What the Tech?! Free tech support Archive
This is a read-only archive. No new posts or registrations. Privacy Page
Spyware / Malware / Virus Removal

Hijackthis HELP

7 min read

This thread's last reply is from . Advice, software, and links below may be out of date — treat specific steps and download links with caution.

Looking for the outcome? Ask AI

Post #1

hello i ran the program hijackthis and came up with a log. i dont want to mess with each entry as im semi clueless as to which log, if any, are infected. i searched the web and found this website and was wondering if anyone could reachout and give me alittle advice.

 

i cant upload files prob some sort of permission i don't have but i can paste the log. Thanks in advance!

 

 

Logfile of Trend Micro HijackThis v2.0.5
Scan saved at 12:56:13 AM, on 4/18/2018
Platform: Windows 7 SP1 (WinNT 6.00.3505)
MSIE: Internet Explorer v11.0 (11.00.9600.18978)


Boot mode: Normal

Running processes:
C:\Program Files (x86)\NVIDIA Corporation\Update Core\NvBackend.exe
C:\Users\Aaron\AppData\Roaming\uTorrent\uTorrent.exe
C:\Program Files (x86)\Spybot - Search & Destroy\TeaTimer.exe
C:\Users\Aaron\AppData\Roaming\uTorrent\updates\3.5.3_44396\utorrentie.exe
C:\Users\Aaron\AppData\Roaming\uTorrent\updates\3.5.3_44396\utorrentie.exe
C:\Program Files\AVAST Software\Avast\AvastUI.exe
C:\Program Files\AVAST Software\Avast\AvastUI.exe
C:\Program Files\AVAST Software\Avast\AvastUI.exe
C:\Users\Aaron\Desktop\HijackThis.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = https://us.search.yahoo.com/yhs/web?hspart=iry&hsimp=yhs-fullyhosted_003&type=wbf_frswfs_17_27¶m1=1¶m2=f%3D1%26b%3DIE%26cc%3Dus%26pa%3Dwincy%26cd%3D2XzuyEtN2Y1L1QzutDtDtDyCyE0FyDyDyCtCyDyBtB0C0DtAtN0D0Tzu0StBtDtCtBtN1L2XzutAtFtBzytFtAtFzztAtN1L1Czu1TtN1L1G1B1V1N2Y1L1Qzu2SyEtDtC0DyEyCyByCtGtC0F0E0AtG0DyB0AzztGyE0E0FzztG0Azy0A0CyByB0CtDzzyEyCtD2QtN1M1F1B2Z1V1N2Y1L1Qzu2S0AtC0C0FtCtC0ByEtGtCzy0CyDtGyEtBtCyDtG0A0AtA0EtGzy0EyB0EyCtBtAtB0EzzyDtA2QtN0A0LzuyE%26cr%3D226074261%26a%3Dwbf_frswfs_17_27%26os_ver%3D6.1%26os%3DWindows%2B7%2BUltimate
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/p/?LinkId=255141
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = https://us.search.yahoo.com/yhs/web?hspart=iry&hsimp=yhs-fullyhosted_003&type=wbf_frswfs_17_27¶m1=1¶m2=f%3D1%26b%3DIE%26cc%3Dus%26pa%3Dwincy%26cd%3D2XzuyEtN2Y1L1QzutDtDtDyCyE0FyDyDyCtCyDyBtB0C0DtAtN0D0Tzu0StBtDtCtBtN1L2XzutAtFtBzytFtAtFzztAtN1L1Czu1TtN1L1G1B1V1N2Y1L1Qzu2SyEtDtC0DyEyCyByCtGtC0F0E0AtG0DyB0AzztGyE0E0FzztG0Azy0A0CyByB0CtDzzyEyCtD2QtN1M1F1B2Z1V1N2Y1L1Qzu2S0AtC0C0FtCtC0ByEtGtCzy0CyDtGyEtBtCyDtG0A0AtA0EtGzy0EyB0EyCtBtAtB0EzzyDtA2QtN0A0LzuyE%26cr%3D226074261%26a%3Dwbf_frswfs_17_27%26os_ver%3D6.1%26os%3DWindows%2B7%2BUltimate
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant =
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch =
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Local Page = C:\Windows\SysWOW64\blank.htm
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName =
F2 - REG:system.ini: UserInit=userinit.exe
O2 - BHO: AcroIEHelperStub - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll
O2 - BHO: Spybot-S&D IE Protection - {53707962-6F74-2D53-2644-206D7942484F} - C:\Program Files (x86)\Spybot - Search & Destroy\SDHelper.dll
O2 - BHO: avast! Online Security - {8E5E2654-AD2D-48bf-AC2D-D17F00898D06} - C:\Program Files\AVAST Software\Avast\aswWebRepIE.dll
O4 - HKLM\..\RunOnce: [Remete] C:\Windows\SysWOW64\wscript.exe /E:vbscript /B "C:\Users\Aaron\AppData\Roaming\Fapanugo"
O4 - HKCU\..\Run: [PeerBlock] C:\Program Files\PeerBlock\peerblock.exe
O4 - HKCU\..\Run: [uTorrent] "C:\Users\Aaron\AppData\Roaming\uTorrent\uTorrent.exe"  /MINIMIZED
O4 - HKCU\..\Run: [SpybotSD TeaTimer] C:\Program Files (x86)\Spybot - Search & Destroy\TeaTimer.exe
O4 - HKCU\..\Run: [DAEMON Tools Lite] "C:\Program Files\DAEMON Tools Lite\DTLite.exe" -autorun
O4 - HKUS\S-1-5-18\..\RunOnce: [SPReview] "C:\Windows\System32\SPReview\SPReview.exe" /sp:1 /errorfwlink:"http://go.microsoft.com/fwlink/?LinkID=122915"/build:7601 (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\RunOnce: [SPReview] "C:\Windows\System32\SPReview\SPReview.exe" /sp:1 /errorfwlink:"http://go.microsoft.com/fwlink/?LinkID=122915"/build:7601 (User 'Default user')
O4 - Startup: GIGABYTE AORUS GRAPHICS ENGINE.lnk = C:\Program Files (x86)\GIGABYTE\AORUS GRAPHICS ENGINE\autorun.exe
O4 - Startup: GRAPHICS ENGINE.lnk = C:\Program Files (x86)\GIGABYTE\AORUS GRAPHICS ENGINE\autorun.exe
O9 - Extra button: (no name) - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\Program Files (x86)\Spybot - Search & Destroy\SDHelper.dll
O9 - Extra 'Tools' menuitem: Spybot - Search && Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\Program Files (x86)\Spybot - Search & Destroy\SDHelper.dll
O11 - Options group: [ACCELERATED_GRAPHICS] Accelerated graphics
O15 - Trusted Zone: http://*.webcompanion.com
O23 - Service: @%SystemRoot%\system32\Alg.exe,-112 (ALG) - Unknown owner - C:\Windows\System32\alg.exe (file missing)
O23 - Service: aswbIDSAgent - AVAST Software - C:\Program Files\AVAST Software\Avast\x64\aswidsagenta.exe
O23 - Service: Avast Antivirus (avast! Antivirus) - AVAST Software - C:\Program Files\AVAST Software\Avast\AvastSvc.exe
O23 - Service: Disc Soft Lite Bus Service - Disc Soft Ltd - C:\Program Files\DAEMON Tools Lite\DiscSoftBusService.exe
O23 - Service: @%SystemRoot%\system32\efssvc.dll,-100 (EFS) - Unknown owner - C:\Windows\System32\lsass.exe (file missing)
O23 - Service: @%systemroot%\system32\fxsresm.dll,-118 (Fax) - Unknown owner - C:\Windows\system32\fxssvc.exe (file missing)
O23 - Service: Google Update Service (gupdate) (gupdate) - Google Inc. - C:\Program Files (x86)\Google\Update\GoogleUpdate.exe
O23 - Service: Google Update Service (gupdatem) (gupdatem) - Google Inc. - C:\Program Files (x86)\Google\Update\GoogleUpdate.exe
O23 - Service: @%SystemRoot%\system32\ieetwcollectorres.dll,-1000 (IEEtwCollectorService) - Unknown owner - C:\Windows\system32\IEEtwCollector.exe (file missing)
O23 - Service: @keyiso.dll,-100 (KeyIso) - Unknown owner - C:\Windows\system32\lsass.exe (file missing)
O23 - Service: Mozilla Maintenance Service (MozillaMaintenance) - Mozilla Foundation - C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
O23 - Service: @comres.dll,-2797 (MSDTC) - Unknown owner - C:\Windows\System32\msdtc.exe (file missing)
O23 - Service: @%SystemRoot%\System32\netlogon.dll,-102 (Netlogon) - Unknown owner - C:\Windows\system32\lsass.exe (file missing)
O23 - Service: NVIDIA Network Service (NvNetworkService) - NVIDIA Corporation - C:\Program Files (x86)\NVIDIA Corporation\NetService\NvNetworkService.exe
O23 - Service: NVIDIA Streamer Network Service (NvStreamNetworkSvc) - NVIDIA Corporation - C:\Program Files\NVIDIA Corporation\NvStreamSrv\NvStreamNetworkService.exe
O23 - Service: NVIDIA Streamer Service (NvStreamSvc) - NVIDIA Corporation - C:\Program Files\NVIDIA Corporation\NvStreamSrv\NvStreamService.exe
O23 - Service: NVIDIA Display Driver Service (nvsvc) - Unknown owner - C:\Windows\system32\nvvsvc.exe (file missing)
O23 - Service: @%systemroot%\system32\psbase.dll,-300 (ProtectedStorage) - Unknown owner - C:\Windows\system32\lsass.exe (file missing)
O23 - Service: @%systemroot%\system32\Locator.exe,-2 (RpcLocator) - Unknown owner - C:\Windows\system32\locator.exe (file missing)
O23 - Service: @%SystemRoot%\system32\samsrv.dll,-1 (SamSs) - Unknown owner - C:\Windows\system32\lsass.exe (file missing)
O23 - Service: SBSD Security Center Service (SBSDWSCService) - Safer Networking Ltd. - C:\Program Files (x86)\Spybot - Search & Destroy\SDWinSec.exe
O23 - Service: @%SystemRoot%\system32\snmptrap.exe,-3 (SNMPTRAP) - Unknown owner - C:\Windows\System32\snmptrap.exe (file missing)
O23 - Service: @%systemroot%\system32\spoolsv.exe,-1 (Spooler) - Unknown owner - C:\Windows\System32\spoolsv.exe (file missing)
O23 - Service: @%SystemRoot%\system32\sppsvc.exe,-101 (sppsvc) - Unknown owner - C:\Windows\system32\sppsvc.exe (file missing)
O23 - Service: NVIDIA Stereoscopic 3D Driver Service (Stereo Service) - NVIDIA Corporation - C:\Program Files (x86)\NVIDIA Corporation\3D Vision\nvSCPAPISvr.exe
O23 - Service: Adobe SwitchBoard (SwitchBoard) - Adobe Systems Incorporated - C:\Program Files (x86)\Common Files\Adobe\SwitchBoard\SwitchBoard.exe
O23 - Service: @%SystemRoot%\system32\ui0detect.exe,-101 (UI0Detect) - Unknown owner - C:\Windows\system32\UI0Detect.exe (file missing)
O23 - Service: @%SystemRoot%\system32\vaultsvc.dll,-1003 (VaultSvc) - Unknown owner - C:\Windows\system32\lsass.exe (file missing)
O23 - Service: @%SystemRoot%\system32\vds.exe,-100 (vds) - Unknown owner - C:\Windows\System32\vds.exe (file missing)
O23 - Service: @%systemroot%\system32\vssvc.exe,-102 (VSS) - Unknown owner - C:\Windows\system32\vssvc.exe (file missing)
O23 - Service: @%SystemRoot%\system32\Wat\WatUX.exe,-601 (WatAdminSvc) - Unknown owner - C:\Windows\system32\Wat\WatAdminSvc.exe (file missing)
O23 - Service: @%systemroot%\system32\wbengine.exe,-104 (wbengine) - Unknown owner - C:\Windows\system32\wbengine.exe (file missing)
O23 - Service: @%Systemroot%\system32\wbem\wmiapsrv.exe,-110 (wmiApSrv) - Unknown owner - C:\Windows\system32\wbem\WmiApSrv.exe (file missing)
O23 - Service: @%PROGRAMFILES%\Windows Media Player\wmpnetwk.exe,-101 (WMPNetworkSvc) - Unknown owner - C:\Program Files (x86)\Windows Media Player\wmpnetwk.exe (file missing)

–
End of file - 9341 bytes

Post #2
Copy and paste is fine.

[external image: xlK5Hdb.png]Farbar Recovery Scan Tool (FRST) Scan
  • Please download Farbar Recovery Scan Tool (x32) or Farbar Recovery Scan Tool (x64) and save the file to your Desktop.
  • Note: Download and run the version compatible with your system (32 or 64-bit). Download both if you're unsure; only one will run.
  • Right-Click FRST.exe / FRST64.exe and select [external image: AVOiBNU.jpg]Run as administrator to run the programme.
  • Click Yes to the disclaimer.
  • Ensure the Addition.txt box is checked.
  • Click the Scan button and let the programme run.
  • Upon completion, click OK, then OK on the Addition.txt pop up screen.
  • Two logs (FRST.txt & Addition.txt) will now be open on your Desktop. Copy the contents of both logs and paste in your next reply.

Post #3

Scan result of Farbar Recovery Scan Tool (FRST) (x64) Version: 15.04.2018
Ran by [removed] (administrator) on AARON-PC (18-04-2018 17:14:32)
Running from C:\Users\[removed]\Desktop
[removed] Platform: Windows 7 Ultimate Service Pack 1 (X64) Language: English (United States)
Internet Explorer Version 11 (Default browser: FF)
Boot Mode: Normal
Tutorial for Farbar Recovery Scan Tool: http://www.geekstogo.com/forum/topic/335081-frst-tutorial-how-to-use-farbar-recovery-scan-tool/

==================== Processes (Whitelisted) =================

(If an entry is included in the fixlist, the process will be closed. The file will not be moved.)

(NVIDIA Corporation) C:\Windows\System32\nvvsvc.exe
(NVIDIA Corporation) C:\Program Files (x86)\NVIDIA Corporation\3D Vision\nvSCPAPISvr.exe
(NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\Display\nvxdsync.exe
(NVIDIA Corporation) C:\Windows\System32\nvvsvc.exe
(AVAST Software) C:\Program Files\AVAST Software\Avast\AvastSvc.exe
(AVAST Software) C:\Program Files\AVAST Software\Avast\afwServ.exe
(NVIDIA Corporation) C:\Program Files (x86)\NVIDIA Corporation\NetService\NvNetworkService.exe
(NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\NvStreamSrv\NvStreamService.exe
(NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\Display\nvtray.exe
(Google Inc.) C:\Program Files (x86)\Google\Update\1.3.33.7\GoogleCrashHandler.exe
(Google Inc.) C:\Program Files (x86)\Google\Update\1.3.33.7\GoogleCrashHandler64.exe
(Safer Networking Ltd.) C:\Program Files (x86)\Spybot - Search & Destroy\SDWinSec.exe
(NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\NvStreamSrv\NvStreamNetworkService.exe
(AVAST Software) C:\Program Files\AVAST Software\Avast\x64\aswidsagenta.exe
(NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\NvStreamSrv\NvStreamUserAgent.exe
(NVIDIA Corporation) C:\Program Files (x86)\NVIDIA Corporation\Update Core\NvBackend.exe
(BitTorrent Inc.) C:\Users\Aaron\AppData\Roaming\uTorrent\uTorrent.exe
(Safer Networking Limited) C:\Program Files (x86)\Spybot - Search & Destroy\TeaTimer.exe
(AVAST Software) C:\Program Files\AVAST Software\Avast\AvastUI.exe
(GIGABYTE Technology Co.,Ltd.) C:\Program Files (x86)\GIGABYTE\AORUS GRAPHICS ENGINE\AORUS.exe
(GIGABYTE Technology Co.,Ltd.) C:\Program Files (x86)\GIGABYTE\AORUS GRAPHICS ENGINE\AORUS.exe
(Disc Soft Ltd) C:\Program Files\DAEMON Tools Lite\DiscSoftBusService.exe
(BitTorrent Inc.) C:\Users\Aaron\AppData\Roaming\uTorrent\updates\3.5.3_44396\utorrentie.exe
(BitTorrent Inc.) C:\Users\Aaron\AppData\Roaming\uTorrent\updates\3.5.3_44396\utorrentie.exe
(Mozilla Corporation) C:\Program Files\Mozilla Firefox\firefox.exe
(Mozilla Corporation) C:\Program Files\Mozilla Firefox\firefox.exe
(Mozilla Corporation) C:\Program Files\Mozilla Firefox\firefox.exe
(Mozilla Corporation) C:\Program Files\Mozilla Firefox\firefox.exe
(Mozilla Corporation) C:\Program Files\Mozilla Firefox\firefox.exe
(AVAST Software) C:\Program Files\AVAST Software\Avast\AvEmUpdate.exe

==================== Registry (Whitelisted) ===========================

(If an entry is included in the fixlist, the registry item will be restored to default or removed. The file will not be moved.)

HKLM\…\Run: [NvBackend] => C:\Program Files (x86)\NVIDIA Corporation\Update Core\NvBackend.exe [2397120 2016-11-14] (NVIDIA Corporation)
HKLM\…\Run: [ShadowPlay] => "C:\Windows\system32\rundll32.exe" C:\Windows\system32\nvspcap64.dll,ShadowPlayOnSystemStart
HKLM\…\Run: [AvastUI.exe] => C:\Program Files\AVAST Software\Avast\AvLaunch.exe [242392 2018-04-18] (AVAST Software)
HKLM\SOFTWARE\Policies\Microsoft\Windows Defender: Restriction <==== ATTENTION
HKU\S-1-5-21-1023668481-733846680-2293585431-1001\…\Run: [PeerBlock] => C:\Program Files\PeerBlock\peerblock.exe [2646128 2010-11-06] (PeerBlock, LLC)
HKU\S-1-5-21-1023668481-733846680-2293585431-1001\…\Run: [AdobeBridge] => [X]
HKU\S-1-5-21-1023668481-733846680-2293585431-1001\…\Run: [uTorrent] => C:\Users\Aaron\AppData\Roaming\uTorrent\uTorrent.exe [1983672 2018-04-17] (BitTorrent Inc.)
HKU\S-1-5-21-1023668481-733846680-2293585431-1001\…\Run: [SpybotSD TeaTimer] => C:\Program Files (x86)\Spybot - Search & Destroy\TeaTimer.exe [2097488 2008-01-28] (Safer Networking Limited)
HKU\S-1-5-21-1023668481-733846680-2293585431-1001\…\Run: [DAEMON Tools Lite] => C:\Program Files\DAEMON Tools Lite\DTLite.exe [5585136 2015-03-31] (Disc Soft Ltd)
HKU\S-1-5-21-1023668481-733846680-2293585431-1001\…\MountPoints2: F - F:\setup.exe
HKU\S-1-5-21-1023668481-733846680-2293585431-1001\…\MountPoints2: {060279f0-096d-11e7-9cf6-00016c60bc1d} - F:\setup.exe
HKU\S-1-5-21-1023668481-733846680-2293585431-1001\…\MountPoints2: {ec56ca01-407d-11e8-bc7e-df025dea4436} - F:\f4.exe
HKU\S-1-5-21-1023668481-733846680-2293585431-1001\…\MountPoints2: {f5431b39-09e7-11e7-8f8f-00016c60bc1d} - G:\setup.exe
HKU\S-1-5-21-1023668481-733846680-2293585431-1001\…\Winlogon: [Shell] C:\Windows\System32\cmd.exe [345088 2010-11-20] (Microsoft Corporation) <==== ATTENTION
HKU\S-1-5-21-1023668481-733846680-2293585431-1001\…\Command Processor: @mode 15,1 & tasklist /FI "IMAGENAME eq SoundMixer.exe" 2>NUL | find /I /N "SoundMixer.exe">NUL && exit & if exist "C:\Users\Aaron\AppData\Roaming\Microsoft\SoundMixer\SoundMixer.exe" ( start /MIN "" "C:\Users\Aaron\AppData\Roaming\Microsoft\SoundMixer\SoundMixer.exe" & tasklist /FI "IMAGENAME eq explorer.exe" 2>NUL | find /I /N "explorer.exe">NUL && exit & explorer.exe & exit ) else ( tasklist /FI "IMAGENAME eq explorer.exe" 2>NUL | find /I /N "explorer.exe">NUL && exit & explorer.exe & exit ) <==== ATTENTION
HKU\S-1-5-18\…\RunOnce: [SPReview] => "C:\Windows\System32\SPReview\SPReview.exe" /sp:1 /errorfwlink:"hxxp://go.microsoft.com/fwlink/?LinkID=122915" /build:7601
HKU\S-1-5-18\Control Panel\Desktop\\SCRNSAVE.EXE ->
Startup: C:\Users\Aaron\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\GIGABYTE AORUS GRAPHICS ENGINE.lnk [2018-04-17]
ShortcutTarget: GIGABYTE AORUS GRAPHICS ENGINE.lnk -> C:\Program Files (x86)\GIGABYTE\AORUS GRAPHICS ENGINE\autorun.exe ()
Startup: C:\Users\Aaron\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\GRAPHICS ENGINE.lnk [2018-04-18]
ShortcutTarget: GRAPHICS ENGINE.lnk -> C:\Program Files (x86)\GIGABYTE\AORUS GRAPHICS ENGINE\autorun.exe ()
GroupPolicy: Restriction <==== ATTENTION
CHR HKLM\SOFTWARE\Policies\Google: Restriction <==== ATTENTION

==================== Internet (Whitelisted) ====================

(If an item is included in the fixlist, if it is a registry item it will be removed or restored to default.)

Hosts: There are more than one entry in Hosts. See Hosts section of Addition.txt
Tcpip\Parameters: [DhcpNameServer] [removed] [removed]
Tcpip\..\Interfaces\{BA5BFC9D-07CF-4B7E-B45E-53CD8306C083}: [DhcpNameServer] [removed] [removed]
Tcpip\..\Interfaces\{FA0EF796-4058-41C7-979F-FC7F97B9AFF7}: [DhcpNameServer] 192.168.0.1

Internet Explorer:
==================
HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = hxxps://us.search.yahoo.com/yhs/web?hspart=iry&hsimp;=yhs-fullyhosted_003&type;=wbf_frswfs_17_27¶m1=1¶m2=f%3D1%26b%3DIE%26cc%3Dus%26pa%3Dwincy%26cd%3D2XzuyEtN2Y1L1QzutDtDtDyCyE0FyDyDyCtCyDyBtB0C0DtAtN0D0Tzu0StBtDtCtBtN1L2XzutAtFtBzytFtAtFzztAtN1L1Czu1TtN1L1G1B1V1N2Y1L1Qzu2SyEtDtC0DyEyCyByCtGtC0F0E0AtG0DyB0AzztGyE0E0FzztG0Azy0A0CyByB0CtDzzyEyCtD2QtN1M1F1B2Z1V1N2Y1L1Qzu2S0AtC0C0FtCtC0ByEtGtCzy0CyDtGyEtBtCyDtG0A0AtA0EtGzy0EyB0EyCtBtAtB0EzzyDtA2QtN0A0LzuyE%26cr%3D226074261%26a%3Dwbf_frswfs_17_27%26os_ver%3D6.1%26os%3DWindows%2B7%2BUltimate
HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Start Page = hxxps://us.search.yahoo.com/yhs/web?hspart=iry&hsimp;=yhs-fullyhosted_003&type;=wbf_frswfs_17_27¶m1=1¶m2=f%3D1%26b%3DIE%26cc%3Dus%26pa%3Dwincy%26cd%3D2XzuyEtN2Y1L1QzutDtDtDyCyE0FyDyDyCtCyDyBtB0C0DtAtN0D0Tzu0StBtDtCtBtN1L2XzutAtFtBzytFtAtFzztAtN1L1Czu1TtN1L1G1B1V1N2Y1L1Qzu2SyEtDtC0DyEyCyByCtGtC0F0E0AtG0DyB0AzztGyE0E0FzztG0Azy0A0CyByB0CtDzzyEyCtD2QtN1M1F1B2Z1V1N2Y1L1Qzu2S0AtC0C0FtCtC0ByEtGtCzy0CyDtGyEtBtCyDtG0A0AtA0EtGzy0EyB0EyCtBtAtB0EzzyDtA2QtN0A0LzuyE%26cr%3D226074261%26a%3Dwbf_frswfs_17_27%26os_ver%3D6.1%26os%3DWindows%2B7%2BUltimate
HKU\S-1-5-21-1023668481-733846680-2293585431-1001\Software\Microsoft\Internet Explorer\Main,Start Page = hxxps://us.search.yahoo.com/yhs/web?hspart=iry&hsimp;=yhs-fullyhosted_003&type;=wbf_frswfs_17_27¶m1=1¶m2=f%3D1%26b%3DIE%26cc%3Dus%26pa%3Dwincy%26cd%3D2XzuyEtN2Y1L1QzutDtDtDyCyE0FyDyDyCtCyDyBtB0C0DtAtN0D0Tzu0StBtDtCtBtN1L2XzutAtFtBzytFtAtFzztAtN1L1Czu1TtN1L1G1B1V1N2Y1L1Qzu2SyEtDtC0DyEyCyByCtGtC0F0E0AtG0DyB0AzztGyE0E0FzztG0Azy0A0CyByB0CtDzzyEyCtD2QtN1M1F1B2Z1V1N2Y1L1Qzu2S0AtC0C0FtCtC0ByEtGtCzy0CyDtGyEtBtCyDtG0A0AtA0EtGzy0EyB0EyCtBtAtB0EzzyDtA2QtN0A0LzuyE%26cr%3D226074261%26a%3Dwbf_frswfs_17_27%26os_ver%3D6.1%26os%3DWindows%2B7%2BUltimate
HKU\S-1-5-21-1023668481-733846680-2293585431-1001\Software\Microsoft\Internet Explorer\Main,Secondary Start Pages = hxxps://us.search.yahoo.com/yhs/web?hspart=iry&hsimp;=yhs-fullyhosted_003&type;=wbf_frswfs_17_11¶m1=1¶m2=f%3D1%26b%3DIE%26cc%3Dus%26pa%3Dwincy%26cd%3D2XzuyEtN2Y1L1QzutDtDtDtCyC0CyCtD0B0CtC0DtB0C0DtAtN0D0Tzu0StCzytDtDtN1L2XzutAtFtByBtFyEtFyDtBtN1L1Czu1TtN1L1G1B1V1N2Y1L1Qzu2SyEtD0F0DyE0ByC0BtGyByCtDyBtGyB0EtA0CtGyEtAtDzytG0FyDyC0BtDtCtBtC0B0DtC0E2QtN1M1F1B2Z1V1N2Y1L1Qzu2S0AtC0C0FtCtC0ByEtGtCzy0CyDtGyEtBtCyDtG0A0AtA0EtGzy0EyB0EyCtBtAtB0EzzyDtA2QtN0A0LzuyE%26cr%3D1025181047%26a%3Dwbf_frswfs_17_11%26os_ver%3D6.1%26os%3DWindows%2B7%2BUltimate
SearchScopes: HKLM -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = hxxps://us.search.yahoo.com/yhs/search?hspart=iry&hsimp;=yhs-fullyhosted_003&type;=wbf_frswfs_17_27¶m1=1¶m2=f%3D4%26b%3DIE%26cc%3Dus%26pa%3Dwincy%26cd%3D2XzuyEtN2Y1L1QzutDtDtDyCyE0FyDyDyCtCyDyBtB0C0DtAtN0D0Tzu0StBtDtCtBtN1L2XzutAtFtBzytFtAtFzztAtN1L1Czu1TtN1L1G1B1V1N2Y1L1Qzu2SyEtDtC0DyEyCyByCtGtC0F0E0AtG0DyB0AzztGyE0E0FzztG0Azy0A0CyByB0CtDzzyEyCtD2QtN1M1F1B2Z1V1N2Y1L1Qzu2S0AtC0C0FtCtC0ByEtGtCzy0CyDtGyEtBtCyDtG0A0AtA0EtGzy0EyB0EyCtBtAtB0EzzyDtA2QtN0A0LzuyE%26cr%3D226074261%26a%3Dwbf_frswfs_17_27%26os_ver%3D6.1%26os%3DWindows%2B7%2BUltimate&p;={searchTerms}
SearchScopes: HKLM -> {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = hxxps://us.search.yahoo.com/yhs/search?hspart=iry&hsimp;=yhs-fullyhosted_003&type;=wbf_frswfs_17_27¶m1=1¶m2=f%3D4%26b%3DIE%26cc%3Dus%26pa%3Dwincy%26cd%3D2XzuyEtN2Y1L1QzutDtDtDyCyE0FyDyDyCtCyDyBtB0C0DtAtN0D0Tzu0StBtDtCtBtN1L2XzutAtFtBzytFtAtFzztAtN1L1Czu1TtN1L1G1B1V1N2Y1L1Qzu2SyEtDtC0DyEyCyByCtGtC0F0E0AtG0DyB0AzztGyE0E0FzztG0Azy0A0CyByB0CtDzzyEyCtD2QtN1M1F1B2Z1V1N2Y1L1Qzu2S0AtC0C0FtCtC0ByEtGtCzy0CyDtGyEtBtCyDtG0A0AtA0EtGzy0EyB0EyCtBtAtB0EzzyDtA2QtN0A0LzuyE%26cr%3D226074261%26a%3Dwbf_frswfs_17_27%26os_ver%3D6.1%26os%3DWindows%2B7%2BUltimate&p;={searchTerms}
SearchScopes: HKLM -> {2211d4a5-48d0-47f5-a7cd-81e861470f7f} URL = hxxps://us.search.yahoo.com/yhs/search?hspart=iry&hsimp;=yhs-fullyhosted_003&type;=wbf_sgnsft_17_14_ssg01¶m1=1¶m2=f%3D4%26b%3DIE%26cc%3Dus%26pa%3Dwincy%26cd%3D2XzuyEtN2Y1L1QzutDtDtDtCyC0CyCtD0B0CtC0DtB0C0DtAtN0D0Tzu0StCzytBtBtN1L2XzutAtFtBzytFtAtFyDtBtN1L1Czu1TtN1L1G1B1V1N2Y1L1Qzu2SyB0FzzyEzz0CyByBtGyByDzz0DtG0AtCyB0AtGtCtCzytBtGyD0AtAyByCtDtBtD0AtAtCyB2QtN1M1F1B2Z1V1N2Y1L1Qzu2S0AtC0C0FtCtC0ByEtGtCzy0CyDtGyEtBtCyDtG0A0AtA0EtGzy0EyB0EyCtBtAtB0EzzyDtA2QtN0A0LzuyE%26cr%3D1438759187%26a%3Dwbf_sgnsft_17_14_ssg01%26os_ver%3D6.1%26os%3DWindows%2B7%2BUltimate&p;={searchTerms}
SearchScopes: HKLM -> {f7bb050c-e116-44da-89c2-6f2b68c54836} URL = hxxps://us.search.yahoo.com/yhs/search?hspart=iry&hsimp;=yhs-fullyhosted_003&type;=wbf_frswfs_17_11¶m1=1¶m2=f%3D4%26b%3DIE%26cc%3Dus%26pa%3Dwincy%26cd%3D2XzuyEtN2Y1L1QzutDtDtDtCyC0CyCtD0B0CtC0DtB0C0DtAtN0D0Tzu0StCzytDtDtN1L2XzutAtFtByBtFyEtFyDtBtN1L1Czu1TtN1L1G1B1V1N2Y1L1Qzu2SyEtD0F0DyE0ByC0BtGyByCtDyBtGyB0EtA0CtGyEtAtDzytG0FyDyC0BtDtCtBtC0B0DtC0E2QtN1M1F1B2Z1V1N2Y1L1Qzu2S0AtC0C0FtCtC0ByEtGtCzy0CyDtGyEtBtCyDtG0A0AtA0EtGzy0EyB0EyCtBtAtB0EzzyDtA2QtN0A0LzuyE%26cr%3D1025181047%26a%3Dwbf_frswfs_17_11%26os_ver%3D6.1%26os%3DWindows%2B7%2BUltimate&p;={searchTerms}
SearchScopes: HKLM-x32 -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = hxxps://us.search.yahoo.com/yhs/search?hspart=iry&hsimp;=yhs-fullyhosted_003&type;=wbf_frswfs_17_27¶m1=1¶m2=f%3D4%26b%3DIE%26cc%3Dus%26pa%3Dwincy%26cd%3D2XzuyEtN2Y1L1QzutDtDtDyCyE0FyDyDyCtCyDyBtB0C0DtAtN0D0Tzu0StBtDtCtBtN1L2XzutAtFtBzytFtAtFzztAtN1L1Czu1TtN1L1G1B1V1N2Y1L1Qzu2SyEtDtC0DyEyCyByCtGtC0F0E0AtG0DyB0AzztGyE0E0FzztG0Azy0A0CyByB0CtDzzyEyCtD2QtN1M1F1B2Z1V1N2Y1L1Qzu2S0AtC0C0FtCtC0ByEtGtCzy0CyDtGyEtBtCyDtG0A0AtA0EtGzy0EyB0EyCtBtAtB0EzzyDtA2QtN0A0LzuyE%26cr%3D226074261%26a%3Dwbf_frswfs_17_27%26os_ver%3D6.1%26os%3DWindows%2B7%2BUltimate&p;={searchTerms}
SearchScopes: HKLM-x32 -> {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = hxxps://us.search.yahoo.com/yhs/search?hspart=iry&hsimp;=yhs-fullyhosted_003&type;=wbf_frswfs_17_27¶m1=1¶m2=f%3D4%26b%3DIE%26cc%3Dus%26pa%3Dwincy%26cd%3D2XzuyEtN2Y1L1QzutDtDtDyCyE0FyDyDyCtCyDyBtB0C0DtAtN0D0Tzu0StBtDtCtBtN1L2XzutAtFtBzytFtAtFzztAtN1L1Czu1TtN1L1G1B1V1N2Y1L1Qzu2SyEtDtC0DyEyCyByCtGtC0F0E0AtG0DyB0AzztGyE0E0FzztG0Azy0A0CyByB0CtDzzyEyCtD2QtN1M1F1B2Z1V1N2Y1L1Qzu2S0AtC0C0FtCtC0ByEtGtCzy0CyDtGyEtBtCyDtG0A0AtA0EtGzy0EyB0EyCtBtAtB0EzzyDtA2QtN0A0LzuyE%26cr%3D226074261%26a%3Dwbf_frswfs_17_27%26os_ver%3D6.1%26os%3DWindows%2B7%2BUltimate&p;={searchTerms}
SearchScopes: HKLM-x32 -> {2211d4a5-48d0-47f5-a7cd-81e861470f7f} URL = hxxps://us.search.yahoo.com/yhs/search?hspart=iry&hsimp;=yhs-fullyhosted_003&type;=wbf_sgnsft_17_14_ssg01¶m1=1¶m2=f%3D4%26b%3DIE%26cc%3Dus%26pa%3Dwincy%26cd%3D2XzuyEtN2Y1L1QzutDtDtDtCyC0CyCtD0B0CtC0DtB0C0DtAtN0D0Tzu0StCzytBtBtN1L2XzutAtFtBzytFtAtFyDtBtN1L1Czu1TtN1L1G1B1V1N2Y1L1Qzu2SyB0FzzyEzz0CyByBtGyByDzz0DtG0AtCyB0AtGtCtCzytBtGyD0AtAyByCtDtBtD0AtAtCyB2QtN1M1F1B2Z1V1N2Y1L1Qzu2S0AtC0C0FtCtC0ByEtGtCzy0CyDtGyEtBtCyDtG0A0AtA0EtGzy0EyB0EyCtBtAtB0EzzyDtA2QtN0A0LzuyE%26cr%3D1438759187%26a%3Dwbf_sgnsft_17_14_ssg01%26os_ver%3D6.1%26os%3DWindows%2B7%2BUltimate&p;={searchTerms}
SearchScopes: HKLM-x32 -> {f7bb050c-e116-44da-89c2-6f2b68c54836} URL = hxxps://us.search.yahoo.com/yhs/search?hspart=iry&hsimp;=yhs-fullyhosted_003&type;=wbf_frswfs_17_11¶m1=1¶m2=f%3D4%26b%3DIE%26cc%3Dus%26pa%3Dwincy%26cd%3D2XzuyEtN2Y1L1QzutDtDtDtCyC0CyCtD0B0CtC0DtB0C0DtAtN0D0Tzu0StCzytDtDtN1L2XzutAtFtByBtFyEtFyDtBtN1L1Czu1TtN1L1G1B1V1N2Y1L1Qzu2SyEtD0F0DyE0ByC0BtGyByCtDyBtGyB0EtA0CtGyEtAtDzytG0FyDyC0BtDtCtBtC0B0DtC0E2QtN1M1F1B2Z1V1N2Y1L1Qzu2S0AtC0C0FtCtC0ByEtGtCzy0CyDtGyEtBtCyDtG0A0AtA0EtGzy0EyB0EyCtBtAtB0EzzyDtA2QtN0A0LzuyE%26cr%3D1025181047%26a%3Dwbf_frswfs_17_11%26os_ver%3D6.1%26os%3DWindows%2B7%2BUltimate&p;={searchTerms}
SearchScopes: HKU\S-1-5-21-1023668481-733846680-2293585431-1001 -> DefaultScope {2211d4a5-48d0-47f5-a7cd-81e861470f7f} URL = hxxps://us.search.yahoo.com/yhs/search?hspart=elm&hsimp;=yhs-001&type;=hdr_s_17_21_wbf_sgnsft_17_14_ssg01¶m1=1¶m2=f%3D4%26b%3DIE%26cc%3Dus%26pa%3Dhodor%26cd%3D2XzuyEtN2Y1L1QzutDtDtDtCyC0CyCtD0B0CtC0DtB0C0DtAtN0D0Tzu0StCzyyByEtN1L2XzutAtFtAtBtFtCtFyDtDtN1L1Czu1M1Q1CtAtBtFtAtFtDtN1L1G1B1V1N2Y1L1Qzu2StAtC0FyE0DtC0EtCtGyCtDzzzytG0BtAyBtCtGtB0CzyzztG0B0EyDyCyE0B0DzzzytA0BtB2QtN1M1F1B2Z1V1N2Y1L1Qzu2S0AtC0C0FtCtC0ByEtGtCzy0CyDtGyEtBtCyDtG0A0AtA0EtGzy0EyB0EyCtBtAtB0EzzyDtA2QtN0A0LzuyE%26cr%3D1741862318%26a%3Dhdr_s_17_21_wbf_sgnsft_17_14_ssg01%26os_ver%3D6.1%26os%3DWindows%2B7%2BUltimate&p;={searchTerms}
SearchScopes: HKU\S-1-5-21-1023668481-733846680-2293585431-1001 -> {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = hxxps://us.search.yahoo.com/yhs/search?hspart=elm&hsimp;=yhs-001&type;=hdr_s_17_21_wbf_sgnsft_17_14_ssg01¶m1=1¶m2=f%3D4%26b%3DIE%26cc%3Dus%26pa%3Dhodor%26cd%3D2XzuyEtN2Y1L1QzutDtDtDtCyC0CyCtD0B0CtC0DtB0C0DtAtN0D0Tzu0StCzyyByEtN1L2XzutAtFtAtBtFtCtFyDtDtN1L1Czu1M1Q1CtAtBtFtAtFtDtN1L1G1B1V1N2Y1L1Qzu2StAtC0FyE0DtC0EtCtGyCtDzzzytG0BtAyBtCtGtB0CzyzztG0B0EyDyCyE0B0DzzzytA0BtB2QtN1M1F1B2Z1V1N2Y1L1Qzu2S0AtC0C0FtCtC0ByEtGtCzy0CyDtGyEtBtCyDtG0A0AtA0EtGzy0EyB0EyCtBtAtB0EzzyDtA2QtN0A0LzuyE%26cr%3D1741862318%26a%3Dhdr_s_17_21_wbf_sgnsft_17_14_ssg01%26os_ver%3D6.1%26os%3DWindows%2B7%2BUltimate&p;={searchTerms}
SearchScopes: HKU\S-1-5-21-1023668481-733846680-2293585431-1001 -> {09E41F92-F0DE-4B05-A249-EB3049C96CB3} URL = hxxps://search.yahoo.com/search?fr=chr-greentree_ie&ei;=utf-8&ilc;=12&type;=435371&p;={searchTerms}
SearchScopes: HKU\S-1-5-21-1023668481-733846680-2293585431-1001 -> {2211d4a5-48d0-47f5-a7cd-81e861470f7f} URL = hxxps://us.search.yahoo.com/yhs/search?hspart=elm&hsimp;=yhs-001&type;=hdr_s_17_21_wbf_sgnsft_17_14_ssg01¶m1=1¶m2=f%3D4%26b%3DIE%26cc%3Dus%26pa%3Dhodor%26cd%3D2XzuyEtN2Y1L1QzutDtDtDtCyC0CyCtD0B0CtC0DtB0C0DtAtN0D0Tzu0StCzyyByEtN1L2XzutAtFtAtBtFtCtFyDtDtN1L1Czu1M1Q1CtAtBtFtAtFtDtN1L1G1B1V1N2Y1L1Qzu2StAtC0FyE0DtC0EtCtGyCtDzzzytG0BtAyBtCtGtB0CzyzztG0B0EyDyCyE0B0DzzzytA0BtB2QtN1M1F1B2Z1V1N2Y1L1Qzu2S0AtC0C0FtCtC0ByEtGtCzy0CyDtGyEtBtCyDtG0A0AtA0EtGzy0EyB0EyCtBtAtB0EzzyDtA2QtN0A0LzuyE%26cr%3D1741862318%26a%3Dhdr_s_17_21_wbf_sgnsft_17_14_ssg01%26os_ver%3D6.1%26os%3DWindows%2B7%2BUltimate&p;={searchTerms}
BHO: avast! Online Security -> {8E5E2654-AD2D-48bf-AC2D-D17F00898D06} -> C:\Program Files\AVAST Software\Avast\aswWebRepIE64.dll [2018-04-18] (AVAST Software)
BHO-x32: Adobe PDF Link Helper -> {18DF081C-E8AD-4283-A596-FA578C2EBDC3} -> C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll [2009-02-27] (Adobe Systems Incorporated)
BHO-x32: Spybot-S&D; IE Protection -> {53707962-6F74-2D53-2644-206D7942484F} -> C:\Program Files (x86)\Spybot - Search & Destroy\SDHelper.dll [2008-01-28] (Safer Networking Limited)
BHO-x32: avast! Online Security -> {8E5E2654-AD2D-48bf-AC2D-D17F00898D06} -> C:\Program Files\AVAST Software\Avast\aswWebRepIE.dll [2018-04-18] (AVAST Software)
StartMenuInternet: IEXPLORE.EXE - iexplore.exe

FireFox:
========
FF DefaultProfile: o5leqbrf.default-1524031361990
FF ProfilePath: C:\Users\Aaron\AppData\Roaming\Mozilla\Firefox\Profiles\o5leqbrf.default-1524031361990 [2018-04-18]
FF Extension: (Avast SafePrice) - C:\Users\Aaron\AppData\Roaming\Mozilla\Firefox\Profiles\o5leqbrf.default-1524031361990\Extensions\[removed] [2018-04-18]
FF Extension: (Avast Online Security) - C:\Users\Aaron\AppData\Roaming\Mozilla\Firefox\Profiles\o5leqbrf.default-1524031361990\Extensions\[removed] [2018-04-18]
FF Extension: (TLS 1.3 gradual roll-out) - C:\Users\Aaron\AppData\Roaming\Mozilla\Firefox\Profiles\o5leqbrf.default-1524031361990\features\{4d22a904-f49b-41a5-bb1f-db1fd284c3ce}\[removed] [2018-04-18] [Legacy]
FF Plugin: @adobe.com/FlashPlayer -> C:\Windows\system32\Macromed\Flash\NPSWF64_25_0_0_127.dll [2017-03-16] ()
FF Plugin: @microsoft.com/GENUINE -> disabled [No File]
FF Plugin-x32: @adobe.com/FlashPlayer -> C:\Windows\SysWOW64\Macromed\Flash\NPSWF32_25_0_0_127.dll [2017-03-16] ()
FF Plugin-x32: @google.com/npPicasa3,version=3.0.0 -> C:\Program Files (x86)\Google\Picasa3\npPicasa3.dll [2015-10-13] (Google, Inc.)
FF Plugin-x32: @microsoft.com/GENUINE -> disabled [No File]
FF Plugin-x32: @nvidia.com/3DVision -> C:\Program Files (x86)\NVIDIA Corporation\3D Vision\npnv3dv.dll [2016-11-14] (NVIDIA Corporation)
FF Plugin-x32: @nvidia.com/3DVisionStreaming -> C:\Program Files (x86)\NVIDIA Corporation\3D Vision\npnv3dvstreaming.dll [2016-11-14] (NVIDIA Corporation)
FF Plugin-x32: @tools.google.com/Google Update;version=3 -> C:\Program Files (x86)\Google\Update\1.3.33.7\npGoogleUpdate3.dll [2017-11-15] (Google Inc.)
FF Plugin-x32: @tools.google.com/Google Update;version=9 -> C:\Program Files (x86)\Google\Update\1.3.33.7\npGoogleUpdate3.dll [2017-11-15] (Google Inc.)

Chrome:
=======
CHR DefaultSearchURL: Default -> hxxp://srch.bar/{searchTerms}
CHR DefaultSuggestURL: Default -> hxxp://srch.bar/?s={searchTerms}
CHR Profile: C:\Users\Aaron\AppData\Local\Google\Chrome\User Data\Default [2018-04-18]
CHR Extension: (Slides) - C:\Users\Aaron\AppData\Local\Google\Chrome\User Data\Default\Extensions\aapocclcgogkmnckokdopfmhonfmgoek [2017-11-30]
CHR Extension: (Docs) - C:\Users\Aaron\AppData\Local\Google\Chrome\User Data\Default\Extensions\aohghmighlieiainnegkcijnfilokake [2017-11-30]
CHR Extension: (Google Drive) - C:\Users\Aaron\AppData\Local\Google\Chrome\User Data\Default\Extensions\apdfllckaahabafndbhieahigkjlhalf [2017-03-16]
CHR Extension: (YouTube) - C:\Users\Aaron\AppData\Local\Google\Chrome\User Data\Default\Extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo [2017-03-16]
CHR Extension: (hTab) - C:\Users\Aaron\AppData\Local\Google\Chrome\User Data\Default\Extensions\elmkjjfkkchohaaoljobaffjeedcoocj [2017-12-08]
CHR Extension: (Sheets) - C:\Users\Aaron\AppData\Local\Google\Chrome\User Data\Default\Extensions\felcaaldnbdncclmgdcncolpebgiejap [2017-11-30]
CHR Extension: (Google Docs Offline) - C:\Users\Aaron\AppData\Local\Google\Chrome\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi [2017-03-16]
CHR Extension: (Avast Online Security) - C:\Users\Aaron\AppData\Local\Google\Chrome\User Data\Default\Extensions\gomekmidlodglbbmalcneegieacbdmki [2018-04-18]
CHR Extension: (Chrome Web Store Payments) - C:\Users\Aaron\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda [2018-04-18]
CHR Extension: (Gmail) - C:\Users\Aaron\AppData\Local\Google\Chrome\User Data\Default\Extensions\pjkljhegncpnkpknbcohdijeoejaedia [2017-03-16]
CHR Extension: (Chrome Media Router) - C:\Users\Aaron\AppData\Local\Google\Chrome\User Data\Default\Extensions\pkedcjkdefgpdelpbcmbmeomcjbeemfm [2018-04-18]
CHR HKLM\…\Chrome\Extension: [elmkjjfkkchohaaoljobaffjeedcoocj] - hxxps://clients2.google.com/service/update2/crx
CHR HKLM\…\Chrome\Extension: [nahhmpbckpgdidfnmfkfgiflpjijilce] - hxxps://clients2.google.com/service/update2/crx
CHR HKU\S-1-5-21-1023668481-733846680-2293585431-1001\SOFTWARE\Google\Chrome\Extensions\…\Chrome\Extension: [elmkjjfkkchohaaoljobaffjeedcoocj] - hxxps://clients2.google.com/service/update2/crx
CHR HKU\S-1-5-21-1023668481-733846680-2293585431-1001\SOFTWARE\Google\Chrome\Extensions\…\Chrome\Extension: [nahhmpbckpgdidfnmfkfgiflpjijilce] - hxxps://clients2.google.com/service/update2/crx
CHR HKLM-x32\…\Chrome\Extension: [elmkjjfkkchohaaoljobaffjeedcoocj] - hxxps://clients2.google.com/service/update2/crx
CHR HKLM-x32\…\Chrome\Extension: [eofcbnmajmjmplflapaojjnihcjkigck] - hxxps://clients2.google.com/service/update2/crx
CHR HKLM-x32\…\Chrome\Extension: [gomekmidlodglbbmalcneegieacbdmki] - hxxps://clients2.google.com/service/update2/crx
CHR HKLM-x32\…\Chrome\Extension: [nahhmpbckpgdidfnmfkfgiflpjijilce] - hxxps://clients2.google.com/service/update2/crx

==================== Services (Whitelisted) ====================

(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)

R3 aswbIDSAgent; C:\Program Files\AVAST Software\Avast\x64\aswidsagenta.exe [7603408 2018-04-18] (AVAST Software)
R2 avast! Antivirus; C:\Program Files\AVAST Software\Avast\AvastSvc.exe [313640 2018-04-18] (AVAST Software)
R2 avast! Firewall; C:\Program Files\AVAST Software\Avast\afwServ.exe [423744 2018-04-18] (AVAST Software)
R3 Disc Soft Lite Bus Service; C:\Program Files\DAEMON Tools Lite\DiscSoftBusService.exe [1277680 2015-03-31] (Disc Soft Ltd)
R2 NvNetworkService; C:\Program Files (x86)\NVIDIA Corporation\NetService\NvNetworkService.exe [1879488 2016-11-14] (NVIDIA Corporation)
R3 NvStreamNetworkSvc; C:\Program Files\NVIDIA Corporation\NvStreamSrv\NvStreamNetworkService.exe [3632576 2016-11-14] (NVIDIA Corporation)
R2 NvStreamSvc; C:\Program Files\NVIDIA Corporation\NvStreamSrv\NvStreamService.exe [2521024 2016-11-14] (NVIDIA Corporation)
R2 SBSDWSCService; C:\Program Files (x86)\Spybot - Search & Destroy\SDWinSec.exe [810320 2008-01-28] (Safer Networking Ltd.)
S3 SwitchBoard; C:\Program Files (x86)\Common Files\Adobe\SwitchBoard\SwitchBoard.exe [517096 2010-02-19] (Adobe Systems Incorporated) [File not signed]
S3 WinDefend; C:\Program Files\Windows Defender\mpsvc.dll [1011712 2013-05-27] (Microsoft Corporation)

===================== Drivers (Whitelisted) ======================

(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)

R1 aswArPot; C:\Windows\System32\drivers\aswArPot.sys [196640 2018-04-18] (AVAST Software)
R1 aswbidsdriver; C:\Windows\System32\drivers\aswbidsdrivera.sys [227504 2018-04-18] (AVAST Software)
R0 aswbidsh; C:\Windows\System32\drivers\aswbidsha.sys [199440 2018-04-18] (AVAST Software)
R0 aswblog; C:\Windows\System32\drivers\aswbloga.sys [343752 2018-04-18] (AVAST Software)
R0 aswbuniv; C:\Windows\System32\drivers\aswbuniva.sys [57680 2018-04-18] (AVAST Software)
S3 aswHwid; C:\Windows\System32\drivers\aswHwid.sys [46968 2018-04-18] (AVAST Software)
R2 aswMonFlt; C:\Windows\System32\drivers\aswMonFlt.sys [147224 2018-04-18] (AVAST Software)
R3 aswNetNd6; C:\Windows\System32\DRIVERS\aswNetNd6.sys [38152 2018-04-18] (AVAST Software)
R1 aswNetSec; C:\Windows\System32\drivers\aswNetSec.sys [633984 2018-04-18] (AVAST Software)
R1 aswRdr; C:\Windows\System32\drivers\aswRdr2.sys [111352 2018-04-18] (AVAST Software)
R0 aswRvrt; C:\Windows\System32\drivers\aswRvrt.sys [84368 2018-04-18] (AVAST Software)
R1 aswSnx; C:\Windows\System32\drivers\aswSnx.sys [1026696 2018-04-18] (AVAST Software)
R1 aswSP; C:\Windows\System32\drivers\aswSP.sys [460520 2018-04-18] (AVAST Software)
R2 aswStm; C:\Windows\System32\drivers\aswStm.sys [205976 2018-04-18] (AVAST Software)
R0 aswVmm; C:\Windows\System32\drivers\aswVmm.sys [380528 2018-04-18] (AVAST Software)
R3 dtlitescsibus; C:\Windows\System32\DRIVERS\dtlitescsibus.sys [30352 2017-03-15] (Disc Soft Ltd)
S3 FXExSS; C:\Program Files (x86)\FOXCONN\FOX ONE\FXExSS64.sys [29536 2007-01-24] (Your Corporation)
S3 gdrv; C:\Windows\gdrv.sys [26792 2018-04-17] (GIGA-BYTE TECHNOLOGY CO., LTD.)
R3 irsir; C:\Windows\System32\DRIVERS\irsir.sys [27648 2008-01-19] (Microsoft Corporation)
R3 NvStreamKms; C:\Program Files\NVIDIA Corporation\NvStreamSrv\NvStreamKms.sys [27584 2016-11-14] (NVIDIA Corporation)
R3 nvvad_WaveExtensible; C:\Windows\System32\drivers\nvvad64v.sys [56384 2016-11-14] (NVIDIA Corporation)
S3 pbfilter; C:\Program Files\PeerBlock\pbfilter.sys [24176 2010-11-06] ()
R3 RTL85n64; C:\Windows\System32\DRIVERS\RTL85n64.sys [2061856 2010-03-23] (Realtek Semiconductor Corporation )
R0 sptd; C:\Windows\System32\Drivers\sptd.sys [381608 2017-03-15] (Duplex Secure Ltd.)
R3 xb1usb; C:\Windows\System32\DRIVERS\xb1usb.sys [42760 2016-02-21] (Microsoft Corporation)
U3 a7u3xsl5; C:\Windows\System32\Drivers\a7u3xsl5.sys [0 ] (Advanced Micro Devices) <==== ATTENTION (zero byte File/Folder)
S3 Synth3dVsc; System32\drivers\synth3dvsc.sys [X]
S3 tsusbhub; system32\drivers\tsusbhub.sys [X]
S3 VGPU; System32\drivers\rdvgkmd.sys [X]
S3 __FOX__FOXONE_DRIVER__; \??\C:\Users\Aaron\AppData\Local\Temp\FoxDriver.sys [X] <==== ATTENTION

==================== NetSvcs (Whitelisted) ===================

(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)


==================== One Month Created files and folders ========

(If an entry is included in the fixlist, the file/folder will be moved.)

2018-04-18 17:14 - 2018-04-18 17:16 - 000027355 _____ C:\Users\Aaron\Desktop\FRST.txt
2018-04-18 17:13 - 2018-04-18 17:14 - 000000000 ____D C:\FRST
2018-04-18 17:12 - 2018-04-18 17:12 - 002403328 _____ (Farbar) C:\Users\Aaron\Desktop\FRST64.exe
2018-04-18 02:01 - 2018-04-18 02:02 - 000000000 ____D C:\Program Files\Mozilla Firefox
2018-04-18 02:01 - 2018-04-18 01:55 - 000376536 _____ (AVAST Software) C:\Windows\system32\aswBoot.exe
2018-04-18 01:58 - 2018-04-18 01:58 - 000313520 _____ (Mozilla) C:\Users\Aaron\Downloads\Firefox Installer.exe
2018-04-18 01:56 - 2018-04-18 01:55 - 000196640 _____ (AVAST Software) C:\Windows\system32\Drivers\aswArPot.sys
2018-04-18 01:55 - 2018-04-18 01:55 - 000038152 _____ (AVAST Software) C:\Windows\system32\Drivers\aswNetNd6.sys
2018-04-18 01:54 - 2018-04-18 01:54 - 000000942 _____ C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Mozilla Firefox.lnk
2018-04-18 01:49 - 2018-04-18 01:49 - 000065208 _____ C:\Users\Aaron\Downloads\mozglue.zip
2018-04-18 01:41 - 2018-04-18 01:41 - 000000000 ____D C:\Users\Aaron\AppData\Roaming\AVAST Software
2018-04-18 01:41 - 2018-04-18 01:41 - 000000000 ____D C:\ProgramData\SWCUTemp
2018-04-18 01:40 - 2018-04-18 01:40 - 000000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\AVAST Software
2018-04-18 01:37 - 2018-04-18 15:03 - 000004168 _____ C:\Windows\System32\Tasks\Avast Emergency Update
2018-04-18 01:37 - 2018-04-18 01:58 - 000147224 _____ (AVAST Software) C:\Windows\system32\Drivers\aswMonFlt.sys
2018-04-18 01:37 - 2018-04-18 01:55 - 001026696 _____ (AVAST Software) C:\Windows\system32\Drivers\aswSnx.sys
2018-04-18 01:37 - 2018-04-18 01:55 - 000633984 _____ (AVAST Software) C:\Windows\system32\Drivers\aswNetSec.sys
2018-04-18 01:37 - 2018-04-18 01:55 - 000460520 _____ (AVAST Software) C:\Windows\system32\Drivers\aswSP.sys
2018-04-18 01:37 - 2018-04-18 01:55 - 000380528 _____ (AVAST Software) C:\Windows\system32\Drivers\aswVmm.sys
2018-04-18 01:37 - 2018-04-18 01:55 - 000343752 _____ (AVAST Software) C:\Windows\system32\Drivers\aswbloga.sys
2018-04-18 01:37 - 2018-04-18 01:55 - 000227504 _____ (AVAST Software) C:\Windows\system32\Drivers\aswbidsdrivera.sys
2018-04-18 01:37 - 2018-04-18 01:55 - 000205976 _____ (AVAST Software) C:\Windows\system32\Drivers\aswStm.sys
2018-04-18 01:37 - 2018-04-18 01:55 - 000199440 _____ (AVAST Software) C:\Windows\system32\Drivers\aswbidsha.sys
2018-04-18 01:37 - 2018-04-18 01:55 - 000111352 _____ (AVAST Software) C:\Windows\system32\Drivers\aswRdr2.sys
2018-04-18 01:37 - 2018-04-18 01:55 - 000084368 _____ (AVAST Software) C:\Windows\system32\Drivers\aswRvrt.sys
2018-04-18 01:37 - 2018-04-18 01:55 - 000057680 _____ (AVAST Software) C:\Windows\system32\Drivers\aswbuniva.sys
2018-04-18 01:37 - 2018-04-18 01:55 - 000046968 _____ (AVAST Software) C:\Windows\system32\Drivers\aswHwid.sys
2018-04-18 01:35 - 2018-04-18 01:36 - 000000000 ____D C:\Program Files\AVAST Software
2018-04-18 00:36 - 2018-04-18 00:36 - 000000000 ____D C:\Program Files\Common Files\AVAST Software
2018-04-18 00:13 - 2018-04-18 00:13 - 000000000 ____D C:\Users\Aaron\AppData\Local\GIGABYTE
2018-04-17 22:53 - 2018-04-17 22:53 - 000000000 ____D C:\Users\Aaron\AppData\Local\CrashDumps
2018-04-17 22:46 - 2018-04-17 22:51 - 000000000 ____D C:\Windows\system32\appmgmt
2018-04-17 22:35 - 2018-04-18 01:20 - 000003322 _____ C:\Windows\System32\Tasks\Launcher GIGABYTE AORUS GRAPHICS ENGINE
2018-04-17 22:35 - 2018-04-17 22:51 - 000000000 ____D C:\Program Files (x86)\GIGABYTE
2018-04-17 22:35 - 2018-04-17 22:35 - 000026792 ____N (GIGA-BYTE TECHNOLOGY CO., LTD.) C:\Windows\gdrv.sys
2018-04-17 22:35 - 2018-04-17 22:35 - 000000000 ____D C:\Users\Aaron\Documents\temp
2018-04-17 22:35 - 2018-04-17 22:35 - 000000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\GIGABYTE
2018-04-17 22:18 - 2018-04-17 22:18 - 000000000 ____D C:\Users\Aaron\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\TechPowerUp GPU-Z
2018-04-17 22:18 - 2018-04-17 22:18 - 000000000 ____D C:\Program Files (x86)\GPU-Z
2018-04-17 21:59 - 2016-11-14 08:30 - 001767712 _____ C:\Windows\system32\nvspcap64.dll
2018-04-17 21:59 - 2016-11-14 08:30 - 001756560 _____ C:\Windows\system32\nvspbridge64.dll
2018-04-17 21:59 - 2016-11-14 08:30 - 001377752 _____ C:\Windows\SysWOW64\nvspcap.dll
2018-04-17 21:59 - 2016-11-14 08:30 - 001316136 _____ C:\Windows\SysWOW64\nvspbridge.dll
2018-04-17 21:59 - 2016-11-14 08:30 - 000112168 _____ C:\Windows\system32\NvRtmpStreamer64.dll
2018-04-17 21:58 - 2018-04-17 22:53 - 000000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\NVIDIA Corporation
2018-04-17 21:58 - 2016-11-14 05:45 - 000615992 _____ (NVIDIA Corporation) C:\Windows\SysWOW64\nvStreaming.exe
2018-04-17 21:54 - 2018-04-17 21:54 - 000000000 ____D C:\Program Files (x86)\EVGA
2018-04-17 21:53 - 2016-11-14 08:30 - 031523384 _____ (NVIDIA Corporation) C:\Windows\system32\nvoglv64.dll
2018-04-17 21:53 - 2016-11-14 08:30 - 024208440 _____ (NVIDIA Corporation) C:\Windows\SysWOW64\nvoglv32.dll
2018-04-17 21:53 - 2016-11-14 08:30 - 023000000 _____ (NVIDIA Corporation) C:\Windows\system32\nvcompiler.dll
2018-04-17 21:53 - 2016-11-14 08:30 - 017559384 _____ (NVIDIA Corporation) C:\Windows\system32\nvd3dumx.dll
2018-04-17 21:53 - 2016-11-14 08:30 - 016128720 _____ (NVIDIA Corporation) C:\Windows\SysWOW64\nvwgf2um.dll
2018-04-17 21:53 - 2016-11-14 08:30 - 015301056 _____ (NVIDIA Corporation) C:\Windows\SysWOW64\nvcompiler.dll
2018-04-17 21:53 - 2016-11-14 08:30 - 014497712 _____ (NVIDIA Corporation) C:\Windows\SysWOW64\nvd3dum.dll
2018-04-17 21:53 - 2016-11-14 08:30 - 013915720 _____ (NVIDIA Corporation) C:\Windows\system32\nvopencl.dll
2018-04-17 21:53 - 2016-11-14 08:30 - 013826968 _____ (NVIDIA Corporation) C:\Windows\system32\nvcuda.dll
2018-04-17 21:53 - 2016-11-14 08:30 - 012905016 _____ (NVIDIA Corporation) C:\Windows\system32\Drivers\nvlddmkm.sys
2018-04-17 21:53 - 2016-11-14 08:30 - 011270656 _____ (NVIDIA Corporation) C:\Windows\SysWOW64\nvopencl.dll
2018-04-17 21:53 - 2016-11-14 08:30 - 011208312 _____ (NVIDIA Corporation) C:\Windows\SysWOW64\nvcuda.dll
2018-04-17 21:53 - 2016-11-14 08:30 - 004253240 _____ (NVIDIA Corporation) C:\Windows\system32\nvcuvid.dll
2018-04-17 21:53 - 2016-11-14 08:30 - 003995192 _____ (NVIDIA Corporation) C:\Windows\SysWOW64\nvcuvid.dll
2018-04-17 21:53 - 2016-11-14 08:30 - 002822568 _____ (NVIDIA Corporation) C:\Windows\SysWOW64\nvapi.dll
2018-04-17 21:53 - 2016-11-14 08:30 - 001908272 _____ (NVIDIA Corporation) C:\Windows\system32\nvdispco6434201.dll
2018-04-17 21:53 - 2016-11-14 08:30 - 001557552 _____ (NVIDIA Corporation) C:\Windows\system32\nvdispgenco6434201.dll
2018-04-17 21:53 - 2016-11-14 08:30 - 000951232 _____ (NVIDIA Corporation) C:\Windows\system32\NvIFR64.dll
2018-04-17 21:53 - 2016-11-14 08:30 - 000913856 _____ (NVIDIA Corporation) C:\Windows\SysWOW64\NvIFR.dll
2018-04-17 21:53 - 2016-11-14 08:30 - 000909760 _____ (NVIDIA Corporation) C:\Windows\system32\NvFBC64.dll
2018-04-17 21:53 - 2016-11-14 08:30 - 000876480 _____ (NVIDIA Corporation) C:\Windows\SysWOW64\NvFBC.dll
2018-04-17 21:53 - 2016-11-14 08:30 - 000104512 _____ (NVIDIA Corporation) C:\Windows\SysWOW64\nvaudcap32v.dll
2018-04-17 21:53 - 2016-11-14 08:30 - 000056384 _____ (NVIDIA Corporation) C:\Windows\system32\Drivers\nvvad64v.sys
2018-04-17 21:51 - 2018-04-17 21:51 - 000000000 ____D C:\NVIDIA
2018-04-16 20:14 - 2017-03-07 10:05 - 000243200 _____ (Microsoft Corporation) C:\Windows\system32\rdpudd.dll
2018-04-16 20:14 - 2016-03-23 18:40 - 003181568 _____ (Microsoft Corporation) C:\Windows\system32\rdpcorets.dll
2018-04-16 20:14 - 2016-03-23 18:40 - 000016384 _____ (Microsoft Corporation) C:\Windows\system32\RdpGroupPolicyExtension.dll
2018-04-16 20:01 - 2012-08-23 10:10 - 000019456 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\rdpvideominiport.sys
2018-04-16 20:01 - 2012-08-23 07:12 - 000192000 _____ (Microsoft Corporation) C:\Windows\SysWOW64\rdpendp_winip.dll
2018-04-16 20:01 - 2012-08-23 06:51 - 000228864 _____ (Microsoft Corporation) C:\Windows\system32\rdpendp_winip.dll
2018-04-16 19:47 - 2016-07-07 11:08 - 000046080 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\tcpipreg.sys
2018-04-16 19:47 - 2016-07-01 11:31 - 000976896 _____ (Microsoft Corporation) C:\Windows\system32\inetcomm.dll
2018-04-16 19:47 - 2016-07-01 11:31 - 000084480 _____ (Microsoft Corporation) C:\Windows\system32\INETRES.dll
2018-04-16 19:47 - 2016-07-01 11:13 - 000741888 _____ (Microsoft Corporation) C:\Windows\SysWOW64\inetcomm.dll
2018-04-16 19:47 - 2016-07-01 11:13 - 000084480 _____ (Microsoft Corporation) C:\Windows\SysWOW64\INETRES.dll
2018-04-16 19:47 - 2016-02-05 14:56 - 000020480 _____ (Microsoft Corporation) C:\Windows\system32\tbs.dll
2018-04-16 19:47 - 2016-02-05 14:54 - 000109568 _____ (Microsoft Corporation) C:\Windows\system32\fveapibase.dll
2018-04-16 19:47 - 2016-02-05 13:33 - 000015360 _____ (Microsoft Corporation) C:\Windows\SysWOW64\tbs.dll
2018-04-16 19:47 - 2015-07-22 20:02 - 000879104 _____ (Microsoft Corporation) C:\Windows\system32\tdh.dll
2018-04-16 19:47 - 2015-07-22 13:53 - 000635392 _____ (Microsoft Corporation) C:\Windows\SysWOW64\tdh.dll
2018-04-16 19:47 - 2015-06-03 16:21 - 000451080 _____ (Microsoft Corporation) C:\Windows\system32\fveapi.dll
2018-04-16 19:47 - 2013-12-03 22:27 - 000488448 _____ (Microsoft Corporation) C:\Windows\system32\secproc.dll
2018-04-16 19:47 - 2013-12-03 22:27 - 000485888 _____ (Microsoft Corporation) C:\Windows\system32\secproc_isv.dll
2018-04-16 19:47 - 2013-12-03 22:27 - 000123392 _____ (Microsoft Corporation) C:\Windows\system32\secproc_ssp_isv.dll
2018-04-16 19:47 - 2013-12-03 22:27 - 000123392 _____ (Microsoft Corporation) C:\Windows\system32\secproc_ssp.dll
2018-04-16 19:47 - 2013-12-03 22:26 - 000528384 _____ (Microsoft Corporation) C:\Windows\system32\msdrm.dll
2018-04-16 19:47 - 2013-12-03 22:16 - 000658432 _____ (Microsoft Corporation) C:\Windows\system32\RMActivate_isv.exe
2018-04-16 19:47 - 2013-12-03 22:16 - 000626176 _____ (Microsoft Corporation) C:\Windows\system32\RMActivate.exe
2018-04-16 19:47 - 2013-12-03 22:16 - 000553984 _____ (Microsoft Corporation) C:\Windows\system32\RMActivate_ssp.exe
2018-04-16 19:47 - 2013-12-03 22:16 - 000552960 _____ (Microsoft Corporation) C:\Windows\system32\RMActivate_ssp_isv.exe
2018-04-16 19:47 - 2013-12-03 22:03 - 000428032 _____ (Microsoft Corporation) C:\Windows\SysWOW64\secproc.dll
2018-04-16 19:47 - 2013-12-03 22:03 - 000423936 _____ (Microsoft Corporation) C:\Windows\SysWOW64\secproc_isv.dll
2018-04-16 19:47 - 2013-12-03 22:03 - 000087040 _____ (Microsoft Corporation) C:\Windows\SysWOW64\secproc_ssp_isv.dll
2018-04-16 19:47 - 2013-12-03 22:03 - 000087040 _____ (Microsoft Corporation) C:\Windows\SysWOW64\secproc_ssp.dll
2018-04-16 19:47 - 2013-12-03 22:02 - 000390144 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msdrm.dll
2018-04-16 19:47 - 2013-12-03 21:54 - 000594944 _____ (Microsoft Corporation) C:\Windows\SysWOW64\RMActivate_isv.exe
2018-04-16 19:47 - 2013-12-03 21:54 - 000572416 _____ (Microsoft Corporation) C:\Windows\SysWOW64\RMActivate.exe
2018-04-16 19:47 - 2013-12-03 21:54 - 000510976 _____ (Microsoft Corporation) C:\Windows\SysWOW64\RMActivate_ssp.exe
2018-04-16 19:47 - 2013-12-03 21:54 - 000508928 _____ (Microsoft Corporation) C:\Windows\SysWOW64\RMActivate_ssp_isv.exe
2018-04-16 19:47 - 2013-10-03 22:28 - 000190464 _____ (Microsoft Corporation) C:\Windows\system32\SmartcardCredentialProvider.dll
2018-04-16 19:47 - 2013-10-03 22:25 - 000197120 _____ (Microsoft Corporation) C:\Windows\system32\credui.dll
2018-04-16 19:47 - 2013-10-03 21:58 - 000152576 _____ (Microsoft Corporation) C:\Windows\SysWOW64\SmartcardCredentialProvider.dll
2018-04-16 19:47 - 2013-10-03 21:56 - 000168960 _____ (Microsoft Corporation) C:\Windows\SysWOW64\credui.dll
2018-04-16 19:47 - 2012-12-07 09:20 - 000441856 _____ (Microsoft Corporation) C:\Windows\system32\Wpc.dll
2018-04-16 19:47 - 2012-12-07 09:15 - 002746368 _____ (Microsoft Corporation) C:\Windows\system32\gameux.dll
2018-04-16 19:47 - 2012-12-07 08:26 - 000308736 _____ (Microsoft Corporation) C:\Windows\SysWOW64\Wpc.dll
2018-04-16 19:47 - 2012-12-07 08:20 - 002576384 _____ (Microsoft Corporation) C:\Windows\SysWOW64\gameux.dll
2018-04-16 19:47 - 2012-12-07 07:20 - 000045568 _____ (Microsoft) C:\Windows\system32\oflc-nz.rs
2018-04-16 19:47 - 2012-12-07 07:20 - 000044544 _____ (Microsoft) C:\Windows\system32\pegibbfc.rs
2018-04-16 19:47 - 2012-12-07 07:20 - 000043520 _____ (Microsoft) C:\Windows\system32\csrr.rs
2018-04-16 19:47 - 2012-12-07 07:20 - 000030720 _____ (Microsoft) C:\Windows\system32\usk.rs
2018-04-16 19:47 - 2012-12-07 07:20 - 000023552 _____ (Microsoft) C:\Windows\system32\oflc.rs
2018-04-16 19:47 - 2012-12-07 07:20 - 000020480 _____ (Microsoft) C:\Windows\system32\pegi-pt.rs
2018-04-16 19:47 - 2012-12-07 07:20 - 000020480 _____ (Microsoft) C:\Windows\system32\pegi-fi.rs
2018-04-16 19:47 - 2012-12-07 07:19 - 000055296 _____ (Microsoft) C:\Windows\system32\cero.rs
2018-04-16 19:47 - 2012-12-07 07:19 - 000051712 _____ (Microsoft) C:\Windows\system32\esrb.rs
2018-04-16 19:47 - 2012-12-07 07:19 - 000046592 _____ (Microsoft) C:\Windows\system32\fpb.rs
2018-04-16 19:47 - 2012-12-07 07:19 - 000040960 _____ (Microsoft) C:\Windows\system32\cob-au.rs
2018-04-16 19:47 - 2012-12-07 07:19 - 000021504 _____ (Microsoft) C:\Windows\system32\grb.rs
2018-04-16 19:47 - 2012-12-07 07:19 - 000020480 _____ (Microsoft) C:\Windows\system32\pegi.rs
2018-04-16 19:47 - 2012-12-07 07:19 - 000015360 _____ (Microsoft) C:\Windows\system32\djctq.rs
2018-04-16 19:47 - 2012-12-07 06:46 - 000055296 _____ (Microsoft) C:\Windows\SysWOW64\cero.rs
2018-04-16 19:47 - 2012-12-07 06:46 - 000051712 _____ (Microsoft) C:\Windows\SysWOW64\esrb.rs
2018-04-16 19:47 - 2012-12-07 06:46 - 000046592 _____ (Microsoft) C:\Windows\SysWOW64\fpb.rs
2018-04-16 19:47 - 2012-12-07 06:46 - 000045568 _____ (Microsoft) C:\Windows\SysWOW64\oflc-nz.rs
2018-04-16 19:47 - 2012-12-07 06:46 - 000044544 _____ (Microsoft) C:\Windows\SysWOW64\pegibbfc.rs
2018-04-16 19:47 - 2012-12-07 06:46 - 000043520 _____ (Microsoft) C:\Windows\SysWOW64\csrr.rs
2018-04-16 19:47 - 2012-12-07 06:46 - 000040960 _____ (Microsoft) C:\Windows\SysWOW64\cob-au.rs
2018-04-16 19:47 - 2012-12-07 06:46 - 000030720 _____ (Microsoft) C:\Windows\SysWOW64\usk.rs
2018-04-16 19:47 - 2012-12-07 06:46 - 000023552 _____ (Microsoft) C:\Windows\SysWOW64\oflc.rs
2018-04-16 19:47 - 2012-12-07 06:46 - 000021504 _____ (Microsoft) C:\Windows\SysWOW64\grb.rs
2018-04-16 19:47 - 2012-12-07 06:46 - 000020480 _____ (Microsoft) C:\Windows\SysWOW64\pegi-pt.rs
2018-04-16 19:47 - 2012-12-07 06:46 - 000020480 _____ (Microsoft) C:\Windows\SysWOW64\pegi-fi.rs
2018-04-16 19:47 - 2012-12-07 06:46 - 000020480 _____ (Microsoft) C:\Windows\SysWOW64\pegi.rs
2018-04-16 19:47 - 2012-12-07 06:46 - 000015360 _____ (Microsoft) C:\Windows\SysWOW64\djctq.rs
2018-04-16 19:47 - 2012-07-04 16:26 - 000041472 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\RNDISMP.sys
2018-04-16 19:34 - 2018-04-16 19:34 - 000000000 ____D C:\Users\Aaron\Documents\Nexus Mod Manager
2018-04-16 19:34 - 2018-04-16 19:34 - 000000000 ____D C:\Users\Aaron\AppData\Local\Black_Tree_Gaming
2018-04-16 19:34 - 2018-04-16 19:34 - 000000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Nexus Mod Manager
2018-04-14 21:57 - 2018-03-30 22:09 - 005583040 _____ (Microsoft Corporation) C:\Windows\system32\ntoskrnl.exe
2018-04-14 21:57 - 2018-03-30 22:09 - 000708288 _____ (Microsoft Corporation) C:\Windows\system32\winload.efi
2018-04-14 21:57 - 2018-03-30 22:09 - 000262336 _____ (Microsoft Corporation) C:\Windows\system32\hal.dll
2018-04-14 21:57 - 2018-03-30 22:09 - 000154816 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\ksecpkg.sys
2018-04-14 21:57 - 2018-03-30 22:09 - 000095424 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\ksecdd.sys
2018-04-14 21:57 - 2018-03-30 21:45 - 000631640 _____ (Microsoft Corporation) C:\Windows\system32\winresume.efi
2018-04-14 21:57 - 2018-03-30 21:39 - 004046528 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ntkrnlpa.exe
2018-04-14 21:57 - 2018-03-30 21:39 - 003958464 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ntoskrnl.exe
2018-04-14 21:57 - 2018-03-30 21:38 - 001665336 _____ (Microsoft Corporation) C:\Windows\system32\ntdll.dll
2018-04-14 21:57 - 2018-03-30 21:35 - 001461248 _____ (Microsoft Corporation) C:\Windows\system32\lsasrv.dll
2018-04-14 21:57 - 2018-03-30 21:35 - 001212928 _____ (Microsoft Corporation) C:\Windows\system32\rpcrt4.dll
2018-04-14 21:57 - 2018-03-30 21:35 - 001163264 _____ (Microsoft Corporation) C:\Windows\system32\kernel32.dll
2018-04-14 21:57 - 2018-03-30 21:35 - 000880640 _____ (Microsoft Corporation) C:\Windows\system32\advapi32.dll
2018-04-14 21:57 - 2018-03-30 21:35 - 000731648 _____ (Microsoft Corporation) C:\Windows\system32\kerberos.dll
2018-04-14 21:57 - 2018-03-30 21:35 - 000690688 _____ (Microsoft Corporation) C:\Windows\system32\adtschema.dll
2018-04-14 21:57 - 2018-03-30 21:35 - 000503808 _____ (Microsoft Corporation) C:\Windows\system32\srcore.dll
2018-04-14 21:57 - 2018-03-30 21:35 - 000463872 _____ (Microsoft Corporation) C:\Windows\system32\certcli.dll
2018-04-14 21:57 - 2018-03-30 21:35 - 000419840 _____ (Microsoft Corporation) C:\Windows\system32\KernelBase.dll
2018-04-14 21:57 - 2018-03-30 21:35 - 000361984 _____ (Microsoft Corporation) C:\Windows\system32\wow64win.dll
2018-04-14 21:57 - 2018-03-30 21:35 - 000345600 _____ (Microsoft Corporation) C:\Windows\system32\schannel.dll
2018-04-14 21:57 - 2018-03-30 21:35 - 000316928 _____ (Microsoft Corporation) C:\Windows\system32\msv1_0.dll
2018-04-14 21:57 - 2018-03-30 21:35 - 000312320 _____ (Microsoft Corporation) C:\Windows\system32\ncrypt.dll
2018-04-14 21:57 - 2018-03-30 21:35 - 000243712 _____ (Microsoft Corporation) C:\Windows\system32\wow64.dll
2018-04-14 21:57 - 2018-03-30 21:35 - 000215552 _____ (Microsoft Corporation) C:\Windows\system32\winsrv.dll
2018-04-14 21:57 - 2018-03-30 21:35 - 000210432 _____ (Microsoft Corporation) C:\Windows\system32\wdigest.dll
2018-04-14 21:57 - 2018-03-30 21:35 - 000190464 _____ (Microsoft Corporation) C:\Windows\system32\rpchttp.dll
2018-04-14 21:57 - 2018-03-30 21:35 - 000123904 _____ (Microsoft Corporation) C:\Windows\system32\bcrypt.dll
2018-04-14 21:57 - 2018-03-30 21:35 - 000094720 _____ (Microsoft Corporation) C:\Windows\system32\TSpkg.dll
2018-04-14 21:57 - 2018-03-30 21:35 - 000034816 _____ (Microsoft Corporation) C:\Windows\system32\appidsvc.dll
2018-04-14 21:57 - 2018-03-30 21:12 - 001314064 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ntdll.dll
2018-04-14 21:57 - 2018-03-30 21:09 - 001114112 _____ (Microsoft Corporation) C:\Windows\SysWOW64\kernel32.dll
2018-04-14 21:57 - 2018-03-30 21:09 - 000690688 _____ (Microsoft Corporation) C:\Windows\SysWOW64\adtschema.dll
2018-04-14 21:57 - 2018-03-30 21:09 - 000666112 _____ (Microsoft Corporation) C:\Windows\SysWOW64\rpcrt4.dll
2018-04-14 21:57 - 2018-03-30 21:09 - 000644096 _____ (Microsoft Corporation) C:\Windows\SysWOW64\advapi32.dll
2018-04-14 21:57 - 2018-03-30 21:09 - 000554496 _____ (Microsoft Corporation) C:\Windows\SysWOW64\kerberos.dll
2018-04-14 21:57 - 2018-03-30 21:09 - 000342528 _____ (Microsoft Corporation) C:\Windows\SysWOW64\certcli.dll
2018-04-14 21:57 - 2018-03-30 21:09 - 000275456 _____ (Microsoft Corporation) C:\Windows\SysWOW64\KernelBase.dll
2018-04-14 21:57 - 2018-03-30 21:09 - 000261120 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msv1_0.dll
2018-04-14 21:57 - 2018-03-30 21:09 - 000254464 _____ (Microsoft Corporation) C:\Windows\SysWOW64\schannel.dll
2018-04-14 21:57 - 2018-03-30 21:09 - 000223232 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ncrypt.dll
2018-04-14 21:57 - 2018-03-30 21:09 - 000172032 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wdigest.dll
2018-04-14 21:57 - 2018-03-30 21:09 - 000141312 _____ (Microsoft Corporation) C:\Windows\SysWOW64\rpchttp.dll
2018-04-14 21:57 - 2018-03-30 21:09 - 000082944 _____ (Microsoft Corporation) C:\Windows\SysWOW64\bcrypt.dll
2018-04-14 21:57 - 2018-03-30 21:09 - 000070144 _____ (Microsoft Corporation) C:\Windows\SysWOW64\TSpkg.dll
2018-04-14 21:57 - 2018-03-30 21:06 - 000148480 _____ (Microsoft Corporation) C:\Windows\system32\appidpolicyconverter.exe
2018-04-14 21:57 - 2018-03-30 21:06 - 000062464 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\appid.sys
2018-04-14 21:57 - 2018-03-30 21:03 - 000338432 _____ (Microsoft Corporation) C:\Windows\system32\conhost.exe
2018-04-14 21:57 - 2018-03-30 20:59 - 000160256 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\mrxsmb.sys
2018-04-14 21:57 - 2018-03-30 20:58 - 000291328 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\mrxsmb10.sys
2018-04-14 21:57 - 2018-03-30 20:58 - 000129536 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\mrxsmb20.sys
2018-04-14 21:57 - 2018-03-28 03:30 - 003225600 _____ (Microsoft Corporation) C:\Windows\system32\win32k.sys
2018-04-14 21:57 - 2018-03-23 14:50 - 000396952 _____ (Microsoft Corporation) C:\Windows\system32\iedkcs32.dll
2018-04-14 21:57 - 2018-03-23 13:59 - 000348824 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iedkcs32.dll
2018-04-14 21:57 - 2018-03-22 19:00 - 025742336 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.dll
2018-04-14 21:57 - 2018-03-22 17:32 - 002724864 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.tlb
2018-04-14 21:57 - 2018-03-22 17:32 - 000004096 _____ (Microsoft Corporation) C:\Windows\system32\ieetwcollectorres.dll
2018-04-14 21:57 - 2018-03-22 17:26 - 020287488 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.dll
2018-04-14 21:57 - 2018-03-22 17:19 - 002901504 _____ (Microsoft Corporation) C:\Windows\system32\iertutil.dll
2018-04-14 21:57 - 2018-03-22 17:18 - 000066560 _____ (Microsoft Corporation) C:\Windows\system32\iesetup.dll
2018-04-14 21:57 - 2018-03-22 17:17 - 000578048 _____ (Microsoft Corporation) C:\Windows\system32\vbscript.dll
2018-04-14 21:57 - 2018-03-22 17:17 - 000417280 _____ (Microsoft Corporation) C:\Windows\system32\html.iec
2018-04-14 21:57 - 2018-03-22 17:17 - 000088064 _____ (Microsoft Corporation) C:\Windows\system32\MshtmlDac.dll
2018-04-14 21:57 - 2018-03-22 17:17 - 000048640 _____ (Microsoft Corporation) C:\Windows\system32\ieetwproxystub.dll
2018-04-14 21:57 - 2018-03-22 17:15 - 005780480 _____ (Microsoft Corporation) C:\Windows\system32\jscript9.dll
2018-04-14 21:57 - 2018-03-22 17:10 - 000054784 _____ (Microsoft Corporation) C:\Windows\system32\jsproxy.dll
2018-04-14 21:57 - 2018-03-22 17:09 - 000034304 _____ (Microsoft Corporation) C:\Windows\system32\iernonce.dll
2018-04-14 21:57 - 2018-03-22 17:07 - 000615936 _____ (Microsoft Corporation) C:\Windows\system32\ieui.dll
2018-04-14 21:57 - 2018-03-22 17:06 - 000794112 _____ (Microsoft Corporation) C:\Windows\system32\jscript.dll
2018-04-14 21:57 - 2018-03-22 17:06 - 000144384 _____ (Microsoft Corporation) C:\Windows\system32\ieUnatt.exe
2018-04-14 21:57 - 2018-03-22 17:06 - 000116224 _____ (Microsoft Corporation) C:\Windows\system32\ieetwcollector.exe
2018-04-14 21:57 - 2018-03-22 17:05 - 000814080 _____ (Microsoft Corporation) C:\Windows\system32\jscript9diag.dll
2018-04-14 21:57 - 2018-03-22 17:04 - 002724864 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.tlb
2018-04-14 21:57 - 2018-03-22 16:58 - 000969216 _____ (Microsoft Corporation) C:\Windows\system32\MsSpellCheckingFacility.exe
2018-04-14 21:57 - 2018-03-22 16:55 - 000489984 _____ (Microsoft Corporation) C:\Windows\system32\dxtmsft.dll
2018-04-14 21:57 - 2018-03-22 16:52 - 000499712 _____ (Microsoft Corporation) C:\Windows\SysWOW64\vbscript.dll
2018-04-14 21:57 - 2018-03-22 16:52 - 000062464 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iesetup.dll
2018-04-14 21:57 - 2018-03-22 16:51 - 000341504 _____ (Microsoft Corporation) C:\Windows\SysWOW64\html.iec
2018-04-14 21:57 - 2018-03-22 16:51 - 000047616 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieetwproxystub.dll
2018-04-14 21:57 - 2018-03-22 16:50 - 000064000 _____ (Microsoft Corporation) C:\Windows\SysWOW64\MshtmlDac.dll
2018-04-14 21:57 - 2018-03-22 16:49 - 000077824 _____ (Microsoft Corporation) C:\Windows\system32\JavaScriptCollectionAgent.dll
2018-04-14 21:57 - 2018-03-22 16:48 - 002295296 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iertutil.dll
2018-04-14 21:57 - 2018-03-22 16:48 - 000107520 _____ (Microsoft Corporation) C:\Windows\system32\inseng.dll
2018-04-14 21:57 - 2018-03-22 16:48 - 000087552 _____ (Microsoft Corporation) C:\Windows\system32\tdc.ocx
2018-04-14 21:57 - 2018-03-22 16:45 - 000199680 _____ (Microsoft Corporation) C:\Windows\system32\msrating.dll
2018-04-14 21:57 - 2018-03-22 16:45 - 000047104 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jsproxy.dll
2018-04-14 21:57 - 2018-03-22 16:45 - 000030720 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iernonce.dll
2018-04-14 21:57 - 2018-03-22 16:44 - 000092160 _____ (Microsoft Corporation) C:\Windows\system32\mshtmled.dll
2018-04-14 21:57 - 2018-03-22 16:43 - 000476160 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieui.dll
2018-04-14 21:57 - 2018-03-22 16:42 - 000661504 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript.dll
2018-04-14 21:57 - 2018-03-22 16:42 - 000315392 _____ (Microsoft Corporation) C:\Windows\system32\dxtrans.dll
2018-04-14 21:57 - 2018-03-22 16:42 - 000115712 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieUnatt.exe
2018-04-14 21:57 - 2018-03-22 16:41 - 000620032 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript9diag.dll
2018-04-14 21:57 - 2018-03-22 16:40 - 000152064 _____ (Microsoft Corporation) C:\Windows\system32\occache.dll
2018-04-14 21:57 - 2018-03-22 16:33 - 000416256 _____ (Microsoft Corporation) C:\Windows\SysWOW64\dxtmsft.dll
2018-04-14 21:57 - 2018-03-22 16:31 - 000262144 _____ (Microsoft Corporation) C:\Windows\system32\webcheck.dll
2018-04-14 21:57 - 2018-03-22 16:29 - 015282688 _____ (Microsoft Corporation) C:\Windows\system32\ieframe.dll
2018-04-14 21:57 - 2018-03-22 16:29 - 000809472 _____ (Microsoft Corporation) C:\Windows\system32\msfeeds.dll
2018-04-14 21:57 - 2018-03-22 16:29 - 000728064 _____ (Microsoft Corporation) C:\Windows\system32\ie4uinit.exe
2018-04-14 21:57 - 2018-03-22 16:29 - 000060416 _____ (Microsoft Corporation) C:\Windows\SysWOW64\JavaScriptCollectionAgent.dll
2018-04-14 21:57 - 2018-03-22 16:28 - 000091136 _____ (Microsoft Corporation) C:\Windows\SysWOW64\inseng.dll
2018-04-14 21:57 - 2018-03-22 16:28 - 000073216 _____ (Microsoft Corporation) C:\Windows\SysWOW64\tdc.ocx
2018-04-14 21:57 - 2018-03-22 16:27 - 002135552 _____ (Microsoft Corporation) C:\Windows\system32\inetcpl.cpl
2018-04-14 21:57 - 2018-03-22 16:27 - 001359360 _____ (Microsoft Corporation) C:\Windows\system32\mshtmlmedia.dll
2018-04-14 21:57 - 2018-03-22 16:25 - 000168960 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msrating.dll
2018-04-14 21:57 - 2018-03-22 16:25 - 000076288 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtmled.dll
2018-04-14 21:57 - 2018-03-22 16:24 - 000279040 _____ (Microsoft Corporation) C:\Windows\SysWOW64\dxtrans.dll
2018-04-14 21:57 - 2018-03-22 16:22 - 000130048 _____ (Microsoft Corporation) C:\Windows\SysWOW64\occache.dll
2018-04-14 21:57 - 2018-03-22 16:21 - 004496896 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript9.dll
2018-04-14 21:57 - 2018-03-22 16:20 - 013680128 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieframe.dll
2018-04-14 21:57 - 2018-03-22 16:17 - 000230400 _____ (Microsoft Corporation) C:\Windows\SysWOW64\webcheck.dll
2018-04-14 21:57 - 2018-03-22 16:15 - 003241472 _____ (Microsoft Corporation) C:\Windows\system32\wininet.dll
2018-04-14 21:57 - 2018-03-22 16:15 - 000696320 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msfeeds.dll
2018-04-14 21:57 - 2018-03-22 16:14 - 002059776 _____ (Microsoft Corporation) C:\Windows\SysWOW64\inetcpl.cpl
2018-04-14 21:57 - 2018-03-22 16:14 - 001155072 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtmlmedia.dll
2018-04-14 21:57 - 2018-03-22 16:04 - 001545728 _____ (Microsoft Corporation) C:\Windows\system32\urlmon.dll
2018-04-14 21:57 - 2018-03-22 15:55 - 002767872 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wininet.dll
2018-04-14 21:57 - 2018-03-22 15:53 - 000800768 _____ (Microsoft Corporation) C:\Windows\system32\ieapfltr.dll
2018-04-14 21:57 - 2018-03-22 15:52 - 001313792 _____ (Microsoft Corporation) C:\Windows\SysWOW64\urlmon.dll
2018-04-14 21:57 - 2018-03-22 15:51 - 000710144 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieapfltr.dll
2018-04-14 21:57 - 2018-03-10 13:11 - 000340480 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msexcl40.dll
2018-04-14 21:57 - 2018-03-09 14:18 - 000309440 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\atmfd.dll
2018-04-14 21:57 - 2018-03-09 14:12 - 000383680 _____ (Adobe Systems Incorporated) C:\Windows\system32\atmfd.dll
2018-04-14 21:57 - 2018-03-09 14:12 - 000111616 _____ (Microsoft Corporation) C:\Windows\SysWOW64\t2embed.dll
2018-04-14 21:57 - 2018-03-09 14:12 - 000071680 _____ (Microsoft Corporation) C:\Windows\SysWOW64\fontsub.dll
2018-04-14 21:57 - 2018-03-09 14:07 - 000152064 _____ (Microsoft Corporation) C:\Windows\system32\t2embed.dll
2018-04-14 21:57 - 2018-03-09 14:07 - 000100864 _____ (Microsoft Corporation) C:\Windows\system32\fontsub.dll
2018-04-14 21:57 - 2018-03-06 14:13 - 000148160 _____ (Microsoft Corporation) C:\Windows\SysWOW64\basecsp.dll
2018-04-14 21:57 - 2018-03-06 14:11 - 000184320 _____ (Microsoft Corporation) C:\Windows\SysWOW64\scksp.dll
2018-04-14 21:57 - 2018-03-06 14:10 - 000170176 _____ (Microsoft Corporation) C:\Windows\system32\basecsp.dll
2018-04-14 21:57 - 2018-03-06 14:07 - 000229376 _____ (Microsoft Corporation) C:\Windows\system32\scksp.dll
2018-04-14 21:57 - 2018-02-21 23:28 - 000217600 _____ (Microsoft Corporation) C:\Windows\system32\WinSCard.dll
2018-04-14 21:57 - 2018-02-21 23:06 - 000134656 _____ (Microsoft Corporation) C:\Windows\SysWOW64\WinSCard.dll
2018-04-14 21:57 - 2018-02-18 17:34 - 000634272 _____ (Microsoft Corporation) C:\Windows\system32\winload.exe
2018-04-14 21:57 - 2018-02-10 14:35 - 000367296 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\msrpc.sys
2018-04-14 21:57 - 2018-02-10 14:35 - 000334528 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\acpi.sys
2018-04-14 21:57 - 2018-02-10 14:35 - 000185024 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\pci.sys
2018-04-14 21:57 - 2018-02-10 14:35 - 000122560 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\NV_AGP.SYS
2018-04-14 21:57 - 2018-02-10 14:35 - 000068288 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\volmgr.sys
2018-04-14 21:57 - 2018-02-10 14:35 - 000064192 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\ULIAGPKX.SYS
2018-04-14 21:57 - 2018-02-10 14:35 - 000063168 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\termdd.sys
2018-04-14 21:57 - 2018-02-10 14:35 - 000060608 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\AGP440.sys
2018-04-14 21:57 - 2018-02-10 14:35 - 000036032 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\vdrvroot.sys
2018-04-14 21:57 - 2018-02-10 14:35 - 000031936 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\mssmbios.sys
2018-04-14 21:57 - 2018-02-10 14:35 - 000023744 _____ (Microsoft Corporation) C:\Windows\system32\streamci.dll
2018-04-14 21:57 - 2018-02-10 14:35 - 000020160 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\isapnp.sys
2018-04-14 21:57 - 2018-02-10 14:35 - 000015040 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\msisadrv.sys
2018-04-14 21:57 - 2018-02-10 14:35 - 000012096 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\swenum.sys
2018-04-14 21:57 - 2018-02-10 14:23 - 002292224 _____ (Microsoft Corporation) C:\Windows\SysWOW64\MSVidCtl.dll
2018-04-14 21:57 - 2018-02-10 14:23 - 000330240 _____ (Microsoft Corporation) C:\Windows\SysWOW64\zipfldr.dll
2018-04-14 21:57 - 2018-02-10 14:11 - 003665920 _____ (Microsoft Corporation) C:\Windows\system32\MSVidCtl.dll
2018-04-14 21:57 - 2018-02-10 14:11 - 000369664 _____ (Microsoft Corporation) C:\Windows\system32\zipfldr.dll
2018-04-14 21:57 - 2018-02-10 13:26 - 000653312 _____ (Microsoft Corporation) C:\Windows\system32\msra.exe
2018-04-14 21:57 - 2018-02-02 14:40 - 000114368 _____ (Microsoft Corporation) C:\Windows\system32\consent.exe
2018-04-14 21:57 - 2018-02-02 14:29 - 002365952 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msi.dll
2018-04-14 21:57 - 2018-02-02 14:29 - 000337408 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msihnd.dll
2018-04-14 21:57 - 2018-02-02 14:28 - 001806848 _____ (Microsoft Corporation) C:\Windows\SysWOW64\authui.dll
2018-04-14 21:57 - 2018-02-02 14:16 - 003246080 _____ (Microsoft Corporation) C:\Windows\system32\msi.dll
2018-04-14 21:57 - 2018-02-02 14:16 - 000504320 _____ (Microsoft Corporation) C:\Windows\system32\msihnd.dll
2018-04-14 21:57 - 2018-02-02 14:14 - 001942016 _____ (Microsoft Corporation) C:\Windows\system32\authui.dll
2018-04-14 21:57 - 2018-02-02 14:14 - 000070144 _____ (Microsoft Corporation) C:\Windows\system32\appinfo.dll
2018-04-14 21:57 - 2018-02-02 13:46 - 000073216 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msiexec.exe
2018-04-14 21:57 - 2018-02-02 13:36 - 000128512 _____ (Microsoft Corporation) C:\Windows\system32\msiexec.exe
2018-04-14 21:57 - 2018-01-25 10:05 - 000995272 _____ (Microsoft Corporation) C:\Windows\system32\ucrtbase.dll
2018-04-14 21:57 - 2018-01-25 10:05 - 000063832 _____ (Microsoft Corporation) C:\Windows\system32\api-ms-win-crt-private-l1-1-0.dll
2018-04-14 21:57 - 2018-01-25 10:05 - 000020824 _____ (Microsoft Corporation) C:\Windows\system32\api-ms-win-crt-math-l1-1-0.dll
2018-04-14 21:57 - 2018-01-25 10:05 - 000019800 _____ (Microsoft Corporation) C:\Windows\system32\api-ms-win-crt-multibyte-l1-1-0.dll
2018-04-14 21:57 - 2018-01-25 10:05 - 000017752 _____ (Microsoft Corporation) C:\Windows\system32\api-ms-win-crt-string-l1-1-0.dll
2018-04-14 21:57 - 2018-01-25 10:05 - 000017752 _____ (Microsoft Corporation) C:\Windows\system32\api-ms-win-crt-stdio-l1-1-0.dll
2018-04-14 21:57 - 2018-01-25 10:05 - 000016216 _____ (Microsoft Corporation) C:\Windows\system32\api-ms-win-crt-runtime-l1-1-0.dll
2018-04-14 21:57 - 2018-01-25 10:05 - 000015704 _____ (Microsoft Corporation) C:\Windows\system32\api-ms-win-crt-convert-l1-1-0.dll
2018-04-14 21:57 - 2018-01-25 10:05 - 000014168 _____ (Microsoft Corporation) C:\Windows\system32\api-ms-win-crt-time-l1-1-0.dll
2018-04-14 21:57 - 2018-01-25 10:05 - 000014168 _____ (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-localization-l1-2-0.dll
2018-04-14 21:57 - 2018-01-25 10:05 - 000013656 _____ (Microsoft Corporation) C:\Windows\system32\api-ms-win-crt-filesystem-l1-1-0.dll
2018-04-14 21:57 - 2018-01-25 10:05 - 000012632 _____ (Microsoft Corporation) C:\Windows\system32\api-ms-win-crt-process-l1-1-0.dll
2018-04-14 21:57 - 2018-01-25 10:05 - 000012632 _____ (Microsoft Corporation) C:\Windows\system32\api-ms-win-crt-heap-l1-1-0.dll
2018-04-14 21:57 - 2018-01-25 10:05 - 000012632 _____ (Microsoft Corporation) C:\Windows\system32\api-ms-win-crt-conio-l1-1-0.dll
2018-04-14 21:57 - 2018-01-25 10:05 - 000012120 _____ (Microsoft Corporation) C:\Windows\system32\api-ms-win-crt-utility-l1-1-0.dll
2018-04-14 21:57 - 2018-01-25 10:05 - 000012120 _____ (Microsoft Corporation) C:\Windows\system32\api-ms-win-crt-locale-l1-1-0.dll
2018-04-14 21:57 - 2018-01-25 10:05 - 000012120 _____ (Microsoft Corporation) C:\Windows\system32\api-ms-win-crt-environment-l1-1-0.dll
2018-04-14 21:57 - 2018-01-25 10:05 - 000012120 _____ (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-synch-l1-2-0.dll
2018-04-14 21:57 - 2018-01-25 10:05 - 000012120 _____ (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-processthreads-l1-1-1.dll
2018-04-14 21:57 - 2018-01-25 10:05 - 000011608 _____ (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-xstate-l2-1-0.dll
2018-04-14 21:57 - 2018-01-25 10:05 - 000011608 _____ (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-timezone-l1-1-0.dll
2018-04-14 21:57 - 2018-01-25 10:05 - 000011608 _____ (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-file-l2-1-0.dll
2018-04-14 21:57 - 2018-01-25 10:05 - 000011608 _____ (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-file-l1-2-0.dll
2018-04-14 21:57 - 2018-01-25 10:04 - 000922944 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ucrtbase.dll
2018-04-14 21:57 - 2018-01-25 10:04 - 000066392 _____ (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-crt-private-l1-1-0.dll
2018-04-14 21:57 - 2018-01-25 10:04 - 000022360 _____ (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-crt-math-l1-1-0.dll
2018-04-14 21:57 - 2018-01-25 10:04 - 000019800 _____ (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-crt-multibyte-l1-1-0.dll
2018-04-14 21:57 - 2018-01-25 10:04 - 000017752 _____ (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-crt-string-l1-1-0.dll
2018-04-14 21:57 - 2018-01-25 10:04 - 000017752 _____ (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-crt-stdio-l1-1-0.dll
2018-04-14 21:57 - 2018-01-25 10:04 - 000016216 _____ (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-crt-runtime-l1-1-0.dll
2018-04-14 21:57 - 2018-01-25 10:04 - 000015704 _____ (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-crt-convert-l1-1-0.dll
2018-04-14 21:57 - 2018-01-25 10:04 - 000014168 _____ (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-crt-time-l1-1-0.dll
2018-04-14 21:57 - 2018-01-25 10:04 - 000014168 _____ (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-localization-l1-2-0.dll
2018-04-14 21:57 - 2018-01-25 10:04 - 000013656 _____ (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-crt-filesystem-l1-1-0.dll
2018-04-14 21:57 - 2018-01-25 10:04 - 000012632 _____ (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-crt-process-l1-1-0.dll
2018-04-14 21:57 - 2018-01-25 10:04 - 000012632 _____ (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-crt-heap-l1-1-0.dll
2018-04-14 21:57 - 2018-01-25 10:04 - 000012632 _____ (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-crt-conio-l1-1-0.dll
2018-04-14 21:57 - 2018-01-25 10:04 - 000012120 _____ (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-crt-utility-l1-1-0.dll
2018-04-14 21:57 - 2018-01-25 10:04 - 000012120 _____ (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-crt-locale-l1-1-0.dll
2018-04-14 21:57 - 2018-01-25 10:04 - 000012120 _____ (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-crt-environment-l1-1-0.dll
2018-04-14 21:57 - 2018-01-25 10:04 - 000012120 _____ (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-synch-l1-2-0.dll
2018-04-14 21:57 - 2018-01-25 10:04 - 000012120 _____ (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-processthreads-l1-1-1.dll
2018-04-14 21:57 - 2018-01-25 10:04 - 000011608 _____ (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-xstate-l2-1-0.dll
2018-04-14 21:57 - 2018-01-25 10:04 - 000011608 _____ (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-timezone-l1-1-0.dll
2018-04-14 21:57 - 2018-01-25 10:04 - 000011608 _____ (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-file-l2-1-0.dll
2018-04-14 21:57 - 2018-01-25 10:04 - 000011608 _____ (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-file-l1-2-0.dll
2018-04-14 21:57 - 2018-01-12 12:44 - 001894120 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\tcpip.sys
2018-04-14 21:57 - 2018-01-12 12:44 - 000377064 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\netio.sys
2018-04-14 21:57 - 2018-01-12 12:44 - 000371432 _____ (Microsoft Corporation) C:\Windows\system32\clfs.sys
2018-04-14 21:57 - 2018-01-12 12:44 - 000287976 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\FWPKCLNT.SYS
2018-04-14 21:57 - 2018-01-12 12:40 - 000484864 _____ (Microsoft Corporation) C:\Windows\system32\StructuredQuery.dll
2018-04-14 21:57 - 2018-01-12 12:40 - 000407040 _____ (Microsoft Corporation) C:\Windows\system32\scesrv.dll
2018-04-14 21:57 - 2018-01-12 12:27 - 004834816 _____ (Microsoft Corporation) C:\Windows\system32\xpsrchvw.exe
2018-04-14 21:57 - 2018-01-12 12:26 - 000363520 _____ (Microsoft Corporation) C:\Windows\SysWOW64\StructuredQuery.dll
2018-04-14 21:57 - 2018-01-12 12:26 - 000308224 _____ (Microsoft Corporation) C:\Windows\SysWOW64\scesrv.dll
2018-04-14 21:57 - 2018-01-12 12:16 - 003405824 _____ (Microsoft Corporation) C:\Windows\SysWOW64\xpsrchvw.exe
2018-04-14 21:57 - 2018-01-12 12:16 - 000076288 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\hidclass.sys
2018-04-14 21:57 - 2018-01-12 12:15 - 000032896 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\hidparse.sys
2018-04-14 21:57 - 2018-01-11 12:41 - 001133568 _____ (Microsoft Corporation) C:\Windows\system32\cdosys.dll
2018-04-14 21:57 - 2018-01-11 12:22 - 000805376 _____ (Microsoft Corporation) C:\Windows\SysWOW64\cdosys.dll
2018-04-14 21:57 - 2017-12-31 22:21 - 001680616 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\ntfs.sys
2018-04-14 21:57 - 2017-12-31 22:21 - 000948968 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\ndis.sys
2018-04-14 21:57 - 2017-12-31 22:21 - 000288488 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\fltMgr.sys
2018-04-14 21:57 - 2017-12-31 22:21 - 000213736 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\rdyboost.sys
2018-04-14 21:57 - 2017-12-31 22:18 - 014183936 _____ (Microsoft Corporation) C:\Windows\system32\shell32.dll
2018-04-14 21:57 - 2017-12-31 22:18 - 002066432 _____ (Microsoft Corporation) C:\Windows\system32\ole32.dll
2018-04-14 21:57 - 2017-12-31 22:18 - 002004480 _____ (Microsoft Corporation) C:\Windows\system32\msxml6.dll
2018-04-14 21:57 - 2017-12-31 22:18 - 001867776 _____ (Microsoft Corporation) C:\Windows\system32\ExplorerFrame.dll
2018-04-14 21:57 - 2017-12-31 22:18 - 001741312 _____ (Microsoft Corporation) C:\Windows\system32\sysmain.dll
2018-04-14 21:57 - 2017-12-31 22:18 - 001361408 _____ (Microsoft Corporation) C:\Windows\system32\PeerDistSvc.dll
2018-04-14 21:57 - 2017-12-31 22:18 - 001110528 _____ (Microsoft Corporation) C:\Windows\system32\schedsvc.dll
2018-04-14 21:57 - 2017-12-31 22:18 - 000961024 _____ (Microsoft Corporation) C:\Windows\system32\actxprxy.dll
2018-04-14 21:57 - 2017-12-31 22:18 - 000863232 _____ (Microsoft Corporation) C:\Windows\system32\IKEEXT.DLL
2018-04-14 21:57 - 2017-12-31 22:18 - 000842752 _____ (Microsoft Corporation) C:\Windows\system32\nshwfp.dll
2018-04-14 21:57 - 2017-12-31 22:18 - 000828928 _____ (Microsoft Corporation) C:\Windows\system32\MPSSVC.dll
2018-04-14 21:57 - 2017-12-31 22:18 - 000749568 _____ (Microsoft Corporation) C:\Windows\system32\FirewallAPI.dll
2018-04-14 21:57 - 2017-12-31 22:18 - 000705024 _____ (Microsoft Corporation) C:\Windows\system32\BFE.DLL
2018-04-14 21:57 - 2017-12-31 22:18 - 000512000 _____ (Microsoft Corporation) C:\Windows\system32\rpcss.dll
2018-04-14 21:57 - 2017-12-31 22:18 - 000473600 _____ (Microsoft Corporation) C:\Windows\system32\taskcomp.dll
2018-04-14 21:57 - 2017-12-31 22:18 - 000444928 _____ (Microsoft Corporation) C:\Windows\system32\winhttp.dll
2018-04-14 21:57 - 2017-12-31 22:18 - 000439296 _____ (Microsoft Corporation) C:\Windows\system32\p2psvc.dll
2018-04-14 21:57 - 2017-12-31 22:18 - 000366592 _____ (Microsoft Corporation) C:\Windows\system32\wcncsvc.dll
2018-04-14 21:57 - 2017-12-31 22:18 - 000327168 _____ (Microsoft Corporation) C:\Windows\system32\pnrpsvc.dll
2018-04-14 21:57 - 2017-12-31 22:18 - 000324096 _____ (Microsoft Corporation) C:\Windows\system32\FWPUCLNT.DLL
2018-04-14 21:57 - 2017-12-31 22:18 - 000303104 _____ (Microsoft Corporation) C:\Windows\system32\nlasvc.dll
2018-04-14 21:57 - 2017-12-31 22:18 - 000264704 _____ (Microsoft Corporation) C:\Windows\system32\P2P.dll
2018-04-14 21:57 - 2017-12-31 22:18 - 000223232 _____ (Microsoft Corporation) C:\Windows\system32\ncsi.dll
2018-04-14 21:57 - 2017-12-31 22:18 - 000181760 _____ (Microsoft Corporation) C:\Windows\system32\PeerDist.dll
2018-04-14 21:57 - 2017-12-31 22:18 - 000120320 _____ (Microsoft Corporation) C:\Windows\system32\WcnApi.dll
2018-04-14 21:57 - 2017-12-31 22:18 - 000108544 _____ (Microsoft Corporation) C:\Windows\system32\icfupgd.dll
2018-04-14 21:57 - 2017-12-31 22:18 - 000101376 _____ (Microsoft Corporation) C:\Windows\system32\fdWCN.dll
2018-04-14 21:57 - 2017-12-31 22:18 - 000070656 _____ (Microsoft Corporation) C:\Windows\system32\nlaapi.dll
2018-04-14 21:57 - 2017-12-31 22:04 - 000559616 _____ (Microsoft Corporation) C:\Windows\system32\spoolsv.exe
2018-04-14 21:57 - 2017-12-31 22:00 - 012880384 _____ (Microsoft Corporation) C:\Windows\SysWOW64\shell32.dll
2018-04-14 21:57 - 2017-12-31 22:00 - 001499648 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ExplorerFrame.dll
2018-04-14 21:57 - 2017-12-31 22:00 - 001417728 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ole32.dll
2018-04-14 21:57 - 2017-12-31 22:00 - 001390080 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msxml6.dll
2018-04-14 21:57 - 2017-12-31 22:00 - 000666624 _____ (Microsoft Corporation) C:\Windows\SysWOW64\nshwfp.dll
2018-04-14 21:57 - 2017-12-31 22:00 - 000463360 _____ (Microsoft Corporation) C:\Windows\SysWOW64\FirewallAPI.dll
2018-04-14 21:57 - 2017-12-31 22:00 - 000351744 _____ (Microsoft Corporation) C:\Windows\SysWOW64\winhttp.dll
2018-04-14 21:57 - 2017-12-31 22:00 - 000304640 _____ (Microsoft Corporation) C:\Windows\SysWOW64\taskcomp.dll
2018-04-14 21:57 - 2017-12-31 22:00 - 000276992 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wcncsvc.dll
2018-04-14 21:57 - 2017-12-31 22:00 - 000217600 _____ (Microsoft Corporation) C:\Windows\SysWOW64\P2P.dll
2018-04-14 21:57 - 2017-12-31 22:00 - 000216576 _____ (Microsoft Corporation) C:\Windows\SysWOW64\FWPUCLNT.DLL
2018-04-14 21:57 - 2017-12-31 22:00 - 000162304 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ncsi.dll
2018-04-14 21:57 - 2017-12-31 22:00 - 000139776 _____ (Microsoft Corporation) C:\Windows\SysWOW64\PeerDist.dll
2018-04-14 21:57 - 2017-12-31 21:59 - 000309760 _____ (Microsoft Corporation) C:\Windows\SysWOW64\actxprxy.dll
2018-04-14 21:57 - 2017-12-31 21:55 - 000131584 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\pacer.sys
2018-04-14 21:57 - 2017-12-31 21:55 - 000088576 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\wanarp.sys
2018-04-14 21:57 - 2017-12-31 21:55 - 000058368 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\ndproxy.sys
2018-04-14 21:57 - 2017-12-31 21:55 - 000045056 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\netbios.sys
2018-04-14 21:57 - 2017-12-31 21:50 - 000455680 _____ (Microsoft Corporation) C:\Windows\system32\winlogon.exe
2018-04-14 21:57 - 2017-12-31 21:47 - 000244224 _____ (Microsoft Corporation) C:\Windows\system32\vmicsvc.exe
2018-04-14 21:57 - 2017-12-31 21:46 - 000128512 _____ (Microsoft Corporation) C:\Windows\system32\IcCoinstall.dll
2018-04-14 21:57 - 2017-12-31 21:42 - 000460288 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\srv.sys
2018-04-14 21:57 - 2017-12-31 21:42 - 000406016 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\srv2.sys
2018-04-14 21:57 - 2017-12-31 21:42 - 000168448 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\srvnet.sys
2018-04-14 21:57 - 2017-12-31 21:41 - 000754176 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\http.sys
2018-04-14 21:57 - 2017-12-31 21:41 - 000106496 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\dfsc.sys
2018-04-14 21:57 - 2017-12-05 13:36 - 001484288 _____ (Microsoft Corporation) C:\Windows\system32\crypt32.dll
2018-04-14 21:57 - 2017-12-05 13:36 - 000625664 _____ (Microsoft Corporation) C:\Windows\system32\mscms.dll
2018-04-14 21:57 - 2017-12-05 13:36 - 000250880 _____ (Microsoft Corporation) C:\Windows\system32\icm32.dll
2018-04-14 21:57 - 2017-12-05 13:36 - 000229376 _____ (Microsoft Corporation) C:\Windows\system32\wintrust.dll
2018-04-14 21:57 - 2017-12-05 13:36 - 000190976 _____ (Microsoft Corporation) C:\Windows\system32\cryptsvc.dll
2018-04-14 21:57 - 2017-12-05 13:36 - 000141824 _____ (Microsoft Corporation) C:\Windows\system32\cryptnet.dll
2018-04-14 21:57 - 2017-12-05 13:36 - 000092160 _____ (Microsoft Corporation) C:\Windows\system32\TabSvc.dll
2018-04-14 21:57 - 2017-12-05 13:08 - 001176576 _____ (Microsoft Corporation) C:\Windows\SysWOW64\crypt32.dll
2018-04-14 21:57 - 2017-12-05 13:08 - 000481792 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mscms.dll
2018-04-14 21:57 - 2017-12-05 13:08 - 000215040 _____ (Microsoft Corporation) C:\Windows\SysWOW64\icm32.dll
2018-04-14 21:57 - 2017-12-05 13:08 - 000179200 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wintrust.dll
2018-04-14 21:57 - 2017-12-05 13:08 - 000145920 _____ (Microsoft Corporation) C:\Windows\SysWOW64\cryptsvc.dll
2018-04-14 21:57 - 2017-12-05 13:08 - 000106496 _____ (Microsoft Corporation) C:\Windows\SysWOW64\cryptnet.dll
2018-04-14 21:57 - 2017-12-05 12:04 - 000404992 _____ (Microsoft Corporation) C:\Windows\system32\wisptis.exe
2018-04-14 21:56 - 2018-03-30 21:35 - 000146432 _____ (Microsoft Corporation) C:\Windows\system32\msaudite.dll
2018-04-14 21:56 - 2018-03-30 21:35 - 000135680 _____ (Microsoft Corporation) C:\Windows\system32\sspicli.dll
2018-04-14 21:56 - 2018-03-30 21:35 - 000063488 _____ (Microsoft Corporation) C:\Windows\system32\setbcdlocale.dll
2018-04-14 21:56 - 2018-03-30 21:35 - 000060416 _____ (Microsoft Corporation) C:\Windows\system32\msobjs.dll
2018-04-14 21:56 - 2018-03-30 21:35 - 000059904 _____ (Microsoft Corporation) C:\Windows\system32\appidapi.dll
2018-04-14 21:56 - 2018-03-30 21:35 - 000050176 _____ (Microsoft Corporation) C:\Windows\system32\srclient.dll
2018-04-14 21:56 - 2018-03-30 21:35 - 000044032 _____ (Microsoft Corporation) C:\Windows\system32\csrsrv.dll
2018-04-14 21:56 - 2018-03-30 21:35 - 000043520 _____ (Microsoft Corporation) C:\Windows\system32\cryptbase.dll
2018-04-14 21:56 - 2018-03-30 21:35 - 000028672 _____ (Microsoft Corporation) C:\Windows\system32\sspisrv.dll
2018-04-14 21:56 - 2018-03-30 21:35 - 000028160 _____ (Microsoft Corporation) C:\Windows\system32\secur32.dll
2018-04-14 21:56 - 2018-03-30 21:35 - 000022016 _____ (Microsoft Corporation) C:\Windows\system32\credssp.dll
2018-04-14 21:56 - 2018-03-30 21:35 - 000016384 _____ (Microsoft Corporation) C:\Windows\system32\ntvdm64.dll
2018-04-14 21:56 - 2018-03-30 21:35 - 000013312 _____ (Microsoft Corporation) C:\Windows\system32\wow64cpu.dll
2018-04-14 21:56 - 2018-03-30 21:35 - 000007168 _____ (Microsoft Corporation) C:\Windows\system32\apisetschema.dll
2018-04-14 21:56 - 2018-03-30 21:35 - 000006144 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-security-base-l1-1-0.dll
2018-04-14 21:56 - 2018-03-30 21:35 - 000005120 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-file-l1-1-0.dll
2018-04-14 21:56 - 2018-03-30 21:35 - 000004608 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-threadpool-l1-1-0.dll
2018-04-14 21:56 - 2018-03-30 21:35 - 000004608 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-processthreads-l1-1-0.dll
2018-04-14 21:56 - 2018-03-30 21:35 - 000004096 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-sysinfo-l1-1-0.dll
2018-04-14 21:56 - 2018-03-30 21:35 - 000004096 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-synch-l1-1-0.dll
2018-04-14 21:56 - 2018-03-30 21:35 - 000004096 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-localregistry-l1-1-0.dll
2018-04-14 21:56 - 2018-03-30 21:35 - 000004096 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-localization-l1-1-0.dll
2018-04-14 21:56 - 2018-03-30 21:35 - 000003584 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-rtlsupport-l1-1-0.dll
2018-04-14 21:56 - 2018-03-30 21:35 - 000003584 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-processenvironment-l1-1-0.dll
2018-04-14 21:56 - 2018-03-30 21:35 - 000003584 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-namedpipe-l1-1-0.dll
2018-04-14 21:56 - 2018-03-30 21:35 - 000003584 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-misc-l1-1-0.dll
2018-04-14 21:56 - 2018-03-30 21:35 - 000003584 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-memory-l1-1-0.dll
2018-04-14 21:56 - 2018-03-30 21:35 - 000003584 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-libraryloader-l1-1-0.dll
2018-04-14 21:56 - 2018-03-30 21:35 - 000003584 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-heap-l1-1-0.dll
2018-04-14 21:56 - 2018-03-30 21:35 - 000003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-xstate-l1-1-0.dll
2018-04-14 21:56 - 2018-03-30 21:35 - 000003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-util-l1-1-0.dll
2018-04-14 21:56 - 2018-03-30 21:35 - 000003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-string-l1-1-0.dll
2018-04-14 21:56 - 2018-03-30 21:35 - 000003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-profile-l1-1-0.dll
2018-04-14 21:56 - 2018-03-30 21:35 - 000003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-io-l1-1-0.dll
2018-04-14 21:56 - 2018-03-30 21:35 - 000003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-interlocked-l1-1-0.dll
2018-04-14 21:56 - 2018-03-30 21:35 - 000003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-handle-l1-1-0.dll
2018-04-14 21:56 - 2018-03-30 21:35 - 000003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-fibers-l1-1-0.dll
2018-04-14 21:56 - 2018-03-30 21:35 - 000003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-errorhandling-l1-1-0.dll
2018-04-14 21:56 - 2018-03-30 21:35 - 000003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-delayload-l1-1-0.dll
2018-04-14 21:56 - 2018-03-30 21:35 - 000003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-debug-l1-1-0.dll
2018-04-14 21:56 - 2018-03-30 21:35 - 000003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-datetime-l1-1-0.dll
2018-04-14 21:56 - 2018-03-30 21:35 - 000003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-console-l1-1-0.dll
2018-04-14 21:56 - 2018-03-30 21:09 - 000146432 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msaudite.dll
2018-04-14 21:56 - 2018-03-30 21:09 - 000096768 _____ (Microsoft Corporation) C:\Windows\SysWOW64\sspicli.dll
2018-04-14 21:56 - 2018-03-30 21:09 - 000060416 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msobjs.dll
2018-04-14 21:56 - 2018-03-30 21:09 - 000050688 _____ (Microsoft Corporation) C:\Windows\SysWOW64\appidapi.dll
2018-04-14 21:56 - 2018-03-30 21:09 - 000043008 _____ (Microsoft Corporation) C:\Windows\SysWOW64\srclient.dll
2018-04-14 21:56 - 2018-03-30 21:09 - 000022016 _____ (Microsoft Corporation) C:\Windows\SysWOW64\secur32.dll
2018-04-14 21:56 - 2018-03-30 21:09 - 000017408 _____ (Microsoft Corporation) C:\Windows\SysWOW64\credssp.dll
2018-04-14 21:56 - 2018-03-30 21:09 - 000007168 _____ (Microsoft Corporation) C:\Windows\SysWOW64\apisetschema.dll
2018-04-14 21:56 - 2018-03-30 21:09 - 000005120 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-file-l1-1-0.dll
2018-04-14 21:56 - 2018-03-30 21:09 - 000005120 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wow32.dll
2018-04-14 21:56 - 2018-03-30 21:09 - 000004608 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-processthreads-l1-1-0.dll
2018-04-14 21:56 - 2018-03-30 21:09 - 000004096 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-sysinfo-l1-1-0.dll
2018-04-14 21:56 - 2018-03-30 21:09 - 000004096 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-synch-l1-1-0.dll
2018-04-14 21:56 - 2018-03-30 21:09 - 000004096 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-misc-l1-1-0.dll
2018-04-14 21:56 - 2018-03-30 21:09 - 000004096 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-localregistry-l1-1-0.dll
2018-04-14 21:56 - 2018-03-30 21:09 - 000004096 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-localization-l1-1-0.dll
2018-04-14 21:56 - 2018-03-30 21:09 - 000003584 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-processenvironment-l1-1-0.dll
2018-04-14 21:56 - 2018-03-30 21:09 - 000003584 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-namedpipe-l1-1-0.dll
2018-04-14 21:56 - 2018-03-30 21:09 - 000003584 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-memory-l1-1-0.dll
2018-04-14 21:56 - 2018-03-30 21:09 - 000003584 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-libraryloader-l1-1-0.dll
2018-04-14 21:56 - 2018-03-30 21:09 - 000003584 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-interlocked-l1-1-0.dll
2018-04-14 21:56 - 2018-03-30 21:09 - 000003584 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-heap-l1-1-0.dll
2018-04-14 21:56 - 2018-03-30 21:09 - 000003072 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-string-l1-1-0.dll
2018-04-14 21:56 - 2018-03-30 21:09 - 000003072 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-rtlsupport-l1-1-0.dll
2018-04-14 21:56 - 2018-03-30 21:09 - 000003072 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-profile-l1-1-0.dll
2018-04-14 21:56 - 2018-03-30 21:09 - 000003072 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-io-l1-1-0.dll
2018-04-14 21:56 - 2018-03-30 21:09 - 000003072 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-handle-l1-1-0.dll
2018-04-14 21:56 - 2018-03-30 21:09 - 000003072 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-fibers-l1-1-0.dll
2018-04-14 21:56 - 2018-03-30 21:09 - 000003072 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-errorhandling-l1-1-0.dll
2018-04-14 21:56 - 2018-03-30 21:09 - 000003072 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-delayload-l1-1-0.dll
2018-04-14 21:56 - 2018-03-30 21:09 - 000003072 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-debug-l1-1-0.dll
2018-04-14 21:56 - 2018-03-30 21:09 - 000003072 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-datetime-l1-1-0.dll
2018-04-14 21:56 - 2018-03-30 21:09 - 000003072 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-console-l1-1-0.dll
2018-04-14 21:56 - 2018-03-30 21:06 - 000064512 _____ (Microsoft Corporation) C:\Windows\system32\auditpol.exe
2018-04-14 21:56 - 2018-03-30 21:06 - 000017920 _____ (Microsoft Corporation) C:\Windows\system32\appidcertstorecheck.exe
2018-04-14 21:56 - 2018-03-30 21:02 - 000296960 _____ (Microsoft Corporation) C:\Windows\system32\rstrui.exe
2018-04-14 21:56 - 2018-03-30 21:02 - 000129536 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\videoprt.sys
2018-04-14 21:56 - 2018-03-30 20:58 - 000112640 _____ (Microsoft Corporation) C:\Windows\system32\smss.exe
2018-04-14 21:56 - 2018-03-30 20:58 - 000030720 _____ (Microsoft Corporation) C:\Windows\system32\lsass.exe
2018-04-14 21:56 - 2018-03-30 20:51 - 000050688 _____ (Microsoft Corporation) C:\Windows\SysWOW64\auditpol.exe
2018-04-14 21:56 - 2018-03-30 20:47 - 000036352 _____ (Microsoft Corporation) C:\Windows\SysWOW64\cryptbase.dll
2018-04-14 21:56 - 2018-03-30 20:47 - 000025600 _____ (Microsoft Corporation) C:\Windows\SysWOW64\setup16.exe
2018-04-14 21:56 - 2018-03-30 20:47 - 000014336 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ntvdm64.dll
2018-04-14 21:56 - 2018-03-30 20:47 - 000007680 _____ (Microsoft Corporation) C:\Windows\SysWOW64\instnm.exe
2018-04-14 21:56 - 2018-03-30 20:47 - 000006144 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-security-base-l1-1-0.dll
2018-04-14 21:56 - 2018-03-30 20:47 - 000004608 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-threadpool-l1-1-0.dll
2018-04-14 21:56 - 2018-03-30 20:47 - 000003584 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-xstate-l1-1-0.dll
2018-04-14 21:56 - 2018-03-30 20:47 - 000003072 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-util-l1-1-0.dll
2018-04-14 21:56 - 2018-03-30 20:47 - 000002048 _____ (Microsoft Corporation) C:\Windows\SysWOW64\user.exe
2018-04-14 21:56 - 2018-03-09 14:12 - 000025600 _____ (Microsoft Corporation) C:\Windows\SysWOW64\lpk.dll
2018-04-14 21:56 - 2018-03-09 14:11 - 000010240 _____ (Microsoft Corporation) C:\Windows\SysWOW64\dciman32.dll
2018-04-14 21:56 - 2018-03-09 14:07 - 000041472 _____ (Microsoft Corporation) C:\Windows\system32\lpk.dll
2018-04-14 21:56 - 2018-03-09 14:06 - 000046080 _____ (Adobe Systems) C:\Windows\system32\atmlib.dll
2018-04-14 21:56 - 2018-03-09 14:06 - 000014336 _____ (Microsoft Corporation) C:\Windows\system32\dciman32.dll
2018-04-14 21:56 - 2018-03-09 13:31 - 000034304 _____ (Adobe Systems) C:\Windows\SysWOW64\atmlib.dll
2018-04-14 21:56 - 2018-03-06 14:11 - 000052224 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wsnmp32.dll
2018-04-14 21:56 - 2018-03-06 14:07 - 000067072 _____ (Microsoft Corporation) C:\Windows\system32\wsnmp32.dll
2018-04-14 21:56 - 2018-02-10 14:23 - 000111616 _____ (Microsoft Corporation) C:\Windows\SysWOW64\racpldlg.dll
2018-04-14 21:56 - 2018-02-10 14:11 - 000133120 _____ (Microsoft Corporation) C:\Windows\system32\msrahc.dll
2018-04-14 21:56 - 2018-02-10 14:11 - 000119296 _____ (Microsoft Corporation) C:\Windows\system32\racpldlg.dll
2018-04-14 21:56 - 2018-02-10 13:36 - 000108032 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msra.exe
2018-04-14 21:56 - 2018-02-10 13:36 - 000040960 _____ (Microsoft Corporation) C:\Windows\SysWOW64\sdchange.exe
2018-04-14 21:56 - 2018-02-10 13:36 - 000007168 _____ (Microsoft Corporation) C:\Windows\SysWOW64\MsraLegacy.tlb
2018-04-14 21:56 - 2018-02-10 13:26 - 000051712 _____ (Microsoft Corporation) C:\Windows\system32\sdchange.exe
2018-04-14 21:56 - 2018-02-10 13:25 - 000014336 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\wmiacpi.sys
2018-04-14 21:56 - 2018-02-10 13:25 - 000009728 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\errdev.sys
2018-04-14 21:56 - 2018-02-10 13:25 - 000007168 _____ (Microsoft Corporation) C:\Windows\system32\MsraLegacy.tlb
2018-04-14 21:56 - 2018-02-02 14:29 - 000025088 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msimsg.dll
2018-04-14 21:56 - 2018-02-02 14:16 - 000025088 _____ (Microsoft Corporation) C:\Windows\system32\msimsg.dll
2018-04-14 21:56 - 2018-01-15 15:59 - 000002048 _____ (Microsoft Corporation) C:\Windows\system32\tzres.dll
2018-04-14 21:56 - 2018-01-15 15:40 - 000002048 _____ (Microsoft Corporation) C:\Windows\SysWOW64\tzres.dll
2018-04-14 21:56 - 2018-01-12 12:16 - 000030208 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\hidusb.sys
2018-04-14 21:56 - 2017-12-31 22:18 - 000131584 _____ (Microsoft Corporation) C:\Windows\system32\PeerDistWSDDiscoProv.dll
2018-04-14 21:56 - 2017-12-31 22:18 - 000095744 _____ (Microsoft Corporation) C:\Windows\system32\rascfg.dll
2018-04-14 21:56 - 2017-12-31 22:18 - 000076288 _____ (Microsoft Corporation) C:\Windows\system32\rasdiag.dll
2018-04-14 21:56 - 2017-12-31 22:18 - 000060928 _____ (Microsoft Corporation) C:\Windows\system32\ndptsp.tsp
2018-04-14 21:56 - 2017-12-31 22:18 - 000053760 _____ (Microsoft Corporation) C:\Windows\system32\vmicres.dll
2018-04-14 21:56 - 2017-12-31 22:18 - 000051200 _____ (Microsoft Corporation) C:\Windows\system32\PeerDistHttpTrans.dll
2018-04-14 21:56 - 2017-12-31 22:18 - 000047104 _____ (Microsoft Corporation) C:\Windows\system32\kmddsp.tsp
2018-04-14 21:56 - 2017-12-31 22:18 - 000041472 _____ (Microsoft Corporation) C:\Windows\system32\rasmxs.dll
2018-04-14 21:56 - 2017-12-31 22:18 - 000039424 _____ (Microsoft Corporation) C:\Windows\system32\traffic.dll
2018-04-14 21:56 - 2017-12-31 22:18 - 000029696 _____ (Microsoft Corporation) C:\Windows\system32\rasser.dll
2018-04-14 21:56 - 2017-12-31 22:18 - 000026112 _____ (Microsoft Corporation) C:\Windows\system32\oleres.dll
2018-04-14 21:56 - 2017-12-31 22:18 - 000024576 _____ (Microsoft Corporation) C:\Windows\system32\WcnEapPeerProxy.dll
2018-04-14 21:56 - 2017-12-31 22:18 - 000024064 _____ (Microsoft Corporation) C:\Windows\system32\WcnEapAuthProxy.dll
2018-04-14 21:56 - 2017-12-31 22:18 - 000022528 _____ (Microsoft Corporation) C:\Windows\system32\wfapigp.dll
2018-04-14 21:56 - 2017-12-31 22:18 - 000016896 _____ (Microsoft Corporation) C:\Windows\system32\wshqos.dll
2018-04-14 21:56 - 2017-12-31 22:18 - 000013312 _____ (Microsoft Corporation) C:\Windows\system32\wshnetbs.dll
2018-04-14 21:56 - 2017-12-31 22:18 - 000008704 _____ (Microsoft Corporation) C:\Windows\system32\comcat.dll
2018-04-14 21:56 - 2017-12-31 22:18 - 000002048 _____ (Microsoft Corporation) C:\Windows\system32\msxml6r.dll
2018-04-14 21:56 - 2017-12-31 22:00 - 000081920 _____ (Microsoft Corporation) C:\Windows\SysWOW64\fdWCN.dll
2018-04-14 21:56 - 2017-12-31 22:00 - 000081408 _____ (Microsoft Corporation) C:\Windows\SysWOW64\rascfg.dll
2018-04-14 21:56 - 2017-12-31 22:00 - 000061952 _____ (Microsoft Corporation) C:\Windows\SysWOW64\rasdiag.dll
2018-04-14 21:56 - 2017-12-31 22:00 - 000052224 _____ (Microsoft Corporation) C:\Windows\SysWOW64\nlaapi.dll
2018-04-14 21:56 - 2017-12-31 22:00 - 000050688 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ndptsp.tsp
2018-04-14 21:56 - 2017-12-31 22:00 - 000033280 _____ (Microsoft Corporation) C:\Windows\SysWOW64\traffic.dll
2018-04-14 21:56 - 2017-12-31 22:00 - 000026112 _____ (Microsoft Corporation) C:\Windows\SysWOW64\oleres.dll
2018-04-14 21:56 - 2017-12-31 22:00 - 000002048 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msxml6r.dll
2018-04-14 21:56 - 2017-12-31 21:55 - 000024064 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\ndistapi.sys
2018-04-14 21:56 - 2017-12-31 21:54 - 000077312 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\mpsdrv.sys
2018-04-14 21:56 - 2017-12-31 21:46 - 000051712 _____ (Microsoft Corporation) C:\Windows\system32\vmictimeprovider.dll
2018-04-14 21:56 - 2017-12-31 21:43 - 000086528 _____ (Microsoft Corporation) C:\Windows\SysWOW64\WcnApi.dll
2018-04-14 21:56 - 2017-12-31 21:43 - 000038912 _____ (Microsoft Corporation) C:\Windows\SysWOW64\kmddsp.tsp
2018-04-14 21:56 - 2017-12-31 21:43 - 000033280 _____ (Microsoft Corporation) C:\Windows\SysWOW64\rasmxs.dll
2018-04-14 21:56 - 2017-12-31 21:43 - 000022528 _____ (Microsoft Corporation) C:\Windows\SysWOW64\rasser.dll
2018-04-14 21:56 - 2017-12-31 21:43 - 000020480 _____ (Microsoft Corporation) C:\Windows\SysWOW64\WcnEapPeerProxy.dll
2018-04-14 21:56 - 2017-12-31 21:43 - 000019968 _____ (Microsoft Corporation) C:\Windows\SysWOW64\WcnEapAuthProxy.dll
2018-04-14 21:56 - 2017-12-31 21:43 - 000018944 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wfapigp.dll
2018-04-14 21:56 - 2017-12-31 21:43 - 000013824 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wshqos.dll
2018-04-14 21:56 - 2017-12-31 21:41 - 000007168 _____ (Microsoft Corporation) C:\Windows\SysWOW64\comcat.dll
2018-04-14 21:56 - 2017-12-05 13:36 - 000040960 _____ (Microsoft Corporation) C:\Windows\system32\WcsPlugInService.dll
2018-04-14 21:56 - 2017-12-05 11:49 - 000032768 _____ (Microsoft Corporation) C:\Windows\SysWOW64\WcsPlugInService.dll
2018-04-14 21:43 - 2018-03-14 13:14 - 000135360 _____ (Microsoft Corporation) C:\Windows\system32\CompatTelRunner.exe
2018-04-14 21:43 - 2018-03-14 13:09 - 000656384 _____ (Microsoft Corporation) C:\Windows\system32\aeinv.dll
2018-04-14 21:43 - 2018-03-14 09:05 - 001993728 _____ (Microsoft Corporation) C:\Windows\system32\aitstatic.exe
2018-04-14 21:43 - 2018-03-14 09:05 - 001559552 _____ (Microsoft Corporation) C:\Windows\system32\appraiser.dll
2018-04-14 21:43 - 2018-03-14 09:05 - 000739840 _____ (Microsoft Corporation) C:\Windows\system32\generaltel.dll
2018-04-14 21:43 - 2018-03-14 09:05 - 000599552 _____ (Microsoft Corporation) C:\Windows\system32\devinv.dll
2018-04-14 21:43 - 2018-03-14 09:05 - 000450048 _____ (Microsoft Corporation) C:\Windows\system32\centel.dll
2018-04-14 21:43 - 2018-03-14 09:05 - 000414720 _____ (Microsoft Corporation) C:\Windows\system32\invagent.dll
2018-04-14 21:43 - 2018-03-14 09:05 - 000291840 _____ (Microsoft Corporation) C:\Windows\system32\acmigration.dll
2018-04-14 21:43 - 2018-03-14 09:05 - 000237056 _____ (Microsoft Corporation) C:\Windows\system32\aepic.dll
2018-04-13 23:54 - 2018-04-14 19:39 - 000000000 ____D C:\ProgramData\Spybot - Search & Destroy
2018-04-13 23:54 - 2018-04-13 23:54 - 000000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Spybot - Search & Destroy
2018-04-13 23:41 - 2018-04-13 23:54 - 000000000 ____D C:\Program Files (x86)\Spybot - Search & Destroy
2018-04-13 21:02 - 2018-04-13 21:03 - 019327064 _____ C:\Users\Aaron\Downloads\dolphin-x64-5.0.exe
2018-04-09 21:53 - 2018-04-09 21:53 - 000000000 ____D C:\Users\Aaron\AppData\Local\{D2DBE487-F673-883F-9BEB-ADD7BF83514F}

==================== One Month Modified files and folders ========

(If an entry is included in the fixlist, the file/folder will be moved.)

2018-04-18 17:17 - 2017-03-16 01:05 - 000000000 ____D C:\Users\Aaron\AppData\Roaming\uTorrent
2018-04-18 17:15 - 2017-04-06 20:15 - 000000982 _____ C:\Windows\Tasks\Yahoo! Powered rinal.job
2018-04-18 17:11 - 2009-07-14 01:13 - 000782470 _____ C:\Windows\system32\PerfStringBackup.INI
2018-04-18 17:11 - 2009-07-13 23:20 - 000000000 ____D C:\Windows\inf
2018-04-18 17:08 - 2017-03-15 05:10 - 000000000 ____D C:\Users\Aaron\AppData\LocalLow\Mozilla
2018-04-18 17:06 - 2017-11-28 05:49 - 000000000 ____D C:\Users\Aaron\AppData\LocalLow\uTorrent
2018-04-18 17:04 - 2017-03-15 05:22 - 000000000 ____D C:\ProgramData\NVIDIA
2018-04-18 17:04 - 2009-07-14 01:08 - 000000006 ____H C:\Windows\Tasks\SA.DAT
2018-04-18 15:15 - 2017-04-06 20:15 - 000000000 ____D C:\ProgramData\{1B3BDE58-9179-549E-17BF-CADC8DFD4112}
2018-04-18 15:14 - 2009-07-14 00:45 - 000017168 ____H C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0
2018-04-18 15:14 - 2009-07-14 00:45 - 000017168 ____H C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0
2018-04-18 15:06 - 2017-03-15 05:10 - 000000000 ____D C:\Program Files (x86)\Mozilla Maintenance Service
2018-04-18 15:00 - 2017-03-15 05:06 - 000000000 ____D C:\Program Files\PeerBlock
2018-04-18 02:34 - 2017-07-05 07:14 - 000000000 ____D C:\ProgramData\AVAST Software
2018-04-18 02:06 - 2017-09-06 20:13 - 000000000 ____D C:\Program Files (x86)\Mozilla Firefox
2018-04-18 02:05 - 2017-03-15 05:11 - 000000000 ____D C:\Users\Aaron\Desktop\Desktop Programs
2018-04-18 01:27 - 2017-03-16 02:50 - 000000000 ____D C:\Users\Aaron\Documents\My Games
2018-04-18 00:55 - 2017-03-15 05:03 - 000000000 ____D C:\Users\Aaron\AppData\Local\VirtualStore
2018-04-18 00:50 - 2017-05-28 18:33 - 000000000 ____D C:\Users\Aaron\AppData\Local\2e57d7520aabe7f79ce04aa94df0720d
2018-04-17 23:01 - 2017-03-15 05:44 - 000000000 ____D C:\Users\Aaron\AppData\Local\NVIDIA
2018-04-17 23:00 - 2009-07-14 00:45 - 004887400 _____ C:\Windows\system32\FNTCACHE.DAT
2018-04-17 22:53 - 2017-03-15 06:52 - 000000000 ____D C:\Users\Aaron\AppData\Local\NVIDIA Corporation
2018-04-17 22:53 - 2017-03-15 05:22 - 000000000 ____D C:\Program Files (x86)\NVIDIA Corporation
2018-04-17 22:52 - 2017-03-15 05:57 - 000058808 _____ C:\Users\Aaron\AppData\Local\GDIPFONTCACHEV1.DAT
2018-04-17 22:52 - 2017-03-15 05:22 - 000000000 ____D C:\ProgramData\NVIDIA Corporation
2018-04-17 22:30 - 2017-03-15 07:06 - 000000000 ____D C:\Users\Aaron\Desktop\Games
2018-04-17 21:59 - 2017-03-15 05:22 - 000000000 ____D C:\Program Files\NVIDIA Corporation
2018-04-17 21:55 - 2017-03-15 19:17 - 000000000 ____D C:\ProgramData\Package Cache
2018-04-17 21:54 - 2017-03-16 00:29 - 000000000 ____D C:\Windows\SysWOW64\directx
2018-04-17 21:42 - 2017-03-15 23:22 - 000000344 __RSH C:\ProgramData\ntuser.pol
2018-04-17 04:09 - 2009-07-13 23:20 - 000000000 ____D C:\Windows\rescache
2018-04-17 03:16 - 2009-07-13 23:20 - 000000000 ____D C:\Windows\PolicyDefinitions
2018-04-16 19:56 - 2017-03-15 06:38 - 000774592 _____ C:\Windows\SysWOW64\PerfStringBackup.INI
2018-04-16 19:35 - 2017-06-26 05:16 - 000000000 ____D C:\Users\Aaron\AppData\Local\Fallout4
2018-04-16 19:26 - 2017-06-26 08:23 - 000000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\by.xatab
2018-04-15 03:21 - 2017-10-06 03:24 - 000000000 ____D C:\Windows\system32\appraiser
2018-04-15 03:06 - 2017-03-15 05:24 - 000000000 ____D C:\Windows\system32\MRT
2018-04-15 03:02 - 2017-10-12 03:02 - 136971704 ____C (Microsoft Corporation) C:\Windows\system32\MRT-KB890830.exe
2018-04-15 03:02 - 2017-03-15 05:24 - 136971704 ____C (Microsoft Corporation) C:\Windows\system32\MRT.exe
2018-04-15 00:50 - 2017-04-07 01:18 - 000000638 _____ C:\Users\Aaron\AppData\Roaming\WB.CFG
2018-04-14 02:01 - 2018-03-03 21:23 - 000000000 ____D C:\Users\Aaron\AppData\Local\ElevatedDiagnostics
2018-04-13 23:52 - 2017-11-14 08:10 - 000000000 ____D C:\Program Files (x86)\TeamViewer
2018-04-13 23:48 - 2017-05-28 18:32 - 000000000 ____D C:\Users\Aaron\AppData\Local\{0CBA3AE6-2812-565E-458A-73B661E28F2E}
2018-03-23 01:32 - 2017-03-16 21:56 - 000002224 _____ C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Google Chrome.lnk

==================== Files in the root of some directories =======

2017-04-07 01:18 - 2018-04-15 00:50 - 000000638 _____ () C:\Users\Aaron\AppData\Roaming\WB.CFG
2017-12-14 01:50 - 2017-12-21 21:16 - 000000072 _____ () C:\Users\Aaron\AppData\Local\1i2j3k4l5m
2017-12-11 21:15 - 2017-12-11 21:15 - 000000068 _____ () C:\Users\Aaron\AppData\Local\bpDLTbpDLT

Some files in TEMP:
====================
2018-04-17 22:52 - 2017-10-10 21:06 - 005023680 _____ (NVIDIA Corporation) C:\Users\Aaron\AppData\Local\Temp\NVI2_29.DLL
2017-03-15 06:35 - 2015-02-03 20:00 - 000826696 _____ (NVIDIA Corporation) C:\Users\Aaron\AppData\Local\Temp\nvStInst.exe
2016-12-15 00:30 - 2016-12-15 00:30 - 001677576 _____ (CompuClever Systems Inc.) C:\Users\Aaron\AppData\Local\Temp\programmanagementconsole_setup.exe
2017-11-02 23:53 - 2017-11-02 23:53 - 003595354 _____ (The                                                         ) C:\Users\Aaron\AppData\Local\Temp\Setup.exe
2017-11-26 14:44 - 2017-11-26 14:44 - 001809096 _____ () C:\Users\Aaron\AppData\Local\Temp\tmp1F31.tmp.exe
2017-11-28 15:55 - 2017-11-28 15:55 - 015510512 _____ (TeamViewer GmbH) C:\Users\Aaron\AppData\Local\Temp\tmp414F.tmp.exe
2017-11-26 10:58 - 2017-11-26 10:58 - 001809096 _____ () C:\Users\Aaron\AppData\Local\Temp\tmp5635.tmp.exe
2017-11-15 14:50 - 2017-11-15 14:50 - 013973136 _____ (TeamViewer GmbH) C:\Users\Aaron\AppData\Local\Temp\tmp5921.tmp.exe
2017-11-14 08:31 - 2017-11-14 08:31 - 000366800 _____ (NirSoft) C:\Users\Aaron\AppData\Local\Temp\tmp5C75.tmp.exe
2017-11-14 07:51 - 2017-11-14 07:51 - 001816776 _____ () C:\Users\Aaron\AppData\Local\Temp\tmpB710.tmp.exe
2017-11-26 10:01 - 2017-11-26 10:01 - 001809096 _____ () C:\Users\Aaron\AppData\Local\Temp\tmpD4D4.tmp.exe
2017-11-27 06:29 - 2017-11-27 06:29 - 001809096 _____ () C:\Users\Aaron\AppData\Local\Temp\tmpD7C5.tmp.exe
2017-11-26 08:04 - 2017-11-26 08:04 - 001809096 _____ () C:\Users\Aaron\AppData\Local\Temp\tmpDC5F.tmp.exe
2017-11-15 14:44 - 2017-11-15 14:44 - 001816776 _____ () C:\Users\Aaron\AppData\Local\Temp\tmpE039.tmp.exe
2017-11-26 13:19 - 2017-11-26 13:19 - 001809096 _____ () C:\Users\Aaron\AppData\Local\Temp\tmpE847.tmp.exe
2017-11-14 07:53 - 2017-11-14 07:53 - 013973136 _____ (TeamViewer GmbH) C:\Users\Aaron\AppData\Local\Temp\tmpF1F.tmp.exe
2018-04-17 22:50 - 2017-11-13 20:37 - 000116968 _____ () C:\Users\Aaron\AppData\Local\Temp\Uninstall.exe

==================== Bamital & volsnap ======================

(There is no automatic fix for files that do not pass verification.)

C:\Windows\system32\winlogon.exe => File is digitally signed
C:\Windows\system32\wininit.exe => File is digitally signed
C:\Windows\SysWOW64\wininit.exe => File is digitally signed
C:\Windows\explorer.exe => File is digitally signed
C:\Windows\SysWOW64\explorer.exe => File is digitally signed
C:\Windows\system32\svchost.exe => File is digitally signed
C:\Windows\SysWOW64\svchost.exe => File is digitally signed
C:\Windows\system32\services.exe => File is digitally signed
C:\Windows\system32\User32.dll => File is digitally signed
C:\Windows\SysWOW64\User32.dll => File is digitally signed
C:\Windows\system32\userinit.exe => File is digitally signed
C:\Windows\SysWOW64\userinit.exe => File is digitally signed
C:\Windows\system32\rpcss.dll => File is digitally signed
C:\Windows\system32\dnsapi.dll => File is digitally signed
C:\Windows\SysWOW64\dnsapi.dll => File is digitally signed
C:\Windows\system32\Drivers\volsnap.sys => File is digitally signed


ATTENTION: ==> Could not access BCD.

LastRegBack: 2018-04-18 15:39

==================== End of FRST.txt ============================

 

 

 

 

 

Additional scan result of Farbar Recovery Scan Tool (x64) Version: 15.04.2018
Ran by [removed] (18-04-2018 17:28:18)
Running from C:\Users\[removed]\Desktop
Windows 7 Ultimate Service Pack 1 (X64) (2017-03-15 09:02:00)
Boot Mode: Normal
==========================================================


==================== Accounts: =============================

Aaron (S-1-5-21-1023668481-733846680-2293585431-1001 - Administrator - Enabled) => C:\Users\Aaron
Administrator (S-1-5-21-1023668481-733846680-2293585431-500 - Administrator - Disabled)
Guest (S-1-5-21-1023668481-733846680-2293585431-501 - Limited - Disabled)
HomeGroupUser$ (S-1-5-21-1023668481-733846680-2293585431-1002 - Limited - Enabled)

==================== Security Center ========================

(If an entry is included in the fixlist, it will be removed.)

AV: Avast Antivirus (Enabled - Up to date) {8EA8924E-BC81-DC44-8BB0-8BAE75D86EBF}
AS: Windows Defender (Disabled - Up to date) {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
AS: Avast Antivirus (Enabled - Up to date) {35C973AA-9ABB-D3CA-B100-B0DC0E5F2402}
FW: Avast Antivirus (Enabled) {B693136B-F6EE-DD1C-A0EF-229B8B0B29C4}

==================== Installed Programs ======================

(Only the adware programs with "Hidden" flag could be added to the fixlist to unhide them. The adware programs should be uninstalled manually.)

µTorrent (HKU\S-1-5-21-1023668481-733846680-2293585431-1001\…\uTorrent) (Version: 3.5.3.44396 - BitTorrent Inc.)
Adobe Flash Player 25 NPAPI (HKLM-x32\…\Adobe Flash Player NPAPI) (Version: 25.0.0.127 - Adobe Systems Incorporated)
Adobe Flash Player 25 PPAPI (HKLM-x32\…\Adobe Flash Player PPAPI) (Version: 25.0.0.127 - Adobe Systems Incorporated)
Adobe Photoshop CS6 (HKLM-x32\…\{74EB3499-8B95-4B5C-96EB-7B342F3FD0C6}) (Version: 13.0 - Adobe Systems Incorporated)
Adobe Reader 9.2 (HKLM-x32\…\{AC76BA86-7AD7-1033-7B44-A92000000001}) (Version: 9.2.0 - Adobe Systems Incorporated)
AORUS GRAPHICS ENGINE (HKLM-x32\…\AORUS GRAPHICS ENGINE_is1) (Version: 1.3.3 - GIGABYTE Technology Co.,Inc.)
Avast Premier (HKLM-x32\…\Avast Antivirus) (Version: 18.3.2333 - AVAST Software)
DAEMON Tools Lite (HKLM\…\DAEMON Tools Lite) (Version: 5.0.1.0407 - Disc Soft Ltd)
Fallout 4 version 1.8.7 (HKLM-x32\…\Fallout 4_is1) (Version: 1.8.7 - [removed])
FOX ONE (HKLM-x32\…\{24F2E03B-ACF2-42FB-8A2A-5F015ACBDD16}) (Version: 1.00.0000 - )
FrostWire 6.5.3 (HKLM-x32\…\FrostWire 6) (Version: 6.5.3.240 - FrostWire LLC)
Google Chrome (HKLM-x32\…\Google Chrome) (Version: 65.0.3325.181 - Google Inc.)
Google Update Helper (HKLM-x32\…\{60EC980A-BDA2-4CB6-A427-B07A5498B4CA}) (Version: 1.3.33.7 - Google Inc.) Hidden
ImgBurn (HKLM-x32\…\ImgBurn) (Version: 2.5.1.0 - LIGHTNING UK!)
Microsoft .NET Framework 4.7.1 (HKLM\…\{92FB6C44-E685-45AD-9B20-CADF4CABA132} - 1033) (Version: 4.7.02558 - Microsoft Corporation)
Microsoft Visual C++ 2005 Redistributable (HKLM-x32\…\{710f4c1c-cc18-4c49-8cbf-51240c89a1a2}) (Version: 8.0.61001 - Microsoft Corporation)
Microsoft Visual C++ 2005 Redistributable (x64) (HKLM\…\{ad8a2fa1-06e7-4b0d-927d-6e54b3d31028}) (Version: 8.0.61000 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.4148 (HKLM\…\{4B6C7001-C7D6-3710-913E-5BC23FCE91E6}) (Version: 9.0.30729.4148 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.4148 (HKLM-x32\…\{1F1C2DFC-2D24-3E06-BCB8-725134ADF989}) (Version: 9.0.30729.4148 - Microsoft Corporation)
Microsoft Visual C++ 2010  x64 Redistributable - 10.0.40219 (HKLM\…\{1D8E6291-B0D5-35EC-8441-6616F567A0F7}) (Version: 10.0.40219 - Microsoft Corporation)
Microsoft Visual C++ 2010  x86 Redistributable - 10.0.40219 (HKLM-x32\…\{F0C3E5D1-1ADE-321E-8167-68EF0DE699A5}) (Version: 10.0.40219 - Microsoft Corporation)
Microsoft Visual C++ 2013 Redistributable (x64) - 12.0.21005 (HKLM-x32\…\{7f51bdb9-ee21-49ee-94d6-90afc321780e}) (Version: 12.0.21005.1 - Microsoft Corporation)
Microsoft Visual C++ 2013 Redistributable (x64) - 12.0.30501 (HKLM-x32\…\{050d4fc8-5d48-4b8f-8972-47c82c46020f}) (Version: 12.0.30501.0 - Microsoft Corporation)
Microsoft Visual C++ 2013 Redistributable (x86) - 12.0.30501 (HKLM-x32\…\{f65db027-aff3-4070-886a-0d87064aabb1}) (Version: 12.0.30501.0 - Microsoft Corporation)
Microsoft Visual C++ 2015 Redistributable (x64) - 14.0.23026 (HKLM-x32\…\{e46eca4f-393b-40df-9f49-076faf788d83}) (Version: 14.0.23026.0 - Microsoft Corporation)
Mozilla Firefox 52.0 (x86 en-US) (HKLM-x32\…\Mozilla Firefox 52.0 (x86 en-US)) (Version: 52.0 - Mozilla)
Mozilla Firefox 59.0.2 (x64 en-US) (HKLM\…\Mozilla Firefox 59.0.2 (x64 en-US)) (Version: 59.0.2 - Mozilla)
Mozilla Maintenance Service (HKLM\…\MozillaMaintenanceService) (Version: 59.0.2 - Mozilla)
Nexus Mod Manager (HKLM\…\6af12c54-643b-4752-87d0-8335503010de_is1) (Version: 0.63.9 - Black Tree Gaming)
NVIDIA 3D Vision Controller Driver 340.50 (HKLM\…\{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_Display.NVIRUSB) (Version: 340.50 - NVIDIA Corporation)
NVIDIA 3D Vision Driver 342.01 (HKLM\…\{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_Display.3DVision) (Version: 342.01 - NVIDIA Corporation)
NVIDIA Drivers (HKLM\…\NVIDIA Drivers) (Version: 1.10.62.40 - NVIDIA Corporation)
NVIDIA Graphics Driver 342.01 (HKLM\…\{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_Display.Driver) (Version: 342.01 - NVIDIA Corporation)
NVIDIA PhysX System Software 9.13.1220 (HKLM\…\{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_Display.PhysX) (Version: 9.13.1220 - NVIDIA Corporation)
PDF Settings CS6 (HKLM-x32\…\{BFEAAE77-BD7F-4534-B286-9C5CB4697EB1}) (Version: 11.0 - Adobe Systems Incorporated) Hidden
PeerBlock 1.1 (r518) (HKLM\…\{015C5B35-B678-451C-9AEE-821E8D69621C}_is1) (Version: 1.1.0.518 - PeerBlock, LLC)
Picasa 3 (HKLM-x32\…\Picasa 3) (Version: 3.9.141.259 - Google, Inc.)
SHIELD Streaming (HKLM\…\{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_GFExperience.NvStreamSrv) (Version: 7.1.0280 - NVIDIA Corporation) Hidden
SHIELD Wireless Controller Driver (HKLM\…\{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_ShieldWirelessController) (Version: 2.11.4.125 - NVIDIA Corporation) Hidden
Spybot - Search & Destroy (HKLM-x32\…\{B4092C6D-E886-4CB2-BA68-FE5A88D31DE6}_is1) (Version: 1.5.2 - Safer Networking Limited)
TechPowerUp GPU-Z (HKLM-x32\…\TechPowerUp GPU-Z) (Version:  - TechPowerUp)
VideoLAN VLC media player 0.8.6f (HKLM-x32\…\VLC media player) (Version: 0.8.6f - VideoLAN Team)
WinRAR 5.40 (64-bit) (HKLM\…\WinRAR archiver) (Version: 5.40.0 - win.rar GmbH)

==================== Custom CLSID (Whitelisted): ==========================

(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)

ShellIconOverlayIdentifiers: [00asw] -> {472083B0-C522-11CF-8763-00608CC02F24} => C:\Program Files\AVAST Software\Avast\ashShA64.dll [2018-04-18] (AVAST Software)
ContextMenuHandlers1: [avast] -> {472083B0-C522-11CF-8763-00608CC02F24} => C:\Program Files\AVAST Software\Avast\ashShA64.dll [2018-04-18] (AVAST Software)
ContextMenuHandlers1: [WinRAR] -> {B41DB860-64E4-11D2-9906-E49FADC173CA} => C:\Program Files\WinRAR\rarext.dll [2016-08-15] (Alexander Roshal)
ContextMenuHandlers1-x32: [WinRAR32] -> {B41DB860-8EE4-11D2-9906-E49FADC173CA} => C:\Program Files\WinRAR\rarext32.dll [2016-08-15] (Alexander Roshal)
ContextMenuHandlers3: [00asw] -> {472083B0-C522-11CF-8763-00608CC02F24} => C:\Program Files\AVAST Software\Avast\ashShA64.dll [2018-04-18] (AVAST Software)
ContextMenuHandlers5: [NvCplDesktopContext] -> {3D1975AF-48C6-4f8e-A182-BE0E08FA86A9} => C:\Windows\system32\nvshext.dll [2016-11-14] (NVIDIA Corporation)
ContextMenuHandlers6: [avast] -> {472083B0-C522-11CF-8763-00608CC02F24} => C:\Program Files\AVAST Software\Avast\ashShA64.dll [2018-04-18] (AVAST Software)
ContextMenuHandlers6: [WinRAR] -> {B41DB860-64E4-11D2-9906-E49FADC173CA} => C:\Program Files\WinRAR\rarext.dll [2016-08-15] (Alexander Roshal)
ContextMenuHandlers6-x32: [WinRAR32] -> {B41DB860-8EE4-11D2-9906-E49FADC173CA} => C:\Program Files\WinRAR\rarext32.dll [2016-08-15] (Alexander Roshal)

==================== Scheduled Tasks (Whitelisted) =============

(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)

Task: {5965C317-A9FD-4617-82BB-C337C3E8F557} - System32\Tasks\GoogleUpdateTaskMachineUA => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe [2017-03-16] (Google Inc.)
Task: {942D7876-644F-4E70-AAAB-C25DD19B9700} - System32\Tasks\GoogleUpdateTaskMachineCore => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe [2017-03-16] (Google Inc.)
Task: {AC06B25E-0941-4B66-9EF6-59D4B83471D2} - System32\Tasks\Avast Emergency Update => C:\Program Files\AVAST Software\Avast\AvEmUpdate.exe [2018-04-18] (AVAST Software)
Task: {CFC3FEA3-6A1F-4DFB-B6F7-B935338999C0} - System32\Tasks\Launcher GIGABYTE AORUS GRAPHICS ENGINE => C:\Program Files (x86)\GIGABYTE\AORUS GRAPHICS ENGINE\AORUS.exe [2018-04-03] (GIGABYTE Technology Co.,Ltd.)
Task: {DB479BC6-D6BA-4942-9F79-564CB7B0F8BE} - \Yahoo! Powered rinal -> No File <==== ATTENTION

(If an entry is included in the fixlist, the task (.job) file will be moved. The file which is running by the task will not be moved.)

Task: C:\Windows\Tasks\Yahoo! Powered rinal.job => Wscript.exe  C:\ProgramData\{1B3BDE58-9179-549E-17BF-CADC8DFD4112}\sili.txt <==== ATTENTION

==================== Shortcuts & WMI ========================

(The entries could be listed to be restored or removed.)


Shortcut: C:\Users\Aaron\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\FrostWire 6\FrostWire 6.5.3-SafeMode.lnk -> C:\Program Files (x86)\FrostWire 6\frostwire.bat ()

==================== Loaded Modules (Whitelisted) ==============

2017-03-15 05:22 - 2016-11-14 07:15 - 000135224 _____ () C:\Program Files\NVIDIA Corporation\Display\NvSmartMax64.dll
2018-04-17 21:59 - 2016-11-14 08:30 - 000367552 _____ () C:\Program Files\NVIDIA Corporation\NvStreamSrv\MessageBus.dll
2018-04-17 21:59 - 2016-11-14 08:30 - 001147328 _____ () C:\Program Files\NVIDIA Corporation\NvStreamSrv\libprotobuf.dll
2018-04-17 21:59 - 2016-11-14 08:30 - 003611584 _____ () C:\Program Files\NVIDIA Corporation\NvStreamSrv\Poco.dll
2018-04-17 21:59 - 2016-11-14 08:30 - 000288192 _____ () C:\Program Files\NVIDIA Corporation\NvStreamSrv\NvStreamBase.dll
2018-04-17 21:59 - 2016-11-14 08:30 - 002665920 _____ () C:\Program Files\NVIDIA Corporation\NvStreamSrv\Plugins\NSS\NvMdnsPlugin.dll
2018-04-17 21:59 - 2016-11-14 08:30 - 001988544 _____ () C:\Program Files\NVIDIA Corporation\NvStreamSrv\Plugins\NSS\NvPortForwardPlugin.dll
2018-04-17 21:59 - 2016-11-14 08:30 - 001840576 _____ () C:\Program Files\NVIDIA Corporation\NvStreamSrv\Plugins\NSS\RtspPlugin.dll
2018-04-17 21:59 - 2016-11-14 08:30 - 000207296 _____ () C:\Program Files\NVIDIA Corporation\NvStreamSrv\RtspServer.dll
2018-04-18 01:55 - 2018-04-18 01:55 - 000728792 _____ () c:\Program Files\AVAST Software\Avast\x64\vaarclient.dll
2018-04-18 01:55 - 2018-04-18 01:55 - 000920280 _____ () C:\Program Files\AVAST Software\Avast\x64\ffl2.dll
2018-04-18 01:55 - 2018-04-18 01:55 - 000348888 _____ () c:\Program Files\AVAST Software\Avast\x64\StreamBack.dll
2018-04-17 21:59 - 2016-11-14 08:30 - 000034240 _____ () C:\Program Files\NVIDIA Corporation\NvStreamSrv\boost_system-vc120-mt-1_58.dll
2018-04-17 21:59 - 2016-11-14 08:30 - 000920000 _____ () C:\Program Files\NVIDIA Corporation\NvStreamSrv\boost_regex-vc120-mt-1_58.dll
2018-04-18 01:55 - 2018-04-18 01:55 - 000349912 _____ () C:\Program Files\AVAST Software\Avast\streamback_avast.dll
2018-04-18 01:55 - 2018-04-18 01:55 - 000295640 _____ () C:\Program Files\AVAST Software\Avast\streamback.dll
2018-04-18 01:55 - 2018-04-18 01:55 - 000282840 _____ () C:\Program Files\AVAST Software\Avast\tasks_core.dll
2018-04-18 15:08 - 2018-04-18 15:08 - 005816976 _____ () C:\Program Files\AVAST Software\Avast\defs\18041804\algo.dll
2018-04-18 01:55 - 2018-04-18 01:55 - 000763608 _____ () C:\Program Files\AVAST Software\Avast\ffl2.dll
2018-04-18 01:55 - 2018-04-18 01:55 - 000911064 _____ () C:\Program Files\AVAST Software\Avast\anen.dll
2018-04-18 01:55 - 2018-04-18 01:55 - 000172760 _____ () C:\Program Files\AVAST Software\Avast\hns_tools.dll
2018-04-18 01:55 - 2018-04-18 01:55 - 000969944 _____ () C:\Program Files\AVAST Software\Avast\shepherdsync.dll
2018-04-18 01:55 - 2018-04-18 01:55 - 000501464 _____ () C:\Program Files\AVAST Software\Avast\gui_cache.dll
2018-04-17 21:58 - 2016-11-14 08:30 - 000018880 _____ () C:\Program Files (x86)\NVIDIA Corporation\Update Core\detoured.dll
2018-04-18 01:55 - 2018-04-18 01:55 - 067126928 _____ () C:\Program Files\AVAST Software\Avast\libcef.dll
2018-04-18 01:55 - 2018-04-18 01:55 - 000281816 _____ () C:\Program Files\AVAST Software\Avast\gaming_mode_ui.dll
2018-04-17 22:35 - 2017-01-12 11:15 - 000225792 _____ () C:\Program Files (x86)\GIGABYTE\AORUS GRAPHICS ENGINE\GvFireware.dll
2018-04-17 22:35 - 2017-01-12 11:15 - 000025088 _____ () C:\Program Files (x86)\GIGABYTE\AORUS GRAPHICS ENGINE\BSL430.dll
2018-04-17 22:35 - 2016-10-24 18:03 - 000225792 _____ () C:\Program Files (x86)\GIGABYTE\AORUS GRAPHICS ENGINE\Led\GvFireware.dll
2018-04-17 22:35 - 2017-12-01 13:43 - 000141824 _____ () C:\Program Files (x86)\GIGABYTE\AORUS GRAPHICS ENGINE\Led\ycc.DLL

==================== Alternate Data Streams (Whitelisted) =========

(If an entry is included in the fixlist, only the ADS will be removed.)


==================== Safe Mode (Whitelisted) ===================

(If an entry is included in the fixlist, it will be removed from the registry. The "AlternateShell" will be restored.)


==================== Association (Whitelisted) ===============

(If an entry is included in the fixlist, the registry item will be restored to default or removed.)


==================== Internet Explorer trusted/restricted ===============

(If an entry is included in the fixlist, it will be removed from the registry.)

IE trusted site: HKU\S-1-5-21-1023668481-733846680-2293585431-1001\…\localhost -> localhost
IE trusted site: HKU\S-1-5-21-1023668481-733846680-2293585431-1001\…\webcompanion.com -> hxxp://webcompanion.com

==================== Hosts content: ==========================

(If needed Hosts: directive could be included in the fixlist to reset Hosts.)

2009-07-13 22:34 - 2017-04-07 01:40 - 000001374 _____ C:\Windows\system32\Drivers\etc\hosts

127.0.0.1       activate.adobe.com
127.0.0.1       practivate.adobe.com
127.0.0.1       3dns-3.adobe.com
127.0.0.1       adobe-dns-2.adobe.com
127.0.0.1       adobe-dns-3.adobe.com
127.0.0.1       ereg.wip3.adobe.com
127.0.0.1       activate-sea.adobe.com
127.0.0.1       wip3.adobe.com
127.0.0.1       wwis-dubc1-vip60.adobe.com
127.0.0.1       activate-sjc0.adobe.com
127.0.0.1       ereg.adobe.com
127.0.0.1       activate.wip3.adobe.com
127.0.0.1       3dns-2.adobe.com
127.0.0.1       adobe-dns.adobe.com

==================== Other Areas ============================

(Currently there is no automatic fix for this section.)

HKU\S-1-5-21-1023668481-733846680-2293585431-1001\Control Panel\Desktop\\Wallpaper -> C:\Users\Aaron\AppData\Roaming\Microsoft\Windows\Themes\TranscodedWallpaper.jpg
DNS Servers: [removed] - [removed]
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System => (ConsentPromptBehaviorAdmin: 5) (ConsentPromptBehaviorUser: 3) (EnableLUA: 1)
Windows Firewall is enabled.

==================== MSCONFIG/TASK MANAGER disabled items ==

MSCONFIG\startupfolder: C:^Users^Aaron^AppData^Roaming^Microsoft^Windows^Start Menu^Programs^Startup^tmpC715.tmp.vbs => C:\Windows\pss\tmpC715.tmp.vbs.Startup
MSCONFIG\startupfolder: C:^Users^Aaron^AppData^Roaming^Microsoft^Windows^Start Menu^Programs^Startup^tmpFED0.tmp.vbs => C:\Windows\pss\tmpFED0.tmp.vbs.Startup
MSCONFIG\startupfolder: C:^Users^Aaron^AppData^Roaming^Microsoft^Windows^Start Menu^Programs^Startup^windows.vbs => C:\Windows\pss\windows.vbs.Startup
MSCONFIG\startupreg: Adobe ARM => "C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe"
MSCONFIG\startupreg: Adobe Reader Speed Launcher => "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Reader_sl.exe"
MSCONFIG\startupreg: AdobeAAMUpdater-1.0 => "C:\Program Files (x86)\Common Files\Adobe\OOBE\PDApp\UWA\UpdaterStartupUtility.exe"
MSCONFIG\startupreg: AdobeCS6ServiceManager => "C:\Program Files (x86)\Common Files\Adobe\CS6ServiceManager\CS6ServiceManager.exe" -launchedbylogin
MSCONFIG\startupreg: ares => "C:\Program Files (x86)\Ares\Ares.exe" -h
MSCONFIG\startupreg: Chromium => c:\users\aaron\appdata\local\chromium\application\chrome.exe –auto-launch-at-startup –profile-directory=Default –restore-last-session –restore-last-session
MSCONFIG\startupreg: DAEMON Tools Lite => "C:\Program Files\DAEMON Tools Lite\DTLite.exe" -autorun
MSCONFIG\startupreg: GoogleChromeAutoLaunch_78C029480869371145D7248C9ED3D129 => "C:\Users\Aaron\AppData\Local\Chromium\Application\chrome.exe" –no-startup-window /prefetch:5
MSCONFIG\startupreg: Logitech Download Assistant => C:\Windows\system32\rundll32.exe C:\Windows\System32\LogiLDA.dll,LogiFetch
MSCONFIG\startupreg: NvBackend => "C:\Program Files (x86)\NVIDIA Corporation\Update Core\NvBackend.exe"
MSCONFIG\startupreg: SwitchBoard => C:\Program Files (x86)\Common Files\Adobe\SwitchBoard\SwitchBoard.exe
MSCONFIG\startupreg: tmpC715 => wscript.exe //B "C:\Users\Aaron\AppData\Local\Temp\tmpC715.tmp.vbs"
MSCONFIG\startupreg: tmpFED0 => wscript.exe //B "C:\Users\Aaron\AppData\Local\Temp\tmpFED0.tmp.vbs"
MSCONFIG\startupreg: uTorrent => "C:\Users\Aaron\AppData\Roaming\uTorrent\uTorrent.exe"  /MINIMIZED

==================== FirewallRules (Whitelisted) ===============

(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)

FirewallRules: [{8C7E4C86-C7A2-4045-B38B-4ABF5EE51113}] => (Allow) C:\Program Files (x86)\Mozilla Firefox\firefox.exe
FirewallRules: [{3BA93B2F-9B7C-47D7-9E77-429EE5DE59F8}] => (Allow) C:\Program Files (x86)\Mozilla Firefox\firefox.exe
FirewallRules: [TCP Query User{DA104FAF-75F7-4C80-B437-DC979C278E64}C:\program files (x86)\ares\ares.exe] => (Allow) C:\program files (x86)\ares\ares.exe
FirewallRules: [UDP Query User{9AE45639-3333-46B4-B023-23F1F885335D}C:\program files (x86)\ares\ares.exe] => (Allow) C:\program files (x86)\ares\ares.exe
FirewallRules: [TCP Query User{C792603D-A76C-4D9F-9A7F-36FC2FAE204F}C:\program files (x86)\emule\emule.exe] => (Allow) C:\program files (x86)\emule\emule.exe
FirewallRules: [UDP Query User{FE685987-A84E-4018-A938-B0D5347E2C3D}C:\program files (x86)\emule\emule.exe] => (Allow) C:\program files (x86)\emule\emule.exe
FirewallRules: [TCP Query User{1F09C144-5BAB-45E0-8D1E-23E55DD0B394}C:\program files (x86)\gtk-gnutella\gtk-gnutella.exe] => (Allow) C:\program files (x86)\gtk-gnutella\gtk-gnutella.exe
FirewallRules: [UDP Query User{8A940083-940A-4DC5-AC2F-A3890218B4E2}C:\program files (x86)\gtk-gnutella\gtk-gnutella.exe] => (Allow) C:\program files (x86)\gtk-gnutella\gtk-gnutella.exe
FirewallRules: [TCP Query User{EE992CC3-8C4E-423F-867A-0B5E640AE347}C:\program files (x86)\frostwire 6\frostwire.exe] => (Allow) C:\program files (x86)\frostwire 6\frostwire.exe
FirewallRules: [UDP Query User{D0A5F1A6-BE9C-4E4A-A7F5-8014301DEDB9}C:\program files (x86)\frostwire 6\frostwire.exe] => (Allow) C:\program files (x86)\frostwire 6\frostwire.exe
FirewallRules: [{94F72810-82EA-4020-8AF0-F0DC5F16C095}] => (Allow) C:\Users\Aaron\AppData\Roaming\uTorrent\uTorrent.exe
FirewallRules: [{37F029FA-2AAE-4373-A503-DCBCB4A70EDC}] => (Allow) C:\Users\Aaron\AppData\Roaming\uTorrent\uTorrent.exe
FirewallRules: [{EC050222-E91C-465C-AAC2-2DC82E92CB43}] => (Allow) C:\Users\Aaron\AppData\Roaming\uTorrent\uTorrent.exe
FirewallRules: [{48897FAC-F739-4010-A451-D940EB7F9DBC}] => (Allow) C:\Users\Aaron\AppData\Roaming\uTorrent\uTorrent.exe
FirewallRules: [{5309F6A1-E304-4E04-A82F-040AB2F24E4D}] => (Allow) C:\Users\Aaron\AppData\Roaming\uTorrent\uTorrent.exe
FirewallRules: [{0A826B82-A866-4466-A1DE-E17BBB53FE54}] => (Allow) C:\Users\Aaron\AppData\Roaming\uTorrent\uTorrent.exe
FirewallRules: [{B1F318BA-6CA8-4E53-9437-F637FA7D7FA8}] => (Allow) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
FirewallRules: [{184A4A88-6D17-4A3F-B1D9-0A843559CD61}] => (Allow) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
FirewallRules: [{B8DD2C8B-3E95-4A31-B2C4-F525F22B93D5}] => (Allow) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
FirewallRules: [{FE39837A-305C-4B67-B269-DB8344D8FB74}] => (Allow) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
FirewallRules: [{76DCFA74-6F4F-4F5C-A58C-E747FB84C1A5}] => (Allow) C:\Users\Aaron\AppData\Local\Chromium\Application\chrome.exe
FirewallRules: [{37405CFD-5E7B-4ACA-A4F2-74237D8DD7C1}] => (Allow) C:\Users\Aaron\AppData\Roaming\uTorrent\uTorrent.exe
FirewallRules: [{64C93B74-A6F6-47DA-B2C2-1679F4A49ACF}] => (Allow) C:\Users\Aaron\AppData\Roaming\uTorrent\uTorrent.exe
FirewallRules: [{F55EF162-A0CC-4BB4-AE1E-E5081AE42B74}] => (Allow) C:\Users\Aaron\AppData\Local\Temp\RarSFX1\windows8.exe
FirewallRules: [{86114306-BBC7-49FF-AD87-E192B369DCE6}] => (Allow) C:\Users\Aaron\AppData\Local\Temp\RarSFX1\windows8.exe
FirewallRules: [{14213899-18AB-4095-BBFC-EA112DD2CE6D}] => (Allow) C:\Users\Aaron\AppData\Local\Temp\tmpB710.tmp.exe
FirewallRules: [{0972EA73-D14C-4153-8250-C52A34A4C639}] => (Allow) C:\Users\Aaron\AppData\Local\Temp\tmpB710.tmp.exe
FirewallRules: [{02B0440B-161A-45A3-B47D-3860EEE2BF0B}] => (Allow) C:\Users\Aaron\AppData\Local\Temp\tmpB710.tmp.exe
FirewallRules: [{2293284D-25BD-472D-BFDE-7AD81EE36C52}] => (Allow) C:\Users\Aaron\AppData\Local\Temp\tmpB710.tmp.exe
FirewallRules: [{1B89AADC-0EC5-4FD9-A32C-FE7D24B94566}] => (Allow) C:\Users\Aaron\AppData\Local\Temp\tmpE039.tmp.exe
FirewallRules: [{88AD43A0-118E-4023-A015-EFEEA745814F}] => (Allow) C:\Users\Aaron\AppData\Local\Temp\tmpE039.tmp.exe
FirewallRules: [{9B5A4248-0342-4FE0-8961-F2E1E90F202E}] => (Allow) C:\Users\Aaron\AppData\Local\Temp\tmpE039.tmp.exe
FirewallRules: [{4B7CE545-02E7-4FBA-A061-2AE2B01625CA}] => (Allow) C:\Users\Aaron\AppData\Local\Temp\tmpE039.tmp.exe
FirewallRules: [{84C413E2-1536-43D1-B2EE-7BB6E0747AAB}] => (Allow) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
FirewallRules: [{CCCBA03B-8C72-4D79-A4DB-E7CE6D2A6AF9}] => (Allow) C:\Program Files (x86)\NVIDIA Corporation\NetService\NvNetworkService.exe
FirewallRules: [{736C897D-5E12-4E21-A5B2-4AAE0436EF29}] => (Allow) C:\Program Files (x86)\NVIDIA Corporation\NetService\NvNetworkService.exe
FirewallRules: [{B52EF4C6-7118-4D34-A883-377254FA5F99}] => (Allow) C:\Program Files\NVIDIA Corporation\NvStreamSrv\NvStreamNetworkService.exe
FirewallRules: [{836294C1-8A61-4E1C-BA64-2C17EFD43755}] => (Allow) C:\Program Files\NVIDIA Corporation\NvStreamSrv\NvStreamNetworkService.exe
FirewallRules: [{0EDA587C-E0C2-49C3-93F3-1445EFCAAA2B}] => (Allow) C:\Program Files\NVIDIA Corporation\NvStreamSrv\NvStreamUserAgent.exe
FirewallRules: [{2FE20A07-5845-41F9-A9D7-54441253A9B5}] => (Allow) C:\Program Files\NVIDIA Corporation\NvStreamSrv\nvstreamer.exe
FirewallRules: [{5EB95F5B-8AAA-49CC-9279-A33E94A98D16}] => (Allow) C:\Program Files\NVIDIA Corporation\NvStreamSrv\nvstreamer.exe
FirewallRules: [TCP Query User{02DCA59A-D48E-4789-A2F1-416D19033F71}C:\program files (x86)\gigabyte\aorus graphics engine\aorus.exe] => (Allow) C:\program files (x86)\gigabyte\aorus graphics engine\aorus.exe
FirewallRules: [UDP Query User{BAFF64CE-C589-42AF-9F85-A5ABE82BDFCC}C:\program files (x86)\gigabyte\aorus graphics engine\aorus.exe] => (Allow) C:\program files (x86)\gigabyte\aorus graphics engine\aorus.exe
FirewallRules: [{FBFBB120-D09B-4786-9F1C-2BAFC657A12B}] => (Allow) C:\Program Files\Mozilla Firefox\firefox.exe
FirewallRules: [{ECC66D0D-E79E-4557-9F29-92E873B14F1C}] => (Allow) C:\Program Files\Mozilla Firefox\firefox.exe

==================== Restore Points =========================

18-04-2018 01:39:08 Device Driver Package Install: Avast Network Service

==================== Faulty Device Manager Devices =============


==================== Event log errors: =========================

Application errors:
==================
Error: (04/17/2018 10:53:09 PM) (Source: Application Error) (EventID: 1000) (User: )
Description: Faulting application name: setup.exe_NVIDIA Install Application, version: 2.1002.259.2249, time stamp: 0x59d76441
Faulting module name: NVI2.DLL, version: 2.1002.259.2249, time stamp: 0x59d76591
Exception code: 0x40000015
Fault offset: 0x00282c7d
Faulting process id: 0xe4c
Faulting application start time: 0x01d3d6c034e92d70
Faulting application path: C:\ProgramData\NVIDIA Corporation\GeForce Experience\Update\setup.exe
Faulting module path: C:\Program Files\NVIDIA Corporation\Installer2\CoreTemp.{F98C1B07-88E5-4CCD-8BAE-C374FA4B36F8}\NVI2.DLL
Report Id: a0083dd0-42b3-11e8-a000-00016c60bc1d

Error: (04/17/2018 09:45:19 PM) (Source: Application Error) (EventID: 1000) (User: )
Description: Faulting application name: Fallout4.exe, version: 1.8.7.0, time stamp: 0x5818e866
Faulting module name: Fallout4.exe, version: 1.8.7.0, time stamp: 0x5818e866
Exception code: 0xc0000005
Fault offset: 0x0000000001cebe1c
Faulting process id: 0xa98
Faulting application start time: 0x01d3d6b6e80092e0
Faulting application path: D:\Games\Fallout 4\Fallout4.exe
Faulting module path: D:\Games\Fallout 4\Fallout4.exe
Report Id: 262da800-42aa-11e8-adf7-00016c60bc1d

Error: (04/17/2018 09:44:30 PM) (Source: Application Error) (EventID: 1000) (User: )
Description: Faulting application name: Fallout4.exe, version: 1.8.7.0, time stamp: 0x5818e866
Faulting module name: Fallout4.exe, version: 1.8.7.0, time stamp: 0x5818e866
Exception code: 0xc0000005
Fault offset: 0x0000000001cebe1c
Faulting process id: 0xa7c
Faulting application start time: 0x01d3d6b6c1638890
Faulting application path: D:\Games\Fallout 4\Fallout4.exe
Faulting module path: D:\Games\Fallout 4\Fallout4.exe
Report Id: 08c10870-42aa-11e8-adf7-00016c60bc1d

Error: (04/16/2018 07:38:01 PM) (Source: Application Error) (EventID: 1000) (User: )
Description: Faulting application name: Fallout4.exe, version: 1.8.7.0, time stamp: 0x5818e866
Faulting module name: Fallout4.exe, version: 1.8.7.0, time stamp: 0x5818e866
Exception code: 0xc0000005
Fault offset: 0x0000000001cebe1c
Faulting process id: 0x91c
Faulting application start time: 0x01d3d5dbf4bc4690
Faulting application path: D:\Games\Fallout 4\Fallout4.exe
Faulting module path: D:\Games\Fallout 4\Fallout4.exe
Report Id: 32d22a30-41cf-11e8-bc7e-df025dea4436

Error: (04/16/2018 07:37:56 PM) (Source: Application Error) (EventID: 1000) (User: )
Description: Faulting application name: Fallout4.exe, version: 1.8.7.0, time stamp: 0x5818e866
Faulting module name: Fallout4.exe, version: 1.8.7.0, time stamp: 0x5818e866
Exception code: 0xc0000005
Fault offset: 0x0000000001cebe1c
Faulting process id: 0xb90
Faulting application start time: 0x01d3d5dbf1e42050
Faulting application path: D:\Games\Fallout 4\Fallout4.exe
Faulting module path: D:\Games\Fallout 4\Fallout4.exe
Report Id: 2fea7390-41cf-11e8-bc7e-df025dea4436

Error: (04/16/2018 07:37:19 PM) (Source: Application Error) (EventID: 1000) (User: )
Description: Faulting application name: Fallout4.exe, version: 1.8.7.0, time stamp: 0x5818e866
Faulting module name: Fallout4.exe, version: 1.8.7.0, time stamp: 0x5818e866
Exception code: 0xc0000005
Fault offset: 0x0000000001cebe1c
Faulting process id: 0x9cc
Faulting application start time: 0x01d3d5dbdc14a150
Faulting application path: D:\Games\Fallout 4\Fallout4.exe
Faulting module path: D:\Games\Fallout 4\Fallout4.exe
Report Id: 1a2813f0-41cf-11e8-bc7e-df025dea4436

Error: (04/16/2018 07:37:08 PM) (Source: Application Error) (EventID: 1000) (User: )
Description: Faulting application name: Fallout4.exe, version: 1.8.7.0, time stamp: 0x5818e866
Faulting module name: Fallout4.exe, version: 1.8.7.0, time stamp: 0x5818e866
Exception code: 0xc0000005
Fault offset: 0x0000000001cebe1c
Faulting process id: 0x1200
Faulting application start time: 0x01d3d5dbd58ba810
Faulting application path: D:\Games\Fallout 4\Fallout4.exe
Faulting module path: D:\Games\Fallout 4\Fallout4.exe
Report Id: 13b47770-41cf-11e8-bc7e-df025dea4436

Error: (04/16/2018 07:36:55 PM) (Source: Application Error) (EventID: 1000) (User: )
Description: Faulting application name: Fallout4.exe, version: 1.8.7.0, time stamp: 0x5818e866
Faulting module name: Fallout4.exe, version: 1.8.7.0, time stamp: 0x5818e866
Exception code: 0xc0000005
Fault offset: 0x0000000001cebe1c
Faulting process id: 0xc18
Faulting application start time: 0x01d3d5dbcbd3dd10
Faulting application path: D:\Games\Fallout 4\Fallout4.exe
Faulting module path: D:\Games\Fallout 4\Fallout4.exe
Report Id: 0baf8c90-41cf-11e8-bc7e-df025dea4436


System errors:
=============
Error: (04/18/2018 05:09:48 PM) (Source: Service Control Manager) (EventID: 7022) (User: )
Description: The Windows Update service hung on starting.

Error: (04/18/2018 05:04:28 PM) (Source: EventLog) (EventID: 6008) (User: )
Description: The previous system shutdown at 5:02:55 PM on ‎4/‎18/‎2018 was unexpected.

Error: (04/18/2018 04:09:49 PM) (Source: Disk) (EventID: 7) (User: )
Description: The device, \Device\Harddisk0\DR0, has a bad block.

Error: (04/18/2018 04:09:46 PM) (Source: Disk) (EventID: 7) (User: )
Description: The device, \Device\Harddisk0\DR0, has a bad block.

Error: (04/18/2018 03:06:50 PM) (Source: Service Control Manager) (EventID: 7000) (User: )
Description: The SBSD Security Center Service service failed to start due to the following error:
The service did not respond to the start or control request in a timely fashion.

Error: (04/18/2018 03:06:50 PM) (Source: Service Control Manager) (EventID: 7009) (User: )
Description: A timeout was reached (30000 milliseconds) while waiting for the SBSD Security Center Service service to connect.

Error: (04/18/2018 03:06:06 PM) (Source: EventLog) (EventID: 6008) (User: )
Description: The previous system shutdown at 3:04:48 PM on ‎4/‎18/‎2018 was unexpected.

Error: (04/18/2018 12:52:52 AM) (Source: VDS Basic Provider) (EventID: 1) (User: )
Description: Unexpected failure. Error code: 490@01010004


==================== Memory info ===========================

Processor: AMD Athlon™ 7750 Dual-Core Processor
Percentage of memory in use: 60%
Total physical RAM: 4094.49 MB
Available physical RAM: 1627.56 MB
Total Virtual: 8187.15 MB
Available Virtual: 5530.08 MB

==================== Drives ================================

Drive c: () (Fixed) (Total:95.61 GB) (Free:22.39 GB) NTFS ==>[system with boot components (obtained from drive)]
Drive d: (STUFF) (Fixed) (Total:500.47 GB) (Free:296.72 GB) NTFS
Drive e: (CD_ROM) (CDROM) (Total:3.73 GB) (Free:0 GB) CDFS
Drive f: (Fallout 4) (CDROM) (Total:30.2 GB) (Free:0 GB) UDF


==================== MBR & Partition Table ==================

========================================================
Disk: 0 (MBR Code: Windows 7/8/10) (Size: 596.2 GB) (Disk ID: 353AD0B7)
Partition 1: (Active) - (Size=95.6 GB) - (Type=07 NTFS)
Partition 2: (Not Active) - (Size=500.5 GB) - (Type=07 NTFS)

==================== End of Addition.txt ============================

Post #4
Select the Start button, then select Control Panel > Appearance and Personalization.
Select Folder Options, then select the View tab.
Under Advanced settings, select Show hidden files, folders, and drives, and then select OK.


Please go to one of the below sites to scan the following files:
Virus Total (Recommended)
jotti.org
VirScan
click on Browse, and upload the following file for analysis:

C:/Users/Aaron/AppData/Roaming/Microsoft/Windows/Start Menu/Programs/Startup/tmpC715.tmp.vbs


Then click Submit. Allow the file to be scanned, and then please copy and paste the results link (for Virus Total) here for me to see.
If it says already scanned – click "reanalyze now"
Please post the results in your next reply.

*******************************
Highlight the entire content of the quote box below and select Copy.

 

Start::
CloseProcesses:
CreateRestorePoint:
HKLM\SOFTWARE\Policies\Microsoft\Windows Defender: Restriction <==== ATTENTION
HKU\S-1-5-21-1023668481-733846680-2293585431-1001\…\Run: [AdobeBridge] => [X
HKU\S-1-5-21-1023668481-733846680-2293585431-1001\…\Winlogon: [Shell] C:\Windows\System32\cmd.exe [345088 2010-11-20] (Microsoft Corporation) <==== ATTENTION
HKU\S-1-5-21-1023668481-733846680-2293585431-1001\…\Command Processor: @mode 15,1 & tasklist /FI "IMAGENAME eq SoundMixer.exe" 2>NUL | find /I /N "SoundMixer.exe">NUL && exit & if exist "C:\Users\Aaron\AppData\Roaming\Microsoft\SoundMixer\SoundMixer.exe" ( start /MIN "" "C:\Users\Aaron\AppData\Roaming\Microsoft\SoundMixer\SoundMixer.exe" & tasklist /FI "IMAGENAME eq explorer.exe" 2>NUL | find /I /N "explorer.exe">NUL && exit & explorer.exe & exit ) else ( tasklist /FI "IMAGENAME eq explorer.exe" 2>NUL | find /I /N "explorer.exe">NUL && exit & explorer.exe & exit ) <==== ATTENTION
GroupPolicy: Restriction <==== ATTENTION
CHR HKLM\SOFTWARE\Policies\Google: Restriction <==== ATTENTION
HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = hxxps://us.search.yahoo.com/yhs/web?hspart=iry&hsimp=yhs-fullyhosted_003&type=wbf_frswfs_17_27¶m1=1¶m2=f%3D1%26b%3DIE%26cc%3Dus%26pa%3Dwincy%26cd%3D2XzuyEtN2Y1L1QzutDtDtDyCyE0FyDyDyCtCyDyBtB0C0DtAtN0D0Tzu0StBtDtCtBtN1L2XzutAtFtBzytFtAtFzztAtN1L1Czu1TtN1L1G1B1V1N2Y1L1Qzu2SyEtDtC0DyEyCyByCtGtC0F0E0AtG0DyB0AzztGyE0E0FzztG0Azy0A0CyByB0CtDzzyEyCtD2QtN1M1F1B2Z1V1N2Y1L1Qzu2S0AtC0C0FtCtC0ByEtGtCzy0CyDtGyEtBtCyDtG0A0AtA0EtGzy0EyB0EyCtBtAtB0EzzyDtA2QtN0A0LzuyE%26cr%3D226074261%26a%3Dwbf_frswfs_17_27%26os_ver%3D6.1%26os%3DWindows%2B7%2BUltimate
HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Start Page = hxxps://us.search.yahoo.com/yhs/web?hspart=iry&hsimp=yhs-fullyhosted_003&type=wbf_frswfs_17_27¶m1=1¶m2=f%3D1%26b%3DIE%26cc%3Dus%26pa%3Dwincy%26cd%3D2XzuyEtN2Y1L1QzutDtDtDyCyE0FyDyDyCtCyDyBtB0C0DtAtN0D0Tzu0StBtDtCtBtN1L2XzutAtFtBzytFtAtFzztAtN1L1Czu1TtN1L1G1B1V1N2Y1L1Qzu2SyEtDtC0DyEyCyByCtGtC0F0E0AtG0DyB0AzztGyE0E0FzztG0Azy0A0CyByB0CtDzzyEyCtD2QtN1M1F1B2Z1V1N2Y1L1Qzu2S0AtC0C0FtCtC0ByEtGtCzy0CyDtGyEtBtCyDtG0A0AtA0EtGzy0EyB0EyCtBtAtB0EzzyDtA2QtN0A0LzuyE%26cr%3D226074261%26a%3Dwbf_frswfs_17_27%26os_ver%3D6.1%26os%3DWindows%2B7%2BUltimate
HKU\S-1-5-21-1023668481-733846680-2293585431-1001\Software\Microsoft\Internet Explorer\Main,Start Page = hxxps://us.search.yahoo.com/yhs/web?hspart=iry&hsimp=yhs-fullyhosted_003&type=wbf_frswfs_17_27¶m1=1¶m2=f%3D1%26b%3DIE%26cc%3Dus%26pa%3Dwincy%26cd%3D2XzuyEtN2Y1L1QzutDtDtDyCyE0FyDyDyCtCyDyBtB0C0DtAtN0D0Tzu0StBtDtCtBtN1L2XzutAtFtBzytFtAtFzztAtN1L1Czu1TtN1L1G1B1V1N2Y1L1Qzu2SyEtDtC0DyEyCyByCtGtC0F0E0AtG0DyB0AzztGyE0E0FzztG0Azy0A0CyByB0CtDzzyEyCtD2QtN1M1F1B2Z1V1N2Y1L1Qzu2S0AtC0C0FtCtC0ByEtGtCzy0CyDtGyEtBtCyDtG0A0AtA0EtGzy0EyB0EyCtBtAtB0EzzyDtA2QtN0A0LzuyE%26cr%3D226074261%26a%3Dwbf_frswfs_17_27%26os_ver%3D6.1%26os%3DWindows%2B7%2BUltimate
HKU\S-1-5-21-1023668481-733846680-2293585431-1001\Software\Microsoft\Internet Explorer\Main,Secondary Start Pages = hxxps://us.search.yahoo.com/yhs/web?hspart=iry&hsimp=yhs-fullyhosted_003&type=wbf_frswfs_17_11¶m1=1¶m2=f%3D1%26b%3DIE%26cc%3Dus%26pa%3Dwincy%26cd%3D2XzuyEtN2Y1L1QzutDtDtDtCyC0CyCtD0B0CtC0DtB0C0DtAtN0D0Tzu0StCzytDtDtN1L2XzutAtFtByBtFyEtFyDtBtN1L1Czu1TtN1L1G1B1V1N2Y1L1Qzu2SyEtD0F0DyE0ByC0BtGyByCtDyBtGyB0EtA0CtGyEtAtDzytG0FyDyC0BtDtCtBtC0B0DtC0E2QtN1M1F1B2Z1V1N2Y1L1Qzu2S0AtC0C0FtCtC0ByEtGtCzy0CyDtGyEtBtCyDtG0A0AtA0EtGzy0EyB0EyCtBtAtB0EzzyDtA2QtN0A0LzuyE%26cr%3D1025181047%26a%3Dwbf_frswfs_17_11%26os_ver%3D6.1%26os%3DWindows%2B7%2BUltimate
SearchScopes: HKLM -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = hxxps://us.search.yahoo.com/yhs/search?hspart=iry&hsimp=yhs-fullyhosted_003&type=wbf_frswfs_17_27¶m1=1¶m2=f%3D4%26b%3DIE%26cc%3Dus%26pa%3Dwincy%26cd%3D2XzuyEtN2Y1L1QzutDtDtDyCyE0FyDyDyCtCyDyBtB0C0DtAtN0D0Tzu0StBtDtCtBtN1L2XzutAtFtBzytFtAtFzztAtN1L1Czu1TtN1L1G1B1V1N2Y1L1Qzu2SyEtDtC0DyEyCyByCtGtC0F0E0AtG0DyB0AzztGyE0E0FzztG0Azy0A0CyByB0CtDzzyEyCtD2QtN1M1F1B2Z1V1N2Y1L1Qzu2S0AtC0C0FtCtC0ByEtGtCzy0CyDtGyEtBtCyDtG0A0AtA0EtGzy0EyB0EyCtBtAtB0EzzyDtA2QtN0A0LzuyE%26cr%3D226074261%26a%3Dwbf_frswfs_17_27%26os_ver%3D6.1%26os%3DWindows%2B7%2BUltimate&p={searchTerms}
SearchScopes: HKLM -> {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = hxxps://us.search.yahoo.com/yhs/search?hspart=iry&hsimp=yhs-fullyhosted_003&type=wbf_frswfs_17_27¶m1=1¶m2=f%3D4%26b%3DIE%26cc%3Dus%26pa%3Dwincy%26cd%3D2XzuyEtN2Y1L1QzutDtDtDyCyE0FyDyDyCtCyDyBtB0C0DtAtN0D0Tzu0StBtDtCtBtN1L2XzutAtFtBzytFtAtFzztAtN1L1Czu1TtN1L1G1B1V1N2Y1L1Qzu2SyEtDtC0DyEyCyByCtGtC0F0E0AtG0DyB0AzztGyE0E0FzztG0Azy0A0CyByB0CtDzzyEyCtD2QtN1M1F1B2Z1V1N2Y1L1Qzu2S0AtC0C0FtCtC0ByEtGtCzy0CyDtGyEtBtCyDtG0A0AtA0EtGzy0EyB0EyCtBtAtB0EzzyDtA2QtN0A0LzuyE%26cr%3D226074261%26a%3Dwbf_frswfs_17_27%26os_ver%3D6.1%26os%3DWindows%2B7%2BUltimate&p={searchTerms}
SearchScopes: HKLM -> {2211d4a5-48d0-47f5-a7cd-81e861470f7f} URL = hxxps://us.search.yahoo.com/yhs/search?hspart=iry&hsimp=yhs-fullyhosted_003&type=wbf_sgnsft_17_14_ssg01¶m1=1¶m2=f%3D4%26b%3DIE%26cc%3Dus%26pa%3Dwincy%26cd%3D2XzuyEtN2Y1L1QzutDtDtDtCyC0CyCtD0B0CtC0DtB0C0DtAtN0D0Tzu0StCzytBtBtN1L2XzutAtFtBzytFtAtFyDtBtN1L1Czu1TtN1L1G1B1V1N2Y1L1Qzu2SyB0FzzyEzz0CyByBtGyByDzz0DtG0AtCyB0AtGtCtCzytBtGyD0AtAyByCtDtBtD0AtAtCyB2QtN1M1F1B2Z1V1N2Y1L1Qzu2S0AtC0C0FtCtC0ByEtGtCzy0CyDtGyEtBtCyDtG0A0AtA0EtGzy0EyB0EyCtBtAtB0EzzyDtA2QtN0A0LzuyE%26cr%3D1438759187%26a%3Dwbf_sgnsft_17_14_ssg01%26os_ver%3D6.1%26os%3DWindows%2B7%2BUltimate&p={searchTerms}
SearchScopes: HKLM -> {f7bb050c-e116-44da-89c2-6f2b68c54836} URL = hxxps://us.search.yahoo.com/yhs/search?hspart=iry&hsimp=yhs-fullyhosted_003&type=wbf_frswfs_17_11¶m1=1¶m2=f%3D4%26b%3DIE%26cc%3Dus%26pa%3Dwincy%26cd%3D2XzuyEtN2Y1L1QzutDtDtDtCyC0CyCtD0B0CtC0DtB0C0DtAtN0D0Tzu0StCzytDtDtN1L2XzutAtFtByBtFyEtFyDtBtN1L1Czu1TtN1L1G1B1V1N2Y1L1Qzu2SyEtD0F0DyE0ByC0BtGyByCtDyBtGyB0EtA0CtGyEtAtDzytG0FyDyC0BtDtCtBtC0B0DtC0E2QtN1M1F1B2Z1V1N2Y1L1Qzu2S0AtC0C0FtCtC0ByEtGtCzy0CyDtGyEtBtCyDtG0A0AtA0EtGzy0EyB0EyCtBtAtB0EzzyDtA2QtN0A0LzuyE%26cr%3D1025181047%26a%3Dwbf_frswfs_17_11%26os_ver%3D6.1%26os%3DWindows%2B7%2BUltimate&p={searchTerms}
SearchScopes: HKLM-x32 -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = hxxps://us.search.yahoo.com/yhs/search?hspart=iry&hsimp=yhs-fullyhosted_003&type=wbf_frswfs_17_27¶m1=1¶m2=f%3D4%26b%3DIE%26cc%3Dus%26pa%3Dwincy%26cd%3D2XzuyEtN2Y1L1QzutDtDtDyCyE0FyDyDyCtCyDyBtB0C0DtAtN0D0Tzu0StBtDtCtBtN1L2XzutAtFtBzytFtAtFzztAtN1L1Czu1TtN1L1G1B1V1N2Y1L1Qzu2SyEtDtC0DyEyCyByCtGtC0F0E0AtG0DyB0AzztGyE0E0FzztG0Azy0A0CyByB0CtDzzyEyCtD2QtN1M1F1B2Z1V1N2Y1L1Qzu2S0AtC0C0FtCtC0ByEtGtCzy0CyDtGyEtBtCyDtG0A0AtA0EtGzy0EyB0EyCtBtAtB0EzzyDtA2QtN0A0LzuyE%26cr%3D226074261%26a%3Dwbf_frswfs_17_27%26os_ver%3D6.1%26os%3DWindows%2B7%2BUltimate&p={searchTerms}
SearchScopes: HKLM-x32 -> {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = hxxps://us.search.yahoo.com/yhs/search?hspart=iry&hsimp=yhs-fullyhosted_003&type=wbf_frswfs_17_27¶m1=1¶m2=f%3D4%26b%3DIE%26cc%3Dus%26pa%3Dwincy%26cd%3D2XzuyEtN2Y1L1QzutDtDtDyCyE0FyDyDyCtCyDyBtB0C0DtAtN0D0Tzu0StBtDtCtBtN1L2XzutAtFtBzytFtAtFzztAtN1L1Czu1TtN1L1G1B1V1N2Y1L1Qzu2SyEtDtC0DyEyCyByCtGtC0F0E0AtG0DyB0AzztGyE0E0FzztG0Azy0A0CyByB0CtDzzyEyCtD2QtN1M1F1B2Z1V1N2Y1L1Qzu2S0AtC0C0FtCtC0ByEtGtCzy0CyDtGyEtBtCyDtG0A0AtA0EtGzy0EyB0EyCtBtAtB0EzzyDtA2QtN0A0LzuyE%26cr%3D226074261%26a%3Dwbf_frswfs_17_27%26os_ver%3D6.1%26os%3DWindows%2B7%2BUltimate&p={searchTerms}
SearchScopes: HKLM-x32 -> {2211d4a5-48d0-47f5-a7cd-81e861470f7f} URL = hxxps://us.search.yahoo.com/yhs/search?hspart=iry&hsimp=yhs-fullyhosted_003&type=wbf_sgnsft_17_14_ssg01¶m1=1¶m2=f%3D4%26b%3DIE%26cc%3Dus%26pa%3Dwincy%26cd%3D2XzuyEtN2Y1L1QzutDtDtDtCyC0CyCtD0B0CtC0DtB0C0DtAtN0D0Tzu0StCzytBtBtN1L2XzutAtFtBzytFtAtFyDtBtN1L1Czu1TtN1L1G1B1V1N2Y1L1Qzu2SyB0FzzyEzz0CyByBtGyByDzz0DtG0AtCyB0AtGtCtCzytBtGyD0AtAyByCtDtBtD0AtAtCyB2QtN1M1F1B2Z1V1N2Y1L1Qzu2S0AtC0C0FtCtC0ByEtGtCzy0CyDtGyEtBtCyDtG0A0AtA0EtGzy0EyB0EyCtBtAtB0EzzyDtA2QtN0A0LzuyE%26cr%3D1438759187%26a%3Dwbf_sgnsft_17_14_ssg01%26os_ver%3D6.1%26os%3DWindows%2B7%2BUltimate&p={searchTerms}
SearchScopes: HKLM-x32 -> {f7bb050c-e116-44da-89c2-6f2b68c54836} URL = hxxps://us.search.yahoo.com/yhs/search?hspart=iry&hsimp=yhs-fullyhosted_003&type=wbf_frswfs_17_11¶m1=1¶m2=f%3D4%26b%3DIE%26cc%3Dus%26pa%3Dwincy%26cd%3D2XzuyEtN2Y1L1QzutDtDtDtCyC0CyCtD0B0CtC0DtB0C0DtAtN0D0Tzu0StCzytDtDtN1L2XzutAtFtByBtFyEtFyDtBtN1L1Czu1TtN1L1G1B1V1N2Y1L1Qzu2SyEtD0F0DyE0ByC0BtGyByCtDyBtGyB0EtA0CtGyEtAtDzytG0FyDyC0BtDtCtBtC0B0DtC0E2QtN1M1F1B2Z1V1N2Y1L1Qzu2S0AtC0C0FtCtC0ByEtGtCzy0CyDtGyEtBtCyDtG0A0AtA0EtGzy0EyB0EyCtBtAtB0EzzyDtA2QtN0A0LzuyE%26cr%3D1025181047%26a%3Dwbf_frswfs_17_11%26os_ver%3D6.1%26os%3DWindows%2B7%2BUltimate&p={searchTerms}
SearchScopes: HKU\S-1-5-21-1023668481-733846680-2293585431-1001 -> DefaultScope {2211d4a5-48d0-47f5-a7cd-81e861470f7f} URL = hxxps://us.search.yahoo.com/yhs/search?hspart=elm&hsimp=yhs-001&type=hdr_s_17_21_wbf_sgnsft_17_14_ssg01¶m1=1¶m2=f%3D4%26b%3DIE%26cc%3Dus%26pa%3Dhodor%26cd%3D2XzuyEtN2Y1L1QzutDtDtDtCyC0CyCtD0B0CtC0DtB0C0DtAtN0D0Tzu0StCzyyByEtN1L2XzutAtFtAtBtFtCtFyDtDtN1L1Czu1M1Q1CtAtBtFtAtFtDtN1L1G1B1V1N2Y1L1Qzu2StAtC0FyE0DtC0EtCtGyCtDzzzytG0BtAyBtCtGtB0CzyzztG0B0EyDyCyE0B0DzzzytA0BtB2QtN1M1F1B2Z1V1N2Y1L1Qzu2S0AtC0C0FtCtC0ByEtGtCzy0CyDtGyEtBtCyDtG0A0AtA0EtGzy0EyB0EyCtBtAtB0EzzyDtA2QtN0A0LzuyE%26cr%3D1741862318%26a%3Dhdr_s_17_21_wbf_sgnsft_17_14_ssg01%26os_ver%3D6.1%26os%3DWindows%2B7%2BUltimate&p={searchTerms}
SearchScopes: HKU\S-1-5-21-1023668481-733846680-2293585431-1001 -> {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = hxxps://us.search.yahoo.com/yhs/search?hspart=elm&hsimp=yhs-001&type=hdr_s_17_21_wbf_sgnsft_17_14_ssg01¶m1=1¶m2=f%3D4%26b%3DIE%26cc%3Dus%26pa%3Dhodor%26cd%3D2XzuyEtN2Y1L1QzutDtDtDtCyC0CyCtD0B0CtC0DtB0C0DtAtN0D0Tzu0StCzyyByEtN1L2XzutAtFtAtBtFtCtFyDtDtN1L1Czu1M1Q1CtAtBtFtAtFtDtN1L1G1B1V1N2Y1L1Qzu2StAtC0FyE0DtC0EtCtGyCtDzzzytG0BtAyBtCtGtB0CzyzztG0B0EyDyCyE0B0DzzzytA0BtB2QtN1M1F1B2Z1V1N2Y1L1Qzu2S0AtC0C0FtCtC0ByEtGtCzy0CyDtGyEtBtCyDtG0A0AtA0EtGzy0EyB0EyCtBtAtB0EzzyDtA2QtN0A0LzuyE%26cr%3D1741862318%26a%3Dhdr_s_17_21_wbf_sgnsft_17_14_ssg01%26os_ver%3D6.1%26os%3DWindows%2B7%2BUltimate&p={searchTerms}
SearchScopes: HKU\S-1-5-21-1023668481-733846680-2293585431-1001 -> {09E41F92-F0DE-4B05-A249-EB3049C96CB3} URL = hxxps://search.yahoo.com/search?fr=chr-greentree_ie&ei=utf-8&ilc=12&type=435371&p={searchTerms}
SearchScopes: HKU\S-1-5-21-1023668481-733846680-2293585431-1001 -> {2211d4a5-48d0-47f5-a7cd-81e861470f7f} URL = hxxps://us.search.yahoo.com/yhs/search?hspart=elm&hsimp=yhs-001&type=hdr_s_17_21_wbf_sgnsft_17_14_ssg01¶m1=1¶m2=f%3D4%26b%3DIE%26cc%3Dus%26pa%3Dhodor%26cd%3D2XzuyEtN2Y1L1QzutDtDtDtCyC0CyCtD0B0CtC0DtB0C0DtAtN0D0Tzu0StCzyyByEtN1L2XzutAtFtAtBtFtCtFyDtDtN1L1Czu1M1Q1CtAtBtFtAtFtDtN1L1G1B1V1N2Y1L1Qzu2StAtC0FyE0DtC0EtCtGyCtDzzzytG0BtAyBtCtGtB0CzyzztG0B0EyDyCyE0B0DzzzytA0BtB2QtN1M1F1B2Z1V1N2Y1L1Qzu2S0AtC0C0FtCtC0ByEtGtCzy0CyDtGyEtBtCyDtG0A0AtA0EtGzy0EyB0EyCtBtAtB0EzzyDtA2QtN0A0LzuyE%26cr%3D1741862318%26a%3Dhdr_s_17_21_wbf_sgnsft_17_14_ssg01%26os_ver%3D6.1%26os%3DWindows%2B7%2BUltimate&p={searchTerms}
CHR DefaultSearchURL: Default -> hxxp://srch.bar/{searchTerms}
CHR DefaultSuggestURL: Default -> hxxp://srch.bar/?s={searchTerms}
U3 a7u3xsl5; C:\Windows\System32\Drivers\a7u3xsl5.sys [0 ] (Advanced Micro Devices) <==== ATTENTION (zero byte File/Folder)
S3 Synth3dVsc; System32\drivers\synth3dvsc.sys [X]
S3 tsusbhub; system32\drivers\tsusbhub.sys [X]
S3 VGPU; System32\drivers\rdvgkmd.sys [X]
S3 __FOX__FOXONE_DRIVER__; \??\C:\Users\Aaron\AppData\Local\Temp\FoxDriver.sys [X] <==== ATTENTION
Task: {DB479BC6-D6BA-4942-9F79-564CB7B0F8BE} - \Yahoo! Powered rinal -> No File <==== ATTENTION
Task: C:\Windows\Tasks\Yahoo! Powered rinal.job => Wscript.exe C:\ProgramData\{1B3BDE58-9179-549E-17BF-CADC8DFD4112}\sili.txt <==== ATTENTION
Emptytemp:
Hosts:
End::



Start FRST (FRST64) with Administrator privileges
Press the Fix button. FRST will process the lines copied above from the clipboard.
When finished, a log file (Fixlog.txt) will pop up and saved in the same location the tool was ran from.

Please copy and paste its contents in your next reply.
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

[external image: RQKuhw1.png]RogueKiller
  • Download the right version of RogueKiller for your Windows version (32 or 64-bit)
  • Once done, move the executable file to your Desktop, right-click on it and select [external image: Spcusrh.png]Run as Administrator (for Windows Vista, 7, 8, 8.1 and 10 users)
  • Click on the Start Scan button in the right panel, which will bring you to another tab, and click on it again (this time it'll be in the bottom right corner)
  • Wait for the scan to complete
  • On completion, the results will be displayed
  • Check every single entry (threat found), and click on the Remove Selected button
  • On completion, the results will be displayed. Click on the Open Report button in the bottom left corner, followed by the Open TXT button (also in the bottom left corner)
  • This will open the report in Notepad. Copy/paste its content in your next reply
[external image: zcMPezJ.png]AdwCleaner - Fix Mode
  • Download AdwCleaner and move it to your Desktop
  • Right-click on AdwCleaner.exe and select [external image: Spcusrh.png]Run as Administrator (for Windows Vista, 7, 8, 8.1 and 10 users)
  • Accept the EULA (I accept), then click on Scan
  • Let the scan complete. Once it's done, make sure that every item listed in the different tabs is checked and click on the Clean button. This will kill all active processes
    🖼Click to load external image (V7SD4El.png)
  • Once the cleaning process is complete, AdwCleaner will ask to restart your computer, do it
  • After the restart, a log will open when logging in. Please copy/paste the content of that log in your next reply
Your next reply(ies) should therefore contain:

  • File requested scanned
  • Copy/pasted Fixlog.txt
  • Copy/pasted RogueKiller clean log
  • Copy/pasted AdwCleaner clean log
created by Aura
Post #5

  The file that you wanted scanned could not be found. I checked show hidden files and folders and couldnt find it. The rest was ok.

 

 

Fix result of Farbar Recovery Scan Tool (x64) Version: 15.04.2018
Ran by [removed] (18-04-2018 21:20:55) Run:1
Running from C:\Users\[removed]\Desktop
[removed] Boot Mode: Normal
==============================================

fixlist content:
*****************
CloseProcesses:
CreateRestorePoint:
HKLM\SOFTWARE\Policies\Microsoft\Windows Defender: Restriction <==== ATTENTION
HKU\S-1-5-21-1023668481-733846680-2293585431-1001\…\Run: [AdobeBridge] => [X
HKU\S-1-5-21-1023668481-733846680-2293585431-1001\…\Winlogon: [Shell] C:\Windows\System32\cmd.exe [345088 2010-11-20] (Microsoft Corporation) <==== ATTENTION
HKU\S-1-5-21-1023668481-733846680-2293585431-1001\…\Command Processor: @mode 15,1 & tasklist /FI "IMAGENAME eq SoundMixer.exe" 2>NUL | find /I /N "SoundMixer.exe">NUL && exit & if exist "C:\Users\Aaron\AppData\Roaming\Microsoft\SoundMixer\SoundMixer.exe" ( start /MIN "" "C:\Users\Aaron\AppData\Roaming\Microsoft\SoundMixer\SoundMixer.exe" & tasklist /FI "IMAGENAME eq explorer.exe" 2>NUL | find /I /N "explorer.exe">NUL && exit & explorer.exe & exit ) else ( tasklist /FI "IMAGENAME eq explorer.exe" 2>NUL | find /I /N "explorer.exe">NUL && exit & explorer.exe & exit ) <==== ATTENTION
GroupPolicy: Restriction <==== ATTENTION
CHR HKLM\SOFTWARE\Policies\Google: Restriction <==== ATTENTION
HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = hxxps://us.search.yahoo.com/yhs/web?hspart=iry&hsimp=yhs-fullyhosted_003&type=wbf_frswfs_17_27¶m1=1¶m2=f%3D1%26b%3DIE%26cc%3Dus%26pa%3Dwincy%26cd%3D2XzuyEtN2Y1L1QzutDtDtDyCyE0FyDyDyCtCyDyBtB0C0DtAtN0D0Tzu0StBtDtCtBtN1L2XzutAtFtBzytFtAtFzztAtN1L1Czu1TtN1L1G1B1V1N2Y1L1Qzu2SyEtDtC0DyEyCyByCtGtC0F0E0AtG0DyB0AzztGyE0E0FzztG0Azy0A0CyByB0CtDzzyEyCtD2QtN1M1F1B2Z1V1N2Y1L1Qzu2S0AtC0C0FtCtC0ByEtGtCzy0CyDtGyEtBtCyDtG0A0AtA0EtGzy0EyB0EyCtBtAtB0EzzyDtA2QtN0A0LzuyE%26cr%3D226074261%26a%3Dwbf_frswfs_17_27%26os_ver%3D6.1%26os%3DWindows%2B7%2BUltimate
HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Start Page = hxxps://us.search.yahoo.com/yhs/web?hspart=iry&hsimp=yhs-fullyhosted_003&type=wbf_frswfs_17_27¶m1=1¶m2=f%3D1%26b%3DIE%26cc%3Dus%26pa%3Dwincy%26cd%3D2XzuyEtN2Y1L1QzutDtDtDyCyE0FyDyDyCtCyDyBtB0C0DtAtN0D0Tzu0StBtDtCtBtN1L2XzutAtFtBzytFtAtFzztAtN1L1Czu1TtN1L1G1B1V1N2Y1L1Qzu2SyEtDtC0DyEyCyByCtGtC0F0E0AtG0DyB0AzztGyE0E0FzztG0Azy0A0CyByB0CtDzzyEyCtD2QtN1M1F1B2Z1V1N2Y1L1Qzu2S0AtC0C0FtCtC0ByEtGtCzy0CyDtGyEtBtCyDtG0A0AtA0EtGzy0EyB0EyCtBtAtB0EzzyDtA2QtN0A0LzuyE%26cr%3D226074261%26a%3Dwbf_frswfs_17_27%26os_ver%3D6.1%26os%3DWindows%2B7%2BUltimate
HKU\S-1-5-21-1023668481-733846680-2293585431-1001\Software\Microsoft\Internet Explorer\Main,Start Page = hxxps://us.search.yahoo.com/yhs/web?hspart=iry&hsimp=yhs-fullyhosted_003&type=wbf_frswfs_17_27¶m1=1¶m2=f%3D1%26b%3DIE%26cc%3Dus%26pa%3Dwincy%26cd%3D2XzuyEtN2Y1L1QzutDtDtDyCyE0FyDyDyCtCyDyBtB0C0DtAtN0D0Tzu0StBtDtCtBtN1L2XzutAtFtBzytFtAtFzztAtN1L1Czu1TtN1L1G1B1V1N2Y1L1Qzu2SyEtDtC0DyEyCyByCtGtC0F0E0AtG0DyB0AzztGyE0E0FzztG0Azy0A0CyByB0CtDzzyEyCtD2QtN1M1F1B2Z1V1N2Y1L1Qzu2S0AtC0C0FtCtC0ByEtGtCzy0CyDtGyEtBtCyDtG0A0AtA0EtGzy0EyB0EyCtBtAtB0EzzyDtA2QtN0A0LzuyE%26cr%3D226074261%26a%3Dwbf_frswfs_17_27%26os_ver%3D6.1%26os%3DWindows%2B7%2BUltimate
HKU\S-1-5-21-1023668481-733846680-2293585431-1001\Software\Microsoft\Internet Explorer\Main,Secondary Start Pages = hxxps://us.search.yahoo.com/yhs/web?hspart=iry&hsimp=yhs-fullyhosted_003&type=wbf_frswfs_17_11¶m1=1¶m2=f%3D1%26b%3DIE%26cc%3Dus%26pa%3Dwincy%26cd%3D2XzuyEtN2Y1L1QzutDtDtDtCyC0CyCtD0B0CtC0DtB0C0DtAtN0D0Tzu0StCzytDtDtN1L2XzutAtFtByBtFyEtFyDtBtN1L1Czu1TtN1L1G1B1V1N2Y1L1Qzu2SyEtD0F0DyE0ByC0BtGyByCtDyBtGyB0EtA0CtGyEtAtDzytG0FyDyC0BtDtCtBtC0B0DtC0E2QtN1M1F1B2Z1V1N2Y1L1Qzu2S0AtC0C0FtCtC0ByEtGtCzy0CyDtGyEtBtCyDtG0A0AtA0EtGzy0EyB0EyCtBtAtB0EzzyDtA2QtN0A0LzuyE%26cr%3D1025181047%26a%3Dwbf_frswfs_17_11%26os_ver%3D6.1%26os%3DWindows%2B7%2BUltimate
SearchScopes: HKLM -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = hxxps://us.search.yahoo.com/yhs/search?hspart=iry&hsimp=yhs-fullyhosted_003&type=wbf_frswfs_17_27¶m1=1¶m2=f%3D4%26b%3DIE%26cc%3Dus%26pa%3Dwincy%26cd%3D2XzuyEtN2Y1L1QzutDtDtDyCyE0FyDyDyCtCyDyBtB0C0DtAtN0D0Tzu0StBtDtCtBtN1L2XzutAtFtBzytFtAtFzztAtN1L1Czu1TtN1L1G1B1V1N2Y1L1Qzu2SyEtDtC0DyEyCyByCtGtC0F0E0AtG0DyB0AzztGyE0E0FzztG0Azy0A0CyByB0CtDzzyEyCtD2QtN1M1F1B2Z1V1N2Y1L1Qzu2S0AtC0C0FtCtC0ByEtGtCzy0CyDtGyEtBtCyDtG0A0AtA0EtGzy0EyB0EyCtBtAtB0EzzyDtA2QtN0A0LzuyE%26cr%3D226074261%26a%3Dwbf_frswfs_17_27%26os_ver%3D6.1%26os%3DWindows%2B7%2BUltimate&p={searchTerms}
SearchScopes: HKLM -> {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = hxxps://us.search.yahoo.com/yhs/search?hspart=iry&hsimp=yhs-fullyhosted_003&type=wbf_frswfs_17_27¶m1=1¶m2=f%3D4%26b%3DIE%26cc%3Dus%26pa%3Dwincy%26cd%3D2XzuyEtN2Y1L1QzutDtDtDyCyE0FyDyDyCtCyDyBtB0C0DtAtN0D0Tzu0StBtDtCtBtN1L2XzutAtFtBzytFtAtFzztAtN1L1Czu1TtN1L1G1B1V1N2Y1L1Qzu2SyEtDtC0DyEyCyByCtGtC0F0E0AtG0DyB0AzztGyE0E0FzztG0Azy0A0CyByB0CtDzzyEyCtD2QtN1M1F1B2Z1V1N2Y1L1Qzu2S0AtC0C0FtCtC0ByEtGtCzy0CyDtGyEtBtCyDtG0A0AtA0EtGzy0EyB0EyCtBtAtB0EzzyDtA2QtN0A0LzuyE%26cr%3D226074261%26a%3Dwbf_frswfs_17_27%26os_ver%3D6.1%26os%3DWindows%2B7%2BUltimate&p={searchTerms}
SearchScopes: HKLM -> {2211d4a5-48d0-47f5-a7cd-81e861470f7f} URL = hxxps://us.search.yahoo.com/yhs/search?hspart=iry&hsimp=yhs-fullyhosted_003&type=wbf_sgnsft_17_14_ssg01¶m1=1¶m2=f%3D4%26b%3DIE%26cc%3Dus%26pa%3Dwincy%26cd%3D2XzuyEtN2Y1L1QzutDtDtDtCyC0CyCtD0B0CtC0DtB0C0DtAtN0D0Tzu0StCzytBtBtN1L2XzutAtFtBzytFtAtFyDtBtN1L1Czu1TtN1L1G1B1V1N2Y1L1Qzu2SyB0FzzyEzz0CyByBtGyByDzz0DtG0AtCyB0AtGtCtCzytBtGyD0AtAyByCtDtBtD0AtAtCyB2QtN1M1F1B2Z1V1N2Y1L1Qzu2S0AtC0C0FtCtC0ByEtGtCzy0CyDtGyEtBtCyDtG0A0AtA0EtGzy0EyB0EyCtBtAtB0EzzyDtA2QtN0A0LzuyE%26cr%3D1438759187%26a%3Dwbf_sgnsft_17_14_ssg01%26os_ver%3D6.1%26os%3DWindows%2B7%2BUltimate&p={searchTerms}
SearchScopes: HKLM -> {f7bb050c-e116-44da-89c2-6f2b68c54836} URL = hxxps://us.search.yahoo.com/yhs/search?hspart=iry&hsimp=yhs-fullyhosted_003&type=wbf_frswfs_17_11¶m1=1¶m2=f%3D4%26b%3DIE%26cc%3Dus%26pa%3Dwincy%26cd%3D2XzuyEtN2Y1L1QzutDtDtDtCyC0CyCtD0B0CtC0DtB0C0DtAtN0D0Tzu0StCzytDtDtN1L2XzutAtFtByBtFyEtFyDtBtN1L1Czu1TtN1L1G1B1V1N2Y1L1Qzu2SyEtD0F0DyE0ByC0BtGyByCtDyBtGyB0EtA0CtGyEtAtDzytG0FyDyC0BtDtCtBtC0B0DtC0E2QtN1M1F1B2Z1V1N2Y1L1Qzu2S0AtC0C0FtCtC0ByEtGtCzy0CyDtGyEtBtCyDtG0A0AtA0EtGzy0EyB0EyCtBtAtB0EzzyDtA2QtN0A0LzuyE%26cr%3D1025181047%26a%3Dwbf_frswfs_17_11%26os_ver%3D6.1%26os%3DWindows%2B7%2BUltimate&p={searchTerms}
SearchScopes: HKLM-x32 -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = hxxps://us.search.yahoo.com/yhs/search?hspart=iry&hsimp=yhs-fullyhosted_003&type=wbf_frswfs_17_27¶m1=1¶m2=f%3D4%26b%3DIE%26cc%3Dus%26pa%3Dwincy%26cd%3D2XzuyEtN2Y1L1QzutDtDtDyCyE0FyDyDyCtCyDyBtB0C0DtAtN0D0Tzu0StBtDtCtBtN1L2XzutAtFtBzytFtAtFzztAtN1L1Czu1TtN1L1G1B1V1N2Y1L1Qzu2SyEtDtC0DyEyCyByCtGtC0F0E0AtG0DyB0AzztGyE0E0FzztG0Azy0A0CyByB0CtDzzyEyCtD2QtN1M1F1B2Z1V1N2Y1L1Qzu2S0AtC0C0FtCtC0ByEtGtCzy0CyDtGyEtBtCyDtG0A0AtA0EtGzy0EyB0EyCtBtAtB0EzzyDtA2QtN0A0LzuyE%26cr%3D226074261%26a%3Dwbf_frswfs_17_27%26os_ver%3D6.1%26os%3DWindows%2B7%2BUltimate&p={searchTerms}
SearchScopes: HKLM-x32 -> {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = hxxps://us.search.yahoo.com/yhs/search?hspart=iry&hsimp=yhs-fullyhosted_003&type=wbf_frswfs_17_27¶m1=1¶m2=f%3D4%26b%3DIE%26cc%3Dus%26pa%3Dwincy%26cd%3D2XzuyEtN2Y1L1QzutDtDtDyCyE0FyDyDyCtCyDyBtB0C0DtAtN0D0Tzu0StBtDtCtBtN1L2XzutAtFtBzytFtAtFzztAtN1L1Czu1TtN1L1G1B1V1N2Y1L1Qzu2SyEtDtC0DyEyCyByCtGtC0F0E0AtG0DyB0AzztGyE0E0FzztG0Azy0A0CyByB0CtDzzyEyCtD2QtN1M1F1B2Z1V1N2Y1L1Qzu2S0AtC0C0FtCtC0ByEtGtCzy0CyDtGyEtBtCyDtG0A0AtA0EtGzy0EyB0EyCtBtAtB0EzzyDtA2QtN0A0LzuyE%26cr%3D226074261%26a%3Dwbf_frswfs_17_27%26os_ver%3D6.1%26os%3DWindows%2B7%2BUltimate&p={searchTerms}
SearchScopes: HKLM-x32 -> {2211d4a5-48d0-47f5-a7cd-81e861470f7f} URL = hxxps://us.search.yahoo.com/yhs/search?hspart=iry&hsimp=yhs-fullyhosted_003&type=wbf_sgnsft_17_14_ssg01¶m1=1¶m2=f%3D4%26b%3DIE%26cc%3Dus%26pa%3Dwincy%26cd%3D2XzuyEtN2Y1L1QzutDtDtDtCyC0CyCtD0B0CtC0DtB0C0DtAtN0D0Tzu0StCzytBtBtN1L2XzutAtFtBzytFtAtFyDtBtN1L1Czu1TtN1L1G1B1V1N2Y1L1Qzu2SyB0FzzyEzz0CyByBtGyByDzz0DtG0AtCyB0AtGtCtCzytBtGyD0AtAyByCtDtBtD0AtAtCyB2QtN1M1F1B2Z1V1N2Y1L1Qzu2S0AtC0C0FtCtC0ByEtGtCzy0CyDtGyEtBtCyDtG0A0AtA0EtGzy0EyB0EyCtBtAtB0EzzyDtA2QtN0A0LzuyE%26cr%3D1438759187%26a%3Dwbf_sgnsft_17_14_ssg01%26os_ver%3D6.1%26os%3DWindows%2B7%2BUltimate&p={searchTerms}
SearchScopes: HKLM-x32 -> {f7bb050c-e116-44da-89c2-6f2b68c54836} URL = hxxps://us.search.yahoo.com/yhs/search?hspart=iry&hsimp=yhs-fullyhosted_003&type=wbf_frswfs_17_11¶m1=1¶m2=f%3D4%26b%3DIE%26cc%3Dus%26pa%3Dwincy%26cd%3D2XzuyEtN2Y1L1QzutDtDtDtCyC0CyCtD0B0CtC0DtB0C0DtAtN0D0Tzu0StCzytDtDtN1L2XzutAtFtByBtFyEtFyDtBtN1L1Czu1TtN1L1G1B1V1N2Y1L1Qzu2SyEtD0F0DyE0ByC0BtGyByCtDyBtGyB0EtA0CtGyEtAtDzytG0FyDyC0BtDtCtBtC0B0DtC0E2QtN1M1F1B2Z1V1N2Y1L1Qzu2S0AtC0C0FtCtC0ByEtGtCzy0CyDtGyEtBtCyDtG0A0AtA0EtGzy0EyB0EyCtBtAtB0EzzyDtA2QtN0A0LzuyE%26cr%3D1025181047%26a%3Dwbf_frswfs_17_11%26os_ver%3D6.1%26os%3DWindows%2B7%2BUltimate&p={searchTerms}
SearchScopes: HKU\S-1-5-21-1023668481-733846680-2293585431-1001 -> DefaultScope {2211d4a5-48d0-47f5-a7cd-81e861470f7f} URL = hxxps://us.search.yahoo.com/yhs/search?hspart=elm&hsimp=yhs-001&type=hdr_s_17_21_wbf_sgnsft_17_14_ssg01¶m1=1¶m2=f%3D4%26b%3DIE%26cc%3Dus%26pa%3Dhodor%26cd%3D2XzuyEtN2Y1L1QzutDtDtDtCyC0CyCtD0B0CtC0DtB0C0DtAtN0D0Tzu0StCzyyByEtN1L2XzutAtFtAtBtFtCtFyDtDtN1L1Czu1M1Q1CtAtBtFtAtFtDtN1L1G1B1V1N2Y1L1Qzu2StAtC0FyE0DtC0EtCtGyCtDzzzytG0BtAyBtCtGtB0CzyzztG0B0EyDyCyE0B0DzzzytA0BtB2QtN1M1F1B2Z1V1N2Y1L1Qzu2S0AtC0C0FtCtC0ByEtGtCzy0CyDtGyEtBtCyDtG0A0AtA0EtGzy0EyB0EyCtBtAtB0EzzyDtA2QtN0A0LzuyE%26cr%3D1741862318%26a%3Dhdr_s_17_21_wbf_sgnsft_17_14_ssg01%26os_ver%3D6.1%26os%3DWindows%2B7%2BUltimate&p={searchTerms}
SearchScopes: HKU\S-1-5-21-1023668481-733846680-2293585431-1001 -> {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = hxxps://us.search.yahoo.com/yhs/search?hspart=elm&hsimp=yhs-001&type=hdr_s_17_21_wbf_sgnsft_17_14_ssg01¶m1=1¶m2=f%3D4%26b%3DIE%26cc%3Dus%26pa%3Dhodor%26cd%3D2XzuyEtN2Y1L1QzutDtDtDtCyC0CyCtD0B0CtC0DtB0C0DtAtN0D0Tzu0StCzyyByEtN1L2XzutAtFtAtBtFtCtFyDtDtN1L1Czu1M1Q1CtAtBtFtAtFtDtN1L1G1B1V1N2Y1L1Qzu2StAtC0FyE0DtC0EtCtGyCtDzzzytG0BtAyBtCtGtB0CzyzztG0B0EyDyCyE0B0DzzzytA0BtB2QtN1M1F1B2Z1V1N2Y1L1Qzu2S0AtC0C0FtCtC0ByEtGtCzy0CyDtGyEtBtCyDtG0A0AtA0EtGzy0EyB0EyCtBtAtB0EzzyDtA2QtN0A0LzuyE%26cr%3D1741862318%26a%3Dhdr_s_17_21_wbf_sgnsft_17_14_ssg01%26os_ver%3D6.1%26os%3DWindows%2B7%2BUltimate&p={searchTerms}
SearchScopes: HKU\S-1-5-21-1023668481-733846680-2293585431-1001 -> {09E41F92-F0DE-4B05-A249-EB3049C96CB3} URL = hxxps://search.yahoo.com/search?fr=chr-greentree_ie&ei=utf-8&ilc=12&type=435371&p={searchTerms}
SearchScopes: HKU\S-1-5-21-1023668481-733846680-2293585431-1001 -> {2211d4a5-48d0-47f5-a7cd-81e861470f7f} URL = hxxps://us.search.yahoo.com/yhs/search?hspart=elm&hsimp=yhs-001&type=hdr_s_17_21_wbf_sgnsft_17_14_ssg01¶m1=1¶m2=f%3D4%26b%3DIE%26cc%3Dus%26pa%3Dhodor%26cd%3D2XzuyEtN2Y1L1QzutDtDtDtCyC0CyCtD0B0CtC0DtB0C0DtAtN0D0Tzu0StCzyyByEtN1L2XzutAtFtAtBtFtCtFyDtDtN1L1Czu1M1Q1CtAtBtFtAtFtDtN1L1G1B1V1N2Y1L1Qzu2StAtC0FyE0DtC0EtCtGyCtDzzzytG0BtAyBtCtGtB0CzyzztG0B0EyDyCyE0B0DzzzytA0BtB2QtN1M1F1B2Z1V1N2Y1L1Qzu2S0AtC0C0FtCtC0ByEtGtCzy0CyDtGyEtBtCyDtG0A0AtA0EtGzy0EyB0EyCtBtAtB0EzzyDtA2QtN0A0LzuyE%26cr%3D1741862318%26a%3Dhdr_s_17_21_wbf_sgnsft_17_14_ssg01%26os_ver%3D6.1%26os%3DWindows%2B7%2BUltimate&p={searchTerms}
CHR DefaultSearchURL: Default -> hxxp://srch.bar/{searchTerms}
CHR DefaultSuggestURL: Default -> hxxp://srch.bar/?s={searchTerms}
U3 a7u3xsl5; C:\Windows\System32\Drivers\a7u3xsl5.sys [0 ] (Advanced Micro Devices) <==== ATTENTION (zero byte File/Folder)
S3 Synth3dVsc; System32\drivers\synth3dvsc.sys [X]
S3 tsusbhub; system32\drivers\tsusbhub.sys [X]
S3 VGPU; System32\drivers\rdvgkmd.sys [X]
S3 __FOX__FOXONE_DRIVER__; \??\C:\Users\Aaron\AppData\Local\Temp\FoxDriver.sys [X] <==== ATTENTION
Task: {DB479BC6-D6BA-4942-9F79-564CB7B0F8BE} - \Yahoo! Powered rinal -> No File <==== ATTENTION
Task: C:\Windows\Tasks\Yahoo! Powered rinal.job => Wscript.exe C:\ProgramData\{1B3BDE58-9179-549E-17BF-CADC8DFD4112}\sili.txt <==== ATTENTION
Emptytemp:
Hosts:

*****************

Processes closed successfully.
Restore point was successfully created.
"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender" => removed successfully
"HKU\S-1-5-21-1023668481-733846680-2293585431-1001\Software\Microsoft\Windows\CurrentVersion\Run\\AdobeBridge" => removed successfully
"HKU\S-1-5-21-1023668481-733846680-2293585431-1001\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\\Shell" => removed successfully
"HKU\S-1-5-21-1023668481-733846680-2293585431-1001\Software\Microsoft\Command Processor\\AutoRun" => removed successfully
C:\Windows\system32\GroupPolicy\Machine => moved successfully
C:\Windows\system32\GroupPolicy\GPT.ini => moved successfully
C:\Windows\SysWOW64\GroupPolicy\GPT.ini => moved successfully
"HKLM\SOFTWARE\Policies\Google" => removed successfully
HKLM\Software\\Microsoft\Internet Explorer\Main\\Start Page => value restored successfully
HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main\\Start Page => value restored successfully
HKU\S-1-5-21-1023668481-733846680-2293585431-1001\Software\Microsoft\Internet Explorer\Main\\Start Page => value restored successfully
"HKU\S-1-5-21-1023668481-733846680-2293585431-1001\Software\Microsoft\Internet Explorer\Main\\Secondary Start Pages" => removed successfully
HKLM\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\\DefaultScope => value restored successfully
"HKLM\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}" => removed successfully
HKLM\Software\Classes\CLSID\{0633EE93-D776-472f-A0FF-E1416B8B2E3A} => not found
"HKLM\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{2211d4a5-48d0-47f5-a7cd-81e861470f7f}" => removed successfully
HKLM\Software\Classes\CLSID\{2211d4a5-48d0-47f5-a7cd-81e861470f7f} => not found
"HKLM\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{f7bb050c-e116-44da-89c2-6f2b68c54836}" => removed successfully
HKLM\Software\Classes\CLSID\{f7bb050c-e116-44da-89c2-6f2b68c54836} => not found
HKLM\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\SearchScopes\\DefaultScope => value restored successfully
"HKLM\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}" => removed successfully
HKLM\Software\Wow6432Node\Classes\CLSID\{0633EE93-D776-472f-A0FF-E1416B8B2E3A} => not found
"HKLM\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\SearchScopes\{2211d4a5-48d0-47f5-a7cd-81e861470f7f}" => removed successfully
HKLM\Software\Wow6432Node\Classes\CLSID\{2211d4a5-48d0-47f5-a7cd-81e861470f7f} => not found
"HKLM\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\SearchScopes\{f7bb050c-e116-44da-89c2-6f2b68c54836}" => removed successfully
HKLM\Software\Wow6432Node\Classes\CLSID\{f7bb050c-e116-44da-89c2-6f2b68c54836} => not found
"HKU\S-1-5-21-1023668481-733846680-2293585431-1001\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\\DefaultScope" => removed successfully
"HKU\S-1-5-21-1023668481-733846680-2293585431-1001\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}" => removed successfully
HKLM\Software\Classes\CLSID\{0633EE93-D776-472f-A0FF-E1416B8B2E3A} => not found
"HKU\S-1-5-21-1023668481-733846680-2293585431-1001\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{09E41F92-F0DE-4B05-A249-EB3049C96CB3}" => removed successfully
HKLM\Software\Classes\CLSID\{09E41F92-F0DE-4B05-A249-EB3049C96CB3} => not found
"HKU\S-1-5-21-1023668481-733846680-2293585431-1001\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{2211d4a5-48d0-47f5-a7cd-81e861470f7f}" => removed successfully
HKLM\Software\Classes\CLSID\{2211d4a5-48d0-47f5-a7cd-81e861470f7f} => not found
"Chrome DefaultSearchURL" => removed successfully
"Chrome DefaultSuggestURL" => removed successfully
"HKLM\System\CurrentControlSet\Services\a7u3xsl5" => removed successfully
a7u3xsl5 => service removed successfully
"HKLM\System\CurrentControlSet\Services\Synth3dVsc" => removed successfully
Synth3dVsc => service removed successfully
"HKLM\System\CurrentControlSet\Services\tsusbhub" => removed successfully
tsusbhub => service removed successfully
"HKLM\System\CurrentControlSet\Services\VGPU" => removed successfully
VGPU => service removed successfully
"HKLM\System\CurrentControlSet\Services\__FOX__FOXONE_DRIVER__" => removed successfully
__FOX__FOXONE_DRIVER__ => service removed successfully
"HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Plain\{DB479BC6-D6BA-4942-9F79-564CB7B0F8BE}" => removed successfully
"HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\{DB479BC6-D6BA-4942-9F79-564CB7B0F8BE}" => removed successfully
"HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tree\Yahoo! Powered rinal" => removed successfully
C:\Windows\Tasks\Yahoo! Powered rinal.job => moved successfully
Could not move "C:\Windows\System32\Drivers\etc\hosts" => Scheduled to move on reboot.

=========== EmptyTemp: ==========

BITS transfer queue => 0 B
DOMStore, IE Recovery, AppCache, Feeds Cache, Thumbcache, IconCache => 42902624 B
Java, Flash, Steam htmlcache => 2606 B
Windows/system/drivers => 683111544 B
Edge => 0 B
Chrome => 402776872 B
Firefox => 78741686 B
Opera => 0 B

Temp, IE cache, history, cookies, recent:
Users => 0 B
Default => 66228 B
Public => 0 B
ProgramData => 0 B
systemprofile => 58558406 B
systemprofile32 => 66356 B
LocalService => 66228 B
NetworkService => 374662 B
Aaron => 1013400664 B

RecycleBin => 1321 B
EmptyTemp: => 2.1 GB temporary data Removed.

================================

Result of scheduled files to move (Boot Mode: Normal) (Date&Time: 18-04-2018 21:24:42)

C:\Windows\System32\Drivers\etc\hosts => Is moved successfully
Hosts restored successfully.

==== End of Fixlog 21:24:42 ====

 

 

 

 

 

 

 

RogueKiller V12.12.13.0 (x64) [Apr 16 2018] (Free) by Adlice Software
mail : http://www.adlice.com/contact/
Feedback : https://forum.adlice.com
Website : http://www.adlice.com/download/roguekiller/
Blog : http://www.adlice.com

Operating System : Windows 7 (6.1.7601 Service Pack 1) 64 bits version
Started in : Normal mode
User : Aaron [Administrator]
Started from : C:\Program Files\RogueKiller\RogueKiller64.exe
Mode : Delete – Date : 04/18/2018 21:31:43 (Duration : 00:59:24)

¤¤¤ Processes : 0 ¤¤¤

¤¤¤ Registry : 29 ¤¤¤
[PUP.Gen1] (X64) HKEY_LOCAL_MACHINE\Software\WebDiscoverBrowser -> Deleted
[PUP.CompuClever] (X64) HKEY_USERS\S-1-5-21-1023668481-733846680-2293585431-1001\Software\CompuClever -> Deleted
[PUP.Gen1] (X64) HKEY_USERS\S-1-5-21-1023668481-733846680-2293585431-1001\Software\csastats -> Deleted
[PUP.Gen1] (X64) HKEY_USERS\S-1-5-21-1023668481-733846680-2293585431-1001\Software\ProductSetup -> Deleted
[PUP.Gen1] (X64) HKEY_USERS\S-1-5-21-1023668481-733846680-2293585431-1001\Software\WebDiscoverBrowser -> Deleted
[PUP.CompuClever] (X86) HKEY_USERS\S-1-5-21-1023668481-733846680-2293585431-1001\Software\CompuClever -> Deleted
[PUP.Gen1] (X86) HKEY_USERS\S-1-5-21-1023668481-733846680-2293585431-1001\Software\csastats -> Deleted
[PUP.Gen1] (X86) HKEY_USERS\S-1-5-21-1023668481-733846680-2293585431-1001\Software\ProductSetup -> Deleted
[PUP.Gen1] (X86) HKEY_USERS\S-1-5-21-1023668481-733846680-2293585431-1001\Software\WebDiscoverBrowser -> Deleted
[Suspicious.Path] (X64) HKEY_LOCAL_MACHINE\System\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\FirewallRules | {F55EF162-A0CC-4BB4-AE1E-E5081AE42B74} : v2.10|Action=Allow|Active=TRUE|Dir=In|Protocol=6|Profile=Private|App=C:\Users\Aaron\AppData\Local\Temp\RarSFX1\windows8.exe|Name=windows8.exe| [x] -> Deleted
[Suspicious.Path] (X64) HKEY_LOCAL_MACHINE\System\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\FirewallRules | {86114306-BBC7-49FF-AD87-E192B369DCE6} : v2.10|Action=Allow|Active=TRUE|Dir=In|Protocol=17|Profile=Private|App=C:\Users\Aaron\AppData\Local\Temp\RarSFX1\windows8.exe|Name=windows8.exe| [x] -> Deleted
[Suspicious.Path] (X64) HKEY_LOCAL_MACHINE\System\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\FirewallRules | {14213899-18AB-4095-BBFC-EA112DD2CE6D} : v2.10|Action=Allow|Active=TRUE|Dir=In|Protocol=6|Profile=Private|App=C:\Users\Aaron\AppData\Local\Temp\tmpB710.tmp.exe|Name=AnyDesk| [x] -> Deleted
[Suspicious.Path] (X64) HKEY_LOCAL_MACHINE\System\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\FirewallRules | {0972EA73-D14C-4153-8250-C52A34A4C639} : v2.10|Action=Allow|Active=TRUE|Dir=In|Protocol=17|Profile=Private|App=C:\Users\Aaron\AppData\Local\Temp\tmpB710.tmp.exe|Name=AnyDesk| [x] -> Deleted
[Suspicious.Path] (X64) HKEY_LOCAL_MACHINE\System\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\FirewallRules | {02B0440B-161A-45A3-B47D-3860EEE2BF0B} : v2.10|Action=Allow|Active=TRUE|Dir=In|Protocol=6|Profile=Domain|App=C:\Users\Aaron\AppData\Local\Temp\tmpB710.tmp.exe|Name=AnyDesk| [x] -> Deleted
[Suspicious.Path] (X64) HKEY_LOCAL_MACHINE\System\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\FirewallRules | {2293284D-25BD-472D-BFDE-7AD81EE36C52} : v2.10|Action=Allow|Active=TRUE|Dir=In|Protocol=17|Profile=Domain|App=C:\Users\Aaron\AppData\Local\Temp\tmpB710.tmp.exe|Name=AnyDesk| [x] -> Deleted
[Suspicious.Path] (X64) HKEY_LOCAL_MACHINE\System\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\FirewallRules | {1B89AADC-0EC5-4FD9-A32C-FE7D24B94566} : v2.10|Action=Allow|Active=TRUE|Dir=In|Protocol=6|Profile=Private|App=C:\Users\Aaron\AppData\Local\Temp\tmpE039.tmp.exe|Name=AnyDesk| [x] -> Deleted
[Suspicious.Path] (X64) HKEY_LOCAL_MACHINE\System\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\FirewallRules | {88AD43A0-118E-4023-A015-EFEEA745814F} : v2.10|Action=Allow|Active=TRUE|Dir=In|Protocol=17|Profile=Private|App=C:\Users\Aaron\AppData\Local\Temp\tmpE039.tmp.exe|Name=AnyDesk| [x] -> Deleted
[Suspicious.Path] (X64) HKEY_LOCAL_MACHINE\System\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\FirewallRules | {9B5A4248-0342-4FE0-8961-F2E1E90F202E} : v2.10|Action=Allow|Active=TRUE|Dir=In|Protocol=6|Profile=Domain|App=C:\Users\Aaron\AppData\Local\Temp\tmpE039.tmp.exe|Name=AnyDesk| [x] -> Deleted
[Suspicious.Path] (X64) HKEY_LOCAL_MACHINE\System\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\FirewallRules | {4B7CE545-02E7-4FBA-A061-2AE2B01625CA} : v2.10|Action=Allow|Active=TRUE|Dir=In|Protocol=17|Profile=Domain|App=C:\Users\Aaron\AppData\Local\Temp\tmpE039.tmp.exe|Name=AnyDesk| [x] -> Deleted
[Suspicious.Path] (X64) HKEY_LOCAL_MACHINE\System\ControlSet002\Services\SharedAccess\Parameters\FirewallPolicy\FirewallRules | {F55EF162-A0CC-4BB4-AE1E-E5081AE42B74} : v2.10|Action=Allow|Active=TRUE|Dir=In|Protocol=6|Profile=Private|App=C:\Users\Aaron\AppData\Local\Temp\RarSFX1\windows8.exe|Name=windows8.exe| [x] -> Deleted
[Suspicious.Path] (X64) HKEY_LOCAL_MACHINE\System\ControlSet002\Services\SharedAccess\Parameters\FirewallPolicy\FirewallRules | {86114306-BBC7-49FF-AD87-E192B369DCE6} : v2.10|Action=Allow|Active=TRUE|Dir=In|Protocol=17|Profile=Private|App=C:\Users\Aaron\AppData\Local\Temp\RarSFX1\windows8.exe|Name=windows8.exe| [x] -> Deleted
[Suspicious.Path] (X64) HKEY_LOCAL_MACHINE\System\ControlSet002\Services\SharedAccess\Parameters\FirewallPolicy\FirewallRules | {14213899-18AB-4095-BBFC-EA112DD2CE6D} : v2.10|Action=Allow|Active=TRUE|Dir=In|Protocol=6|Profile=Private|App=C:\Users\Aaron\AppData\Local\Temp\tmpB710.tmp.exe|Name=AnyDesk| [x] -> Deleted
[Suspicious.Path] (X64) HKEY_LOCAL_MACHINE\System\ControlSet002\Services\SharedAccess\Parameters\FirewallPolicy\FirewallRules | {0972EA73-D14C-4153-8250-C52A34A4C639} : v2.10|Action=Allow|Active=TRUE|Dir=In|Protocol=17|Profile=Private|App=C:\Users\Aaron\AppData\Local\Temp\tmpB710.tmp.exe|Name=AnyDesk| [x] -> Deleted
[Suspicious.Path] (X64) HKEY_LOCAL_MACHINE\System\ControlSet002\Services\SharedAccess\Parameters\FirewallPolicy\FirewallRules | {02B0440B-161A-45A3-B47D-3860EEE2BF0B} : v2.10|Action=Allow|Active=TRUE|Dir=In|Protocol=6|Profile=Domain|App=C:\Users\Aaron\AppData\Local\Temp\tmpB710.tmp.exe|Name=AnyDesk| [x] -> Deleted
[Suspicious.Path] (X64) HKEY_LOCAL_MACHINE\System\ControlSet002\Services\SharedAccess\Parameters\FirewallPolicy\FirewallRules | {2293284D-25BD-472D-BFDE-7AD81EE36C52} : v2.10|Action=Allow|Active=TRUE|Dir=In|Protocol=17|Profile=Domain|App=C:\Users\Aaron\AppData\Local\Temp\tmpB710.tmp.exe|Name=AnyDesk| [x] -> Deleted
[Suspicious.Path] (X64) HKEY_LOCAL_MACHINE\System\ControlSet002\Services\SharedAccess\Parameters\FirewallPolicy\FirewallRules | {1B89AADC-0EC5-4FD9-A32C-FE7D24B94566} : v2.10|Action=Allow|Active=TRUE|Dir=In|Protocol=6|Profile=Private|App=C:\Users\Aaron\AppData\Local\Temp\tmpE039.tmp.exe|Name=AnyDesk| [x] -> Deleted
[Suspicious.Path] (X64) HKEY_LOCAL_MACHINE\System\ControlSet002\Services\SharedAccess\Parameters\FirewallPolicy\FirewallRules | {88AD43A0-118E-4023-A015-EFEEA745814F} : v2.10|Action=Allow|Active=TRUE|Dir=In|Protocol=17|Profile=Private|App=C:\Users\Aaron\AppData\Local\Temp\tmpE039.tmp.exe|Name=AnyDesk| [x] -> Deleted
[Suspicious.Path] (X64) HKEY_LOCAL_MACHINE\System\ControlSet002\Services\SharedAccess\Parameters\FirewallPolicy\FirewallRules | {9B5A4248-0342-4FE0-8961-F2E1E90F202E} : v2.10|Action=Allow|Active=TRUE|Dir=In|Protocol=6|Profile=Domain|App=C:\Users\Aaron\AppData\Local\Temp\tmpE039.tmp.exe|Name=AnyDesk| [x] -> Deleted
[Suspicious.Path] (X64) HKEY_LOCAL_MACHINE\System\ControlSet002\Services\SharedAccess\Parameters\FirewallPolicy\FirewallRules | {4B7CE545-02E7-4FBA-A061-2AE2B01625CA} : v2.10|Action=Allow|Active=TRUE|Dir=In|Protocol=17|Profile=Domain|App=C:\Users\Aaron\AppData\Local\Temp\tmpE039.tmp.exe|Name=AnyDesk| [x] -> Deleted

¤¤¤ Tasks : 0 ¤¤¤

¤¤¤ Files : 10 ¤¤¤
[PUP.CompuClever][Folder] C:\Users\Aaron\AppData\Roaming\CompuClever -> Deleted
[PUP.CompuClever][File] C:\Users\Aaron\AppData\Roaming\CompuClever\Core\adstat.xml -> Deleted
[PUP.CompuClever][File] C:\Users\Aaron\AppData\Roaming\CompuClever\Core\adstat.xml.bak -> Deleted
[PUP.CompuClever][File] C:\Users\Aaron\AppData\Roaming\CompuClever\Core\core.ini -> Deleted
[PUP.CompuClever][File] C:\Users\Aaron\AppData\Roaming\CompuClever\Core\logs.xml -> Deleted
[PUP.CompuClever][Folder] C:\Users\Aaron\AppData\Roaming\CompuClever\Core -> Deleted
[PUP.CompuClever][File] C:\Users\Aaron\AppData\Roaming\CompuClever\PC Clean Maestro\cleanup_cfg.dll -> Deleted
[PUP.CompuClever][Folder] C:\Users\Aaron\AppData\Roaming\CompuClever\PC Clean Maestro -> Deleted
[PUP.CompuClever][File] C:\Users\Aaron\AppData\Roaming\CompuClever\PC TuneUp Maestro\ignorelist.xml -> Deleted
[PUP.CompuClever][File] C:\Users\Aaron\AppData\Roaming\CompuClever\PC TuneUp Maestro\tuneup_cfg.dll -> Deleted
[PUP.CompuClever][Folder] C:\Users\Aaron\AppData\Roaming\CompuClever\PC TuneUp Maestro -> Deleted
[PUP.CompuClever][Folder] C:\Users\Aaron\AppData\Roaming\CompuClever\Program Management Console -> Deleted
[PUP.uTorrentAds][File] C:\Users\Aaron\AppData\Roaming\uTorrent\updates\3.4.9_43388\utorrentie.exe -> Deleted
[PUP.uTorrentAds][File] C:\Users\Aaron\AppData\Roaming\uTorrent\updates\3.5.0_43580\utorrentie.exe -> Deleted
[PUP.uTorrentAds][File] C:\Users\Aaron\AppData\Roaming\uTorrent\updates\3.5.0_43804\utorrentie.exe -> Deleted
[PUP.uTorrentAds][File] C:\Users\Aaron\AppData\Roaming\uTorrent\updates\3.5.0_43916\utorrentie.exe -> Deleted
[PUP.uTorrentAds][File] C:\Users\Aaron\AppData\Roaming\uTorrent\updates\3.5.0_44090\utorrentie.exe -> Deleted
[PUP.uTorrentAds][File] C:\Users\Aaron\AppData\Roaming\uTorrent\updates\3.5.0_44294\utorrentie.exe -> Deleted
[PUP.uTorrentAds][File] C:\Users\Aaron\AppData\Roaming\uTorrent\updates\3.5.3_44396\utorrentie.exe -> Removed at reboot [5]
[PUP.Gen3][File] C:\Users\Aaron\AppData\Roaming\Mozilla\Firefox\Profiles\q3kfh2qz.default\searchplugins\bing-lavasoft.xml -> Deleted
[PUP.Gen0][File] C:\Users\Aaron\AppData\Roaming\Mozilla\Firefox\Profiles\q3kfh2qz.default\searchplugins\yahoo! powered.xml -> Deleted

¤¤¤ WMI : 0 ¤¤¤

¤¤¤ Hosts File : 0 ¤¤¤

¤¤¤ Antirootkit : 0 (Driver: Loaded) ¤¤¤

¤¤¤ Web browsers : 1 ¤¤¤
[PUM.NewTab][Firefox:Config] q3kfh2qz.default : user_pref("browser.newtab.url", "http://www.bing.com/?pc=COSP&ptag=D031717-A21066F3E7D&form=CONMHP&conlogo=CT3334510");-> Deleted

¤¤¤ MBR Check : ¤¤¤
+++++ PhysicalDrive0: WDC WD64 00AACS-00G8B SCSI Disk Device +++++
— User —
[MBR] 3ff1f8e1024faedeb8130d0b02d2b397
[BSP] a6b1aae3b9d96a2abf8901ffbb983083 : Windows Vista/7/8|VT.Unknown MBR Code
Partition table:
0 - [ACTIVE] NTFS (0x7) [VISIBLE] Offset (sectors): 206848 | Size: 97900 MB [Windows Vista/7/8 Bootstrap | Windows Vista/7/8 Bootloader]
1 - [XXXXXX] NTFS (0x7) [VISIBLE] Offset (sectors): 200706048 | Size: 512477 MB [Windows Vista/7/8 Bootstrap | Windows Vista/7/8 Bootloader]
User = LL1 … OK
Error reading LL2 MBR! ([1] Incorrect function. )
 

 

 

 

 

 

 

# ——————————-
# Malwarebytes AdwCleaner 7.1.0.0
# ——————————-
# Build:    04-12-2018
# Database: 2018-04-18.4
# Support:  https://www.malwarebytes.com/support
#
# ——————————-
# Mode: Clean
# ——————————-
# Start:    04-18-2018
# Duration: 00:00:04
# OS:       Windows 7 Ultimate
# Cleaned:  27
# Failed:   0


***** [ Services ] *****

No malicious services cleaned.

***** [ Folders ] *****

Deleted       C:\Windows\SysWOW64\config\systemprofile\AppData\Local\LavasoftTcpService

***** [ Files ] *****

Deleted       C:\Windows\System32\LavasoftTcpService64.dll
Deleted       C:\Windows\System32\LavasoftTcpServiceOff.ini
Deleted       C:\Windows\SysWOW64\LavasoftTcpServiceOff.ini
Deleted       C:\Windows\SysWOW64\lavasofttcpservice.dll

***** [ DLL ] *****

No malicious DLLs cleaned.

***** [ WMI ] *****

No malicious WMI cleaned.

***** [ Shortcuts ] *****

No malicious shortcuts cleaned.

***** [ Tasks ] *****

No malicious tasks cleaned.

***** [ Registry ] *****

Deleted       HKLM\SYSTEM\CurrentControlSet\Services\EventLog\Reason\ReasonByteFence
Deleted       HKLM\Software\pcv-var
Deleted       HKLM\Software\Wow6432Node\Lavasoft\Web Companion
Deleted       HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\Domains\webcompanion.com
Deleted       HKCU\Software\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_BROWSER_EMULATION|WeatherBug.exe
Deleted       HKLM\Software\Wow6432Node\Classes\TypeLib\{ED62BC6E-64F1-46BE-866F-4C8DC0DF7057}
Deleted       HKLM\Software\Classes\TypeLib\{ED62BC6E-64F1-46BE-866F-4C8DC0DF7057}
Deleted       HKLM\Software\Wow6432Node\Classes\CLSID\{FCAA532B-E807-4027-940C-BA16B9D50105}
Deleted       HKLM\Software\Wow6432Node\Classes\CLSID\{CB31FF8F-BF80-4D2B-ADBE-12C6F5347890}
Deleted       HKLM\Software\Wow6432Node\Classes\CLSID\{9A754403-27B1-4ED7-96D7-588F07888EBF}
Deleted       HKLM\Software\Wow6432Node\Classes\CLSID\{8F010D54-C023-457F-AF03-497EACB6D519}
Deleted       HKLM\Software\Wow6432Node\Classes\CLSID\{472EF1D2-4AAE-470D-AE85-6AF8177916FD}
Deleted       HKLM\Software\Wow6432Node\Classes\CLSID\{3A5A5381-DAAF-4C0D-B032-2C66B3EE4A8D}
Deleted       HKLM\Software\Wow6432Node\Classes\CLSID\{26C7AFDB-3690-449E-B979-B0AF5CC56DD4}
Deleted       HKLM\Software\Wow6432Node\Classes\CLSID\{0015CAC9-FC30-4CD0-BFAA-7412CC2C4DD9}
Deleted       HKCU\Software\Microsoft\Internet Explorer\AboutUrls|Tabs
Deleted       HKLM\Software\Wow6432Node\Classes\AppID\LavasoftTcpService.exe
Deleted       HKLM\SOFTWARE\Classes\AppID\LavasoftTcpService.exe
Deleted       HKLM\Software\Wow6432Node\Classes\AppID\{2CE0F1DC-C504-4B7B-A385-D94A2531DFFB}
Deleted       HKLM\Software\Classes\AppID\{2CE0F1DC-C504-4B7B-A385-D94A2531DFFB}

***** [ Chromium (and derivatives) ] *****

No malicious Chromium entries cleaned.

***** [ Chromium URLs ] *****

Deleted       Ask
Deleted       AOL

***** [ Firefox (and derivatives) ] *****

No malicious Firefox entries cleaned.

***** [ Firefox URLs ] *****

No malicious Firefox URLs cleaned.


*************************

[+] Delete Tracing Keys
[+] Reset Winsock

*************************


########## EOF - C:\AdwCleaner\Logs\AdwCleaner[C00].txt ##########

Post #6
Wow, that removed quite a bit.

Please download the Malwarebytes Anti-Malware setup file to your Desktop.

OR from this location Here
  • Open mbam-setup.x.x.xxxx.exe (x represents the version #) and follow the prompts to install the programme.
  • Windows Vista, Windows 7 , 8, 8.1 and 10 : Right click and select "Run as Administrator"

  • After the installation IS complete let it update if it asks.


  • Under SETTINGS…..APPLICATIONS leave everything at default


  • Under SETTINGS…..PROTECTION make sure AUTOMATIC QUARANTINE is on.


  • Then go to the Dashboard and click on SCAN NOW

  • Then on the Dashboard click on Scan
  • Make sure to select THREAT SCAN
  • Then click on Scan
  • Note: You may see the following message, "Could not load DDA driver". Click Yes, allow your PC to reboot and continue afterwards.
If threats are detected, click the Apply Actions button. You will now be prompted to reboot. Click Yes.
Upon completion of the scan (or after the reboot), click the Reports tab.
Double-click the Scan Log.
At the bottom click Export and choose Text file.

Save the file to your desktop and include its content in your next reply.

You can access the logs by going in the "Reports" tab, clicking on the latest "Scan" entry (the one with detections), then clicking on the "Export" button in the bottom-left corner and select "Copy to clipboard". After that, all you have to do is paste it here

*******************

[external image: G0tu5D9.png]Emsisoft Emergency Kit - Fix Mode
Follow the instructions below to run a scan using the Emsisoft Emergency Kit.
  • Download the Emsisoft Emergency Kit and execute it. From there, click on the Install button to extract the program in the EEK folder;
  • Once the extraction is complete, the EEK folder will open. Right-click on [external image: G0tu5D9.png]start emergency kit scanner.exe and select [external image: Spcusrh.png]Run as Administrator (for Windows Vista, 7, 8, 8.1 and 10 users);
  • EEK will suggest that you run an online update before using the program. Click on Yes to launch it.
  • After the update, click on Malware Scan under 2. Scan and accept to let EEK detect PUPs (click on Yes).
  • Once the scan is complete, make sure that every item in the list is checked, and click on the Quarantine selected button;
  • If it asks you for a reboot to delete some items, click on Ok to reboot automatically;
  • After the restart, open EEK again (in the C:\EEK folder);
  • This time, click on Logs;
  • From there, go under the Quarantine Log tab, and click on the Export button;
  • Save the log on your desktop, then open it, and copy/paste its content in your next reply;
  • created b y Aura

    Please post these logs when finished.

    How is your computer now?
Post #7 last edited

looks to be all clean after the second log. Thank you for your help, my computer is running alot better now!

 

 

Malwarebytes
www.malwarebytes.com

-Log Details-
Scan Date: 4/19/18
Scan Time: 10:08 PM
Log File: c1600cf0-443f-11e8-b21d-00016c60bc1d.json
Administrator: Yes

-Software Information-
Version: 3.4.5.2467
Components Version: 1.0.342
Update Package Version: 1.0.4804
License: Trial

-System Information-
OS: Windows 7 Service Pack 1
CPU: x64
File System: NTFS
User: Aaron-PC\Aaron

-Scan Summary-
Scan Type: Threat Scan
Scan Initiated By: Manual
Result: Completed
Objects Scanned: 238092
Threats Detected: 26
Threats Quarantined: 26
Time Elapsed: 4 min, 22 sec

-Scan Options-
Memory: Enabled
Startup: Enabled
Filesystem: Enabled
Archives: Enabled
Rootkits: Disabled
Heuristics: Enabled
PUP: Detect
PUM: Detect

-Scan Details-
Process: 0
(No malicious items detected)

Module: 0
(No malicious items detected)

Registry Key: 6
PUP.Optional.hTab, HKLM\SOFTWARE\GOOGLE\CHROME\EXTENSIONS\ELMKJJFKKCHOHAAOLJOBAFFJEEDCOOCJ, Quarantined, [2133], [460276],1.0.4804
PUP.Optional.hTab, HKLM\SOFTWARE\WOW6432NODE\GOOGLE\CHROME\EXTENSIONS\ELMKJJFKKCHOHAAOLJOBAFFJEEDCOOCJ, Quarantined, [2133], [460276],1.0.4804
PUP.Optional.hTab, HKU\S-1-5-21-1023668481-733846680-2293585431-1001\SOFTWARE\GOOGLE\CHROME\EXTENSIONS\elmkjjfkkchohaaoljobaffjeedcoocj, Quarantined, [2133], [460276],1.0.4804
PUP.Optional.SearchManager, HKLM\SOFTWARE\GOOGLE\CHROME\EXTENSIONS\NAHHMPBCKPGDIDFNMFKFGIFLPJIJILCE, Quarantined, [241], [440037],1.0.4804
PUP.Optional.SearchManager, HKLM\SOFTWARE\WOW6432NODE\GOOGLE\CHROME\EXTENSIONS\NAHHMPBCKPGDIDFNMFKFGIFLPJIJILCE, Quarantined, [241], [440037],1.0.4804
PUP.Optional.SearchManager, HKU\S-1-5-21-1023668481-733846680-2293585431-1001\SOFTWARE\GOOGLE\CHROME\EXTENSIONS\nahhmpbckpgdidfnmfkfgiflpjijilce, Quarantined, [241], [440037],1.0.4804

Registry Value: 0
(No malicious items detected)

Registry Data: 0
(No malicious items detected)

Data Stream: 0
(No malicious items detected)

Folder: 3
PUP.Optional.hTab, C:\Users\Aaron\AppData\Local\Google\Chrome\User Data\Default\Extensions\elmkjjfkkchohaaoljobaffjeedcoocj\1.1.0_0\_metadata, Quarantined, [2133], [460276],1.0.4804
PUP.Optional.hTab, C:\Users\Aaron\AppData\Local\Google\Chrome\User Data\Default\Extensions\elmkjjfkkchohaaoljobaffjeedcoocj\1.1.0_0, Quarantined, [2133], [460276],1.0.4804
PUP.Optional.hTab, C:\USERS\AARON\APPDATA\LOCAL\GOOGLE\CHROME\USER DATA\Default\Extensions\ELMKJJFKKCHOHAAOLJOBAFFJEEDCOOCJ, Quarantined, [2133], [460276],1.0.4804

File: 17
PUP.Optional.hTab, C:\Users\Aaron\AppData\Local\Google\Chrome\User Data\Default\Extensions\elmkjjfkkchohaaoljobaffjeedcoocj\1.1.0_0\_metadata\verified_contents.json, Quarantined, [2133], [460276],1.0.4804
PUP.Optional.hTab, C:\Users\Aaron\AppData\Local\Google\Chrome\User Data\Default\Extensions\elmkjjfkkchohaaoljobaffjeedcoocj\1.1.0_0\ctn.js, Quarantined, [2133], [460276],1.0.4804
PUP.Optional.hTab, C:\Users\Aaron\AppData\Local\Google\Chrome\User Data\Default\Extensions\elmkjjfkkchohaaoljobaffjeedcoocj\1.1.0_0\jquery-3.1.1.min.js, Quarantined, [2133], [460276],1.0.4804
PUP.Optional.hTab, C:\Users\Aaron\AppData\Local\Google\Chrome\User Data\Default\Extensions\elmkjjfkkchohaaoljobaffjeedcoocj\1.1.0_0\manifest.json, Quarantined, [2133], [460276],1.0.4804
PUP.Optional.hTab, C:\Users\Aaron\AppData\Local\Google\Chrome\User Data\Default\Extensions\elmkjjfkkchohaaoljobaffjeedcoocj\1.1.0_0\ntab.html, Quarantined, [2133], [460276],1.0.4804
PUP.Optional.hTab, C:\Users\Aaron\AppData\Local\Google\Chrome\User Data\Default\Extensions\elmkjjfkkchohaaoljobaffjeedcoocj\1.1.0_0\ntab.js, Quarantined, [2133], [460276],1.0.4804
PUP.Optional.hTab, C:\Users\Aaron\AppData\Local\Google\Chrome\User Data\Default\Extensions\elmkjjfkkchohaaoljobaffjeedcoocj\1.1.0_0\pp.pdf, Quarantined, [2133], [460276],1.0.4804
PUP.Optional.hTab, C:\Users\Aaron\AppData\Local\Google\Chrome\User Data\Default\Extensions\elmkjjfkkchohaaoljobaffjeedcoocj\1.1.0_0\search.png, Quarantined, [2133], [460276],1.0.4804
PUP.Optional.hTab, C:\Users\Aaron\AppData\Local\Google\Chrome\User Data\Default\Extensions\elmkjjfkkchohaaoljobaffjeedcoocj\1.1.0_0\searchicon.png, Quarantined, [2133], [460276],1.0.4804
PUP.Optional.hTab, C:\Users\Aaron\AppData\Local\Google\Chrome\User Data\Default\Extensions\elmkjjfkkchohaaoljobaffjeedcoocj\1.1.0_0\stats.js, Quarantined, [2133], [460276],1.0.4804
PUP.Optional.hTab, C:\Users\Aaron\AppData\Local\Google\Chrome\User Data\Default\Extensions\elmkjjfkkchohaaoljobaffjeedcoocj\1.1.0_0\style.css, Quarantined, [2133], [460276],1.0.4804
PUP.Optional.hTab, C:\Users\Aaron\AppData\Local\Google\Chrome\User Data\Default\Extensions\elmkjjfkkchohaaoljobaffjeedcoocj\1.1.0_0\tnc.pdf, Quarantined, [2133], [460276],1.0.4804
PUP.Optional.hTab, C:\USERS\AARON\APPDATA\LOCAL\GOOGLE\CHROME\USER DATA\Default\Preferences, Replaced, [2133], [460276],1.0.4804
PUP.Optional.WinYahoo, C:\USERS\AARON\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\Q3KFH2QZ.DEFAULT\PREFS.JS, Replaced, [244], [388388],1.0.4804
PUP.Optional.DownloadAssistant, C:\USERS\AARON\DOWNLOADS\CHROME SETUP.EXE, Quarantined, [10163], [104822],1.0.4804
PUP.Optional.OpenCandy, C:\USERS\AARON\DOWNLOADS\DTLITE-5.0.1.407.EXE, Quarantined, [1028], [297667],1.0.4804
PUP.Optional.BundleInstaller, C:\USERS\AARON\DOWNLOADS\PICASA.EXE, Quarantined, [392], [387439],1.0.4804

Physical Sector: 0
(No malicious items detected)


(end)

 

 

 

 

 

 

Emsisoft Emergency Kit 2018.3.1.8572 stable [en-us]
OS: Windows 7 Service Pack 1 (Version 6.1, Build 7601, 64-bit Edition)

Forensics log

Date    Component    Action    Details    
4/19/2018 10:39:58 PM    Scanner    Scan finished    Scanned 11117 objects and found nothing.    
4/19/2018 10:35:59 PM    User AARON-PC\Aaron    Scan started    Malware Scan    
4/19/2018 10:35:59 PM    User AARON-PC\Aaron    Setting modified    "Detect PUPs" has been changed to "Enabled".    
4/19/2018 10:35:16 PM    User    Update    Downloaded and installed 28 files (1466 kb) (36 sec.) Application restart notification.    
4/19/2018 10:34:33 PM    User    Update    Failed with error "Server returned error" (0 sec.).    
 

Post #8
Good deal

You had a lot going on with Google Chrome extensions, I think it would be a good idea to save/backup boobkmarks and reset Chrome,
 Instructions on how to backup your Favourites/Bookmarks and other data can be found below.
[external image: U5NwUGc.png]Backup Chrome Bookmarks

Proceed with the reset once done.
 [external image: U5NwUGc.png]Chrome: Chrome - Reset browser settings

Then if all is still good,  we'll remove tools and quarantine folders.
Post #10
  • Please download DelFix or from Here and save the file to your Desktop.
  • Double-click DelFix.exe to run the programme.
  • Place a checkmark next to the following items:
  • Activate UAC
  • Remove disinfection tools
  • Click the Run button.
  • – This will remove the specialized tools we used to disinfect your system.
    Any leftover logs, files, folders or tools remaining on your Desktop which were not removed can be deleted manually (right-click the file + delete    ).
**********

Ask AI

AI can make mistakes. Check the cited posts. Archived advice can be out-of-date

Don't include personal information. Questions and selected public posts go to OpenAI. About Ask AI