Jump to content


 


Register a free account to unlock additional features at BleepingComputer.com
Welcome to BleepingComputer, a free community where people like yourself come together to discuss and learn how to use their computers. Using the site is easy and fun. As a guest, you can browse and view the various discussions in the forums, but can not create a new topic or reply to an existing one unless you are logged in. Other benefits of registering an account are subscribing to topics and forums, creating a blog, and having no ads shown anywhere on the site.


Click here to Register a free account now! or read our Welcome Guide to learn how to use this site.

Photo

Registry Editor Virus


  • This topic is locked This topic is locked
3 replies to this topic

#1 joe5677

joe5677

  • Members
  • 11 posts
  • OFFLINE
  •  
  • Local time:06:11 PM

Posted 03 October 2017 - 03:29 PM

Virus was launched when a phishing email appeared to be from the California Department of Education with Grant Approval Letter. zip was opened.
 
The virus is trying to get permission to modify  the Windows 7 registery. It opens an User Account Control windows Stating "Do you want to allow the following program to make changes to this computer.  Program Name Registry Editor" Select no will relaunch the window.
 
Task manager can not close the task.  Selecting go to the process gets consent.exe
 
Symantec Endpoint Protection has found Trojan.Gen.NPE but apparently can not find the source.
Malwarebytes also finds but has been able to completely remove the problem.

Scan result of Farbar Recovery Scan Tool (FRST) (x64) Version: 02-10-2017 01
Ran by Maria.davis (administrator) on LAT200AD035 (03-10-2017 13:19:57)
Running from C:\Users\Maria.davis\Downloads
Loaded Profiles: Maria.davis & Maria (Available Profiles: Maria.davis & Maria)
Platform: Windows 7 Professional Service Pack 1 (X64) Language: English (United States)
Internet Explorer Version 11 (Default browser: IE)
Boot Mode: Normal
Tutorial for Farbar Recovery Scan Tool: http://www.geekstogo.com/forum/topic/335081-frst-tutorial-how-to-use-farbar-recovery-scan-tool/

==================== Processes (Whitelisted) =================

(If an entry is included in the fixlist, the process will be closed. The file will not be moved.)

(AMD) C:\Windows\System32\atiesrxx.exe
(Intel Corporation) C:\Windows\System32\igfxCUIService.exe
(AMD) C:\Windows\System32\atieclxx.exe
(Apple Inc.) C:\Program Files\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe
(Apple Inc.) C:\Program Files\Bonjour\mDNSResponder.exe
(Microsoft) C:\Program Files (x86)\Personalized Software\Childcare Manager 10\Utilities\CCMLogManagerService\CCMService.exe
(Dropbox, Inc.) C:\Windows\System32\DbxSvc.exe
() C:\Program Files (x86)\Flip Video\FlipShare\FlipShareService.exe
(LogMeIn, Inc.) C:\Program Files (x86)\Citrix\GoToMyPC\g2svc.exe
(LogMeIn, Inc.) C:\Program Files (x86)\Citrix\GoToMyPC\g2comm.exe
(LogMeIn, Inc.) C:\Program Files (x86)\Citrix\GoToMyPC\g2pre.exe
(Microsoft Corporation) C:\Program Files (x86)\Microsoft SQL Server\MSSQL.1\MSSQL\Binn\sqlservr.exe
(Symantec Corporation) C:\Program Files\Symantec.cloud\EndpointProtectionAgent\Engine\22.9.3.13\NIS.exe
(Intuit) C:\Program Files (x86)\Common Files\Intuit\QuickBooks\QBCFMonitorService.exe
(LogMeIn, Inc.) C:\Program Files (x86)\Citrix\GoToMyPC\g2tray.exe
(Microsoft Corporation) C:\Windows\System32\PrintIsolationHost.exe
(Intuit Inc.) C:\Program Files (x86)\Common Files\Intuit\DataProtect\QBIDPService.exe
(Microsoft Corporation) C:\Program Files (x86)\Microsoft SQL Server\90\Shared\sqlbrowser.exe
(Microsoft Corporation) C:\Program Files\Microsoft SQL Server\90\Shared\sqlwriter.exe
(Symantec Corporation) C:\Program Files\Symantec.cloud\PlatformAgent\ccSvcHst.exe
(TeamViewer GmbH) C:\Program Files (x86)\TeamViewer\TeamViewer_Service.exe
(Symantec Corporation) C:\Program Files\Symantec.cloud\PlatformAgent32\ccSvcHst.exe
(Symantec Corporation) C:\Program Files\Symantec.cloud\AntiVirus\AVAgent.exe
(Symantec Corporation) C:\Program Files\Symantec.cloud\AntiVirus\ssDVAgent.exe
(Symantec Corporation) C:\Program Files\Symantec.cloud\EndpointProtectionAgent\Engine\22.9.3.13\NIS.exe
(Microsoft Corporation) C:\Windows\Microsoft.NET\Framework64\v3.0\WPF\PresentationFontCache.exe
(Symantec Corporation) C:\Users\Maria.davis\AppData\Local\Temp\STSFX7C61\SymDiag.exe
(TeamViewer GmbH) C:\Program Files (x86)\TeamViewer\TeamViewer.exe
(TeamViewer GmbH) C:\Program Files (x86)\TeamViewer\tv_w32.exe
(TeamViewer GmbH) C:\Program Files (x86)\TeamViewer\tv_x64.exe
(Symantec Corporation) C:\Users\Maria.davis\AppData\Local\Temp\STSFX7C61\SymDiagUi4.exe
(Intel Corporation) C:\Windows\System32\igfxEM.exe
(Symantec Corporation) C:\Program Files\Symantec.cloud\EndpointProtectionAgent\Engine\22.9.3.13\NIS.exe
(Google Inc.) C:\Program Files (x86)\Google\Update\1.3.33.5\GoogleCrashHandler.exe
(Google Inc.) C:\Program Files (x86)\Google\Update\1.3.33.5\GoogleCrashHandler64.exe
(Realtek Semiconductor) C:\Program Files\Realtek\Audio\HDA\RtkNGUI64.exe
(Realtek Semiconductor) C:\Program Files\Realtek\Audio\HDA\RAVBg64.exe
(Logitech, Inc.) C:\Program Files\Logitech\SetPointP\SetPoint.exe
(Apple Inc.) C:\Program Files\iTunes\iTunesHelper.exe
(Symantec Corporation) C:\Program Files\Symantec.cloud\PlatformAgent\PAUI.exe
(Apple Inc.) C:\Program Files (x86)\Common Files\Apple\Internet Services\iCloudServices.exe
(Microsoft Corporation) C:\Windows\System32\StikyNot.exe
(Apple Inc.) C:\Program Files (x86)\Common Files\Apple\Internet Services\iCloudPhotos.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Oracle Corporation) C:\Users\Maria.davis\AppData\Roaming\Oracle\bin\javaw.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Logitech, Inc.) C:\Program Files\Common Files\Logishrd\KHAL3\KHALMNPR.exe
(Adobe Systems Inc.) C:\Program Files (x86)\Adobe\Acrobat 9.0\Acrobat\acrotray.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Intel® USB 3.0 eXtensible Host Controller Driver\Application\iusb3mon.exe
(Intuit Inc.) C:\Program Files (x86)\Common Files\Intuit\QuickBooks\QBUpdate\qbupdate.exe
(Dropbox, Inc.) C:\Program Files (x86)\Dropbox\Client\Dropbox.exe
(NCR Corporation) C:\Program Files (x86)\NCR\Passport Web Edition\pwecsrvc.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Dropbox, Inc.) C:\Program Files (x86)\Dropbox\Client\Dropbox.exe
(Dropbox, Inc.) C:\Program Files (x86)\Dropbox\Client\Dropbox.exe
(CANON INC.) C:\Program Files (x86)\Canon\IJ Network Scanner Selector EX\CNMNSST.exe
(Oracle Corporation) C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe
(Malwarebytes) C:\Program Files (x86)\Malwarebytes Anti-Malware\BusinessMessaging.exe
(Intuit Inc.) C:\Program Files (x86)\Intuit\QuickBooks 2017\QBW32.EXE
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Apple Inc.) C:\Program Files\iPod\bin\iPodService.exe
(Intel Corporation) C:\Program Files\Intel\Intel® Rapid Storage Technology\IAStorIcon.exe
(Apple Inc.) C:\Program Files (x86)\Common Files\Apple\Apple Application Support\APSDaemon.exe
(Apple, Inc.) C:\Program Files (x86)\Common Files\Apple\Apple Application Support\secd.exe
(Microsoft Corporation) C:\Program Files\Internet Explorer\iexplore.exe
(Intel Corporation) C:\Program Files\Intel\Intel® Rapid Storage Technology\IAStorDataMgrSvc.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Intel® Management Engine Components\DAL\jhi_service.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Intel® Management Engine Components\LMS\LMS.exe
(Microsoft Corporation) C:\Windows\SysWOW64\cmd.exe
(Microsoft Corporation) C:\Windows\System32\consent.exe
(Adobe Systems Incorporated) C:\Windows\System32\Macromed\Flash\FlashUtil64_27_0_0_130_ActiveX.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Intel® Management Engine Components\IMSS\PrivacyIconClient.exe
(Microsoft Corporation) C:\Windows\System32\mobsync.exe
(Advanced Micro Devices Inc.) C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\MOM.exe
(ATI Technologies Inc.) C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\CCC.exe
(Microsoft Corporation) C:\Program Files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\OSPPSVC.EXE

==================== Registry (Whitelisted) ===========================

(If an entry is included in the fixlist, the registry item will be restored to default or removed. The file will not be moved.)

HKLM\...\Run: [RtHDVCpl] => C:\Program Files\Realtek\Audio\HDA\RtkNGUI64.exe [8464600 2015-04-07] (Realtek Semiconductor)
HKLM\...\Run: [RtHDVBg] => C:\Program Files\Realtek\Audio\HDA\RAVBg64.exe [1392856 2015-03-20] (Realtek Semiconductor)
HKLM\...\Run: [IAStorIcon] => C:\Program Files\Intel\Intel® Rapid Storage Technology\IAStorIcon.exe [287592 2014-05-28] (Intel Corporation)
HKLM\...\Run: [EvtMgr6] => C:\Program Files\Logitech\SetPointP\SetPoint.exe [3113592 2015-08-25] (Logitech, Inc.)
HKLM\...\Run: [iTunesHelper] => C:\Program Files\iTunes\iTunesHelper.exe [297784 2017-09-11] (Apple Inc.)
HKLM\...\Run: [SymantecPaui] => C:\Program Files\Symantec.cloud\PlatformAgent\PAUI.exe [6741984 2017-01-31] (Symantec Corporation)
HKLM-x32\...\Run: [] => [X]
HKLM-x32\...\Run: [Adobe Acrobat Speed Launcher] => C:\Program Files (x86)\Adobe\Acrobat 9.0\Acrobat\Acrobat_sl.exe [37232 2008-06-12] (Adobe Systems Incorporated)
HKLM-x32\...\Run: [Acrobat Assistant 8.0] => C:\Program Files (x86)\Adobe\Acrobat 9.0\Acrobat\Acrotray.exe [640376 2008-06-11] (Adobe Systems Inc.)
HKLM-x32\...\Run: [USB3MON] => C:\Program Files (x86)\Intel\Intel® USB 3.0 eXtensible Host Controller Driver\Application\iusb3mon.exe [292848 2014-04-10] (Intel Corporation)
HKLM-x32\...\Run: [IMSS] => C:\Program Files (x86)\Intel\Intel® Management Engine Components\IMSS\PrivacyIconClient.exe [1087960 2014-04-03] (Intel Corporation)
HKLM-x32\...\Run: [Dropbox] => C:\Program Files (x86)\Dropbox\Client\Dropbox.exe [3481912 2017-09-20] (Dropbox, Inc.)
HKLM-x32\...\Run: [Passport Web Edition Client] => C:\Program Files (x86)\NCR\Passport Web Edition\pwecsrvc.exe [16896 2014-03-28] (NCR Corporation)
HKLM-x32\...\Run: [StartCCC] => C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\amd64\CLIStart.exe [766208 2013-12-06] (Advanced Micro Devices, Inc.)
HKLM-x32\...\Run: [IJNetworkScannerSelectorEX] => C:\Program Files (x86)\Canon\IJ Network Scanner Selector EX\CNMNSST.exe [439440 2011-09-27] (CANON INC.)
HKLM-x32\...\Run: [SunJavaUpdateSched] => C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe [587288 2017-07-21] (Oracle Corporation)
HKLM-x32\...\Run: [Malwarebytes Anti-Malware] => C:\Program Files (x86)\Malwarebytes Anti-Malware\BusinessMessaging.exe [3219456 2017-09-29] (Malwarebytes)
HKLM\...\Winlogon: [Shell] [0 ] () <=== ATTENTION
Winlogon\Notify\LBTWlgn: c:\program files\common files\logishrd\bluetooth\LBTWlgn.dll (Logitech, Inc.)
HKU\S-1-5-21-1447001783-2274183133-4180765549-1206\...\Run: [iCloudServices] => C:\Program Files (x86)\Common Files\Apple\Internet Services\iCloudServices.exe [67384 2017-09-18] (Apple Inc.)
HKU\S-1-5-21-1447001783-2274183133-4180765549-1206\...\Run: [RESTART_STICKY_NOTES] => C:\Windows\System32\StikyNot.exe [427520 2009-07-13] (Microsoft Corporation)
HKU\S-1-5-21-1447001783-2274183133-4180765549-1206\...\Run: [iCloudPhotos] => C:\Program Files (x86)\Common Files\Apple\Internet Services\iCloudPhotos.exe [356664 2017-09-18] (Apple Inc.)
HKU\S-1-5-21-1447001783-2274183133-4180765549-1206\...\Run: [GoogleChromeAutoLaunch_318E7946070E09DDE369F456E018B906] => C:\Program Files (x86)\Google\Chrome\Application\chrome.exe [1451352 2017-09-21] (Google Inc.)
HKU\S-1-5-21-1447001783-2274183133-4180765549-1206\...\Run: [bAEGIhHKulb] => "C:\Users\Maria.davis\AppData\Roaming\Oracle\bin\javaw.exe" -jar "C:\Users\Maria.davis\UxxwNlGeszX\VcgPtECafHL.byIXis"
HKU\S-1-5-21-1447001783-2274183133-4180765549-1206\...\Policies\system: [HideLogonScripts] 0
HKU\S-1-5-21-4206511477-2807538862-2280937620-1000\...\Run: [ISUSPM] => C:\Program Files (x86)\Common Files\InstallShield\UpdateService\ISUSPM.exe [218032 2006-09-11] (Macrovision Corporation)
HKU\S-1-5-21-4206511477-2807538862-2280937620-1000\...\MountPoints2: {4fc03b4e-4cc3-11e5-b533-806e6f6e6963} - D:\PerSoft.exe
HKU\S-1-5-18\...\RunOnce: [iCloud] => C:\Program Files (x86)\Common Files\Apple\Internet Services\iCloud.exe [67384 2017-09-18] (Apple Inc.)
SSODL: EldosMountNotificator - {5FF49FE8-B332-4CB9-B102-FB6951629E55} - C:\Windows\system32\CbFsMntNtf3.dll (EldoS Corporation)
SSODL-x32: EldosMountNotificator - {5FF49FE8-B332-4CB9-B102-FB6951629E55} - C:\Windows\SysWOW64\CbFsMntNtf3.dll (EldoS Corporation)
Startup: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\Intuit Data Protect.lnk [2017-03-16]
ShortcutTarget: Intuit Data Protect.lnk -> C:\Program Files (x86)\Common Files\Intuit\DataProtect\IntuitDataProtect.exe (Intuit Inc.)
Startup: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\QuickBooks Update Agent.lnk [2017-03-16]
ShortcutTarget: QuickBooks Update Agent.lnk -> C:\Program Files (x86)\Common Files\Intuit\QuickBooks\QBUpdate\qbupdate.exe (Intuit Inc.)
Startup: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\QuickBooks_Standard_21.lnk [2017-03-16]
ShortcutTarget: QuickBooks_Standard_21.lnk -> C:\Program Files (x86)\Intuit\QuickBooks 2017\QBW32.EXE (Intuit Inc.)

==================== Internet (Whitelisted) ====================

(If an item is included in the fixlist, if it is a registry item it will be removed or restored to default.)

Tcpip\Parameters: [DhcpNameServer] 192.168.1.220
Tcpip\..\Interfaces\{68537748-BC7C-41E1-A308-378098EE1F55}: [DhcpNameServer] 192.168.1.220

Internet Explorer:
==================
HKU\S-1-5-21-1447001783-2274183133-4180765549-1206\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://www.cnn.com/
HKU\S-1-5-21-1447001783-2274183133-4180765549-1206\Software\Microsoft\Internet Explorer\Main,Start Page Redirect Cache = hxxp://www.msn.com/?ocid=iehp
HKU\S-1-5-21-4206511477-2807538862-2280937620-1000\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://www.bing.com/
HKU\S-1-5-21-4206511477-2807538862-2280937620-1000\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = hxxp://www.dell.com
BHO: Skype for Business Browser Helper -> {31D09BA0-12F5-4CCE-BE8A-2923E76605DA} -> C:\Program Files\Microsoft Office\Office15\OCHelper.dll [2017-08-24] (Microsoft Corporation)
BHO: Norton Identity Safety -> {602ADB0E-4AFF-4217-8AA1-95DAC4DFA408} -> C:\Program Files\Symantec.cloud\EndpointProtectionAgent\Engine\22.9.3.13\coIEPlg.dll [2017-05-11] (Symantec Corporation)
BHO: Logitech SetPoint -> {AF949550-9094-4807-95EC-D1C317803333} -> C:\Program Files\Logitech\SetPointP\SetPointSmooth.dll [2015-08-25] (Logitech, Inc.)
BHO: Office Document Cache Handler -> {B4F3A835-0E21-4959-BA22-42B3008E02FF} -> C:\Program Files\Microsoft Office\Office15\URLREDIR.DLL [2014-01-23] (Microsoft Corporation)
BHO: Microsoft SkyDrive Pro Browser Helper -> {D0498E0A-45B7-42AE-A9AA-ABA463DBD3BF} -> C:\Program Files\Microsoft Office\Office15\GROOVEEX.DLL [2017-02-23] (Microsoft Corporation)
BHO-x32: Skype for Business Browser Helper -> {31D09BA0-12F5-4CCE-BE8A-2923E76605DA} -> C:\Program Files (x86)\Microsoft Office\Office15\OCHelper.dll [2017-08-24] (Microsoft Corporation)
BHO-x32: Norton Identity Safety -> {602ADB0E-4AFF-4217-8AA1-95DAC4DFA408} -> C:\Program Files\Symantec.cloud\EndpointProtectionAgent\Engine32\22.9.3.13\coIEPlg.dll [2017-05-11] (Symantec Corporation)
BHO-x32: Java™ Plug-In SSV Helper -> {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} -> C:\Program Files (x86)\Java\jre1.8.0_144\bin\ssv.dll [2017-08-07] (Oracle Corporation)
BHO-x32: Adobe PDF Conversion Toolbar Helper -> {AE7CD045-E861-484f-8273-0445EE161910} -> C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll [2008-06-11] (Adobe Systems Incorporated)
BHO-x32: Logitech SetPoint -> {AF949550-9094-4807-95EC-D1C317803333} -> C:\Program Files\Logitech\SetPointP\32-bit\SetPointSmooth.dll [2015-08-25] (Logitech, Inc.)
BHO-x32: Office Document Cache Handler -> {B4F3A835-0E21-4959-BA22-42B3008E02FF} -> C:\Program Files (x86)\Microsoft Office\Office15\URLREDIR.DLL [2014-01-21] (Microsoft Corporation)
BHO-x32: Microsoft SkyDrive Pro Browser Helper -> {D0498E0A-45B7-42AE-A9AA-ABA463DBD3BF} -> C:\Program Files (x86)\Microsoft Office\Office15\GROOVEEX.DLL [2017-02-23] (Microsoft Corporation)
BHO-x32: Java™ Plug-In 2 SSV Helper -> {DBC80044-A445-435b-BC74-9C25C1C588A9} -> C:\Program Files (x86)\Java\jre1.8.0_144\bin\jp2ssv.dll [2017-08-07] (Oracle Corporation)
BHO-x32: SmartSelect Class -> {F4971EE7-DAA0-4053-9964-665D8EE6A077} -> C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll [2008-06-11] (Adobe Systems Incorporated)
Toolbar: HKLM - Norton Toolbar - {7FEBEFE3-6B19-4349-98D2-FFB09D4B49CA} - C:\Program Files\Symantec.cloud\EndpointProtectionAgent\Engine\22.9.3.13\coIEPlg.dll [2017-05-11] (Symantec Corporation)
Toolbar: HKLM-x32 - Adobe PDF - {47833539-D0C5-4125-9FA8-0819E2EAAC93} - C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll [2008-06-11] (Adobe Systems Incorporated)
Toolbar: HKLM-x32 - Norton Toolbar - {7FEBEFE3-6B19-4349-98D2-FFB09D4B49CA} - C:\Program Files\Symantec.cloud\EndpointProtectionAgent\Engine32\22.9.3.13\coIEPlg.dll [2017-05-11] (Symantec Corporation)
Toolbar: HKU\S-1-5-21-1447001783-2274183133-4180765549-1206 -> No Name - {47833539-D0C5-4125-9FA8-0819E2EAAC93} - No File
DPF: HKLM-x32 {E06E2E99-0AA1-11D4-ABA6-0060082AA75C} hxxps://akamaicdn.webex.com/client/WBXclient-T30L10NSP4EP1-10006/webex/ieatgpc1.cab
Handler-x32: intu-help-qb10 - {E795042F-8A29-42E4-B265-2C7AB38E8AEE} - C:\Program Files (x86)\Intuit\QuickBooks 2017\HelpAsyncPluggableProtocol.dll [2017-03-07] (Intuit, Inc.)
Handler: osf - {D924BDC6-C83A-4BD5-90D0-095128A113D1} - C:\Program Files\Microsoft Office\Office15\MSOSB.DLL [2017-08-15] (Microsoft Corporation)
Handler-x32: qbwc - {FC598A64-626C-4447-85B8-53150405FD57} - C:\Windows\system32\mscoree.dll [2010-11-20] (Microsoft Corporation)

FireFox:
========
FF DefaultProfile: vyx5g407.default
FF ProfilePath: C:\Users\Maria.davis\AppData\Roaming\Mozilla\Firefox\Profiles\vyx5g407.default [2015-12-29]
FF HKLM\...\Firefox\Extensions: [{C1A2A613-35F1-4FCF-B27F-2840527B6556}] - C:\ProgramData\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\NIS_22.9.3.13\coFFAddon
FF Extension: (Norton Security Toolbar) - C:\ProgramData\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\NIS_22.9.3.13\coFFAddon [2017-09-29]
FF HKLM-x32\...\Firefox\Extensions: [{F003DA68-8256-4b37-A6C4-350FA04494DF}] - C:\Program Files\Logitech\SetPointP\LogiSmoothFirefoxExt
FF Extension: (Logitech SetPoint) - C:\Program Files\Logitech\SetPointP\LogiSmoothFirefoxExt [2016-02-29] [not signed]
FF HKLM-x32\...\Firefox\Extensions: [{C1A2A613-35F1-4FCF-B27F-2840527B6556}] - C:\ProgramData\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\NIS_22.9.3.13\coFFAddon
FF Plugin: @microsoft.com/GENUINE -> disabled [No File]
FF Plugin: @microsoft.com/SharePoint,version=14.0 -> C:\PROGRA~1\MICROS~1\Office15\NPSPWRAP.DLL [2014-01-23] (Microsoft Corporation)
FF Plugin-x32: @intel-webapi.intel.com/Intel WebAPI ipt;version=4.0.5 -> C:\Program Files (x86)\Intel\Intel® Management Engine Components\IPT\npIntelWebAPIIPT.dll [2014-04-03] (Intel Corporation)
FF Plugin-x32: @intel-webapi.intel.com/Intel WebAPI updater -> C:\Program Files (x86)\Intel\Intel® Management Engine Components\IPT\npIntelWebAPIUpdater.dll [2014-04-03] (Intel Corporation)
FF Plugin-x32: @java.com/DTPlugin,version=11.144.2 -> C:\Program Files (x86)\Java\jre1.8.0_144\bin\dtplugin\npDeployJava1.dll [2017-08-07] (Oracle Corporation)
FF Plugin-x32: @java.com/JavaPlugin,version=11.144.2 -> C:\Program Files (x86)\Java\jre1.8.0_144\bin\plugin2\npjp2.dll [2017-08-07] (Oracle Corporation)
FF Plugin-x32: @microsoft.com/GENUINE -> disabled [No File]
FF Plugin-x32: @microsoft.com/Lync,version=15.0 -> C:\Program Files (x86)\Mozilla Firefox\plugins\npmeetingjoinpluginoc.dll [2016-07-19] (Microsoft Corporation)
FF Plugin-x32: @microsoft.com/SharePoint,version=14.0 -> C:\PROGRA~2\MICROS~1\Office15\NPSPWRAP.DLL [2014-01-21] (Microsoft Corporation)
FF Plugin-x32: @tools.google.com/Google Update;version=3 -> C:\Program Files (x86)\Google\Update\1.3.33.5\npGoogleUpdate3.dll [2017-04-27] (Google Inc.)
FF Plugin-x32: @tools.google.com/Google Update;version=9 -> C:\Program Files (x86)\Google\Update\1.3.33.5\npGoogleUpdate3.dll [2017-04-27] (Google Inc.)
FF Plugin-x32: Adobe Reader -> C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AIR\nppdf32.dll [2017-07-31] (Adobe Systems Inc.)
FF Plugin HKU\S-1-5-21-1447001783-2274183133-4180765549-1206: @citrixonline.com/appdetectorplugin -> C:\Users\Maria.davis\AppData\Local\Citrix\Plugins\104\npappdetector.dll [2016-03-08] (Citrix Online)
FF Plugin ProgramFiles/Appdata: C:\Program Files (x86)\mozilla firefox\plugins\npMeetingJoinPluginOC.dll [2016-07-19] (Microsoft Corporation)
FF Plugin ProgramFiles/Appdata: C:\Program Files (x86)\mozilla firefox\plugins\nppdf32.dll [2017-07-31] (Adobe Systems Inc.)

Chrome:
=======
CHR Profile: C:\Users\Maria.davis\AppData\Local\Google\Chrome\User Data\Default [2017-10-03]
CHR Extension: (No Name) - C:\Users\Maria.davis\AppData\Local\Google\Chrome\User Data\Default\Extensions\aapocclcgogkmnckokdopfmhonfmgoek [2015-11-04]
CHR Extension: (No Name) - C:\Users\Maria.davis\AppData\Local\Google\Chrome\User Data\Default\Extensions\aohghmighlieiainnegkcijnfilokake [2015-11-04]
CHR Extension: (No Name) - C:\Users\Maria.davis\AppData\Local\Google\Chrome\User Data\Default\Extensions\apdfllckaahabafndbhieahigkjlhalf [2015-11-04]
CHR Extension: (No Name) - C:\Users\Maria.davis\AppData\Local\Google\Chrome\User Data\Default\Extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo [2015-11-04]
CHR Extension: (Norton Security Toolbar) - C:\Users\Maria.davis\AppData\Local\Google\Chrome\User Data\Default\Extensions\cjabmdjcfcfdmffimndhafhblfmpjdpe [2017-09-29]
CHR Extension: (No Name) - C:\Users\Maria.davis\AppData\Local\Google\Chrome\User Data\Default\Extensions\coobgpohoikkiipiblmjeljniedjpjpf [2015-11-04]
CHR Extension: (Google Calendar) - C:\Users\Maria.davis\AppData\Local\Google\Chrome\User Data\Default\Extensions\ejjicmeblgpmajnghnpcppodonldlgfn [2017-02-01]
CHR Extension: (No Name) - C:\Users\Maria.davis\AppData\Local\Google\Chrome\User Data\Default\Extensions\felcaaldnbdncclmgdcncolpebgiejap [2015-11-04]
CHR Extension: (No Name) - C:\Users\Maria.davis\AppData\Local\Google\Chrome\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi [2016-07-06]
CHR Extension: (Norton Identity Safe) - C:\Users\Maria.davis\AppData\Local\Google\Chrome\User Data\Default\Extensions\iikflkcanblccfahdhdonehdalibjnif [2017-09-29]
CHR Extension: (Google Hangouts) - C:\Users\Maria.davis\AppData\Local\Google\Chrome\User Data\Default\Extensions\nckgahadagoaajjgafhacjanaoiihapd [2017-05-04]
CHR Extension: (Chrome Web Store Payments) - C:\Users\Maria.davis\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda [2017-08-29]
CHR Extension: (No Name) - C:\Users\Maria.davis\AppData\Local\Google\Chrome\User Data\Default\Extensions\pjkljhegncpnkpknbcohdijeoejaedia [2015-11-04]
CHR Extension: (Chrome Media Router) - C:\Users\Maria.davis\AppData\Local\Google\Chrome\User Data\Default\Extensions\pkedcjkdefgpdelpbcmbmeomcjbeemfm [2017-09-26]
CHR HKLM\...\Chrome\Extension: [cjabmdjcfcfdmffimndhafhblfmpjdpe] - C:\Program Files\Symantec.cloud\EndpointProtectionAgent\Engine\22.9.3.13\Exts\Chrome.crx [2017-09-29]
CHR HKLM\...\Chrome\Extension: [iikflkcanblccfahdhdonehdalibjnif] - hxxps://clients2.google.com/service/update2/crx
CHR HKLM-x32\...\Chrome\Extension: [cjabmdjcfcfdmffimndhafhblfmpjdpe] - C:\Program Files\Symantec.cloud\EndpointProtectionAgent\Engine\22.9.3.13\Exts\Chrome.crx [2017-09-29]
CHR HKLM-x32\...\Chrome\Extension: [iikflkcanblccfahdhdonehdalibjnif] - hxxps://clients2.google.com/service/update2/crx

==================== Services (Whitelisted) ====================

(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)

R2 Apple Mobile Device Service; C:\Program Files\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe [83768 2017-09-07] (Apple Inc.)
R2 CCMService; C:\Program Files (x86)\Personalized Software\Childcare Manager 10\Utilities\CCMLogManagerService\CCMService.exe [12288 2010-06-03] (Microsoft) [File not signed]
S2 dbupdate; C:\Program Files (x86)\Dropbox\Update\DropboxUpdate.exe [143144 2016-11-04] (Dropbox, Inc.)
S3 dbupdatem; C:\Program Files (x86)\Dropbox\Update\DropboxUpdate.exe [143144 2016-11-04] (Dropbox, Inc.)
R2 DbxSvc; C:\Windows\system32\DbxSvc.exe [49992 2017-09-20] (Dropbox, Inc.)
S3 FLEXnet Licensing Service; C:\Program Files (x86)\Common Files\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exe [651720 2015-08-27] (Macrovision Europe Ltd.) [File not signed]
R2 FlipShare Service; C:\Program Files (x86)\Flip Video\FlipShare\FlipShareService.exe [455944 2010-05-14] ()
R2 GoToMyPC; C:\Program Files (x86)\Citrix\GoToMyPC\g2svc.exe [1799152 2017-05-29] (LogMeIn, Inc.)
S2 HPSupportSolutionsFrameworkService; C:\Program Files (x86)\Hewlett-Packard\HP Support Solutions\HPSupportSolutionsFrameworkService.exe [24888 2015-07-26] (Hewlett-Packard Company)
R2 IAStorDataMgrSvc; C:\Program Files\Intel\Intel® Rapid Storage Technology\IAStorDataMgrSvc.exe [16232 2014-05-28] (Intel Corporation)
R2 igfxCUIService1.0.0.0; C:\Windows\system32\igfxCUIService.exe [344168 2015-09-23] (Intel Corporation)
S3 Intel® Capability Licensing Service TCP IP Interface; C:\Program Files\Intel\iCLS Client\SocketHeciServer.exe [887232 2014-01-31] (Intel® Corporation)
R2 jhi_service; C:\Program Files (x86)\Intel\Intel® Management Engine Components\DAL\jhi_service.exe [154584 2014-04-03] (Intel Corporation)
R2 MSSQL$CCMSERVER; C:\Program Files (x86)\Microsoft SQL Server\MSSQL.1\MSSQL\Binn\sqlservr.exe [29293408 2010-12-10] (Microsoft Corporation)
R2 NIS; C:\Program Files\Symantec.cloud\EndpointProtectionAgent\Engine\22.9.3.13\NIS.exe [326160 2017-05-30] (Symantec Corporation)
S3 QBFCService; C:\Program Files (x86)\Common Files\Intuit\QuickBooks\FCS\Intuit.QuickBooks.FCS.exe [65536 2016-12-03] (Intuit Inc.) [File not signed]
R2 SsPaAdm; C:\Program Files\Symantec.cloud\PlatformAgent\ccSvcHst.exe [199464 2017-01-31] (Symantec Corporation)
R2 ssPaSetMgr; C:\Program Files\Symantec.cloud\PlatformAgent32\ccSvcHst.exe [153632 2017-01-31] (Symantec Corporation)
R2 ssSpnAv; C:\Program Files\Symantec.cloud\AntiVirus\AVAgent.exe [459184 2017-06-08] (Symantec Corporation)
S3 stllssvr; C:\Program Files (x86)\Common Files\SureThing Shared\stllssvr.exe [69632 2007-07-11] (MicroVision Development, Inc.) [File not signed]
R2 TeamViewer; C:\Program Files (x86)\TeamViewer\TeamViewer_Service.exe [7757552 2017-08-16] (TeamViewer GmbH)
R2 WinDefend; C:\Program Files\Windows Defender\mpsvc.dll [1011712 2013-05-26] (Microsoft Corporation)

===================== Drivers (Whitelisted) ======================

(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)

R1 BHDrvx64; C:\Program Files\Symantec.cloud\EndpointProtectionAgent\NortonData\22.9.3.13\Definitions\BASHDefs\20171002.005\BHDrvx64.sys [1872032 2017-09-27] (Symantec Corporation)
R1 cbfs3; C:\Windows\system32\drivers\cbfs3.sys [352144 2012-04-09] (EldoS Corporation)
R1 ccSet_Cloud; C:\Windows\SysWOW64\Drivers\Symantec.cloud\ccSetx64.sys [174328 2017-01-31] (Symantec Corporation)
R1 ccSet_NIS; C:\Windows\system32\drivers\NISx64\1609030.00D\ccSetx64.sys [174232 2017-05-11] (Symantec Corporation)
R2 DLABMFSE; C:\Windows\System32\Drivers\DLABMFSE.SYS [46448 2007-07-23] (Roxio)
R2 DLABOIOE; C:\Windows\System32\Drivers\DLABOIOE.SYS [42352 2007-07-23] (Roxio)
R0 DLACDBHE; C:\Windows\System32\Drivers\DLACDBHE.SYS [17776 2007-07-23] (Roxio)
R2 DLADResE; C:\Windows\System32\Drivers\DLADResE.SYS [9968 2007-07-23] (Roxio)
R2 DLAIFS_E; C:\Windows\System32\Drivers\DLAIFS_E.SYS [146672 2007-07-23] (Roxio)
R2 DLAOPIOE; C:\Windows\System32\Drivers\DLAOPIOE.SYS [35056 2007-07-23] (Roxio)
R2 DLAPoolE; C:\Windows\System32\Drivers\DLAPoolE.SYS [19824 2007-07-23] (Roxio)
R1 DLARTL_E; C:\Windows\System32\Drivers\DLARTL_E.SYS [41072 2007-07-23] (Roxio)
R2 DLAUDFAE; C:\Windows\System32\Drivers\DLAUDFAE.SYS [135152 2007-07-23] (Roxio)
R2 DLAUDF_E; C:\Windows\System32\Drivers\DLAUDF_E.SYS [144112 2007-07-23] (Roxio)
R0 DRVECDB; C:\Windows\System32\Drivers\DRVECDB.SYS [124112 2007-07-23] (Sonic Solutions)
R2 DRVEDDM; C:\Windows\System32\Drivers\DRVEDDM.SYS [63984 2007-07-23] (Roxio)
R3 e1dexpress; C:\Windows\System32\DRIVERS\e1d62x64.sys [378136 2014-09-29] (Intel Corporation)
R1 eeCtrl; C:\Program Files (x86)\Common Files\Symantec Shared\EENGINE\eeCtrl64.sys [508032 2017-06-16] (Symantec Corporation)
R3 EraserUtilRebootDrv; C:\Program Files (x86)\Common Files\Symantec Shared\EENGINE\EraserUtilRebootDrv.sys [158336 2017-06-16] (Symantec Corporation)
R0 iaStorF; C:\Windows\System32\DRIVERS\iaStorF.sys [28008 2014-05-28] (Intel Corporation)
R1 IDSVia64; C:\Program Files\Symantec.cloud\EndpointProtectionAgent\NortonData\22.9.3.13\Definitions\IPSDefs\20171002.001\IDSvia64.sys [1056920 2017-09-28] (Symantec Corporation)
R3 IntcAzAudAddService; C:\Windows\System32\drivers\RTDVHD64.sys [2740056 2015-04-07] (Realtek Semiconductor Corp.)
R3 MEIx64; C:\Windows\System32\DRIVERS\TeeDriverx64.sys [118272 2014-04-03] (Intel Corporation)
R2 monblanking; C:\Windows\System32\DRIVERS\monblanking.sys [37112 2017-05-29] (Citrix Systems)
R3 PaniniUSB; C:\Windows\System32\DRIVERS\PaniniUSB.sys [266752 2014-03-28] (Jungo)
R1 SMR510; C:\Windows\System32\drivers\SMR510.SYS [120024 2017-10-03] (Symantec Corporation)
R3 SRTSP; C:\Windows\system32\drivers\NISx64\1609030.00D\SRTSP64.SYS [770712 2017-05-11] (Symantec Corporation)
R1 SRTSPX; C:\Windows\system32\drivers\NISx64\1609030.00D\SRTSPX64.SYS [49304 2017-05-11] (Symantec Corporation)
R0 SymEFASI; C:\Windows\System32\drivers\NISx64\1609030.00D\SYMEFASI64.SYS [1714328 2017-05-11] (Symantec Corporation)
R3 SymEvent; C:\Windows\system32\Drivers\SYMEVENT64x86.SYS [102608 2017-09-29] (Symantec Corporation)
R1 SymIRON; C:\Windows\system32\drivers\NISx64\1609030.00D\Ironx64.SYS [291480 2017-05-11] (Symantec Corporation)
R1 SymNetS; C:\Windows\system32\drivers\NISx64\1609030.00D\SYMNETS.SYS [567496 2017-05-11] (Symantec Corporation)
S3 dbx; system32\DRIVERS\dbx.sys [X]
S3 NAVENG; \??\C:\Program Files\Symantec.cloud\EndpointProtectionAgent\NortonData\22.9.3.13\Definitions\SDSDefs\20170930.001\NAVENG.SYS [X]
S3 NAVEX15; \??\C:\Program Files\Symantec.cloud\EndpointProtectionAgent\NortonData\22.9.3.13\Definitions\SDSDefs\20170930.001\NAVEX15.SYS [X]

==================== NetSvcs (Whitelisted) ===================

(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)


==================== One Month Created files and folders ========

(If an entry is included in the fixlist, the file/folder will be moved.)

2017-10-03 13:19 - 2017-10-03 13:20 - 000029997 _____ C:\Users\Maria.davis\Downloads\FRST.txt
2017-10-03 13:18 - 2017-10-03 13:19 - 000000000 ____D C:\FRST
2017-10-03 13:18 - 2017-10-03 13:18 - 002399744 _____ (Farbar) C:\Users\Maria.davis\Downloads\FRST64.exe
2017-10-03 12:57 - 2017-10-03 13:11 - 000019738 _____ C:\Windows\ntbtlog.txt
2017-10-03 12:56 - 2017-10-03 12:56 - 000000000 ____D C:\ProgramData\SMR510
2017-10-03 12:55 - 2017-10-03 12:55 - 000120024 _____ (Symantec Corporation) C:\Windows\system32\Drivers\SMR510.SYS
2017-10-03 12:55 - 2017-10-03 12:55 - 000000112 _____ C:\Windows\ntbtlog.txt.bak
2017-10-03 12:21 - 2017-10-03 12:21 - 000000000 ____D C:\Windows\System32\Tasks\Remediation
2017-10-03 11:17 - 2017-10-03 11:17 - 010538464 _____ (Symantec Corporation) C:\Users\Maria.davis\Downloads\SymDiag.exe
2017-10-02 11:41 - 2017-10-02 11:41 - 000000000 ____D C:\Users\Maria.davis\AppData\Local\CrashDumps
2017-10-02 07:19 - 2017-10-02 07:19 - 000000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\iCloud
2017-09-29 15:25 - 2017-09-29 15:25 - 000000000 ____D C:\Windows\System32\Tasks\Endpoint Protection.cloud
2017-09-29 15:22 - 2017-09-29 15:22 - 000102608 _____ (Symantec Corporation) C:\Windows\system32\Drivers\SYMEVENT64x86.SYS
2017-09-29 15:22 - 2017-09-29 15:22 - 000008339 _____ C:\Windows\system32\Drivers\SYMEVENT64x86.CAT
2017-09-29 15:22 - 2017-09-29 15:22 - 000003250 _____ C:\Windows\System32\Tasks\Norton WSC Integration
2017-09-29 15:22 - 2017-09-29 15:22 - 000000000 ____D C:\Program Files\Common Files\Symantec Shared
2017-09-29 15:20 - 2017-09-29 15:24 - 000000000 ____D C:\ProgramData\Norton
2017-09-29 15:20 - 2017-09-29 15:20 - 000000000 ____D C:\Windows\system32\Drivers\NISx64
2017-09-29 15:20 - 2017-09-29 15:20 - 000000000 ____D C:\ProgramData\NortonInstaller
2017-09-29 15:20 - 2017-09-29 15:20 - 000000000 ____D C:\Program Files (x86)\NortonInstaller
2017-09-29 15:19 - 2017-09-29 15:19 - 000000000 ____D C:\Windows\SysWOW64\Drivers\Symantec.cloud
2017-09-29 15:19 - 2017-09-29 15:19 - 000000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Symantec.cloud
2017-09-29 15:17 - 2017-09-29 15:26 - 000000000 ____D C:\Program Files\Symantec.cloud
2017-09-29 15:16 - 2017-10-03 13:19 - 000000000 ____D C:\ProgramData\Symantec.cloud
2017-09-29 13:14 - 2017-09-29 13:14 - 000000000 ___HD C:\Users\Maria.davis\UxxwNlGeszX
2017-09-22 14:31 - 2017-09-22 14:31 - 000000493 _____ C:\Users\Maria.davis\Downloads\calendar.ics
2017-09-21 12:09 - 2017-09-21 12:09 - 000000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Dropbox
2017-09-20 09:48 - 2017-09-20 09:48 - 000049992 _____ (Dropbox, Inc.) C:\Windows\system32\DbxSvc.exe
2017-09-20 09:48 - 2017-09-20 09:48 - 000045672 _____ (Dropbox, Inc.) C:\Windows\system32\Drivers\dbx-dev.sys
2017-09-20 09:48 - 2017-09-20 09:48 - 000045640 _____ (Dropbox, Inc.) C:\Windows\system32\Drivers\dbx-stable.sys
2017-09-20 09:48 - 2017-09-20 09:48 - 000045640 _____ (Dropbox, Inc.) C:\Windows\system32\Drivers\dbx-canary.sys
2017-09-18 08:08 - 2017-09-18 08:08 - 000000000 ___HD C:\Windows\AxInstSV
2017-09-18 07:07 - 2017-09-18 07:08 - 000283408 _____ C:\Windows\Minidump\091817-24398-01.dmp
2017-09-14 07:34 - 2017-09-14 07:34 - 000000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\iTunes
2017-09-14 07:34 - 2017-09-14 07:34 - 000000000 ____D C:\Program Files\iTunes
2017-09-14 07:34 - 2017-09-14 07:34 - 000000000 ____D C:\Program Files\iPod
2017-09-14 07:31 - 2017-09-14 07:31 - 000000000 ____D C:\Windows\System32\Tasks\Apple
2017-09-14 07:31 - 2017-09-14 07:31 - 000000000 ____D C:\Program Files (x86)\Apple Software Update
2017-09-12 22:44 - 2017-08-19 08:28 - 000197120 _____ (Microsoft Corporation) C:\Windows\system32\shdocvw.dll
2017-09-12 22:44 - 2017-08-19 08:10 - 000180224 _____ (Microsoft Corporation) C:\Windows\SysWOW64\shdocvw.dll
2017-09-12 22:44 - 2017-08-16 08:29 - 000806912 _____ (Microsoft Corporation) C:\Windows\system32\usp10.dll
2017-09-12 22:44 - 2017-08-16 08:10 - 000629760 _____ (Microsoft Corporation) C:\Windows\SysWOW64\usp10.dll
2017-09-12 22:44 - 2017-08-16 07:57 - 003224576 _____ (Microsoft Corporation) C:\Windows\system32\win32k.sys
2017-09-12 22:44 - 2017-08-15 18:10 - 000395976 _____ (Microsoft Corporation) C:\Windows\system32\iedkcs32.dll
2017-09-12 22:44 - 2017-08-15 17:25 - 000347336 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iedkcs32.dll
2017-09-12 22:44 - 2017-08-15 08:29 - 014182400 _____ (Microsoft Corporation) C:\Windows\system32\shell32.dll
2017-09-12 22:44 - 2017-08-15 08:29 - 001867264 _____ (Microsoft Corporation) C:\Windows\system32\ExplorerFrame.dll
2017-09-12 22:44 - 2017-08-15 08:10 - 012880896 _____ (Microsoft Corporation) C:\Windows\SysWOW64\shell32.dll
2017-09-12 22:44 - 2017-08-15 08:10 - 001499648 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ExplorerFrame.dll
2017-09-12 22:44 - 2017-08-15 07:06 - 015260160 _____ (Microsoft Corporation) C:\Windows\system32\ieframe.dll
2017-09-12 22:44 - 2017-08-15 07:01 - 000416256 _____ (Microsoft Corporation) C:\Windows\SysWOW64\dxtmsft.dll
2017-09-12 22:44 - 2017-08-15 07:01 - 000279040 _____ (Microsoft Corporation) C:\Windows\SysWOW64\dxtrans.dll
2017-09-12 22:44 - 2017-08-15 07:01 - 000076288 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtmled.dll
2017-09-12 22:44 - 2017-08-15 06:58 - 013673984 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieframe.dll
2017-09-12 22:44 - 2017-08-14 10:35 - 003203584 _____ (Microsoft Corporation) C:\Windows\system32\mmcndmgr.dll
2017-09-12 22:44 - 2017-08-14 10:35 - 002150912 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mmcndmgr.dll
2017-09-12 22:44 - 2017-08-14 10:35 - 000355328 _____ (Microsoft Corporation) C:\Windows\system32\mmcbase.dll
2017-09-12 22:44 - 2017-08-14 10:35 - 000303104 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mmcbase.dll
2017-09-12 22:44 - 2017-08-14 10:35 - 000172544 _____ (Microsoft Corporation) C:\Windows\SysWOW64\cic.dll
2017-09-12 22:44 - 2017-08-14 10:35 - 000131072 _____ (Microsoft Corporation) C:\Windows\system32\mmcshext.dll
2017-09-12 22:44 - 2017-08-14 10:35 - 000128512 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mmcshext.dll
2017-09-12 22:44 - 2017-08-14 10:34 - 000211968 _____ (Microsoft Corporation) C:\Windows\system32\cic.dll
2017-09-12 22:44 - 2017-08-13 14:37 - 002144256 _____ (Microsoft Corporation) C:\Windows\system32\mmc.exe
2017-09-12 22:44 - 2017-08-13 14:30 - 001401344 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mmc.exe
2017-09-12 22:44 - 2017-08-13 11:58 - 025730560 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.dll
2017-09-12 22:44 - 2017-08-13 10:24 - 002724864 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.tlb
2017-09-12 22:44 - 2017-08-13 10:24 - 000004096 _____ (Microsoft Corporation) C:\Windows\system32\ieetwcollectorres.dll
2017-09-12 22:44 - 2017-08-13 10:06 - 000066560 _____ (Microsoft Corporation) C:\Windows\system32\iesetup.dll
2017-09-12 22:44 - 2017-08-13 10:05 - 000576512 _____ (Microsoft Corporation) C:\Windows\system32\vbscript.dll
2017-09-12 22:44 - 2017-08-13 10:05 - 000417792 _____ (Microsoft Corporation) C:\Windows\system32\html.iec
2017-09-12 22:44 - 2017-08-13 10:05 - 000088064 _____ (Microsoft Corporation) C:\Windows\system32\MshtmlDac.dll
2017-09-12 22:44 - 2017-08-13 10:05 - 000048640 _____ (Microsoft Corporation) C:\Windows\system32\ieetwproxystub.dll
2017-09-12 22:44 - 2017-08-13 10:04 - 002899968 _____ (Microsoft Corporation) C:\Windows\system32\iertutil.dll
2017-09-12 22:44 - 2017-08-13 09:56 - 000054784 _____ (Microsoft Corporation) C:\Windows\system32\jsproxy.dll
2017-09-12 22:44 - 2017-08-13 09:55 - 000034304 _____ (Microsoft Corporation) C:\Windows\system32\iernonce.dll
2017-09-12 22:44 - 2017-08-13 09:54 - 020269056 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.dll
2017-09-12 22:44 - 2017-08-13 09:52 - 000615936 _____ (Microsoft Corporation) C:\Windows\system32\ieui.dll
2017-09-12 22:44 - 2017-08-13 09:51 - 005981696 _____ (Microsoft Corporation) C:\Windows\system32\jscript9.dll
2017-09-12 22:44 - 2017-08-13 09:51 - 000144384 _____ (Microsoft Corporation) C:\Windows\system32\ieUnatt.exe
2017-09-12 22:44 - 2017-08-13 09:51 - 000116224 _____ (Microsoft Corporation) C:\Windows\system32\ieetwcollector.exe
2017-09-12 22:44 - 2017-08-13 09:50 - 000817664 _____ (Microsoft Corporation) C:\Windows\system32\jscript.dll
2017-09-12 22:44 - 2017-08-13 09:50 - 000814080 _____ (Microsoft Corporation) C:\Windows\system32\jscript9diag.dll
2017-09-12 22:44 - 2017-08-13 09:46 - 002724864 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.tlb
2017-09-12 22:44 - 2017-08-13 09:41 - 000968704 _____ (Microsoft Corporation) C:\Windows\system32\MsSpellCheckingFacility.exe
2017-09-12 22:44 - 2017-08-13 09:38 - 000489984 _____ (Microsoft Corporation) C:\Windows\system32\dxtmsft.dll
2017-09-12 22:44 - 2017-08-13 09:30 - 000062464 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iesetup.dll
2017-09-12 22:44 - 2017-08-13 09:29 - 000499200 _____ (Microsoft Corporation) C:\Windows\SysWOW64\vbscript.dll
2017-09-12 22:44 - 2017-08-13 09:29 - 000341504 _____ (Microsoft Corporation) C:\Windows\SysWOW64\html.iec
2017-09-12 22:44 - 2017-08-13 09:29 - 000087552 _____ (Microsoft Corporation) C:\Windows\system32\tdc.ocx
2017-09-12 22:44 - 2017-08-13 09:29 - 000077824 _____ (Microsoft Corporation) C:\Windows\system32\JavaScriptCollectionAgent.dll
2017-09-12 22:44 - 2017-08-13 09:29 - 000047616 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieetwproxystub.dll
2017-09-12 22:44 - 2017-08-13 09:28 - 000064000 _____ (Microsoft Corporation) C:\Windows\SysWOW64\MshtmlDac.dll
2017-09-12 22:44 - 2017-08-13 09:27 - 000107520 _____ (Microsoft Corporation) C:\Windows\system32\inseng.dll
2017-09-12 22:44 - 2017-08-13 09:24 - 002291200 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iertutil.dll
2017-09-12 22:44 - 2017-08-13 09:24 - 000199680 _____ (Microsoft Corporation) C:\Windows\system32\msrating.dll
2017-09-12 22:44 - 2017-08-13 09:23 - 000092160 _____ (Microsoft Corporation) C:\Windows\system32\mshtmled.dll
2017-09-12 22:44 - 2017-08-13 09:22 - 000047104 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jsproxy.dll
2017-09-12 22:44 - 2017-08-13 09:21 - 000030720 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iernonce.dll
2017-09-12 22:44 - 2017-08-13 09:20 - 000315392 _____ (Microsoft Corporation) C:\Windows\system32\dxtrans.dll
2017-09-12 22:44 - 2017-08-13 09:19 - 000476160 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieui.dll
2017-09-12 22:44 - 2017-08-13 09:18 - 000152064 _____ (Microsoft Corporation) C:\Windows\system32\occache.dll
2017-09-12 22:44 - 2017-08-13 09:17 - 000663552 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript.dll
2017-09-12 22:44 - 2017-08-13 09:17 - 000620032 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript9diag.dll
2017-09-12 22:44 - 2017-08-13 09:17 - 000115712 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieUnatt.exe
2017-09-12 22:44 - 2017-08-13 09:07 - 000262144 _____ (Microsoft Corporation) C:\Windows\system32\webcheck.dll
2017-09-12 22:44 - 2017-08-13 09:04 - 000807936 _____ (Microsoft Corporation) C:\Windows\system32\msfeeds.dll
2017-09-12 22:44 - 2017-08-13 09:04 - 000726528 _____ (Microsoft Corporation) C:\Windows\system32\ie4uinit.exe
2017-09-12 22:44 - 2017-08-13 09:02 - 001359360 _____ (Microsoft Corporation) C:\Windows\system32\mshtmlmedia.dll
2017-09-12 22:44 - 2017-08-13 09:01 - 002134528 _____ (Microsoft Corporation) C:\Windows\system32\inetcpl.cpl
2017-09-12 22:44 - 2017-08-13 09:01 - 000073216 _____ (Microsoft Corporation) C:\Windows\SysWOW64\tdc.ocx
2017-09-12 22:44 - 2017-08-13 09:01 - 000060416 _____ (Microsoft Corporation) C:\Windows\SysWOW64\JavaScriptCollectionAgent.dll
2017-09-12 22:44 - 2017-08-13 09:00 - 000091136 _____ (Microsoft Corporation) C:\Windows\SysWOW64\inseng.dll
2017-09-12 22:44 - 2017-08-13 08:57 - 000168960 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msrating.dll
2017-09-12 22:44 - 2017-08-13 08:53 - 000130048 _____ (Microsoft Corporation) C:\Windows\SysWOW64\occache.dll
2017-09-12 22:44 - 2017-08-13 08:48 - 004547072 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript9.dll
2017-09-12 22:44 - 2017-08-13 08:46 - 000230400 _____ (Microsoft Corporation) C:\Windows\SysWOW64\webcheck.dll
2017-09-12 22:44 - 2017-08-13 08:44 - 000694784 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msfeeds.dll
2017-09-12 22:44 - 2017-08-13 08:43 - 002058752 _____ (Microsoft Corporation) C:\Windows\SysWOW64\inetcpl.cpl
2017-09-12 22:44 - 2017-08-13 08:43 - 001155072 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtmlmedia.dll
2017-09-12 22:44 - 2017-08-13 08:40 - 003241472 _____ (Microsoft Corporation) C:\Windows\system32\wininet.dll
2017-09-12 22:44 - 2017-08-13 08:27 - 001544704 _____ (Microsoft Corporation) C:\Windows\system32\urlmon.dll
2017-09-12 22:44 - 2017-08-13 08:18 - 000800768 _____ (Microsoft Corporation) C:\Windows\system32\ieapfltr.dll
2017-09-12 22:44 - 2017-08-13 08:17 - 002767872 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wininet.dll
2017-09-12 22:44 - 2017-08-13 08:14 - 000710144 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieapfltr.dll
2017-09-12 22:44 - 2017-08-13 08:13 - 001314816 _____ (Microsoft Corporation) C:\Windows\SysWOW64\urlmon.dll
2017-09-12 22:44 - 2017-08-10 23:42 - 000631176 _____ (Microsoft Corporation) C:\Windows\system32\winresume.efi
2017-09-12 22:44 - 2017-08-10 23:38 - 005547752 _____ (Microsoft Corporation) C:\Windows\system32\ntoskrnl.exe
2017-09-12 22:44 - 2017-08-10 23:38 - 000706792 _____ (Microsoft Corporation) C:\Windows\system32\winload.efi
2017-09-12 22:44 - 2017-08-10 23:38 - 000154856 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\ksecpkg.sys
2017-09-12 22:44 - 2017-08-10 23:38 - 000095464 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\ksecdd.sys
2017-09-12 22:44 - 2017-08-10 23:36 - 001732864 _____ (Microsoft Corporation) C:\Windows\system32\ntdll.dll
2017-09-12 22:44 - 2017-08-10 23:35 - 002065408 _____ (Microsoft Corporation) C:\Windows\system32\ole32.dll
2017-09-12 22:44 - 2017-08-10 23:35 - 001212928 _____ (Microsoft Corporation) C:\Windows\system32\rpcrt4.dll
2017-09-12 22:44 - 2017-08-10 23:35 - 000757248 _____ (Microsoft Corporation) C:\Windows\system32\win32spl.dll
2017-09-12 22:44 - 2017-08-10 23:35 - 000512000 _____ (Microsoft Corporation) C:\Windows\system32\rpcss.dll
2017-09-12 22:44 - 2017-08-10 23:35 - 000503808 _____ (Microsoft Corporation) C:\Windows\system32\srcore.dll
2017-09-12 22:44 - 2017-08-10 23:35 - 000362496 _____ (Microsoft Corporation) C:\Windows\system32\wow64win.dll
2017-09-12 22:44 - 2017-08-10 23:35 - 000346112 _____ (Microsoft Corporation) C:\Windows\system32\ntprint.dll
2017-09-12 22:44 - 2017-08-10 23:35 - 000345600 _____ (Microsoft Corporation) C:\Windows\system32\schannel.dll
2017-09-12 22:44 - 2017-08-10 23:35 - 000313856 _____ (Microsoft Corporation) C:\Windows\system32\Wldap32.dll
2017-09-12 22:44 - 2017-08-10 23:35 - 000243712 _____ (Microsoft Corporation) C:\Windows\system32\wow64.dll
2017-09-12 22:44 - 2017-08-10 23:35 - 000215552 _____ (Microsoft Corporation) C:\Windows\system32\winsrv.dll
2017-09-12 22:44 - 2017-08-10 23:35 - 000210432 _____ (Microsoft Corporation) C:\Windows\system32\wdigest.dll
2017-09-12 22:44 - 2017-08-10 23:35 - 000190464 _____ (Microsoft Corporation) C:\Windows\system32\rpchttp.dll
2017-09-12 22:44 - 2017-08-10 23:35 - 000135680 _____ (Microsoft Corporation) C:\Windows\system32\sspicli.dll
2017-09-12 22:44 - 2017-08-10 23:35 - 000086528 _____ (Microsoft Corporation) C:\Windows\system32\TSpkg.dll
2017-09-12 22:44 - 2017-08-10 23:35 - 000063488 _____ (Microsoft Corporation) C:\Windows\system32\setbcdlocale.dll
2017-09-12 22:44 - 2017-08-10 23:35 - 000050176 _____ (Microsoft Corporation) C:\Windows\system32\srclient.dll
2017-09-12 22:44 - 2017-08-10 23:35 - 000028672 _____ (Microsoft Corporation) C:\Windows\system32\sspisrv.dll
2017-09-12 22:44 - 2017-08-10 23:35 - 000028160 _____ (Microsoft Corporation) C:\Windows\system32\secur32.dll
2017-09-12 22:44 - 2017-08-10 23:35 - 000026112 _____ (Microsoft Corporation) C:\Windows\system32\oleres.dll
2017-09-12 22:44 - 2017-08-10 23:35 - 000026112 _____ (Microsoft Corporation) C:\Windows\system32\nsisvc.dll
2017-09-12 22:44 - 2017-08-10 23:35 - 000025600 _____ (Microsoft Corporation) C:\Windows\system32\winnsi.dll
2017-09-12 22:44 - 2017-08-10 23:35 - 000016384 _____ (Microsoft Corporation) C:\Windows\system32\ntvdm64.dll
2017-09-12 22:44 - 2017-08-10 23:35 - 000013312 _____ (Microsoft Corporation) C:\Windows\system32\wow64cpu.dll
2017-09-12 22:44 - 2017-08-10 23:35 - 000013312 _____ (Microsoft Corporation) C:\Windows\system32\nsi.dll
2017-09-12 22:44 - 2017-08-10 23:34 - 001460736 _____ (Microsoft Corporation) C:\Windows\system32\lsasrv.dll
2017-09-12 22:44 - 2017-08-10 23:34 - 001163264 _____ (Microsoft Corporation) C:\Windows\system32\kernel32.dll
2017-09-12 22:44 - 2017-08-10 23:34 - 000971776 _____ (Microsoft Corporation) C:\Windows\system32\localspl.dll
2017-09-12 22:44 - 2017-08-10 23:34 - 000880640 _____ (Microsoft Corporation) C:\Windows\system32\advapi32.dll
2017-09-12 22:44 - 2017-08-10 23:34 - 000731648 _____ (Microsoft Corporation) C:\Windows\system32\kerberos.dll
2017-09-12 22:44 - 2017-08-10 23:34 - 000690688 _____ (Microsoft Corporation) C:\Windows\system32\adtschema.dll
2017-09-12 22:44 - 2017-08-10 23:34 - 000463872 _____ (Microsoft Corporation) C:\Windows\system32\certcli.dll
2017-09-12 22:44 - 2017-08-10 23:34 - 000419840 _____ (Microsoft Corporation) C:\Windows\system32\KernelBase.dll
2017-09-12 22:44 - 2017-08-10 23:34 - 000316928 _____ (Microsoft Corporation) C:\Windows\system32\msv1_0.dll
2017-09-12 22:44 - 2017-08-10 23:34 - 000312320 _____ (Microsoft Corporation) C:\Windows\system32\ncrypt.dll
2017-09-12 22:44 - 2017-08-10 23:34 - 000166400 _____ (Microsoft Corporation) C:\Windows\system32\inetpp.dll
2017-09-12 22:44 - 2017-08-10 23:34 - 000146432 _____ (Microsoft Corporation) C:\Windows\system32\msaudite.dll
2017-09-12 22:44 - 2017-08-10 23:34 - 000123904 _____ (Microsoft Corporation) C:\Windows\system32\bcrypt.dll
2017-09-12 22:44 - 2017-08-10 23:34 - 000060416 _____ (Microsoft Corporation) C:\Windows\system32\msobjs.dll
2017-09-12 22:44 - 2017-08-10 23:34 - 000059904 _____ (Microsoft Corporation) C:\Windows\system32\appidapi.dll
2017-09-12 22:44 - 2017-08-10 23:34 - 000044032 _____ (Microsoft Corporation) C:\Windows\system32\csrsrv.dll
2017-09-12 22:44 - 2017-08-10 23:34 - 000043520 _____ (Microsoft Corporation) C:\Windows\system32\cryptbase.dll
2017-09-12 22:44 - 2017-08-10 23:34 - 000034816 _____ (Microsoft Corporation) C:\Windows\system32\appidsvc.dll
2017-09-12 22:44 - 2017-08-10 23:34 - 000022528 _____ (Microsoft Corporation) C:\Windows\system32\inetppui.dll
2017-09-12 22:44 - 2017-08-10 23:34 - 000022016 _____ (Microsoft Corporation) C:\Windows\system32\credssp.dll
2017-09-12 22:44 - 2017-08-10 23:34 - 000008704 _____ (Microsoft Corporation) C:\Windows\system32\comcat.dll
2017-09-12 22:44 - 2017-08-10 23:34 - 000006656 _____ (Microsoft Corporation) C:\Windows\system32\apisetschema.dll
2017-09-12 22:44 - 2017-08-10 23:34 - 000006144 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-security-base-l1-1-0.dll
2017-09-12 22:44 - 2017-08-10 23:34 - 000005120 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-file-l1-1-0.dll
2017-09-12 22:44 - 2017-08-10 23:34 - 000004608 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-threadpool-l1-1-0.dll
2017-09-12 22:44 - 2017-08-10 23:34 - 000004608 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-processthreads-l1-1-0.dll
2017-09-12 22:44 - 2017-08-10 23:34 - 000004096 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-sysinfo-l1-1-0.dll
2017-09-12 22:44 - 2017-08-10 23:34 - 000004096 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-synch-l1-1-0.dll
2017-09-12 22:44 - 2017-08-10 23:34 - 000004096 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-localregistry-l1-1-0.dll
2017-09-12 22:44 - 2017-08-10 23:34 - 000004096 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-localization-l1-1-0.dll
2017-09-12 22:44 - 2017-08-10 23:34 - 000003584 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-rtlsupport-l1-1-0.dll
2017-09-12 22:44 - 2017-08-10 23:34 - 000003584 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-processenvironment-l1-1-0.dll
2017-09-12 22:44 - 2017-08-10 23:34 - 000003584 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-namedpipe-l1-1-0.dll
2017-09-12 22:44 - 2017-08-10 23:34 - 000003584 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-misc-l1-1-0.dll
2017-09-12 22:44 - 2017-08-10 23:34 - 000003584 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-memory-l1-1-0.dll
2017-09-12 22:44 - 2017-08-10 23:34 - 000003584 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-libraryloader-l1-1-0.dll
2017-09-12 22:44 - 2017-08-10 23:34 - 000003584 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-heap-l1-1-0.dll
2017-09-12 22:44 - 2017-08-10 23:34 - 000003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-xstate-l1-1-0.dll
2017-09-12 22:44 - 2017-08-10 23:34 - 000003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-util-l1-1-0.dll
2017-09-12 22:44 - 2017-08-10 23:34 - 000003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-string-l1-1-0.dll
2017-09-12 22:44 - 2017-08-10 23:34 - 000003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-profile-l1-1-0.dll
2017-09-12 22:44 - 2017-08-10 23:34 - 000003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-io-l1-1-0.dll
2017-09-12 22:44 - 2017-08-10 23:34 - 000003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-interlocked-l1-1-0.dll
2017-09-12 22:44 - 2017-08-10 23:34 - 000003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-handle-l1-1-0.dll
2017-09-12 22:44 - 2017-08-10 23:34 - 000003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-fibers-l1-1-0.dll
2017-09-12 22:44 - 2017-08-10 23:34 - 000003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-errorhandling-l1-1-0.dll
2017-09-12 22:44 - 2017-08-10 23:34 - 000003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-delayload-l1-1-0.dll
2017-09-12 22:44 - 2017-08-10 23:34 - 000003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-debug-l1-1-0.dll
2017-09-12 22:44 - 2017-08-10 23:34 - 000003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-datetime-l1-1-0.dll
2017-09-12 22:44 - 2017-08-10 23:34 - 000003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-console-l1-1-0.dll
2017-09-12 22:44 - 2017-08-10 23:24 - 004001000 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ntkrnlpa.exe
2017-09-12 22:44 - 2017-08-10 23:24 - 003945704 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ntoskrnl.exe
2017-09-12 22:44 - 2017-08-10 23:21 - 001314112 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ntdll.dll
2017-09-12 22:44 - 2017-08-10 23:20 - 000071680 _____ C:\Windows\system32\PrintBrmUi.exe
2017-09-12 22:44 - 2017-08-10 23:20 - 000061952 _____ (Microsoft Corporation) C:\Windows\system32\ntprint.exe
2017-09-12 22:44 - 2017-08-10 23:20 - 000048640 _____ (Microsoft Corporation) C:\Windows\system32\wpnpinst.exe
2017-09-12 22:44 - 2017-08-10 23:19 - 001417728 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ole32.dll
2017-09-12 22:44 - 2017-08-10 23:19 - 001114112 _____ (Microsoft Corporation) C:\Windows\SysWOW64\kernel32.dll
2017-09-12 22:44 - 2017-08-10 23:19 - 000690688 _____ (Microsoft Corporation) C:\Windows\SysWOW64\adtschema.dll
2017-09-12 22:44 - 2017-08-10 23:19 - 000666112 _____ (Microsoft Corporation) C:\Windows\SysWOW64\rpcrt4.dll
2017-09-12 22:44 - 2017-08-10 23:19 - 000644096 _____ (Microsoft Corporation) C:\Windows\SysWOW64\advapi32.dll
2017-09-12 22:44 - 2017-08-10 23:19 - 000554496 _____ (Microsoft Corporation) C:\Windows\SysWOW64\kerberos.dll
2017-09-12 22:44 - 2017-08-10 23:19 - 000497664 _____ (Microsoft Corporation) C:\Windows\SysWOW64\win32spl.dll
2017-09-12 22:44 - 2017-08-10 23:19 - 000342528 _____ (Microsoft Corporation) C:\Windows\SysWOW64\certcli.dll
2017-09-12 22:44 - 2017-08-10 23:19 - 000299008 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ntprint.dll
2017-09-12 22:44 - 2017-08-10 23:19 - 000275456 _____ (Microsoft Corporation) C:\Windows\SysWOW64\KernelBase.dll
2017-09-12 22:44 - 2017-08-10 23:19 - 000271360 _____ (Microsoft Corporation) C:\Windows\SysWOW64\Wldap32.dll
2017-09-12 22:44 - 2017-08-10 23:19 - 000261120 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msv1_0.dll
2017-09-12 22:44 - 2017-08-10 23:19 - 000254464 _____ (Microsoft Corporation) C:\Windows\SysWOW64\schannel.dll
2017-09-12 22:44 - 2017-08-10 23:19 - 000223232 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ncrypt.dll
2017-09-12 22:44 - 2017-08-10 23:19 - 000172032 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wdigest.dll
2017-09-12 22:44 - 2017-08-10 23:19 - 000146432 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msaudite.dll
2017-09-12 22:44 - 2017-08-10 23:19 - 000141312 _____ (Microsoft Corporation) C:\Windows\SysWOW64\rpchttp.dll
2017-09-12 22:44 - 2017-08-10 23:19 - 000096768 _____ (Microsoft Corporation) C:\Windows\SysWOW64\sspicli.dll
2017-09-12 22:44 - 2017-08-10 23:19 - 000082944 _____ (Microsoft Corporation) C:\Windows\SysWOW64\bcrypt.dll
2017-09-12 22:44 - 2017-08-10 23:19 - 000065536 _____ (Microsoft Corporation) C:\Windows\SysWOW64\TSpkg.dll
2017-09-12 22:44 - 2017-08-10 23:19 - 000060416 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msobjs.dll
2017-09-12 22:44 - 2017-08-10 23:19 - 000050688 _____ (Microsoft Corporation) C:\Windows\SysWOW64\appidapi.dll
2017-09-12 22:44 - 2017-08-10 23:19 - 000043008 _____ (Microsoft Corporation) C:\Windows\SysWOW64\srclient.dll
2017-09-12 22:44 - 2017-08-10 23:19 - 000026112 _____ (Microsoft Corporation) C:\Windows\SysWOW64\oleres.dll
2017-09-12 22:44 - 2017-08-10 23:19 - 000022016 _____ (Microsoft Corporation) C:\Windows\SysWOW64\secur32.dll
2017-09-12 22:44 - 2017-08-10 23:19 - 000017408 _____ (Microsoft Corporation) C:\Windows\SysWOW64\credssp.dll
2017-09-12 22:44 - 2017-08-10 23:19 - 000016384 _____ (Microsoft Corporation) C:\Windows\SysWOW64\winnsi.dll
2017-09-12 22:44 - 2017-08-10 23:19 - 000008704 _____ (Microsoft Corporation) C:\Windows\SysWOW64\nsi.dll
2017-09-12 22:44 - 2017-08-10 23:19 - 000006656 _____ (Microsoft Corporation) C:\Windows\SysWOW64\apisetschema.dll
2017-09-12 22:44 - 2017-08-10 23:19 - 000005120 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-file-l1-1-0.dll
2017-09-12 22:44 - 2017-08-10 23:19 - 000005120 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wow32.dll
2017-09-12 22:44 - 2017-08-10 23:19 - 000004608 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-processthreads-l1-1-0.dll
2017-09-12 22:44 - 2017-08-10 23:19 - 000004096 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-sysinfo-l1-1-0.dll
2017-09-12 22:44 - 2017-08-10 23:19 - 000004096 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-synch-l1-1-0.dll
2017-09-12 22:44 - 2017-08-10 23:19 - 000004096 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-misc-l1-1-0.dll
2017-09-12 22:44 - 2017-08-10 23:19 - 000004096 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-localregistry-l1-1-0.dll
2017-09-12 22:44 - 2017-08-10 23:19 - 000004096 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-localization-l1-1-0.dll
2017-09-12 22:44 - 2017-08-10 23:19 - 000003584 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-processenvironment-l1-1-0.dll
2017-09-12 22:44 - 2017-08-10 23:19 - 000003584 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-namedpipe-l1-1-0.dll
2017-09-12 22:44 - 2017-08-10 23:19 - 000003584 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-memory-l1-1-0.dll
2017-09-12 22:44 - 2017-08-10 23:19 - 000003584 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-libraryloader-l1-1-0.dll
2017-09-12 22:44 - 2017-08-10 23:19 - 000003584 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-interlocked-l1-1-0.dll
2017-09-12 22:44 - 2017-08-10 23:19 - 000003584 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-heap-l1-1-0.dll
2017-09-12 22:44 - 2017-08-10 23:19 - 000003072 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-string-l1-1-0.dll
2017-09-12 22:44 - 2017-08-10 23:19 - 000003072 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-rtlsupport-l1-1-0.dll
2017-09-12 22:44 - 2017-08-10 23:19 - 000003072 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-profile-l1-1-0.dll
2017-09-12 22:44 - 2017-08-10 23:19 - 000003072 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-io-l1-1-0.dll
2017-09-12 22:44 - 2017-08-10 23:19 - 000003072 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-handle-l1-1-0.dll
2017-09-12 22:44 - 2017-08-10 23:19 - 000003072 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-fibers-l1-1-0.dll
2017-09-12 22:44 - 2017-08-10 23:19 - 000003072 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-errorhandling-l1-1-0.dll
2017-09-12 22:44 - 2017-08-10 23:19 - 000003072 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-delayload-l1-1-0.dll
2017-09-12 22:44 - 2017-08-10 23:19 - 000003072 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-debug-l1-1-0.dll
2017-09-12 22:44 - 2017-08-10 23:19 - 000003072 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-datetime-l1-1-0.dll
2017-09-12 22:44 - 2017-08-10 23:19 - 000003072 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-console-l1-1-0.dll
2017-09-12 22:44 - 2017-08-10 23:12 - 000025088 _____ (Microsoft Corporation) C:\Windows\system32\netbtugc.exe
2017-09-12 22:44 - 2017-08-10 23:09 - 000061952 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ntprint.exe
2017-09-12 22:44 - 2017-08-10 23:07 - 000148480 _____ (Microsoft Corporation) C:\Windows\system32\appidpolicyconverter.exe
2017-09-12 22:44 - 2017-08-10 23:07 - 000062464 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\appid.sys
2017-09-12 22:44 - 2017-08-10 23:07 - 000017920 _____ (Microsoft Corporation) C:\Windows\system32\appidcertstorecheck.exe
2017-09-12 22:44 - 2017-08-10 23:06 - 000064000 _____ (Microsoft Corporation) C:\Windows\system32\auditpol.exe
2017-09-12 22:44 - 2017-08-10 23:03 - 000338432 _____ (Microsoft Corporation) C:\Windows\system32\conhost.exe
2017-09-12 22:44 - 2017-08-10 23:03 - 000026624 _____ (Microsoft Corporation) C:\Windows\SysWOW64\netbtugc.exe
2017-09-12 22:44 - 2017-08-10 23:02 - 000296960 _____ (Microsoft Corporation) C:\Windows\system32\rstrui.exe
2017-09-12 22:44 - 2017-08-10 23:01 - 000007168 _____ (Microsoft Corporation) C:\Windows\SysWOW64\comcat.dll
2017-09-12 22:44 - 2017-08-10 23:00 - 000262656 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\netbt.sys
2017-09-12 22:44 - 2017-08-10 23:00 - 000159744 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\mrxsmb.sys
2017-09-12 22:44 - 2017-08-10 23:00 - 000050176 _____ (Microsoft Corporation) C:\Windows\SysWOW64\auditpol.exe
2017-09-12 22:44 - 2017-08-10 22:59 - 000460800 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\srv.sys
2017-09-12 22:44 - 2017-08-10 22:59 - 000405504 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\srv2.sys
2017-09-12 22:44 - 2017-08-10 22:59 - 000291328 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\mrxsmb10.sys
2017-09-12 22:44 - 2017-08-10 22:59 - 000168448 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\srvnet.sys
2017-09-12 22:44 - 2017-08-10 22:59 - 000129536 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\mrxsmb20.sys
2017-09-12 22:44 - 2017-08-10 22:58 - 000112640 _____ (Microsoft Corporation) C:\Windows\system32\smss.exe
2017-09-12 22:44 - 2017-08-10 22:58 - 000030720 _____ (Microsoft Corporation) C:\Windows\system32\lsass.exe
2017-09-12 22:44 - 2017-08-10 22:58 - 000026112 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\nsiproxy.sys
2017-09-12 22:44 - 2017-08-10 22:56 - 000025600 _____ (Microsoft Corporation) C:\Windows\SysWOW64\setup16.exe
2017-09-12 22:44 - 2017-08-10 22:56 - 000014336 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ntvdm64.dll
2017-09-12 22:44 - 2017-08-10 22:56 - 000007680 _____ (Microsoft Corporation) C:\Windows\SysWOW64\instnm.exe
2017-09-12 22:44 - 2017-08-10 22:56 - 000002048 _____ (Microsoft Corporation) C:\Windows\SysWOW64\user.exe
2017-09-12 22:44 - 2017-08-10 22:55 - 000036352 _____ (Microsoft Corporation) C:\Windows\SysWOW64\cryptbase.dll
2017-09-12 22:44 - 2017-08-10 22:55 - 000006144 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-security-base-l1-1-0.dll
2017-09-12 22:44 - 2017-08-10 22:55 - 000004608 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-threadpool-l1-1-0.dll
2017-09-12 22:44 - 2017-08-10 22:55 - 000003584 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-xstate-l1-1-0.dll
2017-09-12 22:44 - 2017-08-10 22:55 - 000003072 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-util-l1-1-0.dll
2017-09-12 22:44 - 2017-07-07 08:29 - 001143296 _____ (Microsoft Corporation) C:\Windows\system32\DXPTaskRingtone.dll
2017-09-12 22:44 - 2017-07-07 08:10 - 000973312 _____ (Microsoft Corporation) C:\Windows\SysWOW64\DXPTaskRingtone.dll
2017-09-05 09:41 - 2017-09-05 09:41 - 000283408 _____ C:\Windows\Minidump\090517-21808-01.dmp

==================== One Month Modified files and folders ========

(If an entry is included in the fixlist, the file/folder will be moved.)

2017-10-03 13:20 - 2009-07-13 21:45 - 000021312 ____H C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0
2017-10-03 13:20 - 2009-07-13 21:45 - 000021312 ____H C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0
2017-10-03 12:59 - 2016-11-27 21:19 - 000000419 _____ C:\Windows\BRWMARK.INI
2017-10-03 12:59 - 2016-11-27 21:19 - 000000027 _____ C:\Windows\BRPP2KA.INI
2017-10-03 12:59 - 2015-08-30 19:55 - 000000000 __SHD C:\Users\Maria.davis\IntelGraphicsProfiles
2017-10-03 12:59 - 2015-08-27 10:05 - 000000902 _____ C:\Windows\Tasks\DropboxUpdateTaskMachineCore.job
2017-10-03 12:58 - 2015-08-30 19:52 - 000000128 _____ C:\Windows\system32\config\netlogon.ftl
2017-10-03 12:58 - 2009-07-13 22:08 - 000000006 ____H C:\Windows\Tasks\SA.DAT
2017-10-03 12:46 - 2016-03-08 09:00 - 000000570 _____ C:\Windows\Tasks\G2MUpdateTask-S-1-5-21-1447001783-2274183133-4180765549-1206.job
2017-10-03 12:37 - 2016-03-08 09:00 - 000000666 _____ C:\Windows\Tasks\G2MUploadTask-S-1-5-21-1447001783-2274183133-4180765549-1206.job
2017-10-03 12:27 - 2015-08-27 10:05 - 000000906 _____ C:\Windows\Tasks\DropboxUpdateTaskMachineUA.job
2017-10-03 11:35 - 2016-02-29 11:39 - 000000000 ____D C:\Users\Maria.davis\AppData\Local\1F20A8EF-7A44-4C5D-ADAA-6D4570C89BE8.aplzod
2017-10-03 11:27 - 2015-08-30 19:55 - 000000000 ____D C:\Users\Maria.davis
2017-10-03 11:26 - 2016-03-08 18:03 - 000000000 ____D C:\Outlook
2017-10-03 11:17 - 2009-07-13 22:13 - 000858672 _____ C:\Windows\system32\PerfStringBackup.INI
2017-10-03 11:17 - 2009-07-13 20:20 - 000000000 ____D C:\Windows\inf
2017-10-03 03:00 - 2015-11-05 10:18 - 000000000 ____D C:\tmp
2017-10-01 13:20 - 2015-08-31 19:50 - 000000000 ___RD C:\Users\Maria.davis\Dropbox
2017-09-29 20:48 - 2017-07-08 08:53 - 000000000 ____D C:\Users\Maria.davis\AppData\Local\GoToMeeting
2017-09-29 20:48 - 2016-03-08 09:00 - 000003704 _____ C:\Windows\System32\Tasks\G2MUploadTask-S-1-5-21-1447001783-2274183133-4180765549-1206
2017-09-29 20:48 - 2016-03-08 09:00 - 000003608 _____ C:\Windows\System32\Tasks\G2MUpdateTask-S-1-5-21-1447001783-2274183133-4180765549-1206
2017-09-29 18:07 - 2016-02-23 13:22 - 000000000 ____D C:\Program Files\Common Files\AV
2017-09-29 15:16 - 2015-08-26 21:00 - 000001945 _____ C:\Windows\epplauncher.mif
2017-09-29 14:59 - 2009-07-13 20:20 - 000000000 ____D C:\Windows\SchCache
2017-09-29 14:58 - 2016-10-15 13:23 - 000000000 ____D C:\Program Files (x86)\Malwarebytes Anti-Malware
2017-09-29 14:07 - 2016-10-15 13:24 - 000192216 _____ (Malwarebytes) C:\Windows\system32\Drivers\MBAMSwissArmy.sys
2017-09-29 13:14 - 2015-10-13 09:57 - 000000000 ____D C:\Users\Maria.davis\AppData\Roaming\Oracle
2017-09-26 15:14 - 2015-11-04 16:39 - 000002195 _____ C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Google Chrome.lnk
2017-09-21 12:10 - 2015-08-27 10:05 - 000000000 ____D C:\Program Files (x86)\Dropbox
2017-09-20 14:43 - 2017-07-21 08:05 - 000000000 ____D C:\Quickbooks Backup
2017-09-18 07:07 - 2017-07-26 09:41 - 000000000 ____D C:\Windows\Minidump
2017-09-18 07:07 - 2017-07-26 09:40 - 1525563144 _____ C:\Windows\MEMORY.DMP
2017-09-14 07:31 - 2015-08-27 09:59 - 000002519 _____ C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Apple Software Update.lnk
2017-09-13 04:32 - 2009-07-13 20:20 - 000000000 ____D C:\Windows\rescache
2017-09-13 03:44 - 2009-07-13 21:45 - 000457064 _____ C:\Windows\system32\FNTCACHE.DAT
2017-09-13 03:25 - 2016-02-28 13:55 - 000000000 ___RD C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Microsoft Office 2013
2017-09-13 03:24 - 2015-08-26 17:11 - 000000000 ____D C:\Windows\system32\MRT
2017-09-13 03:16 - 2015-08-26 17:11 - 138202976 ____C (Microsoft Corporation) C:\Windows\system32\MRT.exe
2017-09-13 03:05 - 2009-07-13 19:34 - 000000478 _____ C:\Windows\win.ini
2017-09-13 03:02 - 2015-08-27 03:51 - 000850794 _____ C:\Windows\SysWOW64\PerfStringBackup.INI
2017-09-12 10:23 - 2015-08-27 09:49 - 000803328 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerApp.exe
2017-09-12 10:23 - 2015-08-27 09:49 - 000144896 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerCPLApp.cpl
2017-09-12 10:23 - 2015-08-27 09:49 - 000004312 _____ C:\Windows\System32\Tasks\Adobe Flash Player Updater
2017-09-12 10:23 - 2015-08-27 09:49 - 000000000 ____D C:\Windows\system32\Macromed
2017-09-12 10:23 - 2015-08-27 09:48 - 000000000 ____D C:\Windows\SysWOW64\Macromed
2017-09-05 04:06 - 2016-07-15 12:25 - 000000000 ____D C:\Program Files (x86)\TeamViewer
2017-09-05 04:05 - 2016-07-15 12:25 - 000000971 _____ C:\ProgramData\Microsoft\Windows\Start Menu\Programs\TeamViewer 11.lnk

==================== Files in the root of some directories =======

2015-11-13 11:12 - 2015-11-13 11:12 - 000038456 _____ () C:\Users\Maria.davis\AppData\Roaming\Comma Separated Values.ADR

Some files in TEMP:
====================
2015-08-27 09:54 - 2012-01-05 12:43 - 000226672 _____ () C:\Users\Maria\AppData\Local\Temp\Abspdf.exe
2015-08-27 09:54 - 2012-01-05 12:43 - 000749715 _____ (AMYUNI Technologies
http://www.amyuni.com) C:\Users\Maria\AppData\Local\Temp\acfpdfu.dll
2015-08-27 09:54 - 2012-01-05 12:43 - 000947200 _____ (AMYUNI Technologies
http://www.amyuni.com) C:\Users\Maria\AppData\Local\Temp\acfpdfuamd64.dll
2015-08-27 09:54 - 2012-01-05 12:43 - 000407269 _____ (AMYUNI Technologies
http://www.amyuni.com) C:\Users\Maria\AppData\Local\Temp\acfpdfui.dll
2015-08-27 09:54 - 2006-07-12 15:11 - 001093632 _____ (AMYUNI Technologies
http://www.amyuni.com) C:\Users\Maria\AppData\Local\Temp\acfpdfuia64.dll
2015-08-27 09:54 - 2012-01-05 12:43 - 000430592 _____ (AMYUNI Technologies
http://www.amyuni.com) C:\Users\Maria\AppData\Local\Temp\acfpdfuiamd64.dll
2015-08-27 09:54 - 2006-07-12 15:11 - 000346112 _____ (AMYUNI Technologies
http://www.amyuni.com) C:\Users\Maria\AppData\Local\Temp\acfpdfuiia64.dll
2015-08-27 09:54 - 2012-01-05 12:43 - 004218880 _____ (Amyuni Technologies
http://www.amyuni.com) C:\Users\Maria\AppData\Local\Temp\cdintf.dll
2015-08-27 14:17 - 2015-08-27 14:17 - 000071168 _____ () C:\Users\Maria\AppData\Local\Temp\dropbox_sqlite_ext.{5f3e3153-5bce-5766-8f84-3e3e7ecf0d81}.tmp9lxxiw.dll
2012-07-21 09:55 - 2012-07-21 09:55 - 009230024 _____ (Adobe Systems Incorporated) C:\Users\Maria\AppData\Local\Temp\InstallAX.exe
2015-08-27 12:44 - 2015-07-02 13:36 - 000098760 _____ () C:\Users\Maria\AppData\Local\Temp\LMkRstPt.exe
2012-11-10 11:29 - 2012-11-10 11:29 - 000178760 ____R (Microsoft Corporation) C:\Users\Maria\AppData\Local\Temp\ose00000.exe
2006-12-28 17:01 - 2006-12-28 17:01 - 000237568 _____ (Payroll Associates, Inc.) C:\Users\Maria\AppData\Local\Temp\paiview.exe
2015-08-27 09:54 - 2011-07-20 09:18 - 000042264 _____ (Tri-Sector, Inc.) C:\Users\Maria\AppData\Local\Temp\PDFPRT400.exe
2006-11-28 15:57 - 2006-11-28 15:57 - 000045056 _____ (Pocket Soft, Inc.) C:\Users\Maria\AppData\Local\Temp\WPATCH.EXE
2015-08-27 09:54 - 2012-01-05 12:43 - 000121856 _____ (Microsoft Corporation) C:\Users\Maria\AppData\Local\Temp\xmllite.dll
2015-12-08 10:28 - 2015-12-08 10:28 - 000071168 _____ () C:\Users\Maria.davis\AppData\Local\Temp\dropbox_sqlite_ext.{5f3e3153-5bce-5766-8f84-3e3e7ecf0d81}.tmphr2vdm.dll
2017-01-17 17:48 - 2017-01-17 17:48 - 000739904 _____ (Oracle Corporation) C:\Users\Maria.davis\AppData\Local\Temp\jre-8u121-windows-au.exe
2017-07-18 16:48 - 2017-07-18 16:48 - 000739904 _____ (Oracle Corporation) C:\Users\Maria.davis\AppData\Local\Temp\jre-8u141-windows-au.exe
2017-08-07 13:53 - 2017-08-07 13:53 - 000740416 _____ (Oracle Corporation) C:\Users\Maria.davis\AppData\Local\Temp\jre-8u144-windows-au.exe
2015-11-03 15:26 - 2015-11-03 15:26 - 000585824 _____ (Oracle Corporation) C:\Users\Maria.davis\AppData\Local\Temp\jre-8u65-windows-au.exe
2017-03-16 10:31 - 2017-03-16 10:31 - 000111936 _____ (Microsoft Corporation) C:\Users\Maria.davis\AppData\Local\Temp\MSIZAP.EXE
2016-02-29 12:02 - 2015-12-28 09:48 - 000059496 _____ (apple) C:\Users\Maria.davis\AppData\Local\Temp\nso6598.tmp.exe
2012-10-01 03:22 - 2012-10-01 03:22 - 000150648 ____R (Microsoft Corporation) C:\Users\Maria.davis\AppData\Local\Temp\ose00000.exe
2012-10-01 03:22 - 2012-10-01 03:22 - 000150648 ____R (Microsoft Corporation) C:\Users\Maria.davis\AppData\Local\Temp\ose00001.exe
2012-11-10 11:29 - 2012-11-10 11:29 - 000178760 ____R (Microsoft Corporation) C:\Users\Maria.davis\AppData\Local\Temp\ose00002.exe
2017-09-29 18:26 - 2017-09-29 18:26 - 000695808 ____N () C:\Users\Maria.davis\AppData\Local\Temp\sqlite-3.8.11.2-7c8d9275-54c1-4fcf-82fc-c32ed88f1fce-sqlitejdbc.dll
2017-09-29 18:26 - 2017-09-29 18:26 - 000039424 _____ () C:\Users\Maria.davis\AppData\Local\Temp\Windows4167073928932320250.dll

==================== Bamital & volsnap ======================

(There is no automatic fix for files that do not pass verification.)

C:\Windows\system32\winlogon.exe => File is digitally signed
C:\Windows\system32\wininit.exe => File is digitally signed
C:\Windows\SysWOW64\wininit.exe => File is digitally signed
C:\Windows\explorer.exe => File is digitally signed
C:\Windows\SysWOW64\explorer.exe => File is digitally signed
C:\Windows\system32\svchost.exe => File is digitally signed
C:\Windows\SysWOW64\svchost.exe => File is digitally signed
C:\Windows\system32\services.exe => File is digitally signed
C:\Windows\system32\User32.dll => File is digitally signed
C:\Windows\SysWOW64\User32.dll => File is digitally signed
C:\Windows\system32\userinit.exe => File is digitally signed
C:\Windows\SysWOW64\userinit.exe => File is digitally signed
C:\Windows\system32\rpcss.dll => File is digitally signed
C:\Windows\system32\dnsapi.dll => File is digitally signed
C:\Windows\SysWOW64\dnsapi.dll => File is digitally signed
C:\Windows\system32\Drivers\volsnap.sys => File is digitally signed

LastRegBack: 2017-09-30 00:22

==================== End of FRST.txt ============================
Additional scan result of Farbar Recovery Scan Tool (x64) Version: 02-10-2017 01
Ran by Maria.davis (03-10-2017 13:21:02)
Running from C:\Users\Maria.davis\Downloads
Windows 7 Professional Service Pack 1 (X64) (2015-08-26 23:19:04)
Boot Mode: Normal
==========================================================


==================== Accounts: =============================

Administrator (S-1-5-21-4206511477-2807538862-2280937620-500 - Administrator - Disabled)
Guest (S-1-5-21-4206511477-2807538862-2280937620-501 - Limited - Disabled)
Maria (S-1-5-21-4206511477-2807538862-2280937620-1000 - Administrator - Enabled) => C:\Users\Maria

==================== Security Center ========================

(If an entry is included in the fixlist, it will be removed.)

AV: Symantec Endpoint Protection.cloud (Disabled - Up to date) {30744133-1E94-7B35-F4A3-82A5AEF1CBAA}
AS: Windows Defender (Enabled - Up to date) {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
AS: Symantec Endpoint Protection.cloud (Disabled - Up to date) {8B15A0D7-38AE-74BB-CE13-B9D7D5768117}
FW: Symantec Endpoint Protection.cloud (Enabled) {084FC016-54FB-7A6D-DFFC-2B9050228CD1}

==================== Installed Programs ======================

(Only the adware programs with "Hidden" flag could be added to the fixlist to unhide them. The adware programs should be uninstalled manually.)

Update (HKLM-x32\...\{EC542D5D-B608-4145-A8F7-749C02BE6D94}) (Version: 2.1.0 - Dell Inc.)
Adobe Acrobat 9 Pro - English, Français, Deutsch (HKLM-x32\...\{AC76BA86-1033-F400-7760-000000000004}{AC76BA86-1033-F400-7760-000000000004}) (Version: 9.0.0 - Adobe Systems)
Adobe Acrobat Reader DC (HKLM-x32\...\{AC76BA86-7AD7-1033-7B44-AC0F074E4100}) (Version: 17.012.20098 - Adobe Systems Incorporated)
Adobe Flash Player 27 ActiveX (HKLM-x32\...\Adobe Flash Player ActiveX) (Version: 27.0.0.130 - Adobe Systems Incorporated)
AMD Catalyst Install Manager (HKLM\...\{8AE48E61-DA96-813C-18CA-727881362878}) (Version: 8.0.915.0 - Advanced Micro Devices, Inc.)
Apple Application Support (32-bit) (HKLM-x32\...\{3D1290E6-1F77-46D5-A715-A56679C8D4E3}) (Version: 6.0.2 - Apple Inc.)
Apple Application Support (64-bit) (HKLM\...\{D0E45DEC-F4B9-4370-A9DF-66837789C2EF}) (Version: 6.0.2 - Apple Inc.)
Apple Mobile Device Support (HKLM\...\{E3C4B99B-BE71-4C27-8E3C-4FAE3C46E1D5}) (Version: 11.0.0.30 - Apple Inc.)
Apple Software Update (HKLM-x32\...\{C1BBFD2A-BCDD-45B3-8C0B-66BD434970A8}) (Version: 2.4.8.1 - Apple Inc.)
Bonjour (HKLM\...\{56DDDFB8-7F79-4480-89D5-25E1F52AB28F}) (Version: 3.1.0.1 - Apple Inc.)
Canon IJ Network Scanner Selector EX (HKLM-x32\...\Canon_IJ_Network_Scanner_Selector_EX) (Version: - )
Canon IJ Network Tool (HKLM-x32\...\Canon_IJ_Network_UTILITY) (Version: 3.1.1 - Canon Inc.)
Canon MP Navigator EX 5.1 (HKLM-x32\...\MP Navigator EX 5.1) (Version: - )
Canon MX510 series MP Drivers (HKLM\...\{1199FAD5-9546-44f3-81CF-FFDB8040B7BF}_Canon_MX510_series) (Version: - Canon Inc.)
Childcare Manager 10 (HKLM-x32\...\{579249CA-0BC9-456E-80BC-4972913564E8}) (Version: 10.0.2905 - Personalized Software)
Cisco WebEx Meetings (HKLM-x32\...\ActiveTouchMeetingClient) (Version: - Cisco WebEx LLC)
Citrix Online Launcher (HKLM-x32\...\{CC8F903A-9698-4245-9A38-22412DEF1029}) (Version: 1.0.446 - Citrix)
Dell Command
Dell System Detect (HKU\S-1-5-21-1447001783-2274183133-4180765549-1206\...\58d94f3ce2c27db0) (Version: 6.12.0.5 - Dell)
Dropbox (HKLM-x32\...\Dropbox) (Version: 35.4.20 - Dropbox, Inc.)
Dropbox Update Helper (HKLM-x32\...\{099218A5-A723-43DC-8DB5-6173656A1E94}) (Version: 1.3.59.1 - Dropbox, Inc.) Hidden
DWACS 1.0.6.3 (HKLM-x32\...\ACS_is1) (Version: 1.0.6.3 - )
eSync-Client Software (HKLM-x32\...\{A325E12D-09FA-4FA3-813B-A4D456E77460}) (Version: - )
FlipShare (HKLM-x32\...\{B1C0D829-FE30-059E-E93F-CDC7A48235C0}) (Version: 5.6.35.0 - Flip Video)
Google Chrome (HKLM-x32\...\Google Chrome) (Version: 61.0.3163.100 - Google Inc.)
Google Earth Pro (HKLM-x32\...\{ECF2E224-42F5-4E50-B58E-94CA70E85697}) (Version: 7.3.0.3832 - Google)
Google Update Helper (HKLM-x32\...\{60EC980A-BDA2-4CB6-A427-B07A5498B4CA}) (Version: 1.3.33.5 - Google Inc.) Hidden
GoToMeeting 8.14.0.7716 (HKU\S-1-5-21-1447001783-2274183133-4180765549-1206\...\GoToMeeting) (Version: 8.14.0.7716 - LogMeIn, Inc.)
GoToMyPC (HKLM\...\{CCB9E105-E105-4025-AC7C-C1C4CF04F3DC}) (Version: 9.4.2149 - LogMeIn, Inc.)
HP Support Solutions Framework (HKLM-x32\...\{F6A11738-3EE4-4573-AEA5-6CD5D491C167}) (Version: 12.0.30.81 - Hewlett-Packard Company)
iCloud (HKLM\...\{7464D896-C63C-412E-8ED3-3261C9F14E21}) (Version: 7.0.1.210 - Apple Inc.)
Intel® Management Engine Components (HKLM\...\{1CEAC85D-2590-4760-800F-8DE5E91F3700}) (Version: 10.0.1.1000 - Intel Corporation)
Intel® Network Connections Drivers (HKLM\...\PROSet) (Version: 19.5 - Intel)
Intel® Processor Graphics (HKLM-x32\...\{F0E3AD40-2BBD-4360-9C76-B9AC9A5886EA}) (Version: 10.18.14.4280 - Intel Corporation)
Intel® Rapid Storage Technology (HKLM\...\{409CB30E-E457-4008-9B1A-ED1B9EA21140}) (Version: 13.1.0.1058 - Intel Corporation)
Intel® USB 3.0 eXtensible Host Controller Driver (HKLM-x32\...\{240C3DDD-C5E9-4029-9DF7-95650D040CF2}) (Version: 2.5.4.40 - Intel Corporation)
Internet Explorer (Enable DEP) (HKLM\...\{a9264802-8a7a-40fe-a135-5c6d204aed7a}.sdb) (Version: - )
iTunes (HKLM\...\{94E81D4F-FB5A-4B29-B385-33896CC9BE7E}) (Version: 12.7.0.166 - Apple Inc.)
Java 8 Update 144 (HKLM-x32\...\{26A24AE4-039D-4CA4-87B4-2F32180144F0}) (Version: 8.0.1440.1 - Oracle Corporation)
Logitech SetPoint 6.67 (HKLM\...\sp6) (Version: 6.67.83 - Logitech)
Malwarebytes Anti-Malware version 2.2.1.1043 (HKLM-x32\...\Malwarebytes Anti-Malware_is1) (Version: 2.2.1.1043 - Malwarebytes)
Maxx Audio Installer (x64) (HKLM\...\{307032B2-6AF2-46D7-B933-62438DEB2B9A}) (Version: 1.6.5073.107 - Waves Audio Ltd.) Hidden
Microsoft .NET Framework 4.7 (HKLM\...\{92FB6C44-E685-45AD-9B20-CADF4CABA132} - 1033) (Version: 4.7.02053 - Microsoft Corporation)
Microsoft Office Professional Plus 2013 (HKLM\...\Office15.PROPLUS) (Version: 15.0.4569.1506 - Microsoft Corporation)
Microsoft Project Professional 2013 (HKLM\...\Office15.PRJPRO) (Version: 15.0.4569.1506 - Microsoft Corporation)
Microsoft SQL Server 2005 (HKLM-x32\...\Microsoft SQL Server 2005) (Version: - Microsoft Corporation)
Microsoft SQL Server Native Client (HKLM\...\{9ACF3FDB-C8E6-444C-8C64-13A221F7BFFD}) (Version: 9.00.5000.00 - Microsoft Corporation)
Microsoft SQL Server Setup Support Files (English) (HKLM-x32\...\{53F5C3EE-05ED-4830-994B-50B2F0D50FCE}) (Version: 9.00.5000.00 - Microsoft Corporation)
Microsoft SQL Server VSS Writer (HKLM\...\{B636C9B9-A3F2-4DCE-ADCC-72E095018385}) (Version: 9.00.5000.00 - Microsoft Corporation)
Microsoft Visio Professional 2013 (HKLM\...\Office15.VISPRO) (Version: 15.0.4569.1506 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.17 (HKLM\...\{8220EEFE-38CD-377E-8595-13398D740ACE}) (Version: 9.0.30729 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.6161 (HKLM\...\{5FCE6D76-F5DC-37AB-B2B8-22AB8CEDB1D4}) (Version: 9.0.30729.6161 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161 (HKLM-x32\...\{9BE518E6-ECC6-35A9-88E4-87755C07200F}) (Version: 9.0.30729.6161 - Microsoft Corporation)
Microsoft Visual C++ 2010 x64 Redistributable - 10.0.40219 (HKLM\...\{1D8E6291-B0D5-35EC-8441-6616F567A0F7}) (Version: 10.0.40219 - Microsoft Corporation)
Microsoft Visual C++ 2010 x86 Redistributable - 10.0.40219 (HKLM-x32\...\{F0C3E5D1-1ADE-321E-8167-68EF0DE699A5}) (Version: 10.0.40219 - Microsoft Corporation)
Microsoft Visual C++ 2012 Redistributable (x64) - 11.0.50727 (HKLM-x32\...\{15134cb0-b767-4960-a911-f2d16ae54797}) (Version: 11.0.50727.1 - Microsoft Corporation)
Microsoft Visual C++ 2012 Redistributable (x64) - 11.0.61030 (HKLM-x32\...\{ca67548a-5ebe-413a-b50c-4b9ceb6d66c6}) (Version: 11.0.61030.0 - Microsoft Corporation)
Microsoft Visual C++ 2012 Redistributable (x86) - 11.0.50727 (HKLM-x32\...\{22154f09-719a-4619-bb71-5b3356999fbf}) (Version: 11.0.50727.1 - Microsoft Corporation)
Microsoft Visual C++ 2013 Redistributable (x64) - 12.0.30501 (HKLM-x32\...\{050d4fc8-5d48-4b8f-8972-47c82c46020f}) (Version: 12.0.30501.0 - Microsoft Corporation)
Microsoft Visual C++ 2013 Redistributable (x86) - 12.0.30501 (HKLM-x32\...\{f65db027-aff3-4070-886a-0d87064aabb1}) (Version: 12.0.30501.0 - Microsoft Corporation)
Microsoft Visual Studio 2010 Tools for Office Runtime (x64) (HKLM\...\Microsoft Visual Studio 2010 Tools for Office Runtime (x64)) (Version: 10.0.50903 - Microsoft Corporation)
Mozilla Firefox 42.0 (x86 en-US) (HKLM-x32\...\Mozilla Firefox 42.0 (x86 en-US)) (Version: 42.0 - Mozilla)
Mozilla Maintenance Service (HKLM-x32\...\MozillaMaintenanceService) (Version: 42.0 - Mozilla)
MSXML 4.0 SP2 (KB954430) (HKLM-x32\...\{86493ADD-824D-4B8E-BD72-8C5DCDC52A71}) (Version: 4.20.9870.0 - Microsoft Corporation)
MSXML 4.0 SP2 (KB973688) (HKLM-x32\...\{F662A8E6-F4DC-41A2-901E-8C11F044BDEC}) (Version: 4.20.9876.0 - Microsoft Corporation)
Outils de vérification linguistique 2013 de Microsoft Office - Français (HKLM\...\{90150000-001F-040C-1000-0000000FF1CE}) (Version: 15.0.4569.1506 - Microsoft Corporation) Hidden
PassportWebClient (HKLM-x32\...\{6A26BCFD-3C93-423A-AA26-AEF9BAD83CA4}) (Version: 3.13.00.04 - NCR)
Pivot 1.0.7.9 (HKLM-x32\...\Pivot_is1) (Version: 1.0.7.9 - )
QuickBooks (HKLM-x32\...\{B52E01F1-D34E-4381-B590-28DFF3C0B647}) (Version: 27.0.4005.2702 - Intuit Inc.) Hidden
QuickBooks Premier Edition 2017 (HKLM-x32\...\{0E58840E-7BEE-4104-89C5-96A570BE2197}) (Version: 27.0.4004.2702 - Intuit Inc.)
QuickBooks Runtime Redistributable (HKLM\...\{F2A4F809-2DE6-4D27-888B-4D2BB8DAF20E}) (Version: 1.00.0000 - Intuit Inc.)
QuickTime 7 (HKLM-x32\...\{FF59BD75-466A-4D5A-AD23-AAD87C5FD44C}) (Version: 7.79.80.95 - Apple Inc.)
Realtek High Definition Audio Driver (HKLM-x32\...\{F132AF7F-7BCA-4EDE-8A7C-958108FE7DBC}) (Version: 6.0.1.6068 - Realtek Semiconductor Corp.)
Revo Uninstaller 1.95 (HKLM-x32\...\Revo Uninstaller) (Version: 1.95 - VS Revo Group)
Roxio Activation Module (HKLM-x32\...\{07159635-9DFE-4105-BFC0-2817DB540C68}) (Version: 1.0 - Roxio)
Roxio Creator Audio (HKLM-x32\...\{83FFCFC7-88C6-41C6-8752-958A45325C82}) (Version: 3.5.0 - Roxio)
Roxio Creator Copy (HKLM-x32\...\{619CDD8A-14B6-43A1-AB6C-0F4EE48CE048}) (Version: 3.5.0 - Roxio)
Roxio Creator Data (HKLM-x32\...\{0D397393-9B50-4C52-84D5-77E344289F87}) (Version: 3.5.0 - Roxio)
Roxio Creator DE (HKLM-x32\...\{C8B0680B-CDAE-4809-9F91-387B6DE00F7C}) (Version: 3.5.0 - Roxio)
Roxio Creator Tools (HKLM-x32\...\{0394CDC8-FABD-4ED8-B104-03393876DFDF}) (Version: 3.5.0 - Roxio)
Roxio Drag-to-Disc (HKLM\...\{AAE78E39-FAAF-4C19-A63E-BDED7428FDE1}) (Version: 9.1 - Roxio)
Roxio Express Labeler 3 (HKLM-x32\...\{6675CA7F-E51B-4F6A-99D4-F8F0124C6EAA}) (Version: 3.2.1 - Roxio)
Roxio Update Manager (HKLM-x32\...\{30465B6C-B53F-49A1-9EBA-A3F187AD502E}) (Version: 6.0.0 - Roxio)
Sdrive (HKU\S-1-5-21-1447001783-2274183133-4180765549-1206\...\Sdrive) (Version: 1.0.5.0 - Seagate Technology LLC)
Sdrive (HKU\S-1-5-21-4206511477-2807538862-2280937620-1000\...\Sdrive) (Version: 1.0.5.0 - Seagate Technology LLC)
Sdrive CBFS (HKLM-x32\...\Sdrive CBFS) (Version: 3.2.107.0 - Seagate Technology LLC)
Skype™ 7.8 (HKLM-x32\...\{6A0549A9-1B96-498C-ACBC-3943001FEB19}) (Version: 7.8.102 - Skype Technologies S.A.)
Sonic CinePlayer Decoder Pack (HKLM-x32\...\{8D337F77-BE7F-41A2-A7CB-D5A63FD7049B}) (Version: 4.2.0 - Sonic Solutions)
Symantec Endpoint Protection.cloud (HKLM-x32\...\NIS) (Version: 22.9.3.13 - Symantec Corporation) Hidden
Symantec.cloud - Cloud Agent (HKLM\...\{735EF746-77A8-44E8-821F-4C77F038AA90}) (Version: 3.00.10.2737 - Symantec Corporation) Hidden
Symantec.cloud - Endpoint Protection (HKLM\...\{4C89867B-2E80-4B0D-87DB-1BD643D5EF5D}) (Version: 6.60.10.800 - Symantec Corporation) Hidden
Symantec.cloud (HKLM\...\Symantec Hosted Services ARP) (Version: 3.00.10.2737 - Symantec Corporation)
TeamViewer 11 (HKLM-x32\...\TeamViewer) (Version: 11.0.80697 - TeamViewer)
ViewChoice (HKLM-x32\...\{48312CB9-F5D5-4E4B-8D5D-34AEF45DAE1F}) (Version: 1.0.0 - Default Company Name)

==================== Custom CLSID (Whitelisted): ==========================

(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)

CustomCLSID: HKU\S-1-5-21-1447001783-2274183133-4180765549-1206_Classes\CLSID\{820D63D5-8CFF-46DE-86AF-4997DEDD6DB5}\localserver32 -> C:\Windows\system32\igfxEM.exe (Intel Corporation)
CustomCLSID: HKU\S-1-5-21-1447001783-2274183133-4180765549-1206_Classes\CLSID\{84B5A313-CD5D-4904-8BA2-AFDC81C1B309}\InprocServer32 -> C:\Users\Maria.davis\AppData\Local\Citrix\GoToMeeting\4431\G2MOutlookAddin64.dll => No File
CustomCLSID: HKU\S-1-5-21-1447001783-2274183133-4180765549-1206_Classes\CLSID\{DAE467D6-5C66-404A-BD99-4AC8261A733A}\InprocServer32 -> C:\Windows\system32\mscoree.dll (Microsoft Corporation)
CustomCLSID: HKU\S-1-5-21-4206511477-2807538862-2280937620-1000_Classes\CLSID\{820D63D5-8CFF-46DE-86AF-4997DEDD6DB5}\localserver32 -> C:\Windows\system32\igfxEM.exe (Intel Corporation)
ShellIconOverlayIdentifiers: [ DropboxExt01] -> {FB314ED9-A251-47B7-93E1-CDD82E34AF8B} => C:\Program Files (x86)\Dropbox\Client\DropboxExt64.18.0.dll [2017-09-20] (Dropbox, Inc.)
ShellIconOverlayIdentifiers: [ DropboxExt02] -> {FB314EDF-A251-47B7-93E1-CDD82E34AF8B} => C:\Program Files (x86)\Dropbox\Client\DropboxExt64.18.0.dll [2017-09-20] (Dropbox, Inc.)
ShellIconOverlayIdentifiers: [ DropboxExt03] -> {FB314EE1-A251-47B7-93E1-CDD82E34AF8B} => C:\Program Files (x86)\Dropbox\Client\DropboxExt64.18.0.dll [2017-09-20] (Dropbox, Inc.)
ShellIconOverlayIdentifiers: [ DropboxExt04] -> {FB314EDB-A251-47B7-93E1-CDD82E34AF8B} => C:\Program Files (x86)\Dropbox\Client\DropboxExt64.18.0.dll [2017-09-20] (Dropbox, Inc.)
ShellIconOverlayIdentifiers: [ DropboxExt05] -> {FB314EDA-A251-47B7-93E1-CDD82E34AF8B} => C:\Program Files (x86)\Dropbox\Client\DropboxExt64.18.0.dll [2017-09-20] (Dropbox, Inc.)
ShellIconOverlayIdentifiers: [ DropboxExt06] -> {FB314EDC-A251-47B7-93E1-CDD82E34AF8B} => C:\Program Files (x86)\Dropbox\Client\DropboxExt64.18.0.dll [2017-09-20] (Dropbox, Inc.)
ShellIconOverlayIdentifiers: [ DropboxExt07] -> {FB314EDD-A251-47B7-93E1-CDD82E34AF8B} => C:\Program Files (x86)\Dropbox\Client\DropboxExt64.18.0.dll [2017-09-20] (Dropbox, Inc.)
ShellIconOverlayIdentifiers: [ DropboxExt08] -> {FB314EE0-A251-47B7-93E1-CDD82E34AF8B} => C:\Program Files (x86)\Dropbox\Client\DropboxExt64.18.0.dll [2017-09-20] (Dropbox, Inc.)
ShellIconOverlayIdentifiers: [ DropboxExt09] -> {FB314EE2-A251-47B7-93E1-CDD82E34AF8B} => C:\Program Files (x86)\Dropbox\Client\DropboxExt64.18.0.dll [2017-09-20] (Dropbox, Inc.)
ShellIconOverlayIdentifiers: [ DropboxExt10] -> {FB314EDE-A251-47B7-93E1-CDD82E34AF8B} => C:\Program Files (x86)\Dropbox\Client\DropboxExt64.18.0.dll [2017-09-20] (Dropbox, Inc.)
ShellIconOverlayIdentifiers: [ OverlayExcluded] -> {4433A54A-1AC8-432F-90FC-85F045CF383C} => C:\Program Files\Symantec.cloud\EndpointProtectionAgent\Engine\22.9.3.13\buShell.dll [2017-05-11] (Symantec Corporation)
ShellIconOverlayIdentifiers: [ OverlayPending] -> {F17C0B1E-EF8E-4AD4-8E1B-7D7E8CB23225} => C:\Program Files\Symantec.cloud\EndpointProtectionAgent\Engine\22.9.3.13\buShell.dll [2017-05-11] (Symantec Corporation)
ShellIconOverlayIdentifiers: [ OverlayProtected] -> {476D0EA3-80F9-48B5-B70B-05E677C9C148} => C:\Program Files\Symantec.cloud\EndpointProtectionAgent\Engine\22.9.3.13\buShell.dll [2017-05-11] (Symantec Corporation)
ShellIconOverlayIdentifiers: [1EldosIconOverlay] -> {41BE046E-2BF0-47C9-BBD6-286B605AC23F} => C:\Windows\System32\CbFsMntNtf3.dll [2012-04-09] (EldoS Corporation)
ShellIconOverlayIdentifiers: [EldosIconOverlay] -> {5BB532A2-BF14-4CCC-86B7-71B81EF6F8BC} => C:\Windows\system32\CbFsMntNtf3.dll [2012-04-09] (EldoS Corporation)
ShellIconOverlayIdentifiers-x32: [ DropboxExt01] -> {FB314ED9-A251-47B7-93E1-CDD82E34AF8B} => C:\Program Files (x86)\Dropbox\Client\DropboxExt64.18.0.dll [2017-09-20] (Dropbox, Inc.)
ShellIconOverlayIdentifiers-x32: [ DropboxExt02] -> {FB314EDF-A251-47B7-93E1-CDD82E34AF8B} => C:\Program Files (x86)\Dropbox\Client\DropboxExt64.18.0.dll [2017-09-20] (Dropbox, Inc.)
ShellIconOverlayIdentifiers-x32: [ DropboxExt03] -> {FB314EE1-A251-47B7-93E1-CDD82E34AF8B} => C:\Program Files (x86)\Dropbox\Client\DropboxExt64.18.0.dll [2017-09-20] (Dropbox, Inc.)
ShellIconOverlayIdentifiers-x32: [ DropboxExt04] -> {FB314EDB-A251-47B7-93E1-CDD82E34AF8B} => C:\Program Files (x86)\Dropbox\Client\DropboxExt64.18.0.dll [2017-09-20] (Dropbox, Inc.)
ShellIconOverlayIdentifiers-x32: [ DropboxExt05] -> {FB314EDA-A251-47B7-93E1-CDD82E34AF8B} => C:\Program Files (x86)\Dropbox\Client\DropboxExt64.18.0.dll [2017-09-20] (Dropbox, Inc.)
ShellIconOverlayIdentifiers-x32: [ DropboxExt06] -> {FB314EDC-A251-47B7-93E1-CDD82E34AF8B} => C:\Program Files (x86)\Dropbox\Client\DropboxExt64.18.0.dll [2017-09-20] (Dropbox, Inc.)
ShellIconOverlayIdentifiers-x32: [ DropboxExt07] -> {FB314EDD-A251-47B7-93E1-CDD82E34AF8B} => C:\Program Files (x86)\Dropbox\Client\DropboxExt64.18.0.dll [2017-09-20] (Dropbox, Inc.)
ShellIconOverlayIdentifiers-x32: [ DropboxExt08] -> {FB314EE0-A251-47B7-93E1-CDD82E34AF8B} => C:\Program Files (x86)\Dropbox\Client\DropboxExt64.18.0.dll [2017-09-20] (Dropbox, Inc.)
ShellIconOverlayIdentifiers-x32: [ DropboxExt09] -> {FB314EE2-A251-47B7-93E1-CDD82E34AF8B} => C:\Program Files (x86)\Dropbox\Client\DropboxExt64.18.0.dll [2017-09-20] (Dropbox, Inc.)
ShellIconOverlayIdentifiers-x32: [ DropboxExt10] -> {FB314EDE-A251-47B7-93E1-CDD82E34AF8B} => C:\Program Files (x86)\Dropbox\Client\DropboxExt64.18.0.dll [2017-09-20] (Dropbox, Inc.)
ShellIconOverlayIdentifiers-x32: [ OverlayExcluded] -> {4433A54A-1AC8-432F-90FC-85F045CF383C} => C:\Program Files\Symantec.cloud\EndpointProtectionAgent\Engine\22.9.3.13\buShell.dll [2017-05-11] (Symantec Corporation)
ShellIconOverlayIdentifiers-x32: [ OverlayPending] -> {F17C0B1E-EF8E-4AD4-8E1B-7D7E8CB23225} => C:\Program Files\Symantec.cloud\EndpointProtectionAgent\Engine\22.9.3.13\buShell.dll [2017-05-11] (Symantec Corporation)
ShellIconOverlayIdentifiers-x32: [ OverlayProtected] -> {476D0EA3-80F9-48B5-B70B-05E677C9C148} => C:\Program Files\Symantec.cloud\EndpointProtectionAgent\Engine\22.9.3.13\buShell.dll [2017-05-11] (Symantec Corporation)
ShellIconOverlayIdentifiers-x32: [1EldosIconOverlay] -> {41BE046E-2BF0-47C9-BBD6-286B605AC23F} => C:\Windows\System32\CbFsMntNtf3.dll [2012-04-09] (EldoS Corporation)
ShellIconOverlayIdentifiers-x32: [EldosIconOverlay] -> {5BB532A2-BF14-4CCC-86B7-71B81EF6F8BC} => C:\Windows\system32\CbFsMntNtf3.dll [2012-04-09] (EldoS Corporation)
ContextMenuHandlers1: [Adobe.Acrobat.ContextMenu] -> {D25B2CAB-8A9A-4517-A9B2-CB5F68A5A802} => C:\Program Files (x86)\Adobe\Acrobat 9.0\Acrobat\..\Acrobat Elements\ContextMenu64.dll [2008-06-11] (Adobe Systems Inc.)
ContextMenuHandlers1: [BUContextMenu] -> {F7CAA2A1-67A2-44BB-B20F-202FD8EB1DAB} => C:\Program Files\Symantec.cloud\EndpointProtectionAgent\Engine\22.9.3.13\buShell.dll [2017-05-11] (Symantec Corporation)
ContextMenuHandlers1: [DropboxExt] -> {ECD97DE5-3C8F-4ACB-AEEE-CCAB78F7711C} => C:\Program Files (x86)\Dropbox\Client\DropboxExt64.18.0.dll [2017-09-20] (Dropbox, Inc.)
ContextMenuHandlers1: [PhotoStreamsExt] -> {89D984B3-813B-406A-8298-118AFA3A22AE} => C:\Program Files\Common Files\Apple\Internet Services\ShellStreams64.dll [2017-09-18] (Apple Inc.)
ContextMenuHandlers1: [Symantec.Norton.Antivirus.IEContextMenu] -> {FAD61B3D-699D-49B2-BE16-7F82CB4C59CA} => C:\Program Files\Symantec.cloud\EndpointProtectionAgent\Engine\22.9.3.13\NavShExt.dll [2017-05-11] (Symantec Corporation)
ContextMenuHandlers2: [Symantec.Norton.Antivirus.IEContextMenu] -> {FAD61B3D-699D-49B2-BE16-7F82CB4C59CA} => C:\Program Files\Symantec.cloud\EndpointProtectionAgent\Engine\22.9.3.13\NavShExt.dll [2017-05-11] (Symantec Corporation)
ContextMenuHandlers3: [MBAMShlExt] -> {57CE581A-0CB6-4266-9CA0-19364C90A0B3} => C:\Program Files (x86)\Malwarebytes Anti-Malware\mbamext.dll [2016-03-10] (Malwarebytes)
ContextMenuHandlers4: [DropboxExt] -> {ECD97DE5-3C8F-4ACB-AEEE-CCAB78F7711C} => C:\Program Files (x86)\Dropbox\Client\DropboxExt64.18.0.dll [2017-09-20] (Dropbox, Inc.)
ContextMenuHandlers5: [ACE] -> {5E2121EE-0300-11D4-8D3B-444553540000} => C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\atiacm64.dll [2013-12-06] (Advanced Micro Devices, Inc.)
ContextMenuHandlers5: [DropboxExt] -> {ECD97DE5-3C8F-4ACB-AEEE-CCAB78F7711C} => C:\Program Files (x86)\Dropbox\Client\DropboxExt64.18.0.dll [2017-09-20] (Dropbox, Inc.)
ContextMenuHandlers5: [igfxcui] -> {3AB1675A-CCFF-11D2-8B20-00A0C93CB1F4} => -> No File
ContextMenuHandlers5: [igfxDTCM] -> {9B5F5829-A529-4B12-814A-E81BCB8D93FC} => C:\Windows\system32\igfxDTCM.dll [2015-09-23] (Intel Corporation)
ContextMenuHandlers6: [Adobe.Acrobat.ContextMenu] -> {D25B2CAB-8A9A-4517-A9B2-CB5F68A5A802} => C:\Program Files (x86)\Adobe\Acrobat 9.0\Acrobat\..\Acrobat Elements\ContextMenu64.dll [2008-06-11] (Adobe Systems Inc.)
ContextMenuHandlers6: [BUContextMenu] -> {F7CAA2A1-67A2-44BB-B20F-202FD8EB1DAB} => C:\Program Files\Symantec.cloud\EndpointProtectionAgent\Engine\22.9.3.13\buShell.dll [2017-05-11] (Symantec Corporation)
ContextMenuHandlers6: [MBAMShlExt] -> {57CE581A-0CB6-4266-9CA0-19364C90A0B3} => C:\Program Files (x86)\Malwarebytes Anti-Malware\mbamext.dll [2016-03-10] (Malwarebytes)
ContextMenuHandlers6: [Symantec.Norton.Antivirus.IEContextMenu] -> {FAD61B3D-699D-49B2-BE16-7F82CB4C59CA} => C:\Program Files\Symantec.cloud\EndpointProtectionAgent\Engine\22.9.3.13\NavShExt.dll [2017-05-11] (Symantec Corporation)

==================== Scheduled Tasks (Whitelisted) =============

(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)

Task: {15E96D23-EFAF-41A0-8FB2-CD88851D91FC} - System32\Tasks\Dell\Command Update => C:\Program Files (x86)\Dell\CommandUpdate\DellCommandUpdate.exe [2015-05-27] (Dell Inc.)
Task: {1681DB7C-7F2E-4183-9BD5-73D5A860BBCF} - System32\Tasks\Remediation\AntimalwareMigrationTask => C:\Program Files\Common Files\AV\Symantec Endpoint Protection.cloud\Upgrade.exe [2017-05-11] (Symantec Corporation)
Task: {1FF8048D-FD1F-4005-B8FD-CF4118F0BB26} - System32\Tasks\Endpoint Protection.cloud\Symantec Endpoint Protection.cloud Error Analyzer => C:\Program Files\Symantec.cloud\EndpointProtectionAgent\Engine\22.9.3.13\SymErr.exe [2017-05-11] (Symantec Corporation)
Task: {35419BFB-D4D4-4686-929A-641D92C1E165} - System32\Tasks\Adobe Flash Player Updater => C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe [2017-09-12] (Adobe Systems Incorporated)
Task: {41E4F690-5E35-4F01-9184-5F2EEC006493} - System32\Tasks\DropboxUpdateTaskMachineCore => C:\Program Files (x86)\Dropbox\Update\DropboxUpdate.exe [2016-11-04] (Dropbox, Inc.)
Task: {44BA33F3-F768-486A-BF8F-5E28AB801E25} - System32\Tasks\DropboxUpdateTaskMachineUA => C:\Program Files (x86)\Dropbox\Update\DropboxUpdate.exe [2016-11-04] (Dropbox, Inc.)
Task: {5267FF29-769B-41F6-9EEE-5A800525B62F} - System32\Tasks\GoogleUpdateTaskMachineUA => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe [2015-08-27] (Google Inc.)
Task: {6C1276EA-1299-437E-9355-8806DC071B0A} - System32\Tasks\{AC425748-F038-4F3C-B247-6AA2D4F7AF58} => C:\Windows\system32\pcalua.exe -a "C:\Manufacturer Data\Childcare Manager\CCM-Server_Setup(V10.0.2905).exe" -d C:\Windows\SysWOW64 -c /embed"{F1FA4930-DCA2-4425-B937-D373AD863961}" /hide_splash /hide_progress /runprerequisites"Help,Reports,ChildcareManager,ProgramFiles,Manual,NetworkServer" /l1033
Task: {71412F38-C94F-4D1E-ADB3-251B67A1493E} - System32\Tasks\Microsoft\Office\Office 15 Subscription Heartbeat => C:\Program Files\Common Files\Microsoft Shared\Office15\OLicenseHeartbeat.exe [2014-01-23] (Microsoft Corporation)
Task: {7AC03665-F4C7-42C8-AF2A-61114D1AD294} - System32\Tasks\Adobe Acrobat Update Task => C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe [2017-07-19] (Adobe Systems Incorporated)
Task: {80CF1F73-3F4F-4254-A824-954DEAA1E314} - System32\Tasks\G2MUploadTask-S-1-5-21-1447001783-2274183133-4180765549-1206 => C:\Users\Maria.davis\AppData\Local\GoToMeeting\7716\g2mupload.exe [2017-09-29] (LogMeIn, Inc.)
Task: {80EAAAE9-8075-48F6-92BD-FC1673F9A528} - System32\Tasks\Microsoft\Office\OfficeTelemetryAgentLogOn => C:\Program Files\Microsoft Office\Office15\msoia.exe [2014-01-23] (Microsoft Corporation)
Task: {81A8B8EF-4C6B-4732-8A1E-BD2C3FD6BF97} - System32\Tasks\QBScheduledReport => C:\Program Files (x86)\Common Files\Intuit\QuickBooks\ScheduledReports\ScheduledReports.Scheduler.exe [2016-12-03] ()
Task: {93E1DAB1-95E3-4FCC-B280-59EF9942EA49} - System32\Tasks\Microsoft\Microsoft Antimalware\Microsoft Antimalware Scheduled Scan => c:\Program Files\Microsoft Security Client\\MpCmdRun.exe
Task: {9DEFC7DE-5E5B-45E3-B4E4-A752A121E28F} - System32\Tasks\G2MUpdateTask-S-1-5-21-1447001783-2274183133-4180765549-1206 => C:\Users\Maria.davis\AppData\Local\GoToMeeting\7716\g2mupdate.exe [2017-09-29] (LogMeIn, Inc.)
Task: {9EB0699C-B222-4B53-9918-369259A3BF6F} - System32\Tasks\Endpoint Protection.cloud\Symantec Endpoint Protection.cloud Error Processor => C:\Program Files\Symantec.cloud\EndpointProtectionAgent\Engine\22.9.3.13\SymErr.exe [2017-05-11] (Symantec Corporation)
Task: {A6DF2D71-FCA6-47DD-A47E-E9EC3CCB79EE} - System32\Tasks\Norton WSC Integration => C:\Program Files\Symantec.cloud\EndpointProtectionAgent\Engine\22.9.3.13\WSCStub.exe [2017-05-11] (Symantec Corporation)
Task: {AD17C2DD-EC6B-443F-A7C0-72702D20C9C4} - System32\Tasks\GoogleUpdateTaskMachineCore => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe [2015-08-27] (Google Inc.)
Task: {C5F0EE36-5D5F-4CB7-BEF7-F6C32DE2980C} - System32\Tasks\AVAST Software\Avast settings backup => C:\Program Files\Common Files\AV\avast! Antivirus\backup.exe [2017-07-13] (AVAST Software)
Task: {CCCE428D-9DA6-4E09-B3F1-952E75D90287} - System32\Tasks\avast! Emergency Update => C:\Program Files\AVAST Software\Avast Business\AvastEmUpdate.exe
Task: {DA16953D-935A-4D33-950A-664AE26EE7C3} - System32\Tasks\Apple\AppleSoftwareUpdate => C:\Program Files (x86)\Apple Software Update\SoftwareUpdate.exe [2017-07-24] (Apple Inc.)
Task: {DBD2636A-7B4B-4384-8A01-049BA28E3528} - System32\Tasks\{F1813929-4853-4128-A138-D95F2093FEC9} => C:\Windows\system32\pcalua.exe -a "C:\Manufacturer Data\HP\HP Adjustment Pattern Utility sp47515.exe" -d "C:\Manufacturer Data\HP"
Task: {EEA3BA83-421F-4192-9CFE-70021A711E8A} - System32\Tasks\{81C6E50A-5986-4004-9EB6-A0D30C3BE888} => C:\Program Files\Microsoft Office\Office15\OUTLOOK.EXE [2017-08-15] (Microsoft Corporation)
Task: {FA4526E6-96F3-409A-BC79-7759E0B58B2C} - System32\Tasks\{101D29CD-2893-4D4E-ABB8-D4F650EB0F71} => C:\Windows\system32\pcalua.exe -a "C:\Manufacturer Data\HP\HP LCD First-Aid Utility sp60004.exe" -d "C:\Manufacturer Data\HP"
Task: {FBDAD7C8-2E48-4BF1-8F5D-9C32713CE3E7} - System32\Tasks\Microsoft\Office\OfficeTelemetryAgentFallBack => C:\Program Files\Microsoft Office\Office15\msoia.exe [2014-01-23] (Microsoft Corporation)
Task: {FFD42BF5-159A-4619-88F8-D92B6FA186CC} - System32\Tasks\{E0DE1E1D-4780-4831-89B4-4978CD15BF48} => C:\Windows\system32\pcalua.exe -a "C:\Manufacturer Data\HP\W2558HC LCD Monitor Driver sp35375.exe" -d "C:\Manufacturer Data\HP"

(If an entry is included in the fixlist, the task (.job) file will be moved. The file which is running by the task will not be moved.)

Task: C:\Windows\Tasks\DropboxUpdateTaskMachineCore.job => C:\Program Files (x86)\Dropbox\Update\DropboxUpdate.exe
Task: C:\Windows\Tasks\DropboxUpdateTaskMachineUA.job => C:\Program Files (x86)\Dropbox\Update\DropboxUpdate.exe
Task: C:\Windows\Tasks\G2MUpdateTask-S-1-5-21-1447001783-2274183133-4180765549-1206.job => C:\Users\Maria.davis\AppData\Local\GoToMeeting\7716\g2mupdate.exe C:\Users\Maria.davis\AppData\Local\GoToMeeting\7716Maria.dav
Task: C:\Windows\Tasks\G2MUploadTask-S-1-5-21-1447001783-2274183133-4180765549-1206.job => C:\Users\Maria.davis\AppData\Local\GoToMeeting\7716\g2mupload.exe C:\Users\Maria.davis\AppData\Local\GoToMeeting\7716Maria.dav

==================== Shortcuts & WMI ========================

(The entries could be listed to be restored or removed.)


==================== Loaded Modules (Whitelisted) ==============

2017-04-16 15:24 - 2017-08-16 02:07 - 000020208 _____ () C:\Windows\system32\spool\PRTPROCS\x64\TeamViewer_PrintProcessor.dll
2017-09-01 02:49 - 2017-09-01 02:49 - 001356088 _____ () C:\Program Files\Common Files\Apple\Apple Application Support\libxml2.dll
2016-09-01 18:12 - 2016-09-01 18:12 - 000092472 _____ () C:\Program Files\Common Files\Apple\Apple Application Support\zlib1.dll
2010-05-14 12:59 - 2010-05-14 12:59 - 000455944 _____ () C:\Program Files (x86)\Flip Video\FlipShare\FlipShareService.exe
2017-02-23 08:29 - 2017-02-23 08:29 - 008909512 _____ () C:\Program Files\Microsoft Office\Office15\1033\GrooveIntlResource.dll
2007-07-23 15:05 - 2007-07-23 15:05 - 000066544 _____ () C:\Program Files\Roxio\Drag-to-Disc\DLAAPI_W.DLL
2017-09-11 14:45 - 2017-09-11 14:45 - 001356088 _____ () C:\Program Files\iTunes\libxml2.dll
2017-09-11 14:45 - 2017-09-11 14:45 - 000092472 _____ () C:\Program Files\iTunes\zlib1.dll
2017-09-26 15:14 - 2017-09-21 00:29 - 004022616 _____ () C:\Program Files (x86)\Google\Chrome\Application\61.0.3163.100\libglesv2.dll
2017-09-26 15:14 - 2017-09-21 00:29 - 000100184 _____ () C:\Program Files (x86)\Google\Chrome\Application\61.0.3163.100\libegl.dll
2010-05-14 12:38 - 2010-05-14 12:38 - 001581056 _____ () C:\Program Files (x86)\Flip Video\FlipShare\QtCore4.dll
2010-05-14 12:49 - 2010-05-14 12:49 - 002519040 _____ () C:\Program Files (x86)\Flip Video\FlipShare\Core.dll
2010-05-14 12:38 - 2010-05-14 12:38 - 000188416 _____ () C:\Program Files (x86)\Flip Video\FlipShare\QtSql4.dll
2010-05-14 12:38 - 2010-05-14 12:38 - 000356352 _____ () C:\Program Files (x86)\Flip Video\FlipShare\QtXml4.dll
2010-05-14 12:38 - 2010-05-14 12:38 - 006443008 _____ () C:\Program Files (x86)\Flip Video\FlipShare\QtGui4.dll
2010-05-14 12:41 - 2010-05-14 12:41 - 000708608 _____ () C:\Program Files (x86)\Flip Video\FlipShare\qca2.dll
2017-10-03 12:52 - 2017-10-03 12:52 - 003629248 ____R () C:\Users\Maria.davis\AppData\Local\Temp\STSFX7C61\SmrDll.dll
2017-09-01 02:49 - 2017-09-01 02:49 - 001042232 _____ () C:\Program Files (x86)\Common Files\Apple\Apple Application Support\libxml2.dll
2016-09-01 18:13 - 2016-09-01 18:13 - 000080184 _____ () C:\Program Files (x86)\Common Files\Apple\Apple Application Support\zlib1.dll
2017-09-01 02:49 - 2017-09-01 02:49 - 000189752 _____ () C:\Program Files (x86)\Common Files\Apple\Apple Application Support\libxslt.dll
2017-02-23 08:29 - 2017-02-23 08:29 - 008909512 _____ () C:\Program Files (x86)\Microsoft Office\Office15\1033\GrooveIntlResource.dll
2017-09-21 12:09 - 2017-09-20 09:48 - 000771904 _____ () C:\Program Files (x86)\Dropbox\Client\dropbox_watchdog.dll
2017-09-21 12:09 - 2017-09-20 09:48 - 001804608 _____ () C:\Program Files (x86)\Dropbox\Client\dropbox_crashpad.dll
2017-09-21 12:09 - 2017-09-20 09:49 - 000023872 _____ () C:\Program Files (x86)\Dropbox\Client\dropbox_bootstrap.dll
2015-12-12 14:12 - 2017-09-20 09:48 - 000100296 _____ () C:\Program Files (x86)\Dropbox\Client\_ctypes.pyd
2015-12-12 14:12 - 2017-09-20 09:48 - 000018888 _____ () C:\Program Files (x86)\Dropbox\Client\select.pyd
2015-12-12 14:12 - 2017-09-20 09:50 - 000020800 _____ () C:\Program Files (x86)\Dropbox\Client\tornado.speedups.pyd
2015-12-12 14:12 - 2017-09-20 09:48 - 000035792 _____ () C:\Program Files (x86)\Dropbox\Client\_multiprocessing.pyd
2017-09-21 12:09 - 2017-09-20 09:49 - 000021848 _____ () C:\Program Files (x86)\Dropbox\Client\cryptography.hazmat.bindings._constant_time.pyd
2015-12-12 14:12 - 2017-09-20 09:48 - 000125904 _____ () C:\Program Files (x86)\Dropbox\Client\_cffi_backend.pyd
2015-12-12 14:12 - 2017-09-20 09:48 - 000694224 _____ () C:\Program Files (x86)\Dropbox\Client\unicodedata.pyd
2017-09-21 12:09 - 2017-09-20 09:49 - 001862992 _____ () C:\Program Files (x86)\Dropbox\Client\cryptography.hazmat.bindings._openssl.pyd
2017-09-21 12:09 - 2017-09-20 09:49 - 000022864 _____ () C:\Program Files (x86)\Dropbox\Client\cryptography.hazmat.bindings._padding.pyd
2017-09-21 12:09 - 2017-09-20 09:48 - 000145864 _____ () C:\Program Files (x86)\Dropbox\Client\pyexpat.pyd
2017-09-21 12:09 - 2017-09-20 09:48 - 000116688 _____ () C:\Program Files (x86)\Dropbox\Client\pywintypes27.dll
2015-12-12 14:12 - 2017-09-20 09:48 - 000105928 _____ () C:\Program Files (x86)\Dropbox\Client\win32api.pyd
2016-08-05 11:34 - 2017-09-20 09:50 - 000022864 _____ () C:\Program Files (x86)\Dropbox\Client\winffi.crt.compiled._winffi_crt.pyd
2017-09-21 12:09 - 2017-09-20 09:49 - 000062784 _____ () C:\Program Files (x86)\Dropbox\Client\psutil._psutil_windows.pyd
2015-12-12 14:12 - 2017-09-20 09:48 - 000024528 _____ () C:\Program Files (x86)\Dropbox\Client\win32event.pyd
2017-09-21 12:09 - 2017-09-20 09:49 - 000040248 _____ () C:\Program Files (x86)\Dropbox\Client\fastpath.pyd
2017-09-21 12:09 - 2017-09-20 09:48 - 000020936 _____ () C:\Program Files (x86)\Dropbox\Client\mmapfile.pyd
2015-12-12 14:12 - 2017-09-20 09:48 - 000124880 _____ () C:\Program Files (x86)\Dropbox\Client\win32file.pyd
2015-12-12 14:12 - 2017-09-20 09:48 - 000116176 _____ () C:\Program Files (x86)\Dropbox\Client\win32security.pyd
2017-09-21 12:09 - 2017-09-20 09:48 - 000392656 _____ () C:\Program Files (x86)\Dropbox\Client\pythoncom27.dll
2015-12-12 14:12 - 2017-09-20 09:50 - 000392512 _____ () C:\Program Files (x86)\Dropbox\Client\win32com.shell.shell.pyd
2016-08-05 11:34 - 2017-09-20 09:50 - 000026456 _____ () C:\Program Files (x86)\Dropbox\Client\winffi.kernel32.compiled._winffi_kernel32.pyd
2015-12-12 14:12 - 2017-09-20 09:48 - 000024016 _____ () C:\Program Files (x86)\Dropbox\Client\win32clipboard.pyd
2015-12-12 14:12 - 2017-09-20 09:48 - 000175560 _____ () C:\Program Files (x86)\Dropbox\Client\win32gui.pyd
2015-12-12 14:12 - 2017-09-20 09:48 - 000030160 _____ () C:\Program Files (x86)\Dropbox\Client\win32pipe.pyd
2015-12-12 14:12 - 2017-09-20 09:48 - 000043472 _____ () C:\Program Files (x86)\Dropbox\Client\win32process.pyd
2017-09-21 12:09 - 2017-09-20 09:48 - 000026056 _____ () C:\Program Files (x86)\Dropbox\Client\win32job.pyd
2015-12-12 14:12 - 2017-09-20 09:48 - 000048592 _____ () C:\Program Files (x86)\Dropbox\Client\win32service.pyd
2015-12-12 14:12 - 2017-09-20 09:48 - 000057808 _____ () C:\Program Files (x86)\Dropbox\Client\win32evtlog.pyd
2017-09-21 12:09 - 2017-09-20 09:49 - 000022336 _____ () C:\Program Files (x86)\Dropbox\Client\cpuid.compiled._cpuid.pyd
2017-09-06 15:07 - 2017-09-20 09:50 - 000023368 _____ () C:\Program Files (x86)\Dropbox\Client\winshell.compiled._winshell.pyd
2017-09-21 12:09 - 2017-09-20 09:49 - 000023368 _____ () C:\Program Files (x86)\Dropbox\Client\crashpad.compiled._Crashpad.pyd
2017-05-17 10:10 - 2017-09-20 09:50 - 000082264 _____ () C:\Program Files (x86)\Dropbox\Client\winenumhandles.compiled._WinEnumHandles.pyd
2015-12-12 14:12 - 2017-09-20 09:50 - 000025432 _____ () C:\Program Files (x86)\Dropbox\Client\winscreenshot.compiled._CaptureScreenshot.pyd
2015-12-12 14:12 - 2017-09-20 09:48 - 000028616 _____ () C:\Program Files (x86)\Dropbox\Client\win32ts.pyd
2015-12-12 14:12 - 2017-09-20 09:48 - 000024016 _____ () C:\Program Files (x86)\Dropbox\Client\win32profile.pyd
2017-09-21 12:09 - 2017-09-20 09:49 - 001796920 _____ () C:\Program Files (x86)\Dropbox\Client\PyQt5.QtCore.pyd
2015-12-12 14:12 - 2017-09-20 09:48 - 000084424 _____ () C:\Program Files (x86)\Dropbox\Client\sip.pyd
2017-09-21 12:09 - 2017-09-20 09:49 - 001956152 _____ () C:\Program Files (x86)\Dropbox\Client\PyQt5.QtGui.pyd
2017-09-21 12:09 - 2017-09-20 09:50 - 003859264 _____ () C:\Program Files (x86)\Dropbox\Client\PyQt5.QtWidgets.pyd
2017-09-21 12:09 - 2017-09-20 09:50 - 000154440 _____ () C:\Program Files (x86)\Dropbox\Client\PyQt5.QtWebEngineWidgets.pyd
2017-09-21 12:09 - 2017-09-20 09:49 - 000521024 _____ () C:\Program Files (x86)\Dropbox\Client\PyQt5.QtNetwork.pyd
2017-09-21 12:09 - 2017-09-20 09:50 - 000045888 _____ () C:\Program Files (x86)\Dropbox\Client\PyQt5.QtWebEngineCore.pyd
2017-09-21 12:09 - 2017-09-20 09:50 - 000042304 _____ () C:\Program Files (x86)\Dropbox\Client\PyQt5.QtWebChannel.pyd
2017-09-21 12:09 - 2017-09-20 09:50 - 000131384 _____ () C:\Program Files (x86)\Dropbox\Client\PyQt5.QtWebKit.pyd
2017-09-21 12:09 - 2017-09-20 09:50 - 000218944 _____ () C:\Program Files (x86)\Dropbox\Client\PyQt5.QtWebKitWidgets.pyd
2017-09-21 12:09 - 2017-09-20 09:49 - 000204096 _____ () C:\Program Files (x86)\Dropbox\Client\PyQt5.QtPrintSupport.pyd
2015-12-12 14:12 - 2017-09-20 09:48 - 000060880 _____ () C:\Program Files (x86)\Dropbox\Client\win32print.pyd
2017-02-27 16:37 - 2017-09-20 09:50 - 000054608 _____ () C:\Program Files (x86)\Dropbox\Client\winrpcserver.compiled._RPCServer.pyd
2017-01-23 16:29 - 2017-09-20 09:50 - 000022864 _____ () C:\Program Files (x86)\Dropbox\Client\winffi.user32.compiled._winffi_user32.pyd
2017-01-23 16:29 - 2017-09-20 09:50 - 000022872 _____ () C:\Program Files (x86)\Dropbox\Client\winffi.iphlpapi.compiled._winffi_iphlpapi.pyd
2017-01-23 16:29 - 2017-09-20 09:50 - 000021848 _____ () C:\Program Files (x86)\Dropbox\Client\winffi.winerror.compiled._winffi_winerror.pyd
2017-01-23 16:29 - 2017-09-20 09:50 - 000022872 _____ () C:\Program Files (x86)\Dropbox\Client\winffi.wininet.compiled._winffi_wininet.pyd
2017-09-21 12:09 - 2017-09-20 09:49 - 000027488 _____ () C:\Program Files (x86)\Dropbox\Client\dropbox.infinite.win.compiled._driverinstallation.pyd
2015-12-12 14:12 - 2017-09-20 09:48 - 000349128 _____ () C:\Program Files (x86)\Dropbox\Client\winxpgui.pyd
2016-02-18 20:53 - 2017-09-20 09:50 - 000023896 _____ () C:\Program Files (x86)\Dropbox\Client\winverifysignature.compiled._VerifySignature.pyd
2017-09-21 12:09 - 2017-09-20 09:49 - 000025936 _____ () C:\Program Files (x86)\Dropbox\Client\librsyncffi.compiled._librsyncffi.pyd
2017-09-21 12:09 - 2017-09-20 09:48 - 000036296 _____ () C:\Program Files (x86)\Dropbox\Client\librsync.dll
2017-09-21 12:09 - 2017-09-20 09:49 - 000181056 _____ () C:\Program Files (x86)\Dropbox\Client\dropbox_sqlite_ext.DLL
2016-07-11 14:31 - 2017-09-20 09:50 - 000030536 _____ () C:\Program Files (x86)\Dropbox\Client\wind3d11.compiled._wind3d11.pyd
2017-09-21 12:09 - 2017-09-20 09:49 - 000024368 _____ () C:\Program Files (x86)\Dropbox\Client\libEGL.DLL
2017-09-21 12:09 - 2017-09-20 09:49 - 001638200 _____ () C:\Program Files (x86)\Dropbox\Client\libGLESv2.dll
2016-08-05 11:34 - 2017-09-20 09:50 - 000026456 _____ () C:\Program Files (x86)\Dropbox\Client\winffi.winhttp.compiled._winffi_winhttp.pyd
2017-09-21 12:09 - 2017-09-20 09:50 - 000545080 _____ () C:\Program Files (x86)\Dropbox\Client\PyQt5.QtQuick.pyd
2017-09-21 12:09 - 2017-09-20 09:50 - 000359224 _____ () C:\Program Files (x86)\Dropbox\Client\PyQt5.QtQml.pyd
2017-09-21 12:09 - 2017-09-20 09:50 - 000038208 _____ () C:\Program Files (x86)\Dropbox\Client\PyQt5.QtWebEngine.pyd
2017-03-07 00:41 - 2017-03-07 00:41 - 000630784 _____ () C:\Program Files (x86)\Intuit\QuickBooks 2017\boost_regex-vc120-mt-1_55.dll
2017-03-07 02:43 - 2017-03-07 02:43 - 000253104 _____ () C:\Program Files (x86)\Intuit\QuickBooks 2017\DiscoManager.dll
2017-03-07 02:44 - 2017-03-07 02:44 - 000038576 _____ () C:\Program Files (x86)\Intuit\QuickBooks 2017\QBCompressor.dll
2017-03-07 02:45 - 2017-03-07 02:45 - 000073392 _____ () C:\Program Files (x86)\Intuit\QuickBooks 2017\zlib1.dll
2017-03-07 02:44 - 2017-03-07 02:44 - 000109232 _____ () C:\Program Files (x86)\Intuit\QuickBooks 2017\QBMAPILibrary.dll
2017-03-07 02:43 - 2017-03-07 02:43 - 000252592 _____ () C:\Program Files (x86)\Intuit\QuickBooks 2017\boost_serialization-vc120-mt-1_55.dll
2017-03-07 02:43 - 2017-03-07 02:43 - 000617136 _____ () C:\Program Files (x86)\Intuit\QuickBooks 2017\FtuEngine.dll
2017-03-07 02:43 - 2017-03-07 02:43 - 000698032 _____ () C:\Program Files (x86)\Intuit\QuickBooks 2017\BackupLib.dll
2017-03-07 02:44 - 2017-03-07 02:44 - 000091312 _____ () C:\Program Files (x86)\Intuit\QuickBooks 2017\QBProActiveCore.dll
2017-03-07 01:41 - 2017-03-07 01:41 - 052036096 _____ () C:\Program Files (x86)\Intuit\QuickBooks 2017\libcef.dll
2017-03-07 02:43 - 2017-03-07 02:43 - 000124080 _____ () C:\Program Files (x86)\Intuit\QuickBooks 2017\ConfigEngineInterop.dll
2017-03-07 02:43 - 2017-09-15 00:58 - 001338544 _____ () C:\Program Files (x86)\Intuit\QuickBooks 2017\FeaturesBridge.dll
2017-03-07 02:44 - 2017-03-07 02:44 - 000074928 _____ () C:\Program Files (x86)\Intuit\QuickBooks 2017\mbpopup.dll
2014-04-03 16:48 - 2014-04-03 16:48 - 001241560 _____ () C:\Program Files (x86)\Intel\Intel® Management Engine Components\LMS\ACE.dll

==================== Alternate Data Streams (Whitelisted) =========

(If an entry is included in the fixlist, only the ADS will be removed.)


==================== Safe Mode (Whitelisted) ===================

(If an entry is included in the fixlist, it will be removed from the registry. The "AlternateShell" will be restored.)


==================== Association (Whitelisted) ===============

(If an entry is included in the fixlist, the registry item will be restored to default or removed.)


==================== Internet Explorer trusted/restricted ===============

(If an entry is included in the fixlist, it will be removed from the registry.)

IE trusted site: HKU\S-1-5-21-1447001783-2274183133-4180765549-1206\...\dell.com -> dell.com
IE trusted site: HKU\S-1-5-21-1447001783-2274183133-4180765549-1206\...\unionbank.com -> hxxps://unionbank.com

==================== Hosts content: ===============================

(If needed Hosts: directive could be included in the fixlist to reset Hosts.)

2009-07-13 19:34 - 2009-06-10 14:00 - 000000824 _____ C:\Windows\system32\Drivers\etc\hosts


==================== Other Areas ============================

(Currently there is no automatic fix for this section.)

HKU\S-1-5-21-1447001783-2274183133-4180765549-1206\Control Panel\Desktop\\Wallpaper -> C:\Users\Maria.davis\AppData\Roaming\Microsoft\Windows\Themes\TranscodedWallpaper.jpg
HKU\S-1-5-21-4206511477-2807538862-2280937620-1000\Control Panel\Desktop\\Wallpaper -> C:\Users\Maria\AppData\Roaming\Microsoft\Windows\Themes\TranscodedWallpaper.jpg
DNS Servers: 192.168.1.220
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System => (ConsentPromptBehaviorAdmin: 5) (ConsentPromptBehaviorUser: 3) (EnableLUA: 1)
Windows Firewall is enabled.

==================== MSCONFIG/TASK MANAGER disabled items ==


==================== FirewallRules (Whitelisted) ===============

(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)

FirewallRules: [SPPSVC-In-TCP] => (Allow) %SystemRoot%\system32\sppsvc.exe
FirewallRules: [SPPSVC-In-TCP-NoScope] => (Allow) %SystemRoot%\system32\sppsvc.exe
FirewallRules: [{D03FBFD5-BDA4-4A2F-A4BD-4E8060FFDBCB}] => (Allow) C:\Program Files\Microsoft Office\Office15\lync.exe
FirewallRules: [{14B18A0F-2272-47FD-B481-29A80FA8B644}] => (Allow) C:\Program Files\Microsoft Office\Office15\lync.exe
FirewallRules: [{A3CF78D2-5D0F-45C0-AD46-3BDBA98E08AF}] => (Allow) C:\Program Files\Microsoft Office\Office15\UcMapi.exe
FirewallRules: [{22812A14-4358-4316-B790-A6512E3CB77C}] => (Allow) C:\Program Files\Microsoft Office\Office15\UcMapi.exe
FirewallRules: [{00FE6A2E-BDC6-442F-8AC2-D9908DC0E75E}] => (Allow) C:\Program Files (x86)\Skype\Phone\Skype.exe
FirewallRules: [TCP Query User{43943F46-BB4F-4A9B-8448-7E60E8C50623}C:\program files (x86)\acs\acs\acs.exe] => (Allow) C:\program files (x86)\acs\acs\acs.exe
FirewallRules: [UDP Query User{A9189961-2CD5-4C57-99A9-48BB8B78D3C1}C:\program files (x86)\acs\acs\acs.exe] => (Allow) C:\program files (x86)\acs\acs\acs.exe
FirewallRules: [TCP Query User{36DD09F6-38EF-4D89-9406-0FCC5B3E5072}C:\program files (x86)\pivotprograms\cms\cms.exe] => (Allow) C:\program files (x86)\pivotprograms\cms\cms.exe
FirewallRules: [UDP Query User{B704E720-E410-48E7-AF8B-3E4B7DF8C069}C:\program files (x86)\pivotprograms\cms\cms.exe] => (Allow) C:\program files (x86)\pivotprograms\cms\cms.exe
FirewallRules: [{839E56E4-11D8-44EA-87A9-C0BB1BFF7FC4}] => (Allow) C:\Program Files\Bonjour\mDNSResponder.exe
FirewallRules: [{0DEE2503-9959-43C5-8C16-42744C2D6C0E}] => (Allow) C:\Program Files\Bonjour\mDNSResponder.exe
FirewallRules: [{E12837D4-104F-48F4-9512-D6D654D0CCBE}] => (Allow) C:\Program Files (x86)\Bonjour\mDNSResponder.exe
FirewallRules: [{E7387861-C280-4418-AE28-775961B17013}] => (Allow) C:\Program Files (x86)\Bonjour\mDNSResponder.exe
FirewallRules: [{9F59B6EE-A26E-4770-848A-00A9D16A982A}] => (Allow) C:\Program Files (x86)\NCR\Passport Web Edition\pwecsrvc.exe
FirewallRules: [{A8973157-C3D8-40C6-B90C-7E78044045ED}] => (Allow) C:\Program Files (x86)\NCR\Passport Web Edition\pwecsrvc.exe
FirewallRules: [TCP Query User{1A9ACFB4-667C-4707-9611-7A4770AA11D4}C:\users\maria.davis\appdata\roaming\sdrive\sdrive.exe] => (Allow) C:\users\maria.davis\appdata\roaming\sdrive\sdrive.exe
FirewallRules: [UDP Query User{0B1F5B22-5F88-4A02-9231-6F00571BB4B7}C:\users\maria.davis\appdata\roaming\sdrive\sdrive.exe] => (Allow) C:\users\maria.davis\appdata\roaming\sdrive\sdrive.exe
FirewallRules: [{AB86D24B-1480-47CF-AEF9-B111CF19AF42}] => (Allow) C:\Program Files\Bonjour\mDNSResponder.exe
FirewallRules: [{CF7D559F-9695-49BF-9EB8-CAB0EAEAC330}] => (Allow) C:\Program Files\Bonjour\mDNSResponder.exe
FirewallRules: [{B4518E21-8212-4DF5-9F91-66370CD0850E}] => (Allow) C:\Program Files (x86)\Bonjour\mDNSResponder.exe
FirewallRules: [{CF1299D7-AEA1-4F06-9855-66F6616B5CF7}] => (Allow) C:\Program Files (x86)\Bonjour\mDNSResponder.exe
FirewallRules: [{3709A257-39B2-4BBC-87DF-C7DCB7E9C55C}] => (Allow) LPort=1434
FirewallRules: [{63577FCB-466F-4437-9732-8828674DD3A6}] => (Allow) LPort=8085
FirewallRules: [{CE7B94B6-40A7-480B-A958-5E2EDAD979A5}] => (Allow) C:\Program Files (x86)\Mozilla Firefox\firefox.exe
FirewallRules: [{ADFFF518-C9BE-4427-BAFD-6962912A49D5}] => (Allow) C:\Program Files (x86)\Mozilla Firefox\firefox.exe
FirewallRules: [TCP Query User{5CF66709-C66C-4C5D-A95C-7E4D558745B2}C:\program files (x86)\ncr\passport web edition\pwecsrvc.exe] => (Allow) C:\program files (x86)\ncr\passport web edition\pwecsrvc.exe
FirewallRules: [UDP Query User{D64D42C3-75C7-42C5-854A-485C8128520D}C:\program files (x86)\ncr\passport web edition\pwecsrvc.exe] => (Allow) C:\program files (x86)\ncr\passport web edition\pwecsrvc.exe
FirewallRules: [{83A6D930-A485-451F-8273-B378B98EF7E4}] => (Allow) C:\Program Files (x86)\NCR\Passport Web Edition\pwecsrvc.exe
FirewallRules: [{D8B6E249-3637-4B90-9C35-0D64BFB0D5BC}] => (Allow) C:\Program Files (x86)\NCR\Passport Web Edition\pwecsrvc.exe
FirewallRules: [{5251C72E-85D8-4489-BCC2-23B63CEA5A37}] => (Allow) C:\Program Files\Microsoft Office\Office15\lync.exe
FirewallRules: [{E5D9AF16-064D-4816-9959-E882A0B23618}] => (Allow) C:\Program Files\Microsoft Office\Office15\lync.exe
FirewallRules: [{67C2E6F6-36C0-4BE5-BDD3-9E261337B45D}] => (Allow) C:\Program Files\Microsoft Office\Office15\UcMapi.exe
FirewallRules: [{D4E45846-95FB-44C6-BA64-614156FE2168}] => (Allow) C:\Program Files\Microsoft Office\Office15\UcMapi.exe
FirewallRules: [TCP Query User{4CA72C05-3608-417F-AFA3-5D1789082850}C:\users\maria.davis\appdata\local\logmein rescue applet\lmir0001.tmp\lmi_rescue.exe] => (Allow) C:\users\maria.davis\appdata\local\logmein rescue applet\lmir0001.tmp\lmi_rescue.exe
FirewallRules: [UDP Query User{AFACAAE9-56C2-461F-81BC-5153EA001522}C:\users\maria.davis\appdata\local\logmein rescue applet\lmir0001.tmp\lmi_rescue.exe] => (Allow) C:\users\maria.davis\appdata\local\logmein rescue applet\lmir0001.tmp\lmi_rescue.exe
FirewallRules: [TCP Query User{9028A46A-1F5E-4B9E-8FF7-39987AED8825}C:\users\maria.davis\appdata\local\temp\g2_1943\g2viewer.exe] => (Allow) C:\users\maria.davis\appdata\local\temp\g2_1943\g2viewer.exe
FirewallRules: [UDP Query User{8B5D958A-9CAD-4EAD-BAF3-49F6BAB3A36A}C:\users\maria.davis\appdata\local\temp\g2_1943\g2viewer.exe] => (Allow) C:\users\maria.davis\appdata\local\temp\g2_1943\g2viewer.exe
FirewallRules: [TCP Query User{26C3B542-F131-47E2-8B68-1DF35CA2C011}C:\program files (x86)\acs\acs\acs.exe] => (Allow) C:\program files (x86)\acs\acs\acs.exe
FirewallRules: [UDP Query User{FA70D028-07A3-4BF9-B8EE-F93669B66719}C:\program files (x86)\acs\acs\acs.exe] => (Allow) C:\program files (x86)\acs\acs\acs.exe
FirewallRules: [{092A1506-CFC4-4C6F-8152-AA9A1B834D79}] => (Allow) C:\Program Files (x86)\TeamViewer\TeamViewer.exe
FirewallRules: [{8FAB5C8D-E42E-4C70-A0A6-AB7338A4D082}] => (Allow) C:\Program Files (x86)\TeamViewer\TeamViewer.exe
FirewallRules: [{B0931261-ECCD-4989-854C-E2725E3B83D2}] => (Allow) C:\Program Files (x86)\TeamViewer\TeamViewer_Service.exe
FirewallRules: [{C952B758-A4F9-4591-AB44-8B4ECE0C23F6}] => (Allow) C:\Program Files (x86)\TeamViewer\TeamViewer_Service.exe
FirewallRules: [{924AEE1E-61E5-4C78-A6A1-64D105B541E4}] => (Allow) C:\Program Files\iTunes\iTunes.exe
FirewallRules: [{CFB8F4FB-0F46-4DEC-83B3-4BD809BACD20}] => (Allow) C:\Program Files (x86)\Dropbox\Client\Dropbox.exe
FirewallRules: [{56520075-9CB9-4B0E-8FC7-C1BF10F3EA75}] => (Allow) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe

==================== Restore Points =========================

19-09-2017 07:19:58 Windows Update
22-09-2017 10:43:50 Windows Update
26-09-2017 10:43:45 Windows Update
29-09-2017 13:49:17 Windows Update
03-10-2017 01:02:25 Windows Update

==================== Faulty Device Manager Devices =============


==================== Event log errors: =========================

Application errors:
==================
Error: (10/02/2017 11:41:18 AM) (Source: Application Error) (EventID: 1000) (User: )
Description: Faulting application name: IEXPLORE.EXE, version: 11.0.9600.18792, time stamp: 0x59906b79
Faulting module name: atidxx32.dll, version: 8.17.10.525, time stamp: 0x52a23862
Exception code: 0xc0000005
Fault offset: 0x0041cd9a
Faulting process id: 0x2a2c
Faulting application start time: 0x01d33ba9e78332b4
Faulting application path: C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
Faulting module path: C:\Windows\system32\atidxx32.dll
Report Id: 465dbfe4-a7a1-11e7-96d3-989096c5876d

Error: (10/02/2017 07:44:13 AM) (Source: QuickBooks) (EventID: 4) (User: )
Description: An unexpected error has occured in "QuickBooks Desktop Premier Edition 2017":
DBConnPool::HandleConnectionError errorCode:-6069, dbCode:-103 from file:'src\connpool.cpp' at line 1038 from function:'DBMgr::DBConnPool::init'

Error: (10/02/2017 07:44:13 AM) (Source: QuickBooks) (EventID: 4) (User: )
Description: An unexpected error has occured in "QuickBooks Desktop Premier Edition 2017":
Connection String:CON=QBConnectionPool-Probe-QB_data_engine_27; ;DBF=\\1-srvf\Private\Executive\Quickbooks\Carousel Schools15.QBW;ENG=QB_data_engine_27;DBN=d17b3085a38f4d0ba610c1d2b295064b

Error: (10/02/2017 07:44:13 AM) (Source: QuickBooks) (EventID: 4) (User: )
Description: An unexpected error has occured in "QuickBooks Desktop Premier Edition 2017":
Connection Error:Invalid user ID or password

Error: (09/29/2017 11:20:21 AM) (Source: QuickBooks) (EventID: 4) (User: )
Description: An unexpected error has occured in "QuickBooks Desktop Premier Edition 2017":
DBConnPool::HandleConnectionError errorCode:-6069, dbCode:-103 from file:'src\connpool.cpp' at line 1038 from function:'DBMgr::DBConnPool::init'

Error: (09/29/2017 11:20:21 AM) (Source: QuickBooks) (EventID: 4) (User: )
Description: An unexpected error has occured in "QuickBooks Desktop Premier Edition 2017":
Connection String:CON=QBConnectionPool-Probe-QB_data_engine_27; ;DBF=\\1-srvf\Private\Executive\Quickbooks\Carousel Schools15.QBW;ENG=QB_data_engine_27;DBN=d60cbcd3cddb4d31a7eb153329086c5b

Error: (09/29/2017 11:20:21 AM) (Source: QuickBooks) (EventID: 4) (User: )
Description: An unexpected error has occured in "QuickBooks Desktop Premier Edition 2017":
Connection Error:Invalid user ID or password

Error: (09/29/2017 10:16:13 AM) (Source: Microsoft Office 15) (EventID: 2001) (User: )
Description: Microsoft Word: Rejected Safe Mode action : You're holding down the CTRL key. Do you want to start Word in safe mode?.
Rejected Safe Mode action : Microsoft Word.

Error: (09/29/2017 10:14:37 AM) (Source: Microsoft Office 15) (EventID: 2001) (User: )
Description: Microsoft Outlook: Rejected Safe Mode action : You're holding down the CTRL key. Do you want to start Outlook in safe mode?.
Rejected Safe Mode action : Microsoft Outlook.

Error: (09/28/2017 08:15:36 AM) (Source: QuickBooks) (EventID: 4) (User: )
Description: An unexpected error has occured in "QuickBooks Desktop Premier Edition 2017":
DBConnPool::HandleConnectionError errorCode:-6069, dbCode:-103 from file:'src\connpool.cpp' at line 1038 from function:'DBMgr::DBConnPool::init'


System errors:
=============
Error: (10/03/2017 01:04:38 PM) (Source: Service Control Manager) (EventID: 7011) (User: )
Description: A timeout (30000 milliseconds) was reached while waiting for a transaction response from the ShellHWDetection service.

Error: (10/03/2017 01:01:51 PM) (Source: Service Control Manager) (EventID: 7000) (User: )
Description: The HP Support Solutions Framework Service service failed to start due to the following error:
The service did not respond to the start or control request in a timely fashion.

Error: (10/03/2017 01:01:51 PM) (Source: Service Control Manager) (EventID: 7009) (User: )
Description: A timeout was reached (30000 milliseconds) while waiting for the HP Support Solutions Framework Service service to connect.

Error: (10/03/2017 12:58:19 PM) (Source: Microsoft-Windows-GroupPolicy) (EventID: 1055) (User: NT AUTHORITY)
Description: The processing of Group Policy failed. Windows could not resolve the computer name. This could be caused by one of more of the following:
a) Name Resolution failure on the current domain controller.
B) Active Directory Replication Latency (an account created on another domain controller has not replicated to the current domain controller).

Error: (10/03/2017 12:58:19 PM) (Source: NETLOGON) (EventID: 5719) (User: )
Description: This computer was not able to set up a secure session with a domain
controller in domain CAROUSEL due to the following:
There are currently no logon servers available to service the logon request.


This may lead to authentication problems. Make sure that this
computer is connected to the network. If the problem persists,
please contact your domain administrator.



ADDITIONAL INFO

If this computer is a domain controller for the specified domain, it
sets up the secure session to the primary domain controller emulator in the specified
domain. Otherwise, this computer sets up the secure session to any domain controller
in the specified domain.

Error: (10/03/2017 11:31:56 AM) (Source: Service Control Manager) (EventID: 7000) (User: )
Description: The HP Support Solutions Framework Service service failed to start due to the following error:
The service did not respond to the start or control request in a timely fashion.

Error: (10/03/2017 11:31:56 AM) (Source: Service Control Manager) (EventID: 7009) (User: )
Description: A timeout was reached (30000 milliseconds) while waiting for the HP Support Solutions Framework Service service to connect.

Error: (10/03/2017 11:28:36 AM) (Source: Microsoft-Windows-GroupPolicy) (EventID: 1055) (User: NT AUTHORITY)
Description: The processing of Group Policy failed. Windows could not resolve the computer name. This could be caused by one of more of the following:
a) Name Resolution failure on the current domain controller.
B) Active Directory Replication Latency (an account created on another domain controller has not replicated to the current domain controller).

Error: (10/03/2017 11:28:36 AM) (Source: NETLOGON) (EventID: 5719) (User: )
Description: This computer was not able to set up a secure session with a domain
controller in domain CAROUSEL due to the following:
There are currently no logon servers available to service the logon request.


This may lead to authentication problems. Make sure that this
computer is connected to the network. If the problem persists,
please contact your domain administrator.



ADDITIONAL INFO

If this computer is a domain controller for the specified domain, it
sets up the secure session to the primary domain controller emulator in the specified
domain. Otherwise, this computer sets up the secure session to any domain controller
in the specified domain.

Error: (10/02/2017 01:25:37 PM) (Source: Schannel) (EventID: 4119) (User: NT AUTHORITY)
Description: The following fatal alert was received: 20.


==================== Memory info ===========================

Processor: Intel® Core™ i5-4590 CPU @ 3.30GHz
Percentage of memory in use: 25%
Total physical RAM: 16292.09 MB
Available physical RAM: 12071.02 MB
Total Virtual: 32582.37 MB
Available Virtual: 27853.68 MB

==================== Drives ================================

Drive c: () (Fixed) (Total:919.74 GB) (Free:516.64 GB) NTFS
Drive i: () (Fixed) (Total:7.45 GB) (Free:4.3 GB) FAT32
Drive z: (DATA) (Network) (Total:544.5 GB) (Free:123.92 GB) NTFS

==================== MBR & Partition Table ==================

========================================================
Disk: 0 (MBR Code: Windows 7 or 8) (Size: 931.5 GB) (Disk ID: 550AA900)
Partition 1: (Not Active) - (Size=39 MB) - (Type=DE)
Partition 2: (Active) - (Size=11.7 GB) - (Type=07 NTFS)
Partition 3: (Not Active) - (Size=919.7 GB) - (Type=07 NTFS)

========================================================
Disk: 1 (Size: 7.5 GB) (Disk ID: 69CA6D1E)
Partition 1: (Not Active) - (Size=7.5 GB) - (Type=0B)

==================== End of Addition.txt ============================

Attached Files


Edited by Oh My!, 03 October 2017 - 07:59 PM.


BC AdBot (Login to Remove)

 


#2 Oh My!

Oh My!

    Adware and Spyware and Malware.....


  • Malware Response Instructor
  • 36,573 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:California
  • Local time:06:11 PM

Posted 03 October 2017 - 08:15 PM

Greetings joe5677 and :welcome: to BleepingComputer's Virus/Trojan/Spyware/Malware Removal forum.

My name is Oh My! and I am here to help you! Now that we are "friends" please call me Gary.

If you would allow me to call you by your first name I would prefer to do that.

===================================================

Ground Rules:
  • First, I would like to inform you that most of us here at Bleeping Computer offer our expert assistance out of the goodness of our hearts. Please try to match our commitment to you with your patience toward us. If this was easy we would never have met.
  • Please do not run any tools or take any steps other than those I will provide for you while we work on your computer together. I need to be certain about the state of your computer in order to provide appropriate and effective steps for you to take. Most often "well intentioned" (and usually panic driven!) independent efforts can make things much worse for both of us. If at any point you would prefer to take your own steps please let me know, I will not be offended. I would be happy to focus on the many others who are waiting in line for assistance.
  • Please perform all steps in the order they are listed in each set of instructions. Some steps may be a bit complicated. If things are not clear, be sure to stop and let me know. We need to work on this together with confidence.
  • Please copy and paste all logs into your post unless directed otherwise. Please do not re-run any programs I suggest. If you encounter problems simply stop and tell me.
  • If you do not reply to your topic after 5 days we assume it has been abandoned and I will close it.
  • When your computer is clean I will alert you of such. I will also provide for you detailed information about how you can combat future infections.
  • I would like to remind you to make no further changes to your computer unless I direct you to do so.
===================================================

Now that I am assisting you, you can expect that I will be very responsive to your situation. If you are able, I would request you check this thread at least once per day so that we can try to resolve your issues effectively and efficiently. If you are going to be delayed please be considerate and post that information so that I know you are still with me. Unfortunately, there are many people waiting to be assisted and not enough of us at BleepingComputer to go around. I appreciate your understanding and diligence.

Thank you for your patience thus far.

Please do this.

===================================================

Farbar's Recovery Scan Tool - Run Fix in Normal or Safe Mode

--------------------
  • Right click on the FRST icon and select Run as administrator
  • Highlight the below information then hit the Ctrl + C keys at the same time
Start::
CreateRestorePoint:
CloseProcesses:
HKLM\...\Winlogon: [Shell] [0 ] () <=== ATTENTION
HKU\S-1-5-21-1447001783-2274183133-4180765549-1206\...\Run: [bAEGIhHKulb] => "C:\Users\Maria.davis\AppData\Roaming\Oracle\bin\javaw.exe" -jar "C:\Users\Maria.davis\UxxwNlGeszX\VcgPtECafHL.byIXis"
C:\Users\Maria.davis\UxxwNlGeszX
HKU\S-1-5-21-4206511477-2807538862-2280937620-1000\...\MountPoints2: {4fc03b4e-4cc3-11e5-b533-806e6f6e6963} - D:\PerSoft.exe
Toolbar: HKU\S-1-5-21-1447001783-2274183133-4180765549-1206 -> No Name - {47833539-D0C5-4125-9FA8-0819E2EAAC93}
2017-10-03 03:00 - 2015-11-05 10:18 - 000000000 ____D C:\tmp
C:\Users\Maria.davis\AppData\Local\Temp\STSFX7C61
Folder: C:\program files (x86)\acs
emptytemp:
End::
  • Click Fix
  • When completed he tool will create a log on the desktop called Fixlog.txt. Please copy and paste the contents of the file in your reply.
===================================================

RogueKiller Anti-Malware

--------------------
  • Download RogueKiller and save it to your desktop
  • Close all running programs
  • Right click on the setup.exe icon and select Run as Administrator
  • For Windows XP simply double click on the icon
  • Click OK on English
  • Select Install 32 and 64 bits versions (Recommended for Technicians), then click Next 2 times
  • Click Install
  • Click Finish
  • Click Start Scan twice
  • When completed click Open Report
  • Click Export Text and save the file on your Desktop as RK.txt
  • Close all open RogueKiller windows
  • Copy and paste the contents of the report in your reply
===================================================

Malwarebytes AdwCleaner

-------------------
  • Please download AdwCleaner and save it on your desktop.
  • Close all open programs and browsers
  • Right click on AdwCleaner.exe then select Run as administrator
  • Click I agree
  • Click Scan
  • Once completed an AdwCleaner document will open on your desktop
  • Copy and paste the contents in your reply
  • ===================================================

    Things I would like to see in your next reply. Please be sure to copy and paste any requested log information unless you are asked to attach it. :thumbsup2:
    • Fixlog
    • RogueKiller log
    • AdwCleaner log
    • Update on computer performance

Gary
 
If I do not reply within 24 hours please send me a Personal Message.

"Lord, to whom would we go? You have the words that give eternal life. We believe, and we know you are the Holy One of God."

#3 Oh My!

Oh My!

    Adware and Spyware and Malware.....


  • Malware Response Instructor
  • 36,573 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:California
  • Local time:06:11 PM

Posted 06 October 2017 - 09:34 AM

Greetings,

===================================================

Do You Still Need Help?

It has been 3 days since my last post.
  • Do you still need help with this?
  • If you have not replied within 48 hours I will assume you have abandoned the Topic and it will be closed.

Gary
 
If I do not reply within 24 hours please send me a Personal Message.

"Lord, to whom would we go? You have the words that give eternal life. We believe, and we know you are the Holy One of God."

#4 Oh My!

Oh My!

    Adware and Spyware and Malware.....


  • Malware Response Instructor
  • 36,573 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:California
  • Local time:06:11 PM

Posted 08 October 2017 - 05:58 PM

Due to the lack of feedback, this topic is now closed.

In the event you still have problems, please send me or any Moderator a Private Message and ask them to reopen this topic within the next 5 days.

Please include a link to your topic in the Private Message. Thank you.
Gary
 
If I do not reply within 24 hours please send me a Personal Message.

"Lord, to whom would we go? You have the words that give eternal life. We believe, and we know you are the Holy One of God."




0 user(s) are reading this topic

0 members, 0 guests, 0 anonymous users