F132AF7F-7BCA-4EDE-8A7C-958108FE7DBC}) (Version: 6.0.1.7944 - Realtek Semiconductor Corp.)
REALTEK Wireless LAN Driver (HKLM-x32\…\{A5107464-AA9B-4177-8129-5FF2F42DD322}) (Version: 1.0.0.59 - REALTEK Semiconductor Corp.)
SafeZone Stable 4.58.2552.909 (HKLM-x32\…\SafeZone 4.58.2552.909) (Version: 4.58.2552.909 - Avast Software) Hidden
Skype™ 7.40 (HKLM-x32\…\{3B7E914A-93D5-4A29-92BB-AF8C3F66C431}) (Version: 7.40.151 - Skype Technologies S.A.)
swMSM (HKLM-x32\…\{612C34C7-5E90-47D8-9B5C-0F717DD82726}) (Version: 12.0.0.1 - Adobe Systems, Inc) Hidden
Synaptics Pointing Device Driver (HKLM\…\SynTPDeinstKey) (Version: 19.3.31.31 - Synaptics Incorporated)
 
==================== Custom CLSID (Whitelisted): ==========================
 
(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)
 
ShellIconOverlayIdentifiers: [00asw] -> {472083B0-C522-11CF-8763-00608CC02F24} => C:\Program Files\AVAST Software\Avast\ashShA64.dll [2017-12-22] (AVAST Software)
ShellIconOverlayIdentifiers: [00avast] -> {472083B0-C522-11CF-8763-00608CC02F24} => C:\Program Files\AVAST Software\Avast\ashShA64.dll [2017-12-22] (AVAST Software)
ContextMenuHandlers1: [avast] -> {472083B0-C522-11CF-8763-00608CC02F24} => C:\Program Files\AVAST Software\Avast\ashShA64.dll [2017-12-22] (AVAST Software)
ContextMenuHandlers3: [00asw] -> {472083B0-C522-11CF-8763-00608CC02F24} => C:\Program Files\AVAST Software\Avast\ashShA64.dll [2017-12-22] (AVAST Software)
ContextMenuHandlers3: [MBAMShlExt] -> {57CE581A-0CB6-4266-9CA0-19364C90A0B3} => C:\Program Files\Malwarebytes\Anti-Malware\mbshlext.dll [2017-11-01] (Malwarebytes)
ContextMenuHandlers5: [igfxcui] -> {3AB1675A-CCFF-11D2-8B20-00A0C93CB1F4} =>  -> No File
ContextMenuHandlers5: [igfxDTCM] -> {9B5F5829-A529-4B12-814A-E81BCB8D93FC} => C:\WINDOWS\system32\igfxDTCM.dll [2017-01-13] (Intel Corporation)
ContextMenuHandlers6: [avast] -> {472083B0-C522-11CF-8763-00608CC02F24} => C:\Program Files\AVAST Software\Avast\ashShA64.dll [2017-12-22] (AVAST Software)
ContextMenuHandlers6: [MBAMShlExt] -> {57CE581A-0CB6-4266-9CA0-19364C90A0B3} => C:\Program Files\Malwarebytes\Anti-Malware\mbshlext.dll [2017-11-01] (Malwarebytes)
 
==================== Scheduled Tasks (Whitelisted) =============
 
(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)
 
Task: {02BA0543-0514-48FD-A950-BBAFC05A56DA} - System32\Tasks\CCleaner Update => C:\Program Files\CCleaner\CCUpdate.exe [2017-10-18] (Piriform Ltd)
Task: {1A973C44-5222-4E32-AA3E-41ADC9DD29E0} - System32\Tasks\Hewlett-Packard\HP Support Assistant\HP Support Solutions Framework Updater => C:\Program Files (x86)\Hewlett-Packard\HP Support Solutions\Modules\HPSSFUpdater.exe [2017-09-20] (HP Inc.)
Task: {25CD2177-8CFB-4A85-921A-63C68780B79A} - System32\Tasks\HPCeeScheduleForLizbeth => C:\Program Files (x86)\Hewlett-Packard\HP Ceement\HPCEE.exe [2015-06-16] (Hewlett-Packard)
Task: {2DE3BC5A-E372-4555-B274-81D8E7F7D3D3} - System32\Tasks\Hewlett-Packard\HP Support Assistant\Product Configurator => C:\Program Files (x86)\Hewlett-Packard\HP Support Framework\Resources\ProductConfig.exe [2018-01-10] (HP Inc.)
Task: {3AB04F2E-7A2A-4FAC-AE28-FFD709481C2B} - System32\Tasks\GoogleUpdateTaskMachineCore => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe [2016-03-23] (Google Inc.)
Task: {5489D876-3BA7-4E92-8641-9CB6D60DC496} - System32\Tasks\{5BADB930-F64E-411D-83DC-883F437B5FDD} => "c:\program files (x86)\google\chrome\application\chrome.exe" hxxp://ui.skype.com/ui/0/7.21.0.100/en/abandoninstall?source=lightinstaller&page;=tsMain
Task: {58A9CA01-54FB-4216-A3DB-43271FDDF619} - System32\Tasks\Hewlett-Packard\HP Support Assistant\PC Health Analysis => C:\Program Files (x86)\Hewlett-Packard\HP Support Framework\HPSF.exe [2017-09-27] (HP Inc.)
Task: {77AECE6C-9271-44BA-B8EE-6A48432451A6} - System32\Tasks\SafeZone scheduled Autoupdate 1458763003 => C:\Program Files\AVAST Software\SZBrowser\launcher.exe [2017-08-04] (Avast Software)
Task: {87458707-05BB-4BC5-8014-163842013A9F} - System32\Tasks\Hewlett-Packard\HP Support Assistant\HP Support Assistant Quick Start => C:\Program Files (x86)\Hewlett-Packard\HP Support Framework\HPSF.exe [2017-09-27] (HP Inc.)
Task: {89207AD9-E18B-4DB9-B6D3-41DF5D1F18E0} - System32\Tasks\S-1-5-21-3614098978-3433991885-866869194-1001\DataSenseLiveTileTask => C:\WINDOWS\System32\DataUsageLiveTileTask.exe [2017-09-29] (Microsoft Corporation)
Task: {8C97058D-A6E1-4758-BFA5-B522B369A4B5} - \Microsoft\Windows\UNP\RunCampaignManager -> No File <==== ATTENTION
Task: {9A17954B-0866-4542-AA57-0F5A8ABF7CFE} - System32\Tasks\YCMServiceAgent => C:\Program Files (x86)\CyberLink\YouCam6\YouCamService6.exe [2015-07-01] (CyberLink Corp.)
Task: {9BEE6FA8-BA3E-45B5-BC29-6E367616DCE4} - System32\Tasks\CCleanerSkipUAC => C:\Program Files\CCleaner\CCleaner.exe [2017-10-18] (Piriform Ltd)
Task: {A38BDBE2-A00F-4296-8155-9460F3EDCE95} - System32\Tasks\Avast Emergency Update => C:\Program Files\AVAST Software\Avast\AvEmUpdate.exe [2017-12-22] (AVAST Software)
Task: {ACFF5E68-67FB-48C2-88B5-B25AB07CD6CB} - System32\Tasks\Adobe Flash Player PPAPI Notifier => C:\WINDOWS\SysWOW64\Macromed\Flash\FlashUtil32_28_0_0_137_pepper.exe [2018-01-10] (Adobe Systems Incorporated)
Task: {AD5C4D17-ACCB-449F-B3C2-6E6CADA7AD97} - System32\Tasks\GoogleUpdateTaskMachineUA => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe [2016-03-23] (Google Inc.)
Task: {B2DD807F-34FC-4AB9-91A9-4D33F3A1B644} - System32\Tasks\AVAST Software\Avast settings backup => C:\Program Files\Common Files\AV\avast! Antivirus\backup.exe
Task: {B4A94271-7089-48E8-BFF6-FA06B4E170E0} - System32\Tasks\Avast Software\Overseer => C:\Program Files\Common Files\Avast Software\Overseer\overseer.exe [2018-01-05] (AVAST Software)
Task: {B66B26C3-B632-4C55-95C9-006BD94FDB34} - System32\Tasks\{C3A4B850-69C4-46EE-8997-4B41E090C03B} => "c:\program files (x86)\google\chrome\application\chrome.exe" hxxps://ui.skype.com/ui/0/7.33.0.104/en/abandoninstall?source=lightinstaller&page;=tsMain
Task: {B81F99AC-7D52-4932-8709-EF71DE509CDC} - System32\Tasks\Hewlett-Packard\HP Support Assistant\HP Support Solutions Framework Report => C:\Program Files (x86)\Hewlett-Packard\HP Support Solutions\Modules\HPSFReport.exe [2017-06-22] (HP Inc.)
Task: {D229F740-C02E-4ACA-B022-5859017C855C} - System32\Tasks\Hewlett-Packard\HP Active Health\HP Active Health Scan (HPSA) => C:\Program Files (x86)\Hewlett-Packard\HP Support Framework\Resources\HPActiveHealth\ActiveHealth.exe [2017-11-23] ()
Task: {E37E62A4-BC09-434C-8D6F-29A89428D2DD} - System32\Tasks\Adobe Flash Player Updater => C:\WINDOWS\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe [2018-01-10] (Adobe Systems Incorporated)
 
(If an entry is included in the fixlist, the task (.job) file will be moved. The file which is running by the task will not be moved.)
 
Task: C:\WINDOWS\Tasks\HPCeeScheduleForLizbeth.job => C:\Program Files (x86)\Hewlett-Packard\HP Ceement\HPCEE.exe
 
==================== Shortcuts & WMI ========================
 
(The entries could be listed to be restored or removed.)
 
 
ShortcutWithArgument: C:\Users\Lizbeth\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\User Pinned\TaskBar\AmazonShopping.lnk -> C:\Program Files (x86)\Hewlett-Packard\Shared\WizLink.exe () -> hxxp://www.amazon.co.uk/gp/bit/amazonbookmark.html?tag=hp2-desktop-uk-21&partner;=HP
ShortcutWithArgument: C:\Users\Lizbeth\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\User Pinned\TaskBar\TripAdvisor.lnk -> C:\Program Files (x86)\Hewlett-Packard\Shared\WizLink.exe () -> hxxp://js.redirect.hp.com/jumpstation?bd=all&c;=none&locale;=all&pf;=cmnb&s;=TripAdvisor_iefav&tp;=iefavs
 
==================== Loaded Modules (Whitelisted) ==============
 
2015-09-22 18:40 - 2015-06-02 09:25 - 000117976 _____ () C:\Program Files (x86)\REALTEK\Realtek Bluetooth\BTDevMgr.exe
2017-12-02 09:16 - 2018-01-28 13:11 - 002301384 _____ () C:\PROGRAM FILES\MALWAREBYTES\ANTI-MALWARE\SelfProtectionSdk.dll
2017-12-02 09:16 - 2018-01-28 13:11 - 002358728 _____ () C:\PROGRAM FILES\MALWAREBYTES\ANTI-MALWARE\MwacLib.dll
2015-09-22 19:02 - 2014-04-14 17:59 - 000389896 _____ () C:\Program Files\CyberLink\Shared files\RichVideo64.exe
2017-09-29 13:41 - 2017-09-29 13:41 - 000184432 _____ () C:\WINDOWS\SYSTEM32\inputhost.dll
2017-12-12 21:46 - 2017-11-26 12:23 - 011044864 _____ () C:\Windows\SystemApps\Microsoft.Windows.Cortana_cw5n1h2txyewy\CortanaApi.dll
2017-12-12 21:45 - 2017-11-26 12:01 - 001804288 _____ () C:\Windows\SystemApps\Microsoft.Windows.Cortana_cw5n1h2txyewy\Cortana.Core.dll
2018-01-30 08:42 - 2018-01-30 08:42 - 000086528 _____ () C:\Program Files\WindowsApps\Microsoft.SkypeApp_12.1803.279.0_x64__kzf8qxf38zg5c\SkypeHost.exe
2018-01-30 08:42 - 2018-01-30 08:42 - 000195072 _____ () C:\Program Files\WindowsApps\Microsoft.SkypeApp_12.1803.279.0_x64__kzf8qxf38zg5c\SkypeBackgroundTasks.dll
2018-01-30 08:42 - 2018-01-30 08:43 - 025135104 _____ () C:\Program Files\WindowsApps\Microsoft.SkypeApp_12.1803.279.0_x64__kzf8qxf38zg5c\SkyWrap.dll
2018-01-30 08:42 - 2018-01-30 08:42 - 002542592 _____ () C:\Program Files\WindowsApps\Microsoft.SkypeApp_12.1803.279.0_x64__kzf8qxf38zg5c\skypert.dll
2018-01-30 08:42 - 2018-01-30 08:42 - 000667136 _____ () C:\Program Files\WindowsApps\Microsoft.SkypeApp_12.1803.279.0_x64__kzf8qxf38zg5c\RtmMvrUap.dll
2018-01-09 11:55 - 2018-01-03 09:20 - 004063064 _____ () C:\Program Files (x86)\Google\Chrome\Application\63.0.3239.132\libglesv2.dll
2018-01-09 11:55 - 2018-01-03 09:20 - 000099672 _____ () C:\Program Files (x86)\Google\Chrome\Application\63.0.3239.132\libegl.dll
2017-09-25 13:24 - 2017-09-18 16:05 - 000114664 _____ () C:\Program Files (x86)\Common Files\DVDVideoSoft\lib\zlib1.dll
2017-09-25 13:24 - 2017-09-18 16:05 - 000108008 _____ () C:\Program Files (x86)\Common Files\DVDVideoSoft\lib\boost_filesystem-vc120-mt-1_56.dll
2017-09-25 13:24 - 2017-09-18 16:05 - 000024040 _____ () C:\Program Files (x86)\Common Files\DVDVideoSoft\lib\boost_system-vc120-mt-1_56.dll
2017-09-25 13:24 - 2017-09-18 16:05 - 000048104 _____ () C:\Program Files (x86)\Common Files\DVDVideoSoft\lib\boost_date_time-vc120-mt-1_56.dll
2017-12-22 16:55 - 2017-12-22 16:55 - 000206152 _____ () C:\Program Files\AVAST Software\Avast\JsonRpcServer.dll
2017-12-22 16:55 - 2017-12-22 16:55 - 000058016 _____ () C:\Program Files\AVAST Software\Avast\module_lifetime.dll
2017-12-22 16:55 - 2017-12-22 16:55 - 000057504 _____ () C:\Program Files\AVAST Software\Avast\dll_loader.dll
2017-07-09 19:14 - 2017-07-09 19:14 - 067109376 _____ () C:\Program Files\AVAST Software\Avast\libcef.dll
2017-12-22 16:55 - 2017-12-22 16:55 - 000289272 _____ () C:\Program Files\AVAST Software\Avast\tasks_core.dll
2017-12-22 16:55 - 2017-12-22 16:55 - 000282560 _____ () C:\Program Files\AVAST Software\Avast\gaming_mode_ui.dll
2017-09-25 13:24 - 2017-09-25 11:43 - 000042984 _____ () C:\Program Files (x86)\Common Files\DVDVideoSoft\lib\vidnotifier\jansson.dll
2017-09-26 21:22 - 2017-09-26 21:22 - 001984000 ____R () C:\Program Files (x86)\Skype\Phone\skypert.dll
 
==================== Alternate Data Streams (Whitelisted) =========
 
(If an entry is included in the fixlist, only the ADS will be removed.)
 
 
==================== Safe Mode (Whitelisted) ===================
 
(If an entry is included in the fixlist, it will be removed from the registry. The "AlternateShell" will be restored.)
 
HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\MBAMService => ""="Service"
HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\MBAMService => ""="Service"
 
==================== Association (Whitelisted) ===============
 
(If an entry is included in the fixlist, the registry item will be restored to default or removed.)
 
 
==================== Internet Explorer trusted/restricted ===============
 
(If an entry is included in the fixlist, it will be removed from the registry.)
 
 
==================== Hosts content: ===============================
 
(If needed Hosts: directive could be included in the fixlist to reset Hosts.)
 
2015-07-10 11:04 - 2015-07-10 11:02 - 000000824 _____ C:\WINDOWS\system32\Drivers\etc\hosts
 
 
==================== Other Areas ============================
 
(Currently there is no automatic fix for this section.)
 
HKU\S-1-5-21-3614098978-3433991885-866869194-1001\Control Panel\Desktop\\Wallpaper -> C:\Windows\web\wallpaper\Hewlett-Packard Backgrounds\backgroundDefault.jpg
DNS Servers: 192.168.1.1
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System => (ConsentPromptBehaviorAdmin: 5) (ConsentPromptBehaviorUser: 3) (EnableLUA: 1)
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer => (SmartScreenEnabled: RequireAdmin)
Windows Firewall is enabled.
 
==================== MSCONFIG/TASK MANAGER disabled items ==
 
HKLM\…\StartupApproved\Run: => "BtServer"
HKU\S-1-5-21-3614098978-3433991885-866869194-1001\…\StartupApproved\Run: => "OneDrive"
 
==================== FirewallRules (Whitelisted) ===============
 
(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)
 
FirewallRules: [{0569DA19-560B-4ABD-AC96-A51DCF091502}] => (Allow) C:\Program Files\AVAST Software\SZBrowser\4.58.2552.909_0\SZBrowser.exe
FirewallRules: [{FEB336AB-5978-4AD8-B014-9D9C657CEEFA}] => (Allow) C:\Program Files\AVAST Software\SZBrowser\4.58.2552.909\SZBrowser.exe
FirewallRules: [{D8916EA4-5ADA-4FC6-9368-CB6AD82236AE}] => (Allow) C:\Program Files (x86)\Hewlett-Packard\HP System Event\HPSOCKSVC.exe
FirewallRules: [{A9CD8E63-A4D7-4DD8-838F-423D22CECD40}] => (Allow) C:\Program Files\Bonjour\mDNSResponder.exe
FirewallRules: [{7F5B8AC8-DA8F-49A2-8963-305D745A5A41}] => (Allow) C:\Program Files\Bonjour\mDNSResponder.exe
FirewallRules: [{E4A7B346-7D8B-44B8-9989-0B5E82389501}] => (Allow) C:\Program Files (x86)\Bonjour\mDNSResponder.exe
FirewallRules: [{E74916DB-5FB0-481F-B477-E3ACCE4DE60E}] => (Allow) C:\Program Files (x86)\Bonjour\mDNSResponder.exe
FirewallRules: [{014E9E65-0413-4211-8E09-A421E1B0B52E}] => (Allow) C:\Program Files (x86)\CyberLink\PowerDVD14\PowerDVD.exe
FirewallRules: [{70284AAA-949E-4967-B9A1-274F675A0CB6}] => (Allow) C:\Program Files (x86)\CyberLink\PowerDVD14\Kernel\DMS\CLMSServerPDVD14.exe
FirewallRules: [{DA325F62-A0D8-49A6-BE20-A5C9A133ECB6}] => (Allow) C:\Program Files (x86)\CyberLink\PowerDVD14\PowerDVD14Agent.exe
FirewallRules: [{EE435BD0-8018-48A9-93A3-45EB10EF2EAA}] => (Allow) C:\Program Files (x86)\CyberLink\PowerDVD14\Movie\PowerDVDMovie.exe
FirewallRules: [{6D011E0A-81D9-41D0-AFC4-F4491CFF6766}] => (Allow) C:\Program Files (x86)\CyberLink\PowerDVD14\Movie\PowerDVD Cinema\PowerDVDCinema.exe
FirewallRules: [{666B54EB-60BB-43AA-B144-FEE67EC93173}] => (Allow) c:\Program Files\CyberLink\PowerDirector12\PDR10.EXE
FirewallRules: [{D0E3EF9A-E889-413C-B385-C54C95643390}] => (Allow) C:\Program Files (x86)\Skype\Phone\Skype.exe
FirewallRules: [{1DE3281D-D6BC-42CF-BF4F-9DB05B3BB2C5}] => (Allow) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
 
==================== Restore Points =========================
 
09-01-2018 10:46:01 Windows Update
20-01-2018 16:24:02 Scheduled Checkpoint
 
==================== Faulty Device Manager Devices =============
 
 
==================== Event log errors: =========================
 
Application errors:
==================
Error: (01/31/2018 07:21:46 PM) (Source: Application Error) (EventID: 1000) (User: )
Description: Faulting application name: PowerDVD14Agent.exe, version: 14.0.1.5418, time stamp: 0x55823d4f
Faulting module name: EvoParser.dll_unloaded, version: 1.2.0.7602, time stamp: 0x551d0eff
Exception code: 0xc0000005
Fault offset: 0x00022fee
Faulting process ID: 0x2a90
Faulting application start time: 0x01d39ac8b8b7c027
Faulting application path: C:\Program Files (x86)\CyberLink\PowerDVD14\PowerDVD14Agent.exe
Faulting module path: EvoParser.dll
Report ID: dae6853e-170a-4857-84bb-48394199f129
Faulting package full name: 
Faulting package-relative application ID:
 
Error: (01/31/2018 07:20:59 PM) (Source: DPTF) (EventID: 256) (User: )
Description: Intel(R) Dynamic Platform and Thermal Framework : ESIF(8.1.10600.150) TYPE: ERROR
 
DPTF Build Version:  8.1.10600.150
DPTF Build Date:  Jun 26 2015 11:46:12
Source File:  ..\..\..\Sources\Manager\EsifApplicationInterface.cpp @ line 737
Executing Function:  DptfEvent
Message:  Received unexpected event
Framework Event:  DptfResume [3]
 
Error: (01/31/2018 06:16:54 PM) (Source: Perflib) (EventID: 1008) (User: )
Description: The Open Procedure for service "BITS" in DLL "C:\Windows\System32\bitsperf.dll" failed. Performance data for this service will not be available. The first four bytes (DWORD) of the Data section contains the error code.
 
Error: (01/31/2018 06:11:06 PM) (Source: DPTF) (EventID: 256) (User: )
Description: Intel(R) Dynamic Platform and Thermal Framework : ESIF(8.1.10600.150) TYPE: ERROR
 
DPTF Build Version:  8.1.10600.150
DPTF Build Date:  Jun 26 2015 11:46:12
Source File:  ..\..\..\Sources\Manager\EsifApplicationInterface.cpp @ line 737
Executing Function:  DptfEvent
Message:  Received unexpected event
Framework Event:  DptfResume [3]
 
Error: (01/30/2018 09:29:17 PM) (Source: DPTF) (EventID: 256) (User: )
Description: Intel(R) Dynamic Platform and Thermal Framework : ESIF(8.1.10600.150) TYPE: ERROR
 
DPTF Build Version:  8.1.10600.150
DPTF Build Date:  Jun 26 2015 11:46:12
Source File:  ..\..\..\Sources\Manager\EsifApplicationInterface.cpp @ line 737
Executing Function:  DptfEvent
Message:  Received unexpected event
Framework Event:  DptfResume [3]
 
Error: (01/30/2018 11:21:36 AM) (Source: DPTF) (EventID: 256) (User: )
Description: Intel(R) Dynamic Platform and Thermal Framework : ESIF(8.1.10600.150) TYPE: ERROR
 
DPTF Build Version:  8.1.10600.150
DPTF Build Date:  Jun 26 2015 11:46:12
Source File:  ..\..\..\Sources\Manager\EsifApplicationInterface.cpp @ line 737
Executing Function:  DptfEvent
Message:  Received unexpected event
Framework Event:  DptfResume [3]
 
Error: (01/30/2018 09:51:48 AM) (Source: DPTF) (EventID: 256) (User: )
Description: Intel(R) Dynamic Platform and Thermal Framework : ESIF(8.1.10600.150) TYPE: ERROR
 
DPTF Build Version:  8.1.10600.150
DPTF Build Date:  Jun 26 2015 11:46:12
Source File:  ..\..\..\Sources\Manager\EsifApplicationInterface.cpp @ line 737
Executing Function:  DptfEvent
Message:  Received unexpected event
Framework Event:  DptfResume [3]
 
Error: (01/30/2018 09:08:59 AM) (Source: DPTF) (EventID: 256) (User: )
Description: Intel(R) Dynamic Platform and Thermal Framework : ESIF(8.1.10600.150) TYPE: ERROR
 
DPTF Build Version:  8.1.10600.150
DPTF Build Date:  Jun 26 2015 11:46:12
Source File:  ..\..\..\Sources\Manager\EsifApplicationInterface.cpp @ line 737
Executing Function:  DptfEvent
Message:  Received unexpected event
Framework Event:  DptfResume [3]
 
Error: (01/30/2018 09:02:44 AM) (Source: DPTF) (EventID: 256) (User: )
Description: Intel(R) Dynamic Platform and Thermal Framework : ESIF(8.1.10600.150) TYPE: ERROR
 
DPTF Build Version:  8.1.10600.150
DPTF Build Date:  Jun 26 2015 11:46:12
Source File:  ..\..\..\Sources\Manager\EsifApplicationInterface.cpp @ line 737
Executing Function:  DptfEvent
Message:  Received unexpected event
Framework Event:  DptfResume [3]
 
Error: (01/30/2018 08:41:17 AM) (Source: Perflib) (EventID: 1008) (User: )
Description: The Open Procedure for service "BITS" in DLL "C:\Windows\System32\bitsperf.dll" failed. Performance data for this service will not be available. The first four bytes (DWORD) of the Data section contains the error code.
 
 
System errors:
=============
Error: (01/31/2018 07:36:10 PM) (Source: DCOM) (EventID: 10016) (User: NT AUTHORITY)
Description: The application-specific permission settings do not grant Local Activation permission for the COM Server application with CLSID 
{D63B10C5-BB46-4990-A94F-E40B9D520160}
 and APPID 
{9CA88EE3-ACB7-47C8-AFC4-AB702511C276}
 to the user NT AUTHORITY\LOCAL SERVICE SID (S-1-5-19) from address LocalHost (Using LRPC) running in the application container Unavailable SID (Unavailable). This security permission can be modified using the Component Services administrative tool.
 
Error: (01/31/2018 07:25:26 PM) (Source: DCOM) (EventID: 10016) (User: DESKTOP-NP808UC)
Description: The application-specific permission settings do not grant Local Activation permission for the COM Server application with CLSID 
{D63B10C5-BB46-4990-A94F-E40B9D520160}
 and APPID 
{9CA88EE3-ACB7-47C8-AFC4-AB702511C276}
 to the user DESKTOP-NP808UC\Lizbeth SID (S-1-5-21-3614098978-3433991885-866869194-1001) from address LocalHost (Using LRPC) running in the application container Unavailable SID (Unavailable). This security permission can be modified using the Component Services administrative tool.
 
Error: (01/31/2018 07:21:50 PM) (Source: DCOM) (EventID: 10016) (User: NT AUTHORITY)
Description: The application-specific permission settings do not grant Local Activation permission for the COM Server application with CLSID 
{D63B10C5-BB46-4990-A94F-E40B9D520160}
 and APPID 
{9CA88EE3-ACB7-47C8-AFC4-AB702511C276}
 to the user NT AUTHORITY\LOCAL SERVICE SID (S-1-5-19) from address LocalHost (Using LRPC) running in the application container Unavailable SID (Unavailable). This security permission can be modified using the Component Services administrative tool.
 
Error: (01/31/2018 07:21:08 PM) (Source: DCOM) (EventID: 10016) (User: NT AUTHORITY)
Description: The application-specific permission settings do not grant Local Activation permission for the COM Server application with CLSID 
{6B3B8D23-FA8D-40B9-8DBD-B950333E2C52}
 and APPID 
{4839DDB7-58C2-48F5-8283-E1D1807D0D7D}
 to the user NT AUTHORITY\LOCAL SERVICE SID (S-1-5-19) from address LocalHost (Using LRPC) running in the application container Unavailable SID (Unavailable). This security permission can be modified using the Component Services administrative tool.
 
Error: (01/31/2018 07:21:08 PM) (Source: DCOM) (EventID: 10016) (User: NT AUTHORITY)
Description: The application-specific permission settings do not grant Local Activation permission for the COM Server application with CLSID 
{6B3B8D23-FA8D-40B9-8DBD-B950333E2C52}
 and APPID 
{4839DDB7-58C2-48F5-8283-E1D1807D0D7D}
 to the user NT AUTHORITY\LOCAL SERVICE SID (S-1-5-19) from address LocalHost (Using LRPC) running in the application container Unavailable SID (Unavailable). This security permission can be modified using the Component Services administrative tool.
 
Error: (01/31/2018 07:21:08 PM) (Source: DCOM) (EventID: 10016) (User: NT AUTHORITY)
Description: The application-specific permission settings do not grant Local Activation permission for the COM Server application with CLSID 
{6B3B8D23-FA8D-40B9-8DBD-B950333E2C52}
 and APPID 
{4839DDB7-58C2-48F5-8283-E1D1807D0D7D}
 to the user NT AUTHORITY\LOCAL SERVICE SID (S-1-5-19) from address LocalHost (Using LRPC) running in the application container Unavailable SID (Unavailable). This security permission can be modified using the Component Services administrative tool.
 
Error: (01/31/2018 07:21:08 PM) (Source: DCOM) (EventID: 10016) (User: NT AUTHORITY)
Description: The application-specific permission settings do not grant Local Activation permission for the COM Server application with CLSID 
{6B3B8D23-FA8D-40B9-8DBD-B950333E2C52}
 and APPID 
{4839DDB7-58C2-48F5-8283-E1D1807D0D7D}
 to the user NT AUTHORITY\LOCAL SERVICE SID (S-1-5-19) from address LocalHost (Using LRPC) running in the application container Unavailable SID (Unavailable). This security permission can be modified using the Component Services administrative tool.
 
Error: (01/31/2018 06:26:16 PM) (Source: DCOM) (EventID: 10016) (User: NT AUTHORITY)
Description: The application-specific permission settings do not grant Local Activation permission for the COM Server application with CLSID 
{D63B10C5-BB46-4990-A94F-E40B9D520160}
 and APPID 
{9CA88EE3-ACB7-47C8-AFC4-AB702511C276}
 to the user NT AUTHORITY\LOCAL SERVICE SID (S-1-5-19) from address LocalHost (Using LRPC) running in the application container Unavailable SID (Unavailable). This security permission can be modified using the Component Services administrative tool.
 
Error: (01/31/2018 06:15:11 PM) (Source: DCOM) (EventID: 10016) (User: DESKTOP-NP808UC)
Description: The application-specific permission settings do not grant Local Activation permission for the COM Server application with CLSID 
{D63B10C5-BB46-4990-A94F-E40B9D520160}
 and APPID 
{9CA88EE3-ACB7-47C8-AFC4-AB702511C276}
 to the user DESKTOP-NP808UC\Lizbeth SID (S-1-5-21-3614098978-3433991885-866869194-1001) from address LocalHost (Using LRPC) running in the application container Unavailable SID (Unavailable). This security permission can be modified using the Component Services administrative tool.
 
Error: (01/31/2018 06:14:09 PM) (Source: DCOM) (EventID: 10016) (User: NT AUTHORITY)
Description: The application-specific permission settings do not grant Local Activation permission for the COM Server application with CLSID 
{D63B10C5-BB46-4990-A94F-E40B9D520160}
 and APPID 
{9CA88EE3-ACB7-47C8-AFC4-AB702511C276}
 to the user NT AUTHORITY\LOCAL SERVICE SID (S-1-5-19) from address LocalHost (Using LRPC) running in the application container Unavailable SID (Unavailable). This security permission can be modified using the Component Services administrative tool.
 
 
CodeIntegrity:
===================================
  Date: 2018-01-28 13:12:13.276
  Description: Code Integrity determined that a process (\Device\HarddiskVolume3\Program Files (x86)\Google\Chrome\Application\chrome.exe) attempted to load \Device\HarddiskVolume3\Program Files\Malwarebytes\Anti-Malware\mbae64.dll that did not meet the Microsoft signing level requirements.
 
  Date: 2018-01-17 18:55:46.675
  Description: Code Integrity determined that a process (\Device\HarddiskVolume3\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe) attempted to load \Device\HarddiskVolume3\Program Files\Malwarebytes\Anti-Malware\mbae64.dll that did not meet the Store signing level requirements.
 
  Date: 2018-01-17 18:55:34.649
  Description: Code Integrity determined that a process (\Device\HarddiskVolume3\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe) attempted to load \Device\HarddiskVolume3\Program Files\Malwarebytes\Anti-Malware\mbae64.dll that did not meet the Store signing level requirements.
 
  Date: 2018-01-17 18:55:33.839
  Description: Code Integrity determined that a process (\Device\HarddiskVolume3\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe) attempted to load \Device\HarddiskVolume3\Program Files\Malwarebytes\Anti-Malware\mbae64.dll that did not meet the Store signing level requirements.
 
  Date: 2018-01-17 18:55:33.535
  Description: Code Integrity determined that a process (\Device\HarddiskVolume3\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe) attempted to load \Device\HarddiskVolume3\Program Files\Malwarebytes\Anti-Malware\mbae64.dll that did not meet the Store signing level requirements.
 
  Date: 2018-01-17 18:55:33.239
  Description: Code Integrity determined that a process (\Device\HarddiskVolume3\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe) attempted to load \Device\HarddiskVolume3\Program Files\Malwarebytes\Anti-Malware\mbae64.dll that did not meet the Store signing level requirements.
 
  Date: 2018-01-17 18:55:01.267
  Description: Code Integrity determined that a process (\Device\HarddiskVolume3\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe) attempted to load \Device\HarddiskVolume3\Program Files\Malwarebytes\Anti-Malware\mbae64.dll that did not meet the Store signing level requirements.
 
  Date: 2018-01-17 18:54:26.700
  Description: Code Integrity determined that a process (\Device\HarddiskVolume3\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe) attempted to load \Device\HarddiskVolume3\Program Files\Malwarebytes\Anti-Malware\mbae64.dll that did not meet the Store signing level requirements.
 
  Date: 2018-01-17 18:54:21.641
  Description: Code Integrity determined that a process (\Device\HarddiskVolume3\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe) attempted to load \Device\HarddiskVolume3\Program Files\Malwarebytes\Anti-Malware\mbae64.dll that did not meet the Store signing level requirements.
 
  Date: 2018-01-17 18:54:21.311
  Description: Code Integrity determined that a process (\Device\HarddiskVolume3\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe) attempted to load \Device\HarddiskVolume3\Program Files\Malwarebytes\Anti-Malware\mbae64.dll that did not meet the Store signing level requirements.
 
 
==================== Memory info =========================== 
 
Processor: Intel(R) Core(TM) i5-5200U CPU @ 2.20GHz
Percentage of memory in use: 64%
Total physical RAM: 4011.39 MB
Available physical RAM: 1426.93 MB
Total Virtual: 8107.39 MB
Available Virtual: 5121.21 MB
 
==================== Drives ================================
 
Drive c: (Windows) (Fixed) (Total:450.3 GB) (Free:391.84 GB) NTFS
Drive d: (RECOVERY) (Fixed) (Total:13.39 GB) (Free:1.6 GB) NTFS ==>[system with boot components (obtained from drive)]
 
==================== MBR & Partition Table ==================
 
========================================================
Disk: 0 (Size: 465.8 GB) (Disk ID: 8318CDD9)
 
Partition: GPT.
 
==================== End of Addition.txt ============================
Post #10
Start Farbar Recovery Scan Tool with Administrator privileges
(Right click on the FRST icon and select Run as administrator)

highlight on the text below and select Copy.
beginning with Start:: and finishing with End::


Start::
CloseProcesses:
CreateRestorePoint:
HKLM Group Policy restriction on software: %systemroot%\system32\mrt.exe <==== ATTENTION
ContextMenuHandlers5: [igfxcui] -> {3AB1675A-CCFF-11D2-8B20-00A0C93CB1F4} => -> No File
Task: {8C97058D-A6E1-4758-BFA5-B522B369A4B5} - \Microsoft\Windows\UNP\RunCampaignManager -> No File <==== ATTENTION
ShortcutWithArgument: C:\Users\Lizbeth\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\User Pinned\TaskBar\AmazonShopping.lnk -> C:\Program Files (x86)\Hewlett-Packard\Shared\WizLink.exe () -> hxxp://www.amazon.co.uk/gp/bit/amazonbookmark.html?tag=hp2-desktop-uk-21&partner=HP
ShortcutWithArgument: C:\Users\Lizbeth\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\User Pinned\TaskBar\TripAdvisor.lnk -> C:\Program Files (x86)\Hewlett-Packard\Shared\WizLink.exe () -> hxxp://js.redirect.hp.com/jumpstation?bd=all&c=none&locale=all&pf=cmnb&s=TripAdvisor_iefav&tp=iefavs
CMD: ipconfig /flushdns
CMD: netsh winsock reset catalog
CMD: Bitsadmin /Reset /Allusers
Hosts:
Emptytemp:
End::


Press the Fix button.
If for some reason the tool needs a restart, please make sure you let the system restart normally. After that let the tool complete its run.
When finished FRST will generate a log on the Desktop (Fixlog.txt). Please post it to your reply.

******

[external image: zcMPezJ.png]AdwCleaner
  • Download AdwCleaner and move it to your Desktop
  • Right-click on AdwCleaner.exe and select [external image: Spcusrh.png]Run as Administrator (for Windows Vista, 7, 8, 8.1 and 10 users)
  • Accept the EULA (I accept), then click on Scan
  • Let the scan complete. Once it's done, make sure that every item listed in the different tabs is checked and click on the Clean button. This will kill all active processes
    🖼Click to load external image (V7SD4El.png)
  • Once the cleaning process is complete, AdwCleaner will ask to restart your computer, do it
  • After the restart, a log will open when logging in. Please copy/paste the content of that log in your next reply
created by Aura

~~

[external image: RQKuhw1.png]RogueKiller
  • Download the right version of RogueKiller for your Windows version (32 or 64-bit)
  • Once done, move the executable file to your Desktop, right-click on it and select [external image: Spcusrh.png]Run as Administrator (for Windows Vista, 7, 8, 8.1 and 10 users)
  • Click on the Start Scan button in the right panel, which will bring you to another tab, and click on it again (this time it'll be in the bottom right corner)
  • Wait for the scan to complete
  • On completion, the results will be displayed
  • Check every single entry (threat found), and click on the Remove Selected button
  • On completion, the results will be displayed. Click on the Open Report button in the bottom left corner, followed by the Open TXT button (also in the bottom left corner)
  • This will open the report in Notepad. Copy/paste its content in your next reply
created by Aura
~~

please post
Fixlog.txt
AdwCleaner log
RogueKiller log
Post #11

Hi Juliet,

 

Sorry for the delay. Scan reports below. Adware didn't find anything.

 

Fix result of Farbar Recovery Scan Tool (x64) Version: 27.01.2018
Ran by [removed] (02-02-2018 16:22:09) Run:1
Running from C:\Users\[removed]\Desktop
[removed]
Boot Mode: Normal
==============================================
 
fixlist content:
*****************
CloseProcesses:
CreateRestorePoint:
HKLM Group Policy restriction on software: %systemroot%\system32\mrt.exe <==== ATTENTION
ContextMenuHandlers5: [igfxcui] -> {3AB1675A-CCFF-11D2-8B20-00A0C93CB1F4} => -> No File
Task: {8C97058D-A6E1-4758-BFA5-B522B369A4B5} - \Microsoft\Windows\UNP\RunCampaignManager -> No File <==== ATTENTION
ShortcutWithArgument: C:\Users\Lizbeth\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\User Pinned\TaskBar\AmazonShopping.lnk -> C:\Program Files (x86)\Hewlett-Packard\Shared\WizLink.exe () -> hxxp://www.amazon.co.uk/gp/bit/amazonbookmark.html?tag=hp2-desktop-uk-21&partner=HP
ShortcutWithArgument: C:\Users\Lizbeth\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\User Pinned\TaskBar\TripAdvisor.lnk -> C:\Program Files (x86)\Hewlett-Packard\Shared\WizLink.exe () -> hxxp://js.redirect.hp.com/jumpstation?bd=all&c=none&locale=all&pf=cmnb&s=TripAdvisor_iefav&tp=iefavs
CMD: ipconfig /flushdns
CMD: netsh winsock reset catalog
CMD: Bitsadmin /Reset /Allusers
Hosts:
Emptytemp:
 
*****************
 
Processes closed successfully.
Restore point was successfully created.
HKLM Group Policy restriction on software: %systemroot%\system32\mrt.exe <==== ATTENTION => restored successfully
"HKLM\Software\Classes\Directory\Background\ShellEx\ContextMenuHandlers\igfxcui" => removed successfully
HKLM\Software\Classes\CLSID\{3AB1675A-CCFF-11D2-8B20-00A0C93CB1F4} => key not found
HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Plain\{8C97058D-A6E1-4758-BFA5-B522B369A4B5} => could not remove key. ErrorCode1: 0x00000002
"HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\{8C97058D-A6E1-4758-BFA5-B522B369A4B5}" => removed successfully
HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tree\Microsoft\Windows\UNP\RunCampaignManager => key not found
C:\Users\Lizbeth\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\User Pinned\TaskBar\AmazonShopping.lnk => Shortcut argument removed successfully
C:\Users\Lizbeth\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\User Pinned\TaskBar\TripAdvisor.lnk => Shortcut argument removed successfully
 
========= ipconfig /flushdns =========
 
 
Windows IP Configuration
 
Successfully flushed the DNS Resolver Cache.
 
========= End of CMD: =========
 
 
========= netsh winsock reset catalog =========
 
 
Sucessfully reset the Winsock Catalog.
You must restart the computer in order to complete the reset.
 
 
========= End of CMD: =========
 
 
========= Bitsadmin /Reset /Allusers =========
 
 
BITSADMIN version 3.0
BITS administration utility.
(C) Copyright 2000-2006 Microsoft Corp.
 
BITSAdmin is deprecated and is not guaranteed to be available in future versions of Windows.
Administrative tools for the BITS service are now provided by BITS PowerShell cmdlets.
 
0 out of 0 jobs canceled.
 
========= End of CMD: =========
 
C:\Windows\System32\Drivers\etc\hosts => moved successfully
Hosts restored successfully.
 
=========== EmptyTemp: ==========
 
BITS transfer queue => 9199616 B
DOMStore, IE Recovery, AppCache, Feeds Cache, Thumbcache, IconCache => 34448982 B
Java, Flash, Steam htmlcache => 1302 B
Windows/system/drivers => 134906 B
Edge => 127791 B
Chrome => 483724625 B
Firefox => 0 B
Opera => 0 B
 
Temp, IE cache, history, cookies, recent:
Default => 0 B
Users => 0 B
ProgramData => 0 B
Public => 0 B
systemprofile => 0 B
systemprofile32 => 0 B
LocalService => 0 B
NetworkService => 0 B
Lizbeth => 11984544 B
 
RecycleBin => 0 B
EmptyTemp: => 514.6 MB temporary data Removed.
 
================================
 
 
The system needed a reboot.
 
==== End of Fixlog 16:24:38 ====
 
RogueKiller V12.12.2.0 (x64) [Jan 29 2018] (Free) by Adlice Software
 
Operating System : Windows 10 (10.0.16299) 64 bits version
Started in : Normal mode
User : Lizbeth [Administrator]
Started from : C:\Users\Lizbeth\Desktop\RogueKiller_portable64.exe
Mode : Delete – Date : 02/02/2018 17:08:37 (Duration : 00:35:34)
 
¤¤¤ Processes : 0 ¤¤¤
 
¤¤¤ Registry : 0 ¤¤¤
 
¤¤¤ Tasks : 2 ¤¤¤
[Hj.Shortcut] \{5BADB930-F64E-411D-83DC-883F437B5FDD} – "c:\program files (x86)\google\chrome\application\chrome.exe" (http://ui.skype.com/ui/0/7.21.0.100/en/abandoninstall?source=lightinstaller&page=tsMain) -> Deleted
[Hj.Shortcut] \{C3A4B850-69C4-46EE-8997-4B41E090C03B} – "c:\program files (x86)\google\chrome\application\chrome.exe" (https://ui.skype.com/ui/0/7.33.0.104/en/abandoninstall?source=lightinstaller&page=tsMain) -> Deleted
 
¤¤¤ Files : 0 ¤¤¤
 
¤¤¤ WMI : 0 ¤¤¤
 
¤¤¤ Hosts File : 0 ¤¤¤
 
¤¤¤ Antirootkit : 0 (Driver: Loaded) ¤¤¤
 
¤¤¤ Web browsers : 0 ¤¤¤
 
¤¤¤ MBR Check : ¤¤¤
+++++ PhysicalDrive0: WDC WD5000LPVX-60V0TT0 +++++
— User —
[MBR] ad1fdbac9e7ce234335da86167aaccf7
[BSP] 9de4a53e5d8726bd0d143ce03d6bf623 : Empty MBR Code
Partition table:
0 - [MAN-MOUNT] EFI system partition | Offset (sectors): 2048 | Size: 260 MB
1 - [MAN-MOUNT] Microsoft reserved partition | Offset (sectors): 534528 | Size: 128 MB
2 - Basic data partition | Offset (sectors): 796672 | Size: 461105 MB
3 - [SYSTEM][MAN-MOUNT]  | Offset (sectors): 945141760 | Size: 1728 MB
4 - [SYSTEM] Basic data partition | Offset (sectors): 948680704 | Size: 13714 MB
User = LL1 … OK
User = LL2 … OK
 
Post #12
Let's follow through with an online to check for remnants.

[external image: G0tu5D9.png]Emsisoft Emergency Kit
Follow the instructions below to run a scan using the Emsisoft Emergency Kit.
  • Download the Emsisoft Emergency Kit and execute it. From there, click on the Install button to extract the program in the EEK folder;
  • Once the extraction is complete, the EEK folder will open. Right-click on [external image: G0tu5D9.png]start emergency kit scanner.exe and select [external image: Spcusrh.png]Run as Administrator (for Windows Vista, 7, 8, 8.1 and 10 users);
  • EEK will suggest that you run an online update before using the program. Click on Yes to launch it.
  • After the update, click on Malware Scan under 2. Scan and accept to let EEK detect PUPs (click on Yes).
  • Once the scan is complete, make sure that every item in the list is checked, and click on the Quarantine selected button;
  • If it asks you for a reboot to delete some items, click on Ok to reboot automatically;
  • After the restart, open EEK again (in the C:\EEK folder);
  • This time, click on Logs;
  • From there, go under the Quarantine Log tab, and click on the Export button;
  • Save the log on your desktop, then open it, and copy/paste its content in your next reply;
created by Aura

Post this log when finished and give me an update on what the computer is doing now.

Ask AI

AI can make mistakes. Check the cited posts. Archived advice can be out-of-date

Don't include personal information. Questions and selected public posts go to OpenAI. About Ask AI