This is a read-only archive. No new posts or registrations. Privacy Page
Spyware / Malware / Virus Removal

Help Can't run any of these virus tools

11 min read

This thread's last reply is from . Advice, software, and links below may be out of date — treat specific steps and download links with caution.

Looking for the outcome? Ask AI

hello,

The issue started when I tried to unsubscribe to an email.  Edge started acting up, and now it won't stay open.  I tried running some of these suggested tools and each time it crashes.  what should I do?  

I was able to run this one.

 

Scan result of Farbar Recovery Scan Tool (FRST) (x64) Version: 17.03.2019
Ran by [removed] (administrator) on DESKTOP-49PEJRG (26-03-2019 00:01:18)
Running from C:\Users\[removed]\Downloads
[removed]
Platform: Windows 10 Home Version 1809 17763.379 (X64) Language: English (United States)
Default browser: Chrome
Boot Mode: Normal
Tutorial for Farbar Recovery Scan Tool: http://www.geekstogo.com/forum/topic/335081-frst-tutorial-how-to-use-farbar-recovery-scan-tool/
 
==================== Processes (Whitelisted) =================
 
(If an entry is included in the fixlist, the process will be closed. The file will not be moved.)
 
(NVIDIA Corporation -> NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\Display.NvContainer\NVDisplay.Container.exe
(NVIDIA Corporation -> NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\Display.NvContainer\NVDisplay.Container.exe
(Adobe Systems, Incorporated -> Adobe Systems Incorporated) C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe
(Adobe Systems Incorporated -> Adobe Inc.) C:\Program Files (x86)\Common Files\Adobe\Adobe Desktop Common\ElevationManager\AdobeUpdateService.exe
(Lenovo -> Lenovo Group Ltd.) C:\Program Files\Lenovo\ImController\Service\Lenovo.Modern.ImController.exe
(LENOVO -> Lenovo) C:\Program Files (x86)\Lenovo\Lenovo Nerve Center\FastBoot\FbService.exe
() [File not signed] C:\Windows\jmesoft\Service.exe
(Adobe Systems Incorporated -> Adobe Systems, Incorporated) C:\Program Files (x86)\Common Files\Adobe\AdobeGCClient\AGSService.exe
(Qualcomm Atheros -> Windows (R) Win 7 DDK provider) C:\Windows\System32\AdminService.exe
(Dropbox, Inc -> Dropbox, Inc.) C:\Windows\System32\DbxSvc.exe
(HP) [File not signed] C:\Program Files (x86)\HP\HPLaserJetService\HPLaserJetService.exe
(Adobe Systems Incorporated -> Adobe Systems, Incorporated) C:\Program Files (x86)\Common Files\Adobe\AdobeGCClient\AGMService.exe
(Protected Antivirus Limited -> TotalAV) C:\Program Files (x86)\TotalAV\SecurityService.exe
(Microsoft Corporation -> Microsoft Corporation) C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeClickToRun.exe
(Microsoft Windows -> Microsoft Corporation) C:\Windows\System32\dllhost.exe
(Dropbox, Inc -> Dropbox, Inc.) C:\Program Files (x86)\Dropbox\Update\DropboxUpdate.exe
(Microsoft Windows -> Microsoft Corporation) C:\Windows\System32\dllhost.exe
(Google Inc -> Google Inc.) C:\Program Files (x86)\Google\Update\1.3.33.23\GoogleCrashHandler.exe
(Google Inc -> Google Inc.) C:\Program Files (x86)\Google\Update\1.3.33.23\GoogleCrashHandler64.exe
() [File not signed] C:\Program Files\WindowsApps\Microsoft.SkypeApp_14.41.54.0_x64__kzf8qxf38zg5c\SkypeBackgroundHost.exe
(Microsoft Corporation) [File not signed] C:\Program Files\WindowsApps\Microsoft.SkypeApp_14.41.54.0_x64__kzf8qxf38zg5c\SkypeApp.exe
() [File not signed] C:\Program Files\WindowsApps\Microsoft.YourPhone_1.0.20594.0_x64__8wekyb3d8bbwe\YourPhone.exe
(Microsoft Windows -> Microsoft Corporation) C:\Windows\System32\Speech_OneCore\common\SpeechRuntime.exe
(Adobe Systems, Incorporated -> ) C:\Program Files\WindowsApps\AcrobatNotificationClient_1.0.4.0_x86__e1rzdqpraam7r\AcrobatNotificationClient.exe
() [File not signed] C:\Program Files\WindowsApps\Microsoft.ZuneVideo_10.19021.10411.0_x64__8wekyb3d8bbwe\Video.UI.exe
(Microsoft Corporation) [File not signed] C:\Program Files\WindowsApps\Microsoft.SkypeApp_14.41.54.0_x64__kzf8qxf38zg5c\SkypeBridge\SkypeBridge.exe
(Microsoft Windows -> Microsoft Corporation) C:\Windows\System32\smartscreen.exe
(Realtek Semiconductor Corp. -> Realtek Semiconductor) C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe
(Protected Antivirus Limited -> TotalAV) C:\Program Files (x86)\TotalAV\TotalAV.exe
(Realtek Semiconductor Corp. -> Realtek Semiconductor) C:\Program Files\Realtek\Audio\HDA\RAVBg64.exe
(Realtek Semiconductor Corp. -> Realtek Semiconductor) C:\Program Files\Realtek\Audio\HDA\RAVBg64.exe
(Lenovo) [File not signed] C:\Windows\jmesoft\hotkey.exe
(Adobe Systems Incorporated -> Adobe Inc.) C:\Program Files (x86)\Adobe\Adobe Creative Cloud\ACC\Creative Cloud.exe
() [File not signed] C:\Windows\jmesoft\JME_LOAD.exe
(Adobe Systems Incorporated -> Adobe Systems Incorporated) C:\Program Files (x86)\Common Files\Adobe\Adobe Desktop Common\IPCBox\AdobeIPCBroker.exe
(Adobe Systems, Incorporated -> Adobe Systems Inc.) C:\Program Files (x86)\Adobe\Acrobat DC\Acrobat\acrotray.exe
(Hewlett-Packard Company -> Hewlett-Packard) C:\Program Files (x86)\HP\HP Software Update\hpwuschd2.exe
(Adobe Systems Incorporated -> Adobe Inc.) C:\Program Files (x86)\Common Files\Adobe\Adobe Desktop Common\ADS\Adobe Desktop Service.exe
(Adobe Systems Incorporated -> Adobe Inc.) C:\Program Files (x86)\Common Files\Adobe\Adobe Desktop Common\HEX\Adobe CEF Helper.exe
(Adobe Systems Incorporated -> ) C:\Program Files (x86)\Adobe\Adobe Sync\CoreSync\CoreSync.exe
(Adobe Inc. -> Adobe Systems Incorporated) C:\Program Files (x86)\Adobe\Adobe Creative Cloud Experience\CCXProcess.exe
(Node.js Foundation -> Node.js) C:\Program Files (x86)\Adobe\Adobe Creative Cloud Experience\libs\node.exe
(Adobe Systems Incorporated -> Adobe Systems Incorporated) C:\Program Files (x86)\Common Files\Adobe\Creative Cloud Libraries\CCLibrary.exe
(Node.js Foundation -> Node.js) C:\Program Files (x86)\Common Files\Adobe\Creative Cloud Libraries\libs\node.exe
(Microsoft Corporation) [File not signed] C:\Program Files\WindowsApps\Microsoft.WindowsStore_11811.1001.18.0_x64__8wekyb3d8bbwe\WinStore.App.exe
(Adobe Systems Incorporated -> Adobe Inc.) C:\Program Files (x86)\Common Files\Adobe\Adobe Desktop Common\ElevationManager\Adobe Installer.exe
(Google LLC -> Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google LLC -> Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google LLC -> Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google LLC -> Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google LLC -> Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Microsoft Corporation -> Microsoft Corporation) C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdge.exe
(Microsoft Windows -> Microsoft Corporation) C:\Windows\System32\browser_broker.exe
(Microsoft Windows -> Microsoft Corporation) C:\Windows\System32\dllhost.exe
(Microsoft Windows -> Microsoft Corporation) C:\Windows\System32\MicrosoftEdgeSH.exe
(Microsoft Windows -> Microsoft Corporation) C:\Windows\System32\MicrosoftEdgeCP.exe
(Google LLC -> Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Dolby Laboratories, Inc. -> ) C:\Program Files\Dolby\Dolby DAX2\DAX2_API\DolbyDAX2API.exe
(HP Inc. -> HP Inc.) C:\Program Files (x86)\Hewlett-Packard\HP Support Solutions\HPSupportSolutionsFrameworkService.exe
(Intel(R) Rapid Storage Technology -> Intel Corporation) C:\Program Files\Intel\Intel(R) Rapid Storage Technology\IAStorDataMgrSvc.exe
(Lenovo -> Lenovo Group Ltd.) C:\Program Files (x86)\Lenovo\ImController\PluginHost\Lenovo.Modern.ImController.PluginHost.Device.exe
(Lenovo -> Lenovo Group Ltd.) C:\Program Files\Lenovo\ImController\PluginHost\Lenovo.Modern.ImController.PluginHost.Device.exe
(Lenovo -> Lenovo Group Ltd.) C:\Program Files\Lenovo\ImController\PluginHost\Lenovo.Modern.ImController.PluginHost.CompanionApp.exe
(Lenovo -> Lenovo Group Ltd.) C:\Program Files\Lenovo\ImController\PluginHost\Lenovo.Modern.ImController.PluginHost.CompanionApp.exe
(Lenovo -> Lenovo Group Ltd.) C:\Program Files (x86)\Lenovo\ImController\PluginHost\Lenovo.Modern.ImController.PluginHost.CompanionApp.exe
(Lenovo -> Lenovo Group Ltd.) C:\Program Files\Lenovo\ImController\PluginHost\Lenovo.Modern.ImController.PluginHost.Device.exe
(Google LLC -> Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google LLC -> Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google LLC -> Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google LLC -> Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google LLC -> Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google LLC -> Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google LLC -> Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google LLC -> Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google LLC -> Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google LLC -> Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google LLC -> Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google LLC -> Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google LLC -> Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google LLC -> Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google LLC -> Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google LLC -> Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google LLC -> Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google LLC -> Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google LLC -> Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google LLC -> Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google LLC -> Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
 
==================== Registry (Whitelisted) ===========================
 
(If an entry is included in the fixlist, the registry item will be restored to default or removed. The file will not be moved.)
 
HKLM\…\Run: [AdobeAAMUpdater-1.0] => C:\Program Files (x86)\Common Files\Adobe\OOBE\PDApp\UWA\UpdaterStartupUtility.exe [509936 2018-04-11] (Adobe Systems Incorporated -> Adobe Systems Incorporated)
HKLM\…\Run: [AdobeGCInvoker-1.0] => C:\Program Files (x86)\Common Files\Adobe\AdobeGCClient\AGCInvokerUtility.exe [2675176 2018-12-13] (Adobe Systems Incorporated -> Adobe Systems, Incorporated)
HKLM\…\Run: [RTHDVCPL] => C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe [16735744 2017-07-14] (Realtek Semiconductor Corp. -> Realtek Semiconductor)
HKLM\…\Run: [RtHDVBg_Dolby] => C:\Program Files\Realtek\Audio\HDA\RAVBg64.exe [1472000 2017-07-14] (Realtek Semiconductor Corp. -> Realtek Semiconductor)
HKLM\…\Run: [RtHDVBg_LENOVO_MICPKEY] => C:\Program Files\Realtek\Audio\HDA\RAVBg64.exe [1472000 2017-07-14] (Realtek Semiconductor Corp. -> Realtek Semiconductor)
HKLM-x32\…\Run: [jmekey] => C:\Windows\jmesoft\hotkey.exe [118784 2013-07-24] (Lenovo) [File not signed]
HKLM-x32\…\Run: [jmesoft] => C:\Windows\jmesoft\ServiceLoader.exe [28672 2011-08-17] () [File not signed]
HKLM-x32\…\Run: [Adobe Creative Cloud] => C:\Program Files (x86)\Adobe\Adobe Creative Cloud\ACC\Creative Cloud.exe [2410960 2019-03-01] (Adobe Systems Incorporated -> Adobe Inc.)
HKLM-x32\…\Run: [Acrobat Assistant 8.0] => C:\Program Files (x86)\Adobe\Acrobat DC\Acrobat\Acrotray.exe [4810224 2019-01-31] (Adobe Systems, Incorporated -> Adobe Systems Inc.)
HKLM-x32\…\Run: [HP Software Update] => C:\Program Files (x86)\Hp\HP Software Update\HPWuSchd2.exe [96056 2013-05-30] (Hewlett-Packard Company -> Hewlett-Packard)
HKLM-x32\…\Run: [StatusAlerts] => C:\Program Files (x86)\HP\StatusAlerts\bin\HPStatusAlerts.exe [331344 2015-07-22] (Hewlett-Packard -> HP Development Company, L.P.)
HKLM-x32\…\Run: [Dropbox] => C:\Program Files (x86)\Dropbox\Client\Dropbox.exe [4426560 2019-03-19] (Dropbox, Inc -> Dropbox, Inc.)
HKU\S-1-5-21-93585695-1239137162-3987457199-1001\…\Run: [Lync] => C:\Program Files (x86)\Microsoft Office\root\Office16\lync.exe [23831432 2019-03-16] (Microsoft Corporation -> Microsoft Corporation)
HKU\S-1-5-21-93585695-1239137162-3987457199-1001\…\MountPoints2: {75d69537-0763-11e8-83de-5800e3e0b272} - "F:\LaunchU3.exe" -a
HKLM\Software\Microsoft\Active Setup\Installed Components: [{8A69D345-D564-463c-AFF1-A69D9E530F96}] -> C:\Program Files (x86)\Google\Chrome\Application\73.0.3683.86\Installer\chrmstp.exe [2019-03-25] (Google LLC -> Google Inc.)
 
==================== Internet (Whitelisted) ====================
 
(If an item is included in the fixlist, if it is a registry item it will be removed or restored to default.)
 
Hosts: There are more than one entry in Hosts. See Hosts section of Addition.txt
Tcpip\Parameters: [DhcpNameServer] [removed] [removed]
Tcpip\..\Interfaces\{41bc1862-9b17-48cf-9726-a914d3b1a3d4}: [DhcpNameServer] [removed] [removed]
Tcpip\..\Interfaces\{7672fee7-d277-4ebe-ac25-dfc4014b61b1}: [DhcpNameServer] 192.168.1.1
 
Internet Explorer:
==================
HKU\S-1-5-21-93585695-1239137162-3987457199-1001\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = hxxp://www.microsoft.com/isapi/redir.dll?prd=ie&pver=6&ar=msnhome
SearchScopes: HKU\S-1-5-21-93585695-1239137162-3987457199-1001 -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = hxxps://www.bing.com/search?q={searchTerms}&src=IE-SearchBox&FORM=IESR02&pc=UE15
SearchScopes: HKU\S-1-5-21-93585695-1239137162-3987457199-1001 -> {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = hxxps://www.bing.com/search?q={searchTerms}&src=IE-SearchBox&FORM=IESR02&pc=UE15
SearchScopes: HKU\S-1-5-21-93585695-1239137162-3987457199-1001 -> {0CE02FFA-A6B0-46F6-BA2F-BD32C3630126} URL = 
BHO: Skype for Business Browser Helper -> {31D09BA0-12F5-4CCE-BE8A-2923E76605DA} -> C:\Program Files (x86)\Microsoft Office\root\VFS\ProgramFilesX64\Microsoft Office\Office16\OCHelper.dll [2019-03-16] (Microsoft Corporation -> Microsoft Corporation)
BHO: Adobe Acrobat Create PDF Helper -> {AE7CD045-E861-484f-8273-0445EE161910} -> C:\Program Files (x86)\Common Files\Adobe\Acrobat\WCIEActiveX\DC\x64\AcroIEFavStub.dll [2017-11-04] (Adobe Systems, Incorporated -> Adobe Systems Incorporated)
BHO: Adobe Acrobat Create PDF from Selection -> {F4971EE7-DAA0-4053-9964-665D8EE6A077} -> C:\Program Files (x86)\Common Files\Adobe\Acrobat\WCIEActiveX\DC\x64\AcroIEFavStub.dll [2017-11-04] (Adobe Systems, Incorporated -> Adobe Systems Incorporated)
BHO-x32: Skype for Business Browser Helper -> {31D09BA0-12F5-4CCE-BE8A-2923E76605DA} -> C:\Program Files (x86)\Microsoft Office\root\Office16\OCHelper.dll [2019-03-16] (Microsoft Corporation -> Microsoft Corporation)
BHO-x32: Adobe Acrobat Create PDF Helper -> {AE7CD045-E861-484f-8273-0445EE161910} -> C:\Program Files (x86)\Common Files\Adobe\Acrobat\WCIEActiveX\DC\AcroIEFavStub.dll [2017-11-04] (Adobe Systems, Incorporated -> Adobe Systems Incorporated)
BHO-x32: Adobe Acrobat Create PDF from Selection -> {F4971EE7-DAA0-4053-9964-665D8EE6A077} -> C:\Program Files (x86)\Common Files\Adobe\Acrobat\WCIEActiveX\DC\AcroIEFavStub.dll [2017-11-04] (Adobe Systems, Incorporated -> Adobe Systems Incorporated)
Toolbar: HKLM - Adobe Acrobat Create PDF Toolbar - {47833539-D0C5-4125-9FA8-0819E2EAAC93} - C:\Program Files (x86)\Common Files\Adobe\Acrobat\WCIEActiveX\DC\x64\AcroIEFavStub.dll [2017-11-04] (Adobe Systems, Incorporated -> Adobe Systems Incorporated)
Toolbar: HKLM-x32 - Adobe Acrobat Create PDF Toolbar - {47833539-D0C5-4125-9FA8-0819E2EAAC93} - C:\Program Files (x86)\Common Files\Adobe\Acrobat\WCIEActiveX\DC\AcroIEFavStub.dll [2017-11-04] (Adobe Systems, Incorporated -> Adobe Systems Incorporated)
Handler-x32: mso-minsb-roaming.16 - {83C25742-A9F7-49FB-9138-434302C88D07} - C:\Program Files (x86)\Microsoft Office\root\Office16\MSOSB.DLL [2019-03-16] (Microsoft Corporation -> Microsoft Corporation)
Handler-x32: mso-minsb.16 - {42089D2D-912D-4018-9087-2B87803E93FB} - C:\Program Files (x86)\Microsoft Office\root\Office16\MSOSB.DLL [2019-03-16] (Microsoft Corporation -> Microsoft Corporation)
Handler-x32: osf-roaming.16 - {42089D2D-912D-4018-9087-2B87803E93FB} - C:\Program Files (x86)\Microsoft Office\root\Office16\MSOSB.DLL [2019-03-16] (Microsoft Corporation -> Microsoft Corporation)
Handler-x32: osf.16 - {5504BE45-A83B-4808-900A-3A5C36E7F77A} - C:\Program Files (x86)\Microsoft Office\root\Office16\MSOSB.DLL [2019-03-16] (Microsoft Corporation -> Microsoft Corporation)
 
Edge: 
======
Edge HomeButtonPage: HKU\S-1-5-21-93585695-1239137162-3987457199-1001 -> hxxp://www.google.com/
 
FireFox:
========
FF DefaultProfile: 0zbzln6t.default
FF ProfilePath: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\0zbzln6t.default [2019-03-25]
FF Extension: (Telemetry coverage) - C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\0zbzln6t.default\features\{c7b2aa11-7929-4d06-9bb9-53bafc1ff0d2}\[removed] [2018-11-27] [Legacy]
FF HKLM\…\Firefox\Extensions: [[removed]] - C:\Program Files (x86)\Adobe\Acrobat DC\Acrobat\Browser\WCFirefoxExtn\WebExtn\signed_extn\adobe_acrobat-1.0-windows.xpi
FF Extension: (Adobe Acrobat) - C:\Program Files (x86)\Adobe\Acrobat DC\Acrobat\Browser\WCFirefoxExtn\WebExtn\signed_extn\adobe_acrobat-1.0-windows.xpi [2018-09-20]
FF HKLM-x32\…\Firefox\Extensions: [[removed]] - C:\Program Files (x86)\Adobe\Acrobat DC\Acrobat\Browser\WCFirefoxExtn\WebExtn\signed_extn\adobe_acrobat-1.0-windows.xpi
FF Plugin: adobe.com/AdobeAAMDetect -> C:\Program Files (x86)\Adobe\Adobe Creative Cloud\Utils\npAdobeAAMDetect64.dll [2019-03-01] (Adobe Systems Incorporated -> Adobe Systems)
FF Plugin-x32: @glance.net/GlanceClient -> C:\Program Files (x86)\GlanceGuest\npglance.dll [2018-06-23] (Glance Networks Inc -> Glance Networks, Inc.)
FF Plugin-x32: @microsoft.com/Lync,version=15.0 -> C:\Program Files (x86)\Microsoft Office\root\VFS\ProgramFilesX86\Mozilla Firefox\plugins\npmeetingjoinpluginoc.dll [2019-03-16] (Microsoft Corporation -> Microsoft Corporation)
FF Plugin-x32: @microsoft.com/SharePoint,version=14.0 -> C:\Program Files (x86)\Microsoft Office\root\Office16\NPSPWRAP.DLL [2019-03-16] (Microsoft Corporation -> Microsoft Corporation)
FF Plugin-x32: @nvidia.com/3DVision -> C:\Program Files (x86)\NVIDIA Corporation\3D Vision\npnv3dv.dll [2017-12-18] (NVIDIA Corporation PE Sign v2016 -> NVIDIA Corporation) [File not signed]
FF Plugin-x32: @nvidia.com/3DVisionStreaming -> C:\Program Files (x86)\NVIDIA Corporation\3D Vision\npnv3dvstreaming.dll [2017-12-18] (NVIDIA Corporation PE Sign v2016 -> NVIDIA Corporation) [File not signed]
FF Plugin-x32: @tools.google.com/Google Update;version=3 -> C:\Program Files (x86)\Google\Update\1.3.33.23\npGoogleUpdate3.dll [2018-12-19] (Google Inc -> Google Inc.)
FF Plugin-x32: @tools.google.com/Google Update;version=9 -> C:\Program Files (x86)\Google\Update\1.3.33.23\npGoogleUpdate3.dll [2018-12-19] (Google Inc -> Google Inc.)
FF Plugin-x32: Adobe Acrobat -> C:\Program Files (x86)\Adobe\Acrobat DC\Acrobat\Air\nppdf32.dll [2019-01-31] (Adobe Systems, Incorporated -> Adobe Systems Inc.)
FF Plugin-x32: adobe.com/AdobeAAMDetect -> C:\Program Files (x86)\Adobe\Adobe Creative Cloud\Utils\npAdobeAAMDetect32.dll [2019-03-01] (Adobe Systems Incorporated -> Adobe Systems)
 
Chrome: 
=======
CHR HomePage: Default -> hxxp://www.google.com/
CHR StartupUrls: Default -> "hxxp://www.google.com/"
CHR NewTab: Default ->  Not-active:"chrome-extension://chmeebignelmkoiapdiipncdekbfnlgo/newtab/quicktab.html"
CHR Profile: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default [2019-03-26]
CHR Extension: (Google Drive) - C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\apdfllckaahabafndbhieahigkjlhalf [2018-10-22]
CHR Extension: (Maps and Driving Direction) - C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\chmeebignelmkoiapdiipncdekbfnlgo [2019-03-19]
CHR Extension: (Adobe Acrobat) - C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\efaidnbmnnnibpcajpcglclefindmkaj [2018-05-27]
CHR Extension: (Google Docs Offline) - C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi [2018-08-21]
CHR Extension: (Inventive Theme | Tema Inventivo) - C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\jogkafbidohnjkkhgjbcmjipdlejjedi [2018-11-06]
CHR Extension: (Wave Accounting) - C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\knpkfcpnjfbniadmfchjpcigfhookhaa [2018-11-06]
CHR Extension: (Application Launcher for Drive (by Google)) - C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\lmjegmlicamnimmfhcmpkclmigmmcbeh [2018-05-27]
CHR Extension: (Chrome Web Store Payments) - C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda [2018-05-27]
CHR Extension: (Chrome Media Router) - C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\pkedcjkdefgpdelpbcmbmeomcjbeemfm [2019-03-25]
CHR HKU\S-1-5-21-93585695-1239137162-3987457199-1001\SOFTWARE\Google\Chrome\Extensions\…\Chrome\Extension: [apdfllckaahabafndbhieahigkjlhalf] - C:\Users\user\AppData\Local\Google\Drive\user_default\apdfllckaahabafndbhieahigkjlhalf_live.crx [2018-05-27]
CHR HKU\S-1-5-21-93585695-1239137162-3987457199-1001\SOFTWARE\Google\Chrome\Extensions\…\Chrome\Extension: [lmjegmlicamnimmfhcmpkclmigmmcbeh] - hxxps://clients2.google.com/service/update2/crx
CHR HKLM-x32\…\Chrome\Extension: [efaidnbmnnnibpcajpcglclefindmkaj] - hxxps://clients2.google.com/service/update2/crx
 
==================== Services (Whitelisted) ====================
 
(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)
 
R2 AdobeUpdateService; C:\Program Files (x86)\Common Files\Adobe\Adobe Desktop Common\ElevationManager\AdobeUpdateService.exe [818128 2019-03-01] (Adobe Systems Incorporated -> Adobe Inc.)
R2 AGMService; C:\Program Files (x86)\Common Files\Adobe\AdobeGCClient\AGMService.exe [2917864 2018-12-13] (Adobe Systems Incorporated -> Adobe Systems, Incorporated)
R2 AGSService; C:\Program Files (x86)\Common Files\Adobe\AdobeGCClient\AGSService.exe [2709480 2018-12-13] (Adobe Systems Incorporated -> Adobe Systems, Incorporated)
R2 ClickToRunSvc; C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe [11129928 2019-03-06] (Microsoft Corporation -> Microsoft Corporation)
R2 DAX2API; C:\Program Files\Dolby\Dolby DAX2\DAX2_API\DolbyDAX2API.exe [163336 2016-09-19] (Dolby Laboratories, Inc. -> )
S2 dbupdate; C:\Program Files (x86)\Dropbox\Update\DropboxUpdate.exe [143144 2018-04-12] (Dropbox, Inc -> Dropbox, Inc.)
S3 dbupdatem; C:\Program Files (x86)\Dropbox\Update\DropboxUpdate.exe [143144 2018-04-12] (Dropbox, Inc -> Dropbox, Inc.)
R2 DbxSvc; C:\WINDOWS\system32\DbxSvc.exe [51024 2019-03-19] (Dropbox, Inc -> Dropbox, Inc.)
R2 FastbootService; C:\Program Files (x86)\Lenovo\Lenovo Nerve Center\FastBoot\FbService.exe [297752 2017-02-25] (LENOVO -> Lenovo)
S3 GameZoneService; C:\Program Files (x86)\Lenovo\Lenovo Nerve Center\GameZoneService.exe [27184 2016-10-10] (LENOVO -> )
R2 HP LaserJet Service; C:\Program Files (x86)\HP\HPLaserJetService\HPLaserJetService.exe [176128 2014-06-24] (HP) [File not signed]
R2 HPSupportSolutionsFrameworkService; C:\Program Files (x86)\Hewlett-Packard\HP Support Solutions\HPSupportSolutionsFrameworkService.exe [347512 2018-12-06] (HP Inc. -> HP Inc.)
R2 IAStorDataMgrSvc; C:\Program Files\Intel\Intel(R) Rapid Storage Technology\IAStorDataMgrSvc.exe [17976 2016-09-20] (Intel(R) Rapid Storage Technology -> Intel Corporation)
R2 ImControllerService; C:\Program Files\Lenovo\ImController\Service\Lenovo.Modern.ImController.exe [71336 2019-01-07] (Lenovo -> Lenovo Group Ltd.)
R2 JME Keyboard; C:\Windows\jmesoft\Service.exe [32768 2011-08-17] () [File not signed]
R2 Net Driver HPZ12; C:\Windows\System32\HPZinw12.dll [50688 2013-05-16] (Hewlett-Packard) [File not signed]
R2 Pml Driver HPZ12; C:\Windows\System32\HPZipm12.dll [66048 2013-05-16] (Hewlett-Packard) [File not signed]
R2 SecurityService; C:\Program Files (x86)\TotalAV\SecurityService.exe [4411616 2018-08-30] (Protected Antivirus Limited -> TotalAV)
S3 WdNisSvc; C:\Program Files\Windows Defender\NisSrv.exe [3830128 2019-03-13] (Microsoft Corporation -> Microsoft Corporation)
S3 WinDefend; C:\Program Files\Windows Defender\MsMpEng.exe [110944 2018-09-15] (Microsoft Corporation -> Microsoft Corporation)
S3 XTU3SERVICE; C:\Program Files (x86)\Intel\Intel(R) Extreme Tuning Utility\XtuService.exe [18232 2016-08-25] (Intel(R) Extreme Tuning Utility -> Intel(R) Corporation)
R2 NVDisplay.ContainerLocalSystem; "C:\Program Files\NVIDIA Corporation\Display.NvContainer\NVDisplay.Container.exe" -s NVDisplay.ContainerLocalSystem -f "C:\ProgramData\NVIDIA\NVDisplay.ContainerLocalSystem.log" -l 3 -d "C:\Program Files\NVIDIA Corporation\Display.NvContainer\plugins\LocalSystem" -r -p 30000
 
===================== Drivers (Whitelisted) ======================
 
(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)
 
R2 avgntflt; C:\WINDOWS\System32\DRIVERS\avgntflt.sys [178840 2018-02-13] (Avira Operations GmbH & Co. KG -> Avira Operations GmbH & Co. KG)
R1 avipbb; C:\WINDOWS\system32\DRIVERS\avipbb.sys [169864 2018-02-13] (Avira Operations GmbH & Co. KG -> Avira Operations GmbH & Co. KG)
R1 avkmgr; C:\WINDOWS\system32\DRIVERS\avkmgr.sys [44488 2018-02-13] (Avira Operations GmbH & Co. KG -> Avira Operations GmbH & Co. KG)
R0 Fastboot; C:\WINDOWS\System32\DRIVERS\Fastboot.sys [70936 2017-02-25] (LENOVO -> Windows (R) Win 7 DDK provider)
R0 FBFsmon; C:\WINDOWS\System32\DRIVERS\FBFsmon.sys [42776 2017-02-25] (LENOVO -> Windows (R) Win 7 DDK provider)
R2 iocbios2; C:\Program Files (x86)\Intel\Intel(R) Extreme Tuning Utility\Drivers\IocDriver\64bit\iocbios2.sys [37064 2016-08-25] (Intel Corporation -> Intel Corporation)
R3 nvlddmkm; C:\WINDOWS\System32\DriverStore\FileRepository\nvle.inf_amd64_fcbf876c2536c2ec\nvlddmkm.sys [17036560 2018-02-13] (NVIDIA Corporation -> NVIDIA Corporation)
R3 Qcamain10x64; C:\WINDOWS\system32\DRIVERS\Qcamain10x64.sys [2413968 2017-06-07] (Qualcomm Atheros -> Qualcomm Atheros, Inc.)
R3 rt640x64; C:\WINDOWS\System32\drivers\rt640x64.sys [895256 2015-06-22] (Realtek Semiconductor Corp -> Realtek )
R3 RTSUER; C:\WINDOWS\system32\Drivers\RtsUer.sys [404184 2015-08-17] (Realtek Semiconductor Corp -> Realsil Semiconductor Corporation)
S3 WdBoot; C:\WINDOWS\system32\drivers\WdBoot.sys [46584 2018-09-15] (Microsoft Windows Early Launch Anti-malware Publisher -> Microsoft Corporation)
S3 WdFilter; C:\WINDOWS\system32\drivers\WdFilter.sys [340008 2018-09-15] (Microsoft Windows -> Microsoft Corporation)
S3 WdNisDrv; C:\WINDOWS\System32\Drivers\WdNisDrv.sys [61992 2018-09-15] (Microsoft Windows -> Microsoft Corporation)
R3 YLED; C:\WINDOWS\System32\drivers\YLED.sys [23960 2016-04-15] (LENOVO -> )
R1 ZAM_Guard; C:\WINDOWS\System32\drivers\zamguard64.sys [203680 2018-06-03] (Zemana Ltd. -> Zemana Ltd.)
 
==================== NetSvcs (Whitelisted) ===================
 
(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)
 
 
==================== One month (created) ========
 
(If an entry is included in the fixlist, the file/folder will be moved.)
 
2019-03-26 00:00 - 2019-03-26 00:00 - 002434048 _____ (Farbar) C:\Users\user\Downloads\FRST64.exe
2019-03-25 23:53 - 2019-03-25 23:53 - 000686108 ____N C:\WINDOWS\Minidump\032519-5000-01.dmp
2019-03-25 23:49 - 2019-03-25 23:49 - 000676062 ____N C:\WINDOWS\Minidump\032519-5578-01.dmp
2019-03-25 23:45 - 2019-03-25 23:53 - 000000000 ____D C:\WINDOWS\Minidump
2019-03-25 23:45 - 2019-03-25 23:45 - 001229192 ____N C:\WINDOWS\Minidump\032519-5625-01.dmp
2019-03-25 23:44 - 2019-03-25 23:48 - 000001028 _____ C:\Users\user\Desktop\aswMBR.txt
2019-03-25 23:43 - 2019-03-25 23:43 - 005198336 _____ (AVAST Software) C:\Users\user\Desktop\aswMBR (1).exe
2019-03-19 22:09 - 2019-03-19 22:09 - 000000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Dropbox
2019-03-19 15:48 - 2019-03-19 15:48 - 000051024 _____ (Dropbox, Inc.) C:\WINDOWS\system32\DbxSvc.exe
2019-03-19 15:48 - 2019-03-19 15:48 - 000047800 _____ (Dropbox, Inc.) C:\WINDOWS\system32\Drivers\dbx-stable.sys
2019-03-19 15:48 - 2019-03-19 15:48 - 000047600 _____ (Dropbox, Inc.) C:\WINDOWS\system32\Drivers\dbx-dev.sys
2019-03-19 15:48 - 2019-03-19 15:48 - 000047600 _____ (Dropbox, Inc.) C:\WINDOWS\system32\Drivers\dbx-canary.sys
2019-03-19 00:09 - 2019-03-19 00:09 - 000001092 _____ C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Adobe Photoshop CC 2018.lnk
2019-03-19 00:06 - 2019-03-19 00:06 - 000002505 _____ C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Skype for Business.lnk
2019-03-19 00:06 - 2019-03-19 00:06 - 000002500 _____ C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Word.lnk
2019-03-19 00:06 - 2019-03-19 00:06 - 000002499 _____ C:\ProgramData\Microsoft\Windows\Start Menu\Programs\PowerPoint.lnk
2019-03-19 00:06 - 2019-03-19 00:06 - 000002463 _____ C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Access.lnk
2019-03-19 00:06 - 2019-03-19 00:06 - 000002462 _____ C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Excel.lnk
2019-03-19 00:06 - 2019-03-19 00:06 - 000002456 _____ C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Outlook.lnk
2019-03-19 00:06 - 2019-03-19 00:06 - 000002450 _____ C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Publisher.lnk
2019-03-19 00:06 - 2019-03-19 00:06 - 000002442 _____ C:\ProgramData\Microsoft\Windows\Start Menu\Programs\OneNote 2016.lnk
2019-03-19 00:06 - 2019-03-19 00:06 - 000000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Microsoft Office Tools
2019-03-18 20:39 - 2019-03-18 20:43 - 000000521 _____ C:\Users\user\Desktop\mailinglist_template.csv
2019-03-18 20:37 - 2019-03-18 20:37 - 000018294 _____ C:\Users\user\Desktop\RJ_Contacts_85937.csv
2019-03-17 10:04 - 2019-03-17 10:28 - 001695744 _____ C:\Users\user\Desktop\justsold_test.indd
2019-03-13 17:54 - 2019-03-13 17:54 - 026810368 _____ (Microsoft Corporation) C:\WINDOWS\system32\edgehtml.dll
2019-03-13 17:54 - 2019-03-13 17:54 - 024616960 _____ (Microsoft Corporation) C:\WINDOWS\system32\Hydrogen.dll
2019-03-13 17:54 - 2019-03-13 17:54 - 023440896 _____ (Microsoft Corporation) C:\WINDOWS\system32\mshtml.dll
2019-03-13 17:54 - 2019-03-13 17:54 - 022114960 _____ (Microsoft Corporation) C:\WINDOWS\system32\shell32.dll
2019-03-13 17:54 - 2019-03-13 17:54 - 020814848 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\edgehtml.dll
2019-03-13 17:54 - 2019-03-13 17:54 - 019284480 _____ (Microsoft Corporation) C:\WINDOWS\system32\HologramWorld.dll
2019-03-13 17:54 - 2019-03-13 17:54 - 019023872 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\mshtml.dll
2019-03-13 17:54 - 2019-03-13 17:54 - 015224320 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\Windows.UI.Xaml.dll
2019-03-13 17:54 - 2019-03-13 17:54 - 012857856 _____ (Microsoft Corporation) C:\WINDOWS\system32\ieframe.dll
2019-03-13 17:54 - 2019-03-13 17:54 - 012151296 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\ieframe.dll
2019-03-13 17:54 - 2019-03-13 17:54 - 009683256 _____ (Microsoft Corporation) C:\WINDOWS\system32\ntoskrnl.exe
2019-03-13 17:54 - 2019-03-13 17:54 - 008875008 _____ (Microsoft Corporation) C:\WINDOWS\system32\mstscax.dll
2019-03-13 17:54 - 2019-03-13 17:54 - 007897088 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\mstscax.dll
2019-03-13 17:54 - 2019-03-13 17:54 - 007882240 _____ (Microsoft Corporation) C:\WINDOWS\system32\Chakra.dll
2019-03-13 17:54 - 2019-03-13 17:54 - 007251456 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\BingMaps.dll
2019-03-13 17:54 - 2019-03-13 17:54 - 006548168 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\Windows.Media.Protection.PlayReady.dll
2019-03-13 17:54 - 2019-03-13 17:54 - 006440960 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\Windows.Data.Pdf.dll
2019-03-13 17:54 - 2019-03-13 17:54 - 006309040 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\windows.storage.dll
2019-03-13 17:54 - 2019-03-13 17:54 - 006069760 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\Chakra.dll
2019-03-13 17:54 - 2019-03-13 17:54 - 005915936 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\d3d10warp.dll
2019-03-13 17:54 - 2019-03-13 17:54 - 005588184 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\shell32.dll
2019-03-13 17:54 - 2019-03-13 17:54 - 005566464 _____ (Microsoft Corporation) C:\WINDOWS\system32\twinui.pcshell.dll
2019-03-13 17:54 - 2019-03-13 17:54 - 005436184 _____ (Microsoft Corporation) C:\WINDOWS\system32\mfcore.dll
2019-03-13 17:54 - 2019-03-13 17:54 - 004920832 _____ (Microsoft Corporation) C:\WINDOWS\system32\MFMediaEngine.dll
2019-03-13 17:54 - 2019-03-13 17:54 - 004883968 _____ (Microsoft Corporation) C:\WINDOWS\system32\jscript9.dll
2019-03-13 17:54 - 2019-03-13 17:54 - 004689408 _____ (Microsoft Corporation) C:\WINDOWS\system32\msi.dll
2019-03-13 17:54 - 2019-03-13 17:54 - 004588744 _____ (Microsoft Corporation) C:\WINDOWS\system32\sppsvc.exe
2019-03-13 17:54 - 2019-03-13 17:54 - 003923456 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\msi.dll
2019-03-13 17:54 - 2019-03-13 17:54 - 003761664 _____ (Microsoft Corporation) C:\WINDOWS\system32\SRH.dll
2019-03-13 17:54 - 2019-03-13 17:54 - 003744256 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\jscript9.dll
2019-03-13 17:54 - 2019-03-13 17:54 - 003729808 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\explorer.exe
2019-03-13 17:54 - 2019-03-13 17:54 - 003660288 _____ (Microsoft Corporation) C:\WINDOWS\system32\win32kfull.sys
2019-03-13 17:54 - 2019-03-13 17:54 - 003656192 _____ (Microsoft Corporation) C:\WINDOWS\system32\mispace.dll
2019-03-13 17:54 - 2019-03-13 17:54 - 003652656 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\OneCoreUAPCommonProxyStub.dll
2019-03-13 17:54 - 2019-03-13 17:54 - 003566080 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\MFMediaEngine.dll
2019-03-13 17:54 - 2019-03-13 17:54 - 003551408 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\mfcore.dll
2019-03-13 17:54 - 2019-03-13 17:54 - 003504128 _____ (Microsoft Corporation) C:\WINDOWS\system32\dwmcore.dll
2019-03-13 17:54 - 2019-03-13 17:54 - 003427840 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\cdp.dll
2019-03-13 17:54 - 2019-03-13 17:54 - 003108864 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\dwmcore.dll
2019-03-13 17:54 - 2019-03-13 17:54 - 002942464 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\mispace.dll
2019-03-13 17:54 - 2019-03-13 17:54 - 002926904 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\tcpip.sys
2019-03-13 17:54 - 2019-03-13 17:54 - 002871312 _____ (Microsoft Corporation) C:\WINDOWS\system32\aitstatic.exe
2019-03-13 17:54 - 2019-03-13 17:54 - 002776712 _____ (Microsoft Corporation) C:\WINDOWS\system32\iertutil.dll
2019-03-13 17:54 - 2019-03-13 17:54 - 002752360 _____ (Microsoft Corporation) C:\WINDOWS\system32\mfmp4srcsnk.dll
2019-03-13 17:54 - 2019-03-13 17:54 - 002700792 _____ (Microsoft Corporation) C:\WINDOWS\system32\KernelBase.dll
2019-03-13 17:54 - 2019-03-13 17:54 - 002689536 _____ (Microsoft Corporation) C:\WINDOWS\system32\WebRuntimeManager.dll
2019-03-13 17:54 - 2019-03-13 17:54 - 002626360 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\ntfs.sys
2019-03-13 17:54 - 2019-03-13 17:54 - 002469440 _____ (Microsoft Corporation) C:\WINDOWS\system32\msmpeg2vdec.dll
2019-03-13 17:54 - 2019-03-13 17:54 - 002447360 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\MapRouter.dll
2019-03-13 17:54 - 2019-03-13 17:54 - 002323688 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\msmpeg2vdec.dll
2019-03-13 17:54 - 2019-03-13 17:54 - 002278240 _____ (Microsoft Corporation) C:\WINDOWS\system32\mfasfsrcsnk.dll
2019-03-13 17:54 - 2019-03-13 17:54 - 002275680 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\iertutil.dll
2019-03-13 17:54 - 2019-03-13 17:54 - 002127360 _____ (Microsoft Corporation) C:\WINDOWS\system32\wsp_fs.dll
2019-03-13 17:54 - 2019-03-13 17:54 - 002073240 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\KernelBase.dll
2019-03-13 17:54 - 2019-03-13 17:54 - 002001408 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\MapGeocoder.dll
2019-03-13 17:54 - 2019-03-13 17:54 - 001994760 _____ (Microsoft Corporation) C:\WINDOWS\system32\ntdll.dll
2019-03-13 17:54 - 2019-03-13 17:54 - 001969464 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\refs.sys
2019-03-13 17:54 - 2019-03-13 17:54 - 001899160 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\AudioEng.dll
2019-03-13 17:54 - 2019-03-13 17:54 - 001884672 _____ (Microsoft Corporation) C:\WINDOWS\system32\msxml3.dll
2019-03-13 17:54 - 2019-03-13 17:54 - 001860608 _____ (Microsoft Corporation) C:\WINDOWS\system32\urlmon.dll
2019-03-13 17:54 - 2019-03-13 17:54 - 001830200 _____ (Microsoft Corporation) C:\WINDOWS\system32\rdpserverbase.dll
2019-03-13 17:54 - 2019-03-13 17:54 - 001782272 _____ (Microsoft Corporation) C:\WINDOWS\system32\wsp_health.dll
2019-03-13 17:54 - 2019-03-13 17:54 - 001760768 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\urlmon.dll
2019-03-13 17:54 - 2019-03-13 17:54 - 001711616 _____ (Microsoft Corporation) C:\WINDOWS\system32\Windows.UI.Immersive.dll
2019-03-13 17:54 - 2019-03-13 17:54 - 001706488 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\mfmp4srcsnk.dll
2019-03-13 17:54 - 2019-03-13 17:54 - 001701376 _____ (Microsoft Corporation) C:\WINDOWS\system32\GdiPlus.dll
2019-03-13 17:54 - 2019-03-13 17:54 - 001697744 _____ (Microsoft Corporation) C:\WINDOWS\system32\winload.efi
2019-03-13 17:54 - 2019-03-13 17:54 - 001644048 _____ (Microsoft Corporation) C:\WINDOWS\system32\appraiser.dll
2019-03-13 17:54 - 2019-03-13 17:54 - 001641400 _____ (Microsoft Corporation) C:\WINDOWS\system32\sppobjs.dll
2019-03-13 17:54 - 2019-03-13 17:54 - 001590072 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\rdpserverbase.dll
2019-03-13 17:54 - 2019-03-13 17:54 - 001572176 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\propsys.dll
2019-03-13 17:54 - 2019-03-13 17:54 - 001521664 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\wsp_fs.dll
2019-03-13 17:54 - 2019-03-13 17:54 - 001506816 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\Windows.UI.Immersive.dll
2019-03-13 17:54 - 2019-03-13 17:54 - 001484800 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\GdiPlus.dll
2019-03-13 17:54 - 2019-03-13 17:54 - 001481488 _____ (Microsoft Corporation) C:\WINDOWS\system32\msctf.dll
2019-03-13 17:54 - 2019-03-13 17:54 - 001479480 _____ (Microsoft Corporation) C:\WINDOWS\system32\rdpbase.dll
2019-03-13 17:54 - 2019-03-13 17:54 - 001468440 _____ (Microsoft Corporation) C:\WINDOWS\system32\winload.exe
2019-03-13 17:54 - 2019-03-13 17:54 - 001457544 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\D3D12.dll
2019-03-13 17:54 - 2019-03-13 17:54 - 001387520 _____ (Microsoft Corporation) C:\WINDOWS\system32\bcastdvruserservice.dll
2019-03-13 17:54 - 2019-03-13 17:54 - 001360696 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\ndis.sys
2019-03-13 17:54 - 2019-03-13 17:54 - 001341880 _____ (Microsoft Corporation) C:\WINDOWS\system32\winresume.efi
2019-03-13 17:54 - 2019-03-13 17:54 - 001332224 _____ (Microsoft Corporation) C:\WINDOWS\system32\lpasvc.dll
2019-03-13 17:54 - 2019-03-13 17:54 - 001309696 _____ (Microsoft Corporation) C:\WINDOWS\system32\webplatstorageserver.dll
2019-03-13 17:54 - 2019-03-13 17:54 - 001307648 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\wsp_health.dll
2019-03-13 17:54 - 2019-03-13 17:54 - 001294856 _____ (Microsoft Corporation) C:\WINDOWS\system32\mfsvr.dll
2019-03-13 17:54 - 2019-03-13 17:54 - 001289192 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\mfasfsrcsnk.dll
2019-03-13 17:54 - 2019-03-13 17:54 - 001272552 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\ttdrecordcpu.dll
2019-03-13 17:54 - 2019-03-13 17:54 - 001267712 _____ (Microsoft Corporation) C:\WINDOWS\system32\APMon.dll
2019-03-13 17:54 - 2019-03-13 17:54 - 001258808 _____ (Microsoft Corporation) C:\WINDOWS\system32\SecConfig.efi
2019-03-13 17:54 - 2019-03-13 17:54 - 001256448 _____ (Microsoft Corporation) C:\WINDOWS\system32\rdpcore.dll
2019-03-13 17:54 - 2019-03-13 17:54 - 001224704 _____ (Microsoft Corporation) C:\WINDOWS\system32\reseteng.dll
2019-03-13 17:54 - 2019-03-13 17:54 - 001221944 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\rdpbase.dll
2019-03-13 17:54 - 2019-03-13 17:54 - 001200920 _____ (Microsoft Corporation) C:\WINDOWS\system32\mfmpeg2srcsnk.dll
2019-03-13 17:54 - 2019-03-13 17:54 - 001180248 _____ (Microsoft Corporation) C:\WINDOWS\system32\rpcrt4.dll
2019-03-13 17:54 - 2019-03-13 17:54 - 001179168 _____ (Microsoft Corporation) C:\WINDOWS\system32\winresume.exe
2019-03-13 17:54 - 2019-03-13 17:54 - 001131520 _____ (Microsoft Corporation) C:\WINDOWS\system32\nettrace.dll
2019-03-13 17:54 - 2019-03-13 17:54 - 001098128 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\AudioSes.dll
2019-03-13 17:54 - 2019-03-13 17:54 - 001077912 _____ (Microsoft Corporation) C:\WINDOWS\system32\DolbyDecMFT.dll
2019-03-13 17:54 - 2019-03-13 17:54 - 001072720 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\mfsvr.dll
2019-03-13 17:54 - 2019-03-13 17:54 - 001072640 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\rdpcore.dll
2019-03-13 17:54 - 2019-03-13 17:54 - 001056272 _____ (Microsoft Corporation) C:\WINDOWS\system32\pidgenx.dll
2019-03-13 17:54 - 2019-03-13 17:54 - 001047040 _____ (Microsoft Corporation) C:\WINDOWS\system32\clusapi.dll
2019-03-13 17:54 - 2019-03-13 17:54 - 001001472 _____ (Microsoft Corporation) C:\WINDOWS\system32\mmsys.cpl
2019-03-13 17:54 - 2019-03-13 17:54 - 000981816 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\refsv1.sys
2019-03-13 17:54 - 2019-03-13 17:54 - 000926208 _____ (Microsoft Corporation) C:\WINDOWS\system32\rasmans.dll
2019-03-13 17:54 - 2019-03-13 17:54 - 000918032 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\ReAgent.dll
2019-03-13 17:54 - 2019-03-13 17:54 - 000912384 _____ (Microsoft Corporation) C:\WINDOWS\system32\EdgeManager.dll
2019-03-13 17:54 - 2019-03-13 17:54 - 000908800 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\mmsys.cpl
2019-03-13 17:54 - 2019-03-13 17:54 - 000888320 _____ (Microsoft Corporation) C:\WINDOWS\system32\mprddm.dll
2019-03-13 17:54 - 2019-03-13 17:54 - 000888120 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\pidgenx.dll
2019-03-13 17:54 - 2019-03-13 17:54 - 000866152 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\DolbyDecMFT.dll
2019-03-13 17:54 - 2019-03-13 17:54 - 000860160 _____ C:\WINDOWS\system32\MBR2GPT.EXE
2019-03-13 17:54 - 2019-03-13 17:54 - 000840192 _____ (Microsoft Corporation) C:\WINDOWS\system32\jscript.dll
2019-03-13 17:54 - 2019-03-13 17:54 - 000836096 _____ (Microsoft Corporation) C:\WINDOWS\system32\bisrv.dll
2019-03-13 17:54 - 2019-03-13 17:54 - 000833024 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\webplatstorageserver.dll
2019-03-13 17:54 - 2019-03-13 17:54 - 000823296 _____ (Microsoft Corporation) C:\WINDOWS\system32\SndVolSSO.dll
2019-03-13 17:54 - 2019-03-13 17:54 - 000808464 _____ (Microsoft Corporation) C:\WINDOWS\system32\generaltel.dll
2019-03-13 17:54 - 2019-03-13 17:54 - 000793088 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\clusapi.dll
2019-03-13 17:54 - 2019-03-13 17:54 - 000782968 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\rpcrt4.dll
2019-03-13 17:54 - 2019-03-13 17:54 - 000775168 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\SndVolSSO.dll
2019-03-13 17:54 - 2019-03-13 17:54 - 000772608 _____ (Microsoft Corporation) C:\WINDOWS\system32\nshwfp.dll
2019-03-13 17:54 - 2019-03-13 17:54 - 000772408 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\Windows.Services.TargetedContent.dll
2019-03-13 17:54 - 2019-03-13 17:54 - 000769536 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\srv2.sys
2019-03-13 17:54 - 2019-03-13 17:54 - 000764216 _____ (Microsoft Corporation) C:\WINDOWS\system32\wimgapi.dll
2019-03-13 17:54 - 2019-03-13 17:54 - 000762880 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\mprddm.dll
2019-03-13 17:54 - 2019-03-13 17:54 - 000735760 _____ (Microsoft Corporation) C:\WINDOWS\system32\aeinv.dll
2019-03-13 17:54 - 2019-03-13 17:54 - 000726416 _____ (Microsoft Corporation) C:\WINDOWS\system32\kernel32.dll
2019-03-13 17:54 - 2019-03-13 17:54 - 000723968 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\BingOnlineServices.dll
2019-03-13 17:54 - 2019-03-13 17:54 - 000703488 _____ (Microsoft Corporation) C:\WINDOWS\system32\jscript9diag.dll
2019-03-13 17:54 - 2019-03-13 17:54 - 000684032 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\jscript.dll
2019-03-13 17:54 - 2019-03-13 17:54 - 000663040 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\EdgeManager.dll
2019-03-13 17:54 - 2019-03-13 17:54 - 000655160 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\afd.sys
2019-03-13 17:54 - 2019-03-13 17:54 - 000652824 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\AppXDeploymentClient.dll
2019-03-13 17:54 - 2019-03-13 17:54 - 000649272 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\kernel32.dll
2019-03-13 17:54 - 2019-03-13 17:54 - 000642048 _____ (Microsoft Corporation) C:\WINDOWS\system32\SharedRealitySvc.dll
2019-03-13 17:54 - 2019-03-13 17:54 - 000626176 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\tdh.dll
2019-03-13 17:54 - 2019-03-13 17:54 - 000622080 _____ (Microsoft Corporation) C:\WINDOWS\system32\NgcCtnrSvc.dll
2019-03-13 17:54 - 2019-03-13 17:54 - 000621568 _____ (Microsoft Corporation) C:\WINDOWS\system32\resutils.dll
2019-03-13 17:54 - 2019-03-13 17:54 - 000619832 _____ (Microsoft Corporation) C:\WINDOWS\system32\devinv.dll
2019-03-13 17:54 - 2019-03-13 17:54 - 000599040 _____ (Microsoft Corporation) C:\WINDOWS\system32\facecredentialprovider.dll
2019-03-13 17:54 - 2019-03-13 17:54 - 000593920 _____ (Microsoft Corporation) C:\WINDOWS\system32\vbscript.dll
2019-03-13 17:54 - 2019-03-13 17:54 - 000591832 _____ C:\WINDOWS\SysWOW64\InputHost.dll
2019-03-13 17:54 - 2019-03-13 17:54 - 000578560 _____ (Microsoft Corporation) C:\WINDOWS\system32\PlayToManager.dll
2019-03-13 17:54 - 2019-03-13 17:54 - 000573440 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\mfh264enc.dll
2019-03-13 17:54 - 2019-03-13 17:54 - 000560128 _____ (Microsoft Corporation) C:\WINDOWS\system32\mfh264enc.dll
2019-03-13 17:54 - 2019-03-13 17:54 - 000553784 _____ (Microsoft Corporation) C:\WINDOWS\system32\pcasvc.dll
2019-03-13 17:54 - 2019-03-13 17:54 - 000549376 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\JpMapControl.dll
2019-03-13 17:54 - 2019-03-13 17:54 - 000548864 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\Windows.Networking.Connectivity.dll
2019-03-13 17:54 - 2019-03-13 17:54 - 000543744 _____ (Microsoft Corporation) C:\WINDOWS\system32\win32k.sys
2019-03-13 17:54 - 2019-03-13 17:54 - 000531968 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\vbscript.dll
2019-03-13 17:54 - 2019-03-13 17:54 - 000525312 _____ (Microsoft Corporation) C:\WINDOWS\system32\nltest.exe
2019-03-13 17:54 - 2019-03-13 17:54 - 000519992 _____ (Microsoft Corporation) C:\WINDOWS\system32\wimserv.exe
2019-03-13 17:54 - 2019-03-13 17:54 - 000497664 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\dsound.dll
2019-03-13 17:54 - 2019-03-13 17:54 - 000495104 _____ (Microsoft Corporation) C:\WINDOWS\system32\werui.dll
2019-03-13 17:54 - 2019-03-13 17:54 - 000489984 _____ (Microsoft Corporation) C:\WINDOWS\system32\ResourceMapper.dll
2019-03-13 17:54 - 2019-03-13 17:54 - 000480256 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\resutils.dll
2019-03-13 17:54 - 2019-03-13 17:54 - 000474936 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\FWPKCLNT.SYS
2019-03-13 17:54 - 2019-03-13 17:54 - 000460304 _____ (Microsoft Corporation) C:\WINDOWS\system32\invagent.dll
2019-03-13 17:54 - 2019-03-13 17:54 - 000453944 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\rdbss.sys
2019-03-13 17:54 - 2019-03-13 17:54 - 000452096 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\cldflt.sys
2019-03-13 17:54 - 2019-03-13 17:54 - 000449024 _____ (Microsoft Corporation) C:\WINDOWS\system32\edgeIso.dll
2019-03-13 17:54 - 2019-03-13 17:54 - 000435712 _____ (Microsoft Corporation) C:\WINDOWS\system32\cryptngc.dll
2019-03-13 17:54 - 2019-03-13 17:54 - 000427520 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\werui.dll
2019-03-13 17:54 - 2019-03-13 17:54 - 000423936 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\MapConfiguration.dll
2019-03-13 17:54 - 2019-03-13 17:54 - 000421688 _____ (Microsoft Corporation) C:\WINDOWS\system32\MSAudDecMFT.dll
2019-03-13 17:54 - 2019-03-13 17:54 - 000414720 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\winspool.drv
2019-03-13 17:54 - 2019-03-13 17:54 - 000411136 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\PlayToManager.dll
2019-03-13 17:54 - 2019-03-13 17:54 - 000407552 _____ (Microsoft Corporation) C:\WINDOWS\system32\rascustom.dll
2019-03-13 17:54 - 2019-03-13 17:54 - 000383288 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\msrpc.sys
2019-03-13 17:54 - 2019-03-13 17:54 - 000361984 _____ (Microsoft Corporation) C:\WINDOWS\system32\DataUsageHandlers.dll
2019-03-13 17:54 - 2019-03-13 17:54 - 000359424 _____ (Microsoft Corporation) C:\WINDOWS\system32\dusmsvc.dll
2019-03-13 17:54 - 2019-03-13 17:54 - 000340480 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\udfs.sys
2019-03-13 17:54 - 2019-03-13 17:54 - 000331264 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\Windows.Devices.Picker.dll
2019-03-13 17:54 - 2019-03-13 17:54 - 000330752 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\edgeIso.dll
2019-03-13 17:54 - 2019-03-13 17:54 - 000322576 _____ (Microsoft Corporation) C:\WINDOWS\system32\acmigration.dll
2019-03-13 17:54 - 2019-03-13 17:54 - 000322048 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\cryptngc.dll
2019-03-13 17:54 - 2019-03-13 17:54 - 000313344 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\msrd2x40.dll
2019-03-13 17:54 - 2019-03-13 17:54 - 000293376 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\srvnet.sys
2019-03-13 17:54 - 2019-03-13 17:54 - 000290816 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\MbbCx.sys
2019-03-13 17:54 - 2019-03-13 17:54 - 000279376 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\wintrust.dll
2019-03-13 17:54 - 2019-03-13 17:54 - 000272648 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\ttdwriter.dll
2019-03-13 17:54 - 2019-03-13 17:54 - 000263360 _____ (Microsoft Corporation) C:\WINDOWS\system32\mfps.dll
2019-03-13 17:54 - 2019-03-13 17:54 - 000262456 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\mrxsmb20.sys
2019-03-13 17:54 - 2019-03-13 17:54 - 000190464 _____ (Microsoft Corporation) C:\WINDOWS\system32\ngcpopkeysrv.dll
2019-03-13 17:54 - 2019-03-13 17:54 - 000180736 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\srumsvc.dll
2019-03-13 17:54 - 2019-03-13 17:54 - 000177664 _____ (Microsoft Corporation) C:\WINDOWS\system32\ngctasks.dll
2019-03-13 17:54 - 2019-03-13 17:54 - 000176640 _____ (Microsoft Corporation) C:\WINDOWS\system32\spacebridge.dll
2019-03-13 17:54 - 2019-03-13 17:54 - 000173568 _____ (Microsoft Corporation) C:\WINDOWS\system32\itss.dll
2019-03-13 17:54 - 2019-03-13 17:54 - 000167424 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\rdpdr.sys
2019-03-13 17:54 - 2019-03-13 17:54 - 000156160 _____ (Microsoft Corporation) C:\WINDOWS\system32\RMapi.dll
2019-03-13 17:54 - 2019-03-13 17:54 - 000147968 _____ (Microsoft Corporation) C:\WINDOWS\system32\srpapi.dll
2019-03-13 17:54 - 2019-03-13 17:54 - 000147256 _____ (Microsoft Corporation) C:\WINDOWS\system32\CompatTelRunner.exe
2019-03-13 17:54 - 2019-03-13 17:54 - 000145920 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\itss.dll
2019-03-13 17:54 - 2019-03-13 17:54 - 000144896 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\SpatialAudioLicenseSrv.exe
2019-03-13 17:54 - 2019-03-13 17:54 - 000134144 _____ (Microsoft Corporation) C:\WINDOWS\system32\DataUsageLiveTileTask.exe
2019-03-13 17:54 - 2019-03-13 17:54 - 000132096 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\smartscreenps.dll
2019-03-13 17:54 - 2019-03-13 17:54 - 000126976 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\srpapi.dll
2019-03-13 17:54 - 2019-03-13 17:54 - 000126464 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\bridge.sys
2019-03-13 17:54 - 2019-03-13 17:54 - 000100352 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\cdfs.sys
2019-03-13 17:54 - 2019-03-13 17:54 - 000096256 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\UserDataTimeUtil.dll
2019-03-13 17:54 - 2019-03-13 17:54 - 000094208 _____ (Microsoft Corporation) C:\WINDOWS\system32\mcbuilder.exe
2019-03-13 17:54 - 2019-03-13 17:54 - 000080896 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\mcbuilder.exe
2019-03-13 17:54 - 2019-03-13 17:54 - 000078336 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\npfs.sys
2019-03-13 17:54 - 2019-03-13 17:54 - 000071184 _____ (Microsoft Corporation) C:\WINDOWS\system32\win32appinventorycsp.dll
2019-03-13 17:54 - 2019-03-13 17:54 - 000059392 _____ (Microsoft Corporation) C:\WINDOWS\system32\mf3216.dll
2019-03-13 17:54 - 2019-03-13 17:54 - 000044544 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\mf3216.dll
2019-03-13 17:54 - 2019-03-13 17:54 - 000044544 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\CredentialMigrationHandler.dll
2019-03-13 17:54 - 2019-03-13 17:54 - 000033792 _____ (Microsoft Corporation) C:\WINDOWS\system32\SecureBioSysprep.dll
2019-03-13 17:54 - 2019-03-13 17:54 - 000033792 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\msfs.sys
2019-03-13 17:53 - 2019-03-13 17:54 - 003399168 _____ (Microsoft Corporation) C:\WINDOWS\system32\MapRouter.dll
2019-03-13 17:53 - 2019-03-13 17:53 - 017520640 _____ (Microsoft Corporation) C:\WINDOWS\system32\Windows.UI.Xaml.dll
2019-03-13 17:53 - 2019-03-13 17:53 - 009670656 _____ (Microsoft Corporation) C:\WINDOWS\system32\BingMaps.dll
2019-03-13 17:53 - 2019-03-13 17:53 - 007883776 _____ (Microsoft Corporation) C:\WINDOWS\system32\Windows.Data.Pdf.dll
2019-03-13 17:53 - 2019-03-13 17:53 - 007688088 _____ (Microsoft Corporation) C:\WINDOWS\system32\windows.storage.dll
2019-03-13 17:53 - 2019-03-13 17:53 - 007647256 _____ (Microsoft Corporation) C:\WINDOWS\system32\OneCoreUAPCommonProxyStub.dll
2019-03-13 17:53 - 2019-03-13 17:53 - 007645392 _____ (Microsoft Corporation) C:\WINDOWS\system32\Windows.Media.Protection.PlayReady.dll
2019-03-13 17:53 - 2019-03-13 17:53 - 007556392 _____ (Microsoft Corporation) C:\WINDOWS\system32\d3d10warp.dll
2019-03-13 17:53 - 2019-03-13 17:53 - 005296640 _____ (Microsoft Corporation) C:\WINDOWS\system32\cdp.dll
2019-03-13 17:53 - 2019-03-13 17:53 - 004245280 _____ (Microsoft Corporation) C:\WINDOWS\explorer.exe
2019-03-13 17:53 - 2019-03-13 17:53 - 003983360 _____ (Microsoft Corporation) C:\WINDOWS\system32\EdgeContent.dll
2019-03-13 17:53 - 2019-03-13 17:53 - 003382272 _____ (Microsoft Corporation) C:\WINDOWS\system32\AppXDeploymentServer.dll
2019-03-13 17:53 - 2019-03-13 17:53 - 003378488 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\dxgkrnl.sys
2019-03-13 17:53 - 2019-03-13 17:53 - 002842112 _____ (Microsoft Corporation) C:\WINDOWS\system32\MapGeocoder.dll
2019-03-13 17:53 - 2019-03-13 17:53 - 002766648 _____ (Microsoft Corporation) C:\WINDOWS\system32\UpdateAgent.dll
2019-03-13 17:53 - 2019-03-13 17:53 - 002720768 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\win32kfull.sys
2019-03-13 17:53 - 2019-03-13 17:53 - 002637312 _____ (Microsoft Corporation) C:\WINDOWS\system32\smartscreen.exe
2019-03-13 17:53 - 2019-03-13 17:53 - 002630656 _____ (Microsoft Corporation) C:\WINDOWS\system32\wlansvc.dll
2019-03-13 17:53 - 2019-03-13 17:53 - 002488320 _____ (Microsoft Corporation) C:\WINDOWS\system32\win32kbase.sys
2019-03-13 17:53 - 2019-03-13 17:53 - 002437344 _____ (Microsoft Corporation) C:\WINDOWS\system32\msxml6.dll
2019-03-13 17:53 - 2019-03-13 17:53 - 002187776 _____ (Microsoft Corporation) C:\WINDOWS\system32\AppXDeploymentExtensions.onecore.dll
2019-03-13 17:53 - 2019-03-13 17:53 - 002044416 _____ (Microsoft Corporation) C:\WINDOWS\system32\Windows.CloudStore.dll
2019-03-13 17:53 - 2019-03-13 17:53 - 002021584 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\msxml6.dll
2019-03-13 17:53 - 2019-03-13 17:53 - 002013696 _____ C:\WINDOWS\system32\rdpnano.dll
2019-03-13 17:53 - 2019-03-13 17:53 - 001931264 _____ (Microsoft Corporation) C:\WINDOWS\system32\audiosrv.dll
2019-03-13 17:53 - 2019-03-13 17:53 - 001893888 _____ (Microsoft Corporation) C:\WINDOWS\system32\wevtsvc.dll
2019-03-13 17:53 - 2019-03-13 17:53 - 001844448 _____ (Microsoft Corporation) C:\WINDOWS\system32\D3D12.dll
2019-03-13 17:53 - 2019-03-13 17:53 - 001742104 _____ (Microsoft Corporation) C:\WINDOWS\system32\propsys.dll
2019-03-13 17:53 - 2019-03-13 17:53 - 001715712 _____ (Microsoft Corporation) C:\WINDOWS\system32\ISM.dll
2019-03-13 17:53 - 2019-03-13 17:53 - 001672704 _____ (Microsoft Corporation) C:\WINDOWS\system32\rdpcorets.dll
2019-03-13 17:53 - 2019-03-13 17:53 - 001656832 _____ (Microsoft Corporation) C:\WINDOWS\system32\wpncore.dll
2019-03-13 17:53 - 2019-03-13 17:53 - 001604096 _____ (Microsoft Corporation) C:\WINDOWS\system32\AppXDeploymentExtensions.desktop.dll
2019-03-13 17:53 - 2019-03-13 17:53 - 001563336 _____ (Microsoft Corporation) C:\WINDOWS\system32\ttdrecordcpu.dll
2019-03-13 17:53 - 2019-03-13 17:53 - 001496064 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\msxml3.dll
2019-03-13 17:53 - 2019-03-13 17:53 - 001331536 _____ (Microsoft Corporation) C:\WINDOWS\system32\AudioSes.dll
2019-03-13 17:53 - 2019-03-13 17:53 - 001296576 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\msctf.dll
2019-03-13 17:53 - 2019-03-13 17:53 - 001259320 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\http.sys
2019-03-13 17:53 - 2019-03-13 17:53 - 001253688 _____ (Microsoft Corporation) C:\WINDOWS\system32\hvix64.exe
2019-03-13 17:53 - 2019-03-13 17:53 - 001221120 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\bthport.sys
2019-03-13 17:53 - 2019-03-13 17:53 - 001208320 _____ (Microsoft Corporation) C:\WINDOWS\system32\rpcss.dll
2019-03-13 17:53 - 2019-03-13 17:53 - 001199104 _____ (Microsoft Corporation) C:\WINDOWS\system32\localspl.dll
2019-03-13 17:53 - 2019-03-13 17:53 - 001191512 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\ucrtbase.dll
2019-03-13 17:53 - 2019-03-13 17:53 - 001176064 _____ (Microsoft Corporation) C:\WINDOWS\system32\MapsStore.dll
2019-03-13 17:53 - 2019-03-13 17:53 - 001087800 _____ (Microsoft Corporation) C:\WINDOWS\system32\ReAgent.dll
2019-03-13 17:53 - 2019-03-13 17:53 - 001078072 _____ (Microsoft Corporation) C:\WINDOWS\system32\Windows.Services.TargetedContent.dll
2019-03-13 17:53 - 2019-03-13 17:53 - 001054200 _____ (Microsoft Corporation) C:\WINDOWS\system32\ApplyTrustOffline.exe
2019-03-13 17:53 - 2019-03-13 17:53 - 001052160 _____ (Microsoft Corporation) C:\WINDOWS\system32\MPSSVC.dll
2019-03-13 17:53 - 2019-03-13 17:53 - 001043256 _____ (Microsoft Corporation) C:\WINDOWS\system32\hvax64.exe
2019-03-13 17:53 - 2019-03-13 17:53 - 001022616 _____ (Microsoft Corporation) C:\WINDOWS\system32\ucrtbase.dll
2019-03-13 17:53 - 2019-03-13 17:53 - 001008128 _____ (Microsoft Corporation) C:\WINDOWS\system32\wcmsvc.dll
2019-03-13 17:53 - 2019-03-13 17:53 - 000955392 _____ (Microsoft Corporation) C:\WINDOWS\system32\wbiosrvc.dll
2019-03-13 17:53 - 2019-03-13 17:53 - 000902144 _____ (Microsoft Corporation) C:\WINDOWS\system32\BingOnlineServices.dll
2019-03-13 17:53 - 2019-03-13 17:53 - 000895048 _____ (Microsoft Corporation) C:\WINDOWS\system32\wer.dll
2019-03-13 17:53 - 2019-03-13 17:53 - 000883712 _____ (Microsoft Corporation) C:\WINDOWS\system32\usocore.dll
2019-03-13 17:53 - 2019-03-13 17:53 - 000871792 _____ (Microsoft Corporation) C:\WINDOWS\system32\ClipSVC.dll
2019-03-13 17:53 - 2019-03-13 17:53 - 000865568 _____ (Microsoft Corporation) C:\WINDOWS\system32\AppXDeploymentClient.dll
2019-03-13 17:53 - 2019-03-13 17:53 - 000850760 _____ (Microsoft Corporation) C:\WINDOWS\system32\ci.dll
2019-03-13 17:53 - 2019-03-13 17:53 - 000833064 _____ C:\WINDOWS\system32\InputHost.dll
2019-03-13 17:53 - 2019-03-13 17:53 - 000790328 _____ (Microsoft Corporation) C:\WINDOWS\system32\upshared.dll
2019-03-13 17:53 - 2019-03-13 17:53 - 000773120 _____ (Microsoft Corporation) C:\WINDOWS\system32\tdh.dll
2019-03-13 17:53 - 2019-03-13 17:53 - 000757664 _____ (Microsoft Corporation) C:\WINDOWS\system32\tcblaunch.exe
2019-03-13 17:53 - 2019-03-13 17:53 - 000749568 _____ (Microsoft Corporation) C:\WINDOWS\system32\AudioEndpointBuilder.dll
2019-03-13 17:53 - 2019-03-13 17:53 - 000745984 _____ (Microsoft Corporation) C:\WINDOWS\system32\Windows.Networking.Connectivity.dll
2019-03-13 17:53 - 2019-03-13 17:53 - 000741888 _____ (Microsoft Corporation) C:\WINDOWS\system32\updatehandlers.dll
2019-03-13 17:53 - 2019-03-13 17:53 - 000714240 _____ (Microsoft Corporation) C:\WINDOWS\system32\JpMapControl.dll
2019-03-13 17:53 - 2019-03-13 17:53 - 000691712 _____ (Microsoft Corporation) C:\WINDOWS\system32\aadcloudap.dll
2019-03-13 17:53 - 2019-03-13 17:53 - 000680184 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\wer.dll
2019-03-13 17:53 - 2019-03-13 17:53 - 000661816 _____ (Microsoft Corporation) C:\WINDOWS\system32\computecore.dll
2019-03-13 17:53 - 2019-03-13 17:53 - 000651576 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\spaceport.sys
2019-03-13 17:53 - 2019-03-13 17:53 - 000646656 _____ (Microsoft Corporation) C:\WINDOWS\system32\w32time.dll
2019-03-13 17:53 - 2019-03-13 17:53 - 000646632 _____ (Microsoft Corporation) C:\WINDOWS\system32\msvcp_win.dll
2019-03-13 17:53 - 2019-03-13 17:53 - 000607744 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\nshwfp.dll
2019-03-13 17:53 - 2019-03-13 17:53 - 000605496 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\wimgapi.dll
2019-03-13 17:53 - 2019-03-13 17:53 - 000604336 _____ (Microsoft Corporation) C:\WINDOWS\system32\audiodg.exe
2019-03-13 17:53 - 2019-03-13 17:53 - 000593920 _____ (Microsoft Corporation) C:\WINDOWS\system32\dsound.dll
2019-03-13 17:53 - 2019-03-13 17:53 - 000572416 _____ (Microsoft Corporation) C:\WINDOWS\system32\wpnprv.dll
2019-03-13 17:53 - 2019-03-13 17:53 - 000566272 _____ (Microsoft Corporation) C:\WINDOWS\system32\MapConfiguration.dll
2019-03-13 17:53 - 2019-03-13 17:53 - 000540672 _____ (Microsoft Corporation) C:\WINDOWS\system32\winspool.drv
2019-03-13 17:53 - 2019-03-13 17:53 - 000511800 _____ (Microsoft Corporation) C:\WINDOWS\system32\aepic.dll
2019-03-13 17:53 - 2019-03-13 17:53 - 000508216 _____ (Microsoft Corporation) C:\WINDOWS\system32\WerFault.exe
2019-03-13 17:53 - 2019-03-13 17:53 - 000505656 _____ (Microsoft Corporation) C:\WINDOWS\system32\dcntel.dll
2019-03-13 17:53 - 2019-03-13 17:53 - 000484976 _____ (Microsoft Corporation) C:\WINDOWS\system32\ucrtbase_enclave.dll
2019-03-13 17:53 - 2019-03-13 17:53 - 000479232 _____ (Microsoft Corporation) C:\WINDOWS\system32\cloudAP.dll
2019-03-13 17:53 - 2019-03-13 17:53 - 000463672 _____ (Microsoft Corporation) C:\WINDOWS\system32\msv1_0.dll
2019-03-13 17:53 - 2019-03-13 17:53 - 000456704 _____ (Microsoft Corporation) C:\WINDOWS\system32\Windows.Devices.Picker.dll
2019-03-13 17:53 - 2019-03-13 17:53 - 000449368 _____ (Microsoft Corporation) C:\WINDOWS\system32\Faultrep.dll
2019-03-13 17:53 - 2019-03-13 17:53 - 000444728 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\WerFault.exe
2019-03-13 17:53 - 2019-03-13 17:53 - 000419128 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\fastfat.sys
2019-03-13 17:53 - 2019-03-13 17:53 - 000404792 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\clfs.sys
2019-03-13 17:53 - 2019-03-13 17:53 - 000402944 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\exfat.sys
2019-03-13 17:53 - 2019-03-13 17:53 - 000387832 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\Faultrep.dll
2019-03-13 17:53 - 2019-03-13 17:53 - 000386872 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\msv1_0.dll
2019-03-13 17:53 - 2019-03-13 17:53 - 000383288 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\aepic.dll
2019-03-13 17:53 - 2019-03-13 17:53 - 000367616 _____ (Microsoft Corporation) C:\WINDOWS\system32\dhcpcore.dll
2019-03-13 17:53 - 2019-03-13 17:53 - 000355360 _____ (Microsoft Corporation) C:\WINDOWS\system32\wintrust.dll
2019-03-13 17:53 - 2019-03-13 17:53 - 000348160 _____ (Microsoft Corporation) C:\WINDOWS\system32\BioCredProv.dll
2019-03-13 17:53 - 2019-03-13 17:53 - 000336744 _____ (Microsoft Corporation) C:\WINDOWS\system32\AudioSrvPolicyManager.dll
2019-03-13 17:53 - 2019-03-13 17:53 - 000330464 _____ (Microsoft Corporation) C:\WINDOWS\system32\ttdwriter.dll
2019-03-13 17:53 - 2019-03-13 17:53 - 000325120 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\dhcpcore.dll
2019-03-13 17:53 - 2019-03-13 17:53 - 000281600 _____ (Microsoft Corporation) C:\WINDOWS\system32\dhcpcore6.dll
2019-03-13 17:53 - 2019-03-13 17:53 - 000275456 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\BioCredProv.dll
2019-03-13 17:53 - 2019-03-13 17:53 - 000271360 _____ (Microsoft Corporation) C:\WINDOWS\system32\MapControlCore.dll
2019-03-13 17:53 - 2019-03-13 17:53 - 000264192 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\dhcpcore6.dll
2019-03-13 17:53 - 2019-03-13 17:53 - 000248832 _____ (Microsoft Corporation) C:\WINDOWS\system32\w32tm.exe
2019-03-13 17:53 - 2019-03-13 17:53 - 000246584 _____ (Microsoft Corporation) C:\WINDOWS\system32\moshostcore.dll
2019-03-13 17:53 - 2019-03-13 17:53 - 000225792 _____ (Microsoft Corporation) C:\WINDOWS\system32\smbwmiv2.dll
2019-03-13 17:53 - 2019-03-13 17:53 - 000224256 _____ (Microsoft Corporation) C:\WINDOWS\system32\ptpprov.dll
2019-03-13 17:53 - 2019-03-13 17:53 - 000214528 _____ (Microsoft Corporation) C:\WINDOWS\system32\srumsvc.dll
2019-03-13 17:53 - 2019-03-13 17:53 - 000211968 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\w32tm.exe
2019-03-13 17:53 - 2019-03-13 17:53 - 000202752 _____ (Microsoft Corporation) C:\WINDOWS\system32\SecureTimeAggregator.dll
2019-03-13 17:53 - 2019-03-13 17:53 - 000202552 _____ (Microsoft Corporation) C:\WINDOWS\system32\tcbloader.dll
2019-03-13 17:53 - 2019-03-13 17:53 - 000196608 _____ (Microsoft Corporation) C:\WINDOWS\system32\smartscreenps.dll
2019-03-13 17:53 - 2019-03-13 17:53 - 000195896 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\spacedump.sys
2019-03-13 17:53 - 2019-03-13 17:53 - 000178688 _____ (Microsoft Corporation) C:\WINDOWS\system32\winbio.dll
2019-03-13 17:53 - 2019-03-13 17:53 - 000171520 _____ (Microsoft Corporation) C:\WINDOWS\system32\SpatialAudioLicenseSrv.exe
2019-03-13 17:53 - 2019-03-13 17:53 - 000169784 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\wcifs.sys
2019-03-13 17:53 - 2019-03-13 17:53 - 000165376 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\spacebridge.dll
2019-03-13 17:53 - 2019-03-13 17:53 - 000156984 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\pdc.sys
2019-03-13 17:53 - 2019-03-13 17:53 - 000138960 _____ (Microsoft Corporation) C:\WINDOWS\system32\wldp.dll
2019-03-13 17:53 - 2019-03-13 17:53 - 000126464 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\winbio.dll
2019-03-13 17:53 - 2019-03-13 17:53 - 000120832 _____ (Microsoft Corporation) C:\WINDOWS\system32\UserDataTimeUtil.dll
2019-03-13 17:53 - 2019-03-13 17:53 - 000119296 _____ (Microsoft Corporation) C:\WINDOWS\system32\DolbyMATEnc.dll
2019-03-13 17:53 - 2019-03-13 17:53 - 000115152 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\wldp.dll
2019-03-13 17:53 - 2019-03-13 17:53 - 000104248 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\bindflt.sys
2019-03-13 17:53 - 2019-03-13 17:53 - 000095544 _____ (Microsoft Corporation) C:\WINDOWS\system32\rdpudd.dll
2019-03-13 17:53 - 2019-03-13 17:53 - 000095544 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\storqosflt.sys
2019-03-13 17:53 - 2019-03-13 17:53 - 000090424 _____ (Microsoft Corporation) C:\WINDOWS\system32\hvloader.dll
2019-03-13 17:53 - 2019-03-13 17:53 - 000054784 _____ (Microsoft Corporation) C:\WINDOWS\system32\CredentialMigrationHandler.dll
2019-03-13 17:53 - 2019-03-13 17:53 - 000046080 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\hidparse.sys
2019-03-13 17:53 - 2019-03-13 17:53 - 000044544 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\kbdhid.sys
2019-03-13 17:53 - 2019-03-13 17:53 - 000035640 _____ (Microsoft Corporation) C:\WINDOWS\system32\DeviceCensus.exe
2019-03-13 17:53 - 2019-03-13 17:53 - 000002560 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\tzres.dll
2019-03-13 17:53 - 2019-03-13 17:53 - 000002560 _____ (Microsoft Corporation) C:\WINDOWS\system32\tzres.dll
2019-03-13 17:53 - 2019-03-13 17:53 - 000000315 _____ C:\WINDOWS\system32\DrtmAuth8.bin
2019-03-13 17:53 - 2019-03-13 17:53 - 000000315 _____ C:\WINDOWS\system32\DrtmAuth7.bin
2019-03-13 17:53 - 2019-03-13 17:53 - 000000315 _____ C:\WINDOWS\system32\DrtmAuth6.bin
2019-03-13 17:53 - 2019-03-13 17:53 - 000000315 _____ C:\WINDOWS\system32\DrtmAuth5.bin
2019-03-13 17:53 - 2019-03-13 17:53 - 000000315 _____ C:\WINDOWS\system32\DrtmAuth4.bin
2019-03-13 17:53 - 2019-03-13 17:53 - 000000315 _____ C:\WINDOWS\system32\DrtmAuth3.bin
2019-03-13 17:53 - 2019-03-13 17:53 - 000000315 _____ C:\WINDOWS\system32\DrtmAuth2.bin
2019-03-13 17:53 - 2019-03-13 17:53 - 000000315 _____ C:\WINDOWS\system32\DrtmAuth1.bin
2019-03-12 07:52 - 2019-03-12 07:52 - 000001092 _____ C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Adobe Photoshop CC 2019.lnk
2019-03-05 22:44 - 2019-03-05 22:44 - 003137217 _____ C:\Users\user\Downloads\Sold_Postcards.zip
2019-03-04 21:39 - 2019-03-04 21:39 - 001047778 _____ C:\Users\user\Desktop\Contact List - Smires Agents_Staff (1).pdf
2019-03-02 18:04 - 2019-01-07 19:38 - 000205992 _____ (Lenovo Group Ltd.) C:\WINDOWS\system32\Lenovo.Modern.CoreTypes.dll
2019-03-02 18:04 - 2019-01-07 19:38 - 000130216 _____ (Lenovo Group Ltd.) C:\WINDOWS\system32\Lenovo.Modern.Utilities.dll
2019-03-02 18:04 - 2019-01-07 19:38 - 000097448 _____ (Lenovo Group Ltd.) C:\WINDOWS\system32\Lenovo.Modern.ImController.ImClient.dll
2019-03-02 18:04 - 2019-01-07 19:38 - 000043688 _____ (Lenovo Group Ltd.) C:\WINDOWS\system32\Lenovo.ImController.EventLogging.dll
2019-03-02 16:20 - 2019-03-02 16:22 - 000000000 ____D C:\WINDOWS\system32\config\bbimigrate
2019-03-02 16:19 - 2019-03-02 16:20 - 000000000 ____D C:\WINDOWS\ServiceProfiles
2019-03-02 16:19 - 2019-03-02 16:19 - 000008192 _____ C:\WINDOWS\system32\config\userdiff
2019-03-02 16:18 - 2019-03-02 16:18 - 011724288 _____ (Microsoft Corporation) C:\WINDOWS\system32\wmp.dll
2019-03-02 16:18 - 2019-03-02 16:18 - 009941504 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\wmp.dll
2019-03-02 16:18 - 2019-03-02 16:18 - 007724992 _____ (Microsoft Corporation) C:\WINDOWS\system32\Windows.Media.dll
2019-03-02 16:18 - 2019-03-02 16:18 - 006925824 _____ (Microsoft Corporation) C:\WINDOWS\system32\twinui.dll
2019-03-02 16:18 - 2019-03-02 16:18 - 006132736 _____ (Microsoft Corporation) C:\WINDOWS\system32\dbgeng.dll
2019-03-02 16:18 - 2019-03-02 16:18 - 005764608 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\twinui.dll
2019-03-02 16:18 - 2019-03-02 16:18 - 005561856 _____ (Microsoft Corporation) C:\WINDOWS\system32\StartTileData.dll
2019-03-02 16:18 - 2019-03-02 16:18 - 005527552 _____ (Microsoft Corporation) C:\WINDOWS\system32\InputService.dll
2019-03-02 16:18 - 2019-03-02 16:18 - 005205464 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\Windows.StateRepository.dll
2019-03-02 16:18 - 2019-03-02 16:18 - 005130752 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\dbgeng.dll
2019-03-02 16:18 - 2019-03-02 16:18 - 005112792 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\Windows.Media.dll
2019-03-02 16:18 - 2019-03-02 16:18 - 005086208 _____ (Microsoft Corporation) C:\WINDOWS\system32\wininet.dll
2019-03-02 16:18 - 2019-03-02 16:18 - 004991096 _____ (Microsoft Corporation) C:\WINDOWS\system32\Windows.StateRepository.dll
2019-03-02 16:18 - 2019-03-02 16:18 - 004702704 _____ (Microsoft Corporation) C:\WINDOWS\system32\setupapi.dll
2019-03-02 16:18 - 2019-03-02 16:18 - 004627456 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\wininet.dll
2019-03-02 16:18 - 2019-03-02 16:18 - 004526080 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\setupapi.dll
2019-03-02 16:18 - 2019-03-02 16:18 - 004488192 _____ (Microsoft Corporation) C:\WINDOWS\system32\xpsrchvw.exe
2019-03-02 16:18 - 2019-03-02 16:18 - 004298752 _____ (Microsoft Corporation) C:\WINDOWS\system32\SettingsHandlers_nt.dll
2019-03-02 16:18 - 2019-03-02 16:18 - 004019200 _____ (Microsoft Corporation) C:\WINDOWS\system32\SystemSettingsThresholdAdminFlowUI.dll
2019-03-02 16:18 - 2019-03-02 16:18 - 003952952 _____ (Microsoft Corporation) C:\WINDOWS\system32\Windows.Mirage.dll
2019-03-02 16:18 - 2019-03-02 16:18 - 003556352 _____ (Microsoft Corporation) C:\WINDOWS\system32\diagtrack.dll
2019-03-02 16:18 - 2019-03-02 16:18 - 003442176 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\xpsrchvw.exe
2019-03-02 16:18 - 2019-03-02 16:18 - 003338328 _____ (Microsoft Corporation) C:\WINDOWS\system32\combase.dll
2019-03-02 16:18 - 2019-03-02 16:18 - 003334144 _____ (Microsoft Corporation) C:\WINDOWS\system32\tquery.dll
2019-03-02 16:18 - 2019-03-02 16:18 - 003270144 _____ (Microsoft Corporation) C:\WINDOWS\system32\esent.dll
2019-03-02 16:18 - 2019-03-02 16:18 - 003092480 _____ (Microsoft Corporation) C:\WINDOWS\system32\DWrite.dll
2019-03-02 16:18 - 2019-03-02 16:18 - 002992640 _____ (Microsoft Corporation) C:\WINDOWS\system32\wuaueng.dll
2019-03-02 16:18 - 2019-03-02 16:18 - 002986352 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\Windows.Mirage.dll
2019-03-02 16:18 - 2019-03-02 16:18 - 002929152 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\esent.dll
2019-03-02 16:18 - 2019-03-02 16:18 - 002893312 _____ (Microsoft Corporation) C:\WINDOWS\system32\themeui.dll
2019-03-02 16:18 - 2019-03-02 16:18 - 002879488 _____ (Microsoft Corporation) C:\WINDOWS\system32\xpsservices.dll
2019-03-02 16:18 - 2019-03-02 16:18 - 002843136 _____ (Microsoft Corporation) C:\WINDOWS\system32\mssrch.dll
2019-03-02 16:18 - 2019-03-02 16:18 - 002832896 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\themeui.dll
2019-03-02 16:18 - 2019-03-02 16:18 - 002765312 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\tquery.dll
2019-03-02 16:18 - 2019-03-02 16:18 - 002654208 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\DWrite.dll
2019-03-02 16:18 - 2019-03-02 16:18 - 002618880 _____ (Microsoft Corporation) C:\WINDOWS\system32\WsmSvc.dll
2019-03-02 16:18 - 2019-03-02 16:18 - 002594872 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\combase.dll
2019-03-02 16:18 - 2019-03-02 16:18 - 002466304 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\WsmSvc.dll
2019-03-02 16:18 - 2019-03-02 16:18 - 002429752 _____ (Microsoft Corporation) C:\WINDOWS\system32\WMVCORE.DLL
2019-03-02 16:18 - 2019-03-02 16:18 - 002392576 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\AcGenral.dll
2019-03-02 16:18 - 2019-03-02 16:18 - 002346496 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\mssrch.dll
2019-03-02 16:18 - 2019-03-02 16:18 - 002298880 _____ (Microsoft Corporation) C:\WINDOWS\system32\ResetEngine.dll
2019-03-02 16:18 - 2019-03-02 16:18 - 002185728 _____ (Microsoft Corporation) C:\WINDOWS\system32\wlidsvc.dll
2019-03-02 16:18 - 2019-03-02 16:18 - 002160160 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\WMVCORE.DLL
2019-03-02 16:18 - 2019-03-02 16:18 - 002149368 _____ (Microsoft Corporation) C:\WINDOWS\system32\twinapi.appcore.dll
2019-03-02 16:18 - 2019-03-02 16:18 - 002086400 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\xpsservices.dll
2019-03-02 16:18 - 2019-03-02 16:18 - 002085376 _____ (Microsoft Corporation) C:\WINDOWS\system32\AudioEng.dll
2019-03-02 16:18 - 2019-03-02 16:18 - 001903616 _____ (Microsoft Corporation) C:\WINDOWS\system32\FntCache.dll
2019-03-02 16:18 - 2019-03-02 16:18 - 001824768 _____ (Microsoft Corporation) C:\WINDOWS\system32\aadtb.dll
2019-03-02 16:18 - 2019-03-02 16:18 - 001819136 _____ (Microsoft Corporation) C:\WINDOWS\system32\Windows.Media.Speech.dll
2019-03-02 16:18 - 2019-03-02 16:18 - 001797128 _____ (Microsoft Corporation) C:\WINDOWS\system32\WindowsCodecs.dll
2019-03-02 16:18 - 2019-03-02 16:18 - 001749504 _____ (Microsoft Corporation) C:\WINDOWS\system32\wwansvc.dll
2019-03-02 16:18 - 2019-03-02 16:18 - 001720936 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\twinapi.appcore.dll
2019-03-02 16:18 - 2019-03-02 16:18 - 001700880 _____ (Microsoft Corporation) C:\WINDOWS\system32\ContentDeliveryManager.Utilities.dll
2019-03-02 16:18 - 2019-03-02 16:18 - 001688576 _____ (Microsoft Corporation) C:\WINDOWS\system32\enterprisecsps.dll
2019-03-02 16:18 - 2019-03-02 16:18 - 001675712 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\user32.dll
2019-03-02 16:18 - 2019-03-02 16:18 - 001674480 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\ntdll.dll
2019-03-02 16:18 - 2019-03-02 16:18 - 001671864 _____ (Microsoft Corporation) C:\WINDOWS\system32\gdi32full.dll
2019-03-02 16:18 - 2019-03-02 16:18 - 001671680 _____ (Microsoft Corporation) C:\WINDOWS\system32\XpsPrint.dll
2019-03-02 16:18 - 2019-03-02 16:18 - 001664904 _____ (Microsoft Corporation) C:\WINDOWS\system32\user32.dll
2019-03-02 16:18 - 2019-03-02 16:18 - 001616384 _____ (Microsoft Corporation) C:\WINDOWS\system32\lsasrv.dll
2019-03-02 16:18 - 2019-03-02 16:18 - 001533440 _____ (Microsoft Corporation) C:\WINDOWS\system32\Windows.Globalization.dll
2019-03-02 16:18 - 2019-03-02 16:18 - 001520208 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\WindowsCodecs.dll
2019-03-02 16:18 - 2019-03-02 16:18 - 001476096 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\aadtb.dll
2019-03-02 16:18 - 2019-03-02 16:18 - 001467560 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\gdi32full.dll
2019-03-02 16:18 - 2019-03-02 16:18 - 001462272 _____ (Microsoft Corporation) C:\WINDOWS\system32\TokenBroker.dll
2019-03-02 16:18 - 2019-03-02 16:18 - 001446400 _____ (Microsoft Corporation) C:\WINDOWS\system32\mfc42u.dll
2019-03-02 16:18 - 2019-03-02 16:18 - 001415680 _____ (Microsoft Corporation) C:\WINDOWS\system32\mfc42.dll
2019-03-02 16:18 - 2019-03-02 16:18 - 001395248 _____ (Microsoft Corporation) C:\WINDOWS\system32\ole32.dll
2019-03-02 16:18 - 2019-03-02 16:18 - 001391096 _____ (Microsoft Corporation) C:\WINDOWS\system32\Taskmgr.exe
2019-03-02 16:18 - 2019-03-02 16:18 - 001387496 _____ (Microsoft Corporation) C:\WINDOWS\system32\WinTypes.dll
2019-03-02 16:18 - 2019-03-02 16:18 - 001315840 _____ (Microsoft Corporation) C:\WINDOWS\system32\wpx.dll
2019-03-02 16:18 - 2019-03-02 16:18 - 001314304 _____ (Microsoft Corporation) C:\WINDOWS\system32\NotificationController.dll
2019-03-02 16:18 - 2019-03-02 16:18 - 001311744 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\msjet40.dll
2019-03-02 16:18 - 2019-03-02 16:18 - 001294848 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\Windows.Media.Speech.dll
2019-03-02 16:18 - 2019-03-02 16:18 - 001287776 _____ (Microsoft Corporation) C:\WINDOWS\system32\Windows.UI.dll
2019-03-02 16:18 - 2019-03-02 16:18 - 001282640 _____ (Microsoft Corporation) C:\WINDOWS\system32\mfreadwrite.dll
2019-03-02 16:18 - 2019-03-02 16:18 - 001279024 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\Taskmgr.exe
2019-03-02 16:18 - 2019-03-02 16:18 - 001271608 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\ContentDeliveryManager.Utilities.dll
2019-03-02 16:18 - 2019-03-02 16:18 - 001254912 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\TokenBroker.dll
2019-03-02 16:18 - 2019-03-02 16:18 - 001249792 _____ (Microsoft Corporation) C:\WINDOWS\system32\SystemSettings.Handlers.dll
2019-03-02 16:18 - 2019-03-02 16:18 - 001221528 _____ (Microsoft Corporation) C:\WINDOWS\system32\ClipUp.exe
2019-03-02 16:18 - 2019-03-02 16:18 - 001209360 _____ (Microsoft Corporation) C:\WINDOWS\system32\drvstore.dll
2019-03-02 16:18 - 2019-03-02 16:18 - 001192448 _____ (Microsoft Corporation) C:\WINDOWS\system32\TSWorkspace.dll
2019-03-02 16:18 - 2019-03-02 16:18 - 001182720 _____ (Microsoft Corporation) C:\WINDOWS\system32\wscui.cpl
2019-03-02 16:18 - 2019-03-02 16:18 - 001168384 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\Windows.Globalization.dll
2019-03-02 16:18 - 2019-03-02 16:18 - 001166336 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\wscui.cpl
2019-03-02 16:18 - 2019-03-02 16:18 - 001162280 _____ (Microsoft Corporation) C:\WINDOWS\system32\Windows.Internal.Shell.Broker.dll
2019-03-02 16:18 - 2019-03-02 16:18 - 001110528 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\XpsPrint.dll
2019-03-02 16:18 - 2019-03-02 16:18 - 001064448 _____ (Microsoft Corporation) C:\WINDOWS\system32\sysmain.dll
2019-03-02 16:18 - 2019-03-02 16:18 - 001057976 _____ (Microsoft Corporation) C:\WINDOWS\system32\msmpeg2adec.dll
2019-03-02 16:18 - 2019-03-02 16:18 - 001057792 _____ (Microsoft Corporation) C:\WINDOWS\system32\SearchIndexer.exe
2019-03-02 16:18 - 2019-03-02 16:18 - 001051960 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\ClipSp.sys
2019-03-02 16:18 - 2019-03-02 16:18 - 001032704 _____ (Microsoft Corporation) C:\WINDOWS\system32\Windows.Security.Authentication.Web.Core.dll
2019-03-02 16:18 - 2019-03-02 16:18 - 001026992 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\ole32.dll
2019-03-02 16:18 - 2019-03-02 16:18 - 001024920 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\mfmpeg2srcsnk.dll
2019-03-02 16:18 - 2019-03-02 16:18 - 001022464 _____ (Microsoft Corporation) C:\WINDOWS\system32\Windows.Media.MixedRealityCapture.dll
2019-03-02 16:18 - 2019-03-02 16:18 - 001018880 _____ (Microsoft Corporation) C:\WINDOWS\system32\termsrv.dll
2019-03-02 16:18 - 2019-03-02 16:18 - 001010176 _____ (Microsoft Corporation) C:\WINDOWS\system32\refsutil.exe
2019-03-02 16:18 - 2019-03-02 16:18 - 001005568 _____ (Microsoft Corporation) C:\WINDOWS\system32\wuapi.dll
2019-03-02 16:18 - 2019-03-02 16:18 - 000998912 _____ (Microsoft Corporation) C:\WINDOWS\system32\kerberos.dll
2019-03-02 16:18 - 2019-03-02 16:18 - 000982576 _____ (Microsoft Corporation) C:\WINDOWS\system32\winhttp.dll
2019-03-02 16:18 - 2019-03-02 16:18 - 000972288 _____ (Microsoft Corporation) C:\WINDOWS\system32\StorSvc.dll
2019-03-02 16:18 - 2019-03-02 16:18 - 000970256 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\drvstore.dll
2019-03-02 16:18 - 2019-03-02 16:18 - 000964976 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\Windows.UI.dll
2019-03-02 16:18 - 2019-03-02 16:18 - 000956416 _____ (Microsoft Corporation) C:\WINDOWS\system32\MusUpdateHandlers.dll
2019-03-02 16:18 - 2019-03-02 16:18 - 000954368 _____ (Microsoft Corporation) C:\WINDOWS\system32\rasapi32.dll
2019-03-02 16:18 - 2019-03-02 16:18 - 000953856 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\TSWorkspace.dll
2019-03-02 16:18 - 2019-03-02 16:18 - 000949760 _____ (Microsoft Corporation) C:\WINDOWS\system32\Windows.Mirage.Internal.dll
2019-03-02 16:18 - 2019-03-02 16:18 - 000949248 _____ (Microsoft Corporation) C:\WINDOWS\system32\Windows.Internal.Management.dll
2019-03-02 16:18 - 2019-03-02 16:18 - 000947200 _____ (Microsoft Corporation) C:\WINDOWS\system32\uDWM.dll
2019-03-02 16:18 - 2019-03-02 16:18 - 000918304 _____ (Microsoft Corporation) C:\WINDOWS\system32\CoreMessaging.dll
2019-03-02 16:18 - 2019-03-02 16:18 - 000913920 _____ (Microsoft Corporation) C:\WINDOWS\system32\Microsoft.Graphics.Display.DisplayEnhancementService.dll
2019-03-02 16:18 - 2019-03-02 16:18 - 000901632 _____ (Microsoft Corporation) C:\WINDOWS\system32\schedsvc.dll
2019-03-02 16:18 - 2019-03-02 16:18 - 000890368 _____ (Microsoft Corporation) C:\WINDOWS\system32\Windows.Security.Authentication.OnlineId.dll
2019-03-02 16:18 - 2019-03-02 16:18 - 000889344 _____ (Microsoft Corporation) C:\WINDOWS\system32\PhoneService.dll
2019-03-02 16:18 - 2019-03-02 16:18 - 000883200 _____ (Microsoft Corporation) C:\WINDOWS\system32\CPFilters.dll
2019-03-02 16:18 - 2019-03-02 16:18 - 000882688 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\SearchIndexer.exe
2019-03-02 16:18 - 2019-03-02 16:18 - 000875008 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\rasapi32.dll
2019-03-02 16:18 - 2019-03-02 16:18 - 000870400 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\Windows.Media.MixedRealityCapture.dll
2019-03-02 16:18 - 2019-03-02 16:18 - 000864056 _____ (Microsoft Corporation) C:\WINDOWS\system32\SecurityHealthService.exe
2019-03-02 16:18 - 2019-03-02 16:18 - 000863752 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\dxgmms2.sys
2019-03-02 16:18 - 2019-03-02 16:18 - 000854784 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\msmpeg2adec.dll
2019-03-02 16:18 - 2019-03-02 16:18 - 000854016 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\wuapi.dll
2019-03-02 16:18 - 2019-03-02 16:18 - 000829440 _____ (Microsoft Corporation) C:\WINDOWS\system32\HologramCompositor.dll
2019-03-02 16:18 - 2019-03-02 16:18 - 000822448 _____ (Microsoft Corporation) C:\WINDOWS\system32\oleaut32.dll
2019-03-02 16:18 - 2019-03-02 16:18 - 000820736 _____ (Microsoft Corporation) C:\WINDOWS\system32\Windows.UI.Core.TextInput.dll
2019-03-02 16:18 - 2019-03-02 16:18 - 000818832 _____ (Microsoft Corporation) C:\WINDOWS\system32\windows.applicationmodel.datatransfer.dll
2019-03-02 16:18 - 2019-03-02 16:18 - 000803328 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\Windows.Security.Authentication.OnlineId.dll
2019-03-02 16:18 - 2019-03-02 16:18 - 000801792 _____ (Microsoft Corporation) C:\WINDOWS\system32\mssvp.dll
2019-03-02 16:18 - 2019-03-02 16:18 - 000800256 _____ (Microsoft Corporation) C:\WINDOWS\system32\uReFS.dll
2019-03-02 16:18 - 2019-03-02 16:18 - 000799568 _____ (Microsoft Corporation) C:\WINDOWS\system32\dnsapi.dll
2019-03-02 16:18 - 2019-03-02 16:18 - 000787456 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\Windows.Security.Authentication.Web.Core.dll
2019-03-02 16:18 - 2019-03-02 16:18 - 000773120 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\kerberos.dll
2019-03-02 16:18 - 2019-03-02 16:18 - 000765960 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\winhttp.dll
2019-03-02 16:18 - 2019-03-02 16:18 - 000762272 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\mfreadwrite.dll
2019-03-02 16:18 - 2019-03-02 16:18 - 000752136 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\vhdmp.sys
2019-03-02 16:18 - 2019-03-02 16:18 - 000742912 _____ (Microsoft Corporation) C:\WINDOWS\system32\SpaceControl.dll
2019-03-02 16:18 - 2019-03-02 16:18 - 000735232 _____ (Microsoft Corporation) C:\WINDOWS\system32\Windows.Web.dll
2019-03-02 16:18 - 2019-03-02 16:18 - 000729088 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\mssvp.dll
2019-03-02 16:18 - 2019-03-02 16:18 - 000701440 _____ (Microsoft Corporation) C:\WINDOWS\system32\FrameServer.dll
2019-03-02 16:18 - 2019-03-02 16:18 - 000700416 _____ (Microsoft Corporation) C:\WINDOWS\system32\SettingsHandlers_Language.dll
2019-03-02 16:18 - 2019-03-02 16:18 - 000690688 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\CPFilters.dll
2019-03-02 16:18 - 2019-03-02 16:18 - 000684544 _____ (Microsoft Corporation) C:\WINDOWS\system32\vpnike.dll
2019-03-02 16:18 - 2019-03-02 16:18 - 000681984 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\uReFS.dll
2019-03-02 16:18 - 2019-03-02 16:18 - 000681984 _____ (Microsoft Corporation) C:\WINDOWS\system32\ActivationManager.dll
2019-03-02 16:18 - 2019-03-02 16:18 - 000669184 _____ (Microsoft Corporation) C:\WINDOWS\system32\ApplicationFrame.dll
2019-03-02 16:18 - 2019-03-02 16:18 - 000663552 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\Windows.Internal.Management.dll
2019-03-02 16:18 - 2019-03-02 16:18 - 000663552 _____ (Microsoft Corporation) C:\WINDOWS\system32\PsmServiceExtHost.dll
2019-03-02 16:18 - 2019-03-02 16:18 - 000662528 ____R (Microsoft Corporation) C:\WINDOWS\system32\MixedRealityCapture.Pipeline.dll
2019-03-02 16:18 - 2019-03-02 16:18 - 000654848 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\Windows.Mirage.Internal.dll
2019-03-02 16:18 - 2019-03-02 16:18 - 000651304 _____ (Microsoft Corporation) C:\WINDOWS\system32\securekernel.exe
2019-03-02 16:18 - 2019-03-02 16:18 - 000629576 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\oleaut32.dll
2019-03-02 16:18 - 2019-03-02 16:18 - 000624640 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\apphelp.dll
2019-03-02 16:18 - 2019-03-02 16:18 - 000615936 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\Windows.UI.Core.TextInput.dll
2019-03-02 16:18 - 2019-03-02 16:18 - 000612368 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\storport.sys
2019-03-02 16:18 - 2019-03-02 16:18 - 000609792 _____ (Microsoft Corporation) C:\WINDOWS\system32\daxexec.dll
2019-03-02 16:18 - 2019-03-02 16:18 - 000604248 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\windows.applicationmodel.datatransfer.dll
2019-03-02 16:18 - 2019-03-02 16:18 - 000588304 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\netio.sys
2019-03-02 16:18 - 2019-03-02 16:18 - 000585728 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\ActivationManager.dll
2019-03-02 16:18 - 2019-03-02 16:18 - 000582240 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\CoreMessaging.dll
2019-03-02 16:18 - 2019-03-02 16:18 - 000580024 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\dnsapi.dll
2019-03-02 16:18 - 2019-03-02 16:18 - 000578560 _____ (Microsoft Corporation) C:\WINDOWS\system32\SppExtComObj.Exe
2019-03-02 16:18 - 2019-03-02 16:18 - 000577536 _____ (Microsoft Corporation) C:\WINDOWS\system32\netprofmsvc.dll
2019-03-02 16:18 - 2019-03-02 16:18 - 000577024 _____ (Microsoft Corporation) C:\WINDOWS\system32\HolographicExtensions.dll
2019-03-02 16:18 - 2019-03-02 16:18 - 000570368 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\Windows.Web.dll
2019-03-02 16:18 - 2019-03-02 16:18 - 000566584 _____ (Microsoft Corporation) C:\WINDOWS\system32\hal.dll
2019-03-02 16:18 - 2019-03-02 16:18 - 000556544 _____ (Microsoft Corporation) C:\WINDOWS\system32\BTAGService.dll
2019-03-02 16:18 - 2019-03-02 16:18 - 000553984 _____ (Microsoft Corporation) C:\WINDOWS\system32\apphelp.dll
2019-03-02 16:18 - 2019-03-02 16:18 - 000547840 _____ (Microsoft Corporation) C:\WINDOWS\system32\TileDataRepository.dll
2019-03-02 16:18 - 2019-03-02 16:18 - 000535048 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\mrxsmb.sys
2019-03-02 16:18 - 2019-03-02 16:18 - 000531976 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\mf.dll
2019-03-02 16:18 - 2019-03-02 16:18 - 000527872 _____ (Microsoft Corporation) C:\WINDOWS\system32\MusNotification.exe
2019-03-02 16:18 - 2019-03-02 16:18 - 000522312 _____ (Microsoft Corporation) C:\WINDOWS\system32\systemreset.exe
2019-03-02 16:18 - 2019-03-02 16:18 - 000519992 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\Vid.sys
2019-03-02 16:18 - 2019-03-02 16:18 - 000518656 _____ (Microsoft Corporation) C:\WINDOWS\system32\modernexecserver.dll
2019-03-02 16:18 - 2019-03-02 16:18 - 000516608 _____ (Microsoft Corporation) C:\WINDOWS\system32\ncsi.dll
2019-03-02 16:18 - 2019-03-02 16:18 - 000515584 _____ (Microsoft Corporation) C:\WINDOWS\system32\sppcext.dll
2019-03-02 16:18 - 2019-03-02 16:18 - 000514112 _____ (Microsoft Corporation) C:\WINDOWS\system32\policymanager.dll
2019-03-02 16:18 - 2019-03-02 16:18 - 000514048 _____ (Microsoft Corporation) C:\WINDOWS\system32\cdpusersvc.dll
2019-03-02 16:18 - 2019-03-02 16:18 - 000506408 _____ (Microsoft Corporation) C:\WINDOWS\system32\mf.dll
2019-03-02 16:18 - 2019-03-02 16:18 - 000500224 _____ (Microsoft Corporation) C:\WINDOWS\system32\SettingsHandlers_PCDisplay.dll
2019-03-02 16:18 - 2019-03-02 16:18 - 000496872 _____ (Microsoft Corporation) C:\WINDOWS\system32\SystemSettingsAdminFlows.exe
2019-03-02 16:18 - 2019-03-02 16:18 - 000494080 _____ (Microsoft Corporation) C:\WINDOWS\system32\Windows.Graphics.dll
2019-03-02 16:18 - 2019-03-02 16:18 - 000494080 _____ (Microsoft Corporation) C:\WINDOWS\system32\Windows.Data.Activities.dll
2019-03-02 16:18 - 2019-03-02 16:18 - 000492032 _____ (Microsoft Corporation) C:\WINDOWS\system32\defragsvc.dll
2019-03-02 16:18 - 2019-03-02 16:18 - 000487424 _____ (Microsoft Corporation) C:\WINDOWS\system32\PhotoMetadataHandler.dll
2019-03-02 16:18 - 2019-03-02 16:18 - 000478208 _____ (Microsoft Corporation) C:\WINDOWS\system32\wuuhext.dll
2019-03-02 16:18 - 2019-03-02 16:18 - 000473616 _____ (Microsoft Corporation) C:\WINDOWS\system32\bcdedit.exe
2019-03-02 16:18 - 2019-03-02 16:18 - 000469504 _____ (Microsoft Corporation) C:\WINDOWS\system32\profsvc.dll
2019-03-02 16:18 - 2019-03-02 16:18 - 000468992 _____ (Microsoft Corporation) C:\WINDOWS\system32\coml2.dll
2019-03-02 16:18 - 2019-03-02 16:18 - 000461824 _____ (Microsoft Corporation) C:\WINDOWS\system32\WpAXHolder.dll
2019-03-02 16:18 - 2019-03-02 16:18 - 000454144 _____ (Microsoft Corporation) C:\WINDOWS\system32\bdesvc.dll
2019-03-02 16:18 - 2019-03-02 16:18 - 000451072 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\policymanager.dll
2019-03-02 16:18 - 2019-03-02 16:18 - 000448000 _____ (Microsoft Corporation) C:\WINDOWS\system32\Windows.Graphics.Printing.Workflow.dll
2019-03-02 16:18 - 2019-03-02 16:18 - 000439296 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\dxgmms1.sys
2019-03-02 16:18 - 2019-03-02 16:18 - 000434176 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\TileDataRepository.dll
2019-03-02 16:18 - 2019-03-02 16:18 - 000433152 _____ (Microsoft Corporation) C:\WINDOWS\system32\SensorService.dll
2019-03-02 16:18 - 2019-03-02 16:18 - 000430904 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\Classpnp.sys
2019-03-02 16:18 - 2019-03-02 16:18 - 000429568 _____ (Microsoft Corporation) C:\WINDOWS\system32\zipfldr.dll
2019-03-02 16:18 - 2019-03-02 16:18 - 000429056 _____ (Microsoft Corporation) C:\WINDOWS\system32\MixedReality.Broker.dll
2019-03-02 16:18 - 2019-03-02 16:18 - 000427520 _____ (Microsoft Corporation) C:\WINDOWS\system32\MSFlacDecoder.dll
2019-03-02 16:18 - 2019-03-02 16:18 - 000424960 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\daxexec.dll
2019-03-02 16:18 - 2019-03-02 16:18 - 000421376 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\pci.sys
2019-03-02 16:18 - 2019-03-02 16:18 - 000420864 _____ (Microsoft Corporation) C:\WINDOWS\system32\SettingsEnvironment.Desktop.dll
2019-03-02 16:18 - 2019-03-02 16:18 - 000417792 _____ (Microsoft Corporation) C:\WINDOWS\system32\eeprov.dll
2019-03-02 16:18 - 2019-03-02 16:18 - 000415744 _____ (Microsoft Corporation) C:\WINDOWS\system32\SearchProtocolHost.exe
2019-03-02 16:18 - 2019-03-02 16:18 - 000408800 _____ (Microsoft Corporation) C:\WINDOWS\system32\mswsock.dll
2019-03-02 16:18 - 2019-03-02 16:18 - 000407040 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\Windows.Graphics.dll
2019-03-02 16:18 - 2019-03-02 16:18 - 000403968 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\PhotoMetadataHandler.dll
2019-03-02 16:18 - 2019-03-02 16:18 - 000402576 _____ (Microsoft Corporation) C:\WINDOWS\system32\SgrmEnclave.dll
2019-03-02 16:18 - 2019-03-02 16:18 - 000400384 _____ (Microsoft Corporation) C:\WINDOWS\system32\AboveLockAppHost.dll
2019-03-02 16:18 - 2019-03-02 16:18 - 000398848 _____ (Microsoft Corporation) C:\WINDOWS\system32\SensorsApi.dll
2019-03-02 16:18 - 2019-03-02 16:18 - 000398848 _____ (Microsoft Corporation) C:\WINDOWS\system32\iedkcs32.dll
2019-03-02 16:18 - 2019-03-02 16:18 - 000398416 _____ (Microsoft Corporation) C:\WINDOWS\system32\SgrmEnclave_secure.dll
2019-03-02 16:18 - 2019-03-02 16:18 - 000394752 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\AcLayers.dll
2019-03-02 16:18 - 2019-03-02 16:18 - 000394240 _____ (Microsoft Corporation) C:\WINDOWS\system32\Search.ProtocolHandler.MAPI2.dll
2019-03-02 16:18 - 2019-03-02 16:18 - 000388096 _____ (Microsoft Corporation) C:\WINDOWS\system32\MusNotificationUx.exe
2019-03-02 16:18 - 2019-03-02 16:18 - 000378368 _____ (Microsoft Corporation) C:\WINDOWS\system32\provengine.dll
2019-03-02 16:18 - 2019-03-02 16:18 - 000375544 _____ (Microsoft Corporation) C:\WINDOWS\system32\MusNotifyIcon.exe
2019-03-02 16:18 - 2019-03-02 16:18 - 000374784 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\zipfldr.dll
2019-03-02 16:18 - 2019-03-02 16:18 - 000373768 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\coml2.dll
2019-03-02 16:18 - 2019-03-02 16:18 - 000371712 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\MSFlacDecoder.dll
2019-03-02 16:18 - 2019-03-02 16:18 - 000371200 _____ (Microsoft Corporation) C:\WINDOWS\system32\Windows.System.Diagnostics.dll
2019-03-02 16:18 - 2019-03-02 16:18 - 000365056 _____ (Microsoft Corporation) C:\WINDOWS\system32\NotificationControllerPS.dll
2019-03-02 16:18 - 2019-03-02 16:18 - 000358400 _____ (Microsoft Corporation) C:\WINDOWS\regedit.exe
2019-03-02 16:18 - 2019-03-02 16:18 - 000352768 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\msrd3x40.dll
2019-03-02 16:18 - 2019-03-02 16:18 - 000349184 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\SearchProtocolHost.exe
2019-03-02 16:18 - 2019-03-02 16:18 - 000349184 _____ (Microsoft Corporation) C:\WINDOWS\system32\dnsrslvr.dll
2019-03-02 16:18 - 2019-03-02 16:18 - 000349184 _____ (Microsoft Corporation) C:\WINDOWS\system32\AcGenral.dll
2019-03-02 16:18 - 2019-03-02 16:18 - 000346624 _____ (Microsoft Corporation) C:\WINDOWS\system32\AppxAllUserStore.dll
2019-03-02 16:18 - 2019-03-02 16:18 - 000329728 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\AboveLockAppHost.dll
2019-03-02 16:18 - 2019-03-02 16:18 - 000329216 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\regedit.exe
2019-03-02 16:18 - 2019-03-02 16:18 - 000326144 _____ (Microsoft Corporation) C:\WINDOWS\system32\Windows.Cortana.OneCore.dll
2019-03-02 16:18 - 2019-03-02 16:18 - 000324408 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\mswsock.dll
2019-03-02 16:18 - 2019-03-02 16:18 - 000316416 _____ (Microsoft Corporation) C:\WINDOWS\system32\FSClient.dll
2019-03-02 16:18 - 2019-03-02 16:18 - 000314368 _____ (Microsoft Corporation) C:\WINDOWS\system32\AcLayers.dll
2019-03-02 16:18 - 2019-03-02 16:18 - 000312832 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\Windows.Graphics.Printing.Workflow.dll
2019-03-02 16:18 - 2019-03-02 16:18 - 000312832 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\SensorsApi.dll
2019-03-02 16:18 - 2019-03-02 16:18 - 000310784 _____ (Microsoft Corporation) C:\WINDOWS\system32\icsvcext.dll
2019-03-02 16:18 - 2019-03-02 16:18 - 000306704 _____ (Microsoft Corporation) C:\WINDOWS\system32\computestorage.dll
2019-03-02 16:18 - 2019-03-02 16:18 - 000305664 _____ (Microsoft Corporation) C:\WINDOWS\system32\rasppp.dll
2019-03-02 16:18 - 2019-03-02 16:18 - 000303616 _____ (Microsoft Corporation) C:\WINDOWS\system32\wc_storage.dll
2019-03-02 16:18 - 2019-03-02 16:18 - 000301096 _____ (Microsoft Corporation) C:\WINDOWS\system32\wmpeffects.dll
2019-03-02 16:18 - 2019-03-02 16:18 - 000300024 _____ (Microsoft Corporation) C:\WINDOWS\system32\icsvc.dll
2019-03-02 16:18 - 2019-03-02 16:18 - 000298296 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\sdbus.sys
2019-03-02 16:18 - 2019-03-02 16:18 - 000297984 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\Windows.System.Diagnostics.dll
2019-03-02 16:18 - 2019-03-02 16:18 - 000294072 _____ (Microsoft Corporation) C:\WINDOWS\system32\wscapi.dll
2019-03-02 16:18 - 2019-03-02 16:18 - 000290816 _____ (Microsoft Corporation) C:\WINDOWS\system32\wkssvc.dll
2019-03-02 16:18 - 2019-03-02 16:18 - 000289792 _____ (Microsoft Corporation) C:\WINDOWS\system32\provops.dll
2019-03-02 16:18 - 2019-03-02 16:18 - 000289792 _____ (Microsoft Corporation) C:\WINDOWS\system32\discan.dll
2019-03-02 16:18 - 2019-03-02 16:18 - 000286208 _____ (Microsoft Corporation) C:\WINDOWS\system32\wisp.dll
2019-03-02 16:18 - 2019-03-02 16:18 - 000284672 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\Search.ProtocolHandler.MAPI2.dll
2019-03-02 16:18 - 2019-03-02 16:18 - 000284160 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\rasppp.dll
2019-03-02 16:18 - 2019-03-02 16:18 - 000276488 _____ (Microsoft Corporation) C:\WINDOWS\system32\MTF.dll
2019-03-02 16:18 - 2019-03-02 16:18 - 000275768 _____ (Microsoft Corporation) C:\WINDOWS\system32\browserbroker.dll
2019-03-02 16:18 - 2019-03-02 16:18 - 000275456 _____ (Microsoft Corporation) C:\WINDOWS\system32\ubpm.dll
2019-03-02 16:18 - 2019-03-02 16:18 - 000273920 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\AppxAllUserStore.dll
2019-03-02 16:18 - 2019-03-02 16:18 - 000273408 _____ (Microsoft Corporation) C:\WINDOWS\system32\SystemEventsBrokerServer.dll
2019-03-02 16:18 - 2019-03-02 16:18 - 000266240 _____ (Microsoft Corporation) C:\WINDOWS\system32\provhandlers.dll
2019-03-02 16:18 - 2019-03-02 16:18 - 000256512 _____ (Microsoft Corporation) C:\WINDOWS\system32\prnntfy.dll
2019-03-02 16:18 - 2019-03-02 16:18 - 000252536 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\wscapi.dll
2019-03-02 16:18 - 2019-03-02 16:18 - 000251904 _____ (Microsoft Corporation) C:\WINDOWS\system32\HttpsDataSource.dll
2019-03-02 16:18 - 2019-03-02 16:18 - 000246784 _____ (Microsoft Corporation) C:\WINDOWS\system32\tetheringservice.dll
2019-03-02 16:18 - 2019-03-02 16:18 - 000241680 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\wmpeffects.dll
2019-03-02 16:18 - 2019-03-02 16:18 - 000241664 _____ (Microsoft Corporation) C:\WINDOWS\system32\psmsrv.dll
2019-03-02 16:18 - 2019-03-02 16:18 - 000241152 _____ (Microsoft Corporation) C:\WINDOWS\system32\ResetEngOnline.dll
2019-03-02 16:18 - 2019-03-02 16:18 - 000240640 _____ (Microsoft Corporation) C:\WINDOWS\system32\SearchFilterHost.exe
2019-03-02 16:18 - 2019-03-02 16:18 - 000228864 _____ (Microsoft Corporation) C:\WINDOWS\system32\provisioningcsp.dll
2019-03-02 16:18 - 2019-03-02 16:18 - 000226816 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\wisp.dll
2019-03-02 16:18 - 2019-03-02 16:18 - 000222720 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\prnntfy.dll
2019-03-02 16:18 - 2019-03-02 16:18 - 000218624 _____ (Microsoft Corporation) C:\WINDOWS\system32\wscinterop.dll
2019-03-02 16:18 - 2019-03-02 16:18 - 000218624 _____ (Microsoft Corporation) C:\WINDOWS\system32\wmpdxm.dll
2019-03-02 16:18 - 2019-03-02 16:18 - 000217600 _____ (Microsoft Corporation) C:\WINDOWS\system32\container.dll
2019-03-02 16:18 - 2019-03-02 16:18 - 000202552 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\MTF.dll
2019-03-02 16:18 - 2019-03-02 16:18 - 000201216 _____ (Microsoft Corporation) C:\WINDOWS\system32\wincredui.dll
2019-03-02 16:18 - 2019-03-02 16:18 - 000200192 _____ (Microsoft Corporation) C:\WINDOWS\system32\ACPBackgroundManagerPolicy.dll
2019-03-02 16:18 - 2019-03-02 16:18 - 000198144 _____ (Microsoft Corporation) C:\WINDOWS\system32\netiohlp.dll
2019-03-02 16:18 - 2019-03-02 16:18 - 000197120 _____ (Microsoft Corporation) C:\WINDOWS\system32\bthserv.dll
2019-03-02 16:18 - 2019-03-02 16:18 - 000195072 _____ (Microsoft Corporation) C:\WINDOWS\system32\Windows.StateRepositoryUpgrade.dll
2019-03-02 16:18 - 2019-03-02 16:18 - 000195072 _____ (Microsoft Corporation) C:\WINDOWS\system32\scrrun.dll
2019-03-02 16:18 - 2019-03-02 16:18 - 000193032 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\dumpsd.sys
2019-03-02 16:18 - 2019-03-02 16:18 - 000184320 _____ (Microsoft Corporation) C:\WINDOWS\system32\rasman.dll
2019-03-02 16:18 - 2019-03-02 16:18 - 000182784 _____ (Microsoft Corporation) C:\WINDOWS\system32\mssph.dll
2019-03-02 16:18 - 2019-03-02 16:18 - 000179712 _____ (Microsoft Corporation) C:\WINDOWS\system32\wuuhosdeployment.dll
2019-03-02 16:18 - 2019-03-02 16:18 - 000178696 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\ksecpkg.sys
2019-03-02 16:18 - 2019-03-02 16:18 - 000178176 _____ (Microsoft Corporation) C:\WINDOWS\system32\appsruprov.dll
2019-03-02 16:18 - 2019-03-02 16:18 - 000176440 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\partmgr.sys
2019-03-02 16:18 - 2019-03-02 16:18 - 000175104 _____ (Microsoft Corporation) C:\WINDOWS\system32\energyprov.dll
2019-03-02 16:18 - 2019-03-02 16:18 - 000175096 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\msgpioclx.sys
2019-03-02 16:18 - 2019-03-02 16:18 - 000173568 _____ (Microsoft Corporation) C:\WINDOWS\system32\WPTaskScheduler.dll
2019-03-02 16:18 - 2019-03-02 16:18 - 000171520 _____ (Microsoft Corporation) C:\WINDOWS\system32\DisplayManager.dll
2019-03-02 16:18 - 2019-03-02 16:18 - 000167424 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\wmpdxm.dll
2019-03-02 16:18 - 2019-03-02 16:18 - 000166400 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\wscinterop.dll
2019-03-02 16:18 - 2019-03-02 16:18 - 000165376 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\scrrun.dll
2019-03-02 16:18 - 2019-03-02 16:18 - 000165376 _____ (Microsoft Corporation) C:\WINDOWS\system32\CompPkgSrv.exe
2019-03-02 16:18 - 2019-03-02 16:18 - 000164344 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\storahci.sys
2019-03-02 16:18 - 2019-03-02 16:18 - 000164288 _____ (Microsoft Corporation) C:\WINDOWS\system32\vertdll.dll
2019-03-02 16:18 - 2019-03-02 16:18 - 000162304 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\Windows.StateRepositoryUpgrade.dll
2019-03-02 16:18 - 2019-03-02 16:18 - 000160256 _____ (Microsoft Corporation) C:\WINDOWS\system32\spopk.dll
2019-03-02 16:18 - 2019-03-02 16:18 - 000159744 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\wincredui.dll
2019-03-02 16:18 - 2019-03-02 16:18 - 000156672 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\rasman.dll
2019-03-02 16:18 - 2019-03-02 16:18 - 000155648 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\netiohlp.dll
2019-03-02 16:18 - 2019-03-02 16:18 - 000155648 _____ (Microsoft Corporation) C:\WINDOWS\system32\dssvc.dll
2019-03-02 16:18 - 2019-03-02 16:18 - 000151872 _____ (Microsoft Corporation) C:\WINDOWS\system32\rmclient.dll
2019-03-02 16:18 - 2019-03-02 16:18 - 000151040 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\container.dll
2019-03-02 16:18 - 2019-03-02 16:18 - 000148992 _____ (Microsoft Corporation) C:\WINDOWS\system32\CastingShellExt.dll
2019-03-02 16:18 - 2019-03-02 16:18 - 000148480 _____ C:\WINDOWS\system32\DataStoreCacheDumpTool.exe
2019-03-02 16:18 - 2019-03-02 16:18 - 000146888 _____ (Microsoft Corporation) C:\WINDOWS\system32\smss.exe
2019-03-02 16:18 - 2019-03-02 16:18 - 000146432 _____ (Microsoft Corporation) C:\WINDOWS\system32\mssprxy.dll
2019-03-02 16:18 - 2019-03-02 16:18 - 000144384 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\mssph.dll
2019-03-02 16:18 - 2019-03-02 16:18 - 000143872 _____ (Microsoft Corporation) C:\WINDOWS\system32\musdialoghandlers.dll
2019-03-02 16:18 - 2019-03-02 16:18 - 000140808 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\tm.sys
2019-03-02 16:18 - 2019-03-02 16:18 - 000140288 _____ (Microsoft Corporation) C:\WINDOWS\system32\Windows.Networking.NetworkOperators.HotspotAuthentication.dll
2019-03-02 16:18 - 2019-03-02 16:18 - 000139776 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\PrintWorkflowService.dll
2019-03-02 16:18 - 2019-03-02 16:18 - 000137216 _____ (Microsoft Corporation) C:\WINDOWS\system32\SpaceAgent.exe
2019-03-02 16:18 - 2019-03-02 16:18 - 000134144 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\CastingShellExt.dll
2019-03-02 16:18 - 2019-03-02 16:18 - 000132104 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\stornvme.sys
2019-03-02 16:18 - 2019-03-02 16:18 - 000129024 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\spopk.dll
2019-03-02 16:18 - 2019-03-02 16:18 - 000125440 _____ (Microsoft Corporation) C:\WINDOWS\system32\wmpshell.dll
2019-03-02 16:18 - 2019-03-02 16:18 - 000122368 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\DisplayManager.dll
2019-03-02 16:18 - 2019-03-02 16:18 - 000121872 _____ (Microsoft Corporation) C:\WINDOWS\system32\kdnet.dll
2019-03-02 16:18 - 2019-03-02 16:18 - 000120320 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\bthhfenum.sys
2019-03-02 16:18 - 2019-03-02 16:18 - 000119296 _____ (Microsoft Corporation) C:\WINDOWS\system32\setupcln.dll
2019-03-02 16:18 - 2019-03-02 16:18 - 000114856 _____ (Microsoft Corporation) C:\WINDOWS\system32\CompPkgSup.dll
2019-03-02 16:18 - 2019-03-02 16:18 - 000114344 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\rmclient.dll
2019-03-02 16:18 - 2019-03-02 16:18 - 000111104 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\bthenum.sys
2019-03-02 16:18 - 2019-03-02 16:18 - 000109568 _____ (Microsoft Corporation) C:\WINDOWS\system32\dab.dll
2019-03-02 16:18 - 2019-03-02 16:18 - 000104960 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\Windows.Networking.NetworkOperators.HotspotAuthentication.dll
2019-03-02 16:18 - 2019-03-02 16:18 - 000104960 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\setupcln.dll
2019-03-02 16:18 - 2019-03-02 16:18 - 000098816 ____R (Microsoft Corporation) C:\WINDOWS\system32\MixedRealityCapture.Broker.dll
2019-03-02 16:18 - 2019-03-02 16:18 - 000097592 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\dam.sys
2019-03-02 16:18 - 2019-03-02 16:18 - 000096768 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\wmpshell.dll
2019-03-02 16:18 - 2019-03-02 16:18 - 000094224 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\fileinfo.sys
2019-03-02 16:18 - 2019-03-02 16:18 - 000094208 _____ (Microsoft Corporation) C:\WINDOWS\system32\provdatastore.dll
2019-03-02 16:18 - 2019-03-02 16:18 - 000093696 _____ (Microsoft Corporation) C:\WINDOWS\system32\nlahc.dll
2019-03-02 16:18 - 2019-03-02 16:18 - 000092672 _____ (Microsoft Corporation) C:\WINDOWS\system32\PktMon.exe
2019-03-02 16:18 - 2019-03-02 16:18 - 000092160 _____ (Microsoft Corporation) C:\WINDOWS\system32\nlaapi.dll
2019-03-02 16:18 - 2019-03-02 16:18 - 000092160 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\wanarp.sys
2019-03-02 16:18 - 2019-03-02 16:18 - 000091424 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\CompPkgSup.dll
2019-03-02 16:18 - 2019-03-02 16:18 - 000090112 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\volmgr.sys
2019-03-02 16:18 - 2019-03-02 16:18 - 000087552 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\wcnfs.sys
2019-03-02 16:18 - 2019-03-02 16:18 - 000086528 _____ (Microsoft Corporation) C:\WINDOWS\system32\nslookup.exe
2019-03-02 16:18 - 2019-03-02 16:18 - 000083472 _____ (Microsoft Corporation) C:\WINDOWS\system32\vid.dll
2019-03-02 16:18 - 2019-03-02 16:18 - 000083456 _____ (Microsoft Corporation) C:\WINDOWS\system32\provtool.exe
2019-03-02 16:18 - 2019-03-02 16:18 - 000080400 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\vpci.sys
2019-03-02 16:18 - 2019-03-02 16:18 - 000078848 _____ (Microsoft Corporation) C:\WINDOWS\system32\ProvSysprep.dll
2019-03-02 16:18 - 2019-03-02 16:18 - 000077824 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\nslookup.exe
2019-03-02 16:18 - 2019-03-02 16:18 - 000077824 _____ (Microsoft Corporation) C:\WINDOWS\system32\offreg.dll
2019-03-02 16:18 - 2019-03-02 16:18 - 000077824 _____ (Microsoft Corporation) C:\WINDOWS\system32\iscsiwmi.dll
2019-03-02 16:18 - 2019-03-02 16:18 - 000075776 _____ (Microsoft Corporation) C:\WINDOWS\system32\SMSRouter.dll
2019-03-02 16:18 - 2019-03-02 16:18 - 000075264 _____ (Microsoft Corporation) C:\WINDOWS\system32\WSManMigrationPlugin.dll
2019-03-02 16:18 - 2019-03-02 16:18 - 000074424 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\WindowsTrustedRT.sys
2019-03-02 16:18 - 2019-03-02 16:18 - 000071168 _____ (Microsoft Corporation) C:\WINDOWS\system32\fdBth.dll
2019-03-02 16:18 - 2019-03-02 16:18 - 000070144 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\nlaapi.dll
2019-03-02 16:18 - 2019-03-02 16:18 - 000067584 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\iscsiwmi.dll
2019-03-02 16:18 - 2019-03-02 16:18 - 000063488 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\WSManMigrationPlugin.dll
2019-03-02 16:18 - 2019-03-02 16:18 - 000062464 _____ (Microsoft Corporation) C:\WINDOWS\system32\umpo-overrides.dll
2019-03-02 16:18 - 2019-03-02 16:18 - 000059392 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\fdBth.dll
2019-03-02 16:18 - 2019-03-02 16:18 - 000058880 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\offreg.dll
2019-03-02 16:18 - 2019-03-02 16:18 - 000056320 _____ (Microsoft Corporation) C:\WINDOWS\system32\msscntrs.dll
2019-03-02 16:18 - 2019-03-02 16:18 - 000055608 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\iorate.sys
2019-03-02 16:18 - 2019-03-02 16:18 - 000051712 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\mmcss.sys
2019-03-02 16:18 - 2019-03-02 16:18 - 000047136 _____ (Microsoft Corporation) C:\WINDOWS\system32\browser_broker.exe
2019-03-02 16:18 - 2019-03-02 16:18 - 000041984 _____ (Microsoft Corporation) C:\WINDOWS\system32\lpkinstall.exe
2019-03-02 16:18 - 2019-03-02 16:18 - 000039936 _____ (Microsoft Corporation) C:\WINDOWS\system32\npmproxy.dll
2019-03-02 16:18 - 2019-03-02 16:18 - 000039304 _____ (Microsoft Corporation) C:\WINDOWS\system32\NtlmShared.dll
2019-03-02 16:18 - 2019-03-02 16:18 - 000036864 _____ (Microsoft Corporation) C:\WINDOWS\system32\wpnsruprov.dll
2019-03-02 16:18 - 2019-03-02 16:18 - 000036864 _____ (Microsoft Corporation) C:\WINDOWS\system32\perfts.dll
2019-03-02 16:18 - 2019-03-02 16:18 - 000033280 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\WSManHTTPConfig.exe
2019-03-02 16:18 - 2019-03-02 16:18 - 000033056 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\NtlmShared.dll
2019-03-02 16:18 - 2019-03-02 16:18 - 000032768 _____ (Microsoft Corporation) C:\WINDOWS\system32\WSManHTTPConfig.exe
2019-03-02 16:18 - 2019-03-02 16:18 - 000030208 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\perfts.dll
2019-03-02 16:18 - 2019-03-02 16:18 - 000030208 _____ (Microsoft Corporation) C:\WINDOWS\system32\msisip.dll
2019-03-02 16:18 - 2019-03-02 16:18 - 000024064 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\msisip.dll
2019-03-02 16:18 - 2019-03-02 16:18 - 000021504 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\npmproxy.dll
2019-03-02 16:18 - 2019-03-02 16:18 - 000000072 _____ C:\WINDOWS\system32\edgehtmlpluginpolicy.bin
2019-03-02 16:16 - 2019-03-02 16:16 - 001167960 _____ (Microsoft Corporation) C:\WINDOWS\system32\PresentationNative_v0300.dll
2019-03-02 16:16 - 2019-03-02 16:16 - 000922112 _____ (Microsoft Corporation) C:\WINDOWS\system32\XpsFilt.dll
2019-03-02 16:16 - 2019-03-02 16:16 - 000780376 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\PresentationNative_v0300.dll
2019-03-02 16:16 - 2019-03-02 16:16 - 000595968 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\XpsFilt.dll
2019-03-02 16:16 - 2019-03-02 16:16 - 000126064 _____ (Microsoft Corporation) C:\WINDOWS\system32\PresentationCFFRasterizerNative_v0300.dll
2019-03-02 16:16 - 2019-03-02 16:16 - 000104560 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\PresentationCFFRasterizerNative_v0300.dll
2019-03-02 16:16 - 2019-03-02 16:16 - 000099328 _____ (Microsoft Corporation) C:\WINDOWS\system32\XPSSHHDR.dll
2019-03-02 16:16 - 2019-03-02 16:16 - 000081408 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\XPSSHHDR.dll
2019-03-02 16:16 - 2019-03-02 16:16 - 000076060 _____ C:\WINDOWS\SysWOW64\xpsrchvw.xml
2019-03-02 16:16 - 2019-03-02 16:16 - 000076060 _____ C:\WINDOWS\system32\xpsrchvw.xml
2019-03-02 16:16 - 2019-03-02 16:16 - 000036896 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\TsWpfWrp.exe
2019-03-02 16:16 - 2019-03-02 16:16 - 000035440 _____ (Microsoft Corporation) C:\WINDOWS\system32\TsWpfWrp.exe
2019-03-02 16:16 - 2019-03-02 16:16 - 000000000 ____D C:\Program Files\Reference Assemblies
2019-03-02 16:16 - 2019-03-02 16:16 - 000000000 ____D C:\Program Files\MSBuild
2019-03-02 16:16 - 2019-03-02 16:16 - 000000000 ____D C:\Program Files (x86)\Reference Assemblies
2019-03-02 16:16 - 2019-03-02 16:16 - 000000000 ____D C:\Program Files (x86)\MSBuild
2019-03-02 13:31 - 2019-03-25 23:59 - 000842664 _____ C:\WINDOWS\system32\PerfStringBackup.INI
2019-03-02 13:31 - 2019-03-02 13:31 - 000000000 ____D C:\ProgramData\Microsoft OneDrive
2019-03-02 13:30 - 2019-03-02 13:30 - 000000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Dolby
2019-03-02 13:30 - 2019-03-02 13:30 - 000000000 ____D C:\ProgramData\Dolby
2019-03-02 13:30 - 2019-03-02 13:30 - 000000000 ____D C:\Program Files\Dolby
2019-03-02 13:29 - 2019-03-25 23:53 - 000000006 ____H C:\WINDOWS\Tasks\SA.DAT
2019-03-02 13:29 - 2019-03-25 21:57 - 000004162 _____ C:\WINDOWS\System32\Tasks\User_Feed_Synchronization-{8F64D61C-7D50-49F0-A569-657BFAFDD7F8}
2019-03-02 13:29 - 2019-03-20 20:56 - 000003248 _____ C:\WINDOWS\System32\Tasks\HPCeeScheduleForuser
2019-03-02 13:29 - 2019-03-09 22:22 - 000003372 _____ C:\WINDOWS\System32\Tasks\OneDrive Standalone Update Task-S-1-5-21-93585695-1239137162-3987457199-1001
2019-03-02 13:29 - 2019-03-02 13:33 - 000000000 ____D C:\WINDOWS\System32\Tasks\Hewlett-Packard
2019-03-02 13:29 - 2019-03-02 13:29 - 000003760 _____ C:\WINDOWS\System32\Tasks\Adobe Flash Player PPAPI Notifier
2019-03-02 13:29 - 2019-03-02 13:29 - 000003482 _____ C:\WINDOWS\System32\Tasks\Adobe Acrobat Update Task
2019-03-02 13:29 - 2019-03-02 13:29 - 000003450 _____ C:\WINDOWS\System32\Tasks\DropboxUpdateTaskMachineUA
2019-03-02 13:29 - 2019-03-02 13:29 - 000003446 _____ C:\WINDOWS\System32\Tasks\Adobe Flash Player Updater
2019-03-02 13:29 - 2019-03-02 13:29 - 000003346 _____ C:\WINDOWS\System32\Tasks\GoogleUpdateTaskMachineUA
2019-03-02 13:29 - 2019-03-02 13:29 - 000003226 _____ C:\WINDOWS\System32\Tasks\DropboxUpdateTaskMachineCore
2019-03-02 13:29 - 2019-03-02 13:29 - 000003122 _____ C:\WINDOWS\System32\Tasks\GoogleUpdateTaskMachineCore
2019-03-02 13:29 - 2019-03-02 13:29 - 000002852 _____ C:\WINDOWS\System32\Tasks\OneDrive Standalone Update Task-S-1-5-21-93585695-1239137162-3987457199-1003
2019-03-02 13:29 - 2019-03-02 13:29 - 000002814 _____ C:\WINDOWS\System32\Tasks\AdobeGCInvoker-1.0-DESKTOP-49PEJRG-user
2019-03-02 13:29 - 2019-03-02 13:29 - 000002768 _____ C:\WINDOWS\System32\Tasks\AdobeAAMUpdater-1.0-DESKTOP-49PEJRG-user
2019-03-02 13:29 - 2019-03-02 13:29 - 000002524 _____ C:\WINDOWS\System32\Tasks\HPLJCustParticipation
2019-03-02 13:29 - 2019-03-02 13:29 - 000000020 ___SH C:\Users\user\ntuser.ini
2019-03-02 13:29 - 2019-03-02 13:29 - 000000000 ____D C:\WINDOWS\System32\Tasks\McAfee
2019-03-02 13:29 - 2019-03-02 13:29 - 000000000 ____D C:\WINDOWS\System32\Tasks\Lenovo
2019-03-02 13:28 - 2019-03-02 13:29 - 000011433 _____ C:\WINDOWS\diagwrn.xml
2019-03-02 13:28 - 2019-03-02 13:29 - 000011433 _____ C:\WINDOWS\diagerr.xml
2019-03-02 13:25 - 2019-03-02 13:25 - 000001576 _____ C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Windows Media Player.lnk
2019-03-02 13:25 - 2019-03-02 13:25 - 000000000 ____D C:\ProgramData\USOShared
2019-03-02 13:24 - 2019-03-09 22:22 - 000002367 _____ C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\OneDrive.lnk
2019-03-02 13:24 - 2019-03-02 13:26 - 000000000 ____D C:\Users\Someone Else
2019-03-02 13:24 - 2019-03-02 13:24 - 000002141 _____ C:\Users\Public\Desktop\3D Vision Photo Viewer.lnk
2019-03-02 13:24 - 2019-03-02 13:24 - 000000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\NVIDIA Corporation
2019-03-02 13:24 - 2019-03-02 13:24 - 000000000 ____D C:\Program Files (x86)\VulkanRT
2019-03-02 13:24 - 2018-09-15 03:29 - 000001105 _____ C:\Users\Someone Else\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\OneDrive.lnk
2019-03-02 13:24 - 2018-02-13 14:46 - 000541456 _____ (Khronos Group) C:\WINDOWS\system32\OpenCL.dll
2019-03-02 13:24 - 2018-02-13 14:46 - 000447248 _____ (Khronos Group) C:\WINDOWS\SysWOW64\OpenCL.dll
2019-03-02 13:24 - 2017-12-18 22:51 - 000137200 _____ (NVIDIA Corporation) C:\WINDOWS\SysWOW64\nvStreaming.exe
2019-03-02 13:24 - 2017-09-13 19:20 - 000798008 _____ C:\WINDOWS\SysWOW64\vulkan-1.dll
2019-03-02 13:24 - 2017-09-13 19:20 - 000490296 _____ C:\WINDOWS\SysWOW64\vulkaninfo.exe
2019-03-02 13:24 - 2017-09-13 19:19 - 000927544 _____ C:\WINDOWS\system32\vulkan-1.dll
2019-03-02 13:24 - 2017-09-13 19:19 - 000591160 _____ C:\WINDOWS\system32\vulkaninfo.exe
2019-03-02 13:23 - 2019-03-25 23:53 - 000000000 ____D C:\WINDOWS\system32\SleepStudy
2019-03-02 13:23 - 2019-03-19 00:05 - 000568680 _____ C:\WINDOWS\system32\FNTCACHE.DAT
2019-03-02 13:23 - 2019-03-13 17:53 - 002865152 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\PrintConfig.dll
2019-02-26 00:32 - 2019-02-26 00:32 - 000095427 _____ C:\Users\user\Downloads\Aurulent Sans-FontZillion.zip
2019-02-26 00:32 - 2019-02-26 00:32 - 000000000 ____D C:\Users\user\Downloads\Aurulent Sans-FontZillion
 
==================== One month (modified) ========
 
(If an entry is included in the fixlist, the file/folder will be moved.)
 
2019-03-26 00:01 - 2018-09-16 23:48 - 000062234 _____ C:\WINDOWS\ZAM_Guard.krnl.trace
2019-03-26 00:01 - 2018-05-27 06:27 - 000027491 _____ C:\Users\user\Downloads\FRST.txt
2019-03-26 00:01 - 2018-05-27 06:27 - 000000000 ____D C:\FRST
2019-03-25 23:59 - 2018-09-15 03:31 - 000000000 ____D C:\WINDOWS\INF
2019-03-25 23:54 - 2018-01-24 23:38 - 000000000 ___RD C:\Users\user\Creative Cloud Files
2019-03-25 23:54 - 2018-01-24 23:33 - 000000000 ____D C:\Users\user\AppData\Local\Adobe
2019-03-25 23:53 - 2018-09-16 23:24 - 000000000 ____D C:\Program Files (x86)\TotalAV
2019-03-25 23:53 - 2018-09-15 03:33 - 000000000 ____D C:\ProgramData\regid.1991-06.com.microsoft
2019-03-25 23:53 - 2017-02-25 15:43 - 000000000 ____D C:\ProgramData\NVIDIA
2019-03-25 23:42 - 2018-01-24 17:48 - 000000000 ____D C:\Users\user\AppData\Local\PlaceholderTileLogoFolder
2019-03-25 23:36 - 2018-01-22 17:35 - 000000000 ____D C:\Users\user\AppData\Local\Packages
2019-03-25 23:35 - 2018-09-15 02:09 - 000786432 _____ C:\WINDOWS\system32\config\BBI
2019-03-25 21:58 - 2018-09-15 03:33 - 000000000 ___HD C:\Program Files\WindowsApps
2019-03-25 21:58 - 2018-09-15 03:33 - 000000000 ____D C:\WINDOWS\AppReadiness
2019-03-25 21:57 - 2018-04-06 08:25 - 000000000 ____D C:\Users\user\AppData\Local\HP
2019-03-25 21:55 - 2018-01-24 22:44 - 000002308 _____ C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Google Chrome.lnk
2019-03-25 21:55 - 2018-01-24 22:44 - 000002267 _____ C:\Users\Public\Desktop\Google Chrome.lnk
2019-03-24 09:17 - 2018-01-26 00:56 - 000000000 ____D C:\Users\user\Documents\smires
2019-03-24 08:41 - 2018-09-15 03:23 - 000000000 ____D C:\WINDOWS\CbsTemp
2019-03-24 08:41 - 2018-09-15 02:09 - 000000000 ____D C:\WINDOWS\servicing
2019-03-24 08:14 - 2019-02-20 08:54 - 000000360 _____ C:\WINDOWS\Tasks\HPCeeScheduleForuser.job
2019-03-19 22:09 - 2018-04-12 21:25 - 000000000 ____D C:\Program Files (x86)\Dropbox
2019-03-19 00:09 - 2018-01-24 23:42 - 000000000 ____D C:\Users\user\Documents\Adobe
2019-03-19 00:05 - 2018-01-22 17:43 - 000592616 ____N (Microsoft Corporation) C:\WINDOWS\system32\MpSigStub.exe
2019-03-19 00:05 - 2018-01-22 17:39 - 000000000 ___RD C:\Users\user\3D Objects
2019-03-19 00:05 - 2017-02-25 15:06 - 000000000 ____D C:\Program Files (x86)\Microsoft Office
2019-03-19 00:05 - 2016-07-29 13:27 - 000000000 __RHD C:\Users\Public\AccountPictures
2019-03-19 00:04 - 2018-09-15 03:33 - 000000000 ___RD C:\Program Files\Windows Defender
2019-03-19 00:04 - 2018-09-15 03:33 - 000000000 ____D C:\WINDOWS\TextInput
2019-03-19 00:04 - 2018-09-15 03:33 - 000000000 ____D C:\WINDOWS\system32\oobe
2019-03-19 00:04 - 2018-09-15 03:33 - 000000000 ____D C:\WINDOWS\system32\appraiser
2019-03-19 00:04 - 2018-09-15 03:33 - 000000000 ____D C:\WINDOWS\ShellExperiences
2019-03-19 00:04 - 2018-09-15 03:33 - 000000000 ____D C:\WINDOWS\bcastdvr
2019-03-16 23:24 - 2018-03-21 12:34 - 000000000 ____D C:\Users\user\AppData\Local\File Viewer Plus
2019-03-15 05:37 - 2018-01-22 16:34 - 000000000 ____D C:\Users\user\AppData\Roaming\Adobe
2019-03-13 17:53 - 2018-09-15 03:28 - 000806560 _____ C:\WINDOWS\SysWOW64\locale.nls
2019-03-13 17:52 - 2018-09-15 03:28 - 000806560 _____ C:\WINDOWS\system32\locale.nls
2019-03-13 17:51 - 2018-09-15 03:36 - 000835480 _____ (Adobe Systems Incorporated) C:\WINDOWS\SysWOW64\FlashPlayerApp.exe
2019-03-13 17:51 - 2018-09-15 03:36 - 000179608 _____ (Adobe Systems Incorporated) C:\WINDOWS\SysWOW64\FlashPlayerCPLApp.cpl
2019-03-13 17:51 - 2018-01-22 17:42 - 000000000 ____D C:\WINDOWS\system32\MRT
2019-03-13 17:50 - 2018-01-22 17:42 - 127411920 ____C (Microsoft Corporation) C:\WINDOWS\system32\MRT.exe
2019-03-12 07:53 - 2018-01-24 23:38 - 000000000 ____D C:\Program Files\Adobe
2019-03-12 07:48 - 2018-07-10 00:22 - 000001413 _____ C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Adobe Creative Cloud.lnk
2019-03-12 07:48 - 2018-07-10 00:22 - 000001401 _____ C:\Users\Public\Desktop\Adobe Creative Cloud.lnk
2019-03-12 07:48 - 2018-01-24 23:33 - 000000000 ____D C:\Program Files (x86)\Adobe
2019-03-10 21:25 - 2018-04-19 20:34 - 000000000 ____D C:\Users\user\Documents\Scanned Documents
2019-03-09 22:22 - 2018-01-22 16:36 - 000000000 ___RD C:\Users\user\OneDrive
2019-03-04 03:54 - 2018-09-15 02:09 - 000032768 _____ C:\WINDOWS\system32\config\ELAM
2019-03-03 22:44 - 2018-01-26 00:56 - 000001190 _____ C:\Users\user\Desktop\socialmedia.txt
2019-03-03 22:32 - 2018-09-15 03:33 - 000000000 ____D C:\WINDOWS\appcompat
2019-03-02 16:22 - 2019-02-12 01:24 - 000000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\HP Help and Support
2019-03-02 16:22 - 2018-12-03 10:26 - 000000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\FileZilla FTP Client
2019-03-02 16:22 - 2018-09-15 03:36 - 000000000 ____D C:\WINDOWS\Setup
2019-03-02 16:22 - 2018-09-15 03:33 - 000000000 ____D C:\WINDOWS\Web
2019-03-02 16:22 - 2018-09-15 03:33 - 000000000 ____D C:\WINDOWS\SysWOW64\Macromed
2019-03-02 16:22 - 2018-09-15 03:33 - 000000000 ____D C:\WINDOWS\system32\WinBioDatabase
2019-03-02 16:22 - 2018-09-15 03:33 - 000000000 ____D C:\WINDOWS\system32\spool
2019-03-02 16:22 - 2018-09-15 03:33 - 000000000 ____D C:\WINDOWS\system32\NDF
2019-03-02 16:22 - 2018-09-15 03:33 - 000000000 ____D C:\WINDOWS\system32\Macromed
2019-03-02 16:22 - 2018-09-15 03:33 - 000000000 ____D C:\WINDOWS\Registration
2019-03-02 16:22 - 2018-09-15 03:33 - 000000000 ____D C:\WINDOWS\Help
2019-03-02 16:22 - 2018-09-15 03:33 - 000000000 ____D C:\Program Files\Common Files\microsoft shared
2019-03-02 16:22 - 2018-09-15 03:31 - 000028672 _____ C:\WINDOWS\system32\config\BCD-Template
2019-03-02 16:22 - 2018-09-03 21:48 - 000000000 ____D C:\WINDOWS\SysWOW64\1033
2019-03-02 16:22 - 2018-09-03 21:48 - 000000000 ____D C:\WINDOWS\system32\1033
2019-03-02 16:22 - 2018-05-27 20:15 - 000000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Revo Uninstaller
2019-03-02 16:22 - 2018-04-11 19:38 - 000000000 ____D C:\WINDOWS\system32\Tasks_Migrated
2019-03-02 16:22 - 2018-04-06 08:24 - 000000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\HP
2019-03-02 16:22 - 2018-03-21 12:34 - 000000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\File Viewer Plus
2019-03-02 16:22 - 2018-01-26 01:25 - 000000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Backup and Sync from Google
2019-03-02 16:22 - 2018-01-24 23:55 - 000000000 ____D C:\ProgramData\regid.1986-12.com.adobe
2019-03-02 16:22 - 2017-02-25 15:45 - 000000000 ____D C:\WINDOWS\system32\ihvmanager
2019-03-02 16:22 - 2017-02-25 15:43 - 000000000 ___RD C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Intel
2019-03-02 16:22 - 2017-02-25 15:43 - 000000000 ____D C:\Program Files\Intel
2019-03-02 16:22 - 2017-02-25 15:43 - 000000000 ____D C:\Program Files (x86)\NVIDIA Corporation
2019-03-02 16:22 - 2017-02-25 15:12 - 000000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Lenovo
2019-03-02 16:22 - 2017-02-25 15:07 - 000000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Microsoft Office 2016 Tools
2019-03-02 16:22 - 2016-07-16 07:47 - 000000000 ___HD C:\WINDOWS\system32\GroupPolicy
2019-03-02 16:21 - 2018-09-15 03:33 - 000000000 __RHD C:\Users\Public\Libraries
2019-03-02 16:21 - 2018-04-11 19:38 - 000000000 ____D C:\WINDOWS\InfusedApps
2019-03-02 16:20 - 2018-09-15 03:33 - 000000000 ____D C:\WINDOWS\Resources
2019-03-02 16:20 - 2018-03-17 23:46 - 000000000 ____D C:\WINDOWS\system32\Drivers\Lenovo
2019-03-02 16:20 - 2017-02-25 15:44 - 000000000 ____D C:\Program Files\Realtek
2019-03-02 16:19 - 2018-09-15 05:11 - 000000000 ____D C:\Program Files\Windows Photo Viewer
2019-03-02 16:19 - 2018-09-15 05:11 - 000000000 ____D C:\Program Files (x86)\Windows Photo Viewer
2019-03-02 16:19 - 2018-09-15 03:33 - 000000000 ___SD C:\WINDOWS\system32\DiagSvcs
2019-03-02 16:19 - 2018-09-15 03:33 - 000000000 ____D C:\WINDOWS\SysWOW64\oobe
2019-03-02 16:19 - 2018-09-15 03:33 - 000000000 ____D C:\WINDOWS\SysWOW64\Dism
2019-03-02 16:19 - 2018-09-15 03:33 - 000000000 ____D C:\WINDOWS\system32\migwiz
2019-03-02 16:19 - 2018-09-15 03:33 - 000000000 ____D C:\WINDOWS\ShellComponents
2019-03-02 16:19 - 2018-09-15 02:09 - 000000000 ____D C:\WINDOWS\system32\Dism
2019-03-02 16:16 - 2018-09-15 03:33 - 000000000 ____D C:\WINDOWS\SysWOW64\lv-LV
2019-03-02 16:16 - 2018-09-15 03:33 - 000000000 ____D C:\WINDOWS\SysWOW64\lt-LT
2019-03-02 16:16 - 2018-09-15 03:33 - 000000000 ____D C:\WINDOWS\SysWOW64\et-EE
2019-03-02 16:16 - 2018-09-15 03:33 - 000000000 ____D C:\WINDOWS\SysWOW64\es-MX
2019-03-02 16:16 - 2018-09-15 03:33 - 000000000 ____D C:\WINDOWS\system32\lv-LV
2019-03-02 16:16 - 2018-09-15 03:33 - 000000000 ____D C:\WINDOWS\system32\lt-LT
2019-03-02 16:16 - 2018-09-15 03:33 - 000000000 ____D C:\WINDOWS\system32\et-EE
2019-03-02 16:16 - 2018-09-15 03:33 - 000000000 ____D C:\WINDOWS\system32\es-MX
2019-03-02 13:45 - 2018-06-14 22:15 - 000000000 ____D C:\ProgramData\Packages
2019-03-02 13:33 - 2018-01-24 17:47 - 000000000 ____D C:\ProgramData\Hewlett-Packard
2019-03-02 13:30 - 2017-02-25 15:44 - 000000000 ____D C:\WINDOWS\SysWOW64\RTCOM
2019-03-02 13:30 - 2017-02-25 15:44 - 000000000 ____D C:\WINDOWS\system32\DAX2
2019-03-02 13:29 - 2019-02-21 11:15 - 000000000 ___DC C:\WINDOWS\Panther
2019-03-02 13:29 - 2018-04-12 21:25 - 000000936 _____ C:\WINDOWS\Tasks\DropboxUpdateTaskMachineUA.job
2019-03-02 13:29 - 2018-04-12 21:25 - 000000932 _____ C:\WINDOWS\Tasks\DropboxUpdateTaskMachineCore.job
2019-03-02 13:29 - 2018-01-22 16:34 - 000000000 ____D C:\Users\user\AppData\Local\ConnectedDevicesPlatform
2019-03-02 13:27 - 2018-09-15 03:33 - 000000000 ___RD C:\WINDOWS\PrintDialog
2019-03-02 13:25 - 2018-09-15 03:33 - 000000000 ____D C:\ProgramData\USOPrivate
2019-03-02 13:25 - 2018-08-11 12:56 - 000000000 ____D C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\JPEG Autorotate
2019-03-02 13:24 - 2018-06-14 19:54 - 000000000 ____D C:\Users\Someone Else\AppData\Local\Packages
2019-03-02 13:24 - 2017-02-25 15:43 - 000000000 ____D C:\ProgramData\NVIDIA Corporation
2019-03-02 13:23 - 2018-09-15 03:33 - 000000000 ____D C:\WINDOWS\ServiceState
2019-03-02 13:23 - 2017-02-25 15:43 - 000000000 ____D C:\Program Files\NVIDIA Corporation
2019-03-02 13:23 - 2017-02-25 15:42 - 000000000 ____D C:\WINDOWS\SysWOW64\sda
2019-03-01 11:50 - 2018-01-22 16:39 - 000000000 ____D C:\Program Files\rempl
 
==================== Files in the root of some directories =======
 
2018-01-28 18:02 - 2018-12-14 01:45 - 000000033 _____ () C:\Users\user\AppData\Roaming\AdobeWLCMCache.dat
2018-01-24 22:26 - 2018-01-24 22:26 - 000073634 _____ () C:\Users\user\AppData\Roaming\Gabim
2018-08-16 02:42 - 2018-11-05 22:32 - 000000028 _____ () C:\Users\user\AppData\Roaming\kulerdata.json
2018-01-27 03:26 - 2018-01-28 03:26 - 000000052 _____ () C:\Users\user\AppData\Local\bpDLTbpDLT
2018-09-26 01:08 - 2018-09-26 01:08 - 000000000 _____ () C:\Users\user\AppData\Local\oobelibMkey.log
2018-12-03 10:55 - 2018-12-03 10:59 - 000000600 _____ () C:\Users\user\AppData\Local\PUTTY.RND
 
==================== Bamital & volsnap ======================
 
(There is no automatic fix for files that do not pass verification.)
 
C:\WINDOWS\system32\winlogon.exe => File is digitally signed
C:\WINDOWS\system32\wininit.exe => File is digitally signed
C:\WINDOWS\explorer.exe => File is digitally signed
C:\WINDOWS\SysWOW64\explorer.exe => File is digitally signed
C:\WINDOWS\system32\svchost.exe => File is digitally signed
C:\WINDOWS\SysWOW64\svchost.exe => File is digitally signed
C:\WINDOWS\system32\services.exe => File is digitally signed
C:\WINDOWS\system32\User32.dll => File is digitally signed
C:\WINDOWS\SysWOW64\User32.dll => File is digitally signed
C:\WINDOWS\system32\userinit.exe => File is digitally signed
C:\WINDOWS\SysWOW64\userinit.exe => File is digitally signed
C:\WINDOWS\system32\rpcss.dll => File is digitally signed
C:\WINDOWS\system32\dnsapi.dll => File is digitally signed
C:\WINDOWS\SysWOW64\dnsapi.dll => File is digitally signed
C:\WINDOWS\system32\dllhost.exe => File is digitally signed
C:\WINDOWS\SysWOW64\dllhost.exe => File is digitally signed
C:\WINDOWS\system32\Drivers\volsnap.sys => File is digitally signed
 
==================== End of FRST.txt ============================
Additional scan result of Farbar Recovery Scan Tool (x64) Version: 17.03.2019
Ran by [removed] (26-03-2019 00:02:02)
Running from C:\Users\[removed]\Downloads
Windows 10 Home Version 1809 17763.379 (X64) (2019-03-02 17:29:25)
Boot Mode: Normal
==========================================================
 
 
==================== Accounts: =============================
 
Administrator (S-1-5-21-93585695-1239137162-3987457199-500 - Administrator - Disabled)
DefaultAccount (S-1-5-21-93585695-1239137162-3987457199-503 - Limited - Disabled)
Guest (S-1-5-21-93585695-1239137162-3987457199-501 - Limited - Disabled)
Someone Else (S-1-5-21-93585695-1239137162-3987457199-1003 - Limited - Enabled) => C:\Users\Someone Else
user (S-1-5-21-93585695-1239137162-3987457199-1001 - Administrator - Enabled) => C:\Users\user
WDAGUtilityAccount (S-1-5-21-93585695-1239137162-3987457199-504 - Limited - Disabled)
 
==================== Security Center ========================
 
(If an entry is included in the fixlist, it will be removed.)
 
AV: Windows Defender (Disabled - Up to date) {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
AV: Total AV (Enabled - Up to date) {AC3490DF-B2AE-610F-9290-A5E6E0CD5323}
AS: Total AV (Enabled - Up to date) {1755713B-9494-6E81-A820-9E949B4A199E}
AS: Windows Defender (Disabled - Up to date) {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
 
==================== Installed Programs ======================
 
(Only the adware programs with "Hidden" flag could be added to the fixlist to unhide them. The adware programs should be uninstalled manually.)
 
64 Bit HP CIO Components Installer (HKLM\…\{345F3F90-0505-4EDF-B7A9-5E3AC1AC6CE4}) (Version: 15.2.1 - Hewlett-Packard) Hidden
Adobe Acrobat DC (HKLM-x32\…\{AC76BA86-1033-FFFF-7760-0C0F074E4100}) (Version: 19.010.20098 - Adobe Systems Incorporated)
Adobe Creative Cloud (HKLM-x32\…\Adobe Creative Cloud) (Version: 4.8.1.435 - Adobe Systems Incorporated)
Adobe Dreamweaver CC 2019 (HKLM-x32\…\DRWV_19_0_1) (Version: 19.0.1 - Adobe Systems Incorporated)
Adobe Illustrator CC 2019 (HKLM-x32\…\ILST_23_0_2) (Version: 23.0.2 - Adobe Systems Incorporated)
Adobe InDesign CC 2018 (HKLM-x32\…\IDSN_13_1) (Version: 13.1 - Adobe Systems Incorporated)
Adobe InDesign CC 2019 (HKLM-x32\…\IDSN_14_0_1) (Version: 14.0.1 - Adobe Systems Incorporated)
Adobe Photoshop CC 2018 (HKLM-x32\…\PHSP_19_1_8) (Version: 19.1.8 - Adobe Systems Incorporated)
Adobe Photoshop CC 2019 (HKLM-x32\…\PHSP_20_0_4) (Version: 20.0.4 - Adobe Systems Incorporated)
Backup and Sync from Google (HKLM\…\{693CADB0-962B-4AC1-A939-9524B258C997}) (Version: 3.43.2448.9071 - Google, Inc.)
Dolby Audio X2 Windows API SDK (HKLM\…\{AA950AA4-CD9B-4D81-B6C0-BFABB7A24261}) (Version: 0.7.5.65 - Dolby Laboratories, Inc.)
Dolby Audio X2 Windows APP (HKLM\…\{DBC4388A-9417-41DB-85CF-DF4993B84D5A}) (Version: 0.7.5.67 - Dolby Laboratories, Inc.)
Dropbox (HKLM-x32\…\Dropbox) (Version: 69.4.102 - Dropbox, Inc.)
Dropbox Update Helper (HKLM-x32\…\{099218A5-A723-43DC-8DB5-6173656A1E94}) (Version: 1.3.189.1 - Dropbox, Inc.) Hidden
File Identifier (HKLM-x32\…\{C257E434-E8F1-4E06-A616-598E4933553E}_is1) (Version: 1.0.11 - Sharpened Productions)
File Viewer Plus (HKLM-x32\…\{C8B24B83-920A-446E-B027-38F72C9D8898}_is1) (Version: 2.2.1 - Sharpened Productions)
FileZilla Client 3.39.0 (HKLM-x32\…\FileZilla Client) (Version: 3.39.0 - Tim Kosse)
GlanceGuest version 4.2.0.38 (HKLM-x32\…\{F5AC5408-CC29-47C0-AD53-1BBBF268B364}_is1) (Version: 4.2.0.38 - Glance Networks, Inc.)
Google Chrome (HKLM-x32\…\Google Chrome) (Version: 73.0.3683.86 - Google Inc.)
Google Update Helper (HKLM-x32\…\{60EC980A-BDA2-4CB6-A427-B07A5498B4CA}) (Version: 1.3.33.23 - Google Inc.) Hidden
HP Color LaserJet Pro MFP M476 (HKLM-x32\…\{4b849805-3b07-4b35-874a-705c0d103672}) (Version: 15.0.16077.631 - Hewlett-Packard)
HP Support Assistant (HKLM-x32\…\{1E14ACF0-1480-4467-A73D-67C4FD35A5F4}) (Version: 8.7.50.3 - HP Inc.)
HP Support Solutions Framework (HKLM-x32\…\{EBD077C6-0032-4309-AA04-C67836D717DA}) (Version: 12.10.49.21 - HP Inc.)
HP Update (HKLM-x32\…\{912D30CF-F39E-4B31-AD9A-123C6B794EE2}) (Version: 5.005.002.002 - Hewlett-Packard)
HPCLJProMFPM476 (HKLM-x32\…\{C44C593D-3009-4D03-910E-243050C5E193}) (Version: 0.05.0000 - Hewlett-Packard)
HPDXP (HKLM-x32\…\{6BAA82C9-42B6-4B7D-A490-23EAC0E70C17}) (Version: 3.0.26.15 - HP) Hidden
HPLJDXPHelper (HKLM-x32\…\{010788AB-706E-4604-A46B-6785EAB64B5E}) (Version: 140.069.007 - HP) Hidden
HPLJUTCore (HKLM-x32\…\{06C9D648-CFC6-48CC-A11B-C4A21BEDDAF1}) (Version: [removed] - HP) Hidden
HPLJUTM476 (HKLM-x32\…\{92AB9371-D327-4D56-9BDD-B38A671A631D}) (Version: [removed] - HP) Hidden
hppLaserJetService (HKLM-x32\…\{0C4C3664-157A-4D69-B474-31EBF2EE1AE3}) (Version: 009.033.00926 - Hewlett-Packard) Hidden
hppM476LaserJetService (HKLM-x32\…\{CD86BE42-2844-4A15-A487-0F60CAB31664}) (Version: 001.034.00634 - Hewlett-Packard) Hidden
hpStatusAlerts (HKLM-x32\…\{32DE03E8-D0B3-4D13-A885-D3EDFC959EEC}) (Version: 180.040.00267 - HP Development Company, L.P.) Hidden
hpStatusAlertsM476 (HKLM-x32\…\{C864CA6F-3A1D-45B5-A115-C8D47CAE3845}) (Version: 100.046.00121 - Hewlett-Packard) Hidden
Intel(R) Chipset Device Software (HKLM-x32\…\{bb0592a7-5772-4736-9d55-2402740085db}) (Version: 10.1.1.38 - Intel(R) Corporation) Hidden
Intel(R) Rapid Storage Technology (HKLM\…\{409CB30E-E457-4008-9B1A-ED1B9EA21140}) (Version: 15.2.0.1020 - Intel Corporation)
Intel(R) Serial IO (HKLM\…\{9FD91C5C-44AE-4D9D-85BE-AE52816B0294}) (Version: 30.100.1519.7 - Intel Corporation)
JPEG-EXIF_autorotate (HKLM-x32\…\JPEG-EXIF_autorotate) (Version:  - )
Lenovo Blacksilk USB Keyboard Driver (HKLM-x32\…\{B266E062-D6C5-485B-B426-51B152B041A6}) (Version: V1.6.13.0724 - Lenovo)
Lenovo Nerve Center (HKLM-x32\…\{7E58C73E-30D0-4944-952C-6F29AADC38E9}) (Version: 1.50.1010 - Lenovo) Hidden
Lenovo Nerve Center (HKLM-x32\…\{93EA1F94-3617-47CE-9EB2-B8DC3AC0B880}) (Version: 1.50.1010 - Lenovo)
LJDXPHelperUI (HKLM-x32\…\{DEB23FB1-04FF-44AC-98B5-EEB243D65A28}) (Version: 140.069.007 - HP) Hidden
Manual (HKLM-x32\…\{A79C1D34-2831-4A5D-91C7-279EF892B5CF}) (Version: 2.02.0813 - Lenovo)
Microsoft ODBC Driver 13 for SQL Server (HKLM\…\{2D98CD18-5754-4D94-B7E8-E6E11DAA56B1}) (Version: 13.0.811.168 - Microsoft Corporation)
Microsoft Office 365 ProPlus - en-us (HKLM\…\O365ProPlusRetail - en-us) (Version: 16.0.11328.20158 - Microsoft Corporation)
Microsoft OneDrive (HKU\S-1-5-21-93585695-1239137162-3987457199-1001\…\OneDriveSetup.exe) (Version: 19.012.0121.0011 - Microsoft Corporation)
Microsoft Visual C++ 2005 Redistributable (HKLM-x32\…\{7299052b-02a4-4627-81f2-1818da5d550d}) (Version: 8.0.56336 - Microsoft Corporation)
Microsoft Visual C++ 2005 Redistributable (x64) (HKLM\…\{071c9b48-7c32-4621-a0ac-3f809523288f}) (Version: 8.0.56336 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.17 (HKLM\…\{8220EEFE-38CD-377E-8595-13398D740ACE}) (Version: 9.0.30729 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17 (HKLM-x32\…\{9A25302D-30C0-39D9-BD6F-21E6EC160475}) (Version: 9.0.30729 - Microsoft Corporation)
Microsoft Visual C++ 2010  x64 Redistributable - 10.0.40219 (HKLM\…\{1D8E6291-B0D5-35EC-8441-6616F567A0F7}) (Version: 10.0.40219 - Microsoft Corporation)
Microsoft Visual C++ 2010  x86 Redistributable - 10.0.40219 (HKLM-x32\…\{F0C3E5D1-1ADE-321E-8167-68EF0DE699A5}) (Version: 10.0.40219 - Microsoft Corporation)
Microsoft Visual C++ 2012 Redistributable (x64) - 11.0.61030 (HKLM-x32\…\{ca67548a-5ebe-413a-b50c-4b9ceb6d66c6}) (Version: 11.0.61030.0 - Microsoft Corporation)
Microsoft Visual C++ 2012 Redistributable (x86) - 11.0.61030 (HKLM-x32\…\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}) (Version: 11.0.61030.0 - Microsoft Corporation)
Microsoft Visual C++ 2013 Redistributable (x64) - 12.0.30501 (HKLM-x32\…\{050d4fc8-5d48-4b8f-8972-47c82c46020f}) (Version: 12.0.30501.0 - Microsoft Corporation)
Microsoft Visual C++ 2013 Redistributable (x64) - 12.0.40660 (HKLM-x32\…\{ef6b00ec-13e1-4c25-9064-b2f383cb8412}) (Version: 12.0.40660.0 - Microsoft Corporation)
Microsoft Visual C++ 2013 Redistributable (x86) - 12.0.30501 (HKLM-x32\…\{f65db027-aff3-4070-886a-0d87064aabb1}) (Version: 12.0.30501.0 - Microsoft Corporation)
Microsoft Visual C++ 2013 Redistributable (x86) - 12.0.40660 (HKLM-x32\…\{61087a79-ac85-455c-934d-1fa22cc64f36}) (Version: 12.0.40660.0 - Microsoft Corporation)
Microsoft Visual C++ 2017 Redistributable (x64) - 14.15.26706 (HKLM-x32\…\{95ac1cfa-f4fb-4d1b-8912-7f9d5fbb140d}) (Version: 14.15.26706.0 - Microsoft Corporation)
Microsoft Visual C++ 2017 Redistributable (x86) - 14.15.26706 (HKLM-x32\…\{7e9fae12-5bbf-47fb-b944-09c49e75c061}) (Version: 14.15.26706.0 - Microsoft Corporation)
Mozilla Firefox 63.0.3 (x64 en-US) (HKLM\…\Mozilla Firefox 63.0.3 (x64 en-US)) (Version: 63.0.3 - Mozilla)
NVIDIA 3D Vision Driver 388.73 (HKLM\…\{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_Display.3DVision) (Version: 388.73 - NVIDIA Corporation)
NVIDIA Graphics Driver 388.73 (HKLM\…\{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_Display.Driver) (Version: 388.73 - NVIDIA Corporation)
NVIDIA HD Audio Driver 1.3.36.6 (HKLM\…\{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_HDAudio.Driver) (Version: 1.3.36.6 - NVIDIA Corporation)
NVIDIA PhysX System Software 9.16.0318 (HKLM\…\{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_Display.PhysX) (Version: 9.16.0318 - NVIDIA Corporation)
Office 16 Click-to-Run Extensibility Component (HKLM-x32\…\{90160000-008C-0000-0000-0000000FF1CE}) (Version: 16.0.11328.20158 - Microsoft Corporation) Hidden
Office 16 Click-to-Run Extensibility Component 64-bit Registration (HKLM\…\{90160000-00DD-0000-1000-0000000FF1CE}) (Version: 16.0.11328.20158 - Microsoft Corporation) Hidden
Office 16 Click-to-Run Licensing Component (HKLM\…\{90160000-008F-0000-1000-0000000FF1CE}) (Version: 16.0.11328.20158 - Microsoft Corporation) Hidden
Office 16 Click-to-Run Localization Component (HKLM-x32\…\{90160000-008C-0409-0000-0000000FF1CE}) (Version: 16.0.11328.20158 - Microsoft Corporation) Hidden
psqlODBC_x64 (HKLM\…\{3D4F4C5A-28C7-441D-81DC-2AA2C1A61B6A}) (Version: 09.06.0201 - PostgreSQL Global Development Group)
Qualcomm Atheros 11ac Wireless LAN Installer (HKLM-x32\…\{20CA507E-24AA-4741-87CF-CC1B250790B7}) (Version: 11.0.10332 - Qualcomm Atheros)
Qualcomm Atheros Bluetooth Installer (64) (HKLM\…\{628988B4-3FA5-4EA6-BAA3-DA640F6718BD}) (Version: 10.0.0.242 - Qualcomm Atheros)
Realtek Card Reader (HKLM-x32\…\{5BC2B5AB-80DE-4E83-B8CF-426902051D0A}) (Version: 10.0.10240.31217 - Realtek Semiconductor Corp.)
Realtek Ethernet Controller All-In-One Windows Driver (HKLM-x32\…\{F7E7F0CB-AA41-4D5A-B6F2-8E6738EB063F}) (Version: 10.1.505.2015 - Realtek)
Revo Uninstaller 2.0.5 (HKLM\…\{A28DBDA2-3CC7-4ADC-8BFE-66D7743C6C97}_is1) (Version: 2.0.5 - VS Revo Group, Ltd.)
Top Producer Editor (HKLM-x32\…\Top Producer Editor_is1) (Version:  - )
TotalAV (HKLM-x32\…\TotalAV) (Version: 4.9.36 - TotalAV)
Update for Windows 10 for x64-based Systems (KB4023057) (HKLM\…\{1FD817A6-63E1-4519-BFD4-228DABB7AB6B}) (Version: 2.55.0.0 - Microsoft Corporation)
Vulkan Run Time Libraries 1.0.61.0 (HKLM\…\VulkanRT1.0.61.0) (Version: 1.0.61.0 - LunarG, Inc.) Hidden
Windows 10 Update Assistant (HKLM-x32\…\{D5C69738-B486-402E-85AC-2456D98A64E4}) (Version: 1.4.9200.22329 - Microsoft Corporation)
 
==================== Custom CLSID (Whitelisted): ==========================
 
(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)
 
CustomCLSID: HKU\S-1-5-21-93585695-1239137162-3987457199-1001_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6} -> [OneDrive] => {a52bba46-e9e1-435f-b3d9-28daa648c0f6}
CustomCLSID: HKU\S-1-5-21-93585695-1239137162-3987457199-1001_Classes\CLSID\{0E270DAA-1BE6-48F2-AC49-A53DA100DCA5} -> [Creative Cloud Files] => C:\Users\user\Creative Cloud Files [2018-01-24 23:38]
CustomCLSID: HKU\S-1-5-21-93585695-1239137162-3987457199-1001_Classes\CLSID\{E31EA727-12ED-4702-820C-4B6445F28E1A} -> [Dropbox] => C:\Users\user\Dropbox [2018-04-12 21:29]
CustomCLSID: HKU\S-1-5-21-93585695-1239137162-3987457199-1001_Classes\CLSID\{e8c77137-e224-5791-b6e9-ff0305797a13}\InprocServer32 -> C:\Program Files (x86)\Adobe\Adobe Creative Cloud\Utils\npAdobeAAMDetect64.dll (Adobe Systems Incorporated -> Adobe Systems)
ShellIconOverlayIdentifiers: [   AccExtIco1] -> {AB9CF9F8-8A96-4F9D-BF21-CE85714C3A47} => C:\Program Files (x86)\Common Files\Adobe\CoreSyncExtension\CoreSync_x64.dll [2018-03-05] (Adobe Systems Incorporated -> )
ShellIconOverlayIdentifiers: [   AccExtIco2] -> {853B7E05-C47D-4985-909A-D0DC5C6D7303} => C:\Program Files (x86)\Common Files\Adobe\CoreSyncExtension\CoreSync_x64.dll [2018-03-05] (Adobe Systems Incorporated -> )
ShellIconOverlayIdentifiers: [   AccExtIco3] -> {42D38F2E-98E9-4382-B546-E24E4D6D04BB} => C:\Program Files (x86)\Common Files\Adobe\CoreSyncExtension\CoreSync_x64.dll [2018-03-05] (Adobe Systems Incorporated -> )
ShellIconOverlayIdentifiers: [   DropboxExt01] -> {FB314ED9-A251-47B7-93E1-CDD82E34AF8B} => C:\Program Files (x86)\Dropbox\Client\DropboxExt64.27.0.dll [2019-03-19] (Dropbox, Inc -> Dropbox, Inc.)
ShellIconOverlayIdentifiers: [   DropboxExt02] -> {FB314EDF-A251-47B7-93E1-CDD82E34AF8B} => C:\Program Files (x86)\Dropbox\Client\DropboxExt64.27.0.dll [2019-03-19] (Dropbox, Inc -> Dropbox, Inc.)
ShellIconOverlayIdentifiers: [   DropboxExt03] -> {FB314EE1-A251-47B7-93E1-CDD82E34AF8B} => C:\Program Files (x86)\Dropbox\Client\DropboxExt64.27.0.dll [2019-03-19] (Dropbox, Inc -> Dropbox, Inc.)
ShellIconOverlayIdentifiers: [   DropboxExt04] -> {FB314EDB-A251-47B7-93E1-CDD82E34AF8B} => C:\Program Files (x86)\Dropbox\Client\DropboxExt64.27.0.dll [2019-03-19] (Dropbox, Inc -> Dropbox, Inc.)
ShellIconOverlayIdentifiers: [   DropboxExt05] -> {FB314EDA-A251-47B7-93E1-CDD82E34AF8B} => C:\Program Files (x86)\Dropbox\Client\DropboxExt64.27.0.dll [2019-03-19] (Dropbox, Inc -> Dropbox, Inc.)
ShellIconOverlayIdentifiers: [   DropboxExt06] -> {FB314EDC-A251-47B7-93E1-CDD82E34AF8B} => C:\Program Files (x86)\Dropbox\Client\DropboxExt64.27.0.dll [2019-03-19] (Dropbox, Inc -> Dropbox, Inc.)
ShellIconOverlayIdentifiers: [   DropboxExt07] -> {FB314EDD-A251-47B7-93E1-CDD82E34AF8B} => C:\Program Files (x86)\Dropbox\Client\DropboxExt64.27.0.dll [2019-03-19] (Dropbox, Inc -> Dropbox, Inc.)
ShellIconOverlayIdentifiers: [   DropboxExt08] -> {FB314EE0-A251-47B7-93E1-CDD82E34AF8B} => C:\Program Files (x86)\Dropbox\Client\DropboxExt64.27.0.dll [2019-03-19] (Dropbox, Inc -> Dropbox, Inc.)
ShellIconOverlayIdentifiers: [   DropboxExt09] -> {FB314EE2-A251-47B7-93E1-CDD82E34AF8B} => C:\Program Files (x86)\Dropbox\Client\DropboxExt64.27.0.dll [2019-03-19] (Dropbox, Inc -> Dropbox, Inc.)
ShellIconOverlayIdentifiers: [   DropboxExt10] -> {FB314EDE-A251-47B7-93E1-CDD82E34AF8B} => C:\Program Files (x86)\Dropbox\Client\DropboxExt64.27.0.dll [2019-03-19] (Dropbox, Inc -> Dropbox, Inc.)
ShellIconOverlayIdentifiers: [  GoogleDriveBlacklisted] -> {81539FE6-33C7-4CE7-90C7-1C7B8F2F2D42} => C:\Program Files\Google\Drive\googledrivesync64.dll [2018-12-07] (Google Inc -> Google)
ShellIconOverlayIdentifiers: [  GoogleDriveSynced] -> {81539FE6-33C7-4CE7-90C7-1C7B8F2F2D40} => C:\Program Files\Google\Drive\googledrivesync64.dll [2018-12-07] (Google Inc -> Google)
ShellIconOverlayIdentifiers: [  GoogleDriveSyncing] -> {81539FE6-33C7-4CE7-90C7-1C7B8F2F2D41} => C:\Program Files\Google\Drive\googledrivesync64.dll [2018-12-07] (Google Inc -> Google)
ShellIconOverlayIdentifiers: [00asw] -> {472083B0-C522-11CF-8763-00608CC02F24} =>  -> No File
ShellIconOverlayIdentifiers-x32: [   DropboxExt01] -> {FB314ED9-A251-47B7-93E1-CDD82E34AF8B} => C:\Program Files (x86)\Dropbox\Client\DropboxExt64.27.0.dll [2019-03-19] (Dropbox, Inc -> Dropbox, Inc.)
ShellIconOverlayIdentifiers-x32: [   DropboxExt02] -> {FB314EDF-A251-47B7-93E1-CDD82E34AF8B} => C:\Program Files (x86)\Dropbox\Client\DropboxExt64.27.0.dll [2019-03-19] (Dropbox, Inc -> Dropbox, Inc.)
ShellIconOverlayIdentifiers-x32: [   DropboxExt03] -> {FB314EE1-A251-47B7-93E1-CDD82E34AF8B} => C:\Program Files (x86)\Dropbox\Client\DropboxExt64.27.0.dll [2019-03-19] (Dropbox, Inc -> Dropbox, Inc.)
ShellIconOverlayIdentifiers-x32: [   DropboxExt04] -> {FB314EDB-A251-47B7-93E1-CDD82E34AF8B} => C:\Program Files (x86)\Dropbox\Client\DropboxExt64.27.0.dll [2019-03-19] (Dropbox, Inc -> Dropbox, Inc.)
ShellIconOverlayIdentifiers-x32: [   DropboxExt05] -> {FB314EDA-A251-47B7-93E1-CDD82E34AF8B} => C:\Program Files (x86)\Dropbox\Client\DropboxExt64.27.0.dll [2019-03-19] (Dropbox, Inc -> Dropbox, Inc.)
ShellIconOverlayIdentifiers-x32: [   DropboxExt06] -> {FB314EDC-A251-47B7-93E1-CDD82E34AF8B} => C:\Program Files (x86)\Dropbox\Client\DropboxExt64.27.0.dll [2019-03-19] (Dropbox, Inc -> Dropbox, Inc.)
ShellIconOverlayIdentifiers-x32: [   DropboxExt07] -> {FB314EDD-A251-47B7-93E1-CDD82E34AF8B} => C:\Program Files (x86)\Dropbox\Client\DropboxExt64.27.0.dll [2019-03-19] (Dropbox, Inc -> Dropbox, Inc.)
ShellIconOverlayIdentifiers-x32: [   DropboxExt08] -> {FB314EE0-A251-47B7-93E1-CDD82E34AF8B} => C:\Program Files (x86)\Dropbox\Client\DropboxExt64.27.0.dll [2019-03-19] (Dropbox, Inc -> Dropbox, Inc.)
ShellIconOverlayIdentifiers-x32: [   DropboxExt09] -> {FB314EE2-A251-47B7-93E1-CDD82E34AF8B} => C:\Program Files (x86)\Dropbox\Client\DropboxExt64.27.0.dll [2019-03-19] (Dropbox, Inc -> Dropbox, Inc.)
ShellIconOverlayIdentifiers-x32: [   DropboxExt10] -> {FB314EDE-A251-47B7-93E1-CDD82E34AF8B} => C:\Program Files (x86)\Dropbox\Client\DropboxExt64.27.0.dll [2019-03-19] (Dropbox, Inc -> Dropbox, Inc.)
ContextMenuHandlers1: [AccExt] -> {2A118EB5-5797-4F5E-8B3D-F4ECBA3C98E4} => C:\Program Files (x86)\Common Files\Adobe\CoreSyncExtension\CoreSync_x64.dll [2018-03-05] (Adobe Systems Incorporated -> )
ContextMenuHandlers1: [Adobe.Acrobat.ContextMenu] -> {A6595CD1-BF77-430A-A452-18696685F7C7} => C:\Program Files (x86)\Adobe\Acrobat DC\Acrobat Elements\ContextMenuShim64.dll [2015-03-17] (Adobe Systems, Incorporated -> Adobe Systems Inc.)
ContextMenuHandlers1: [DropboxExt] -> {ECD97DE5-3C8F-4ACB-AEEE-CCAB78F7711C} => C:\Program Files (x86)\Dropbox\Client\DropboxExt64.27.0.dll [2019-03-19] (Dropbox, Inc -> Dropbox, Inc.)
ContextMenuHandlers1: [GDContextMenu] -> {BB02B294-8425-42E5-983F-41A1FA970CD6} => C:\Program Files\Google\Drive\contextmenu64.dll [2018-12-07] (Google Inc -> Google)
ContextMenuHandlers4: [DropboxExt] -> {ECD97DE5-3C8F-4ACB-AEEE-CCAB78F7711C} => C:\Program Files (x86)\Dropbox\Client\DropboxExt64.27.0.dll [2019-03-19] (Dropbox, Inc -> Dropbox, Inc.)
ContextMenuHandlers4: [GDContextMenu] -> {BB02B294-8425-42E5-983F-41A1FA970CD6} => C:\Program Files\Google\Drive\contextmenu64.dll [2018-12-07] (Google Inc -> Google)
ContextMenuHandlers5: [DropboxExt] -> {ECD97DE5-3C8F-4ACB-AEEE-CCAB78F7711C} => C:\Program Files (x86)\Dropbox\Client\DropboxExt64.27.0.dll [2019-03-19] (Dropbox, Inc -> Dropbox, Inc.)
ContextMenuHandlers5: [NvCplDesktopContext] -> {3D1975AF-48C6-4f8e-A182-BE0E08FA86A9} => C:\WINDOWS\system32\nvshext.dll [2017-12-18] (NVIDIA Corporation -> NVIDIA Corporation)
ContextMenuHandlers6: [AccExt] -> {2A118EB5-5797-4F5E-8B3D-F4ECBA3C98E4} => C:\Program Files (x86)\Common Files\Adobe\CoreSyncExtension\CoreSync_x64.dll [2018-03-05] (Adobe Systems Incorporated -> )
ContextMenuHandlers6: [Adobe.Acrobat.ContextMenu] -> {A6595CD1-BF77-430A-A452-18696685F7C7} => C:\Program Files (x86)\Adobe\Acrobat DC\Acrobat Elements\ContextMenuShim64.dll [2015-03-17] (Adobe Systems, Incorporated -> Adobe Systems Inc.)
 
==================== Scheduled Tasks (Whitelisted) =============
 
(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)
 
Task: {10A4EF20-1973-4DEF-8705-392A00E7B4E2} - System32\Tasks\Adobe Flash Player Updater => C:\WINDOWS\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe (Adobe Systems Incorporated -> Adobe Systems Incorporated)
Task: {12229541-7014-438C-A373-AB8402A46C6E} - System32\Tasks\AdobeAAMUpdater-1.0-DESKTOP-49PEJRG-user => C:\Program Files (x86)\Common Files\Adobe\OOBE\PDApp\UWA\UpdaterStartupUtility.exe (Adobe Systems Incorporated -> Adobe Systems Incorporated)
Task: {1495E0EA-F20E-4139-9B69-698FD79B8381} - System32\Tasks\Lenovo\ImController\TimeBasedEvents\9b198029-ae48-4d7a-87a8-32f4030442fa => C:\Program Files\Lenovo\ImController\Service\Lenovo.Modern.ImController.exe (Lenovo -> Lenovo Group Ltd.)
Task: {1C057A45-4224-4599-B7A2-903FFF36375A} - System32\Tasks\GoogleUpdateTaskMachineUA => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe (Google Inc -> Google Inc.)
Task: {1EB67667-3334-4834-BB24-A160DA6C6D5E} - System32\Tasks\Lenovo\ImController\TimeBasedEvents\a955846c-9dbe-43d2-b517-8bade28bddac => C:\Program Files\Lenovo\ImController\Service\Lenovo.Modern.ImController.exe (Lenovo -> Lenovo Group Ltd.)
Task: {2B9522EB-ABB7-4D91-8906-EEC9F4E0D615} - System32\Tasks\Adobe Acrobat Update Task => C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe (Adobe Systems, Incorporated -> Adobe Systems Incorporated)
Task: {2C95A9D9-16BD-4AFD-A435-CA0C378178C9} - System32\Tasks\AdobeGCInvoker-1.0-DESKTOP-49PEJRG-user => C:\Program Files (x86)\Common Files\Adobe\AdobeGCClient\AGCInvokerUtility.exe (Adobe Systems Incorporated -> Adobe Systems, Incorporated)
Task: {33C25AE9-96CE-40F2-B6BD-36F13640F9FE} - System32\Tasks\Microsoft\Office\OfficeTelemetryAgentFallBack2016 => C:\Program Files (x86)\Microsoft Office\root\Office16\msoia.exe (Microsoft Corporation -> Microsoft Corporation)
Task: {509C3D05-126F-48B5-9200-3EE66BEA5DA1} - System32\Tasks\Lenovo\ImController\Plugins\LenovoSystemUpdatePlugin_WeeklyTask => %windir%\System32\reg.exe add hklm\SOFTWARE\Lenovo\SystemUpdatePlugin\scheduler  /v start /t reg_dword /d 1 /f /reg:32
Task: {634E4A4F-EF5F-49B5-A3B4-D0AC9CBD4171} - System32\Tasks\Hewlett-Packard\HP Support Assistant\PC Health Analysis => C:\Program Files (x86)\Hewlett-Packard\HP Support Framework\HPSF.exe (HP Inc. -> HP Inc.)
Task: {65A74192-B2F1-40CE-B5CA-BDB0BBAFDF41} - System32\Tasks\HPCeeScheduleForuser => C:\Program Files (x86)\Hewlett-Packard\HP Ceement\HPCEE.exe (HP Inc. -> HP Inc.)
Task: {6E85B9FB-3B40-4BD6-80C8-C8C4FD0B457F} - System32\Tasks\Microsoft\Office\Office Feature Updates => C:\Program Files (x86)\Microsoft Office\root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\sdxhelper.exe (Microsoft Corporation -> Microsoft Corporation)
Task: {75118EC5-CEAE-4510-81C7-0878CD26E32F} - System32\Tasks\GoogleUpdateTaskMachineCore => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe (Google Inc -> Google Inc.)
Task: {77A663BE-0EFA-43A0-8426-0538882117C2} - System32\Tasks\Microsoft\Office\Office Feature Updates Logon => C:\Program Files (x86)\Microsoft Office\root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\sdxhelper.exe (Microsoft Corporation -> Microsoft Corporation)
Task: {826111E1-3059-4F6B-8F8D-FDEE4AD2B792} - System32\Tasks\Microsoft\Office\OfficeBackgroundTaskHandlerLogon => C:\Program Files (x86)\Microsoft Office\root\Office16\officebackgroundtaskhandler.exe (Microsoft Corporation -> Microsoft Corporation)
Task: {895519C8-DC3F-4C91-9E89-C3173ED2B6E3} - System32\Tasks\Hewlett-Packard\HP Active Health\HP Active Health Scan (HPSA) => C:\Program Files (x86)\Hewlett-Packard\HP Support Framework\Resources\HPActiveHealth\ActiveHealth.exe (HP Inc. -> HP Inc.)
Task: {93B17491-8AC8-48DD-89F2-B6D4B5096E06} - System32\Tasks\Microsoft\Office\OfficeBackgroundTaskHandlerRegistration => C:\Program Files (x86)\Microsoft Office\root\Office16\officebackgroundtaskhandler.exe (Microsoft Corporation -> Microsoft Corporation)
Task: {9956C6E1-9705-4FB2-AE8C-696EA1F57A3B} - System32\Tasks\Microsoft\Office\OfficeTelemetryAgentLogOn2016 => C:\Program Files (x86)\Microsoft Office\root\Office16\msoia.exe (Microsoft Corporation -> Microsoft Corporation)
Task: {9C321270-78DD-47C6-B7C6-05955BFBFFCC} - System32\Tasks\Lenovo\ImController\Lenovo iM Controller Monitor => C:\WINDOWS\system32\ImController.InfInstaller.exe (Lenovo -> Lenovo Group Ltd.)
Task: {A314228D-599F-4387-A5BB-7B0D3BFE0436} - System32\Tasks\Lenovo\ImController\Lenovo iM Controller Scheduled Maintenance => %windir%\system32\sc.exe START ImControllerService
Task: {A49CDD0B-79AC-4C6C-9EF2-F6694863D63D} - System32\Tasks\Lenovo\ImController\TimeBasedEvents\ced0e93f-a2fd-4408-b557-fe253b7b00ba => C:\Program Files\Lenovo\ImController\Service\Lenovo.Modern.ImController.exe (Lenovo -> Lenovo Group Ltd.)
Task: {B1DC7632-89B4-4BAA-B561-B38CEF91B09C} - System32\Tasks\Microsoft\Office\Office Automatic Updates 2.0 => C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeC2RClient.exe (Microsoft Corporation -> Microsoft Corporation)
Task: {B2C74C01-D7A8-4FCC-A376-B8BED9C7C916} - System32\Tasks\Hewlett-Packard\HP Support Assistant\HP Support Solutions Framework Updater => C:\Program Files (x86)\Hewlett-Packard\HP Support Solutions\Modules\HPSSFUpdater.exe (HP Inc. -> HP Inc.)
Task: {B89F491A-623F-4E97-A443-BBEDBDDBDCD7} - System32\Tasks\Hewlett-Packard\HP Support Assistant\HP Support Assistant Quick Start => C:\Program Files (x86)\Hewlett-Packard\HP Support Framework\HPSF.exe (HP Inc. -> HP Inc.)
Task: {BA7681EF-54AB-4782-8041-A0A560241195} - System32\Tasks\Microsoft\Office\Office Subscription Maintenance => C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonx86\Microsoft Shared\Office16\OLicenseHeartbeat.exe (Microsoft Corporation -> Microsoft Corporation)
Task: {C10E7859-4F8D-466F-B238-7280CCB197EA} - System32\Tasks\Hewlett-Packard\HP Support Assistant\WarrantyChecker_DeviceScan => C:\Program Files (x86)\Hewlett-Packard\HP Support Framework\Resources\HPWarrantyCheck\HPWarrantyChecker.exe (HP Inc. -> HP Inc.)
Task: {C116D9EF-C620-42F0-BFED-9E7FCAF96B03} - System32\Tasks\Adobe Flash Player PPAPI Notifier => C:\WINDOWS\SysWOW64\Macromed\Flash\FlashUtil32_30_0_0_154_pepper.exe
Task: {CAF10449-D7B2-4977-AC82-0ED2B8D58FFD} - System32\Tasks\Microsoft\Office\Office ClickToRun Service Monitor => C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeC2RClient.exe (Microsoft Corporation -> Microsoft Corporation)
Task: {CDF557D9-82EA-4924-B7BD-8BF5CB44FCFA} - System32\Tasks\Hewlett-Packard\HP Support Assistant\HP Support Solutions Framework Report => C:\Program Files (x86)\Hewlett-Packard\HP Support Solutions\Modules\HPSFReport.exe (HP Inc. -> HP Inc.)
Task: {E6DFE5D4-E9C4-4D62-A1F0-1CF94C7B29EB} - System32\Tasks\Lenovo\ImController\TimeBasedEvents\09b326ba-4295-4806-b5f9-8f08599373e9 => C:\Program Files\Lenovo\ImController\Service\Lenovo.Modern.ImController.exe (Lenovo -> Lenovo Group Ltd.)
Task: {EC6A0165-5691-46D4-BAE7-6434EA76B761} - System32\Tasks\DropboxUpdateTaskMachineUA => C:\Program Files (x86)\Dropbox\Update\DropboxUpdate.exe (Dropbox, Inc -> Dropbox, Inc.)
Task: {F2BBD2D9-E5C1-42CB-8A1A-E8FE56FFF15B} - System32\Tasks\DropboxUpdateTaskMachineCore => C:\Program Files (x86)\Dropbox\Update\DropboxUpdate.exe (Dropbox, Inc -> Dropbox, Inc.)
Task: {F2FB44B9-7D43-4F51-A973-3E66A18744EE} - System32\Tasks\HPLJCustParticipation => C:\Program Files (x86)\HP\HPLJUT\HPLJUTSCH.exe (Hewlett-Packard -> HP Development Company, L.P.)
Task: {F5324FF7-B479-4455-A24C-2F73E8547267} - System32\Tasks\Hewlett-Packard\HP Support Assistant\Product Configurator => C:\Program Files (x86)\Hewlett-Packard\HP Support Framework\Resources\ProductConfig.exe (HP Inc. -> HP Inc.)
 
(If an entry is included in the fixlist, the task (.job) file will be moved. The file which is running by the task will not be moved.)
 
Task: C:\WINDOWS\Tasks\DropboxUpdateTaskMachineCore.job => C:\Program Files (x86)\Dropbox\Update\DropboxUpdate.exe
Task: C:\WINDOWS\Tasks\DropboxUpdateTaskMachineUA.job => C:\Program Files (x86)\Dropbox\Update\DropboxUpdate.exe
Task: C:\WINDOWS\Tasks\HPCeeScheduleForuser.job => C:\Program Files (x86)\Hewlett-Packard\HP Ceement\HPCEE.exe
 
==================== Shortcuts & WMI ========================
 
(The entries could be listed to be restored or removed.)
 
 
==================== Loaded Modules (Whitelisted) ==============
 
2019-03-02 13:24 - 2017-12-18 22:51 - 000874880 _____ (NVIDIA Corporation PE Sign v2016 -> NVIDIA Corporation) [File not signed] C:\Program Files (x86)\NVIDIA Corporation\3D Vision\nvSCPAPI64.dll
2019-03-02 13:24 - 2017-12-18 22:51 - 000339072 _____ (NVIDIA Corporation PE Sign v2016 -> NVIDIA Corporation) [File not signed] C:\Program Files\NVIDIA Corporation\Display.NvContainer\plugins\LocalSystem\NvStereo\_nvstapisvr64.dll
2009-09-16 18:45 - 2009-09-16 18:45 - 000331264 _____ (Hewlett Packard) [File not signed] C:\WINDOWS\System32\HpTcpMon.dll
2009-09-16 18:45 - 2009-09-16 18:45 - 000317440 _____ (Microsoft Corporation) [File not signed] C:\WINDOWS\System32\HPTcpMUI.dll
2009-09-16 11:44 - 2009-09-16 11:44 - 000132096 _____ (Hewlett Packard) [File not signed] C:\WINDOWS\System32\hpzjrd01.dll
2009-09-16 18:44 - 2009-09-16 18:44 - 000153088 _____ (Hewlett Packard) [File not signed] C:\WINDOWS\System32\hptcpmib.dll
2013-05-16 07:52 - 2013-05-16 07:52 - 000066048 _____ (Hewlett-Packard) [File not signed] c:\windows\system32\hpzipm12.dll
2017-02-25 15:44 - 2011-08-17 00:46 - 000032768 _____ () [File not signed] C:\Windows\jmesoft\Service.exe
2013-05-16 07:52 - 2013-05-16 07:52 - 000050688 _____ (Hewlett-Packard) [File not signed] c:\windows\system32\hpzinw12.dll
2014-06-24 23:31 - 2014-06-24 23:31 - 000176128 _____ (HP) [File not signed] C:\Program Files (x86)\HP\HPLaserJetService\HPLaserJetService.exe
2017-02-25 15:44 - 2013-07-24 17:15 - 000118784 _____ (Lenovo) [File not signed] C:\Windows\jmesoft\hotkey.exe
2017-02-25 15:44 - 2011-08-17 00:46 - 000024576 _____ () [File not signed] C:\Windows\jmesoft\JME_LOAD.exe
2014-06-24 23:31 - 2014-06-24 23:31 - 000073728 _____ (Hewlett-Packard Company) [File not signed] C:\Program Files (x86)\HP\HPLaserJetService\HPTools.dll
2014-06-24 23:31 - 2014-06-24 23:31 - 000034816 _____ (HP) [File not signed] C:\Program Files (x86)\HP\HPLaserJetService\HPServiceCommunicator.dll
2014-06-24 23:31 - 2014-06-24 23:31 - 000041472 _____ (Hewlett-Packard Company) [File not signed] C:\Program Files (x86)\HP\HPLaserJetService\HPHTTPProxy.dll
2014-06-24 23:31 - 2014-06-24 23:31 - 001222656 _____ (Hewlett-Packard Company) [File not signed] C:\Program Files (x86)\HP\HPLaserJetService\LEDMXMLObjects.dll
2019-03-02 13:24 - 2017-12-18 22:51 - 000759848 _____ (NVIDIA Corporation PE Sign v2016 -> NVIDIA Corporation) [File not signed] C:\Program Files (x86)\NVIDIA Corporation\3D Vision\nvSCPAPI.dll
2017-02-25 15:44 - 2011-05-17 17:27 - 000028672 _____ () [File not signed] C:\Windows\jmesoft\hidhook.dll
2019-03-19 00:39 - 2018-08-12 20:29 - 001255424 _____ (Robert Simpson, et al.) [File not signed] C:\ProgramData\Lenovo\iMController\Plugins\GenericMessagingPlugin\x86\x86\SQLite.Interop.dll
 
==================== Alternate Data Streams (Whitelisted) =========
 
(If an entry is included in the fixlist, only the ADS will be removed.)
 
 
==================== Safe Mode (Whitelisted) ===================
 
(If an entry is included in the fixlist, it will be removed from the registry. The "AlternateShell" will be restored.)
 
 
==================== Association (Whitelisted) ===============
 
(If an entry is included in the fixlist, the registry item will be restored to default or removed.)
 
 
==================== Internet Explorer trusted/restricted ===============
 
(If an entry is included in the fixlist, it will be removed from the registry.)
 
IE trusted site: HKU\S-1-5-21-93585695-1239137162-3987457199-1001\…\sharepoint.com -> hxxps://njjudiciary-files.sharepoint.com
 
==================== Hosts content: ==========================
 
(If needed Hosts: directive could be included in the fixlist to reset Hosts.)
 
2016-07-16 07:47 - 2018-05-27 06:15 - 000002103 _____ C:\WINDOWS\system32\drivers\etc\hosts
 
0.0.0.0 0.0.0.0 # fix for traceroute and netstat display anomaly
0.0.0.0 tracking.opencandy.com.s3.amazonaws.com
0.0.0.0 media.opencandy.com
0.0.0.0 cdn.opencandy.com
0.0.0.0 tracking.opencandy.com
0.0.0.0 api.opencandy.com
0.0.0.0 api.recommendedsw.com
0.0.0.0 rp.yefeneri2.com
0.0.0.0 os.yefeneri2.com
0.0.0.0 os2.yefeneri2.com
0.0.0.0 installer.betterinstaller.com
0.0.0.0 installer.filebulldog.com
0.0.0.0 d3oxtn1x3b8d7i.cloudfront.net
0.0.0.0 inno.bisrv.com
0.0.0.0 nsis.bisrv.com
0.0.0.0 cdn.file2desktop.com
0.0.0.0 cdn.goateastcach.us
0.0.0.0 cdn.guttastatdk.us
0.0.0.0 cdn.inskinmedia.com
0.0.0.0 cdn.insta.oibundles2.com
0.0.0.0 cdn.insta.playbryte.com
0.0.0.0 cdn.llogetfastcach.us
0.0.0.0 cdn.montiera.com
0.0.0.0 cdn.msdwnld.com
0.0.0.0 cdn.mypcbackup.com
0.0.0.0 cdn.ppdownload.com
0.0.0.0 cdn.riceateastcach.us
0.0.0.0 cdn.shyapotato.us
0.0.0.0 cdn.solimba.com
0.0.0.0 cdn.tuto4pc.com
 
==================== Other Areas ============================
 
(Currently there is no automatic fix for this section.)
 
HKU\S-1-5-21-93585695-1239137162-3987457199-1001\Control Panel\Desktop\\Wallpaper -> C:\Windows\web\wallpaper\Signature\Signature01.jpg
DNS Servers: [removed] - [removed]
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System => (ConsentPromptBehaviorAdmin: 5) (ConsentPromptBehaviorUser: 3) (EnableLUA: 1)
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer => (SmartScreenEnabled: RequireAdmin)
Windows Firewall is enabled.
 
==================== MSCONFIG/TASK MANAGER disabled items ==
 
If an entry is included in the fixlist, it will be removed.
 
HKLM\…\StartupApproved\Run: => "ZAM"
HKLM\…\StartupApproved\Run32: => "StatusAlerts"
HKLM\…\StartupApproved\Run32: => "Dropbox"
HKU\S-1-5-21-93585695-1239137162-3987457199-1001\…\StartupApproved\Run: => "Lync"
 
==================== FirewallRules (Whitelisted) ===============
 
(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)
 
FirewallRules: [{BF399EF9-85D8-4351-886C-20C20F70B348}] => (Allow) C:\Program Files (x86)\Microsoft Office\root\Office16\UcMapi.exe (Microsoft Corporation -> Microsoft Corporation)
FirewallRules: [{B1BD0C0A-69D5-4E20-8981-0E5EA3506BE2}] => (Allow) C:\Program Files (x86)\Microsoft Office\root\Office16\Lync.exe (Microsoft Corporation -> Microsoft Corporation)
FirewallRules: [{C0761818-54F3-4FE9-8EB4-C8BEF2850C10}] => (Allow) C:\Program Files (x86)\Microsoft Office\root\Office16\outlook.exe (Microsoft Corporation -> Microsoft Corporation)
FirewallRules: [{62C699DC-CF80-402E-A8DB-358EB49EA895}] => (Allow) C:\Program Files (x86)\HP\HP Color LaserJet Pro MFP M476\bin\EWSProxy.exe (Hewlett Packard -> Hewlett-Packard Co.)
FirewallRules: [{EBA72650-142A-474D-963A-B00FDCD9EA22}] => (Allow) C:\Program Files (x86)\HP\HP Color LaserJet Pro MFP M476\bin\FaxApplications.exe (Hewlett Packard -> Hewlett-Packard Co.)
FirewallRules: [{7FFF2BBF-580E-442B-AB21-68DE113AEA82}] => (Allow) C:\Program Files (x86)\HP\HP Color LaserJet Pro MFP M476\bin\DigitalWizards.exe (Hewlett Packard -> Hewlett-Packard Co.)
FirewallRules: [{78EE7E10-EE3A-4512-88E3-FD80F2E50518}] => (Allow) C:\Program Files (x86)\HP\HP Color LaserJet Pro MFP M476\Bin\HPNetworkCommunicatorCom.exe (Hewlett Packard -> Hewlett-Packard Co.)
FirewallRules: [{08ABBD64-645D-4F66-B63A-9A55F9E2DD4E}] => (Allow) C:\Program Files\HP\HP Color LaserJet Pro MFP M476\Bin\HPNetworkCommunicatorCom.exe (Hewlett Packard -> Hewlett-Packard Co.)
FirewallRules: [{DBE718F4-1331-49B8-AEED-44C3053E6946}] => (Allow) C:\Program Files\HP\HP Color LaserJet Pro MFP M476\bin\FaxPrinterUtility.exe (Hewlett Packard -> Hewlett-Packard Co.)
FirewallRules: [{413ACEE0-1008-4421-BFAC-C44C3E6F37A1}] => (Allow) C:\Program Files\HP\HP Color LaserJet Pro MFP M476\bin\SendAFax.exe (Hewlett Packard -> Hewlett-Packard Co.)
FirewallRules: [{A9CF555A-AE40-4338-A4A1-0F52365DFCD9}] => (Allow) C:\Program Files (x86)\Microsoft Office\root\Office16\UcMapi.exe (Microsoft Corporation -> Microsoft Corporation)
FirewallRules: [{FD3B2798-82D6-40E6-B41C-4B3B0655B623}] => (Allow) C:\Program Files (x86)\Microsoft Office\root\Office16\Lync.exe (Microsoft Corporation -> Microsoft Corporation)
FirewallRules: [{601C37F8-9F36-4C19-84E3-BC88EE50D5F9}] => (Allow) C:\Program Files (x86)\Common Files\Mcafee\MMSSHost\MMSSHost.exe No File
FirewallRules: [{155BB0C6-7ADE-439B-8FA6-921F9BE21E7B}] => (Allow) C:\Program Files\Common Files\McAfee\MMSSHost\MMSSHost.exe No File
FirewallRules: [{08128340-B60D-40CD-8906-35BA2938CDFD}] => (Allow) C:\Program Files\Mozilla Firefox\firefox.exe (Mozilla Corporation -> Mozilla Corporation)
FirewallRules: [{8105E030-7946-4470-A828-0CAA5DE08707}] => (Allow) C:\Program Files\Mozilla Firefox\firefox.exe (Mozilla Corporation -> Mozilla Corporation)
FirewallRules: [{2454A74F-5452-4390-81A5-6288B7CCB16D}] => (Allow) C:\Program Files\WindowsApps\SpotifyAB.SpotifyMusic_1.101.348.0_x86__zpdnekdrzrea0\Spotify.exe (Spotify AB -> Spotify Ltd)
FirewallRules: [{3173187C-A0F3-400E-9351-820FEEFA4F92}] => (Allow) C:\Program Files\WindowsApps\SpotifyAB.SpotifyMusic_1.101.348.0_x86__zpdnekdrzrea0\Spotify.exe (Spotify AB -> Spotify Ltd)
FirewallRules: [{F2E53368-2FF3-4BEE-8133-14FB7F4D29A6}] => (Allow) C:\Program Files\WindowsApps\SpotifyAB.SpotifyMusic_1.101.348.0_x86__zpdnekdrzrea0\Spotify.exe (Spotify AB -> Spotify Ltd)
FirewallRules: [{CF2B44CD-ABA9-4FBD-B3E8-C769AF0A40D6}] => (Allow) C:\Program Files\WindowsApps\SpotifyAB.SpotifyMusic_1.101.348.0_x86__zpdnekdrzrea0\Spotify.exe (Spotify AB -> Spotify Ltd)
FirewallRules: [{6BBBE08A-2F34-485A-923C-FB0357C08366}] => (Allow) C:\Program Files\WindowsApps\SpotifyAB.SpotifyMusic_1.101.348.0_x86__zpdnekdrzrea0\Spotify.exe (Spotify AB -> Spotify Ltd)
FirewallRules: [{BFF7F048-FE3B-4AB7-9A93-3476BDC7ADFA}] => (Allow) C:\Program Files\WindowsApps\SpotifyAB.SpotifyMusic_1.101.348.0_x86__zpdnekdrzrea0\Spotify.exe (Spotify AB -> Spotify Ltd)
FirewallRules: [{68E1BA68-889D-4044-A96B-0075D0F87BB7}] => (Allow) C:\Program Files\WindowsApps\SpotifyAB.SpotifyMusic_1.101.348.0_x86__zpdnekdrzrea0\Spotify.exe (Spotify AB -> Spotify Ltd)
FirewallRules: [{AD040159-6212-4EC0-B79D-0BF97DAF0F2A}] => (Allow) C:\Program Files\WindowsApps\SpotifyAB.SpotifyMusic_1.101.348.0_x86__zpdnekdrzrea0\Spotify.exe (Spotify AB -> Spotify Ltd)
FirewallRules: [TCP Query User{58505E77-6B40-4D28-855D-475A2BD5F93E}C:\program files\adobe\adobe dreamweaver cc 2019\node\node.exe] => (Allow) C:\program files\adobe\adobe dreamweaver cc 2019\node\node.exe (Adobe Systems Incorporated -> Node.js)
FirewallRules: [UDP Query User{123AEE70-B073-4960-BF05-9B933E3F601F}C:\program files\adobe\adobe dreamweaver cc 2019\node\node.exe] => (Allow) C:\program files\adobe\adobe dreamweaver cc 2019\node\node.exe (Adobe Systems Incorporated -> Node.js)
FirewallRules: [{D8E446C8-B92F-4CDC-BFE7-462F5D5C04FC}] => (Allow) C:\Program Files (x86)\Dropbox\Client\Dropbox.exe (Dropbox, Inc -> Dropbox, Inc.)
FirewallRules: [{8F5A5D43-F1AA-4AA0-9028-85BC3480169E}] => (Allow) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe (Google LLC -> Google Inc.)
 
==================== Restore Points =========================
 
ATTENTION: System Restore is disabled
 
==================== Faulty Device Manager Devices =============
 
 
==================== Event log errors: =========================
 
Application errors:
==================
Error: (03/25/2019 11:54:01 PM) (Source: SecurityCenter) (EventID: 17) (User: )
Description: Security Center failed to validate caller with error %1.
 
Error: (03/25/2019 11:50:20 PM) (Source: SecurityCenter) (EventID: 17) (User: )
Description: Security Center failed to validate caller with error %1.
 
Error: (03/25/2019 11:47:12 PM) (Source: Application Error) (EventID: 1000) (User: )
Description: Faulting application name: MicrosoftEdge.exe, version: 11.0.17763.379, time stamp: 0x5c80c08d
Faulting module name: mshtml.dll, version: 11.0.17763.379, time stamp: 0xd676eb8b
Exception code: 0xc0000602
Fault offset: 0x00000000002ecc47
Faulting process id: 0x37e8
Faulting application start time: 0x01d4e38688a697c2
Faulting application path: C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdge.exe
Faulting module path: C:\Windows\System32\mshtml.dll
Report Id: 866565cb-2446-424a-a4d7-08fbf35db875
Faulting package full name: Microsoft.MicrosoftEdge_44.17763.1.0_neutral__8wekyb3d8bbwe
Faulting package-relative application ID: MicrosoftEdge
 
Error: (03/25/2019 11:46:36 PM) (Source: SecurityCenter) (EventID: 17) (User: )
Description: Security Center failed to validate caller with error %1.
 
Error: (03/25/2019 11:42:51 PM) (Source: Application Error) (EventID: 1000) (User: )
Description: Faulting application name: MicrosoftEdge.exe, version: 11.0.17763.379, time stamp: 0x5c80c08d
Faulting module name: mshtml.dll, version: 11.0.17763.379, time stamp: 0xd676eb8b
Exception code: 0xc0000602
Fault offset: 0x00000000002ecc47
Faulting process id: 0x3234
Faulting application start time: 0x01d4e385d55a63a8
Faulting application path: C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdge.exe
Faulting module path: C:\Windows\System32\mshtml.dll
Report Id: b2543ab0-29b3-4835-a184-53225b230b97
Faulting package full name: Microsoft.MicrosoftEdge_44.17763.1.0_neutral__8wekyb3d8bbwe
Faulting package-relative application ID: MicrosoftEdge
 
Error: (03/25/2019 11:42:43 PM) (Source: SecurityCenter) (EventID: 17) (User: )
Description: Security Center failed to validate caller with error %1.
 
Error: (03/25/2019 11:41:39 PM) (Source: SecurityCenter) (EventID: 17) (User: )
Description: Security Center failed to validate caller with error %1.
 
Error: (03/25/2019 11:37:07 PM) (Source: Application Error) (EventID: 1000) (User: )
Description: Faulting application name: MicrosoftEdge.exe, version: 11.0.17763.379, time stamp: 0x5c80c08d
Faulting module name: mshtml.dll, version: 11.0.17763.379, time stamp: 0xd676eb8b
Exception code: 0xc0000602
Fault offset: 0x00000000002ecc47
Faulting process id: 0xf24
Faulting application start time: 0x01d4e3851d6e0807
Faulting application path: C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdge.exe
Faulting module path: C:\Windows\System32\mshtml.dll
Report Id: 6cce86bd-d413-4ba1-8e82-9e54108d5d30
Faulting package full name: Microsoft.MicrosoftEdge_44.17763.1.0_neutral__8wekyb3d8bbwe
Faulting package-relative application ID: MicrosoftEdge
 
 
System errors:
=============
Error: (03/25/2019 11:54:42 PM) (Source: DCOM) (EventID: 10016) (User: DESKTOP-49PEJRG)
Description: The application-specific permission settings do not grant Local Activation permission for the COM Server application with CLSID 
{2593F8B9-4EAF-457C-B68A-50F6B8EA6B54}
 and APPID 
{15C20B67-12E7-4BB6-92BB-7AFF07997402}
 to the user DESKTOP-49PEJRG\user SID (S-1-5-21-93585695-1239137162-3987457199-1001) from address LocalHost (Using LRPC) running in the application container Unavailable SID (Unavailable). This security permission can be modified using the Component Services administrative tool.
 
Error: (03/25/2019 11:53:59 PM) (Source: DCOM) (EventID: 10016) (User: NT AUTHORITY)
Description: The application-specific permission settings do not grant Local Activation permission for the COM Server application with CLSID 
{6B3B8D23-FA8D-40B9-8DBD-B950333E2C52}
 and APPID 
{4839DDB7-58C2-48F5-8283-E1D1807D0D7D}
 to the user NT AUTHORITY\LOCAL SERVICE SID (S-1-5-19) from address LocalHost (Using LRPC) running in the application container Unavailable SID (Unavailable). This security permission can be modified using the Component Services administrative tool.
 
Error: (03/25/2019 11:53:59 PM) (Source: DCOM) (EventID: 10016) (User: NT AUTHORITY)
Description: The application-specific permission settings do not grant Local Activation permission for the COM Server application with CLSID 
{6B3B8D23-FA8D-40B9-8DBD-B950333E2C52}
 and APPID 
{4839DDB7-58C2-48F5-8283-E1D1807D0D7D}
 to the user NT AUTHORITY\LOCAL SERVICE SID (S-1-5-19) from address LocalHost (Using LRPC) running in the application container Unavailable SID (Unavailable). This security permission can be modified using the Component Services administrative tool.
 
Error: (03/25/2019 11:53:04 PM) (Source: BugCheck) (EventID: 1001) (User: )
Description: The computer has rebooted from a bugcheck.  The bugcheck was: 0x000000d1 (0xffff9000e3136010, 0x00000000000000ff, 0x0000000000000000, 0xfffff802580795ae). A dump was saved in: C:\WINDOWS\Minidump\032519-5000-01.dmp. Report Id: 9b479016-b8c8-4ea4-a4d0-fb974b1f1598.
 
Error: (03/25/2019 11:49:34 PM) (Source: DCOM) (EventID: 10016) (User: NT AUTHORITY)
Description: The application-specific permission settings do not grant Local Activation permission for the COM Server application with CLSID 
{6B3B8D23-FA8D-40B9-8DBD-B950333E2C52}
 and APPID 
{4839DDB7-58C2-48F5-8283-E1D1807D0D7D}
 to the user NT AUTHORITY\LOCAL SERVICE SID (S-1-5-19) from address LocalHost (Using LRPC) running in the application container Unavailable SID (Unavailable). This security permission can be modified using the Component Services administrative tool.
 
Error: (03/25/2019 11:49:34 PM) (Source: DCOM) (EventID: 10016) (User: NT AUTHORITY)
Description: The application-specific permission settings do not grant Local Activation permission for the COM Server application with CLSID 
{6B3B8D23-FA8D-40B9-8DBD-B950333E2C52}
 and APPID 
{4839DDB7-58C2-48F5-8283-E1D1807D0D7D}
 to the user NT AUTHORITY\LOCAL SERVICE SID (S-1-5-19) from address LocalHost (Using LRPC) running in the application container Unavailable SID (Unavailable). This security permission can be modified using the Component Services administrative tool.
 
Error: (03/25/2019 11:49:08 PM) (Source: BugCheck) (EventID: 1001) (User: )
Description: The computer has rebooted from a bugcheck.  The bugcheck was: 0x000000d1 (0xffffa900f11ca010, 0x00000000000000ff, 0x0000000000000000, 0xfffff801d74195ae). A dump was saved in: C:\WINDOWS\Minidump\032519-5578-01.dmp. Report Id: d5442ff8-a150-4283-8a39-dff1cfe29597.
 
Error: (03/25/2019 11:45:59 PM) (Source: DCOM) (EventID: 10016) (User: DESKTOP-49PEJRG)
Description: The application-specific permission settings do not grant Local Activation permission for the COM Server application with CLSID 
{2593F8B9-4EAF-457C-B68A-50F6B8EA6B54}
 and APPID 
{15C20B67-12E7-4BB6-92BB-7AFF07997402}
 to the user DESKTOP-49PEJRG\user SID (S-1-5-21-93585695-1239137162-3987457199-1001) from address LocalHost (Using LRPC) running in the application container Unavailable SID (Unavailable). This security permission can be modified using the Component Services administrative tool.
 
 
CodeIntegrity:
===================================
 
Date: 2019-03-25 23:54:01.557
Description: 
Windows is unable to verify the image integrity of the file \Device\HarddiskVolume3\Program Files (x86)\TotalAV\TotalAV.exe because file hash could not be found on the system. A recent hardware or software change might have installed a file that is signed incorrectly or damaged, or that might be malicious software from an unknown source.
 
Date: 2019-03-25 23:53:20.786
Description: 
Windows is unable to verify the image integrity of the file \Device\HarddiskVolume3\Program Files (x86)\TotalAV\TotalAV.exe because file hash could not be found on the system. A recent hardware or software change might have installed a file that is signed incorrectly or damaged, or that might be malicious software from an unknown source.
 
Date: 2019-03-25 23:53:20.637
Description: 
Windows is unable to verify the image integrity of the file \Device\HarddiskVolume3\Program Files (x86)\TotalAV\TotalAV.exe because file hash could not be found on the system. A recent hardware or software change might have installed a file that is signed incorrectly or damaged, or that might be malicious software from an unknown source.
 
Date: 2019-03-25 23:53:20.503
Description: 
Windows is unable to verify the image integrity of the file \Device\HarddiskVolume3\Program Files (x86)\TotalAV\TotalAV.exe because file hash could not be found on the system. A recent hardware or software change might have installed a file that is signed incorrectly or damaged, or that might be malicious software from an unknown source.
 
Date: 2019-03-25 23:53:20.376
Description: 
Windows is unable to verify the image integrity of the file \Device\HarddiskVolume3\Program Files (x86)\TotalAV\TotalAV.exe because file hash could not be found on the system. A recent hardware or software change might have installed a file that is signed incorrectly or damaged, or that might be malicious software from an unknown source.
 
Date: 2019-03-25 23:53:20.238
Description: 
Windows is unable to verify the image integrity of the file \Device\HarddiskVolume3\Program Files (x86)\TotalAV\TotalAV.exe because file hash could not be found on the system. A recent hardware or software change might have installed a file that is signed incorrectly or damaged, or that might be malicious software from an unknown source.
 
Date: 2019-03-25 23:53:20.108
Description: 
Windows is unable to verify the image integrity of the file \Device\HarddiskVolume3\Program Files (x86)\TotalAV\TotalAV.exe because file hash could not be found on the system. A recent hardware or software change might have installed a file that is signed incorrectly or damaged, or that might be malicious software from an unknown source.
 
Date: 2019-03-25 23:53:15.419
Description: 
Windows is unable to verify the image integrity of the file \Device\HarddiskVolume3\Program Files (x86)\TotalAV\TotalAV.exe because file hash could not be found on the system. A recent hardware or software change might have installed a file that is signed incorrectly or damaged, or that might be malicious software from an unknown source.
 
==================== Memory info =========================== 
 
Processor: Intel(R) Core(TM) i7-7700 CPU @ 3.60GHz
Percentage of memory in use: 52%
Total physical RAM: 16338.11 MB
Available physical RAM: 7813.25 MB
Total Virtual: 35794.11 MB
Available Virtual: 25430.13 MB
 
==================== Drives ================================
 
Drive c: (Windows) (Fixed) (Total:117.89 GB) (Free:46.92 GB) NTFS
Drive d: () (Fixed) (Total:931.51 GB) (Free:911.18 GB) NTFS
Drive f: (U3 System) (CDROM) (Total:0.01 GB) (Free:0 GB) CDFS
Drive g: () (Removable) (Total:7.47 GB) (Free:3.43 GB) FAT32
 
\\?\Volume{cf5fcf1b-cf1c-4769-a735-3c9a62404f2a}\ (WinRE_DRV) (Fixed) (Total:0.98 GB) (Free:0.58 GB) NTFS
\\?\Volume{8468cdb4-c32b-4da2-ac4f-ca6481782e90}\ (SYSTEM) (Fixed) (Total:0.25 GB) (Free:0.22 GB) FAT32
 
==================== MBR & Partition Table ==================
 
========================================================
Disk: 0 (Size: 119.2 GB) (Disk ID: 79A07A6E)
 
Partition: GPT.
 
========================================================
Disk: 1 (Size: 931.5 GB) (Disk ID: 79A07A7A)
 
Partition: GPT.
 
========================================================
Disk: 2 (Protective MBR) (Size: 7.5 GB) (Disk ID: 00000000)
 
Partition: GPT.
 
==================== End of Addition.txt ============================
Sorry for the wait.

Let's see if we can enable system restore.
Enable System Restore in Windows Backup & Restore
https://www.tenforums.com/tutorials/99782-enable-disable-system-restore-windows.html

~~~~~~~~~~~~~~~~~
Please try to uninstall
TotalAV (HKLM-x32\…\TotalAV) (Version: 4.9.36 - TotalAV)


Start Farbar Recovery Scan Tool with Administrator privileges
(Right click on the FRST icon and select Run as administrator)

highlight on the text below and select Copy.
beginning with Start:: and finishing with End::
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

Highlight the entire content of the quote box below and select Copy.

 

Start::
CloseProcesses:
CreateRestorePoint:
SearchScopes: HKU\S-1-5-21-93585695-1239137162-3987457199-1001 -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = hxxps://www.bing.com/search?q={searchTerms}&src=IE-SearchBox&FORM=IESR02&pc=UE15
SearchScopes: HKU\S-1-5-21-93585695-1239137162-3987457199-1001 -> {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = hxxps://www.bing.com/search?q={searchTerms}&src=IE-SearchBox&FORM=IESR02&pc=UE15
SearchScopes: HKU\S-1-5-21-93585695-1239137162-3987457199-1001 -> {0CE02FFA-A6B0-46F6-BA2F-BD32C3630126} URL =
C:\Program Files (x86)\TotalAV\SecurityService.exe
C:\Program Files (x86)\TotalAV
C:\Windows\Temp\*.*
Emptytemp:
End::



Start FRST (FRST64) with Administrator privileges
Press the Fix button. FRST will process the lines copied above from the clipboard.
When finished, a log file Fixlog.txt will pop up and saved in the same location the tool was ran from.

Please copy and paste its contents in your next reply.
~~~~~~~~~~~~~~~~~~~~~~~~~~~~

Follow the instructions in the thread below to run a scan with MBAR. Don't forget to update the database before launching the scan, and once launched, leave MBAR running and do not touch your computer until it is done scanning.

https://forums.malwarebytes.com/topic/198907-requested-resource-is-in-use-error-unable-to-start-malwarebytes/

Once MBAR is done scanning, removing threats and rebooting your computer, go in its MBAR folder, and copy/paste the content of the mbar-log-TODAYS-DATE.txt log in your next reply.

hi thank you.  my system restore wasn't enabled, so I couldn't restore to a earlier time.  I uninstalled my virus protection and I ran the FRST fix.  here is the log.  I'll do the other part next.  

 

Fix result of Farbar Recovery Scan Tool (x64) Version: 17.03.2019
Ran by [removed] (26-03-2019 17:56:35) Run:1
Running from C:\Users\[removed]\Downloads
[removed]
Boot Mode: Normal
==============================================
 
fixlist content:
*****************
CloseProcesses:
CreateRestorePoint:
SearchScopes: HKU\S-1-5-21-93585695-1239137162-3987457199-1001 -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = hxxps://www.bing.com/search?q={searchTerms}&src=IE-SearchBox&FORM=IESR02&pc=UE15
SearchScopes: HKU\S-1-5-21-93585695-1239137162-3987457199-1001 -> {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = hxxps://www.bing.com/search?q={searchTerms}&src=IE-SearchBox&FORM=IESR02&pc=UE15
SearchScopes: HKU\S-1-5-21-93585695-1239137162-3987457199-1001 -> {0CE02FFA-A6B0-46F6-BA2F-BD32C3630126} URL =
C:\Program Files (x86)\TotalAV\SecurityService.exe
C:\Program Files (x86)\TotalAV
C:\Windows\Temp\*.*
Emptytemp:
 
*****************
 
Processes closed successfully.
Restore point was successfully created.
"HKU\S-1-5-21-93585695-1239137162-3987457199-1001\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\\DefaultScope" => removed successfully
HKU\S-1-5-21-93585695-1239137162-3987457199-1001\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A} => removed successfully
HKLM\Software\Classes\CLSID\{0633EE93-D776-472f-A0FF-E1416B8B2E3A} => not found
HKU\S-1-5-21-93585695-1239137162-3987457199-1001\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{0CE02FFA-A6B0-46F6-BA2F-BD32C3630126} => removed successfully
HKLM\Software\Classes\CLSID\{0CE02FFA-A6B0-46F6-BA2F-BD32C3630126} => not found
"C:\Program Files (x86)\TotalAV\SecurityService.exe" => not found
"C:\Program Files (x86)\TotalAV" => not found
 
=========== "C:\Windows\Temp\*.*" ==========
 
C:\Windows\Temp\.session => moved successfully
C:\Windows\Temp\.session64 => moved successfully
C:\Windows\Temp\adobegc.log => moved successfully
C:\Windows\Temp\aria-debug-10312.log => moved successfully
C:\Windows\Temp\aria-debug-1040.log => moved successfully
C:\Windows\Temp\aria-debug-10580.log => moved successfully
C:\Windows\Temp\aria-debug-10892.log => moved successfully
C:\Windows\Temp\aria-debug-11080.log => moved successfully
C:\Windows\Temp\aria-debug-12780.log => moved successfully
C:\Windows\Temp\aria-debug-13140.log => moved successfully
C:\Windows\Temp\aria-debug-13756.log => moved successfully
C:\Windows\Temp\aria-debug-14540.log => moved successfully
C:\Windows\Temp\aria-debug-1488.log => moved successfully
C:\Windows\Temp\aria-debug-15756.log => moved successfully
C:\Windows\Temp\aria-debug-16124.log => moved successfully
C:\Windows\Temp\aria-debug-16544.log => moved successfully
C:\Windows\Temp\aria-debug-16944.log => moved successfully
C:\Windows\Temp\aria-debug-17800.log => moved successfully
C:\Windows\Temp\aria-debug-18072.log => moved successfully
C:\Windows\Temp\aria-debug-18320.log => moved successfully
C:\Windows\Temp\aria-debug-18536.log => moved successfully
C:\Windows\Temp\aria-debug-19272.log => moved successfully
C:\Windows\Temp\aria-debug-1944.log => moved successfully
C:\Windows\Temp\aria-debug-19856.log => moved successfully
C:\Windows\Temp\aria-debug-20080.log => moved successfully
C:\Windows\Temp\aria-debug-20688.log => moved successfully
C:\Windows\Temp\aria-debug-20944.log => moved successfully
C:\Windows\Temp\aria-debug-21348.log => moved successfully
C:\Windows\Temp\aria-debug-21520.log => moved successfully
C:\Windows\Temp\aria-debug-23056.log => moved successfully
C:\Windows\Temp\aria-debug-23776.log => moved successfully
C:\Windows\Temp\aria-debug-24644.log => moved successfully
C:\Windows\Temp\aria-debug-24688.log => moved successfully
C:\Windows\Temp\aria-debug-25948.log => moved successfully
C:\Windows\Temp\aria-debug-272.log => moved successfully
C:\Windows\Temp\aria-debug-27904.log => moved successfully
C:\Windows\Temp\aria-debug-2812.log => moved successfully
Could not move "C:\Windows\Temp\aria-debug-2816.log" => Scheduled to move on reboot.
C:\Windows\Temp\aria-debug-3192.log => moved successfully
C:\Windows\Temp\aria-debug-3212.log => moved successfully
C:\Windows\Temp\aria-debug-3220.log => moved successfully
C:\Windows\Temp\aria-debug-32928.log => moved successfully
C:\Windows\Temp\aria-debug-3492.log => moved successfully
C:\Windows\Temp\aria-debug-3572.log => moved successfully
C:\Windows\Temp\aria-debug-3616.log => moved successfully
C:\Windows\Temp\aria-debug-3656.log => moved successfully
C:\Windows\Temp\aria-debug-3812.log => moved successfully
C:\Windows\Temp\aria-debug-3820.log => moved successfully
C:\Windows\Temp\aria-debug-3896.log => moved successfully
C:\Windows\Temp\aria-debug-3980.log => moved successfully
C:\Windows\Temp\aria-debug-4024.log => moved successfully
C:\Windows\Temp\aria-debug-4116.log => moved successfully
C:\Windows\Temp\aria-debug-4608.log => moved successfully
C:\Windows\Temp\aria-debug-4856.log => moved successfully
C:\Windows\Temp\aria-debug-4864.log => moved successfully
C:\Windows\Temp\aria-debug-5968.log => moved successfully
C:\Windows\Temp\aria-debug-6140.log => moved successfully
C:\Windows\Temp\aria-debug-6172.log => moved successfully
C:\Windows\Temp\aria-debug-6196.log => moved successfully
C:\Windows\Temp\aria-debug-6312.log => moved successfully
C:\Windows\Temp\aria-debug-6768.log => moved successfully
C:\Windows\Temp\aria-debug-7388.log => moved successfully
C:\Windows\Temp\aria-debug-740.log => moved successfully
C:\Windows\Temp\aria-debug-7620.log => moved successfully
C:\Windows\Temp\aria-debug-7652.log => moved successfully
C:\Windows\Temp\aria-debug-7936.log => moved successfully
C:\Windows\Temp\aria-debug-8116.log => moved successfully
C:\Windows\Temp\aria-debug-8752.log => moved successfully
C:\Windows\Temp\aria-debug-8904.log => moved successfully
C:\Windows\Temp\aria-debug-9024.log => moved successfully
C:\Windows\Temp\aria-debug-9648.log => moved successfully
C:\Windows\Temp\chrome_installer.log => moved successfully
C:\Windows\Temp\DESKTOP-49PEJRG-20190304-0253.log => moved successfully
C:\Windows\Temp\DESKTOP-49PEJRG-20190318-2300.log => moved successfully
C:\Windows\Temp\DESKTOP-49PEJRG-20190318-2300a.log => moved successfully
C:\Windows\Temp\DESKTOP-49PEJRG-20190318-2338.log => moved successfully
C:\Windows\Temp\DESKTOP-49PEJRG-20190318-2339.log => moved successfully
C:\Windows\Temp\DESKTOP-49PEJRG-20190319-0005.log => moved successfully
C:\Windows\Temp\DESKTOP-49PEJRG-20190319-0005a.log => moved successfully
C:\Windows\Temp\DESKTOP-49PEJRG-20190319-0005b.log => moved successfully
C:\Windows\Temp\DESKTOP-49PEJRG-20190319-0006.log => moved successfully
C:\Windows\Temp\DESKTOP-49PEJRG-20190319-0006a.log => moved successfully
C:\Windows\Temp\DESKTOP-49PEJRG-20190319-0015.log => moved successfully
C:\Windows\Temp\DESKTOP-49PEJRG-20190319-0049.log => moved successfully
C:\Windows\Temp\DESKTOP-49PEJRG-20190319-0104.log => moved successfully
C:\Windows\Temp\DESKTOP-49PEJRG-20190319-2208.log => moved successfully
C:\Windows\Temp\DESKTOP-49PEJRG-20190319-2210.log => moved successfully
C:\Windows\Temp\DESKTOP-49PEJRG-20190319-2211.log => moved successfully
C:\Windows\Temp\DESKTOP-49PEJRG-20190319-2225.log => moved successfully
C:\Windows\Temp\DESKTOP-49PEJRG-20190319-2302.log => moved successfully
C:\Windows\Temp\DESKTOP-49PEJRG-20190319-2319.log => moved successfully
C:\Windows\Temp\DESKTOP-49PEJRG-20190320-0001.log => moved successfully
C:\Windows\Temp\DESKTOP-49PEJRG-20190320-0016.log => moved successfully
C:\Windows\Temp\DESKTOP-49PEJRG-20190320-0017.log => moved successfully
C:\Windows\Temp\DESKTOP-49PEJRG-20190320-0135.log => moved successfully
C:\Windows\Temp\DESKTOP-49PEJRG-20190320-0639.log => moved successfully
C:\Windows\Temp\DESKTOP-49PEJRG-20190320-0646.log => moved successfully
C:\Windows\Temp\DESKTOP-49PEJRG-20190320-2056.log => moved successfully
C:\Windows\Temp\DESKTOP-49PEJRG-20190320-2103.log => moved successfully
C:\Windows\Temp\DESKTOP-49PEJRG-20190320-2128.log => moved successfully
C:\Windows\Temp\DESKTOP-49PEJRG-20190320-2139.log => moved successfully
C:\Windows\Temp\DESKTOP-49PEJRG-20190320-2210.log => moved successfully
C:\Windows\Temp\DESKTOP-49PEJRG-20190320-2242.log => moved successfully
C:\Windows\Temp\DESKTOP-49PEJRG-20190320-2256.log => moved successfully
C:\Windows\Temp\DESKTOP-49PEJRG-20190320-2308.log => moved successfully
C:\Windows\Temp\DESKTOP-49PEJRG-20190321-0748.log => moved successfully
C:\Windows\Temp\DESKTOP-49PEJRG-20190321-0751.log => moved successfully
C:\Windows\Temp\DESKTOP-49PEJRG-20190321-0759.log => moved successfully
C:\Windows\Temp\DESKTOP-49PEJRG-20190321-1725.log => moved successfully
C:\Windows\Temp\DESKTOP-49PEJRG-20190321-1742.log => moved successfully
C:\Windows\Temp\DESKTOP-49PEJRG-20190321-2208.log => moved successfully
C:\Windows\Temp\DESKTOP-49PEJRG-20190323-2358.log => moved successfully
C:\Windows\Temp\DESKTOP-49PEJRG-20190323-2358a.log => moved successfully
C:\Windows\Temp\DESKTOP-49PEJRG-20190324-0006.log => moved successfully
C:\Windows\Temp\DESKTOP-49PEJRG-20190324-0730.log => moved successfully
C:\Windows\Temp\DESKTOP-49PEJRG-20190324-0814.log => moved successfully
C:\Windows\Temp\DESKTOP-49PEJRG-20190324-0820.log => moved successfully
C:\Windows\Temp\DESKTOP-49PEJRG-20190324-0823.log => moved successfully
C:\Windows\Temp\DESKTOP-49PEJRG-20190324-0841.log => moved successfully
C:\Windows\Temp\DESKTOP-49PEJRG-20190324-0923.log => moved successfully
C:\Windows\Temp\DESKTOP-49PEJRG-20190324-1219.log => moved successfully
C:\Windows\Temp\DESKTOP-49PEJRG-20190324-1830.log => moved successfully
C:\Windows\Temp\DESKTOP-49PEJRG-20190325-2154.log => moved successfully
C:\Windows\Temp\DESKTOP-49PEJRG-20190325-2157.log => moved successfully
C:\Windows\Temp\DESKTOP-49PEJRG-20190325-2157a.log => moved successfully
C:\Windows\Temp\DESKTOP-49PEJRG-20190325-2239.log => moved successfully
C:\Windows\Temp\DESKTOP-49PEJRG-20190325-2335.log => moved successfully
C:\Windows\Temp\DESKTOP-49PEJRG-20190325-2345.log => moved successfully
C:\Windows\Temp\DESKTOP-49PEJRG-20190325-2349.log => moved successfully
C:\Windows\Temp\DESKTOP-49PEJRG-20190325-2353.log => moved successfully
C:\Windows\Temp\DESKTOP-49PEJRG-20190325-2359.log => moved successfully
C:\Windows\Temp\DESKTOP-49PEJRG-20190326-0011.log => moved successfully
C:\Windows\Temp\DESKTOP-49PEJRG-20190326-0017.log => moved successfully
C:\Windows\Temp\DESKTOP-49PEJRG-20190326-0133.log => moved successfully
C:\Windows\Temp\DESKTOP-49PEJRG-20190326-0256.log => moved successfully
C:\Windows\Temp\DESKTOP-49PEJRG-20190326-1732.log => moved successfully
C:\Windows\Temp\DESKTOP-49PEJRG-20190326-1734.log => moved successfully
C:\Windows\Temp\DESKTOP-49PEJRG-20190326-1734a.log => moved successfully
C:\Windows\Temp\DESKTOP-49PEJRG-20190326-1754.log => moved successfully
Could not move "C:\Windows\Temp\DESKTOP-49PEJRG-20190326-1756.log" => Scheduled to move on reboot.
C:\Windows\Temp\InfInstallerLog._19-03-19_12-06-40-111.log => moved successfully
C:\Windows\Temp\InfInstallerLog._19-03-19_12-16-11-900.log => moved successfully
C:\Windows\Temp\MpCmdRun.log => moved successfully
C:\Windows\Temp\MpSigStub.log => moved successfully
C:\Windows\Temp\officeclicktorun.exe_streamserver(20190325233552C8C).log => moved successfully
C:\Windows\Temp\officeclicktorun.exe_streamserver(20190325234525E20).log => moved successfully
C:\Windows\Temp\officeclicktorun.exe_streamserver(20190325234908FB8).log => moved successfully
C:\Windows\Temp\officeclicktorun.exe_streamserver(20190325235305DA4).log => moved successfully
C:\Windows\Temp\officeclicktorun.exe_streamserver(20190326175358F38).log => moved successfully
Could not move "C:\Windows\Temp\officeclicktorun.exe_streamserver(20190326175635B00).log" => Scheduled to move on reboot.
C:\Windows\Temp\WERFC7F.tmp.WERDataCollectionStatus.txt => moved successfully
 
========= End -> "C:\Windows\Temp\*.*" ========
 
 
=========== EmptyTemp: ==========
 
BITS transfer queue => 10510336 B
DOMStore, IE Recovery, AppCache, Feeds Cache, Thumbcache, IconCache => 190993616 B
Java, Flash, Steam htmlcache => 1546 B
Windows/system/drivers => 4209544 B
Edge => 102014436 B
Chrome => 513637934 B
Firefox => 186647747 B
Opera => 0 B
 
Temp, IE cache, history, cookies, recent:
Default => 0 B
Users => 0 B
ProgramData => 0 B
Public => 0 B
systemprofile => 0 B
systemprofile32 => 0 B
LocalService => 22466 B
LocalService => 0 B
NetworkService => 16778 B
NetworkService => 0 B
user => 806359693 B
Someone Else => 22149 B
 
RecycleBin => 590024386 B
EmptyTemp: => 2.2 GB temporary data Removed.
 
================================
 
Result of scheduled files to move (Boot Mode: Normal) (Date&Time: 26-03-2019 17:59:48)
 
C:\Windows\Temp\aria-debug-2816.log => Is moved successfully
C:\Windows\Temp\DESKTOP-49PEJRG-20190326-1756.log => Is moved successfully
C:\Windows\Temp\officeclicktorun.exe_streamserver(20190326175635B00).log => Is moved successfully
 
==== End of Fixlog 17:59:48 ====

No threats found when I ran the MBAR

 

Malwarebytes Anti-Rootkit BETA 1.10.3.1001
www.malwarebytes.org
 
Database version:
  main:    v2019.03.26.12
  rootkit: v2019.03.26.12
 
Windows 10 x64 NTFS
Internet Explorer 11.379.17763.0
user :: DESKTOP-49PEJRG [administrator]
 
3/26/2019 6:05:19 PM
mbar-log-2019-03-26 (18-05-19).txt
 
Scan type: Quick scan
Scan options enabled: Anti-Rootkit | Drivers | MBR | Physical Sectors | Memory | Startup | Registry | File System | Heuristics/Extra | Heuristics/Shuriken
Scan options disabled: 
Objects scanned: 222067
Time elapsed: 4 minute(s), 37 second(s)
 
Memory Processes Detected: 0
(No malicious items detected)
 
Memory Modules Detected: 0
(No malicious items detected)
 
Registry Keys Detected: 0
(No malicious items detected)
 
Registry Values Detected: 0
(No malicious items detected)
 
Registry Data Items Detected: 0
(No malicious items detected)
 
Folders Detected: 0
(No malicious items detected)
 
Files Detected: 0
(No malicious items detected)
 
Physical Sectors Detected: 0
(No malicious items detected)
 
(end)
You have files and folders that show Avira on the computer?, or are those left over from an uninstall too?

R2 avgntflt; C:\WINDOWS\System32\DRIVERS\avgntflt.sys [178840 2018-02-13] (Avira Operations GmbH & Co. KG -> Avira Operations GmbH & Co. KG)
R1 avipbb; C:\WINDOWS\system32\DRIVERS\avipbb.sys [169864 2018-02-13] (Avira Operations GmbH & Co. KG -> Avira Operations GmbH & Co. KG)
R1 avkmgr; C:\WINDOWS\system32\DRIVERS\avkmgr.sys [44488 2018-02-13] (Avira Operations GmbH & Co. KG -> Avira Operations GmbH & Co. KG)

~~~~~~~~~~~~~~~~~~
Let's see if we can run a few more tools.

[external image: zcMPezJ.png]AdwCleaner - Fix Mode
  • Download AdwCleaner and move it to your Desktop
  • Right-click on AdwCleaner.exe and select [external image: Spcusrh.png]Run as Administrator (for Windows Vista, 7, 8, 8.1 and 10 users)
  • Accept the EULA (I accept), then click on Scan
  • Let the scan complete. Once it's done, make sure that every item listed in the different tabs is checked and click on the Clean & Repair button. This will kill all the active processes
  • Once the cleaning process is complete, AdwCleaner will ask to restart your computer, do it
  • After the restart, a log will open when logging in. Please copy/paste the content of that log in your next reply

    ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~`
    [external image: RQKuhw1.png]RogueKiller
  • Download the right version of RogueKiller for your Windows version (32 or 64-bit)
  • Once done, move the executable file to your Desktop, right-click on it and select [external image: Spcusrh.png]Run as Administrator (for Windows Vista, 7, 8, 8.1 and 10 users)
  • Click on the Start Scan button in the right panel, which will bring you to another tab, and click on it again (this time it'll be in the bottom right corner)
  • Wait for the scan to complete
  • On completion, the results will be displayed
  • Check every single entry (threat found), and click on the Remove Selected button
  • On completion, the results will be displayed. Click on the Open Report button in the bottom left corner, followed by the Open TXT button (also in the bottom left corner)
  • This will open the report in Notepad. Copy/paste its content in your next reply

    ~~~~~~~~~~~~~~~~~~~~~~~~~`

    Please download the Malwarebytes Anti-Malware setup file to your Desktop.

    OR from this location Here

  • Open mbam-setup.x.x.xxxx.exe (x represents the version #) and follow the prompts to install the programme.
  • Windows Vista, Windows 7 , 8, 8.1 and 10 : Right click and select "Run as Administrator"
    [external image: MBAM3_zpsw0f8rn9n.jpg]
  • After the installation IS complete let it update if it asks.
  • Then go to the Dashboard and click on SCAN NOW
  • If threats are detected, click the Apply Actions button. You will now be prompted to reboot. Click Yes.
    Upon completion of the scan (or after the reboot), click the Reports tab.
    Double-click the Scan Log.
    At the bottom click Export and choose Text file.

    Save the file to your desktop and include its content in your next reply.

    You can access the logs by going in the "Reports" tab, clicking on the latest "Scan" entry (the one with detections), then clicking on the "Export" button in the bottom-left corner and select "Copy to clipboard". After that, all you have to do is paste it here
  • Then click on POST
  • Exit Malwarebytes
Please post these 3 logs when finished.

I uninstalled my virus protection - not sure why traces are still showing?  Here is the adware log

 

# ——————————-
# Malwarebytes AdwCleaner 7.2.7.0
# ——————————-
# Build:    01-30-2019
# Database: 2019-03-25.1 (Cloud)
# Support:  https://www.malwarebytes.com/support
#
# ——————————-
# Mode: Clean
# ——————————-
# Start:    03-26-2019
# Duration: 00:00:02
# OS:       Windows 10 Home
# Cleaned:  15
# Failed:   0
 
 
***** [ Services ] *****
 
No malicious services cleaned.
 
***** [ Folders ] *****
 
Deleted       C:\Windows\ServiceProfiles\LocalService\AppData\Local\Host App Service
Deleted       C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Host App Service
Deleted       C:\Users\Someone Else\AppData\Local\Host App Service
Deleted       C:\Windows\SysWOW64\config\systemprofile\AppData\Roaming\TotalAV
Deleted       C:\Users\user\Documents\TotalAV
Deleted       C:\ProgramData\SecuritySuite
 
***** [ Files ] *****
 
Deleted       C:\Users\user\Downloads\TOTALAV.EXE
Deleted       C:\Users\user\Downloads\TOTALAV_SETUP.EXE
 
***** [ DLL ] *****
 
No malicious DLLs cleaned.
 
***** [ WMI ] *****
 
No malicious WMI cleaned.
 
***** [ Shortcuts ] *****
 
No malicious shortcuts cleaned.
 
***** [ Tasks ] *****
 
No malicious tasks cleaned.
 
***** [ Registry ] *****
 
Deleted       HKCU\Software\SSProtect
Deleted       HKCU\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\Internet Explorer\DOMStorage\thebrighttag.com
Deleted       HKCU\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\Internet Explorer\DOMStorage\s.thebrighttag.com
Deleted       HKCU\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\Internet Explorer\EdpDomStorage\thebrighttag.com
Deleted       HKCU\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\Internet Explorer\EdpDomStorage\s.thebrighttag.com
Deleted       HKLM\SOFTWARE\Mozilla\NativeMessagingHosts\com.totalav.passwordvaultassistant
Deleted       HKLM\SOFTWARE\Google\Chrome\NativeMessagingHosts\com.totalav.passwordvaultassistant
 
***** [ Chromium (and derivatives) ] *****
 
No malicious Chromium entries cleaned.
 
***** [ Chromium URLs ] *****
 
No malicious Chromium URLs cleaned.
 
***** [ Firefox (and derivatives) ] *****
 
No malicious Firefox entries cleaned.
 
***** [ Firefox URLs ] *****
 
No malicious Firefox URLs cleaned.
 
 
*************************
 
[+] Delete Tracing Keys
[+] Reset Winsock
 
*************************
 
AdwCleaner[S00].txt - [3455 octets] - [27/05/2018 20:46:18]
AdwCleaner[C00].txt - [3066 octets] - [27/05/2018 20:46:54]
AdwCleaner[S01].txt - [3159 octets] - [26/03/2019 21:35:54]
 
########## EOF - C:\AdwCleaner\Logs\AdwCleaner[C01].txt ##########

roguekiller found no problems

 

RogueKiller Anti-Malware V13.1.8.0 (x64) [Mar 12 2019] (Free) by Adlice Software
mail : https://adlice.com/contact/
Website : https://adlice.com/download/roguekiller/
Operating System : Windows 10 (10.0.17763) 64 bits
Started in : Normal mode
User : user [Administrator]
Started from : C:\Program Files\RogueKiller\RogueKiller64.exe
Signatures : 20190304_123840, Driver : Loaded
Mode : Standard Scan, Scan – Date : 2019/03/26 21:41:37 (Duration : 00:02:59)
 
¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤ Processes ¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤
 
¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤ Process Modules ¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤
 
¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤ Services ¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤
 
¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤ Tasks ¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤
 
¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤ Registry ¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤
 
¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤ WMI ¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤
 
¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤ Hosts File ¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤
 
¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤ Files ¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤
 
¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤ Web browsers ¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤

and finally the last

 

 

Malwarebytes
www.malwarebytes.com
 
-Log Details-
Scan Date: 3/26/19
Scan Time: 9:48 PM
Log File: 787baeea-5032-11e9-aee1-f44d30b723c3.json
 
-Software Information-
Version: 3.7.1.2839
Components Version: 1.0.563
Update Package Version: 1.0.9872
License: Trial
 
-System Information-
OS: Windows 10 (Build 17763.379)
CPU: x64
File System: NTFS
User: DESKTOP-49PEJRG\user
 
-Scan Summary-
Scan Type: Threat Scan
Scan Initiated By: Manual
Result: Completed
Objects Scanned: 309054
Threats Detected: 38
Threats Quarantined: 38
Time Elapsed: 0 min, 50 sec
 
-Scan Options-
Memory: Enabled
Startup: Enabled
Filesystem: Enabled
Archives: Enabled
Rootkits: Disabled
Heuristics: Enabled
PUP: Detect
PUM: Detect
 
-Scan Details-
Process: 0
(No malicious items detected)
 
Module: 0
(No malicious items detected)
 
Registry Key: 0
(No malicious items detected)
 
Registry Value: 1
PUP.Optional.Spigot.Generic, HKU\S-1-5-21-93585695-1239137162-3987457199-1001\SOFTWARE\GOOGLE\CHROME\PREFERENCEMACS\Default\extensions.settings|chmeebignelmkoiapdiipncdekbfnlgo, Quarantined, [217], [530199],1.0.9872
 
Registry Data: 0
(No malicious items detected)
 
Data Stream: 0
(No malicious items detected)
 
Folder: 11
PUP.Optional.Spigot.Generic, C:\USERS\USER\APPDATA\LOCAL\GOOGLE\CHROME\USER DATA\Default\Sync Extension Settings\chmeebignelmkoiapdiipncdekbfnlgo, Quarantined, [217], [530199],1.0.9872
PUP.Optional.Spigot.Generic, C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\chmeebignelmkoiapdiipncdekbfnlgo\6.6_0\html\browserAction, Quarantined, [217], [530199],1.0.9872
PUP.Optional.Spigot.Generic, C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\chmeebignelmkoiapdiipncdekbfnlgo\6.6_0\_locales\en, Quarantined, [217], [530199],1.0.9872
PUP.Optional.Spigot.Generic, C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\chmeebignelmkoiapdiipncdekbfnlgo\6.6_0\_metadata, Quarantined, [217], [530199],1.0.9872
PUP.Optional.Spigot.Generic, C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\chmeebignelmkoiapdiipncdekbfnlgo\6.6_0\_locales, Quarantined, [217], [530199],1.0.9872
PUP.Optional.Spigot.Generic, C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\chmeebignelmkoiapdiipncdekbfnlgo\6.6_0\newtab, Quarantined, [217], [530199],1.0.9872
PUP.Optional.Spigot.Generic, C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\chmeebignelmkoiapdiipncdekbfnlgo\6.6_0\html, Quarantined, [217], [530199],1.0.9872
PUP.Optional.Spigot.Generic, C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\chmeebignelmkoiapdiipncdekbfnlgo\6.6_0\css, Quarantined, [217], [530199],1.0.9872
PUP.Optional.Spigot.Generic, C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\chmeebignelmkoiapdiipncdekbfnlgo\6.6_0\js, Quarantined, [217], [530199],1.0.9872
PUP.Optional.Spigot.Generic, C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\chmeebignelmkoiapdiipncdekbfnlgo\6.6_0, Quarantined, [217], [530199],1.0.9872
PUP.Optional.Spigot.Generic, C:\USERS\USER\APPDATA\LOCAL\GOOGLE\CHROME\USER DATA\DEFAULT\EXTENSIONS\CHMEEBIGNELMKOIAPDIIPNCDEKBFNLGO, Quarantined, [217], [530199],1.0.9872
 
File: 26
PUP.Optional.Spigot.Generic, C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Sync Extension Settings\chmeebignelmkoiapdiipncdekbfnlgo\000003.log, Quarantined, [217], [530199],1.0.9872
PUP.Optional.Spigot.Generic, C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Sync Extension Settings\chmeebignelmkoiapdiipncdekbfnlgo\CURRENT, Quarantined, [217], [530199],1.0.9872
PUP.Optional.Spigot.Generic, C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Sync Extension Settings\chmeebignelmkoiapdiipncdekbfnlgo\LOCK, Quarantined, [217], [530199],1.0.9872
PUP.Optional.Spigot.Generic, C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Sync Extension Settings\chmeebignelmkoiapdiipncdekbfnlgo\LOG, Quarantined, [217], [530199],1.0.9872
PUP.Optional.Spigot.Generic, C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Sync Extension Settings\chmeebignelmkoiapdiipncdekbfnlgo\LOG.old, Quarantined, [217], [530199],1.0.9872
PUP.Optional.Spigot.Generic, C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Sync Extension Settings\chmeebignelmkoiapdiipncdekbfnlgo\MANIFEST-000001, Quarantined, [217], [530199],1.0.9872
PUP.Optional.Spigot.Generic, C:\USERS\USER\APPDATA\LOCAL\GOOGLE\CHROME\USER DATA\Default\Secure Preferences, Replaced, [217], [530199],1.0.9872
PUP.Optional.Spigot.Generic, C:\USERS\USER\APPDATA\LOCAL\GOOGLE\CHROME\USER DATA\Default\Preferences, Replaced, [217], [530199],1.0.9872
PUP.Optional.Spigot.Generic, C:\USERS\USER\APPDATA\LOCAL\GOOGLE\CHROME\USER DATA\Default\Sync Data\SyncData.sqlite3, Replaced, [217], [530199],1.0.9872
PUP.Optional.Spigot.Generic, C:\USERS\USER\APPDATA\LOCAL\GOOGLE\CHROME\USER DATA\DEFAULT\EXTENSIONS\CHMEEBIGNELMKOIAPDIIPNCDEKBFNLGO\6.6_0\CHROMERESTORE.JS, Quarantined, [217], [530199],1.0.9872
PUP.Optional.Spigot.Generic, C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\chmeebignelmkoiapdiipncdekbfnlgo\6.6_0\css\browserAction.css, Quarantined, [217], [530199],1.0.9872
PUP.Optional.Spigot.Generic, C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\chmeebignelmkoiapdiipncdekbfnlgo\6.6_0\css\description.css, Quarantined, [217], [530199],1.0.9872
PUP.Optional.Spigot.Generic, C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\chmeebignelmkoiapdiipncdekbfnlgo\6.6_0\html\browserAction\browserAction.html, Quarantined, [217], [530199],1.0.9872
PUP.Optional.Spigot.Generic, C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\chmeebignelmkoiapdiipncdekbfnlgo\6.6_0\html\browserAction\description.html, Quarantined, [217], [530199],1.0.9872
PUP.Optional.Spigot.Generic, C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\chmeebignelmkoiapdiipncdekbfnlgo\6.6_0\js\userNewTab.js, Quarantined, [217], [530199],1.0.9872
PUP.Optional.Spigot.Generic, C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\chmeebignelmkoiapdiipncdekbfnlgo\6.6_0\newtab\quicknewtabpage.html, Quarantined, [217], [530199],1.0.9872
PUP.Optional.Spigot.Generic, C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\chmeebignelmkoiapdiipncdekbfnlgo\6.6_0\_locales\en\messages.json, Quarantined, [217], [530199],1.0.9872
PUP.Optional.Spigot.Generic, C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\chmeebignelmkoiapdiipncdekbfnlgo\6.6_0\_metadata\verified_contents.json, Quarantined, [217], [530199],1.0.9872
PUP.Optional.Spigot.Generic, C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\chmeebignelmkoiapdiipncdekbfnlgo\6.6_0\after.js, Quarantined, [217], [530199],1.0.9872
PUP.Optional.Spigot.Generic, C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\chmeebignelmkoiapdiipncdekbfnlgo\6.6_0\background.js, Quarantined, [217], [530199],1.0.9872
PUP.Optional.Spigot.Generic, C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\chmeebignelmkoiapdiipncdekbfnlgo\6.6_0\contentscript.js, Quarantined, [217], [530199],1.0.9872
PUP.Optional.Spigot.Generic, C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\chmeebignelmkoiapdiipncdekbfnlgo\6.6_0\icon.png, Quarantined, [217], [530199],1.0.9872
PUP.Optional.Spigot.Generic, C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\chmeebignelmkoiapdiipncdekbfnlgo\6.6_0\manifest.json, Quarantined, [217], [530199],1.0.9872
PUP.Optional.PCProtect, C:\USERS\USER\DOWNLOADS\TOTALAV (1).EXE, Quarantined, [654], [652430],1.0.9872
PUP.Optional.DriverSupport, C:\USERS\USER\DOWNLOADS\DRIVERSUPPORT.EXE, Quarantined, [12926], [645741],1.0.9872
PUP.Optional.PCProtect, C:\USERS\USER\DOWNLOADS\TOTALAV (2).EXE, Quarantined, [654], [652430],1.0.9872
 
Physical Sector: 0
(No malicious items detected)
 
WMI: 0
(No malicious items detected)
 
 
(end)

Why is Google Chrome and my antivirus protection coming up in these logs?  Does this mean I can't reinstall my virus protection?  so much for protection anyway.  lol

Why is Google Chrome and my antivirus protection coming up in these logs?  Does this mean I can't reinstall my virus protection?  so much for protection anyway.  lol

Somewhere you visited placed bad chrome extensions on your machine or, it came bundled with the antivirus you downloaded….which you didn't know was a bad choice.

I can give you a list of good options

How's your computer now?

you should always keep vulnerable programs like Adobe Flash Player, Adobe Shockwave Player, Java, Silverlight, Google Chrome, Mozilla Firefox, VLC Media Player, etc. updated to their most recent version (even better, you don't have to install them if you don't use them). Programs like 🖼Click to load external image (eF2jhaz.png)UCheck, ]SUMo and 🖼Click to load external image (y5YE7At.png)Heimdal Free will scan your system for outdated programs, and help you identify them, as well as update them.Note: The programs listed below are all free to use or they have some sort of trial. Some of them have a paid version that provides more features, while a lot of other good programs only have a paid version but aren't listed there (such as Kaspersky and ESET Antivirus products).

Anti-VirusAnti-MalwareWeb Browsers and Web Browsing

Web Browsers could be considered as the closest door between a malware and your system. This is where most malware goes through to infect a system, and therefore it should be the program(s) you want to secure the most. There are two ways of going about it: hardening your web browser via extensions, and having good browsing habits.

Hardening your web browser means to install extensions that will help it protect itself (and your system on the same occasion) against Exploit Kits, MiTM attacks, etc. but also you at the same time. Here are a few extensions that I recommend you to install.
  • uBlock Origin: Efficient multi-purpose blocker that is lightweight on RAM and CPU usage (Google Chrome, Mozilla Firefox, Microsoft Edge, Opera and most Chromium and Firefox-based browsers)
  • HTTPS Everywhere: Extension that converts your HTTP (unencrypted) requests to HTTPS (encrypted) ones (Google Chrome, Mozilla Firefox and Opera)
  • Web of Trust: Website reputation, rating and review extension that will help you quickly identify bad and suspicious sites from good ones (every web browsers)
  • NoScript: NoScript is a script blocker (Java, Flash, JavaScript, etc.) for Mozilla Firefox and Firefox-based browsers (Mozilla Firefox and Firefox-based web browsers)
  • uMatrix: For advanced users, a point and click matrix-like extensions that allow you to control requests done on a webpage (based on source, destination and type) (Google Chrome, Mozilla Firefox and Opera)
  • LastPass: Secure password manager allowing you to create, manage, and use passwords you save in your LastPass account (every web browser)
created by Aura

The pc seems better.  my anti virus program is supposed to be reputable, no?  I have a paid subscription and now i have no protection.  Do you really think if I downloaded back it would give me an issue?

Quote
my anti virus program is supposed to be reputable, no?  I have a paid subscription and now i have no protection.

creators of malware removal tools find it and quarantine it because of suspicious behavior or by what it downloads and bundles on your computer, thats my guess
Malwarebytes AdwCleaner == TotalAV
https://www.pcmag.com/review/364523/totalav-essential-antivirus

Even if you do not download and install another antivirus program your machine still has an on board antivirus called Windows Defender.
Some people use that only or you can chose another one from a list of antivirus I posted in an earlier post.

I think we're ready to remove the tools we used to remove the infection?

Ask AI

AI can make mistakes. Check the cited posts. Archived advice can be out-of-date

Don't include personal information. Questions and selected public posts go to OpenAI. About Ask AI