Jump to content


 


Register a free account to unlock additional features at BleepingComputer.com
Welcome to BleepingComputer, a free community where people like yourself come together to discuss and learn how to use their computers. Using the site is easy and fun. As a guest, you can browse and view the various discussions in the forums, but can not create a new topic or reply to an existing one unless you are logged in. Other benefits of registering an account are subscribing to topics and forums, creating a blog, and having no ads shown anywhere on the site.


Click here to Register a free account now! or read our Welcome Guide to learn how to use this site.

Photo

SmartSystem Rootkit and more (?)


  • This topic is locked This topic is locked
3 replies to this topic

#1 DottieDo

DottieDo

  • Members
  • 8 posts
  • OFFLINE
  •  
  • Local time:12:01 PM

Posted 18 October 2017 - 08:59 AM

Hello,

 

Brief scenario:

 

I thought I had just a trojan ... clicker whatever and followed bleeping computers doc to remove it.  Most of the malware from that particular package was found and removed.  However there was still the C:\Windows\System32\drivers\ndistpr64.sys. I have been having to do hard shutdowns and Windows prompted me to reset.  Before doing a reset I decided to delete the indistpr64.sys in Safe Mode.
 
I installed free version of Emsisoft Anti-Malware and ran it.  It detected the SmartSystem Rootkit.  However, Emsisoft said that it could not remove the rootkit.
 
So I googled the rootkit and found Bleeping Computer's doc on removal.  I got as far as trying to install Malwarebytes anti-rootkit, but it won't install.  I get the pop-up of whether I want the sw to make changes and I select "yes" and then it just blinks out, like I never clicked it.  I tried installing as Admin and in safe mode.
 
So I downloaded  GMER out of desperation.  I'm not that advanced ... just dangerous.  Anyway it stopped with a warning saying that modifications were made on my system possibly from the rootkit.  It stopped at (in red) C:\\WINDOWS\system32\drivers\monjmqtw.sys (*** hidden ***)  ---- Value [BOOT] nviat

 

Twice a day since I got this Rootkit/trogan (about 2 weeks ago), I have been running Super Anti spyware and getting 700-1000 adware items to delete.  I did a full scan once and it detected two malware that it could not remove.  Those are located at (1) users/Tina/AppData/Local/ctfblong\Lsadich.exe and (2) Windows\System32\config\systemProfile\AppData\Local\ctblon\Sadich.exe.  Tried to remove them manually but could not.  By this time I contacted Bleeping Computers.  Was going to try remove them in Safe Mode but figured I probably done enough damage and did not.

 

I have installed and uninstalled quite a few tools trying to rid myself of this.  Mainly the ones directed in docs from Bleeping Computers with the exception of GMER.  Last I used of RKill it didn't detect anything.  I used the unsigned version and renamed file.

 

Since contacting Bleeping Computers, I have only been using my current trial anti virus/malware and Super Anti Spyware.  My disk is almost always showing 100% full in task manager.

 

Below are the files created from FRST64 as instructed.

 

FIRST FILE:  FRST.txt

 

Scan result of Farbar Recovery Scan Tool (FRST) (x64) Version: 16-10-2017
Ran by Tina (administrator) on LAPTOP (18-10-2017 00:53:45)
Running from C:\Users\Tina\Desktop
Loaded Profiles: Tina (Available Profiles: Tina)
Platform: Windows 10 Home Version 1607 170917-1700 (X64) Language: English (United States)
Internet Explorer Version 11 (Default browser: Chrome)
Boot Mode: Normal
 
==================== Processes (Whitelisted) =================
 
(If an entry is included in the fixlist, the process will be closed. The file will not be moved.)
 
(TOSHIBA CORPORATION) C:\Windows\Temp\msktxgisrv.exe
(Emsisoft Ltd) C:\Program Files\Emsisoft Anti-Malware\a2service.exe
(Intel Corporation) C:\Windows\System32\igfxCUIService.exe
(ASUS) C:\Program Files (x86)\ASUS\ATK Package\ATKGFNEX\GFNEXSrv.exe
(ASUSTek Computer Inc.) C:\Program Files (x86)\ASUS\ATK Package\ATK Hotkey\AsLdrSrv.exe
(SUPERAntiSpyware.com) C:\Program Files\SUPERAntiSpyware\SASCore64.exe
(Intel Corporation) C:\Windows\System32\DptfParticipantProcessorService.exe
(Broadcom Corporation.) C:\Windows\System32\BtwRSupportService.exe
(ASUS Cloud Corporation) C:\Program Files (x86)\ASUS\WebStorage\2.1.11.399\AsusWSWinService.exe
(Amazon.com) C:\Program Files (x86)\Amazon\Amazon Games & Software Downloader\AmazonGSDownloaderService.exe
(Intel Corporation) C:\Windows\System32\DptfPolicyConfigTDPService.exe
(Intel Corporation) C:\Windows\System32\DptfPolicyCriticalService.exe
(Reason Software Company Inc.) C:\Program Files (x86)\Unchecky\bin\unchecky_svc.exe
(Malwarebytes) C:\Program Files\Malwarebytes\Anti-Malware\MBAMService.exe
(Intel Corporation) C:\Windows\System32\DptfPolicyLpmService.exe
(Microsoft Corporation) C:\Windows\System32\wlanext.exe
(Microsoft Corporation) C:\Windows\Microsoft.NET\Framework64\v3.0\WPF\PresentationFontCache.exe
(Microsoft Corporation) C:\Windows\Microsoft.NET\Framework64\v3.0\WPF\PresentationFontCache.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Intel® Management Engine Components\FWService\IntelMeFWService.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Intel® Management Engine Components\DAL\jhi_service.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Intel® Management Engine Components\LMS\LMS.exe
(ASUSTek Computer Inc.) C:\Program Files (x86)\ASUS\ATK Package\ATK Hotkey\HControl.exe
(Malwarebytes) C:\Program Files\Malwarebytes\Anti-Malware\mbamtray.exe
(Reason Software Company Inc.) C:\Program Files (x86)\Unchecky\bin\unchecky_bg.exe
(ASUSTek Computer Inc.) C:\Program Files (x86)\ASUS\ATK Package\ATK Hotkey\KBFiltr.exe
(ASUSTek Computer Inc.) C:\Program Files (x86)\ASUS\USBChargerPlus\USBChargerPlus.exe
(ASUSTek Computer Inc.) C:\Program Files (x86)\ASUS\ATK Package\ATKOSD2\ATKOSD2.exe
(ASUSTek Computer Inc.) C:\Program Files (x86)\ASUS\ATK Package\ATK Media\DMedia.exe
(AsusTek) C:\Program Files (x86)\ASUS\ASUS Smart Gesture\AsTPCenter\x64\AsusTPLoader.exe
(Emsisoft Ltd) C:\Program Files\Emsisoft Anti-Malware\a2guard.exe
(Piriform Ltd) C:\Program Files\CCleaner\CCleaner64.exe
(AsusTek) C:\Program Files (x86)\ASUS\ASUS Smart Gesture\AsTPCenter\x64\AsusTPCenter.exe
(Realtek Semiconductor) C:\Program Files\Realtek\Audio\HDA\RAVBg64.exe
(Realtek Semiconductor) C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe
(Emsisoft Ltd) C:\Program Files\Emsisoft Anti-Malware\a2start.exe
(AsusTek) C:\Program Files (x86)\ASUS\ASUS Smart Gesture\AsTPCenter\x64\AsusTPHelper.exe
() C:\Program Files\WindowsApps\Microsoft.ZuneVideo_10.17082.14121.0_x64__8wekyb3d8bbwe\Video.UI.exe
(Microsoft Corporation) C:\Windows\splwow64.exe
() C:\Program Files (x86)\bfgclient\bfggameservices.exe
(Microsoft Corporation) C:\Windows\SystemApps\Microsoft.Windows.Cortana_cw5n1h2txyewy\RemindersServer.exe
(Microsoft Corporation) C:\Windows\SystemApps\Microsoft.Windows.Cortana_cw5n1h2txyewy\ActionUriServer.exe
(Microsoft Corporation) C:\Windows\System32\smartscreen.exe
 
==================== Registry (Whitelisted) ===========================
 
(If an entry is included in the fixlist, the registry item will be restored to default or removed. The file will not be moved.)
 
HKLM\...\Run: [DptfPolicyLpmServiceHelper] => C:\WINDOWS\system32\DptfPolicyLpmServiceHelper.exe [114048 2013-10-17] (Intel Corporation)
HKLM\...\Run: [emsisoft anti-malware] => c:\program files\emsisoft anti-malware\a2guard.exe [8844592 2017-10-02] (Emsisoft Ltd)
HKLM-x32\...\Run: [WebStorage] => C:\Program Files (x86)\ASUS\WebStorage\2.1.11.399\ASUSWSLoader.exe [63296 2014-08-20] ()
HKLM-x32\...\Run: [GrooveMonitor] => C:\Program Files (x86)\Microsoft Office\Office12\GrooveMonitor.exe [30040 2009-02-26] (Microsoft Corporation)
HKLM-x32\...\Run: [AmazonGSDownloaderTray] => C:\Program Files (x86)\Amazon\Amazon Games & Software Downloader\AmazonGSDownloaderTray.exe [331776 2015-06-19] (Amazon.com)
HKLM-x32\...\Run: [SunJavaUpdateSched] => C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe [587288 2017-07-21] (Oracle Corporation)
HKLM Group Policy restriction on software: %systemroot%\system32\mrt.exe <==== ATTENTION
HKU\S-1-5-21-2910918007-1667735213-2428426781-1001\...\Run: [PicPick Start] => C:\Program Files (x86)\PicPick\picpick.exe [19970368 2015-10-22] (NGWIN)
HKU\S-1-5-21-2910918007-1667735213-2428426781-1001\...\Run: [CCleaner Monitoring] => C:\Program Files\CCleaner\CCleaner64.exe [9856176 2017-09-20] (Piriform Ltd)
HKU\S-1-5-21-2910918007-1667735213-2428426781-1001\...\Run: [SUPERAntiSpyware] => C:\Program Files\SUPERAntiSpyware\SUPERAntiSpyware.exe [7964064 2017-08-17] (SUPERAntiSpyware)
HKU\S-1-5-21-2910918007-1667735213-2428426781-1001\Control Panel\Desktop\\SCRNSAVE.EXE -> C:\WINDOWS\system32\scrnsave.scr [37376 2016-07-16] (Microsoft Corporation)
CHR HKLM\SOFTWARE\Policies\Google: Restriction <==== ATTENTION
 
==================== Internet (Whitelisted) ====================
 
(If an item is included in the fixlist, if it is a registry item it will be removed or restored to default.)
 
Hosts: There are more than one entry in Hosts. See Hosts section of Addition.txt
Tcpip\Parameters: [DhcpNameServer] 68.105.28.11 68.105.29.11 68.105.28.12
Tcpip\..\Interfaces\{1e91abec-f557-47c7-8775-43779374c818}: [DhcpNameServer] 68.105.28.11 68.105.29.11 68.105.28.12
Tcpip\..\Interfaces\{911c9d35-4399-4894-9477-101fef3b9890}: [DhcpNameServer] 68.105.28.11 68.105.29.11 68.105.28.12
Tcpip\..\Interfaces\{e6cca8c8-fb32-46f6-82c0-1aa1f538211b}: [DhcpNameServer] 172.18.13.1
 
Internet Explorer:
==================
HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = www.google.com
HKU\S-1-5-21-2910918007-1667735213-2428426781-1001\Software\Microsoft\Internet Explorer\Main,Search Page = hxxps://www.google.com/
SearchScopes: HKLM -> OldSearch URL = hxxp://www.bing.com/search?FORM=INCOH2&PC=IC05&PTAG=ICO-251d136&q={searchTerms}
SearchScopes: HKLM -> {fcd9f10e-0daa-405f-bca0-0dd3f37c59d9} URL = hxxp://www.bing.com/search?FORM=INCOH2&PC=IC05&PTAG=ICO-251d136&q={searchTerms}
SearchScopes: HKLM-x32 -> DefaultScope {E9410C70-B6AE-41FF-AB71-32F4B279EA5F} URL = hxxps://www.google.com/search?trackid=sp-006&q={searchTerms}
SearchScopes: HKLM-x32 -> {E9410C70-B6AE-41FF-AB71-32F4B279EA5F} URL = hxxps://www.google.com/search?trackid=sp-006&q={searchTerms}
SearchScopes: HKU\S-1-5-21-2910918007-1667735213-2428426781-1001 -> DefaultScope OldSearch URL = hxxp://www.bing.com/search?FORM=INCOH2&PC=IC05&PTAG=ICO-251d136&q={searchTerms}
SearchScopes: HKU\S-1-5-21-2910918007-1667735213-2428426781-1001 -> OldSearch URL = hxxp://www.bing.com/search?FORM=INCOH2&PC=IC05&PTAG=ICO-251d136&q={searchTerms}
SearchScopes: HKU\S-1-5-21-2910918007-1667735213-2428426781-1001 -> Yahoo URL = hxxp://search.yahoo.com/search?p={searchTerms}&ei=utf-8&fr=oberhp&type=iwingamestoolbar
SearchScopes: HKU\S-1-5-21-2910918007-1667735213-2428426781-1001 -> {012E1000-F331-11DB-8314-0800200C9A66} URL = hxxp://www.google.com/search?q={searchTerms}
SearchScopes: HKU\S-1-5-21-2910918007-1667735213-2428426781-1001 -> {fcd9f10e-0daa-405f-bca0-0dd3f37c59d9} URL = hxxp://www.bing.com/search?FORM=INCOH2&PC=IC05&PTAG=ICO-251d136&q={searchTerms}
BHO-x32: Groove GFS Browser Helper -> {72853161-30C5-4D22-B7F9-0BBC1D38A37E} -> C:\Program Files (x86)\Microsoft Office\Office12\GrooveShellExtensions.dll [2009-02-26] (Microsoft Corporation)
BHO-x32: Java™ Plug-In SSV Helper -> {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} -> C:\Program Files (x86)\Java\jre1.8.0_144\bin\ssv.dll [2017-10-08] (Oracle Corporation)
BHO-x32: Java™ Plug-In 2 SSV Helper -> {DBC80044-A445-435b-BC74-9C25C1C588A9} -> C:\Program Files (x86)\Java\jre1.8.0_144\bin\jp2ssv.dll [2017-10-08] (Oracle Corporation)
Toolbar: HKU\S-1-5-21-2910918007-1667735213-2428426781-1001 -> No Name - {91D850E0-DAA4-48CE-AB6F-FFCE463324FB} -  No File
DPF: HKLM-x32 {0D41B8C5-2599-4893-8183-00195EC8D5F9} hxxp://support.asus.com/select/asusTek_sys_ctrl3.cab
DPF: HKLM-x32 {6A060448-60F9-11D5-A6CD-0002B31F7455} 
Handler-x32: http - {E1D2BF42-A96B-11D1-9C6B-0000F875AC61} - C:\PROGRA~2\COMMON~1\System\OLEDB~1\MSDAIPP.DLL [1999-12-02] (Microsoft Corporation)
Handler-x32: http - {E1D2BF40-A96B-11D1-9C6B-0000F875AC61} - C:\PROGRA~2\COMMON~1\System\OLEDB~1\MSDAIPP.DLL [1999-12-02] (Microsoft Corporation)
Handler-x32: https - {E1D2BF42-A96B-11D1-9C6B-0000F875AC61} - C:\PROGRA~2\COMMON~1\System\OLEDB~1\MSDAIPP.DLL [1999-12-02] (Microsoft Corporation)
Handler-x32: https - {E1D2BF40-A96B-11D1-9C6B-0000F875AC61} - C:\PROGRA~2\COMMON~1\System\OLEDB~1\MSDAIPP.DLL [1999-12-02] (Microsoft Corporation)
Handler-x32: ipp - {E1D2BF42-A96B-11D1-9C6B-0000F875AC61} - C:\PROGRA~2\COMMON~1\System\OLEDB~1\MSDAIPP.DLL [1999-12-02] (Microsoft Corporation)
Handler-x32: msdaipp - {E1D2BF42-A96B-11D1-9C6B-0000F875AC61} - C:\PROGRA~2\COMMON~1\System\OLEDB~1\MSDAIPP.DLL [1999-12-02] (Microsoft Corporation)
Handler-x32: msdaipp - {E1D2BF40-A96B-11D1-9C6B-0000F875AC61} - C:\PROGRA~2\COMMON~1\System\OLEDB~1\MSDAIPP.DLL [1999-12-02] (Microsoft Corporation)
Handler: WSWSVCUchrome - No CLSID Value
 
FireFox:
========
FF DefaultProfile: d7phfry3.default-1505427235000
FF ProfilePath: C:\Users\Tina\AppData\Roaming\Mozilla\Firefox\Profiles\d7phfry3.default-1505427235000 [2017-10-17]
FF HKLM\...\Firefox\Extensions: [{4ED1F68A-5463-4931-9384-8FFF5ED91D92}] - C:\Program Files (x86)\McAfee\SiteAdvisor => not found
FF Plugin: @adobe.com/FlashPlayer -> C:\WINDOWS\system32\Macromed\Flash\NPSWF64_27_0_0_170.dll [2017-10-16] ()
FF Plugin: @Microsoft.com/NpCtrl,version=1.0 -> c:\Program Files\Microsoft Silverlight\5.1.50907.0\npctrl.dll [2017-05-03] ( Microsoft Corporation)
FF Plugin-x32: @adobe.com/FlashPlayer -> C:\WINDOWS\SysWOW64\Macromed\Flash\NPSWF32_27_0_0_170.dll [2017-10-16] ()
FF Plugin-x32: @exent.com/npExentCtl,version=7.0.0.0 -> C:\Program Files (x86)\Free Ride Games\npExentCtl.dll [No File]
FF Plugin-x32: @foxitsoftware.com/Foxit PhantomPDF Plugin,version=1.0,application/pdf -> C:\Program Files (x86)\Foxit PhantomPDF\plugins\npFoxitPhantomPDFPlugin.dll [2014-10-20] (Foxit Corporation)
FF Plugin-x32: @foxitsoftware.com/Foxit PhantomPDF Plugin,version=1.0,application/vnd.fdf -> C:\Program Files (x86)\Foxit PhantomPDF\plugins\npFoxitPhantomPDFPlugin.dll [2014-10-20] (Foxit Corporation)
FF Plugin-x32: @foxitsoftware.com/Foxit PhantomPDF Plugin,version=1.0,application/vnd.xdp -> C:\Program Files (x86)\Foxit PhantomPDF\plugins\npFoxitPhantomPDFPlugin.dll [2014-10-20] (Foxit Corporation)
FF Plugin-x32: @foxitsoftware.com/Foxit PhantomPDF Plugin,version=1.0,application/vnd.xfdf -> C:\Program Files (x86)\Foxit PhantomPDF\plugins\npFoxitPhantomPDFPlugin.dll [2014-10-20] (Foxit Corporation)
FF Plugin-x32: @intel-webapi.intel.com/Intel WebAPI ipt;version=4.0.5 -> C:\Program Files (x86)\Intel\Intel® Management Engine Components\IPT\npIntelWebAPIIPT.dll [2013-10-23] (Intel Corporation)
FF Plugin-x32: @intel-webapi.intel.com/Intel WebAPI updater -> C:\Program Files (x86)\Intel\Intel® Management Engine Components\IPT\npIntelWebAPIUpdater.dll [2013-10-23] (Intel Corporation)
FF Plugin-x32: @java.com/DTPlugin,version=11.144.2 -> C:\Program Files (x86)\Java\jre1.8.0_144\bin\dtplugin\npDeployJava1.dll [2017-10-08] (Oracle Corporation)
FF Plugin-x32: @java.com/JavaPlugin,version=11.144.2 -> C:\Program Files (x86)\Java\jre1.8.0_144\bin\plugin2\npjp2.dll [2017-10-08] (Oracle Corporation)
FF Plugin-x32: @Microsoft.com/NpCtrl,version=1.0 -> c:\Program Files (x86)\Microsoft Silverlight\5.1.50907.0\npctrl.dll [2017-05-03] ( Microsoft Corporation)
FF Plugin-x32: @tools.google.com/Google Update;version=3 -> C:\Program Files (x86)\Google\Update\1.3.33.5\npGoogleUpdate3.dll [2017-09-15] (Google Inc.)
FF Plugin-x32: @tools.google.com/Google Update;version=9 -> C:\Program Files (x86)\Google\Update\1.3.33.5\npGoogleUpdate3.dll [2017-09-15] (Google Inc.)
FF Plugin-x32: @videolan.org/vlc,version=2.2.4 -> C:\Program Files (x86)\VideoLAN\VLC\npvlc.dll [2017-05-24] (VideoLAN)
FF Plugin-x32: @videolan.org/vlc,version=2.2.6 -> C:\Program Files (x86)\VideoLAN\VLC\npvlc.dll [2017-05-24] (VideoLAN)
FF Plugin-x32: www.exent.com/GameTreatWidget -> C:\Program Files (x86)\Free Ride Games\NPGameTreatPlugin.dll [No File]
FF Plugin HKU\S-1-5-21-2910918007-1667735213-2428426781-1001: www.exent.com/GameTreatWidget -> C:\Program Files (x86)\Free Ride Games\npGameTreatWidget.dll [No File]
 
Chrome: 
=======
CHR HomePage: Default -> hxxp://www.google.com/
CHR Profile: C:\Users\Tina\AppData\Local\Google\Chrome\User Data\Default [2017-10-17]
CHR Extension: (Slides) - C:\Users\Tina\AppData\Local\Google\Chrome\User Data\Default\Extensions\aapocclcgogkmnckokdopfmhonfmgoek [2017-10-13]
CHR Extension: (Docs) - C:\Users\Tina\AppData\Local\Google\Chrome\User Data\Default\Extensions\aohghmighlieiainnegkcijnfilokake [2017-10-13]
CHR Extension: (Google Drive) - C:\Users\Tina\AppData\Local\Google\Chrome\User Data\Default\Extensions\apdfllckaahabafndbhieahigkjlhalf [2017-09-15]
CHR Extension: (YouTube) - C:\Users\Tina\AppData\Local\Google\Chrome\User Data\Default\Extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo [2017-09-15]
CHR Extension: (Session Buddy) - C:\Users\Tina\AppData\Local\Google\Chrome\User Data\Default\Extensions\edacconmaakjimmfgnblocblbcdcpbko [2017-09-15]
CHR Extension: (uBlock) - C:\Users\Tina\AppData\Local\Google\Chrome\User Data\Default\Extensions\epcnnfbjfcgphgdmggkamkmgojdagdnn [2017-09-15]
CHR Extension: (Sheets) - C:\Users\Tina\AppData\Local\Google\Chrome\User Data\Default\Extensions\felcaaldnbdncclmgdcncolpebgiejap [2017-10-13]
CHR Extension: (Google Docs Offline) - C:\Users\Tina\AppData\Local\Google\Chrome\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi [2017-09-15]
CHR Extension: (Kittens) - C:\Users\Tina\AppData\Local\Google\Chrome\User Data\Default\Extensions\hmhjmbmjbhhgbnkikokgilllcbbbleno [2017-09-15]
CHR Extension: (Popup Blocker Pro) - C:\Users\Tina\AppData\Local\Google\Chrome\User Data\Default\Extensions\kiodaajmphnkcajieajajinghpejdjai [2017-09-15]
CHR Extension: (Skype) - C:\Users\Tina\AppData\Local\Google\Chrome\User Data\Default\Extensions\lifbcibllhkdhoafpjfnlhfpfgnpldfl [2017-09-15]
CHR Extension: (Chrome Web Store Payments) - C:\Users\Tina\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda [2017-09-15]
CHR Extension: (Gmail) - C:\Users\Tina\AppData\Local\Google\Chrome\User Data\Default\Extensions\pjkljhegncpnkpknbcohdijeoejaedia [2017-09-15]
CHR Extension: (Chrome Media Router) - C:\Users\Tina\AppData\Local\Google\Chrome\User Data\Default\Extensions\pkedcjkdefgpdelpbcmbmeomcjbeemfm [2017-09-15]
CHR Profile: C:\Users\Tina\AppData\Local\Google\Chrome\User Data\System Profile [2017-10-14]
CHR HKLM-x32\...\Chrome\Extension: [lifbcibllhkdhoafpjfnlhfpfgnpldfl] - hxxps://clients2.google.com/service/update2/crx
 
==================== Services (Whitelisted) ====================
 
(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)
 
R2 !SASCORE; C:\Program Files\SUPERAntiSpyware\SASCORE64.EXE [173472 2017-01-30] (SUPERAntiSpyware.com)
R2 a2AntiMalware; C:\Program Files\Emsisoft Anti-Malware\a2service.exe [9151744 2017-10-02] (Emsisoft Ltd)
R2 Amazon Download Agent; C:\Program Files (x86)\Amazon\Amazon Games & Software Downloader\AmazonGSDownloaderService.exe [407040 2015-06-19] (Amazon.com) [File not signed]
R2 Asus WebStorage Windows Service; C:\Program Files (x86)\ASUS\WebStorage\2.1.11.399\AsusWSWinService.exe [71168 2014-08-20] (ASUS Cloud Corporation) [File not signed]
R2 BcmBtRSupport; C:\WINDOWS\system32\BtwRSupportService.exe [2251992 2015-03-27] (Broadcom Corporation.)
R2 DptfParticipantProcessorService; C:\WINDOWS\system32\DptfParticipantProcessorService.exe [117704 2013-10-17] (Intel Corporation)
R2 DptfPolicyConfigTDPService; C:\WINDOWS\system32\DptfPolicyConfigTDPService.exe [116680 2013-10-17] (Intel Corporation)
R2 DptfPolicyCriticalService; C:\WINDOWS\system32\DptfPolicyCriticalService.exe [148160 2013-10-17] (Intel Corporation)
R2 DptfPolicyLpmService; C:\WINDOWS\system32\DptfPolicyLpmService.exe [126952 2013-10-17] (Intel Corporation)
R2 igfxCUIService2.0.0.0; C:\WINDOWS\system32\igfxCUIService.exe [373728 2016-11-30] (Intel Corporation)
S3 Intel® Capability Licensing Service TCP IP Interface; C:\Program Files\Intel\iCLS Client\SocketHeciServer.exe [827392 2013-09-02] (Intel® Corporation) [File not signed]
R2 Intel® ME Service; C:\Program Files (x86)\Intel\Intel® Management Engine Components\FWService\IntelMeFWService.exe [131544 2013-10-23] (Intel Corporation)
R2 jhi_service; C:\Program Files (x86)\Intel\Intel® Management Engine Components\DAL\jhi_service.exe [169432 2013-10-23] (Intel Corporation)
R2 MBAMService; C:\Program Files\Malwarebytes\Anti-Malware\mbamservice.exe [6058960 2017-08-07] (Malwarebytes)
S3 OpenVPNService; C:\Program Files\OpenVPN\bin\openvpnserv.exe [34528 2013-03-28] (The OpenVPN Project)
R2 Unchecky; C:\Program Files (x86)\Unchecky\bin\unchecky_svc.exe [294168 2017-10-03] (Reason Software Company Inc.)
S3 WdNisSvc; C:\Program Files\Windows Defender\NisSrv.exe [347320 2017-04-27] (Microsoft Corporation)
S3 WinDefend; C:\Program Files\Windows Defender\MsMpEng.exe [103720 2017-08-08] (Microsoft Corporation)
 
===================== Drivers (Whitelisted) ======================
 
(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)
 
R3 AsusTP; C:\WINDOWS\System32\drivers\AsusTP.sys [124928 2017-03-09] (ASUS Corporation)
R3 bcbtums; C:\WINDOWS\system32\drivers\bcbtums.sys [173312 2015-03-27] (Broadcom Corporation.)
R3 BCM43XX; C:\WINDOWS\system32\DRIVERS\bcmwl63a.sys [7546544 2014-12-05] (Broadcom Corporation)
R3 DptfDevDram; C:\WINDOWS\system32\DRIVERS\DptfDevDram.sys [145640 2013-10-17] (Intel Corporation)
R3 DptfDevPch; C:\WINDOWS\system32\DRIVERS\DptfDevPch.sys [116752 2013-10-17] (Intel Corporation)
R3 DptfDevProc; C:\WINDOWS\system32\DRIVERS\DptfDevProc.sys [289744 2013-10-17] (Intel Corporation)
R3 DptfManager; C:\WINDOWS\system32\DRIVERS\DptfManager.sys [494296 2013-10-17] (Intel Corporation)
R1 epp; C:\PROGRAM FILES\EMSISOFT ANTI-MALWARE\epp.sys [124552 2016-11-23] (Emsisoft Ltd)
S3 hitmanpro37; C:\Windows\system32\drivers\hitmanpro37.sys [55232 2017-10-08] ()
S3 hxsyol; C:\WINDOWS\system32\hxsy64.sys [86352 2015-12-01] ()
R3 kbfiltr; C:\WINDOWS\System32\drivers\kbfiltr.sys [17280 2012-08-05] ( )
R4 MBAMSwissArmy; C:\WINDOWS\System32\Drivers\mbamswissarmy.sys [252232 2017-10-16] (Malwarebytes)
R3 MEIx64; C:\WINDOWS\system32\DRIVERS\TeeDriverx64.sys [99288 2013-10-23] (Intel Corporation)
S3 NetAdapterCx; C:\WINDOWS\System32\drivers\NetAdapterCx.sys [90624 2016-07-16] ()
R3 rt640x64; C:\WINDOWS\System32\drivers\rt640x64.sys [895256 2015-07-07] (Realtek )
R3 RTSUER; C:\WINDOWS\system32\Drivers\RtsUer.sys [410880 2015-07-01] (Realsil Semiconductor Corporation)
R1 SASDIFSV; C:\Program Files\SUPERAntiSpyware\SASDIFSV64.SYS [14928 2011-07-22] (SUPERAdBlocker.com and SUPERAntiSpyware.com)
R1 SASKUTIL; C:\Program Files\SUPERAntiSpyware\SASKUTIL64.SYS [12368 2011-07-12] (SUPERAdBlocker.com and SUPERAntiSpyware.com)
S3 tap-tb-0901; C:\WINDOWS\System32\drivers\tap-tb-0901.sys [38656 2015-08-10] (The OpenVPN Project)
S3 WdBoot; C:\WINDOWS\system32\drivers\WdBoot.sys [44056 2016-07-16] (Microsoft Corporation)
S3 WdFilter; C:\WINDOWS\system32\drivers\WdFilter.sys [290144 2016-07-16] (Microsoft Corporation)
S3 WdNisDrv; C:\WINDOWS\System32\Drivers\WdNisDrv.sys [123232 2016-07-16] (Microsoft Corporation)
R1 ZAM; C:\WINDOWS\System32\drivers\zam64.sys [203680 2017-10-08] (Zemana Ltd.)
R1 ZAM_Guard; C:\WINDOWS\System32\drivers\zamguard64.sys [203680 2017-10-08] (Zemana Ltd.)
 
==================== NetSvcs (Whitelisted) ===================
 
(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)
 
 
==================== One Month Created files and folders ========
 
(If an entry is included in the fixlist, the file/folder will be moved.)
 
2017-10-18 00:53 - 2017-10-18 00:54 - 000021182 _____ C:\Users\Tina\Desktop\FRST.txt
2017-10-18 00:53 - 2017-10-18 00:53 - 000000000 ____D C:\Users\Tina\Desktop\FRST-OlderVersion
2017-10-18 00:53 - 2017-10-18 00:53 - 000000000 ____D C:\FRST
2017-10-16 21:57 - 2017-10-16 21:57 - 000252232 ____N (Malwarebytes) C:\WINDOWS\system32\Drivers\mbamswissarmy.sys
2017-10-16 09:40 - 2017-10-16 09:40 - 000115536 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\monmpsvz.sys
2017-10-15 16:47 - 2017-10-15 16:47 - 000000012 _____ C:\Users\Tina\Desktop\KIT monjmqtw.txt
2017-10-15 15:14 - 2017-10-15 15:14 - 000000512 _____ C:\Users\Tina\Desktop\gmerstuff.txt
2017-10-15 15:13 - 2017-10-15 15:13 - 000000512 _____ C:\Users\Tina\Desktop\MBR.dat
2017-10-15 15:12 - 2017-10-15 15:12 - 000000512 _____ C:\Users\Tina\Desktop\kill
2017-10-15 15:08 - 2017-10-15 15:13 - 000021172 _____ C:\Users\Tina\Desktop\Rkill.txt
2017-10-15 14:03 - 2017-10-16 21:55 - 000081696 _____ (Windows ® Win 7 DDK provider) C:\WINDOWS\system32\Drivers\msidntfs.sys
2017-10-15 13:54 - 2017-10-15 13:55 - 016563352 _____ (Malwarebytes Corp.) C:\Users\Tina\Desktop\mbar-1.09.3.1001.exe
2017-10-15 13:47 - 2017-10-15 14:06 - 000380928 _____ C:\Users\Tina\Desktop\sq50sdne.exe
2017-10-14 23:23 - 2017-10-14 23:23 - 005490752 _____ (Secunia) C:\Users\Tina\Desktop\PSISetup.exe
2017-10-14 23:15 - 2017-10-14 23:15 - 011599120 _____ (SurfRight B.V.) C:\Users\Tina\Desktop\HitmanPro_x64.exe
2017-10-14 23:13 - 2017-10-14 23:13 - 005766464 _____ (Zemana Ltd. ) C:\Users\Tina\Desktop\eXplorer.exe
2017-10-14 23:11 - 2017-10-15 13:01 - 001792640 _____ (Bleeping Computer, LLC) C:\Users\Tina\Desktop\ohboy.exe
2017-10-14 22:57 - 2017-10-18 00:53 - 002401792 _____ (Farbar) C:\Users\Tina\Desktop\FRST64.exe
2017-10-14 22:52 - 2017-10-14 22:52 - 000009937 _____ C:\Users\Tina\Desktop\fixlist.txt
2017-10-14 21:54 - 2017-10-14 21:54 - 000000939 _____ C:\Users\Public\Desktop\Emsisoft Anti-Malware.lnk
2017-10-14 21:54 - 2017-10-14 21:54 - 000000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Emsisoft Anti-Malware
2017-10-14 21:50 - 2017-10-14 21:50 - 007161304 _____ (AVAST Software) C:\Users\Tina\Desktop\avast_free_antivirus_setup_online.exe
2017-10-14 21:42 - 2017-10-14 21:42 - 006625600 _____ (Zemana Ltd. ) C:\Users\Tina\Desktop\Zemana.AntiMalware.Setup.exe
2017-10-14 12:09 - 2017-10-14 12:09 - 000001589 _____ C:\Users\Tina\Desktop\Calculator.lnk
2017-10-13 21:24 - 2017-09-17 21:52 - 006672680 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\Windows.Media.Protection.PlayReady.dll
2017-10-13 21:23 - 2017-09-17 21:55 - 005722320 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\windows.storage.dll
2017-10-13 21:23 - 2017-09-17 21:52 - 020967840 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\shell32.dll
2017-10-13 21:23 - 2017-09-17 21:14 - 002483712 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\wininet.dll
2017-10-13 21:23 - 2017-03-04 01:00 - 000862208 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\SettingSyncCore.dll
2017-10-13 21:22 - 2017-09-17 22:27 - 000218976 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\offlinesam.dll
2017-10-13 21:22 - 2017-09-17 22:03 - 000791272 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\rpcrt4.dll
2017-10-13 21:22 - 2017-09-17 21:59 - 000341344 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\msv1_0.dll
2017-10-13 21:22 - 2017-09-17 21:55 - 001431240 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\Windows.ApplicationModel.Store.dll
2017-10-13 21:22 - 2017-09-17 21:52 - 004023560 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\mfcore.dll
2017-10-13 21:22 - 2017-09-17 21:52 - 001845512 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\mfmp4srcsnk.dll
2017-10-13 21:22 - 2017-09-17 21:52 - 001360464 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\mfnetsrc.dll
2017-10-13 21:22 - 2017-09-17 21:52 - 001277856 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\mfasfsrcsnk.dll
2017-10-13 21:22 - 2017-09-17 21:52 - 000981888 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\mfnetcore.dll
2017-10-13 21:22 - 2017-09-17 21:51 - 000178016 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\basecsp.dll
2017-10-13 21:22 - 2017-09-17 21:49 - 001412128 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\gdi32full.dll
2017-10-13 21:22 - 2017-09-17 21:49 - 001260784 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\msctf.dll
2017-10-13 21:22 - 2017-09-17 21:30 - 000232448 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\scksp.dll
2017-10-13 21:22 - 2017-09-17 21:27 - 004615168 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\Windows.Media.dll
2017-10-13 21:22 - 2017-09-17 21:26 - 000538112 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\PCPTpm12.dll
2017-10-13 21:22 - 2017-09-17 21:25 - 002333184 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\WsmSvc.dll
2017-10-13 21:22 - 2017-09-17 21:25 - 000461824 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\webio.dll
2017-10-13 21:22 - 2017-09-17 21:24 - 007626240 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\twinui.dll
2017-10-13 21:22 - 2017-09-17 21:24 - 000819200 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\AppContracts.dll
2017-10-13 21:22 - 2017-09-17 21:24 - 000755200 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\kerberos.dll
2017-10-13 21:22 - 2017-09-17 21:23 - 000636928 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\winhttp.dll
2017-10-13 21:22 - 2017-09-17 21:23 - 000287744 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\cryptngc.dll
2017-10-13 21:22 - 2017-09-17 21:22 - 001323008 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\wsp_fs.dll
2017-10-13 21:22 - 2017-09-17 21:22 - 001137664 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\wsp_health.dll
2017-10-13 21:22 - 2017-09-17 21:20 - 002641920 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\tquery.dll
2017-10-13 21:22 - 2017-09-17 21:19 - 002750976 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\mispace.dll
2017-10-13 21:22 - 2017-09-17 21:18 - 007470592 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\mstscax.dll
2017-10-13 21:22 - 2017-09-17 21:14 - 002997760 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\win32kfull.sys
2017-10-13 21:22 - 2017-09-17 21:14 - 002740224 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\msftedit.dll
2017-10-13 21:22 - 2017-09-17 21:14 - 002649600 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\CertEnroll.dll
2017-10-13 21:22 - 2017-09-17 21:14 - 001988096 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\mssrch.dll
2017-10-13 21:22 - 2017-09-17 21:14 - 001599488 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\urlmon.dll
2017-10-13 21:22 - 2017-09-17 21:14 - 001556992 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\Windows.UI.Immersive.dll
2017-10-13 21:22 - 2017-09-17 21:11 - 000450048 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\TpmCoreProvisioning.dll
2017-10-13 21:22 - 2017-09-14 17:49 - 001202936 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\mfmpeg2srcsnk.dll
2017-10-13 21:22 - 2017-09-13 21:04 - 000345088 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\msexcl40.dll
2017-10-13 21:22 - 2017-03-04 01:00 - 000711680 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\Windows.UI.Search.dll
2017-10-13 21:21 - 2017-09-17 22:05 - 000497424 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\dnsapi.dll
2017-10-13 21:21 - 2017-09-17 22:04 - 000918304 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\ucrtbase.dll
2017-10-13 21:21 - 2017-09-17 21:54 - 001980768 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\msxml6.dll
2017-10-13 21:21 - 2017-09-17 21:49 - 001435896 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\user32.dll
2017-10-13 21:21 - 2017-09-17 21:48 - 000117792 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\sspicli.dll
2017-10-13 21:21 - 2017-09-17 21:34 - 000095232 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\UserDataTimeUtil.dll
2017-10-13 21:21 - 2017-09-17 21:33 - 000135168 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\t2embed.dll
2017-10-13 21:21 - 2017-09-17 21:32 - 000041472 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\BasicRender.sys
2017-10-13 21:21 - 2017-09-17 21:31 - 000519168 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\ngccredprov.dll
2017-10-13 21:21 - 2017-09-17 21:31 - 000156672 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\UserDeviceRegistration.dll
2017-10-13 21:21 - 2017-09-17 21:30 - 000147456 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\VCardParser.dll
2017-10-13 21:21 - 2017-09-17 21:29 - 000184320 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\UserMgrProxy.dll
2017-10-13 21:21 - 2017-09-17 21:28 - 000406016 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\dsreg.dll
2017-10-13 21:21 - 2017-09-17 21:28 - 000237056 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\SyncSettings.dll
2017-10-13 21:21 - 2017-09-17 21:26 - 000431616 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\efswrt.dll
2017-10-13 21:21 - 2017-09-17 21:26 - 000367104 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\FirewallAPI.dll
2017-10-13 21:21 - 2017-09-17 21:26 - 000298496 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\Windows.Internal.Management.dll
2017-10-13 21:21 - 2017-09-17 21:26 - 000284672 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\apprepsync.dll
2017-10-13 21:21 - 2017-09-17 21:26 - 000125952 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\apprepapi.dll
2017-10-13 21:21 - 2017-09-17 21:23 - 000857600 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\EmailApis.dll
2017-10-13 21:21 - 2017-09-17 21:23 - 000816640 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\NaturalLanguage6.dll
2017-10-13 21:21 - 2017-09-17 21:23 - 000297472 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\SearchProtocolHost.exe
2017-10-13 21:21 - 2017-09-17 21:23 - 000238080 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\AboveLockAppHost.dll
2017-10-13 21:21 - 2017-09-17 21:20 - 000343040 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\PlayToDevice.dll
2017-10-13 21:21 - 2017-09-17 21:19 - 000303616 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\mcbuilder.exe
2017-10-13 21:21 - 2017-09-17 21:19 - 000161792 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\rpchttp.dll
2017-10-13 21:21 - 2017-09-17 21:17 - 000641024 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\MCRecvSrc.dll
2017-10-13 21:21 - 2017-09-17 21:14 - 006474752 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\mspaint.exe
2017-10-13 21:21 - 2017-09-17 21:14 - 002682880 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\netshell.dll
2017-10-13 21:21 - 2017-09-17 21:14 - 001170944 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\Windows.Media.Speech.dll
2017-10-13 21:21 - 2017-09-17 21:14 - 000827904 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\twinui.appcore.dll
2017-10-13 21:21 - 2017-09-17 21:14 - 000675840 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\Windows.Networking.dll
2017-10-13 21:21 - 2017-09-17 21:14 - 000657408 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\jscript.dll
2017-10-13 21:21 - 2017-09-17 21:14 - 000542208 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\Windows.Networking.Connectivity.dll
2017-10-13 21:21 - 2017-09-17 21:13 - 001013248 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\Windows.Web.Http.dll
2017-10-13 21:21 - 2017-09-17 21:13 - 000886272 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\aadtb.dll
2017-10-13 21:21 - 2017-09-17 21:13 - 000773120 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\SearchIndexer.exe
2017-10-13 21:21 - 2017-09-17 21:13 - 000751104 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\Windows.Networking.BackgroundTransfer.dll
2017-10-13 21:21 - 2017-09-17 21:13 - 000598528 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\Windows.Web.dll
2017-10-13 21:21 - 2017-09-17 21:13 - 000589312 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\Windows.Devices.Sensors.dll
2017-10-13 21:21 - 2017-09-17 21:13 - 000164864 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\netprofm.dll
2017-10-13 21:21 - 2017-09-17 21:11 - 000783360 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\TSWorkspace.dll
2017-10-13 21:21 - 2017-09-14 17:59 - 000096064 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\dmcmnutils.dll
2017-10-13 21:21 - 2017-09-14 17:52 - 000136032 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\CloudExperienceHostUser.dll
2017-10-13 21:21 - 2017-09-14 17:34 - 000108544 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\hidbth.sys
2017-10-13 21:21 - 2017-09-14 17:31 - 000328192 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\daxexec.dll
2017-10-13 21:21 - 2017-09-14 17:30 - 000291840 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\CertEnrollUI.dll
2017-10-13 21:21 - 2017-09-14 17:30 - 000194560 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\MSWB7.dll
2017-10-13 21:21 - 2017-09-14 17:30 - 000185344 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\authz.dll
2017-10-13 21:21 - 2017-09-14 17:30 - 000172032 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\dinput8.dll
2017-10-13 21:21 - 2017-09-14 17:30 - 000098304 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\Windows.Security.Credentials.UI.UserConsentVerifier.dll
2017-10-13 21:21 - 2017-09-14 17:28 - 000311296 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\Wldap32.dll
2017-10-13 21:21 - 2017-09-14 17:28 - 000136192 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\dinput.dll
2017-10-13 21:21 - 2017-09-14 17:27 - 000662528 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\netlogon.dll
2017-10-13 21:21 - 2017-09-14 17:26 - 001167360 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\certutil.exe
2017-10-13 21:21 - 2017-09-14 17:26 - 000636928 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\SmartcardCredentialProvider.dll
2017-10-13 21:21 - 2017-09-14 17:26 - 000359424 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\certreq.exe
2017-10-13 21:21 - 2017-09-14 17:25 - 000529920 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\StructuredQuery.dll
2017-10-13 21:21 - 2017-09-14 17:15 - 003106304 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\mstsc.exe
2017-10-13 21:21 - 2017-09-13 21:04 - 000640512 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\mswstr10.dll
2017-10-13 21:21 - 2017-09-13 21:04 - 000008704 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\msjint40.dll
2017-10-13 21:21 - 2017-03-04 01:28 - 000224256 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\ExSMime.dll
2017-10-13 21:21 - 2017-03-04 01:24 - 000088576 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\UserDeviceRegistration.Ngc.dll
2017-10-13 21:21 - 2017-03-04 01:23 - 000299520 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\UserDataAccountApis.dll
2017-10-13 21:21 - 2017-03-04 01:16 - 000368128 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\puiobj.dll
2017-10-13 21:20 - 2017-09-17 22:02 - 007213464 _____ (Microsoft Corporation) C:\WINDOWS\system32\windows.storage.dll
2017-10-13 21:20 - 2017-09-17 22:02 - 001860288 _____ (Microsoft Corporation) C:\WINDOWS\system32\Windows.ApplicationModel.Store.dll
2017-10-13 21:20 - 2017-09-17 22:00 - 001072248 _____ (Microsoft Corporation) C:\WINDOWS\system32\mfnetcore.dll
2017-10-13 21:20 - 2017-09-17 21:59 - 022220864 _____ (Microsoft Corporation) C:\WINDOWS\system32\shell32.dll
2017-10-13 21:20 - 2017-09-17 21:59 - 008173672 _____ (Microsoft Corporation) C:\WINDOWS\system32\Windows.Media.Protection.PlayReady.dll
2017-10-13 21:20 - 2017-09-17 21:59 - 004260072 _____ (Microsoft Corporation) C:\WINDOWS\system32\mfcore.dll
2017-10-13 21:20 - 2017-09-17 21:59 - 001702392 _____ (Microsoft Corporation) C:\WINDOWS\system32\mfasfsrcsnk.dll
2017-10-13 21:20 - 2017-09-17 21:33 - 000119808 _____ (Microsoft Corporation) C:\WINDOWS\system32\UserDataTimeUtil.dll
2017-10-13 21:20 - 2017-09-17 21:31 - 006288384 _____ (Microsoft Corporation) C:\WINDOWS\system32\Windows.Media.dll
2017-10-13 21:20 - 2017-09-17 21:31 - 000123904 _____ (Microsoft Corporation) C:\WINDOWS\system32\mssprxy.dll
2017-10-13 21:20 - 2017-09-17 21:27 - 000719872 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\WdiWiFi.sys
2017-10-13 21:20 - 2017-09-17 21:27 - 000349184 _____ (Microsoft Corporation) C:\WINDOWS\system32\SearchProtocolHost.exe
2017-10-13 21:20 - 2017-09-17 21:26 - 000283136 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\mrxsmb10.sys
2017-10-13 21:20 - 2017-09-17 21:24 - 000713216 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\srv2.sys
2017-10-13 21:20 - 2017-09-17 21:24 - 000409600 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\srv.sys
2017-10-13 21:20 - 2017-09-17 21:18 - 000330752 _____ (Microsoft Corporation) C:\WINDOWS\system32\NgcCtnrSvc.dll
2017-10-13 21:20 - 2017-09-17 21:17 - 003401216 _____ (Microsoft Corporation) C:\WINDOWS\system32\tquery.dll
2017-10-13 21:20 - 2017-09-17 21:16 - 004596224 _____ (Microsoft Corporation) C:\WINDOWS\system32\xpsrchvw.exe
2017-10-13 21:20 - 2017-09-17 21:16 - 003520512 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\xpsrchvw.exe
2017-10-13 21:20 - 2017-09-17 21:15 - 002538496 _____ (Microsoft Corporation) C:\WINDOWS\system32\mssrch.dll
2017-10-13 21:20 - 2017-09-17 21:14 - 000983552 _____ (Microsoft Corporation) C:\WINDOWS\system32\ngcsvc.dll
2017-10-13 21:20 - 2017-09-17 21:14 - 000903680 _____ (Microsoft Corporation) C:\WINDOWS\system32\SearchIndexer.exe
2017-10-13 21:20 - 2017-09-14 18:05 - 001302136 _____ (Microsoft Corporation) C:\WINDOWS\system32\mfmpeg2srcsnk.dll
2017-10-13 21:20 - 2017-09-14 17:32 - 000326144 _____ (Microsoft Corporation) C:\WINDOWS\system32\CertEnrollUI.dll
2017-10-13 21:20 - 2017-09-14 17:18 - 003299840 _____ (Microsoft Corporation) C:\WINDOWS\system32\mstsc.exe
2017-10-13 21:20 - 2017-03-04 01:23 - 001184256 _____ (Microsoft Corporation) C:\WINDOWS\system32\Unistore.dll
2017-10-13 21:19 - 2017-09-17 22:09 - 002213760 _____ (Microsoft Corporation) C:\WINDOWS\system32\KernelBase.dll
2017-10-13 21:19 - 2017-09-17 22:09 - 000133984 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\ksecdd.sys
2017-10-13 21:19 - 2017-09-17 22:08 - 000998920 _____ (Microsoft Corporation) C:\WINDOWS\system32\ucrtbase.dll
2017-10-13 21:19 - 2017-09-17 22:05 - 001177688 _____ (Microsoft Corporation) C:\WINDOWS\system32\rpcrt4.dll
2017-10-13 21:19 - 2017-09-17 22:05 - 000172536 _____ (Microsoft Corporation) C:\WINDOWS\system32\sspicli.dll
2017-10-13 21:19 - 2017-09-17 22:04 - 001706488 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\KernelBase.dll
2017-10-13 21:19 - 2017-09-17 21:59 - 001983408 _____ (Microsoft Corporation) C:\WINDOWS\system32\mfmp4srcsnk.dll
2017-10-13 21:19 - 2017-09-17 21:56 - 000057408 _____ (Microsoft Corporation) C:\WINDOWS\system32\lsass.exe
2017-10-13 21:19 - 2017-09-17 21:35 - 000372736 _____ (Microsoft Corporation) C:\WINDOWS\system32\RDXTaskFactory.dll
2017-10-13 21:19 - 2017-09-17 21:32 - 000028672 _____ (Microsoft Corporation) C:\WINDOWS\system32\sspisrv.dll
2017-10-13 21:19 - 2017-09-17 21:31 - 000239104 _____ (Microsoft Corporation) C:\WINDOWS\system32\MusNotification.exe
2017-10-13 21:19 - 2017-09-17 21:29 - 000411136 _____ (Microsoft Corporation) C:\WINDOWS\system32\NgcCtnr.dll
2017-10-13 21:19 - 2017-09-17 21:29 - 000187904 _____ (Microsoft Corporation) C:\WINDOWS\system32\VCardParser.dll
2017-10-13 21:19 - 2017-09-17 21:28 - 000536064 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\nwifi.sys
2017-10-13 21:19 - 2017-09-17 21:27 - 000641024 _____ (Microsoft Corporation) C:\WINDOWS\system32\ngccredprov.dll
2017-10-13 21:19 - 2017-09-17 21:27 - 000590336 _____ (Microsoft Corporation) C:\WINDOWS\system32\efswrt.dll
2017-10-13 21:19 - 2017-09-17 21:27 - 000463360 _____ (Microsoft Corporation) C:\WINDOWS\system32\wlansec.dll
2017-10-13 21:19 - 2017-09-17 21:27 - 000295424 _____ (Microsoft Corporation) C:\WINDOWS\system32\updatehandlers.dll
2017-10-13 21:19 - 2017-09-17 21:26 - 000384000 _____ (Microsoft Corporation) C:\WINDOWS\system32\cryptngc.dll
2017-10-13 21:19 - 2017-09-17 21:19 - 000549376 _____ (Microsoft Corporation) C:\WINDOWS\system32\usocore.dll
2017-10-13 21:19 - 2017-09-17 21:18 - 008077312 _____ (Microsoft Corporation) C:\WINDOWS\system32\mstscax.dll
2017-10-13 21:19 - 2017-09-17 21:18 - 001145344 _____ (Microsoft Corporation) C:\WINDOWS\system32\EmailApis.dll
2017-10-13 21:19 - 2017-09-17 21:15 - 002370048 _____ (Microsoft Corporation) C:\WINDOWS\system32\wlansvc.dll
2017-10-13 21:19 - 2017-09-17 21:14 - 000765440 _____ (Microsoft Corporation) C:\WINDOWS\system32\Windows.Devices.Sensors.dll
2017-10-13 21:19 - 2017-09-17 21:14 - 000392192 _____ (Microsoft Corporation) C:\WINDOWS\system32\wuuhext.dll
2017-10-13 21:19 - 2017-09-17 21:12 - 000998912 _____ (Microsoft Corporation) C:\WINDOWS\system32\TSWorkspace.dll
2017-10-13 21:19 - 2017-09-17 21:12 - 000532992 _____ (Microsoft Corporation) C:\WINDOWS\system32\TpmCoreProvisioning.dll
2017-10-13 21:19 - 2017-09-14 17:30 - 000456192 _____ (Microsoft Corporation) C:\WINDOWS\system32\puiobj.dll
2017-10-13 21:19 - 2017-09-14 17:22 - 000987648 _____ (Microsoft Corporation) C:\WINDOWS\system32\termsrv.dll
2017-10-13 21:19 - 2017-09-14 17:18 - 000273920 _____ (Microsoft Corporation) C:\WINDOWS\system32\umrdp.dll
2017-10-13 21:19 - 2016-08-27 00:12 - 000244816 _____ (Microsoft Corporation) C:\WINDOWS\system32\mfps.dll
2017-10-13 21:18 - 2017-09-17 22:09 - 007780192 _____ (Microsoft Corporation) C:\WINDOWS\system32\ntoskrnl.exe
2017-10-13 21:18 - 2017-09-17 22:09 - 000646688 _____ (Microsoft Corporation) C:\WINDOWS\system32\dnsapi.dll
2017-10-13 21:18 - 2017-09-17 22:01 - 000431456 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\rdbss.sys
2017-10-13 21:18 - 2017-09-17 22:01 - 000223072 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\mrxsmb20.sys
2017-10-13 21:18 - 2017-09-17 21:59 - 000241504 _____ (Microsoft Corporation) C:\WINDOWS\system32\CloudExperienceHost.dll
2017-10-13 21:18 - 2017-09-17 21:36 - 022570496 _____ (Microsoft Corporation) C:\WINDOWS\system32\edgehtml.dll
2017-10-13 21:18 - 2017-09-17 21:33 - 000057856 _____ (Microsoft Corporation) C:\WINDOWS\system32\TransliterationRanker.dll
2017-10-13 21:18 - 2017-09-17 21:32 - 000054272 _____ (Microsoft Corporation) C:\WINDOWS\system32\jpninputrouter.dll
2017-10-13 21:18 - 2017-09-17 21:32 - 000054272 _____ (Microsoft Corporation) C:\WINDOWS\system32\EmojiDS.dll
2017-10-13 21:18 - 2017-09-17 21:31 - 000069120 _____ (Microsoft Corporation) C:\WINDOWS\system32\RuleBasedDS.dll
2017-10-13 21:18 - 2017-09-17 21:30 - 000262656 _____ (Microsoft Corporation) C:\WINDOWS\system32\jpnranker.dll
2017-10-13 21:18 - 2017-09-17 21:30 - 000174592 _____ C:\WINDOWS\system32\IHDS.dll
2017-10-13 21:18 - 2017-09-17 21:30 - 000131584 _____ (Microsoft Corporation) C:\WINDOWS\system32\VocabRoamingHandler.dll
2017-10-13 21:18 - 2017-09-17 21:30 - 000117760 _____ (Microsoft Corporation) C:\WINDOWS\system32\StaticDictDS.dll
2017-10-13 21:18 - 2017-09-17 21:30 - 000095232 _____ (Microsoft Corporation) C:\WINDOWS\system32\chxranker.dll
2017-10-13 21:18 - 2017-09-17 21:29 - 000414720 _____ (Microsoft Corporation) C:\WINDOWS\system32\ChsStrokeDS.dll
2017-10-13 21:18 - 2017-09-17 21:29 - 000231424 _____ (Microsoft Corporation) C:\WINDOWS\system32\shutdownux.dll
2017-10-13 21:18 - 2017-09-17 21:28 - 000414720 _____ (Microsoft Corporation) C:\WINDOWS\system32\ChtHkStrokeDS.dll
2017-10-13 21:18 - 2017-09-17 21:28 - 000335872 _____ (Microsoft Corporation) C:\WINDOWS\system32\ChsPinyinRanker.dll
2017-10-13 21:18 - 2017-09-17 21:28 - 000290816 _____ (Microsoft Corporation) C:\WINDOWS\system32\MtfDecoder.dll
2017-10-13 21:18 - 2017-09-17 21:28 - 000140288 _____ (Microsoft Corporation) C:\WINDOWS\system32\AppointmentActivation.dll
2017-10-13 21:18 - 2017-09-17 21:28 - 000105984 _____ (Microsoft Corporation) C:\WINDOWS\system32\ngcpopkeysrv.dll
2017-10-13 21:18 - 2017-09-17 21:27 - 000497152 _____ (Microsoft Corporation) C:\WINDOWS\system32\ChxAPDS.dll
2017-10-13 21:18 - 2017-09-17 21:27 - 000480768 _____ (Microsoft Corporation) C:\WINDOWS\system32\msimeChsPinyinMainDS.dll
2017-10-13 21:18 - 2017-09-17 21:27 - 000469504 _____ (Microsoft Corporation) C:\WINDOWS\system32\ChxHAPDS.dll
2017-10-13 21:18 - 2017-09-17 21:27 - 000422400 _____ (Microsoft Corporation) C:\WINDOWS\system32\ChtCangjieDS.dll
2017-10-13 21:18 - 2017-09-17 21:27 - 000410624 _____ (Microsoft Corporation) C:\WINDOWS\system32\ChtQuickDS.dll
2017-10-13 21:18 - 2017-09-17 21:27 - 000336384 _____ (Microsoft Corporation) C:\WINDOWS\system32\jpndecoder.dll
2017-10-13 21:18 - 2017-09-17 21:27 - 000329728 _____ (Microsoft Corporation) C:\WINDOWS\system32\chxinputrouter.dll
2017-10-13 21:18 - 2017-09-17 21:27 - 000326656 _____ (Microsoft Corporation) C:\WINDOWS\system32\domgmt.dll
2017-10-13 21:18 - 2017-09-17 21:27 - 000310784 _____ (Microsoft Corporation) C:\WINDOWS\system32\SyncSettings.dll
2017-10-13 21:18 - 2017-09-17 21:26 - 000805888 _____ (Microsoft Corporation) C:\WINDOWS\system32\jscript9diag.dll
2017-10-13 21:18 - 2017-09-17 21:26 - 000396800 _____ (Microsoft Corporation) C:\WINDOWS\system32\tpmvsc.dll
2017-10-13 21:18 - 2017-09-17 21:26 - 000265216 _____ (Microsoft Corporation) C:\WINDOWS\system32\dnsrslvr.dll
2017-10-13 21:18 - 2017-09-17 21:25 - 000425984 _____ (Microsoft Corporation) C:\WINDOWS\system32\aadcloudap.dll
2017-10-13 21:18 - 2017-09-17 21:24 - 013107712 _____ (Microsoft Corporation) C:\WINDOWS\system32\ieframe.dll
2017-10-13 21:18 - 2017-09-17 21:24 - 002103808 _____ (Microsoft Corporation) C:\WINDOWS\system32\wlidsvc.dll
2017-10-13 21:18 - 2017-09-17 21:24 - 001589760 _____ (Microsoft Corporation) C:\WINDOWS\system32\msdtctm.dll
2017-10-13 21:18 - 2017-09-17 21:23 - 000442368 _____ (Microsoft Corporation) C:\WINDOWS\system32\PlayToDevice.dll
2017-10-13 21:18 - 2017-09-17 21:22 - 000198144 _____ (Microsoft Corporation) C:\WINDOWS\system32\rpchttp.dll
2017-10-13 21:18 - 2017-09-17 21:21 - 018364928 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\edgehtml.dll
2017-10-13 21:18 - 2017-09-17 21:20 - 023677952 _____ (Microsoft Corporation) C:\WINDOWS\system32\mshtml.dll
2017-10-13 21:18 - 2017-09-17 21:20 - 019414016 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\mshtml.dll
2017-10-13 21:18 - 2017-09-17 21:20 - 000937984 _____ (Microsoft Corporation) C:\WINDOWS\system32\MCRecvSrc.dll
2017-10-13 21:18 - 2017-09-17 21:20 - 000284160 _____ (Microsoft Corporation) C:\WINDOWS\system32\AboveLockAppHost.dll
2017-10-13 21:18 - 2017-09-17 21:18 - 012204032 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\ieframe.dll
2017-10-13 21:18 - 2017-09-17 21:18 - 008114688 _____ (Microsoft Corporation) C:\WINDOWS\system32\Chakra.dll
2017-10-13 21:18 - 2017-09-17 21:17 - 001783296 _____ (Microsoft Corporation) C:\WINDOWS\system32\urlmon.dll
2017-10-13 21:18 - 2017-09-17 21:16 - 004743168 _____ (Microsoft Corporation) C:\WINDOWS\system32\jscript9.dll
2017-10-13 21:18 - 2017-09-17 21:15 - 006065152 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\Chakra.dll
2017-10-13 21:18 - 2017-09-17 21:15 - 003202048 _____ (Microsoft Corporation) C:\WINDOWS\system32\msftedit.dll
2017-10-13 21:18 - 2017-09-17 21:15 - 002800128 _____ (Microsoft Corporation) C:\WINDOWS\system32\netshell.dll
2017-10-13 21:18 - 2017-09-17 21:15 - 001282048 _____ (Microsoft Corporation) C:\WINDOWS\system32\wwansvc.dll
2017-10-13 21:18 - 2017-09-17 21:15 - 001231360 _____ (Microsoft Corporation) C:\WINDOWS\system32\dosvc.dll
2017-10-13 21:18 - 2017-09-17 21:15 - 000701952 _____ (Microsoft Corporation) C:\WINDOWS\system32\Windows.Networking.Connectivity.dll
2017-10-13 21:18 - 2017-09-17 21:14 - 003663360 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\jscript9.dll
2017-10-13 21:18 - 2017-09-17 21:14 - 002897408 _____ (Microsoft Corporation) C:\WINDOWS\system32\wininet.dll
2017-10-13 21:18 - 2017-09-17 21:14 - 001518080 _____ (Microsoft Corporation) C:\WINDOWS\system32\win32kbase.sys
2017-10-13 21:18 - 2017-09-17 21:14 - 001328640 _____ (Microsoft Corporation) C:\WINDOWS\system32\Windows.Web.Http.dll
2017-10-13 21:18 - 2017-09-17 21:14 - 000971264 _____ (Microsoft Corporation) C:\WINDOWS\system32\twinui.appcore.dll
2017-10-13 21:18 - 2017-09-17 21:14 - 000913920 _____ (Microsoft Corporation) C:\WINDOWS\system32\Windows.Networking.dll
2017-10-13 21:18 - 2017-09-17 21:14 - 000908800 _____ (Microsoft Corporation) C:\WINDOWS\system32\Windows.UI.Search.dll
2017-10-13 21:18 - 2017-09-17 21:14 - 000799744 _____ (Microsoft Corporation) C:\WINDOWS\system32\jscript.dll
2017-10-13 21:18 - 2017-09-17 21:14 - 000774656 _____ (Microsoft Corporation) C:\WINDOWS\system32\Windows.Web.dll
2017-10-13 21:18 - 2017-09-17 21:14 - 000650752 _____ (Microsoft Corporation) C:\WINDOWS\system32\RDXService.dll
2017-10-13 21:18 - 2017-09-17 21:13 - 001121280 _____ (Microsoft Corporation) C:\WINDOWS\system32\aadtb.dll
2017-10-13 21:18 - 2017-09-17 21:13 - 000924672 _____ (Microsoft Corporation) C:\WINDOWS\system32\Windows.Networking.BackgroundTransfer.dll
2017-10-13 21:18 - 2017-09-17 21:12 - 000439296 _____ (Microsoft Corporation) C:\WINDOWS\system32\wksprt.exe
2017-10-13 21:18 - 2017-09-17 21:11 - 000151552 _____ (Microsoft Corporation) C:\WINDOWS\system32\trie.dll
2017-10-13 21:18 - 2017-09-17 21:11 - 000108032 _____ (Microsoft Corporation) C:\WINDOWS\system32\MTFFuzzyDS.dll
2017-10-13 21:18 - 2017-09-17 21:11 - 000064512 _____ (Microsoft Corporation) C:\WINDOWS\system32\MTFSpellcheckDS.dll
2017-10-13 21:18 - 2017-09-14 18:14 - 000119328 _____ (Microsoft Corporation) C:\WINDOWS\system32\dmcmnutils.dll
2017-10-13 21:18 - 2017-09-14 17:32 - 000210432 _____ (Microsoft Corporation) C:\WINDOWS\system32\dinput8.dll
2017-10-13 21:18 - 2017-09-14 17:32 - 000162304 _____ (Microsoft Corporation) C:\WINDOWS\system32\dinput.dll
2017-10-13 21:18 - 2017-09-14 17:32 - 000127488 _____ (Microsoft Corporation) C:\WINDOWS\system32\Windows.Security.Credentials.UI.UserConsentVerifier.dll
2017-10-13 21:18 - 2017-09-14 17:25 - 000821248 _____ (Microsoft Corporation) C:\WINDOWS\system32\comuid.dll
2017-10-13 21:18 - 2017-09-14 17:24 - 000981504 _____ (Microsoft Corporation) C:\WINDOWS\system32\Windows.Security.Authentication.OnlineId.dll
2017-10-13 21:18 - 2017-09-14 17:22 - 000634368 _____ (Microsoft Corporation) C:\WINDOWS\system32\StructuredQuery.dll
2017-10-13 21:18 - 2017-09-14 17:20 - 002852864 _____ (Microsoft Corporation) C:\WINDOWS\system32\SystemSettingsThresholdAdminFlowUI.dll
2017-10-13 21:18 - 2017-09-14 17:16 - 000068608 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\npfs.sys
2017-10-13 21:18 - 2017-03-04 02:10 - 000360040 _____ (Microsoft Corporation) C:\WINDOWS\system32\SystemSettingsAdminFlows.exe
2017-10-13 21:17 - 2017-09-17 22:17 - 001564512 _____ (Microsoft Corporation) C:\WINDOWS\system32\appraiser.dll
2017-10-13 21:17 - 2017-09-17 22:17 - 000245600 _____ (Microsoft Corporation) C:\WINDOWS\system32\offlinesam.dll
2017-10-13 21:17 - 2017-09-17 22:17 - 000136032 _____ (Microsoft Corporation) C:\WINDOWS\system32\acmigration.dll
2017-10-13 21:17 - 2017-09-17 22:08 - 002253664 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\ntfs.sys
2017-10-13 21:17 - 2017-09-17 22:05 - 000168800 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\ksecpkg.sys
2017-10-13 21:17 - 2017-09-17 22:04 - 000404832 _____ (Microsoft Corporation) C:\WINDOWS\system32\msv1_0.dll
2017-10-13 21:17 - 2017-09-17 22:01 - 002446704 _____ (Microsoft Corporation) C:\WINDOWS\system32\msxml6.dll
2017-10-13 21:17 - 2017-09-17 22:01 - 000624048 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\cng.sys
2017-10-13 21:17 - 2017-09-17 21:58 - 001600632 _____ (Microsoft Corporation) C:\WINDOWS\system32\sppobjs.dll
2017-10-13 21:17 - 2017-09-17 21:58 - 000206688 _____ (Microsoft Corporation) C:\WINDOWS\system32\basecsp.dll
2017-10-13 21:17 - 2017-09-17 21:57 - 001566552 _____ (Microsoft Corporation) C:\WINDOWS\system32\gdi32full.dll
2017-10-13 21:17 - 2017-09-17 21:57 - 001460696 _____ (Microsoft Corporation) C:\WINDOWS\system32\user32.dll
2017-10-13 21:17 - 2017-09-17 21:57 - 001415712 _____ (Microsoft Corporation) C:\WINDOWS\system32\msctf.dll
2017-10-13 21:17 - 2017-09-17 21:32 - 000177152 _____ (Microsoft Corporation) C:\WINDOWS\system32\t2embed.dll
2017-10-13 21:17 - 2017-09-17 21:30 - 000257536 _____ (Microsoft Corporation) C:\WINDOWS\system32\scksp.dll
2017-10-13 21:17 - 2017-09-17 21:30 - 000196096 _____ (Microsoft Corporation) C:\WINDOWS\system32\UserDeviceRegistration.dll
2017-10-13 21:17 - 2017-09-17 21:30 - 000101888 _____ (Microsoft Corporation) C:\WINDOWS\system32\UserDeviceRegistration.Ngc.dll
2017-10-13 21:17 - 2017-09-17 21:29 - 009129984 _____ (Microsoft Corporation) C:\WINDOWS\system32\twinui.dll
2017-10-13 21:17 - 2017-09-17 21:28 - 000289792 _____ (Microsoft Corporation) C:\WINDOWS\system32\DeveloperOptionsSettingsHandlers.dll
2017-10-13 21:17 - 2017-09-17 21:28 - 000043520 _____ (Microsoft Corporation) C:\WINDOWS\system32\TpmTasks.dll
2017-10-13 21:17 - 2017-09-17 21:27 - 000626176 _____ (Microsoft Corporation) C:\WINDOWS\system32\PCPTpm12.dll
2017-10-13 21:17 - 2017-09-17 21:27 - 000525824 _____ (Microsoft Corporation) C:\WINDOWS\system32\FirewallAPI.dll
2017-10-13 21:17 - 2017-09-17 21:27 - 000407552 _____ (Microsoft Corporation) C:\WINDOWS\system32\Windows.Internal.Management.dll
2017-10-13 21:17 - 2017-09-17 21:27 - 000379904 _____ (Microsoft Corporation) C:\WINDOWS\system32\apprepsync.dll
2017-10-13 21:17 - 2017-09-17 21:27 - 000268800 _____ (Microsoft Corporation) C:\WINDOWS\system32\UserMgrProxy.dll
2017-10-13 21:17 - 2017-09-17 21:27 - 000147456 _____ (Microsoft Corporation) C:\WINDOWS\system32\winsrv.dll
2017-10-13 21:17 - 2017-09-17 21:26 - 002716672 _____ (Microsoft Corporation) C:\WINDOWS\system32\WsmSvc.dll
2017-10-13 21:17 - 2017-09-17 21:26 - 000686592 _____ (Microsoft Corporation) C:\WINDOWS\system32\dsregcmd.exe
2017-10-13 21:17 - 2017-09-17 21:26 - 000562176 _____ (Microsoft Corporation) C:\WINDOWS\system32\webio.dll
2017-10-13 21:17 - 2017-09-17 21:26 - 000481792 _____ (Microsoft Corporation) C:\WINDOWS\system32\dsreg.dll
2017-10-13 21:17 - 2017-09-17 21:26 - 000176128 _____ (Microsoft Corporation) C:\WINDOWS\system32\apprepapi.dll
2017-10-13 21:17 - 2017-09-17 21:25 - 001914368 _____ (Microsoft Corporation) C:\WINDOWS\system32\wsp_fs.dll
2017-10-13 21:17 - 2017-09-17 21:25 - 000148992 _____ (Microsoft Corporation) C:\WINDOWS\system32\TabSvc.dll
2017-10-13 21:17 - 2017-09-17 21:25 - 000105984 _____ (Microsoft Corporation) C:\WINDOWS\system32\RjvMDMConfig.dll
2017-10-13 21:17 - 2017-09-17 21:24 - 001584640 _____ (Microsoft Corporation) C:\WINDOWS\system32\wsp_health.dll
2017-10-13 21:17 - 2017-09-17 21:22 - 004749824 _____ (Microsoft Corporation) C:\WINDOWS\system32\SettingsHandlers_nt.dll
2017-10-13 21:17 - 2017-09-17 21:22 - 003291648 _____ (Microsoft Corporation) C:\WINDOWS\system32\mispace.dll
2017-10-13 21:17 - 2017-09-17 21:22 - 000883712 _____ (Microsoft Corporation) C:\WINDOWS\system32\samsrv.dll
2017-10-13 21:17 - 2017-09-17 21:22 - 000352256 _____ (Microsoft Corporation) C:\WINDOWS\system32\mcbuilder.exe
2017-10-13 21:17 - 2017-09-17 21:19 - 001060352 _____ (Microsoft Corporation) C:\WINDOWS\system32\AppContracts.dll
2017-10-13 21:17 - 2017-09-17 21:19 - 000519168 _____ (Microsoft Corporation) C:\WINDOWS\system32\netprofmsvc.dll
2017-10-13 21:17 - 2017-09-17 21:18 - 001010176 _____ (Microsoft Corporation) C:\WINDOWS\system32\enterprisecsps.dll
2017-10-13 21:17 - 2017-09-17 21:18 - 000956416 _____ (Microsoft Corporation) C:\WINDOWS\system32\AppXDeploymentExtensions.desktop.dll
2017-10-13 21:17 - 2017-09-17 21:18 - 000932864 _____ (Microsoft Corporation) C:\WINDOWS\system32\kerberos.dll
2017-10-13 21:17 - 2017-09-17 21:17 - 002279424 _____ (Microsoft Corporation) C:\WINDOWS\system32\AppXDeploymentServer.dll
2017-10-13 21:17 - 2017-09-17 21:16 - 001484800 _____ (Microsoft Corporation) C:\WINDOWS\system32\lsasrv.dll
2017-10-13 21:17 - 2017-09-17 21:15 - 002919936 _____ (Microsoft Corporation) C:\WINDOWS\system32\CertEnroll.dll
2017-10-13 21:17 - 2017-09-17 21:15 - 001692160 _____ (Microsoft Corporation) C:\WINDOWS\system32\AppXDeploymentExtensions.onecore.dll
2017-10-13 21:17 - 2017-09-17 21:15 - 000893952 _____ (Microsoft Corporation) C:\WINDOWS\system32\MPSSVC.dll
2017-10-13 21:17 - 2017-09-17 21:14 - 003615744 _____ (Microsoft Corporation) C:\WINDOWS\system32\win32kfull.sys
2017-10-13 21:17 - 2017-09-17 21:14 - 002321408 _____ (Microsoft Corporation) C:\WINDOWS\system32\wuaueng.dll
2017-10-13 21:17 - 2017-09-17 21:14 - 001040896 _____ (Microsoft Corporation) C:\WINDOWS\system32\NaturalLanguage6.dll
2017-10-13 21:17 - 2017-09-17 21:14 - 000817664 _____ (Microsoft Corporation) C:\WINDOWS\system32\winhttp.dll
2017-10-13 21:17 - 2017-09-17 21:13 - 001726976 _____ (Microsoft Corporation) C:\WINDOWS\system32\Windows.UI.Immersive.dll
2017-10-13 21:17 - 2017-09-17 21:13 - 000203264 _____ (Microsoft Corporation) C:\WINDOWS\system32\netprofm.dll
2017-10-13 21:17 - 2017-09-14 17:32 - 000250880 _____ (Microsoft Corporation) C:\WINDOWS\system32\MSWB7.dll
2017-10-13 21:17 - 2017-09-14 17:31 - 000463872 _____ (Microsoft Corporation) C:\WINDOWS\system32\daxexec.dll
2017-10-13 21:17 - 2017-09-14 17:31 - 000280576 _____ (Microsoft Corporation) C:\WINDOWS\system32\authz.dll
2017-10-13 21:17 - 2017-09-14 17:29 - 000352256 _____ (Microsoft Corporation) C:\WINDOWS\system32\Wldap32.dll
2017-10-13 21:17 - 2017-09-14 17:24 - 000433152 _____ (Microsoft Corporation) C:\WINDOWS\system32\certreq.exe
2017-10-13 21:17 - 2017-09-14 17:23 - 000560128 _____ (Microsoft Corporation) C:\WINDOWS\system32\AppReadiness.dll
2017-10-13 21:17 - 2017-09-14 17:22 - 000820736 _____ (Microsoft Corporation) C:\WINDOWS\system32\netlogon.dll
2017-10-13 21:17 - 2017-09-14 17:19 - 001421824 _____ (Microsoft Corporation) C:\WINDOWS\system32\certutil.exe
2017-10-13 21:17 - 2017-09-14 17:19 - 000928256 _____ (Microsoft Corporation) C:\WINDOWS\system32\SmartcardCredentialProvider.dll
2017-10-13 21:17 - 2017-03-04 01:11 - 001643008 _____ (Microsoft Corporation) C:\WINDOWS\system32\Windows.Media.Speech.dll
2017-10-13 21:17 - 2017-03-04 01:07 - 001064448 _____ (Microsoft Corporation) C:\WINDOWS\system32\SettingSyncCore.dll
2017-10-11 08:42 - 2017-10-14 13:28 - 000000000 ____D C:\WINDOWS\system32\MpEngineStore
2017-10-11 08:39 - 2017-10-14 13:22 - 126925120 ____C (Microsoft Corporation) C:\WINDOWS\system32\MRT-KB890830.exe
2017-10-09 08:26 - 2017-10-11 19:38 - 000000000 _____ C:\WINDOWS\system32\last.dump
2017-10-08 22:24 - 2017-10-18 00:53 - 000161919 _____ C:\WINDOWS\ZAM.krnl.trace
2017-10-08 22:24 - 2017-10-18 00:53 - 000129956 _____ C:\WINDOWS\ZAM_Guard.krnl.trace
2017-10-08 22:24 - 2017-10-09 23:30 - 000000000 ____D C:\Program Files (x86)\Zemana AntiMalware
2017-10-08 22:24 - 2017-10-08 22:24 - 000203680 _____ (Zemana Ltd.) C:\WINDOWS\system32\Drivers\zamguard64.sys
2017-10-08 22:24 - 2017-10-08 22:24 - 000203680 _____ (Zemana Ltd.) C:\WINDOWS\system32\Drivers\zam64.sys
2017-10-08 22:23 - 2017-10-08 22:23 - 000000000 ____D C:\Users\Tina\AppData\Local\Zemana
2017-10-08 18:50 - 2017-10-14 22:42 - 000000000 ____D C:\ProgramData\Emsisoft
2017-10-08 18:47 - 2017-10-18 00:52 - 000000000 ____D C:\Program Files\Emsisoft Anti-Malware
2017-10-08 17:01 - 2017-10-16 09:01 - 008250832 _____ (Malwarebytes) C:\Users\Tina\Desktop\adwcleaner_7.0.3.1.exe
2017-10-06 15:30 - 2017-10-06 15:30 - 000000947 _____ C:\Users\Tina\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Start Tor Browser.lnk
2017-10-06 15:29 - 2017-10-06 15:30 - 000000000 ____D C:\Users\Tina\Desktop\Tor Browser
2017-10-06 11:02 - 2017-10-14 21:51 - 000000000 ____D C:\Users\Tina\AppData\Local\ctfblon
2017-10-06 10:08 - 2017-10-06 10:08 - 000110016 _____ (Malwarebytes) C:\WINDOWS\system32\Drivers\farflt.sys
2017-10-06 10:08 - 2017-10-06 10:08 - 000094144 _____ (Malwarebytes) C:\WINDOWS\system32\Drivers\mwac.sys
2017-10-06 07:59 - 2017-10-13 19:17 - 000077440 _____ C:\WINDOWS\system32\Drivers\mbae64.sys
2017-10-06 07:59 - 2017-10-06 07:59 - 000001914 _____ C:\Users\Public\Desktop\Malwarebytes.lnk
2017-10-06 07:59 - 2017-10-06 07:59 - 000000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Malwarebytes
2017-10-06 07:59 - 2017-10-06 07:59 - 000000000 ____D C:\Program Files\Malwarebytes
2017-10-05 16:34 - 2017-10-05 16:34 - 000000000 ____H C:\Users\Tina\AppData\Local\BITE51C.tmp
2017-10-05 16:31 - 2017-10-05 16:31 - 000000000 _____ C:\Users\Tina\AppData\Local\{25E8ED07-D27B-492A-B460-2DE19B7054D3}
2017-10-05 01:54 - 2017-10-05 01:54 - 000000000 __SHD C:\found.002
2017-10-05 01:54 - 2017-10-05 01:54 - 000000000 __SHD C:\found.001
2017-10-05 01:54 - 2017-10-05 01:54 - 000000000 __SHD C:\found.000
2017-10-04 20:22 - 2017-10-04 20:32 - 000000000 ____D C:\Users\Tina\Downloads\Night Gallery - Season 2 [TVRip mixed] - cOOt
2017-10-02 17:23 - 2017-10-02 17:24 - 016049971 _____ C:\Users\Tina\Downloads\45a179d8-0c44-4e8d-881a-222b9d930ee0.tmp
2017-10-01 19:56 - 2017-10-07 14:40 - 000000000 ____D C:\Users\Tina\Desktop\Tor stuff
2017-10-01 05:04 - 2017-10-05 11:56 - 000000000 ____D C:\Users\Tina\Downloads\Night Gallery - Season 1
2017-10-01 02:54 - 2017-10-01 02:58 - 000088763 _____ C:\Users\Tina\Downloads\.9ee158084dbc475a674ebffd33c97bd533a06db9.parts
2017-10-01 02:53 - 2017-10-01 19:59 - 000000000 ____D C:\Users\Tina\Downloads\My Tribe - New Strategy Game [h33t][Wendy99]
2017-10-01 02:13 - 2017-10-08 14:50 - 000001940 _____ C:\Users\Tina\Desktop\BitLord.lnk
2017-10-01 02:13 - 2017-10-05 10:27 - 000000000 ____D C:\Users\Tina\AppData\Roaming\BitLord
2017-10-01 02:13 - 2017-10-04 18:33 - 000000000 ____D C:\ProgramData\Package Cache
2017-10-01 02:13 - 2017-10-01 02:13 - 000000000 ____D C:\Users\Tina\Documents\BitLord
2017-10-01 02:13 - 2017-10-01 02:13 - 000000000 ____D C:\Users\Tina\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\BitLord
2017-10-01 02:13 - 2017-10-01 02:13 - 000000000 ____D C:\Users\Tina\AppData\Local\BitLord
2017-10-01 02:13 - 2017-10-01 02:13 - 000000000 ____D C:\Users\Tina\.QtWebEngineProcess
2017-10-01 02:13 - 2017-10-01 02:13 - 000000000 ____D C:\Users\Tina\.BitLord
2017-10-01 02:12 - 2017-10-01 02:13 - 000000000 ____D C:\Program Files (x86)\BitLord
2017-10-01 02:10 - 2017-10-06 11:07 - 000000000 ____D C:\Users\Tina\Desktop\Setup Files
2017-09-30 22:26 - 2017-10-10 20:04 - 000004422 _____ C:\WINDOWS\System32\Tasks\Adobe Flash Player Updater
2017-09-30 16:41 - 2017-10-12 20:31 - 000000000 ____D C:\Program Files\rempl
2017-09-27 13:19 - 2017-09-27 13:19 - 000000012 _____ C:\Users\Tina\Documents\key.txt
2017-09-24 12:25 - 2017-09-24 12:25 - 000000000 ____D C:\ProgramData\PicPick
2017-09-20 21:51 - 2017-09-30 22:26 - 000000000 ____D C:\Users\Tina\AppData\Local\Adobe
2017-09-20 12:32 - 2017-09-20 12:32 - 000002234 _____ C:\Users\Public\Desktop\Play Diner Dash - Seasonal Snack Pack.lnk
2017-09-20 12:31 - 2017-09-20 12:32 - 000000000 ____D C:\Program Files (x86)\Diner Dash - Seasonal Snack Pack
2017-09-20 12:31 - 2017-09-20 12:31 - 000000000 ____D C:\Users\Tina\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Diner Dash - Seasonal Snack Pack
2017-09-20 12:31 - 2017-09-20 12:31 - 000000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Diner Dash - Seasonal Snack Pack
2017-09-20 02:13 - 2017-09-20 12:32 - 000001254 _____ C:\Users\Public\Desktop\More Great Games.lnk
 
==================== One Month Modified files and folders ========
 
(If an entry is included in the fixlist, the file/folder will be moved.)
 
2017-10-18 00:50 - 2015-06-14 20:57 - 000000000 ____D C:\ProgramData\TEMP
2017-10-17 19:14 - 2016-09-05 16:27 - 000000000 ____D C:\WINDOWS\system32\SleepStudy
2017-10-17 19:08 - 2016-07-16 06:36 - 000000000 ____D C:\WINDOWS\CbsTemp
2017-10-17 19:07 - 2017-07-25 07:32 - 000000000 ____D C:\ProgramData\ASUS Smart Gesture
2017-10-17 19:06 - 2017-09-15 01:05 - 000000180 _____ C:\WINDOWS\system32\{A6D608F0-0BDE-491A-97AE-5C4B05D86E01}.bat
2017-10-17 07:40 - 2015-07-06 15:21 - 000000000 ____D C:\Program Files\SUPERAntiSpyware
2017-10-16 23:04 - 2016-07-16 06:47 - 000000000 ____D C:\WINDOWS\SysWOW64\Macromed
2017-10-16 23:04 - 2016-07-16 06:47 - 000000000 ____D C:\WINDOWS\system32\Macromed
2017-10-16 21:56 - 2016-09-05 16:56 - 000000006 ____H C:\WINDOWS\Tasks\SA.DAT
2017-10-16 21:48 - 2017-09-13 14:08 - 000000000 ____D C:\WINDOWS\pss
2017-10-16 21:48 - 2016-09-05 16:35 - 000000000 ____D C:\Users\Tina
2017-10-16 19:30 - 2016-07-16 01:04 - 017301504 _____ C:\WINDOWS\system32\config\HARDWARE
2017-10-16 09:40 - 2016-07-16 01:04 - 000786432 _____ C:\WINDOWS\system32\config\BBI
2017-10-16 09:01 - 2015-06-14 09:55 - 000000000 ____D C:\AdwCleaner
2017-10-15 16:36 - 2017-09-15 01:47 - 000000000 ____D C:\zoek_backup
2017-10-15 14:01 - 2017-09-17 07:54 - 000000214 _____ C:\WINDOWS\Tasks\CreateExplorerShellUnelevatedTask.job
2017-10-15 13:14 - 2015-03-21 18:25 - 000000000 ____D C:\ProgramData\AVAST Software
2017-10-14 22:26 - 2016-09-05 13:46 - 000001212 _____ C:\Users\Tina\Desktop\LUXOR 2.lnk
2017-10-14 21:57 - 2016-08-26 10:22 - 000000000 ____D C:\Program Files (x86)\Fishdom H20 Hidden Odyssey
2017-10-14 13:22 - 2015-03-21 20:31 - 126925120 ____C (Microsoft Corporation) C:\WINDOWS\system32\MRT.exe
2017-10-14 10:01 - 2016-07-16 06:45 - 000000000 ____D C:\WINDOWS\INF
2017-10-14 09:51 - 2017-09-14 19:57 - 000000000 ____D C:\Users\Tina\Documents\Backup CCleaner Reg logs
2017-10-14 09:41 - 2015-03-21 17:55 - 000000424 _____ C:\Users\Tina\Desktop\This PC - Shortcut.lnk
2017-10-14 08:41 - 2016-07-16 06:47 - 000000000 ____D C:\WINDOWS\AppReadiness
2017-10-14 08:34 - 2014-12-05 11:55 - 000000000 __RHD C:\Users\Public\AccountPictures
2017-10-14 02:25 - 2016-07-16 06:47 - 000000000 ____D C:\WINDOWS\rescache
2017-10-14 00:18 - 2015-11-28 13:55 - 002260978 _____ C:\WINDOWS\system32\PerfStringBackup.INI
2017-10-14 00:12 - 2017-09-14 19:25 - 000346472 _____ C:\WINDOWS\system32\FNTCACHE.DAT
2017-10-14 00:08 - 2016-07-16 06:47 - 000000000 ___RD C:\WINDOWS\ImmersiveControlPanel
2017-10-14 00:08 - 2016-07-16 06:47 - 000000000 ____D C:\WINDOWS\system32\oobe
2017-10-14 00:08 - 2016-07-16 06:47 - 000000000 ____D C:\WINDOWS\ShellExperiences
2017-10-12 17:27 - 2016-07-16 06:49 - 000835576 _____ (Adobe Systems Incorporated) C:\WINDOWS\SysWOW64\FlashPlayerApp.exe
2017-10-12 17:27 - 2016-07-16 06:49 - 000177656 _____ (Adobe Systems Incorporated) C:\WINDOWS\SysWOW64\FlashPlayerCPLApp.cpl
2017-10-11 08:39 - 2015-03-21 20:31 - 000000000 ____D C:\WINDOWS\system32\MRT
2017-10-08 23:06 - 2015-06-14 09:48 - 000000000 ____D C:\Users\Tina\Desktop\backgrounds
2017-10-08 22:42 - 2015-06-14 08:27 - 000000000 ___RD C:\Users\Tina\Desktop\tools
2017-10-08 18:06 - 2015-06-09 18:01 - 000000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Microsoft Office
2017-10-08 17:34 - 2015-11-27 20:33 - 000055232 _____ C:\WINDOWS\system32\Drivers\hitmanpro37.sys
2017-10-08 15:39 - 2016-01-09 16:18 - 000097856 _____ (Oracle Corporation) C:\WINDOWS\SysWOW64\WindowsAccessBridge-32.dll
2017-10-08 15:39 - 2016-01-09 16:18 - 000000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Java
2017-10-08 15:38 - 2016-01-09 16:17 - 000000000 ____D C:\Program Files (x86)\Java
2017-10-08 15:37 - 2016-08-28 13:54 - 000001145 _____ C:\Users\Public\Desktop\VLC media player.lnk
2017-10-08 15:37 - 2015-06-27 13:32 - 000000000 ____D C:\Users\Tina\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\WinRAR
2017-10-08 15:37 - 2015-06-27 13:32 - 000000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\WinRAR
2017-10-08 15:37 - 2015-06-27 13:29 - 000000000 ____D C:\Program Files\WinRaR
2017-10-07 20:38 - 2016-08-28 13:54 - 000000000 ____D C:\Users\Tina\AppData\Roaming\vlc
2017-10-07 14:37 - 2016-07-16 06:47 - 000000000 ___HD C:\Program Files\WindowsApps
2017-10-07 14:37 - 2015-03-21 17:34 - 000000000 ____D C:\Users\Tina\AppData\Local\Packages
2017-10-07 14:26 - 2017-09-15 01:24 - 000000000 ____D C:\Program Files\FreeFixer
2017-10-06 15:50 - 2015-10-30 04:07 - 000000000 ____D C:\WINDOWS\ShellNew
2017-10-06 11:05 - 2017-07-07 00:48 - 000061304 _____ () C:\WINDOWS\system32\Drivers\lpsport.sys
2017-10-06 08:34 - 2016-07-16 06:47 - 000000000 ____D C:\WINDOWS\LiveKernelReports
2017-10-06 08:05 - 2016-06-17 14:19 - 000000000 ___RD C:\Users\Tina\Desktop\Fun and Games
2017-10-06 07:59 - 2015-03-21 18:43 - 000000000 ____D C:\ProgramData\Malwarebytes
2017-10-05 11:26 - 2017-09-15 10:32 - 000000000 ____D C:\Program Files\Mozilla Firefox
2017-10-05 11:26 - 2017-09-15 10:32 - 000000000 ____D C:\Program Files (x86)\Mozilla Maintenance Service
2017-09-30 18:35 - 2017-09-15 01:06 - 000000000 ____D C:\Users\Tina\AppData\Local\unilezp
2017-09-27 13:22 - 2015-03-22 12:05 - 000000000 ___RD C:\Users\Tina\OneDrive
2017-09-27 12:27 - 2017-09-15 09:52 - 000002274 _____ C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Google Chrome.lnk
2017-09-23 00:37 - 2017-06-15 23:57 - 000000000 ____D C:\WINDOWS\Minidump
2017-09-22 14:20 - 2017-07-27 10:52 - 000003358 _____ C:\WINDOWS\System32\Tasks\OneDrive Standalone Update Task-S-1-5-21-2910918007-1667735213-2428426781-1001
2017-09-22 14:20 - 2015-11-28 20:39 - 000002404 _____ C:\Users\Tina\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\OneDrive.lnk
2017-09-22 01:39 - 2015-06-13 20:31 - 000000000 ____D C:\BigFishCache
2017-09-20 12:31 - 2014-10-02 15:34 - 000000000 ___RD C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Games
2017-09-20 11:43 - 2017-08-18 13:46 - 000000000 ____D C:\Program Files\CCleaner
2017-09-19 19:05 - 2017-07-11 01:54 - 000000000 ____D C:\$WINDOWS.~BT
2017-09-19 19:05 - 2016-09-05 20:26 - 000000000 ___DC C:\WINDOWS\Panther
 
==================== Files in the root of some directories =======
 
2017-10-05 16:34 - 2017-10-05 16:34 - 000000000 ____H () C:\Users\Tina\AppData\Local\BITE51C.tmp
2016-05-26 21:33 - 2016-05-26 23:22 - 000010240 _____ () C:\Users\Tina\AppData\Local\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini
2017-10-05 16:31 - 2017-10-05 16:31 - 000000000 _____ () C:\Users\Tina\AppData\Local\{25E8ED07-D27B-492A-B460-2DE19B7054D3}
2016-09-05 16:31 - 2016-09-05 16:31 - 000000000 ____H () C:\ProgramData\DP45977C.lfl
2014-10-02 15:33 - 2012-09-07 06:40 - 000000256 _____ () C:\ProgramData\SetStretch.cmd
2014-10-02 15:33 - 2009-07-22 05:04 - 000024576 _____ () C:\ProgramData\SetStretch.exe
2014-10-02 15:33 - 2012-09-07 06:37 - 000000103 _____ () C:\ProgramData\SetStretch.VBS
 
==================== Bamital & volsnap ======================
 
(There is no automatic fix for files that do not pass verification.)
 
C:\WINDOWS\system32\winlogon.exe => File is digitally signed
C:\WINDOWS\system32\wininit.exe => File is digitally signed
C:\WINDOWS\explorer.exe => File is digitally signed
C:\WINDOWS\SysWOW64\explorer.exe => File is digitally signed
C:\WINDOWS\system32\svchost.exe => File is digitally signed
C:\WINDOWS\SysWOW64\svchost.exe => File is digitally signed
C:\WINDOWS\system32\services.exe => File is digitally signed
C:\WINDOWS\system32\User32.dll => File is digitally signed
C:\WINDOWS\SysWOW64\User32.dll => File is digitally signed
C:\WINDOWS\system32\userinit.exe => File is digitally signed
C:\WINDOWS\SysWOW64\userinit.exe => File is digitally signed
C:\WINDOWS\system32\rpcss.dll => File is digitally signed
C:\WINDOWS\system32\dnsapi.dll => File is digitally signed
C:\WINDOWS\SysWOW64\dnsapi.dll => File is digitally signed
C:\WINDOWS\system32\Drivers\volsnap.sys => File is digitally signed
 
LastRegBack: 2017-10-14 00:23
 
==================== End of FRST.txt ============================
 
 

SECOND FILE:   Addition.txt

 

 

Additional scan result of Farbar Recovery Scan Tool (x64) Version: 16-10-2017
Ran by Tina (18-10-2017 00:55:42)
Running from C:\Users\Tina\Desktop
Windows 10 Home Version 1607 170917-1700 (X64) (2016-09-05 22:12:08)
Boot Mode: Normal
==========================================================
 
 
==================== Accounts: =============================
 
Administrator (S-1-5-21-2910918007-1667735213-2428426781-500 - Administrator - Disabled)
DefaultAccount (S-1-5-21-2910918007-1667735213-2428426781-503 - Limited - Disabled)
Guest (S-1-5-21-2910918007-1667735213-2428426781-501 - Limited - Disabled)
HomeGroupUser$ (S-1-5-21-2910918007-1667735213-2428426781-1003 - Limited - Enabled)
Tina (S-1-5-21-2910918007-1667735213-2428426781-1001 - Administrator - Enabled) => C:\Users\Tina
 
==================== Security Center ========================
 
(If an entry is included in the fixlist, it will be removed.)
 
AV: Windows Defender (Disabled - Up to date) {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
AV: Emsisoft Anti-Malware (Enabled - Up to date) {701CB209-EBBC-AADC-11E6-DE73E7AF4C9D}
AS: Emsisoft Anti-Malware (Enabled - Up to date) {CB7D53ED-CD86-A552-2B56-E5019C280620}
AS: Windows Defender (Disabled - Up to date) {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
 
==================== Installed Programs ======================
 
(Only the adware programs with "Hidden" flag could be added to the fixlist to unhide them. The adware programs should be uninstalled manually.)
 
Adobe Flash Player 27 NPAPI (HKLM-x32\...\Adobe Flash Player NPAPI) (Version: 27.0.0.170 - Adobe Systems Incorporated)
Amazon Games & Software Downloader (HKLM-x32\...\Amazon Games & Software Downloader_is1) (Version: 2.1.0.1 - Amazon)
ASUS Screen Saver (HKLM-x32\...\{0FBEEDF8-30FA-4FA3-B31F-C9C7E7E8DFA2}) (Version: 1.0.3 - ASUS)
ASUS Smart Gesture (HKLM-x32\...\{4D3286A6-F6AB-498A-82A4-E4F040529F3D}) (Version: 4.0.18 - ASUS)
ASUS USB Charger Plus (HKLM-x32\...\{A859E3E5-C62F-4BFA-AF1D-2B95E03166AF}) (Version: 3.1.9 - ASUS)
ATK Package (HKLM-x32\...\{AB5C933E-5C7D-4D30-B314-9C83A49B94BE}) (Version: 1.0.0036 - ASUS)
Big Fish: Game Manager (HKLM-x32\...\BFGC) (Version: 3.3.0.2 - )
BitLord 2.5 (HKLM-x32\...\BitLord) (Version: 2.4.5-316 - House of Life)
Broadcom 802.11 Network Adapter (HKLM\...\Broadcom 802.11 Network Adapter) (Version: 6.30.223.228 - Broadcom Corporation)
Build in Time (HKLM-x32\...\Build in Time_is1) (Version:  - )
CCleaner (HKLM\...\CCleaner) (Version: 5.35 - Piriform)
CPUID CPU-Z 1.76 (HKLM\...\CPUID CPU-Z_is1) (Version:  - )
Device Setup (HKLM-x32\...\{1F07F2C7-596F-4F34-B805-2C61A3E50E5A}) (Version: 1.0.18 - ASUSTek Computer Inc.)
Diner Dash: Seasonal Snack Pack (HKLM-x32\...\BFG-Diner Dash - Seasonal Snack Pack) (Version:  - )
Emsisoft Anti-Malware (HKLM\...\{5502032C-88C1-4303-99FE-B5CBD7684CEA}_is1) (Version: 2017.9 - Emsisoft Ltd.)
Fishdom H20 Hidden Odyssey (HKLM-x32\...\Fishdom H20 Hidden Odyssey_is1) (Version:  - )
Foxit PhantomPDF (HKLM-x32\...\{045A0488-55C1-45B1-9992-4B4134904D61}) (Version: 7.0.59.127 - Foxit Software Inc.)
Google Chrome (HKLM-x32\...\Google Chrome) (Version: 61.0.3163.100 - Google Inc.)
Google Update Helper (HKLM-x32\...\{60EC980A-BDA2-4CB6-A427-B07A5498B4CA}) (Version: 1.3.33.5 - Google Inc.) Hidden
Intel® Dynamic Platform and Thermal Framework (HKLM-x32\...\FFD10ECE-F715-4a86-9BD8-F6F47DA5DA1C) (Version: 7.1.0.2105 - Intel Corporation)
Intel® Management Engine Components (HKLM-x32\...\{65153EA5-8B6E-43B6-857B-C6E4FC25798A}) (Version: 9.6.0.1038 - Intel Corporation)
Java 8 Update 131 (HKLM-x32\...\{26A24AE4-039D-4CA4-87B4-2F32180131F0}) (Version: 8.0.1310.11 - Oracle Corporation)
Java 8 Update 144 (HKLM-x32\...\{26A24AE4-039D-4CA4-87B4-2F32180144F0}) (Version: 8.0.1440.1 - Oracle Corporation)
KB4023057 (HKLM\...\{0C050BEE-16BE-4998-8959-2A421433DB6E}) (Version: 2.5.0.0 - Microsoft Corporation)
LUXOR - Amun Rising (HKLM-x32\...\LUXOR - Amun Rising) (Version: 1.1.0.0 - MumboJumbo)
LUXOR - Mah Jong (HKLM-x32\...\LUXOR - Mah Jong) (Version: 1.1.0.0 - MumboJumbo)
LUXOR (HKLM-x32\...\LUXOR) (Version: 1.1.0.0 - MumboJumbo)
LUXOR 2 (HKLM-x32\...\LUXOR 2) (Version: 1.1.0.0 - MumboJumbo)
Malwarebytes version 3.2.2.2029 (HKLM\...\{35065F43-4BB2-439A-BFF7-0F1014F2E0CD}_is1) (Version: 3.2.2.2029 - Malwarebytes)
Microsoft Office 2007 Service Pack 3 (SP3) (HKLM-x32\...\{90120000-0030-0000-0000-0000000FF1CE}_ENTERPRISE_{6E107EB7-8B55-48BF-ACCB-199F86A2CD93}) (Version:  - Microsoft)
Microsoft Office Enterprise 2007 (HKLM-x32\...\ENTERPRISE) (Version: 12.0.6612.1000 - Microsoft Corporation)
Microsoft Office File Validation Add-In (HKLM-x32\...\{90140000-2005-0000-0000-0000000FF1CE}) (Version: 14.0.5130.5003 - Microsoft Corporation)
Microsoft OneDrive (HKU\S-1-5-21-2910918007-1667735213-2428426781-1001\...\OneDriveSetup.exe) (Version: 17.3.6998.0830 - Microsoft Corporation)
Microsoft Project Workgroup (HKLM-x32\...\MS Project Workgroup) (Version:  - )
Microsoft Silverlight (HKLM\...\{89F4137D-6C26-4A84-BDB8-2E5A4BB71E00}) (Version: 5.1.50907.0 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17 (HKLM-x32\...\{9A25302D-30C0-39D9-BD6F-21E6EC160475}) (Version: 9.0.30729 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161 (HKLM-x32\...\{9BE518E6-ECC6-35A9-88E4-87755C07200F}) (Version: 9.0.30729.6161 - Microsoft Corporation)
Microsoft Visual C++ 2010  x64 Redistributable - 10.0.40219 (HKLM\...\{1D8E6291-B0D5-35EC-8441-6616F567A0F7}) (Version: 10.0.40219 - Microsoft Corporation)
Microsoft Visual C++ 2010  x86 Redistributable - 10.0.40219 (HKLM-x32\...\{F0C3E5D1-1ADE-321E-8167-68EF0DE699A5}) (Version: 10.0.40219 - Microsoft Corporation)
Microsoft Visual C++ 2012 Redistributable (x86) - 11.0.61030 (HKLM-x32\...\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}) (Version: 11.0.61030.0 - Microsoft Corporation)
Microsoft Visual C++ 2013 Redistributable (x86) - 12.0.30501 (HKLM-x32\...\{f65db027-aff3-4070-886a-0d87064aabb1}) (Version: 12.0.30501.0 - Microsoft Corporation)
Microsoft Visual C++ 2015 Redistributable (x86) - 14.0.24215 (HKLM-x32\...\{e2803110-78b3-4664-a479-3611a381656a}) (Version: 14.0.24215.1 - Microsoft Corporation)
Mozilla Firefox 56.0 (x64 en-US) (HKLM\...\Mozilla Firefox 56.0 (x64 en-US)) (Version: 56.0 - Mozilla)
Mozilla Maintenance Service (HKLM\...\MozillaMaintenanceService) (Version: 55.0.3 - Mozilla)
OpenVPN 2.3.1-I001  (HKLM\...\OpenVPN) (Version: 2.3.1-I001 - )
PicPick (HKLM-x32\...\PicPick) (Version: 4.0.8.1 - NGWIN)
Realtek Ethernet Controller Driver (HKLM-x32\...\{8833FFB6-5B0C-4764-81AA-06DFEED9A476}) (Version: 8.33.529.2014 - Realtek)
Realtek High Definition Audio Driver (HKLM-x32\...\{F132AF7F-7BCA-4EDE-8A7C-958108FE7DBC}) (Version: 6.0.1.7224 - Realtek Semiconductor Corp.)
Skype Click to Call (HKLM-x32\...\{873F8E7C-10E6-449F-BD7E-5FBA7C8E1C9B}) (Version: 8.5.0.9167 - Microsoft Corporation)
Skype™ 7.40 (HKLM-x32\...\{3B7E914A-93D5-4A29-92BB-AF8C3F66C431}) (Version: 7.40.103 - Skype Technologies S.A.)
SUPERAntiSpyware (HKLM\...\{CDDCBBF1-2703-46BC-938B-BCC81A1EEAAA}) (Version: 6.0.1248 - SUPERAntiSpyware.com)
TAP-Windows 9.9.2 (HKLM\...\TAP-Windows) (Version: 9.9.2 - )
Total Video Converter 3.71 100812 (HKLM-x32\...\Total Video Converter 3.71_is1) (Version:  - EffectMatrix Inc.)
Unchecky v1.1 (HKLM-x32\...\Unchecky) (Version: 1.1 - Reason Software Company Inc.)
Update for 2007 Microsoft Office System (KB967642) (HKLM-x32\...\{90120000-0030-0000-0000-0000000FF1CE}_ENTERPRISE_{C444285D-5E4F-48A4-91DD-47AAAA68E92D}) (Version:  - Microsoft)
Virtual Families 2 - Our Dream House (HKLM-x32\...\Virtual Families 2 - Our Dream Housev1.1.1) (Version: v1.1.1 - Last Day of Work)
VLC media player (HKLM-x32\...\VLC media player) (Version: 2.2.6 - VideoLAN)
WebStorage (HKLM-x32\...\WebStorage) (Version: 2.1.11.399 - ASUS Cloud Corporation)
Windows 10 Update and Privacy Settings (HKLM\...\{4DFCD818-036A-4229-A67D-CF17DC461D92}) (Version: 1.0.14.0 - Microsoft Corporation)
WinFlash (HKLM-x32\...\{8F21291E-0444-4B1D-B9F9-4370A73E346D}) (Version: 2.42.0 - ASUS)
WinRAR 5.40 (64-bit) (HKLM\...\WinRAR archiver) (Version: 5.40.0 - win.rar GmbH)
 
==================== Custom CLSID (Whitelisted): ==========================
 
(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)
 
ShellIconOverlayIdentifiers: [!AsusWSShellExt_B] -> {6D4133E5-0742-4ADC-8A8C-9303440F7191} => C:\Program Files (x86)\Common Files\AWS\2.1.11.399\ASUSWSShellExt64.dll [2013-06-25] (ASUS Cloud Corporation.)
ShellIconOverlayIdentifiers: [!AsusWSShellExt_O] -> {64174815-8D98-4CE6-8646-4C039977D809} => C:\Program Files (x86)\Common Files\AWS\2.1.11.399\ASUSWSShellExt64.dll [2013-06-25] (ASUS Cloud Corporation.)
ShellIconOverlayIdentifiers: [!AsusWSShellExt_U] -> {1C5AB7B1-0B38-4EC4-9093-7FD277E2AF4E} => C:\Program Files (x86)\Common Files\AWS\2.1.11.399\ASUSWSShellExt64.dll [2013-06-25] (ASUS Cloud Corporation.)
ShellIconOverlayIdentifiers: [00asw] -> {472083B0-C522-11CF-8763-00608CC02F24} =>  -> No File
ShellIconOverlayIdentifiers: [00avast] -> {472083B0-C522-11CF-8763-00608CC02F24} =>  -> No File
ContextMenuHandlers1: [2.0 Zemana AntiMalware] -> {6ABB1C11-E261-4CEA-BBB5-3836225689DD} => C:\Program Files (x86)\Zemana AntiMalware\ZAMShellExt64.dll [2017-10-08] ()
ContextMenuHandlers1: [Foxit_ConvertToPDF] -> {C5269811-4A29-4818-A4BB-111F9FC63A5F} => C:\Program Files (x86)\Foxit PhantomPDF\plugins\ConvertToPDFShellExtension_x64.dll [2015-01-27] (Foxit Software Inc.)
ContextMenuHandlers1: [TVCShellExt] -> {4E33A7F5-8083-4C08-9D45-C5CED88F5C04} => C:\Program Files (x86)\Total Video Converter\TVCShellExtx64.dll [2010-07-29] ()
ContextMenuHandlers1: [WinRAR] -> {B41DB860-64E4-11D2-9906-E49FADC173CA} => C:\Program Files\WinRAR\rarext.dll [2016-08-15] (Alexander Roshal)
ContextMenuHandlers1-x32: [WinRAR32] -> {B41DB860-8EE4-11D2-9906-E49FADC173CA} => C:\Program Files\WinRAR\rarext32.dll [2016-08-15] (Alexander Roshal)
ContextMenuHandlers1-x32: [WondershareVideoConverterFileOpreation] -> {FEB746CA-95C2-485F-B386-C30D4E56D22E} => C:\WINDOWS\SysWoW64\WSCM64.dll [2015-02-27] ()
ContextMenuHandlers2-x32: [Emsisoft Shell Extension] -> {AB77609F-2178-4E6F-9C4B-44AC179D937A} => C:\PROGRAM FILES\EMSISOFT ANTI-MALWARE\A2CONTMENU.DLL [2015-10-21] (Emsisoft Ltd)
ContextMenuHandlers2-x32: [Emsisoft Shell Extension x64] -> {E3F21FC7-6D65-48E7-B62B-E9ED8200C764} => C:\PROGRAM FILES\EMSISOFT ANTI-MALWARE\A2CONTMENU64.DLL [2015-10-21] (Emsisoft Ltd)
ContextMenuHandlers3: [BackupContextMenuExtension] -> {b1b96b20-da1d-4a3c-92c1-7229b32f2326} => C:\WINDOWS\SYSTEM32\mscoree.dll [2016-07-16] (Microsoft Corporation)
ContextMenuHandlers3-x32: [Emsisoft Shell Extension] -> {AB77609F-2178-4E6F-9C4B-44AC179D937A} => C:\PROGRAM FILES\EMSISOFT ANTI-MALWARE\A2CONTMENU.DLL [2015-10-21] (Emsisoft Ltd)
ContextMenuHandlers3-x32: [Emsisoft Shell Extension x64] -> {E3F21FC7-6D65-48E7-B62B-E9ED8200C764} => C:\PROGRAM FILES\EMSISOFT ANTI-MALWARE\A2CONTMENU64.DLL [2015-10-21] (Emsisoft Ltd)
ContextMenuHandlers3-x32: [MBAMShlExt] -> {57CE581A-0CB6-4266-9CA0-19364C90A0B3} => C:\Program Files\Malwarebytes\Anti-Malware\mbshlext.dll [2017-08-30] (Malwarebytes)
ContextMenuHandlers5: [igfxcui] -> {3AB1675A-CCFF-11D2-8B20-00A0C93CB1F4} =>  -> No File
ContextMenuHandlers5: [igfxOSP] -> {FA507C3F-30C6-4DCA-9EE5-2656072EEC14} =>  -> No File
ContextMenuHandlers6: [2.0 Zemana AntiMalware] -> {6ABB1C11-E261-4CEA-BBB5-3836225689DD} => C:\Program Files (x86)\Zemana AntiMalware\ZAMShellExt64.dll [2017-10-08] ()
ContextMenuHandlers6-x32: [Emsisoft Shell Extension] -> {AB77609F-2178-4E6F-9C4B-44AC179D937A} => C:\PROGRAM FILES\EMSISOFT ANTI-MALWARE\A2CONTMENU.DLL [2015-10-21] (Emsisoft Ltd)
ContextMenuHandlers6-x32: [Emsisoft Shell Extension x64] -> {E3F21FC7-6D65-48E7-B62B-E9ED8200C764} => C:\PROGRAM FILES\EMSISOFT ANTI-MALWARE\A2CONTMENU64.DLL [2015-10-21] (Emsisoft Ltd)
ContextMenuHandlers6-x32: [MBAMShlExt] -> {57CE581A-0CB6-4266-9CA0-19364C90A0B3} => C:\Program Files\Malwarebytes\Anti-Malware\mbshlext.dll [2017-08-30] (Malwarebytes)
ContextMenuHandlers6-x32: [WinRAR] -> {B41DB860-64E4-11D2-9906-E49FADC173CA} => C:\Program Files\WinRAR\rarext.dll [2016-08-15] (Alexander Roshal)
ContextMenuHandlers6-x32-x32: [WinRAR32] -> {B41DB860-8EE4-11D2-9906-E49FADC173CA} => C:\Program Files\WinRAR\rarext32.dll [2016-08-15] (Alexander Roshal)
 
==================== Scheduled Tasks (Whitelisted) =============
 
(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)
 
Task: {06DAD1E6-CF4E-437C-B5D8-A3DE7902AC36} - System32\Tasks\{EFAFD107-EC0F-4492-8BBA-4EBC93A81596} => C:\WINDOWS\system32\pcalua.exe -a "C:\Program Files (x86)\epson\escndv\setup\setup.exe" -c /r
Task: {09BFB9A5-37F5-41A0-BBF0-27765AB74FD0} - System32\Tasks\{C4C972DF-E716-4715-B990-92097B6CAC0E} => C:\WINDOWS\system32\pcalua.exe -a C:\Users\Tina\Desktop\PuzzleInlay\UNWISE.EXE -d C:\Users\Tina\Desktop\PuzzleInlay
Task: {1019DC13-0F1D-4902-AF93-CAA73A5AB4EE} - System32\Tasks\{B8E6547F-6E69-4900-8D51-34D0E151292E} => C:\Windows\system32\pcalua.exe -a "C:\Program Files (x86)\Itibiti Soft Phone\unins000.exe"
Task: {17712375-1A2D-4CFC-BAE5-D099B308180C} - \Microsoft\Windows\Setup\GWXTriggers\Time-5d -> No File <==== ATTENTION
Task: {2424E699-5352-4010-837B-16514C7881FB} - System32\Tasks\Adobe Flash Player Updater => C:\WINDOWS\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe [2017-10-16] (Adobe Systems Incorporated)
Task: {27453EC7-81D1-4C28-B5B9-8763392E5A40} - \WPD\SqmUpload_S-1-5-21-2910918007-1667735213-2428426781-1001 -> No File <==== ATTENTION
Task: {2B299388-474D-470D-B137-C7A8198131E9} - \ActionManager -> No File <==== ATTENTION
Task: {3072F555-9DC6-4FA0-B7CD-205E0A39D1C6} - System32\Tasks\SafeZone scheduled Autoupdate 1463262979 => C:\Program Files\AVAST Software\SZBrowser\launcher.exe
Task: {352E6CA0-7314-4DF4-89C4-682368D80D57} - System32\Tasks\Microsoft\Windows\Workplace Join\Automatic-Workplace-Join => C:\WINDOWS\System32\AutoWorkplace.exe
Task: {3570237E-B30B-4A1C-B97E-E08786E58E1B} - \Microsoft\Windows\Setup\gwx\refreshgwxcontent -> No File <==== ATTENTION
Task: {40340C9A-4F5A-4A22-9797-0A246D3DC857} - \Microsoft\Windows\Setup\gwx\launchtrayprocess -> No File <==== ATTENTION
Task: {426851B6-06A9-40A4-A822-75C9390CB2FA} - System32\Tasks\GoogleUpdateTaskMachineUA => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe [2017-09-15] (Google Inc.)
Task: {5C171501-F48B-4E74-87B4-FAD4F7C150A7} - \Microsoft\Windows\Setup\GWXTriggers\OutOfIdle-5d -> No File <==== ATTENTION
Task: {64AEA766-EE79-4B9F-AF42-DE4C5045EA04} - System32\Tasks\RtHDVBg => C:\Program Files\Realtek\Audio\HDA\RAVBg64.exe [2014-04-15] (Realtek Semiconductor)
Task: {675BCD46-CF07-4166-9967-5F60ED15454B} - System32\Tasks\{523D8A65-41A9-4331-812C-683E6201B6B2} => C:\WINDOWS\system32\pcalua.exe -a D:\Setup.exe -d C:\Users\Tina\Desktop
Task: {720ECEF6-A436-4770-920D-30FD3CFEBECC} - System32\Tasks\ASUS USB Charger Plus => C:\Program Files (x86)\ASUS\USBChargerPlus\USBChargerPlus.exe [2014-03-27] (ASUSTek Computer Inc.)
Task: {A6B0D864-3E49-4509-8BF6-E385DA9801C6} - \Microsoft\Windows\Setup\gwx\refreshgwxconfig -> No File <==== ATTENTION
Task: {BD01B2B6-2328-412E-A7F5-0972D1B24FD1} - System32\Tasks\CCleanerSkipUAC => C:\Program Files\CCleaner\CCleaner.exe [2017-09-20] (Piriform Ltd)
Task: {C1AA9627-E598-4A35-AEB2-356016A3D2CA} - System32\Tasks\ASUS\ASUS Product Register Service => C:\Program Files (x86)\ASUS\APRP\aprp.exe [2014-09-02] (ASUSTek Computer Inc.)
Task: {C812A007-2406-46EE-A701-596601030215} - \Microsoft\Windows\Setup\GWXTriggers\Telemetry-4xd -> No File <==== ATTENTION
Task: {CD9C5AE6-74E3-4DC2-BE09-3545C484BB40} - \Microsoft\Windows\Setup\GWXTriggers\MachineUnlock-5d -> No File <==== ATTENTION
Task: {D27433ED-A69B-4CD1-A214-FF2AD89D7400} - \Microsoft\Windows\Setup\GWXTriggers\Logon-5d -> No File <==== ATTENTION
Task: {D7E92260-6511-4D37-95D6-6EE71387E303} - System32\Tasks\ATK Package 36D18D69AFC3 => C:\Program Files (x86)\ASUS\ATK Package\ATK Hotkey\SimAppExec.exe [2014-01-14] (ASUSTek Computer Inc.)
Task: {DBC21411-678E-487B-B900-7372D96DACF6} - System32\Tasks\ASUS Smart Gesture Launcher => C:\Program Files (x86)\ASUS\ASUS Smart Gesture\AsTPCenter\x64\AsusTPLauncher.exe [2017-03-09] (AsusTek)
Task: {E0ABC341-3B57-41D3-92F5-7CCBFEF9BA90} - System32\Tasks\RTKCPL => C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe [2014-04-10] (Realtek Semiconductor)
Task: {E644A76B-8005-4888-9510-B018D3558581} - \Microsoft\Windows\Setup\GWXTriggers\OutOfSleep-5d -> No File <==== ATTENTION
Task: {F7B51E51-066B-40DE-B15A-E36206C36C08} - System32\Tasks\GoogleUpdateTaskMachineCore => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe [2017-09-15] (Google Inc.)
Task: {F86CE443-C535-4D5D-B4B7-D2FD730D6709} - \RunAsStdUser Task -> No File <==== ATTENTION
Task: {FAD4A979-0D0F-48A7-A002-E94CAB2C0D40} - \Microsoft\Windows\Setup\GWXTriggers\refreshgwxconfig-B -> No File <==== ATTENTION
Task: {FFECD001-ADE6-4E75-8A62-B2A55F657156} - \Microsoft\Windows\Setup\gwx\refreshgwxconfigandcontent -> No File <==== ATTENTION
 
(If an entry is included in the fixlist, the task (.job) file will be moved. The file which is running by the task will not be moved.)
 
Task: C:\WINDOWS\Tasks\CreateExplorerShellUnelevatedTask.job => C:\WINDOWS\explorer.exe
 
==================== Shortcuts & WMI ========================
 
(The entries could be listed to be restored or removed.)
 
 
==================== Loaded Modules (Whitelisted) ==============
 
2017-10-06 07:59 - 2017-10-13 19:17 - 002289096 _____ () C:\PROGRAM FILES\MALWAREBYTES\ANTI-MALWARE\SelfProtectionSdk.dll
2016-07-16 06:42 - 2016-07-16 06:42 - 000231424 _____ () C:\WINDOWS\SYSTEM32\ism32k.dll
2017-09-14 15:50 - 2017-09-07 01:01 - 002681200 _____ () C:\WINDOWS\System32\CoreUIComponents.dll
2016-09-29 15:02 - 2016-09-06 23:56 - 000134656 _____ () C:\Windows\ShellExperiences\Windows.UI.Shell.SharedUtilities.dll
2017-03-23 15:21 - 2017-03-04 01:31 - 000474112 _____ () C:\Windows\ShellExperiences\QuickActions.dll
2017-03-23 15:23 - 2017-03-04 01:12 - 009760768 _____ () C:\Windows\SystemApps\Microsoft.Windows.Cortana_cw5n1h2txyewy\CortanaApi.dll
2017-03-23 15:23 - 2017-03-04 01:05 - 001401856 _____ () C:\Windows\SystemApps\Microsoft.Windows.Cortana_cw5n1h2txyewy\Cortana.Core.dll
2017-03-23 15:23 - 2017-03-04 01:05 - 000757248 _____ () C:\Windows\SystemApps\Microsoft.Windows.Cortana_cw5n1h2txyewy\CSGSuggestLib.dll
2017-10-13 21:18 - 2017-09-17 21:13 - 001033216 _____ () C:\Windows\SystemApps\Microsoft.Windows.Cortana_cw5n1h2txyewy\Cortana.Actions.dll
2017-10-13 21:18 - 2017-09-17 21:14 - 002424320 _____ () C:\Windows\SystemApps\Microsoft.Windows.Cortana_cw5n1h2txyewy\Cortana.BackgroundTask.dll
2017-10-13 21:18 - 2017-09-17 21:16 - 004853760 _____ () C:\Windows\SystemApps\Microsoft.Windows.Cortana_cw5n1h2txyewy\RemindersUI.dll
2017-09-30 15:38 - 2017-09-30 15:38 - 026118656 _____ () C:\Program Files\WindowsApps\Microsoft.ZuneVideo_10.17082.14121.0_x64__8wekyb3d8bbwe\Video.UI.exe
2017-09-30 15:38 - 2017-09-30 15:38 - 009162240 _____ () C:\Program Files\WindowsApps\Microsoft.ZuneVideo_10.17082.14121.0_x64__8wekyb3d8bbwe\EntCommon.dll
2017-09-30 15:38 - 2017-09-30 15:38 - 003553704 _____ () C:\Program Files\WindowsApps\Microsoft.ZuneVideo_10.17082.14121.0_x64__8wekyb3d8bbwe\Microsoft.UI.Xaml.dll
2014-03-05 16:44 - 2014-03-05 16:44 - 000274208 _____ () C:\Program Files (x86)\bfgclient\bfggameservices.exe
2016-02-28 17:54 - 2015-06-19 12:50 - 000038912 _____ () C:\Program Files (x86)\Amazon\Amazon Games & Software Downloader\utility.dll
2014-12-05 11:16 - 2013-10-23 16:44 - 001242584 _____ () C:\Program Files (x86)\Intel\Intel® Management Engine Components\LMS\ACE.dll
2014-03-05 16:44 - 2014-03-05 16:44 - 001568032 _____ () C:\Program Files (x86)\bfgclient\bfgcommon.dll
 
==================== Alternate Data Streams (Whitelisted) =========
 
(If an entry is included in the fixlist, only the ADS will be removed.)
 
AlternateDataStreams: C:\ProgramData\TEMP:1F96ED45 [217]
AlternateDataStreams: C:\ProgramData\TEMP:2CB9631F [134]
AlternateDataStreams: C:\ProgramData\TEMP:366B74CA [128]
AlternateDataStreams: C:\ProgramData\TEMP:89C2A42C [220]
 
==================== Safe Mode (Whitelisted) ===================
 
(If an entry is included in the fixlist, it will be removed from the registry. The "AlternateShell" will be restored.)
 
HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\MBAMService => ""="Service"
HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\MBAMService => ""="Service"
 
==================== Association (Whitelisted) ===============
 
(If an entry is included in the fixlist, the registry item will be restored to default or removed.)
 
 
==================== Internet Explorer trusted/restricted ===============
 
(If an entry is included in the fixlist, it will be removed from the registry.)
 
IE trusted site: HKU\S-1-5-21-2910918007-1667735213-2428426781-1001\...\aeriagames.com -> hxxps://aeriagames.com
IE trusted site: HKU\S-1-5-21-2910918007-1667735213-2428426781-1001\...\aeriagames.com -> hxxp://aeriagames.com
 
==================== Hosts content: ==========================
 
(If needed Hosts: directive could be included in the fixlist to reset Hosts.)
 
2013-08-22 08:25 - 2017-10-16 21:56 - 000010989 _____ C:\WINDOWS\system32\Drivers\etc\hosts
 
0.0.0.0 0.0.0.0 # fix for traceroute and netstat display anomaly
0.0.0.0 tracking.opencandy.com.s3.amazonaws.com
0.0.0.0 media.opencandy.com
0.0.0.0 cdn.opencandy.com
0.0.0.0 tracking.opencandy.com
0.0.0.0 api.opencandy.com
0.0.0.0 api.recommendedsw.com
0.0.0.0 rp.yefeneri2.com
0.0.0.0 os.yefeneri2.com
0.0.0.0 os2.yefeneri2.com
0.0.0.0 installer.betterinstaller.com
0.0.0.0 installer.filebulldog.com
0.0.0.0 d3oxtn1x3b8d7i.cloudfront.net
0.0.0.0 inno.bisrv.com
0.0.0.0 nsis.bisrv.com
0.0.0.0 cdn.file2desktop.com
0.0.0.0 cdn.goateastcach.us
0.0.0.0 cdn.guttastatdk.us
0.0.0.0 cdn.inskinmedia.com
0.0.0.0 cdn.insta.oibundles2.com
0.0.0.0 cdn.insta.playbryte.com
0.0.0.0 cdn.llogetfastcach.us
0.0.0.0 cdn.montiera.com
0.0.0.0 cdn.msdwnld.com
0.0.0.0 cdn.mypcbackup.com
0.0.0.0 cdn.ppdownload.com
0.0.0.0 cdn.riceateastcach.us
0.0.0.0 cdn.shyapotato.us
0.0.0.0 cdn.solimba.com
0.0.0.0 cdn.tuto4pc.com
 
==================== Other Areas ============================
 
(Currently there is no automatic fix for this section.)
 
HKU\S-1-5-21-2910918007-1667735213-2428426781-1001\Control Panel\Desktop\\Wallpaper -> C:\Users\Tina\AppData\Local\Packages\Microsoft.Windows.Photos_8wekyb3d8bbwe\LocalState\PhotosAppBackground\{9c2ad409-d276-4246-a024-b61a88760277}.jpg
DNS Servers: 68.105.28.11 - 68.105.29.11
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System => (ConsentPromptBehaviorAdmin: 5) (ConsentPromptBehaviorUser: 3) (EnableLUA: 1)
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer => (SmartScreenEnabled: Prompt)
Windows Firewall is enabled.
 
==================== MSCONFIG/TASK MANAGER disabled items ==
 
HKLM\...\StartupApproved\StartupFolder: => "Bluetooth.lnk"
HKLM\...\StartupApproved\Run: => "DptfPolicyLpmServiceHelper"
HKLM\...\StartupApproved\Run: => "WindowsDefender"
HKLM\...\StartupApproved\Run: => "AvastUI.exe"
HKLM\...\StartupApproved\Run32: => "WebStorage"
HKLM\...\StartupApproved\Run32: => "mcpltui_exe"
HKLM\...\StartupApproved\Run32: => "GrooveMonitor"
HKLM\...\StartupApproved\Run32: => "EEventManager"
HKLM\...\StartupApproved\Run32: => "SunJavaUpdateSched"
HKLM\...\StartupApproved\Run32: => "AmazonGSDownloaderTray"
HKU\S-1-5-21-2910918007-1667735213-2428426781-1001\...\StartupApproved\Run: => "PicPick Start"
HKU\S-1-5-21-2910918007-1667735213-2428426781-1001\...\StartupApproved\Run: => "SUPERAntiSpyware"
HKU\S-1-5-21-2910918007-1667735213-2428426781-1001\...\StartupApproved\Run: => "OneDrive"
HKU\S-1-5-21-2910918007-1667735213-2428426781-1001\...\StartupApproved\Run: => "TunnelBear"
 
==================== FirewallRules (Whitelisted) ===============
 
(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)
 
FirewallRules: [TCP Query User{72844607-0D03-4DBC-812A-B56076E2C32C}C:\program files (x86)\google\chrome\application\chrome.exe] => (Allow) C:\program files (x86)\google\chrome\application\chrome.exe
FirewallRules: [UDP Query User{BDFCEE95-4084-4F0E-8179-B09840DD1677}C:\program files (x86)\google\chrome\application\chrome.exe] => (Allow) C:\program files (x86)\google\chrome\application\chrome.exe
FirewallRules: [{EFDA5868-8826-4137-BA79-8F35AFA614FA}] => (Allow) C:\Program Files (x86)\Skype\Phone\Skype.exe
FirewallRules: [{6BF6C6F1-A915-4D87-A98D-DCA9B193E511}] => (Allow) C:\Program Files\Mozilla Firefox\firefox.exe
FirewallRules: [{2838DB7C-603F-4165-B8B9-1540A0FB7B12}] => (Allow) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
FirewallRules: [TCP Query User{59DD7521-01BC-4D82-BD37-2D6B0CF245CE}C:\program files\mozilla firefox\firefox.exe] => (Allow) C:\program files\mozilla firefox\firefox.exe
FirewallRules: [UDP Query User{C6F100DD-C150-434A-9D94-28E0089D8686}C:\program files\mozilla firefox\firefox.exe] => (Allow) C:\program files\mozilla firefox\firefox.exe
 
==================== Restore Points =========================
 
11-10-2017 08:28:18 Windows Update
17-10-2017 19:06:15 Windows Update
 
==================== Faulty Device Manager Devices =============
 
 
==================== Event log errors: =========================
 
Application errors:
==================
Error: (10/17/2017 08:27:48 PM) (Source: Microsoft-Windows-Immersive-Shell) (EventID: 5973) (User: LAPTOP)
Description: Activation of app Microsoft.Windows.Cortana_cw5n1h2txyewy!ppleae38af2e007f4358a809ac99a64a67c1 failed with error: -2147023174 See the Microsoft-Windows-TWinUI/Operational log for additional information.
 
Error: (10/17/2017 07:06:40 PM) (Source: Microsoft-Windows-CAPI2) (EventID: 513) (User: )
Description: Cryptographic Services failed while processing the OnIdentity() call in the System Writer Object.
 
Details:
AddLegacyDriverFiles: Unable to back up image of binary Microsoft Link-Layer Discovery Protocol.
 
System Error:
Access is denied.
.
 
Error: (10/16/2017 09:57:58 PM) (Source: COM) (EventID: 10031) (User: )
Description: An unmarshaling policy check was performed when unmarshaling a custom marshaled object and the class {2CD39202-3A2F-4935-9A86-65B919919A7F} was rejected
 
Error: (10/16/2017 07:32:48 PM) (Source: COM) (EventID: 10031) (User: )
Description: An unmarshaling policy check was performed when unmarshaling a custom marshaled object and the class {2CD39202-3A2F-4935-9A86-65B919919A7F} was rejected
 
Error: (10/16/2017 08:37:07 AM) (Source: COM) (EventID: 10031) (User: )
Description: An unmarshaling policy check was performed when unmarshaling a custom marshaled object and the class {2CD39202-3A2F-4935-9A86-65B919919A7F} was rejected
 
Error: (10/16/2017 08:37:07 AM) (Source: COM) (EventID: 10031) (User: )
Description: An unmarshaling policy check was performed when unmarshaling a custom marshaled object and the class {2CD39202-3A2F-4935-9A86-65B919919A7F} was rejected
 
Error: (10/15/2017 10:39:46 PM) (Source: COM) (EventID: 10031) (User: )
Description: An unmarshaling policy check was performed when unmarshaling a custom marshaled object and the class {2CD39202-3A2F-4935-9A86-65B919919A7F} was rejected
 
Error: (10/15/2017 10:28:31 PM) (Source: COM) (EventID: 10031) (User: )
Description: An unmarshaling policy check was performed when unmarshaling a custom marshaled object and the class {2CD39202-3A2F-4935-9A86-65B919919A7F} was rejected
 
Error: (10/15/2017 10:21:39 PM) (Source: Microsoft-Windows-Immersive-Shell) (EventID: 5973) (User: LAPTOP)
Description: Activation of app Microsoft.Windows.CloudExperienceHost_cw5n1h2txyewy!App failed with error: -2144927142 See the Microsoft-Windows-TWinUI/Operational log for additional information.
 
Error: (10/15/2017 02:13:02 PM) (Source: Application Error) (EventID: 1000) (User: )
Description: Faulting application name: sq50sdne.exe, version: 2.2.19882.0, time stamp: 0x56e2cdca
Faulting module name: sq50sdne.exe, version: 2.2.19882.0, time stamp: 0x56e2cdca
Exception code: 0xc0000005
Fault offset: 0x0008dcc4
Faulting process id: 0x1304
Faulting application start time: 0x01d345e8bb1c2ae5
Faulting application path: C:\Users\Tina\Desktop\sq50sdne.exe
Faulting module path: C:\Users\Tina\Desktop\sq50sdne.exe
Report Id: f4e3a4fb-c35e-4d4b-a5c2-1ce3a08829f2
Faulting package full name: 
Faulting package-relative application ID:
 
 
System errors:
=============
Error: (10/18/2017 12:57:27 AM) (Source: disk) (EventID: 7) (User: )
Description: The device, \Device\Harddisk0\DR0, has a bad block.
 
Error: (10/18/2017 12:57:23 AM) (Source: disk) (EventID: 7) (User: )
Description: The device, \Device\Harddisk0\DR0, has a bad block.
 
Error: (10/18/2017 12:57:19 AM) (Source: disk) (EventID: 7) (User: )
Description: The device, \Device\Harddisk0\DR0, has a bad block.
 
Error: (10/18/2017 12:57:15 AM) (Source: disk) (EventID: 7) (User: )
Description: The device, \Device\Harddisk0\DR0, has a bad block.
 
Error: (10/18/2017 12:57:12 AM) (Source: disk) (EventID: 7) (User: )
Description: The device, \Device\Harddisk0\DR0, has a bad block.
 
Error: (10/18/2017 12:57:08 AM) (Source: disk) (EventID: 7) (User: )
Description: The device, \Device\Harddisk0\DR0, has a bad block.
 
Error: (10/18/2017 12:57:04 AM) (Source: disk) (EventID: 7) (User: )
Description: The device, \Device\Harddisk0\DR0, has a bad block.
 
Error: (10/18/2017 12:57:00 AM) (Source: disk) (EventID: 7) (User: )
Description: The device, \Device\Harddisk0\DR0, has a bad block.
 
Error: (10/18/2017 12:56:56 AM) (Source: disk) (EventID: 7) (User: )
Description: The device, \Device\Harddisk0\DR0, has a bad block.
 
Error: (10/18/2017 12:56:52 AM) (Source: disk) (EventID: 7) (User: )
Description: The device, \Device\Harddisk0\DR0, has a bad block.
 
 
CodeIntegrity:
===================================
  Date: 2017-10-17 20:27:48.076
  Description: Code Integrity determined that a process (\Device\HarddiskVolume4\Windows\System32\svchost.exe) attempted to load \Device\HarddiskVolume4\Program Files\Emsisoft Anti-Malware\a2hooks64.dll that did not meet the Windows signing level requirements.
 
  Date: 2017-10-17 20:08:16.411
  Description: Code Integrity determined that a process (\Device\HarddiskVolume4\Windows\System32\svchost.exe) attempted to load \Device\HarddiskVolume4\Program Files\Emsisoft Anti-Malware\a2hooks64.dll that did not meet the Windows signing level requirements.
 
  Date: 2017-10-17 19:15:23.525
  Description: Code Integrity determined that a process (\Device\HarddiskVolume4\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe) attempted to load \Device\HarddiskVolume4\Program Files\Emsisoft Anti-Malware\a2hooks32.dll that did not meet the Microsoft signing level requirements.
 
  Date: 2017-10-17 19:15:12.683
  Description: Code Integrity determined that a process (\Device\HarddiskVolume4\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe) attempted to load \Device\HarddiskVolume4\Program Files\Emsisoft Anti-Malware\a2hooks64.dll that did not meet the Microsoft signing level requirements.
 
  Date: 2017-10-17 19:14:40.842
  Description: Code Integrity determined that a process (\Device\HarddiskVolume4\Windows\System32\svchost.exe) attempted to load \Device\HarddiskVolume4\Program Files\Emsisoft Anti-Malware\a2hooks64.dll that did not meet the Windows signing level requirements.
 
  Date: 2017-10-17 19:07:03.024
  Description: Code Integrity determined that a process (\Device\HarddiskVolume4\Windows\System32\svchost.exe) attempted to load \Device\HarddiskVolume4\Program Files\Emsisoft Anti-Malware\a2hooks64.dll that did not meet the Windows signing level requirements.
 
  Date: 2017-10-17 09:20:45.321
  Description: Code Integrity determined that a process (\Device\HarddiskVolume4\Windows\System32\svchost.exe) attempted to load \Device\HarddiskVolume4\Program Files\Emsisoft Anti-Malware\a2hooks64.dll that did not meet the Windows signing level requirements.
 
  Date: 2017-10-17 09:01:23.069
  Description: Code Integrity determined that a process (\Device\HarddiskVolume4\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe) attempted to load \Device\HarddiskVolume4\Program Files\Emsisoft Anti-Malware\a2hooks32.dll that did not meet the Microsoft signing level requirements.
 
  Date: 2017-10-17 09:00:54.686
  Description: Code Integrity determined that a process (\Device\HarddiskVolume4\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe) attempted to load \Device\HarddiskVolume4\Program Files\Emsisoft Anti-Malware\a2hooks64.dll that did not meet the Microsoft signing level requirements.
 
  Date: 2017-10-17 09:00:24.843
  Description: Code Integrity determined that a process (\Device\HarddiskVolume4\Windows\System32\svchost.exe) attempted to load \Device\HarddiskVolume4\Program Files\Emsisoft Anti-Malware\a2hooks64.dll that did not meet the Windows signing level requirements.
 
 
==================== Memory info =========================== 
 
Processor: Intel® Core™ i3-4030U CPU @ 1.90GHz
Percentage of memory in use: 37%
Total physical RAM: 6027.65 MB
Available physical RAM: 3747.81 MB
Total Virtual: 6987.65 MB
Available Virtual: 4762.41 MB
 
==================== Drives ================================
 
Drive c: (OS) (Fixed) (Total:444.65 GB) (Free:362.76 GB) NTFS ==>[system with boot components (obtained from drive)]
 
==================== MBR & Partition Table ==================
 
========================================================
Disk: 0 (Size: 465.8 GB) (Disk ID: 664B316A)
 
Partition: GPT.
 
==================== End of Addition.txt ============================
 
 
Hope I gave you enough info.  
 
Thank you,
DottieDo

Edited by hamluis, 18 October 2017 - 09:13 AM.
Moved from AII to MRL - Hamluis.


BC AdBot (Login to Remove)

 


#2 Aura

Aura

    Bleepin' Special Ops


  • Malware Response Team
  • 19,683 posts
  • ONLINE
  •  
  • Gender:Male
  • Local time:01:01 PM

Posted 18 October 2017 - 10:53 AM

Hi DottieDo :)

My name is Aura and I'll be assisting you with your malware issue. Since we'll be working together, you can call me Aura or Yoan, which is my real name, it's up to you! Now that we've broke the ice, I'll just ask you a few things during the time we'll be working together to clean your system and get it back to an operational state.
  • As you'll notice, the logs we are asking for here are quite lenghty, so it's normal for me to not reply exactly after you post them. This is because I need some time to analyse them and then act accordingly. However, I'll always reply within 24 hours, 48 hours at most if something unexpected happens
  • As long as I'm assisting you on BleepingComputer, in this thread, I'll ask you to not seek assistance anywhere else for any issue related to the system we are working on. If you have an issue, question, etc. about your computer, please ask it in this thread and I'll assist you
  • The same principle applies to any modifications you make to your system, I would like you to ask me before you do any manipulations that aren't in the instructions I posted. This is to ensure that we are operating in sync and I know exactly what's happening on your system
  • If you aren't sure about an instruction I'm giving you, ask me about it. This is to ensure that the clean-up process goes without any issue. I'll answer you and even give you more precise instructions/explanations if you need. There's no shame in asking questions here, better be safe than sorry!
  • If you don't reply to your thread within 3 days, I'll bump this thread to let you know that I'm waiting for you. If you don't reply after 5 days, it'll be closed. If you return after that period, you can send me a PM to get it unlocked and we'll continue where we left off
  • Since malware can work quickly, we want to get rid of them as fast as we can, before they make unknown changes to the system. This being said, I would appreciate if you could reply to this thread within 24 hours of me posting. This way, we'll have a good clean-up rhythm and the chances of complications will be reduced
  • I'm against any form of pirated, illegal and counterfeit software and material. So if you have any installed on your system, I'll ask you to uninstall them right now. You don't have to tell me if you indeed had some or not, I'll give you the benefit of the doubt. Plus, this would be against BleepingComputer's rules
  • In the end, you are the one asking for assistance here. So if you wish to go a different way during the clean-up, like format and reinstall Windows, you are free to do so. I would appreciate you to let me know about it first, and if you need, I can also assist you in the process
  • I would appreciate if you were to stay with me until the end, which means, until I declare your system clean. Just because your system isn't behaving weirdly anymore, or is running better than before, it doesn't mean that the infection is completely gone
    This being said, I have a full time job so sometimes it'll take longer for me to reply to you. Don't worry, you'll be my first priority as soon as I get home and have time to look at your thread
This being said, it's time to clean-up some malware, so let's get started, shall we? :)

Follow the instructions in the thread below. Make sure to download the MBAR version linked in it. Let me know if you're not able to launch it and run a scan.

https://forums.malwarebytes.com/topic/198907-requested-resource-is-in-use-error-unable-to-start-malwarebytes/

If you manage to run a scan, delete everything it finds, and then copy/paste the content of the mbar-log-DATE-(TIME).txt log that is located in the MBAR folder here after.

unite_blue.png
Security Administrator | Sysnative Windows Update Senior Analyst | Malware Hunter | @SecurityAura
My timezone UTC-05:00 (East. Coast). If I didn't reply to you within 48 hours, please send me a PM.


#3 DottieDo

DottieDo
  • Topic Starter

  • Members
  • 8 posts
  • OFFLINE
  •  
  • Local time:12:01 PM

Posted 18 October 2017 - 07:41 PM

Hi Yoan,

 

My real name is Tina. Thank you for your reply and helping me.  

 

I downloaded the Malwarebytes Anti-rootkit from the link you provided and attempted to run as administrator.  It won't install.  I get the windows pop-up box to allow it to run, I select yes, the pop up goes away and nothing happens.   :(  I'm worried.

 

(I trashed the malwarebytes anti-rootkit, that I download previously and started fresh with the link you provided.)

 

Kind Regards,

 

Tina


Edited by DottieDo, 18 October 2017 - 07:43 PM.


#4 Aura

Aura

    Bleepin' Special Ops


  • Malware Response Team
  • 19,683 posts
  • ONLINE
  •  
  • Gender:Male
  • Local time:01:01 PM

Posted 18 October 2017 - 10:57 PM

Hi Tina, nice to meet you :)

Did it at least create the mbar folder on your desktop? If so, can you go in it and launch the mbar.exe file manually (with Admin Rights)?

unite_blue.png
Security Administrator | Sysnative Windows Update Senior Analyst | Malware Hunter | @SecurityAura
My timezone UTC-05:00 (East. Coast). If I didn't reply to you within 48 hours, please send me a PM.





0 user(s) are reading this topic

0 members, 0 guests, 0 anonymous users