Jump to content


 


Register a free account to unlock additional features at BleepingComputer.com
Welcome to BleepingComputer, a free community where people like yourself come together to discuss and learn how to use their computers. Using the site is easy and fun. As a guest, you can browse and view the various discussions in the forums, but can not create a new topic or reply to an existing one unless you are logged in. Other benefits of registering an account are subscribing to topics and forums, creating a blog, and having no ads shown anywhere on the site.


Click here to Register a free account now! or read our Welcome Guide to learn how to use this site.

Photo

browser redirect after a fresh windows 10 install?


  • This topic is locked This topic is locked
2 replies to this topic

#1 eb0y1

eb0y1

  • Members
  • 3 posts
  • OFFLINE
  •  

Posted 17 December 2015 - 01:39 PM

I don't know the specific name of this virus

I installed a fresh copy of windows downloaded some drivers from official dell website and google chrome

I have this annoying redirect virus as you can see in the picture below

uX6BfAg.png

I have attached the "Addition" log file And here is the FRST log:

 

Scan result of Farbar Recovery Scan Tool (FRST) (x64) Version:17-12-2015
Ran by Safwat (administrator) on DESKTOP-QDHMVVU (17-12-2015 20:25:03)
Running from C:\Users\Safwat\Downloads
Loaded Profiles: Safwat (Available Profiles: Safwat)
Platform: Windows 10 Enterprise Version 1511 (X64) Language: English (United Kingdom)
Internet Explorer Version 11 (Default browser: Chrome)
Boot Mode: Normal
 
==================== Processes (Whitelisted) =================
 
(If an entry is included in the fixlist, the process will be closed. The file will not be moved.)
 
(AMD) C:\Windows\System32\atiesrxx.exe
(AMD) C:\Windows\System32\atieclxx.exe
(Intel Corporation) C:\Windows\SysWOW64\IntelCpHeciSvc.exe
(Intel Corporation) C:\Windows\System32\igfxCUIService.exe
(Realtek Semiconductor) C:\Program Files\Realtek\Audio\HDA\RtkAudioService64.exe
(Realtek Semiconductor) C:\Program Files\Realtek\Audio\HDA\RAVBg64.exe
(Realtek Semiconductor) C:\Program Files\Realtek\Audio\HDA\RAVBg64.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome Remote Desktop\47.0.2526.18\remoting_host.exe
(Microsoft Corporation) C:\Program Files\Windows Defender\MsMpEng.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome Remote Desktop\47.0.2526.18\remoting_host.exe
(Microsoft Corporation) C:\Program Files\Windows Defender\NisSrv.exe
(Microsoft Corporation) C:\Windows\Microsoft.NET\Framework64\v3.0\WPF\PresentationFontCache.exe
(Synaptics Incorporated) C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
() C:\Program Files\WindowsApps\Microsoft.Messaging_1.10.22012.0_x86__8wekyb3d8bbwe\SkypeHost.exe
(Intel Corporation) C:\Windows\System32\igfxEM.exe
(Intel Corporation) C:\Windows\System32\igfxHK.exe
(Intel Corporation) C:\Windows\System32\igfxTray.exe
(Synaptics Incorporated) C:\Program Files\Synaptics\SynTP\SynTPHelper.exe
(Dell Inc.) C:\Program Files\Dell\QuickSet\quickset.exe
(Realtek Semiconductor) C:\Program Files\Realtek\Audio\HDA\RtkNGUI64.exe
(Realtek Semiconductor) C:\Program Files\Realtek\Audio\HDA\RAVBg64.exe
(Realtek Semiconductor) C:\Program Files\Realtek\Audio\HDA\RAVBg64.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Advanced Micro Devices Inc.) C:\Program Files (x86)\AMD\ATI.ACE\Core-Static\MOM.exe
(Advanced Micro Devices Inc.) C:\Program Files (x86)\AMD\ATI.ACE\Core-Static\CCC.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Microsoft Corporation) C:\Program Files\Windows Defender\MpCmdRun.exe
 
 
==================== Registry (Whitelisted) ===========================
 
(If an entry is included in the fixlist, the registry item will be restored to default or removed. The file will not be moved.)
 
HKLM\...\Run: [QuickSet] => C:\Program Files\Dell\QuickSet\QuickSet.exe [5774664 2013-10-21] (Dell Inc.)
HKLM\...\Run: [RTHDVCPL] => C:\Program Files\Realtek\Audio\HDA\RtkNGUI64.exe [8468184 2015-05-22] (Realtek Semiconductor)
HKLM\...\Run: [RtHDVBg] => C:\Program Files\Realtek\Audio\HDA\RAVBg64.exe [1393880 2015-04-28] (Realtek Semiconductor)
HKLM-x32\...\Run: [StartCCC] => C:\Program Files (x86)\AMD\ATI.ACE\Core-Static\amd64\CLIStart.exe [767176 2015-08-06] (Advanced Micro Devices, Inc.)
 
==================== Internet (Whitelisted) ====================
 
(If an item is included in the fixlist, if it is a registry item it will be removed or restored to default.)
 
Tcpip\Parameters: [DhcpNameServer] 5.39.23.194 8.8.8.8
Tcpip\..\Interfaces\{45034f97-6019-49b5-905b-e090e3dbf1e9}: [DhcpNameServer] 5.39.23.194 8.8.8.8
 
Internet Explorer:
==================
 
FireFox:
========
FF Plugin-x32: @tools.google.com/Google Update;version=3 -> C:\Program Files (x86)\Google\Update\1.3.29.1\npGoogleUpdate3.dll [2015-12-17] (Google Inc.)
FF Plugin-x32: @tools.google.com/Google Update;version=9 -> C:\Program Files (x86)\Google\Update\1.3.29.1\npGoogleUpdate3.dll [2015-12-17] (Google Inc.)
 
Chrome: 
=======
CHR HomePage: Default -> hxxp://www.omniboxes.com/?type=hp&ts=1426879469&from=obw&uid=ST1000LM024XHN-M101MBB_S2WZJ90D336887336887
CHR StartupUrls: Default -> "hxxp://www.omniboxes.com/?type=hp&ts=1426879469&from=obw&uid=ST1000LM024XHN-M101MBB_S2WZJ90D336887336887"
CHR Profile: C:\Users\Safwat\AppData\Local\Google\Chrome\User Data\Default
CHR Extension: (Google Slides) - C:\Users\Safwat\AppData\Local\Google\Chrome\User Data\Default\Extensions\aapocclcgogkmnckokdopfmhonfmgoek [2015-12-17]
CHR Extension: (Google Docs) - C:\Users\Safwat\AppData\Local\Google\Chrome\User Data\Default\Extensions\aohghmighlieiainnegkcijnfilokake [2015-12-17]
CHR Extension: (Google Drive) - C:\Users\Safwat\AppData\Local\Google\Chrome\User Data\Default\Extensions\apdfllckaahabafndbhieahigkjlhalf [2015-12-17]
CHR Extension: (YouTube) - C:\Users\Safwat\AppData\Local\Google\Chrome\User Data\Default\Extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo [2015-12-17]
CHR Extension: (APK Downloader) - C:\Users\Safwat\AppData\Local\Google\Chrome\User Data\Default\Extensions\cgihflhdpokeobcfimliamffejfnmfii [2015-12-17]
CHR Extension: (Pushbullet) - C:\Users\Safwat\AppData\Local\Google\Chrome\User Data\Default\Extensions\chlffgpmiacpedhhbkiomidkjlcfhogd [2015-12-17]
CHR Extension: (Google Search) - C:\Users\Safwat\AppData\Local\Google\Chrome\User Data\Default\Extensions\coobgpohoikkiipiblmjeljniedjpjpf [2015-12-17]
CHR Extension: (Google Sheets) - C:\Users\Safwat\AppData\Local\Google\Chrome\User Data\Default\Extensions\felcaaldnbdncclmgdcncolpebgiejap [2015-12-17]
CHR Extension: (EditThisCookie) - C:\Users\Safwat\AppData\Local\Google\Chrome\User Data\Default\Extensions\fngmhnnpilhplaeedifhccceomclgfbg [2015-12-17]
CHR Extension: (Chrome Remote Desktop) - C:\Users\Safwat\AppData\Local\Google\Chrome\User Data\Default\Extensions\gbchcmhmhahfdphkhkmpfmihenigjmpp [2015-12-17]
CHR Extension: (Google Docs Offline) - C:\Users\Safwat\AppData\Local\Google\Chrome\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi [2015-12-17]
CHR Extension: (AdBlock) - C:\Users\Safwat\AppData\Local\Google\Chrome\User Data\Default\Extensions\gighmmpiobklfepjocnamgkkbiglidom [2015-12-17]
CHR Extension: (Unlimited Free VPN - Hola) - C:\Users\Safwat\AppData\Local\Google\Chrome\User Data\Default\Extensions\gkojfkhlekighikafcpjkiklfbnlmeio [2015-12-17]
CHR Extension: (Anti-Porn Pro - The best Anti-Porn addon!) - C:\Users\Safwat\AppData\Local\Google\Chrome\User Data\Default\Extensions\hbepadcdhpahlikldbochnhfleejiokp [2015-12-17]
CHR Extension: (Chrome Web Store Payments) - C:\Users\Safwat\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda [2015-12-17]
CHR Extension: (ImTranslator: Translator, Dictionary, TTS) - C:\Users\Safwat\AppData\Local\Google\Chrome\User Data\Default\Extensions\noaijdpnepcgjemiklgfkcfbkokogabh [2015-12-17]
CHR Extension: (Gmail) - C:\Users\Safwat\AppData\Local\Google\Chrome\User Data\Default\Extensions\pjkljhegncpnkpknbcohdijeoejaedia [2015-12-17]
 
==================== Services (Whitelisted) ========================
 
(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)
 
R2 chromoting; C:\Program Files (x86)\Google\Chrome Remote Desktop\47.0.2526.18\remoting_host.exe [69448 2015-10-14] (Google Inc.)
R2 igfxCUIService1.0.0.0; C:\Windows\system32\igfxCUIService.exe [328608 2015-07-30] (Intel Corporation)
R2 RtkAudioService; C:\Program Files\Realtek\Audio\HDA\RtkAudioService64.exe [294616 2015-05-22] (Realtek Semiconductor)
R3 WdNisSvc; C:\Program Files\Windows Defender\NisSrv.exe [364464 2015-10-30] (Microsoft Corporation)
R2 WinDefend; C:\Program Files\Windows Defender\MsMpEng.exe [24864 2015-10-30] (Microsoft Corporation)
 
===================== Drivers (Whitelisted) ==========================
 
(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)
 
R0 amdkmpfd; C:\Windows\System32\drivers\amdkmpfd.sys [82696 2015-07-31] (Advanced Micro Devices, Inc.)
R3 MEIx64; C:\Windows\System32\drivers\TeeDriverW8x64.sys [193336 2015-07-10] (Intel Corporation)
R3 rt640x64; C:\Windows\System32\drivers\rt640x64.sys [589824 2015-10-30] (Realtek                                            )
R3 SmbDrvI; C:\Windows\system32\DRIVERS\Smb_driver_Intel.sys [33960 2015-05-29] (Synaptics Incorporated)
S0 WdBoot; C:\Windows\System32\drivers\WdBoot.sys [44568 2015-10-30] (Microsoft Corporation)
R0 WdFilter; C:\Windows\System32\drivers\WdFilter.sys [293216 2015-10-30] (Microsoft Corporation)
R3 WdNisDrv; C:\Windows\System32\Drivers\WdNisDrv.sys [118112 2015-10-30] (Microsoft Corporation)
 
==================== NetSvcs (Whitelisted) ===================
 
(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)
 
 
==================== One Month Created files and folders ========
 
(If an entry is included in the fixlist, the file/folder will be moved.)
 
2015-12-17 20:25 - 2015-12-17 20:25 - 00009545 _____ C:\Users\Safwat\Downloads\FRST.txt
2015-12-17 20:24 - 2015-12-17 20:25 - 00000000 ____D C:\FRST
2015-12-17 20:21 - 2015-12-17 20:24 - 02370048 _____ (Farbar) C:\Users\Safwat\Downloads\FRST64.exe
2015-12-17 19:52 - 2015-12-17 19:54 - 00479418 _____ C:\TDSSKiller.3.1.0.9_17.12.2015_19.52.06_log.txt
2015-12-17 19:51 - 2015-12-17 19:52 - 04727984 _____ (Kaspersky Lab ZAO) C:\Users\Safwat\Downloads\tdsskiller.exe
2015-12-17 19:46 - 2013-08-05 21:20 - 00053248 _____ (Windows XP Bundled build C-Centric Single User) C:\Windows\SysWOW64\CSVer.dll
2015-12-17 19:30 - 2015-12-17 19:30 - 00000000 ____D C:\Users\Safwat\AppData\Roaming\ATI
2015-12-17 19:30 - 2015-12-17 19:30 - 00000000 ____D C:\Users\Safwat\AppData\Local\ATI
2015-12-17 19:30 - 2015-12-17 19:30 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\AMD Catalyst Control Center
2015-12-17 19:30 - 2015-12-17 19:30 - 00000000 ____D C:\ProgramData\ATI
2015-12-17 19:29 - 2015-12-17 19:29 - 00000000 ____D C:\Program Files (x86)\AMD
2015-12-17 19:28 - 2015-12-17 19:28 - 00000000 ____D C:\ProgramData\Package Cache
2015-12-17 19:24 - 2015-12-17 19:24 - 00000000 ____H C:\Windows\system32\Drivers\Msft_User_WpdMtpDr_01_11_00.Wdf
2015-12-17 19:20 - 2015-12-17 19:20 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Dell Audio
2015-12-17 19:20 - 2015-12-17 19:20 - 00000000 ____D C:\Program Files\Waves
2015-12-17 19:19 - 2015-12-17 19:29 - 00000000 ____D C:\Windows\LastGood
2015-12-17 19:19 - 2015-12-17 19:19 - 00000000 ____D C:\Users\Safwat\AppData\Roaming\Macromedia
2015-12-17 19:19 - 2015-05-26 17:26 - 01746136 _____ (Realtek Semiconductor Corp.) C:\Windows\system32\RCoInstII64.dll
2015-12-17 19:19 - 2015-05-26 16:59 - 02072039 _____ C:\Windows\system32\Drivers\RTAIODAT.DAT
2015-12-17 19:19 - 2015-05-26 11:59 - 00166616 _____ (Realtek Semiconductor Corp.) C:\Windows\system32\RtkCfg64.dll
2015-12-17 19:19 - 2015-05-20 16:14 - 03234520 _____ (Realtek Semiconductor Corp.) C:\Windows\system32\RtkApi64.dll
2015-12-17 19:19 - 2015-05-18 14:47 - 02702040 _____ (Realtek Semiconductor Corp.) C:\Windows\system32\RTSnMg64.cpl
2015-12-17 19:19 - 2015-05-15 19:27 - 02918104 _____ (Realtek Semiconductor Corp.) C:\Windows\system32\RtPgEx64.dll
2015-12-17 19:19 - 2015-05-15 16:32 - 01316056 _____ (Realtek Semiconductor Corp.) C:\Windows\system32\RTCOM64.dll
2015-12-17 19:19 - 2015-01-19 17:10 - 72113152 _____ (Realtek Semiconductor Corp.) C:\Windows\system32\RCORES64.dat
2015-12-17 19:19 - 2014-11-11 12:44 - 00631000 _____ (Realtek Semiconductor Corp.) C:\Windows\system32\RtDataProc64.dll
2015-12-17 19:19 - 2013-04-23 14:54 - 00154184 _____ (Realtek Semiconductor Corp.) C:\Windows\system32\RtkXInterface64.dll
2015-12-17 19:19 - 2013-01-11 15:27 - 00628504 _____ (Creative Technology Ltd.) C:\Windows\system32\MBTHX64.dll
2015-12-17 19:19 - 2013-01-11 15:27 - 00563992 _____ (Creative Technology Ltd.) C:\Windows\SysWOW64\MBTHX32.dll
2015-12-17 19:19 - 2012-08-31 19:18 - 07164176 _____ (Dolby Laboratories) C:\Windows\system32\R4EEP64A.dll
2015-12-17 19:19 - 2012-08-31 19:17 - 00434960 _____ (Dolby Laboratories) C:\Windows\system32\R4EED64A.dll
2015-12-17 19:19 - 2012-08-31 19:17 - 00141584 _____ (Dolby Laboratories) C:\Windows\system32\R4EEL64A.dll
2015-12-17 19:19 - 2012-08-31 19:17 - 00124176 _____ (Dolby Laboratories) C:\Windows\system32\R4EEA64A.dll
2015-12-17 19:19 - 2012-08-31 19:17 - 00075024 _____ (Dolby Laboratories) C:\Windows\system32\R4EEG64A.dll
2015-12-17 19:19 - 2012-06-08 16:21 - 00897152 _____ (Creative Technology Ltd.) C:\Windows\system32\MBAPO64.dll
2015-12-17 19:19 - 2012-06-08 16:21 - 00753280 _____ (Creative Technology Ltd.) C:\Windows\SysWOW64\MBAPO32.dll
2015-12-17 19:19 - 2011-12-20 14:32 - 00331880 _____ (Realtek Semiconductor Corp.) C:\Windows\system32\RtlCPAPI64.dll
2015-12-17 19:19 - 2011-12-16 13:57 - 00065112 _____ (Creative Technology Ltd.) C:\Windows\system32\MBppld64.dll
2015-12-17 19:19 - 2010-11-08 06:31 - 00375128 _____ (Dolby Laboratories, Inc.) C:\Windows\system32\RTEEP64A.dll
2015-12-17 19:19 - 2010-11-08 06:31 - 00310104 _____ (Dolby Laboratories, Inc.) C:\Windows\system32\RP3DHT64.dll
2015-12-17 19:19 - 2010-11-08 06:31 - 00310104 _____ (Dolby Laboratories, Inc.) C:\Windows\system32\RP3DAA64.dll
2015-12-17 19:19 - 2010-11-08 06:31 - 00204120 _____ (Dolby Laboratories, Inc.) C:\Windows\system32\RTEED64A.dll
2015-12-17 19:19 - 2010-11-08 06:31 - 00101208 _____ (Dolby Laboratories, Inc.) C:\Windows\system32\RTEEL64A.dll
2015-12-17 19:19 - 2010-11-08 06:31 - 00078680 _____ (Dolby Laboratories, Inc.) C:\Windows\system32\RTEEG64A.dll
2015-12-17 19:19 - 2009-11-24 08:55 - 00518896 _____ (SRS Labs, Inc.) C:\Windows\system32\SRSTSX64.dll
2015-12-17 19:19 - 2009-11-24 08:55 - 00211184 _____ (SRS Labs, Inc.) C:\Windows\system32\SRSTSH64.dll
2015-12-17 19:19 - 2009-11-24 08:55 - 00198896 _____ (SRS Labs, Inc.) C:\Windows\system32\SRSHP64.dll
2015-12-17 19:19 - 2009-11-24 08:55 - 00155888 _____ (SRS Labs, Inc.) C:\Windows\system32\SRSWOW64.dll
2015-12-17 19:19 - 2009-11-18 06:13 - 00060504 _____ (Creative Technology Ltd.) C:\Windows\system32\MBPPCn64.dll
2015-12-17 19:18 - 2015-12-17 19:18 - 00000000 ___HD C:\Program Files (x86)\InstallShield Installation Information
2015-12-17 19:18 - 2015-05-05 14:01 - 01716480 _____ (Creative Technology Ltd.) C:\Windows\SysWOW64\MBAPO232.dll
2015-12-17 19:18 - 2015-04-03 13:24 - 01365768 _____ (Waves Audio Ltd.) C:\Windows\system32\MaxxAudioAPO6064.dll
2015-12-17 19:18 - 2015-03-08 12:22 - 03182104 _____ (Fortemedia Corporation) C:\Windows\system32\FMAPO64.dll
2015-12-17 19:18 - 2015-01-19 08:08 - 12975360 _____ (Waves Audio Ltd.) C:\Windows\system32\MaxxVoiceAPO3064.dll
2015-12-17 19:18 - 2015-01-19 08:08 - 11884288 _____ (Waves Audio Ltd.) C:\Windows\SysWOW64\MaxxVoiceAPO30.dll
2015-12-17 19:18 - 2014-09-24 11:31 - 07087448 _____ (Dolby Laboratories) C:\Windows\system32\DDPP64A.dll
2015-12-17 19:18 - 2014-09-24 11:31 - 01939800 _____ (Dolby Laboratories) C:\Windows\system32\DDPD64A.dll
2015-12-17 19:18 - 2014-09-24 11:31 - 00315736 _____ (Dolby Laboratories) C:\Windows\system32\DDPO64A.dll
2015-12-17 19:18 - 2014-09-24 11:31 - 00261464 _____ (Dolby Laboratories) C:\Windows\system32\DDPA64.dll
2015-12-17 19:18 - 2014-07-03 14:44 - 01499984 _____ (Waves Audio Ltd.) C:\Windows\system32\MaxxAudioAPO5064.dll
2015-12-17 19:18 - 2014-07-03 14:44 - 00979280 _____ (Waves Audio Ltd.) C:\Windows\system32\MaxxVoiceAPO2064.dll
2015-12-17 19:18 - 2014-06-09 10:59 - 00560328 _____ (Andrea Electronics Corporation) C:\Windows\system32\AERTAC64.dll
2015-12-17 19:18 - 2014-04-10 12:19 - 03691608 _____ (Waves Audio Ltd.) C:\Windows\system32\MaxxAudioMeters64.exe
2015-12-17 19:18 - 2014-04-10 12:19 - 02041432 _____ (Waves Audio Ltd.) C:\Windows\system32\MaxxAudioEQ64.dll
2015-12-17 19:18 - 2013-10-11 12:47 - 00113576 _____ (Real Sound Lab SIA) C:\Windows\system32\CONEQMSAPOGUILibrary.dll
2015-12-17 19:18 - 2013-08-14 15:36 - 00662784 _____ (Waves Audio Ltd.) C:\Windows\system32\MaxxVolumeSDAPO.dll
2015-12-17 19:18 - 2013-08-14 15:35 - 00663296 _____ (Waves Audio Ltd.) C:\Windows\system32\MaxxAudioAPO30.dll
2015-12-17 19:18 - 2013-07-22 15:36 - 00194816 _____ (Waves Audio) C:\Windows\system32\MaxxAudioVienna264.dll
2015-12-17 19:18 - 2012-03-08 10:47 - 00108640 _____ (Andrea Electronics Corporation) C:\Windows\system32\AERTAR64.dll
2015-12-17 19:18 - 2011-05-31 09:42 - 01756264 _____ (DTS) C:\Windows\system32\DTSS2SpeakerDLL64.dll
2015-12-17 19:18 - 2011-05-31 09:42 - 01568360 _____ (DTS) C:\Windows\system32\DTSS2HeadphoneDLL64.dll
2015-12-17 19:18 - 2011-05-31 09:42 - 01486952 _____ (DTS) C:\Windows\system32\DTSBoostDLL64.dll
2015-12-17 19:18 - 2011-05-31 09:42 - 00728680 _____ (DTS) C:\Windows\system32\DTSBassEnhancementDLL64.dll
2015-12-17 19:18 - 2011-05-31 09:42 - 00712296 _____ (DTS) C:\Windows\system32\DTSSymmetryDLL64.dll
2015-12-17 19:18 - 2011-05-31 09:42 - 00693352 _____ (DTS) C:\Windows\system32\DTSVoiceClarityDLL64.dll
2015-12-17 19:18 - 2011-05-31 09:42 - 00491112 _____ (DTS) C:\Windows\system32\DTSNeoPCDLL64.dll
2015-12-17 19:18 - 2011-05-31 09:42 - 00432744 _____ (DTS) C:\Windows\system32\DTSLimiterDLL64.dll
2015-12-17 19:18 - 2011-05-31 09:42 - 00428648 _____ (DTS) C:\Windows\system32\DTSGainCompensatorDLL64.dll
2015-12-17 19:18 - 2011-05-31 09:42 - 00242792 _____ (DTS) C:\Windows\system32\DTSLFXAPO64.dll
2015-12-17 19:18 - 2011-05-31 09:42 - 00242792 _____ (DTS) C:\Windows\system32\DTSGFXAPO64.dll
2015-12-17 19:18 - 2011-05-31 09:42 - 00241768 _____ (DTS) C:\Windows\system32\DTSGFXAPONS64.dll
2015-12-17 19:18 - 2010-09-27 09:34 - 00318808 _____ (Waves Audio Ltd.) C:\Windows\system32\MaxxAudioAPO20.dll
2015-12-17 19:16 - 2015-12-17 19:20 - 00849474 _____ C:\Windows\system32\Drivers\rtwavesskdy.dat
2015-12-17 19:16 - 2015-12-17 19:20 - 00031095 _____ C:\Windows\system32\Drivers\rtwavesEFX.dat
2015-12-17 19:16 - 2015-12-17 19:20 - 00010945 _____ C:\Windows\system32\Drivers\rtwavesMFX.dat
2015-12-17 19:16 - 2015-12-17 19:16 - 00003218 _____ C:\Windows\System32\Tasks\RtHDVBg_PushButton
2015-12-17 19:16 - 2015-12-17 19:16 - 00000000 ____D C:\Program Files\Realtek
2015-12-17 19:15 - 2015-03-11 18:04 - 02825944 _____ (Realtek Semiconductor Corp.) C:\Windows\RtlExUpd.dll
2015-12-17 19:12 - 2015-12-17 19:20 - 00000000 ___HD C:\Program Files (x86)\Temp
2015-12-17 19:12 - 2015-12-17 19:12 - 00001536 _____ C:\Windows\SysWOW64\RtkMsgs.dll
2015-12-17 19:12 - 2015-12-17 19:12 - 00000000 ____D C:\Program Files (x86)\Realtek
2015-12-17 19:12 - 2015-12-17 19:12 - 00000000 ____D C:\Dell
2015-12-17 19:10 - 2015-12-17 19:10 - 00000000 ____D C:\Program Files\Common Files\Atheros
2015-12-17 18:52 - 2015-12-17 19:28 - 00000000 ____D C:\Program Files\AMD
2015-12-17 18:52 - 2015-12-17 19:09 - 00000000 ____D C:\Windows\LastGood.Tmp
2015-12-17 18:52 - 2015-12-17 18:52 - 00000000 ____D C:\Program Files\Common Files\ATI Technologies
2015-12-17 18:52 - 2015-12-17 18:52 - 00000000 _____ C:\Windows\ativpsrm.bin
2015-12-17 18:52 - 2015-07-31 22:36 - 00082696 _____ (Advanced Micro Devices, Inc.) C:\Windows\system32\Drivers\amdkmpfd.sys
2015-12-17 18:48 - 2015-12-17 18:48 - 00000144 _____ C:\Windows\system32\{A6D608F0-0BDE-491A-97AE-5C4B05D86E01}.bat
2015-12-17 18:40 - 2015-10-29 19:42 - 16736256 _____ (Microsoft Corporation) C:\Windows\system32\prm0001.dll
2015-12-17 18:38 - 2015-12-17 18:38 - 00001051 _____ C:\Users\Safwat\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Optional Features.lnk
2015-12-17 18:34 - 2015-12-17 18:34 - 00003088 _____ C:\Windows\System32\Tasks\Synaptics TouchPad Enhancements
2015-12-17 18:34 - 2015-12-17 18:34 - 00000000 ____H C:\Windows\system32\Drivers\Msft_Kernel_SynTP_01011.Wdf
2015-12-17 18:34 - 2015-12-17 18:34 - 00000000 ____H C:\Windows\system32\Drivers\Msft_Kernel_Smb_driver_Intel_01011.Wdf
2015-12-17 18:33 - 2015-12-17 18:33 - 00000000 ____D C:\Program Files\Synaptics
2015-12-17 18:33 - 2015-05-29 16:45 - 00410792 _____ (Synaptics Incorporated) C:\Windows\SysWOW64\SynCom.dll
2015-12-17 18:33 - 2015-05-29 16:45 - 00033960 _____ (Synaptics Incorporated) C:\Windows\system32\Drivers\Smb_driver_Intel_Aux.sys
2015-12-17 18:33 - 2015-05-29 16:45 - 00033960 _____ (Synaptics Incorporated) C:\Windows\system32\Drivers\Smb_driver_Intel.sys
2015-12-17 18:33 - 2015-05-29 16:45 - 00033448 _____ (Synaptics Incorporated) C:\Windows\system32\Drivers\Smb_driver_AMDASF_Aux.sys
2015-12-17 18:33 - 2014-01-30 18:17 - 01795952 _____ (Microsoft Corporation) C:\Windows\system32\WdfCoInstaller01011.dll
2015-12-17 18:32 - 2015-05-29 16:46 - 00246440 _____ (Synaptics Incorporated) C:\Windows\system32\SynTPCo29.dll
2015-12-17 18:32 - 2015-05-29 16:45 - 00755880 _____ (Synaptics Incorporated) C:\Windows\system32\SynCOM.dll
2015-12-17 18:32 - 2015-05-29 16:45 - 00604840 _____ (Synaptics Incorporated) C:\Windows\system32\Drivers\SynTP.sys
2015-12-17 18:32 - 2015-05-29 16:45 - 00259240 _____ (Synaptics Incorporated) C:\Windows\system32\SynTPAPI.dll
2015-12-17 18:29 - 2015-12-17 18:29 - 00000000 ____D C:\Program Files\Dell
2015-12-17 08:13 - 2015-12-17 19:45 - 12187184 _____ (Dell Inc.) C:\Users\Safwat\Downloads\Chipset_Driver_61V9W_WN_9.4.0.1026_A00.EXE
2015-12-17 08:06 - 2015-12-17 18:32 - 63864280 _____ (Dell Inc.) C:\Users\Safwat\Downloads\Input_Driver_X78P8_WN32_19.0.9.4_A00.EXE
2015-12-17 08:03 - 2015-12-17 18:24 - 34496824 _____ (Dell Inc.) C:\Users\Safwat\Downloads\Application_7JTWX_WN_10.16.004_A01.EXE
2015-12-17 07:53 - 2015-12-17 07:53 - 00000000 ____D C:\ProgramData\USOShared
2015-12-17 07:52 - 2015-12-17 19:55 - 00000006 ____H C:\Windows\Tasks\SA.DAT
2015-12-17 07:51 - 2015-12-17 20:00 - 00879220 _____ C:\Windows\system32\PerfStringBackup.INI
2015-12-17 07:51 - 2015-12-02 15:18 - 00301728 ____N (Microsoft Corporation) C:\Windows\system32\MpSigStub.exe
2015-12-17 07:50 - 2015-12-17 07:50 - 00000000 ____D C:\Program Files\Reference Assemblies
2015-12-17 07:50 - 2015-12-17 07:50 - 00000000 ____D C:\Program Files\MSBuild
2015-12-17 07:50 - 2015-12-17 07:50 - 00000000 ____D C:\Program Files (x86)\Reference Assemblies
2015-12-17 07:50 - 2015-12-17 07:50 - 00000000 ____D C:\Program Files (x86)\MSBuild
2015-12-17 07:48 - 2015-12-17 07:49 - 04800776 _____ (Igor Pavlov) C:\Users\Safwat\Downloads\3521A14.exe
2015-12-17 07:47 - 2015-10-23 19:47 - 00778936 _____ (Microsoft Corporation) C:\Windows\SysWOW64\PresentationNative_v0300.dll
2015-12-17 07:47 - 2015-10-23 19:47 - 00103120 _____ (Microsoft Corporation) C:\Windows\SysWOW64\PresentationCFFRasterizerNative_v0300.dll
2015-12-17 07:47 - 2015-10-23 19:47 - 00035480 _____ (Microsoft Corporation) C:\Windows\SysWOW64\TsWpfWrp.exe
2015-12-17 07:47 - 2015-10-23 19:46 - 01166520 _____ (Microsoft Corporation) C:\Windows\system32\PresentationNative_v0300.dll
2015-12-17 07:47 - 2015-10-23 19:46 - 00035480 _____ (Microsoft Corporation) C:\Windows\system32\TsWpfWrp.exe
2015-12-17 07:47 - 2015-10-23 19:45 - 00124624 _____ (Microsoft Corporation) C:\Windows\system32\PresentationCFFRasterizerNative_v0300.dll
2015-12-17 07:46 - 2015-12-17 07:46 - 00004608 _____ C:\Windows\SECOH-QAD.exe
2015-12-17 07:46 - 2015-12-17 07:46 - 00003584 _____ C:\Windows\SECOH-QAD.dll
2015-12-17 07:43 - 2015-12-17 07:43 - 00000000 ____H C:\Windows\system32\Drivers\Msft_User_WpdFs_01_11_00.Wdf
2015-12-17 07:42 - 2015-12-17 18:48 - 00202096 _____ C:\Windows\system32\FNTCACHE.DAT
2015-12-17 07:41 - 2015-12-17 07:45 - 00000000 ____D C:\Windows\Panther
2015-12-17 06:51 - 2015-12-17 19:24 - 402206392 _____ (Dell Inc.) C:\Users\Safwat\Downloads\Video_Driver_6YKW1_WN32_15.201.1101_A01.EXE
2015-12-17 06:51 - 2015-12-17 19:23 - 102906456 _____ (Dell Inc.) C:\Users\Safwat\Downloads\Network_Driver_N80VN_WN32_10.0.0.0_A00.EXE
2015-12-17 06:51 - 2015-12-17 19:19 - 00188557 _____ C:\Windows\system32\Drivers\RTWAVES40.dat
2015-12-17 06:51 - 2015-12-17 19:11 - 330513456 _____ (Dell Inc.) C:\Users\Safwat\Downloads\Audio_Driver_21H15_WN32_6.0.1.7520_A00.EXE
2015-12-17 06:51 - 2015-12-17 06:51 - 00000000 ____H C:\ProgramData\DP45977C.lfl
2015-12-17 06:50 - 2015-12-17 19:19 - 00000000 ____D C:\Windows\SysWOW64\RTCOM
2015-12-17 06:50 - 2015-12-17 06:50 - 00000000 ____D C:\Windows\system32\SRSLabs
2015-12-17 06:40 - 2015-12-17 19:56 - 00000000 __SHD C:\Users\Safwat\IntelGraphicsProfiles
2015-12-17 06:40 - 2015-12-17 19:14 - 00000451 _____ C:\Windows\system32\{F33C3B9B-72AF-418A-B3FD-560646F7CDA2}.bat
2015-12-17 06:38 - 2015-12-17 06:38 - 00000728 _____ C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Intel® HD Graphics Control Panel.lnk
2015-12-17 06:38 - 2015-12-17 06:38 - 00000716 _____ C:\Users\Public\Desktop\Intel® HD Graphics Control Panel.lnk
2015-12-17 06:37 - 2015-12-17 19:46 - 00000000 ____D C:\Program Files (x86)\Intel
2015-12-17 06:37 - 2015-12-17 06:37 - 00000000 ____D C:\Program Files\Intel
2015-12-17 06:36 - 2015-12-17 19:09 - 00000000 ____D C:\Intel
2015-12-17 06:35 - 2015-12-17 18:29 - 00000000 ____D C:\ProgramData\Dell
2015-12-17 06:31 - 2015-12-17 06:31 - 00000000 ____D C:\ProgramData\Google
2015-12-17 06:24 - 2015-12-17 06:24 - 00000000 ____D C:\Users\Safwat\AppData\Local\Comms
2015-12-17 06:23 - 2015-12-17 06:28 - 08400896 _____ C:\Users\Safwat\Downloads\chromeremotedesktophost.msi
2015-12-17 06:21 - 2015-12-17 06:21 - 00000000 ____D C:\Users\Safwat\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps
2015-12-17 06:20 - 2015-12-17 06:20 - 00002380 _____ C:\Users\Safwat\Desktop\Chrome App Launcher.lnk
2015-12-17 06:20 - 2015-12-17 06:20 - 00000000 ____D C:\Users\Safwat\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Google Chrome
2015-12-17 06:16 - 2015-12-17 06:35 - 138082456 _____ (Dell Inc.) C:\Users\Safwat\Downloads\Video_Driver_RRDD3_WN32_10.18.10.4242_A00.EXE
2015-12-17 06:16 - 2015-12-17 06:16 - 00002336 _____ C:\Users\Public\Desktop\Google Chrome.lnk
2015-12-17 06:16 - 2015-12-17 06:16 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Google Chrome
2015-12-17 06:14 - 2015-12-17 06:14 - 00000000 ____D C:\Users\Safwat\AppData\Local\NetworkTiles
2015-12-17 06:10 - 2015-12-17 20:15 - 00000930 _____ C:\Windows\Tasks\GoogleUpdateTaskMachineUA.job
2015-12-17 06:10 - 2015-12-17 19:56 - 00000926 _____ C:\Windows\Tasks\GoogleUpdateTaskMachineCore.job
2015-12-17 06:10 - 2015-12-17 18:38 - 00000000 ____D C:\Users\Safwat\AppData\Local\Google
2015-12-17 06:10 - 2015-12-17 06:28 - 00000000 ____D C:\Program Files (x86)\Google
2015-12-17 06:10 - 2015-12-17 06:10 - 00003988 _____ C:\Windows\System32\Tasks\GoogleUpdateTaskMachineUA
2015-12-17 06:10 - 2015-12-17 06:10 - 00003756 _____ C:\Windows\System32\Tasks\GoogleUpdateTaskMachineCore
2015-12-17 06:09 - 2015-12-17 06:10 - 00927824 _____ (Google Inc.) C:\Users\Safwat\Downloads\ChromeSetup.exe
2015-12-17 06:08 - 2015-12-17 06:08 - 00002341 _____ C:\Users\Safwat\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\OneDrive.lnk
2015-12-17 06:08 - 2015-12-17 06:08 - 00000000 ___RD C:\Users\Safwat\OneDrive
2015-12-17 06:08 - 2015-12-17 06:08 - 00000000 ____D C:\Users\Safwat\AppData\Local\MicrosoftEdge
2015-12-17 06:07 - 2015-12-17 06:07 - 00000000 ____D C:\ProgramData\Microsoft OneDrive
2015-12-17 06:06 - 2015-12-17 06:06 - 00000000 ____D C:\Users\Safwat\AppData\Local\ActiveSync
2015-12-17 06:05 - 2015-12-17 06:05 - 00000000 ____D C:\Users\Safwat\AppData\Local\Publishers
2015-12-17 06:04 - 2015-12-17 06:45 - 00000000 ____D C:\Users\Safwat\AppData\Local\Packages
2015-12-17 06:04 - 2015-12-17 06:40 - 00000000 ____D C:\Users\Safwat
2015-12-17 06:04 - 2015-12-17 06:04 - 00000020 ___SH C:\Users\Safwat\ntuser.ini
2015-12-17 06:04 - 2015-12-17 06:04 - 00000000 __RHD C:\Users\Public\AccountPictures
2015-12-17 06:04 - 2015-12-17 06:04 - 00000000 ____D C:\Users\Safwat\AppData\Roaming\Adobe
2015-12-17 06:04 - 2015-12-17 06:04 - 00000000 ____D C:\Users\Safwat\AppData\Local\VirtualStore
2015-12-17 06:04 - 2015-12-17 06:04 - 00000000 ____D C:\Users\Safwat\AppData\Local\TileDataLayer
2015-12-17 05:54 - 2015-12-17 05:54 - 00000000 ____D C:\Windows\CSC
2015-12-17 05:54 - 2015-10-30 09:17 - 02718208 _____ (Microsoft Corporation) C:\Windows\SysWOW64\PrintConfig.dll
2015-12-11 05:10 - 2015-12-11 05:10 - 24601600 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.dll
2015-12-11 05:10 - 2015-12-11 05:10 - 22572632 _____ (Microsoft Corporation) C:\Windows\system32\shell32.dll
2015-12-11 05:10 - 2015-12-11 05:10 - 22393856 _____ (Microsoft Corporation) C:\Windows\system32\edgehtml.dll
2015-12-11 05:10 - 2015-12-11 05:10 - 21125408 _____ (Microsoft Corporation) C:\Windows\SysWOW64\shell32.dll
2015-12-11 05:10 - 2015-12-11 05:10 - 19338240 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.dll
2015-12-11 05:10 - 2015-12-11 05:10 - 18678272 _____ (Microsoft Corporation) C:\Windows\SysWOW64\edgehtml.dll
2015-12-11 05:10 - 2015-12-11 05:10 - 16984576 _____ (Microsoft Corporation) C:\Windows\system32\Windows.UI.Xaml.dll
2015-12-11 05:10 - 2015-12-11 05:10 - 13381120 _____ (Microsoft Corporation) C:\Windows\system32\ieframe.dll
2015-12-11 05:10 - 2015-12-11 05:10 - 13017600 _____ (Microsoft Corporation) C:\Windows\SysWOW64\Windows.UI.Xaml.dll
2015-12-11 05:10 - 2015-12-11 05:10 - 12125184 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieframe.dll
2015-12-11 05:10 - 2015-12-11 05:10 - 11545088 _____ (Microsoft Corporation) C:\Windows\system32\twinui.dll
2015-12-11 05:10 - 2015-12-11 05:10 - 09918976 _____ (Microsoft Corporation) C:\Windows\SysWOW64\twinui.dll
2015-12-11 05:10 - 2015-12-11 05:10 - 07979008 _____ (Microsoft Corporation) C:\Windows\system32\mos.dll
2015-12-11 05:10 - 2015-12-11 05:10 - 07476576 _____ (Microsoft Corporation) C:\Windows\system32\ntoskrnl.exe
2015-12-11 05:10 - 2015-12-11 05:10 - 07199232 _____ (Microsoft Corporation) C:\Windows\system32\BingMaps.dll
2015-12-11 05:10 - 2015-12-11 05:10 - 06572032 _____ (Microsoft Corporation) C:\Windows\system32\wwanmm.dll
2015-12-11 05:10 - 2015-12-11 05:10 - 06297088 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mos.dll
2015-12-11 05:10 - 2015-12-11 05:10 - 05202944 _____ (Microsoft Corporation) C:\Windows\SysWOW64\BingMaps.dll
2015-12-11 05:10 - 2015-12-11 05:10 - 03993600 _____ (Microsoft Corporation) C:\Windows\system32\SettingsHandlers_nt.dll
2015-12-11 05:10 - 2015-12-11 05:10 - 03671896 _____ (Microsoft Corporation) C:\Windows\system32\iertutil.dll
2015-12-11 05:10 - 2015-12-11 05:10 - 03593216 _____ (Microsoft Corporation) C:\Windows\system32\win32kfull.sys
2015-12-11 05:10 - 2015-12-11 05:10 - 03355136 _____ (Microsoft Corporation) C:\Windows\system32\msftedit.dll
2015-12-11 05:10 - 2015-12-11 05:10 - 02918808 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iertutil.dll
2015-12-11 05:10 - 2015-12-11 05:10 - 02843136 _____ (Microsoft Corporation) C:\Windows\system32\cdp.dll
2015-12-11 05:10 - 2015-12-11 05:10 - 02772584 _____ (Microsoft Corporation) C:\Windows\system32\d3d11.dll
2015-12-11 05:10 - 2015-12-11 05:10 - 02756096 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.tlb
2015-12-11 05:10 - 2015-12-11 05:10 - 02756096 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.tlb
2015-12-11 05:10 - 2015-12-11 05:10 - 02680320 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msftedit.dll
2015-12-11 05:10 - 2015-12-11 05:10 - 02653816 _____ C:\Windows\system32\CoreUIComponents.dll
2015-12-11 05:10 - 2015-12-11 05:10 - 02647552 _____ (Microsoft Corporation) C:\Windows\system32\wininet.dll
2015-12-11 05:10 - 2015-12-11 05:10 - 02624512 _____ (Microsoft Corporation) C:\Windows\system32\InputService.dll
2015-12-11 05:10 - 2015-12-11 05:10 - 02598400 _____ (Microsoft Corporation) C:\Windows\system32\NetworkMobileSettings.dll
2015-12-11 05:10 - 2015-12-11 05:10 - 02587136 _____ (Microsoft Corporation) C:\Windows\system32\MFMediaEngine.dll
2015-12-11 05:10 - 2015-12-11 05:10 - 02544264 _____ (Microsoft Corporation) C:\Windows\system32\mfcore.dll
2015-12-11 05:10 - 2015-12-11 05:10 - 02444288 _____ (Microsoft Corporation) C:\Windows\system32\twinui.appcore.dll
2015-12-11 05:10 - 2015-12-11 05:10 - 02352128 _____ (Microsoft Corporation) C:\Windows\system32\authui.dll
2015-12-11 05:10 - 2015-12-11 05:10 - 02280448 _____ (Microsoft Corporation) C:\Windows\system32\wuaueng.dll
2015-12-11 05:10 - 2015-12-11 05:10 - 02185840 _____ (Microsoft Corporation) C:\Windows\SysWOW64\d3d11.dll
2015-12-11 05:10 - 2015-12-11 05:10 - 02179584 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mfcore.dll
2015-12-11 05:10 - 2015-12-11 05:10 - 02155008 _____ (Microsoft Corporation) C:\Windows\SysWOW64\authui.dll
2015-12-11 05:10 - 2015-12-11 05:10 - 02152800 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\ntfs.sys
2015-12-11 05:10 - 2015-12-11 05:10 - 02126848 _____ (Microsoft Corporation) C:\Windows\system32\inetcpl.cpl
2015-12-11 05:10 - 2015-12-11 05:10 - 02121216 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wininet.dll
2015-12-11 05:10 - 2015-12-11 05:10 - 02064384 _____ (Microsoft Corporation) C:\Windows\SysWOW64\MFMediaEngine.dll
2015-12-11 05:10 - 2015-12-11 05:10 - 02049024 _____ (Microsoft Corporation) C:\Windows\SysWOW64\inetcpl.cpl
2015-12-11 05:10 - 2015-12-11 05:10 - 02001408 _____ (Microsoft Corporation) C:\Windows\SysWOW64\twinui.appcore.dll
2015-12-11 05:10 - 2015-12-11 05:10 - 01995264 _____ (Microsoft Corporation) C:\Windows\system32\ActiveSyncProvider.dll
2015-12-11 05:10 - 2015-12-11 05:10 - 01944576 _____ (Microsoft Corporation) C:\Windows\SysWOW64\InputService.dll
2015-12-11 05:10 - 2015-12-11 05:10 - 01860096 _____ (Microsoft Corporation) C:\Windows\SysWOW64\cdp.dll
2015-12-11 05:10 - 2015-12-11 05:10 - 01859448 _____ C:\Windows\SysWOW64\CoreUIComponents.dll
2015-12-11 05:10 - 2015-12-11 05:10 - 01817160 _____ (Microsoft Corporation) C:\Windows\system32\ntdll.dll
2015-12-11 05:10 - 2015-12-11 05:10 - 01814528 _____ (Microsoft Corporation) C:\Windows\system32\pnidui.dll
2015-12-11 05:10 - 2015-12-11 05:10 - 01734656 _____ (Microsoft Corporation) C:\Windows\system32\urlmon.dll
2015-12-11 05:10 - 2015-12-11 05:10 - 01717248 _____ (Microsoft Corporation) C:\Windows\system32\GdiPlus.dll
2015-12-11 05:10 - 2015-12-11 05:10 - 01713664 _____ (Microsoft Corporation) C:\Windows\system32\SRHInproc.dll
2015-12-11 05:10 - 2015-12-11 05:10 - 01706496 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ActiveSyncProvider.dll
2015-12-11 05:10 - 2015-12-11 05:10 - 01648640 _____ (Microsoft Corporation) C:\Windows\system32\comsvcs.dll
2015-12-11 05:10 - 2015-12-11 05:10 - 01540768 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ntdll.dll
2015-12-11 05:10 - 2015-12-11 05:10 - 01505280 _____ (Microsoft Corporation) C:\Windows\SysWOW64\urlmon.dll
2015-12-11 05:10 - 2015-12-11 05:10 - 01467392 _____ (Microsoft Corporation) C:\Windows\SysWOW64\GdiPlus.dll
2015-12-11 05:10 - 2015-12-11 05:10 - 01443328 _____ (Microsoft Corporation) C:\Windows\SysWOW64\SRHInproc.dll
2015-12-11 05:10 - 2015-12-11 05:10 - 01399224 _____ (Microsoft Corporation) C:\Windows\system32\user32.dll
2015-12-11 05:10 - 2015-12-11 05:10 - 01395200 _____ (Microsoft Corporation) C:\Windows\system32\UIAutomationCore.dll
2015-12-11 05:10 - 2015-12-11 05:10 - 01393664 _____ (Microsoft Corporation) C:\Windows\system32\win32kbase.sys
2015-12-11 05:10 - 2015-12-11 05:10 - 01387008 _____ (Microsoft Corporation) C:\Windows\system32\lsasrv.dll
2015-12-11 05:10 - 2015-12-11 05:10 - 01337240 _____ (Microsoft Corporation) C:\Windows\SysWOW64\user32.dll
2015-12-11 05:10 - 2015-12-11 05:10 - 01328128 _____ (Microsoft Corporation) C:\Windows\SysWOW64\comsvcs.dll
2015-12-11 05:10 - 2015-12-11 05:10 - 01284960 _____ (Microsoft Corporation) C:\Windows\system32\LicenseManager.dll
2015-12-11 05:10 - 2015-12-11 05:10 - 01268736 _____ (Microsoft Corporation) C:\Windows\SysWOW64\Windows.UI.Xaml.Resources.dll
2015-12-11 05:10 - 2015-12-11 05:10 - 01268736 _____ (Microsoft Corporation) C:\Windows\system32\Windows.UI.Xaml.Resources.dll
2015-12-11 05:10 - 2015-12-11 05:10 - 01223168 _____ (Microsoft Corporation) C:\Windows\system32\Unistore.dll
2015-12-11 05:10 - 2015-12-11 05:10 - 01212928 _____ (Microsoft Corporation) C:\Windows\system32\wwansvc.dll
2015-12-11 05:10 - 2015-12-11 05:10 - 01139200 _____ (Microsoft Corporation) C:\Windows\SysWOW64\UIAutomationCore.dll
2015-12-11 05:10 - 2015-12-11 05:10 - 01063424 _____ (Microsoft Corporation) C:\Windows\system32\audiosrv.dll
2015-12-11 05:10 - 2015-12-11 05:10 - 01056256 _____ (Microsoft Corporation) C:\Windows\system32\JpMapControl.dll
2015-12-11 05:10 - 2015-12-11 05:10 - 01042432 _____ (Microsoft Corporation) C:\Windows\system32\BingOnlineServices.dll
2015-12-11 05:10 - 2015-12-11 05:10 - 00988160 _____ (Microsoft Corporation) C:\Windows\system32\NMAA.dll
2015-12-11 05:10 - 2015-12-11 05:10 - 00975200 _____ (Microsoft Corporation) C:\Windows\SysWOW64\LicenseManager.dll
2015-12-11 05:10 - 2015-12-11 05:10 - 00969728 _____ (Microsoft Corporation) C:\Windows\system32\kerberos.dll
2015-12-11 05:10 - 2015-12-11 05:10 - 00957440 _____ (Microsoft Corporation) C:\Windows\system32\SRH.dll
2015-12-11 05:10 - 2015-12-11 05:10 - 00948224 _____ (Microsoft Corporation) C:\Windows\SysWOW64\Unistore.dll
2015-12-11 05:10 - 2015-12-11 05:10 - 00948224 _____ (Microsoft Corporation) C:\Windows\system32\XblAuthManager.dll
2015-12-11 05:10 - 2015-12-11 05:10 - 00938496 _____ (Microsoft Corporation) C:\Windows\system32\MapControlCore.dll
2015-12-11 05:10 - 2015-12-11 05:10 - 00912384 _____ (Microsoft Corporation) C:\Windows\system32\usermgr.dll
2015-12-11 05:10 - 2015-12-11 05:10 - 00911648 _____ (Microsoft Corporation) C:\Windows\system32\dcomp.dll
2015-12-11 05:10 - 2015-12-11 05:10 - 00870400 _____ (Microsoft Corporation) C:\Windows\system32\wpncore.dll
2015-12-11 05:10 - 2015-12-11 05:10 - 00870400 _____ (Microsoft Corporation) C:\Windows\system32\modernexecserver.dll
2015-12-11 05:10 - 2015-12-11 05:10 - 00850432 _____ (Microsoft Corporation) C:\Windows\system32\MapsStore.dll
2015-12-11 05:10 - 2015-12-11 05:10 - 00809312 _____ (Microsoft Corporation) C:\Windows\system32\WWAHost.exe
2015-12-11 05:10 - 2015-12-11 05:10 - 00803840 _____ (Microsoft Corporation) C:\Windows\system32\jscript.dll
2015-12-11 05:10 - 2015-12-11 05:10 - 00800768 _____ (Microsoft Corporation) C:\Windows\SysWOW64\JpMapControl.dll
2015-12-11 05:10 - 2015-12-11 05:10 - 00795840 _____ (Microsoft Corporation) C:\Windows\system32\generaltel.dll
2015-12-11 05:10 - 2015-12-11 05:10 - 00793600 _____ (Microsoft Corporation) C:\Windows\SysWOW64\SRH.dll
2015-12-11 05:10 - 2015-12-11 05:10 - 00791552 _____ (Microsoft Corporation) C:\Windows\SysWOW64\kerberos.dll
2015-12-11 05:10 - 2015-12-11 05:10 - 00784896 _____ (Microsoft Corporation) C:\Windows\SysWOW64\NMAA.dll
2015-12-11 05:10 - 2015-12-11 05:10 - 00783360 _____ (Microsoft Corporation) C:\Windows\system32\msfeeds.dll
2015-12-11 05:10 - 2015-12-11 05:10 - 00711680 _____ (Microsoft Corporation) C:\Windows\SysWOW64\MapControlCore.dll
2015-12-11 05:10 - 2015-12-11 05:10 - 00709120 _____ (Microsoft Corporation) C:\Windows\SysWOW64\BingOnlineServices.dll
2015-12-11 05:10 - 2015-12-11 05:10 - 00704352 _____ (Microsoft Corporation) C:\Windows\SysWOW64\WWAHost.exe
2015-12-11 05:10 - 2015-12-11 05:10 - 00704000 _____ (Microsoft Corporation) C:\Windows\system32\CellularAPI.dll
2015-12-11 05:10 - 2015-12-11 05:10 - 00698208 _____ (Microsoft Corporation) C:\Windows\system32\wimgapi.dll
2015-12-11 05:10 - 2015-12-11 05:10 - 00697856 _____ (Microsoft Corporation) C:\Windows\system32\PlayToManager.dll
2015-12-11 05:10 - 2015-12-11 05:10 - 00686592 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msfeeds.dll
2015-12-11 05:10 - 2015-12-11 05:10 - 00675064 _____ (Microsoft Corporation) C:\Windows\SysWOW64\dcomp.dll
2015-12-11 05:10 - 2015-12-11 05:10 - 00674816 _____ (Microsoft Corporation) C:\Windows\system32\Windows.UI.dll
2015-12-11 05:10 - 2015-12-11 05:10 - 00647168 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript.dll
2015-12-11 05:10 - 2015-12-11 05:10 - 00638464 _____ (Microsoft Corporation) C:\Windows\system32\enterprisecsps.dll
2015-12-11 05:10 - 2015-12-11 05:10 - 00630632 _____ (Microsoft Corporation) C:\Windows\system32\fontdrvhost.exe
2015-12-11 05:10 - 2015-12-11 05:10 - 00623616 _____ (Microsoft Corporation) C:\Windows\system32\PhoneProviders.dll
2015-12-11 05:10 - 2015-12-11 05:10 - 00607232 _____ (Microsoft Corporation) C:\Windows\system32\wcmsvc.dll
2015-12-11 05:10 - 2015-12-11 05:10 - 00604928 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\cng.sys
2015-12-11 05:10 - 2015-12-11 05:10 - 00604672 _____ (Microsoft Corporation) C:\Windows\system32\vbscript.dll
2015-12-11 05:10 - 2015-12-11 05:10 - 00589312 _____ (Microsoft Corporation) C:\Windows\system32\MbaeApi.dll
2015-12-11 05:10 - 2015-12-11 05:10 - 00586208 _____ (Microsoft Corporation) C:\Windows\system32\mf.dll
2015-12-11 05:10 - 2015-12-11 05:10 - 00586080 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wimgapi.dll
2015-12-11 05:10 - 2015-12-11 05:10 - 00578912 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\afd.sys
2015-12-11 05:10 - 2015-12-11 05:10 - 00558080 _____ (Microsoft Corporation) C:\Windows\system32\MBMediaManager.dll
2015-12-11 05:10 - 2015-12-11 05:10 - 00543232 _____ (Microsoft Corporation) C:\Windows\system32\StoreAgent.dll
2015-12-11 05:10 - 2015-12-11 05:10 - 00540752 _____ (Microsoft Corporation) C:\Windows\SysWOW64\fontdrvhost.exe
2015-12-11 05:10 - 2015-12-11 05:10 - 00538632 _____ (Microsoft Corporation) C:\Windows\system32\WWanAPI.dll
2015-12-11 05:10 - 2015-12-11 05:10 - 00536768 _____ (Microsoft Corporation) C:\Windows\system32\AudioSes.dll
2015-12-11 05:10 - 2015-12-11 05:10 - 00523776 _____ (Microsoft Corporation) C:\Windows\system32\catsrvut.dll
2015-12-11 05:10 - 2015-12-11 05:10 - 00523616 _____ (Microsoft Corporation) C:\Windows\system32\wimserv.exe
2015-12-11 05:10 - 2015-12-11 05:10 - 00517632 _____ (Microsoft Corporation) C:\Windows\SysWOW64\PlayToManager.dll
2015-12-11 05:10 - 2015-12-11 05:10 - 00517632 _____ (Microsoft Corporation) C:\Windows\system32\winspool.drv
2015-12-11 05:10 - 2015-12-11 05:10 - 00516544 _____ (Microsoft Corporation) C:\Windows\system32\AudioEng.dll
2015-12-11 05:10 - 2015-12-11 05:10 - 00515584 _____ (Microsoft Corporation) C:\Windows\system32\LogonController.dll
2015-12-11 05:10 - 2015-12-11 05:10 - 00511320 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mf.dll
2015-12-11 05:10 - 2015-12-11 05:10 - 00503296 _____ (Microsoft Corporation) C:\Windows\SysWOW64\vbscript.dll
2015-12-11 05:10 - 2015-12-11 05:10 - 00497664 _____ (Microsoft Corporation) C:\Windows\system32\mfmkvsrcsnk.dll
2015-12-11 05:10 - 2015-12-11 05:10 - 00490496 _____ (Microsoft Corporation) C:\Windows\SysWOW64\Windows.UI.dll
2015-12-11 05:10 - 2015-12-11 05:10 - 00470528 _____ (Microsoft Corporation) C:\Windows\SysWOW64\MbaeApi.dll
2015-12-11 05:10 - 2015-12-11 05:10 - 00465920 _____ (Microsoft Corporation) C:\Windows\system32\wwanconn.dll
2015-12-11 05:10 - 2015-12-11 05:10 - 00459776 _____ (Microsoft Corporation) C:\Windows\system32\MapConfiguration.dll
2015-12-11 05:10 - 2015-12-11 05:10 - 00458752 _____ (Microsoft Corporation) C:\Windows\system32\PlayToDevice.dll
2015-12-11 05:10 - 2015-12-11 05:10 - 00454056 _____ (Microsoft Corporation) C:\Windows\SysWOW64\AudioEng.dll
2015-12-11 05:10 - 2015-12-11 05:10 - 00450560 _____ (Microsoft Corporation) C:\Windows\system32\Windows.Internal.Bluetooth.dll
2015-12-11 05:10 - 2015-12-11 05:10 - 00440160 _____ (Microsoft Corporation) C:\Windows\system32\services.exe
2015-12-11 05:10 - 2015-12-11 05:10 - 00431232 _____ (Microsoft Corporation) C:\Windows\SysWOW64\WWanAPI.dll
2015-12-11 05:10 - 2015-12-11 05:10 - 00421888 _____ (Microsoft Corporation) C:\Windows\SysWOW64\LogonController.dll
2015-12-11 05:10 - 2015-12-11 05:10 - 00416768 _____ (Microsoft Corporation) C:\Windows\system32\dmenrollengine.dll
2015-12-11 05:10 - 2015-12-11 05:10 - 00415744 _____ (Microsoft Corporation) C:\Windows\SysWOW64\catsrvut.dll
2015-12-11 05:10 - 2015-12-11 05:10 - 00414720 _____ (Microsoft Corporation) C:\Windows\system32\bcastdvr.exe
2015-12-11 05:10 - 2015-12-11 05:10 - 00409088 _____ (Microsoft Corporation) C:\Windows\SysWOW64\StoreAgent.dll
2015-12-11 05:10 - 2015-12-11 05:10 - 00408128 _____ (Microsoft Corporation) C:\Windows\system32\AUDIOKSE.dll
2015-12-11 05:10 - 2015-12-11 05:10 - 00405048 _____ (Microsoft Corporation) C:\Windows\SysWOW64\AudioSes.dll
2015-12-11 05:10 - 2015-12-11 05:10 - 00400896 _____ (Microsoft Corporation) C:\Windows\SysWOW64\winspool.drv
2015-12-11 05:10 - 2015-12-11 05:10 - 00382464 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mfmkvsrcsnk.dll
2015-12-11 05:10 - 2015-12-11 05:10 - 00382464 _____ (Microsoft Corporation) C:\Windows\system32\iedkcs32.dll
2015-12-11 05:10 - 2015-12-11 05:10 - 00369912 _____ (Microsoft Corporation) C:\Windows\system32\audiodg.exe
2015-12-11 05:10 - 2015-12-11 05:10 - 00366224 _____ (Microsoft Corporation) C:\Windows\SysWOW64\AUDIOKSE.dll
2015-12-11 05:10 - 2015-12-11 05:10 - 00365568 _____ (Adobe Systems Incorporated) C:\Windows\system32\atmfd.dll
2015-12-11 05:10 - 2015-12-11 05:10 - 00346112 _____ (Microsoft Corporation) C:\Windows\SysWOW64\MapConfiguration.dll
2015-12-11 05:10 - 2015-12-11 05:10 - 00345600 _____ (Microsoft Corporation) C:\Windows\system32\TextInputFramework.dll
2015-12-11 05:10 - 2015-12-11 05:10 - 00342016 _____ (Microsoft Corporation) C:\Windows\system32\SensorService.dll
2015-12-11 05:10 - 2015-12-11 05:10 - 00340480 _____ (Microsoft Corporation) C:\Windows\SysWOW64\PlayToDevice.dll
2015-12-11 05:10 - 2015-12-11 05:10 - 00334848 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iedkcs32.dll
2015-12-11 05:10 - 2015-12-11 05:10 - 00334736 _____ (Microsoft Corporation) C:\Windows\system32\policymanager.dll
2015-12-11 05:10 - 2015-12-11 05:10 - 00334336 _____ (Microsoft Corporation) C:\Windows\SysWOW64\bcastdvr.exe
2015-12-11 05:10 - 2015-12-11 05:10 - 00320000 _____ (Microsoft Corporation) C:\Windows\system32\cryptngc.dll
2015-12-11 05:10 - 2015-12-11 05:10 - 00315904 _____ (Microsoft Corporation) C:\Windows\SysWOW64\Windows.Internal.Bluetooth.dll
2015-12-11 05:10 - 2015-12-11 05:10 - 00303104 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\atmfd.dll
2015-12-11 05:10 - 2015-12-11 05:10 - 00296488 _____ (Microsoft Corporation) C:\Windows\SysWOW64\policymanager.dll
2015-12-11 05:10 - 2015-12-11 05:10 - 00292352 _____ (Microsoft Corporation) C:\Windows\system32\provengine.dll
2015-12-11 05:10 - 2015-12-11 05:10 - 00286720 _____ (Microsoft Corporation) C:\Windows\system32\deviceaccess.dll
2015-12-11 05:10 - 2015-12-11 05:10 - 00286208 _____ (Microsoft Corporation) C:\Windows\system32\provhandlers.dll
2015-12-11 05:10 - 2015-12-11 05:10 - 00275456 _____ (Microsoft Corporation) C:\Windows\system32\AudioEndpointBuilder.dll
2015-12-11 05:10 - 2015-12-11 05:10 - 00269824 _____ (Microsoft Corporation) C:\Windows\system32\moshostcore.dll
2015-12-11 05:10 - 2015-12-11 05:10 - 00264192 _____ (Nokia) C:\Windows\system32\NmaDirect.dll
2015-12-11 05:10 - 2015-12-11 05:10 - 00248832 _____ (Microsoft Corporation) C:\Windows\system32\UserMgrProxy.dll
2015-12-11 05:10 - 2015-12-11 05:10 - 00245848 _____ (Microsoft Corporation) C:\Windows\system32\mfps.dll
2015-12-11 05:10 - 2015-12-11 05:10 - 00245760 _____ (Microsoft Corporation) C:\Windows\SysWOW64\TextInputFramework.dll
2015-12-11 05:10 - 2015-12-11 05:10 - 00241664 _____ (Microsoft Corporation) C:\Windows\SysWOW64\cryptngc.dll
2015-12-11 05:10 - 2015-12-11 05:10 - 00231936 _____ (Microsoft Corporation) C:\Windows\system32\KnobsCore.dll
2015-12-11 05:10 - 2015-12-11 05:10 - 00227840 _____ (Microsoft Corporation) C:\Windows\SysWOW64\deviceaccess.dll
2015-12-11 05:10 - 2015-12-11 05:10 - 00220672 _____ (Microsoft Corporation) C:\Windows\system32\ie4uinit.exe
2015-12-11 05:10 - 2015-12-11 05:10 - 00209920 _____ (Microsoft Corporation) C:\Windows\system32\wcmcsp.dll
2015-12-11 05:10 - 2015-12-11 05:10 - 00205824 _____ (Nokia) C:\Windows\SysWOW64\NmaDirect.dll
2015-12-11 05:10 - 2015-12-11 05:10 - 00204800 _____ (Microsoft Corporation) C:\Windows\system32\Microsoft-Windows-AppModelExecEvents.dll
2015-12-11 05:10 - 2015-12-11 05:10 - 00198656 _____ (Microsoft Corporation) C:\Windows\system32\InstallAgent.exe
2015-12-11 05:10 - 2015-12-11 05:10 - 00192000 _____ (Microsoft Corporation) C:\Windows\system32\provisioningcsp.dll
2015-12-11 05:10 - 2015-12-11 05:10 - 00182784 _____ (Microsoft Corporation) C:\Windows\system32\shutdownux.dll
2015-12-11 05:10 - 2015-12-11 05:10 - 00175616 _____ (Microsoft Corporation) C:\Windows\system32\Windows.UI.Core.TextInput.dll
2015-12-11 05:10 - 2015-12-11 05:10 - 00168960 _____ (Microsoft Corporation) C:\Windows\system32\mdmmigrator.dll
2015-12-11 05:10 - 2015-12-11 05:10 - 00166912 _____ (Microsoft Corporation) C:\Windows\SysWOW64\UserMgrProxy.dll
2015-12-11 05:10 - 2015-12-11 05:10 - 00165376 _____ (Microsoft Corporation) C:\Windows\system32\provdatastore.dll
2015-12-11 05:10 - 2015-12-11 05:10 - 00163328 _____ (Microsoft Corporation) C:\Windows\system32\provops.dll
2015-12-11 05:10 - 2015-12-11 05:10 - 00162304 _____ (Microsoft Corporation) C:\Windows\system32\tetheringservice.dll
2015-12-11 05:10 - 2015-12-11 05:10 - 00162304 _____ (Microsoft Corporation) C:\Windows\system32\DeviceCensus.exe
2015-12-11 05:10 - 2015-12-11 05:10 - 00161632 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\ksecpkg.sys
2015-12-11 05:10 - 2015-12-11 05:10 - 00160768 _____ (Microsoft Corporation) C:\Windows\SysWOW64\InstallAgent.exe
2015-12-11 05:10 - 2015-12-11 05:10 - 00160768 _____ (Microsoft Corporation) C:\Windows\system32\enrollmentapi.dll
2015-12-11 05:10 - 2015-12-11 05:10 - 00157184 _____ (Microsoft Corporation) C:\Windows\system32\dmcertinst.exe
2015-12-11 05:10 - 2015-12-11 05:10 - 00147968 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\rmcast.sys
2015-12-11 05:10 - 2015-12-11 05:10 - 00138240 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ETWCoreUIComponentsResources.dll
2015-12-11 05:10 - 2015-12-11 05:10 - 00138240 _____ (Microsoft Corporation) C:\Windows\system32\ETWCoreUIComponentsResources.dll
2015-12-11 05:10 - 2015-12-11 05:10 - 00133632 _____ (Microsoft Corporation) C:\Windows\SysWOW64\Windows.UI.Core.TextInput.dll
2015-12-11 05:10 - 2015-12-11 05:10 - 00122368 _____ (Microsoft Corporation) C:\Windows\system32\KnobsCsp.dll
2015-12-11 05:10 - 2015-12-11 05:10 - 00119808 _____ (Microsoft Corporation) C:\Windows\system32\MapsBtSvc.dll
2015-12-11 05:10 - 2015-12-11 05:10 - 00118624 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\tdx.sys
2015-12-11 05:10 - 2015-12-11 05:10 - 00118272 _____ (Microsoft Corporation) C:\Windows\system32\fontsub.dll
2015-12-11 05:10 - 2015-12-11 05:10 - 00117248 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\capimg.sys
2015-12-11 05:10 - 2015-12-11 05:10 - 00116728 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mfps.dll
2015-12-11 05:10 - 2015-12-11 05:10 - 00115200 _____ (Microsoft Corporation) C:\Windows\system32\win32k.sys
2015-12-11 05:10 - 2015-12-11 05:10 - 00114688 _____ (Microsoft Corporation) C:\Windows\system32\offlinelsa.dll
2015-12-11 05:10 - 2015-12-11 05:10 - 00110592 _____ (Microsoft Corporation) C:\Windows\SysWOW64\Microsoft-Windows-MapControls.dll
2015-12-11 05:10 - 2015-12-11 05:10 - 00110592 _____ (Microsoft Corporation) C:\Windows\system32\Microsoft-Windows-MapControls.dll
2015-12-11 05:10 - 2015-12-11 05:10 - 00110032 _____ (Microsoft Corporation) C:\Windows\system32\EncDump.dll
2015-12-11 05:10 - 2015-12-11 05:10 - 00108544 _____ (Microsoft Corporation) C:\Windows\system32\InputLocaleManager.dll
2015-12-11 05:10 - 2015-12-11 05:10 - 00100864 _____ (Microsoft Corporation) C:\Windows\SysWOW64\offlinelsa.dll
2015-12-11 05:10 - 2015-12-11 05:10 - 00095072 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\sdstor.sys
2015-12-11 05:10 - 2015-12-11 05:10 - 00093696 _____ (Microsoft Corporation) C:\Windows\SysWOW64\fontsub.dll
2015-12-11 05:10 - 2015-12-11 05:10 - 00092352 _____ (Microsoft Corporation) C:\Windows\system32\acmigration.dll
2015-12-11 05:10 - 2015-12-11 05:10 - 00092160 _____ (Microsoft Corporation) C:\Windows\system32\SensorsNativeApi.V2.dll
2015-12-11 05:10 - 2015-12-11 05:10 - 00089600 _____ (Microsoft Corporation) C:\Windows\system32\NFCProvisioningPlugin.dll
2015-12-11 05:10 - 2015-12-11 05:10 - 00089088 _____ (Microsoft Corporation) C:\Windows\system32\MapsCSP.dll
2015-12-11 05:10 - 2015-12-11 05:10 - 00088392 _____ (Microsoft Corporation) C:\Windows\system32\remoteaudioendpoint.dll
2015-12-11 05:10 - 2015-12-11 05:10 - 00087040 _____ (Microsoft Corporation) C:\Windows\system32\tzautoupdate.dll
2015-12-11 05:10 - 2015-12-11 05:10 - 00086528 _____ (Microsoft Corporation) C:\Windows\SysWOW64\MapsBtSvc.dll
2015-12-11 05:10 - 2015-12-11 05:10 - 00086528 _____ (Microsoft Corporation) C:\Windows\system32\AppCapture.dll
2015-12-11 05:10 - 2015-12-11 05:10 - 00083456 _____ (Microsoft Corporation) C:\Windows\SysWOW64\InputLocaleManager.dll
2015-12-11 05:10 - 2015-12-11 05:10 - 00080600 _____ (Microsoft Corporation) C:\Windows\system32\wwapi.dll
2015-12-11 05:10 - 2015-12-11 05:10 - 00078336 _____ (Microsoft Corporation) C:\Windows\system32\BarcodeProvisioningPlugin.dll
2015-12-11 05:10 - 2015-12-11 05:10 - 00077312 _____ (Microsoft Corporation) C:\Windows\system32\ProvPluginEng.dll
2015-12-11 05:10 - 2015-12-11 05:10 - 00075264 _____ (Microsoft Corporation) C:\Windows\system32\wwanprotdim.dll
2015-12-11 05:10 - 2015-12-11 05:10 - 00075264 _____ (Microsoft Corporation) C:\Windows\system32\EditBufferTestHook.dll
2015-12-11 05:10 - 2015-12-11 05:10 - 00074240 _____ (Microsoft Corporation) C:\Windows\system32\mssign32.dll
2015-12-11 05:10 - 2015-12-11 05:10 - 00073728 _____ (Microsoft Corporation) C:\Windows\system32\wwancfg.dll
2015-12-11 05:10 - 2015-12-11 05:10 - 00073360 _____ (Microsoft Corporation) C:\Windows\SysWOW64\remoteaudioendpoint.dll
2015-12-11 05:10 - 2015-12-11 05:10 - 00072704 _____ (Microsoft Corporation) C:\Windows\system32\MosStorage.dll
2015-12-11 05:10 - 2015-12-11 05:10 - 00070656 _____ (Microsoft Corporation) C:\Windows\SysWOW64\AppCapture.dll
2015-12-11 05:10 - 2015-12-11 05:10 - 00070656 _____ (Microsoft Corporation) C:\Windows\system32\XblAuthManagerProxy.dll
2015-12-11 05:10 - 2015-12-11 05:10 - 00069632 _____ (Microsoft Corporation) C:\Windows\system32\wininetlui.dll
2015-12-11 05:10 - 2015-12-11 05:10 - 00066560 _____ (Microsoft Corporation) C:\Windows\system32\moshost.dll
2015-12-11 05:10 - 2015-12-11 05:10 - 00066560 _____ (Microsoft Corporation) C:\Windows\system32\iesetup.dll
2015-12-11 05:10 - 2015-12-11 05:10 - 00065536 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wininetlui.dll
2015-12-11 05:10 - 2015-12-11 05:10 - 00064000 _____ (Microsoft Corporation) C:\Windows\system32\MosHostClient.dll
2015-12-11 05:10 - 2015-12-11 05:10 - 00064000 _____ (Microsoft Corporation) C:\Windows\system32\ihvrilproxy.dll
2015-12-11 05:10 - 2015-12-11 05:10 - 00063528 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wwapi.dll
2015-12-11 05:10 - 2015-12-11 05:10 - 00060928 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mssign32.dll
2015-12-11 05:10 - 2015-12-11 05:10 - 00060928 _____ (Microsoft Corporation) C:\Windows\system32\XblAuthTokenBrokerExt.dll
2015-12-11 05:10 - 2015-12-11 05:10 - 00059904 _____ (Microsoft Corporation) C:\Windows\SysWOW64\EditBufferTestHook.dll
2015-12-11 05:10 - 2015-12-11 05:10 - 00058408 _____ (Microsoft Corporation) C:\Windows\system32\SensorsNativeApi.dll
2015-12-11 05:10 - 2015-12-11 05:10 - 00058368 _____ (Microsoft Corporation) C:\Windows\SysWOW64\MosStorage.dll
2015-12-11 05:10 - 2015-12-11 05:10 - 00058368 _____ (Microsoft Corporation) C:\Windows\SysWOW64\MosResource.dll
2015-12-11 05:10 - 2015-12-11 05:10 - 00058368 _____ (Microsoft Corporation) C:\Windows\system32\MosResource.dll
2015-12-11 05:10 - 2015-12-11 05:10 - 00056320 _____ (Microsoft Corporation) C:\Windows\system32\provtool.exe
2015-12-11 05:10 - 2015-12-11 05:10 - 00055808 _____ (Microsoft Corporation) C:\Windows\system32\rilproxy.dll
2015-12-11 05:10 - 2015-12-11 05:10 - 00052736 _____ (Microsoft Corporation) C:\Windows\system32\tetheringclient.dll
2015-12-11 05:10 - 2015-12-11 05:10 - 00052736 _____ (Microsoft Corporation) C:\Windows\system32\RemovableMediaProvisioningPlugin.dll
2015-12-11 05:10 - 2015-12-11 05:10 - 00052224 _____ (Microsoft Corporation) C:\Windows\system32\Wwanpref.dll
2015-12-11 05:10 - 2015-12-11 05:10 - 00052224 _____ (Microsoft Corporation) C:\Windows\system32\jsproxy.dll
2015-12-11 05:10 - 2015-12-11 05:10 - 00051680 _____ (Microsoft Corporation) C:\Windows\system32\SensorsUtilsV2.dll
2015-12-11 05:10 - 2015-12-11 05:10 - 00049152 _____ (Microsoft Corporation) C:\Windows\SysWOW64\XblAuthTokenBrokerExt.dll
2015-12-11 05:10 - 2015-12-11 05:10 - 00048640 _____ (Microsoft Corporation) C:\Windows\SysWOW64\MosHostClient.dll
2015-12-11 05:10 - 2015-12-11 05:10 - 00045568 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jsproxy.dll
2015-12-11 05:10 - 2015-12-11 05:10 - 00045568 _____ (Adobe Systems) C:\Windows\system32\atmlib.dll
2015-12-11 05:10 - 2015-12-11 05:10 - 00044032 _____ (Microsoft Corporation) C:\Windows\system32\wsplib.dll
2015-12-11 05:10 - 2015-12-11 05:10 - 00043520 _____ (Microsoft Corporation) C:\Windows\system32\bcastdvr.proxy.dll
2015-12-11 05:10 - 2015-12-11 05:10 - 00042496 _____ (Microsoft Corporation) C:\Windows\system32\mapstoasttask.dll
2015-12-11 05:10 - 2015-12-11 05:10 - 00041984 _____ (Microsoft Corporation) C:\Windows\SysWOW64\XblAuthManagerProxy.dll
2015-12-11 05:10 - 2015-12-11 05:10 - 00037376 _____ (Microsoft Corporation) C:\Windows\system32\LaunchWinApp.exe
2015-12-11 05:10 - 2015-12-11 05:10 - 00037376 _____ (Adobe Systems) C:\Windows\SysWOW64\atmlib.dll
2015-12-11 05:10 - 2015-12-11 05:10 - 00036352 _____ (Microsoft Corporation) C:\Windows\SysWOW64\UIAutomationCoreRes.dll
2015-12-11 05:10 - 2015-12-11 05:10 - 00036352 _____ (Microsoft Corporation) C:\Windows\system32\UIAutomationCoreRes.dll
2015-12-11 05:10 - 2015-12-11 05:10 - 00035680 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\wimmount.sys
2015-12-11 05:10 - 2015-12-11 05:10 - 00035656 _____ (Microsoft Corporation) C:\Windows\system32\mfpmp.exe
2015-12-11 05:10 - 2015-12-11 05:10 - 00034304 _____ (Microsoft Corporation) C:\Windows\system32\iernonce.dll
2015-12-11 05:10 - 2015-12-11 05:10 - 00032256 _____ (Microsoft Corporation) C:\Windows\system32\wups2.dll
2015-12-11 05:10 - 2015-12-11 05:10 - 00032040 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mfpmp.exe
2015-12-11 05:10 - 2015-12-11 05:10 - 00030720 _____ (Microsoft Corporation) C:\Windows\system32\tetheringconfigsp.dll
2015-12-11 05:10 - 2015-12-11 05:10 - 00029696 _____ (Microsoft Corporation) C:\Windows\SysWOW64\LaunchWinApp.exe
2015-12-11 05:10 - 2015-12-11 05:10 - 00028672 _____ (Microsoft Corporation) C:\Windows\system32\WordBreakers.dll
2015-12-11 05:10 - 2015-12-11 05:10 - 00028672 _____ (Microsoft Corporation) C:\Windows\system32\mapsupdatetask.dll
2015-12-11 05:10 - 2015-12-11 05:10 - 00028160 _____ (Microsoft Corporation) C:\Windows\system32\Windows.Management.Provisioning.ProxyStub.dll
2015-12-11 05:10 - 2015-12-11 05:10 - 00028160 _____ (Microsoft Corporation) C:\Windows\system32\nativemap.dll
2015-12-11 05:10 - 2015-12-11 05:10 - 00027136 _____ (Microsoft Corporation) C:\Windows\SysWOW64\bcastdvr.proxy.dll
2015-12-11 05:10 - 2015-12-11 05:10 - 00026408 _____ (Microsoft Corporation) C:\Windows\system32\wuauclt.exe
2015-12-11 05:10 - 2015-12-11 05:10 - 00024064 _____ (Microsoft Corporation) C:\Windows\SysWOW64\WordBreakers.dll
2015-12-11 05:10 - 2015-12-11 05:10 - 00018944 _____ (Microsoft Corporation) C:\Windows\system32\wshrm.dll
2015-12-11 05:10 - 2015-12-11 05:10 - 00017408 _____ (Microsoft Corporation) C:\Windows\system32\IcsEntitlementHost.exe
2015-12-11 05:10 - 2015-12-11 05:10 - 00014336 _____ (Microsoft Corporation) C:\Windows\system32\dciman32.dll
2015-12-11 05:10 - 2015-12-11 05:10 - 00013312 _____ (Microsoft Corporation) C:\Windows\system32\MapsBtSvcProxy.dll
2015-12-11 05:10 - 2015-12-11 05:10 - 00011776 _____ (Microsoft Corporation) C:\Windows\SysWOW64\dciman32.dll
2015-12-11 05:10 - 2015-12-11 05:10 - 00010240 _____ (Microsoft Corporation) C:\Windows\SysWOW64\Microsoft-Windows-MosTrace.dll
2015-12-11 05:10 - 2015-12-11 05:10 - 00010240 _____ (Microsoft Corporation) C:\Windows\system32\Microsoft-Windows-MosTrace.dll
2015-12-11 05:10 - 2015-12-11 05:10 - 00009728 _____ (Microsoft Corporation) C:\Windows\SysWOW64\Microsoft-Windows-MosHost.dll
2015-12-11 05:10 - 2015-12-11 05:10 - 00009728 _____ (Microsoft Corporation) C:\Windows\system32\Microsoft-Windows-MosHost.dll
2015-12-11 05:10 - 2015-12-11 05:10 - 00007680 _____ (Microsoft Corporation) C:\Windows\system32\readingviewresources.dll
2015-12-11 05:10 - 2015-12-11 05:10 - 00003072 _____ (Microsoft Corporation) C:\Windows\SysWOW64\MapControlStringsRes.dll
2015-12-11 05:10 - 2015-12-11 05:10 - 00003072 _____ (Microsoft Corporation) C:\Windows\SysWOW64\lpk.dll
2015-12-11 05:10 - 2015-12-11 05:10 - 00003072 _____ (Microsoft Corporation) C:\Windows\system32\MapControlStringsRes.dll
2015-12-11 05:10 - 2015-12-11 05:10 - 00003072 _____ (Microsoft Corporation) C:\Windows\system32\lpk.dll
 
==================== One Month Modified files and folders ========
 
(If an entry is included in the fixlist, the file/folder will be moved.)
 
2015-12-17 20:24 - 2015-10-30 08:28 - 00000000 ____D C:\Windows
2015-12-17 20:00 - 2015-10-30 09:21 - 00000000 ____D C:\Windows\INF
2015-12-17 19:55 - 2015-10-30 08:28 - 00262144 ___SH C:\Windows\system32\config\BBI
2015-12-17 18:46 - 2015-10-30 09:11 - 00000000 ____D C:\Windows\CbsTemp
2015-12-17 18:43 - 2015-10-30 20:08 - 00000000 ____D C:\Windows\OCR
2015-12-17 18:35 - 2015-10-30 09:24 - 00000000 ___HD C:\Program Files\WindowsApps
2015-12-17 18:35 - 2015-10-30 09:24 - 00000000 ____D C:\Windows\AppReadiness
2015-12-17 07:53 - 2015-10-30 09:24 - 00000000 ____D C:\ProgramData\USOPrivate
2015-12-17 07:52 - 2015-10-30 08:28 - 00032768 ___SH C:\Windows\system32\config\ELAM
2015-12-17 07:45 - 2015-10-30 08:28 - 00000000 ____D C:\Windows\system32\Sysprep
2015-12-17 07:42 - 2015-10-30 20:28 - 00000000 ____D C:\Windows\ServiceProfiles
2015-12-17 07:41 - 2015-10-30 09:24 - 00028672 _____ C:\Windows\system32\config\BCD-Template
2015-12-17 06:22 - 2015-10-30 09:24 - 00000000 ___RD C:\Windows\DevicesFlow
2015-12-17 06:05 - 2015-10-30 09:24 - 00000000 ___RD C:\Windows\PurchaseDialog
2015-12-17 06:05 - 2015-10-30 09:24 - 00000000 ___RD C:\Windows\PrintDialog
2015-12-17 06:05 - 2015-10-30 09:24 - 00000000 ___RD C:\Windows\MiracastView
2015-12-17 06:05 - 2015-10-30 09:24 - 00000000 ___RD C:\Windows\ImmersiveControlPanel
2015-12-17 05:54 - 2015-10-30 09:24 - 00000000 ____D C:\Windows\system32\spool
2015-12-17 05:54 - 2015-10-30 09:24 - 00000000 ____D C:\Windows\system32\FxsTmp
2015-12-17 05:54 - 2015-10-30 09:24 - 00000000 ____D C:\Windows\rescache
2015-12-11 05:53 - 2015-10-30 09:26 - 00000000 ____D C:\Windows\Setup
2015-12-11 05:10 - 2015-10-30 09:26 - 00826872 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerApp.exe
2015-12-11 05:10 - 2015-10-30 09:26 - 00176632 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerCPLApp.cpl
2015-12-11 05:10 - 2015-10-30 09:24 - 00000000 ____D C:\Windows\SysWOW64\en-GB
2015-12-11 05:10 - 2015-10-30 09:24 - 00000000 ____D C:\Windows\system32\SystemResetPlatform
2015-12-11 05:10 - 2015-10-30 09:24 - 00000000 ____D C:\Windows\system32\oobe
2015-12-11 05:10 - 2015-10-30 09:24 - 00000000 ____D C:\Windows\system32\en-GB
2015-12-11 05:10 - 2015-10-30 09:24 - 00000000 ____D C:\Windows\system32\appraiser
2015-12-11 05:10 - 2015-10-30 09:24 - 00000000 ____D C:\Windows\Provisioning
2015-12-11 05:10 - 2015-10-30 08:28 - 00000000 ____D C:\Windows\SysWOW64\Dism
2015-12-11 05:10 - 2015-10-30 08:28 - 00000000 ____D C:\Windows\system32\Dism
 
==================== Files in the root of some directories =======
 
2015-12-17 06:51 - 2015-12-17 06:51 - 0000000 ____H () C:\ProgramData\DP45977C.lfl
 
==================== Bamital & volsnap =================
 
(There is no automatic fix for files that do not pass verification.)
 
C:\Windows\system32\winlogon.exe => File is digitally signed
C:\Windows\system32\wininit.exe => File is digitally signed
C:\Windows\explorer.exe => File is digitally signed
C:\Windows\SysWOW64\explorer.exe => File is digitally signed
C:\Windows\system32\svchost.exe => File is digitally signed
C:\Windows\SysWOW64\svchost.exe => File is digitally signed
C:\Windows\system32\services.exe => File is digitally signed
C:\Windows\system32\User32.dll => File is digitally signed
C:\Windows\SysWOW64\User32.dll => File is digitally signed
C:\Windows\system32\userinit.exe => File is digitally signed
C:\Windows\SysWOW64\userinit.exe => File is digitally signed
C:\Windows\system32\rpcss.dll => File is digitally signed
C:\Windows\system32\dnsapi.dll => File is digitally signed
C:\Windows\SysWOW64\dnsapi.dll => File is digitally signed
C:\Windows\system32\Drivers\volsnap.sys => File is digitally signed
 
 
LastRegBack: 2015-12-17 07:42
 
==================== End of FRST.txt ============================


BC AdBot (Login to Remove)

 


#2 nasdaq

nasdaq

  • Malware Response Team
  • 38,950 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:Montreal, QC. Canada
  • Local time:08:49 PM

Posted 19 December 2015 - 09:24 AM

Hello, Welcome to BleepingComputer.
I'm nasdaq and will be helping you.

If you can please print this topic it will make it easier for you to follow the instructions and complete all of the necessary steps in the order listed.
===

Press the windows key Windows_Logo_key.gif+ r on your keyboard at the same time. This will open the RUN BOX.
Type Notepad and and click the OK key.
Please copy the entire contents of the code box below to the a new file.


start

CreateRestorePoint:
EmptyTemp:
CloseProcesses:

CHR HomePage: Default -> hxxp://www.omniboxes.com/?type=hp&ts=1426879469&from=obw&uid=ST1000LM024XHN-M101MBB_S2WZJ90D336887336887
CHR StartupUrls: Default -> "hxxp://www.omniboxes.com/?type=hp&ts=1426879469&from=obw&uid=ST1000LM024XHN-M101MBB_S2WZJ90D336887336887"

End
Save the file as fixlist.txt in the same folder where the Farbar tool is running from.
The location is listed in the 3rd line of the Farbar log you have submitted.

Run FRST and click Fix only once and wait.

Restart the computer normally to reset the registry.

The tool will create a log (Fixlog.txt) please post it to your reply.
===

Please download AdwCleaner by Xplode onto your Desktop.
  • Close all open programs and internet browsers.
  • Double click on AdwCleaner.exe to run the tool.
  • Click the Scan button and wait for the process to complete.
  • Click the LogFile button and the report will open in Notepad.
IMPORTANT
  • If you click the Clean button all items listed in the report will be removed.
If you find some false positive items or programs that you wish to keep, Close the AdwCleaner windows.
  • Close all open programs and internet browsers.
  • Double click on AdwCleaner.exe to run the tool.
  • Click the Scan button and wait for the process to complete.
  • Check off the element(s) you wish to keep.
  • Click on the Clean button follow the prompts.
  • A log file will automatically open after the scan has finished.
  • Please post the content of that log file with your next answer.
  • You can find the log file at C:\AdwCleanerCx.txt (x is a number).
===

Reset the browsers that have been compromised.

Reset Chrome...
Open Google Chrome, click on menu icon google-chrome-setting-icon.png which is located right side top of the google chrome.
 
Click "Settings" then "Show advanced settings" at the bottom of the screen.
 
Click "Reset browser settings" button.
 
Clear your cache and cookies
https://support.google.com/chromebook/answer/183083?hl=en
Select "From the beginning of time"

Restart Chrome.

====

How is the computer running now?

p.s.
The addition.txt file was not attached.
Please post it in your next reply. I will review it.

#3 nasdaq

nasdaq

  • Malware Response Team
  • 38,950 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:Montreal, QC. Canada
  • Local time:08:49 PM

Posted 24 December 2015 - 10:44 AM

Due to the lack of feedback, this topic is now closed.

In the event you still have problems, please send me or any Moderator a Private Message and ask them to reopen this topic within the next 5 days.

Please include a link to your topic in the Private Message. Thank you.




0 user(s) are reading this topic

0 members, 0 guests, 0 anonymous users