Jump to content


 


Register a free account to unlock additional features at BleepingComputer.com
Welcome to BleepingComputer, a free community where people like yourself come together to discuss and learn how to use their computers. Using the site is easy and fun. As a guest, you can browse and view the various discussions in the forums, but can not create a new topic or reply to an existing one unless you are logged in. Other benefits of registering an account are subscribing to topics and forums, creating a blog, and having no ads shown anywhere on the site.


Click here to Register a free account now! or read our Welcome Guide to learn how to use this site.

Photo

HIGHJACK THIS LOG NEWLY FORMATTED MACHINE BADLY INFECTED


  • This topic is locked This topic is locked
22 replies to this topic

#1 looney2340

looney2340

  • Members
  • 202 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:NYC
  • Local time:06:13 PM

Posted 09 July 2016 - 10:31 PM

Hi everyone,

I am using a newly formatted machine ( week old ) and hard drive running windows 10. In the process of setting up machine i hit on something really big. It installed many programs that i did uninstall but my virus scan keeps finding things as well as malwarebytes as many as 125 infections which it cleaned but when rerun keeps finding other things. It affected fire fox saying the link is invalid unable to start it i tried to download it again and re install but it says set up was interrupted and stops. Below is my log and as you can see there is a lot in it for a machine about a week formatted. I keep deleting the file missing entries but when i scan again they still show up.

This is the file avast keeps finding as infected and stops the execution.

 

C:\Windows\SysWOW64\

 

Thanks for  your help.

 

 

 

Logfile of Trend Micro HijackThis v2.0.5
Scan saved at 10:56:11 PM, on 7/9/2016
Platform: Unknown Windows (WinNT 6.02.1008)
MSIE: Internet Explorer v11.0 (11.00.10586.0420)
 
FIREFOX: 47.0 (x86 en-US)
Boot mode: Normal
 
Running processes:
C:\Program Files\WindowsApps\Microsoft.Messaging_2.15.20002.0_x86__8wekyb3d8bbwe\SkypeHost.exe
C:\Windows\System32\spool\drivers\x64\3\WrtMon.exe
C:\Program Files\AVAST Software\Avast\AvastUI.exe
C:\Windows\System32\spool\drivers\x64\3\WrtProc.exe
C:\Users\Hank\Desktop\New folder\HijackThis.exe
 
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/p/?LinkId=255141
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/p/?LinkId=255141
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/p/?LinkId=255141
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant = 
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch = 
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page = %11%\blank.htm
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Local Page = C:\Windows\SysWOW64\blank.htm
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = 
O4 - HKLM\..\Run: [AvastUI.exe] "C:\Program Files\AVAST Software\Avast\AvastUI.exe" /nogui
O4 - HKCU\..\Run: [OneDrive] "C:\Users\Hank\AppData\Local\Microsoft\OneDrive\OneDrive.exe" /background
O4 - HKUS\S-1-5-19\..\Run: [OneDriveSetup] C:\Windows\SysWOW64\OneDriveSetup.exe /thfirstsetup (User 'LOCAL SERVICE')
O4 - HKUS\S-1-5-20\..\Run: [OneDriveSetup] C:\Windows\SysWOW64\OneDriveSetup.exe /thfirstsetup (User 'NETWORK SERVICE')
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\Program Files (x86)\Microsoft Office\Root\Office16\EXCEL.EXE/3000
O11 - Options group: [ACCELERATED_GRAPHICS] Accelerated graphics
O18 - Protocol: mso-minsb-roaming.16 - {83C25742-A9F7-49FB-9138-434302C88D07} - C:\Program Files (x86)\Microsoft Office\root\Office16\MSOSB.DLL
O18 - Protocol: mso-minsb.16 - {42089D2D-912D-4018-9087-2B87803E93FB} - C:\Program Files (x86)\Microsoft Office\root\Office16\MSOSB.DLL
O18 - Protocol: osf-roaming.16 - {42089D2D-912D-4018-9087-2B87803E93FB} - C:\Program Files (x86)\Microsoft Office\root\Office16\MSOSB.DLL
O18 - Protocol: osf.16 - {5504BE45-A83B-4808-900A-3A5C36E7F77A} - C:\Program Files (x86)\Microsoft Office\root\Office16\MSOSB.DLL
O18 - Protocol: tbauth - {14654CA6-5711-491D-B89A-58E571679951} - C:\Windows\SysWOW64\tbauth.dll
O18 - Protocol: windows.tbauth - {14654CA6-5711-491D-B89A-58E571679951} - C:\Windows\SysWOW64\tbauth.dll
O23 - Service: @%SystemRoot%\system32\Alg.exe,-112 (ALG) - Unknown owner - C:\Windows\System32\alg.exe (file missing)
O23 - Service: Avast Antivirus (avast! Antivirus) - AVAST Software - C:\Program Files\AVAST Software\Avast\AvastSvc.exe
O23 - Service: @%SystemRoot%\system32\DiagSvcs\DiagnosticsHub.StandardCollector.ServiceRes.dll,-1000 (diagnosticshub.standardcollector.service) - Unknown owner - C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe (file missing)
O23 - Service: @%SystemRoot%\system32\efssvc.dll,-100 (EFS) - Unknown owner - C:\Windows\System32\lsass.exe (file missing)
O23 - Service: @%systemroot%\system32\fxsresm.dll,-118 (Fax) - Unknown owner - C:\Windows\system32\fxssvc.exe (file missing)
O23 - Service: @%SystemRoot%\system32\ieetwcollectorres.dll,-1000 (IEEtwCollectorService) - Unknown owner - C:\Windows\system32\IEEtwCollector.exe (file missing)
O23 - Service: @keyiso.dll,-100 (KeyIso) - Unknown owner - C:\Windows\system32\lsass.exe (file missing)
O23 - Service: Mozilla Maintenance Service (MozillaMaintenance) - Mozilla Foundation - C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
O23 - Service: @comres.dll,-2797 (MSDTC) - Unknown owner - C:\Windows\System32\msdtc.exe (file missing)
O23 - Service: @%SystemRoot%\System32\netlogon.dll,-102 (Netlogon) - Unknown owner - C:\Windows\system32\lsass.exe (file missing)
O23 - Service: NitroPDFReaderDriverCreatorReadSpool3 (NitroReaderDriverReadSpool3) - Nitro PDF Software - C:\Program Files\Common Files\Nitro\Reader\3.0\NitroPDFReaderDriverService3x64.exe
O23 - Service: @%systemroot%\system32\Locator.exe,-2 (RpcLocator) - Unknown owner - C:\Windows\system32\locator.exe (file missing)
O23 - Service: @%SystemRoot%\system32\samsrv.dll,-1 (SamSs) - Unknown owner - C:\Windows\system32\lsass.exe (file missing)
O23 - Service: @%SystemRoot%\system32\SensorDataService.exe,-101 (SensorDataService) - Unknown owner - C:\Windows\System32\SensorDataService.exe (file missing)
O23 - Service: @%SystemRoot%\system32\snmptrap.exe,-3 (SNMPTRAP) - Unknown owner - C:\Windows\System32\snmptrap.exe (file missing)
O23 - Service: @%systemroot%\system32\spoolsv.exe,-1 (Spooler) - Unknown owner - C:\Windows\System32\spoolsv.exe (file missing)
O23 - Service: @%SystemRoot%\system32\sppsvc.exe,-101 (sppsvc) - Unknown owner - C:\Windows\system32\sppsvc.exe (file missing)
O23 - Service: @%SystemRoot%\system32\TieringEngineService.exe,-702 (TieringEngineService) - Unknown owner - C:\Windows\system32\TieringEngineService.exe (file missing)
O23 - Service: @%SystemRoot%\system32\ui0detect.exe,-101 (UI0Detect) - Unknown owner - C:\Windows\system32\UI0Detect.exe (file missing)
O23 - Service: @%SystemRoot%\system32\vaultsvc.dll,-1003 (VaultSvc) - Unknown owner - C:\Windows\system32\lsass.exe (file missing)
O23 - Service: @%SystemRoot%\system32\vds.exe,-100 (vds) - Unknown owner - C:\Windows\System32\vds.exe (file missing)
O23 - Service: @%systemroot%\system32\vssvc.exe,-102 (VSS) - Unknown owner - C:\Windows\system32\vssvc.exe (file missing)
O23 - Service: @%systemroot%\system32\wbengine.exe,-104 (wbengine) - Unknown owner - C:\Windows\system32\wbengine.exe (file missing)
O23 - Service: @%ProgramFiles%\Windows Defender\MpAsDesc.dll,-320 (WdNisSvc) - Unknown owner - C:\Program Files (x86)\Windows Defender\NisSrv.exe (file missing)
O23 - Service: @%ProgramFiles%\Windows Defender\MpAsDesc.dll,-310 (WinDefend) - Unknown owner - C:\Program Files (x86)\Windows Defender\MsMpEng.exe (file missing)
O23 - Service: @%Systemroot%\system32\wbem\wmiapsrv.exe,-110 (wmiApSrv) - Unknown owner - C:\Windows\system32\wbem\WmiApSrv.exe (file missing)
O23 - Service: @%PROGRAMFILES%\Windows Media Player\wmpnetwk.exe,-101 (WMPNetworkSvc) - Unknown owner - C:\Program Files (x86)\Windows Media Player\wmpnetwk.exe (file missing)
 
--
End of file - 6931 bytes
 


BC AdBot (Login to Remove)

 


#2 nasdaq

nasdaq

  • Malware Response Team
  • 38,559 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:Montreal, QC. Canada
  • Local time:07:13 PM

Posted 10 July 2016 - 08:23 AM

Hello, Welcome to BleepingComputer.
I'm nasdaq and will be helping you.

If you can please print this topic it will make it easier for you to follow the instructions and complete all of the necessary steps in the order listed.
===

I need more information.

Download the version of this tool for your operating system.
Farbar Recovery Scan Tool (64 bit)
Farbar Recovery Scan Tool (32 bit)
and save it to a folder on your computer's Desktop.
Double-click to run it. When the tool opens click Yes to disclaimer.
Press Scan button.
It will make a log (FRST.txt) in the same directory the tool is run. Please copy and paste it to your reply.
The first time the tool is run, it makes also another log (Addition.txt). Please attach it to your reply.

How to attach a file to your reply:
In the Reply section in the bottom of the topic Click the "more reply Options" button.
attachlogs.png

Attach the file.
Select the "Choose a File" navigate to the location of the File.
Click the file you wish to Attach.

Click the Add reply button.
===


Please post the logs and wait for further instructions.

p.s.
HijackThis is no longer supported.
I suggest your remove via the Control panel > Programs > Programs and Features Applet.
Use the Farbar tool from now on to report problems.
<<<>>>

#3 looney2340

looney2340
  • Topic Starter

  • Members
  • 202 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:NYC
  • Local time:06:13 PM

Posted 10 July 2016 - 07:44 PM

Hi and thanks for the fast reply. Below is my log and attached is my other log.

 

 

 

 

Scan result of Farbar Recovery Scan Tool (FRST) (x64) Version: 10-07-2016 01
Ran by Hank (administrator) on DESKTOP-MOPCK7C (10-07-2016 20:31:22)
Running from C:\Users\Hank\Downloads
Loaded Profiles: Hank (Available Profiles: Hank)
Platform: Windows 10 Home Version 1511 (X64) Language: English (United States)
Internet Explorer Version 11 (Default browser: Edge)
Boot Mode: Normal
Tutorial for Farbar Recovery Scan Tool: http://www.geekstogo.com/forum/topic/335081-frst-tutorial-how-to-use-farbar-recovery-scan-tool/
 
==================== Processes (Whitelisted) =================
 
(If an entry is included in the fixlist, the process will be closed. The file will not be moved.)
 
(AVAST Software) C:\Program Files\AVAST Software\Avast\AvastSvc.exe
(@ByELDI) C:\Program Files\KMSpico\Service_KMS.exe
(Nitro PDF Software) C:\Program Files\Common Files\Nitro\Reader\3.0\NitroPDFReaderDriverService3x64.exe
(Microsoft Corporation) C:\Program Files\Microsoft SQL Server\90\Shared\sqlwriter.exe
(Microsoft Corporation) C:\Program Files (x86)\Common Files\Microsoft Shared\Phone Tools\CoreCon\11.0\bin\IpOverUsbSvc.exe
(Microsoft Corporation) C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeClickToRun.exe
() C:\Program Files\WindowsApps\Microsoft.Messaging_2.15.20002.0_x86__8wekyb3d8bbwe\SkypeHost.exe
(Microsoft Corporation) C:\Windows\System32\dllhost.exe
(Synaptics, Inc.) C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
(CANON INC.) C:\Program Files\Canon\Canon MF Network Scan Utility\CNMFSUT6.EXE
(Synaptics, Inc.) C:\Program Files\Synaptics\SynTP\SynToshiba.exe
() C:\Windows\System32\spool\drivers\x64\3\WrtMon.exe
(Synaptics, Inc.) C:\Program Files\Synaptics\SynTP\SynTPHelper.exe
() C:\Windows\System32\spool\drivers\x64\3\WrtProc.exe
(AVAST Software) C:\Program Files\AVAST Software\Avast\AvastUI.exe
(Microsoft Corporation) C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdge.exe
(Microsoft Corporation) C:\Windows\System32\browser_broker.exe
(Microsoft Corporation) C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
(Microsoft Corporation) C:\Windows\ImmersiveControlPanel\SystemSettings.exe
(Microsoft Corporation) C:\Program Files\WindowsApps\Microsoft.WindowsStore_11602.1.26.0_x64__8wekyb3d8bbwe\WinStore.Mobile.exe
 

==================== Registry (Whitelisted) ===========================
 
(If an entry is included in the fixlist, the registry item will be restored to default or removed. The file will not be moved.)
 
HKLM\...\Run: [SynTPEnh] => C:\Program Files\Synaptics\SynTP\SynTPEnh.exe [1533736 2008-06-20] (Synaptics, Inc.)
HKLM\...\Run: [MFNetworkScanUtility] => C:\Program Files\Canon\Canon MF Network Scan Utility\CNMFSUT6.EXE [486552 2012-09-26] (CANON INC.)
HKLM\...\Run: [WrtMon.exe] => C:\Windows\system32\spool\drivers\x64\3\WrtMon.exe [20480 2006-09-20] ()
HKLM-x32\...\Run: [AvastUI.exe] => C:\Program Files\AVAST Software\Avast\AvastUI.exe [8897712 2016-06-29] (AVAST Software)
HKU\S-1-5-21-1912047634-4237204969-221734255-1001\...\MountPoints2: {2e417251-367f-11e6-8034-001b381bc345} - "E:\LaunchU3.exe" -a
HKU\S-1-5-21-1912047634-4237204969-221734255-1001\...\MountPoints2: {4e9427b3-2b6c-11e6-802a-806e6f6e6963} - "D:\OInstall.exe"
ShellIconOverlayIdentifiers: [ SkyDrivePro1 (ErrorConflict)] -> {8BA85C75-763B-4103-94EB-9470F12FE0F7} => C:\Program Files (x86)\Microsoft Office\root\VFS\ProgramFilesX64\Microsoft Office\Office16\GROOVEEX.DLL No File
ShellIconOverlayIdentifiers: [ SkyDrivePro2 (SyncInProgress)] -> {CD55129A-B1A1-438E-A425-CEBC7DC684EE} => C:\Program Files (x86)\Microsoft Office\root\VFS\ProgramFilesX64\Microsoft Office\Office16\GROOVEEX.DLL No File
ShellIconOverlayIdentifiers: [ SkyDrivePro3 (InSync)] -> {E768CD3B-BDDC-436D-9C13-E1B39CA257B1} => C:\Program Files (x86)\Microsoft Office\root\VFS\ProgramFilesX64\Microsoft Office\Office16\GROOVEEX.DLL No File
ShellIconOverlayIdentifiers: [00avast] -> {472083B0-C522-11CF-8763-00608CC02F24} => C:\Program Files\AVAST Software\Avast\ashShA64.dll [2016-06-29] (AVAST Software)
 
==================== Internet (Whitelisted) ====================
 
(If an item is included in the fixlist, if it is a registry item it will be removed or restored to default.)
 
AutoConfigURL: [S-1-5-21-1912047634-4237204969-221734255-1001] => hxxp://stop-block.net/wpad.dat?05ef45486509d17ae4d4bf25d3366a9712629225
Hosts: There are more than one entry in Hosts. See Hosts section of Addition.txt
Tcpip\Parameters: [DhcpNameServer] 192.168.1.1
Tcpip\..\Interfaces\{a2102fec-7098-4df4-ae3c-7f7b267dc1cb}: [DhcpNameServer] 192.168.1.1
 
Internet Explorer:
==================
HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Start Page = hxxp://www.msn.com/
HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Search Page =
HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Default_Page_URL =
HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Default_Search_URL =
BHO-x32: Lync Browser Helper -> {31D09BA0-12F5-4CCE-BE8A-2923E76605DA} -> C:\Program Files\Microsoft Office\root\VFS\ProgramFilesX86\Microsoft Office\Office16\OCHelper.dll [2016-07-10] (Microsoft Corporation)
BHO-x32: Microsoft OneDrive for Business Browser Helper -> {D0498E0A-45B7-42AE-A9AA-ABA463DBD3BF} -> C:\Program Files\Microsoft Office\root\VFS\ProgramFilesX86\Microsoft Office\Office16\GROOVEEX.DLL [2016-07-10] (Microsoft Corporation)
Handler: mk - a0;ImkTMTbQAWXZsgUEpO?_[cqQDNcNHdXVv!fWK -  No File
Handler: mso-minsb-roaming.16 - {83C25742-A9F7-49FB-9138-434302C88D07} - C:\Program Files\Microsoft Office\root\Office16\MSOSB.DLL [2016-07-10] (Microsoft Corporation)
Handler-x32: mso-minsb-roaming.16 - {83C25742-A9F7-49FB-9138-434302C88D07} - C:\Program Files\Microsoft Office\root\VFS\ProgramFilesX86\Microsoft Office\Office16\MSOSB.DLL [2016-07-10] (Microsoft Corporation)
Handler: mso-minsb.16 - {42089D2D-912D-4018-9087-2B87803E93FB} - C:\Program Files\Microsoft Office\root\Office16\MSOSB.DLL [2016-07-10] (Microsoft Corporation)
Handler-x32: mso-minsb.16 - {42089D2D-912D-4018-9087-2B87803E93FB} - C:\Program Files\Microsoft Office\root\VFS\ProgramFilesX86\Microsoft Office\Office16\MSOSB.DLL [2016-07-10] (Microsoft Corporation)
Handler: osf-roaming.16 - {42089D2D-912D-4018-9087-2B87803E93FB} - C:\Program Files\Microsoft Office\root\Office16\MSOSB.DLL [2016-07-10] (Microsoft Corporation)
Handler-x32: osf-roaming.16 - {42089D2D-912D-4018-9087-2B87803E93FB} - C:\Program Files\Microsoft Office\root\VFS\ProgramFilesX86\Microsoft Office\Office16\MSOSB.DLL [2016-07-10] (Microsoft Corporation)
Handler: osf.16 - {5504BE45-A83B-4808-900A-3A5C36E7F77A} - C:\Program Files\Microsoft Office\root\Office16\MSOSB.DLL [2016-07-10] (Microsoft Corporation)
Handler-x32: osf.16 - {5504BE45-A83B-4808-900A-3A5C36E7F77A} - C:\Program Files\Microsoft Office\root\VFS\ProgramFilesX86\Microsoft Office\Office16\MSOSB.DLL [2016-07-10] (Microsoft Corporation)
 
FireFox:
========
FF ProfilePath: C:\Users\Hank\AppData\Roaming\Mozilla\Firefox\Profiles\mn1qzjiu.default
FF Plugin: @microsoft.com/SharePoint,version=14.0 -> C:\Program Files\Microsoft Office\root\Office16\NPSPWRAP.DLL [2016-07-10] (Microsoft Corporation)
FF Plugin-x32: @Microsoft.com/NpCtrl,version=1.0 -> c:\Program Files (x86)\Microsoft Silverlight\5.1.30514.0\npctrl.dll [2014-05-13] ( Microsoft Corporation)
FF Plugin-x32: @microsoft.com/SharePoint,version=14.0 -> C:\Program Files\Microsoft Office\root\VFS\ProgramFilesX86\Microsoft Office\Office16\NPSPWRAP.DLL [2016-07-10] (Microsoft Corporation)
FF Plugin-x32: @nitropdf.com/NitroPDF -> C:\Program Files (x86)\Nitro\Reader 3\npnitromozilla.dll [2013-07-26] (Nitro PDF)
FF HKLM\...\Firefox\Extensions: [wrc@avast.com] - C:\Program Files\AVAST Software\Avast\WebRep\FF
FF Extension: Avast Online Security - C:\Program Files\AVAST Software\Avast\WebRep\FF [2016-07-01]
FF HKLM\...\Firefox\Extensions: [sp@avast.com] - C:\Program Files\AVAST Software\Avast\SafePrice\FF
FF Extension: Avast SafePrice - C:\Program Files\AVAST Software\Avast\SafePrice\FF [2016-07-01]
FF HKLM-x32\...\Firefox\Extensions: [wrc@avast.com] - C:\Program Files\AVAST Software\Avast\WebRep\FF
FF HKLM-x32\...\Firefox\Extensions: [sp@avast.com] - C:\Program Files\AVAST Software\Avast\SafePrice\FF
 
==================== Services (Whitelisted) ========================
 
(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)
 
R2 avast! Antivirus; C:\Program Files\AVAST Software\Avast\AvastSvc.exe [197128 2016-06-29] (AVAST Software)
R2 ClickToRunSvc; C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe [2944768 2016-06-10] (Microsoft Corporation)
R2 IpOverUsbSvc; C:\Program Files (x86)\Common Files\Microsoft Shared\Phone Tools\CoreCon\11.0\bin\IpOverUsbSvc.exe [21184 2016-03-29] (Microsoft Corporation)
R2 NitroReaderDriverReadSpool3; C:\Program Files\Common Files\Nitro\Reader\3.0\NitroPDFReaderDriverService3x64.exe [230416 2013-07-26] (Nitro PDF Software)
R2 Service KMSELDI; C:\Program Files\KMSpico\Service_KMS.exe [735936 2015-08-16] (@ByELDI) [File not signed]
S3 Te.Service; C:\Program Files (x86)\Windows Kits\10\Testing\Runtimes\TAEF\Wex.Services.exe [137216 2016-03-29] (Microsoft Corporation) [File not signed]
S3 VsEtwService120; C:\Program Files (x86)\Microsoft Visual Studio 12.0\Common7\Packages\Debugger\Services\VsEtwService.exe [89232 2014-07-22] (Microsoft Corporation)
S3 VSStandardCollectorService140; C:\Program Files (x86)\Microsoft Visual Studio 14.0\Team Tools\DiagnosticsHub\Collector\StandardCollector.Service.exe [56552 2016-03-22] (Microsoft Corporation)
S3 WdNisSvc; C:\Program Files\Windows Defender\NisSrv.exe [364464 2015-10-30] (Microsoft Corporation)
S3 WinDefend; C:\Program Files\Windows Defender\MsMpEng.exe [24864 2015-10-30] (Microsoft Corporation)
 
===================== Drivers (Whitelisted) ==========================
 
(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)
 
R2 aswHwid; C:\Windows\system32\drivers\aswHwid.sys [37656 2016-06-29] (AVAST Software)
R1 aswKbd; C:\Windows\system32\drivers\aswKbd.sys [37144 2016-06-29] (AVAST Software)
R2 aswMonFlt; C:\Windows\system32\drivers\aswMonFlt.sys [108304 2016-06-29] (AVAST Software)
R1 aswRdr; C:\Windows\system32\drivers\aswRdr2.sys [103064 2016-06-29] (AVAST Software)
R0 aswRvrt; C:\Windows\System32\Drivers\aswRvrt.sys [74544 2016-06-29] (AVAST Software)
R1 aswSnx; C:\Windows\system32\drivers\aswSnx.sys [1070904 2016-06-29] (AVAST Software)
R1 aswSP; C:\Windows\system32\drivers\aswSP.sys [473592 2016-06-29] (AVAST Software)
R2 aswStm; C:\Windows\system32\drivers\aswStm.sys [162904 2016-06-29] (AVAST Software)
R0 aswVmm; C:\Windows\System32\Drivers\aswVmm.sys [290088 2016-06-29] (AVAST Software)
R3 athr; C:\Windows\System32\drivers\athw10x.sys [4342936 2015-09-22] (Qualcomm Atheros Communications, Inc.)
R3 rt640x64; C:\Windows\System32\drivers\rt640x64.sys [589824 2015-10-30] (Realtek                                            )
R3 SensorsSimulatorDriver; C:\Windows\system32\DRIVERS\WUDFRd.sys [216064 2015-10-30] (Microsoft Corporation)
R3 Thotkey; C:\Windows\System32\drivers\Thotkey.sys [45720 2015-12-31] (Toshiba Corporation)
U3 TrueSight; C:\Windows\System32\drivers\TrueSight.sys [24688 2016-07-09] ()
S3 WdBoot; C:\Windows\system32\drivers\WdBoot.sys [44568 2015-10-30] (Microsoft Corporation)
R0 WdFilter; C:\Windows\System32\drivers\WdFilter.sys [293216 2015-10-30] (Microsoft Corporation)
S3 WdNisDrv; C:\Windows\System32\Drivers\WdNisDrv.sys [118112 2015-10-30] (Microsoft Corporation)
S1 epp; \??\C:\Users\Hank\Desktop\New folder\bin64\epp.sys [X]
S3 MFE_RR; \??\C:\Users\Hank\AppData\Local\Temp\mfe_rr.sys [X]
 
==================== NetSvcs (Whitelisted) ===================
 
(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)
 

==================== One Month Created files and folders ========
 
(If an entry is included in the fixlist, the file/folder will be moved.)
 
2016-07-10 20:31 - 2016-07-10 20:32 - 00012108 _____ C:\Users\Hank\Downloads\FRST.txt
2016-07-10 20:30 - 2016-07-10 20:31 - 00000000 ____D C:\FRST
2016-07-10 20:30 - 2016-07-10 20:30 - 02390528 _____ (Farbar) C:\Users\Hank\Downloads\FRST64.exe
2016-07-10 18:48 - 2016-07-10 19:38 - 1180346299 _____ C:\Users\Hank\Downloads\MS Office 15.13.3 [Volume Licensed] (1).dmg
2016-07-10 18:45 - 2016-07-10 19:35 - 1180346299 _____ C:\Users\Hank\Downloads\MS Office 15.13.3 [Volume Licensed].dmg
2016-07-10 18:32 - 2016-07-10 19:03 - 2753500098 _____ C:\Users\Hank\Downloads\Microsoft Office (Full, Free, 2016).zip
2016-07-10 18:08 - 2016-07-10 18:08 - 19316456 _____ (Innovative Solutions ) C:\Users\Hank\Downloads\Advanced_Uninstaller11.exe
2016-07-10 17:50 - 2016-07-10 17:51 - 00000000 ____D C:\Program Files\KMSpico
2016-07-10 17:50 - 2016-07-10 17:50 - 00004608 _____ C:\Windows\SECOH-QAD.exe
2016-07-10 17:50 - 2016-07-10 17:50 - 00003584 _____ C:\Windows\SECOH-QAD.dll
2016-07-10 17:50 - 2016-07-10 17:50 - 00003474 _____ C:\Windows\System32\Tasks\AutoPico Daily Restart
2016-07-10 17:50 - 2010-12-05 22:16 - 00090112 _____ (Vestris Inc.) C:\Windows\system32\Vestris.ResourceLib.dll
2016-07-10 17:47 - 2016-07-10 18:02 - 00000000 ____D C:\Users\Hank\Downloads\Office 16
2016-07-10 17:32 - 2016-07-10 17:58 - 00356352 _____ C:\Users\Hank\Documents\Database1.accdb
2016-07-10 17:31 - 2015-11-11 08:08 - 00008336 _____ C:\Windows\system32\SppExtComObjPatcher.exe
2016-07-10 17:31 - 2014-05-24 20:36 - 00015360 _____ C:\Windows\system32\SppExtComObjHook.dll
2016-07-10 17:23 - 2016-07-10 17:23 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Microsoft Silverlight
2016-07-10 17:22 - 2016-07-10 17:22 - 00000000 ____D C:\Program Files (x86)\Microsoft Silverlight
2016-07-10 17:21 - 2016-07-10 17:21 - 05132288 _____ C:\Users\Hank\Downloads\Kmspico_Office_2016_Activator_Free_Download.iso
2016-07-10 17:03 - 2016-07-10 17:03 - 00000000 ____D C:\Program Files\Common Files\DESIGNER
2016-07-10 16:49 - 2016-07-10 16:49 - 00002451 _____ C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Word 2016.lnk
2016-07-10 16:49 - 2016-07-10 16:49 - 00002450 _____ C:\ProgramData\Microsoft\Windows\Start Menu\Programs\PowerPoint 2016.lnk
2016-07-10 16:49 - 2016-07-10 16:49 - 00002414 _____ C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Access 2016.lnk
2016-07-10 16:49 - 2016-07-10 16:49 - 00002413 _____ C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Excel 2016.lnk
2016-07-10 16:49 - 2016-07-10 16:49 - 00002407 _____ C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Outlook 2016.lnk
2016-07-10 16:49 - 2016-07-10 16:49 - 00002401 _____ C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Publisher 2016.lnk
2016-07-10 16:49 - 2016-07-10 16:49 - 00002393 _____ C:\ProgramData\Microsoft\Windows\Start Menu\Programs\OneNote 2016.lnk
2016-07-10 16:49 - 2016-07-10 16:49 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Microsoft Office 2016 Tools
2016-07-10 16:43 - 2016-07-10 19:15 - 00000000 ____D C:\Program Files\Microsoft Office
2016-07-10 16:43 - 2016-07-10 16:43 - 00000000 ____D C:\Program Files\Microsoft Office 15
2016-07-10 10:11 - 2016-07-10 10:11 - 00006884 _____ C:\Users\Hank\AppData\Local\census.cache
2016-07-10 10:11 - 2016-07-10 10:11 - 00000000 _____ C:\Users\Hank\AppData\Local\ars.cache
2016-07-10 00:37 - 2016-07-10 00:37 - 00000010 _____ C:\Users\Hank\AppData\Local\sponge.last.runtime.cache
2016-07-10 00:23 - 2016-07-10 19:14 - 00004164 _____ C:\Windows\System32\Tasks\User_Feed_Synchronization-{3B4C5E7F-5334-4C98-885C-130AFF7EA6F2}
2016-07-10 00:23 - 2016-07-10 00:23 - 00000000 ____D C:\Users\Hank\AppData\Roaming\Nitro PDF
2016-07-10 00:19 - 2016-07-10 00:19 - 00000036 _____ C:\Users\Hank\AppData\Local\housecall.guid.cache
2016-07-10 00:19 - 2015-12-24 09:03 - 00316168 _____ (Trend Micro Inc.) C:\Windows\system32\Drivers\tmcomm.sys
2016-07-10 00:04 - 2016-07-10 17:21 - 00001420 _____ C:\Users\Public\Desktop\Mozilla Firefox.lnk
2016-07-09 23:42 - 2016-07-09 23:46 - 00000000 ____D C:\Users\Hank\AppData\Local\SterJo Key Finder
2016-07-09 23:42 - 2005-04-15 19:58 - 01351392 _____ (Microsoft Corporation) C:\Windows\SysWOW64\comctl32.ocx
2016-07-09 22:47 - 2016-07-09 22:47 - 00262144 ____N C:\Windows\Minidump\070916-29078-01.dmp
2016-07-09 21:53 - 2016-07-09 21:53 - 00000112 ___RH C:\Users\Hank\Downloads\Stinger.opt
2016-07-09 21:31 - 2016-07-10 16:00 - 00000000 ____D C:\Users\Hank\AppData\Local\CrashDumps
2016-07-09 21:02 - 2016-07-09 21:02 - 00024688 _____ C:\Windows\system32\Drivers\TrueSight.sys
2016-07-09 21:01 - 2016-07-09 21:01 - 00000000 ____D C:\ProgramData\RogueKiller
2016-07-09 20:48 - 2016-07-10 10:42 - 00000000 ____D C:\ProgramData\Malwarebytes' Anti-Malware (portable)
2016-07-09 20:08 - 2016-07-10 00:56 - 00000000 ____D C:\Users\Hank\Desktop\New folder
2016-07-09 17:58 - 2016-07-10 15:57 - 00642146 _____ C:\Windows\ntbtlog.txt
2016-07-09 17:58 - 2016-07-10 15:55 - 00000214 _____ C:\Windows\Tasks\CreateExplorerShellUnelevatedTask.job
2016-07-09 17:52 - 2016-07-09 17:52 - 00262144 ____N C:\Windows\Minidump\070916-35250-01.dmp
2016-07-09 17:08 - 2016-07-09 17:08 - 00000000 ____D C:\Windows\system32\rog
2016-07-09 17:07 - 2016-07-09 18:02 - 00000000 ____D C:\Windows\system32\SSL
2016-07-09 17:07 - 2016-07-09 17:52 - 00003738 _____ C:\Windows\System32\Tasks\1ded083255147653035377f75c72529b
2016-07-09 17:07 - 2016-07-09 17:07 - 07101952 _____ C:\Users\Hank\AppData\Roaming\agent.dat
2016-07-09 17:07 - 2016-07-09 17:07 - 00018432 _____ C:\Users\Hank\AppData\Roaming\Main.dat
2016-07-09 17:06 - 2016-07-09 19:22 - 00000000 ____D C:\Users\Hank\AppData\Roaming\Inedkhhyg
2016-07-09 17:06 - 2016-07-09 17:06 - 00000000 ____D C:\Users\Hank\AppData\Roaming\Securid
2016-07-09 17:06 - 2016-07-09 17:06 - 00000000 ____D C:\Users\Hank\AppData\Local\Tempfolder
2016-07-09 17:05 - 2016-07-09 19:22 - 00000000 ____D C:\Users\Hank\AppData\Local\Apps\2.0
2016-07-09 17:05 - 2016-07-09 17:05 - 00128512 _____ C:\Users\Hank\AppData\Roaming\Installer.dat
2016-07-09 17:00 - 2016-07-10 17:33 - 00000000 ____D C:\Users\Hank\AppData\Local\MSfree Inc
2016-07-09 16:58 - 2016-07-09 17:02 - 00000984 _____ C:\Windows\SysWOW64\${LOGFILE}
2016-07-09 16:58 - 2016-07-09 16:54 - 00001006 _____ C:\Windows\system32\Drivers\etc\hp.bak
2016-07-09 16:01 - 2016-07-09 16:01 - 00000000 ____D C:\Users\Public\Documents\iSumsoft Product Key Finder
2016-07-09 15:21 - 2016-07-10 17:29 - 00000000 ____D C:\Users\Hank\Downloads\OFFICE ACTIVATION 2016
2016-07-03 09:02 - 2016-07-03 09:02 - 00262144 ____N C:\Windows\Minidump\070316-18109-01.dmp
2016-07-02 18:28 - 2016-07-03 11:46 - 00013824 ___SH C:\Users\Hank\Desktop\Thumbs.db
2016-07-02 17:54 - 2016-07-10 15:57 - 00192216 _____ (Malwarebytes) C:\Windows\system32\Drivers\MBAMSwissArmy.sys
2016-07-02 17:54 - 2016-07-10 10:52 - 00001188 _____ C:\Users\Public\Desktop\Malwarebytes Anti-Malware.lnk
2016-07-02 17:54 - 2016-07-02 17:54 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Malwarebytes Anti-Malware
2016-07-02 17:53 - 2016-07-10 00:12 - 00000000 ____D C:\Program Files (x86)\Malwarebytes Anti-Malware
2016-07-02 17:53 - 2016-07-09 20:48 - 00109272 _____ (Malwarebytes) C:\Windows\system32\Drivers\mbamchameleon.sys
2016-07-02 17:53 - 2016-07-02 17:53 - 00000000 ____D C:\ProgramData\Malwarebytes
2016-07-02 17:53 - 2016-03-10 14:09 - 00065408 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mwac.sys
2016-07-02 17:53 - 2016-03-10 14:08 - 00027008 _____ (Malwarebytes) C:\Windows\system32\Drivers\mbam.sys
2016-07-01 22:21 - 2016-07-01 22:21 - 00000000 ____D C:\Users\Hank\AppData\Local\CEF
2016-07-01 22:10 - 2016-06-29 23:28 - 00390984 _____ (AVAST Software) C:\Windows\system32\aswBoot.exe
2016-06-29 23:28 - 2016-06-29 23:28 - 00053208 _____ (AVAST Software) C:\Windows\avastSS.scr
2016-06-24 19:51 - 2016-06-24 19:51 - 00000000 ____D C:\Windows\System32\Tasks\Canon
2016-06-24 19:50 - 2016-06-24 19:50 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Canon MF8500C Series
2016-06-24 19:48 - 2016-06-24 19:48 - 00000264 _____ C:\Windows\setup.iss
2016-06-24 19:47 - 2001-09-10 18:05 - 00087392 _____ (Twain Working Group) C:\Windows\TWAIN.DLL
2016-06-24 19:47 - 2001-09-10 18:05 - 00069632 _____ (Twain Working Group) C:\Windows\Twunk_32.exe
2016-06-24 19:47 - 2001-09-10 18:05 - 00048560 _____ (Twain Working Group) C:\Windows\Twunk_16.exe
2016-06-24 19:46 - 2016-06-24 19:49 - 00000000 ____D C:\Program Files (x86)\Canon
2016-06-24 19:46 - 2016-06-24 19:46 - 00000000 ___HD C:\Windows\system32\CanonMF Uninstaller Information
2016-06-24 19:45 - 2016-06-24 19:51 - 00000000 ____D C:\Program Files\Canon
2016-06-24 19:45 - 2016-06-24 19:46 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Canon
2016-06-24 19:45 - 2012-09-26 13:37 - 00368640 _____ (CANON INC.) C:\Windows\system32\CNCC8500C.DLL
2016-06-24 19:45 - 2012-09-26 13:37 - 00189952 _____ (CANON INC.) C:\Windows\system32\CNCLSU45b.DLL
2016-06-24 19:45 - 2012-09-26 13:37 - 00152576 _____ (CANON INC.) C:\Windows\system32\CNCE8500C.DLL
2016-06-24 19:45 - 2012-09-26 13:37 - 00132096 _____ (CANON INC.) C:\Windows\system32\CNCLSD45b.DLL
2016-06-24 19:45 - 2012-09-26 13:37 - 00131584 _____ (CANON INC.) C:\Windows\system32\CNCL8500C.DLL
2016-06-24 19:45 - 2012-09-26 13:37 - 00118272 _____ (CANON INC.) C:\Windows\system32\CNCLSI45b.DLL
2016-06-24 19:45 - 2012-09-26 13:37 - 00118272 _____ (CANON INC.) C:\Windows\system32\CNCI8500C.DLL
2016-06-24 19:45 - 2012-09-26 13:37 - 00105472 _____ (CANON INC.) C:\Windows\system32\CNCLST45b.DLL
2016-06-24 19:45 - 2012-09-26 13:37 - 00090624 _____ (CANON INC.) C:\Windows\system32\CNCLSC45b.DLL
2016-06-24 19:45 - 2012-07-26 09:14 - 00000439 _____ C:\Windows\system32\CNCMFP45.INI
2016-06-24 19:44 - 2016-06-24 19:51 - 00000000 ____D C:\ProgramData\Canon
2016-06-24 19:44 - 2012-10-19 00:00 - 01367040 _____ (CANON INC.) C:\Windows\system32\cnnx0_flm.dll
2016-06-24 19:43 - 2012-08-09 12:59 - 01006080 _____ (CANON INC.) C:\Windows\system32\CNAS0MOK.DLL
2016-06-24 19:42 - 2012-09-26 01:02 - 00195584 _____ (CANON INC.) C:\Windows\system32\CNCENPR6.dll
2016-06-24 19:42 - 2012-09-26 01:02 - 00152064 _____ (CANON INC.) C:\Windows\SysWOW64\CNCENPM6.dll
2016-06-24 19:42 - 2012-09-26 01:02 - 00152064 _____ (CANON INC.) C:\Windows\system32\CNCENPM6.dll
2016-06-24 19:42 - 2012-09-26 01:02 - 00105984 _____ (CANON INC.) C:\Windows\system32\CNCENPU6.dll
2016-06-24 19:42 - 2009-06-11 09:47 - 00017879 _____ C:\Windows\system32\CNCENPMU.chm
2016-06-24 15:07 - 2016-06-24 15:07 - 00000000 ____D C:\Users\Hank\AppData\Roaming\FileOpen
2016-06-24 15:07 - 2016-06-24 15:07 - 00000000 ____D C:\ProgramData\FileOpen
2016-06-24 15:07 - 2013-07-26 06:48 - 00029712 _____ (Nitro PDF Software) C:\Windows\system32\nitrolocalmon2.dll
2016-06-24 15:07 - 2013-07-26 06:48 - 00017936 _____ (Nitro PDF Software) C:\Windows\system32\nitrolocalui2.dll
2016-06-24 15:06 - 2016-07-09 19:37 - 00002503 _____ C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Nitro Reader 3.lnk
2016-06-24 15:06 - 2016-07-09 19:37 - 00002070 _____ C:\Users\Public\Desktop\Nitro Reader.lnk
2016-06-24 15:06 - 2016-06-24 15:06 - 00000000 ____D C:\Program Files\Common Files\Nitro
2016-06-24 15:06 - 2016-06-24 15:06 - 00000000 ____D C:\Program Files (x86)\Nitro
2016-06-21 00:02 - 2016-07-09 18:04 - 00000000 ____D C:\Users\Hank\AppData\Local\ElevatedDiagnostics
2016-06-19 20:34 - 2016-06-20 23:56 - 00000000 ____D C:\Users\Hank\AppData\Roaming\Nitro
2016-06-19 20:33 - 2016-06-19 20:33 - 00000000 ____D C:\ProgramData\Nitro
2016-06-19 20:30 - 2016-06-24 15:06 - 00000000 ____D C:\Users\Hank\AppData\Roaming\Downloaded Installations
2016-06-16 20:40 - 2016-05-28 02:13 - 01401024 _____ (Microsoft Corporation) C:\Windows\system32\appraiser.dll
2016-06-16 20:40 - 2016-05-28 02:13 - 00046784 _____ (Microsoft Corporation) C:\Windows\system32\CompatTelRunner.exe
2016-06-16 20:40 - 2016-05-28 01:07 - 03675512 _____ (Microsoft Corporation) C:\Windows\system32\iertutil.dll
2016-06-16 20:40 - 2016-05-28 00:35 - 00123392 _____ (Microsoft Corporation) C:\Windows\system32\tdlrecover.exe
2016-06-16 20:40 - 2016-05-28 00:29 - 22379008 _____ (Microsoft Corporation) C:\Windows\system32\edgehtml.dll
2016-06-16 20:40 - 2016-05-28 00:19 - 24605696 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.dll
2016-06-16 20:40 - 2016-05-28 00:18 - 11545088 _____ (Microsoft Corporation) C:\Windows\system32\twinui.dll
2016-06-16 20:40 - 2016-05-28 00:18 - 07977472 _____ (Microsoft Corporation) C:\Windows\system32\mos.dll
2016-06-16 20:40 - 2016-05-28 00:17 - 09918976 _____ (Microsoft Corporation) C:\Windows\SysWOW64\twinui.dll
2016-06-16 20:40 - 2016-05-28 00:17 - 00630784 _____ (Microsoft Corporation) C:\Windows\system32\MessagingDataModel2.dll
2016-06-16 20:40 - 2016-05-28 00:16 - 19344384 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.dll
2016-06-16 20:40 - 2016-05-28 00:14 - 18674176 _____ (Microsoft Corporation) C:\Windows\SysWOW64\edgehtml.dll
2016-06-16 20:40 - 2016-05-28 00:08 - 13385728 _____ (Microsoft Corporation) C:\Windows\system32\ieframe.dll
2016-06-16 20:40 - 2016-05-28 00:08 - 06295552 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mos.dll
2016-06-16 20:40 - 2016-05-28 00:06 - 12128256 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieframe.dll
2016-06-16 20:40 - 2016-05-28 00:06 - 07200256 _____ (Microsoft Corporation) C:\Windows\system32\BingMaps.dll
2016-06-16 20:40 - 2016-05-28 00:06 - 01339904 _____ (Microsoft Corporation) C:\Windows\system32\gpsvc.dll
2016-06-16 20:40 - 2016-05-28 00:05 - 03994624 _____ (Microsoft Corporation) C:\Windows\system32\SettingsHandlers_nt.dll
2016-06-16 20:40 - 2016-05-28 00:05 - 03664896 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript9.dll
2016-06-16 20:40 - 2016-05-28 00:05 - 02582016 _____ (Microsoft Corporation) C:\Windows\system32\MFMediaEngine.dll
2016-06-16 20:40 - 2016-05-28 00:04 - 06973952 _____ (Microsoft Corporation) C:\Windows\system32\Windows.Data.Pdf.dll
2016-06-16 20:40 - 2016-05-28 00:03 - 05323776 _____ (Microsoft Corporation) C:\Windows\SysWOW64\Windows.Data.Pdf.dll
2016-06-16 20:40 - 2016-05-28 00:03 - 02609664 _____ (Microsoft Corporation) C:\Windows\system32\NetworkMobileSettings.dll
2016-06-16 20:40 - 2016-05-28 00:02 - 01534464 _____ (Microsoft Corporation) C:\Windows\system32\LocationFramework.dll
2016-06-16 20:40 - 2016-05-28 00:00 - 05660160 _____ (Microsoft Corporation) C:\Windows\SysWOW64\Chakra.dll
2016-06-16 20:40 - 2016-05-28 00:00 - 03585536 _____ (Microsoft Corporation) C:\Windows\system32\SystemSettingsThresholdAdminFlowUI.dll
2016-06-16 20:40 - 2016-05-28 00:00 - 02635776 _____ (Microsoft Corporation) C:\Windows\system32\Windows.UI.Logon.dll
2016-06-16 20:40 - 2016-05-28 00:00 - 02168320 _____ (Microsoft Corporation) C:\Windows\system32\AppXDeploymentServer.dll
2016-06-16 20:40 - 2016-05-27 23:58 - 07832576 _____ (Microsoft Corporation) C:\Windows\system32\Chakra.dll
2016-06-16 20:40 - 2016-05-27 23:58 - 04896256 _____ (Microsoft Corporation) C:\Windows\system32\jscript9.dll
2016-06-16 20:39 - 2016-05-28 02:13 - 01184960 _____ (Microsoft Corporation) C:\Windows\system32\aeinv.dll
2016-06-16 20:39 - 2016-05-28 02:13 - 00514752 _____ (Microsoft Corporation) C:\Windows\system32\devinv.dll
2016-06-16 20:39 - 2016-05-28 02:13 - 00290496 _____ (Microsoft Corporation) C:\Windows\system32\invagent.dll
2016-06-16 20:39 - 2016-05-28 02:13 - 00092352 _____ (Microsoft Corporation) C:\Windows\system32\acmigration.dll
2016-06-16 20:39 - 2016-05-28 01:25 - 04268880 _____ (Microsoft Corporation) C:\Windows\SysWOW64\setupapi.dll
2016-06-16 20:39 - 2016-05-28 01:23 - 00388384 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ws2_32.dll
2016-06-16 20:39 - 2016-05-28 01:23 - 00312160 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mswsock.dll
2016-06-16 20:39 - 2016-05-28 01:22 - 07474528 _____ (Microsoft Corporation) C:\Windows\system32\ntoskrnl.exe
2016-06-16 20:39 - 2016-05-28 01:22 - 04387680 _____ (Microsoft Corporation) C:\Windows\system32\setupapi.dll
2016-06-16 20:39 - 2016-05-28 01:22 - 00428896 _____ (Microsoft Corporation) C:\Windows\system32\hal.dll
2016-06-16 20:39 - 2016-05-28 01:22 - 00211296 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\tpm.sys
2016-06-16 20:39 - 2016-05-28 01:22 - 00118624 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\partmgr.sys
2016-06-16 20:39 - 2016-05-28 01:20 - 00430312 _____ (Microsoft Corporation) C:\Windows\system32\ws2_32.dll
2016-06-16 20:39 - 2016-05-28 01:18 - 00357216 _____ (Microsoft Corporation) C:\Windows\system32\mswsock.dll
2016-06-16 20:39 - 2016-05-28 01:16 - 00026408 _____ (Microsoft Corporation) C:\Windows\system32\wuauclt.exe
2016-06-16 20:39 - 2016-05-28 01:09 - 00501600 _____ (Microsoft Corporation) C:\Windows\SysWOW64\NetSetupEngine.dll
2016-06-16 20:39 - 2016-05-28 01:09 - 00170848 _____ (Microsoft Corporation) C:\Windows\system32\NetworkUXBroker.exe
2016-06-16 20:39 - 2016-05-28 01:09 - 00084832 _____ (Microsoft Corporation) C:\Windows\SysWOW64\NetSetupApi.dll
2016-06-16 20:39 - 2016-05-28 01:08 - 00693600 _____ (Microsoft Corporation) C:\Windows\system32\NetSetupEngine.dll
2016-06-16 20:39 - 2016-05-28 01:08 - 00258912 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\ufx01000.sys
2016-06-16 20:39 - 2016-05-28 01:08 - 00115040 _____ (Microsoft Corporation) C:\Windows\system32\NetSetupApi.dll
2016-06-16 20:39 - 2016-05-28 01:07 - 02921880 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iertutil.dll
2016-06-16 20:39 - 2016-05-28 01:07 - 01322248 _____ (Microsoft Corporation) C:\Windows\system32\ole32.dll
2016-06-16 20:39 - 2016-05-28 01:07 - 00957608 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ole32.dll
2016-06-16 20:39 - 2016-05-28 01:07 - 00808288 _____ (Microsoft Corporation) C:\Windows\system32\WWAHost.exe
2016-06-16 20:39 - 2016-05-28 01:07 - 00703840 _____ (Microsoft Corporation) C:\Windows\SysWOW64\WWAHost.exe
2016-06-16 20:39 - 2016-05-28 01:07 - 00331616 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\pci.sys
2016-06-16 20:39 - 2016-05-28 01:06 - 22561256 _____ (Microsoft Corporation) C:\Windows\system32\shell32.dll
2016-06-16 20:39 - 2016-05-28 01:06 - 04074160 _____ (Microsoft Corporation) C:\Windows\SysWOW64\explorer.exe
2016-06-16 20:39 - 2016-05-28 01:06 - 00730344 _____ (Microsoft Corporation) C:\Windows\system32\Windows.Internal.Shell.Broker.dll
2016-06-16 20:39 - 2016-05-28 01:06 - 00303216 _____ (Microsoft Corporation) C:\Windows\system32\LockAppHost.exe
2016-06-16 20:39 - 2016-05-28 01:06 - 00254656 _____ (Microsoft Corporation) C:\Windows\SysWOW64\LockAppHost.exe
2016-06-16 20:39 - 2016-05-28 01:05 - 04515264 _____ (Microsoft Corporation) C:\Windows\explorer.exe
2016-06-16 20:39 - 2016-05-28 01:04 - 00604928 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\cng.sys
2016-06-16 20:39 - 2016-05-28 01:04 - 00431296 _____ (Microsoft Corporation) C:\Windows\system32\bcryptprimitives.dll
2016-06-16 20:39 - 2016-05-28 01:04 - 00360480 _____ (Microsoft Corporation) C:\Windows\SysWOW64\bcryptprimitives.dll
2016-06-16 20:39 - 2016-05-28 01:04 - 00161632 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\ksecpkg.sys
2016-06-16 20:39 - 2016-05-28 01:04 - 00111064 _____ (Microsoft Corporation) C:\Windows\system32\ncryptsslp.dll
2016-06-16 20:39 - 2016-05-28 01:04 - 00097096 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ncryptsslp.dll
2016-06-16 20:39 - 2016-05-28 01:03 - 00131248 _____ (Microsoft Corporation) C:\Windows\system32\gpapi.dll
2016-06-16 20:39 - 2016-05-28 00:58 - 01996640 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\dxgkrnl.sys
2016-06-16 20:39 - 2016-05-28 00:58 - 00379232 _____ (Adobe Systems Incorporated) C:\Windows\system32\atmfd.dll
2016-06-16 20:39 - 2016-05-28 00:57 - 02548944 _____ (Microsoft Corporation) C:\Windows\system32\d3d10warp.dll
2016-06-16 20:39 - 2016-05-28 00:57 - 02195632 _____ (Microsoft Corporation) C:\Windows\SysWOW64\d3d10warp.dll
2016-06-16 20:39 - 2016-05-28 00:57 - 01594416 _____ (Microsoft Corporation) C:\Windows\system32\gdi32.dll
2016-06-16 20:39 - 2016-05-28 00:57 - 01372312 _____ (Microsoft Corporation) C:\Windows\SysWOW64\gdi32.dll
2016-06-16 20:39 - 2016-05-28 00:57 - 00649792 _____ (Microsoft Corporation) C:\Windows\system32\dxgi.dll
2016-06-16 20:39 - 2016-05-28 00:57 - 00636304 _____ (Microsoft Corporation) C:\Windows\system32\fontdrvhost.exe
2016-06-16 20:39 - 2016-05-28 00:57 - 00577376 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\dxgmms2.sys
2016-06-16 20:39 - 2016-05-28 00:57 - 00546456 _____ (Microsoft Corporation) C:\Windows\SysWOW64\fontdrvhost.exe
2016-06-16 20:39 - 2016-05-28 00:57 - 00521664 _____ (Microsoft Corporation) C:\Windows\SysWOW64\dxgi.dll
2016-06-16 20:39 - 2016-05-28 00:57 - 00316256 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\atmfd.dll
2016-06-16 20:39 - 2016-05-28 00:35 - 00089088 _____ (Microsoft Corporation) C:\Windows\system32\MapsCSP.dll
2016-06-16 20:39 - 2016-05-28 00:35 - 00031744 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\dumpsdport.sys
2016-06-16 20:39 - 2016-05-28 00:31 - 00091648 _____ (Microsoft Corporation) C:\Windows\SysWOW64\tdlrecover.exe
2016-06-16 20:39 - 2016-05-28 00:31 - 00088576 _____ (Microsoft Corporation) C:\Windows\SysWOW64\olepro32.dll
2016-06-16 20:39 - 2016-05-28 00:31 - 00066560 _____ (Microsoft Corporation) C:\Windows\system32\MosHostClient.dll
2016-06-16 20:39 - 2016-05-28 00:29 - 00080384 _____ (Microsoft Corporation) C:\Windows\system32\VSD3DWARP12Debug.dll
2016-06-16 20:39 - 2016-05-28 00:29 - 00079360 _____ (Microsoft Corporation) C:\Windows\system32\adhsvc.dll
2016-06-16 20:39 - 2016-05-28 00:29 - 00045568 _____ (Adobe Systems) C:\Windows\system32\atmlib.dll
2016-06-16 20:39 - 2016-05-28 00:29 - 00019456 _____ (Microsoft Corporation) C:\Windows\system32\httpprxp.dll
2016-06-16 20:39 - 2016-05-28 00:28 - 00166400 _____ (Microsoft Corporation) C:\Windows\system32\MusNotification.exe
2016-06-16 20:39 - 2016-05-28 00:28 - 00118272 _____ (Microsoft Corporation) C:\Windows\system32\fontsub.dll
2016-06-16 20:39 - 2016-05-28 00:28 - 00090112 _____ (Microsoft Corporation) C:\Windows\system32\FwRemoteSvr.dll
2016-06-16 20:39 - 2016-05-28 00:27 - 00050176 _____ (Microsoft Corporation) C:\Windows\SysWOW64\MosHostClient.dll
2016-06-16 20:39 - 2016-05-28 00:27 - 00028672 _____ (Microsoft Corporation) C:\Windows\system32\mapsupdatetask.dll
2016-06-16 20:39 - 2016-05-28 00:26 - 00199168 _____ (Microsoft Corporation) C:\Windows\system32\InstallAgent.exe
2016-06-16 20:39 - 2016-05-28 00:26 - 00157184 _____ (Microsoft Corporation) C:\Windows\system32\dmcertinst.exe
2016-06-16 20:39 - 2016-05-28 00:26 - 00145920 _____ (Microsoft Corporation) C:\Windows\system32\omadmclient.exe
2016-06-16 20:39 - 2016-05-28 00:26 - 00120320 _____ (Microsoft Corporation) C:\Windows\system32\MapsBtSvc.dll
2016-06-16 20:39 - 2016-05-28 00:26 - 00074752 _____ (Microsoft Corporation) C:\Windows\system32\MosStorage.dll
2016-06-16 20:39 - 2016-05-28 00:25 - 00080384 _____ (Microsoft Corporation) C:\Windows\system32\VSD3DWARPDebug.dll
2016-06-16 20:39 - 2016-05-28 00:25 - 00060416 _____ (Microsoft Corporation) C:\Windows\SysWOW64\VSD3DWARP12Debug.dll
2016-06-16 20:39 - 2016-05-28 00:25 - 00037376 _____ (Adobe Systems) C:\Windows\SysWOW64\atmlib.dll
2016-06-16 20:39 - 2016-05-28 00:24 - 00218624 _____ (Microsoft Corporation) C:\Windows\system32\cdd.dll
2016-06-16 20:39 - 2016-05-28 00:24 - 00124928 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\Ndu.sys
2016-06-16 20:39 - 2016-05-28 00:24 - 00093696 _____ (Microsoft Corporation) C:\Windows\SysWOW64\fontsub.dll
2016-06-16 20:39 - 2016-05-28 00:24 - 00091136 _____ (Microsoft Corporation) C:\Windows\system32\browserbroker.dll
2016-06-16 20:39 - 2016-05-28 00:24 - 00086528 _____ (Microsoft Corporation) C:\Windows\system32\AppCapture.dll
2016-06-16 20:39 - 2016-05-28 00:24 - 00072704 _____ (Microsoft Corporation) C:\Windows\system32\moshost.dll
2016-06-16 20:39 - 2016-05-28 00:24 - 00067072 _____ (Microsoft Corporation) C:\Windows\system32\dhcpcsvc6.dll
2016-06-16 20:39 - 2016-05-28 00:24 - 00053760 _____ (Microsoft Corporation) C:\Windows\SysWOW64\FwRemoteSvr.dll
2016-06-16 20:39 - 2016-05-28 00:23 - 00155136 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\hidclass.sys
2016-06-16 20:39 - 2016-05-28 00:23 - 00086016 _____ (Microsoft Corporation) C:\Windows\system32\dhcpcsvc.dll
2016-06-16 20:39 - 2016-05-28 00:22 - 00406528 _____ (Microsoft Corporation) C:\Windows\system32\MusUpdateHandlers.dll
2016-06-16 20:39 - 2016-05-28 00:22 - 00368640 _____ (Microsoft Corporation) C:\Windows\system32\usocore.dll
2016-06-16 20:39 - 2016-05-28 00:22 - 00278528 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\netbt.sys
2016-06-16 20:39 - 2016-05-28 00:22 - 00269824 _____ (Microsoft Corporation) C:\Windows\system32\moshostcore.dll
2016-06-16 20:39 - 2016-05-28 00:22 - 00163328 _____ (Microsoft Corporation) C:\Windows\system32\tetheringservice.dll
2016-06-16 20:39 - 2016-05-28 00:22 - 00161280 _____ (Microsoft Corporation) C:\Windows\SysWOW64\InstallAgent.exe
2016-06-16 20:39 - 2016-05-28 00:22 - 00087040 _____ (Microsoft Corporation) C:\Windows\SysWOW64\MapsBtSvc.dll
2016-06-16 20:39 - 2016-05-28 00:22 - 00079872 _____ (Microsoft Corporation) C:\Windows\system32\cryptsvc.dll
2016-06-16 20:39 - 2016-05-28 00:22 - 00059904 _____ (Microsoft Corporation) C:\Windows\SysWOW64\MosStorage.dll
2016-06-16 20:39 - 2016-05-28 00:21 - 00550912 _____ (Microsoft Corporation) C:\Windows\system32\StoreAgent.dll
2016-06-16 20:39 - 2016-05-28 00:21 - 00239104 _____ (Microsoft Corporation) C:\Windows\system32\BrokerLib.dll
2016-06-16 20:39 - 2016-05-28 00:21 - 00207360 _____ (Microsoft Corporation) C:\Windows\system32\NetSetupSvc.dll
2016-06-16 20:39 - 2016-05-28 00:21 - 00190464 _____ (Microsoft Corporation) C:\Windows\system32\wscsvc.dll
2016-06-16 20:39 - 2016-05-28 00:21 - 00060416 _____ (Microsoft Corporation) C:\Windows\SysWOW64\VSD3DWARPDebug.dll
2016-06-16 20:39 - 2016-05-28 00:20 - 00641536 _____ (Microsoft Corporation) C:\Windows\system32\enterprisecsps.dll
2016-06-16 20:39 - 2016-05-28 00:20 - 00511488 _____ (Microsoft Corporation) C:\Windows\system32\newdev.dll
2016-06-16 20:39 - 2016-05-28 00:20 - 00332288 _____ (Microsoft Corporation) C:\Windows\system32\polstore.dll
2016-06-16 20:39 - 2016-05-28 00:20 - 00267264 _____ (Microsoft Corporation) C:\Windows\system32\dhcpcore6.dll
2016-06-16 20:39 - 2016-05-28 00:20 - 00199168 _____ (Microsoft Corporation) C:\Windows\system32\GnssAdapter.dll
2016-06-16 20:39 - 2016-05-28 00:20 - 00174080 _____ (Microsoft Corporation) C:\Windows\system32\SettingsHandlers_Privacy.dll
2016-06-16 20:39 - 2016-05-28 00:20 - 00057344 _____ (Microsoft Corporation) C:\Windows\SysWOW64\dhcpcsvc6.dll
2016-06-16 20:39 - 2016-05-28 00:19 - 00764928 _____ (Microsoft Corporation) C:\Windows\system32\Chakradiag.dll
2016-06-16 20:39 - 2016-05-28 00:19 - 00567808 _____ (Microsoft Corporation) C:\Windows\system32\MBMediaManager.dll
2016-06-16 20:39 - 2016-05-28 00:19 - 00414720 _____ (Microsoft Corporation) C:\Windows\system32\bcastdvr.exe
2016-06-16 20:39 - 2016-05-28 00:19 - 00355840 _____ (Microsoft Corporation) C:\Windows\system32\dhcpcore.dll
2016-06-16 20:39 - 2016-05-28 00:19 - 00064000 _____ (Microsoft Corporation) C:\Windows\SysWOW64\dhcpcsvc.dll
2016-06-16 20:39 - 2016-05-28 00:18 - 00610816 _____ (Microsoft Corporation) C:\Windows\system32\rastls.dll
2016-06-16 20:39 - 2016-05-28 00:18 - 00591360 _____ (Microsoft Corporation) C:\Windows\system32\vpnike.dll
2016-06-16 20:39 - 2016-05-28 00:18 - 00460800 _____ (Microsoft Corporation) C:\Windows\system32\MapConfiguration.dll
2016-06-16 20:39 - 2016-05-28 00:18 - 00392192 _____ (Microsoft Corporation) C:\Windows\system32\IPSECSVC.DLL
2016-06-16 20:39 - 2016-05-28 00:18 - 00380416 _____ (Microsoft Corporation) C:\Windows\system32\SystemEventsBrokerServer.dll
2016-06-16 20:39 - 2016-05-28 00:18 - 00285184 _____ (Microsoft Corporation) C:\Windows\system32\VEEventDispatcher.dll
2016-06-16 20:39 - 2016-05-28 00:17 - 00963072 _____ (Microsoft Corporation) C:\Windows\system32\iphlpsvc.dll
2016-06-16 20:39 - 2016-05-28 00:17 - 00485888 _____ (Microsoft Corporation) C:\Windows\SysWOW64\newdev.dll
2016-06-16 20:39 - 2016-05-28 00:17 - 00415232 _____ (Microsoft Corporation) C:\Windows\SysWOW64\StoreAgent.dll
2016-06-16 20:39 - 2016-05-28 00:17 - 00315392 _____ (Microsoft Corporation) C:\Windows\system32\RDXTaskFactory.dll
2016-06-16 20:39 - 2016-05-28 00:17 - 00278016 _____ (Microsoft Corporation) C:\Windows\system32\Windows.Internal.Management.dll
2016-06-16 20:39 - 2016-05-28 00:17 - 00173056 _____ (Microsoft Corporation) C:\Windows\system32\mdmmigrator.dll
2016-06-16 20:39 - 2016-05-28 00:16 - 00690176 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\srv2.sys
2016-06-16 20:39 - 2016-05-28 00:16 - 00684544 _____ (Microsoft Corporation) C:\Windows\system32\StructuredQuery.dll
2016-06-16 20:39 - 2016-05-28 00:16 - 00592896 _____ (Microsoft Corporation) C:\Windows\system32\AppContracts.dll
2016-06-16 20:39 - 2016-05-28 00:16 - 00503808 _____ (Microsoft Corporation) C:\Windows\system32\tileobjserver.dll
2016-06-16 20:39 - 2016-05-28 00:16 - 00406528 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\srv.sys
2016-06-16 20:39 - 2016-05-28 00:16 - 00291328 _____ (Microsoft Corporation) C:\Windows\SysWOW64\polstore.dll
2016-06-16 20:39 - 2016-05-28 00:16 - 00230400 _____ (Microsoft Corporation) C:\Windows\SysWOW64\dhcpcore6.dll
2016-06-16 20:39 - 2016-05-28 00:15 - 01056256 _____ (Microsoft Corporation) C:\Windows\system32\JpMapControl.dll
2016-06-16 20:39 - 2016-05-28 00:15 - 00853504 _____ (Microsoft Corporation) C:\Windows\system32\MapsStore.dll
2016-06-16 20:39 - 2016-05-28 00:15 - 00794624 _____ (Microsoft Corporation) C:\Windows\system32\winhttp.dll
2016-06-16 20:39 - 2016-05-28 00:15 - 00535040 _____ (Microsoft Corporation) C:\Windows\SysWOW64\rastls.dll
2016-06-16 20:39 - 2016-05-28 00:15 - 00349696 _____ (Microsoft Corporation) C:\Windows\SysWOW64\MapConfiguration.dll
2016-06-16 20:39 - 2016-05-28 00:15 - 00293888 _____ (Microsoft Corporation) C:\Windows\SysWOW64\dhcpcore.dll
2016-06-16 20:39 - 2016-05-28 00:15 - 00237056 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\srvnet.sys
2016-06-16 20:39 - 2016-05-28 00:14 - 03292672 _____ (Microsoft Corporation) C:\Windows\system32\d3d12warp.dll
2016-06-16 20:39 - 2016-05-28 00:14 - 01716736 _____ (Microsoft Corporation) C:\Windows\system32\SRHInproc.dll
2016-06-16 20:39 - 2016-05-28 00:14 - 00988160 _____ (Microsoft Corporation) C:\Windows\system32\NMAA.dll
2016-06-16 20:39 - 2016-05-28 00:14 - 00965632 _____ (Microsoft Corporation) C:\Windows\system32\SRH.dll
2016-06-16 20:39 - 2016-05-28 00:14 - 00784384 _____ (Microsoft Corporation) C:\Windows\system32\msfeeds.dll
2016-06-16 20:39 - 2016-05-28 00:14 - 00606208 _____ (Microsoft Corporation) C:\Windows\system32\vbscript.dll
2016-06-16 20:39 - 2016-05-28 00:14 - 00499712 _____ (Microsoft Corporation) C:\Windows\SysWOW64\MessagingDataModel2.dll
2016-06-16 20:39 - 2016-05-28 00:14 - 00219136 _____ (Microsoft Corporation) C:\Windows\SysWOW64\VEEventDispatcher.dll
2016-06-16 20:39 - 2016-05-28 00:14 - 00200192 _____ (Microsoft Corporation) C:\Windows\SysWOW64\Windows.Internal.Management.dll
2016-06-16 20:39 - 2016-05-28 00:13 - 01387520 _____ (Microsoft Corporation) C:\Windows\system32\win32kbase.sys
2016-06-16 20:39 - 2016-05-28 00:13 - 00990208 _____ (Microsoft Corporation) C:\Windows\system32\SharedStartModel.dll
2016-06-16 20:39 - 2016-05-28 00:13 - 00982016 _____ (Microsoft Corporation) C:\Windows\system32\AppxPackaging.dll
2016-06-16 20:39 - 2016-05-28 00:13 - 00939520 _____ (Microsoft Corporation) C:\Windows\system32\MapControlCore.dll
2016-06-16 20:39 - 2016-05-28 00:13 - 00587776 _____ (Microsoft Corporation) C:\Windows\system32\bisrv.dll
2016-06-16 20:39 - 2016-05-28 00:13 - 00467456 _____ (Microsoft Corporation) C:\Windows\SysWOW64\AppContracts.dll
2016-06-16 20:39 - 2016-05-28 00:12 - 00800768 _____ (Microsoft Corporation) C:\Windows\SysWOW64\JpMapControl.dll
2016-06-16 20:39 - 2016-05-28 00:12 - 00614400 _____ (Microsoft Corporation) C:\Windows\SysWOW64\winhttp.dll
2016-06-16 20:39 - 2016-05-28 00:12 - 00521728 _____ (Microsoft Corporation) C:\Windows\SysWOW64\StructuredQuery.dll
2016-06-16 20:39 - 2016-05-28 00:11 - 02470912 _____ (Microsoft Corporation) C:\Windows\SysWOW64\d3d12warp.dll
2016-06-16 20:39 - 2016-05-28 00:11 - 01445888 _____ (Microsoft Corporation) C:\Windows\SysWOW64\SRHInproc.dll
2016-06-16 20:39 - 2016-05-28 00:11 - 00890368 _____ (Microsoft Corporation) C:\Windows\SysWOW64\AppxPackaging.dll
2016-06-16 20:39 - 2016-05-28 00:11 - 00799744 _____ (Microsoft Corporation) C:\Windows\SysWOW64\SRH.dll
2016-06-16 20:39 - 2016-05-28 00:11 - 00784896 _____ (Microsoft Corporation) C:\Windows\SysWOW64\NMAA.dll
2016-06-16 20:39 - 2016-05-28 00:11 - 00711680 _____ (Microsoft Corporation) C:\Windows\SysWOW64\MapControlCore.dll
2016-06-16 20:39 - 2016-05-28 00:11 - 00687616 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msfeeds.dll
2016-06-16 20:39 - 2016-05-28 00:11 - 00504320 _____ (Microsoft Corporation) C:\Windows\SysWOW64\vbscript.dll
2016-06-16 20:39 - 2016-05-28 00:11 - 00128512 _____ (Microsoft Corporation) C:\Windows\system32\httpprxm.dll
2016-06-16 20:39 - 2016-05-28 00:09 - 01073152 _____ (Microsoft Corporation) C:\Windows\system32\RDXService.dll
2016-06-16 20:39 - 2016-05-28 00:05 - 01797120 _____ (Microsoft Corporation) C:\Windows\system32\Windows.UI.Immersive.dll
2016-06-16 20:39 - 2016-05-28 00:04 - 00555520 _____ (Microsoft Corporation) C:\Windows\system32\SyncController.dll
2016-06-16 20:39 - 2016-05-28 00:04 - 00450560 _____ (Microsoft Corporation) C:\Windows\SysWOW64\SyncController.dll
2016-06-16 20:39 - 2016-05-28 00:03 - 05205504 _____ (Microsoft Corporation) C:\Windows\SysWOW64\BingMaps.dll
2016-06-16 20:39 - 2016-05-28 00:03 - 01185280 _____ (Microsoft Corporation) C:\Windows\SysWOW64\LocationFramework.dll
2016-06-16 20:39 - 2016-05-28 00:03 - 00693760 _____ (Microsoft Corporation) C:\Windows\system32\internetmail.dll
2016-06-16 20:39 - 2016-05-28 00:03 - 00417792 _____ (Microsoft Corporation) C:\Windows\system32\dmenrollengine.dll
2016-06-16 20:39 - 2016-05-28 00:02 - 03590144 _____ (Microsoft Corporation) C:\Windows\system32\win32kfull.sys
2016-06-16 20:39 - 2016-05-28 00:02 - 02061824 _____ (Microsoft Corporation) C:\Windows\SysWOW64\MFMediaEngine.dll
2016-06-16 20:39 - 2016-05-28 00:02 - 00103424 _____ (Microsoft Corporation) C:\Windows\SysWOW64\updatepolicy.dll
2016-06-16 20:39 - 2016-05-28 00:01 - 01799680 _____ (Microsoft Corporation) C:\Windows\SysWOW64\Windows.UI.Logon.dll
2016-06-16 20:39 - 2016-05-28 00:01 - 01582080 _____ (Microsoft Corporation) C:\Windows\SysWOW64\Windows.UI.Immersive.dll
2016-06-16 20:39 - 2016-05-28 00:01 - 01500160 _____ (Microsoft Corporation) C:\Windows\SysWOW64\urlmon.dll
2016-06-16 20:39 - 2016-05-28 00:01 - 00111104 _____ (Microsoft Corporation) C:\Windows\system32\updatepolicy.dll
2016-06-16 20:39 - 2016-05-28 00:00 - 02230272 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wininet.dll
2016-06-16 20:39 - 2016-05-28 00:00 - 01730560 _____ (Microsoft Corporation) C:\Windows\system32\urlmon.dll
2016-06-16 20:39 - 2016-05-28 00:00 - 01707520 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ActiveSyncProvider.dll
2016-06-16 20:39 - 2016-05-28 00:00 - 00162816 _____ (Microsoft Corporation) C:\Windows\system32\enrollmentapi.dll
2016-06-16 20:39 - 2016-05-28 00:00 - 00151040 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mdmregistration.dll
2016-06-16 20:39 - 2016-05-28 00:00 - 00090624 _____ (Microsoft Corporation) C:\Windows\system32\DeviceEnroller.exe
2016-06-16 20:39 - 2016-05-27 23:59 - 00176640 _____ (Microsoft Corporation) C:\Windows\system32\mdmregistration.dll
2016-06-16 20:39 - 2016-05-27 23:58 - 02755584 _____ (Microsoft Corporation) C:\Windows\system32\wininet.dll
2016-06-16 20:39 - 2016-05-27 23:58 - 02066432 _____ (Microsoft Corporation) C:\Windows\system32\AppXDeploymentExtensions.dll
2016-06-16 20:39 - 2016-05-27 23:58 - 01996288 _____ (Microsoft Corporation) C:\Windows\system32\ActiveSyncProvider.dll
2016-06-16 20:39 - 2016-05-27 23:57 - 02281472 _____ (Microsoft Corporation) C:\Windows\system32\wuaueng.dll
2016-06-16 20:39 - 2016-05-27 23:55 - 01390080 _____ (Microsoft Corporation) C:\Windows\system32\Windows.UI.Shell.dll
2016-06-16 20:39 - 2016-05-27 23:53 - 00076800 _____ (Microsoft Corporation) C:\Windows\system32\ngcpopkeysrv.dll
2016-06-12 18:09 - 2016-06-12 18:09 - 00262144 ____N C:\Windows\Minidump\061216-23125-01.dmp
2016-06-11 16:57 - 2016-07-09 22:47 - 00000000 ____D C:\Windows\Minidump
2016-06-11 16:57 - 2016-06-11 16:57 - 00262144 ____N C:\Windows\Minidump\061116-26250-01.dmp
2016-06-10 20:03 - 2016-06-10 20:03 - 00000000 ____H C:\Windows\system32\Drivers\Msft_User_WpdFs_01_11_00.Wdf
 
==================== One Month Modified files and folders ========
 
(If an entry is included in the fixlist, the file/folder will be moved.)
 
2016-07-10 17:55 - 2016-06-05 17:29 - 00000006 ____H C:\Windows\Tasks\SA.DAT
2016-07-10 17:54 - 2015-10-30 02:28 - 00524288 ___SH C:\Windows\system32\config\BBI
2016-07-10 17:34 - 2016-06-05 17:25 - 00363160 _____ C:\Windows\system32\FNTCACHE.DAT
2016-07-10 17:22 - 2016-06-07 17:27 - 00000000 ____D C:\Program Files (x86)\Mozilla Firefox
2016-07-10 17:03 - 2015-10-30 03:24 - 00000000 ____D C:\ProgramData\regid.1991-06.com.microsoft
2016-07-10 17:03 - 2015-10-30 03:24 - 00000000 ____D C:\Program Files\Common Files\microsoft shared
2016-07-10 16:52 - 2015-10-30 03:21 - 00000000 ____D C:\Windows\INF
2016-07-10 10:38 - 2016-06-05 14:40 - 00000000 ____D C:\Users\Hank
2016-07-10 01:58 - 2015-10-30 03:24 - 00000000 ____D C:\Windows\AppReadiness
2016-07-09 20:25 - 2015-10-30 03:24 - 00000000 ____D C:\Windows\Registration
2016-07-09 20:19 - 2016-06-05 14:40 - 00000000 ____D C:\Users\Hank\AppData\Local\VirtualStore
2016-07-09 19:38 - 2016-06-05 14:44 - 00002358 _____ C:\Users\Hank\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\OneDrive.lnk
2016-07-09 19:37 - 2016-06-06 15:12 - 00001486 _____ C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Blend for Visual Studio 2015.lnk
2016-07-09 19:37 - 2016-06-06 15:11 - 00001443 _____ C:\ProgramData\Microsoft\Windows\Start Menu\Programs\VS Express for Windows 10.lnk
2016-07-09 19:37 - 2016-06-05 23:03 - 00002031 _____ C:\Users\Public\Desktop\Easy Calendar.lnk
2016-07-09 19:37 - 2016-06-05 15:28 - 00001434 _____ C:\ProgramData\Microsoft\Windows\Start Menu\Programs\VS Express for Desktop.lnk
2016-07-09 19:37 - 2016-06-05 15:01 - 00002011 _____ C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Avast Free Antivirus.lnk
2016-07-09 19:37 - 2016-06-05 15:01 - 00002005 _____ C:\Users\Public\Desktop\Avast Free Antivirus.lnk
2016-07-09 19:37 - 2015-10-30 03:19 - 00002425 _____ C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Immersive Control Panel.lnk
2016-07-09 19:37 - 2015-10-30 03:19 - 00002289 _____ C:\ProgramData\Microsoft\Windows\Start Menu\Programs\PrintDialog.lnk
2016-07-09 19:37 - 2015-10-30 03:19 - 00002287 _____ C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Devices Flow.lnk
2016-07-09 19:37 - 2015-10-30 03:18 - 00000853 _____ C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Desktop.lnk
2016-07-09 19:37 - 2015-10-30 03:17 - 00002313 _____ C:\ProgramData\Microsoft\Windows\Start Menu\Programs\MiracastView.lnk
2016-07-09 19:26 - 2015-10-30 03:24 - 00000000 ____D C:\Windows\bcastdvr
2016-07-09 17:16 - 2016-06-05 16:40 - 00000000 ____D C:\Users\Hank\Documents\Visual Studio 2015
2016-07-09 16:53 - 2016-06-05 15:04 - 00002143 ____R C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Аvаst SаfеZоnе Вrоwsеr.lnk
2016-07-08 23:03 - 2015-10-30 03:24 - 00000000 ___HD C:\Program Files\WindowsApps
2016-07-07 12:28 - 2016-06-05 14:39 - 00834360 _____ C:\Windows\system32\PerfStringBackup.INI
2016-07-01 22:41 - 2016-06-05 23:03 - 00006442 _____ C:\Users\Hank\Documents\calendar.ec2
2016-07-01 22:38 - 2016-06-05 23:08 - 00003988 _____ C:\Users\Hank\Documents\calendarBackup.ec2
2016-07-01 22:11 - 2016-06-05 15:04 - 00004020 _____ C:\Windows\System32\Tasks\SafeZone scheduled Autoupdate 1465153438
2016-07-01 22:10 - 2016-06-05 15:00 - 00004004 _____ C:\Windows\System32\Tasks\avast! Emergency Update
2016-06-29 23:29 - 2016-06-05 15:00 - 00473592 _____ (AVAST Software) C:\Windows\system32\Drivers\aswSP.sys
2016-06-29 23:28 - 2016-06-05 15:03 - 00037144 _____ (AVAST Software) C:\Windows\system32\Drivers\aswKbd.sys
2016-06-29 23:28 - 2016-06-05 15:00 - 01070904 _____ (AVAST Software) C:\Windows\system32\Drivers\aswSnx.sys
2016-06-29 23:28 - 2016-06-05 15:00 - 00473592 _____ (AVAST Software) C:\Windows\system32\Drivers\aswsp.sys.146725735881202
2016-06-29 23:28 - 2016-06-05 15:00 - 00290088 _____ (AVAST Software) C:\Windows\system32\Drivers\aswVmm.sys
2016-06-29 23:28 - 2016-06-05 15:00 - 00162904 _____ (AVAST Software) C:\Windows\system32\Drivers\aswStm.sys
2016-06-29 23:28 - 2016-06-05 15:00 - 00108304 _____ (AVAST Software) C:\Windows\system32\Drivers\aswMonFlt.sys
2016-06-29 23:28 - 2016-06-05 15:00 - 00103064 _____ (AVAST Software) C:\Windows\system32\Drivers\aswRdr2.sys
2016-06-29 23:28 - 2016-06-05 15:00 - 00074544 _____ (AVAST Software) C:\Windows\system32\Drivers\aswRvrt.sys
2016-06-29 23:28 - 2016-06-05 15:00 - 00037656 _____ (AVAST Software) C:\Windows\system32\Drivers\aswHwid.sys
2016-06-24 19:45 - 2015-10-30 03:24 - 00000000 __RSD C:\Windows\Media
2016-06-19 20:52 - 2015-10-30 03:24 - 00000000 ____D C:\Windows\rescache
2016-06-18 03:36 - 2016-06-05 14:40 - 00000000 __RHD C:\Users\Public\AccountPictures
2016-06-18 03:32 - 2015-10-30 03:24 - 00000000 ___SD C:\Windows\system32\DiagSvcs
2016-06-18 03:32 - 2015-10-30 03:24 - 00000000 ____D C:\Windows\system32\SystemResetPlatform
2016-06-17 20:19 - 2015-10-30 03:11 - 00000000 ____D C:\Windows\CbsTemp
2016-06-17 19:32 - 2016-06-06 14:49 - 00000000 ____D C:\Windows\system32\MRT
2016-06-17 19:25 - 2016-06-06 14:49 - 142482544 _____ (Microsoft Corporation) C:\Windows\system32\MRT.exe
2016-06-14 14:33 - 2015-10-30 03:26 - 00828408 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerApp.exe
2016-06-14 14:33 - 2015-10-30 03:26 - 00176632 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerCPLApp.cpl
2016-06-11 17:00 - 2016-06-05 14:40 - 00000000 ____D C:\Users\Hank\AppData\Local\Packages
2016-06-10 22:49 - 2016-06-06 19:59 - 00000000 ____D C:\Users\Hank\Documents\Visual Studio 2013
 
==================== Files in the root of some directories =======
 
2016-07-09 17:07 - 2016-07-09 17:07 - 7101952 _____ () C:\Users\Hank\AppData\Roaming\agent.dat
2016-07-09 17:05 - 2016-07-09 17:05 - 0128512 _____ () C:\Users\Hank\AppData\Roaming\Installer.dat
2016-07-09 17:07 - 2016-07-09 17:07 - 0018432 _____ () C:\Users\Hank\AppData\Roaming\Main.dat
2016-07-10 10:11 - 2016-07-10 10:11 - 0000000 _____ () C:\Users\Hank\AppData\Local\ars.cache
2016-07-10 10:11 - 2016-07-10 10:11 - 0006884 _____ () C:\Users\Hank\AppData\Local\census.cache
2016-07-10 00:19 - 2016-07-10 00:19 - 0000036 _____ () C:\Users\Hank\AppData\Local\housecall.guid.cache
2016-07-10 00:37 - 2016-07-10 00:37 - 0000010 _____ () C:\Users\Hank\AppData\Local\sponge.last.runtime.cache
 
Some files in TEMP:
====================
C:\Users\Hank\AppData\Local\Temp\BFItqZvvC4.exe
C:\Users\Hank\AppData\Local\Temp\c11w.exe
C:\Users\Hank\AppData\Local\Temp\dllnt_dump.dll
C:\Users\Hank\AppData\Local\Temp\GHSLQERF.exe
C:\Users\Hank\AppData\Local\Temp\H.exe
C:\Users\Hank\AppData\Local\Temp\HRZKY.exe
C:\Users\Hank\AppData\Local\Temp\KzF4P6aktG.exe
C:\Users\Hank\AppData\Local\Temp\libeay32.dll
C:\Users\Hank\AppData\Local\Temp\MDI.exe
C:\Users\Hank\AppData\Local\Temp\MNWVFZUV.exe
C:\Users\Hank\AppData\Local\Temp\msvcr120.dll
C:\Users\Hank\AppData\Local\Temp\NE.exe
C:\Users\Hank\AppData\Local\Temp\nitro_reader3.exe
C:\Users\Hank\AppData\Local\Temp\nitro_reader3_64.exe
C:\Users\Hank\AppData\Local\Temp\nsaB66.tmp.exe
C:\Users\Hank\AppData\Local\Temp\nsm9B44.tmp.exe
C:\Users\Hank\AppData\Local\Temp\sqlite3.dll
C:\Users\Hank\AppData\Local\Temp\uii.exe
C:\Users\Hank\AppData\Local\Temp\_isFFD3.exe
 

==================== Bamital & volsnap =================
 
(There is no automatic fix for files that do not pass verification.)
 
C:\Windows\system32\winlogon.exe => File is digitally signed
C:\Windows\system32\wininit.exe => File is digitally signed
C:\Windows\explorer.exe => File is digitally signed
C:\Windows\SysWOW64\explorer.exe => File is digitally signed
C:\Windows\system32\svchost.exe => File is digitally signed
C:\Windows\SysWOW64\svchost.exe => File is digitally signed
C:\Windows\system32\services.exe => File is digitally signed
C:\Windows\system32\User32.dll => File is digitally signed
C:\Windows\SysWOW64\User32.dll => File is digitally signed
C:\Windows\system32\userinit.exe => File is digitally signed
C:\Windows\SysWOW64\userinit.exe => File is digitally signed
C:\Windows\system32\rpcss.dll => File is digitally signed
C:\Windows\system32\dnsapi.dll => File is digitally signed
C:\Windows\SysWOW64\dnsapi.dll
[2016-06-05 16:58] - [2016-06-05 16:58] - 0535080 ____A () D41D8CD98F00B204E9800998ECF8427E
 
C:\Windows\SysWOW64\dnsapi.dll => no Company Name <===== ATTENTION
 
C:\Windows\system32\Drivers\volsnap.sys => File is digitally signed
 

LastRegBack: 2016-07-07 22:01
 
==================== End of FRST.txt ============================

 

Attached Files



#4 nasdaq

nasdaq

  • Malware Response Team
  • 38,559 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:Montreal, QC. Canada
  • Local time:07:13 PM

Posted 11 July 2016 - 07:19 AM

Remove KMSpico via the Control Panel > Programs > Programs and Features applet
KMSpico (HKLM\...\{8B29D47F-92E2-4C20-9EE0-F710991F5D7C}_is1) (Version: - )
===

This fix will remove the link to stop-block.net/ if you did not set this or know what it remove this line in the fix before saving the fixlist.txt file.
AutoConfigURL: [S-1-5-21-1912047634-4237204969-221734255-1001] => hxxp://stop-block.net/wpad.dat?05ef45486509d17ae4d4bf25d3366a9712629225

The same for this PowerShell modification. If you did not create this script remove these lines before saving the fixlist.txt file.
Task: {E60FB8AA-8DB8-432C-8577-2FE385954EE9} - System32\Tasks\1ded083255147653035377f75c72529b => powershell.exe -NoProfile -NoLogo -NonInteractive -ExecutionPolicy Bypass -File C:\Windows\1ded083255147653035377f75c72529b.ps1 <==== ATTENTION
C:\Windows\1ded083255147653035377f75c72529b.ps1 <==== ATTENTION


Press the windows key Windows_Logo_key.gif+ r on your keyboard at the same time. This will open the RUN BOX.
Type Notepad and and click the OK key.

Please copy the entire contents of the code box below to a new file.
 
Start

CreateRestorePoint:
EmptyTemp:
CloseProcesses:

(@ByELDI) C:\Program Files\KMSpico\Service_KMS.exe
HKU\S-1-5-21-1912047634-4237204969-221734255-1001\...\MountPoints2: {4e9427b3-2b6c-11e6-802a-806e6f6e6963} - "D:\OInstall.exe"
AutoConfigURL: [S-1-5-21-1912047634-4237204969-221734255-1001] => hxxp://stop-block.net/wpad.dat?05ef45486509d17ae4d4bf25d3366a9712629225
Handler: mk - a0;ImkTMTbQAWXZsgUEpO?_[cqQDNcNHdXVv!fWK -  No File
R2 Service KMSELDI; C:\Program Files\KMSpico\Service_KMS.exe [735936 2015-08-16] (@ByELDI) [File not signed]
S1 epp; \??\C:\Users\Hank\Desktop\New folder\bin64\epp.sys [X]
S3 MFE_RR; \??\C:\Users\Hank\AppData\Local\Temp\mfe_rr.sys [X]
Task: {E60FB8AA-8DB8-432C-8577-2FE385954EE9} - System32\Tasks\1ded083255147653035377f75c72529b => powershell.exe -NoProfile -NoLogo -NonInteractive -ExecutionPolicy Bypass -File C:\Windows\1ded083255147653035377f75c72529b.ps1 <==== ATTENTION	
C:\Windows\1ded083255147653035377f75c72529b.ps1 <==== ATTENTION
Task: {A9CEFC31-F557-427F-94FD-75456232B631} - System32\Tasks\AutoPico Daily Restart =>  [2015-08-16] (@ByELDI)
Shortcut: C:\Users\Public\Desktop\Mozilla Firefox.lnk -> hxxp://safebrowsing.biz/?ssid=1468185709&a=1058466&src=sh&uuid=1caf90fc-3664-4e88-ba55-b8173c6edd6c" (No File)
C:\Program Files\KMSpico

End
Save the file as fixlist.txt in the same folder where the Farbar tool is running from.
The location is listed in the 3rd line of the Farbar log you have submitted.

Run FRST and click Fix only once and wait.

Restart the computer normally to reset the registry.

The tool will create a log (Fixlog.txt) please post it to your reply.

Please let me know what problem persists with this computer.

===

Lets find out more about this.
C:\Windows\SysWOW64\dnsapi.dll => no Company Name <===== ATTENTION

Please download SystemLook if your system is a 64bit system, then download the SystemLook_x64.exe save it to your Desktop.
SystemLook.exe
SystemLook_x64.exe
  • Double-click SystemLook.exe/SystemLook_x64.exe
  • to run it.
  • Copy and paste the content of the following bold text into the main textfield:
  • :filefind
    dnsapi.dll
  • Click the Look button to start the scan.
  • When finished, a notepad window will open with the results of the scan. Please post this log in your next reply.
  • Note: The log can also be found on your Desktop entitled SystemLook.txt.
  • ===

Edited by nasdaq, 11 July 2016 - 12:56 PM.


#5 looney2340

looney2340
  • Topic Starter

  • Members
  • 202 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:NYC
  • Local time:06:13 PM

Posted 11 July 2016 - 11:33 AM

Attached File  Capture.PNG   10.01KB   0 downloadsAttached File  Capture2.PNG   9.26KB   0 downloadsHi,
Here is the log you asked for. I am unable to download the systemlook.exe file it says page not found. I am also attaching screen shots of what my virus scan keeps finding.
 
 
 
 
Fix result of Farbar Recovery Scan Tool (x64) Version: 10-07-2016 01
Ran by Hank (2016-07-11 12:13:17) Run:1
Running from C:\Users\Hank\Downloads
Loaded Profiles: Hank (Available Profiles: Hank)
Boot Mode: Normal
==============================================
 
fixlist content:
*****************
Start
 
CreateRestorePoint:
EmptyTemp:
CloseProcesses:
 
(@ByELDI) C:\Program Files\KMSpico\Service_KMS.exe
HKU\S-1-5-21-1912047634-4237204969-221734255-1001\...\MountPoints2: {4e9427b3-2b6c-11e6-802a-806e6f6e6963} - "D:\OInstall.exe"
AutoConfigURL: [S-1-5-21-1912047634-4237204969-221734255-1001] => hxxp://stop-block.net/wpad.dat?05ef45486509d17ae4d4bf25d3366a9712629225
Handler: mk - a0;ImkTMTbQAWXZsgUEpO?_[cqQDNcNHdXVv!fWK -  No File
R2 Service KMSELDI; C:\Program Files\KMSpico\Service_KMS.exe [735936 2015-08-16] (@ByELDI) [File not signed]
S1 epp; \??\C:\Users\Hank\Desktop\New folder\bin64\epp.sys [X]
S3 MFE_RR; \??\C:\Users\Hank\AppData\Local\Temp\mfe_rr.sys [X]
Task: {E60FB8AA-8DB8-432C-8577-2FE385954EE9} - System32\Tasks\1ded083255147653035377f75c72529b => powershell.exe -NoProfile -NoLogo -NonInteractive -ExecutionPolicy Bypass -File C:\Windows\1ded083255147653035377f75c72529b.ps1 <==== ATTENTION 
C:\Windows\1ded083255147653035377f75c72529b.ps1 <==== ATTENTION
Task: {A9CEFC31-F557-427F-94FD-75456232B631} - System32\Tasks\AutoPico Daily Restart =>  [2015-08-16] (@ByELDI)
Shortcut: C:\Users\Public\Desktop\Mozilla Firefox.lnk -> hxxp://safebrowsing.biz/?ssid=1468185709&a=1058466&src=sh&uuid=1caf90fc-3664-4e88-ba55-b8173c6edd6c" (No File)
C:\Program Files\KMSpico
 
End
*****************
 
Restore point was successfully created.
Processes closed successfully.
C:\Program Files\KMSpico\Service_KMS.exe => No running process found
"HKU\S-1-5-21-1912047634-4237204969-221734255-1001\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{4e9427b3-2b6c-11e6-802a-806e6f6e6963}" => key removed successfully
HKCR\CLSID\{4e9427b3-2b6c-11e6-802a-806e6f6e6963} => key not found.
HKU\S-1-5-21-1912047634-4237204969-221734255-1001\Software\Microsoft\Windows\CurrentVersion\Internet Settings\\AutoConfigURL => value removed successfully
"HKCR\PROTOCOLS\Handler\mk" => key removed successfully
Service KMSELDI => service not found.
epp => service removed successfully
MFE_RR => service removed successfully
"HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Plain\{E60FB8AA-8DB8-432C-8577-2FE385954EE9}" => key removed successfully
"HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\{E60FB8AA-8DB8-432C-8577-2FE385954EE9}" => key removed successfully
C:\Windows\System32\Tasks\1ded083255147653035377f75c72529b => moved successfully
"HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tree\1ded083255147653035377f75c72529b" => key removed successfully
"C:\Windows\1ded083255147653035377f75c72529b.ps1 <==== ATTENTION" => not found.
HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\{A9CEFC31-F557-427F-94FD-75456232B631} => key not found.
C:\Windows\System32\Tasks\AutoPico Daily Restart => not found.
HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tree\AutoPico Daily Restart => key not found.
Shortcut: C:\Users\Public\Desktop\Mozilla Firefox.lnk -> hxxp://safebrowsing.biz/?ssid=1468185709&a=1058466&src=sh&uuid=1caf90fc-3664-4e88-ba55-b8173c6edd6c" (No File) => Error: No automatic fix found for this entry.
C:\Program Files\KMSpico => moved successfully
 
=========== EmptyTemp: ==========
 
BITS transfer queue => 6588328 B
DOMStore, IE Recovery, AppCache, Feeds Cache, Thumbcache, IconCache => 11683165 B
Java, Flash, Steam htmlcache => 2969 B
Windows/system/drivers => 413286 B
Edge => 81731858 B
Chrome => 0 B
Firefox => 39106763 B
Opera => 0 B
 
Temp, IE cache, history, cookies, recent:
Default => 0 B
ProgramData => 0 B
Public => 0 B
systemprofile => 128 B
systemprofile32 => 0 B
LocalService => 31884 B
NetworkService => 1874 B
Hank => 156670922 B
 
RecycleBin => 58387 B
EmptyTemp: => 282.6 MB temporary data Removed.
 
================================
 

The system needed a reboot.
 
==== End of Fixlog 12:15:16 ====

 

 

 



#6 nasdaq

nasdaq

  • Malware Response Team
  • 38,559 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:Montreal, QC. Canada
  • Local time:07:13 PM

Posted 11 July 2016 - 12:58 PM


The site is under maintenance.
http://247fixes.com/

Run the Farbar tool, in the search box type dnsapi.dll hit the Search File button.

Post the results for my review.

#7 looney2340

looney2340
  • Topic Starter

  • Members
  • 202 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:NYC
  • Local time:06:13 PM

Posted 11 July 2016 - 04:33 PM

Farbar Recovery Scan Tool (x64) Version: 10-07-2016 01
Ran by Hank (2016-07-11 17:29:46)
Running from C:\Users\Hank\Downloads
Boot Mode: Normal
 
================== Search Files: "dnsapi.dll" =============
 
C:\Windows\WinSxS\wow64_microsoft-windows-dns-client-minwin_31bf3856ad364e35_10.0.10586.212_none_0d0987cfb6756063\dnsapi.dll
[2016-06-05 16:58][2016-03-29 05:28] 0535080 ____A (Microsoft Corporation) 6A7ACABAE92C837F5C1330188EAE36AE [File is digitally signed]
 
C:\Windows\WinSxS\wow64_microsoft-windows-dns-client-minwin_31bf3856ad364e35_10.0.10586.0_none_2c65f66b01dd8f12\dnsapi.dll
[2015-10-30 03:18][2016-07-06 23:13] 0017780 ____A () 4C8C167B131EBE7A4D94504F82DAD316 [File not signed]
 
C:\Windows\WinSxS\amd64_microsoft-windows-dns-client-minwin_31bf3856ad364e35_10.0.10586.212_none_02b4dd7d82149e68\dnsapi.dll
[2016-06-05 16:58][2016-03-29 06:11] 0686976 ____A (Microsoft Corporation) 9A3E17CDB177913C2A111C80F3D0DBB4 [File is digitally signed]
 
C:\Windows\WinSxS\amd64_microsoft-windows-dns-client-minwin_31bf3856ad364e35_10.0.10586.0_none_22114c18cd7ccd17\dnsapi.dll
[2015-10-30 03:18][2016-07-06 22:39] 0010782 ____A () E4E48EFBCF7DF993A1377CB0518411BC [File not signed]
 
C:\Windows\SysWOW64\dnsapi.dll
[2016-06-05 16:58][2016-06-05 16:58] 0535080 ____A (Microsoft Corporation) D24948A54B1957C450CD854F6F65E033 [File not signed]
 
C:\Windows\System32\dnsapi.dll
[2016-06-05 16:58][2016-03-29 06:11] 0686976 ____A (Microsoft Corporation) 9A3E17CDB177913C2A111C80F3D0DBB4 [File is digitally signed]
 
====== End of Search ======


#8 nasdaq

nasdaq

  • Malware Response Team
  • 38,559 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:Montreal, QC. Canada
  • Local time:07:13 PM

Posted 12 July 2016 - 07:18 AM

Press the windows key Windows_Logo_key.gif+ r on your keyboard at the same time. This will open the RUN BOX.
Type Notepad and and click the OK key.
Please copy the entire contents of the code box below to the a new file.
 
start


CreateRestorePoint:
CloseProcesses:
Replace:
C:\Windows\WinSxS\wow64_microsoft-windows-dns-client-minwin_31bf3856ad364e35_10.0.10586.212_none_0d0987cfb6756063\dnsapi.dll C:\Windows\SysWOW64\dnsapi.dll

End
Save the file as fixlist.txt in the same folder where the Farbar tool is running from.
The location is listed in the 3rd line of the Farbar log you have submitted.

Run FRST and click Fix only once and wait.

Restart the computer normally to reset the registry.

The tool will create a log (Fixlog.txt) please post it to your reply.
===

How is the computer runming now?

#9 looney2340

looney2340
  • Topic Starter

  • Members
  • 202 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:NYC
  • Local time:06:13 PM

Posted 12 July 2016 - 07:56 PM

Hi,

I am still getting these errors when I open fire fox it always crashes and this is what I get

 

Attached File  Capture.PNG   31.26KB   0 downloads

 

Also here is the other log you had asked for.

 

 

Fix result of Farbar Recovery Scan Tool (x64) Version: 10-07-2016 01
Ran by Hank (2016-07-12 20:45:31) Run:2
Running from C:\Users\Hank\Downloads
Loaded Profiles: Hank (Available Profiles: Hank)
Boot Mode: Normal
==============================================
 
fixlist content:
*****************
start
 

CreateRestorePoint:
CloseProcesses:
Replace:
C:\Windows\WinSxS\wow64_microsoft-windows-dns-client-minwin_31bf3856ad364e35_10.0.10586.212_none_0d0987cfb6756063\dnsapi.dll C:\Windows\SysWOW64\dnsapi.dll
 
End
*****************
 
Restore point was successfully created.
Processes closed successfully.
"Replace:" -> not found => Could not replace
"C:\Windows\WinSxS\wow64_microsoft-windows-dns-client-minwin_31bf3856ad364e35_10.0.10586.212_none_0d0987cfb6756063\dnsapi.dll C:\Windows\SysWOW64\dnsapi.dll" => not found.
 

The system needed a reboot.
 
==== End of Fixlog 20:46:11 ====

Edited by looney2340, 12 July 2016 - 07:59 PM.


#10 nasdaq

nasdaq

  • Malware Response Team
  • 38,559 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:Montreal, QC. Canada
  • Local time:07:13 PM

Posted 13 July 2016 - 09:38 AM

The replacement of the file dnsapi.dll failed - File not found.
Try this fix.

Press the windows key Windows_Logo_key.gif+ r on your keyboard at the same time. This will open the RUN BOX.
Type Notepad and and click the OK key.
Please copy the entire contents of the code box below to the a new file.
 
start

CreateRestorePoint:
CloseProcesses:
Replace: C:\Windows\WinSxS\amd64_microsoft-windows-dns-client-minwin_31bf3856ad364e35_10.0.10586.212_none_02b4dd7d82149e68\dnsapi.dll C:\Windows\SysWOW64\dnsapi.dll

End
Save the file as fixlist.txt in the same folder where the Farbar tool is running from.
The location is listed in the 3rd line of the Farbar log you have submitted.

Run FRST and click Fix only once and wait.

Restart the computer normally to reset the registry.

The tool will create a log (Fixlog.txt) please post it to your reply.

How is it now?

#11 looney2340

looney2340
  • Topic Starter

  • Members
  • 202 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:NYC
  • Local time:06:13 PM

Posted 13 July 2016 - 10:26 PM

 
Hello,
Below is my log as requested. But upon reboot avast didn't start and neither did windows defender I was unable to start them manually. I also still am unable to run fire fox as well as malware bytes, but malware bytes does run in safe mode I get the error still that fire fox  has crashed and doesn't run. Also attached is the errors when I try to run them.
 
 
 
 
 
Fix result of Farbar Recovery Scan Tool (x64) Version: 13-07-2016 02
Ran by Hank (2016-07-13 23:14:01) Run:4
Running from C:\Users\Hank\Downloads
Loaded Profiles: Hank (Available Profiles: Hank)
Boot Mode: Normal
==============================================
 
fixlist content:
*****************
start
 
CreateRestorePoint:
CloseProcesses:
Replace: C:\Windows\WinSxS\amd64_microsoft-windows-dns-client-minwin_31bf3856ad364e35_10.0.10586.212_none_02b4dd7d82149e68\dnsapi.dll C:\Windows\SysWOW64\dnsapi.dll
 
End
*****************
 
Restore point was successfully created.
Processes closed successfully.
C:\Windows\SysWOW64\dnsapi.dll => moved successfully
C:\Windows\WinSxS\amd64_microsoft-windows-dns-client-minwin_31bf3856ad364e35_10.0.10586.212_none_02b4dd7d82149e68\dnsapi.dll copied successfully to C:\Windows\SysWOW64\dnsapi.dll
 

The system needed a reboot.
 
==== End of Fixlog 23:14:45 ====

 

Attached Files



#12 nasdaq

nasdaq

  • Malware Response Team
  • 38,559 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:Montreal, QC. Canada
  • Local time:07:13 PM

Posted 14 July 2016 - 09:02 AM

Go to this page.

http://www.tomshardware.com/answers/id-1991597/windows-bit-error-0xc000007b.html

Look at the solutions by Curiousaboutpc

I suggest you start with No3, then 2, then 1.

If this fails try get the Latest Windows Updates.

Keep me posted.

#13 looney2340

looney2340
  • Topic Starter

  • Members
  • 202 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:NYC
  • Local time:06:13 PM

Posted 14 July 2016 - 06:24 PM

Ok i will follow the directions and let you know. i also wanted to update you i tried to go in safe mode and uninstall fire fox and malwarebytes so i can do fresh installs and i get runtime .dll errors and i cant. Right now i am unprotected with no virus scan because it will still hot start.



#14 looney2340

looney2340
  • Topic Starter

  • Members
  • 202 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:NYC
  • Local time:06:13 PM

Posted 14 July 2016 - 10:38 PM

Hello,

I am still unable to run malware bytes or my virus program even after trying the suggested fix. I used an uninstaller to uninstall both programs. I get an error still when trying to reinstall avast. I will try to reinstall Malwarebytes later on and let you know what happens



#15 nasdaq

nasdaq

  • Malware Response Team
  • 38,559 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:Montreal, QC. Canada
  • Local time:07:13 PM

Posted 15 July 2016 - 07:42 AM


To remove every traces of programs I suggest that your Download the Revo Unintaller.

Get the Free version.
http://www.revouninstaller.com/

Run the tool and remove everything referencing Firefox.
Restart the computer normally and see if you can reinstall the browser.

===

You can do the same for any other programs not working properly.

Keep me posted.




0 user(s) are reading this topic

0 members, 0 guests, 0 anonymous users