Jump to content


 


Register a free account to unlock additional features at BleepingComputer.com
Welcome to BleepingComputer, a free community where people like yourself come together to discuss and learn how to use their computers. Using the site is easy and fun. As a guest, you can browse and view the various discussions in the forums, but can not create a new topic or reply to an existing one unless you are logged in. Other benefits of registering an account are subscribing to topics and forums, creating a blog, and having no ads shown anywhere on the site.


Click here to Register a free account now! or read our Welcome Guide to learn how to use this site.

Photo

Fake Zeus virus warning popup


  • This topic is locked This topic is locked
10 replies to this topic

#1 almasat

almasat

  • Members
  • 26 posts
  • OFFLINE
  •  
  • Local time:02:07 AM

Posted 04 August 2017 - 03:32 AM

Hello,

I am getting fake warning about Windows kernel getting infected by Zeus virus. Also, sometimes, google search shows my location as North Korea. The FRST.txt and Addion.txt log files are below.

None of the scans by Malwarebytes or Eset show anything wrong.

 

Thanks.

 

Scan result of Farbar Recovery Scan Tool (FRST) (x64) Version: 31-07-2017
Ran by Raj (administrator) on DESKTOP-MOI971O (04-08-2017 13:55:12)
Running from C:\Users\Raj\Desktop
Loaded Profiles: Raj (Available Profiles: Raj)
Platform: Windows 10 Home Single Language Version 1607 (X64) Language: English (United States)
Internet Explorer Version 11 (Default browser: Chrome)
Boot Mode: Normal
Tutorial for Farbar Recovery Scan Tool: http://www.geekstogo.com/forum/topic/335081-frst-tutorial-how-to-use-farbar-recovery-scan-tool/

==================== Processes (Whitelisted) =================

(If an entry is included in the fixlist, the process will be closed. The file will not be moved.)

(Intel Corporation) C:\Windows\System32\DriverStore\FileRepository\k120836.inf_amd64_ccaf7e7e1e972b78\igfxCUIService.exe
(AMD) C:\Windows\System32\atiesrxx.exe
(Realtek Semiconductor) C:\Program Files\Realtek\Audio\HDA\RtkAudioService64.exe
(Microsoft Corporation) C:\Windows\System32\wlanext.exe
(Intel® Corporation) C:\Program Files\Intel\WiFi\bin\EvtEng.exe
(Intel Corporation) C:\Windows\System32\ibtsiva.exe
(AO Kaspersky Lab) C:\Program Files (x86)\Kaspersky Lab\Kaspersky Security Scan\kss.exe
(Intel® Corporation) C:\Program Files\Common Files\Intel\WirelessCommon\RegSrvc.exe
(Waves Audio Ltd.) C:\Program Files\Waves\MaxxAudio\WavesSysSvc64.exe
(Intel® Corporation) C:\Program Files\Intel\WiFi\bin\ZeroConfigService.exe
(Microsoft Corporation) C:\Program Files\Windows Defender\MsMpEng.exe
(Copyright 2017.) C:\Program Files (x86)\Zemana AntiLogger\ZAM.exe
(Malwarebytes) C:\Program Files\Malwarebytes\Anti-Malware\MBAMService.exe
(Microsoft Corporation) C:\Program Files\Windows Defender\NisSrv.exe
(Dell Inc.) C:\Program Files\Dell\DellDataVault\DDVRulesProcessor.exe
(Dell Inc.) C:\Program Files (x86)\Dell Customer Connect\DCCService.exe
(Dell) C:\Program Files\Dell\Dell Foundation Services\DFSSvc.exe
(Dell Inc.) C:\Program Files\Dell\Dell Help & Support\MDLCSvc.exe
(Dell Products, LP.) C:\Program Files (x86)\Dell Digital Delivery\DeliveryService.exe
(Intel Corporation) C:\Program Files\Intel\Intel® Rapid Storage Technology\IAStorDataMgrSvc.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Intel® Management Engine Components\DAL\jhi_service.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Intel® Management Engine Components\LMS\LMS.exe
(Dell) C:\Program Files\Dell\Dell Product Registration\PRSvc.exe
(Dell Inc.) C:\Program Files\Dell\SupportAssistAgent\bin\SupportAssistAgent.exe
(Microsoft Corporation) C:\Windows\Microsoft.NET\Framework64\v3.0\WPF\PresentationFontCache.exe
(Dell Inc.) C:\Program Files\Dell\DellDataVault\DDVDataCollector.exe
(Dell Inc.) C:\Program Files\Dell\DellDataVault\DDVCollectorSvcApi.exe
(Microsoft Corporation) C:\Windows\SysWOW64\wbem\WmiPrvSE.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Intel® Security Assist\isa.exe
(AMD) C:\Windows\System32\atieclxx.exe
(Realtek Semiconductor) C:\Program Files\Realtek\Audio\HDA\RAVBg64.exe
(Realtek Semiconductor) C:\Program Files\Realtek\Audio\HDA\RAVBg64.exe
(Dell) C:\Program Files\Dell\Dell Foundation Services\DFS.Common.Agent.exe
(Intel Corporation) C:\Windows\System32\DriverStore\FileRepository\k120836.inf_amd64_ccaf7e7e1e972b78\igfxEM.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Realtek Semiconductor) C:\Program Files\Realtek\Audio\HDA\RtkNGUI64.exe
(Realtek Semiconductor) C:\Program Files\Realtek\Audio\HDA\RAVBg64.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Dell Inc.) C:\Program Files\Dell\QuickSet\quickset.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Waves Audio Ltd.) C:\Program Files\Waves\MaxxAudio\WavesSvc64.exe
(Malwarebytes) C:\Program Files\Malwarebytes\Anti-Malware\mbamtray.exe
(Microsoft Corporation) C:\Program Files\Windows Defender\MSASCuiL.exe
(Copyright 2017.) C:\Program Files (x86)\Zemana AntiLogger\ZAM.exe
(Realtek Semiconductor) C:\Program Files\Realtek\Audio\HDA\RAVBg64.exe
(Advanced Micro Devices, Inc.) C:\Program Files\AMD\CNext\CNext\RadeonSettings.exe
(Flux Software LLC) C:\Users\Raj\AppData\Local\FluxSoftware\Flux\flux.exe
(QFX Software Corporation) C:\Program Files (x86)\KeyScrambler\KeyScrambler.exe
(QFX Software Corporation) C:\Program Files (x86)\KeyScrambler\x64\KeyScrambler.exe
(Microsoft Corporation) C:\Windows\System32\InstallAgent.exe
(Microsoft Corporation) C:\Windows\System32\InstallAgentUserBroker.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Intel Corporation) C:\Program Files\Intel\Intel® Rapid Storage Technology\IAStorIcon.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Mozilla Corporation) C:\Users\Raj\Desktop\Misc\Browser\firefox.exe
() C:\Users\Raj\Desktop\Misc\Browser\TorBrowser\Tor\tor.exe
(Mozilla Corporation) C:\Users\Raj\Desktop\Misc\Browser\firefox.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Microsoft Corporation) C:\Windows\System32\smartscreen.exe
(Microsoft Corporation) C:\Program Files\Windows Defender\MpCmdRun.exe

==================== Registry (Whitelisted) ====================

(If an entry is included in the fixlist, the registry item will be restored to default or removed. The file will not be moved.)

HKLM\...\Run: [RTHDVCPL] => C:\Program Files\Realtek\Audio\HDA\RtkNGUI64.exe [8848640 2016-02-05] (Realtek Semiconductor)
HKLM\...\Run: [RtHDVBg_MAXX6] => C:\Program Files\Realtek\Audio\HDA\RAVBg64.exe [1419008 2016-02-05] (Realtek Semiconductor)
HKLM\...\Run: [QuickSet] => c:\Program Files\Dell\QuickSet\QuickSet.exe [7823824 2015-09-22] (Dell Inc.)
HKLM\...\Run: [WavesSvc] => C:\Program Files\Waves\MaxxAudio\WavesSvc64.exe [718256 2015-12-22] (Waves Audio Ltd.)
HKLM\...\Run: [Eraser] => C:\Program Files\Eraser\Eraser.exe [1074600 2016-08-28] (The Eraser Project)
HKLM\...\Run: [IAStorIcon] => C:\Program Files\Intel\Intel® Rapid Storage Technology\IAStorIcon.exe [322120 2016-04-28] (Intel Corporation)
HKLM\...\Run: [Malwarebytes TrayApp] => C:\PROGRAM FILES\MALWAREBYTES\ANTI-MALWARE\mbamtray.exe [3146704 2017-05-09] (Malwarebytes)
HKLM\...\Run: [WindowsDefender] => C:\Program Files\Windows Defender\MSASCuiL.exe [631808 2017-04-28] (Microsoft Corporation)
HKLM\...\Run: [ZAM] => C:\Program Files (x86)\Zemana AntiLogger\ZAM.exe [15546512 2017-06-19] (Copyright 2017.)
HKLM\...\Run: [StartCN] => C:\Program Files\AMD\CNext\CNext\RadeonSettings.exe [8029576 2016-12-06] (Advanced Micro Devices, Inc.)
HKLM-x32\...\Run: [KeyScrambler] => C:\Program Files (x86)\KeyScrambler\keyscrambler.exe [515600 2017-04-23] (QFX Software Corporation)
HKU\S-1-5-21-3363881303-3615463573-1429575272-1001\...\Run: [CCleaner Monitoring] => C:\Program Files\CCleaner\CCleaner64.exe [9818328 2017-06-30] (Piriform Ltd)
HKU\S-1-5-21-3363881303-3615463573-1429575272-1001\...\Run: [f.lux] => C:\Users\Raj\AppData\Local\FluxSoftware\Flux\flux.exe [1017224 2013-10-24] (Flux Software LLC)
HKU\S-1-5-21-3363881303-3615463573-1429575272-1001\...\Run: [KSS] => C:\Program Files (x86)\Kaspersky Lab\Kaspersky Security Scan\kss.exe [1556448 2015-12-15] (AO Kaspersky Lab)
HKU\S-1-5-21-3363881303-3615463573-1429575272-1001\...\Run: [Kaspersky Software Updater] => C:\Program Files (x86)\Kaspersky Lab\Kaspersky Software Updater\kl_platf.exe [1565000 2016-11-26] (AO Kaspersky Lab)
HKU\S-1-5-21-3363881303-3615463573-1429575272-1001\...\MountPoints2: {32b5b2b8-12c8-11e6-be32-001e64ec2a92} - "E:\Windows\AutoRun.exe"
HKU\S-1-5-21-3363881303-3615463573-1429575272-1001\...\MountPoints2: {948c60aa-168a-11e6-be35-806e6f6e6963} - "F:\Windows\AutoRun.exe"
HKU\S-1-5-18\...\Run: [KSS] => C:\Program Files (x86)\Kaspersky Lab\Kaspersky Security Scan\kss.exe [1556448 2015-12-15] (AO Kaspersky Lab)
AppInit_DLLs: C:\PROGRA~2\KEYCRY~1\KE1E1C~1.DLL => C:\Program Files (x86)\KeyCryptSDK\KeyCrypt64(3).dll [94568 2017-01-19] (Zemana Ltd.)
AppInit_DLLs-x32: C:\PROGRA~2\KEYCRY~1\KE4A1D~1.DLL => C:\Program Files (x86)\KeyCryptSDK\KeyCrypt32(3).dll [85864 2017-01-19] (Zemana Ltd.)
AppInit_DLLs-x32: ,C:\PROGRA~2\Sophos\SOPHOS~1\\SOPHOS~1.DLL => No File

==================== Internet (Whitelisted) ====================

(If an item is included in the fixlist, if it is a registry item it will be removed or restored to default.)

Tcpip\Parameters: [DhcpNameServer] 192.168.225.1
Tcpip\..\Interfaces\{05f48935-ee50-464d-b93f-e92cd0c5ad2f}: [DhcpNameServer] 192.168.225.1
Tcpip\..\Interfaces\{b254e67b-2b43-464b-9f75-89f3b502f54a}: [DhcpNameServer] 192.168.225.1

Internet Explorer:
==================
HKU\S-1-5-21-3363881303-3615463573-1429575272-1001\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://dell15.msn.com/?pc=DCTE
HKU\S-1-5-21-3363881303-3615463573-1429575272-1001\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = hxxp://dell15.msn.com/?pc=DCTE
SearchScopes: HKU\S-1-5-21-3363881303-3615463573-1429575272-1001 -> DefaultScope {81792A9A-D0FA-473B-89D7-6C5B030C7109} URL =
SearchScopes: HKU\S-1-5-21-3363881303-3615463573-1429575272-1001 -> {81792A9A-D0FA-473B-89D7-6C5B030C7109} URL =
DPF: HKLM-x32 {5AE58FCF-6F6A-49B2-B064-02492C66E3F4} hxxp://catalog.update.microsoft.com/v7/site/ClientControl/en/x86/MuCatalogWebControl.cab?1472886130458

FireFox:
========
FF ProfilePath: C:\Users\Raj\AppData\Roaming\Mozilla\Firefox\Profiles\2swvr9eq.default-1479369694386 [2017-08-01]
FF Extension: (ZenMate Security, Privacy & Unblock VPN) - C:\Users\Raj\AppData\Roaming\Mozilla\Firefox\Profiles\2swvr9eq.default-1479369694386\Extensions\firefox@zenmate.com.xpi [2017-08-01]
FF Extension: (uBlock Origin) - C:\Users\Raj\AppData\Roaming\Mozilla\Firefox\Profiles\2swvr9eq.default-1479369694386\Extensions\uBlock0@raymondhill.net.xpi [2017-07-30]
FF Extension: (NoScript) - C:\Users\Raj\AppData\Roaming\Mozilla\Firefox\Profiles\2swvr9eq.default-1479369694386\Extensions\{73a6fe31-595d-460b-a920-fcc0f8843232}.xpi [2017-07-30]
FF Extension: (Video DownloadHelper) - C:\Users\Raj\AppData\Roaming\Mozilla\Firefox\Profiles\2swvr9eq.default-1479369694386\Extensions\{b9db16a4-6edc-47ec-a1f4-b86292ed211d}.xpi [2017-07-30]
FF Plugin-x32: @intel-webapi.intel.com/Intel WebAPI ipt;version=4.0.68 -> C:\Program Files (x86)\Intel\Intel® Management Engine Components\IPT\npIntelWebAPIIPT.dll [2015-08-25] (Intel Corporation)
FF Plugin-x32: @intel-webapi.intel.com/Intel WebAPI updater -> C:\Program Files (x86)\Intel\Intel® Management Engine Components\IPT\npIntelWebAPIUpdater.dll [2015-08-25] (Intel Corporation)
FF Plugin-x32: @tools.google.com/Google Update;version=3 -> C:\Program Files (x86)\Google\Update\1.3.33.5\npGoogleUpdate3.dll [2017-04-30] (Google Inc.)
FF Plugin-x32: @tools.google.com/Google Update;version=9 -> C:\Program Files (x86)\Google\Update\1.3.33.5\npGoogleUpdate3.dll [2017-04-30] (Google Inc.)
FF Plugin-x32: @videolan.org/vlc,version=2.2.3 -> C:\Program Files (x86)\VideoLAN\VLC\npvlc.dll [2017-05-24] (VideoLAN)
FF Plugin-x32: @videolan.org/vlc,version=2.2.4 -> C:\Program Files (x86)\VideoLAN\VLC\npvlc.dll [2017-05-24] (VideoLAN)
FF Plugin-x32: @videolan.org/vlc,version=2.2.6 -> C:\Program Files (x86)\VideoLAN\VLC\npvlc.dll [2017-05-24] (VideoLAN)

Chrome:
=======
CHR DefaultProfile: Profile 1
CHR DefaultSearchKeyword: Profile 1 -> lp
CHR Profile: C:\Users\Raj\AppData\Local\Google\Chrome\User Data\Default [2017-08-04]
CHR Extension: (Google Slides) - C:\Users\Raj\AppData\Local\Google\Chrome\User Data\Default\Extensions\aapocclcgogkmnckokdopfmhonfmgoek [2016-05-07]
CHR Extension: (Google Docs) - C:\Users\Raj\AppData\Local\Google\Chrome\User Data\Default\Extensions\aohghmighlieiainnegkcijnfilokake [2016-05-07]
CHR Extension: (Google Drive) - C:\Users\Raj\AppData\Local\Google\Chrome\User Data\Default\Extensions\apdfllckaahabafndbhieahigkjlhalf [2016-05-10]
CHR Extension: (ZenMate VPN - Best Cyber Security & Unblock) - C:\Users\Raj\AppData\Local\Google\Chrome\User Data\Default\Extensions\fdcgdnkidjaadafnichfpabhfomcebme [2017-08-02]
CHR Extension: (HTTPS Everywhere) - C:\Users\Raj\AppData\Local\Google\Chrome\User Data\Default\Extensions\gcbommkclmclpchllfjekcdonpmejbdp [2017-07-20]
CHR Extension: (Google Docs Offline) - C:\Users\Raj\AppData\Local\Google\Chrome\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi [2016-05-07]
CHR Extension: (Chrome Web Store Payments) - C:\Users\Raj\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda [2017-03-12]
CHR Extension: (Data Saver) - C:\Users\Raj\AppData\Local\Google\Chrome\User Data\Default\Extensions\pfmgfdlgomnbgkofeojodiodmgpgmkac [2016-05-29]
CHR Extension: (Gmail) - C:\Users\Raj\AppData\Local\Google\Chrome\User Data\Default\Extensions\pjkljhegncpnkpknbcohdijeoejaedia [2016-05-07]
CHR Extension: (Chrome Media Router) - C:\Users\Raj\AppData\Local\Google\Chrome\User Data\Default\Extensions\pkedcjkdefgpdelpbcmbmeomcjbeemfm [2017-07-26]
CHR Extension: (Privacy Badger) - C:\Users\Raj\AppData\Local\Google\Chrome\User Data\Default\Extensions\pkehgijcmpdhfbdbbnkijodmdjhbjlgp [2017-07-25]
CHR Profile: C:\Users\Raj\AppData\Local\Google\Chrome\User Data\Guest Profile [2017-07-31]
CHR Profile: C:\Users\Raj\AppData\Local\Google\Chrome\User Data\Profile 1 [2017-08-04]
CHR Extension: (Google Drive) - C:\Users\Raj\AppData\Local\Google\Chrome\User Data\Profile 1\Extensions\apdfllckaahabafndbhieahigkjlhalf [2016-05-08]
CHR Extension: (Yukon Extension) - C:\Users\Raj\AppData\Local\Google\Chrome\User Data\Profile 1\Extensions\belncckcaakhmonmcfmegbglccbjlebc [2017-05-31]
CHR Extension: (YouTube) - C:\Users\Raj\AppData\Local\Google\Chrome\User Data\Profile 1\Extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo [2016-05-07]
CHR Extension: (HTTPS Everywhere) - C:\Users\Raj\AppData\Local\Google\Chrome\User Data\Profile 1\Extensions\gcbommkclmclpchllfjekcdonpmejbdp [2017-07-19]
CHR Extension: (LastPass: Free Password Manager) - C:\Users\Raj\AppData\Local\Google\Chrome\User Data\Profile 1\Extensions\hdokiejnpimakedhajhdlcegeplioahd [2017-08-02]
CHR Extension: (Chrome Web Store Payments) - C:\Users\Raj\AppData\Local\Google\Chrome\User Data\Profile 1\Extensions\nmmhkkegccagdldgiimedpiccmgmieda [2017-03-09]
CHR Extension: (AMP Validator) - C:\Users\Raj\AppData\Local\Google\Chrome\User Data\Profile 1\Extensions\nmoffdblmcmgeicmolmhobpoocbbmknc [2017-07-04]
CHR Extension: (Transcribe: transcribe audio/interviews fast!) - C:\Users\Raj\AppData\Local\Google\Chrome\User Data\Profile 1\Extensions\ogokenmicnjdfhmhocanoemnddmpcjjm [2017-06-03]
CHR Extension: (Data Saver) - C:\Users\Raj\AppData\Local\Google\Chrome\User Data\Profile 1\Extensions\pfmgfdlgomnbgkofeojodiodmgpgmkac [2016-06-23]
CHR Extension: (Evernote Web Clipper) - C:\Users\Raj\AppData\Local\Google\Chrome\User Data\Profile 1\Extensions\pioclpoplcdbaefihamjohnefbikjilc [2017-05-31]
CHR Extension: (Gmail) - C:\Users\Raj\AppData\Local\Google\Chrome\User Data\Profile 1\Extensions\pjkljhegncpnkpknbcohdijeoejaedia [2016-05-07]
CHR Extension: (Chrome Media Router) - C:\Users\Raj\AppData\Local\Google\Chrome\User Data\Profile 1\Extensions\pkedcjkdefgpdelpbcmbmeomcjbeemfm [2017-07-26]
CHR Profile: C:\Users\Raj\AppData\Local\Google\Chrome\User Data\System Profile [2017-06-26]

==================== Services (Whitelisted) ====================

(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)

S3 cphs; C:\WINDOWS\System32\DriverStore\FileRepository\k120836.inf_amd64_ccaf7e7e1e972b78\IntelCpHeciSvc.exe [303064 2017-02-20] (Intel Corporation)
S3 cplspcon; C:\WINDOWS\System32\DriverStore\FileRepository\k120836.inf_amd64_ccaf7e7e1e972b78\IntelCpHDCPSvc.exe [480224 2017-02-20] (Intel Corporation)
R2 DDVCollectorSvcApi; C:\Program Files\Dell\DellDataVault\DDVCollectorSvcApi.exe [206712 2017-06-20] (Dell Inc.)
R2 DDVDataCollector; C:\Program Files\Dell\DellDataVault\DDVDataCollector.exe [3296632 2017-06-20] (Dell Inc.)
R2 DDVRulesProcessor; C:\Program Files\Dell\DellDataVault\DDVRulesProcessor.exe [217464 2017-06-20] (Dell Inc.)
R2 Dell Customer Connect; C:\Program Files (x86)\Dell Customer Connect\DCCService.exe [130936 2016-12-21] (Dell Inc.)
R2 Dell Foundation Services; C:\Program Files\Dell\Dell Foundation Services\DFSSvc.exe [97616 2017-01-11] (Dell)
R2 Dell Help & Support; C:\Program Files\Dell\Dell Help & Support\MDLCSvc.exe [77648 2016-12-22] (Dell Inc.)
S4 DellUpdate; C:\Program Files (x86)\Dell Update\DellUpService.exe [230248 2017-05-01] (Dell Inc.)
R2 IAStorDataMgrSvc; C:\Program Files\Intel\Intel® Rapid Storage Technology\IAStorDataMgrSvc.exe [18504 2016-04-28] (Intel Corporation)
R2 igfxCUIService2.0.0.0; C:\WINDOWS\System32\DriverStore\FileRepository\k120836.inf_amd64_ccaf7e7e1e972b78\igfxCUIService.exe [341976 2017-02-20] (Intel Corporation)
S3 Intel® Capability Licensing Service TCP IP Interface; C:\Program Files\Intel\iCLS Client\SocketHeciServer.exe [881152 2015-05-22] (Intel® Corporation)
R3 Intel® Security Assist; C:\Program Files (x86)\Intel\Intel® Security Assist\isa.exe [335872 2015-05-19] (Intel Corporation) [File not signed]
S2 isaHelperSvc; C:\Program Files (x86)\Intel\Intel® Security Assist\isaHelperService.exe [7680 2015-05-19] () [File not signed]
R2 jhi_service; C:\Program Files (x86)\Intel\Intel® Management Engine Components\DAL\jhi_service.exe [207648 2015-09-19] (Intel Corporation)
R2 kss; C:\Program Files (x86)\Kaspersky Lab\Kaspersky Security Scan\kss.exe [1556448 2015-12-15] (AO Kaspersky Lab)
S3 ksu; C:\Program Files (x86)\Kaspersky Lab\Kaspersky Software Updater\kl_platf.exe [1565000 2016-11-26] (AO Kaspersky Lab)
R2 MBAMService; C:\Program Files\Malwarebytes\Anti-Malware\mbamservice.exe [4470736 2017-05-09] (Malwarebytes)
S3 MyWiFiDHCPDNS; C:\Program Files\Intel\WiFi\bin\PanDhcpDns.exe [268704 2017-03-21] ()
R2 Product Registration; C:\Program Files\Dell\Dell Product Registration\PRSvc.exe [47144 2017-04-06] (Dell)
S3 QFXUpdateService; C:\Program Files (x86)\KeyScrambler\x64\QFXUpdateService.exe [86544 2017-04-23] ()
S3 rpcapd; C:\Program Files (x86)\WinPcap\rpcapd.exe [118520 2013-03-01] (Riverbed Technology, Inc.)
R2 RtkAudioService; C:\Program Files\Realtek\Audio\HDA\RtkAudioService64.exe [310016 2016-02-05] (Realtek Semiconductor)
R2 SupportAssistAgent; C:\Program Files\Dell\SupportAssistAgent\bin\SupportAssistAgent.exe [52696 2017-06-28] (Dell Inc.)
R2 WavesSysSvc; C:\Program Files\Waves\MaxxAudio\WavesSysSvc64.exe [613296 2015-12-22] (Waves Audio Ltd.)
R3 WdNisSvc; C:\Program Files\Windows Defender\NisSrv.exe [347320 2017-04-28] (Microsoft Corporation)
R2 WinDefend; C:\Program Files\Windows Defender\MsMpEng.exe [103712 2017-04-28] (Microsoft Corporation)
R2 ZAMSvc; C:\Program Files (x86)\Zemana AntiLogger\ZAM.exe [15546512 2017-06-19] (Copyright 2017.)
R2 ZeroConfigService; C:\Program Files\Intel\WiFi\bin\ZeroConfigService.exe [3750304 2017-03-21] (Intel® Corporation)
R2 ibtsiva; %SystemRoot%\system32\ibtsiva [X]

===================== Drivers (Whitelisted) ======================

(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)

R3 amdkmdag; C:\WINDOWS\System32\DriverStore\FileRepository\c0313191.inf_amd64_f86a31122289b968\atikmdag.sys [26565632 2016-12-07] (Advanced Micro Devices, Inc.)
R3 amdkmdap; C:\WINDOWS\System32\DriverStore\FileRepository\c0313191.inf_amd64_f86a31122289b968\atikmpag.sys [520584 2016-12-07] (Advanced Micro Devices, Inc.)
R3 DDDriver; C:\WINDOWS\system32\drivers\DDDriver64Dcsa.sys [32960 2017-04-11] (Dell Inc.)
R3 DellProf; C:\WINDOWS\system32\drivers\DellProf.sys [32568 2017-04-11] (Dell Computer Corporation)
R3 DellRbtn; C:\WINDOWS\System32\drivers\DellRbtn.sys [19440 2015-05-09] (OSR Open Systems Resources, Inc.)
R3 ibtusb; C:\WINDOWS\system32\DRIVERS\ibtusb.sys [347912 2016-08-03] (Intel Corporation)
R3 igfx; C:\WINDOWS\System32\DriverStore\FileRepository\k120836.inf_amd64_ccaf7e7e1e972b78\igdkmd64.sys [11060192 2017-02-20] (Intel Corporation)
R3 keycrypt; C:\WINDOWS\System32\DRIVERS\KeyCrypt64.sys [161408 2017-03-22] (Zemana Ltd.)
R3 KeyScrambler; C:\WINDOWS\System32\drivers\keyscrambler.sys [233248 2017-02-20] (QFX Software Corporation)
S3 MBAMFarflt; C:\WINDOWS\system32\drivers\farflt.sys [111544 2017-05-17] (Malwarebytes)
R3 MBAMSwissArmy; C:\WINDOWS\system32\drivers\MBAMSwissArmy.sys [253856 2017-07-30] (Malwarebytes)
R1 MpKsl386aa734; C:\ProgramData\Microsoft\Windows Defender\Definition Updates\{F0BCDDB0-ECBD-4467-9F0F-A3EEF60DF38F}\MpKsl386aa734.sys [44928 2017-08-03] (Microsoft Corporation)
R1 MpKsl561b69a0; C:\ProgramData\Microsoft\Windows Defender\Definition Updates\{8F6417CF-DC94-46A3-AE1D-232F39BB9301}\MpKsl561b69a0.sys [44928 2017-07-30] (Microsoft Corporation)
S3 NetAdapterCx; C:\WINDOWS\System32\drivers\NetAdapterCx.sys [90624 2016-07-16] ()
R3 NETwNb64; C:\WINDOWS\System32\drivers\Netwbw02.sys [3517696 2017-04-13] (Intel Corporation)
R3 NPF; C:\WINDOWS\System32\drivers\npf.sys [36600 2013-03-01] (Riverbed Technology, Inc.)
R3 rt640x64; C:\WINDOWS\System32\drivers\rt640x64.sys [886528 2015-05-29] (Realtek                                            )
R3 RTSUER; C:\WINDOWS\system32\Drivers\RtsUer.sys [402136 2015-05-28] (Realsil Semiconductor Corporation)
R1 veracrypt; C:\WINDOWS\System32\drivers\veracrypt.sys [467368 2017-05-09] (IDRIX)
S0 WdBoot; C:\WINDOWS\System32\drivers\WdBoot.sys [44056 2016-07-16] (Microsoft Corporation)
R0 WdFilter; C:\WINDOWS\System32\drivers\WdFilter.sys [290144 2016-07-16] (Microsoft Corporation)
S3 wdm_usb; C:\WINDOWS\system32\DRIVERS\usb2ser.sys [151184 2016-07-15] (MBB)
R3 WdNisDrv; C:\WINDOWS\System32\Drivers\WdNisDrv.sys [123232 2016-07-16] (Microsoft Corporation)
R1 ZAM; C:\WINDOWS\System32\drivers\zam64.sys [203680 2017-06-13] (Zemana Ltd.)
R1 ZAM_Guard; C:\WINDOWS\System32\drivers\zamguard64.sys [203680 2017-06-13] (Zemana Ltd.)

==================== NetSvcs (Whitelisted) ===================

(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)


==================== One Month Created files and folders ========

(If an entry is included in the fixlist, the file/folder will be moved.)

2017-08-04 13:55 - 2017-08-04 13:56 - 000022675 _____ C:\Users\Raj\Desktop\FRST.txt
2017-08-04 13:55 - 2017-08-04 13:55 - 000000000 ____D C:\FRST
2017-08-04 13:53 - 2017-08-04 13:54 - 002381312 _____ (Farbar) C:\Users\Raj\Desktop\FRST64.exe
2017-08-03 08:11 - 2017-08-03 08:11 - 004964024 _____ C:\Users\Raj\Downloads\The Making of Don.azw3
2017-08-02 15:37 - 2017-08-02 15:43 - 000000000 ____D C:\Users\Raj\AppData\Local\Thunderbird
2017-08-02 15:37 - 2017-08-02 15:37 - 000000000 ____D C:\Users\Raj\AppData\Roaming\Thunderbird
2017-08-02 15:36 - 2017-08-02 15:36 - 000001284 _____ C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Mozilla Thunderbird.lnk
2017-08-02 15:36 - 2017-08-02 15:36 - 000000000 ____D C:\Program Files (x86)\Mozilla Thunderbird
2017-08-02 15:29 - 2017-08-02 15:29 - 000000000 ____D C:\Users\Raj\Documents\Takeout
2017-08-02 15:26 - 2017-08-02 15:27 - 019175518 _____ C:\Users\Raj\Documents\takeout-20170802T095359Z-001.zip
2017-08-02 09:47 - 2017-08-02 09:47 - 000663186 _____ C:\Users\Raj\Downloads\Logogram_Decks.zip
2017-08-01 09:48 - 2017-08-01 09:48 - 000001829 _____ C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Wireshark.lnk
2017-07-31 22:53 - 2017-07-31 22:53 - 004353633 _____ C:\Users\Raj\Documents\Tim.Blogging.Hacks.pdf
2017-07-31 22:51 - 2017-07-31 22:51 - 011995611 _____ C:\Users\Raj\Documents\5-morning-rituals-that-help-me-win-the-day1.pdf
2017-07-28 10:06 - 2017-07-28 10:34 - 000000000 ____D C:\Users\Raj\Documents\mbar
2017-07-28 10:05 - 2017-07-28 10:06 - 016563352 _____ (Malwarebytes Corp.) C:\Users\Raj\Downloads\mbar-1.09.3.1001.exe
2017-07-27 19:09 - 2017-07-27 19:11 - 042179032 _____ C:\Users\Raj\Downloads\Mastering_Kanji_1500.pdf
2017-07-25 17:55 - 2017-07-25 17:55 - 000003934 _____ C:\WINDOWS\System32\Tasks\Dell SupportAssistAgent AnonymousRegistration
2017-07-22 13:26 - 2017-08-03 22:22 - 000000000 ____D C:\Users\Raj\Hindi
2017-07-18 17:53 - 2017-07-18 17:53 - 000194859 _____ C:\Users\Raj\Documents\The Ultimate Guide to Habits – Peak Performance Made Easy.html
2017-07-18 17:53 - 2017-07-18 17:53 - 000000000 ____D C:\Users\Raj\Documents\The Ultimate Guide to Habits – Peak Performance Made Easy_files
2017-07-13 12:51 - 2017-08-02 19:43 - 000000000 ____D C:\Users\Raj\Kindle_on1307
2017-07-13 02:06 - 2017-07-07 13:15 - 002263832 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\iertutil.dll
2017-07-13 02:06 - 2017-07-07 12:59 - 005686272 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\Windows.Data.Pdf.dll
2017-07-13 02:06 - 2017-07-07 12:50 - 000059904 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\l2gpstore.dll
2017-07-13 02:06 - 2017-07-07 12:41 - 000340480 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\iedkcs32.dll
2017-07-13 02:06 - 2017-07-07 12:39 - 000637952 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\SmartcardCredentialProvider.dll
2017-07-13 02:06 - 2017-07-07 12:24 - 002027008 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\inetcpl.cpl
2017-07-13 02:06 - 2017-07-07 12:23 - 002483200 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\wininet.dll
2017-07-13 02:06 - 2017-07-07 12:22 - 001599488 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\urlmon.dll
2017-07-13 02:06 - 2017-07-07 12:22 - 001413632 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\OpcServices.dll
2017-07-13 02:06 - 2017-06-21 12:52 - 000361104 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\tsmf.dll
2017-07-13 02:06 - 2017-06-21 12:51 - 006665440 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\Windows.Media.Protection.PlayReady.dll
2017-07-13 02:06 - 2017-06-21 12:29 - 000255488 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\unimdm.tsp
2017-07-13 02:06 - 2017-06-21 12:28 - 000136192 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\WinRtTracing.dll
2017-07-13 02:06 - 2017-06-21 12:28 - 000094208 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\Windows.StateRepositoryClient.dll
2017-07-13 02:06 - 2017-06-21 12:28 - 000059904 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\Windows.System.UserDeviceAssociation.dll
2017-07-13 02:06 - 2017-06-21 12:26 - 000392192 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\Windows.Gaming.Input.dll
2017-07-13 02:06 - 2017-06-21 12:26 - 000315904 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\Windows.Gaming.XboxLive.Storage.dll
2017-07-13 02:06 - 2017-06-21 12:26 - 000237056 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\SyncSettings.dll
2017-07-13 02:06 - 2017-06-21 12:25 - 000115712 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\Windows.ApplicationModel.Core.dll
2017-07-13 02:06 - 2017-06-21 12:21 - 000846336 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\WebcamUi.dll
2017-07-13 02:06 - 2017-06-21 12:21 - 000747520 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\Windows.Media.Ocr.dll
2017-07-13 02:06 - 2017-06-21 12:21 - 000284672 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\Windows.ApplicationModel.dll
2017-07-13 02:06 - 2017-06-21 12:21 - 000258048 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\XpsDocumentTargetPrint.dll
2017-07-13 02:06 - 2017-06-21 12:20 - 001167360 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\certutil.exe
2017-07-13 02:06 - 2017-06-21 12:20 - 000529920 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\StructuredQuery.dll
2017-07-13 02:06 - 2017-06-21 12:20 - 000297472 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\SearchProtocolHost.exe
2017-07-13 02:06 - 2017-06-21 12:18 - 000395264 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\dmenrollengine.dll
2017-07-13 02:06 - 2017-06-21 12:18 - 000336384 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\azroleui.dll
2017-07-13 02:06 - 2017-06-21 12:14 - 000027136 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\fdProxy.dll
2017-07-13 02:06 - 2017-06-21 12:13 - 000035328 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\cnvfat.dll
2017-07-13 02:06 - 2017-06-21 12:12 - 002749440 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\mispace.dll
2017-07-13 02:06 - 2017-06-21 12:12 - 000853504 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\autofmt.exe
2017-07-13 02:06 - 2017-06-21 12:11 - 001255936 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\AzureSettingSyncProvider.dll
2017-07-13 02:06 - 2017-06-21 12:10 - 002641920 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\tquery.dll
2017-07-13 02:06 - 2017-06-21 12:10 - 000090624 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\olepro32.dll
2017-07-13 02:06 - 2017-06-21 12:08 - 003520512 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\xpsrchvw.exe
2017-07-13 02:06 - 2017-06-21 12:08 - 000877056 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\autoconv.exe
2017-07-13 02:06 - 2017-06-21 12:08 - 000709120 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\CPFilters.dll
2017-07-13 02:06 - 2017-06-21 12:07 - 007468544 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\mstscax.dll
2017-07-13 02:06 - 2017-06-21 12:06 - 002648576 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\CertEnroll.dll
2017-07-13 02:06 - 2017-06-21 12:06 - 001988096 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\mssrch.dll
2017-07-13 02:06 - 2017-06-21 12:05 - 002682880 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\netshell.dll
2017-07-13 02:06 - 2017-06-21 12:05 - 001656320 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\Windows.Devices.Perception.dll
2017-07-13 02:06 - 2017-06-21 12:05 - 001170944 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\Windows.Media.Speech.dll
2017-07-13 02:06 - 2017-06-21 12:05 - 000732160 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\MsSpellCheckingFacility.dll
2017-07-13 02:06 - 2017-06-21 12:04 - 000773120 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\SearchIndexer.exe
2017-07-13 02:06 - 2017-06-21 12:00 - 000038912 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\tlscsp.dll
2017-07-13 02:06 - 2017-03-04 12:26 - 000263472 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\Windows.Storage.ApplicationData.dll
2017-07-13 02:06 - 2017-03-04 11:51 - 001243136 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\Windows.Media.FaceAnalysis.dll
2017-07-13 02:06 - 2016-09-15 22:28 - 000092672 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\Windows.ApplicationModel.Background.SystemEventsBroker.dll
2017-07-13 02:05 - 2017-07-07 13:19 - 000340824 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\msv1_0.dll
2017-07-13 02:05 - 2017-07-07 13:16 - 000781152 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\WWAHost.exe
2017-07-13 02:05 - 2017-07-07 13:10 - 020967840 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\shell32.dll
2017-07-13 02:05 - 2017-07-07 12:49 - 000081408 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\mshtmled.dll
2017-07-13 02:05 - 2017-07-07 12:49 - 000025088 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\eapprovp.dll
2017-07-13 02:05 - 2017-07-07 12:48 - 000450560 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\rastls.dll
2017-07-13 02:05 - 2017-07-07 12:48 - 000210432 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\onex.dll
2017-07-13 02:05 - 2017-07-07 12:47 - 000118784 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\raschap.dll
2017-07-13 02:05 - 2017-07-07 12:44 - 000270336 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\dxtrans.dll
2017-07-13 02:05 - 2017-07-07 12:44 - 000126464 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\iepeers.dll
2017-07-13 02:05 - 2017-07-07 12:43 - 000364544 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\NetSetupShim.dll
2017-07-13 02:05 - 2017-07-07 12:43 - 000310272 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\Wldap32.dll
2017-07-13 02:05 - 2017-07-07 12:40 - 000755200 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\kerberos.dll
2017-07-13 02:05 - 2017-07-07 12:39 - 000506368 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\vbscript.dll
2017-07-13 02:05 - 2017-07-07 12:36 - 018364928 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\edgehtml.dll
2017-07-13 02:05 - 2017-07-07 12:36 - 007626752 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\twinui.dll
2017-07-13 02:05 - 2017-07-07 12:35 - 019414528 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\mshtml.dll
2017-07-13 02:05 - 2017-07-07 12:33 - 000337408 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\msinfo32.exe
2017-07-13 02:05 - 2017-07-07 12:32 - 001313280 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\wdc.dll
2017-07-13 02:05 - 2017-07-07 12:30 - 012187136 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\ieframe.dll
2017-07-13 02:05 - 2017-07-07 12:30 - 000476160 _____ (Microsoft® Windows® Operating System) C:\WINDOWS\SysWOW64\wvc.dll
2017-07-13 02:05 - 2017-07-07 12:27 - 000691712 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\msfeeds.dll
2017-07-13 02:05 - 2017-07-07 12:26 - 006035456 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\Chakra.dll
2017-07-13 02:05 - 2017-07-07 12:25 - 004423680 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\ExplorerFrame.dll
2017-07-13 02:05 - 2017-07-07 12:25 - 003664896 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\jscript9.dll
2017-07-13 02:05 - 2017-07-07 12:25 - 001571840 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\msxml3.dll
2017-07-13 02:05 - 2017-07-07 12:24 - 002997248 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\win32kfull.sys
2017-07-13 02:05 - 2017-07-07 12:22 - 004561408 _____ (Microsoft) C:\WINDOWS\SysWOW64\dbgeng.dll
2017-07-13 02:05 - 2017-06-21 13:12 - 001573280 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\ntdll.dll
2017-07-13 02:05 - 2017-06-21 13:12 - 000601712 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\oleaut32.dll
2017-07-13 02:05 - 2017-06-21 13:11 - 001706488 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\KernelBase.dll
2017-07-13 02:05 - 2017-06-21 13:09 - 002048496 _____ C:\WINDOWS\SysWOW64\CoreUIComponents.dll
2017-07-13 02:05 - 2017-06-21 13:08 - 000790752 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\rpcrt4.dll
2017-07-13 02:05 - 2017-06-21 13:00 - 000869848 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\MrmCoreR.dll
2017-07-13 02:05 - 2017-06-21 13:00 - 000196960 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\ifsutil.dll
2017-07-13 02:05 - 2017-06-21 12:59 - 005722320 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\windows.storage.dll
2017-07-13 02:05 - 2017-06-21 12:58 - 002277288 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\d3d11.dll
2017-07-13 02:05 - 2017-06-21 12:58 - 001504056 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\WindowsCodecs.dll
2017-07-13 02:05 - 2017-06-21 12:58 - 000524776 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\dxgi.dll
2017-07-13 02:05 - 2017-06-21 12:58 - 000170960 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\gdi32.dll
2017-07-13 02:05 - 2017-06-21 12:57 - 001431232 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\Windows.ApplicationModel.Store.dll
2017-07-13 02:05 - 2017-06-21 12:57 - 001122344 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\dcomp.dll
2017-07-13 02:05 - 2017-06-21 12:57 - 000975744 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\twinapi.appcore.dll
2017-07-13 02:05 - 2017-06-21 12:57 - 000861024 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\LicenseManager.dll
2017-07-13 02:05 - 2017-06-21 12:57 - 000549088 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\SHCore.dll
2017-07-13 02:05 - 2017-06-21 12:57 - 000116576 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\CloudExperienceHostCommon.dll
2017-07-13 02:05 - 2017-06-21 12:55 - 002168288 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\combase.dll
2017-07-13 02:05 - 2017-06-21 12:55 - 001980776 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\msxml6.dll
2017-07-13 02:05 - 2017-06-21 12:54 - 000846560 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\WinTypes.dll
2017-07-13 02:05 - 2017-06-21 12:54 - 000154432 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\ntmarta.dll
2017-07-13 02:05 - 2017-06-21 12:51 - 004023552 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\mfcore.dll
2017-07-13 02:05 - 2017-06-21 12:51 - 001845512 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\mfmp4srcsnk.dll
2017-07-13 02:05 - 2017-06-21 12:51 - 001557808 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\winmde.dll
2017-07-13 02:05 - 2017-06-21 12:51 - 001277856 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\mfasfsrcsnk.dll
2017-07-13 02:05 - 2017-06-21 12:51 - 000952416 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\mfsvr.dll
2017-07-13 02:05 - 2017-06-21 12:51 - 000374448 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\MFPlay.dll
2017-07-13 02:05 - 2017-06-21 12:50 - 001360464 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\mfnetsrc.dll
2017-07-13 02:05 - 2017-06-21 12:50 - 000981888 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\mfnetcore.dll
2017-07-13 02:05 - 2017-06-21 12:50 - 000962768 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\ole32.dll
2017-07-13 02:05 - 2017-06-21 12:50 - 000312472 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\mftranscode.dll
2017-07-13 02:05 - 2017-06-21 12:49 - 004312248 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\explorer.exe
2017-07-13 02:05 - 2017-06-21 12:34 - 001631232 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\Windows.UI.Xaml.Resources.dll
2017-07-13 02:05 - 2017-06-21 12:34 - 000026112 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\odbcconf.dll
2017-07-13 02:05 - 2017-06-21 12:31 - 000141824 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\Windows.Devices.Radios.dll
2017-07-13 02:05 - 2017-06-21 12:30 - 000519168 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\ngccredprov.dll
2017-07-13 02:05 - 2017-06-21 12:30 - 000156672 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\UserDeviceRegistration.dll
2017-07-13 02:05 - 2017-06-21 12:30 - 000143360 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\uudf.dll
2017-07-13 02:05 - 2017-06-21 12:30 - 000138240 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\DisplayManager.dll
2017-07-13 02:05 - 2017-06-21 12:29 - 000285184 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\Windows.UI.BlockedShutdown.dll
2017-07-13 02:05 - 2017-06-21 12:29 - 000177664 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\Windows.Web.Diagnostics.dll
2017-07-13 02:05 - 2017-06-21 12:29 - 000123904 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\Windows.Networking.HostName.dll
2017-07-13 02:05 - 2017-06-21 12:29 - 000097792 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\Windows.System.SystemManagement.dll
2017-07-13 02:05 - 2017-06-21 12:28 - 000129024 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\Windows.Devices.SerialCommunication.dll
2017-07-13 02:05 - 2017-06-21 12:28 - 000087040 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\Windows.Networking.ServiceDiscovery.Dnssd.dll
2017-07-13 02:05 - 2017-06-21 12:27 - 000142336 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\Windows.Devices.WiFi.dll
2017-07-13 02:05 - 2017-06-21 12:27 - 000122880 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\sendmail.dll
2017-07-13 02:05 - 2017-06-21 12:27 - 000088576 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\UserDeviceRegistration.Ngc.dll
2017-07-13 02:05 - 2017-06-21 12:26 - 000374784 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\Windows.Devices.LowLevel.dll
2017-07-13 02:05 - 2017-06-21 12:26 - 000299520 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\UserDataAccountApis.dll
2017-07-13 02:05 - 2017-06-21 12:26 - 000231936 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\Windows.ApplicationModel.LockScreen.dll
2017-07-13 02:05 - 2017-06-21 12:26 - 000203776 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\credprovhost.dll
2017-07-13 02:05 - 2017-06-21 12:26 - 000184320 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\UserMgrProxy.dll
2017-07-13 02:05 - 2017-06-21 12:26 - 000180224 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\InstallAgent.exe
2017-07-13 02:05 - 2017-06-21 12:26 - 000113152 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\Windows.Devices.Lights.dll
2017-07-13 02:05 - 2017-06-21 12:25 - 000557568 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\StoreAgent.dll
2017-07-13 02:05 - 2017-06-21 12:25 - 000533504 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\FXSCOMEX.dll
2017-07-13 02:05 - 2017-06-21 12:25 - 000404992 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\dsreg.dll
2017-07-13 02:05 - 2017-06-21 12:25 - 000265728 _____ C:\WINDOWS\SysWOW64\Windows.Perception.Stub.dll
2017-07-13 02:05 - 2017-06-21 12:25 - 000117760 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\AuthBroker.dll
2017-07-13 02:05 - 2017-06-21 12:25 - 000020480 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\regsvr32.exe
2017-07-13 02:05 - 2017-06-21 12:24 - 000609280 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\Windows.Media.Import.dll
2017-07-13 02:05 - 2017-06-21 12:24 - 000483840 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\Windows.Devices.AllJoyn.dll
2017-07-13 02:05 - 2017-06-21 12:24 - 000298496 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\Windows.Internal.Management.dll
2017-07-13 02:05 - 2017-06-21 12:24 - 000223232 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\InstallAgentUserBroker.exe
2017-07-13 02:05 - 2017-06-21 12:24 - 000141824 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\easwrt.dll
2017-07-13 02:05 - 2017-06-21 12:23 - 000431616 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\efswrt.dll
2017-07-13 02:05 - 2017-06-21 12:23 - 000390656 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\CredProvDataModel.dll
2017-07-13 02:05 - 2017-06-21 12:23 - 000386048 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\Windows.Devices.WiFiDirect.dll
2017-07-13 02:05 - 2017-06-21 12:23 - 000332288 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\Windows.Internal.Bluetooth.dll
2017-07-13 02:05 - 2017-06-21 12:23 - 000325120 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\oleacc.dll
2017-07-13 02:05 - 2017-06-21 12:23 - 000284672 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\apprepsync.dll
2017-07-13 02:05 - 2017-06-21 12:23 - 000271360 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\deviceaccess.dll
2017-07-13 02:05 - 2017-06-21 12:23 - 000218624 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\WwaApi.dll
2017-07-13 02:05 - 2017-06-21 12:23 - 000202752 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\Windows.Devices.HumanInterfaceDevice.dll
2017-07-13 02:05 - 2017-06-21 12:23 - 000201728 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\ExecModelClient.dll
2017-07-13 02:05 - 2017-06-21 12:23 - 000185856 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\Windows.Security.Authentication.Identity.Provider.dll
2017-07-13 02:05 - 2017-06-21 12:23 - 000175616 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\Windows.Devices.Scanners.dll
2017-07-13 02:05 - 2017-06-21 12:23 - 000125952 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\apprepapi.dll
2017-07-13 02:05 - 2017-06-21 12:22 - 000262144 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\Windows.Devices.Picker.dll
2017-07-13 02:05 - 2017-06-21 12:22 - 000182784 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\BioCredProv.dll
2017-07-13 02:05 - 2017-06-21 12:21 - 000314368 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\Windows.Devices.Usb.dll
2017-07-13 02:05 - 2017-06-21 12:20 - 000857600 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\EmailApis.dll
2017-07-13 02:05 - 2017-06-21 12:20 - 000661504 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\WpcWebFilter.dll
2017-07-13 02:05 - 2017-06-21 12:20 - 000238080 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\AboveLockAppHost.dll
2017-07-13 02:05 - 2017-06-21 12:19 - 000500224 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\Windows.Graphics.Printing.dll
2017-07-13 02:05 - 2017-06-21 12:19 - 000295936 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\Windows.Graphics.dll
2017-07-13 02:05 - 2017-06-21 12:19 - 000288256 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\CryptoWinRT.dll
2017-07-13 02:05 - 2017-06-21 12:18 - 002333184 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\WsmSvc.dll
2017-07-13 02:05 - 2017-06-21 12:17 - 013873664 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\Windows.UI.Xaml.dll
2017-07-13 02:05 - 2017-06-21 12:16 - 004615168 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\Windows.Media.dll
2017-07-13 02:05 - 2017-06-21 12:16 - 001323008 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\wsp_fs.dll
2017-07-13 02:05 - 2017-06-21 12:16 - 001137152 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\wsp_health.dll
2017-07-13 02:05 - 2017-06-21 12:16 - 001077760 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\Windows.Media.Editing.dll
2017-07-13 02:05 - 2017-06-21 12:16 - 000355328 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\RTMediaFrame.dll
2017-07-13 02:05 - 2017-06-21 12:15 - 000891904 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\autochk.exe
2017-07-13 02:05 - 2017-06-21 12:15 - 000471552 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\Windows.Media.BackgroundMediaPlayback.dll
2017-07-13 02:05 - 2017-06-21 12:15 - 000313856 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\AppXDeploymentClient.dll
2017-07-13 02:05 - 2017-06-21 12:15 - 000102400 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\uexfat.dll
2017-07-13 02:05 - 2017-06-21 12:14 - 000795648 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\MiracastReceiver.dll
2017-07-13 02:05 - 2017-06-21 12:14 - 000535040 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\untfs.dll
2017-07-13 02:05 - 2017-06-21 12:14 - 000343040 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\PlayToDevice.dll
2017-07-13 02:05 - 2017-06-21 12:14 - 000136704 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\ufat.dll
2017-07-13 02:05 - 2017-06-21 12:13 - 001534464 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\Windows.Graphics.Printing.3D.dll
2017-07-13 02:05 - 2017-06-21 12:13 - 000713216 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\wpnapps.dll
2017-07-13 02:05 - 2017-06-21 12:13 - 000653312 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\Windows.AccountsControl.dll
2017-07-13 02:05 - 2017-06-21 12:13 - 000468992 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\Windows.UI.Xaml.InkControls.dll
2017-07-13 02:05 - 2017-06-21 12:12 - 003307008 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\MFMediaEngine.dll
2017-07-13 02:05 - 2017-06-21 12:12 - 000525312 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\LogonController.dll
2017-07-13 02:05 - 2017-06-21 12:12 - 000470016 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\Windows.Media.Playback.BackgroundMediaPlayer.dll
2017-07-13 02:05 - 2017-06-21 12:12 - 000380416 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\uReFSv1.dll
2017-07-13 02:05 - 2017-06-21 12:11 - 000459776 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\Windows.Media.Playback.MediaPlayer.dll
2017-07-13 02:05 - 2017-06-21 12:10 - 002154496 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\storagewmi.dll
2017-07-13 02:05 - 2017-06-21 12:10 - 000901120 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\Windows.Devices.Bluetooth.dll
2017-07-13 02:05 - 2017-06-21 12:10 - 000895488 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\Windows.Media.Streaming.dll
2017-07-13 02:05 - 2017-06-21 12:10 - 000675840 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\Windows.Networking.dll
2017-07-13 02:05 - 2017-06-21 12:10 - 000220672 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\PlayToReceiver.dll
2017-07-13 02:05 - 2017-06-21 12:09 - 000546304 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\uReFS.dll
2017-07-13 02:05 - 2017-06-21 12:09 - 000134144 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\ErrorDetails.dll
2017-07-13 02:05 - 2017-06-21 12:08 - 003733504 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\D3DCompiler_47.dll
2017-07-13 02:05 - 2017-06-21 12:08 - 001221120 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\Windows.Media.Audio.dll
2017-07-13 02:05 - 2017-06-21 12:08 - 000886272 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\aadtb.dll
2017-07-13 02:05 - 2017-06-21 12:08 - 000753152 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\imapi2fs.dll
2017-07-13 02:05 - 2017-06-21 12:07 - 006109696 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\mos.dll
2017-07-13 02:05 - 2017-06-21 12:07 - 000400384 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\PlayToManager.dll
2017-07-13 02:05 - 2017-06-21 12:07 - 000357376 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\Geolocation.dll
2017-07-13 02:05 - 2017-06-21 12:07 - 000103936 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\Windows.Media.Devices.dll
2017-07-13 02:05 - 2017-06-21 12:06 - 001247232 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\Windows.Globalization.dll
2017-07-13 02:05 - 2017-06-21 12:05 - 002740224 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\msftedit.dll
2017-07-13 02:05 - 2017-06-21 12:05 - 001232384 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\Windows.UI.Xaml.Maps.dll
2017-07-13 02:05 - 2017-06-21 12:05 - 000827904 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\twinui.appcore.dll
2017-07-13 02:05 - 2017-06-21 12:05 - 000598528 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\Windows.Web.dll
2017-07-13 02:05 - 2017-06-21 12:05 - 000589312 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\Windows.Devices.Sensors.dll
2017-07-13 02:05 - 2017-06-21 12:05 - 000348160 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\Windows.Devices.Midi.dll
2017-07-13 02:05 - 2017-06-21 12:04 - 001886720 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\Windows.UI.Logon.dll
2017-07-13 02:05 - 2017-06-21 12:04 - 000711168 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\Windows.UI.Search.dll
2017-07-13 02:05 - 2017-06-21 12:04 - 000654336 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\MbaeApiPublic.dll
2017-07-13 02:05 - 2017-06-21 12:04 - 000621056 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\Windows.UI.dll
2017-07-13 02:05 - 2017-06-21 12:04 - 000566784 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\ShareHost.dll
2017-07-13 02:05 - 2017-06-21 12:04 - 000542208 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\Windows.Networking.Connectivity.dll
2017-07-13 02:05 - 2017-06-21 12:03 - 001170944 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\Windows.UI.Xaml.Phone.dll
2017-07-13 02:05 - 2017-06-21 12:03 - 001013248 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\Windows.Web.Http.dll
2017-07-13 02:05 - 2017-06-21 12:03 - 000751104 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\Windows.Networking.BackgroundTransfer.dll
2017-07-13 02:05 - 2017-06-21 12:03 - 000691200 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\TokenBroker.dll
2017-07-13 02:05 - 2017-06-21 12:02 - 001556992 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\Windows.UI.Immersive.dll
2017-07-13 02:05 - 2017-06-21 12:02 - 000353280 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\TextInputFramework.dll
2017-07-13 02:05 - 2017-06-21 12:01 - 003106304 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\mstsc.exe
2017-07-13 02:05 - 2017-06-21 11:40 - 000483840 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\CoreMessaging.dll
2017-07-13 02:05 - 2017-03-04 11:51 - 000670208 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\Windows.Devices.PointOfService.dll
2017-07-13 02:05 - 2017-03-04 11:50 - 000562176 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\Windows.Devices.SmartCards.dll
2017-07-13 02:05 - 2017-03-04 11:50 - 000426496 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\Windows.ApplicationModel.Wallet.dll
2017-07-13 02:05 - 2017-03-04 11:50 - 000206336 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\vaultcli.dll
2017-07-13 02:05 - 2017-03-04 11:49 - 000498688 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\mbsmsapi.dll
2017-07-13 02:05 - 2017-03-04 11:48 - 000525824 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\PrintDialogs.dll
2017-07-13 02:05 - 2017-03-04 11:46 - 000584192 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\Windows.Security.Authentication.Web.Core.dll
2017-07-13 02:05 - 2017-03-04 11:32 - 002138112 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\InputService.dll
2017-07-13 02:05 - 2016-10-05 14:45 - 000141312 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\dialclient.dll
2017-07-13 02:05 - 2016-09-15 22:17 - 000134656 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\Windows.Energy.dll
2017-07-13 01:58 - 2017-07-07 12:14 - 000147456 _____ (Microsoft Corporation) C:\WINDOWS\system32\winsrv.dll
2017-07-13 01:58 - 2017-06-21 13:22 - 000088416 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\scmbus.sys
2017-07-13 01:58 - 2017-06-21 13:22 - 000081760 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\stornvme.sys
2017-07-13 01:58 - 2017-06-21 13:10 - 000328008 _____ (Microsoft Corporation) C:\WINDOWS\system32\Windows.Storage.ApplicationData.dll
2017-07-13 01:58 - 2017-06-21 13:02 - 008169024 _____ (Microsoft Corporation) C:\WINDOWS\system32\Windows.Media.Protection.PlayReady.dll
2017-07-13 01:58 - 2017-06-21 12:32 - 000124928 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\scmdisk0101.sys
2017-07-13 01:58 - 2017-06-21 12:32 - 000124416 _____ (Microsoft Corporation) C:\WINDOWS\system32\mssprxy.dll
2017-07-13 01:58 - 2017-06-21 12:30 - 000193536 _____ (Microsoft Corporation) C:\WINDOWS\system32\WinRtTracing.dll
2017-07-13 01:58 - 2017-06-21 12:30 - 000114688 _____ (Microsoft Corporation) C:\WINDOWS\system32\Windows.ApplicationModel.Background.SystemEventsBroker.dll
2017-07-13 01:58 - 2017-06-21 12:30 - 000082432 _____ (Microsoft Corporation) C:\WINDOWS\system32\Windows.System.UserDeviceAssociation.dll
2017-07-13 01:58 - 2017-06-21 12:30 - 000073216 _____ (Microsoft Corporation) C:\WINDOWS\system32\Windows.StateRepositoryBroker.dll
2017-07-13 01:58 - 2017-06-21 12:29 - 000467968 _____ (Microsoft Corporation) C:\WINDOWS\system32\Windows.Gaming.XboxLive.Storage.dll
2017-07-13 01:58 - 2017-06-21 12:29 - 000149504 _____ (Microsoft Corporation) C:\WINDOWS\system32\Windows.ApplicationModel.Core.dll
2017-07-13 01:58 - 2017-06-21 12:29 - 000122880 _____ (Microsoft Corporation) C:\WINDOWS\system32\Windows.StateRepositoryClient.dll
2017-07-13 01:58 - 2017-06-21 12:28 - 000547840 _____ (Microsoft Corporation) C:\WINDOWS\system32\Windows.Gaming.Input.dll
2017-07-13 01:58 - 2017-06-21 12:28 - 000224768 _____ (Microsoft Corporation) C:\WINDOWS\system32\wpd_ci.dll
2017-07-13 01:58 - 2017-06-21 12:27 - 000087552 _____ (Microsoft Corporation) C:\WINDOWS\system32\wpdbusenum.dll
2017-07-13 01:58 - 2017-06-21 12:26 - 001507840 _____ (Microsoft Corporation) C:\WINDOWS\system32\Windows.Media.FaceAnalysis.dll
2017-07-13 01:58 - 2017-06-21 12:25 - 000358912 _____ (Microsoft Corporation) C:\WINDOWS\system32\Windows.ApplicationModel.dll
2017-07-13 01:58 - 2017-06-21 12:25 - 000349184 _____ (Microsoft Corporation) C:\WINDOWS\system32\SearchProtocolHost.exe
2017-07-13 01:58 - 2017-06-21 12:24 - 001159680 _____ (Microsoft Corporation) C:\WINDOWS\system32\XblGameSave.dll
2017-07-13 01:58 - 2017-06-21 12:23 - 000339968 _____ (Microsoft Corporation) C:\WINDOWS\system32\Windows.Graphics.dll
2017-07-13 01:58 - 2017-06-21 12:22 - 000775168 _____ (Microsoft Corporation) C:\WINDOWS\system32\GamePanel.exe
2017-07-13 01:58 - 2017-06-21 12:21 - 000634368 _____ (Microsoft Corporation) C:\WINDOWS\system32\StructuredQuery.dll
2017-07-13 01:58 - 2017-06-21 12:19 - 002104320 _____ (Microsoft Corporation) C:\WINDOWS\system32\wlidsvc.dll
2017-07-13 01:58 - 2017-06-21 12:19 - 001913856 _____ (Microsoft Corporation) C:\WINDOWS\system32\wsp_fs.dll
2017-07-13 01:58 - 2017-06-21 12:19 - 001584128 _____ (Microsoft Corporation) C:\WINDOWS\system32\wsp_health.dll
2017-07-13 01:58 - 2017-06-21 12:16 - 003290112 _____ (Microsoft Corporation) C:\WINDOWS\system32\mispace.dll
2017-07-13 01:58 - 2017-06-21 12:14 - 000588288 _____ (Microsoft Corporation) C:\WINDOWS\system32\wlidprov.dll
2017-07-13 01:58 - 2017-06-21 12:11 - 003400704 _____ (Microsoft Corporation) C:\WINDOWS\system32\tquery.dll
2017-07-13 01:58 - 2017-06-21 12:11 - 001080320 _____ (Microsoft Corporation) C:\WINDOWS\system32\Windows.Media.Ocr.dll
2017-07-13 01:58 - 2017-06-21 12:09 - 002916864 _____ (Microsoft Corporation) C:\WINDOWS\system32\CertEnroll.dll
2017-07-13 01:58 - 2017-06-21 12:09 - 002538496 _____ (Microsoft Corporation) C:\WINDOWS\system32\mssrch.dll
2017-07-13 01:58 - 2017-06-21 12:09 - 001643008 _____ (Microsoft Corporation) C:\WINDOWS\system32\Windows.Media.Speech.dll
2017-07-13 01:58 - 2017-06-21 12:08 - 002424320 _____ (Microsoft Corporation) C:\WINDOWS\system32\Windows.Devices.Perception.dll
2017-07-13 01:58 - 2017-06-21 12:06 - 000903680 _____ (Microsoft Corporation) C:\WINDOWS\system32\SearchIndexer.exe
2017-07-13 01:58 - 2017-05-23 10:28 - 000448576 _____ C:\WINDOWS\system32\ApnDatabase.xml
2017-07-13 01:58 - 2017-03-04 11:42 - 004596224 _____ (Microsoft Corporation) C:\WINDOWS\system32\xpsrchvw.exe
2017-07-13 01:57 - 2017-07-07 13:14 - 000108896 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\pdc.sys
2017-07-13 01:57 - 2017-07-07 13:12 - 007781720 _____ (Microsoft Corporation) C:\WINDOWS\system32\ntoskrnl.exe
2017-07-13 01:57 - 2017-07-07 13:07 - 000468320 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\netio.sys
2017-07-13 01:57 - 2017-07-07 13:07 - 000118112 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\tdx.sys
2017-07-13 01:57 - 2017-07-07 13:02 - 000404824 _____ (Microsoft Corporation) C:\WINDOWS\system32\msv1_0.dll
2017-07-13 01:57 - 2017-07-07 12:59 - 000857440 _____ (Microsoft Corporation) C:\WINDOWS\system32\WWAHost.exe
2017-07-13 01:57 - 2017-07-07 12:58 - 000223584 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\mrxsmb20.sys
2017-07-13 01:57 - 2017-07-07 12:54 - 022220856 _____ (Microsoft Corporation) C:\WINDOWS\system32\shell32.dll
2017-07-13 01:57 - 2017-07-07 12:53 - 001600624 _____ (Microsoft Corporation) C:\WINDOWS\system32\sppobjs.dll
2017-07-13 01:57 - 2017-07-07 12:48 - 002532192 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\tcpip.sys
2017-07-13 01:57 - 2017-07-07 12:19 - 000115200 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\bridge.sys
2017-07-13 01:57 - 2017-07-07 12:18 - 000030208 _____ (Microsoft Corporation) C:\WINDOWS\system32\eapprovp.dll
2017-07-13 01:57 - 2017-07-07 12:17 - 000201728 _____ (Microsoft Corporation) C:\WINDOWS\system32\ScDeviceEnum.dll
2017-07-13 01:57 - 2017-07-07 12:16 - 000231424 _____ (Microsoft Corporation) C:\WINDOWS\system32\shutdownux.dll
2017-07-13 01:57 - 2017-07-07 12:15 - 000488960 _____ (Microsoft Corporation) C:\WINDOWS\system32\NetSetupShim.dll
2017-07-13 01:57 - 2017-07-07 12:15 - 000289792 _____ (Microsoft Corporation) C:\WINDOWS\system32\DeveloperOptionsSettingsHandlers.dll
2017-07-13 01:57 - 2017-07-07 12:14 - 000502784 _____ (Microsoft Corporation) C:\WINDOWS\system32\rastls.dll
2017-07-13 01:57 - 2017-07-07 12:14 - 000238592 _____ (Microsoft Corporation) C:\WINDOWS\system32\onex.dll
2017-07-13 01:57 - 2017-07-07 12:14 - 000193536 _____ (Microsoft Corporation) C:\WINDOWS\system32\certprop.dll
2017-07-13 01:57 - 2017-07-07 12:14 - 000137728 _____ (Microsoft Corporation) C:\WINDOWS\system32\raschap.dll
2017-07-13 01:57 - 2017-07-07 12:13 - 001081856 _____ (Microsoft Corporation) C:\WINDOWS\system32\Chakradiag.dll
2017-07-13 01:57 - 2017-07-07 12:12 - 000805888 _____ (Microsoft Corporation) C:\WINDOWS\system32\jscript9diag.dll
2017-07-13 01:57 - 2017-07-07 12:09 - 000282624 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\mrxsmb10.sys
2017-07-13 01:57 - 2017-07-07 12:05 - 001397760 _____ (Microsoft Corporation) C:\WINDOWS\system32\wdc.dll
2017-07-13 01:57 - 2017-07-07 12:04 - 009131008 _____ (Microsoft Corporation) C:\WINDOWS\system32\twinui.dll
2017-07-13 01:57 - 2017-07-07 12:03 - 000576000 _____ (Microsoft® Windows® Operating System) C:\WINDOWS\system32\wvc.dll
2017-07-13 01:57 - 2017-07-07 11:59 - 004749824 _____ (Microsoft Corporation) C:\WINDOWS\system32\SettingsHandlers_nt.dll
2017-07-13 01:57 - 2017-07-07 11:59 - 000932864 _____ (Microsoft Corporation) C:\WINDOWS\system32\kerberos.dll
2017-07-13 01:57 - 2017-07-07 11:58 - 000589312 _____ (Microsoft Corporation) C:\WINDOWS\system32\vbscript.dll
2017-07-13 01:57 - 2017-07-07 11:57 - 008120832 _____ (Microsoft Corporation) C:\WINDOWS\system32\Chakra.dll
2017-07-13 01:57 - 2017-07-07 11:54 - 005388800 _____ (Microsoft) C:\WINDOWS\system32\dbgeng.dll
2017-07-13 01:57 - 2017-07-07 11:54 - 004744704 _____ (Microsoft Corporation) C:\WINDOWS\system32\jscript9.dll
2017-07-13 01:57 - 2017-07-07 11:54 - 003615744 _____ (Microsoft Corporation) C:\WINDOWS\system32\win32kfull.sys
2017-07-13 01:57 - 2017-07-07 11:54 - 001513472 _____ (Microsoft Corporation) C:\WINDOWS\system32\win32kbase.sys
2017-07-13 01:57 - 2017-06-21 13:22 - 001886344 _____ (Microsoft Corporation) C:\WINDOWS\system32\ntdll.dll
2017-07-13 01:57 - 2017-06-21 13:22 - 000774224 _____ (Microsoft Corporation) C:\WINDOWS\system32\oleaut32.dll
2017-07-13 01:57 - 2017-06-21 13:21 - 002255712 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\ntfs.sys
2017-07-13 01:57 - 2017-06-21 13:08 - 001860288 _____ (Microsoft Corporation) C:\WINDOWS\system32\Windows.ApplicationModel.Store.dll
2017-07-13 01:57 - 2017-06-21 13:08 - 001738560 _____ (Microsoft Corporation) C:\WINDOWS\system32\WindowsCodecs.dll
2017-07-13 01:57 - 2017-06-21 13:07 - 001157008 _____ (Microsoft Corporation) C:\WINDOWS\system32\twinapi.appcore.dll
2017-07-13 01:57 - 2017-06-21 13:03 - 000408600 _____ (Microsoft Corporation) C:\WINDOWS\system32\tsmf.dll
2017-07-13 01:57 - 2017-06-21 13:03 - 000092512 _____ (Microsoft Corporation) C:\WINDOWS\system32\rdpudd.dll
2017-07-13 01:57 - 2017-06-21 12:36 - 000372736 _____ (Microsoft Corporation) C:\WINDOWS\system32\RDXTaskFactory.dll
2017-07-13 01:57 - 2017-06-21 12:33 - 000013312 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\rootmdm.sys
2017-07-13 01:57 - 2017-06-21 12:32 - 000237568 _____ (Microsoft Corporation) C:\WINDOWS\system32\Windows.Web.Diagnostics.dll
2017-07-13 01:57 - 2017-06-21 12:32 - 000124416 _____ (Microsoft Corporation) C:\WINDOWS\system32\Windows.System.SystemManagement.dll
2017-07-13 01:57 - 2017-06-21 12:31 - 000156160 _____ (Microsoft Corporation) C:\WINDOWS\system32\Family.Client.dll
2017-07-13 01:57 - 2017-06-21 12:31 - 000138752 _____ (Microsoft Corporation) C:\WINDOWS\system32\VEDataLayerHelpers.dll
2017-07-13 01:57 - 2017-06-21 12:31 - 000108032 _____ (Microsoft Corporation) C:\WINDOWS\system32\Family.Authentication.dll
2017-07-13 01:57 - 2017-06-21 12:31 - 000015872 _____ (Microsoft Corporation) C:\WINDOWS\system32\snmptrap.exe
2017-07-13 01:57 - 2017-06-21 12:30 - 000295424 _____ (Microsoft Corporation) C:\WINDOWS\system32\unimdm.tsp
2017-07-13 01:57 - 2017-06-21 12:30 - 000259072 _____ (Microsoft Corporation) C:\WINDOWS\system32\Family.SyncEngine.dll
2017-07-13 01:57 - 2017-06-21 12:30 - 000233984 _____ (Microsoft Corporation) C:\WINDOWS\system32\ProvisioningHandlers.dll
2017-07-13 01:57 - 2017-06-21 12:30 - 000224256 _____ (Microsoft Corporation) C:\WINDOWS\system32\SettingsHandlers_SignInOptions.dll
2017-07-13 01:57 - 2017-06-21 12:30 - 000148480 _____ (Microsoft Corporation) C:\WINDOWS\system32\Windows.System.Profile.RetailInfo.dll
2017-07-13 01:57 - 2017-06-21 12:30 - 000113664 _____ (Microsoft Corporation) C:\WINDOWS\system32\Windows.Networking.ServiceDiscovery.Dnssd.dll
2017-07-13 01:57 - 2017-06-21 12:29 - 000196096 _____ (Microsoft Corporation) C:\WINDOWS\system32\UserDeviceRegistration.dll
2017-07-13 01:57 - 2017-06-21 12:29 - 000137216 _____ (Microsoft Corporation) C:\WINDOWS\system32\tdlrecover.exe
2017-07-13 01:57 - 2017-06-21 12:29 - 000136192 _____ (Microsoft Corporation) C:\WINDOWS\system32\sendmail.dll
2017-07-13 01:57 - 2017-06-21 12:29 - 000101888 _____ (Microsoft Corporation) C:\WINDOWS\system32\UserDeviceRegistration.Ngc.dll
2017-07-13 01:57 - 2017-06-21 12:28 - 000418304 _____ C:\WINDOWS\system32\Windows.Perception.Stub.dll
2017-07-13 01:57 - 2017-06-21 12:28 - 000211968 _____ (Microsoft Corporation) C:\WINDOWS\system32\InstallAgent.exe
2017-07-13 01:57 - 2017-06-21 12:27 - 000418304 _____ (Microsoft Corporation) C:\WINDOWS\system32\Windows.UI.BlockedShutdown.dll
2017-07-13 01:57 - 2017-06-21 12:27 - 000360448 _____ (Microsoft Corporation) C:\WINDOWS\system32\rdpencom.dll
2017-07-13 01:57 - 2017-06-21 12:26 - 000748544 _____ (Microsoft Corporation) C:\WINDOWS\system32\StoreAgent.dll
2017-07-13 01:57 - 2017-06-21 12:26 - 000719872 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\WdiWiFi.sys
2017-07-13 01:57 - 2017-06-21 12:26 - 000590336 _____ (Microsoft Corporation) C:\WINDOWS\system32\efswrt.dll
2017-07-13 01:57 - 2017-06-21 12:26 - 000267264 _____ (Microsoft Corporation) C:\WINDOWS\system32\vaultcli.dll
2017-07-13 01:57 - 2017-06-21 12:26 - 000260608 _____ (Microsoft Corporation) C:\WINDOWS\system32\InstallAgentUserBroker.exe
2017-07-13 01:57 - 2017-06-21 12:26 - 000216576 _____ (Microsoft Corporation) C:\WINDOWS\system32\Windows.Devices.Scanners.dll
2017-07-13 01:57 - 2017-06-21 12:25 - 000561664 _____ (Microsoft Corporation) C:\WINDOWS\system32\Windows.ApplicationModel.Wallet.dll
2017-07-13 01:57 - 2017-06-21 12:25 - 000456192 _____ (Microsoft Corporation) C:\WINDOWS\system32\puiobj.dll
2017-07-13 01:57 - 2017-06-21 12:25 - 000310784 _____ (Microsoft Corporation) C:\WINDOWS\system32\SyncSettings.dll
2017-07-13 01:57 - 2017-06-21 12:25 - 000252416 _____ (Microsoft Corporation) C:\WINDOWS\system32\Windows.Security.Authentication.Identity.Provider.dll
2017-07-13 01:57 - 2017-06-21 12:24 - 000574976 _____ (Microsoft Corporation) C:\WINDOWS\system32\tileobjserver.dll
2017-07-13 01:57 - 2017-06-21 12:24 - 000245760 _____ (Microsoft Corporation) C:\WINDOWS\system32\WwaApi.dll
2017-07-13 01:57 - 2017-06-21 12:24 - 000168960 _____ (Microsoft Corporation) C:\WINDOWS\system32\easwrt.dll
2017-07-13 01:57 - 2017-06-21 12:23 - 000642048 _____ (Microsoft Corporation) C:\WINDOWS\system32\Windows.UI.Xaml.InkControls.dll
2017-07-13 01:57 - 2017-06-21 12:23 - 000425984 _____ (Microsoft Corporation) C:\WINDOWS\system32\aadcloudap.dll
2017-07-13 01:57 - 2017-06-21 12:22 - 006288384 _____ (Microsoft Corporation) C:\WINDOWS\system32\Windows.Media.dll
2017-07-13 01:57 - 2017-06-21 12:22 - 000963584 _____ (Microsoft Corporation) C:\WINDOWS\system32\WebcamUi.dll
2017-07-13 01:57 - 2017-06-21 12:22 - 000352256 _____ (Microsoft Corporation) C:\WINDOWS\system32\XpsDocumentTargetPrint.dll
2017-07-13 01:57 - 2017-06-21 12:22 - 000331264 _____ (Microsoft Corporation) C:\WINDOWS\system32\NgcCtnrSvc.dll
2017-07-13 01:57 - 2017-06-21 12:19 - 001403392 _____ (Microsoft Corporation) C:\WINDOWS\system32\Windows.Media.Editing.dll
2017-07-13 01:57 - 2017-06-21 12:19 - 000458752 _____ (Microsoft Corporation) C:\WINDOWS\system32\RTMediaFrame.dll
2017-07-13 01:57 - 2017-06-21 12:19 - 000175616 _____ (Microsoft Corporation) C:\WINDOWS\system32\SystemSettings.DeviceEncryptionHandlers.dll
2017-07-13 01:57 - 2017-06-21 12:17 - 000442368 _____ (Microsoft Corporation) C:\WINDOWS\system32\PlayToDevice.dll
2017-07-13 01:57 - 2017-06-21 12:16 - 001908224 _____ (Microsoft Corporation) C:\WINDOWS\system32\AzureSettingSyncProvider.dll
2017-07-13 01:57 - 2017-06-21 12:16 - 000627200 _____ (Microsoft Corporation) C:\WINDOWS\system32\SpaceControl.dll
2017-07-13 01:57 - 2017-06-21 12:15 - 002861056 _____ (Microsoft Corporation) C:\WINDOWS\system32\storagewmi.dll
2017-07-13 01:57 - 2017-06-21 12:13 - 000130560 _____ (Microsoft Corporation) C:\WINDOWS\system32\SpaceAgent.exe
2017-07-13 01:57 - 2017-06-21 12:12 - 000981504 _____ (Microsoft Corporation) C:\WINDOWS\system32\Windows.Security.Authentication.OnlineId.dll
2017-07-13 01:57 - 2017-06-21 12:12 - 000539136 _____ (Microsoft Corporation) C:\WINDOWS\system32\PlayToManager.dll
2017-07-13 01:57 - 2017-06-21 12:11 - 001359872 _____ (Microsoft Corporation) C:\WINDOWS\system32\SharedStartModel.dll
2017-07-13 01:57 - 2017-06-21 12:11 - 000983040 _____ (Microsoft Corporation) C:\WINDOWS\system32\ngcsvc.dll
2017-07-13 01:57 - 2017-06-21 12:11 - 000945664 _____ (Microsoft Corporation) C:\WINDOWS\system32\WpcWebFilter.dll
2017-07-13 01:57 - 2017-06-21 12:11 - 000913920 _____ (Microsoft Corporation) C:\WINDOWS\system32\Windows.Networking.dll
2017-07-13 01:57 - 2017-06-21 12:10 - 001891328 _____ (Microsoft Corporation) C:\WINDOWS\system32\pnidui.dll
2017-07-13 01:57 - 2017-06-21 12:10 - 000611328 _____ (Microsoft Corporation) C:\WINDOWS\system32\Windows.Graphics.Printing.dll
2017-07-13 01:57 - 2017-06-21 12:09 - 008076288 _____ (Microsoft Corporation) C:\WINDOWS\system32\mstscax.dll
2017-07-13 01:57 - 2017-06-21 12:09 - 002208768 _____ (Microsoft Corporation) C:\WINDOWS\system32\Windows.Graphics.Printing.3D.dll
2017-07-13 01:57 - 2017-06-21 12:09 - 000971264 _____ (Microsoft Corporation) C:\WINDOWS\system32\twinui.appcore.dll
2017-07-13 01:57 - 2017-06-21 12:09 - 000816640 _____ (Microsoft Corporation) C:\WINDOWS\system32\Windows.UI.dll
2017-07-13 01:57 - 2017-06-21 12:09 - 000673792 _____ (Microsoft Corporation) C:\WINDOWS\system32\winlogon.exe
2017-07-13 01:57 - 2017-06-21 12:08 - 002695680 _____ (Microsoft Corporation) C:\WINDOWS\system32\Windows.UI.Logon.dll
2017-07-13 01:57 - 2017-06-21 12:08 - 001984000 _____ (Microsoft Corporation) C:\WINDOWS\system32\diagtrack.dll
2017-07-13 01:57 - 2017-06-21 12:08 - 000908800 _____ (Microsoft Corporation) C:\WINDOWS\system32\Windows.UI.Search.dll
2017-07-13 01:57 - 2017-06-21 12:08 - 000765440 _____ (Microsoft Corporation) C:\WINDOWS\system32\Windows.Devices.Sensors.dll
2017-07-13 01:57 - 2017-06-21 12:07 - 000875520 _____ (Microsoft Corporation) C:\WINDOWS\system32\TokenBroker.dll
2017-07-13 01:57 - 2017-06-21 12:07 - 000774656 _____ (Microsoft Corporation) C:\WINDOWS\system32\Windows.Web.dll
2017-07-13 01:57 - 2017-06-21 12:06 - 002318848 _____ (Microsoft Corporation) C:\WINDOWS\system32\wuaueng.dll
2017-07-13 01:57 - 2017-06-21 12:06 - 001424896 _____ (Microsoft Corporation) C:\WINDOWS\system32\Windows.UI.Xaml.Maps.dll
2017-07-13 01:57 - 2017-06-21 12:06 - 000881152 _____ (Microsoft Corporation) C:\WINDOWS\system32\MsSpellCheckingFacility.dll
2017-07-13 01:57 - 2017-06-21 12:06 - 000701952 _____ (Microsoft Corporation) C:\WINDOWS\system32\Windows.Networking.Connectivity.dll
2017-07-13 01:57 - 2017-06-21 12:05 - 004149248 _____ (Microsoft Corporation) C:\WINDOWS\system32\rdpcorets.dll
2017-07-13 01:57 - 2017-06-21 12:05 - 001726976 _____ (Microsoft Corporation) C:\WINDOWS\system32\Windows.UI.Immersive.dll
2017-07-13 01:57 - 2017-06-21 12:05 - 001369088 _____ (Microsoft Corporation) C:\WINDOWS\system32\Windows.UI.Xaml.Phone.dll
2017-07-13 01:57 - 2017-06-21 12:05 - 001328640 _____ (Microsoft Corporation) C:\WINDOWS\system32\Windows.Web.Http.dll
2017-07-13 01:57 - 2017-06-21 12:04 - 003299840 _____ (Microsoft Corporation) C:\WINDOWS\system32\mstsc.exe
2017-07-13 01:57 - 2017-06-21 12:04 - 001121280 _____ (Microsoft Corporation) C:\WINDOWS\system32\aadtb.dll
2017-07-13 01:57 - 2017-06-21 12:04 - 000035328 _____ (Microsoft Corporation) C:\WINDOWS\system32\spaceman.exe
2017-07-13 01:57 - 2017-06-21 12:03 - 000439296 _____ (Microsoft Corporation) C:\WINDOWS\system32\wksprt.exe
2017-07-13 01:57 - 2017-06-21 12:03 - 000048128 _____ (Microsoft Corporation) C:\WINDOWS\system32\tlscsp.dll
2017-07-13 01:57 - 2017-03-04 12:40 - 000360040 _____ (Microsoft Corporation) C:\WINDOWS\system32\SystemSettingsAdminFlows.exe
2017-07-13 01:57 - 2017-03-04 11:57 - 000391168 _____ (Microsoft Corporation) C:\WINDOWS\system32\oleacc.dll
2017-07-13 01:57 - 2017-03-04 11:56 - 000307200 _____ (Microsoft Corporation) C:\WINDOWS\system32\PrintDialogs3D.dll
2017-07-13 01:57 - 2017-03-04 11:53 - 001145856 _____ (Microsoft Corporation) C:\WINDOWS\system32\EmailApis.dll
2017-07-13 01:57 - 2017-03-04 11:53 - 000583680 _____ (Microsoft Corporation) C:\WINDOWS\system32\PrintDialogs.dll
2017-07-13 01:57 - 2017-03-04 11:50 - 000800768 _____ (Microsoft Corporation) C:\WINDOWS\system32\Windows.Security.Authentication.Web.Core.dll
2017-07-13 01:57 - 2017-03-04 11:47 - 000864256 _____ (Microsoft Corporation) C:\WINDOWS\system32\wpnapps.dll
2017-07-13 01:57 - 2017-03-04 11:44 - 000279552 _____ (Microsoft Corporation) C:\WINDOWS\system32\PlayToReceiver.dll
2017-07-13 01:57 - 2016-10-05 15:02 - 000146432 _____ (Microsoft Corporation) C:\WINDOWS\system32\AuthBroker.dll
2017-07-13 01:56 - 2017-07-07 12:59 - 002759712 _____ (Microsoft Corporation) C:\WINDOWS\system32\iertutil.dll
2017-07-13 01:56 - 2017-07-07 12:48 - 001100120 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\http.sys
2017-07-13 01:56 - 2017-07-07 12:48 - 000057400 _____ (Microsoft Corporation) C:\WINDOWS\system32\lsass.exe
2017-07-13 01:56 - 2017-07-07 12:21 - 022569984 _____ (Microsoft Corporation) C:\WINDOWS\system32\edgehtml.dll
2017-07-13 01:56 - 2017-07-07 12:18 - 000071680 _____ (Microsoft Corporation) C:\WINDOWS\system32\l2gpstore.dll
2017-07-13 01:56 - 2017-07-07 12:16 - 000052224 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\tcpipreg.sys
2017-07-13 01:56 - 2017-07-07 12:15 - 000276992 _____ (Microsoft Corporation) C:\WINDOWS\system32\dxtrans.dll
2017-07-13 01:56 - 2017-07-07 12:15 - 000223744 _____ (Microsoft Corporation) C:\WINDOWS\system32\ie4uinit.exe
2017-07-13 01:56 - 2017-07-07 12:14 - 000139264 _____ (Microsoft Corporation) C:\WINDOWS\system32\iepeers.dll
2017-07-13 01:56 - 2017-07-07 12:13 - 000431616 _____ (Microsoft Corporation) C:\WINDOWS\system32\WpAXHolder.dll
2017-07-13 01:56 - 2017-07-07 12:13 - 000387584 _____ (Microsoft Corporation) C:\WINDOWS\system32\iedkcs32.dll
2017-07-13 01:56 - 2017-07-07 12:13 - 000088576 _____ (Microsoft Corporation) C:\WINDOWS\system32\mshtmled.dll
2017-07-13 01:56 - 2017-07-07 12:12 - 000352256 _____ (Microsoft Corporation) C:\WINDOWS\system32\Wldap32.dll
2017-07-13 01:56 - 2017-07-07 12:06 - 000369664 _____ (Microsoft Corporation) C:\WINDOWS\system32\msinfo32.exe
2017-07-13 01:56 - 2017-07-07 12:01 - 023676416 _____ (Microsoft Corporation) C:\WINDOWS\system32\mshtml.dll
2017-07-13 01:56 - 2017-07-07 12:00 - 013090816 _____ (Microsoft Corporation) C:\WINDOWS\system32\ieframe.dll
2017-07-13 01:56 - 2017-07-07 11:58 - 002096640 _____ (Microsoft Corporation) C:\WINDOWS\system32\inetcpl.cpl
2017-07-13 01:56 - 2017-07-07 11:58 - 000759296 _____ (Microsoft Corporation) C:\WINDOWS\system32\msfeeds.dll
2017-07-13 01:56 - 2017-07-07 11:55 - 004708864 _____ (Microsoft Corporation) C:\WINDOWS\system32\ExplorerFrame.dll
2017-07-13 01:56 - 2017-07-07 11:54 - 002895872 _____ (Microsoft Corporation) C:\WINDOWS\system32\wininet.dll
2017-07-13 01:56 - 2017-07-07 11:54 - 001783296 _____ (Microsoft Corporation) C:\WINDOWS\system32\urlmon.dll
2017-07-13 01:56 - 2017-07-07 11:52 - 001826816 _____ (Microsoft Corporation) C:\WINDOWS\system32\msxml3.dll
2017-07-13 01:56 - 2017-06-21 13:23 - 000794928 _____ (Microsoft Corporation) C:\WINDOWS\system32\Windows.Internal.Shell.Broker.dll
2017-07-13 01:56 - 2017-06-21 13:22 - 002213760 _____ (Microsoft Corporation) C:\WINDOWS\system32\KernelBase.dll
2017-07-13 01:56 - 2017-06-21 13:21 - 000434528 _____ (Microsoft Corporation) C:\WINDOWS\system32\hal.dll
2017-07-13 01:56 - 2017-06-21 13:20 - 000126304 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\mup.sys
2017-07-13 01:56 - 2017-06-21 13:10 - 000224096 _____ (Microsoft Corporation) C:\WINDOWS\system32\ifsutil.dll
2017-07-13 01:56 - 2017-06-21 13:08 - 007220192 _____ (Microsoft Corporation) C:\WINDOWS\system32\windows.storage.dll
2017-07-13 01:56 - 2017-06-21 13:07 - 002446704 _____ (Microsoft Corporation) C:\WINDOWS\system32\msxml6.dll
2017-07-13 01:56 - 2017-06-21 13:06 - 000624048 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\cng.sys
2017-07-13 01:56 - 2017-06-21 13:02 - 004260576 _____ (Microsoft Corporation) C:\WINDOWS\system32\mfcore.dll
2017-07-13 01:56 - 2017-06-21 13:02 - 001983408 _____ (Microsoft Corporation) C:\WINDOWS\system32\mfmp4srcsnk.dll
2017-07-13 01:56 - 2017-06-21 13:02 - 001702392 _____ (Microsoft Corporation) C:\WINDOWS\system32\mfasfsrcsnk.dll
2017-07-13 01:56 - 2017-06-21 13:02 - 001072248 _____ (Microsoft Corporation) C:\WINDOWS\system32\mfnetcore.dll
2017-07-13 01:56 - 2017-06-21 13:01 - 004674360 _____ (Microsoft Corporation) C:\WINDOWS\explorer.exe
2017-07-13 01:56 - 2017-06-21 12:56 - 000387864 _____ (Microsoft Corporation) C:\WINDOWS\system32\wmpps.dll
2017-07-13 01:56 - 2017-06-21 12:34 - 001631232 _____ (Microsoft Corporation) C:\WINDOWS\system32\Windows.UI.Xaml.Resources.dll
2017-07-13 01:56 - 2017-06-21 12:33 - 000167936 _____ (Microsoft Corporation) C:\WINDOWS\system32\uudf.dll
2017-07-13 01:56 - 2017-06-21 12:32 - 000030208 _____ (Microsoft Corporation) C:\WINDOWS\system32\odbcconf.dll
2017-07-13 01:56 - 2017-06-21 12:31 - 000185344 _____ (Microsoft Corporation) C:\WINDOWS\system32\DisplayManager.dll
2017-07-13 01:56 - 2017-06-21 12:29 - 000082944 _____ (Microsoft Corporation) C:\WINDOWS\system32\KdsCli.dll
2017-07-13 01:56 - 2017-06-21 12:26 - 000852480 _____ (Microsoft Corporation) C:\WINDOWS\system32\Windows.Media.Import.dll
2017-07-13 01:56 - 2017-06-21 12:25 - 000407552 _____ (Microsoft Corporation) C:\WINDOWS\system32\Windows.Internal.Management.dll
2017-07-13 01:56 - 2017-06-21 12:24 - 000671744 _____ (Microsoft Corporation) C:\WINDOWS\system32\mbsmsapi.dll
2017-07-13 01:56 - 2017-06-21 12:24 - 000472064 _____ (Microsoft Corporation) C:\WINDOWS\system32\Windows.Internal.Bluetooth.dll
2017-07-13 01:56 - 2017-06-21 12:24 - 000247808 _____ (Microsoft Corporation) C:\WINDOWS\system32\ExecModelClient.dll
2017-07-13 01:56 - 2017-06-21 12:23 - 000284160 _____ (Microsoft Corporation) C:\WINDOWS\system32\AboveLockAppHost.dll
2017-07-13 01:56 - 2017-06-21 12:22 - 017198592 _____ (Microsoft Corporation) C:\WINDOWS\system32\Windows.UI.Xaml.dll
2017-07-13 01:56 - 2017-06-21 12:19 - 003778048 _____ (Microsoft Corporation) C:\WINDOWS\system32\MFMediaEngine.dll
2017-07-13 01:56 - 2017-06-21 12:19 - 000169984 _____ (Microsoft Corporation) C:\WINDOWS\system32\Windows.Energy.dll
2017-07-13 01:56 - 2017-06-21 12:18 - 000112640 _____ (Microsoft Corporation) C:\WINDOWS\system32\uexfat.dll
2017-07-13 01:56 - 2017-06-21 12:17 - 007655424 _____ (Microsoft Corporation) C:\WINDOWS\system32\mos.dll
2017-07-13 01:56 - 2017-06-21 12:17 - 001105408 _____ (Microsoft Corporation) C:\WINDOWS\system32\MiracastReceiver.dll
2017-07-13 01:56 - 2017-06-21 12:17 - 000574976 _____ (Microsoft Corporation) C:\WINDOWS\system32\untfs.dll
2017-07-13 01:56 - 2017-06-21 12:17 - 000152064 _____ (Microsoft Corporation) C:\WINDOWS\system32\ufat.dll
2017-07-13 01:56 - 2017-06-21 12:16 - 000516608 _____ (Microsoft Corporation) C:\WINDOWS\system32\uReFSv1.dll
2017-07-13 01:56 - 2017-06-21 12:13 - 001217024 _____ (Microsoft Corporation) C:\WINDOWS\system32\Windows.Media.Audio.dll
2017-07-13 01:56 - 2017-06-21 12:13 - 000961536 _____ (Microsoft Corporation) C:\WINDOWS\system32\imapi2fs.dll
2017-07-13 01:56 - 2017-06-21 12:13 - 000628736 _____ (Microsoft Corporation) C:\WINDOWS\system32\uReFS.dll
2017-07-13 01:56 - 2017-06-21 12:12 - 000467968 _____ (Microsoft Corporation) C:\WINDOWS\system32\Geolocation.dll
2017-07-13 01:56 - 2017-06-21 12:12 - 000139776 _____ (Microsoft Corporation) C:\WINDOWS\system32\Windows.Media.Devices.dll
2017-07-13 01:56 - 2017-06-21 12:12 - 000079360 _____ (Microsoft Corporation) C:\WINDOWS\system32\LocationFrameworkInternalPS.dll
2017-07-13 01:56 - 2017-06-21 12:10 - 004474368 _____ (Microsoft Corporation) C:\WINDOWS\system32\D3DCompiler_47.dll
2017-07-13 01:56 - 2017-06-21 12:10 - 001586176 _____ (Microsoft Corporation) C:\WINDOWS\system32\Windows.Globalization.dll
2017-07-13 01:56 - 2017-06-21 12:09 - 001490432 _____ (Microsoft Corporation) C:\WINDOWS\system32\lsasrv.dll
2017-07-13 01:56 - 2017-06-21 12:08 - 000846336 _____ (Microsoft Corporation) C:\WINDOWS\system32\MbaeApiPublic.dll
2017-07-13 01:56 - 2017-06-21 12:07 - 000735744 _____ (Microsoft Corporation) C:\WINDOWS\system32\LogonController.dll
2017-07-13 01:56 - 2017-06-21 12:06 - 000180224 _____ (Microsoft Corporation) C:\WINDOWS\system32\enrollmentapi.dll
2017-07-13 01:56 - 2017-06-21 12:05 - 000924672 _____ (Microsoft Corporation) C:\WINDOWS\system32\Windows.Networking.BackgroundTransfer.dll
2017-07-13 01:56 - 2017-03-04 11:45 - 001078784 _____ (Microsoft Corporation) C:\WINDOWS\system32\Windows.Media.Streaming.dll
2017-07-13 01:56 - 2016-10-15 09:15 - 001790464 _____ (Microsoft Corporation) C:\WINDOWS\system32\LocationFramework.dll
2017-07-13 01:56 - 2016-08-27 10:42 - 000244816 _____ (Microsoft Corporation) C:\WINDOWS\system32\mfps.dll
2017-07-13 01:55 - 2017-07-07 13:10 - 000376672 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\clfs.sys
2017-07-13 01:55 - 2017-07-07 12:53 - 000241504 _____ (Microsoft Corporation) C:\WINDOWS\system32\CloudExperienceHost.dll
2017-07-13 01:55 - 2017-07-07 12:28 - 007217152 _____ (Microsoft Corporation) C:\WINDOWS\system32\Windows.Data.Pdf.dll
2017-07-13 01:55 - 2017-07-07 11:58 - 000927744 _____ (Microsoft Corporation) C:\WINDOWS\system32\SmartcardCredentialProvider.dll
2017-07-13 01:55 - 2017-07-07 11:54 - 002217472 _____ (Microsoft Corporation) C:\WINDOWS\system32\OpcServices.dll
2017-07-13 01:55 - 2017-06-21 13:24 - 000603488 _____ (Microsoft Corporation) C:\WINDOWS\system32\ContentDeliveryManager.Utilities.dll
2017-07-13 01:55 - 2017-06-21 13:18 - 002681200 _____ C:\WINDOWS\system32\CoreUIComponents.dll
2017-07-13 01:55 - 2017-06-21 13:17 - 000764392 _____ (Microsoft Corporation) C:\WINDOWS\system32\CoreMessaging.dll
2017-07-13 01:55 - 2017-06-21 13:10 - 001069720 _____ (Microsoft Corporation) C:\WINDOWS\system32\MrmCoreR.dll
2017-07-13 01:55 - 2017-06-21 13:07 - 001369240 _____ (Microsoft Corporation) C:\WINDOWS\system32\dcomp.dll
2017-07-13 01:55 - 2017-06-21 13:07 - 000146784 _____ (Microsoft Corporation) C:\WINDOWS\system32\CloudExperienceHostCommon.dll
2017-07-13 01:55 - 2017-06-21 13:05 - 002915704 _____ (Microsoft Corporation) C:\WINDOWS\system32\combase.dll
2017-07-13 01:55 - 2017-06-21 13:05 - 001267512 _____ (Microsoft Corporation) C:\WINDOWS\system32\WinTypes.dll
2017-07-13 01:55 - 2017-06-21 13:01 - 001277824 _____ (Microsoft Corporation) C:\WINDOWS\system32\ole32.dll
2017-07-13 01:55 - 2017-06-21 13:01 - 000160096 _____ (Microsoft Corporation) C:\WINDOWS\system32\CloudExperienceHostBroker.dll
2017-07-13 01:55 - 2017-06-21 12:30 - 000193536 _____ (Microsoft Corporation) C:\WINDOWS\system32\Windows.Devices.WiFi.dll
2017-07-13 01:55 - 2017-06-21 12:29 - 000182272 _____ (Microsoft Corporation) C:\WINDOWS\system32\DeviceDirectoryClient.dll
2017-07-13 01:55 - 2017-06-21 12:28 - 000257024 _____ (Microsoft Corporation) C:\WINDOWS\system32\CloudDomainJoinDataModelServer.dll
2017-07-13 01:55 - 2017-06-21 12:28 - 000186368 _____ (Microsoft Corporation) C:\WINDOWS\system32\Windows.Devices.Radios.dll
2017-07-13 01:55 - 2017-06-21 12:28 - 000144896 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\dfsc.sys
2017-07-13 01:55 - 2017-06-21 12:27 - 000651264 _____ (Microsoft Corporation) C:\WINDOWS\system32\Windows.Devices.AllJoyn.dll
2017-07-13 01:55 - 2017-06-21 12:27 - 000505856 _____ (Microsoft Corporation) C:\WINDOWS\system32\Windows.Devices.WiFiDirect.dll
2017-07-13 01:55 - 2017-06-21 12:27 - 000243712 _____ (Microsoft Corporation) C:\WINDOWS\system32\credprovhost.dll
2017-07-13 01:55 - 2017-06-21 12:27 - 000171520 _____ (Microsoft Corporation) C:\WINDOWS\system32\Windows.Devices.SerialCommunication.dll
2017-07-13 01:55 - 2017-06-21 12:27 - 000157696 _____ (Microsoft Corporation) C:\WINDOWS\system32\XamlTileRender.dll
2017-07-13 01:55 - 2017-06-21 12:27 - 000144896 _____ (Microsoft Corporation) C:\WINDOWS\system32\Windows.Devices.Lights.dll
2017-07-13 01:55 - 2017-06-21 12:26 - 000912384 _____ (Microsoft Corporation) C:\WINDOWS\system32\Windows.Devices.SmartCards.dll
2017-07-13 01:55 - 2017-06-21 12:26 - 000568320 _____ (Microsoft Corporation) C:\WINDOWS\system32\Windows.Devices.LowLevel.dll
2017-07-13 01:55 - 2017-06-21 12:26 - 000379904 _____ (Microsoft Corporation) C:\WINDOWS\system32\apprepsync.dll
2017-07-13 01:55 - 2017-06-21 12:26 - 000324608 _____ (Microsoft Corporation) C:\WINDOWS\system32\Windows.ApplicationModel.LockScreen.dll
2017-07-13 01:55 - 2017-06-21 12:26 - 000268800 _____ (Microsoft Corporation) C:\WINDOWS\system32\UserMgrProxy.dll
2017-07-13 01:55 - 2017-06-21 12:25 - 000176128 _____ (Microsoft Corporation) C:\WINDOWS\system32\apprepapi.dll
2017-07-13 01:55 - 2017-06-21 12:24 - 000949248 _____ (Microsoft Corporation) C:\WINDOWS\system32\Windows.Devices.PointOfService.dll
2017-07-13 01:55 - 2017-06-21 12:24 - 000337408 _____ (Microsoft Corporation) C:\WINDOWS\system32\Windows.Devices.Picker.dll
2017-07-13 01:55 - 2017-06-21 12:23 - 001010176 _____ (Microsoft Corporation) C:\WINDOWS\system32\enterprisecsps.dll
2017-07-13 01:55 - 2017-06-21 12:23 - 000437248 _____ (Microsoft Corporation) C:\WINDOWS\system32\Windows.Devices.Usb.dll
2017-07-13 01:55 - 2017-06-21 12:23 - 000329728 _____ (Microsoft Corporation) C:\WINDOWS\system32\deviceaccess.dll
2017-07-13 01:55 - 2017-06-21 12:22 - 000956416 _____ (Microsoft Corporation) C:\WINDOWS\system32\AppXDeploymentExtensions.desktop.dll
2017-07-13 01:55 - 2017-06-21 12:22 - 000896512 _____ (Microsoft Corporation) C:\WINDOWS\system32\Windows.AccountsControl.dll
2017-07-13 01:55 - 2017-06-21 12:22 - 000560128 _____ (Microsoft Corporation) C:\WINDOWS\system32\AppReadiness.dll
2017-07-13 01:55 - 2017-06-21 12:22 - 000410112 _____ (Microsoft Corporation) C:\WINDOWS\system32\DevicesFlowBroker.dll
2017-07-13 01:55 - 2017-06-21 12:21 - 000410112 _____ (Microsoft Corporation) C:\WINDOWS\system32\AppXDeploymentClient.dll
2017-07-13 01:55 - 2017-06-21 12:20 - 001054208 _____ (Microsoft Corporation) C:\WINDOWS\system32\qmgr.dll
2017-07-13 01:55 - 2017-06-21 12:18 - 000968192 _____ (Microsoft Corporation) C:\WINDOWS\system32\autochk.exe
2017-07-13 01:55 - 2017-06-21 12:17 - 000064000 _____ (Microsoft Corporation) C:\WINDOWS\system32\fdProxy.dll
2017-07-13 01:55 - 2017-06-21 12:16 - 000925184 _____ (Microsoft Corporation) C:\WINDOWS\system32\autofmt.exe
2017-07-13 01:55 - 2017-06-21 12:16 - 000187904 _____ (Microsoft Corporation) C:\WINDOWS\system32\dialclient.dll
2017-07-13 01:55 - 2017-06-21 12:16 - 000039424 _____ (Microsoft Corporation) C:\WINDOWS\system32\cnvfat.dll
2017-07-13 01:55 - 2017-06-21 12:14 - 000167936 _____ (Microsoft Corporation) C:\WINDOWS\system32\ErrorDetails.dll
2017-07-13 01:55 - 2017-06-21 12:13 - 000953344 _____ (Microsoft Corporation) C:\WINDOWS\system32\autoconv.exe
2017-07-13 01:55 - 2017-06-21 12:11 - 002279424 _____ (Microsoft Corporation) C:\WINDOWS\system32\AppXDeploymentServer.dll
2017-07-13 01:55 - 2017-06-21 12:11 - 001692160 _____ (Microsoft Corporation) C:\WINDOWS\system32\AppXDeploymentExtensions.onecore.dll
2017-07-13 01:55 - 2017-06-21 12:11 - 001021440 _____ (Microsoft Corporation) C:\WINDOWS\system32\usermgr.dll
2017-07-13 01:55 - 2017-06-21 12:11 - 000460800 _____ (Microsoft Corporation) C:\WINDOWS\system32\Windows.Devices.Midi.dll
2017-07-13 01:55 - 2017-06-21 12:10 - 001421824 _____ (Microsoft Corporation) C:\WINDOWS\system32\certutil.exe
2017-07-13 01:55 - 2017-06-21 12:10 - 000886784 _____ (Microsoft Corporation) C:\WINDOWS\system32\CPFilters.dll
2017-07-13 01:55 - 2017-06-21 12:10 - 000376832 _____ (Microsoft Corporation) C:\WINDOWS\system32\CryptoWinRT.dll
2017-07-13 01:55 - 2017-06-21 12:08 - 005611008 _____ (Microsoft Corporation) C:\WINDOWS\system32\d2d1.dll
2017-07-13 01:55 - 2017-06-21 12:08 - 001275392 _____ (Microsoft Corporation) C:\WINDOWS\system32\Windows.Devices.Bluetooth.dll
2017-07-13 01:55 - 2017-06-21 12:07 - 000716800 _____ (Microsoft Corporation) C:\WINDOWS\system32\ShareHost.dll
2017-07-13 01:55 - 2017-03-04 11:58 - 000279552 _____ (Microsoft Corporation) C:\WINDOWS\system32\Windows.Devices.HumanInterfaceDevice.dll
2017-07-13 01:55 - 2017-03-04 11:49 - 001589760 _____ (Microsoft Corporation) C:\WINDOWS\system32\msdtctm.dll
2017-07-13 01:54 - 2017-07-07 12:17 - 000128512 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\bthpan.sys
2017-07-13 01:54 - 2017-06-21 13:06 - 000557408 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\spaceport.sys
2017-07-13 01:54 - 2017-06-21 13:06 - 000129888 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\USBSTOR.SYS
2017-07-12 18:29 - 2017-07-10 18:18 - 000012793 ____N C:\Users\Raj\Documents\Midnight in Paris (2011) [720p] [YTS.AG].torrent
2017-07-12 18:29 - 2017-07-03 23:25 - 000009914 ____N C:\Users\Raj\Documents\The Age of Innocence (1993) [720p] [YTS.AG].torrent
2017-07-12 18:28 - 2017-07-10 18:15 - 000010937 ____N C:\Users\Raj\Documents\Avatar (2009) [720p] [YTS.AG].torrent
2017-07-12 18:28 - 2017-07-10 00:13 - 000118890 ____N C:\Users\Raj\Documents\maninthearena.pdf
2017-07-09 11:47 - 2017-07-09 11:47 - 000000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\qBittorrent
2017-07-09 11:47 - 2017-07-09 11:47 - 000000000 ____D C:\Program Files (x86)\qBittorrent
2017-07-07 14:40 - 2017-07-07 14:40 - 005447663 _____ C:\Users\Raj\Documents\taoofseneca_vol1-1.pdf
2017-07-07 14:40 - 2017-07-07 14:40 - 004358518 _____ C:\Users\Raj\Documents\taoofseneca_vol3.pdf
2017-07-07 14:40 - 2017-07-07 14:40 - 004148564 _____ C:\Users\Raj\Documents\taoofseneca_vol2.pdf
2017-07-05 10:21 - 2017-07-05 10:21 - 000000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\LibreOffice 5.3

==================== One Month Modified files and folders ========

(If an entry is included in the fixlist, the file/folder will be moved.)

2017-08-04 13:55 - 2017-06-28 11:41 - 009216744 _____ C:\WINDOWS\ZAM.krnl.trace
2017-08-04 13:55 - 2017-06-28 11:41 - 001632023 _____ C:\WINDOWS\ZAM_Guard.krnl.trace
2017-08-04 13:43 - 2016-05-05 14:28 - 000000000 __SHD C:\Users\Raj\IntelGraphicsProfiles
2017-08-04 09:44 - 2016-08-05 23:08 - 000000000 ____D C:\WINDOWS\system32\SleepStudy
2017-08-04 08:04 - 2016-07-16 17:17 - 000000000 ____D C:\WINDOWS\AppReadiness
2017-08-03 23:56 - 2016-05-07 18:43 - 000000000 ____D C:\Users\Raj\AppData\Roaming\vlc
2017-08-03 22:32 - 2017-04-24 17:33 - 000001396 _____ C:\Users\Raj\Desktop\e.txt
2017-08-03 10:46 - 2016-05-05 22:57 - 000000000 ____D C:\Users\Raj\English Blog
2017-08-03 09:59 - 2016-05-29 19:17 - 000000000 ____D C:\Users\Raj\.FBReader
2017-08-03 07:09 - 2016-05-07 17:10 - 000002274 _____ C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Google Chrome.lnk
2017-08-02 18:14 - 2017-06-14 20:21 - 000000000 ____D C:\Users\Raj\AppData\Local\CrashDumps
2017-08-02 16:08 - 2016-07-16 17:15 - 000000000 ____D C:\WINDOWS\INF
2017-08-02 15:58 - 2016-11-17 13:31 - 000000000 ____D C:\Users\Raj\AppData\LocalLow\Mozilla
2017-08-02 15:36 - 2016-05-08 09:57 - 000000000 ____D C:\Program Files (x86)\Mozilla Maintenance Service
2017-08-01 10:22 - 2016-12-17 19:22 - 000000000 ____D C:\Users\Raj\AppData\Roaming\Wireshark
2017-08-01 09:48 - 2017-07-03 11:26 - 000000000 ____D C:\Program Files\Wireshark
2017-08-01 09:48 - 2016-12-17 19:18 - 000000000 ____D C:\Program Files (x86)\WinPcap
2017-08-01 09:47 - 2016-02-01 17:02 - 000000000 ____D C:\ProgramData\Package Cache
2017-07-31 20:02 - 2017-06-13 12:39 - 000000000 ____D C:\Users\Raj\AppData\Local\NPE
2017-07-31 18:53 - 2016-08-10 19:14 - 000000000 ____D C:\Users\Raj\Documents\Kindle
2017-07-31 09:28 - 2017-05-02 15:44 - 000000000 ___RD C:\Users\Raj\Japanese
2017-07-30 23:39 - 2016-02-01 17:12 - 002654514 _____ C:\WINDOWS\system32\PerfStringBackup.INI
2017-07-30 23:33 - 2017-05-09 19:09 - 000253856 _____ (Malwarebytes) C:\WINDOWS\system32\Drivers\MBAMSwissArmy.sys
2017-07-30 23:33 - 2016-08-05 23:25 - 000000006 ____H C:\WINDOWS\Tasks\SA.DAT
2017-07-30 23:33 - 2016-07-16 11:34 - 000262144 _____ C:\WINDOWS\system32\config\BBI
2017-07-28 14:14 - 2016-07-16 17:17 - 000000000 ____D C:\WINDOWS\system32\NDF
2017-07-28 10:34 - 2017-04-17 12:49 - 000000000 ____D C:\ProgramData\Malwarebytes' Anti-Malware (portable)
2017-07-28 10:07 - 2017-05-09 19:08 - 000000000 ____D C:\ProgramData\Malwarebytes
2017-07-28 10:07 - 2017-05-04 18:18 - 000109272 _____ (Malwarebytes) C:\WINDOWS\system32\Drivers\MBAMChameleon.sys
2017-07-27 23:11 - 2016-05-05 22:58 - 000000000 ____D C:\Users\Raj\Leapforce
2017-07-25 17:54 - 2017-06-27 12:43 - 000000000 ____D C:\ProgramData\SupportAssist
2017-07-25 09:30 - 2017-05-09 19:09 - 000000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Malwarebytes
2017-07-23 19:04 - 2016-05-05 13:23 - 000000000 ____D C:\Users\Raj\AppData\Roaming\PCDr
2017-07-22 13:26 - 2016-08-05 23:14 - 000000000 ____D C:\Users\Raj
2017-07-20 13:26 - 2016-05-09 09:08 - 000000000 ____D C:\Users\Raj\dwhelper
2017-07-18 15:19 - 2016-05-24 14:32 - 000000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\calibre - E-book Management
2017-07-18 15:19 - 2016-05-24 14:32 - 000000000 ____D C:\Program Files (x86)\Calibre2
2017-07-18 15:10 - 2016-05-24 14:32 - 000000000 ____D C:\Users\Raj\Documents\Calibre Library
2017-07-16 12:54 - 2016-07-16 17:17 - 000000000 ____D C:\WINDOWS\rescache
2017-07-13 13:33 - 2016-07-16 17:06 - 000000000 ____D C:\WINDOWS\CbsTemp
2017-07-13 04:19 - 2016-02-01 17:28 - 000000000 __RHD C:\Users\Public\AccountPictures
2017-07-13 04:16 - 2016-08-05 23:08 - 000302432 _____ C:\WINDOWS\system32\FNTCACHE.DAT
2017-07-13 04:14 - 2016-07-16 17:17 - 000000000 ____D C:\WINDOWS\system32\oobe
2017-07-13 04:14 - 2016-07-16 17:17 - 000000000 ____D C:\WINDOWS\system32\appraiser
2017-07-13 04:13 - 2016-07-16 17:17 - 000000000 ___RD C:\WINDOWS\ImmersiveControlPanel
2017-07-13 04:13 - 2016-07-16 17:17 - 000000000 ____D C:\WINDOWS\ShellExperiences
2017-07-13 04:13 - 2016-07-16 17:17 - 000000000 ____D C:\Program Files\Windows Photo Viewer
2017-07-13 04:13 - 2016-07-16 17:17 - 000000000 ____D C:\Program Files (x86)\Windows Photo Viewer
2017-07-13 02:09 - 2016-06-17 12:14 - 000000000 ____D C:\WINDOWS\system32\MRT
2017-07-13 02:08 - 2016-05-14 20:06 - 135225752 ____C (Microsoft Corporation) C:\WINDOWS\system32\MRT.exe
2017-07-12 14:41 - 2016-07-16 17:13 - 000157696 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\enrollmentapi.dll
2017-07-11 21:09 - 2017-04-03 13:51 - 000000000 ____D C:\Users\Raj\Videos1
2017-07-09 11:42 - 2016-09-22 19:46 - 000000000 ____D C:\Users\Raj\AppData\Roaming\qBittorrent
2017-07-05 10:21 - 2017-06-02 20:25 - 000000000 ____D C:\Program Files\LibreOffice 5

==================== Files in the root of some directories =======

2016-08-16 13:29 - 2016-08-16 13:29 - 000000017 _____ () C:\Users\Raj\AppData\Local\resmon.resmoncfg
2016-12-26 10:02 - 2016-12-26 10:02 - 000047518 _____ () C:\ProgramData\agent.1482726766.bdinstall.bin
2016-12-26 10:03 - 2016-12-26 10:03 - 000028745 _____ () C:\ProgramData\agent.1482726826.bdinstall.bin
2016-12-26 10:13 - 2016-12-26 10:13 - 000028744 _____ () C:\ProgramData\agent.1482727395.bdinstall.bin
2016-12-26 10:42 - 2016-12-26 10:42 - 000029152 _____ () C:\ProgramData\agent.1482729156.bdinstall.bin
2016-12-26 17:46 - 2016-12-26 17:46 - 000048381 _____ () C:\ProgramData\agent.1482754582.bdinstall.bin
2016-12-27 10:03 - 2016-12-27 10:03 - 000028745 _____ () C:\ProgramData\agent.1482813235.bdinstall.bin
2017-05-06 20:32 - 2017-05-06 20:32 - 000047586 _____ () C:\ProgramData\agent.1494082959.bdinstall.bin
2017-05-07 09:46 - 2017-05-07 09:46 - 000047804 _____ () C:\ProgramData\agent.1494130567.bdinstall.bin
2017-05-09 18:32 - 2017-05-09 18:32 - 000030030 _____ () C:\ProgramData\agent.uninstall.1494334947.bdinstall.bin
2017-05-07 19:50 - 2017-05-07 19:50 - 000029963 _____ () C:\ProgramData\agent.update.1494166823.bdinstall.bin
2016-08-05 23:11 - 2016-08-05 23:11 - 000000000 ____H () C:\ProgramData\DP45977C.lfl

==================== Bamital & volsnap ======================

(There is no automatic fix for files that do not pass verification.)

C:\WINDOWS\system32\winlogon.exe => File is digitally signed
C:\WINDOWS\system32\wininit.exe => File is digitally signed
C:\WINDOWS\explorer.exe => File is digitally signed
C:\WINDOWS\SysWOW64\explorer.exe => File is digitally signed
C:\WINDOWS\system32\svchost.exe => File is digitally signed
C:\WINDOWS\SysWOW64\svchost.exe => File is digitally signed
C:\WINDOWS\system32\services.exe => File is digitally signed
C:\WINDOWS\system32\User32.dll => File is digitally signed
C:\WINDOWS\SysWOW64\User32.dll => File is digitally signed
C:\WINDOWS\system32\userinit.exe => File is digitally signed
C:\WINDOWS\SysWOW64\userinit.exe => File is digitally signed
C:\WINDOWS\system32\rpcss.dll => File is digitally signed
C:\WINDOWS\system32\dnsapi.dll => File is digitally signed
C:\WINDOWS\SysWOW64\dnsapi.dll => File is digitally signed
C:\WINDOWS\system32\Drivers\volsnap.sys => File is digitally signed

LastRegBack: 2017-07-25 23:28

==================== End of FRST.txt ============================

 

Additional scan result of Farbar Recovery Scan Tool (x64) Version: 31-07-2017
Ran by Raj (04-08-2017 13:56:44)
Running from C:\Users\Raj\Desktop
Windows 10 Home Single Language Version 1607 (X64) (2016-08-05 18:00:10)
Boot Mode: Normal
==========================================================


==================== Accounts: =============================

Administrator (S-1-5-21-3363881303-3615463573-1429575272-500 - Administrator - Disabled)
DefaultAccount (S-1-5-21-3363881303-3615463573-1429575272-503 - Limited - Disabled)
Guest (S-1-5-21-3363881303-3615463573-1429575272-501 - Limited - Disabled)
Raj (S-1-5-21-3363881303-3615463573-1429575272-1001 - Administrator - Enabled) => C:\Users\Raj
SophosSAUDESKTOP-MO0 (S-1-5-21-3363881303-3615463573-1429575272-1006 - Limited - Enabled)

==================== Security Center ========================

(If an entry is included in the fixlist, it will be removed.)

AV: Windows Defender (Enabled - Up to date) {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
AS: Windows Defender (Enabled - Up to date) {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}

==================== Installed Programs ======================

(Only the adware programs with "Hidden" flag could be added to the fixlist to unhide them. The adware programs should be uninstalled manually.)

Amazon Kindle (HKU\S-1-5-21-3363881303-3615463573-1429575272-1001\...\Amazon Kindle) (Version: 1.20.1.47037 - Amazon)
AMD Install Manager (HKLM\...\AMD Catalyst Install Manager) (Version: 9.0.000.4 - Advanced Micro Devices, Inc.)
calibre (HKLM-x32\...\{5B27E69E-F59D-4B62-901F-F6981C826A5A}) (Version: 3.4.0 - Kovid Goyal)
Catalyst Control Center Next Localization BR (HKLM\...\{F6179602-B81A-8280-ED6A-60C4CE3BFB44}) (Version: 2016.1206.1960.35982 - Advanced Micro Devices, Inc.) Hidden
Catalyst Control Center Next Localization CHS (HKLM\...\{84A7D3B6-F315-EB89-8B81-A7F5E97843BF}) (Version: 2016.1206.1960.35982 - Advanced Micro Devices, Inc.) Hidden
Catalyst Control Center Next Localization CHT (HKLM\...\{B60CE830-8747-B6B4-3D76-D04799EF8F00}) (Version: 2016.1206.1960.35982 - Advanced Micro Devices, Inc.) Hidden
Catalyst Control Center Next Localization CS (HKLM\...\{38E01689-ECCD-0B42-95D6-9FD56BDE11B4}) (Version: 2016.1206.1960.35982 - Advanced Micro Devices, Inc.) Hidden
Catalyst Control Center Next Localization DA (HKLM\...\{B537565B-B778-33C9-6D73-D4C65E65C877}) (Version: 2016.1206.1960.35982 - Advanced Micro Devices, Inc.) Hidden
Catalyst Control Center Next Localization DE (HKLM\...\{9AA4635B-0074-9D40-2820-5AC2123C5E4E}) (Version: 2016.1206.1960.35982 - Advanced Micro Devices, Inc.) Hidden
Catalyst Control Center Next Localization EL (HKLM\...\{D02B5EFD-8560-FE50-73CE-B08AD35DE353}) (Version: 2016.1206.1960.35982 - Advanced Micro Devices, Inc.) Hidden
Catalyst Control Center Next Localization ES (HKLM\...\{77ACB171-E4C4-B9E6-363B-B43D05F2B31D}) (Version: 2016.1206.1960.35982 - Advanced Micro Devices, Inc.) Hidden
Catalyst Control Center Next Localization FI (HKLM\...\{3BCEC951-192C-BF61-90AD-838419ED6BD7}) (Version: 2016.1206.1960.35982 - Advanced Micro Devices, Inc.) Hidden
Catalyst Control Center Next Localization FR (HKLM\...\{74449FE3-5AF8-8A79-0E26-5286455FD89D}) (Version: 2016.1206.1960.35982 - Advanced Micro Devices, Inc.) Hidden
Catalyst Control Center Next Localization HU (HKLM\...\{82FFDEB9-05BB-3CB2-3176-4913B1F34499}) (Version: 2016.1206.1960.35982 - Advanced Micro Devices, Inc.) Hidden
Catalyst Control Center Next Localization IT (HKLM\...\{F9A05A5E-1F16-2250-D7BD-B1D89C388771}) (Version: 2016.1206.1960.35982 - Advanced Micro Devices, Inc.) Hidden
Catalyst Control Center Next Localization JA (HKLM\...\{BC3E9171-36CB-644F-1CDF-D78FA385F648}) (Version: 2016.1206.1960.35982 - Advanced Micro Devices, Inc.) Hidden
Catalyst Control Center Next Localization KO (HKLM\...\{DB214277-8102-1BB2-B5C4-801F4D1E5FA5}) (Version: 2016.1206.1960.35982 - Advanced Micro Devices, Inc.) Hidden
Catalyst Control Center Next Localization NL (HKLM\...\{FC03878F-379F-49AC-989A-0BAF64CBAF58}) (Version: 2016.1206.1960.35982 - Advanced Micro Devices, Inc.) Hidden
Catalyst Control Center Next Localization NO (HKLM\...\{1C3ECA52-28D9-7ACD-D827-C3AD1385FF83}) (Version: 2016.1206.1960.35982 - Advanced Micro Devices, Inc.) Hidden
Catalyst Control Center Next Localization PL (HKLM\...\{E6F74259-2418-FA53-90C2-8BE208E12F69}) (Version: 2016.1206.1960.35982 - Advanced Micro Devices, Inc.) Hidden
Catalyst Control Center Next Localization RU (HKLM\...\{88452244-BB97-1471-E8C6-14EFE80EB921}) (Version: 2016.1206.1960.35982 - Advanced Micro Devices, Inc.) Hidden
Catalyst Control Center Next Localization SV (HKLM\...\{5E5438D8-A264-56E4-06F2-0A3F7B04D544}) (Version: 2016.1206.1960.35982 - Advanced Micro Devices, Inc.) Hidden
Catalyst Control Center Next Localization TH (HKLM\...\{142C59E1-549F-1601-094B-9C9BF57A3851}) (Version: 2016.1206.1960.35982 - Advanced Micro Devices, Inc.) Hidden
Catalyst Control Center Next Localization TR (HKLM\...\{360F558F-8E4D-55B8-9FA1-DEB550D7F337}) (Version: 2016.1206.1960.35982 - Advanced Micro Devices, Inc.) Hidden
CCleaner (HKLM\...\CCleaner) (Version: 5.32 - Piriform)
Dell Customer Connect (HKLM-x32\...\{4FA72FF9-DD64-43A8-8704-6380A11F11D5}) (Version: 1.4.15.0 - Dell Inc.)
Dell Digital Delivery (HKLM-x32\...\{AB7F2792-2ED1-4C5C-9F28-680E5110BF72}) (Version: 3.1.1018.0 - Dell Products, LP)
Dell Foundation Services (HKLM\...\{BDB50421-E961-42F3-B803-6DAC6F173834}) (Version: 3.4.16100.0 - Dell Inc.)
Dell Help & Support (HKLM\...\{E8669F4E-F2BE-48A9-B5A5-0BC12CA4CB4F}) (Version: 2.4.18.0 - Dell Inc.) Hidden
Dell Help & Support (HKLM-x32\...\InstallShield_{E8669F4E-F2BE-48A9-B5A5-0BC12CA4CB4F}) (Version: 2.4.18.0 - Dell Inc.)
Dell Product Registration (HKLM-x32\...\InstallShield_{48114909-3C3B-43E6-BF98-AE9C396500A3}) (Version: 3.0.127.0 - Dell Inc.)
Dell SupportAssist (HKLM\...\PC-Doctor for Windows) (Version: 2.0.6875.402 - Dell)
Dell SupportAssistAgent (HKLM\...\{90881C8E-6C4F-4662-9923-85AFCA058C44}) (Version: 2.0.1.7 - Dell)
Dell System Detect (HKU\S-1-5-21-3363881303-3615463573-1429575272-1001\...\d24084d039586cae) (Version: 8.4.0.5 - Dell)
Dell Update - SupportAssist Update Plugin (HKLM\...\{EEA45885-F3E3-4E7D-8435-E9C21D36C141}) (Version: 3.0.0.2840 - Dell Inc.)
Dell Update (HKLM-x32\...\{F91263FA-BE4D-439D-9C0A-2E7204E0E9E3}) (Version: 1.9.20.0 - Dell Inc.)
Eraser 6.2.0.2979 (HKLM\...\{C5900DE9-D199-4C27-B692-354C9A6A6C8B}) (Version: 6.2.2979 - The Eraser Project)
f.lux (HKU\S-1-5-21-3363881303-3615463573-1429575272-1001\...\Flux) (Version:  - )
FBReader for Windows (HKLM-x32\...\FBReader for Windows) (Version:  - )
gamabhana fonftfreedom version 2016 (HKLM-x32\...\{30DC6BA9-0D64-4C58-B8FE-79824546C9A7}_is1) (Version: 2016 - gamabhana)
Google Chrome (HKLM-x32\...\Google Chrome) (Version: 60.0.3112.90 - Google Inc.)
Google Update Helper (HKLM-x32\...\{60EC980A-BDA2-4CB6-A427-B07A5498B4CA}) (Version: 1.3.33.5 - Google Inc.) Hidden
Intel® Chipset Device Software (HKLM-x32\...\{60c073df-e736-4210-9c3a-5fc2b651cef3}) (Version: 10.1.1.7 - Intel® Corporation) Hidden
Intel® Management Engine Components (HKLM\...\{1CEAC85D-2590-4760-800F-8DE5E91F3700}) (Version: 11.0.0.1169 - Intel Corporation)
Intel® Processor Graphics (HKLM-x32\...\{F0E3AD40-2BBD-4360-9C76-B9AC9A5886EA}) (Version: 21.20.16.4590 - Intel Corporation)
Intel® Rapid Storage Technology (HKLM\...\{409CB30E-E457-4008-9B1A-ED1B9EA21140}) (Version: 14.8.9.1053 - Intel Corporation)
Intel® Serial IO (HKLM\...\{9FD91C5C-44AE-4D9D-85BE-AE52816B0294}) (Version: 30.100.1519.7 - Intel Corporation)
Intel® Wireless Bluetooth® (HKLM-x32\...\{52DA40D6-6EF4-4B28-B501-FC538ECE638C}) (Version: 19.01.1627.3533 - Intel Corporation)
Intel® PROSet/Wireless Software (HKLM-x32\...\{8431b7d7-59d1-4f45-8212-a2eac049528f}) (Version: 19.60.0 - Intel Corporation)
Intel® Security Assist (HKLM-x32\...\{4B230374-6475-4A73-BA6E-41015E9C5013}) (Version: 1.0.0.532 - Intel Corporation)
Kaspersky Security Scan (HKLM-x32\...\{D1282694-0693-41A8-ABC1-6D1FFC1F65C5}) (Version: 16.0.0.1344 - Kaspersky Lab) Hidden
Kaspersky Security Scan (HKLM-x32\...\InstallWIX_{D1282694-0693-41A8-ABC1-6D1FFC1F65C5}) (Version: 16.0.0.1344 - Kaspersky Lab)
Kaspersky Software Updater (HKLM-x32\...\{DEEDA858-A9B4-4212-8873-2F2CE2706E68}) (Version: 2.0.0.623 - Kaspersky Lab) Hidden
Kaspersky Software Updater (HKLM-x32\...\InstallWIX_{DEEDA858-A9B4-4212-8873-2F2CE2706E68}) (Version: 2.0.0.623 - Kaspersky Lab)
KeyScrambler (HKLM-x32\...\KeyScrambler) (Version: 3.11.0.3 - QFX Software Corporation)
Leapforce Extension Native Host (HKLM-x32\...\{C15F26C8-6656-4A6A-A586-42872E7FFA2D}) (Version: 1.1.6 - Leapforce)
LibreOffice 5.3.4.2 (HKLM\...\{798CC630-3AA2-457E-B453-1EBBC3A4582F}) (Version: 5.3.4.2 - The Document Foundation)
Malwarebytes version 3.1.2.1733 (HKLM\...\{35065F43-4BB2-439A-BFF7-0F1014F2E0CD}_is1) (Version: 3.1.2.1733 - Malwarebytes)
Maxx Audio Installer (x64) (HKLM\...\{307032B2-6AF2-46D7-B933-62438DEB2B9A}) (Version: 2.6.8006.3 - Waves Audio Ltd.) Hidden
Microsoft Office (HKLM-x32\...\{90150000-0138-0409-0000-0000000FF1CE}) (Version: 15.0.4693.1005 - Microsoft Corporation)
Microsoft Visual C++ 2012 Redistributable (x64) - 11.0.50727 (HKLM-x32\...\{15134cb0-b767-4960-a911-f2d16ae54797}) (Version: 11.0.50727.1 - Microsoft Corporation)
Microsoft Visual C++ 2012 Redistributable (x86) - 11.0.50727 (HKLM-x32\...\{22154f09-719a-4619-bb71-5b3356999fbf}) (Version: 11.0.50727.1 - Microsoft Corporation)
Microsoft Visual C++ 2013 Redistributable (x64) - 12.0.30501 (HKLM-x32\...\{050d4fc8-5d48-4b8f-8972-47c82c46020f}) (Version: 12.0.30501.0 - Microsoft Corporation)
Microsoft Visual C++ 2013 Redistributable (x64) - 12.0.40649 (HKLM-x32\...\{5d0723d3-cff7-4e07-8d0b-ada737deb5e6}) (Version: 12.0.40649.5 - Microsoft Corporation)
Microsoft Visual C++ 2013 Redistributable (x86) - 12.0.30501 (HKLM-x32\...\{f65db027-aff3-4070-886a-0d87064aabb1}) (Version: 12.0.30501.0 - Microsoft Corporation)
Microsoft Visual C++ 2015 Redistributable (x64) - 14.0.24215 (HKLM-x32\...\{d992c12e-cab2-426f-bde3-fb8c53950b0d}) (Version: 14.0.24215.1 - Microsoft Corporation)
Mozilla Firefox 54.0.1 (x86 en-US) (HKLM-x32\...\Mozilla Firefox 54.0.1 (x86 en-US)) (Version: 54.0.1 - Mozilla)
Mozilla Maintenance Service (HKLM-x32\...\MozillaMaintenanceService) (Version: 52.2.1 - Mozilla)
Mozilla Thunderbird 52.2.1 (x86 en-US) (HKLM-x32\...\Mozilla Thunderbird 52.2.1 (x86 en-US)) (Version: 52.2.1 - Mozilla)
MusicBee 3.0 (HKLM-x32\...\MusicBee) (Version: 3.0 - Steven Mayall)
OEM Application Profile (HKLM-x32\...\{B4B7FD8F-06FC-E277-4F29-8F75F8281D8F}) (Version: 1.00.0000 - Advanced Micro Devices, Inc.) Hidden
Product Registration (HKLM\...\{48114909-3C3B-43E6-BF98-AE9C396500A3}) (Version: 3.0.127.0 - Dell Inc.) Hidden
PX Profile Update (HKLM-x32\...\{0D5E5C9A-84C2-D3E9-30EE-1836BA479E0E}) (Version: 1.00.1. - AMD) Hidden
PX Profile Update (HKLM-x32\...\{8DC1990E-2E49-BEA6-D083-C26A2BB218F9}) (Version: 1.00.1. - AMD) Hidden
qBittorrent 3.3.13 (HKLM-x32\...\qBittorrent) (Version: 3.3.13 - The qBittorrent project)
Quickset64 (HKLM\...\{87CF757E-C1F1-4D22-865C-00C6950B5258}) (Version: 10.17.009 - Dell Inc.)
Realtek Card Reader (HKLM-x32\...\{5BC2B5AB-80DE-4E83-B8CF-426902051D0A}) (Version: 10.0.10125.31214 - Realtek Semiconductor Corp.)
Realtek High Definition Audio Driver (HKLM-x32\...\{F132AF7F-7BCA-4EDE-8A7C-958108FE7DBC}) (Version: 6.0.1.7737 - Realtek Semiconductor Corp.)
SumatraPDF (HKLM\...\SumatraPDF) (Version: 3.1.2 - Krzysztof Kowalczyk)
VeraCrypt (HKLM-x32\...\VeraCrypt) (Version: 1.19 - IDRIX)
Virtual Audio Cable 4.15 (HKLM\...\Virtual Audio Cable 4.15) (Version:  - )
VLC media player (HKLM-x32\...\VLC media player) (Version: 2.2.6 - VideoLAN)
Vulkan Run Time Libraries 1.0.17.0 (HKLM\...\VulkanRT1.0.17.0) (Version: 1.0.17.0 - LunarG, Inc.)
Vulkan Run Time Libraries 1.0.26.0 (HKLM\...\VulkanRT1.0.26.0) (Version: 1.0.26.0 - LunarG, Inc.)
Vulkan Run Time Libraries 1.0.33.0 (HKLM\...\VulkanRT1.0.33.0) (Version: 1.0.33.0 - LunarG, Inc.)
WinPcap 4.1.3 (HKLM-x32\...\WinPcapInst) (Version: 4.1.0.2980 - Riverbed Technology, Inc.)
WinRAR 5.40 beta 2 (64-bit) (HKLM\...\WinRAR archiver) (Version: 5.40.2 - win.rar GmbH)
Wireshark 2.4.0 64-bit (HKLM-x32\...\Wireshark) (Version: 2.4.0 - The Wireshark developer community, hxxps://www.wireshark.org)
Zemana AntiLogger (HKLM-x32\...\{8F0CD7D1-42F3-4195-95CD-833578D45057}_is1) (Version: 2.74.0.76 - Zemana Ltd.)

==================== Custom CLSID (Whitelisted): ==========================

(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)

ContextMenuHandlers1: [2.0 Zemana AntiMalware] -> {6ABB1C11-E261-4CEA-BBB5-3836225689DD} => C:\Program Files (x86)\Zemana AntiLogger\ZAMShellExt64.dll [2017-06-17] ()
ContextMenuHandlers1: [Eraser] -> {BC9B776A-90D7-4476-A791-79D835F30650} => C:\Program Files\Eraser\Eraser.Shell.dll [2016-08-28] (The Eraser Project)
ContextMenuHandlers1: [WinRAR] -> {B41DB860-64E4-11D2-9906-E49FADC173CA} => C:\Program Files\WinRAR\rarext.dll [2016-06-10] (Alexander Roshal)
ContextMenuHandlers1-x32: [WinRAR32] -> {B41DB860-8EE4-11D2-9906-E49FADC173CA} => C:\Program Files\WinRAR\rarext32.dll [2016-06-10] (Alexander Roshal)
ContextMenuHandlers2: [Eraser] -> {BC9B776A-90D7-4476-A791-79D835F30650} => C:\Program Files\Eraser\Eraser.Shell.dll [2016-08-28] (The Eraser Project)
ContextMenuHandlers3: [MBAMShlExt] -> {57CE581A-0CB6-4266-9CA0-19364C90A0B3} => C:\Program Files\Malwarebytes\Anti-Malware\mbshlext.dll [2017-05-09] (Malwarebytes)
ContextMenuHandlers4: [Eraser] -> {BC9B776A-90D7-4476-A791-79D835F30650} => C:\Program Files\Eraser\Eraser.Shell.dll [2016-08-28] (The Eraser Project)
ContextMenuHandlers5: [ACE] -> {5E2121EE-0300-11D4-8D3B-444553540000} => C:\Program Files\AMD\CNext\CNext\atiacm64.dll [2016-12-06] (Advanced Micro Devices, Inc.)
ContextMenuHandlers5: [Eraser] -> {BC9B776A-90D7-4476-A791-79D835F30650} => C:\Program Files\Eraser\Eraser.Shell.dll [2016-08-28] (The Eraser Project)
ContextMenuHandlers5: [igfxcui] -> {3AB1675A-CCFF-11D2-8B20-00A0C93CB1F4} =>  -> No File
ContextMenuHandlers5: [igfxDTCM] -> {9B5F5829-A529-4B12-814A-E81BCB8D93FC} => C:\WINDOWS\System32\DriverStore\FileRepository\k120836.inf_amd64_ccaf7e7e1e972b78\igfxDTCM.dll [2017-02-20] (Intel Corporation)
ContextMenuHandlers6: [2.0 Zemana AntiMalware] -> {6ABB1C11-E261-4CEA-BBB5-3836225689DD} => C:\Program Files (x86)\Zemana AntiLogger\ZAMShellExt64.dll [2017-06-17] ()
ContextMenuHandlers6: [Eraser] -> {BC9B776A-90D7-4476-A791-79D835F30650} => C:\Program Files\Eraser\Eraser.Shell.dll [2016-08-28] (The Eraser Project)
ContextMenuHandlers6: [MBAMShlExt] -> {57CE581A-0CB6-4266-9CA0-19364C90A0B3} => C:\Program Files\Malwarebytes\Anti-Malware\mbshlext.dll [2017-05-09] (Malwarebytes)
ContextMenuHandlers6: [WinRAR] -> {B41DB860-64E4-11D2-9906-E49FADC173CA} => C:\Program Files\WinRAR\rarext.dll [2016-06-10] (Alexander Roshal)
ContextMenuHandlers6-x32: [WinRAR32] -> {B41DB860-8EE4-11D2-9906-E49FADC173CA} => C:\Program Files\WinRAR\rarext32.dll [2016-06-10] (Alexander Roshal)

==================== Scheduled Tasks (Whitelisted) =============

(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)

Task: {06A5B55C-93A8-4D1F-A716-D7E857A23224} - System32\Tasks\Microsoft\Windows\Windows Defender\Windows Defender Cache Maintenance => C:\Program Files\Windows Defender\\MpCmdRun.exe [2017-04-28] (Microsoft Corporation)
Task: {07C5E538-CF62-46CC-B8E9-EA1EE0A3309C} - System32\Tasks\GoogleUpdateTaskMachineUA => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe [2016-05-07] (Google Inc.)
Task: {2047B541-1788-400E-8BD7-F8BC98F52485} - System32\Tasks\PCDDataUploadTask => uaclauncher.exe
Task: {30169E8C-AF3D-4BAC-AF27-22E27F6FB8D2} - System32\Tasks\Dell SupportAssistAgent AnonymousRegistration => C:\Program Files\Dell\SupportAssistAgent\bin\SupportAssist.exe [2017-06-28] (Dell Inc.)
Task: {4D6CB832-2654-435D-87E4-357AE5BCD95B} - System32\Tasks\GoogleUpdateTaskMachineCore => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe [2016-05-07] (Google Inc.)
Task: {4E78E269-AFDA-4053-BC2A-37C3C83DEF17} - System32\Tasks\Microsoft\Windows\Windows Defender\Windows Defender Cleanup => C:\Program Files\Windows Defender\\MpCmdRun.exe [2017-04-28] (Microsoft Corporation)
Task: {5A537394-1582-4A55-9095-CAD139224E09} - System32\Tasks\CCleanerSkipUAC => C:\Program Files\CCleaner\CCleaner.exe [2017-06-30] (Piriform Ltd)
Task: {872C64C4-E930-446B-A7B0-02FB0F4A4CF7} - System32\Tasks\Microsoft\Windows\Windows Defender\Windows Defender Scheduled Scan => C:\Program Files\Windows Defender\\MpCmdRun.exe [2017-04-28] (Microsoft Corporation)
Task: {958AD575-00FA-4C3A-AA91-409E542C338E} - System32\Tasks\PCDoctorBackgroundMonitorTask => C:\Program Files\Dell\SupportAssist\uaclauncher.exe [2017-05-29] (PC-Doctor, Inc.)
Task: {9CA3B792-D648-41E7-9CBB-BC5EB3D6CE7C} - System32\Tasks\PCDEventLauncherTask => C:\Program Files\Dell\SupportAssist\sessionchecker.exe [2017-05-29] (PC-Doctor, Inc.)
Task: {9F276E29-A22D-43CC-9DE4-433E8A7A31B1} - System32\Tasks\Microsoft\Windows\Windows Defender\Windows Defender Verification => C:\Program Files\Windows Defender\\MpCmdRun.exe [2017-04-28] (Microsoft Corporation)
Task: {B6151DFE-C0E3-45D2-A205-01DEC3C39394} - System32\Tasks\Dell SupportAssistAgent AutoUpdate => C:\Program Files\Dell\SupportAssistAgent\bin\SupportAssist.exe [2017-06-28] (Dell Inc.)
Task: {E0A020DE-473B-4102-B54E-55C1427E9A1D} - System32\Tasks\RtHDVBg_PushButton => C:\Program Files\Realtek\Audio\HDA\RAVBg64.exe [2016-02-05] (Realtek Semiconductor)
Task: {F4AB147E-AAF7-48AB-880A-C4526DEB9946} - System32\Tasks\SystemToolsDailyTest => uaclauncher.exe

(If an entry is included in the fixlist, the task (.job) file will be moved. The file which is running by the task will not be moved.)

Task: C:\WINDOWS\Tasks\CreateExplorerShellUnelevatedTask.job => C:\WINDOWS\explorer.exe
Task: C:\WINDOWS\Tasks\RunDLC.job => cmd c sc start Dell Help SupportWORKGROUP DESKTOP MOI971O

==================== Shortcuts & WMI ========================

(The entries could be listed to be restored or removed.)


==================== Loaded Modules (Whitelisted) ==============

2016-07-16 17:12 - 2016-07-16 17:12 - 000231424 _____ () C:\WINDOWS\SYSTEM32\ism32k.dll
2017-07-13 01:55 - 2017-06-21 13:18 - 002681200 _____ () C:\WINDOWS\System32\CoreUIComponents.dll
2016-08-05 23:33 - 2016-08-05 23:33 - 000959168 _____ () C:\Users\Raj\AppData\Local\Microsoft\OneDrive\17.3.6390.0509_1\amd64\ClientTelemetry.dll
2016-09-22 19:00 - 2016-09-07 10:26 - 000134656 _____ () C:\Windows\ShellExperiences\Windows.UI.Shell.SharedUtilities.dll
2017-03-20 09:58 - 2017-03-04 12:01 - 000474112 _____ () C:\Windows\ShellExperiences\QuickActions.dll
2017-03-20 09:58 - 2017-03-04 11:42 - 009760768 _____ () C:\Windows\SystemApps\Microsoft.Windows.Cortana_cw5n1h2txyewy\CortanaApi.dll
2017-03-20 09:58 - 2017-03-04 11:35 - 001401856 _____ () C:\Windows\SystemApps\Microsoft.Windows.Cortana_cw5n1h2txyewy\Cortana.Core.dll
2017-03-20 09:58 - 2017-03-04 11:35 - 000757248 _____ () C:\Windows\SystemApps\Microsoft.Windows.Cortana_cw5n1h2txyewy\CSGSuggestLib.dll
2017-07-13 01:55 - 2017-06-21 12:05 - 002424320 _____ () C:\Windows\SystemApps\Microsoft.Windows.Cortana_cw5n1h2txyewy\Cortana.BackgroundTask.dll
2017-07-13 01:55 - 2017-06-21 12:07 - 004853760 _____ () C:\Windows\SystemApps\Microsoft.Windows.Cortana_cw5n1h2txyewy\RemindersUI.dll
2017-08-03 07:09 - 2017-08-02 13:09 - 003824472 _____ () C:\Program Files (x86)\Google\Chrome\Application\60.0.3112.90\libglesv2.dll
2017-08-03 07:09 - 2017-08-02 13:09 - 000100184 _____ () C:\Program Files (x86)\Google\Chrome\Application\60.0.3112.90\libegl.dll
2016-09-13 02:51 - 2016-09-13 02:51 - 000014336 _____ () C:\Program Files\AMD\CNext\CNext\QtQuick.2\qtquick2plugin.dll
2016-09-13 02:51 - 2016-09-13 02:51 - 000739840 _____ () C:\Program Files\AMD\CNext\CNext\QtQuick\Controls\qtquickcontrolsplugin.dll
2016-09-13 02:51 - 2016-09-13 02:51 - 000014336 _____ () C:\Program Files\AMD\CNext\CNext\QtQuick\Window.2\windowplugin.dll
2016-09-13 02:51 - 2016-09-13 02:51 - 000071168 _____ () C:\Program Files\AMD\CNext\CNext\QtQuick\Layouts\qquicklayoutsplugin.dll
2016-09-13 02:50 - 2016-09-13 02:50 - 000011776 _____ () C:\Program Files\AMD\CNext\CNext\libEGL.dll
2016-09-13 02:50 - 2016-09-13 02:50 - 002013696 _____ () C:\Program Files\AMD\CNext\CNext\libGLESv2.dll
2000-01-01 05:30 - 2017-07-04 10:17 - 003282432 _____ () C:\Users\Raj\Desktop\Misc\Browser\TorBrowser\Tor\tor.exe
2015-12-15 13:38 - 2015-12-15 13:38 - 000326112 _____ () C:\Program Files (x86)\Kaspersky Lab\Kaspersky Security Scan\dblite.dll
2015-10-27 16:44 - 2015-10-27 16:44 - 000404952 _____ () C:\Program Files (x86)\Kaspersky Lab\Kaspersky Security Scan\ipm_service.dll
2016-12-21 10:24 - 2016-12-21 10:24 - 000134008 _____ () C:\Program Files (x86)\Dell Customer Connect\ServiceTagPlusPlus.dll
2015-06-24 05:56 - 2015-06-24 05:56 - 000155888 _____ () c:\Program Files (x86)\Dell Digital Delivery\ServiceTagPlusPlus.dll
2015-09-19 13:04 - 2015-09-19 13:04 - 001243936 _____ () C:\Program Files (x86)\Intel\Intel® Management Engine Components\LMS\ACE.dll
2000-01-01 05:30 - 2017-06-07 17:23 - 000093535 _____ () C:\Users\Raj\Desktop\Misc\Browser\libssp-0.dll
2016-08-05 23:33 - 2016-08-05 23:33 - 000679624 _____ () C:\Users\Raj\AppData\Local\Microsoft\OneDrive\17.3.6390.0509_1\ClientTelemetry.dll
2000-01-01 05:30 - 2017-06-07 17:23 - 000720153 _____ () C:\Users\Raj\Desktop\Misc\Browser\TorBrowser\Tor\libevent-2-0-5.dll
2000-01-01 05:30 - 2017-06-07 17:23 - 000093535 _____ () C:\Users\Raj\Desktop\Misc\Browser\TorBrowser\Tor\libssp-0.dll
2000-01-01 05:30 - 2017-06-07 17:23 - 000107520 _____ () C:\Users\Raj\Desktop\Misc\Browser\TorBrowser\Tor\zlib1.dll
2000-01-01 05:30 - 2017-06-07 17:23 - 000524198 _____ () C:\Users\Raj\Desktop\Misc\Browser\TorBrowser\Tor\libgcc_s_sjlj-1.dll

==================== Alternate Data Streams (Whitelisted) =========

(If an entry is included in the fixlist, only the ADS will be removed.)


==================== Safe Mode (Whitelisted) ===================

(If an entry is included in the fixlist, it will be removed from the registry. The "AlternateShell" will be restored.)

HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\MBAMService => ""="Service"
HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\MBAMService => ""="Service"

==================== Association (Whitelisted) ===============

(If an entry is included in the fixlist, the registry item will be restored to default or removed.)


==================== Internet Explorer trusted/restricted ===============

(If an entry is included in the fixlist, it will be removed from the registry.)


==================== Hosts content: ===============================

(If needed Hosts: directive could be included in the fixlist to reset Hosts.)

2015-10-30 12:54 - 2015-10-30 12:51 - 000000824 _____ C:\WINDOWS\system32\Drivers\etc\hosts


==================== Other Areas ============================

(Currently there is no automatic fix for this section.)

HKU\S-1-5-21-3363881303-3615463573-1429575272-1001\Control Panel\Desktop\\Wallpaper -> C:\Users\Raj\Pictures\Saved Pictures\shinjuku-japan-rain_95377_990x742.jpg
DNS Servers: 192.168.225.1
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System => (ConsentPromptBehaviorAdmin: 2) (ConsentPromptBehaviorUser: 3) (EnableLUA: 1)
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer => (SmartScreenEnabled: RequireAdmin)
Windows Firewall is enabled.

==================== MSCONFIG/TASK MANAGER disabled items ==

HKLM\...\StartupApproved\Run: => "Eraser"
HKLM\...\StartupApproved\Run32: => "Eraser"
HKU\S-1-5-21-3363881303-3615463573-1429575272-1001\...\StartupApproved\Run: => "OneDrive"
HKU\S-1-5-21-3363881303-3615463573-1429575272-1001\...\StartupApproved\Run: => "CCleaner Monitoring"
HKU\S-1-5-21-3363881303-3615463573-1429575272-1001\...\StartupApproved\Run: => "uTorrent"
HKU\S-1-5-21-3363881303-3615463573-1429575272-1001\...\StartupApproved\Run: => "Kaspersky Software Updater"
HKU\S-1-5-21-3363881303-3615463573-1429575272-1001\...\StartupApproved\Run: => "KSS"

==================== FirewallRules (Whitelisted) ===============

(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)

FirewallRules: [UDP Query User{17C69C75-4483-46AD-ADED-5553EFF070CE}C:\program files (x86)\mozilla firefox\firefox.exe] => (Block) C:\program files (x86)\mozilla firefox\firefox.exe
FirewallRules: [TCP Query User{9F09B7F9-1D22-4BC3-9B41-6033D8DCC922}C:\program files (x86)\mozilla firefox\firefox.exe] => (Block) C:\program files (x86)\mozilla firefox\firefox.exe
FirewallRules: [{42E1CCF1-7B06-4BF3-AA48-79374DC47C72}] => (Allow) C:\Program Files (x86)\Mozilla Firefox\firefox.exe
FirewallRules: [{90E36EC3-6BBF-4FBD-8630-0913513DAC54}] => (Allow) C:\Program Files (x86)\Mozilla Firefox\firefox.exe
FirewallRules: [{27BA3F49-75F6-42E0-BFAF-EA380E1A8691}] => (Allow) C:\Users\Raj\AppData\Roaming\uTorrent\uTorrent.exe
FirewallRules: [{F90E079D-FD04-41A1-B8F7-E8B757388F29}] => (Allow) C:\Users\Raj\AppData\Roaming\uTorrent\uTorrent.exe
FirewallRules: [{48D1AE60-6F73-4927-A4AC-3FB0806D3BCE}] => (Allow) C:\Users\Raj\AppData\Roaming\uTorrent\uTorrent.exe
FirewallRules: [{46198B7F-809C-4493-A1B4-57940CB39F85}] => (Allow) C:\Users\Raj\AppData\Roaming\uTorrent\uTorrent.exe
FirewallRules: [{7099CD32-C78B-4ECE-9E3F-300692B41137}] => (Allow) C:\Users\Raj\AppData\Roaming\uTorrent\uTorrent.exe
FirewallRules: [{0188AFEA-BD30-4B86-8A54-A85D3E9FC4BA}] => (Allow) C:\Users\Raj\AppData\Roaming\uTorrent\uTorrent.exe
FirewallRules: [{D11F509A-B8AD-4C72-A924-266440DC8C3E}] => (Allow) C:\Program Files\Intel\WiFi\bin\PanDhcpDns.exe
FirewallRules: [{AB745123-F302-4149-AA92-DEF76816F07B}] => (Allow) C:\Program Files (x86)\qBittorrent\qbittorrent.exe
FirewallRules: [{4A0E73D7-ACAA-4A63-BFE1-784B3A0B6F37}] => (Allow) C:\Program Files (x86)\qBittorrent\qbittorrent.exe
FirewallRules: [{2A9B4316-45F2-4CB5-92C4-1F9FF5E5CDAC}] => (Allow) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe

==================== Restore Points =========================

18-07-2017 15:17:36 Installed calibre
27-07-2017 10:24:45 Scheduled Checkpoint

==================== Faulty Device Manager Devices =============


==================== Event log errors: =========================

Application errors:
==================
Error: (08/03/2017 05:31:43 PM) (Source: Microsoft-Windows-Immersive-Shell) (EventID: 5973) (User: DESKTOP-MOI971O)
Description: Activation of app Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy!App failed with error: -2144927141 See the Microsoft-Windows-TWinUI/Operational log for additional information.

Error: (08/03/2017 11:22:32 AM) (Source: Microsoft-Windows-Immersive-Shell) (EventID: 5973) (User: DESKTOP-MOI971O)
Description: Activation of app Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy!App failed with error: -2144927141 See the Microsoft-Windows-TWinUI/Operational log for additional information.

Error: (08/02/2017 11:44:48 PM) (Source: Microsoft-Windows-Immersive-Shell) (EventID: 5973) (User: DESKTOP-MOI971O)
Description: Activation of app Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy!App failed with error: -2144927141 See the Microsoft-Windows-TWinUI/Operational log for additional information.

Error: (08/02/2017 11:44:48 PM) (Source: Microsoft-Windows-Immersive-Shell) (EventID: 5973) (User: DESKTOP-MOI971O)
Description: Activation of app Microsoft.Windows.Cortana_cw5n1h2txyewy!CortanaUI failed with error: -2144927141 See the Microsoft-Windows-TWinUI/Operational log for additional information.

Error: (08/02/2017 06:14:09 PM) (Source: Application Error) (EventID: 1000) (User: )
Description: Faulting application name: atiw.exe, version: 5.2.1.55, time stamp: 0x594974c2
Faulting module name: atiw.exe, version: 5.2.1.55, time stamp: 0x594974c2
Exception code: 0xc0000005
Fault offset: 0x00000000000020d5
Faulting process id: 0x1fc
Faulting application start time: 0x01d30b8af015b1fb
Faulting application path: C:\Program Files\Dell\DellDataVault\atiw.exe
Faulting module path: C:\Program Files\Dell\DellDataVault\atiw.exe
Report Id: f9da9eb7-c3bb-40b3-be2a-a5d0f7564c1c
Faulting package full name:
Faulting package-relative application ID:

Error: (08/02/2017 04:54:20 PM) (Source: Microsoft-Windows-Immersive-Shell) (EventID: 5973) (User: DESKTOP-MOI971O)
Description: Activation of app Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy!App failed with error: -2144927141 See the Microsoft-Windows-TWinUI/Operational log for additional information.

Error: (08/01/2017 11:46:36 PM) (Source: Microsoft-Windows-Immersive-Shell) (EventID: 5973) (User: DESKTOP-MOI971O)
Description: Activation of app Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy!App failed with error: -2144927141 See the Microsoft-Windows-TWinUI/Operational log for additional information.

Error: (08/01/2017 09:47:43 AM) (Source: VSS) (EventID: 8193) (User: )
Description: Volume Shadow Copy Service error: Unexpected error calling routine QueryFullProcessImageNameW.  hr = 0x80070006, The handle is invalid.
.


Operation:
   Executing Asynchronous Operation

Context:
   Current State: DoSnapshotSet

Error: (08/01/2017 09:47:19 AM) (Source: Microsoft-Windows-CAPI2) (EventID: 513) (User: )
Description: Cryptographic Services failed while processing the OnIdentity() call in the System Writer Object.

Details:
AddLegacyDriverFiles: Unable to back up image of binary Microsoft Link-Layer Discovery Protocol.

System Error:
Access is denied.
.

Error: (07/31/2017 03:11:04 PM) (Source: Application Error) (EventID: 1000) (User: )
Description: Faulting application name: Explorer.EXE, version: 10.0.14393.1378, time stamp: 0x594a1517
Faulting module name: ntdll.dll, version: 10.0.14393.1378, time stamp: 0x594a1350
Exception code: 0xc0000374
Fault offset: 0x00000000000f8353
Faulting process id: 0x245c
Faulting application start time: 0x01d309d56247ebd1
Faulting application path: C:\WINDOWS\Explorer.EXE
Faulting module path: C:\WINDOWS\SYSTEM32\ntdll.dll
Report Id: 272ca86d-3743-422f-abed-312a332f31bf
Faulting package full name:
Faulting package-relative application ID:


System errors:
=============
Error: (08/04/2017 01:43:51 PM) (Source: Tcpip) (EventID: 4199) (User: )
Description: The system detected an address conflict for IP address 2405:204:970e:859d:ed6e:8e56:4ca:b487 with the system
having network hardware address FE-87-46-CD-0E-EA. Network operations on this system may
be disrupted as a result.

Error: (08/04/2017 01:43:39 PM) (Source: DCOM) (EventID: 10016) (User: NT AUTHORITY)
Description: The application-specific permission settings do not grant Local Activation permission for the COM Server application with CLSID
{8D8F4F83-3594-4F07-8369-FC3C3CAE4919}
 and APPID
{F72671A9-012C-4725-9D2F-2A4D32D65169}
 to the user NT AUTHORITY\SYSTEM SID (S-1-5-18) from address LocalHost (Using LRPC) running in the application container Unavailable SID (Unavailable). This security permission can be modified using the Component Services administrative tool.

Error: (08/04/2017 01:43:39 PM) (Source: DCOM) (EventID: 10016) (User: NT AUTHORITY)
Description: The application-specific permission settings do not grant Local Activation permission for the COM Server application with CLSID
{6B3B8D23-FA8D-40B9-8DBD-B950333E2C52}
 and APPID
{4839DDB7-58C2-48F5-8283-E1D1807D0D7D}
 to the user NT AUTHORITY\LOCAL SERVICE SID (S-1-5-19) from address LocalHost (Using LRPC) running in the application container Unavailable SID (Unavailable). This security permission can be modified using the Component Services administrative tool.

Error: (08/04/2017 01:43:39 PM) (Source: DCOM) (EventID: 10016) (User: NT AUTHORITY)
Description: The application-specific permission settings do not grant Local Activation permission for the COM Server application with CLSID
{6B3B8D23-FA8D-40B9-8DBD-B950333E2C52}
 and APPID
{4839DDB7-58C2-48F5-8283-E1D1807D0D7D}
 to the user NT AUTHORITY\LOCAL SERVICE SID (S-1-5-19) from address LocalHost (Using LRPC) running in the application container Unavailable SID (Unavailable). This security permission can be modified using the Component Services administrative tool.

Error: (08/04/2017 09:50:08 AM) (Source: DCOM) (EventID: 10016) (User: NT AUTHORITY)
Description: The application-specific permission settings do not grant Local Activation permission for the COM Server application with CLSID
{D63B10C5-BB46-4990-A94F-E40B9D520160}
 and APPID
{9CA88EE3-ACB7-47C8-AFC4-AB702511C276}
 to the user NT AUTHORITY\SYSTEM SID (S-1-5-18) from address LocalHost (Using LRPC) running in the application container Unavailable SID (Unavailable). This security permission can be modified using the Component Services administrative tool.

Error: (08/04/2017 08:03:27 AM) (Source: Tcpip) (EventID: 4199) (User: )
Description: The system detected an address conflict for IP address 2405:204:95a5:3662:ed6e:8e56:4ca:b487 with the system
having network hardware address BE-C4-62-D1-5A-A6. Network operations on this system may
be disrupted as a result.

Error: (08/04/2017 08:03:14 AM) (Source: DCOM) (EventID: 10016) (User: NT AUTHORITY)
Description: The application-specific permission settings do not grant Local Activation permission for the COM Server application with CLSID
{8D8F4F83-3594-4F07-8369-FC3C3CAE4919}
 and APPID
{F72671A9-012C-4725-9D2F-2A4D32D65169}
 to the user NT AUTHORITY\SYSTEM SID (S-1-5-18) from address LocalHost (Using LRPC) running in the application container Unavailable SID (Unavailable). This security permission can be modified using the Component Services administrative tool.

Error: (08/04/2017 08:03:14 AM) (Source: DCOM) (EventID: 10016) (User: NT AUTHORITY)
Description: The application-specific permission settings do not grant Local Activation permission for the COM Server application with CLSID
{6B3B8D23-FA8D-40B9-8DBD-B950333E2C52}
 and APPID
{4839DDB7-58C2-48F5-8283-E1D1807D0D7D}
 to the user NT AUTHORITY\LOCAL SERVICE SID (S-1-5-19) from address LocalHost (Using LRPC) running in the application container Unavailable SID (Unavailable). This security permission can be modified using the Component Services administrative tool.

Error: (08/04/2017 08:03:14 AM) (Source: DCOM) (EventID: 10016) (User: NT AUTHORITY)
Description: The application-specific permission settings do not grant Local Activation permission for the COM Server application with CLSID
{6B3B8D23-FA8D-40B9-8DBD-B950333E2C52}
 and APPID
{4839DDB7-58C2-48F5-8283-E1D1807D0D7D}
 to the user NT AUTHORITY\LOCAL SERVICE SID (S-1-5-19) from address LocalHost (Using LRPC) running in the application container Unavailable SID (Unavailable). This security permission can be modified using the Component Services administrative tool.

Error: (08/03/2017 11:56:36 PM) (Source: DCOM) (EventID: 10016) (User: NT AUTHORITY)
Description: The application-specific permission settings do not grant Local Activation permission for the COM Server application with CLSID
{D63B10C5-BB46-4990-A94F-E40B9D520160}
 and APPID
{9CA88EE3-ACB7-47C8-AFC4-AB702511C276}
 to the user NT AUTHORITY\SYSTEM SID (S-1-5-18) from address LocalHost (Using LRPC) running in the application container Unavailable SID (Unavailable). This security permission can be modified using the Component Services administrative tool.


CodeIntegrity:
===================================
  Date: 2017-07-31 19:42:19.162
  Description: Code Integrity determined that a process (\Device\HarddiskVolume3\Program Files\Windows Defender\MsMpEng.exe) attempted to load \Device\HarddiskVolume3\Windows\System32\DriverStore\FileRepository\c0313191.inf_amd64_f86a31122289b968\amdhdl64.dll that did not meet the Custom 3 / Antimalware signing level requirements.

  Date: 2017-07-24 19:48:59.278
  Description: Code Integrity determined that a process (\Device\HarddiskVolume3\Program Files\Windows Defender\MsMpEng.exe) attempted to load \Device\HarddiskVolume3\Windows\System32\DriverStore\FileRepository\c0313191.inf_amd64_f86a31122289b968\amdhdl64.dll that did not meet the Custom 3 / Antimalware signing level requirements.

  Date: 2017-07-20 20:16:42.809
  Description: Code Integrity determined that a process (\Device\HarddiskVolume3\Program Files\Windows Defender\MsMpEng.exe) attempted to load \Device\HarddiskVolume3\Windows\System32\DriverStore\FileRepository\c0313191.inf_amd64_f86a31122289b968\amdhdl64.dll that did not meet the Custom 3 / Antimalware signing level requirements.

  Date: 2017-07-18 20:09:09.726
  Description: Code Integrity determined that a process (\Device\HarddiskVolume3\Program Files\Windows Defender\MsMpEng.exe) attempted to load \Device\HarddiskVolume3\Windows\System32\DriverStore\FileRepository\c0313191.inf_amd64_f86a31122289b968\amdhdl64.dll that did not meet the Custom 3 / Antimalware signing level requirements.

  Date: 2017-07-16 19:49:32.733
  Description: Code Integrity determined that a process (\Device\HarddiskVolume3\Program Files\Windows Defender\MsMpEng.exe) attempted to load \Device\HarddiskVolume3\Windows\System32\DriverStore\FileRepository\c0313191.inf_amd64_f86a31122289b968\amdhdl64.dll that did not meet the Custom 3 / Antimalware signing level requirements.

  Date: 2017-07-13 19:45:51.940
  Description: Code Integrity determined that a process (\Device\HarddiskVolume3\Program Files\Windows Defender\MsMpEng.exe) attempted to load \Device\HarddiskVolume3\Windows\System32\DriverStore\FileRepository\c0313191.inf_amd64_f86a31122289b968\amdhdl64.dll that did not meet the Custom 3 / Antimalware signing level requirements.

  Date: 2017-07-05 19:19:43.488
  Description: Code Integrity determined that a process (\Device\HarddiskVolume3\Program Files\Windows Defender\MsMpEng.exe) attempted to load \Device\HarddiskVolume3\Windows\System32\DriverStore\FileRepository\c0313191.inf_amd64_f86a31122289b968\amdhdl64.dll that did not meet the Custom 3 / Antimalware signing level requirements.

  Date: 2017-07-03 20:33:39.009
  Description: Code Integrity determined that a process (\Device\HarddiskVolume3\Program Files\Windows Defender\MsMpEng.exe) attempted to load \Device\HarddiskVolume3\Windows\System32\DriverStore\FileRepository\c0313191.inf_amd64_f86a31122289b968\amdhdl64.dll that did not meet the Custom 3 / Antimalware signing level requirements.

  Date: 2017-06-28 19:27:37.417
  Description: Code Integrity determined that a process (\Device\HarddiskVolume3\Program Files\Windows Defender\MsMpEng.exe) attempted to load \Device\HarddiskVolume3\Windows\System32\amdhdl64.dll that did not meet the Custom 3 / Antimalware signing level requirements.

  Date: 2017-06-26 18:58:02.623
  Description: Code Integrity determined that a process (\Device\HarddiskVolume3\Program Files\Windows Defender\MsMpEng.exe) attempted to load \Device\HarddiskVolume3\Windows\System32\amdhdl64.dll that did not meet the Custom 3 / Antimalware signing level requirements.


==================== Memory info ===========================

Processor: Intel® Core™ i5-6200U CPU @ 2.30GHz
Percentage of memory in use: 44%
Total physical RAM: 8083.82 MB
Available physical RAM: 4460.05 MB
Total Virtual: 8595.82 MB
Available Virtual: 4182.47 MB

==================== Drives ================================

Drive c: (OS) (Fixed) (Total:919.57 GB) (Free:651.27 GB) NTFS

==================== MBR & Partition Table ==================

========================================================
Disk: 0 (Size: 931.5 GB) (Disk ID: 4889B82E)

Partition: GPT.

==================== End of Addition.txt ============================

Attached Files



BC AdBot (Login to Remove)

 


#2 Oh My!

Oh My!

    Adware and Spyware and Malware.....


  • Malware Response Instructor
  • 36,142 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:California
  • Local time:01:37 PM

Posted 04 August 2017 - 09:24 PM

Greetings almasat and :welcome: to BleepingComputer's Virus/Trojan/Spyware/Malware Removal forum.

My name is Oh My! and I am here to help you! Now that we are "friends" please call me Gary.

If you would allow me to call you by your first name I would prefer to do that.

===================================================

Ground Rules:
  • First, I would like to inform you that most of us here at Bleeping Computer offer our expert assistance out of the goodness of our hearts. Please try to match our commitment to you with your patience toward us. If this was easy we would never have met.
  • Please do not run any tools or take any steps other than those I will provide for you while we work on your computer together. I need to be certain about the state of your computer in order to provide appropriate and effective steps for you to take. Most often "well intentioned" (and usually panic driven!) independent efforts can make things much worse for both of us. If at any point you would prefer to take your own steps please let me know, I will not be offended. I would be happy to focus on the many others who are waiting in line for assistance.
  • Please perform all steps in the order they are listed in each set of instructions. Some steps may be a bit complicated. If things are not clear, be sure to stop and let me know. We need to work on this together with confidence.
  • Please copy and paste all logs into your post unless directed otherwise. Please do not re-run any programs I suggest. If you encounter problems simply stop and tell me.
  • If you do not reply to your topic after 5 days we assume it has been abandoned and I will close it.
  • When your computer is clean I will alert you of such. I will also provide for you detailed information about how you can combat future infections.
  • I would like to remind you to make no further changes to your computer unless I direct you to do so.
===================================================

Now that I am assisting you, you can expect that I will be very responsive to your situation. If you are able, I would request you check this thread at least once per day so that we can try to resolve your issues effectively and efficiently. If you are going to be delayed please be considerate and post that information so that I know you are still with me. Unfortunately, there are many people waiting to be assisted and not enough of us at BleepingComputer to go around. I appreciate your understanding and diligence.

Thank you for your patience thus far.

What security program is providing the pop up warning. Can you provide a screen shot?

Please describe your Internet setup, i.e. modem, router, combo/

Please consider and do this.

===================================================

Peer to Peer (P2P) Warning

--------------------

Going over your logs I noticed that you have Peer 2 Peer (torrent) program(s) installed. It is pretty much certain that if you continue to use P2P programs, you will get infected again.
  • Avoid gaming sites, pirated software, cracking tools, keygens, and peer-to-peer (P2P) file sharing programs.
  • They are a security risk which can make your computer susceptible to a smörgåsbord of malware infections, remote attacks, exposure of personal information, and identity theft. Many malicious worms and Trojans spread across P2P file sharing networks, gaming and underground sites.
  • Users visiting such pages may see innocuous-looking banner ads containing code which can trigger pop-up ads and malicious Flash ads that install viruses, Trojans and spyware. Ads are a target for hackers because they offer a stealthy way to distribute malware to a wide range of Internet users.
  • The best way to reduce the risk of infection is to avoid these types of web sites and not use any P2P applications.
I would recommend that you uninstall Peer 2 Peer programs, however that choice is up to you. If you choose to remove the program, you can do so via Start > Control Panel > Add/Remove Programs.

If you are still leaning toward using this program, please take a look at this information about CryptoLocker Ransomware, a type of Ransomware which can be delivered via P2P file transfers. The newest variation of Ransomware can make it impossible to recover the files this malicious software encrypts. In other words, you will probably lose most if not all of your valuable information, including pictures. In addition it has recently been reported that P2P downloads may be tracked resulting in your IP address being monitored by copyright authorities.

If you wish to keep it, please do not use it until we are completely done and your machine is determined to be clean and updated.

===================================================

Farbar's Recovery Scan Tool - Run Fix in Normal or Safe Mode

--------------------
  • Right click on the FRST icon and select Run as administrator
  • Highlight the below information then hit the Ctrl + C keys at the same time
Start::
CreateRestorePoint:
CloseProcesses:
HKU\S-1-5-21-3363881303-3615463573-1429575272-1001\...\MountPoints2: {32b5b2b8-12c8-11e6-be32-001e64ec2a92} - "E:\Windows\AutoRun.exe"
HKU\S-1-5-21-3363881303-3615463573-1429575272-1001\...\MountPoints2: {948c60aa-168a-11e6-be35-806e6f6e6963} - "F:\Windows\AutoRun.exe"
AppInit_DLLs-x32: ,C:\PROGRA~2\Sophos\SOPHOS~1\\SOPHOS~1.DLL
SearchScopes: HKU\S-1-5-21-3363881303-3615463573-1429575272-1001 -> DefaultScope {81792A9A-D0FA-473B-89D7-6C5B030C7109} URL =
SearchScopes: HKU\S-1-5-21-3363881303-3615463573-1429575272-1001 -> {81792A9A-D0FA-473B-89D7-6C5B030C7109} URL =
emptytemp:
End::
  • Click Fix
  • Copy and paste the contents of the Fixlog.txt file in your reply.
===================================================

Malwarebytes AdwCleaner

-------------------
  • Please download AdwCleaner and save it on your desktop.
  • Close all open programs and browsers
  • Double click on AdwCleaner.exe, click Run, then select I agree if it appears
  • Click Scan
  • Once the scan has completed if there are threats found you will see Found 3 threats or something similar above the progress bar
  • Click each tab under Results and uncheck any items you want to keep
  • Click on Clean
  • Confirm the cleaning and rebooting of your computer by clicking OK
  • Click OK twice to finish the removal process by automatically rebooting your computer
  • Once completed an AdwCleaner document will open on your desktop
  • Copy and paste the contents in your reply
===================================================

RogueKiller

--------------------
  • Download RogueKiller and save it to your desktop
  • Close all running programs
  • Right click on the setup.exe icon and select Run as Administrator
  • For Windows XP simply double click on the icon
  • Click OK on English
  • Select Install 32 and 64 bits versions (Recommended for Technicians), then click Next 2 times
  • Click Install
  • Click Finish
  • Click Start Scan twice
  • When completed click Open Report
  • Click Export Text and save the file on your Desktop as RK.txt
  • Close all open RogueKiller windows
  • Copy and paste the contents of the report in your reply
===================================================

Farbar's MiniToolBox

--------------------
  • Please download MiniToolBox, save it to your desktop
  • Please close any Firefox browsers you may have open
  • Double click the icon to launch the program
  • Make sure only the following options are checked:

Flush DNS
Report IE Proxy Settings
Reset IE Proxy Settings
Report FF Proxy Settings
Reset FF Proxy Settings
List content of Hosts
List IP configuration
List Winsock Entries

  • Click Go and once the scan is completed a MTB.txt Notepad document will open on your desktop
  • Please copy and paste the contents in your reply
===================================================

Things I would like to see in your next reply. Please be sure to copy and paste any requested log information unless you are asked to attach it. :thumbsup2:
  • Reply to questions
  • Fixlog
  • AdwCleaner log
  • RogueKiller log
  • MTB log
  • Update on computer performance

Gary
 
If I do not reply within 24 hours please send me a Personal Message.

"Lord, to whom would we go? You have the words that give eternal life. We believe, and we know you are the Holy One of God."

#3 almasat

almasat
  • Topic Starter

  • Members
  • 26 posts
  • OFFLINE
  •  
  • Local time:02:07 AM

Posted 05 August 2017 - 12:21 AM

Hello Gary,

Thank you for your reply. Your help is much appreciated. You can call me Raj.

Unfortunately, I forgot to take a screenshot. The pop-up showed up in Chrome while I was browsing a site. The address redirected to a Microsoft address (no https) with blank page and the popup.

I am using a JioFi3 Router similar to the one shown here -
http://www.amazon.in/RELIANCE-JIO-4G-ROUTER-JIOFI3/dp/B01N2IASJ8

I have uninstalled the P2P program as per your suggestion.
All the logs are pasted below.
As for updates on performance, I have not encountered the popup again.
No other suspicious activity either.

Raj

Fix result of Farbar Recovery Scan Tool (x64) Version: 31-07-2017
Ran by Raj (05-08-2017 09:17:24) Run:1
Running from C:\Users\Raj\Desktop
Loaded Profiles: Raj (Available Profiles: Raj)
Boot Mode: Normal
==============================================

fixlist content:
*****************

CreateRestorePoint:
CloseProcesses:
HKU\S-1-5-21-3363881303-3615463573-1429575272-1001\...\MountPoints2: {32b5b2b8-12c8-11e6-be32-001e64ec2a92} - "E:\Windows\AutoRun.exe"
HKU\S-1-5-21-3363881303-3615463573-1429575272-1001\...\MountPoints2: {948c60aa-168a-11e6-be35-806e6f6e6963} - "F:\Windows\AutoRun.exe"
AppInit_DLLs-x32: ,C:\PROGRA~2\Sophos\SOPHOS~1\\SOPHOS~1.DLL
SearchScopes: HKU\S-1-5-21-3363881303-3615463573-1429575272-1001 -> DefaultScope {81792A9A-D0FA-473B-89D7-6C5B030C7109} URL =
SearchScopes: HKU\S-1-5-21-3363881303-3615463573-1429575272-1001 -> {81792A9A-D0FA-473B-89D7-6C5B030C7109} URL =
emptytemp:

*****************

Restore point was successfully created.
Processes closed successfully.
HKU\S-1-5-21-3363881303-3615463573-1429575272-1001\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{32b5b2b8-12c8-11e6-be32-001e64ec2a92} => key removed successfully
HKLM\Software\Classes\CLSID\{32b5b2b8-12c8-11e6-be32-001e64ec2a92} => key not found.
HKU\S-1-5-21-3363881303-3615463573-1429575272-1001\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{948c60aa-168a-11e6-be35-806e6f6e6963} => key removed successfully
HKLM\Software\Classes\CLSID\{948c60aa-168a-11e6-be35-806e6f6e6963} => key not found.
"AppInit_DLLs-x32: ,C:\PROGRA~2\Sophos\SOPHOS~1\\SOPHOS~1.DLL" => Value data not found.
HKU\S-1-5-21-3363881303-3615463573-1429575272-1001\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\\DefaultScope => value removed successfully
HKU\S-1-5-21-3363881303-3615463573-1429575272-1001\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{81792A9A-D0FA-473B-89D7-6C5B030C7109} => key removed successfully
HKLM\Software\Classes\CLSID\{81792A9A-D0FA-473B-89D7-6C5B030C7109} => key not found.

=========== EmptyTemp: ==========

BITS transfer queue => 553966 B
DOMStore, IE Recovery, AppCache, Feeds Cache, Thumbcache, IconCache => 44577062 B
Java, Flash, Steam htmlcache => 506 B
Windows/system/drivers => 10826251 B
Edge => 0 B
Chrome => 622485660 B
Firefox => 177967120 B
Opera => 0 B

Temp, IE cache, history, cookies, recent:
Default => 6656 B
Users => 0 B
ProgramData => 0 B
Public => 0 B
systemprofile => 128 B
systemprofile32 => 1142606 B
LocalService => 962258 B
NetworkService => 3948 B
Raj => 116423971 B

RecycleBin => 1900043894 B
EmptyTemp: => 2.7 GB temporary data Removed.

================================


The system needed a reboot.

==== End of Fixlog 09:19:25 ====

# AdwCleaner 7.0.1.0 - Logfile created on Sat Aug 05 04:26:18 2017
# Updated on 2017/05/08 by Malwarebytes
# Running on Windows 10 Home Single Language (X64)
# Mode: clean
# Support: https://www.malwarebytes.com/support

***** [ Services ] *****

No malicious services deleted.

***** [ Folders ] *****

Deleted: C:\ProgramData\2738385d-5d34-4031-98d6-d5d1f9f7aeb6
Deleted: C:\ProgramData\7b9da2e0-8fa7-4b61-a6b0-659ce074f39c
Deleted: C:\ProgramData\ab02cc3c-4252-41fe-9a88-163b19ffdd4b
Deleted: C:\ProgramData\c272719c-c1bc-47f0-a0f5-2c6497b86353
Deleted: C:\ProgramData\f6b533c4-3fc9-4f81-af4f-3eb5db44c0b7


***** [ Files ] *****

No malicious files deleted.

***** [ DLL ] *****

No malicious DLLs cleaned.

***** [ WMI ] *****

No malicious WMI cleaned.

***** [ Shortcuts ] *****

No malicious shortcuts cleaned.

***** [ Tasks ] *****

No malicious tasks deleted.

***** [ Registry ] *****

No malicious registry entries deleted.

***** [ Firefox (and derivatives) ] *****

No malicious Firefox entries deleted.

***** [ Chromium (and derivatives) ] *****

No malicious Chromium entries deleted.

*************************

::Tracing keys deleted
::Winsock settings cleared
::Additional Actions: 0



*************************

C:/AdwCleaner/AdwCleaner[S0].txt - [1309 B] - [2017/8/5 4:23:48]


########## EOF - C:\AdwCleaner\AdwCleaner[C0].txt ##########

RogueKiller V12.11.9.0 (x64) [Aug  3 2017] (Free) by Adlice Software
mail : http://www.adlice.com/contact/
Feedback : https://forum.adlice.com
Website : http://www.adlice.com/download/roguekiller/
Blog : http://www.adlice.com

Operating System : Windows 10 (10.0.14393) 64 bits version
Started in : Normal mode
User : Raj [Administrator]
Started from : C:\Program Files\RogueKiller\RogueKiller64.exe
Mode : Scan -- Date : 08/05/2017 10:06:38 (Duration : 00:30:31)
Switches : -refid

¤¤¤ Processes : 0 ¤¤¤

¤¤¤ Registry : 6 ¤¤¤
[PUM.HomePage] (X64) HKEY_USERS\S-1-5-21-3363881303-3615463573-1429575272-1001\Software\Microsoft\Internet Explorer\Main | Start Page :
[PUM.HomePage] (X86) HKEY_USERS\S-1-5-21-3363881303-3615463573-1429575272-1001\Software\Microsoft\Internet Explorer\Main | Start Page :
[PUM.HomePage] (X64) HKEY_USERS\S-1-5-21-3363881303-3615463573-1429575272-1001\Software\Microsoft\Internet Explorer\Main | Default_Page_URL :
[PUM.HomePage] (X86) HKEY_USERS\S-1-5-21-3363881303-3615463573-1429575272-1001\Software\Microsoft\Internet Explorer\Main | Default_Page_URL :
[PUM.StartMenu] (X64) HKEY_USERS\S-1-5-21-3363881303-3615463573-1429575272-1001\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced | Start_TrackProgs : 0  -> Found
[PUM.StartMenu] (X86) HKEY_USERS\S-1-5-21-3363881303-3615463573-1429575272-1001\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced | Start_TrackProgs : 0  -> Found

¤¤¤ Tasks : 0 ¤¤¤

¤¤¤ Files : 0 ¤¤¤

¤¤¤ WMI : 0 ¤¤¤

¤¤¤ Hosts File : 0 ¤¤¤

¤¤¤ Antirootkit : 0 (Driver: Loaded) ¤¤¤

¤¤¤ Web browsers : 0 ¤¤¤

¤¤¤ MBR Check : ¤¤¤
+++++ PhysicalDrive0: WDC WD10JPVX-75JC3T0 +++++
--- User ---
[MBR] 2152c3b36cceb8c3c6ad4500be7a2f45
[BSP] 030aba3c279c0029eff327c24c1ebdfe : Empty|VT.Unknown MBR Code
Partition table:
0 - [MAN-MOUNT] EFI system partition | Offset (sectors): 2048 | Size: 500 MB
1 - [MAN-MOUNT] Microsoft reserved partition | Offset (sectors): 1026048 | Size: 128 MB
2 - Basic data partition | Offset (sectors): 1288192 | Size: 941637 MB
3 - [SYSTEM][MAN-MOUNT]  | Offset (sectors): 1929760768 | Size: 450 MB
4 - [SYSTEM][MAN-MOUNT]  | Offset (sectors): 1930682368 | Size: 11153 MB
User = LL1 ... OK
User = LL2 ... OK

MiniToolBox by Farbar  Version: 17-06-2016
Ran by Raj (administrator) on 05-08-2017 at 10:42:57
Running from "C:\Users\Raj\Desktop"
Microsoft Windows 10 Home Single Language  (X64)
Model: Inspiron 5559 Manufacturer: Dell Inc.
Boot Mode: Normal
***************************************************************************

========================= Flush DNS: ===================================

Windows IP Configuration

Successfully flushed the DNS Resolver Cache.

========================= IE Proxy Settings: ==============================

Proxy is not enabled.
No Proxy Server is set.

"Reset IE Proxy Settings": IE Proxy Settings were reset.

========================= FF Proxy Settings: ==============================


"Reset FF Proxy Settings": Firefox Proxy settings were reset.

========================= Hosts content: =================================
========================= IP Configuration: ================================

Intel® Dual Band Wireless-AC 3160 = Wi-Fi (Connected)
Realtek PCIe FE Family Controller = Ethernet (Media disconnected)
Bluetooth Device (Personal Area Network) = Bluetooth Network Connection (Media disconnected)


# ----------------------------------
# IPv4 Configuration
# ----------------------------------
pushd interface ipv4

reset
set global icmpredirects=enabled
set interface interface="Wi-Fi" forwarding=enabled advertise=enabled nud=enabled ignoredefaultroutes=disabled
set interface interface="Ethernet" forwarding=enabled advertise=enabled nud=enabled ignoredefaultroutes=disabled
set interface interface="Local Area Connection* 1" forwarding=enabled advertise=enabled nud=enabled ignoredefaultroutes=disabled
set interface interface="Local Area Connection* 2" forwarding=enabled advertise=enabled nud=enabled ignoredefaultroutes=disabled
set interface interface="Local Area Connection* 11" forwarding=enabled advertise=enabled nud=enabled ignoredefaultroutes=disabled
set interface interface="Bluetooth Network Connection" forwarding=enabled advertise=enabled nud=enabled ignoredefaultroutes=disabled
set interface interface="Ethernet 2" forwarding=enabled advertise=enabled nud=enabled ignoredefaultroutes=disabled


popd
# End of IPv4 configuration



Windows IP Configuration

   Host Name . . . . . . . . . . . . : DESKTOP-MOI971O
   Primary Dns Suffix  . . . . . . . :
   Node Type . . . . . . . . . . . . : Hybrid
   IP Routing Enabled. . . . . . . . : No
   WINS Proxy Enabled. . . . . . . . : No

Ethernet adapter Ethernet:

   Media State . . . . . . . . . . . : Media disconnected
   Connection-specific DNS Suffix  . :
   Description . . . . . . . . . . . : Realtek PCIe FE Family Controller
   Physical Address. . . . . . . . . : F8-CA-B8-57-57-D3
   DHCP Enabled. . . . . . . . . . . : Yes
   Autoconfiguration Enabled . . . . : Yes

Wireless LAN adapter Local Area Connection* 2:

   Media State . . . . . . . . . . . : Media disconnected
   Connection-specific DNS Suffix  . :
   Description . . . . . . . . . . . : Microsoft Wi-Fi Direct Virtual Adapter
   Physical Address. . . . . . . . . : 00-1E-64-EC-2A-8F
   DHCP Enabled. . . . . . . . . . . : Yes
   Autoconfiguration Enabled . . . . : Yes

Wireless LAN adapter Wi-Fi:

   Connection-specific DNS Suffix  . :
   Description . . . . . . . . . . . : Intel® Dual Band Wireless-AC 3160
   Physical Address. . . . . . . . . : 00-1E-64-EC-2A-8E
   DHCP Enabled. . . . . . . . . . . : Yes
   Autoconfiguration Enabled . . . . : Yes
   IPv6 Address. . . . . . . . . . . : 2405:204:9616:1606:ed6e:8e56:4ca:b487(Preferred)
   Temporary IPv6 Address. . . . . . : 2405:204:9616:1606:bdd7:8dd8:d600:d85c(Preferred)
   Link-local IPv6 Address . . . . . : fe80::ed6e:8e56:4ca:b487%2(Preferred)
   IPv4 Address. . . . . . . . . . . : 192.168.225.162(Preferred)
   Subnet Mask . . . . . . . . . . . : 255.255.255.0
   Lease Obtained. . . . . . . . . . : 05 August 2017 09:59:36
   Lease Expires . . . . . . . . . . : 05 August 2017 21:59:36
   Default Gateway . . . . . . . . . : fe80::e1cf:34af:265f:50d5%2
                                       192.168.225.1
   DHCP Server . . . . . . . . . . . : 192.168.225.1
   DHCPv6 IAID . . . . . . . . . . . : 33562212
   DHCPv6 Client DUID. . . . . . . . : 00-01-00-01-1E-40-F9-B0-F8-CA-B8-57-57-D3
   DNS Servers . . . . . . . . . . . : 192.168.225.1
   NetBIOS over Tcpip. . . . . . . . : Enabled

Ethernet adapter Bluetooth Network Connection:

   Media State . . . . . . . . . . . : Media disconnected
   Connection-specific DNS Suffix  . :
   Description . . . . . . . . . . . : Bluetooth Device (Personal Area Network)
   Physical Address. . . . . . . . . : 00-1E-64-EC-2A-92
   DHCP Enabled. . . . . . . . . . . : Yes
   Autoconfiguration Enabled . . . . : Yes

Tunnel adapter Local Area Connection* 12:

   Connection-specific DNS Suffix  . :
   Description . . . . . . . . . . . : Microsoft Teredo Tunneling Adapter
   Physical Address. . . . . . . . . : 00-00-00-00-00-00-00-E0
   DHCP Enabled. . . . . . . . . . . : No
   Autoconfiguration Enabled . . . . : Yes
   IPv6 Address. . . . . . . . . . . : 2001:0:9d38:90d7:24f7:fbc:3f57:1e5d(Preferred)
   Link-local IPv6 Address . . . . . : fe80::24f7:fbc:3f57:1e5d%16(Preferred)
   Default Gateway . . . . . . . . . :
   DHCPv6 IAID . . . . . . . . . . . : 268435456
   DHCPv6 Client DUID. . . . . . . . : 00-01-00-01-1E-40-F9-B0-F8-CA-B8-57-57-D3
   NetBIOS over Tcpip. . . . . . . . : Disabled

Tunnel adapter isatap.{05F48935-EE50-464D-B93F-E92CD0C5AD2F}:

   Media State . . . . . . . . . . . : Media disconnected
   Connection-specific DNS Suffix  . :
   Description . . . . . . . . . . . : Microsoft ISATAP Adapter #2
   Physical Address. . . . . . . . . : 00-00-00-00-00-00-00-E0
   DHCP Enabled. . . . . . . . . . . : No
   Autoconfiguration Enabled . . . . : Yes
Server:  jiofi.local.html
Address:  192.168.225.1

Name:    google.com
Addresses:  2404:6800:4009:807::200e
      216.58.203.206


Pinging google.com [2404:6800:4009:807::200e] with 32 bytes of data:
Reply from 2404:6800:4009:807::200e: time=104ms
Reply from 2404:6800:4009:807::200e: time=80ms

Ping statistics for 2404:6800:4009:807::200e:
    Packets: Sent = 2, Received = 2, Lost = 0 (0% loss),
Approximate round trip times in milli-seconds:
    Minimum = 80ms, Maximum = 104ms, Average = 92ms
Server:  jiofi.local.html
Address:  192.168.225.1

Name:    yahoo.com
Addresses:  2001:4998:58:c02::a9
      2001:4998:c:a06::2:4008
      2001:4998:44:204::a7
      98.138.253.109
      98.139.180.149
      206.190.36.45


Pinging yahoo.com [2001:4998:44:204::a7] with 32 bytes of data:
Reply from 2001:4998:44:204::a7: time=571ms
Reply from 2001:4998:44:204::a7: time=529ms

Ping statistics for 2001:4998:44:204::a7:
    Packets: Sent = 2, Received = 2, Lost = 0 (0% loss),
Approximate round trip times in milli-seconds:
    Minimum = 529ms, Maximum = 571ms, Average = 550ms

Pinging 127.0.0.1 with 32 bytes of data:
Reply from 127.0.0.1: bytes=32 time<1ms TTL=128
Reply from 127.0.0.1: bytes=32 time<1ms TTL=128

Ping statistics for 127.0.0.1:
    Packets: Sent = 2, Received = 2, Lost = 0 (0% loss),
Approximate round trip times in milli-seconds:
    Minimum = 0ms, Maximum = 0ms, Average = 0ms
===========================================================================
Interface List
 12...f8 ca b8 57 57 d3 ......Realtek PCIe FE Family Controller
  6...00 1e 64 ec 2a 8f ......Microsoft Wi-Fi Direct Virtual Adapter
  2...00 1e 64 ec 2a 8e ......Intel® Dual Band Wireless-AC 3160
  9...00 1e 64 ec 2a 92 ......Bluetooth Device (Personal Area Network)
  1...........................Software Loopback Interface 1
 16...00 00 00 00 00 00 00 e0 Microsoft Teredo Tunneling Adapter
 18...00 00 00 00 00 00 00 e0 Microsoft ISATAP Adapter #2
===========================================================================

IPv4 Route Table
===========================================================================
Active Routes:
Network Destination        Netmask          Gateway       Interface  Metric
          0.0.0.0          0.0.0.0    192.168.225.1  192.168.225.162     55
        127.0.0.0        255.0.0.0         On-link         127.0.0.1    331
        127.0.0.1  255.255.255.255         On-link         127.0.0.1    331
  127.255.255.255  255.255.255.255         On-link         127.0.0.1    331
    192.168.225.0    255.255.255.0         On-link   192.168.225.162    311
  192.168.225.162  255.255.255.255         On-link   192.168.225.162    311
  192.168.225.255  255.255.255.255         On-link   192.168.225.162    311
        224.0.0.0        240.0.0.0         On-link         127.0.0.1    331
        224.0.0.0        240.0.0.0         On-link   192.168.225.162    311
  255.255.255.255  255.255.255.255         On-link         127.0.0.1    331
  255.255.255.255  255.255.255.255         On-link   192.168.225.162    311
===========================================================================
Persistent Routes:
  None

IPv6 Route Table
===========================================================================
Active Routes:
 If Metric Network Destination      Gateway
  2    311 ::/0                     fe80::e1cf:34af:265f:50d5
  1    331 ::1/128                  On-link
 16    331 2001::/32                On-link
 16    331 2001:0:9d38:90d7:24f7:fbc:3f57:1e5d/128
                                    On-link
  2    311 2405:204:9616:1606::/64  On-link
  2    311 2405:204:9616:1606:bdd7:8dd8:d600:d85c/128
                                    On-link
  2    311 2405:204:9616:1606:ed6e:8e56:4ca:b487/128
                                    On-link
  2    311 fe80::/64                On-link
 16    331 fe80::/64                On-link
 16    331 fe80::24f7:fbc:3f57:1e5d/128
                                    On-link
  2    311 fe80::ed6e:8e56:4ca:b487/128
                                    On-link
  1    331 ff00::/8                 On-link
  2    311 ff00::/8                 On-link
 16    331 ff00::/8                 On-link
===========================================================================
Persistent Routes:
  None
========================= Winsock entries =====================================

Catalog5 01 C:\WINDOWS\SysWOW64\napinsp.dll [55808] (Microsoft Corporation)
Catalog5 02 C:\WINDOWS\SysWOW64\pnrpnsp.dll [70656] (Microsoft Corporation)
Catalog5 03 C:\WINDOWS\SysWOW64\pnrpnsp.dll [70656] (Microsoft Corporation)
Catalog5 04 C:\WINDOWS\SysWOW64\NLAapi.dll [65024] (Microsoft Corporation)
Catalog5 05 C:\WINDOWS\SysWOW64\mswsock.dll [306016] (Microsoft Corporation)
Catalog5 06 C:\WINDOWS\SysWOW64\winrnr.dll [24064] (Microsoft Corporation)
Catalog5 07 C:\WINDOWS\SysWOW64\wshbth.dll [51712] (Microsoft Corporation)
Catalog9 01 C:\WINDOWS\SysWOW64\mswsock.dll [306016] (Microsoft Corporation)
Catalog9 02 C:\WINDOWS\SysWOW64\mswsock.dll [306016] (Microsoft Corporation)
Catalog9 03 C:\WINDOWS\SysWOW64\mswsock.dll [306016] (Microsoft Corporation)
Catalog9 04 C:\WINDOWS\SysWOW64\mswsock.dll [306016] (Microsoft Corporation)
Catalog9 05 C:\WINDOWS\SysWOW64\mswsock.dll [306016] (Microsoft Corporation)
Catalog9 06 C:\WINDOWS\SysWOW64\mswsock.dll [306016] (Microsoft Corporation)
Catalog9 07 C:\WINDOWS\SysWOW64\mswsock.dll [306016] (Microsoft Corporation)
Catalog9 08 C:\WINDOWS\SysWOW64\mswsock.dll [306016] (Microsoft Corporation)
Catalog9 09 C:\WINDOWS\SysWOW64\mswsock.dll [306016] (Microsoft Corporation)
Catalog9 10 C:\WINDOWS\SysWOW64\mswsock.dll [306016] (Microsoft Corporation)
Catalog9 11 C:\WINDOWS\SysWOW64\mswsock.dll [306016] (Microsoft Corporation)
Catalog9 12 C:\WINDOWS\SysWOW64\mswsock.dll [306016] (Microsoft Corporation)
Catalog9 13 C:\WINDOWS\SysWOW64\mswsock.dll [306016] (Microsoft Corporation)
x64-Catalog5 01 C:\Windows\System32\napinsp.dll [67584] (Microsoft Corporation)
x64-Catalog5 02 C:\Windows\System32\pnrpnsp.dll [86016] (Microsoft Corporation)
x64-Catalog5 03 C:\Windows\System32\pnrpnsp.dll [86016] (Microsoft Corporation)
x64-Catalog5 04 C:\Windows\System32\NLAapi.dll [80896] (Microsoft Corporation)
x64-Catalog5 05 C:\Windows\System32\mswsock.dll [357216] (Microsoft Corporation)
x64-Catalog5 06 C:\Windows\System32\winrnr.dll [31744] (Microsoft Corporation)
x64-Catalog5 07 C:\Windows\System32\wshbth.dll [62976] (Microsoft Corporation)
x64-Catalog9 01 C:\Windows\System32\mswsock.dll [357216] (Microsoft Corporation)
x64-Catalog9 02 C:\Windows\System32\mswsock.dll [357216] (Microsoft Corporation)
x64-Catalog9 03 C:\Windows\System32\mswsock.dll [357216] (Microsoft Corporation)
x64-Catalog9 04 C:\Windows\System32\mswsock.dll [357216] (Microsoft Corporation)
x64-Catalog9 05 C:\Windows\System32\mswsock.dll [357216] (Microsoft Corporation)
x64-Catalog9 06 C:\Windows\System32\mswsock.dll [357216] (Microsoft Corporation)
x64-Catalog9 07 C:\Windows\System32\mswsock.dll [357216] (Microsoft Corporation)
x64-Catalog9 08 C:\Windows\System32\mswsock.dll [357216] (Microsoft Corporation)
x64-Catalog9 09 C:\Windows\System32\mswsock.dll [357216] (Microsoft Corporation)
x64-Catalog9 10 C:\Windows\System32\mswsock.dll [357216] (Microsoft Corporation)
x64-Catalog9 11 C:\Windows\System32\mswsock.dll [357216] (Microsoft Corporation)
x64-Catalog9 12 C:\Windows\System32\mswsock.dll [357216] (Microsoft Corporation)
x64-Catalog9 13 C:\Windows\System32\mswsock.dll [357216] (Microsoft Corporation)

**** End of log ****


 



#4 Oh My!

Oh My!

    Adware and Spyware and Malware.....


  • Malware Response Instructor
  • 36,142 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:California
  • Local time:01:37 PM

Posted 05 August 2017 - 07:59 AM

Greetings Raj.

Were you experiencing pop ups up until the time you ran the programs? In other words, did the previous steps appear to resolve the issue?

Please do this.

===================================================

Emsisoft Emergency Kit Scan

--------------------
  • Download Emsisoft Emergency Kit and save it to your desktop.
  • Double-click icon then click Install
  • A Window should open highlighting Start Emergency Kit Scanner
  • Right click on the icon and select Run as administrator
  • Click Yes to update now
  • Once the update is completed select Settings under Scan
  • Uncheck Join the Emsisoft Anti-Malware Network
  • Click Scan at the top
  • Click Yes on the detection of PUP's pop up window
  • Click Scanner settings at the bottom
  • Select Quarantine detected objects and leave the other default settings
  • Click Scan now
  • Click Malware Scan
  • Click Quarantine selected
  • Once completed click View Report
  • Copy and paste the report in your reply
===================================================

screen317's Security Check

--------------------
  • Please download screen317's Security Check to your desktop
  • Double-click icon then click Run
  • Press any key to launch the program
  • Note: If you receive an error message saying UNSUPPORTED OPERATING SYSTEM! ABORTED! reboot your computer and attempt to run it again
  • Allow the program to run
  • When completed a Notepad document will open on your desktop. Please copy and paste the contents in your reply
===================================================

Things I would like to see in your next reply. Please be sure to copy and paste any requested log information unless you are asked to attach it. :thumbsup2:
  • Emsisoft report
  • Security check report
  • Update on computer behavior

Gary
 
If I do not reply within 24 hours please send me a Personal Message.

"Lord, to whom would we go? You have the words that give eternal life. We believe, and we know you are the Holy One of God."

#5 almasat

almasat
  • Topic Starter

  • Members
  • 26 posts
  • OFFLINE
  •  
  • Local time:02:07 AM

Posted 05 August 2017 - 11:06 PM

Hello Gary,

Sorry I should have been clear. The popup appeared a total of three times and this was before I started the scanning procedures recommended by you. They did not appear when I first posted the topic and have not appeared since then.

The logs are as follows.

Emsisoft Emergency Kit - Version 2017.6
Last update: 06-08-2017 09:02:40
User account: DESKTOP-MOI971O\Raj
Computer name: DESKTOP-MOI971O
OS version: Windows 10x64

Scan settings:

Scan type: Malware Scan
Objects: Rootkits, Memory, Traces, Files

Detect PUPs: On
Scan archives: Off
Scan mail archives: Off
ADS Scan: On
File extension filter: Off
Direct disk access: Off

Scan start:    06-08-2017 09:04:46

Scanned    77732
Found    0

Scan end:    06-08-2017 09:10:31
Scan time:    0:05:45

 Results of screen317's Security Check version 1.014 --- 12/23/15  
   x64 (UAC is enabled)  
 Internet Explorer 11  
``````````````Antivirus/Firewall Check:``````````````
 Windows Firewall Enabled!  
Windows Defender   
 WMI entry may not exist for antivirus; attempting automatic update.
`````````Anti-malware/Other Utilities Check:`````````
 Zemana AntiLogger    
 Mozilla Firefox (54.0.1)
 Mozilla Thunderbird (52.2.1)
 Google Chrome (60.0.3112.90)
 Google Chrome (SetupMetrics...)
````````Process Check: objlist.exe by Laurent````````  
 Windows Defender MSMpEng.exe
 Malwarebytes Anti-Malware mbamservice.exe  
 Malwarebytes Anti-Malware mbamtray.exe  
 Windows Defender MpCmdRun.exe   
 Windows Defender MSASCuiL.exe   
 Kaspersky Lab Kaspersky Security Scan kss.exe  
`````````````````System Health check`````````````````
 Total Fragmentation on Drive C:  %
````````````````````End of Log``````````````````````
 



#6 Oh My!

Oh My!

    Adware and Spyware and Malware.....


  • Malware Response Instructor
  • 36,142 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:California
  • Local time:01:37 PM

Posted 06 August 2017 - 12:20 PM

Thanks for clarifying that for me.

Everything looks good. Are there any other current issues?
Gary
 
If I do not reply within 24 hours please send me a Personal Message.

"Lord, to whom would we go? You have the words that give eternal life. We believe, and we know you are the Holy One of God."

#7 almasat

almasat
  • Topic Starter

  • Members
  • 26 posts
  • OFFLINE
  •  
  • Local time:02:07 AM

Posted 06 August 2017 - 12:27 PM

No other issues. Thank you so much for your help.

One question. I am using Malwarebytes, ESET, Kaspersky regularly.

Would you recommend any other softwares?



#8 Oh My!

Oh My!

    Adware and Spyware and Malware.....


  • Malware Response Instructor
  • 36,142 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:California
  • Local time:01:37 PM

Posted 06 August 2017 - 12:32 PM

You are welcome but I didn't do much.

No, I think that is sufficient as all of those are good programs. I will post some additional information for you to consider as well.

Now that your computer is running well it is my great pleasure to proclaim to you the Good News!

===================================================

All Clean!

--------------

Your machine appears to be clean and we will now remove the tools used and logs created during our steps. Please do this.

===================================================

Delfix by Xplode

--------------------
  • Download Delfix and save it to your Desktop
  • Double click the icon
  • Place checkmarks in:

Remove disinfection tools
Create registry backup
Purge system restore

  • Click Run
===================================================

You may delete any additional programs or logs on your computer which were not automatically removed by Delfix. Simply delete the log files or desktop icons. If we used Emsisoft Emergency Kit just delete the icon on your desktop and the C:\EEK folder.

Please take the time to read below on how to secure the machine and take the necessary steps to keep it clean :thumbsup:

Lawrence Abrams, the founder of BleepingComputer.com, has developed an excellent tutorial which will provide you with the information you need to know to keep your computer secure and clean. Please take the time to read:In addition, here are some more links you might find of interest:Thank you for placing your trust in BleepingComputer. It was a pleasure serving you. ohmy_done.gif
Gary
 
If I do not reply within 24 hours please send me a Personal Message.

"Lord, to whom would we go? You have the words that give eternal life. We believe, and we know you are the Holy One of God."

#9 almasat

almasat
  • Topic Starter

  • Members
  • 26 posts
  • OFFLINE
  •  
  • Local time:02:07 AM

Posted 06 August 2017 - 12:46 PM

Done. Thank you Gary.

Bleeping Computer has always been a great help.

The work you and your colleagues do is invaluable and much appreciated.

Keep up the good work. :thumbsup2:



#10 Oh My!

Oh My!

    Adware and Spyware and Malware.....


  • Malware Response Instructor
  • 36,142 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:California
  • Local time:01:37 PM

Posted 06 August 2017 - 01:20 PM

My pleasure. Thank you for your kind words.

Gary
Gary
 
If I do not reply within 24 hours please send me a Personal Message.

"Lord, to whom would we go? You have the words that give eternal life. We believe, and we know you are the Holy One of God."

#11 Oh My!

Oh My!

    Adware and Spyware and Malware.....


  • Malware Response Instructor
  • 36,142 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:California
  • Local time:01:37 PM

Posted 07 August 2017 - 02:08 PM

It appears that this issue is resolved, therefore I am closing the topic. If that is not the case and you need or wish to continue with this topic, please send me or any Moderator a Personal Message (PM) that you would like this topic re-opened.
Gary
 
If I do not reply within 24 hours please send me a Personal Message.

"Lord, to whom would we go? You have the words that give eternal life. We believe, and we know you are the Holy One of God."




0 user(s) are reading this topic

0 members, 0 guests, 0 anonymous users