Jump to content


 


Register a free account to unlock additional features at BleepingComputer.com
Welcome to BleepingComputer, a free community where people like yourself come together to discuss and learn how to use their computers. Using the site is easy and fun. As a guest, you can browse and view the various discussions in the forums, but can not create a new topic or reply to an existing one unless you are logged in. Other benefits of registering an account are subscribing to topics and forums, creating a blog, and having no ads shown anywhere on the site.


Click here to Register a free account now! or read our Welcome Guide to learn how to use this site.

Photo

Chrome popups, redirects.


  • This topic is locked This topic is locked
2 replies to this topic

#1 Spirit02

Spirit02

  • Members
  • 1 posts
  • OFFLINE
  •  
  • Local time:02:41 AM

Posted 24 March 2016 - 02:48 PM

My brother thought he needed codecs to play a video in VLC. He downloaded something - I'm not sure what.

Said he installed it, and was sure to untick all the 'optional extras'.

 

There were 6 or 8 new items in Programs and Features, some of them having copied the names of legitimate items already installed on the PC.

I uninstalled them all.

 

Followed various malware removal guides - I have disabled DaemonTools, and run TDSSKiller, rkill, RogueKiller, MBAM, AdwCleaner, HitmanPro, JRT, Zemana AntiMalware, MGTools, CrapCleaner, HijackThis (to see if I could see anything obviously wrong), and perhaps ill-advisedly, ComboFix. 

 

There was a proxy set in IE's network settings which I removed.

 

MBAM picks up a bunch of things in Chrome's Local Storage folder. The following get recreated every time Chrome is run:

 

https_api.getmyprimarycolor.com_0

https_clients5.google.com_0

https_hdapp1008-a.akamaihd.net_0

https_plus.google.com_0

https_pstatic.bestpriceninja.com_0

https_static.cmptch.com_0

https_static.re-markit00.re-markit.co_0

https_www.donation-tools.org_0

https_www.google.com.au_0

 

After deleting said items and restarting Chrome, it starts fine on the New Tab page, then "Search Google" becomes double-underlined in green, and 7 popups to yxo.warmportrait.com are blocked.

Attempting to download things typically succeeds on the third attempt, with the first two redirected somewhere else. Not all popups are blocked by Chrome.

 

I'm using TeamViewer to diagnose the PC.

 

Please help.

 

 

 

Scan result of Farbar Recovery Scan Tool (FRST) (x64) Version:05-03-2016 01
Ran by Chaser TW (administrator) on ENIGMA (25-03-2016 04:23:39)
Running from D:\My Documents\Downloads
Loaded Profiles: Chaser TW (Available Profiles: Chaser TW)
Platform: Windows 7 Ultimate Service Pack 1 (X64) Language: English (United States)
Internet Explorer Version 11 (Default browser: Chrome)
Boot Mode: Normal
 
==================== Processes (Whitelisted) =================
 
(If an entry is included in the fixlist, the process will be closed. The file will not be moved.)
 
(AMD) C:\Windows\System32\atiesrxx.exe
(Intel Corporation) C:\Windows\System32\igfxCUIService.exe
(AMD) C:\Windows\System32\atieclxx.exe
(Seiko Epson Corporation) C:\Windows\System32\escsvc64.exe
() C:\Windows\SysWOW64\PnkBstrA.exe
(TeamViewer GmbH) C:\Program Files (x86)\TeamViewer\TeamViewer_Service.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Intel® Rapid Storage Technology\IAStorDataMgrSvc.exe
(Microsoft Corporation) C:\Windows\Microsoft.NET\Framework64\v3.0\WPF\PresentationFontCache.exe
(Intel Corporation) C:\Windows\System32\igfxEM.exe
(Intel Corporation) C:\Windows\System32\igfxHK.exe
(Intel Corporation) C:\Windows\System32\igfxTray.exe
() C:\Windows\SysWOW64\HsMgr.exe
() C:\Windows\system\HsMgr64.exe
(Logitech Inc.) C:\Program Files\Logitech Gaming Software\LCore.exe
(SEIKO EPSON CORPORATION) C:\Windows\System32\spool\drivers\x64\3\E_YATIKDE.EXE
(Intel Corporation) C:\Program Files (x86)\Intel\Intel® USB 3.0 eXtensible Host Controller Driver\Application\iusb3mon.exe
(Advanced Micro Devices Inc.) C:\Program Files (x86)\AMD\ATI.ACE\Core-Static\MOM.exe
(SEIKO EPSON CORPORATION) C:\Program Files (x86)\Epson Software\Event Manager\EEventManager.exe
(Advanced Micro Devices Inc.) C:\Program Files (x86)\AMD\ATI.ACE\Core-Static\CCC.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Intel® Rapid Storage Technology\IAStorIcon.exe
(TeamViewer GmbH) C:\Program Files (x86)\TeamViewer\TeamViewer.exe
(TeamViewer GmbH) C:\Program Files (x86)\TeamViewer\tv_w32.exe
(TeamViewer GmbH) C:\Program Files (x86)\TeamViewer\tv_x64.exe
(TeamViewer GmbH) C:\Program Files (x86)\TeamViewer\TeamViewer_Desktop.exe
(Microsoft Corporation) C:\Windows\System32\GWX\GWX.exe
(Microsoft Corporation) C:\Windows\System32\msiexec.exe
(Microsoft Corporation) C:\Program Files\Microsoft Security Client\MsMpEng.exe
(Microsoft Corporation) C:\Program Files\Microsoft Security Client\NisSrv.exe
(Microsoft Corporation) C:\Program Files\Microsoft Security Client\msseces.exe
(Microsoft Corporation) C:\Program Files\Internet Explorer\iexplore.exe
 
 
==================== Registry (Whitelisted) ===========================
 
(If an entry is included in the fixlist, the registry item will be restored to default or removed. The file will not be moved.)
 
HKLM\...\Run: [Cmaudio8788] => C:\Windows\syswow64\RunDll32.exe C:\Windows\Syswow64\cmicnfgp.dll,CMICtrlWnd
HKLM\...\Run: [Cmaudio8788GX] => C:\Windows\syswow64\HsMgr.exe [200704 2008-07-12] ()
HKLM\...\Run: [Cmaudio8788GX64] => C:\Windows\system\HsMgr64.exe [282112 2008-07-12] ()
HKLM\...\Run: [Launch LCore] => C:\Program Files\Logitech Gaming Software\LCore.exe [14601160 2015-07-02] (Logitech Inc.)
HKLM\...\Run: [AdobeAAMUpdater-1.0] => C:\Program Files (x86)\Common Files\Adobe\OOBE\PDApp\UWA\UpdaterStartupUtility.exe [446392 2012-04-04] (Adobe Systems Incorporated)
HKLM\...\Run: [MSC] => C:\Program Files\Microsoft Security Client\msseces.exe [1340192 2016-01-29] (Microsoft Corporation)
HKLM-x32\...\Run: [IAStorIcon] => C:\Program Files (x86)\Intel\Intel® Rapid Storage Technology\IAStorIcon.exe [284440 2012-02-01] (Intel Corporation)
HKLM-x32\...\Run: [StartCCC] => C:\Program Files (x86)\AMD\ATI.ACE\Core-Static\amd64\CLIStart.exe [767176 2015-06-22] (Advanced Micro Devices, Inc.)
HKLM-x32\...\Run: [USB3MON] => C:\Program Files (x86)\Intel\Intel® USB 3.0 eXtensible Host Controller Driver\Application\iusb3mon.exe [291648 2012-05-21] (Intel Corporation)
HKLM-x32\...\Run: [SwitchBoard] => C:\Program Files (x86)\Common Files\Adobe\SwitchBoard\SwitchBoard.exe [517096 2010-02-19] (Adobe Systems Incorporated)
HKLM-x32\...\Run: [AdobeCS6ServiceManager] => C:\Program Files (x86)\Common Files\Adobe\CS6ServiceManager\CS6ServiceManager.exe [1073312 2012-03-09] (Adobe Systems Incorporated)
HKLM-x32\...\Run: [EEventManager] => C:\Program Files (x86)\Epson Software\Event Manager\EEventManager.exe [1065968 2015-07-23] (SEIKO EPSON CORPORATION)
HKU\S-1-5-21-4272222158-3063515441-3191840995-1000\...\Run: [GarminExpressTrayApp] => C:\Program Files (x86)\Garmin\Express Tray\ExpressTray.exe [1403304 2016-01-28] (Garmin Ltd. or its subsidiaries)
HKU\S-1-5-21-4272222158-3063515441-3191840995-1000\...\Run: [BingSvc] => C:\Users\Chaser TW\AppData\Local\Microsoft\BingSvc\BingSvc.exe
HKU\S-1-5-21-4272222158-3063515441-3191840995-1000\...\Run: [EPLTarget\P0000000000000001] => C:\Windows\system32\spool\DRIVERS\x64\3\E_YATIKDE.EXE [298560 2013-09-12] (SEIKO EPSON CORPORATION)
CHR HKLM\SOFTWARE\Policies\Google: Restriction <======= ATTENTION
 
==================== Internet (Whitelisted) ====================
 
(If an item is included in the fixlist, if it is a registry item it will be removed or restored to default.)
 
Tcpip\Parameters: [DhcpNameServer] 10.0.0.138
Tcpip\..\Interfaces\{8F573A6B-38C9-4C35-A2FA-CDF0CFC67F4F}: [DhcpNameServer] 10.0.0.138
 
Internet Explorer:
==================
HKLM\SOFTWARE\Policies\Microsoft\Internet Explorer: Restriction <======= ATTENTION
HKU\S-1-5-21-4272222158-3063515441-3191840995-1000\SOFTWARE\Policies\Microsoft\Internet Explorer: Restriction <======= ATTENTION
HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Search Page = www.google.com
HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Default_Search_URL = www.google.com
HKU\.DEFAULT\Software\Microsoft\Internet Explorer\Main,Search Page = hxxp://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch
HKU\.DEFAULT\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://www.microsoft.com/isapi/redir.dll?prd=ie&ar=msnhome
HKU\S-1-5-21-4272222158-3063515441-3191840995-1000\Software\Microsoft\Internet Explorer\Main,Search Page = hxxp://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch
HKU\S-1-5-21-4272222158-3063515441-3191840995-1000\Software\Microsoft\Internet Explorer\Main,Start Page = hxxps://www.google.com/
SearchScopes: HKU\S-1-5-21-4272222158-3063515441-3191840995-1000 -> DefaultScope {801A1D4E-3F52-475A-92AD-F375F05119B1} URL = hxxps://www.google.com/search?q={searchTerms}&sourceid=ie7&rls=com.microsoft:{language}:{referrer:source}&ie={inputEncoding?}&oe={outputEncoding?}
SearchScopes: HKU\S-1-5-21-4272222158-3063515441-3191840995-1000 -> {801A1D4E-3F52-475A-92AD-F375F05119B1} URL = hxxps://www.google.com/search?q={searchTerms}&sourceid=ie7&rls=com.microsoft:{language}:{referrer:source}&ie={inputEncoding?}&oe={outputEncoding?}
 
FireFox:
========
FF Plugin: @microsoft.com/GENUINE -> disabled [No File]
FF Plugin-x32: @microsoft.com/GENUINE -> disabled [No File]
FF Plugin-x32: @tools.google.com/Google Update;version=3 -> C:\Program Files (x86)\Google\Update\1.3.29.5\npGoogleUpdate3.dll [2016-02-03] (Google Inc.)
FF Plugin-x32: @tools.google.com/Google Update;version=9 -> C:\Program Files (x86)\Google\Update\1.3.29.5\npGoogleUpdate3.dll [2016-02-03] (Google Inc.)
FF Plugin-x32: Adobe Reader -> C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AIR\nppdf32.dll [2015-12-19] (Adobe Systems Inc.)
FF Plugin HKU\S-1-5-21-4272222158-3063515441-3191840995-1000: ubisoft.com/uplaypc -> C:\Program Files (x86)\Ubisoft\Ubisoft Game Launcher\npuplaypc.dll [2016-01-14] ()
 
Chrome: 
=======
CHR DefaultSearchURL: Default -> hxxp://www-searching.com/search.aspx?s=G3Jzgutbl343BA,919cc3da-5636-4318-8ef4-7bf66a5013f8,&prd=smw&q={searchTerms}
CHR DefaultSearchKeyword: Default -> www-searching.com
CHR DefaultSuggestURL: Default -> hxxp://api.searchpredict.com/api/?rqtype=ffplugin&siteID=8661&dbCode=1&command={searchTerms}
CHR Profile: C:\Users\Chaser TW\AppData\Local\Google\Chrome\User Data\Default
CHR Extension: (Google Drive) - C:\Users\Chaser TW\AppData\Local\Google\Chrome\User Data\Default\Extensions\apdfllckaahabafndbhieahigkjlhalf [2015-10-22]
CHR Extension: (YouTube) - C:\Users\Chaser TW\AppData\Local\Google\Chrome\User Data\Default\Extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo [2015-09-27]
CHR Extension: (uBlock Origin) - C:\Users\Chaser TW\AppData\Local\Google\Chrome\User Data\Default\Extensions\cjpalhdlnbpafiamejdnhcphjbkeiagm [2016-03-24]
CHR Extension: (Google Search) - C:\Users\Chaser TW\AppData\Local\Google\Chrome\User Data\Default\Extensions\coobgpohoikkiipiblmjeljniedjpjpf [2015-10-29]
CHR Extension: (Chrome Web Store Payments) - C:\Users\Chaser TW\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda [2015-07-25]
CHR Extension: (Gmail) - C:\Users\Chaser TW\AppData\Local\Google\Chrome\User Data\Default\Extensions\pjkljhegncpnkpknbcohdijeoejaedia [2015-07-13]
 
==================== Services (Whitelisted) ========================
 
(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)
 
R2 EpsonScanSvc; C:\Windows\system32\EscSvc64.exe [144560 2012-05-17] (Seiko Epson Corporation)
S2 Garmin Device Interaction Service; C:\Program Files (x86)\Garmin\Device Interaction Service\GarminService.exe [803856 2016-01-28] (Garmin Ltd. or its subsidiaries)
R2 igfxCUIService1.0.0.0; C:\Windows\system32\igfxCUIService.exe [330136 2015-08-27] (Intel Corporation)
R2 MsMpSvc; C:\Program Files\Microsoft Security Client\MsMpEng.exe [23808 2016-01-29] (Microsoft Corporation)
R3 NisSrv; C:\Program Files\Microsoft Security Client\NisSrv.exe [374344 2016-01-29] (Microsoft Corporation)
R2 PnkBstrA; C:\Windows\SysWOW64\PnkBstrA.exe [76888 2015-10-14] ()
S3 SwitchBoard; C:\Program Files (x86)\Common Files\Adobe\SwitchBoard\SwitchBoard.exe [517096 2010-02-19] (Adobe Systems Incorporated) [File not signed]
R2 TeamViewer; C:\Program Files (x86)\TeamViewer\TeamViewer_Service.exe [6942480 2016-03-03] (TeamViewer GmbH)
S3 WinDefend; C:\Program Files\Windows Defender\mpsvc.dll [1011712 2013-05-27] (Microsoft Corporation)
S2 ZAMSvc; "C:\Program Files (x86)\Zemana AntiMalware\ZAM.exe" /service [X]
 
===================== Drivers (Whitelisted) ==========================
 
(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)
 
R3 cmudaxp; C:\Windows\System32\drivers\cmudaxp.sys [1267200 2010-10-28] (C-Media Inc)
S3 ebdrv; C:\Windows\system32\DRIVERS\evbda.sys [3286016 2009-06-11] (Broadcom Corporation)
R2 LGCoreTemp; C:\Program Files\Logitech Gaming Software\Drivers\LgCoreTemp\lgcoretemp.sys [14184 2015-06-22] (Logitech)
R3 LGJoyXlCore; C:\Windows\System32\drivers\LGJoyXlCore.sys [68384 2015-06-11] (Logitech Inc.)
R3 LGSHidFilt; C:\Windows\System32\DRIVERS\LGSHidFilt.Sys [64280 2013-05-31] (Logitech Inc.)
R0 MpFilter; C:\Windows\System32\DRIVERS\MpFilter.sys [289120 2015-11-13] (Microsoft Corporation)
R3 NisDrv; C:\Windows\System32\DRIVERS\NisDrvWFP.sys [133816 2015-11-13] (Microsoft Corporation)
R0 sptd; C:\Windows\System32\Drivers\sptd.sys [560184 2015-07-13] (Duplex Secure Ltd.)
U3 TrueSight; C:\Windows\System32\drivers\TrueSight.sys [24688 2016-03-23] ()
S3 catchme; \??\C:\ComboFix\catchme.sys [X]
S0 hitmanpro37duringboot; system32\drivers\hitmanpro37.sys [X]
S3 Synth3dVsc; System32\drivers\synth3dvsc.sys [X]
S3 tsusbhub; system32\drivers\tsusbhub.sys [X]
S3 VGPU; System32\drivers\rdvgkmd.sys [X]
S1 ZAM; \??\C:\Windows\System32\drivers\zam64.sys [X]
S1 ZAM_Guard; \??\C:\Windows\System32\drivers\zamguard64.sys [X]
 
==================== NetSvcs (Whitelisted) ===================
 
(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)
 
 
==================== One Month Created files and folders ========
 
(If an entry is included in the fixlist, the file/folder will be moved.)
 
2016-03-25 04:23 - 2016-03-25 04:23 - 00000000 ____D C:\FRST
2016-03-24 12:04 - 2016-03-25 04:20 - 00002117 _____ C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Microsoft Security Essentials.lnk
2016-03-24 12:04 - 2016-03-25 04:20 - 00000000 ____D C:\Program Files\Microsoft Security Client
2016-03-24 12:04 - 2016-03-25 04:20 - 00000000 ____D C:\Program Files (x86)\Microsoft Security Client
2016-03-24 10:23 - 2016-03-24 11:11 - 00000000 __SHD C:\Users\Chaser TW\IntelGraphicsProfiles
2016-03-24 10:21 - 2016-03-24 10:21 - 00000000 ____D C:\Intel
2016-03-23 20:06 - 2016-03-23 20:09 - 00377553 _____ C:\MGlogs.zip
2016-03-23 20:06 - 2016-03-23 20:09 - 00000000 ____D C:\MGtools
2016-03-23 20:06 - 2016-03-23 20:06 - 00000000 ____D C:\Users\Chaser TW\AppData\Local\CrashDumps
2016-03-23 19:48 - 2016-03-23 19:50 - 00202884 _____ C:\TDSSKiller.3.1.0.9_23.03.2016_19.48.04_log.txt
2016-03-23 19:31 - 2016-03-23 19:31 - 00024688 _____ C:\Windows\system32\Drivers\TrueSight.sys
2016-03-23 10:00 - 2016-03-23 10:00 - 01993486 _____ C:\MGtools.exe
2016-03-23 09:01 - 2016-03-23 09:01 - 00000000 ____D C:\Users\Chaser TW\AppData\Local\TeamViewer
2016-03-23 08:58 - 2016-03-24 11:11 - 00000000 ____D C:\Program Files (x86)\TeamViewer
2016-03-23 08:58 - 2016-03-24 10:22 - 00000000 ____D C:\Users\Chaser TW\AppData\Roaming\TeamViewer
2016-03-23 08:58 - 2016-03-23 08:58 - 00001047 _____ C:\ProgramData\Microsoft\Windows\Start Menu\Programs\TeamViewer 11.lnk
2016-03-23 00:49 - 2016-03-23 00:49 - 00019050 _____ C:\ComboFix.txt
2016-03-23 00:44 - 2016-03-23 00:49 - 00000000 ____D C:\Qoobox
2016-03-23 00:44 - 2016-03-23 00:48 - 00000000 ____D C:\Windows\erdnt
2016-03-23 00:44 - 2011-06-26 16:45 - 00256000 _____ C:\Windows\PEV.exe
2016-03-23 00:44 - 2010-11-08 03:20 - 00208896 _____ C:\Windows\MBR.exe
2016-03-23 00:44 - 2009-04-20 14:56 - 00060416 _____ (NirSoft) C:\Windows\NIRCMD.exe
2016-03-23 00:44 - 2000-08-31 10:00 - 00518144 _____ (SteelWerX) C:\Windows\SWREG.exe
2016-03-23 00:44 - 2000-08-31 10:00 - 00406528 _____ (SteelWerX) C:\Windows\SWSC.exe
2016-03-23 00:44 - 2000-08-31 10:00 - 00098816 _____ C:\Windows\sed.exe
2016-03-23 00:44 - 2000-08-31 10:00 - 00080412 _____ C:\Windows\grep.exe
2016-03-23 00:44 - 2000-08-31 10:00 - 00068096 _____ C:\Windows\zip.exe
2016-03-20 14:23 - 2016-03-20 14:33 - 00000000 ____D C:\EEK
2016-03-20 13:48 - 2016-03-23 09:28 - 00000000 ____D C:\Program Files (x86)\Zemana AntiMalware
2016-03-20 13:48 - 2016-03-23 09:24 - 00032075 _____ C:\Windows\ZAM.krnl.trace
2016-03-20 13:48 - 2016-03-23 09:24 - 00001597 _____ C:\Windows\ZAM_Guard.krnl.trace
2016-03-20 13:47 - 2016-03-20 13:47 - 00000000 ____D C:\Users\Chaser TW\AppData\Local\Zemana
2016-03-20 13:43 - 2016-03-20 13:43 - 00008454 _____ C:\Windows\system32\.crusader
2016-03-20 13:20 - 2016-03-20 13:21 - 00004948 _____ C:\TDSSKiller.3.1.0.9_20.03.2016_13.20.38_log.txt
2016-03-20 13:18 - 2016-03-20 13:18 - 00000000 ____D C:\TDSSKiller_Quarantine
2016-03-20 13:15 - 2016-03-20 13:20 - 00209300 _____ C:\TDSSKiller.3.1.0.9_20.03.2016_13.15.42_log.txt
2016-03-20 12:43 - 2016-03-20 13:59 - 00000000 ____D C:\Program Files (x86)\AdwCleaner
2016-03-20 12:35 - 2016-03-20 12:35 - 00000000 ____D C:\Users\Chaser TW\AppData\Local\ACD Systems
2016-03-20 12:35 - 2016-03-20 12:35 - 00000000 ____D C:\ProgramData\ACD Systems
2016-03-20 11:48 - 2016-03-20 11:58 - 00000000 ____D C:\ProgramData\WinZip
2016-03-20 11:48 - 2016-03-20 11:48 - 00000000 ____D C:\Users\Chaser TW\AppData\Local\Downloaded Installations
2016-03-20 11:47 - 2016-03-20 11:47 - 00000000 ____D C:\ProgramData\NortonInstaller
2016-03-20 11:37 - 2016-03-20 11:37 - 00000000 ____D C:\Users\Chaser TW\AppData\Roaming\MCorp
2016-03-20 11:18 - 2016-03-20 11:19 - 00000000 ____D C:\Windows\system32\appmgmt
2016-03-20 11:17 - 2016-03-20 12:40 - 00000000 ____D C:\ProgramData\Skype
2016-03-20 11:17 - 2016-03-20 12:29 - 00000000 ____D C:\Users\Chaser TW\AppData\Roaming\Skype
2016-03-20 11:17 - 2016-03-20 11:17 - 00000000 ____D C:\Users\Chaser TW\AppData\Local\Skype
2016-03-20 11:05 - 2016-03-20 11:05 - 00000044 _____ C:\Users\Chaser TW\AppData\Roaming\WB.CFG
2016-03-20 10:43 - 2016-03-20 10:43 - 00000003 _____ C:\Users\Chaser\chrome_shutdown_ms.txt
2016-03-20 10:32 - 2016-03-20 10:32 - 00592240 _____ C:\Users\Chaser\Safe Browsing Bloom Prefix Set
2016-03-20 10:32 - 2016-03-20 10:32 - 00281782 _____ C:\Users\Chaser\Safe Browsing UwS List Prefix Set
2016-03-20 10:31 - 2016-03-20 10:32 - 03997052 _____ C:\Users\Chaser\Safe Browsing Bloom
2016-03-20 10:31 - 2016-03-20 10:32 - 01003172 _____ C:\Users\Chaser\Safe Browsing UwS List
2016-03-20 10:31 - 2016-03-20 10:32 - 00304424 _____ C:\Users\Chaser\Safe Browsing Download
2016-03-20 10:31 - 2016-03-20 10:32 - 00126544 _____ C:\Users\Chaser\Safe Browsing Csd Whitelist
2016-03-20 10:31 - 2016-03-20 10:32 - 00058120 _____ C:\Users\Chaser\Safe Browsing Extension Blacklist
2016-03-20 10:31 - 2016-03-20 10:32 - 00016300 _____ C:\Users\Chaser\Safe Browsing Download Whitelist
2016-03-20 10:31 - 2016-03-20 10:32 - 00000116 _____ C:\Users\Chaser\Safe Browsing IP Blacklist
2016-03-20 10:31 - 2016-03-20 10:32 - 00000068 _____ C:\Users\Chaser\Safe Browsing Inclusion Whitelist
2016-03-20 10:30 - 2015-11-12 11:51 - 00034720 ____H (LogMeIn, Inc.) C:\Windows\system32\hamachi.sys
2016-03-20 10:08 - 2016-03-20 10:08 - 00000000 _____ C:\Windows\EEventManager.INI
2016-03-20 10:02 - 2016-03-20 10:02 - 00000000 ____D C:\Users\Chaser TW\AppData\Local\LogMeIn
2016-03-20 10:02 - 2016-03-20 10:02 - 00000000 ____D C:\ProgramData\LogMeIn
2016-03-19 19:18 - 2016-03-23 00:49 - 00000000 ____D C:\Users\Chaser
2016-03-19 19:18 - 2016-03-20 10:43 - 00045799 _____ C:\Users\Chaser\Local State
2016-03-19 19:18 - 2016-03-20 10:43 - 00000000 ____D C:\Users\Chaser\Default
2016-03-19 19:18 - 2016-03-20 10:33 - 00000000 ____D C:\Users\Chaser\WidevineCDM
2016-03-19 19:18 - 2016-03-20 10:32 - 00007168 _____ C:\Users\Chaser\Safe Browsing Cookies
2016-03-19 19:18 - 2016-03-20 10:32 - 00000000 _____ C:\Users\Chaser\Safe Browsing Cookies-journal
2016-03-19 19:18 - 2016-03-19 19:18 - 00000000 ____D C:\Users\Chaser\SwReporter
2016-03-19 19:18 - 2016-03-19 19:18 - 00000000 ____D C:\Users\Chaser\SwiftShader
2016-03-19 19:18 - 2016-03-19 19:18 - 00000000 ____D C:\Users\Chaser\pnacl
2016-03-19 19:18 - 2016-03-19 19:18 - 00000000 ____D C:\Users\Chaser\PepperFlash
2016-03-19 19:18 - 2016-03-19 19:18 - 00000000 ____D C:\Users\Chaser\EVWhitelist
2016-03-19 19:18 - 2016-03-19 19:18 - 00000000 ____D C:\Users\Chaser\Caps
2016-03-19 19:18 - 2016-03-19 19:18 - 00000000 _____ C:\Users\Chaser\First Run
2016-03-19 19:08 - 2016-03-19 19:08 - 00127488 _____ C:\Users\Chaser TW\AppData\Roaming\Installer.dat
2016-03-19 19:07 - 2016-03-19 19:07 - 00000000 ____D C:\Program Files (x86)\GUM141C.tmp
2016-03-19 19:04 - 2016-03-20 11:08 - 00000000 ____D C:\Users\Chaser TW\AppData\Local\brsrv
2016-03-19 19:02 - 2016-03-20 13:43 - 00000000 ____D C:\Users\Chaser TW\AppData\Local\Setup Wizard
2016-03-19 18:57 - 2016-03-19 19:03 - 00000000 ____D C:\Users\Chaser TW\AppData\Local\3810282D-6C19-47B0-8283-5C6C29A7E108
2016-03-19 18:56 - 2016-03-19 18:56 - 00000000 ____D C:\extensions
2016-03-19 18:55 - 2016-03-19 18:55 - 00000000 ____D C:\ProgramData\DivX
2016-03-09 18:39 - 2016-02-13 04:52 - 03169792 _____ (Microsoft Corporation) C:\Windows\system32\wucltux.dll
2016-03-09 18:39 - 2016-02-13 04:52 - 00192512 _____ (Microsoft Corporation) C:\Windows\system32\wuwebv.dll
2016-03-09 18:39 - 2016-02-13 04:52 - 00098816 _____ (Microsoft Corporation) C:\Windows\system32\wudriver.dll
2016-03-09 18:39 - 2016-02-13 04:44 - 00091136 _____ (Microsoft Corporation) C:\Windows\system32\WinSetupUI.dll
2016-03-09 18:39 - 2016-02-13 04:39 - 00174080 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wuwebv.dll
2016-03-09 18:39 - 2016-02-13 04:22 - 02610688 _____ (Microsoft Corporation) C:\Windows\system32\wuaueng.dll
2016-03-09 18:39 - 2016-02-13 04:19 - 00709120 _____ (Microsoft Corporation) C:\Windows\system32\wuapi.dll
2016-03-09 18:39 - 2016-02-13 04:18 - 00140288 _____ (Microsoft Corporation) C:\Windows\system32\wuauclt.exe
2016-03-09 18:39 - 2016-02-13 04:18 - 00037888 _____ (Microsoft Corporation) C:\Windows\system32\wups2.dll
2016-03-09 18:39 - 2016-02-13 04:18 - 00037888 _____ (Microsoft Corporation) C:\Windows\system32\wuapp.exe
2016-03-09 18:39 - 2016-02-13 04:18 - 00036864 _____ (Microsoft Corporation) C:\Windows\system32\wups.dll
2016-03-09 18:39 - 2016-02-13 04:18 - 00012288 _____ (Microsoft Corporation) C:\Windows\system32\wu.upgrade.ps.dll
2016-03-09 18:39 - 2016-02-13 04:06 - 00573440 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wuapi.dll
2016-03-09 18:39 - 2016-02-13 04:05 - 00093696 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wudriver.dll
2016-03-09 18:39 - 2016-02-13 04:05 - 00035328 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wuapp.exe
2016-03-09 18:39 - 2016-02-13 04:05 - 00030208 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wups.dll
2016-03-09 18:39 - 2016-02-09 16:53 - 00387792 _____ (Microsoft Corporation) C:\Windows\system32\iedkcs32.dll
2016-03-09 18:39 - 2016-02-09 16:10 - 00341200 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iedkcs32.dll
2016-03-09 18:39 - 2016-02-09 07:05 - 20352512 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.dll
2016-03-09 18:39 - 2016-02-09 06:51 - 02724864 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.tlb
2016-03-09 18:39 - 2016-02-09 06:39 - 00496640 _____ (Microsoft Corporation) C:\Windows\SysWOW64\vbscript.dll
2016-03-09 18:39 - 2016-02-09 06:39 - 00062464 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iesetup.dll
2016-03-09 18:39 - 2016-02-09 06:38 - 00341504 _____ (Microsoft Corporation) C:\Windows\SysWOW64\html.iec
2016-03-09 18:39 - 2016-02-09 06:38 - 00047616 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieetwproxystub.dll
2016-03-09 18:39 - 2016-02-09 06:37 - 00064000 _____ (Microsoft Corporation) C:\Windows\SysWOW64\MshtmlDac.dll
2016-03-09 18:39 - 2016-02-09 06:34 - 02280448 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iertutil.dll
2016-03-09 18:39 - 2016-02-09 06:32 - 00047104 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jsproxy.dll
2016-03-09 18:39 - 2016-02-09 06:31 - 00030720 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iernonce.dll
2016-03-09 18:39 - 2016-02-09 06:30 - 00476160 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieui.dll
2016-03-09 18:39 - 2016-02-09 06:28 - 00663552 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript.dll
2016-03-09 18:39 - 2016-02-09 06:28 - 00620032 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript9diag.dll
2016-03-09 18:39 - 2016-02-09 06:28 - 00115712 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieUnatt.exe
2016-03-09 18:39 - 2016-02-09 06:20 - 00416256 _____ (Microsoft Corporation) C:\Windows\SysWOW64\dxtmsft.dll
2016-03-09 18:39 - 2016-02-09 06:16 - 00060416 _____ (Microsoft Corporation) C:\Windows\SysWOW64\JavaScriptCollectionAgent.dll
2016-03-09 18:39 - 2016-02-09 06:15 - 00091136 _____ (Microsoft Corporation) C:\Windows\SysWOW64\inseng.dll
2016-03-09 18:39 - 2016-02-09 06:13 - 00168960 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msrating.dll
2016-03-09 18:39 - 2016-02-09 06:12 - 00076288 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtmled.dll
2016-03-09 18:39 - 2016-02-09 06:11 - 00279040 _____ (Microsoft Corporation) C:\Windows\SysWOW64\dxtrans.dll
2016-03-09 18:39 - 2016-02-09 06:10 - 04611072 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript9.dll
2016-03-09 18:39 - 2016-02-09 06:10 - 00130048 _____ (Microsoft Corporation) C:\Windows\SysWOW64\occache.dll
2016-03-09 18:39 - 2016-02-09 06:05 - 25816576 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.dll
2016-03-09 18:39 - 2016-02-09 06:03 - 00230400 _____ (Microsoft Corporation) C:\Windows\SysWOW64\webcheck.dll
2016-03-09 18:39 - 2016-02-09 06:02 - 13012480 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieframe.dll
2016-03-09 18:39 - 2016-02-09 06:02 - 00687104 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msfeeds.dll
2016-03-09 18:39 - 2016-02-09 06:01 - 02050560 _____ (Microsoft Corporation) C:\Windows\SysWOW64\inetcpl.cpl
2016-03-09 18:39 - 2016-02-09 06:01 - 01155072 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtmlmedia.dll
2016-03-09 18:39 - 2016-02-09 05:43 - 02121216 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wininet.dll
2016-03-09 18:39 - 2016-02-09 05:39 - 01311744 _____ (Microsoft Corporation) C:\Windows\SysWOW64\urlmon.dll
2016-03-09 18:39 - 2016-02-09 05:38 - 00710144 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieapfltr.dll
2016-03-09 18:39 - 2016-02-09 04:41 - 02724864 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.tlb
2016-03-09 18:39 - 2016-02-09 04:41 - 00004096 _____ (Microsoft Corporation) C:\Windows\system32\ieetwcollectorres.dll
2016-03-09 18:39 - 2016-02-09 04:27 - 02887680 _____ (Microsoft Corporation) C:\Windows\system32\iertutil.dll
2016-03-09 18:39 - 2016-02-09 04:27 - 00066560 _____ (Microsoft Corporation) C:\Windows\system32\iesetup.dll
2016-03-09 18:39 - 2016-02-09 04:26 - 00571904 _____ (Microsoft Corporation) C:\Windows\system32\vbscript.dll
2016-03-09 18:39 - 2016-02-09 04:26 - 00417792 _____ (Microsoft Corporation) C:\Windows\system32\html.iec
2016-03-09 18:39 - 2016-02-09 04:26 - 00088064 _____ (Microsoft Corporation) C:\Windows\system32\MshtmlDac.dll
2016-03-09 18:39 - 2016-02-09 04:26 - 00048640 _____ (Microsoft Corporation) C:\Windows\system32\ieetwproxystub.dll
2016-03-09 18:39 - 2016-02-09 04:19 - 00054784 _____ (Microsoft Corporation) C:\Windows\system32\jsproxy.dll
2016-03-09 18:39 - 2016-02-09 04:18 - 00034304 _____ (Microsoft Corporation) C:\Windows\system32\iernonce.dll
2016-03-09 18:39 - 2016-02-09 04:16 - 06052352 _____ (Microsoft Corporation) C:\Windows\system32\jscript9.dll
2016-03-09 18:39 - 2016-02-09 04:15 - 00615936 _____ (Microsoft Corporation) C:\Windows\system32\ieui.dll
2016-03-09 18:39 - 2016-02-09 04:14 - 00144384 _____ (Microsoft Corporation) C:\Windows\system32\ieUnatt.exe
2016-03-09 18:39 - 2016-02-09 04:14 - 00114688 _____ (Microsoft Corporation) C:\Windows\system32\ieetwcollector.exe
2016-03-09 18:39 - 2016-02-09 04:13 - 00817664 _____ (Microsoft Corporation) C:\Windows\system32\jscript.dll
2016-03-09 18:39 - 2016-02-09 04:13 - 00814080 _____ (Microsoft Corporation) C:\Windows\system32\jscript9diag.dll
2016-03-09 18:39 - 2016-02-09 04:06 - 00968704 _____ (Microsoft Corporation) C:\Windows\system32\MsSpellCheckingFacility.exe
2016-03-09 18:39 - 2016-02-09 04:03 - 00489984 _____ (Microsoft Corporation) C:\Windows\system32\dxtmsft.dll
2016-03-09 18:39 - 2016-02-09 03:55 - 00077824 _____ (Microsoft Corporation) C:\Windows\system32\JavaScriptCollectionAgent.dll
2016-03-09 18:39 - 2016-02-09 03:54 - 00107520 _____ (Microsoft Corporation) C:\Windows\system32\inseng.dll
2016-03-09 18:39 - 2016-02-09 03:52 - 00199680 _____ (Microsoft Corporation) C:\Windows\system32\msrating.dll
2016-03-09 18:39 - 2016-02-09 03:51 - 00092160 _____ (Microsoft Corporation) C:\Windows\system32\mshtmled.dll
2016-03-09 18:39 - 2016-02-09 03:49 - 00315392 _____ (Microsoft Corporation) C:\Windows\system32\dxtrans.dll
2016-03-09 18:39 - 2016-02-09 03:47 - 00152064 _____ (Microsoft Corporation) C:\Windows\system32\occache.dll
2016-03-09 18:39 - 2016-02-09 03:37 - 00262144 _____ (Microsoft Corporation) C:\Windows\system32\webcheck.dll
2016-03-09 18:39 - 2016-02-09 03:35 - 00718336 _____ (Microsoft Corporation) C:\Windows\system32\ie4uinit.exe
2016-03-09 18:39 - 2016-02-09 03:34 - 00798720 _____ (Microsoft Corporation) C:\Windows\system32\msfeeds.dll
2016-03-09 18:39 - 2016-02-09 03:33 - 14613504 _____ (Microsoft Corporation) C:\Windows\system32\ieframe.dll
2016-03-09 18:39 - 2016-02-09 03:33 - 02123264 _____ (Microsoft Corporation) C:\Windows\system32\inetcpl.cpl
2016-03-09 18:39 - 2016-02-09 03:33 - 01359360 _____ (Microsoft Corporation) C:\Windows\system32\mshtmlmedia.dll
2016-03-09 18:39 - 2016-02-09 03:19 - 02597376 _____ (Microsoft Corporation) C:\Windows\system32\wininet.dll
2016-03-09 18:39 - 2016-02-09 03:07 - 01546752 _____ (Microsoft Corporation) C:\Windows\system32\urlmon.dll
2016-03-09 18:39 - 2016-02-09 02:55 - 00800768 _____ (Microsoft Corporation) C:\Windows\system32\ieapfltr.dll
2016-03-09 18:39 - 2016-02-05 03:52 - 03211264 _____ (Microsoft Corporation) C:\Windows\system32\win32k.sys
2016-03-09 18:39 - 2016-02-04 04:58 - 00862208 _____ (Microsoft Corporation) C:\Windows\system32\oleaut32.dll
2016-03-09 18:39 - 2016-02-04 04:52 - 00084992 _____ (Microsoft Corporation) C:\Windows\system32\asycfilt.dll
2016-03-09 18:39 - 2016-02-04 04:49 - 00572416 _____ (Microsoft Corporation) C:\Windows\SysWOW64\oleaut32.dll
2016-03-09 18:39 - 2016-02-04 04:43 - 00067584 _____ (Microsoft Corporation) C:\Windows\SysWOW64\asycfilt.dll
2016-03-09 18:39 - 2016-02-04 04:07 - 00091648 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\USBSTOR.SYS
2016-03-09 18:39 - 2016-01-12 05:11 - 01684416 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\ntfs.sys
2016-03-09 18:39 - 2015-11-20 00:07 - 00994760 _____ (Microsoft Corporation) C:\Windows\system32\ucrtbase.dll
2016-03-09 18:39 - 2015-11-20 00:07 - 00063840 _____ (Microsoft Corporation) C:\Windows\system32\api-ms-win-crt-private-l1-1-0.dll
2016-03-09 18:39 - 2015-11-20 00:07 - 00020832 _____ (Microsoft Corporation) C:\Windows\system32\api-ms-win-crt-math-l1-1-0.dll
2016-03-09 18:39 - 2015-11-20 00:07 - 00019808 _____ (Microsoft Corporation) C:\Windows\system32\api-ms-win-crt-multibyte-l1-1-0.dll
2016-03-09 18:39 - 2015-11-20 00:07 - 00017760 _____ (Microsoft Corporation) C:\Windows\system32\api-ms-win-crt-string-l1-1-0.dll
2016-03-09 18:39 - 2015-11-20 00:07 - 00017760 _____ (Microsoft Corporation) C:\Windows\system32\api-ms-win-crt-stdio-l1-1-0.dll
2016-03-09 18:39 - 2015-11-20 00:07 - 00016224 _____ (Microsoft Corporation) C:\Windows\system32\api-ms-win-crt-runtime-l1-1-0.dll
2016-03-09 18:39 - 2015-11-20 00:07 - 00015712 _____ (Microsoft Corporation) C:\Windows\system32\api-ms-win-crt-convert-l1-1-0.dll
2016-03-09 18:39 - 2015-11-20 00:07 - 00014176 _____ (Microsoft Corporation) C:\Windows\system32\api-ms-win-crt-time-l1-1-0.dll
2016-03-09 18:39 - 2015-11-20 00:07 - 00014176 _____ (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-localization-l1-2-0.dll
2016-03-09 18:39 - 2015-11-20 00:07 - 00013664 _____ (Microsoft Corporation) C:\Windows\system32\api-ms-win-crt-filesystem-l1-1-0.dll
2016-03-09 18:39 - 2015-11-20 00:07 - 00012640 _____ (Microsoft Corporation) C:\Windows\system32\api-ms-win-crt-process-l1-1-0.dll
2016-03-09 18:39 - 2015-11-20 00:07 - 00012640 _____ (Microsoft Corporation) C:\Windows\system32\api-ms-win-crt-heap-l1-1-0.dll
2016-03-09 18:39 - 2015-11-20 00:07 - 00012640 _____ (Microsoft Corporation) C:\Windows\system32\api-ms-win-crt-conio-l1-1-0.dll
2016-03-09 18:39 - 2015-11-20 00:07 - 00012128 _____ (Microsoft Corporation) C:\Windows\system32\api-ms-win-crt-utility-l1-1-0.dll
2016-03-09 18:39 - 2015-11-20 00:07 - 00012128 _____ (Microsoft Corporation) C:\Windows\system32\api-ms-win-crt-locale-l1-1-0.dll
2016-03-09 18:39 - 2015-11-20 00:07 - 00012128 _____ (Microsoft Corporation) C:\Windows\system32\api-ms-win-crt-environment-l1-1-0.dll
2016-03-09 18:39 - 2015-11-20 00:07 - 00012128 _____ (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-synch-l1-2-0.dll
2016-03-09 18:39 - 2015-11-20 00:07 - 00012128 _____ (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-processthreads-l1-1-1.dll
2016-03-09 18:39 - 2015-11-20 00:07 - 00011616 _____ (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-xstate-l2-1-0.dll
2016-03-09 18:39 - 2015-11-20 00:07 - 00011616 _____ (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-timezone-l1-1-0.dll
2016-03-09 18:39 - 2015-11-20 00:07 - 00011616 _____ (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-file-l2-1-0.dll
2016-03-09 18:39 - 2015-11-20 00:07 - 00011616 _____ (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-file-l1-2-0.dll
2016-03-09 18:39 - 2015-11-20 00:06 - 00922432 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ucrtbase.dll
2016-03-09 18:39 - 2015-11-20 00:06 - 00066400 _____ (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-crt-private-l1-1-0.dll
2016-03-09 18:39 - 2015-11-20 00:06 - 00022368 _____ (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-crt-math-l1-1-0.dll
2016-03-09 18:39 - 2015-11-20 00:06 - 00019808 _____ (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-crt-multibyte-l1-1-0.dll
2016-03-09 18:39 - 2015-11-20 00:06 - 00017760 _____ (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-crt-string-l1-1-0.dll
2016-03-09 18:39 - 2015-11-20 00:06 - 00017760 _____ (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-crt-stdio-l1-1-0.dll
2016-03-09 18:39 - 2015-11-20 00:06 - 00016224 _____ (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-crt-runtime-l1-1-0.dll
2016-03-09 18:39 - 2015-11-20 00:06 - 00015712 _____ (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-crt-convert-l1-1-0.dll
2016-03-09 18:39 - 2015-11-20 00:06 - 00014176 _____ (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-crt-time-l1-1-0.dll
2016-03-09 18:39 - 2015-11-20 00:06 - 00014176 _____ (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-localization-l1-2-0.dll
2016-03-09 18:39 - 2015-11-20 00:06 - 00013664 _____ (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-crt-filesystem-l1-1-0.dll
2016-03-09 18:39 - 2015-11-20 00:06 - 00012640 _____ (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-crt-process-l1-1-0.dll
2016-03-09 18:39 - 2015-11-20 00:06 - 00012640 _____ (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-crt-heap-l1-1-0.dll
2016-03-09 18:39 - 2015-11-20 00:06 - 00012640 _____ (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-crt-conio-l1-1-0.dll
2016-03-09 18:39 - 2015-11-20 00:06 - 00012128 _____ (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-crt-utility-l1-1-0.dll
2016-03-09 18:39 - 2015-11-20 00:06 - 00012128 _____ (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-crt-locale-l1-1-0.dll
2016-03-09 18:39 - 2015-11-20 00:06 - 00012128 _____ (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-crt-environment-l1-1-0.dll
2016-03-09 18:39 - 2015-11-20 00:06 - 00012128 _____ (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-synch-l1-2-0.dll
2016-03-09 18:39 - 2015-11-20 00:06 - 00012128 _____ (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-processthreads-l1-1-1.dll
2016-03-09 18:39 - 2015-11-20 00:06 - 00011616 _____ (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-xstate-l2-1-0.dll
2016-03-09 18:39 - 2015-11-20 00:06 - 00011616 _____ (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-timezone-l1-1-0.dll
2016-03-09 18:39 - 2015-11-20 00:06 - 00011616 _____ (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-file-l2-1-0.dll
2016-03-09 18:39 - 2015-11-20 00:06 - 00011616 _____ (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-file-l1-2-0.dll
2016-03-09 18:38 - 2016-02-20 05:02 - 00038336 _____ (Microsoft Corporation) C:\Windows\system32\CompatTelRunner.exe
2016-03-09 18:38 - 2016-02-20 04:54 - 01168896 _____ (Microsoft Corporation) C:\Windows\system32\aeinv.dll
2016-03-09 18:38 - 2016-02-20 00:07 - 01373184 _____ (Microsoft Corporation) C:\Windows\system32\appraiser.dll
2016-03-09 18:38 - 2016-02-12 04:56 - 05572032 _____ (Microsoft Corporation) C:\Windows\system32\ntoskrnl.exe
2016-03-09 18:38 - 2016-02-12 04:56 - 00154560 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\ksecpkg.sys
2016-03-09 18:38 - 2016-02-12 04:56 - 00095680 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\ksecdd.sys
2016-03-09 18:38 - 2016-02-12 04:52 - 01733592 _____ (Microsoft Corporation) C:\Windows\system32\ntdll.dll
2016-03-09 18:38 - 2016-02-12 04:49 - 00362496 _____ (Microsoft Corporation) C:\Windows\system32\wow64win.dll
2016-03-09 18:38 - 2016-02-12 04:49 - 00243712 _____ (Microsoft Corporation) C:\Windows\system32\wow64.dll
2016-03-09 18:38 - 2016-02-12 04:49 - 00215040 _____ (Microsoft Corporation) C:\Windows\system32\winsrv.dll
2016-03-09 18:38 - 2016-02-12 04:49 - 00210432 _____ (Microsoft Corporation) C:\Windows\system32\wdigest.dll
2016-03-09 18:38 - 2016-02-12 04:49 - 00135680 _____ (Microsoft Corporation) C:\Windows\system32\sspicli.dll
2016-03-09 18:38 - 2016-02-12 04:49 - 00086528 _____ (Microsoft Corporation) C:\Windows\system32\TSpkg.dll
2016-03-09 18:38 - 2016-02-12 04:49 - 00028672 _____ (Microsoft Corporation) C:\Windows\system32\sspisrv.dll
2016-03-09 18:38 - 2016-02-12 04:49 - 00013312 _____ (Microsoft Corporation) C:\Windows\system32\wow64cpu.dll
2016-03-09 18:38 - 2016-02-12 04:48 - 01214464 _____ (Microsoft Corporation) C:\Windows\system32\rpcrt4.dll
2016-03-09 18:38 - 2016-02-12 04:48 - 00503808 _____ (Microsoft Corporation) C:\Windows\system32\srcore.dll
2016-03-09 18:38 - 2016-02-12 04:48 - 00344064 _____ (Microsoft Corporation) C:\Windows\system32\schannel.dll
2016-03-09 18:38 - 2016-02-12 04:48 - 00050176 _____ (Microsoft Corporation) C:\Windows\system32\srclient.dll
2016-03-09 18:38 - 2016-02-12 04:48 - 00028160 _____ (Microsoft Corporation) C:\Windows\system32\secur32.dll
2016-03-09 18:38 - 2016-02-12 04:47 - 00016384 _____ (Microsoft Corporation) C:\Windows\system32\ntvdm64.dll
2016-03-09 18:38 - 2016-02-12 04:45 - 00315392 _____ (Microsoft Corporation) C:\Windows\system32\msv1_0.dll
2016-03-09 18:38 - 2016-02-12 04:45 - 00312320 _____ (Microsoft Corporation) C:\Windows\system32\ncrypt.dll
2016-03-09 18:38 - 2016-02-12 04:45 - 00146432 _____ (Microsoft Corporation) C:\Windows\system32\msaudite.dll
2016-03-09 18:38 - 2016-02-12 04:45 - 00060416 _____ (Microsoft Corporation) C:\Windows\system32\msobjs.dll
2016-03-09 18:38 - 2016-02-12 04:44 - 03994560 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ntkrnlpa.exe
2016-03-09 18:38 - 2016-02-12 04:44 - 03938240 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ntoskrnl.exe
2016-03-09 18:38 - 2016-02-12 04:44 - 01461248 _____ (Microsoft Corporation) C:\Windows\system32\lsasrv.dll
2016-03-09 18:38 - 2016-02-12 04:44 - 01163264 _____ (Microsoft Corporation) C:\Windows\system32\kernel32.dll
2016-03-09 18:38 - 2016-02-12 04:44 - 00730112 _____ (Microsoft Corporation) C:\Windows\system32\kerberos.dll
2016-03-09 18:38 - 2016-02-12 04:44 - 00422400 _____ (Microsoft Corporation) C:\Windows\system32\KernelBase.dll
2016-03-09 18:38 - 2016-02-12 04:42 - 00043520 _____ (Microsoft Corporation) C:\Windows\system32\csrsrv.dll
2016-03-09 18:38 - 2016-02-12 04:42 - 00043520 _____ (Microsoft Corporation) C:\Windows\system32\cryptbase.dll
2016-03-09 18:38 - 2016-02-12 04:42 - 00022016 _____ (Microsoft Corporation) C:\Windows\system32\credssp.dll
2016-03-09 18:38 - 2016-02-12 04:41 - 01314328 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ntdll.dll
2016-03-09 18:38 - 2016-02-12 04:41 - 00880128 _____ (Microsoft Corporation) C:\Windows\system32\advapi32.dll
2016-03-09 18:38 - 2016-02-12 04:41 - 00686080 _____ (Microsoft Corporation) C:\Windows\system32\adtschema.dll
2016-03-09 18:38 - 2016-02-12 04:41 - 00006656 _____ (Microsoft Corporation) C:\Windows\system32\apisetschema.dll
2016-03-09 18:38 - 2016-02-12 04:41 - 00006144 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-security-base-l1-1-0.dll
2016-03-09 18:38 - 2016-02-12 04:41 - 00005120 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-file-l1-1-0.dll
2016-03-09 18:38 - 2016-02-12 04:41 - 00004608 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-threadpool-l1-1-0.dll
2016-03-09 18:38 - 2016-02-12 04:41 - 00004608 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-processthreads-l1-1-0.dll
2016-03-09 18:38 - 2016-02-12 04:41 - 00004096 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-sysinfo-l1-1-0.dll
2016-03-09 18:38 - 2016-02-12 04:41 - 00004096 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-synch-l1-1-0.dll
2016-03-09 18:38 - 2016-02-12 04:41 - 00004096 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-localregistry-l1-1-0.dll
2016-03-09 18:38 - 2016-02-12 04:41 - 00004096 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-localization-l1-1-0.dll
2016-03-09 18:38 - 2016-02-12 04:41 - 00003584 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-rtlsupport-l1-1-0.dll
2016-03-09 18:38 - 2016-02-12 04:41 - 00003584 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-processenvironment-l1-1-0.dll
2016-03-09 18:38 - 2016-02-12 04:41 - 00003584 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-namedpipe-l1-1-0.dll
2016-03-09 18:38 - 2016-02-12 04:41 - 00003584 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-misc-l1-1-0.dll
2016-03-09 18:38 - 2016-02-12 04:41 - 00003584 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-memory-l1-1-0.dll
2016-03-09 18:38 - 2016-02-12 04:41 - 00003584 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-libraryloader-l1-1-0.dll
2016-03-09 18:38 - 2016-02-12 04:41 - 00003584 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-heap-l1-1-0.dll
2016-03-09 18:38 - 2016-02-12 04:41 - 00003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-xstate-l1-1-0.dll
2016-03-09 18:38 - 2016-02-12 04:41 - 00003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-util-l1-1-0.dll
2016-03-09 18:38 - 2016-02-12 04:41 - 00003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-string-l1-1-0.dll
2016-03-09 18:38 - 2016-02-12 04:41 - 00003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-profile-l1-1-0.dll
2016-03-09 18:38 - 2016-02-12 04:41 - 00003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-io-l1-1-0.dll
2016-03-09 18:38 - 2016-02-12 04:41 - 00003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-interlocked-l1-1-0.dll
2016-03-09 18:38 - 2016-02-12 04:41 - 00003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-handle-l1-1-0.dll
2016-03-09 18:38 - 2016-02-12 04:41 - 00003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-fibers-l1-1-0.dll
2016-03-09 18:38 - 2016-02-12 04:41 - 00003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-errorhandling-l1-1-0.dll
2016-03-09 18:38 - 2016-02-12 04:41 - 00003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-delayload-l1-1-0.dll
2016-03-09 18:38 - 2016-02-12 04:41 - 00003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-debug-l1-1-0.dll
2016-03-09 18:38 - 2016-02-12 04:41 - 00003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-datetime-l1-1-0.dll
2016-03-09 18:38 - 2016-02-12 04:41 - 00003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-console-l1-1-0.dll
2016-03-09 18:38 - 2016-02-12 04:38 - 01114112 _____ (Microsoft Corporation) C:\Windows\SysWOW64\kernel32.dll
2016-03-09 18:38 - 2016-02-12 04:38 - 00665088 _____ (Microsoft Corporation) C:\Windows\SysWOW64\rpcrt4.dll
2016-03-09 18:38 - 2016-02-12 04:38 - 00275456 _____ (Microsoft Corporation) C:\Windows\SysWOW64\KernelBase.dll
2016-03-09 18:38 - 2016-02-12 04:38 - 00171520 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wdigest.dll
2016-03-09 18:38 - 2016-02-12 04:38 - 00096768 _____ (Microsoft Corporation) C:\Windows\SysWOW64\sspicli.dll
2016-03-09 18:38 - 2016-02-12 04:38 - 00065536 _____ (Microsoft Corporation) C:\Windows\SysWOW64\TSpkg.dll
2016-03-09 18:38 - 2016-02-12 04:38 - 00005120 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wow32.dll
2016-03-09 18:38 - 2016-02-12 04:37 - 00251392 _____ (Microsoft Corporation) C:\Windows\SysWOW64\schannel.dll
2016-03-09 18:38 - 2016-02-12 04:37 - 00043008 _____ (Microsoft Corporation) C:\Windows\SysWOW64\srclient.dll
2016-03-09 18:38 - 2016-02-12 04:37 - 00022016 _____ (Microsoft Corporation) C:\Windows\SysWOW64\secur32.dll
2016-03-09 18:38 - 2016-02-12 04:35 - 00259584 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msv1_0.dll
2016-03-09 18:38 - 2016-02-12 04:35 - 00223232 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ncrypt.dll
2016-03-09 18:38 - 2016-02-12 04:35 - 00060416 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msobjs.dll
2016-03-09 18:38 - 2016-02-12 04:34 - 00146432 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msaudite.dll
2016-03-09 18:38 - 2016-02-12 04:33 - 00553472 _____ (Microsoft Corporation) C:\Windows\SysWOW64\kerberos.dll
2016-03-09 18:38 - 2016-02-12 04:31 - 00017408 _____ (Microsoft Corporation) C:\Windows\SysWOW64\credssp.dll
2016-03-09 18:38 - 2016-02-12 04:30 - 00686080 _____ (Microsoft Corporation) C:\Windows\SysWOW64\adtschema.dll
2016-03-09 18:38 - 2016-02-12 04:30 - 00642560 _____ (Microsoft Corporation) C:\Windows\SysWOW64\advapi32.dll
2016-03-09 18:38 - 2016-02-12 04:30 - 00006656 _____ (Microsoft Corporation) C:\Windows\SysWOW64\apisetschema.dll
2016-03-09 18:38 - 2016-02-12 04:30 - 00005120 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-file-l1-1-0.dll
2016-03-09 18:38 - 2016-02-12 04:30 - 00004608 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-processthreads-l1-1-0.dll
2016-03-09 18:38 - 2016-02-12 04:30 - 00004096 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-sysinfo-l1-1-0.dll
2016-03-09 18:38 - 2016-02-12 04:30 - 00004096 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-synch-l1-1-0.dll
2016-03-09 18:38 - 2016-02-12 04:30 - 00004096 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-misc-l1-1-0.dll
2016-03-09 18:38 - 2016-02-12 04:30 - 00004096 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-localregistry-l1-1-0.dll
2016-03-09 18:38 - 2016-02-12 04:30 - 00004096 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-localization-l1-1-0.dll
2016-03-09 18:38 - 2016-02-12 04:30 - 00003584 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-processenvironment-l1-1-0.dll
2016-03-09 18:38 - 2016-02-12 04:30 - 00003584 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-namedpipe-l1-1-0.dll
2016-03-09 18:38 - 2016-02-12 04:30 - 00003584 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-memory-l1-1-0.dll
2016-03-09 18:38 - 2016-02-12 04:30 - 00003584 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-libraryloader-l1-1-0.dll
2016-03-09 18:38 - 2016-02-12 04:30 - 00003584 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-interlocked-l1-1-0.dll
2016-03-09 18:38 - 2016-02-12 04:30 - 00003584 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-heap-l1-1-0.dll
2016-03-09 18:38 - 2016-02-12 04:30 - 00003072 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-string-l1-1-0.dll
2016-03-09 18:38 - 2016-02-12 04:30 - 00003072 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-rtlsupport-l1-1-0.dll
2016-03-09 18:38 - 2016-02-12 04:30 - 00003072 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-profile-l1-1-0.dll
2016-03-09 18:38 - 2016-02-12 04:30 - 00003072 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-io-l1-1-0.dll
2016-03-09 18:38 - 2016-02-12 04:30 - 00003072 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-handle-l1-1-0.dll
2016-03-09 18:38 - 2016-02-12 04:30 - 00003072 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-fibers-l1-1-0.dll
2016-03-09 18:38 - 2016-02-12 04:30 - 00003072 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-errorhandling-l1-1-0.dll
2016-03-09 18:38 - 2016-02-12 04:30 - 00003072 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-delayload-l1-1-0.dll
2016-03-09 18:38 - 2016-02-12 04:30 - 00003072 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-debug-l1-1-0.dll
2016-03-09 18:38 - 2016-02-12 04:30 - 00003072 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-datetime-l1-1-0.dll
2016-03-09 18:38 - 2016-02-12 04:30 - 00003072 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-console-l1-1-0.dll
2016-03-09 18:38 - 2016-02-12 03:48 - 00064000 _____ (Microsoft Corporation) C:\Windows\system32\auditpol.exe
2016-03-09 18:38 - 2016-02-12 03:43 - 00050176 _____ (Microsoft Corporation) C:\Windows\SysWOW64\auditpol.exe
2016-03-09 18:38 - 2016-02-12 03:41 - 00338432 _____ (Microsoft Corporation) C:\Windows\system32\conhost.exe
2016-03-09 18:38 - 2016-02-12 03:40 - 00296960 _____ (Microsoft Corporation) C:\Windows\system32\rstrui.exe
2016-03-09 18:38 - 2016-02-12 03:34 - 00290816 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\mrxsmb10.sys
2016-03-09 18:38 - 2016-02-12 03:34 - 00159232 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\mrxsmb.sys
2016-03-09 18:38 - 2016-02-12 03:33 - 00129024 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\mrxsmb20.sys
2016-03-09 18:38 - 2016-02-12 03:32 - 00112640 _____ (Microsoft Corporation) C:\Windows\system32\smss.exe
2016-03-09 18:38 - 2016-02-12 03:32 - 00030720 _____ (Microsoft Corporation) C:\Windows\system32\lsass.exe
2016-03-09 18:38 - 2016-02-12 03:32 - 00025600 _____ (Microsoft Corporation) C:\Windows\SysWOW64\setup16.exe
2016-03-09 18:38 - 2016-02-12 03:32 - 00014336 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ntvdm64.dll
2016-03-09 18:38 - 2016-02-12 03:32 - 00007680 _____ (Microsoft Corporation) C:\Windows\SysWOW64\instnm.exe
2016-03-09 18:38 - 2016-02-12 03:32 - 00002048 _____ (Microsoft Corporation) C:\Windows\SysWOW64\user.exe
2016-03-09 18:38 - 2016-02-12 03:31 - 00036352 _____ (Microsoft Corporation) C:\Windows\SysWOW64\cryptbase.dll
2016-03-09 18:38 - 2016-02-12 03:30 - 00006144 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-security-base-l1-1-0.dll
2016-03-09 18:38 - 2016-02-12 03:30 - 00004608 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-threadpool-l1-1-0.dll
2016-03-09 18:38 - 2016-02-12 03:30 - 00003584 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-xstate-l1-1-0.dll
2016-03-09 18:38 - 2016-02-12 03:30 - 00003072 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-util-l1-1-0.dll
2016-03-09 18:38 - 2016-02-12 00:07 - 00689152 _____ (Microsoft Corporation) C:\Windows\system32\generaltel.dll
2016-03-09 18:38 - 2016-02-09 19:57 - 14634496 _____ (Microsoft Corporation) C:\Windows\system32\wmp.dll
2016-03-09 18:38 - 2016-02-09 19:57 - 12625920 _____ (Microsoft Corporation) C:\Windows\system32\wmploc.DLL
2016-03-09 18:38 - 2016-02-09 19:56 - 00005120 _____ (Microsoft Corporation) C:\Windows\system32\msdxm.ocx
2016-03-09 18:38 - 2016-02-09 19:56 - 00005120 _____ (Microsoft Corporation) C:\Windows\system32\dxmasf.dll
2016-03-09 18:38 - 2016-02-09 19:55 - 00030720 _____ (Microsoft Corporation) C:\Windows\system32\seclogon.dll
2016-03-09 18:38 - 2016-02-09 19:54 - 00009728 _____ (Microsoft Corporation) C:\Windows\system32\spwmp.dll
2016-03-09 18:38 - 2016-02-09 19:51 - 12625408 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wmploc.DLL
2016-03-09 18:38 - 2016-02-09 19:51 - 11411456 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wmp.dll
2016-03-09 18:38 - 2016-02-09 19:13 - 00008192 _____ (Microsoft Corporation) C:\Windows\SysWOW64\spwmp.dll
2016-03-09 18:38 - 2016-02-09 19:13 - 00004096 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msdxm.ocx
2016-03-09 18:38 - 2016-02-09 19:13 - 00004096 _____ (Microsoft Corporation) C:\Windows\SysWOW64\dxmasf.dll
2016-03-09 18:38 - 2016-02-06 04:54 - 00100864 _____ (Microsoft Corporation) C:\Windows\system32\fontsub.dll
2016-03-09 18:38 - 2016-02-06 04:54 - 00041472 _____ (Microsoft Corporation) C:\Windows\system32\lpk.dll
2016-03-09 18:38 - 2016-02-06 04:53 - 00046080 _____ (Adobe Systems) C:\Windows\system32\atmlib.dll
2016-03-09 18:38 - 2016-02-06 04:53 - 00014336 _____ (Microsoft Corporation) C:\Windows\system32\dciman32.dll
2016-03-09 18:38 - 2016-02-06 04:50 - 00025600 _____ (Microsoft Corporation) C:\Windows\SysWOW64\lpk.dll
2016-03-09 18:38 - 2016-02-06 04:44 - 00070656 _____ (Microsoft Corporation) C:\Windows\SysWOW64\fontsub.dll
2016-03-09 18:38 - 2016-02-06 04:42 - 00010240 _____ (Microsoft Corporation) C:\Windows\SysWOW64\dciman32.dll
2016-03-09 18:38 - 2016-02-06 03:48 - 00372736 _____ (Adobe Systems Incorporated) C:\Windows\system32\atmfd.dll
2016-03-09 18:38 - 2016-02-06 03:43 - 00299520 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\atmfd.dll
2016-03-09 18:38 - 2016-02-06 03:43 - 00034304 _____ (Adobe Systems) C:\Windows\SysWOW64\atmlib.dll
2016-03-09 18:38 - 2016-02-06 00:07 - 00696832 _____ (Microsoft Corporation) C:\Windows\system32\invagent.dll
2016-03-09 18:38 - 2016-02-06 00:07 - 00499200 _____ (Microsoft Corporation) C:\Windows\system32\devinv.dll
2016-03-09 18:38 - 2016-02-06 00:07 - 00076800 _____ (Microsoft Corporation) C:\Windows\system32\acmigration.dll
2016-03-09 18:38 - 2016-02-05 11:19 - 00381440 _____ (Microsoft Corporation) C:\Windows\system32\mfds.dll
2016-03-09 18:38 - 2016-02-05 04:41 - 00296448 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mfds.dll
2016-03-01 19:13 - 2016-03-01 19:13 - 00000000 ____D C:\Users\Chaser TW\AppData\Local\GARMIN_Corp
2016-03-01 19:13 - 2016-03-01 19:13 - 00000000 ____D C:\Users\Chaser TW\AppData\Local\Garmin
2016-03-01 15:32 - 2016-03-01 19:13 - 00000000 ____D C:\Users\Chaser TW\AppData\Roaming\Garmin
2016-03-01 15:32 - 2016-03-01 18:59 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Garmin
2016-03-01 15:32 - 2016-03-01 18:58 - 00000000 ____D C:\ProgramData\Garmin
2016-03-01 15:32 - 2016-03-01 18:58 - 00000000 ____D C:\Program Files (x86)\Garmin
2016-03-01 15:32 - 2016-03-01 15:32 - 00003552 _____ C:\Windows\System32\Tasks\GarminUpdaterTask
2016-03-01 15:32 - 2016-03-01 15:32 - 00000000 ____D C:\Users\Chaser TW\AppData\Local\Garmin_Ltd._or_its_subsid
2016-03-01 15:32 - 2016-03-01 15:32 - 00000000 ____D C:\Program Files\DIFX
 
==================== One Month Modified files and folders ========
 
(If an entry is included in the fixlist, the file/folder will be moved.)
 
2016-03-25 04:20 - 2015-12-15 15:00 - 00000000 ___SD C:\Windows\SysWOW64\GWX
2016-03-25 04:20 - 2015-12-15 15:00 - 00000000 ___SD C:\Windows\system32\GWX
2016-03-25 04:20 - 2015-08-19 03:56 - 00001945 _____ C:\Windows\epplauncher.mif
2016-03-25 04:20 - 2009-07-14 14:45 - 00019584 ____H C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0
2016-03-25 04:20 - 2009-07-14 14:45 - 00019584 ____H C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0
2016-03-25 04:13 - 2016-01-29 00:13 - 00000911 _____ C:\Windows\Tasks\EPSON WF-3640 Series Update {B024067E-F0CA-4581-8900-97111F2CE449}.job
2016-03-25 04:13 - 2016-01-29 00:13 - 00000725 _____ C:\Windows\Tasks\EPSON WF-3640 Series Invitation {B024067E-F0CA-4581-8900-97111F2CE449}.job
2016-03-25 03:46 - 2015-07-13 15:01 - 00000898 _____ C:\Windows\Tasks\GoogleUpdateTaskMachineUA.job
2016-03-24 17:46 - 2015-07-13 15:01 - 00000894 _____ C:\Windows\Tasks\GoogleUpdateTaskMachineCore.job
2016-03-24 11:14 - 2009-07-14 15:13 - 00782578 _____ C:\Windows\system32\PerfStringBackup.INI
2016-03-24 11:14 - 2009-07-14 13:20 - 00000000 ____D C:\Windows\inf
2016-03-24 11:08 - 2009-07-14 15:08 - 00000006 ____H C:\Windows\Tasks\SA.DAT
2016-03-24 10:23 - 2015-07-13 13:48 - 00000000 ____D C:\Users\Chaser TW
2016-03-24 10:21 - 2015-07-13 14:20 - 00000000 ____D C:\Program Files (x86)\Intel
2016-03-24 10:21 - 2015-07-13 14:16 - 00000000 ____D C:\Program Files\Intel
2016-03-24 10:20 - 2015-07-13 14:34 - 00774700 _____ C:\Windows\SysWOW64\PerfStringBackup.INI
2016-03-23 20:11 - 2009-07-14 13:20 - 00000000 ____D C:\Windows\tracing
2016-03-23 19:30 - 2015-08-19 03:22 - 00000000 ____D C:\ProgramData\RogueKiller
2016-03-23 10:43 - 2009-07-14 13:20 - 00000000 ____D C:\Windows\schemas
2016-03-23 09:44 - 2015-07-15 23:12 - 00000000 ____D C:\Users\Chaser TW\AppData\Roaming\MPC-HC
2016-03-23 09:33 - 2015-07-13 15:07 - 00000000 ____D C:\Users\Chaser TW\AppData\Roaming\foobar2000
2016-03-23 09:28 - 2015-07-13 14:24 - 00111144 _____ C:\Users\Chaser TW\AppData\Local\GDIPFONTCACHEV1.DAT
2016-03-23 09:28 - 2009-07-14 14:45 - 05057648 _____ C:\Windows\system32\FNTCACHE.DAT
2016-03-23 09:13 - 2015-11-13 07:01 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Epson Software
2016-03-23 09:13 - 2015-07-13 14:20 - 00000000 ___HD C:\Program Files (x86)\InstallShield Installation Information
2016-03-23 00:48 - 2009-07-14 12:34 - 00000215 _____ C:\Windows\system.ini
2016-03-22 20:57 - 2015-07-14 03:37 - 00000000 ____D C:\Users\Chaser TW\AppData\Roaming\qBittorrent
2016-03-20 13:56 - 2015-07-13 15:02 - 00001164 _____ C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Google Chrome.lnk
2016-03-20 13:43 - 2015-08-19 03:40 - 00000000 ____D C:\ProgramData\HitmanPro
2016-03-20 13:36 - 2009-07-14 17:46 - 00000000 ____D C:\Windows\RemotePackages
2016-03-20 12:57 - 2009-07-14 13:20 - 00000000 ____D C:\Windows\LiveKernelReports
2016-03-20 11:22 - 2015-07-13 16:36 - 00000000 ____D C:\Program Files (x86)\Microsoft Office
2016-03-20 11:22 - 2009-07-14 13:20 - 00000000 ____D C:\Program Files\Common Files\Microsoft Shared
2016-03-20 11:11 - 2015-07-16 09:42 - 00001511 _____ C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Adobe ExtendScript Toolkit CS6.lnk
2016-03-20 11:11 - 2015-07-16 09:42 - 00001345 _____ C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Adobe Extension Manager CS6.lnk
2016-03-20 11:11 - 2015-07-16 09:42 - 00001199 _____ C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Adobe Photoshop CS6.lnk
2016-03-20 11:11 - 2015-07-16 09:42 - 00001161 _____ C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Adobe Bridge CS6.lnk
2016-03-20 11:11 - 2015-07-16 09:42 - 00001107 _____ C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Adobe Photoshop CS6 (64 Bit).lnk
2016-03-20 11:11 - 2015-07-16 09:42 - 00001069 _____ C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Adobe Bridge CS6 (64bit).lnk
2016-03-20 11:11 - 2015-07-14 06:43 - 00001333 _____ C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Media Center.lnk
2016-03-20 11:11 - 2015-07-14 06:43 - 00001314 _____ C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Windows DVD Maker.lnk
2016-03-20 11:11 - 2015-07-14 00:04 - 00002429 _____ C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Acrobat Reader DC.lnk
2016-03-20 11:11 - 2015-07-13 15:07 - 00001105 _____ C:\ProgramData\Microsoft\Windows\Start Menu\Programs\foobar2000.lnk
2016-03-20 11:11 - 2015-07-13 13:50 - 00001393 _____ C:\Users\Chaser TW\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Internet Explorer.lnk
2016-03-20 11:11 - 2009-07-14 15:01 - 00001282 _____ C:\ProgramData\Microsoft\Windows\Start Menu\Default Programs.lnk
2016-03-20 11:11 - 2009-07-14 14:57 - 00001535 _____ C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Windows Media Player.lnk
2016-03-20 11:11 - 2009-07-14 14:57 - 00001318 _____ C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Sidebar.lnk
2016-03-20 11:11 - 2009-07-14 14:57 - 00001234 _____ C:\ProgramData\Microsoft\Windows\Start Menu\Programs\XPS Viewer.lnk
2016-03-20 11:11 - 2009-07-14 14:54 - 00001198 _____ C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Windows Fax and Scan.lnk
2016-03-20 11:11 - 2009-07-14 14:49 - 00001266 _____ C:\ProgramData\Microsoft\Windows\Start Menu\Windows Update.lnk
2016-03-20 11:10 - 2015-07-14 07:41 - 00000000 ____D C:\Windows\Panther
2016-03-20 11:09 - 2009-07-14 12:34 - 00000505 _____ C:\Windows\win.ini
2016-03-20 10:25 - 2009-07-14 13:20 - 00000000 ___HD C:\Windows\system32\GroupPolicy
2016-03-19 19:12 - 2009-07-14 15:32 - 00000000 ___RD C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Games
2016-03-19 18:57 - 2009-07-14 15:09 - 00000000 ____D C:\Windows\System32\Tasks\WPD
2016-03-10 18:00 - 2009-07-14 13:20 - 00000000 ____D C:\Windows\rescache
2016-03-10 01:25 - 2015-07-13 15:25 - 00000000 ____D C:\Windows\system32\MRT
2016-03-10 01:23 - 2015-07-16 16:32 - 00000000 ____D C:\Windows\system32\appraiser
2016-03-10 01:23 - 2015-07-13 15:25 - 143659408 _____ (Microsoft Corporation) C:\Windows\system32\MRT.exe
2016-03-08 23:39 - 2015-11-13 07:00 - 00000000 ____D C:\Program Files (x86)\Epson Software
2016-03-08 23:39 - 2015-11-13 07:00 - 00000000 ____D C:\Program Files (x86)\epson
2016-03-08 16:21 - 2009-07-14 15:08 - 00032604 _____ C:\Windows\Tasks\SCHEDLGU.TXT
2016-03-01 15:32 - 2015-07-13 14:16 - 00000000 ____D C:\ProgramData\Package Cache
 
==================== Files in the root of some directories =======
 
2016-03-19 19:08 - 2016-03-19 19:08 - 0127488 _____ () C:\Users\Chaser TW\AppData\Roaming\Installer.dat
2016-03-20 11:05 - 2016-03-20 11:05 - 0000044 _____ () C:\Users\Chaser TW\AppData\Roaming\WB.CFG
2008-02-05 14:28 - 2008-02-05 14:28 - 0000051 _____ () C:\Users\Chaser TW\AppData\Local\setup.txt
 
Some files in TEMP:
====================
C:\Users\Chaser TW\AppData\Local\Temp\dllnt_dump.dll
C:\Users\Chaser TW\AppData\Local\Temp\HitmanPro.exe
C:\Users\Chaser TW\AppData\Local\Temp\sqlite3.dll
C:\Users\Chaser TW\AppData\Local\Temp\_is387E.exe
 
 
==================== Bamital & volsnap =================
 
(There is no automatic fix for files that do not pass verification.)
 
C:\Windows\system32\winlogon.exe => File is digitally signed
C:\Windows\system32\wininit.exe => File is digitally signed
C:\Windows\SysWOW64\wininit.exe => File is digitally signed
C:\Windows\explorer.exe => File is digitally signed
C:\Windows\SysWOW64\explorer.exe => File is digitally signed
C:\Windows\system32\svchost.exe => File is digitally signed
C:\Windows\SysWOW64\svchost.exe => File is digitally signed
C:\Windows\system32\services.exe => File is digitally signed
C:\Windows\system32\User32.dll => File is digitally signed
C:\Windows\SysWOW64\User32.dll => File is digitally signed
C:\Windows\system32\userinit.exe => File is digitally signed
C:\Windows\SysWOW64\userinit.exe => File is digitally signed
C:\Windows\system32\rpcss.dll => File is digitally signed
C:\Windows\system32\dnsapi.dll => File is digitally signed
C:\Windows\SysWOW64\dnsapi.dll => File is digitally signed
C:\Windows\system32\Drivers\volsnap.sys => File is digitally signed
 
 
LastRegBack: 2016-03-19 14:29
 
==================== End of FRST.txt ============================

Attached Files


Edited by Spirit02, 24 March 2016 - 03:06 PM.


BC AdBot (Login to Remove)

 


#2 nasdaq

nasdaq

  • Malware Response Team
  • 39,946 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:Montreal, QC. Canada
  • Local time:03:41 AM

Posted 25 March 2016 - 07:02 AM

Hello, Welcome to BleepingComputer.
I'm nasdaq and will be helping you.

If you can please print this topic it will make it easier for you to follow the instructions and complete all of the necessary steps in the order listed.
===

Press the windows key Windows_Logo_key.gif+ r on your keyboard at the same time. This will open the RUN BOX.
Type Notepad and and click the OK key.

Please copy the entire contents of the code box below to the a new file.
 
Start

CreateRestorePoint:
EmptyTemp:
CloseProcesses:

HKU\S-1-5-21-4272222158-3063515441-3191840995-1000\...\Run: [BingSvc] => C:\Users\Chaser TW\AppData\Local\Microsoft\BingSvc\BingSvc.exe
CHR HKLM\SOFTWARE\Policies\Google: Restriction <======= ATTENTION
HKLM\SOFTWARE\Policies\Microsoft\Internet Explorer: Restriction <======= ATTENTION
HKU\S-1-5-21-4272222158-3063515441-3191840995-1000\SOFTWARE\Policies\Microsoft\Internet Explorer: Restriction <======= ATTENTION
FF Plugin: @microsoft.com/GENUINE -> disabled [No File]
FF Plugin-x32: @microsoft.com/GENUINE -> disabled [No File]
CHR DefaultSearchURL: Default -> hxxp://www-searching.com/search.aspx?s=G3Jzgutbl343BA,919cc3da-5636-4318-8ef4-7bf66a5013f8,&prd=smw&q={searchTerms}
CHR DefaultSearchKeyword: Default -> www-searching.com
CHR DefaultSuggestURL: Default -> hxxp://api.searchpredict.com/api/?rqtype=ffplugin&siteID=8661&dbCode=1&command={searchTerms}
CHR Extension: (Chrome Web Store Payments) - C:\Users\Chaser TW\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda [2015-07-25]
S3 catchme; \??\C:\ComboFix\catchme.sys [X]
S0 hitmanpro37duringboot; system32\drivers\hitmanpro37.sys [X]
S3 Synth3dVsc; System32\drivers\synth3dvsc.sys [X]
S3 tsusbhub; system32\drivers\tsusbhub.sys [X]
S3 VGPU; System32\drivers\rdvgkmd.sys [X]
S1 ZAM; \??\C:\Windows\System32\drivers\zam64.sys [X]
S1 ZAM_Guard; \??\C:\Windows\System32\drivers\zamguard64.sys [X]
C:\Users\Chaser TW\AppData\Local\Microsoft\BingSvc
C:\Users\Chaser TW\AppData\Local\Temp\_is387E.exe
Task: {7AA144E6-DA3B-4503-9BA6-C74FA639B625} - \Advanced PC Care_Logon -> No File <==== ATTENTION
Task: {859F81F1-CEAD-4758-9C67-4E1173210B39} - \osTip -> No File <==== ATTENTION
End
Save the file as fixlist.txt in the same folder where the Farbar tool is running from.
The location is listed in the 3rd line of the Farbar log you have submitted.

Run FRST and click Fix only once and wait.

Restart the computer normally to reset the registry.

The tool will create a log (Fixlog.txt) please post it to your reply.
---

Reset Chrome...
Open Google Chrome, click on menu icon google-chrome-setting-icon.png which is located right side top of the google chrome.
 
Click "Settings" then "Show advanced settings" at the bottom of the screen.
 
Click "Reset browser settings" button.
 
Clear your cache and cookies
https://support.google.com/chromebook/answer/183083?hl=en

Restart Chrome.

====

Please let me know what problem persists with this computer.

#3 nasdaq

nasdaq

  • Malware Response Team
  • 39,946 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:Montreal, QC. Canada
  • Local time:03:41 AM

Posted 30 March 2016 - 08:18 AM

Due to the lack of feedback, this topic is now closed.

In the event you still have problems, please send me or any Moderator a Private Message and ask them to reopen this topic within the next 5 days.

Please include a link to your topic in the Private Message. Thank you.




0 user(s) are reading this topic

0 members, 0 guests, 0 anonymous users