Jump to content


 


Register a free account to unlock additional features at BleepingComputer.com
Welcome to BleepingComputer, a free community where people like yourself come together to discuss and learn how to use their computers. Using the site is easy and fun. As a guest, you can browse and view the various discussions in the forums, but can not create a new topic or reply to an existing one unless you are logged in. Other benefits of registering an account are subscribing to topics and forums, creating a blog, and having no ads shown anywhere on the site.


Click here to Register a free account now! or read our Welcome Guide to learn how to use this site.

Photo

http://www.google-analytics.com/__utm.gif Pop up when I click on certain links


  • This topic is locked This topic is locked
6 replies to this topic

#1 harrod

harrod

  • Members
  • 2 posts
  • OFFLINE
  •  
  • Local time:03:14 AM

Posted 13 January 2016 - 07:40 PM

I just started getting these pop ups today. Most of the time when it comes up, it will close out. I believe this is because I have adblock plus. I did a google search and saw to run FRST to remove any malware that I may have. I just formatted my hard drive in December and installed a dual partition of windows 10 and ubuntu. From what I have read, It is recommended to post the FRST logs. I have attached them to this message.

 

If anyone can let me know if I have any malware or infections, I would really appreciate it. Also, what steps should I take to remove the infection?

 

P.S. I've also pasted the txt files below if you do not want to download them

 

FRST.txt

--------------------------------------------------------

Scan result of Farbar Recovery Scan Tool (FRST) (x64) Version:10-01-2015 01
Ran by E (administrator) on DESKTOP-BT8FLMF (13-01-2016 19:05:54)
Running from C:\Users\E\Downloads
Loaded Profiles: E (Available Profiles: E)
Platform: Windows 10 Home Version 1511 (X64) Language: English (United States)
Internet Explorer Version 11 (Default browser: Chrome)
Boot Mode: Normal
 
==================== Processes (Whitelisted) =================
 
(If an entry is included in the fixlist, the process will be closed. The file will not be moved.)
 
(Intel Corporation) C:\Windows\System32\igfxCUIService.exe
(Realtek Semiconductor) C:\Program Files\Realtek\Audio\HDA\RtkAudioService64.exe
(Realtek Semiconductor) C:\Program Files\Realtek\Audio\HDA\RAVBg64.exe
(Microsoft Corporation) C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeClickToRun.exe
(Microsoft Corporation) C:\Program Files\Windows Defender\MsMpEng.exe
(Synaptics Incorporated) C:\Program Files\Synaptics\SynTP\SynTPEnhService.exe
() C:\Program Files\WindowsApps\Microsoft.Messaging_2.12.15004.0_x86__8wekyb3d8bbwe\SkypeHost.exe
(Google Inc.) C:\Program Files (x86)\Google\Update\1.3.29.1\GoogleCrashHandler.exe
(Microsoft Corporation) C:\Program Files\Windows Defender\NisSrv.exe
(Google Inc.) C:\Program Files (x86)\Google\Update\1.3.29.1\GoogleCrashHandler64.exe
(Intel Corporation) C:\Windows\System32\igfxEM.exe
(Intel Corporation) C:\Windows\System32\igfxHK.exe
(Intel Corporation) C:\Windows\System32\igfxTray.exe
(Realtek Semiconductor) C:\Program Files\Realtek\Audio\HDA\RtkNGUI64.exe
(Microsoft Corporation) C:\Windows\System32\Taskmgr.exe
(Microsoft Corporation) C:\Program Files\Windows Defender\MSASCui.exe
(Microsoft Corporation) C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE
() C:\Program Files (x86)\qBittorrent\qbittorrent.exe
(Microsoft Corporation) C:\Windows\ImmersiveControlPanel\SystemSettings.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Microsoft Corporation) C:\Program Files (x86)\Microsoft Office\root\Office16\msoia.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
 
 
==================== Registry (Whitelisted) ===========================
 
(If an entry is included in the fixlist, the registry item will be restored to default or removed. The file will not be moved.)
 
HKLM\...\Run: [SynTPEnh] => C:\Program Files\Synaptics\SynTP\SynTPEnh.exe [3942568 2015-08-03] (Synaptics Incorporated)
HKLM\...\Run: [RTHDVCPL] => C:\Program Files\Realtek\Audio\HDA\RtkNGUI64.exe [8520448 2015-08-03] (Realtek Semiconductor)
HKU\S-1-5-21-482056995-2111253809-2895985789-1001\...\Run: [GoogleDriveSync] => C:\Program Files (x86)\Google\Drive\googledrivesync.exe [22790776 2015-11-04] (Google)
HKU\S-1-5-21-482056995-2111253809-2895985789-1001\...\MountPoints2: {45087f0e-ac3d-11e5-9d6e-3863bb95cdd6} - "D:\VZW_Software_upgrade_assistant.exe" 
ShellIconOverlayIdentifiers: [  GoogleDriveBlacklisted] -> {81539FE6-33C7-4CE7-90C7-1C7B8F2F2D42} => C:\Program Files (x86)\Google\Drive\googledrivesync64.dll [2015-11-04] (Google)
ShellIconOverlayIdentifiers: [  GoogleDriveSynced] -> {81539FE6-33C7-4CE7-90C7-1C7B8F2F2D40} => C:\Program Files (x86)\Google\Drive\googledrivesync64.dll [2015-11-04] (Google)
ShellIconOverlayIdentifiers: [  GoogleDriveSyncing] -> {81539FE6-33C7-4CE7-90C7-1C7B8F2F2D41} => C:\Program Files (x86)\Google\Drive\googledrivesync64.dll [2015-11-04] (Google)
 
==================== Internet (Whitelisted) ====================
 
(If an item is included in the fixlist, if it is a registry item it will be removed or restored to default.)
 
Tcpip\Parameters: [DhcpNameServer] 192.168.1.1
Tcpip\..\Interfaces\{8be68d11-428a-4261-b35a-d963c8b5f8fe}: [DhcpNameServer] 192.168.1.1
 
Internet Explorer:
==================
BHO: Lync Browser Helper -> {31D09BA0-12F5-4CCE-BE8A-2923E76605DA} -> C:\Program Files (x86)\Microsoft Office\root\VFS\ProgramFilesX64\Microsoft Office\Office16\OCHelper.dll [2015-12-25] (Microsoft Corporation)
BHO: Microsoft OneDrive for Business Browser Helper -> {D0498E0A-45B7-42AE-A9AA-ABA463DBD3BF} -> C:\Program Files (x86)\Microsoft Office\root\VFS\ProgramFilesX64\Microsoft Office\Office16\GROOVEEX.DLL [2015-12-25] (Microsoft Corporation)
BHO-x32: Lync Browser Helper -> {31D09BA0-12F5-4CCE-BE8A-2923E76605DA} -> C:\Program Files (x86)\Microsoft Office\root\Office16\OCHelper.dll [2015-12-25] (Microsoft Corporation)
BHO-x32: Microsoft OneDrive for Business Browser Helper -> {D0498E0A-45B7-42AE-A9AA-ABA463DBD3BF} -> C:\Program Files (x86)\Microsoft Office\root\Office16\GROOVEEX.DLL [2015-12-25] (Microsoft Corporation)
Handler-x32: mso-minsb-roaming.16 - {83C25742-A9F7-49FB-9138-434302C88D07} - C:\Program Files (x86)\Microsoft Office\root\Office16\MSOSB.DLL [2015-12-25] (Microsoft Corporation)
Handler-x32: mso-minsb.16 - {42089D2D-912D-4018-9087-2B87803E93FB} - C:\Program Files (x86)\Microsoft Office\root\Office16\MSOSB.DLL [2015-12-25] (Microsoft Corporation)
Handler-x32: osf-roaming.16 - {42089D2D-912D-4018-9087-2B87803E93FB} - C:\Program Files (x86)\Microsoft Office\root\Office16\MSOSB.DLL [2015-12-25] (Microsoft Corporation)
Handler-x32: osf.16 - {5504BE45-A83B-4808-900A-3A5C36E7F77A} - C:\Program Files (x86)\Microsoft Office\root\Office16\MSOSB.DLL [2015-12-25] (Microsoft Corporation)
 
FireFox:
========
FF Plugin: @videolan.org/vlc,version=2.2.1 -> C:\Program Files\VideoLAN\VLC\npvlc.dll [2015-04-16] (VideoLAN)
FF Plugin-x32: @microsoft.com/Lync,version=15.0 -> C:\Program Files (x86)\Microsoft Office\root\VFS\ProgramFilesX86\Mozilla Firefox\plugins\npmeetingjoinpluginoc.dll [2015-12-25] (Microsoft Corporation)
FF Plugin-x32: @microsoft.com/SharePoint,version=14.0 -> C:\Program Files (x86)\Microsoft Office\root\Office16\NPSPWRAP.DLL [2015-12-25] (Microsoft Corporation)
FF Plugin-x32: @tools.google.com/Google Update;version=3 -> C:\Program Files (x86)\Google\Update\1.3.29.1\npGoogleUpdate3.dll [2015-12-21] (Google Inc.)
FF Plugin-x32: @tools.google.com/Google Update;version=9 -> C:\Program Files (x86)\Google\Update\1.3.29.1\npGoogleUpdate3.dll [2015-12-21] (Google Inc.)
FF Plugin-x32: Adobe Reader -> C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AIR\nppdf32.dll [2015-12-18] (Adobe Systems Inc.)
 
Chrome: 
=======
CHR StartupUrls: Default -> "hxxp://ocio.osu.edu/elearning"
CHR Profile: C:\Users\E\AppData\Local\Google\Chrome\User Data\Default
CHR Extension: (craigslist pop for power users) - C:\Users\E\AppData\Local\Google\Chrome\User Data\Default\Extensions\aikbdokcmcbbeaadpdbhlcdcgghdkhja [2015-12-22]
CHR Extension: (Google Docs) - C:\Users\E\AppData\Local\Google\Chrome\User Data\Default\Extensions\aohghmighlieiainnegkcijnfilokake [2015-12-21]
CHR Extension: (Google Drive) - C:\Users\E\AppData\Local\Google\Chrome\User Data\Default\Extensions\apdfllckaahabafndbhieahigkjlhalf [2015-12-21]
CHR Extension: (YouTube) - C:\Users\E\AppData\Local\Google\Chrome\User Data\Default\Extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo [2015-12-21]
CHR Extension: (Adblock Plus) - C:\Users\E\AppData\Local\Google\Chrome\User Data\Default\Extensions\cfhdojbkjhnklbpkdaibdccddilifddb [2016-01-05]
CHR Extension: (uBlock Origin) - C:\Users\E\AppData\Local\Google\Chrome\User Data\Default\Extensions\cjpalhdlnbpafiamejdnhcphjbkeiagm [2016-01-11]
CHR Extension: (Google Search) - C:\Users\E\AppData\Local\Google\Chrome\User Data\Default\Extensions\coobgpohoikkiipiblmjeljniedjpjpf [2015-12-21]
CHR Extension: (Google Calendar) - C:\Users\E\AppData\Local\Google\Chrome\User Data\Default\Extensions\ejjicmeblgpmajnghnpcppodonldlgfn [2015-12-22]
CHR Extension: (Google Sheets) - C:\Users\E\AppData\Local\Google\Chrome\User Data\Default\Extensions\felcaaldnbdncclmgdcncolpebgiejap [2015-12-21]
CHR Extension: (Readium) - C:\Users\E\AppData\Local\Google\Chrome\User Data\Default\Extensions\fepbnnnkkadjhjahcafoaglimekefifl [2015-12-22]
CHR Extension: (Google Docs Offline) - C:\Users\E\AppData\Local\Google\Chrome\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi [2015-12-21]
CHR Extension: (Planetarium) - C:\Users\E\AppData\Local\Google\Chrome\User Data\Default\Extensions\gheikhdfflhlbemfmhcfpeblehemeklp [2015-12-22]
CHR Extension: (AdBlock) - C:\Users\E\AppData\Local\Google\Chrome\User Data\Default\Extensions\gighmmpiobklfepjocnamgkkbiglidom [2016-01-09]
CHR Extension: (Unlimited Free VPN - Hola) - C:\Users\E\AppData\Local\Google\Chrome\User Data\Default\Extensions\gkojfkhlekighikafcpjkiklfbnlmeio [2016-01-03]
CHR Extension: (Reddit Enhancement Suite) - C:\Users\E\AppData\Local\Google\Chrome\User Data\Default\Extensions\kbmfpngjjgdllneeigpgjifpgocmfgmb [2016-01-11]
CHR Extension: (Google Voice (by Google)) - C:\Users\E\AppData\Local\Google\Chrome\User Data\Default\Extensions\kcnhkahnjcbndmmehfkdnkjomaanaooo [2015-12-22]
CHR Extension: (Alarm Clock Radio) - C:\Users\E\AppData\Local\Google\Chrome\User Data\Default\Extensions\kipdhcpepbpjaoggihaloebfjfafagmi [2015-12-22]
CHR Extension: (The Great Suspender) - C:\Users\E\AppData\Local\Google\Chrome\User Data\Default\Extensions\klbibkeccnjlkjkiokjodocebajanakg [2015-12-22]
CHR Extension: (PadMapper) - C:\Users\E\AppData\Local\Google\Chrome\User Data\Default\Extensions\lljagjbdinjommccodelnfmkepbdoafl [2015-12-22]
CHR Extension: (Application Launcher for Drive (by Google)) - C:\Users\E\AppData\Local\Google\Chrome\User Data\Default\Extensions\lmjegmlicamnimmfhcmpkclmigmmcbeh [2016-01-04]
CHR Extension: (Google Dictionary (by Google)) - C:\Users\E\AppData\Local\Google\Chrome\User Data\Default\Extensions\mgijmajocgfcbeboacabfgobmjgjcoja [2015-12-22]
CHR Extension: (Ghostery) - C:\Users\E\AppData\Local\Google\Chrome\User Data\Default\Extensions\mlomiejdfkolichcflejclcbmpeaniij [2015-12-29]
CHR Extension: (Cenafy) - C:\Users\E\AppData\Local\Google\Chrome\User Data\Default\Extensions\ndchmakhfaakbkhnkdgambadneloplnn [2015-12-22]
CHR Extension: (Reddit Preload GIFs) - C:\Users\E\AppData\Local\Google\Chrome\User Data\Default\Extensions\nghfcbekdkjbeichjmohlojmpikchibd [2015-12-22]
CHR Extension: (Chrome Web Store Payments) - C:\Users\E\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda [2015-12-21]
CHR Extension: (CLMapper) - C:\Users\E\AppData\Local\Google\Chrome\User Data\Default\Extensions\omonmigaleaafgpkgoammpclbcdepjpi [2015-12-22]
CHR Extension: (Gmail) - C:\Users\E\AppData\Local\Google\Chrome\User Data\Default\Extensions\pjkljhegncpnkpknbcohdijeoejaedia [2015-12-21]
CHR HKU\S-1-5-21-482056995-2111253809-2895985789-1001\SOFTWARE\Google\Chrome\Extensions\...\Chrome\Extension: [lmjegmlicamnimmfhcmpkclmigmmcbeh] - hxxps://clients2.google.com/service/update2/crx
 
==================== Services (Whitelisted) ========================
 
(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)
 
R2 ClickToRunSvc; C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe [2748600 2015-12-04] (Microsoft Corporation)
R2 HPSLPSVC; C:\Users\E\AppData\Local\Temp\7zS03AC\hpslpsvc64.dll [1039360 2015-09-21] (Hewlett-Packard Co.) [File not signed]
R2 igfxCUIService1.0.0.0; C:\Windows\system32\igfxCUIService.exe [330136 2015-08-27] (Intel Corporation)
R2 RtkAudioService; C:\Program Files\Realtek\Audio\HDA\RtkAudioService64.exe [306944 2015-08-03] (Realtek Semiconductor)
R2 SynTPEnhService; C:\Program Files\Synaptics\SynTP\SynTPEnhService.exe [237736 2015-08-03] (Synaptics Incorporated)
R3 WdNisSvc; C:\Program Files\Windows Defender\NisSrv.exe [364464 2015-10-30] (Microsoft Corporation)
R2 WinDefend; C:\Program Files\Windows Defender\MsMpEng.exe [24864 2015-10-30] (Microsoft Corporation)
 
===================== Drivers (Whitelisted) ==========================
 
(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)
 
S3 dot4; C:\Windows\system32\DRIVERS\Dot4.sys [151968 2012-10-19] (Windows ® Win 7 DDK provider)
S3 Dot4Print; C:\Windows\System32\drivers\Dot4Prt.sys [27040 2012-10-19] (Windows ® Win 7 DDK provider)
R0 MBI; C:\Windows\System32\drivers\MBI.sys [41464 2015-11-19] (Intel® Corporation)
R3 RSP2STOR; C:\Windows\system32\DRIVERS\RtsP2Stor.sys [310528 2015-06-29] (Realtek Semiconductor Corp.)
R3 rt640x64; C:\Windows\System32\drivers\rt640x64.sys [589824 2015-10-30] (Realtek                                            )
R3 RTWlanE; C:\Windows\System32\drivers\rtwlane.sys [4629744 2015-08-28] (Realtek Semiconductor Corporation                           )
R3 SmbDrvI; C:\Windows\system32\DRIVERS\Smb_driver_Intel.sys [33960 2015-08-03] (Synaptics Incorporated)
S0 WdBoot; C:\Windows\System32\drivers\WdBoot.sys [44568 2015-10-30] (Microsoft Corporation)
R0 WdFilter; C:\Windows\System32\drivers\WdFilter.sys [293216 2015-10-30] (Microsoft Corporation)
R3 WdNisDrv; C:\Windows\System32\Drivers\WdNisDrv.sys [118112 2015-10-30] (Microsoft Corporation)
R3 WirelessButtonDriver64; C:\Windows\System32\drivers\WirelessButtonDriver64.sys [30544 2015-08-13] (HP)
 
==================== NetSvcs (Whitelisted) ===================
 
(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)
 
 
==================== One Month Created files and folders ========
 
(If an entry is included in the fixlist, the file/folder will be moved.)
 
2016-01-13 19:05 - 2016-01-13 19:07 - 00014474 _____ C:\Users\E\Downloads\FRST.txt
2016-01-13 19:05 - 2016-01-13 19:05 - 00000000 ____D C:\FRST
2016-01-13 19:04 - 2016-01-13 19:05 - 02370560 _____ (Farbar) C:\Users\E\Downloads\FRST64.exe
2016-01-13 18:52 - 2016-01-13 18:57 - 00000000 ____D C:\Users\E\Downloads\Stephen.Colbert.2016.01.12.Saoirse.Ronan.720p.CBS.WEBRip.AAC2.0.x264-SynHD[rarbg]
2016-01-13 18:08 - 2016-01-13 18:38 - 00000000 ____D C:\Users\E\Downloads\SW2015_SP4.0_Full_SSQ
2016-01-13 17:48 - 2016-01-13 17:48 - 00000000 ____D C:\Users\E\Downloads\lab1_problem3
2016-01-13 17:46 - 2016-01-13 18:43 - 00000000 ____D C:\Users\E\AppData\Local\Arduino15
2016-01-13 17:46 - 2016-01-13 17:55 - 00000000 ____D C:\Users\E\Documents\Arduino
2016-01-13 17:46 - 2016-01-13 17:46 - 00000000 ____D C:\Users\E\.jssc
2016-01-13 17:45 - 2016-01-13 17:45 - 00000000 ____D C:\Users\E\.oracle_jre_usage
2016-01-13 11:10 - 2014-07-14 13:53 - 43963167 _____ C:\Users\E\Downloads\Gilat - Numerical Methods for Engineers and Scientists 3rd c2014.pdf
2016-01-12 21:17 - 2016-01-12 21:21 - 00000000 ____D C:\Users\E\Downloads\Stephen.Colbert.2016.01.11.Jane.Lynch.HDTV.x264-CROOKS[ettv]
2016-01-12 18:41 - 2016-01-12 18:42 - 00000000 ____D C:\Users\E\Downloads\Fast.N.Loud.S06E09.HDTV.x264-FUM[ettv]
2016-01-11 22:00 - 2016-01-11 22:00 - 00001072 _____ C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Arduino.lnk
2016-01-11 22:00 - 2016-01-11 22:00 - 00001060 _____ C:\Users\Public\Desktop\Arduino.lnk
2016-01-11 21:53 - 2016-01-11 22:00 - 00000000 ____D C:\Program Files (x86)\Arduino
2016-01-11 21:47 - 2016-01-11 21:53 - 00000000 ____D C:\Users\E\Downloads\Stephen.Colbert.2016.01.08.Matthew.Broderick.HDTV.x264-UAV[rarbg]
2016-01-11 21:06 - 2016-01-11 21:06 - 84671416 _____ C:\Users\E\Downloads\arduino-1.6.7-windows.exe
2016-01-11 18:13 - 2016-01-11 18:13 - 00023000 _____ C:\Users\E\Downloads\MATLAB.zip
2016-01-11 18:13 - 2015-11-16 22:48 - 00000000 ____D C:\Users\E\Downloads\MATLAB
2016-01-11 18:12 - 2016-01-11 18:12 - 00000000 ____D C:\Users\E\AppData\Roaming\Subversion
2016-01-11 18:12 - 2016-01-11 18:12 - 00000000 ____D C:\Users\E\AppData\Local\MathWorks
2016-01-11 18:11 - 2016-01-11 18:11 - 00000000 ____D C:\Users\E\Documents\MATLAB
2016-01-11 18:10 - 2016-01-11 18:10 - 00000000 ____D C:\Users\E\AppData\Roaming\MathWorks
2016-01-11 18:04 - 2016-01-11 18:04 - 00001372 _____ C:\ProgramData\Microsoft\Windows\Start Menu\Programs\MATLAB R2015b.lnk
2016-01-11 18:04 - 2016-01-11 18:04 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\MATLAB
2016-01-11 18:00 - 2016-01-11 18:09 - 00000570 _____ C:\Windows\Tasks\MATLAB R2015b Startup Accelerator.job
2016-01-11 18:00 - 2016-01-11 18:00 - 00003840 _____ C:\Windows\System32\Tasks\MATLAB R2015b Startup Accelerator
2016-01-11 18:00 - 2016-01-11 18:00 - 00000000 ____D C:\ProgramData\MathWorks
2016-01-11 17:50 - 2016-01-11 17:51 - 22211882 _____ C:\Users\E\Downloads\OpenRocket-15.03.jar
2016-01-11 15:34 - 2016-01-11 16:09 - 2398255619 _____ C:\Users\E\Downloads\Mathematica_10.3.1_WIN.zip
2016-01-11 15:13 - 2016-01-11 15:14 - 00128416 _____ C:\Users\E\Downloads\mathematica-student-readme.pdf
2016-01-11 15:00 - 2016-01-11 15:00 - 00000000 ____D C:\Users\E\Downloads\MathWorks
2016-01-11 14:59 - 2016-01-11 14:59 - 00000000 ____D C:\Program Files\MATLAB
2016-01-11 14:52 - 2016-01-11 14:53 - 00000000 ____D C:\Users\E\Downloads\_temp_matlab_R2015b_win64
2016-01-11 14:49 - 2016-01-11 14:50 - 95660312 _____ C:\Users\E\Downloads\matlab_R2015b_win64.exe
2016-01-11 14:40 - 2016-01-11 14:40 - 01341097 _____ C:\Users\E\Downloads\matlab-student.pdf
2016-01-11 14:39 - 2016-01-11 14:39 - 00015416 _____ C:\Users\E\Downloads\raspberrypiio.mlpkginstall
2016-01-11 14:39 - 2016-01-11 14:39 - 00015414 _____ C:\Users\E\Downloads\raspberrypi.mlpkginstall
2016-01-11 14:39 - 2016-01-11 14:39 - 00015408 _____ C:\Users\E\Downloads\arduinoio.mlpkginstall
2016-01-11 14:39 - 2016-01-11 14:39 - 00015405 _____ C:\Users\E\Downloads\arduino.mlpkginstall
2016-01-10 22:11 - 2016-01-10 22:16 - 00000000 ____D C:\Users\E\Downloads\Family.Guy.S14E11.HDTV.x264-KILLERS[ettv]
2016-01-10 22:11 - 2016-01-10 22:13 - 00000000 ____D C:\Users\E\Downloads\The.Simpsons.S27E11.HDTV.x264-KILLERS[ettv]
2016-01-10 12:19 - 2016-01-10 12:20 - 00000000 ____D C:\Users\E\Downloads\MythBusters.S16E01.The.Explosion.Special.HDTV.x264-W4F[ettv]
2016-01-09 01:44 - 2016-01-09 01:44 - 00259120 _____ C:\Users\E\Downloads\Tethered Satellites.pdf
2016-01-08 23:56 - 2016-01-08 23:56 - 00000000 ____D C:\Users\E\Downloads\Gold.Rush.S06E12.Crew.War.HDTV.x264-W4F[ettv]
2016-01-08 23:25 - 2016-01-08 23:37 - 00000000 ____D C:\Users\E\Downloads\[ www.torrenting.com ] - Shark.Tank.S07E13.HDTV.x264-UAV
2016-01-08 23:25 - 2016-01-08 23:27 - 00000000 ____D C:\Users\E\Downloads\Undercover.Boss.US.S07E04.HDTV.x264-FUM[ettv]
2016-01-08 20:20 - 2016-01-08 20:20 - 00000000 ____D C:\Users\E\Downloads\The.Hateful.Eight.2015.DVDSCR.XviD.AC3-ETRG
2016-01-08 12:09 - 2016-01-08 12:10 - 37515932 _____ C:\Users\E\Downloads\Gilat - Numerical Methods for Engineers and Scientists 3rd c2014.7z
2016-01-08 12:07 - 2016-01-08 12:09 - 00012019 _____ C:\Users\E\Downloads\Numerical+Methods+for+Engineers+and+Scientists+3rd+c2014+Gilat.torrent
2016-01-08 11:48 - 2016-01-08 11:53 - 58922855 _____ C:\Users\E\Downloads\Mechanics of Materials 8th Edition, R.C. Hibbeler.pdf
2016-01-08 11:48 - 2016-01-08 11:49 - 00000000 ____D C:\Users\E\Downloads\Mechanics_of_Materials-8th-Hibbeler-Solutions
2016-01-08 10:45 - 2016-01-08 10:52 - 00000000 ____D C:\Users\E\Downloads\Stephen.Colbert.2016.01.07.Damian.Lewis.HDTV.x264-UAV[ettv]
2016-01-07 19:31 - 2016-01-07 19:58 - 1629626354 _____ C:\Users\E\Downloads\Bridge.of.Spies.2015.HDRip.XviD.AC3-EVO.avi
2016-01-07 10:17 - 2016-01-07 10:17 - 00000000 ____D C:\Users\E\Downloads\Stephen.Colbert.2016.01.06.Jerry.Seinfeld.HDTV.x264-CROOKS[ettv]
2016-01-07 10:13 - 2016-01-07 10:14 - 00000000 ____D C:\Users\E\Downloads\Its.Always.Sunny.in.Philadelphia.S11E01.HDTV.x264-KILLERS[ettv]
2016-01-06 23:19 - 2016-01-06 23:19 - 04677893 _____ C:\Users\E\Downloads\osu1248457135.pdf
2016-01-06 22:19 - 2016-01-06 22:19 - 00038437 _____ C:\Users\E\Downloads\proposed_ug_research_projects_15-16.pdf
2016-01-06 22:10 - 2016-01-06 22:19 - 00000000 ____D C:\Users\E\Downloads\Modern.Family.S07E10.HDTV.x264-FUM[ettv]
2016-01-06 08:44 - 2016-01-06 08:45 - 00000000 ____D C:\Users\E\Downloads\Shark.Tank.S07E12.HDTV.x264-UAV[rarbg]
2016-01-06 08:43 - 2016-01-06 08:49 - 00000000 ____D C:\Users\E\Downloads\Stephen.Colbert.2016.01.05.John.Krasinski.HDTV.x264-UAV[rarbg]
2016-01-05 20:22 - 2016-01-05 20:22 - 00000000 ____D C:\Users\E\Downloads\Limitless.S01E12.HDTV.x264-LOL[ettv]
2016-01-05 19:39 - 2016-01-05 20:47 - 00017222 _____ C:\Users\E\Downloads\technical_elective_worksheet.xlsx
2016-01-05 15:24 - 2016-01-05 15:26 - 00000000 ____D C:\Users\E\Downloads\Fast.N.Loud.S06E08.HDTV.x264-FUM[ettv]
2016-01-05 15:19 - 2016-01-05 15:27 - 00000000 ____D C:\Users\E\Downloads\Stephen.Colbert.2016.01.04.Samuel.L.Jackson.HDTV.x264-UAV[rarbg]
2016-01-04 18:49 - 2016-01-13 15:21 - 00000000 ____D C:\Users\E\Desktop\Books
2016-01-04 18:48 - 2016-01-11 15:48 - 00000000 ___RD C:\Users\E\Google Drive
2016-01-04 18:44 - 2016-01-04 18:44 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Google Drive
2016-01-04 18:42 - 2016-01-04 18:42 - 00927824 _____ (Google Inc.) C:\Users\E\Downloads\googledrivesync.exe
2016-01-01 04:06 - 2016-01-01 04:16 - 00000000 ____D C:\Users\E\Downloads\About Time (2013) [1080p]
2015-12-28 16:57 - 2015-12-28 16:57 - 00000000 ____H C:\Windows\system32\Drivers\Msft_Kernel_WinUSB_01007.Wdf
2015-12-28 16:49 - 2015-12-28 16:49 - 00000000 ____H C:\Windows\system32\Drivers\Msft_User_WpdMtpDr_01_11_00.Wdf
2015-12-26 22:05 - 2015-12-26 22:05 - 00000000 ____D C:\Users\E\Documents\Think Tank Coalition
2015-12-26 20:15 - 2015-12-26 20:15 - 00000000 ____D C:\Windows\system32\SleepStudy
2015-12-25 14:10 - 2015-12-25 14:10 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\SDFormatter
2015-12-25 14:10 - 2015-12-25 14:10 - 00000000 ____D C:\Program Files (x86)\SDA
2015-12-25 14:09 - 2015-12-25 14:09 - 00000000 ____D C:\Users\E\AppData\Local\Downloaded Installations
2015-12-25 12:10 - 2015-12-25 12:10 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Image Writer
2015-12-25 12:10 - 2015-12-25 12:10 - 00000000 ____D C:\Program Files (x86)\ImageWriter
2015-12-24 20:23 - 2015-12-26 20:50 - 00000000 ____D C:\Users\E\Documents\BRV1
2015-12-24 20:23 - 2015-12-24 20:23 - 00000000 ____D C:\Users\E\Documents\Custom Office Templates
2015-12-24 19:49 - 2015-12-24 19:49 - 58840299 _____ C:\Users\E\Downloads\ThermodynamicsRocketPropulsionDobbins.pdf
2015-12-24 19:49 - 2015-12-24 19:49 - 06428525 _____ C:\Users\E\Downloads\DESIGN, BUILD, TEST LIQUID ROCKET ENGINES.pdf
2015-12-24 19:47 - 2015-12-24 19:47 - 00000000 ____D C:\Users\E\AppData\LocalLow\Adobe
2015-12-24 19:47 - 2015-12-24 19:47 - 00000000 ____D C:\Users\E\AppData\Local\CEF
2015-12-24 19:30 - 2016-01-13 18:53 - 00003972 _____ C:\Windows\System32\Tasks\Adobe Acrobat Update Task
2015-12-24 19:29 - 2016-01-13 18:51 - 00002457 _____ C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Acrobat Reader DC.lnk
2015-12-24 19:29 - 2015-12-24 19:29 - 13685202 _____ C:\Users\E\Downloads\rocket and spacecraft propulsion 3540221905_1.pdf
2015-12-24 19:28 - 2015-12-24 19:28 - 00000000 ____D C:\Program Files (x86)\Adobe
2015-12-24 19:24 - 2015-12-24 19:48 - 00000000 ____D C:\ProgramData\Adobe
2015-12-24 19:21 - 2015-12-24 19:47 - 00000000 ____D C:\Users\E\AppData\Local\Adobe
2015-12-24 19:04 - 2016-01-08 10:54 - 00000000 ____D C:\ProgramData\KMSAutoS
2015-12-24 19:04 - 2015-12-24 19:04 - 00003786 _____ C:\Windows\System32\Tasks\KMSAutoNet
2015-12-24 18:48 - 2015-12-24 18:48 - 00000000 ____D C:\Users\E\AppData\LocalLow\Temp
2015-12-24 17:12 - 2015-12-24 17:12 - 00000000 ___RD C:\Users\E\3D Objects
2015-12-23 18:03 - 2015-12-24 19:04 - 00000000 ____D C:\Users\E\AppData\Local\MSfree Inc
2015-12-23 17:52 - 2015-12-23 17:52 - 00002534 _____ C:\ProgramData\Microsoft\Windows\Start Menu\Programs\OneDrive for Business.lnk
2015-12-23 17:52 - 2015-12-23 17:52 - 00002498 _____ C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Skype for Business 2016.lnk
2015-12-23 17:52 - 2015-12-23 17:52 - 00002493 _____ C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Word 2016.lnk
2015-12-23 17:52 - 2015-12-23 17:52 - 00002492 _____ C:\ProgramData\Microsoft\Windows\Start Menu\Programs\PowerPoint 2016.lnk
2015-12-23 17:52 - 2015-12-23 17:52 - 00002456 _____ C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Access 2016.lnk
2015-12-23 17:52 - 2015-12-23 17:52 - 00002455 _____ C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Excel 2016.lnk
2015-12-23 17:52 - 2015-12-23 17:52 - 00002449 _____ C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Outlook 2016.lnk
2015-12-23 17:52 - 2015-12-23 17:52 - 00002443 _____ C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Publisher 2016.lnk
2015-12-23 17:52 - 2015-12-23 17:52 - 00002435 _____ C:\ProgramData\Microsoft\Windows\Start Menu\Programs\OneNote 2016.lnk
2015-12-23 17:52 - 2015-12-23 17:52 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Microsoft Office 2016 Tools
2015-12-23 17:34 - 2015-12-25 13:22 - 00000000 ____D C:\Program Files (x86)\Microsoft Office
2015-12-23 17:34 - 2015-12-23 17:34 - 00000000 ____D C:\Program Files\Microsoft Office 15
2015-12-23 17:17 - 2015-12-25 15:29 - 00000000 ____D C:\Users\E\AppData\Local\ElevatedDiagnostics
2015-12-23 17:10 - 2015-12-23 17:10 - 00000000 ____D C:\ProgramData\HP
2015-12-22 15:48 - 2015-12-22 15:48 - 00000000 ____D C:\Users\E\AppData\Roaming\WinRAR
2015-12-22 15:47 - 2015-12-22 15:48 - 00000000 ____D C:\Program Files\WinRAR
2015-12-22 15:47 - 2015-12-22 15:47 - 00000000 ____D C:\Users\E\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\WinRAR
2015-12-22 15:47 - 2015-12-22 15:47 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\WinRAR
2015-12-22 03:40 - 2016-01-13 19:05 - 00000000 ____D C:\Users\E\AppData\Roaming\qBittorrent
2015-12-22 03:40 - 2016-01-12 22:33 - 00000000 ____D C:\Users\E\AppData\Roaming\vlc
2015-12-22 03:40 - 2015-12-22 03:40 - 00000000 ____D C:\Users\E\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps
2015-12-22 03:40 - 2015-12-22 03:40 - 00000000 ____D C:\Users\E\AppData\Local\qBittorrent
2015-12-22 03:40 - 2015-12-22 03:40 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\VideoLAN
2015-12-22 03:39 - 2015-12-22 03:39 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\qBittorrent
2015-12-22 03:39 - 2015-12-22 03:39 - 00000000 ____D C:\Program Files\VideoLAN
2015-12-22 03:39 - 2015-12-22 03:39 - 00000000 ____D C:\Program Files (x86)\qBittorrent
2015-12-22 03:18 - 2015-12-22 03:18 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Music, Photos and Videos
2015-12-22 03:18 - 2015-12-22 03:18 - 00000000 ____D C:\Program Files\Realtek
2015-12-22 03:18 - 2015-08-03 06:03 - 72121872 _____ (Realtek Semiconductor Corp.) C:\Windows\system32\RCoRes64.dat
2015-12-22 03:18 - 2015-08-03 06:03 - 31085611 _____ C:\Windows\system32\Drivers\RTAIODAT.DAT
2015-12-22 03:18 - 2015-08-03 06:03 - 03271912 _____ (Realtek Semiconductor Corp.) C:\Windows\system32\RtkApi64.dll
2015-12-22 03:18 - 2015-08-03 06:03 - 02946304 _____ (Realtek Semiconductor Corp.) C:\Windows\system32\RtPgEx64.dll
2015-12-22 03:18 - 2015-08-03 06:03 - 02711296 _____ (Realtek Semiconductor Corp.) C:\Windows\system32\RTSnMg64.cpl
2015-12-22 03:18 - 2015-08-03 06:03 - 01759488 _____ (Realtek Semiconductor Corp.) C:\Windows\system32\RCoInstII64.dll
2015-12-22 03:18 - 2015-08-03 06:03 - 01435152 _____ (Synopsys, Inc.) C:\Windows\system32\SRRPTR64.dll
2015-12-22 03:18 - 2015-08-03 06:03 - 01331336 _____ (Realtek Semiconductor Corp.) C:\Windows\system32\RTCOM64.dll
2015-12-22 03:18 - 2015-08-03 06:03 - 01122648 _____ (SRS Labs, Inc.) C:\Windows\system32\slcnt64.dll
2015-12-22 03:18 - 2015-08-03 06:03 - 00961024 _____ (DTS, Inc.) C:\Windows\system32\sl3apo64.dll
2015-12-22 03:18 - 2015-08-03 06:03 - 00749776 _____ (DTS, Inc.) C:\Windows\system32\sltech64.dll
2015-12-22 03:18 - 2015-08-03 06:03 - 00645464 _____ (Realtek Semiconductor Corp.) C:\Windows\system32\RtDataProc64.dll
2015-12-22 03:18 - 2015-08-03 06:03 - 00532384 _____ (SRS Labs, Inc.) C:\Windows\system32\SRSTSX64.dll
2015-12-22 03:18 - 2015-08-03 06:03 - 00467168 _____ (Synopsys, Inc.) C:\Windows\system32\SRAPO64.dll
2015-12-22 03:18 - 2015-08-03 06:03 - 00387320 _____ (Dolby Laboratories, Inc.) C:\Windows\system32\RTEEP64A.dll
2015-12-22 03:18 - 2015-08-03 06:03 - 00381416 _____ (Synopsys, Inc.) C:\Windows\system32\SRCOM64.dll
2015-12-22 03:18 - 2015-08-03 06:03 - 00343712 _____ (Realtek Semiconductor Corp.) C:\Windows\system32\RtlCPAPI64.dll
2015-12-22 03:18 - 2015-08-03 06:03 - 00341160 _____ (Synopsys, Inc.) C:\Windows\system32\SRCOM.dll
2015-12-22 03:18 - 2015-08-03 06:03 - 00321720 _____ (Dolby Laboratories, Inc.) C:\Windows\system32\RP3DHT64.dll
2015-12-22 03:18 - 2015-08-03 06:03 - 00321720 _____ (Dolby Laboratories, Inc.) C:\Windows\system32\RP3DAA64.dll
2015-12-22 03:18 - 2015-08-03 06:03 - 00259288 _____ (TODO: <Company name>) C:\Windows\system32\slprp64.dll
2015-12-22 03:18 - 2015-08-03 06:03 - 00214840 _____ (Dolby Laboratories, Inc.) C:\Windows\system32\RTEED64A.dll
2015-12-22 03:18 - 2015-08-03 06:03 - 00195192 _____ (Realtek Semiconductor Corp.) C:\Windows\system32\RtkCfg64.dll
2015-12-22 03:18 - 2015-08-03 06:03 - 00166208 _____ (SRS Labs, Inc.) C:\Windows\system32\SRSWOW64.dll
2015-12-22 03:18 - 2015-08-03 06:03 - 00110992 _____ (Dolby Laboratories, Inc.) C:\Windows\system32\RTEEL64A.dll
2015-12-22 03:18 - 2015-08-03 06:03 - 00088352 _____ (Dolby Laboratories, Inc.) C:\Windows\system32\RTEEG64A.dll
2015-12-22 03:17 - 2015-12-22 03:17 - 00000000 ___HD C:\Program Files (x86)\InstallShield Installation Information
2015-12-22 03:17 - 2015-08-03 06:03 - 01601952 _____ (Conexant Systems Inc.) C:\Windows\system32\CX64APO.dll
2015-12-22 03:17 - 2015-08-03 06:03 - 00574760 _____ (Andrea Electronics Corporation) C:\Windows\system32\AERTAC64.dll
2015-12-22 03:17 - 2015-08-03 06:03 - 00122328 _____ (Real Sound Lab SIA) C:\Windows\system32\CONEQMSAPOGUILibrary.dll
2015-12-22 03:17 - 2015-08-03 06:03 - 00118600 _____ (Andrea Electronics Corporation) C:\Windows\system32\AERTAR64.dll
2015-12-22 03:16 - 2015-08-03 06:03 - 02825944 _____ (Realtek Semiconductor Corp.) C:\Windows\RtlExUpd.dll
2015-12-21 19:08 - 2015-12-21 19:08 - 00000000 ____D C:\Program Files (x86)\Realtek
2015-12-21 19:07 - 2015-12-22 03:20 - 00000000 ___HD C:\Program Files (x86)\Temp
2015-12-21 19:04 - 2016-01-06 21:05 - 00000006 ____H C:\Windows\Tasks\SA.DAT
2015-12-21 19:04 - 2015-12-21 19:04 - 00000000 _SHDL C:\Users\Public\Documents\My Videos
2015-12-21 19:04 - 2015-12-21 19:04 - 00000000 _SHDL C:\Users\Public\Documents\My Pictures
2015-12-21 19:04 - 2015-12-21 19:04 - 00000000 _SHDL C:\Users\Public\Documents\My Music
2015-12-21 19:04 - 2015-12-21 19:04 - 00000000 _SHDL C:\Users\Default\My Documents
2015-12-21 19:04 - 2015-12-21 19:04 - 00000000 _SHDL C:\Users\Default\Documents\My Videos
2015-12-21 19:04 - 2015-12-21 19:04 - 00000000 _SHDL C:\Users\Default\Documents\My Pictures
2015-12-21 19:04 - 2015-12-21 19:04 - 00000000 _SHDL C:\Users\Default\Documents\My Music
2015-12-21 19:04 - 2015-12-21 19:04 - 00000000 _SHDL C:\Users\Default User\Documents\My Videos
2015-12-21 19:04 - 2015-12-21 19:04 - 00000000 _SHDL C:\Users\Default User\Documents\My Pictures
2015-12-21 19:04 - 2015-12-21 19:04 - 00000000 _SHDL C:\Users\Default User\Documents\My Music
2015-12-21 19:04 - 2015-12-21 19:04 - 00000000 _SHDL C:\Documents and Settings
2015-12-21 19:00 - 2015-12-21 19:00 - 00000144 _____ C:\Windows\system32\{A6D608F0-0BDE-491A-97AE-5C4B05D86E01}.bat
2015-12-21 18:58 - 2015-12-21 18:58 - 00000000 ____H C:\Windows\system32\Drivers\Msft_User_WpdFs_01_11_00.Wdf
2015-12-21 18:57 - 2015-12-24 21:21 - 00331624 _____ C:\Windows\system32\FNTCACHE.DAT
2015-12-21 18:43 - 2015-12-21 19:02 - 00000000 ____D C:\Windows\Panther
2015-12-21 17:34 - 2016-01-06 21:06 - 00000000 __SHD C:\Users\E\IntelGraphicsProfiles
2015-12-21 17:34 - 2015-12-21 17:34 - 00015552 _____ C:\Windows\system32\results.xml
2015-12-21 17:34 - 2015-12-21 17:34 - 00000451 _____ C:\Windows\system32\{F33C3B9B-72AF-418A-B3FD-560646F7CDA2}.bat
2015-12-21 17:12 - 2015-12-21 17:12 - 00000000 ____D C:\Users\E\AppData\Local\Comms
2015-12-21 17:08 - 2015-12-08 22:39 - 00301728 ____N (Microsoft Corporation) C:\Windows\system32\MpSigStub.exe
2015-12-21 16:58 - 2015-12-21 17:04 - 00000000 ____D C:\Windows\system32\MRT
2015-12-21 16:58 - 2015-11-23 19:10 - 140158008 _____ (Microsoft Corporation) C:\Windows\system32\MRT.exe
2015-12-21 16:55 - 2015-12-21 16:55 - 00000724 _____ C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Intel® HD Graphics Control Panel.lnk
2015-12-21 16:50 - 2015-12-06 23:07 - 16984064 _____ (Microsoft Corporation) C:\Windows\system32\Windows.UI.Xaml.dll
2015-12-21 16:50 - 2015-12-06 22:58 - 24601600 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.dll
2015-12-21 16:50 - 2015-11-24 02:35 - 22393856 _____ (Microsoft Corporation) C:\Windows\system32\edgehtml.dll
2015-12-21 16:50 - 2015-11-24 02:23 - 13381120 _____ (Microsoft Corporation) C:\Windows\system32\ieframe.dll
2015-12-21 16:50 - 2015-11-24 02:11 - 18678272 _____ (Microsoft Corporation) C:\Windows\SysWOW64\edgehtml.dll
2015-12-21 16:50 - 2015-11-24 02:08 - 12125184 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieframe.dll
2015-12-21 16:50 - 2015-11-13 01:41 - 22572632 _____ (Microsoft Corporation) C:\Windows\system32\shell32.dll
2015-12-21 16:50 - 2015-11-13 01:18 - 21125408 _____ (Microsoft Corporation) C:\Windows\SysWOW64\shell32.dll
2015-12-21 16:50 - 2015-11-13 00:58 - 11545088 _____ (Microsoft Corporation) C:\Windows\system32\twinui.dll
2015-12-21 16:50 - 2015-11-13 00:29 - 09918976 _____ (Microsoft Corporation) C:\Windows\SysWOW64\twinui.dll
2015-12-21 16:49 - 2015-12-06 23:55 - 01281376 _____ (Microsoft Corporation) C:\Windows\system32\LicenseManager.dll
2015-12-21 16:49 - 2015-12-06 23:48 - 02544256 _____ (Microsoft Corporation) C:\Windows\system32\mfcore.dll
2015-12-21 16:49 - 2015-12-06 23:48 - 02180136 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mfcore.dll
2015-12-21 16:49 - 2015-12-06 23:48 - 01299504 _____ (Microsoft Corporation) C:\Windows\system32\mfnetsrc.dll
2015-12-21 16:49 - 2015-12-06 23:48 - 01155944 _____ (Microsoft Corporation) C:\Windows\system32\mfasfsrcsnk.dll
2015-12-21 16:49 - 2015-12-06 23:48 - 01118208 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mfnetsrc.dll
2015-12-21 16:49 - 2015-12-06 23:48 - 00983464 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mfasfsrcsnk.dll
2015-12-21 16:49 - 2015-12-06 23:48 - 00823264 _____ (Microsoft Corporation) C:\Windows\system32\mfmpeg2srcsnk.dll
2015-12-21 16:49 - 2015-12-06 23:47 - 00716928 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mfmpeg2srcsnk.dll
2015-12-21 16:49 - 2015-12-06 23:46 - 03671888 _____ (Microsoft Corporation) C:\Windows\system32\iertutil.dll
2015-12-21 16:49 - 2015-12-06 23:46 - 02919320 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iertutil.dll
2015-12-21 16:49 - 2015-12-06 23:10 - 00824320 _____ (Microsoft Corporation) C:\Windows\system32\WpcWebFilter.dll
2015-12-21 16:49 - 2015-12-06 23:03 - 13017600 _____ (Microsoft Corporation) C:\Windows\SysWOW64\Windows.UI.Xaml.dll
2015-12-21 16:49 - 2015-12-06 22:53 - 19339264 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.dll
2015-12-21 16:49 - 2015-12-06 22:45 - 02582016 _____ (Microsoft Corporation) C:\Windows\system32\MFMediaEngine.dll
2015-12-21 16:49 - 2015-12-06 22:43 - 02598400 _____ (Microsoft Corporation) C:\Windows\system32\NetworkMobileSettings.dll
2015-12-21 16:49 - 2015-12-06 22:40 - 03593216 _____ (Microsoft Corporation) C:\Windows\system32\win32kfull.sys
2015-12-21 16:49 - 2015-12-06 22:40 - 01995776 _____ (Microsoft Corporation) C:\Windows\system32\ActiveSyncProvider.dll
2015-12-21 16:49 - 2015-12-06 22:40 - 01706496 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ActiveSyncProvider.dll
2015-12-21 16:49 - 2015-12-01 02:12 - 02152800 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\ntfs.sys
2015-12-21 16:49 - 2015-11-24 07:07 - 01817160 _____ (Microsoft Corporation) C:\Windows\system32\ntdll.dll
2015-12-21 16:49 - 2015-11-24 06:06 - 01540768 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ntdll.dll
2015-12-21 16:49 - 2015-11-24 03:58 - 00604672 _____ (Microsoft Corporation) C:\Windows\system32\vbscript.dll
2015-12-21 16:49 - 2015-11-24 03:55 - 01393664 _____ (Microsoft Corporation) C:\Windows\system32\win32kbase.sys
2015-12-21 16:49 - 2015-11-24 03:52 - 01717248 _____ (Microsoft Corporation) C:\Windows\system32\GdiPlus.dll
2015-12-21 16:49 - 2015-11-24 03:49 - 01648640 _____ (Microsoft Corporation) C:\Windows\system32\comsvcs.dll
2015-12-21 16:49 - 2015-11-24 03:03 - 00503296 _____ (Microsoft Corporation) C:\Windows\SysWOW64\vbscript.dll
2015-12-21 16:49 - 2015-11-24 02:59 - 01467392 _____ (Microsoft Corporation) C:\Windows\SysWOW64\GdiPlus.dll
2015-12-21 16:49 - 2015-11-24 02:57 - 01328128 _____ (Microsoft Corporation) C:\Windows\SysWOW64\comsvcs.dll
2015-12-21 16:49 - 2015-11-24 02:29 - 02352128 _____ (Microsoft Corporation) C:\Windows\system32\authui.dll
2015-12-21 16:49 - 2015-11-24 02:04 - 02155008 _____ (Microsoft Corporation) C:\Windows\SysWOW64\authui.dll
2015-12-21 16:49 - 2015-11-22 05:47 - 07476576 _____ (Microsoft Corporation) C:\Windows\system32\ntoskrnl.exe
2015-12-21 16:49 - 2015-11-22 05:47 - 02653816 _____ C:\Windows\system32\CoreUIComponents.dll
2015-12-21 16:49 - 2015-11-22 05:41 - 01859448 _____ C:\Windows\SysWOW64\CoreUIComponents.dll
2015-12-21 16:49 - 2015-11-22 05:24 - 02772584 _____ (Microsoft Corporation) C:\Windows\system32\d3d11.dll
2015-12-21 16:49 - 2015-11-22 05:19 - 00440160 _____ (Microsoft Corporation) C:\Windows\system32\services.exe
2015-12-21 16:49 - 2015-11-22 05:14 - 02185840 _____ (Microsoft Corporation) C:\Windows\SysWOW64\d3d11.dll
2015-12-21 16:49 - 2015-11-22 04:54 - 00138240 _____ (Microsoft Corporation) C:\Windows\system32\ETWCoreUIComponentsResources.dll
2015-12-21 16:49 - 2015-11-22 04:45 - 00638464 _____ (Microsoft Corporation) C:\Windows\system32\enterprisecsps.dll
2015-12-21 16:49 - 2015-11-22 04:42 - 00589312 _____ (Microsoft Corporation) C:\Windows\system32\MbaeApi.dll
2015-12-21 16:49 - 2015-11-22 04:42 - 00138240 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ETWCoreUIComponentsResources.dll
2015-12-21 16:49 - 2015-11-22 04:41 - 00948224 _____ (Microsoft Corporation) C:\Windows\system32\XblAuthManager.dll
2015-12-21 16:49 - 2015-11-22 04:39 - 00938496 _____ (Microsoft Corporation) C:\Windows\system32\MapControlCore.dll
2015-12-21 16:49 - 2015-11-22 04:39 - 00870400 _____ (Microsoft Corporation) C:\Windows\system32\modernexecserver.dll
2015-12-21 16:49 - 2015-11-22 04:39 - 00783360 _____ (Microsoft Corporation) C:\Windows\system32\msfeeds.dll
2015-12-21 16:49 - 2015-11-22 04:38 - 01223168 _____ (Microsoft Corporation) C:\Windows\system32\Unistore.dll
2015-12-21 16:49 - 2015-11-22 04:38 - 01212928 _____ (Microsoft Corporation) C:\Windows\system32\wwansvc.dll
2015-12-21 16:49 - 2015-11-22 04:38 - 00912384 _____ (Microsoft Corporation) C:\Windows\system32\usermgr.dll
2015-12-21 16:49 - 2015-11-22 04:37 - 02624512 _____ (Microsoft Corporation) C:\Windows\system32\InputService.dll
2015-12-21 16:49 - 2015-11-22 04:37 - 01395200 _____ (Microsoft Corporation) C:\Windows\system32\UIAutomationCore.dll
2015-12-21 16:49 - 2015-11-22 04:36 - 01042432 _____ (Microsoft Corporation) C:\Windows\system32\BingOnlineServices.dll
2015-12-21 16:49 - 2015-11-22 04:34 - 02843136 _____ (Microsoft Corporation) C:\Windows\system32\cdp.dll
2015-12-21 16:49 - 2015-11-22 04:28 - 00948224 _____ (Microsoft Corporation) C:\Windows\SysWOW64\Unistore.dll
2015-12-21 16:49 - 2015-11-22 04:28 - 00870400 _____ (Microsoft Corporation) C:\Windows\system32\wpncore.dll
2015-12-21 16:49 - 2015-11-22 04:27 - 03993600 _____ (Microsoft Corporation) C:\Windows\system32\SettingsHandlers_nt.dll
2015-12-21 16:49 - 2015-11-22 04:27 - 01944576 _____ (Microsoft Corporation) C:\Windows\SysWOW64\InputService.dll
2015-12-21 16:49 - 2015-11-22 04:26 - 03355136 _____ (Microsoft Corporation) C:\Windows\system32\msftedit.dll
2015-12-21 16:49 - 2015-11-22 04:26 - 01139200 _____ (Microsoft Corporation) C:\Windows\SysWOW64\UIAutomationCore.dll
2015-12-21 16:49 - 2015-11-22 04:25 - 02280448 _____ (Microsoft Corporation) C:\Windows\system32\wuaueng.dll
2015-12-21 16:49 - 2015-11-22 04:24 - 02647552 _____ (Microsoft Corporation) C:\Windows\system32\wininet.dll
2015-12-21 16:49 - 2015-11-22 04:20 - 01860096 _____ (Microsoft Corporation) C:\Windows\SysWOW64\cdp.dll
2015-12-21 16:49 - 2015-11-22 04:18 - 01505280 _____ (Microsoft Corporation) C:\Windows\SysWOW64\urlmon.dll
2015-12-21 16:49 - 2015-11-22 04:18 - 00697856 _____ (Microsoft Corporation) C:\Windows\system32\PlayToManager.dll
2015-12-21 16:49 - 2015-11-22 04:17 - 02680320 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msftedit.dll
2015-12-21 16:49 - 2015-11-22 04:17 - 02121216 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wininet.dll
2015-12-21 16:49 - 2015-11-22 04:11 - 00517632 _____ (Microsoft Corporation) C:\Windows\SysWOW64\PlayToManager.dll
2015-12-21 16:49 - 2015-11-13 01:43 - 00586208 _____ (Microsoft Corporation) C:\Windows\system32\mf.dll
2015-12-21 16:49 - 2015-11-13 01:33 - 00911648 _____ (Microsoft Corporation) C:\Windows\system32\dcomp.dll
2015-12-21 16:49 - 2015-11-13 01:21 - 00511320 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mf.dll
2015-12-21 16:49 - 2015-11-13 00:57 - 00623616 _____ (Microsoft Corporation) C:\Windows\system32\PhoneProviders.dll
2015-12-21 16:49 - 2015-11-13 00:39 - 02444288 _____ (Microsoft Corporation) C:\Windows\system32\twinui.appcore.dll
2015-12-21 16:49 - 2015-11-13 00:19 - 02001408 _____ (Microsoft Corporation) C:\Windows\SysWOW64\twinui.appcore.dll
2015-12-21 16:49 - 2015-11-05 04:13 - 00969728 _____ (Microsoft Corporation) C:\Windows\system32\kerberos.dll
2015-12-21 16:48 - 2015-12-06 23:57 - 00973664 _____ (Microsoft Corporation) C:\Windows\SysWOW64\LicenseManager.dll
2015-12-21 16:48 - 2015-12-06 23:49 - 00412512 _____ (Microsoft Corporation) C:\Windows\system32\wifitask.exe
2015-12-21 16:48 - 2015-12-06 23:48 - 01092456 _____ (Microsoft Corporation) C:\Windows\system32\mfplat.dll
2015-12-21 16:48 - 2015-12-06 23:48 - 01065080 _____ (Microsoft Corporation) C:\Windows\system32\mfmp4srcsnk.dll
2015-12-21 16:48 - 2015-12-06 23:48 - 01020096 _____ (Microsoft Corporation) C:\Windows\system32\mfsrcsnk.dll
2015-12-21 16:48 - 2015-12-06 23:48 - 00884256 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mfmp4srcsnk.dll
2015-12-21 16:48 - 2015-12-06 23:48 - 00794888 _____ (Microsoft Corporation) C:\Windows\system32\mfds.dll
2015-12-21 16:48 - 2015-12-06 23:48 - 00696160 _____ (Microsoft Corporation) C:\Windows\system32\NetSetupEngine.dll
2015-12-21 16:48 - 2015-12-06 23:48 - 00670928 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mfds.dll
2015-12-21 16:48 - 2015-12-06 23:48 - 00526856 _____ (Microsoft Corporation) C:\Windows\system32\mfreadwrite.dll
2015-12-21 16:48 - 2015-12-06 23:48 - 00502112 _____ (Microsoft Corporation) C:\Windows\SysWOW64\NetSetupEngine.dll
2015-12-21 16:48 - 2015-12-06 23:48 - 00498448 _____ (Microsoft Corporation) C:\Windows\system32\MFCaptureEngine.dll
2015-12-21 16:48 - 2015-12-06 23:48 - 00462760 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mfreadwrite.dll
2015-12-21 16:48 - 2015-12-06 23:48 - 00450904 _____ (Microsoft Corporation) C:\Windows\SysWOW64\MFCaptureEngine.dll
2015-12-21 16:48 - 2015-12-06 23:48 - 00337840 _____ (Microsoft Corporation) C:\Windows\system32\MFPlay.dll
2015-12-21 16:48 - 2015-12-06 23:48 - 00289248 _____ (Microsoft Corporation) C:\Windows\SysWOW64\MFPlay.dll
2015-12-21 16:48 - 2015-12-06 23:48 - 00245848 _____ (Microsoft Corporation) C:\Windows\system32\mfps.dll
2015-12-21 16:48 - 2015-12-06 23:48 - 00115040 _____ (Microsoft Corporation) C:\Windows\system32\NetSetupApi.dll
2015-12-21 16:48 - 2015-12-06 23:48 - 00084832 _____ (Microsoft Corporation) C:\Windows\SysWOW64\NetSetupApi.dll
2015-12-21 16:48 - 2015-12-06 23:47 - 00925064 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mfplat.dll
2015-12-21 16:48 - 2015-12-06 23:47 - 00898184 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mfsrcsnk.dll
2015-12-21 16:48 - 2015-12-06 23:47 - 00116720 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mfps.dll
2015-12-21 16:48 - 2015-12-06 23:45 - 00264544 _____ (Microsoft Corporation) C:\Windows\system32\ContentDeliveryManager.Utilities.dll
2015-12-21 16:48 - 2015-12-06 23:15 - 01035776 _____ (Microsoft Corporation) C:\Windows\system32\XboxNetApiSvc.dll
2015-12-21 16:48 - 2015-12-06 23:15 - 00075776 _____ (Microsoft Corporation) C:\Windows\system32\Windows.Networking.XboxLive.ProxyStub.dll
2015-12-21 16:48 - 2015-12-06 23:09 - 00133120 _____ (Microsoft Corporation) C:\Windows\system32\flvprophandler.dll
2015-12-21 16:48 - 2015-12-06 23:09 - 00092160 _____ (Microsoft Corporation) C:\Windows\system32\policymanagerprecheck.dll
2015-12-21 16:48 - 2015-12-06 23:09 - 00030208 _____ (Microsoft Corporation) C:\Windows\system32\StorageUsage.dll
2015-12-21 16:48 - 2015-12-06 23:07 - 00134656 _____ (Microsoft Corporation) C:\Windows\system32\wificonnapi.dll
2015-12-21 16:48 - 2015-12-06 23:07 - 00077312 _____ (Microsoft Corporation) C:\Windows\system32\ProvPluginEng.dll
2015-12-21 16:48 - 2015-12-06 23:06 - 00572928 _____ (Microsoft Corporation) C:\Windows\SysWOW64\WpcWebFilter.dll
2015-12-21 16:48 - 2015-12-06 23:06 - 00231936 _____ (Microsoft Corporation) C:\Windows\system32\KnobsCore.dll
2015-12-21 16:48 - 2015-12-06 23:06 - 00199168 _____ (Microsoft Corporation) C:\Windows\system32\InstallAgent.exe
2015-12-21 16:48 - 2015-12-06 23:05 - 00192000 _____ (Microsoft Corporation) C:\Windows\system32\provisioningcsp.dll
2015-12-21 16:48 - 2015-12-06 23:05 - 00036864 _____ (Microsoft Corporation) C:\Windows\system32\BackgroundTransferHost.exe
2015-12-21 16:48 - 2015-12-06 23:04 - 00066560 _____ (Microsoft Corporation) C:\Windows\system32\moshost.dll
2015-12-21 16:48 - 2015-12-06 23:04 - 00056320 _____ (Microsoft Corporation) C:\Windows\system32\provtool.exe
2015-12-21 16:48 - 2015-12-06 23:02 - 00269824 _____ (Microsoft Corporation) C:\Windows\system32\moshostcore.dll
2015-12-21 16:48 - 2015-12-06 23:02 - 00161280 _____ (Microsoft Corporation) C:\Windows\SysWOW64\InstallAgent.exe
2015-12-21 16:48 - 2015-12-06 23:01 - 00543232 _____ (Microsoft Corporation) C:\Windows\system32\StoreAgent.dll
2015-12-21 16:48 - 2015-12-06 23:01 - 00034304 _____ (Microsoft Corporation) C:\Windows\SysWOW64\BackgroundTransferHost.exe
2015-12-21 16:48 - 2015-12-06 23:00 - 00618496 _____ (Microsoft Corporation) C:\Windows\system32\StorSvc.dll
2015-12-21 16:48 - 2015-12-06 23:00 - 00323072 _____ (Microsoft Corporation) C:\Windows\system32\MSFlacDecoder.dll
2015-12-21 16:48 - 2015-12-06 23:00 - 00210432 _____ (Microsoft Corporation) C:\Windows\system32\wcmcsp.dll
2015-12-21 16:48 - 2015-12-06 23:00 - 00203776 _____ (Microsoft Corporation) C:\Windows\system32\NetSetupSvc.dll
2015-12-21 16:48 - 2015-12-06 22:59 - 00558080 _____ (Microsoft Corporation) C:\Windows\system32\MBMediaManager.dll
2015-12-21 16:48 - 2015-12-06 22:59 - 00292352 _____ (Microsoft Corporation) C:\Windows\system32\provengine.dll
2015-12-21 16:48 - 2015-12-06 22:59 - 00286208 _____ (Microsoft Corporation) C:\Windows\system32\provhandlers.dll
2015-12-21 16:48 - 2015-12-06 22:59 - 00165376 _____ (Microsoft Corporation) C:\Windows\system32\provdatastore.dll
2015-12-21 16:48 - 2015-12-06 22:58 - 00459776 _____ (Microsoft Corporation) C:\Windows\system32\MapConfiguration.dll
2015-12-21 16:48 - 2015-12-06 22:57 - 00409088 _____ (Microsoft Corporation) C:\Windows\SysWOW64\StoreAgent.dll
2015-12-21 16:48 - 2015-12-06 22:57 - 00387072 _____ (Microsoft Corporation) C:\Windows\system32\qdvd.dll
2015-12-21 16:48 - 2015-12-06 22:57 - 00270848 _____ (Microsoft Corporation) C:\Windows\SysWOW64\MSFlacDecoder.dll
2015-12-21 16:48 - 2015-12-06 22:56 - 00607232 _____ (Microsoft Corporation) C:\Windows\system32\wcmsvc.dll
2015-12-21 16:48 - 2015-12-06 22:56 - 00497152 _____ (Microsoft Corporation) C:\Windows\system32\mfmkvsrcsnk.dll
2015-12-21 16:48 - 2015-12-06 22:55 - 07979008 _____ (Microsoft Corporation) C:\Windows\system32\mos.dll
2015-12-21 16:48 - 2015-12-06 22:55 - 00346112 _____ (Microsoft Corporation) C:\Windows\SysWOW64\MapConfiguration.dll
2015-12-21 16:48 - 2015-12-06 22:54 - 00850432 _____ (Microsoft Corporation) C:\Windows\system32\MapsStore.dll
2015-12-21 16:48 - 2015-12-06 22:54 - 00569856 _____ (Microsoft Corporation) C:\Windows\SysWOW64\qdvd.dll
2015-12-21 16:48 - 2015-12-06 22:53 - 00381952 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mfmkvsrcsnk.dll
2015-12-21 16:48 - 2015-12-06 22:51 - 01318912 _____ (Microsoft Corporation) C:\Windows\system32\wifinetworkmanager.dll
2015-12-21 16:48 - 2015-12-06 22:51 - 00223232 _____ (Microsoft Corporation) C:\Windows\system32\fveapibase.dll
2015-12-21 16:48 - 2015-12-06 22:50 - 01131520 _____ (Microsoft Corporation) C:\Windows\system32\Windows.Media.Audio.dll
2015-12-21 16:48 - 2015-12-06 22:49 - 01105920 _____ (Microsoft Corporation) C:\Windows\SysWOW64\Windows.Media.Audio.dll
2015-12-21 16:48 - 2015-12-06 22:48 - 06297088 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mos.dll
2015-12-21 16:48 - 2015-12-06 22:47 - 03428864 _____ (Microsoft Corporation) C:\Windows\system32\Windows.Media.dll
2015-12-21 16:48 - 2015-12-06 22:45 - 00900608 _____ (Microsoft Corporation) C:\Windows\system32\Windows.Networking.BackgroundTransfer.dll
2015-12-21 16:48 - 2015-12-06 22:45 - 00683008 _____ (Microsoft Corporation) C:\Windows\SysWOW64\Windows.Networking.BackgroundTransfer.dll
2015-12-21 16:48 - 2015-12-06 22:44 - 02796032 _____ (Microsoft Corporation) C:\Windows\SysWOW64\Windows.Media.dll
2015-12-21 16:48 - 2015-12-06 22:43 - 00931328 _____ (Microsoft Corporation) C:\Windows\system32\MSMPEG2ENC.DLL
2015-12-21 16:48 - 2015-12-06 22:41 - 02061824 _____ (Microsoft Corporation) C:\Windows\SysWOW64\MFMediaEngine.dll
2015-12-21 16:48 - 2015-12-06 22:39 - 00764928 _____ (Microsoft Corporation) C:\Windows\system32\fveapi.dll
2015-12-21 16:48 - 2015-12-06 22:38 - 00871936 _____ (Microsoft Corporation) C:\Windows\SysWOW64\MSMPEG2ENC.DLL
2015-12-21 16:48 - 2015-12-06 22:33 - 00375296 _____ (Microsoft Corporation) C:\Windows\system32\MDEServer.exe
2015-12-21 16:48 - 2015-12-06 22:32 - 00126464 _____ (Microsoft Corporation) C:\Windows\system32\dialserver.dll
2015-12-21 16:48 - 2015-11-24 05:26 - 01399224 _____ (Microsoft Corporation) C:\Windows\system32\user32.dll
2015-12-21 16:48 - 2015-11-24 05:01 - 02756096 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.tlb
2015-12-21 16:48 - 2015-11-24 04:54 - 00007680 _____ (Microsoft Corporation) C:\Windows\system32\readingviewresources.dll
2015-12-21 16:48 - 2015-11-24 04:53 - 00115200 _____ (Microsoft Corporation) C:\Windows\system32\win32k.sys
2015-12-21 16:48 - 2015-11-24 04:45 - 00018944 _____ (Microsoft Corporation) C:\Windows\system32\wshrm.dll
2015-12-21 16:48 - 2015-11-24 04:37 - 00147968 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\rmcast.sys
2015-12-21 16:48 - 2015-11-24 04:26 - 01337240 _____ (Microsoft Corporation) C:\Windows\SysWOW64\user32.dll
2015-12-21 16:48 - 2015-11-24 04:19 - 00182784 _____ (Microsoft Corporation) C:\Windows\system32\shutdownux.dll
2015-12-21 16:48 - 2015-11-24 04:12 - 00523776 _____ (Microsoft Corporation) C:\Windows\system32\catsrvut.dll
2015-12-21 16:48 - 2015-11-24 03:54 - 02756096 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.tlb
2015-12-21 16:48 - 2015-11-24 03:14 - 00415744 _____ (Microsoft Corporation) C:\Windows\SysWOW64\catsrvut.dll
2015-12-21 16:48 - 2015-11-22 05:41 - 00026408 _____ (Microsoft Corporation) C:\Windows\system32\wuauclt.exe
2015-12-21 16:48 - 2015-11-22 05:35 - 00538632 _____ (Microsoft Corporation) C:\Windows\system32\WWanAPI.dll
2015-12-21 16:48 - 2015-11-22 05:34 - 00080600 _____ (Microsoft Corporation) C:\Windows\system32\wwapi.dll
2015-12-21 16:48 - 2015-11-22 05:33 - 00095072 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\sdstor.sys
2015-12-21 16:48 - 2015-11-22 05:33 - 00058408 _____ (Microsoft Corporation) C:\Windows\system32\SensorsNativeApi.dll
2015-12-21 16:48 - 2015-11-22 05:33 - 00051680 _____ (Microsoft Corporation) C:\Windows\system32\SensorsUtilsV2.dll
2015-12-21 16:48 - 2015-11-22 05:30 - 00604928 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\cng.sys
2015-12-21 16:48 - 2015-11-22 05:30 - 00161632 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\ksecpkg.sys
2015-12-21 16:48 - 2015-11-22 05:26 - 00431232 _____ (Microsoft Corporation) C:\Windows\SysWOW64\WWanAPI.dll
2015-12-21 16:48 - 2015-11-22 05:25 - 00063528 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wwapi.dll
2015-12-21 16:48 - 2015-11-22 05:20 - 00795840 _____ (Microsoft Corporation) C:\Windows\system32\generaltel.dll
2015-12-21 16:48 - 2015-11-22 05:00 - 00089088 _____ (Microsoft Corporation) C:\Windows\system32\MapsCSP.dll
2015-12-21 16:48 - 2015-11-22 04:56 - 00064000 _____ (Microsoft Corporation) C:\Windows\system32\MosHostClient.dll
2015-12-21 16:48 - 2015-11-22 04:56 - 00064000 _____ (Microsoft Corporation) C:\Windows\system32\ihvrilproxy.dll
2015-12-21 16:48 - 2015-11-22 04:56 - 00055808 _____ (Microsoft Corporation) C:\Windows\system32\rilproxy.dll
2015-12-21 16:48 - 2015-11-22 04:55 - 00070656 _____ (Microsoft Corporation) C:\Windows\system32\XblAuthManagerProxy.dll
2015-12-21 16:48 - 2015-11-22 04:55 - 00013312 _____ (Microsoft Corporation) C:\Windows\system32\MapsBtSvcProxy.dll
2015-12-21 16:48 - 2015-11-22 04:54 - 00117248 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\capimg.sys
2015-12-21 16:48 - 2015-11-22 04:54 - 00092160 _____ (Microsoft Corporation) C:\Windows\system32\SensorsNativeApi.V2.dll
2015-12-21 16:48 - 2015-11-22 04:54 - 00075264 _____ (Microsoft Corporation) C:\Windows\system32\wwanprotdim.dll
2015-12-21 16:48 - 2015-11-22 04:54 - 00044032 _____ (Microsoft Corporation) C:\Windows\system32\wsplib.dll
2015-12-21 16:48 - 2015-11-22 04:54 - 00032256 _____ (Microsoft Corporation) C:\Windows\system32\wups2.dll
2015-12-21 16:48 - 2015-11-22 04:54 - 00028672 _____ (Microsoft Corporation) C:\Windows\system32\WordBreakers.dll
2015-12-21 16:48 - 2015-11-22 04:54 - 00028160 _____ (Microsoft Corporation) C:\Windows\system32\nativemap.dll
2015-12-21 16:48 - 2015-11-22 04:52 - 00069632 _____ (Microsoft Corporation) C:\Windows\system32\wininetlui.dll
2015-12-21 16:48 - 2015-11-22 04:52 - 00060928 _____ (Microsoft Corporation) C:\Windows\system32\XblAuthTokenBrokerExt.dll
2015-12-21 16:48 - 2015-11-22 04:52 - 00052224 _____ (Microsoft Corporation) C:\Windows\system32\jsproxy.dll
2015-12-21 16:48 - 2015-11-22 04:52 - 00028672 _____ (Microsoft Corporation) C:\Windows\system32\mapsupdatetask.dll
2015-12-21 16:48 - 2015-11-22 04:51 - 00157184 _____ (Microsoft Corporation) C:\Windows\system32\dmcertinst.exe
2015-12-21 16:48 - 2015-11-22 04:51 - 00119808 _____ (Microsoft Corporation) C:\Windows\system32\MapsBtSvc.dll
2015-12-21 16:48 - 2015-11-22 04:51 - 00072704 _____ (Microsoft Corporation) C:\Windows\system32\MosStorage.dll
2015-12-21 16:48 - 2015-11-22 04:51 - 00042496 _____ (Microsoft Corporation) C:\Windows\system32\mapstoasttask.dll
2015-12-21 16:48 - 2015-11-22 04:51 - 00034304 _____ (Microsoft Corporation) C:\Windows\system32\iernonce.dll
2015-12-21 16:48 - 2015-11-22 04:50 - 00074240 _____ (Microsoft Corporation) C:\Windows\system32\mssign32.dll
2015-12-21 16:48 - 2015-11-22 04:49 - 00162304 _____ (Microsoft Corporation) C:\Windows\system32\DeviceCensus.exe
2015-12-21 16:48 - 2015-11-22 04:49 - 00066560 _____ (Microsoft Corporation) C:\Windows\system32\iesetup.dll
2015-12-21 16:48 - 2015-11-22 04:49 - 00052224 _____ (Microsoft Corporation) C:\Windows\system32\Wwanpref.dll
2015-12-21 16:48 - 2015-11-22 04:46 - 00248832 _____ (Microsoft Corporation) C:\Windows\system32\UserMgrProxy.dll
2015-12-21 16:48 - 2015-11-22 04:45 - 06572032 _____ (Microsoft Corporation) C:\Windows\system32\wwanmm.dll
2015-12-21 16:48 - 2015-11-22 04:45 - 00220672 _____ (Microsoft Corporation) C:\Windows\system32\ie4uinit.exe
2015-12-21 16:48 - 2015-11-22 04:45 - 00073728 _____ (Microsoft Corporation) C:\Windows\system32\wwancfg.dll
2015-12-21 16:48 - 2015-11-22 04:44 - 00048640 _____ (Microsoft Corporation) C:\Windows\SysWOW64\MosHostClient.dll
2015-12-21 16:48 - 2015-11-22 04:43 - 00704000 _____ (Microsoft Corporation) C:\Windows\system32\CellularAPI.dll
2015-12-21 16:48 - 2015-11-22 04:43 - 00382464 _____ (Microsoft Corporation) C:\Windows\system32\iedkcs32.dll
2015-12-21 16:48 - 2015-11-22 04:43 - 00342016 _____ (Microsoft Corporation) C:\Windows\system32\SensorService.dll
2015-12-21 16:48 - 2015-11-22 04:43 - 00041984 _____ (Microsoft Corporation) C:\Windows\SysWOW64\XblAuthManagerProxy.dll
2015-12-21 16:48 - 2015-11-22 04:42 - 00168960 _____ (Microsoft Corporation) C:\Windows\system32\mdmmigrator.dll
2015-12-21 16:48 - 2015-11-22 04:42 - 00024064 _____ (Microsoft Corporation) C:\Windows\SysWOW64\WordBreakers.dll
2015-12-21 16:48 - 2015-11-22 04:41 - 01814528 _____ (Microsoft Corporation) C:\Windows\system32\pnidui.dll
2015-12-21 16:48 - 2015-11-22 04:40 - 01056256 _____ (Microsoft Corporation) C:\Windows\system32\JpMapControl.dll
2015-12-21 16:48 - 2015-11-22 04:40 - 00465920 _____ (Microsoft Corporation) C:\Windows\system32\wwanconn.dll
2015-12-21 16:48 - 2015-11-22 04:40 - 00065536 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wininetlui.dll
2015-12-21 16:48 - 2015-11-22 04:40 - 00049152 _____ (Microsoft Corporation) C:\Windows\SysWOW64\XblAuthTokenBrokerExt.dll
2015-12-21 16:48 - 2015-11-22 04:39 - 02126848 _____ (Microsoft Corporation) C:\Windows\system32\inetcpl.cpl
2015-12-21 16:48 - 2015-11-22 04:39 - 01713664 _____ (Microsoft Corporation) C:\Windows\system32\SRHInproc.dll
2015-12-21 16:48 - 2015-11-22 04:39 - 00988160 _____ (Microsoft Corporation) C:\Windows\system32\NMAA.dll
2015-12-21 16:48 - 2015-11-22 04:39 - 00957440 _____ (Microsoft Corporation) C:\Windows\system32\SRH.dll
2015-12-21 16:48 - 2015-11-22 04:39 - 00114688 _____ (Microsoft Corporation) C:\Windows\system32\offlinelsa.dll
2015-12-21 16:48 - 2015-11-22 04:39 - 00086528 _____ (Microsoft Corporation) C:\Windows\SysWOW64\MapsBtSvc.dll
2015-12-21 16:48 - 2015-11-22 04:39 - 00058368 _____ (Microsoft Corporation) C:\Windows\SysWOW64\MosStorage.dll
2015-12-21 16:48 - 2015-11-22 04:39 - 00045568 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jsproxy.dll
2015-12-21 16:48 - 2015-11-22 04:38 - 00320000 _____ (Microsoft Corporation) C:\Windows\system32\cryptngc.dll
2015-12-21 16:48 - 2015-11-22 04:38 - 00060928 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mssign32.dll
2015-12-21 16:48 - 2015-11-22 04:37 - 00515584 _____ (Microsoft Corporation) C:\Windows\system32\LogonController.dll
2015-12-21 16:48 - 2015-11-22 04:34 - 00345600 _____ (Microsoft Corporation) C:\Windows\system32\TextInputFramework.dll
2015-12-21 16:48 - 2015-11-22 04:34 - 00175616 _____ (Microsoft Corporation) C:\Windows\system32\Windows.UI.Core.TextInput.dll
2015-12-21 16:48 - 2015-11-22 04:34 - 00166912 _____ (Microsoft Corporation) C:\Windows\SysWOW64\UserMgrProxy.dll
2015-12-21 16:48 - 2015-11-22 04:34 - 00108544 _____ (Microsoft Corporation) C:\Windows\system32\InputLocaleManager.dll
2015-12-21 16:48 - 2015-11-22 04:34 - 00075264 _____ (Microsoft Corporation) C:\Windows\system32\EditBufferTestHook.dll
2015-12-21 16:48 - 2015-11-22 04:33 - 00205824 _____ (Nokia) C:\Windows\SysWOW64\NmaDirect.dll
2015-12-21 16:48 - 2015-11-22 04:32 - 00340480 _____ (Microsoft Corporation) C:\Windows\SysWOW64\PlayToDevice.dll
2015-12-21 16:48 - 2015-11-22 04:32 - 00334848 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iedkcs32.dll
2015-12-21 16:48 - 2015-11-22 04:31 - 07199232 _____ (Microsoft Corporation) C:\Windows\system32\BingMaps.dll
2015-12-21 16:48 - 2015-11-22 04:31 - 00470528 _____ (Microsoft Corporation) C:\Windows\SysWOW64\MbaeApi.dll
2015-12-21 16:48 - 2015-11-22 04:31 - 00416768 _____ (Microsoft Corporation) C:\Windows\system32\dmenrollengine.dll
2015-12-21 16:48 - 2015-11-22 04:29 - 00800768 _____ (Microsoft Corporation) C:\Windows\SysWOW64\JpMapControl.dll
2015-12-21 16:48 - 2015-11-22 04:28 - 01734656 _____ (Microsoft Corporation) C:\Windows\system32\urlmon.dll
2015-12-21 16:48 - 2015-11-22 04:28 - 01443328 _____ (Microsoft Corporation) C:\Windows\SysWOW64\SRHInproc.dll
2015-12-21 16:48 - 2015-11-22 04:28 - 01387008 _____ (Microsoft Corporation) C:\Windows\system32\lsasrv.dll
2015-12-21 16:48 - 2015-11-22 04:28 - 00793600 _____ (Microsoft Corporation) C:\Windows\SysWOW64\SRH.dll
2015-12-21 16:48 - 2015-11-22 04:28 - 00784896 _____ (Microsoft Corporation) C:\Windows\SysWOW64\NMAA.dll
2015-12-21 16:48 - 2015-11-22 04:28 - 00686592 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msfeeds.dll
2015-12-21 16:48 - 2015-11-22 04:28 - 00100864 _____ (Microsoft Corporation) C:\Windows\SysWOW64\offlinelsa.dll
2015-12-21 16:48 - 2015-11-22 04:27 - 02049024 _____ (Microsoft Corporation) C:\Windows\SysWOW64\inetcpl.cpl
2015-12-21 16:48 - 2015-11-22 04:27 - 00711680 _____ (Microsoft Corporation) C:\Windows\SysWOW64\MapControlCore.dll
2015-12-21 16:48 - 2015-11-22 04:27 - 00241664 _____ (Microsoft Corporation) C:\Windows\SysWOW64\cryptngc.dll
2015-12-21 16:48 - 2015-11-22 04:27 - 00160768 _____ (Microsoft Corporation) C:\Windows\system32\enrollmentapi.dll
2015-12-21 16:48 - 2015-11-22 04:26 - 00709120 _____ (Microsoft Corporation) C:\Windows\SysWOW64\BingOnlineServices.dll
2015-12-21 16:48 - 2015-11-22 04:26 - 00421888 _____ (Microsoft Corporation) C:\Windows\SysWOW64\LogonController.dll
2015-12-21 16:48 - 2015-11-22 04:25 - 00133632 _____ (Microsoft Corporation) C:\Windows\SysWOW64\Windows.UI.Core.TextInput.dll
2015-12-21 16:48 - 2015-11-22 04:24 - 00245760 _____ (Microsoft Corporation) C:\Windows\SysWOW64\TextInputFramework.dll
2015-12-21 16:48 - 2015-11-22 04:24 - 00083456 _____ (Microsoft Corporation) C:\Windows\SysWOW64\InputLocaleManager.dll
2015-12-21 16:48 - 2015-11-22 04:24 - 00059904 _____ (Microsoft Corporation) C:\Windows\SysWOW64\EditBufferTestHook.dll
2015-12-21 16:48 - 2015-11-22 04:23 - 05202944 _____ (Microsoft Corporation) C:\Windows\SysWOW64\BingMaps.dll
2015-12-21 16:48 - 2015-11-22 04:18 - 00458752 _____ (Microsoft Corporation) C:\Windows\system32\PlayToDevice.dll
2015-12-21 16:48 - 2015-11-21 01:21 - 00809312 _____ (Microsoft Corporation) C:\Windows\system32\WWAHost.exe
2015-12-21 16:48 - 2015-11-21 01:02 - 00704352 _____ (Microsoft Corporation) C:\Windows\SysWOW64\WWAHost.exe
2015-12-21 16:48 - 2015-11-21 00:44 - 00204800 _____ (Microsoft Corporation) C:\Windows\system32\Microsoft-Windows-AppModelExecEvents.dll
2015-12-21 16:48 - 2015-11-21 00:29 - 00286720 _____ (Microsoft Corporation) C:\Windows\system32\deviceaccess.dll
2015-12-21 16:48 - 2015-11-21 00:07 - 00227840 _____ (Microsoft Corporation) C:\Windows\SysWOW64\deviceaccess.dll
2015-12-21 16:48 - 2015-11-13 01:55 - 00035680 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\wimmount.sys
2015-12-21 16:48 - 2015-11-13 01:51 - 00698208 _____ (Microsoft Corporation) C:\Windows\system32\wimgapi.dll
2015-12-21 16:48 - 2015-11-13 01:51 - 00523616 _____ (Microsoft Corporation) C:\Windows\system32\wimserv.exe
2015-12-21 16:48 - 2015-11-13 01:51 - 00334736 _____ (Microsoft Corporation) C:\Windows\system32\policymanager.dll
2015-12-21 16:48 - 2015-11-13 01:43 - 00536768 _____ (Microsoft Corporation) C:\Windows\system32\AudioSes.dll
2015-12-21 16:48 - 2015-11-13 01:43 - 00369912 _____ (Microsoft Corporation) C:\Windows\system32\audiodg.exe
2015-12-21 16:48 - 2015-11-13 01:43 - 00110032 _____ (Microsoft Corporation) C:\Windows\system32\EncDump.dll
2015-12-21 16:48 - 2015-11-13 01:43 - 00035656 _____ (Microsoft Corporation) C:\Windows\system32\mfpmp.exe
2015-12-21 16:48 - 2015-11-13 01:42 - 00516544 _____ (Microsoft Corporation) C:\Windows\system32\AudioEng.dll
2015-12-21 16:48 - 2015-11-13 01:42 - 00408128 _____ (Microsoft Corporation) C:\Windows\system32\AUDIOKSE.dll
2015-12-21 16:48 - 2015-11-13 01:42 - 00088392 _____ (Microsoft Corporation) C:\Windows\system32\remoteaudioendpoint.dll
2015-12-21 16:48 - 2015-11-13 01:33 - 00586080 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wimgapi.dll
2015-12-21 16:48 - 2015-11-13 01:33 - 00092352 _____ (Microsoft Corporation) C:\Windows\system32\acmigration.dll
2015-12-21 16:48 - 2015-11-13 01:32 - 00296488 _____ (Microsoft Corporation) C:\Windows\SysWOW64\policymanager.dll
2015-12-21 16:48 - 2015-11-13 01:21 - 00454056 _____ (Microsoft Corporation) C:\Windows\SysWOW64\AudioEng.dll
2015-12-21 16:48 - 2015-11-13 01:21 - 00405048 _____ (Microsoft Corporation) C:\Windows\SysWOW64\AudioSes.dll
2015-12-21 16:48 - 2015-11-13 01:21 - 00366224 _____ (Microsoft Corporation) C:\Windows\SysWOW64\AUDIOKSE.dll
2015-12-21 16:48 - 2015-11-13 01:21 - 00073360 _____ (Microsoft Corporation) C:\Windows\SysWOW64\remoteaudioendpoint.dll
2015-12-21 16:48 - 2015-11-13 01:21 - 00032040 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mfpmp.exe
2015-12-21 16:48 - 2015-11-13 01:09 - 00675064 _____ (Microsoft Corporation) C:\Windows\SysWOW64\dcomp.dll
2015-12-21 16:48 - 2015-11-13 01:07 - 00028160 _____ (Microsoft Corporation) C:\Windows\system32\Windows.Management.Provisioning.ProxyStub.dll
2015-12-21 16:48 - 2015-11-13 01:06 - 00052736 _____ (Microsoft Corporation) C:\Windows\system32\RemovableMediaProvisioningPlugin.dll
2015-12-21 16:48 - 2015-11-13 01:05 - 00122368 _____ (Microsoft Corporation) C:\Windows\system32\KnobsCsp.dll
2015-12-21 16:48 - 2015-11-13 01:05 - 00078336 _____ (Microsoft Corporation) C:\Windows\system32\BarcodeProvisioningPlugin.dll
2015-12-21 16:48 - 2015-11-13 01:05 - 00043520 _____ (Microsoft Corporation) C:\Windows\system32\bcastdvr.proxy.dll
2015-12-21 16:48 - 2015-11-13 01:05 - 00030720 _____ (Microsoft Corporation) C:\Windows\system32\tetheringconfigsp.dll
2015-12-21 16:48 - 2015-11-13 01:04 - 00089600 _____ (Microsoft Corporation) C:\Windows\system32\NFCProvisioningPlugin.dll
2015-12-21 16:48 - 2015-11-13 01:04 - 00037376 _____ (Microsoft Corporation) C:\Windows\system32\LaunchWinApp.exe
2015-12-21 16:48 - 2015-11-13 01:04 - 00017408 _____ (Microsoft Corporation) C:\Windows\system32\IcsEntitlementHost.exe
2015-12-21 16:48 - 2015-11-13 01:03 - 00052736 _____ (Microsoft Corporation) C:\Windows\system32\tetheringclient.dll
2015-12-21 16:48 - 2015-11-13 01:00 - 00087040 _____ (Microsoft Corporation) C:\Windows\system32\tzautoupdate.dll
2015-12-21 16:48 - 2015-11-13 00:59 - 00086528 _____ (Microsoft Corporation) C:\Windows\system32\AppCapture.dll
2015-12-21 16:48 - 2015-11-13 00:58 - 00162304 _____ (Microsoft Corporation) C:\Windows\system32\tetheringservice.dll
2015-12-21 16:48 - 2015-11-13 00:56 - 00163328 _____ (Microsoft Corporation) C:\Windows\system32\provops.dll
2015-12-21 16:48 - 2015-11-13 00:55 - 00450560 _____ (Microsoft Corporation) C:\Windows\system32\Windows.Internal.Bluetooth.dll
2015-12-21 16:48 - 2015-11-13 00:54 - 00275456 _____ (Microsoft Corporation) C:\Windows\system32\AudioEndpointBuilder.dll
2015-12-21 16:48 - 2015-11-13 00:53 - 00517632 _____ (Microsoft Corporation) C:\Windows\system32\winspool.drv
2015-12-21 16:48 - 2015-11-13 00:50 - 01063424 _____ (Microsoft Corporation) C:\Windows\system32\audiosrv.dll
2015-12-21 16:48 - 2015-11-13 00:49 - 00674816 _____ (Microsoft Corporation) C:\Windows\system32\Windows.UI.dll
2015-12-21 16:48 - 2015-11-13 00:40 - 00029696 _____ (Microsoft Corporation) C:\Windows\SysWOW64\LaunchWinApp.exe
2015-12-21 16:48 - 2015-11-13 00:40 - 00027136 _____ (Microsoft Corporation) C:\Windows\SysWOW64\bcastdvr.proxy.dll
2015-12-21 16:48 - 2015-11-13 00:34 - 00070656 _____ (Microsoft Corporation) C:\Windows\SysWOW64\AppCapture.dll
2015-12-21 16:48 - 2015-11-13 00:33 - 00414720 _____ (Microsoft Corporation) C:\Windows\system32\bcastdvr.exe
2015-12-21 16:48 - 2015-11-13 00:30 - 00334336 _____ (Microsoft Corporation) C:\Windows\SysWOW64\bcastdvr.exe
2015-12-21 16:48 - 2015-11-13 00:30 - 00315904 _____ (Microsoft Corporation) C:\Windows\SysWOW64\Windows.Internal.Bluetooth.dll
2015-12-21 16:48 - 2015-11-13 00:27 - 00400896 _____ (Microsoft Corporation) C:\Windows\SysWOW64\winspool.drv
2015-12-21 16:48 - 2015-11-13 00:23 - 00490496 _____ (Microsoft Corporation) C:\Windows\SysWOW64\Windows.UI.dll
2015-12-21 16:48 - 2015-11-05 07:05 - 00118624 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\tdx.sys
2015-12-21 16:48 - 2015-11-05 05:40 - 00630632 _____ (Microsoft Corporation) C:\Windows\system32\fontdrvhost.exe
2015-12-21 16:48 - 2015-11-05 05:25 - 00578912 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\afd.sys
2015-12-21 16:48 - 2015-11-05 05:08 - 00014336 _____ (Microsoft Corporation) C:\Windows\system32\dciman32.dll
2015-12-21 16:48 - 2015-11-05 05:08 - 00003072 _____ (Microsoft Corporation) C:\Windows\system32\lpk.dll
2015-12-21 16:48 - 2015-11-05 05:00 - 00118272 _____ (Microsoft Corporation) C:\Windows\system32\fontsub.dll
2015-12-21 16:48 - 2015-11-05 04:44 - 00365568 _____ (Adobe Systems Incorporated) C:\Windows\system32\atmfd.dll
2015-12-21 16:48 - 2015-11-05 04:41 - 00540752 _____ (Microsoft Corporation) C:\Windows\SysWOW64\fontdrvhost.exe
2015-12-21 16:48 - 2015-11-05 04:10 - 00803840 _____ (Microsoft Corporation) C:\Windows\system32\jscript.dll
2015-12-21 16:48 - 2015-11-05 04:03 - 00003072 _____ (Microsoft Corporation) C:\Windows\SysWOW64\lpk.dll
2015-12-21 16:48 - 2015-11-05 04:02 - 00011776 _____ (Microsoft Corporation) C:\Windows\SysWOW64\dciman32.dll
2015-12-21 16:48 - 2015-11-05 03:55 - 00093696 _____ (Microsoft Corporation) C:\Windows\SysWOW64\fontsub.dll
2015-12-21 16:48 - 2015-11-05 03:18 - 00791552 _____ (Microsoft Corporation) C:\Windows\SysWOW64\kerberos.dll
2015-12-21 16:48 - 2015-11-05 03:15 - 00647168 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript.dll
2015-12-21 16:47 - 2015-11-22 05:00 - 00058368 _____ (Microsoft Corporation) C:\Windows\system32\MosResource.dll
2015-12-21 16:47 - 2015-11-22 04:57 - 00110592 _____ (Microsoft Corporation) C:\Windows\system32\Microsoft-Windows-MapControls.dll
2015-12-21 16:47 - 2015-11-22 04:57 - 00036352 _____ (Microsoft Corporation) C:\Windows\system32\UIAutomationCoreRes.dll
2015-12-21 16:47 - 2015-11-22 04:57 - 00010240 _____ (Microsoft Corporation) C:\Windows\system32\Microsoft-Windows-MosTrace.dll
2015-12-21 16:47 - 2015-11-22 04:57 - 00009728 _____ (Microsoft Corporation) C:\Windows\system32\Microsoft-Windows-MosHost.dll
2015-12-21 16:47 - 2015-11-22 04:56 - 01268736 _____ (Microsoft Corporation) C:\Windows\system32\Windows.UI.Xaml.Resources.dll
2015-12-21 16:47 - 2015-11-22 04:54 - 00003072 _____ (Microsoft Corporation) C:\Windows\system32\MapControlStringsRes.dll
2015-12-21 16:47 - 2015-11-22 04:48 - 00058368 _____ (Microsoft Corporation) C:\Windows\SysWOW64\MosResource.dll
2015-12-21 16:47 - 2015-11-22 04:45 - 00264192 _____ (Nokia) C:\Windows\system32\NmaDirect.dll
2015-12-21 16:47 - 2015-11-22 04:45 - 00110592 _____ (Microsoft Corporation) C:\Windows\SysWOW64\Microsoft-Windows-MapControls.dll
2015-12-21 16:47 - 2015-11-22 04:45 - 00036352 _____ (Microsoft Corporation) C:\Windows\SysWOW64\UIAutomationCoreRes.dll
2015-12-21 16:47 - 2015-11-22 04:45 - 00010240 _____ (Microsoft Corporation) C:\Windows\SysWOW64\Microsoft-Windows-MosTrace.dll
2015-12-21 16:47 - 2015-11-22 04:45 - 00009728 _____ (Microsoft Corporation) C:\Windows\SysWOW64\Microsoft-Windows-MosHost.dll
2015-12-21 16:47 - 2015-11-22 04:44 - 01268736 _____ (Microsoft Corporation) C:\Windows\SysWOW64\Windows.UI.Xaml.Resources.dll
2015-12-21 16:47 - 2015-11-22 04:42 - 00003072 _____ (Microsoft Corporation) C:\Windows\SysWOW64\MapControlStringsRes.dll
2015-12-21 16:47 - 2015-11-05 05:04 - 00045568 _____ (Adobe Systems) C:\Windows\system32\atmlib.dll
2015-12-21 16:47 - 2015-11-05 03:59 - 00037376 _____ (Adobe Systems) C:\Windows\SysWOW64\atmlib.dll
2015-12-21 16:47 - 2015-11-05 03:42 - 00303104 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\atmfd.dll
2015-12-21 16:44 - 2015-12-21 16:55 - 00000000 ____D C:\Program Files (x86)\Intel
2015-12-21 16:43 - 2015-12-21 16:43 - 00002332 _____ C:\Users\Public\Desktop\Google Chrome.lnk
2015-12-21 16:43 - 2015-12-21 16:43 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Google Chrome
2015-12-21 16:43 - 2015-12-21 16:43 - 00000000 ____D C:\Program Files\Intel
2015-12-21 16:43 - 2015-08-27 18:20 - 00072704 _____ (Khronos Group) C:\Windows\system32\OpenCL.DLL
2015-12-21 16:43 - 2015-08-27 18:20 - 00069120 _____ (Khronos Group) C:\Windows\SysWOW64\OpenCL.DLL
2015-12-21 16:34 - 2016-01-13 18:39 - 00000920 _____ C:\Windows\Tasks\GoogleUpdateTaskMachineUA.job
2015-12-21 16:34 - 2016-01-10 16:39 - 00000916 _____ C:\Windows\Tasks\GoogleUpdateTaskMachineCore.job
2015-12-21 16:34 - 2016-01-04 18:44 - 00000000 ____D C:\Program Files (x86)\Google
2015-12-21 16:34 - 2015-12-21 16:34 - 00003978 _____ C:\Windows\System32\Tasks\GoogleUpdateTaskMachineUA
2015-12-21 16:34 - 2015-12-21 16:34 - 00003746 _____ C:\Windows\System32\Tasks\GoogleUpdateTaskMachineCore
2015-12-21 16:33 - 2016-01-04 18:44 - 00000000 ____D C:\Users\E\AppData\Local\Google
2015-12-21 16:33 - 2015-12-21 16:33 - 00000000 ____D C:\Users\E\AppData\Roaming\Macromedia
2015-12-21 16:31 - 2015-12-21 16:32 - 00000000 ____D C:\Users\E\AppData\Local\MicrosoftEdge
2015-12-21 16:30 - 2015-12-21 16:51 - 00000000 ____D C:\Intel
2015-12-21 16:30 - 2015-12-21 16:30 - 00000000 ____H C:\Windows\system32\Drivers\Msft_Kernel_SynTP_01011.Wdf
2015-12-21 16:30 - 2015-12-21 16:30 - 00000000 ____H C:\Windows\system32\Drivers\Msft_Kernel_Smb_driver_Intel_01011.Wdf
2015-12-21 16:30 - 2015-12-21 16:30 - 00000000 ____D C:\Program Files\Synaptics
2015-12-21 16:27 - 2015-12-21 19:07 - 00000000 ____D C:\swsetup
2015-12-21 16:27 - 2015-12-21 16:27 - 00000000 ____D C:\Windows\SysWOW64\sda
2015-12-21 16:25 - 2015-12-22 03:19 - 00000000 ____D C:\Windows\SysWOW64\RTCOM
2015-12-21 16:25 - 2015-12-21 16:26 - 00002351 _____ C:\Users\E\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\OneDrive.lnk
2015-12-21 16:25 - 2015-12-21 16:26 - 00000000 ___RD C:\Users\E\OneDrive
2015-12-21 16:25 - 2015-12-21 16:25 - 00000000 ____D C:\Windows\system32\SRSLabs
2015-12-21 16:23 - 2015-12-21 16:23 - 00000000 ____D C:\ProgramData\Microsoft OneDrive
2015-12-21 16:19 - 2016-01-13 15:23 - 00834360 _____ C:\Windows\system32\PerfStringBackup.INI
2015-12-21 16:18 - 2015-12-21 16:18 - 00000000 ____D C:\Users\E\AppData\Local\Publishers
2015-12-21 16:18 - 2015-12-21 16:18 - 00000000 ____D C:\Users\E\AppData\Local\ActiveSync
2015-12-21 16:16 - 2015-12-21 17:34 - 00000000 __RHD C:\Users\Public\AccountPictures
2015-12-21 16:15 - 2016-01-05 19:41 - 00000000 ____D C:\Users\E\AppData\Local\Packages
2015-12-21 16:15 - 2015-12-24 19:47 - 00000000 ____D C:\Users\E\AppData\Roaming\Adobe
2015-12-21 16:15 - 2015-12-21 16:15 - 00000000 ____D C:\Users\E\AppData\Local\VirtualStore
2015-12-21 16:15 - 2015-12-21 16:15 - 00000000 ____D C:\Users\E\AppData\Local\TileDataLayer
2015-12-21 16:14 - 2016-01-13 17:46 - 00000000 ____D C:\Users\E
2015-12-21 16:14 - 2015-12-21 16:14 - 00000020 ___SH C:\Users\E\ntuser.ini
2015-12-21 16:14 - 2015-12-21 16:14 - 00000000 _SHDL C:\Users\E\My Documents
2015-12-21 16:14 - 2015-12-21 16:14 - 00000000 _SHDL C:\Users\E\Documents\My Videos
2015-12-21 16:14 - 2015-12-21 16:14 - 00000000 _SHDL C:\Users\E\Documents\My Pictures
2015-12-21 16:14 - 2015-12-21 16:14 - 00000000 _SHDL C:\Users\E\Documents\My Music
2015-12-21 16:09 - 2015-12-21 16:09 - 00000000 ____D C:\ProgramData\USOShared
2015-12-21 16:09 - 2015-10-30 02:17 - 02718208 _____ (Microsoft Corporation) C:\Windows\SysWOW64\PrintConfig.dll
 
==================== One Month Modified files and folders ========
 
(If an entry is included in the fixlist, the file/folder will be moved.)
 
2016-01-13 19:05 - 2015-10-30 01:28 - 00000000 ____D C:\Windows
2016-01-13 18:36 - 2015-10-30 02:24 - 00000000 ____D C:\Windows\AppReadiness
2016-01-13 15:23 - 2015-10-30 02:21 - 00000000 ____D C:\Windows\INF
2016-01-12 19:12 - 2015-10-30 02:24 - 00000000 ___HD C:\Program Files\WindowsApps
2016-01-12 18:47 - 2015-10-30 02:11 - 00000000 ____D C:\Windows\CbsTemp
2016-01-11 14:55 - 2015-10-30 02:24 - 00000000 ____D C:\Program Files\Common Files\microsoft shared
2016-01-06 12:15 - 2015-10-30 01:28 - 00262144 ___SH C:\Windows\system32\config\BBI
2016-01-02 20:40 - 2015-10-30 02:26 - 00826872 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerApp.exe
2016-01-02 20:40 - 2015-10-30 02:26 - 00176632 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerCPLApp.cpl
2015-12-26 20:18 - 2015-10-30 02:24 - 00000000 ____D C:\Windows\rescache
2015-12-25 15:29 - 2015-10-30 02:24 - 00000000 ____D C:\Windows\system32\NDF
2015-12-25 13:26 - 2015-10-30 02:24 - 00000000 ____D C:\ProgramData\regid.1991-06.com.microsoft
2015-12-22 03:20 - 2015-10-30 02:24 - 00000000 ____D C:\Windows\appcompat
2015-12-21 19:00 - 2015-10-30 01:28 - 00000000 ____D C:\Windows\system32\Sysprep
2015-12-21 18:57 - 2015-10-30 04:13 - 00000000 ____D C:\Windows\ServiceProfiles
2015-12-21 18:43 - 2015-10-30 02:24 - 00028672 _____ C:\Windows\system32\config\BCD-Template
2015-12-21 17:30 - 2015-10-30 02:24 - 00000000 ___RD C:\Windows\PurchaseDialog
2015-12-21 17:30 - 2015-10-30 02:24 - 00000000 ___RD C:\Windows\ImmersiveControlPanel
2015-12-21 17:30 - 2015-10-30 02:24 - 00000000 ____D C:\Windows\system32\SystemResetPlatform
2015-12-21 17:30 - 2015-10-30 02:24 - 00000000 ____D C:\Windows\system32\oobe
2015-12-21 17:30 - 2015-10-30 02:24 - 00000000 ____D C:\Windows\system32\appraiser
2015-12-21 17:30 - 2015-10-30 02:24 - 00000000 ____D C:\Windows\Provisioning
2015-12-21 17:30 - 2015-10-30 02:24 - 00000000 ____D C:\Windows\bcastdvr
2015-12-21 17:30 - 2015-10-30 01:28 - 00000000 ____D C:\Windows\SysWOW64\Dism
2015-12-21 17:30 - 2015-10-30 01:28 - 00000000 ____D C:\Windows\system32\Dism
2015-12-21 16:38 - 2015-10-30 02:24 - 00000000 ___RD C:\Windows\DevicesFlow
2015-12-21 16:18 - 2015-10-30 02:24 - 00000000 ___RD C:\Windows\PrintDialog
2015-12-21 16:17 - 2015-10-30 02:24 - 00000000 ___RD C:\Windows\MiracastView
2015-12-21 16:09 - 2015-10-30 02:24 - 00000000 ____D C:\Windows\system32\spool
2015-12-21 16:09 - 2015-10-30 02:24 - 00000000 ____D C:\Windows\system32\FxsTmp
2015-12-21 16:09 - 2015-10-30 02:24 - 00000000 ____D C:\ProgramData\USOPrivate
2015-12-21 16:09 - 2015-10-30 01:28 - 00032768 ___SH C:\Windows\system32\config\ELAM
 
==================== Bamital & volsnap =================
 
(There is no automatic fix for files that do not pass verification.)
 
C:\Windows\system32\winlogon.exe => File is digitally signed
C:\Windows\system32\wininit.exe => File is digitally signed
C:\Windows\explorer.exe => File is digitally signed
C:\Windows\SysWOW64\explorer.exe => File is digitally signed
C:\Windows\system32\svchost.exe => File is digitally signed
C:\Windows\SysWOW64\svchost.exe => File is digitally signed
C:\Windows\system32\services.exe => File is digitally signed
C:\Windows\system32\User32.dll => File is digitally signed
C:\Windows\SysWOW64\User32.dll => File is digitally signed
C:\Windows\system32\userinit.exe => File is digitally signed
C:\Windows\SysWOW64\userinit.exe => File is digitally signed
C:\Windows\system32\rpcss.dll => File is digitally signed
C:\Windows\system32\dnsapi.dll => File is digitally signed
C:\Windows\SysWOW64\dnsapi.dll => File is digitally signed
C:\Windows\system32\Drivers\volsnap.sys => File is digitally signed
 
 
LastRegBack: 2016-01-01 06:57
 
==================== End of FRST.txt ============================
 
Addition.txt
--------------------------------------------------------------------------
Additional scan result of Farbar Recovery Scan Tool (x64) Version:10-01-2015 01
Ran by E (2016-01-13 19:13:32)
Running from C:\Users\E\Downloads
Windows 10 Home (X64) (2015-12-21 21:13:00)
Boot Mode: Normal
==========================================================
 
 
==================== Accounts: =============================
 
Administrator (S-1-5-21-482056995-2111253809-2895985789-500 - Administrator - Disabled)
DefaultAccount (S-1-5-21-482056995-2111253809-2895985789-503 - Limited - Disabled)
E (S-1-5-21-482056995-2111253809-2895985789-1001 - Administrator - Enabled) => C:\Users\E
Guest (S-1-5-21-482056995-2111253809-2895985789-501 - Limited - Disabled)
 
==================== Security Center ========================
 
(If an entry is included in the fixlist, it will be removed.)
 
AV: Windows Defender (Enabled - Out of date) {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
AS: Windows Defender (Enabled - Out of date) {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
 
==================== Installed Programs ======================
 
(Only the adware programs with "Hidden" flag could be added to the fixlist to unhide them. The adware programs should be uninstalled manually.)
 
Adobe Acrobat Reader DC (HKLM-x32\...\{AC76BA86-7AD7-1033-7B44-AC0F074E4100}) (Version: 15.010.20056 - Adobe Systems Incorporated)
Arduino (HKLM-x32\...\Arduino) (Version: 1.6.7 - Arduino LLC)
Google Chrome (HKLM-x32\...\Google Chrome) (Version: 47.0.2526.106 - Google Inc.)
Google Drive (HKLM-x32\...\{1C3D2F92-D25E-4D98-B810-3F3B0857BF26}) (Version: 1.26.0707.2863 - Google, Inc.)
Google Update Helper (x32 Version: 1.3.29.1 - Google Inc.) Hidden
Intel® Processor Graphics (HKLM-x32\...\{F0E3AD40-2BBD-4360-9C76-B9AC9A5886EA}) (Version: 10.18.10.4252 - Intel Corporation)
MATLAB R2015b (HKLM\...\Matlab R2015b) (Version: 8.6 - MathWorks)
Microsoft Office Professional Plus 2016 - en-us (HKLM\...\ProPlusRetail - en-us) (Version: 16.0.6366.2036 - Microsoft Corporation)
Microsoft Visual C++ 2005 Redistributable (x64) (HKLM\...\{ad8a2fa1-06e7-4b0d-927d-6e54b3d31028}) (Version: 8.0.61000 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.6161 (HKLM\...\{5FCE6D76-F5DC-37AB-B2B8-22AB8CEDB1D4}) (Version: 9.0.30729.6161 - Microsoft Corporation)
Office 16 Click-to-Run Extensibility Component (x32 Version: 16.0.6326.1010 - Microsoft Corporation) Hidden
Office 16 Click-to-Run Licensing Component (Version: 16.0.6326.1010 - Microsoft Corporation) Hidden
Office 16 Click-to-Run Localization Component (x32 Version: 16.0.6326.1010 - Microsoft Corporation) Hidden
qBittorrent 3.3.1 (HKLM-x32\...\qBittorrent) (Version: 3.3.1 - The qBittorrent project)
Realtek High Definition Audio Driver (HKLM-x32\...\{F132AF7F-7BCA-4EDE-8A7C-958108FE7DBC}) (Version: 6.0.1.7571 - Realtek Semiconductor Corp.)
SDFormatter (HKLM-x32\...\{179324FF-7B16-4BA8-9836-055CAAEE4F08}) (Version: 4.0.0 - SD Association)
Synaptics Pointing Device Driver (HKLM\...\SynTPDeinstKey) (Version: 19.0.19.1 - Synaptics Incorporated)
VLC media player (HKLM\...\VLC media player) (Version: 2.2.1 - VideoLAN)
Win32DiskImager version 0.9.5 (HKLM-x32\...\{D074CE74-912A-4AD3-A0BF-3937D9D01F17}_is1) (Version: 0.9.5 - ImageWriter Developers)
WinRAR 5.20 (64-bit) (HKLM\...\WinRAR archiver) (Version: 5.20.0 - win.rar GmbH)
 
==================== Custom CLSID (Whitelisted): ==========================
 
(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)
 
CustomCLSID: HKU\S-1-5-21-482056995-2111253809-2895985789-1001_Classes\CLSID\{71DCE5D6-4B57-496B-AC21-CD5B54EB93FD}\localserver32 -> C:\Users\E\AppData\Local\Microsoft\OneDrive\17.3.6281.1202\FileCoAuth.exe (Microsoft Corporation)
CustomCLSID: HKU\S-1-5-21-482056995-2111253809-2895985789-1001_Classes\CLSID\{820D63D5-8CFF-46DE-86AF-4997DEDD6DB5}\localserver32 -> C:\Windows\system32\igfxEM.exe (Intel Corporation)
 
==================== Scheduled Tasks (Whitelisted) =============
 
(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)
 
Task: {0CFE2E40-6A97-48C5-9F38-DE82315CF1B0} - System32\Tasks\Microsoft\Windows\UPnP\UPnPHostConfig => config upnphost start= auto
Task: {10A5F935-CC79-4366-BEDD-27EDFF4A8A4B} - System32\Tasks\GoogleUpdateTaskMachineCore => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe [2015-12-21] (Google Inc.)
Task: {20D92A8B-99DD-4879-8FC2-1C62A74B7124} - System32\Tasks\Adobe Acrobat Update Task => C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe [2015-12-13] (Adobe Systems Incorporated)
Task: {29B48E68-F034-4A0B-A587-73EAE0D2C962} - System32\Tasks\Microsoft\Office\Office ClickToRun Service Monitor => C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeC2RClient.exe [2015-12-04] (Microsoft Corporation)
Task: {2AD40207-01F6-4E2E-BB4D-8597DB9FB9E8} - System32\Tasks\KMSAutoNet => C:\ProgramData\KMSAutoS\KMSAuto Net.exe [2015-08-10] (MSFree Inc.)
Task: {40D24C49-3B5D-4DA8-8330-297362AEC994} - System32\Tasks\Microsoft\Office\Office Automatic Updates => C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeC2RClient.exe [2015-12-04] (Microsoft Corporation)
Task: {4B63B343-0DEF-414C-8BF3-8840AAEEA8CC} - System32\Tasks\Microsoft\Windows\RemovalTools\MRT_HB => C:\Windows\system32\MRT.exe [2015-11-23] (Microsoft Corporation)
Task: {4DC4A9B8-8993-404B-B8C7-5E913C8148CA} - System32\Tasks\MATLAB R2015b Startup Accelerator => C:\Program Files\MATLAB\R2015b\bin\win64\MATLABStartupAccelerator.exe [2015-07-30] ()
Task: {5AA32C52-9DEF-41F3-8639-20AEE314574D} - System32\Tasks\GoogleUpdateTaskMachineUA => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe [2015-12-21] (Google Inc.)
Task: {8019185F-60C4-44B5-9B4F-219559FA2CAD} - System32\Tasks\Microsoft\Office\OfficeTelemetryAgentLogOn2016 => C:\Program Files (x86)\Microsoft Office\root\Office16\msoia.exe [2015-12-25] (Microsoft Corporation)
Task: {A14DD87A-72E0-475A-B6AA-C66DA0EBE031} - System32\Tasks\Microsoft\Office\OfficeTelemetryAgentFallBack2016 => C:\Program Files (x86)\Microsoft Office\root\Office16\msoia.exe [2015-12-25] (Microsoft Corporation)
 
(If an entry is included in the fixlist, the task (.job) file will be moved. The file which is running by the task will not be moved.)
 
Task: C:\Windows\Tasks\GoogleUpdateTaskMachineCore.job => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe
Task: C:\Windows\Tasks\GoogleUpdateTaskMachineUA.job => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe
Task: C:\Windows\Tasks\MATLAB R2015b Startup Accelerator.job => C:\Program Files\MATLAB\R2015b\bin\win64\MATLABStartupAccelerator.exe
 
==================== Shortcuts =============================
 
(The entries could be listed to be restored or removed.)
 
==================== Loaded Modules (Whitelisted) ==============
 
2015-10-30 02:18 - 2015-10-30 02:18 - 00185856 _____ () C:\Windows\SYSTEM32\ism32k.dll
2015-12-23 17:34 - 2015-12-04 08:52 - 00162472 _____ () C:\Program Files\Common Files\Microsoft Shared\ClickToRun\ApiClient.dll
2015-12-21 16:49 - 2015-11-22 05:47 - 02653816 _____ () C:\Windows\system32\CoreUIComponents.dll
2015-12-21 18:12 - 2015-12-21 18:13 - 00144384 _____ () C:\Program Files\WindowsApps\Microsoft.Messaging_2.12.15004.0_x86__8wekyb3d8bbwe\SkypeHost.exe
2015-12-07 18:00 - 2015-12-07 18:00 - 15711744 _____ () C:\Program Files (x86)\qBittorrent\qbittorrent.exe
2015-12-21 16:49 - 2015-11-22 05:47 - 02653816 _____ () C:\Windows\System32\CoreUIComponents.dll
2015-12-25 13:02 - 2015-12-25 13:02 - 08903848 _____ () C:\Program Files (x86)\Microsoft Office\root\VFS\ProgramFilesX64\Microsoft Office\Office16\1033\GrooveIntlResource.dll
2015-12-21 16:47 - 2015-12-06 23:14 - 00093696 _____ () C:\Windows\SystemApps\ShellExperienceHost_cw5n1h2txyewy\Windows.UI.Shell.SharedUtilities.dll
2015-12-21 16:48 - 2015-12-06 23:00 - 00472064 _____ () C:\Windows\SystemApps\ShellExperienceHost_cw5n1h2txyewy\QuickActions.dll
2015-12-21 16:48 - 2015-12-06 23:00 - 00674816 _____ () C:\Windows\SystemApps\ShellExperienceHost_cw5n1h2txyewy\MtcUvc.dll
2015-12-21 16:50 - 2015-12-06 22:37 - 07992832 _____ () C:\Windows\SystemApps\Microsoft.Windows.Cortana_cw5n1h2txyewy\CortanaApi.dll
2015-12-21 16:48 - 2015-12-06 22:33 - 00591360 _____ () C:\Windows\SystemApps\Microsoft.Windows.Cortana_cw5n1h2txyewy\Cortana.Core.dll
2015-12-21 16:49 - 2015-12-06 22:34 - 02483200 _____ () C:\Windows\SystemApps\Microsoft.Windows.Cortana_cw5n1h2txyewy\Cortana.BackgroundTask.dll
2015-12-21 16:49 - 2015-12-06 22:36 - 04089856 _____ () C:\Windows\SystemApps\Microsoft.Windows.Cortana_cw5n1h2txyewy\RemindersUI.dll
2015-12-21 18:12 - 2015-12-21 18:13 - 00141312 _____ () C:\Program Files\WindowsApps\Microsoft.Messaging_2.12.15004.0_x86__8wekyb3d8bbwe\SkypeBackgroundTasks.dll
2015-12-21 18:12 - 2015-12-21 18:13 - 21845504 _____ () C:\Program Files\WindowsApps\Microsoft.Messaging_2.12.15004.0_x86__8wekyb3d8bbwe\SkyWrap.dll
2015-12-21 16:43 - 2015-12-10 22:54 - 01583432 _____ () C:\Program Files (x86)\Google\Chrome\Application\47.0.2526.106\libglesv2.dll
2015-12-21 16:43 - 2015-12-10 22:54 - 00081224 _____ () C:\Program Files (x86)\Google\Chrome\Application\47.0.2526.106\libegl.dll
2015-12-25 05:38 - 2015-12-24 12:46 - 16792256 _____ () C:\Users\E\AppData\Local\Google\Chrome\User Data\PepperFlash\20.0.0.267\pepflashplayer.dll
 
==================== Alternate Data Streams (Whitelisted) =========
 
(If an entry is included in the fixlist, only the ADS will be removed.)
 
 
==================== Safe Mode (Whitelisted) ===================
 
(If an entry is included in the fixlist, it will be removed from the registry. The "AlternateShell" will be restored.)
 
 
==================== EXE Association (Whitelisted) ===============
 
(If an entry is included in the fixlist, the registry item will be restored to default or removed.)
 
 
==================== Internet Explorer trusted/restricted ===============
 
(If an entry is included in the fixlist, it will be removed from the registry.)
 
 
==================== Hosts content: ===============================
 
(If needed Hosts: directive could be included in the fixlist to reset Hosts.)
 
2015-10-30 02:24 - 2015-10-30 02:21 - 00000824 ____A C:\Windows\system32\Drivers\etc\hosts
 
 
==================== Other Areas ============================
 
(Currently there is no automatic fix for this section.)
 
HKU\S-1-5-21-482056995-2111253809-2895985789-1001\Control Panel\Desktop\\Wallpaper -> C:\Users\E\Downloads\20141220_124737.jpg
DNS Servers: 192.168.1.1
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System => (ConsentPromptBehaviorAdmin: 0) (ConsentPromptBehaviorUser: 3) (EnableLUA: 1)
Windows Firewall is enabled.
 
==================== MSCONFIG/TASK MANAGER disabled items ==
 
(Currently there is no automatic fix for this section.)
 
 
==================== FirewallRules (Whitelisted) ===============
 
(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)
 
FirewallRules: [vm-monitoring-nb-session] => (Allow) LPort=139
FirewallRules: [{A142ED69-C390-47DE-A300-82C14C9351AC}] => (Allow) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
FirewallRules: [{C9548FBC-9EFE-4B59-86E4-0F9CCC1D8B4A}] => (Allow) C:\Program Files (x86)\qBittorrent\qbittorrent.exe
FirewallRules: [{4C26DC9F-2F40-4B24-BB55-5D854CE89E9B}] => (Allow) C:\Program Files (x86)\qBittorrent\qbittorrent.exe
FirewallRules: [{54298909-48AF-4FAA-BBBA-AAA80E946B9B}] => (Allow) C:\Users\E\AppData\Local\Temp\7zS03AC\hppiw.exe
FirewallRules: [{949CEF70-1C5F-40B8-B3F3-51AE786F2171}] => (Allow) C:\Users\E\AppData\Local\Temp\7zS03AC\hppiw.exe
FirewallRules: [{10488895-04BE-407B-B081-E159E99FD515}] => (Allow) C:\Program Files (x86)\Microsoft Office\root\Office16\Lync.exe
FirewallRules: [{2EFC0C42-E8F5-4A06-93AA-D6BB2DF0994C}] => (Allow) C:\Program Files (x86)\Microsoft Office\root\Office16\UcMapi.exe
FirewallRules: [{40E754C8-EC73-4C91-819E-1250AF2C8C85}] => (Allow) C:\Program Files (x86)\Microsoft Office\root\Office16\outlook.exe
FirewallRules: [{5358FFBD-D8AC-49A3-A22D-B0115EB2D44C}] => (Allow) C:\Program Files (x86)\Microsoft Office\root\Office16\Lync.exe
FirewallRules: [{42AA4970-3C0F-4815-91A5-8796E3A80591}] => (Allow) C:\Program Files (x86)\Microsoft Office\root\Office16\UcMapi.exe
FirewallRules: [TCP Query User{058B796D-10BA-47BB-9D04-FA6E7334D107}C:\program files\matlab\r2015b\bin\win64\matlab.exe] => (Allow) C:\program files\matlab\r2015b\bin\win64\matlab.exe
FirewallRules: [UDP Query User{D3D6E77A-0184-4300-8309-C3B608A2FBA0}C:\program files\matlab\r2015b\bin\win64\matlab.exe] => (Allow) C:\program files\matlab\r2015b\bin\win64\matlab.exe
FirewallRules: [TCP Query User{15E51429-0214-46DA-A2E1-152AC0CB03ED}C:\program files (x86)\arduino\java\bin\javaw.exe] => (Allow) C:\program files (x86)\arduino\java\bin\javaw.exe
FirewallRules: [UDP Query User{1482F95E-5CB1-40AE-952E-ED3829E60E72}C:\program files (x86)\arduino\java\bin\javaw.exe] => (Allow) C:\program files (x86)\arduino\java\bin\javaw.exe
 
==================== Restore Points =========================
 
21-12-2015 16:10:56 Windows Modules Installer
25-12-2015 14:09:36 Installed SDFormatter.
29-12-2015 00:57:40 Windows Modules Installer
01-01-2016 06:58:30 Windows Update
06-01-2016 21:25:09 Windows Update
11-01-2016 14:53:48 Installed Microsoft Visual C++ 2005 Redistributable (x64)
 
==================== Faulty Device Manager Devices =============
 
Name: Synaptics SMBus TouchPad
Description: Synaptics SMBus TouchPad
Class Guid: {4d36e96f-e325-11ce-bfc1-08002be10318}
Manufacturer: Synaptics
Service: i8042prt
Problem: : This device is not present, is not working properly, or does not have all its drivers installed. (Code 24)
Resolution: The device is installed incorrectly. The problem could be a hardware failure, or a new driver might be needed.
Devices stay in this state if they have been prepared for removal.
After you remove the device, this error disappears.Remove the device, and this error should be resolved.
 
Name: PCI Encryption/Decryption Controller
Description: PCI Encryption/Decryption Controller
Class Guid: 
Manufacturer: 
Service: 
Problem: : The drivers for this device are not installed. (Code 28)
Resolution: To install the drivers for this device, click "Update Driver", which starts the Hardware Update wizard.
 
 
==================== Event log errors: =========================
 
Application errors:
==================
Error: (01/13/2016 11:05:01 AM) (Source: Microsoft-Windows-Immersive-Shell) (EventID: 5973) (User: DESKTOP-BT8FLMF)
Description: Activation of app Microsoft.LockApp_cw5n1h2txyewy!WindowsDefaultLockScreen failed with error: -2144927142 See the Microsoft-Windows-TWinUI/Operational log for additional information.
 
Error: (01/12/2016 11:11:08 AM) (Source: Application Error) (EventID: 1000) (User: )
Description: Faulting application name: AccountsControlHost.exe, version: 10.0.10586.0, time stamp: 0x5632d643
Faulting module name: CoreUIComponents.dll, version: 0.0.0.0, time stamp: 0x565185e4
Exception code: 0xc0000005
Fault offset: 0x00000000000780cd
Faulting process id: 0x37108
Faulting application start time: 0xAccountsControlHost.exe0
Faulting application path: AccountsControlHost.exe1
Faulting module path: AccountsControlHost.exe2
Report Id: AccountsControlHost.exe3
Faulting package full name: AccountsControlHost.exe4
Faulting package-relative application ID: AccountsControlHost.exe5
 
Error: (01/12/2016 11:10:28 AM) (Source: Application Error) (EventID: 1000) (User: )
Description: Faulting application name: Explorer.EXE, version: 10.0.10586.0, time stamp: 0x5632d4c0
Faulting module name: DUI70.dll, version: 10.0.10586.0, time stamp: 0x5632d29e
Exception code: 0xc0000005
Fault offset: 0x000000000004e908
Faulting process id: 0x1f8
Faulting application start time: 0xExplorer.EXE0
Faulting application path: Explorer.EXE1
Faulting module path: Explorer.EXE2
Report Id: Explorer.EXE3
Faulting package full name: Explorer.EXE4
Faulting package-relative application ID: Explorer.EXE5
 
Error: (01/11/2016 10:50:12 PM) (Source: Application Error) (EventID: 1000) (User: )
Description: Faulting application name: googledrivesync.exe, version: 1.26.707.2863, time stamp: 0x509418e4
Faulting module name: pyexpat.pyd, version: 0.0.0.0, time stamp: 0x55b99e69
Exception code: 0xc0000005
Fault offset: 0x00011160
Faulting process id: 0x1338
Faulting application start time: 0xgoogledrivesync.exe0
Faulting application path: googledrivesync.exe1
Faulting module path: googledrivesync.exe2
Report Id: googledrivesync.exe3
Faulting package full name: googledrivesync.exe4
Faulting package-relative application ID: googledrivesync.exe5
 
Error: (01/11/2016 03:48:13 PM) (Source: Microsoft-Windows-Immersive-Shell) (EventID: 2484) (User: DESKTOP-BT8FLMF)
Description: Package Microsoft.Windows.Photos_15.1208.10480.0_x64__8wekyb3d8bbwe+App was terminated because it took too long to suspend.
 
Error: (01/11/2016 03:42:38 PM) (Source: Application Error) (EventID: 1000) (User: )
Description: Faulting application name: SystemSettingsBroker.exe, version: 10.0.10586.0, time stamp: 0x5632d7b4
Faulting module name: KERNELBASE.dll, version: 10.0.10586.0, time stamp: 0x5632d1de
Exception code: 0xe06d7363
Fault offset: 0x0000000000071f08
Faulting process id: 0x1a2f8
Faulting application start time: 0xSystemSettingsBroker.exe0
Faulting application path: SystemSettingsBroker.exe1
Faulting module path: SystemSettingsBroker.exe2
Report Id: SystemSettingsBroker.exe3
Faulting package full name: SystemSettingsBroker.exe4
Faulting package-relative application ID: SystemSettingsBroker.exe5
 
Error: (01/11/2016 03:42:35 PM) (Source: Application Error) (EventID: 1000) (User: )
Description: Faulting application name: ShellExperienceHost.exe, version: 10.0.10586.35, time stamp: 0x566505bc
Faulting module name: QuickActions.dll, version: 0.0.0.0, time stamp: 0x56650458
Exception code: 0xc0000005
Fault offset: 0x0000000000001931
Faulting process id: 0xd34
Faulting application start time: 0xShellExperienceHost.exe0
Faulting application path: ShellExperienceHost.exe1
Faulting module path: ShellExperienceHost.exe2
Report Id: ShellExperienceHost.exe3
Faulting package full name: ShellExperienceHost.exe4
Faulting package-relative application ID: ShellExperienceHost.exe5
 
Error: (01/11/2016 02:55:40 PM) (Source: SideBySide) (EventID: 33) (User: )
Description: Activation context generation failed for "Microsoft.VC90.MFC,processorArchitecture="amd64",publicKeyToken="1fc8b3b9a1e18e3b",type="win32",version="9.0.30729.6161"1".
Dependent Assembly Microsoft.VC90.MFC,processorArchitecture="amd64",publicKeyToken="1fc8b3b9a1e18e3b",type="win32",version="9.0.30729.6161" could not be found.
Please use sxstrace.exe for detailed diagnosis.
 
Error: (01/11/2016 02:54:10 PM) (Source: Microsoft-Windows-CAPI2) (EventID: 513) (User: )
Description: Cryptographic Services failed while processing the OnIdentity() call in the System Writer Object.
 
Details:
AddLegacyDriverFiles: Unable to back up image of binary Microsoft Link-Layer Discovery Protocol.
 
System Error:
Access is denied.
.
 
Error: (01/11/2016 02:53:43 PM) (Source: SideBySide) (EventID: 33) (User: )
Description: Activation context generation failed for "Microsoft.VC80.MFC,processorArchitecture="amd64",publicKeyToken="1fc8b3b9a1e18e3b",type="win32",version="8.0.50727.6195"1".
Dependent Assembly Microsoft.VC80.MFC,processorArchitecture="amd64",publicKeyToken="1fc8b3b9a1e18e3b",type="win32",version="8.0.50727.6195" could not be found.
Please use sxstrace.exe for detailed diagnosis.
 
 
System errors:
=============
Error: (01/13/2016 06:08:51 PM) (Source: DCOM) (EventID: 10016) (User: NT AUTHORITY)
Description: application-specificLocalActivation{D63B10C5-BB46-4990-A94F-E40B9D520160}{9CA88EE3-ACB7-47C8-AFC4-AB702511C276}NT AUTHORITYSYSTEMS-1-5-18LocalHost (Using LRPC)UnavailableUnavailable
 
Error: (01/13/2016 03:34:33 PM) (Source: DCOM) (EventID: 10016) (User: NT AUTHORITY)
Description: application-specificLocalActivation{D63B10C5-BB46-4990-A94F-E40B9D520160}{9CA88EE3-ACB7-47C8-AFC4-AB702511C276}NT AUTHORITYSYSTEMS-1-5-18LocalHost (Using LRPC)UnavailableUnavailable
 
Error: (01/13/2016 03:06:45 PM) (Source: DCOM) (EventID: 10016) (User: NT AUTHORITY)
Description: application-specificLocalActivation{D63B10C5-BB46-4990-A94F-E40B9D520160}{9CA88EE3-ACB7-47C8-AFC4-AB702511C276}NT AUTHORITYSYSTEMS-1-5-18LocalHost (Using LRPC)UnavailableUnavailable
 
Error: (01/13/2016 11:16:27 AM) (Source: DCOM) (EventID: 10016) (User: NT AUTHORITY)
Description: application-specificLocalActivation{D63B10C5-BB46-4990-A94F-E40B9D520160}{9CA88EE3-ACB7-47C8-AFC4-AB702511C276}NT AUTHORITYSYSTEMS-1-5-18LocalHost (Using LRPC)UnavailableUnavailable
 
Error: (01/12/2016 10:34:15 PM) (Source: DCOM) (EventID: 10016) (User: NT AUTHORITY)
Description: application-specificLocalActivation{D63B10C5-BB46-4990-A94F-E40B9D520160}{9CA88EE3-ACB7-47C8-AFC4-AB702511C276}NT AUTHORITYSYSTEMS-1-5-18LocalHost (Using LRPC)UnavailableUnavailable
 
Error: (01/12/2016 05:13:02 PM) (Source: DCOM) (EventID: 10016) (User: NT AUTHORITY)
Description: application-specificLocalActivation{D63B10C5-BB46-4990-A94F-E40B9D520160}{9CA88EE3-ACB7-47C8-AFC4-AB702511C276}NT AUTHORITYSYSTEMS-1-5-18LocalHost (Using LRPC)UnavailableUnavailable
 
Error: (01/12/2016 12:17:15 PM) (Source: DCOM) (EventID: 10016) (User: NT AUTHORITY)
Description: application-specificLocalActivation{D63B10C5-BB46-4990-A94F-E40B9D520160}{9CA88EE3-ACB7-47C8-AFC4-AB702511C276}NT AUTHORITYSYSTEMS-1-5-18LocalHost (Using LRPC)UnavailableUnavailable
 
Error: (01/12/2016 11:14:41 AM) (Source: DCOM) (EventID: 10016) (User: NT AUTHORITY)
Description: application-specificLocalActivation{D63B10C5-BB46-4990-A94F-E40B9D520160}{9CA88EE3-ACB7-47C8-AFC4-AB702511C276}NT AUTHORITYSYSTEMS-1-5-18LocalHost (Using LRPC)UnavailableUnavailable
 
Error: (01/12/2016 07:58:07 AM) (Source: DCOM) (EventID: 10016) (User: NT AUTHORITY)
Description: application-specificLocalActivation{D63B10C5-BB46-4990-A94F-E40B9D520160}{9CA88EE3-ACB7-47C8-AFC4-AB702511C276}NT AUTHORITYSYSTEMS-1-5-18LocalHost (Using LRPC)UnavailableUnavailable
 
Error: (01/11/2016 11:02:06 PM) (Source: DCOM) (EventID: 10016) (User: NT AUTHORITY)
Description: application-specificLocalActivation{D63B10C5-BB46-4990-A94F-E40B9D520160}{9CA88EE3-ACB7-47C8-AFC4-AB702511C276}NT AUTHORITYSYSTEMS-1-5-18LocalHost (Using LRPC)UnavailableUnavailable
 
 
CodeIntegrity:
===================================
  Date: 2016-01-11 15:40:51.266
  Description: Code Integrity is unable to verify the image integrity of the file \Device\HarddiskVolume3\Windows\System32\efswrt.dll because the set of per-page image hashes could not be found on the system.
 
  Date: 2016-01-06 22:48:15.924
  Description: Code Integrity is unable to verify the image integrity of the file \Device\HarddiskVolume3\Windows\System32\efswrt.dll because the set of per-page image hashes could not be found on the system.
 
  Date: 2016-01-02 04:43:08.653
  Description: Code Integrity is unable to verify the image integrity of the file \Device\HarddiskVolume3\Windows\System32\efswrt.dll because the set of per-page image hashes could not be found on the system.
 
  Date: 2015-12-29 01:26:00.856
  Description: Code Integrity is unable to verify the image integrity of the file \Device\HarddiskVolume3\Windows\System32\efswrt.dll because the set of per-page image hashes could not be found on the system.
 
  Date: 2015-12-26 04:52:47.796
  Description: Code Integrity is unable to verify the image integrity of the file \Device\HarddiskVolume3\Windows\System32\efswrt.dll because the set of per-page image hashes could not be found on the system.
 
  Date: 2015-12-25 13:24:29.422
  Description: Code Integrity is unable to verify the image integrity of the file \Device\HarddiskVolume3\Windows\System32\efswrt.dll because the set of per-page image hashes could not be found on the system.
 
  Date: 2015-12-24 18:58:05.115
  Description: Code Integrity is unable to verify the image integrity of the file \Device\HarddiskVolume3\Windows\System32\efswrt.dll because the set of per-page image hashes could not be found on the system.
 
  Date: 2015-12-24 18:55:22.851
  Description: Code Integrity is unable to verify the image integrity of the file \Device\HarddiskVolume3\Windows\System32\efswrt.dll because the set of per-page image hashes could not be found on the system.
 
  Date: 2015-12-23 17:51:48.565
  Description: Code Integrity is unable to verify the image integrity of the file \Device\HarddiskVolume3\Windows\System32\efswrt.dll because the set of per-page image hashes could not be found on the system.
 
  Date: 2015-12-21 17:33:50.150
  Description: Code Integrity is unable to verify the image integrity of the file \Device\HarddiskVolume3\Windows\System32\efswrt.dll because the set of per-page image hashes could not be found on the system.
 
 
==================== Memory info =========================== 
 
Processor: Intel® Celeron® CPU N2840 @ 2.16GHz
Percentage of memory in use: 88%
Total physical RAM: 3991.36 MB
Available physical RAM: 460.18 MB
Total Virtual: 5689.7 MB
Available Virtual: 1263.11 MB
 
==================== Drives ================================
 
Drive c: () (Fixed) (Total:566.41 GB) (Free:497.67 GB) NTFS
 
==================== MBR & Partition Table ==================
 
========================================================
Disk: 0 (Size: 596.2 GB) (Disk ID: 9EDC240C)
Partition 1: (Active) - (Size=500 MB) - (Type=07 NTFS)
Partition 2: (Not Active) - (Size=29.3 GB) - (Type=83)
Partition 3: (Not Active) - (Size=566.4 GB) - (Type=07 NTFS)
 
==================== End of Addition.txt ============================
 

Attached Files



BC AdBot (Login to Remove)

 


#2 nasdaq

nasdaq

  • Malware Response Team
  • 38,950 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:Montreal, QC. Canada
  • Local time:04:14 AM

Posted 15 January 2016 - 02:17 PM

Hello, Welcome to BleepingComputer.
I'm nasdaq and will be helping you.

If you can please print this topic it will make it easier for you to follow the instructions and complete all of the necessary steps in the order listed.
===

Is the Firefox Extension the problem?

CHR Extension: (craigslist pop for power users) - C:\Users\E\AppData\Local\Google\Chrome\User Data\Default\Extensions\aikbdokcmcbbeaadpdbhlcdcgghdkhja [2015-12-22]
https://chrome.google.com/webstore/detail/craigslist-pop-for-power/aikbdokcmcbbeaadpdbhlcdcgghdkhja/reviews?hl=en

If you wish to remove it then add these lines in bold to the Code box before saving the Fixllist.txt file.
CHR Extension: (craigslist pop for power users) - C:\Users\E\AppData\Local\Google\Chrome\User Data\Default\Extensions\aikbdokcmcbbeaadpdbhlcdcgghdkhja
C:\Users\E\AppData\Local\Google\Chrome\User Data\Default\Extensions\aikbdokcmcbbeaadpdbhlcdcgghdkhja


You can disable the Extension in Chrome. Use it when you want.
===


Press the windows key Windows_Logo_key.gif+ r on your keyboard at the same time. This will open the RUN BOX.
Type Notepad and and click the OK key.
Please copy the entire contents of the code box below to the a new file.
 
start

CreateRestorePoint:
EmptyTemp:
CloseProcesses:

R2 HPSLPSVC; C:\Users\E\AppData\Local\Temp\7zS03AC\hpslpsvc64.dll [1039360 2015-09-21] (Hewlett-Packard Co.) [File not signed]

End
Save the file as fixlist.txt in the same folder where the Farbar tool is running from.
The location is listed in the 3rd line of the Farbar log you have submitted.

Run FRST and click Fix only once and wait.

Restart the computer normally to reset the registry.

The tool will create a log (Fixlog.txt) please post it to your reply.
===

Please download AdwCleaner by Xplode onto your Desktop.
  • Close all open programs and internet browsers.
  • Double click on AdwCleaner.exe to run the tool.
  • Click the Scan button and wait for the process to complete.
  • Click the LogFile button and the report will open in Notepad.
IMPORTANT
  • If you click the Clean button all items listed in the report will be removed.
If you find some false positive items or programs that you wish to keep, Close the AdwCleaner windows.
  • Close all open programs and internet browsers.
  • Double click on AdwCleaner.exe to run the tool.
  • Click the Scan button and wait for the process to complete.
  • Check off the element(s) you wish to keep.
  • Click on the Clean button follow the prompts.
  • A log file will automatically open after the scan has finished.
  • Please post the content of that log file with your next answer.
  • You can find the log file at C:\AdwCleanerCx.txt (x is a number).
===

Please let me know if the problem persists.

Edited by nasdaq, 15 January 2016 - 02:17 PM.


#3 nasdaq

nasdaq

  • Malware Response Team
  • 38,950 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:Montreal, QC. Canada
  • Local time:04:14 AM

Posted 20 January 2016 - 09:31 AM

Due to the lack of feedback, this topic is now closed.

In the event you still have problems, please send me or any Moderator a Private Message and ask them to reopen this topic within the next 5 days.

Please include a link to your topic in the Private Message. Thank you.

#4 harrod

harrod
  • Topic Starter

  • Members
  • 2 posts
  • OFFLINE
  •  
  • Local time:03:14 AM

Posted 20 January 2016 - 06:51 PM

Hello,

 

thank you nasdaq for your help. I have tried your recommendation, but it seems to have not fixed the problem. I am posting the adwcleaner txt below. 

 

 

# AdwCleaner v5.030 - Logfile created 20/01/2016 at 18:10:06
# Updated 17/01/2016 by Xplode
# Database : 2016-01-19.2 [Server]
# Operating system : Windows 10 Home  (x64)
# Username : E - DESKTOP-BT8FLMF
# Running from : C:\Users\E\Downloads\adwcleaner_5.030.exe
# Option : Cleaning
 
***** [ Services ] *****
 
 
***** [ Folders ] *****
 
 
***** [ Files ] *****
 
 
***** [ DLLs ] *****
 
 
***** [ Shortcuts ] *****
 
 
***** [ Scheduled tasks ] *****
 
 
***** [ Registry ] *****
 
 
***** [ Web browsers ] *****
 
[-] [C:\Users\E\AppData\Local\Google\Chrome\User Data\Default\Web Data] [Search Provider] Deleted : aol.com
[-] [C:\Users\E\AppData\Local\Google\Chrome\User Data\Default\Web Data] [Search Provider] Deleted : ask.com
[-] [C:\Users\E\AppData\Local\Google\Chrome\User Data\Default\Web Data] [Search Provider] Deleted : websearch.ask.com
 
*************************
 
:: "Tracing" keys removed
:: Winsock settings cleared
 
########## EOF - C:\AdwCleaner\AdwCleaner[C1].txt - [997 bytes] ##########


#5 nasdaq

nasdaq

  • Malware Response Team
  • 38,950 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:Montreal, QC. Canada
  • Local time:04:14 AM

Posted 21 January 2016 - 10:05 AM

Reset the browsers that have been compromised.

Reset Chrome...
Open Google Chrome, click on menu icon google-chrome-setting-icon.png which is located right side top of the google chrome.
 
Click "Settings" then "Show advanced settings" at the bottom of the screen.
 
Click "Reset browser settings" button.
 
Clear your cache and cookies
https://support.google.com/chromebook/answer/183083?hl=en
Select "From the beginning of time"

Restart Chrome.

How is it now?

#6 nasdaq

nasdaq

  • Malware Response Team
  • 38,950 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:Montreal, QC. Canada
  • Local time:04:14 AM

Posted 27 January 2016 - 09:30 AM

If all is well.

To learn more about how to protect yourself while on the internet read this little guide best security practices keep safe.
http://www.bleepingcomputer.com/forums/t/407147/answers-to-common-security-questions-best-practices/
===

#7 nasdaq

nasdaq

  • Malware Response Team
  • 38,950 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:Montreal, QC. Canada
  • Local time:04:14 AM

Posted 02 February 2016 - 10:30 AM

It appears that this issue is resolved, therefore I am closing the topic. If that is not the case and you need or wish to continue with this topic, please send me or any Moderator a Personal Message (PM) that you would like this topic re-opened.




0 user(s) are reading this topic

0 members, 0 guests, 0 anonymous users