Jump to content


 


Register a free account to unlock additional features at BleepingComputer.com
Welcome to BleepingComputer, a free community where people like yourself come together to discuss and learn how to use their computers. Using the site is easy and fun. As a guest, you can browse and view the various discussions in the forums, but can not create a new topic or reply to an existing one unless you are logged in. Other benefits of registering an account are subscribing to topics and forums, creating a blog, and having no ads shown anywhere on the site.


Click here to Register a free account now! or read our Welcome Guide to learn how to use this site.

Photo

Possible infection?


  • This topic is locked This topic is locked
13 replies to this topic

#1 Spextrun

Spextrun

  • Members
  • 5 posts
  • OFFLINE
  •  
  • Local time:09:00 PM

Posted 18 January 2018 - 08:53 PM

I am using Windows 10, just for your information. I have noticed my PC is being slow latley. I do YouTube and I have recently found out that the editor I have been using is infected and is is ran by the Peoples Republic of China. It would help if you could see if I have ANY PUP's, rootkit infections, trojans, worms, etc. I want to have my Windows 10 PC 100% free of malware because I am VERY paranoid about having an infected computer. Thank you so much for helping.
 
(I have added both Addition.txt and FRST.txt just incase you need it.)

Scan result of Farbar Recovery Scan Tool (FRST) (x64) Version: 17.01.2018 01
Ran by drpmc (administrator) on DESKTOP-N7204RC (18-01-2018 20:51:45)
Running from C:\Users\drpmc\Downloads
Loaded Profiles: drpmc (Available Profiles: drpmc)
Platform: Windows 10 Home Version 1709 16299.192 (X64) Language: English (United States)
Internet Explorer Version 11 (Default browser: Edge)
Boot Mode: Normal
Tutorial for Farbar Recovery Scan Tool: http://www.geekstogo.com/forum/topic/335081-frst-tutorial-how-to-use-farbar-recovery-scan-tool/

==================== Processes (Whitelisted) =================

(If an entry is included in the fixlist, the process will be closed. The file will not be moved.)

(Intel Corporation) C:\Windows\System32\igfxCUIService.exe
(Intel Corporation) C:\Windows\System32\IntelSSTAPO\ParameterService\ParameterService.exe
(Microsoft Corporation) C:\Windows\Microsoft.NET\Framework64\v3.0\WPF\PresentationFontCache.exe
(Intel Corporation) C:\Windows\System32\igfxEM.exe
(Intel Corporation) C:\Windows\System32\igfxHK.exe
() C:\Windows\System32\igfxTray.exe
(Acer Incorporated) C:\Program Files\Acer\Acer Quick Access\QASvc.exe
(Windows ® Win 7 DDK provider) C:\Windows\System32\AdminService.exe
(Apple Inc.) C:\Program Files (x86)\Bonjour\mDNSResponder.exe
(Acer Incorporated) C:\Program Files (x86)\Acer\AOP Framework\CCDMonitorService.exe
() C:\Program Files\Dolby\Dolby DAX2\DAX2_API\DolbyDAX2API.exe
(Malwarebytes) C:\Program Files\Malwarebytes\Anti-Malware\MBAMService.exe
(McAfee, Inc.) C:\Program Files\Common Files\McAfee\SystemCore\mfemms.exe
(Symantec Corporation) C:\Program Files\Norton Internet Security\Engine\22.11.2.7\NIS.exe
() C:\Program Files\AVAST Software\SecureLine\vpnsvc.exe
(McAfee, Inc.) C:\Windows\System32\mfevtps.exe
(Symantec Corporation) C:\Program Files\Norton Internet Security\Engine\22.11.2.7\NIS.exe
(McAfee, Inc.) C:\Windows\System32\mfevtps.exe
(McAfee, Inc.) C:\Program Files\Common Files\McAfee\SystemCore\mfefire.exe
(McAfee, Inc.) C:\Program Files\Common Files\McAfee\platform\McSvcHost\McSvHost.exe
(Acer Incorporated) C:\Program Files\Acer\Acer Quick Access\QALSvc.exe
(Malwarebytes) C:\Program Files\Malwarebytes\Anti-Malware\mbamtray.exe
(Microsoft Corporation) C:\Program Files\Windows Defender\MSASCuiL.exe
(Realtek Semiconductor) C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe
(Realtek Semiconductor) C:\Program Files\Realtek\Audio\HDA\RAVBg64.exe
() C:\Program Files\Dolby\Dolby DAX2\DAX2_APP\DolbyDAX2TrayIcon.exe
(Acer Incorporated) C:\Program Files\Acer\Acer Quick Access\QAAgent.exe
(Acer Incorporated) C:\Program Files\Acer\Acer Quick Access\QALockHandler.exe
(Acer Incorporated) C:\Program Files\Acer\Acer Quick Access\QAAdminAgent.exe
(Google Inc.) C:\Program Files (x86)\Google\Update\1.3.33.7\GoogleCrashHandler.exe
(Google Inc.) C:\Program Files (x86)\Google\Update\1.3.33.7\GoogleCrashHandler64.exe
(Acer Incorporated) C:\Program Files\Acer\Acer Power Management\ePowerSvc.exe
(Acer Incorporate) C:\Program Files (x86)\Acer\Acer Audio Invert Utility\AudioInvertAgent.exe
(Acer Incorporated) C:\Program Files\Acer\Acer Power Management\ePowerTray.exe
(Intel Corporation) C:\Windows\System32\igfxext.exe
(Acer Incorporated) C:\Program Files\Acer\Acer Power Management\ePowerEvent.exe
(McAfee, Inc.) C:\Program Files\Common Files\McAfee\CSP\1.5.471.0\McCSPServiceHost.exe
(McAfee, Inc.) C:\Program Files\mcafee\msc\McAPExe.exe
(McAfee, Inc.) C:\Program Files\Common Files\McAfee\SystemCore\mfefire.exe
(McAfee, Inc.) C:\Program Files\Common Files\McAfee\AMCore\mcshield.exe
(Intel Corporation) C:\Program Files\Intel\Intel® Rapid Storage Technology\IAStorIcon.exe
(Acer Incorporated) C:\Program Files (x86)\Acer\AOP Framework\BackgroundAgent.exe
(AVAST Software) C:\Program Files\AVAST Software\SecureLine\secureline.exe
(Acer) C:\Program Files (x86)\Acer\Acer Portal\AcerPortal.exe
(Acer Cloud Technology) C:\Program Files (x86)\Acer\AOP Framework\acer\ccd.exe
(Dashlane SAS) C:\Program Files (x86)\Dashlane\Upgrade\DashlaneUpgradeService.exe
(WildTangent) C:\Program Files (x86)\WildTangent Games\App\GamesAppIntegrationService.exe
(Intel Corporation) C:\Program Files\Intel\Intel® Rapid Storage Technology\IAStorDataMgrSvc.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Intel® Management Engine Components\DAL\jhi_service.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Intel® Management Engine Components\LMS\LMS.exe
() C:\Program Files (x86)\Acer\Care Center\ACCStd.exe
(acer) C:\Program Files\Acer\User Experience Improvement Program\Framework\UBTService.exe
(acer) C:\Program Files\Acer\User Experience Improvement Program\Framework\MSG.exe
(Microsoft Corporation) C:\Windows\System32\dllhost.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Intel® Security Assist\isa.exe
(Microsoft Corporation) C:\Program Files\WindowsApps\Microsoft.WindowsStore_11712.1001.11.0_x64__8wekyb3d8bbwe\WinStore.App.exe
() C:\Program Files\WindowsApps\Microsoft.SkypeApp_12.13.274.0_x64__kzf8qxf38zg5c\SkypeHost.exe
(Microsoft Corporation) C:\Windows\SystemApps\Microsoft.LockApp_cw5n1h2txyewy\LockApp.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Microsoft Corporation) C:\Windows\System32\cmd.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Symantec Corporation) C:\Program Files\Norton Internet Security\Engine\22.11.2.7\coNatHst.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(McAfee, Inc.) C:\Program Files\Common Files\McAfee\platform\McUICnt.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Microsoft Corporation) C:\Windows\System32\smartscreen.exe

==================== Registry (Whitelisted) ===========================

(If an entry is included in the fixlist, the registry item will be restored to default or removed. The file will not be moved.)

HKLM\...\Run: [SecurityHealth] => C:\Program Files\Windows Defender\MSASCuiL.exe [630168 2017-09-29] (Microsoft Corporation)
HKLM\...\Run: [RTHDVCPL] => C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe [16407296 2015-10-06] (Realtek Semiconductor)
HKLM\...\Run: [RtHDVBg_Dolby] => C:\Program Files\Realtek\Audio\HDA\RAVBg64.exe [1407744 2015-10-06] (Realtek Semiconductor)
HKLM\...\Run: [DAX2_APP] => C:\Program Files\Dolby\Dolby DAX2\DAX2_APP\DolbyDAX2TrayIcon.exe [628736 2015-09-22] ()
HKLM\...\Run: [IAStorIcon] => C:\Program Files\Intel\Intel® Rapid Storage Technology\IAStorIcon.exe [322472 2015-07-27] (Intel Corporation)
HKLM-x32\...\Run: [mcpltui_exe] => C:\Program Files\Common Files\McAfee\Platform\mcuicnt.exe [719272 2015-04-02] (McAfee, Inc.)

==================== Internet (Whitelisted) ====================

(If an item is included in the fixlist, if it is a registry item it will be removed or restored to default.)

Tcpip\Parameters: [DhcpNameServer] 75.75.75.75 75.75.76.76
Tcpip\..\Interfaces\{41b253f2-a1d0-48ef-a07f-9c37eaad9bb6}: [DhcpNameServer] 192.168.184.1
Tcpip\..\Interfaces\{ebf99745-6ae8-4a3a-b6ec-d90ede0c9601}: [DhcpNameServer] 75.75.75.75 75.75.76.76

Internet Explorer:
==================
HKU\S-1-5-21-703669745-1628820323-22978762-1001\Software\Microsoft\Internet Explorer\Main,Start Page = about:blank
HKU\S-1-5-21-703669745-1628820323-22978762-1001\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = hxxp://acer15.msn.com/?pc=ACTE
SearchScopes: HKLM -> {AA9A4890-4262-4441-8977-E2FFCBFB706C} URL = hxxp://us.yhs4.search.yahoo.com/yhs/search?hspart=acer&hsimp=yhs-acer_001&p={searchTerms}
SearchScopes: HKLM-x32 -> {AA9A4890-4262-4441-8977-E2FFCBFB706C} URL = hxxp://us.yhs4.search.yahoo.com/yhs/search?hspart=acer&hsimp=yhs-acer_001&p={searchTerms}
SearchScopes: HKU\S-1-5-21-703669745-1628820323-22978762-1001 -> {AA9A4890-4262-4441-8977-E2FFCBFB706C} URL = hxxp://us.yhs4.search.yahoo.com/yhs/search?hspart=acer&hsimp=yhs-acer_001&p={searchTerms}
BHO: Norton Identity Safety -> {602ADB0E-4AFF-4217-8AA1-95DAC4DFA408} -> C:\Program Files\Norton Internet Security\Engine\22.11.2.7\coIEPlg.dll [2017-11-10] (Symantec Corporation)
BHO-x32: Norton Identity Safety -> {602ADB0E-4AFF-4217-8AA1-95DAC4DFA408} -> C:\Program Files\Norton Internet Security\Engine32\22.11.2.7\coIEPlg.dll [2017-11-10] (Symantec Corporation)
Toolbar: HKLM - Norton Toolbar - {7FEBEFE3-6B19-4349-98D2-FFB09D4B49CA} - C:\Program Files\Norton Internet Security\Engine\22.11.2.7\coIEPlg.dll [2017-11-10] (Symantec Corporation)
Toolbar: HKLM-x32 - Norton Toolbar - {7FEBEFE3-6B19-4349-98D2-FFB09D4B49CA} - C:\Program Files\Norton Internet Security\Engine32\22.11.2.7\coIEPlg.dll [2017-11-10] (Symantec Corporation)
Filter: application/x-mfe-ipt - {3EF5086B-5478-4598-A054-786C45D75692} - c:\Program Files\mcafee\msc\McSnIePl64.dll [2015-07-16] (McAfee, Inc.)
Filter-x32: application/x-mfe-ipt - {3EF5086B-5478-4598-A054-786C45D75692} - c:\Program Files (x86)\McAfee\msc\McSnIePl.dll [2015-07-16] (McAfee, Inc.)

FireFox:
========
FF Extension: (Amazon 1Button App for Firefox) - C:\Program Files (x86)\Mozilla Firefox\distribution\extensions\abb@amazon.com [2018-01-18] [Legacy] [not signed]
FF Extension: (English (US) Language Pack) - C:\Program Files (x86)\Mozilla Firefox\distribution\extensions\langpack-en-US@firefox.mozilla.org [2018-01-18] [Legacy] [not signed]
FF HKLM-x32\...\Thunderbird\Extensions: [msktbird@mcafee.com] - C:\Program Files\McAfee\MSK
FF Extension: (McAfee Anti-Spam Thunderbird Extension) - C:\Program Files\McAfee\MSK [2018-01-18] [Legacy] [not signed]
FF Plugin: @mcafee.com/MSC,version=10 -> c:\PROGRA~1\mcafee\msc\NPMCSN~1.DLL [2015-07-16] ()
FF Plugin-x32: @foxitsoftware.com/Foxit PhantomPDF Plugin,version=1.0,application/pdf -> C:\Program Files (x86)\Foxit PhantomPDF\plugins\npFoxitPhantomPDFPlugin.dll [2014-10-20] (Foxit Corporation)
FF Plugin-x32: @foxitsoftware.com/Foxit PhantomPDF Plugin,version=1.0,application/vnd.fdf -> C:\Program Files (x86)\Foxit PhantomPDF\plugins\npFoxitPhantomPDFPlugin.dll [2014-10-20] (Foxit Corporation)
FF Plugin-x32: @foxitsoftware.com/Foxit PhantomPDF Plugin,version=1.0,application/vnd.xdp -> C:\Program Files (x86)\Foxit PhantomPDF\plugins\npFoxitPhantomPDFPlugin.dll [2014-10-20] (Foxit Corporation)
FF Plugin-x32: @foxitsoftware.com/Foxit PhantomPDF Plugin,version=1.0,application/vnd.xfdf -> C:\Program Files (x86)\Foxit PhantomPDF\plugins\npFoxitPhantomPDFPlugin.dll [2014-10-20] (Foxit Corporation)
FF Plugin-x32: @intel-webapi.intel.com/Intel WebAPI ipt;version=4.0.68 -> C:\Program Files (x86)\Intel\Intel® Management Engine Components\IPT\npIntelWebAPIIPT.dll [2015-04-21] (Intel Corporation)
FF Plugin-x32: @intel-webapi.intel.com/Intel WebAPI updater -> C:\Program Files (x86)\Intel\Intel® Management Engine Components\IPT\npIntelWebAPIUpdater.dll [2015-04-21] (Intel Corporation)
FF Plugin-x32: @mcafee.com/MSC,version=10 -> c:\PROGRA~2\mcafee\msc\NPMCSN~1.DLL [2015-07-16] ()
FF Plugin-x32: @tools.google.com/Google Update;version=3 -> C:\Program Files (x86)\Google\Update\1.3.33.7\npGoogleUpdate3.dll [2018-01-18] (Google Inc.)
FF Plugin-x32: @tools.google.com/Google Update;version=9 -> C:\Program Files (x86)\Google\Update\1.3.33.7\npGoogleUpdate3.dll [2018-01-18] (Google Inc.)
FF Plugin-x32: @WildTangent.com/GamesAppPresenceDetector,Version=1.0 -> C:\Program Files (x86)\WildTangent Games\App\BrowserIntegration\Registered\0\NP_wtapp.dll [2014-11-14] ()

Chrome:
=======
CHR Profile: C:\Users\drpmc\AppData\Local\Google\Chrome\User Data\Default [2018-01-18]
CHR Extension: (Slides) - C:\Users\drpmc\AppData\Local\Google\Chrome\User Data\Default\Extensions\aapocclcgogkmnckokdopfmhonfmgoek [2018-01-18]
CHR Extension: (Docs) - C:\Users\drpmc\AppData\Local\Google\Chrome\User Data\Default\Extensions\aohghmighlieiainnegkcijnfilokake [2018-01-18]
CHR Extension: (Google Drive) - C:\Users\drpmc\AppData\Local\Google\Chrome\User Data\Default\Extensions\apdfllckaahabafndbhieahigkjlhalf [2018-01-18]
CHR Extension: (YouTube) - C:\Users\drpmc\AppData\Local\Google\Chrome\User Data\Default\Extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo [2018-01-18]
CHR Extension: (Norton Security Toolbar) - C:\Users\drpmc\AppData\Local\Google\Chrome\User Data\Default\Extensions\cjabmdjcfcfdmffimndhafhblfmpjdpe [2018-01-18]
CHR Extension: (Sheets) - C:\Users\drpmc\AppData\Local\Google\Chrome\User Data\Default\Extensions\felcaaldnbdncclmgdcncolpebgiejap [2018-01-18]
CHR Extension: (Google Docs Offline) - C:\Users\drpmc\AppData\Local\Google\Chrome\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi [2018-01-18]
CHR Extension: (Norton Identity Safe) - C:\Users\drpmc\AppData\Local\Google\Chrome\User Data\Default\Extensions\iikflkcanblccfahdhdonehdalibjnif [2018-01-18]
CHR Extension: (Chrome Web Store Payments) - C:\Users\drpmc\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda [2018-01-18]
CHR Extension: (Gmail) - C:\Users\drpmc\AppData\Local\Google\Chrome\User Data\Default\Extensions\pjkljhegncpnkpknbcohdijeoejaedia [2018-01-18]
CHR Extension: (Chrome Media Router) - C:\Users\drpmc\AppData\Local\Google\Chrome\User Data\Default\Extensions\pkedcjkdefgpdelpbcmbmeomcjbeemfm [2018-01-18]
CHR HKLM\...\Chrome\Extension: [cjabmdjcfcfdmffimndhafhblfmpjdpe] - C:\Program Files\Norton Internet Security\Engine\22.11.2.7\Exts\Chrome.crx <not found>
CHR HKLM\...\Chrome\Extension: [iikflkcanblccfahdhdonehdalibjnif] - hxxps://clients2.google.com/service/update2/crx
CHR HKLM-x32\...\Chrome\Extension: [cjabmdjcfcfdmffimndhafhblfmpjdpe] - C:\Program Files\Norton Internet Security\Engine\22.11.2.7\Exts\Chrome.crx <not found>
CHR HKLM-x32\...\Chrome\Extension: [iikflkcanblccfahdhdonehdalibjnif] - hxxps://clients2.google.com/service/update2/crx

==================== Services (Whitelisted) ====================

(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)

R2 CCDMonitorService; C:\Program Files (x86)\Acer\AOP Framework\CCDMonitorService.exe [2278616 2017-03-19] (Acer Incorporated)
S3 cplspcon; C:\WINDOWS\system32\IntelCpHDCPSvc.exe [630752 2016-05-19] (Intel Corporation)
R2 Dashlane Upgrade Service; C:\Program Files (x86)\Dashlane\Upgrade\DashlaneUpgradeService.exe [75056 2015-06-24] (Dashlane SAS)
R2 DAX2API; C:\Program Files\Dolby\Dolby DAX2\DAX2_API\DolbyDAX2API.exe [176640 2015-09-22] () [File not signed]
R3 ePowerSvc; C:\Program Files\Acer\Acer Power Management\ePowerSvc.exe [2573568 2015-05-14] (Acer Incorporated)
R2 GamesAppIntegrationService; C:\Program Files (x86)\WildTangent Games\App\GamesAppIntegrationService.exe [373312 2015-04-14] (WildTangent)
R2 HomeNetSvc; C:\Program Files\Common Files\McAfee\Platform\McSvcHost\McSvHost.exe [340744 2015-04-02] (McAfee, Inc.)
R2 IAStorDataMgrSvc; C:\Program Files\Intel\Intel® Rapid Storage Technology\IAStorDataMgrSvc.exe [18856 2015-07-27] (Intel Corporation)
R2 igfxCUIService2.0.0.0; C:\WINDOWS\system32\igfxCUIService.exe [382424 2016-05-19] (Intel Corporation)
S3 Intel® Capability Licensing Service TCP IP Interface; C:\Program Files\Intel\iCLS Client\SocketHeciServer.exe [881152 2015-05-22] (Intel® Corporation)
R3 Intel® Security Assist; C:\Program Files (x86)\Intel\Intel® Security Assist\isa.exe [335872 2015-05-19] (Intel Corporation) [File not signed]
R2 IntelSSTSvc; C:\WINDOWS\system32\IntelSSTAPO\ParameterService\ParameterService.exe [25928 2015-09-22] (Intel Corporation)
S2 isaHelperSvc; C:\Program Files (x86)\Intel\Intel® Security Assist\isaHelperService.exe [7680 2015-05-19] () [File not signed]
R2 jhi_service; C:\Program Files (x86)\Intel\Intel® Management Engine Components\DAL\jhi_service.exe [207648 2015-08-07] (Intel Corporation)
R2 MBAMService; C:\Program Files\Malwarebytes\Anti-Malware\mbamservice.exe [6234056 2017-11-01] (Malwarebytes)
R2 McAPExe; C:\Program Files\McAfee\MSC\McAPExe.exe [754792 2015-07-16] (McAfee, Inc.)
S3 McAWFwk; C:\Program Files\Common Files\McAfee\ActWiz\McAWFwk.exe [338208 2015-03-19] (McAfee, Inc.)
R2 mcbootdelaystartsvc; C:\Program Files\Common Files\McAfee\platform\McSvcHost\McSvHost.exe [340744 2015-04-02] (McAfee, Inc.)
R2 mccspsvc; C:\Program Files\Common Files\McAfee\CSP\1.5.471.0\McCSPServiceHost.exe [207344 2015-04-27] (McAfee, Inc.)
R2 McMPFSvc; C:\Program Files\Common Files\McAfee\Platform\McSvcHost\McSvHost.exe [340744 2015-04-02] (McAfee, Inc.)
R2 McNaiAnn; C:\Program Files\Common Files\McAfee\platform\McSvcHost\McSvHost.exe [340744 2015-04-02] (McAfee, Inc.)
S3 McODS; C:\Program Files\mcafee\VirusScan\mcods.exe [612688 2015-04-09] (McAfee, Inc.)
S4 McOobeSv2; C:\Program Files\Common Files\McAfee\platform\McSvcHost\McSvHost.exe [340744 2015-04-02] (McAfee, Inc.)
R2 mcpltsvc; C:\Program Files\Common Files\McAfee\platform\McSvcHost\McSvHost.exe [340744 2015-04-02] (McAfee, Inc.)
R2 McProxy; C:\Program Files\Common Files\McAfee\platform\McSvcHost\McSvHost.exe [340744 2015-04-02] (McAfee, Inc.)
R3 mfefire; C:\Program Files\Common Files\McAfee\SystemCore\\mfefire.exe [232656 2015-06-29] (McAfee, Inc.)
R2 mfemms; C:\Program Files\Common Files\McAfee\SystemCore\\mfemms.exe [373704 2015-07-30] (McAfee, Inc.)
R3 mfevtp; C:\Windows\system32\mfevtps.exe [254792 2015-06-29] (McAfee, Inc.)
R2 MSK80Service; C:\Program Files\Common Files\McAfee\Platform\McSvcHost\McSvHost.exe [340744 2015-04-02] (McAfee, Inc.)
R2 NIS; C:\Program Files\Norton Internet Security\Engine\22.11.2.7\NIS.exe [326144 2017-11-10] (Symantec Corporation)
R3 QALSvc; C:\Program Files\Acer\Acer Quick Access\QALSvc.exe [401248 2015-09-04] (Acer Incorporated)
R3 QASvc; C:\Program Files\Acer\Acer Quick Access\QASvc.exe [453984 2015-09-04] (Acer Incorporated)
R2 SecureLine; C:\Program Files\AVAST Software\SecureLine\VpnSvc.exe [592392 2018-01-18] ()
U3 UEIPSvc; C:\Program Files\Acer\User Experience Improvement Program\Framework\UBTService.exe [247040 2015-05-26] (acer)
S3 WdNisSvc; C:\Program Files\Windows Defender\NisSrv.exe [355304 2017-09-29] (Microsoft Corporation)
S3 WinDefend; C:\Program Files\Windows Defender\MsMpEng.exe [105944 2017-09-29] (Microsoft Corporation)

===================== Drivers (Whitelisted) ======================

(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)

R1 BHDrvx64; C:\Program Files\Norton Internet Security\NortonData\22.11.2.7\Definitions\BASHDefs\20180117.007\BHDrvx64.sys [1872024 2018-01-17] (Symantec Corporation)
R1 ccSet_NIS; C:\WINDOWS\system32\drivers\NISx64\160B020.007\ccSetx64.sys [187544 2017-11-10] (Symantec Corporation)
R3 cfwids; C:\WINDOWS\System32\drivers\cfwids.sys [77536 2015-07-02] (McAfee, Inc.)
S3 dg_ssudbus; C:\WINDOWS\System32\drivers\ssudbus.sys [131712 2016-09-05] (Samsung Electronics Co., Ltd.)
R1 eeCtrl; C:\Program Files (x86)\Common Files\Symantec Shared\EENGINE\eeCtrl64.sys [507984 2017-12-27] (Symantec Corporation)
R3 EraserUtilRebootDrv; C:\Program Files (x86)\Common Files\Symantec Shared\EENGINE\EraserUtilRebootDrv.sys [152656 2017-12-27] (Symantec Corporation)
R1 ESProtectionDriver; C:\WINDOWS\system32\drivers\mbae64.sys [77432 2017-11-29] ()
S3 HipShieldK; C:\WINDOWS\System32\drivers\HipShieldK.sys [207208 2015-05-19] (McAfee, Inc.)
S3 iaLPSS2_GPIO2; C:\WINDOWS\System32\drivers\iaLPSS2_GPIO2.sys [84264 2015-06-16] (Intel Corporation)
R1 IDSVia64; C:\Program Files\Norton Internet Security\NortonData\22.11.2.7\Definitions\IPSDefs\20180118.001\IDSvia64.sys [1056920 2018-01-18] (Symantec Corporation)
R3 LMDriver; C:\WINDOWS\System32\drivers\LMDriver.sys [21344 2015-09-04] (Acer Incorporated)
R2 MBAMChameleon; C:\WINDOWS\System32\Drivers\MbamChameleon.sys [193968 2018-01-18] (Malwarebytes)
R3 MBAMFarflt; C:\WINDOWS\system32\DRIVERS\farflt.sys [110016 2018-01-18] (Malwarebytes)
R3 MBAMProtection; C:\WINDOWS\system32\DRIVERS\mbam.sys [46008 2018-01-18] (Malwarebytes)
R0 MBAMSwissArmy; C:\WINDOWS\System32\Drivers\mbamswissarmy.sys [253880 2018-01-18] (Malwarebytes)
R3 MBAMWebProtection; C:\WINDOWS\system32\DRIVERS\mwac.sys [94144 2018-01-18] (Malwarebytes)
R2 mfeaack; C:\WINDOWS\System32\drivers\mfeaack.sys [412440 2015-07-02] (McAfee, Inc.)
R2 mfeavfk; C:\WINDOWS\System32\drivers\mfeavfk.sys [347800 2015-07-02] (McAfee, Inc.)
S0 mfeelamk; C:\WINDOWS\System32\drivers\mfeelamk.sys [80920 2015-07-02] (McAfee, Inc.)
R3 mfefirek; C:\WINDOWS\System32\drivers\mfefirek.sys [496888 2015-07-02] (McAfee, Inc.)
R2 mfehidk; C:\WINDOWS\System32\drivers\mfehidk.sys [875928 2015-07-02] (McAfee, Inc.)
R3 mfencbdc; C:\WINDOWS\System32\DRIVERS\mfencbdc.sys [492000 2015-05-27] (McAfee, Inc.)
S3 mfencrk; C:\WINDOWS\System32\DRIVERS\mfencrk.sys [109480 2015-05-27] (McAfee, Inc.)
R2 mfewfpk; C:\WINDOWS\System32\drivers\mfewfpk.sys [344704 2015-07-02] (McAfee, Inc.)
S3 pelmouse; C:\WINDOWS\System32\drivers\pelmouse.sys [26880 2016-07-11] (TPMX Electronics Ltd.)
S3 pelusblf; C:\WINDOWS\System32\drivers\pelusblf.sys [33048 2016-07-11] ()
S3 pelvendr; C:\WINDOWS\System32\drivers\pelvendr.sys [15032 2016-07-11] (TPMX Electronics Ltd.)
S3 phidmice; C:\WINDOWS\System32\drivers\phidmice.sys [33048 2016-07-11] ()
S3 pmouself; C:\WINDOWS\System32\drivers\pmouself.sys [26880 2016-07-11] (TPMX Electronics Ltd.)
S3 pvendrlf; C:\WINDOWS\System32\drivers\pvendrlf.sys [15032 2016-07-11] (TPMX Electronics Ltd.)
R3 RadioShim; C:\WINDOWS\System32\drivers\RadioShim.sys [14688 2015-09-04] (Acer Incorporated)
R3 RTSUER; C:\WINDOWS\system32\Drivers\RtsUer.sys [433912 2016-08-03] (Realsil Semiconductor Corporation)
R3 SRTSP; C:\WINDOWS\system32\drivers\NISx64\160B020.007\SRTSP64.SYS [812696 2017-11-10] (Symantec Corporation)
R1 SRTSPX; C:\WINDOWS\system32\drivers\NISx64\160B020.007\SRTSPX64.SYS [49304 2017-11-10] (Symantec Corporation)
S3 ssudqcfilter; C:\WINDOWS\System32\drivers\ssudqcfilter.sys [64640 2016-09-05] (QUALCOMM Incorporated)
R0 SymEFASI; C:\WINDOWS\System32\drivers\NISx64\160B020.007\SYMEFASI64.SYS [1938584 2017-11-10] (Symantec Corporation)
S0 SymELAM; C:\WINDOWS\System32\drivers\NISx64\160B020.007\SymELAM.sys [24608 2017-11-10] (Symantec Corporation)
R3 SymEvent; C:\WINDOWS\system32\Drivers\SYMEVENT64x86.SYS [102600 2018-01-18] (Symantec Corporation)
R1 SymIRON; C:\WINDOWS\system32\drivers\NISx64\160B020.007\Ironx64.SYS [309984 2017-11-10] (Symantec Corporation)
R1 SymNetS; C:\WINDOWS\system32\drivers\NISx64\160B020.007\SYMNETS.SYS [566936 2017-11-10] (Symantec Corporation)
R3 VirtualButtons; C:\WINDOWS\System32\drivers\VirtualButtons.sys [41992 2017-03-31] (Intel Corporation)
S3 WdBoot; C:\WINDOWS\system32\drivers\WdBoot.sys [44608 2017-09-29] (Microsoft Corporation)
S3 WdFilter; C:\WINDOWS\system32\drivers\WdFilter.sys [309144 2017-09-29] (Microsoft Corporation)
S3 WdNisDrv; C:\WINDOWS\System32\Drivers\WdNisDrv.sys [119192 2017-09-29] (Microsoft Corporation)

==================== NetSvcs (Whitelisted) ===================

(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)


==================== One Month Created files and folders ========

(If an entry is included in the fixlist, the file/folder will be moved.)

2018-01-18 20:02 - 2018-01-18 20:02 - 000000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\McAfee
2018-01-18 19:57 - 2018-01-18 19:57 - 000000000 ____D C:\WINDOWS\System32\Tasks\Remediation
2018-01-18 19:57 - 2018-01-18 19:57 - 000000000 ____D C:\Program Files\Common Files\AV
2018-01-18 17:17 - 2018-01-18 20:52 - 000023766 _____ C:\Users\drpmc\Downloads\FRST.txt
2018-01-18 17:13 - 2018-01-18 17:13 - 000001245 _____ C:\Users\drpmc\Documents\MbamScan.txt
2018-01-18 17:04 - 2018-01-18 17:04 - 000000000 ____D C:\Users\drpmc\AppData\Local\DBG
2018-01-18 17:04 - 2018-01-18 17:04 - 000000000 ____D C:\Users\drpmc\AppData\Local\CrashDumps
2018-01-18 16:57 - 2018-01-18 16:58 - 008206624 _____ (Malwarebytes) C:\Users\drpmc\Downloads\adwcleaner_7.0.7.0.exe
2018-01-18 16:52 - 2018-01-18 16:52 - 000000000 ____D C:\deb2007df3f9be2c0eb78a21e1e036
2018-01-18 16:46 - 2018-01-18 16:48 - 000000000 ____D C:\Users\drpmc\AppData\Local\PackageStaging
2018-01-18 16:45 - 2018-01-18 16:45 - 000000000 ____D C:\Users\drpmc\AppData\Roaming\AVAST Software
2018-01-18 16:44 - 2018-01-18 16:44 - 000000000 ____D C:\Users\drpmc\AppData\Local\Comms
2018-01-18 16:35 - 2018-01-18 20:51 - 000000000 ____D C:\FRST
2018-01-18 16:35 - 2018-01-18 16:35 - 002393088 _____ (Farbar) C:\Users\drpmc\Downloads\FRST64.exe
2018-01-18 16:34 - 2018-01-18 20:46 - 000000000 ____D C:\WINDOWS\System32\Tasks\Norton Internet Security
2018-01-18 16:33 - 2018-01-18 17:17 - 000046008 _____ (Malwarebytes) C:\WINDOWS\system32\Drivers\mbam.sys
2018-01-18 16:33 - 2018-01-18 17:16 - 000110016 _____ (Malwarebytes) C:\WINDOWS\system32\Drivers\farflt.sys
2018-01-18 16:33 - 2018-01-18 17:16 - 000094144 _____ (Malwarebytes) C:\WINDOWS\system32\Drivers\mwac.sys
2018-01-18 16:33 - 2018-01-18 16:43 - 000253880 _____ (Malwarebytes) C:\WINDOWS\system32\Drivers\mbamswissarmy.sys
2018-01-18 16:33 - 2018-01-18 16:33 - 000193968 _____ (Malwarebytes) C:\WINDOWS\system32\Drivers\MbamChameleon.sys
2018-01-18 16:33 - 2018-01-18 16:33 - 000001916 _____ C:\Users\Public\Desktop\Malwarebytes.lnk
2018-01-18 16:33 - 2018-01-18 16:33 - 000000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Malwarebytes
2018-01-18 16:33 - 2017-11-29 09:11 - 000077432 _____ C:\WINDOWS\system32\Drivers\mbae64.sys
2018-01-18 16:32 - 2018-01-18 17:15 - 000000000 ____D C:\AdwCleaner
2018-01-18 16:32 - 2018-01-18 16:32 - 000102600 _____ (Symantec Corporation) C:\WINDOWS\system32\Drivers\SYMEVENT64x86.SYS
2018-01-18 16:32 - 2018-01-18 16:32 - 000008471 _____ C:\WINDOWS\system32\Drivers\SYMEVENT64x86.CAT
2018-01-18 16:32 - 2018-01-18 16:32 - 000003392 _____ C:\WINDOWS\System32\Tasks\Norton WSC Integration
2018-01-18 16:32 - 2018-01-18 16:32 - 000002325 _____ C:\Users\Public\Desktop\Norton Internet Security.lnk
2018-01-18 16:32 - 2018-01-18 16:32 - 000000000 ___RD C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Norton Internet Security
2018-01-18 16:32 - 2018-01-18 16:32 - 000000000 ____D C:\WINDOWS\system32\Drivers\NISx64
2018-01-18 16:32 - 2018-01-18 16:32 - 000000000 ____D C:\ProgramData\NortonInstaller
2018-01-18 16:32 - 2018-01-18 16:32 - 000000000 ____D C:\ProgramData\Malwarebytes
2018-01-18 16:32 - 2018-01-18 16:32 - 000000000 ____D C:\Program Files\Norton Internet Security
2018-01-18 16:32 - 2018-01-18 16:32 - 000000000 ____D C:\Program Files\Malwarebytes
2018-01-18 16:32 - 2018-01-18 16:32 - 000000000 ____D C:\Program Files\Common Files\Symantec Shared
2018-01-18 16:32 - 2018-01-18 16:32 - 000000000 ____D C:\Program Files (x86)\NortonInstaller
2018-01-18 16:31 - 2018-01-18 16:34 - 000000000 ____D C:\ProgramData\Norton
2018-01-18 16:31 - 2018-01-18 16:32 - 082463440 _____ (Malwarebytes ) C:\Users\drpmc\Downloads\mb3-setup-consumer-3.3.1.2183-1.0.262-1.0.3724.exe
2018-01-18 16:31 - 2018-01-18 16:31 - 001120240 _____ (Symantec Corporation) C:\Users\drpmc\Downloads\NortonNISDownloader.exe
2018-01-18 16:31 - 2018-01-18 16:31 - 000003508 _____ C:\WINDOWS\System32\Tasks\BacKGroundAgent
2018-01-18 16:31 - 2018-01-18 16:31 - 000001337 _____ C:\Users\drpmc\Desktop\Norton Installation Files.lnk
2018-01-18 16:31 - 2018-01-18 16:31 - 000000000 ____D C:\Users\Public\Downloads\Norton
2018-01-18 16:31 - 2018-01-18 16:31 - 000000000 ____D C:\Users\drpmc\AppData\Roaming\Macromedia
2018-01-18 16:31 - 2018-01-18 16:31 - 000000000 ____D C:\ProgramData\Apple
2018-01-18 16:31 - 2018-01-18 16:31 - 000000000 ____D C:\Program Files\Bonjour
2018-01-18 16:31 - 2018-01-18 16:31 - 000000000 ____D C:\Program Files (x86)\Bonjour
2018-01-18 16:30 - 2018-01-18 16:30 - 000003416 _____ C:\WINDOWS\System32\Tasks\GoogleUpdateTaskMachineUA
2018-01-18 16:30 - 2018-01-18 16:30 - 000003372 _____ C:\WINDOWS\System32\Tasks\OneDrive Standalone Update Task-S-1-5-21-703669745-1628820323-22978762-1001
2018-01-18 16:30 - 2018-01-18 16:30 - 000003292 _____ C:\WINDOWS\System32\Tasks\GoogleUpdateTaskMachineCore
2018-01-18 16:30 - 2018-01-18 16:30 - 000002344 _____ C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Google Chrome.lnk
2018-01-18 16:30 - 2018-01-18 16:30 - 000002332 _____ C:\Users\Public\Desktop\Google Chrome.lnk
2018-01-18 16:30 - 2018-01-18 16:30 - 000000000 ____D C:\Users\drpmc\AppData\Roaming\Intel Corporation
2018-01-18 16:30 - 2018-01-18 16:30 - 000000000 ____D C:\Users\drpmc\AppData\Local\CareCenter
2018-01-18 16:29 - 2018-01-18 17:12 - 000000000 ____D C:\Users\drpmc\AppData\Local\Google
2018-01-18 16:29 - 2018-01-18 16:30 - 000002363 _____ C:\Users\drpmc\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\OneDrive.lnk
2018-01-18 16:29 - 2018-01-18 16:30 - 000000000 ___RD C:\Users\drpmc\OneDrive
2018-01-18 16:29 - 2018-01-18 16:30 - 000000000 ____D C:\Program Files (x86)\Google
2018-01-18 16:28 - 2018-01-18 17:03 - 000000000 ____D C:\Users\drpmc\AppData\Local\clear.fi
2018-01-18 16:28 - 2018-01-18 16:28 - 000001329 _____ C:\Users\drpmc\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\HD Audio Manager.lnk
2018-01-18 16:28 - 2018-01-18 16:28 - 000000000 ____D C:\Users\drpmc\PicStream
2018-01-18 16:27 - 2018-01-18 17:48 - 000000000 ____D C:\Users\drpmc\AppData\Local\Packages
2018-01-18 16:27 - 2018-01-18 17:16 - 000000000 __SHD C:\Users\drpmc\IntelGraphicsProfiles
2018-01-18 16:27 - 2018-01-18 16:29 - 000000000 ____D C:\Users\drpmc\AppData\Local\AOP SDK
2018-01-18 16:27 - 2018-01-18 16:28 - 000000000 ____D C:\Users\drpmc\AppData\Local\ConnectedDevicesPlatform
2018-01-18 16:27 - 2018-01-18 16:27 - 000002166 _____ C:\Users\drpmc\Desktop\Dashlane Password Manager.lnk
2018-01-18 16:27 - 2018-01-18 16:27 - 000001782 _____ C:\Users\Public\Desktop\Acer Store.lnk
2018-01-18 16:27 - 2018-01-18 16:27 - 000000000 ___RD C:\Users\drpmc\3D Objects
2018-01-18 16:27 - 2018-01-18 16:27 - 000000000 ___HD C:\Users\drpmc\MicrosoftEdgeBackups
2018-01-18 16:27 - 2018-01-18 16:27 - 000000000 ____D C:\Users\drpmc\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Dashlane
2018-01-18 16:27 - 2018-01-18 16:27 - 000000000 ____D C:\Users\drpmc\AppData\Roaming\Adobe
2018-01-18 16:27 - 2018-01-18 16:27 - 000000000 ____D C:\Users\drpmc\AppData\Local\VirtualStore
2018-01-18 16:27 - 2018-01-18 16:27 - 000000000 ____D C:\Users\drpmc\AppData\Local\Publishers
2018-01-18 16:27 - 2018-01-18 16:27 - 000000000 ____D C:\Users\drpmc\AppData\Local\MicrosoftEdge
2018-01-18 16:27 - 2018-01-18 16:27 - 000000000 ____D C:\ProgramData\OEM_YAHOO
2018-01-18 16:27 - 2018-01-18 16:27 - 000000000 ____D C:\Program Files\Accessory Store
2018-01-18 16:27 - 2018-01-18 16:27 - 000000000 ____D C:\Program Files (x86)\OEM
2018-01-18 16:25 - 2018-01-18 16:46 - 000000000 ____D C:\Users\drpmc
2018-01-18 16:25 - 2018-01-18 16:25 - 000000020 ___SH C:\Users\drpmc\ntuser.ini
2018-01-18 16:24 - 2018-01-18 16:24 - 000000000 ____D C:\ProgramData\Dashlane
2018-01-18 16:23 - 2018-01-18 17:16 - 000000006 ____H C:\WINDOWS\Tasks\SA.DAT
2018-01-18 16:23 - 2018-01-18 16:23 - 000004302 _____ C:\WINDOWS\System32\Tasks\Software Update Application
2018-01-18 16:23 - 2018-01-18 16:23 - 000003852 _____ C:\WINDOWS\System32\Tasks\ACCAgent
2018-01-18 16:23 - 2018-01-18 16:23 - 000002926 _____ C:\WINDOWS\System32\Tasks\avast! SL Update
2018-01-18 16:23 - 2018-01-18 16:23 - 000002888 _____ C:\WINDOWS\System32\Tasks\ACC
2018-01-18 16:23 - 2018-01-18 16:23 - 000002780 _____ C:\WINDOWS\System32\Tasks\WindowsStoreGiftCardPromoBackgroundTaskX86
2018-01-18 16:23 - 2018-01-18 16:23 - 000002706 _____ C:\WINDOWS\System32\Tasks\UbtFrameworkService
2018-01-18 16:23 - 2018-01-18 16:23 - 000002654 _____ C:\WINDOWS\System32\Tasks\Avast SecureLine
2018-01-18 16:23 - 2018-01-18 16:23 - 000002534 _____ C:\WINDOWS\System32\Tasks\AcerCloud
2018-01-18 16:23 - 2018-01-18 16:23 - 000002328 _____ C:\WINDOWS\System32\Tasks\ACCBackgroundApplication
2018-01-18 16:23 - 2018-01-18 16:23 - 000002238 _____ C:\WINDOWS\System32\Tasks\Audio Invert Utility
2018-01-18 16:23 - 2018-01-18 16:23 - 000002222 _____ C:\WINDOWS\System32\Tasks\Power Management
2018-01-18 16:23 - 2018-01-18 16:23 - 000002180 _____ C:\WINDOWS\System32\Tasks\Quick Access
2018-01-18 16:23 - 2018-01-18 16:23 - 000002074 _____ C:\WINDOWS\System32\Tasks\FUBTrackingByPLD
2018-01-18 16:23 - 2018-01-18 16:23 - 000000000 _SHDL C:\Users\Default User
2018-01-18 16:23 - 2018-01-18 16:23 - 000000000 _SHDL C:\Users\All Users
2018-01-18 16:23 - 2018-01-18 16:23 - 000000000 ____D C:\WINDOWS\oem
2018-01-18 16:22 - 2018-01-18 16:22 - 000022744 _____ C:\WINDOWS\system32\emptyregdb.dat
2018-01-18 16:22 - 2017-09-29 05:41 - 002241024 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\PrintConfig.dll
2018-01-18 16:21 - 2018-01-18 16:21 - 000001576 _____ C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Windows Media Player.lnk
2018-01-18 16:20 - 2018-01-18 16:20 - 000000000 ____D C:\WINDOWS\system32\config\bbimigrate
2018-01-18 16:18 - 2018-01-18 17:16 - 000000180 _____ C:\WINDOWS\system32\{A6D608F0-0BDE-491A-97AE-5C4B05D86E01}.bat
2018-01-18 16:18 - 2018-01-18 16:20 - 000000000 ____D C:\Program Files\Intel
2018-01-18 16:18 - 2018-01-18 16:20 - 000000000 ____D C:\Program Files (x86)\Realtek
2018-01-18 16:18 - 2018-01-18 16:20 - 000000000 ____D C:\Intel
2018-01-18 16:18 - 2018-01-18 16:18 - 000000200 _____ C:\WINDOWS\system32\{EC94D02F-D200-4428-9531-05AF7F9799CB}.bat
2018-01-18 16:18 - 2018-01-18 16:18 - 000000102 _____ C:\ProgramData\Microsoft.SqlServer.Compact.400.64.bc
2018-01-18 16:18 - 2018-01-18 16:18 - 000000000 ____D C:\ProgramData\Dolby
2018-01-18 16:18 - 2018-01-18 16:18 - 000000000 ____D C:\Program Files\Dolby
2018-01-18 16:18 - 2018-01-18 16:18 - 000000000 ____D C:\Program Files\Common Files\Atheros
2018-01-18 16:18 - 2018-01-18 16:18 - 000000000 _____ C:\WINDOWS\system32\GfxValDisplayLog.bin
2018-01-18 16:18 - 2016-05-19 20:37 - 000112648 _____ (Khronos Group) C:\WINDOWS\SysWOW64\OpenCL.DLL
2018-01-18 16:18 - 2016-05-19 20:37 - 000108560 _____ (Khronos Group) C:\WINDOWS\system32\OpenCL.DLL
2018-01-18 16:17 - 2018-01-18 20:21 - 000000000 ____D C:\WINDOWS\system32\SleepStudy
2018-01-18 16:17 - 2018-01-18 16:22 - 000222608 _____ C:\WINDOWS\system32\FNTCACHE.DAT
2018-01-18 16:17 - 2018-01-18 16:18 - 000000000 ____D C:\WINDOWS\system32\DAX2
2018-01-18 16:17 - 2018-01-18 16:17 - 001151965 _____ C:\WINDOWS\system32\Drivers\rtkhdasetting.zip
2018-01-18 16:17 - 2018-01-18 16:17 - 000000000 ____H C:\ProgramData\DP45977C.lfl
2018-01-18 16:17 - 2018-01-18 16:17 - 000000000 ____D C:\WINDOWS\SysWOW64\RTCOM
2018-01-18 16:17 - 2018-01-18 16:17 - 000000000 ____D C:\WINDOWS\system32\IntelSSTAPO
2018-01-18 16:17 - 2018-01-18 16:17 - 000000000 ____D C:\WINDOWS\ServiceProfiles
2018-01-18 16:17 - 2018-01-18 16:17 - 000000000 ____D C:\ProgramData\rtkSSTSetting
2018-01-18 16:17 - 2018-01-18 16:17 - 000000000 ____D C:\Program Files\Realtek
2018-01-18 16:17 - 2015-10-06 11:24 - 003154607 _____ C:\WINDOWS\system32\Drivers\rtkSSTSetting.zip
2018-01-18 16:01 - 2018-01-18 16:02 - 000000000 ____D C:\Windows.old
2018-01-18 16:01 - 2018-01-18 16:01 - 000008192 _____ C:\WINDOWS\system32\config\userdiff
2018-01-18 16:01 - 2018-01-18 16:01 - 000000000 ____D C:\WINDOWS\SysWOW64\sda
2018-01-18 16:01 - 2018-01-18 16:01 - 000000000 ____D C:\WINDOWS\InfusedApps
2018-01-18 16:01 - 2018-01-18 16:01 - 000000000 ____D C:\Program Files\Lenovo
2018-01-18 16:00 - 2018-01-18 16:00 - 000000000 ____D C:\WINDOWS\Setup
2018-01-18 15:58 - 2018-01-18 16:00 - 000000000 ____D C:\WINDOWS\SysWOW64\zu-ZA
2018-01-18 15:58 - 2018-01-18 16:00 - 000000000 ____D C:\WINDOWS\SysWOW64\yo-NG
2018-01-18 15:58 - 2018-01-18 16:00 - 000000000 ____D C:\WINDOWS\SysWOW64\xh-ZA
2018-01-18 15:58 - 2018-01-18 16:00 - 000000000 ____D C:\WINDOWS\SysWOW64\wo-SN
2018-01-18 15:58 - 2018-01-18 16:00 - 000000000 ____D C:\WINDOWS\SysWOW64\vi-VN
2018-01-18 15:58 - 2018-01-18 16:00 - 000000000 ____D C:\WINDOWS\SysWOW64\uz-Latn-UZ
2018-01-18 15:58 - 2018-01-18 16:00 - 000000000 ____D C:\WINDOWS\SysWOW64\ur-PK
2018-01-18 15:58 - 2018-01-18 16:00 - 000000000 ____D C:\WINDOWS\SysWOW64\ug-CN
2018-01-18 15:58 - 2018-01-18 16:00 - 000000000 ____D C:\WINDOWS\SysWOW64\tt-RU
2018-01-18 15:58 - 2018-01-18 16:00 - 000000000 ____D C:\WINDOWS\SysWOW64\tn-ZA
2018-01-18 15:58 - 2018-01-18 16:00 - 000000000 ____D C:\WINDOWS\SysWOW64\tk-TM
2018-01-18 15:58 - 2018-01-18 16:00 - 000000000 ____D C:\WINDOWS\SysWOW64\ti-ET
2018-01-18 15:58 - 2018-01-18 16:00 - 000000000 ____D C:\WINDOWS\SysWOW64\tg-Cyrl-TJ
2018-01-18 15:58 - 2018-01-18 16:00 - 000000000 ____D C:\WINDOWS\SysWOW64\te-IN
2018-01-18 15:58 - 2018-01-18 16:00 - 000000000 ____D C:\WINDOWS\SysWOW64\ta-IN
2018-01-18 15:58 - 2018-01-18 16:00 - 000000000 ____D C:\WINDOWS\SysWOW64\sw-KE
2018-01-18 15:58 - 2018-01-18 16:00 - 000000000 ____D C:\WINDOWS\SysWOW64\sr-Cyrl-RS
2018-01-18 15:58 - 2018-01-18 16:00 - 000000000 ____D C:\WINDOWS\SysWOW64\sr-Cyrl-BA
2018-01-18 15:58 - 2018-01-18 16:00 - 000000000 ____D C:\WINDOWS\SysWOW64\sq-AL
2018-01-18 15:58 - 2018-01-18 16:00 - 000000000 ____D C:\WINDOWS\SysWOW64\si-LK
2018-01-18 15:58 - 2018-01-18 16:00 - 000000000 ____D C:\WINDOWS\SysWOW64\sd-Arab-PK
2018-01-18 15:58 - 2018-01-18 16:00 - 000000000 ____D C:\WINDOWS\SysWOW64\rw-RW
2018-01-18 15:58 - 2018-01-18 16:00 - 000000000 ____D C:\WINDOWS\SysWOW64\quz-PE
2018-01-18 15:58 - 2018-01-18 16:00 - 000000000 ____D C:\WINDOWS\SysWOW64\quc-Latn-GT
2018-01-18 15:58 - 2018-01-18 16:00 - 000000000 ____D C:\WINDOWS\SysWOW64\prs-AF
2018-01-18 15:58 - 2018-01-18 16:00 - 000000000 ____D C:\WINDOWS\SysWOW64\pa-IN
2018-01-18 15:58 - 2018-01-18 16:00 - 000000000 ____D C:\WINDOWS\SysWOW64\pa-Arab-PK
2018-01-18 15:58 - 2018-01-18 16:00 - 000000000 ____D C:\WINDOWS\SysWOW64\or-IN
2018-01-18 15:58 - 2018-01-18 16:00 - 000000000 ____D C:\WINDOWS\SysWOW64\nso-ZA
2018-01-18 15:58 - 2018-01-18 16:00 - 000000000 ____D C:\WINDOWS\SysWOW64\nn-NO
2018-01-18 15:58 - 2018-01-18 16:00 - 000000000 ____D C:\WINDOWS\SysWOW64\ne-NP
2018-01-18 15:58 - 2018-01-18 16:00 - 000000000 ____D C:\WINDOWS\SysWOW64\mt-MT
2018-01-18 15:58 - 2018-01-18 16:00 - 000000000 ____D C:\WINDOWS\SysWOW64\mr-IN
2018-01-18 15:58 - 2018-01-18 16:00 - 000000000 ____D C:\WINDOWS\SysWOW64\mn-MN
2018-01-18 15:58 - 2018-01-18 16:00 - 000000000 ____D C:\WINDOWS\SysWOW64\ml-IN
2018-01-18 15:58 - 2018-01-18 16:00 - 000000000 ____D C:\WINDOWS\SysWOW64\mk-MK
2018-01-18 15:58 - 2018-01-18 16:00 - 000000000 ____D C:\WINDOWS\SysWOW64\mi-NZ
2018-01-18 15:58 - 2018-01-18 16:00 - 000000000 ____D C:\WINDOWS\SysWOW64\lo-LA
2018-01-18 15:58 - 2018-01-18 16:00 - 000000000 ____D C:\WINDOWS\SysWOW64\lb-LU
2018-01-18 15:58 - 2018-01-18 16:00 - 000000000 ____D C:\WINDOWS\SysWOW64\ky-KG
2018-01-18 15:58 - 2018-01-18 16:00 - 000000000 ____D C:\WINDOWS\SysWOW64\ku-Arab-IQ
2018-01-18 15:58 - 2018-01-18 16:00 - 000000000 ____D C:\WINDOWS\SysWOW64\kok-IN
2018-01-18 15:58 - 2018-01-18 16:00 - 000000000 ____D C:\WINDOWS\SysWOW64\kn-IN
2018-01-18 15:58 - 2018-01-18 16:00 - 000000000 ____D C:\WINDOWS\SysWOW64\km-KH
2018-01-18 15:58 - 2018-01-18 16:00 - 000000000 ____D C:\WINDOWS\SysWOW64\kk-KZ
2018-01-18 15:58 - 2018-01-18 16:00 - 000000000 ____D C:\WINDOWS\SysWOW64\ka-GE
2018-01-18 15:58 - 2018-01-18 16:00 - 000000000 ____D C:\WINDOWS\SysWOW64\is-IS
2018-01-18 15:58 - 2018-01-18 16:00 - 000000000 ____D C:\WINDOWS\SysWOW64\ig-NG
2018-01-18 15:58 - 2018-01-18 16:00 - 000000000 ____D C:\WINDOWS\SysWOW64\id-ID
2018-01-18 15:58 - 2018-01-18 16:00 - 000000000 ____D C:\WINDOWS\SysWOW64\hy-AM
2018-01-18 15:58 - 2018-01-18 16:00 - 000000000 ____D C:\WINDOWS\SysWOW64\ha-Latn-NG
2018-01-18 15:58 - 2018-01-18 16:00 - 000000000 ____D C:\WINDOWS\SysWOW64\gu-IN
2018-01-18 15:58 - 2018-01-18 16:00 - 000000000 ____D C:\WINDOWS\SysWOW64\gd-GB
2018-01-18 15:58 - 2018-01-18 16:00 - 000000000 ____D C:\WINDOWS\SysWOW64\ga-IE
2018-01-18 15:58 - 2018-01-18 16:00 - 000000000 ____D C:\WINDOWS\SysWOW64\fil-PH
2018-01-18 15:58 - 2018-01-18 16:00 - 000000000 ____D C:\WINDOWS\SysWOW64\fa-IR
2018-01-18 15:58 - 2018-01-18 16:00 - 000000000 ____D C:\WINDOWS\SysWOW64\cy-GB
2018-01-18 15:58 - 2018-01-18 16:00 - 000000000 ____D C:\WINDOWS\SysWOW64\chr-CHER-US
2018-01-18 15:58 - 2018-01-18 16:00 - 000000000 ____D C:\WINDOWS\SysWOW64\ca-ES-valencia
2018-01-18 15:58 - 2018-01-18 16:00 - 000000000 ____D C:\WINDOWS\SysWOW64\bs-Latn-BA
2018-01-18 15:58 - 2018-01-18 16:00 - 000000000 ____D C:\WINDOWS\SysWOW64\bn-IN
2018-01-18 15:58 - 2018-01-18 16:00 - 000000000 ____D C:\WINDOWS\SysWOW64\bn-BD
2018-01-18 15:58 - 2018-01-18 16:00 - 000000000 ____D C:\WINDOWS\SysWOW64\be-BY
2018-01-18 15:58 - 2018-01-18 16:00 - 000000000 ____D C:\WINDOWS\SysWOW64\az-Latn-AZ
2018-01-18 15:58 - 2018-01-18 16:00 - 000000000 ____D C:\WINDOWS\SysWOW64\as-IN
2018-01-18 15:58 - 2018-01-18 16:00 - 000000000 ____D C:\WINDOWS\SysWOW64\am-ET
2018-01-18 15:58 - 2018-01-18 16:00 - 000000000 ____D C:\WINDOWS\SysWOW64\af-ZA
2018-01-18 15:58 - 2018-01-18 16:00 - 000000000 ____D C:\WINDOWS\system32\zu-ZA
2018-01-18 15:58 - 2018-01-18 16:00 - 000000000 ____D C:\WINDOWS\system32\yo-NG
2018-01-18 15:58 - 2018-01-18 16:00 - 000000000 ____D C:\WINDOWS\system32\xh-ZA
2018-01-18 15:58 - 2018-01-18 16:00 - 000000000 ____D C:\WINDOWS\system32\wo-SN
2018-01-18 15:58 - 2018-01-18 16:00 - 000000000 ____D C:\WINDOWS\system32\vi-VN
2018-01-18 15:58 - 2018-01-18 16:00 - 000000000 ____D C:\WINDOWS\system32\uz-Latn-UZ
2018-01-18 15:58 - 2018-01-18 16:00 - 000000000 ____D C:\WINDOWS\system32\ur-PK
2018-01-18 15:58 - 2018-01-18 16:00 - 000000000 ____D C:\WINDOWS\system32\ug-CN
2018-01-18 15:58 - 2018-01-18 16:00 - 000000000 ____D C:\WINDOWS\system32\tt-RU
2018-01-18 15:58 - 2018-01-18 16:00 - 000000000 ____D C:\WINDOWS\system32\tn-ZA
2018-01-18 15:58 - 2018-01-18 16:00 - 000000000 ____D C:\WINDOWS\system32\tk-TM
2018-01-18 15:58 - 2018-01-18 16:00 - 000000000 ____D C:\WINDOWS\system32\ti-ET
2018-01-18 15:58 - 2018-01-18 16:00 - 000000000 ____D C:\WINDOWS\system32\tg-Cyrl-TJ
2018-01-18 15:58 - 2018-01-18 16:00 - 000000000 ____D C:\WINDOWS\system32\te-IN
2018-01-18 15:58 - 2018-01-18 16:00 - 000000000 ____D C:\WINDOWS\system32\ta-IN
2018-01-18 15:58 - 2018-01-18 16:00 - 000000000 ____D C:\WINDOWS\system32\sw-KE
2018-01-18 15:58 - 2018-01-18 16:00 - 000000000 ____D C:\WINDOWS\system32\sr-Cyrl-RS
2018-01-18 15:58 - 2018-01-18 16:00 - 000000000 ____D C:\WINDOWS\system32\sr-Cyrl-BA
2018-01-18 15:58 - 2018-01-18 16:00 - 000000000 ____D C:\WINDOWS\system32\sq-AL
2018-01-18 15:58 - 2018-01-18 16:00 - 000000000 ____D C:\WINDOWS\system32\si-LK
2018-01-18 15:58 - 2018-01-18 16:00 - 000000000 ____D C:\WINDOWS\system32\sd-Arab-PK
2018-01-18 15:58 - 2018-01-18 16:00 - 000000000 ____D C:\WINDOWS\system32\rw-RW
2018-01-18 15:58 - 2018-01-18 16:00 - 000000000 ____D C:\WINDOWS\system32\quz-PE
2018-01-18 15:58 - 2018-01-18 16:00 - 000000000 ____D C:\WINDOWS\system32\quc-Latn-GT
2018-01-18 15:58 - 2018-01-18 16:00 - 000000000 ____D C:\WINDOWS\system32\prs-AF
2018-01-18 15:58 - 2018-01-18 16:00 - 000000000 ____D C:\WINDOWS\system32\pa-IN
2018-01-18 15:58 - 2018-01-18 16:00 - 000000000 ____D C:\WINDOWS\system32\pa-Arab-PK
2018-01-18 15:58 - 2018-01-18 16:00 - 000000000 ____D C:\WINDOWS\system32\or-IN
2018-01-18 15:58 - 2018-01-18 16:00 - 000000000 ____D C:\WINDOWS\system32\nso-ZA
2018-01-18 15:58 - 2018-01-18 16:00 - 000000000 ____D C:\WINDOWS\system32\nn-NO
2018-01-18 15:58 - 2018-01-18 16:00 - 000000000 ____D C:\WINDOWS\system32\ne-NP
2018-01-18 15:58 - 2018-01-18 16:00 - 000000000 ____D C:\WINDOWS\system32\mt-MT
2018-01-18 15:58 - 2018-01-18 16:00 - 000000000 ____D C:\WINDOWS\system32\mr-IN
2018-01-18 15:58 - 2018-01-18 16:00 - 000000000 ____D C:\WINDOWS\system32\mn-MN
2018-01-18 15:58 - 2018-01-18 16:00 - 000000000 ____D C:\WINDOWS\system32\ml-IN
2018-01-18 15:58 - 2018-01-18 16:00 - 000000000 ____D C:\WINDOWS\system32\mk-MK
2018-01-18 15:58 - 2018-01-18 16:00 - 000000000 ____D C:\WINDOWS\system32\mi-NZ
2018-01-18 15:58 - 2018-01-18 16:00 - 000000000 ____D C:\WINDOWS\system32\lo-LA
2018-01-18 15:58 - 2018-01-18 16:00 - 000000000 ____D C:\WINDOWS\system32\lb-LU
2018-01-18 15:58 - 2018-01-18 16:00 - 000000000 ____D C:\WINDOWS\system32\ky-KG
2018-01-18 15:58 - 2018-01-18 16:00 - 000000000 ____D C:\WINDOWS\system32\ku-Arab-IQ
2018-01-18 15:58 - 2018-01-18 16:00 - 000000000 ____D C:\WINDOWS\system32\kok-IN
2018-01-18 15:58 - 2018-01-18 16:00 - 000000000 ____D C:\WINDOWS\system32\kn-IN
2018-01-18 15:58 - 2018-01-18 16:00 - 000000000 ____D C:\WINDOWS\system32\km-KH
2018-01-18 15:58 - 2018-01-18 16:00 - 000000000 ____D C:\WINDOWS\system32\kk-KZ
2018-01-18 15:58 - 2018-01-18 16:00 - 000000000 ____D C:\WINDOWS\system32\ka-GE
2018-01-18 15:58 - 2018-01-18 16:00 - 000000000 ____D C:\WINDOWS\system32\is-IS
2018-01-18 15:58 - 2018-01-18 16:00 - 000000000 ____D C:\WINDOWS\system32\ig-NG
2018-01-18 15:58 - 2018-01-18 16:00 - 000000000 ____D C:\WINDOWS\system32\id-ID
2018-01-18 15:58 - 2018-01-18 16:00 - 000000000 ____D C:\WINDOWS\system32\hy-AM
2018-01-18 15:58 - 2018-01-18 16:00 - 000000000 ____D C:\WINDOWS\system32\ha-Latn-NG
2018-01-18 15:58 - 2018-01-18 16:00 - 000000000 ____D C:\WINDOWS\system32\gu-IN
2018-01-18 15:58 - 2018-01-18 16:00 - 000000000 ____D C:\WINDOWS\system32\gd-GB
2018-01-18 15:58 - 2018-01-18 16:00 - 000000000 ____D C:\WINDOWS\system32\ga-IE
2018-01-18 15:58 - 2018-01-18 16:00 - 000000000 ____D C:\WINDOWS\system32\fil-PH
2018-01-18 15:58 - 2018-01-18 16:00 - 000000000 ____D C:\WINDOWS\system32\fa-IR
2018-01-18 15:58 - 2018-01-18 16:00 - 000000000 ____D C:\WINDOWS\system32\cy-GB
2018-01-18 15:58 - 2018-01-18 16:00 - 000000000 ____D C:\WINDOWS\system32\chr-CHER-US
2018-01-18 15:58 - 2018-01-18 16:00 - 000000000 ____D C:\WINDOWS\system32\ca-ES-valencia
2018-01-18 15:58 - 2018-01-18 16:00 - 000000000 ____D C:\WINDOWS\system32\bs-Latn-BA
2018-01-18 15:58 - 2018-01-18 16:00 - 000000000 ____D C:\WINDOWS\system32\bn-IN
2018-01-18 15:58 - 2018-01-18 16:00 - 000000000 ____D C:\WINDOWS\system32\bn-BD
2018-01-18 15:58 - 2018-01-18 16:00 - 000000000 ____D C:\WINDOWS\system32\be-BY
2018-01-18 15:58 - 2018-01-18 16:00 - 000000000 ____D C:\WINDOWS\system32\az-Latn-AZ
2018-01-18 15:58 - 2018-01-18 16:00 - 000000000 ____D C:\WINDOWS\system32\as-IN
2018-01-18 15:58 - 2018-01-18 16:00 - 000000000 ____D C:\WINDOWS\system32\am-ET
2018-01-18 15:58 - 2018-01-18 16:00 - 000000000 ____D C:\WINDOWS\system32\af-ZA
2018-01-18 15:58 - 2018-01-18 15:58 - 000000000 ____D C:\WINDOWS\SysWOW64\winrm
2018-01-18 15:58 - 2018-01-18 15:58 - 000000000 ____D C:\WINDOWS\SysWOW64\WCN
2018-01-18 15:58 - 2018-01-18 15:58 - 000000000 ____D C:\WINDOWS\SysWOW64\sysprep
2018-01-18 15:58 - 2018-01-18 15:58 - 000000000 ____D C:\WINDOWS\SysWOW64\slmgr
2018-01-18 15:58 - 2018-01-18 15:58 - 000000000 ____D C:\WINDOWS\SysWOW64\Printing_Admin_Scripts
2018-01-18 15:58 - 2018-01-18 15:58 - 000000000 ____D C:\WINDOWS\SysWOW64\MailContactsCalendarSync
2018-01-18 15:58 - 2018-01-18 15:58 - 000000000 ____D C:\WINDOWS\SysWOW64\hi-IN
2018-01-18 15:58 - 2018-01-18 15:58 - 000000000 ____D C:\WINDOWS\SysWOW64\gl-ES
2018-01-18 15:58 - 2018-01-18 15:58 - 000000000 ____D C:\WINDOWS\SysWOW64\eu-ES
2018-01-18 15:58 - 2018-01-18 15:58 - 000000000 ____D C:\WINDOWS\SysWOW64\ca-ES
2018-01-18 15:58 - 2018-01-18 15:58 - 000000000 ____D C:\WINDOWS\SysWOW64\0409
2018-01-18 15:58 - 2018-01-18 15:58 - 000000000 ____D C:\WINDOWS\system32\winrm
2018-01-18 15:58 - 2018-01-18 15:58 - 000000000 ____D C:\WINDOWS\system32\WCN
2018-01-18 15:58 - 2018-01-18 15:58 - 000000000 ____D C:\WINDOWS\system32\slmgr
2018-01-18 15:58 - 2018-01-18 15:58 - 000000000 ____D C:\WINDOWS\system32\Printing_Admin_Scripts
2018-01-18 15:58 - 2018-01-18 15:58 - 000000000 ____D C:\WINDOWS\system32\MailContactsCalendarSync
2018-01-18 15:58 - 2018-01-18 15:58 - 000000000 ____D C:\WINDOWS\system32\hi-IN
2018-01-18 15:58 - 2018-01-18 15:58 - 000000000 ____D C:\WINDOWS\system32\gl-ES
2018-01-18 15:58 - 2018-01-18 15:58 - 000000000 ____D C:\WINDOWS\system32\eu-ES
2018-01-18 15:58 - 2018-01-18 15:58 - 000000000 ____D C:\WINDOWS\system32\ca-ES
2018-01-18 15:58 - 2018-01-18 15:58 - 000000000 ____D C:\WINDOWS\system32\0409
2018-01-18 15:58 - 2018-01-18 15:58 - 000000000 ____D C:\WINDOWS\OCR
2018-01-18 15:58 - 2018-01-18 15:58 - 000000000 ____D C:\WINDOWS\DigitalLocker
2018-01-18 15:58 - 2018-01-18 15:58 - 000000000 ____D C:\Program Files\Reference Assemblies
2018-01-18 15:58 - 2018-01-18 15:58 - 000000000 ____D C:\Program Files\MSBuild
2018-01-18 15:58 - 2018-01-18 15:58 - 000000000 ____D C:\Program Files (x86)\Reference Assemblies
2018-01-18 15:58 - 2018-01-18 15:58 - 000000000 ____D C:\Program Files (x86)\MSBuild
2018-01-18 15:57 - 2017-12-22 05:45 - 000835576 _____ (Adobe Systems Incorporated) C:\WINDOWS\SysWOW64\FlashPlayerApp.exe
2018-01-18 15:57 - 2017-12-22 05:45 - 000177648 _____ (Adobe Systems Incorporated) C:\WINDOWS\SysWOW64\FlashPlayerCPLApp.cpl
2018-01-18 15:56 - 2018-01-18 20:02 - 000000000 ____D C:\WINDOWS\system32\config\systemprofile
2018-01-18 15:56 - 2018-01-18 19:44 - 000000000 ___HD C:\Program Files\WindowsApps
2018-01-18 15:56 - 2018-01-18 18:14 - 000000000 ____D C:\WINDOWS\DeliveryOptimization
2018-01-18 15:56 - 2018-01-18 17:50 - 000000000 ____D C:\WINDOWS\AppReadiness
2018-01-18 15:56 - 2018-01-18 16:32 - 000000000 ___RD C:\Program Files (x86)
2018-01-18 15:56 - 2018-01-18 16:32 - 000000000 ___HD C:\WINDOWS\ELAMBKUP
2018-01-18 15:56 - 2018-01-18 16:23 - 000000000 ____D C:\WINDOWS\system32\WinBioDatabase
2018-01-18 15:56 - 2018-01-18 16:23 - 000000000 ____D C:\WINDOWS\Registration
2018-01-18 15:56 - 2018-01-18 16:22 - 000000000 __RHD C:\Users\Public\Libraries
2018-01-18 15:56 - 2018-01-18 16:22 - 000000000 ____D C:\WINDOWS\system32\FxsTmp
2018-01-18 15:56 - 2018-01-18 16:21 - 000000000 ____D C:\WINDOWS\system32\spool
2018-01-18 15:56 - 2018-01-18 16:20 - 000000000 ____D C:\ProgramData\USOPrivate
2018-01-18 15:56 - 2018-01-18 16:20 - 000000000 ____D C:\ProgramData\regid.1991-06.com.microsoft
2018-01-18 15:56 - 2018-01-18 16:20 - 000000000 ____D C:\Program Files\Common Files\microsoft shared
2018-01-18 15:56 - 2018-01-18 16:19 - 000000000 ____D C:\WINDOWS\system32\Sysprep
2018-01-18 15:56 - 2018-01-18 16:19 - 000000000 ____D C:\WINDOWS\appcompat
2018-01-18 15:56 - 2018-01-18 16:18 - 000000000 ___RD C:\WINDOWS\PrintDialog
2018-01-18 15:56 - 2018-01-18 16:18 - 000000000 ___RD C:\WINDOWS\ImmersiveControlPanel
2018-01-18 15:56 - 2018-01-18 16:02 - 000000000 ____D C:\WINDOWS\system32\oobe
2018-01-18 15:56 - 2018-01-18 16:01 - 000028672 _____ C:\WINDOWS\system32\config\BCD-Template
2018-01-18 15:56 - 2018-01-18 16:00 - 000000000 ___SD C:\WINDOWS\SysWOW64\F12
2018-01-18 15:56 - 2018-01-18 16:00 - 000000000 ___SD C:\WINDOWS\system32\F12
2018-01-18 15:56 - 2018-01-18 16:00 - 000000000 ____D C:\WINDOWS\TextInput
2018-01-18 15:56 - 2018-01-18 16:00 - 000000000 ____D C:\WINDOWS\SysWOW64\WinMetadata
2018-01-18 15:56 - 2018-01-18 16:00 - 000000000 ____D C:\WINDOWS\SysWOW64\Dism
2018-01-18 15:56 - 2018-01-18 16:00 - 000000000 ____D C:\WINDOWS\system32\WinMetadata
2018-01-18 15:56 - 2018-01-18 16:00 - 000000000 ____D C:\WINDOWS\system32\WinBioPlugIns
2018-01-18 15:56 - 2018-01-18 16:00 - 000000000 ____D C:\WINDOWS\system32\migwiz
2018-01-18 15:56 - 2018-01-18 16:00 - 000000000 ____D C:\WINDOWS\system32\Dism
2018-01-18 15:56 - 2018-01-18 16:00 - 000000000 ____D C:\WINDOWS\system32\appraiser
2018-01-18 15:56 - 2018-01-18 16:00 - 000000000 ____D C:\WINDOWS\ShellExperiences
2018-01-18 15:56 - 2018-01-18 16:00 - 000000000 ____D C:\WINDOWS\Provisioning
2018-01-18 15:56 - 2018-01-18 16:00 - 000000000 ____D C:\Program Files\Windows Defender
2018-01-18 15:56 - 2018-01-18 15:58 - 000000000 ___SD C:\WINDOWS\SysWOW64\DiagSvcs
2018-01-18 15:56 - 2018-01-18 15:58 - 000000000 ___SD C:\WINDOWS\system32\dsc
2018-01-18 15:56 - 2018-01-18 15:58 - 000000000 ___SD C:\WINDOWS\system32\DiagSvcs
2018-01-18 15:56 - 2018-01-18 15:58 - 000000000 ____D C:\WINDOWS\SysWOW64\setup
2018-01-18 15:56 - 2018-01-18 15:58 - 000000000 ____D C:\WINDOWS\SysWOW64\oobe
2018-01-18 15:56 - 2018-01-18 15:58 - 000000000 ____D C:\WINDOWS\SysWOW64\MUI
2018-01-18 15:56 - 2018-01-18 15:58 - 000000000 ____D C:\WINDOWS\SysWOW64\com
2018-01-18 15:56 - 2018-01-18 15:58 - 000000000 ____D C:\WINDOWS\system32\SystemResetPlatform
2018-01-18 15:56 - 2018-01-18 15:58 - 000000000 ____D C:\WINDOWS\system32\setup
2018-01-18 15:56 - 2018-01-18 15:58 - 000000000 ____D C:\WINDOWS\system32\MUI
2018-01-18 15:56 - 2018-01-18 15:58 - 000000000 ____D C:\WINDOWS\system32\com
2018-01-18 15:56 - 2018-01-18 15:58 - 000000000 ____D C:\WINDOWS\PolicyDefinitions
2018-01-18 15:56 - 2018-01-18 15:58 - 000000000 ____D C:\WINDOWS\IME
2018-01-18 15:56 - 2018-01-18 15:58 - 000000000 ____D C:\WINDOWS\Help
2018-01-18 15:56 - 2018-01-18 15:58 - 000000000 ____D C:\Program Files\Windows Photo Viewer
2018-01-18 15:56 - 2018-01-18 15:58 - 000000000 ____D C:\Program Files\Common Files\system
2018-01-18 15:56 - 2018-01-18 15:58 - 000000000 ____D C:\Program Files (x86)\Windows Photo Viewer
2018-01-18 15:56 - 2018-01-18 15:58 - 000000000 ____D C:\Program Files (x86)\Windows Defender
2018-01-18 15:56 - 2018-01-18 15:56 - 000000000 __SHD C:\Program Files\Windows Sidebar
2018-01-18 15:56 - 2018-01-18 15:56 - 000000000 __SHD C:\Program Files (x86)\Windows Sidebar
2018-01-18 15:56 - 2018-01-18 15:56 - 000000000 __RSD C:\WINDOWS\media
2018-01-18 15:56 - 2018-01-18 15:56 - 000000000 ___SD C:\WINDOWS\SysWOW64\Nui
2018-01-18 15:56 - 2018-01-18 15:56 - 000000000 ___SD C:\WINDOWS\SysWOW64\Configuration
2018-01-18 15:56 - 2018-01-18 15:56 - 000000000 ___SD C:\WINDOWS\system32\UNP
2018-01-18 15:56 - 2018-01-18 15:56 - 000000000 ___SD C:\WINDOWS\system32\Nui
2018-01-18 15:56 - 2018-01-18 15:56 - 000000000 ___SD C:\WINDOWS\system32\Configuration
2018-01-18 15:56 - 2018-01-18 15:56 - 000000000 ___SD C:\WINDOWS\Downloaded Program Files
2018-01-18 15:56 - 2018-01-18 15:56 - 000000000 ___RD C:\WINDOWS\Offline Web Pages
2018-01-18 15:56 - 2018-01-18 15:56 - 000000000 ____D C:\WINDOWS\Web
2018-01-18 15:56 - 2018-01-18 15:56 - 000000000 ____D C:\WINDOWS\Vss
2018-01-18 15:56 - 2018-01-18 15:56 - 000000000 ____D C:\WINDOWS\tracing
2018-01-18 15:56 - 2018-01-18 15:56 - 000000000 ____D C:\WINDOWS\TAPI
2018-01-18 15:56 - 2018-01-18 15:56 - 000000000 ____D C:\WINDOWS\SysWOW64\SMI
2018-01-18 15:56 - 2018-01-18 15:56 - 000000000 ____D C:\WINDOWS\SysWOW64\ras
2018-01-18 15:56 - 2018-01-18 15:56 - 000000000 ____D C:\WINDOWS\SysWOW64\NDF
2018-01-18 15:56 - 2018-01-18 15:56 - 000000000 ____D C:\WINDOWS\SysWOW64\Msdtc
2018-01-18 15:56 - 2018-01-18 15:56 - 000000000 ____D C:\WINDOWS\SysWOW64\migwiz
2018-01-18 15:56 - 2018-01-18 15:56 - 000000000 ____D C:\WINDOWS\SysWOW64\Macromed
2018-01-18 15:56 - 2018-01-18 15:56 - 000000000 ____D C:\WINDOWS\SysWOW64\Ipmi
2018-01-18 15:56 - 2018-01-18 15:56 - 000000000 ____D C:\WINDOWS\SysWOW64\InputMethod
2018-01-18 15:56 - 2018-01-18 15:56 - 000000000 ____D C:\WINDOWS\SysWOW64\inetsrv
2018-01-18 15:56 - 2018-01-18 15:56 - 000000000 ____D C:\WINDOWS\SysWOW64\IME
2018-01-18 15:56 - 2018-01-18 15:56 - 000000000 ____D C:\WINDOWS\SysWOW64\icsxml
2018-01-18 15:56 - 2018-01-18 15:56 - 000000000 ____D C:\WINDOWS\SysWOW64\GroupPolicyUsers
2018-01-18 15:56 - 2018-01-18 15:56 - 000000000 ____D C:\WINDOWS\SysWOW64\GroupPolicy
2018-01-18 15:56 - 2018-01-18 15:56 - 000000000 ____D C:\WINDOWS\SysWOW64\FxsTmp
2018-01-18 15:56 - 2018-01-18 15:56 - 000000000 ____D C:\WINDOWS\SysWOW64\downlevel
2018-01-18 15:56 - 2018-01-18 15:56 - 000000000 ____D C:\WINDOWS\SysWOW64\Bthprops
2018-01-18 15:56 - 2018-01-18 15:56 - 000000000 ____D C:\WINDOWS\SysWOW64\AppLocker
2018-01-18 15:56 - 2018-01-18 15:56 - 000000000 ____D C:\WINDOWS\SysWOW64\AdvancedInstallers
2018-01-18 15:56 - 2018-01-18 15:56 - 000000000 ____D C:\WINDOWS\SystemResources
2018-01-18 15:56 - 2018-01-18 15:56 - 000000000 ____D C:\WINDOWS\SystemApps
2018-01-18 15:56 - 2018-01-18 15:56 - 000000000 ____D C:\WINDOWS\system32\winevt
2018-01-18 15:56 - 2018-01-18 15:56 - 000000000 ____D C:\WINDOWS\system32\SecureBootUpdates
2018-01-18 15:56 - 2018-01-18 15:56 - 000000000 ____D C:\WINDOWS\system32\ras
2018-01-18 15:56 - 2018-01-18 15:56 - 000000000 ____D C:\WINDOWS\system32\ProximityToast
2018-01-18 15:56 - 2018-01-18 15:56 - 000000000 ____D C:\WINDOWS\system32\PointOfService
2018-01-18 15:56 - 2018-01-18 15:56 - 000000000 ____D C:\WINDOWS\system32\NDF
2018-01-18 15:56 - 2018-01-18 15:56 - 000000000 ____D C:\WINDOWS\system32\MsDtc
2018-01-18 15:56 - 2018-01-18 15:56 - 000000000 ____D C:\WINDOWS\system32\Macromed
2018-01-18 15:56 - 2018-01-18 15:56 - 000000000 ____D C:\WINDOWS\system32\Ipmi
2018-01-18 15:56 - 2018-01-18 15:56 - 000000000 ____D C:\WINDOWS\system32\InputMethod
2018-01-18 15:56 - 2018-01-18 15:56 - 000000000 ____D C:\WINDOWS\system32\inetsrv
2018-01-18 15:56 - 2018-01-18 15:56 - 000000000 ____D C:\WINDOWS\system32\IME
2018-01-18 15:56 - 2018-01-18 15:56 - 000000000 ____D C:\WINDOWS\system32\icsxml
2018-01-18 15:56 - 2018-01-18 15:56 - 000000000 ____D C:\WINDOWS\system32\ias
2018-01-18 15:56 - 2018-01-18 15:56 - 000000000 ____D C:\WINDOWS\system32\hydrogen
2018-01-18 15:56 - 2018-01-18 15:56 - 000000000 ____D C:\WINDOWS\system32\GroupPolicyUsers
2018-01-18 15:56 - 2018-01-18 15:56 - 000000000 ____D C:\WINDOWS\system32\GroupPolicy
2018-01-18 15:56 - 2018-01-18 15:56 - 000000000 ____D C:\WINDOWS\system32\downlevel
2018-01-18 15:56 - 2018-01-18 15:56 - 000000000 ____D C:\WINDOWS\system32\DDFs
2018-01-18 15:56 - 2018-01-18 15:56 - 000000000 ____D C:\WINDOWS\system32\config\TxR
2018-01-18 15:56 - 2018-01-18 15:56 - 000000000 ____D C:\WINDOWS\system32\config\RegBack
2018-01-18 15:56 - 2018-01-18 15:56 - 000000000 ____D C:\WINDOWS\system32\config\Journal
2018-01-18 15:56 - 2018-01-18 15:56 - 000000000 ____D C:\WINDOWS\system32\Bthprops
2018-01-18 15:56 - 2018-01-18 15:56 - 000000000 ____D C:\WINDOWS\system32\AppLocker
2018-01-18 15:56 - 2018-01-18 15:56 - 000000000 ____D C:\WINDOWS\system32\AdvancedInstallers
2018-01-18 15:56 - 2018-01-18 15:56 - 000000000 ____D C:\WINDOWS\System
2018-01-18 15:56 - 2018-01-18 15:56 - 000000000 ____D C:\WINDOWS\SKB
2018-01-18 15:56 - 2018-01-18 15:56 - 000000000 ____D C:\WINDOWS\security
2018-01-18 15:56 - 2018-01-18 15:56 - 000000000 ____D C:\WINDOWS\schemas
2018-01-18 15:56 - 2018-01-18 15:56 - 000000000 ____D C:\WINDOWS\SchCache
2018-01-18 15:56 - 2018-01-18 15:56 - 000000000 ____D C:\WINDOWS\Resources
2018-01-18 15:56 - 2018-01-18 15:56 - 000000000 ____D C:\WINDOWS\rescache
2018-01-18 15:56 - 2018-01-18 15:56 - 000000000 ____D C:\WINDOWS\PLA
2018-01-18 15:56 - 2018-01-18 15:56 - 000000000 ____D C:\WINDOWS\Performance
2018-01-18 15:56 - 2018-01-18 15:56 - 000000000 ____D C:\WINDOWS\ModemLogs
2018-01-18 15:56 - 2018-01-18 15:56 - 000000000 ____D C:\WINDOWS\LiveKernelReports
2018-01-18 15:56 - 2018-01-18 15:56 - 000000000 ____D C:\WINDOWS\L2Schemas
2018-01-18 15:56 - 2018-01-18 15:56 - 000000000 ____D C:\WINDOWS\InputMethod
2018-01-18 15:56 - 2018-01-18 15:56 - 000000000 ____D C:\WINDOWS\Globalization
2018-01-18 15:56 - 2018-01-18 15:56 - 000000000 ____D C:\WINDOWS\GameBarPresenceWriter
2018-01-18 15:56 - 2018-01-18 15:56 - 000000000 ____D C:\WINDOWS\Cursors
2018-01-18 15:56 - 2018-01-18 15:56 - 000000000 ____D C:\WINDOWS\Branding
2018-01-18 15:56 - 2018-01-18 15:56 - 000000000 ____D C:\WINDOWS\bcastdvr
2018-01-18 15:56 - 2018-01-18 15:56 - 000000000 ____D C:\WINDOWS\addins
2018-01-18 15:56 - 2018-01-18 15:56 - 000000000 ____D C:\ProgramData\WindowsHolographicDevices
2018-01-18 15:56 - 2018-01-18 15:56 - 000000000 ____D C:\Program Files\Windows Security
2018-01-18 15:56 - 2018-01-18 15:56 - 000000000 ____D C:\Program Files\Windows Portable Devices
2018-01-18 15:56 - 2018-01-18 15:56 - 000000000 ____D C:\Program Files\windows nt
2018-01-18 15:56 - 2018-01-18 15:56 - 000000000 ____D C:\Program Files\Windows Multimedia Platform
2018-01-18 15:56 - 2018-01-18 15:56 - 000000000 ____D C:\Program Files\Common Files\Services
2018-01-18 15:56 - 2018-01-18 15:56 - 000000000 ____D C:\Program Files (x86)\Windows Portable Devices
2018-01-18 15:56 - 2018-01-18 15:56 - 000000000 ____D C:\Program Files (x86)\windows nt
2018-01-18 15:56 - 2018-01-18 15:56 - 000000000 ____D C:\Program Files (x86)\Windows Multimedia Platform
2018-01-18 15:56 - 2018-01-18 15:55 - 000229376 _____ (Microsoft Corporation) C:\WINDOWS\system32\msclmd.dll
2018-01-18 15:56 - 2018-01-18 15:55 - 000215943 _____ C:\WINDOWS\SysWOW64\dssec.dat
2018-01-18 15:56 - 2018-01-18 15:55 - 000215943 _____ C:\WINDOWS\system32\dssec.dat
2018-01-18 15:56 - 2018-01-18 15:55 - 000208384 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\msclmd.dll
2018-01-18 15:56 - 2018-01-18 15:55 - 000017572 _____ C:\WINDOWS\system32\OEMDefaultAssociations.xml
2018-01-18 15:56 - 2018-01-18 15:55 - 000004096 _____ C:\WINDOWS\system32\config\VSMIDK
2018-01-18 15:56 - 2018-01-18 15:55 - 000003683 _____ C:\WINDOWS\system32\Drivers\etc\lmhosts.sam
2018-01-18 15:56 - 2018-01-18 15:55 - 000000858 _____ C:\WINDOWS\system32\DefaultQuestions.json
2018-01-18 15:56 - 2018-01-18 15:55 - 000000741 _____ C:\WINDOWS\SysWOW64\NOISE.DAT
2018-01-18 15:56 - 2018-01-18 15:55 - 000000741 _____ C:\WINDOWS\system32\NOISE.DAT
2018-01-18 15:55 - 2018-01-18 17:18 - 000000000 ____D C:\WINDOWS\INF
2018-01-18 15:53 - 2018-01-18 18:13 - 000000000 ____D C:\WINDOWS\CbsTemp
2018-01-18 15:52 - 2018-01-18 17:16 - 077856768 _____ C:\WINDOWS\system32\config\SOFTWARE
2018-01-18 15:52 - 2018-01-18 17:16 - 019660800 _____ C:\WINDOWS\system32\config\SYSTEM
2018-01-18 15:52 - 2018-01-18 17:16 - 000524288 _____ C:\WINDOWS\system32\config\DEFAULT
2018-01-18 15:52 - 2018-01-18 17:16 - 000524288 _____ C:\WINDOWS\system32\config\BBI
2018-01-18 15:52 - 2018-01-18 17:16 - 000065536 _____ C:\WINDOWS\system32\config\SECURITY
2018-01-18 15:52 - 2018-01-18 16:33 - 000032768 _____ C:\WINDOWS\system32\config\ELAM
2018-01-18 15:52 - 2018-01-18 16:23 - 000000000 ____D C:\WINDOWS\Panther
2018-01-18 15:52 - 2018-01-18 15:58 - 000000000 ____D C:\WINDOWS\servicing
2018-01-18 15:52 - 2018-01-18 15:57 - 000131072 _____ C:\WINDOWS\system32\config\SAM
2018-01-18 15:52 - 2018-01-18 15:56 - 000000000 ____D C:\WINDOWS\system32\SMI
2018-01-18 15:49 - 2018-01-18 16:02 - 000000000 ___HD C:\$SysReset
2018-01-08 23:43 - 2018-01-01 04:51 - 001055128 ____N (Microsoft Corporation) C:\WINDOWS\system32\hvax64.exe
2018-01-08 23:43 - 2018-01-01 04:51 - 000059800 ____N (Microsoft Corporation) C:\WINDOWS\system32\Drivers\bam.sys
2018-01-08 23:43 - 2018-01-01 04:49 - 008605080 ____N (Microsoft Corporation) C:\WINDOWS\system32\ntoskrnl.exe
2018-01-08 23:43 - 2018-01-01 04:48 - 001954048 ____N (Microsoft Corporation) C:\WINDOWS\system32\ntdll.dll
2018-01-08 23:43 - 2018-01-01 04:47 - 000082840 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\volmgr.sys
2018-01-08 23:43 - 2018-01-01 04:46 - 002709704 ____N (Microsoft Corporation) C:\WINDOWS\system32\iertutil.dll
2018-01-08 23:43 - 2018-01-01 04:46 - 000471960 ____N (Microsoft Corporation) C:\WINDOWS\system32\hal.dll
2018-01-08 23:43 - 2018-01-01 04:45 - 000398744 ____N (Microsoft Corporation) C:\WINDOWS\system32\Drivers\fltMgr.sys
2018-01-08 23:43 - 2018-01-01 04:42 - 000571288 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\spaceport.sys
2018-01-08 23:43 - 2018-01-01 04:39 - 000902416 ____N (Microsoft Corporation) C:\WINDOWS\system32\winhttp.dll
2018-01-08 23:43 - 2018-01-01 04:39 - 000362904 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\pci.sys
2018-01-08 23:43 - 2018-01-01 04:39 - 000129432 ____N (Microsoft Corporation) C:\WINDOWS\system32\Drivers\hvsocket.sys
2018-01-08 23:43 - 2018-01-01 04:37 - 001426664 ____N (Microsoft Corporation) C:\WINDOWS\system32\AudioEng.dll
2018-01-08 23:43 - 2018-01-01 04:36 - 000166296 ____N (Microsoft Corporation) C:\WINDOWS\system32\Drivers\partmgr.sys
2018-01-08 23:43 - 2018-01-01 04:35 - 001170008 ____N (Microsoft Corporation) C:\WINDOWS\system32\AudioSes.dll
2018-01-08 23:43 - 2018-01-01 04:34 - 007385088 ____N (Microsoft Corporation) C:\WINDOWS\system32\Windows.Media.Protection.PlayReady.dll
2018-01-08 23:43 - 2018-01-01 04:33 - 000603920 ____N (Microsoft Corporation) C:\WINDOWS\system32\audiodg.exe
2018-01-08 23:43 - 2018-01-01 04:26 - 000428952 ____N (Microsoft Corporation) C:\WINDOWS\system32\Drivers\rdbss.sys
2018-01-08 23:43 - 2018-01-01 04:25 - 000147864 ____N (Microsoft Corporation) C:\WINDOWS\system32\Drivers\wcifs.sys
2018-01-08 23:43 - 2018-01-01 03:53 - 001615712 ____N (Microsoft Corporation) C:\WINDOWS\SysWOW64\ntdll.dll
2018-01-08 23:43 - 2018-01-01 03:45 - 005615968 ____N (Microsoft Corporation) C:\WINDOWS\SysWOW64\d3d10warp.dll
2018-01-08 23:43 - 2018-01-01 03:45 - 002192624 ____N (Microsoft Corporation) C:\WINDOWS\SysWOW64\iertutil.dll
2018-01-08 23:43 - 2018-01-01 03:42 - 006479552 ____N (Microsoft Corporation) C:\WINDOWS\SysWOW64\Windows.Media.Protection.PlayReady.dll
2018-01-08 23:43 - 2018-01-01 03:42 - 004644912 ____N (Microsoft Corporation) C:\WINDOWS\SysWOW64\mfcore.dll
2018-01-08 23:43 - 2018-01-01 03:42 - 001246432 ____N (Microsoft Corporation) C:\WINDOWS\SysWOW64\AudioEng.dll
2018-01-08 23:43 - 2018-01-01 03:42 - 000982528 ____N (Microsoft Corporation) C:\WINDOWS\SysWOW64\AudioSes.dll
2018-01-08 23:43 - 2018-01-01 03:34 - 000703568 ____N (Microsoft Corporation) C:\WINDOWS\SysWOW64\winhttp.dll
2018-01-08 23:43 - 2018-01-01 03:25 - 002905600 ____N (Microsoft Corporation) C:\WINDOWS\SysWOW64\win32kfull.sys
2018-01-08 23:43 - 2018-01-01 03:25 - 000344576 ____N (Microsoft Corporation) C:\WINDOWS\SysWOW64\edgeIso.dll
2018-01-08 23:43 - 2018-01-01 03:24 - 003668480 ____N (Microsoft Corporation) C:\WINDOWS\system32\win32kfull.sys
2018-01-08 23:43 - 2018-01-01 03:24 - 000202240 ____N (Microsoft Corporation) C:\WINDOWS\SysWOW64\AppxAllUserStore.dll
2018-01-08 23:43 - 2018-01-01 03:23 - 000536576 ____N (Microsoft Corporation) C:\WINDOWS\system32\edgeIso.dll
2018-01-08 23:43 - 2018-01-01 03:21 - 000192512 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\netvsc.sys
2018-01-08 23:43 - 2018-01-01 03:20 - 019337216 ____N (Microsoft Corporation) C:\WINDOWS\SysWOW64\mshtml.dll
2018-01-08 23:43 - 2018-01-01 03:20 - 018917888 ____N (Microsoft Corporation) C:\WINDOWS\SysWOW64\edgehtml.dll
2018-01-08 23:43 - 2018-01-01 03:19 - 000369152 ____N (Microsoft Corporation) C:\WINDOWS\SysWOW64\msIso.dll
2018-01-08 23:43 - 2018-01-01 03:19 - 000365568 ____N (Microsoft Corporation) C:\WINDOWS\SysWOW64\ieproxy.dll
2018-01-08 23:43 - 2018-01-01 03:18 - 000374784 ____N (Microsoft Corporation) C:\WINDOWS\SysWOW64\FirewallAPI.dll
2018-01-08 23:43 - 2018-01-01 03:18 - 000261632 ____N (Microsoft Corporation) C:\WINDOWS\SysWOW64\actxprxy.dll
2018-01-08 23:43 - 2018-01-01 03:17 - 011923968 ____N (Microsoft Corporation) C:\WINDOWS\SysWOW64\ieframe.dll
2018-01-08 23:43 - 2018-01-01 03:17 - 000708096 ____N (Microsoft Corporation) C:\WINDOWS\system32\jscript9diag.dll
2018-01-08 23:43 - 2018-01-01 03:17 - 000559104 ____N (Microsoft Corporation) C:\WINDOWS\SysWOW64\jscript9diag.dll
2018-01-08 23:43 - 2018-01-01 03:17 - 000542208 ____N (Microsoft Corporation) C:\WINDOWS\system32\FirewallAPI.dll
2018-01-08 23:43 - 2018-01-01 03:16 - 003676672 ____N (Microsoft Corporation) C:\WINDOWS\SysWOW64\jscript9.dll
2018-01-08 23:43 - 2018-01-01 03:16 - 000815616 ____N (Microsoft Corporation) C:\WINDOWS\system32\ieproxy.dll
2018-01-08 23:43 - 2018-01-01 03:16 - 000664576 ____N (Microsoft Corporation) C:\WINDOWS\SysWOW64\jscript.dll
2018-01-08 23:43 - 2018-01-01 03:16 - 000594944 ____N (Microsoft Corporation) C:\WINDOWS\system32\vbscript.dll
2018-01-08 23:43 - 2018-01-01 03:16 - 000463360 ____N (Microsoft Corporation) C:\WINDOWS\SysWOW64\vbscript.dll
2018-01-08 23:43 - 2018-01-01 03:15 - 012687872 ____N (Microsoft Corporation) C:\WINDOWS\SysWOW64\wmp.dll
2018-01-08 23:43 - 2018-01-01 03:15 - 006029312 ____N (Microsoft Corporation) C:\WINDOWS\SysWOW64\Chakra.dll
2018-01-08 23:43 - 2018-01-01 03:15 - 000588800 ____N (Microsoft Corporation) C:\WINDOWS\system32\actxprxy.dll
2018-01-08 23:43 - 2018-01-01 03:14 - 002465280 ____N (Microsoft Corporation) C:\WINDOWS\SysWOW64\dwmcore.dll
2018-01-08 23:43 - 2018-01-01 03:13 - 012830208 ____N (Microsoft Corporation) C:\WINDOWS\system32\ieframe.dll
2018-01-08 23:43 - 2018-01-01 03:13 - 002869760 ____N (Microsoft Corporation) C:\WINDOWS\SysWOW64\wininet.dll
2018-01-08 23:43 - 2018-01-01 03:12 - 001547776 ____N (Microsoft Corporation) C:\WINDOWS\system32\lsasrv.dll
2018-01-08 23:43 - 2018-01-01 03:11 - 008108544 ____N (Microsoft Corporation) C:\WINDOWS\system32\Chakra.dll
2018-01-08 23:43 - 2018-01-01 03:11 - 004748288 ____N (Microsoft Corporation) C:\WINDOWS\system32\jscript9.dll
2018-01-08 23:43 - 2018-01-01 03:11 - 000812032 ____N (Microsoft Corporation) C:\WINDOWS\system32\jscript.dll
2018-01-08 23:43 - 2018-01-01 03:09 - 001487872 ____N (Microsoft Corporation) C:\WINDOWS\system32\audiosrv.dll
2018-01-08 23:43 - 2018-01-01 03:08 - 000685056 ____N (Microsoft Corporation) C:\WINDOWS\system32\AudioEndpointBuilder.dll
2018-01-08 23:42 - 2018-01-01 09:15 - 000956416 ____N (Microsoft Corporation) C:\WINDOWS\system32\Spectrum.exe
2018-01-08 23:42 - 2018-01-01 04:54 - 000924648 ____N (Microsoft Corporation) C:\WINDOWS\system32\winresume.exe
2018-01-08 23:42 - 2018-01-01 04:53 - 001090984 ____N (Microsoft Corporation) C:\WINDOWS\system32\winresume.efi
2018-01-08 23:42 - 2018-01-01 04:52 - 000066712 ____N (Microsoft Corporation) C:\WINDOWS\system32\iumcrypt.dll
2018-01-08 23:42 - 2018-01-01 04:51 - 001414784 ____N (Microsoft Corporation) C:\WINDOWS\system32\winload.efi
2018-01-08 23:42 - 2018-01-01 04:51 - 001209240 ____N (Microsoft Corporation) C:\WINDOWS\system32\winload.exe
2018-01-08 23:42 - 2018-01-01 04:51 - 000191816 ____N (Microsoft Corporation) C:\WINDOWS\system32\skci.dll
2018-01-08 23:42 - 2018-01-01 04:50 - 005905752 ____N (Microsoft Corporation) C:\WINDOWS\system32\StartTileData.dll
2018-01-08 23:42 - 2018-01-01 04:50 - 000780464 ____N (Microsoft Corporation) C:\WINDOWS\system32\fontdrvhost.exe
2018-01-08 23:42 - 2018-01-01 04:50 - 000479912 ____N (Microsoft Corporation) C:\WINDOWS\system32\ucrtbase_enclave.dll
2018-01-08 23:42 - 2018-01-01 04:50 - 000077208 ____N (Microsoft Corporation) C:\WINDOWS\system32\hvloader.dll
2018-01-08 23:42 - 2018-01-01 04:49 - 000599448 ____N (Microsoft Corporation) C:\WINDOWS\system32\securekernel.exe
2018-01-08 23:42 - 2018-01-01 04:49 - 000319352 ____N (Microsoft Corporation) C:\WINDOWS\system32\wow64.dll
2018-01-08 23:42 - 2018-01-01 04:49 - 000292376 ____N (Microsoft Corporation) C:\WINDOWS\system32\wscapi.dll
2018-01-08 23:42 - 2018-01-01 04:48 - 007831760 ____N (Microsoft Corporation) C:\WINDOWS\system32\d3d10warp.dll
2018-01-08 23:42 - 2018-01-01 04:48 - 000382360 ____N (Adobe Systems Incorporated) C:\WINDOWS\system32\atmfd.dll
2018-01-08 23:42 - 2018-01-01 04:47 - 000649304 ____N (Microsoft Corporation) C:\WINDOWS\system32\advapi32.dll
2018-01-08 23:42 - 2018-01-01 04:46 - 000898216 ____N (Microsoft Corporation) C:\WINDOWS\system32\CoreMessaging.dll
2018-01-08 23:42 - 2018-01-01 04:46 - 000733592 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\acpi.sys
2018-01-08 23:42 - 2018-01-01 04:45 - 002395032 ____N (Microsoft Corporation) C:\WINDOWS\system32\Drivers\ntfs.sys
2018-01-08 23:42 - 2018-01-01 04:45 - 001277848 ____N (Microsoft Corporation) C:\WINDOWS\system32\Drivers\ndis.sys
2018-01-08 23:42 - 2018-01-01 04:43 - 001173576 ____N (Microsoft Corporation) C:\WINDOWS\system32\rpcrt4.dll
2018-01-08 23:42 - 2018-01-01 04:43 - 000367336 ____N (Microsoft Corporation) C:\WINDOWS\system32\Windows.Storage.ApplicationData.dll
2018-01-08 23:42 - 2018-01-01 04:43 - 000062872 ____N (Microsoft Corporation) C:\WINDOWS\system32\Drivers\fsdepends.sys
2018-01-08 23:42 - 2018-01-01 04:42 - 001029016 ____N (Microsoft Corporation) C:\WINDOWS\system32\efscore.dll
2018-01-08 23:42 - 2018-01-01 04:42 - 000494488 ____N (Microsoft Corporation) C:\WINDOWS\system32\pcasvc.dll
2018-01-08 23:42 - 2018-01-01 04:42 - 000184984 ____N (Microsoft Corporation) C:\WINDOWS\system32\sspicli.dll
2018-01-08 23:42 - 2018-01-01 04:42 - 000109976 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\vmbus.sys
2018-01-08 23:42 - 2018-01-01 04:41 - 007676296 ____N (Microsoft Corporation) C:\WINDOWS\system32\windows.storage.dll
2018-01-08 23:42 - 2018-01-01 04:41 - 000559512 ____N (Microsoft Corporation) C:\WINDOWS\system32\Drivers\storport.sys
2018-01-08 23:42 - 2018-01-01 04:41 - 000549552 ____N (Microsoft Corporation) C:\WINDOWS\system32\WWanAPI.dll
2018-01-08 23:42 - 2018-01-01 04:40 - 001206680 ____N (Microsoft Corporation) C:\WINDOWS\system32\hvix64.exe
2018-01-08 23:42 - 2018-01-01 04:39 - 000677784 ____N (Microsoft Corporation) C:\WINDOWS\system32\Drivers\cng.sys
2018-01-08 23:42 - 2018-01-01 04:39 - 000508264 ____N (Microsoft Corporation) C:\WINDOWS\system32\systemreset.exe
2018-01-08 23:42 - 2018-01-01 04:38 - 003904808 ____N (Microsoft Corporation) C:\WINDOWS\explorer.exe
2018-01-08 23:42 - 2018-01-01 04:38 - 000727448 ____N (Microsoft Corporation) C:\WINDOWS\system32\Drivers\fvevol.sys
2018-01-08 23:42 - 2018-01-01 04:38 - 000519152 ____N (Microsoft Corporation) C:\WINDOWS\system32\SecurityHealthService.exe
2018-01-08 23:42 - 2018-01-01 04:38 - 000103320 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\stornvme.sys
2018-01-08 23:42 - 2018-01-01 04:38 - 000038808 ____N (Microsoft Corporation) C:\WINDOWS\system32\Drivers\Diskdump.sys
2018-01-08 23:42 - 2018-01-01 04:37 - 000461720 ____N (Microsoft Corporation) C:\WINDOWS\system32\wifitask.exe
2018-01-08 23:42 - 2018-01-01 04:36 - 000413888 ____N (Microsoft Corporation) C:\WINDOWS\system32\AUDIOKSE.dll
2018-01-08 23:42 - 2018-01-01 04:36 - 000374032 ____N (Microsoft Corporation) C:\WINDOWS\system32\vac.exe
2018-01-08 23:42 - 2018-01-01 04:36 - 000113560 ____N (Microsoft Corporation) C:\WINDOWS\system32\icfupgd.dll
2018-01-08 23:42 - 2018-01-01 04:36 - 000057752 ____N (Microsoft Corporation) C:\WINDOWS\system32\Drivers\netbios.sys
2018-01-08 23:42 - 2018-01-01 04:35 - 000075160 ____N (Microsoft Corporation) C:\WINDOWS\system32\SecurityHealthProxyStub.dll
2018-01-08 23:42 - 2018-01-01 04:34 - 001336344 ____N (Microsoft Corporation) C:\WINDOWS\system32\ole32.dll
2018-01-08 23:42 - 2018-01-01 04:34 - 000260896 ____N (Microsoft Corporation) C:\WINDOWS\system32\mfps.dll
2018-01-08 23:42 - 2018-01-01 04:34 - 000087384 ____N (Microsoft Corporation) C:\WINDOWS\system32\remoteaudioendpoint.dll
2018-01-08 23:42 - 2018-01-01 04:33 - 002773400 ____N (Microsoft Corporation) C:\WINDOWS\system32\Drivers\tcpip.sys
2018-01-08 23:42 - 2018-01-01 04:32 - 004481240 ____N (Microsoft Corporation) C:\WINDOWS\system32\mfcore.dll
2018-01-08 23:42 - 2018-01-01 04:32 - 000617304 ____N (Microsoft Corporation) C:\WINDOWS\system32\TextInputFramework.dll
2018-01-08 23:42 - 2018-01-01 04:27 - 000713624 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\vhdmp.sys
2018-01-08 23:42 - 2018-01-01 04:27 - 000163736 ____N (Microsoft Corporation) C:\WINDOWS\system32\Drivers\wfplwfs.sys
2018-01-08 23:42 - 2018-01-01 04:26 - 000081304 ____N (Microsoft Corporation) C:\WINDOWS\system32\Drivers\vmbkmcl.sys
2018-01-08 23:42 - 2018-01-01 04:25 - 000615768 ____N (Microsoft Corporation) C:\WINDOWS\system32\services.exe
2018-01-08 23:42 - 2018-01-01 04:23 - 021352144 ____N (Microsoft Corporation) C:\WINDOWS\system32\shell32.dll
2018-01-08 23:42 - 2018-01-01 04:21 - 001103768 ____N (Microsoft Corporation) C:\WINDOWS\system32\Drivers\http.sys
2018-01-08 23:42 - 2018-01-01 04:21 - 000614296 ____N (Microsoft Corporation) C:\WINDOWS\system32\Drivers\afd.sys
2018-01-08 23:42 - 2018-01-01 04:06 - 000311192 ____N (Adobe Systems Incorporated) C:\WINDOWS\SysWOW64\atmfd.dll
2018-01-08 23:42 - 2018-01-01 04:03 - 000777904 ____N (Microsoft Corporation) C:\WINDOWS\SysWOW64\rpcrt4.dll
2018-01-08 23:42 - 2018-01-01 04:03 - 000650328 ____N (Microsoft Corporation) C:\WINDOWS\SysWOW64\fontdrvhost.exe
2018-01-08 23:42 - 2018-01-01 04:03 - 000566664 ____N (Microsoft Corporation) C:\WINDOWS\SysWOW64\CoreMessaging.dll
2018-01-08 23:42 - 2018-01-01 04:03 - 000123512 ____N (Microsoft Corporation) C:\WINDOWS\SysWOW64\sspicli.dll
2018-01-08 23:42 - 2018-01-01 03:49 - 000481464 ____N (Microsoft Corporation) C:\WINDOWS\SysWOW64\advapi32.dll
2018-01-08 23:42 - 2018-01-01 03:49 - 000258808 ____N (Microsoft Corporation) C:\WINDOWS\SysWOW64\wscapi.dll
2018-01-08 23:42 - 2018-01-01 03:46 - 003485392 ____N (Microsoft Corporation) C:\WINDOWS\SysWOW64\explorer.exe
2018-01-08 23:42 - 2018-01-01 03:46 - 000289816 ____N (Microsoft Corporation) C:\WINDOWS\SysWOW64\Windows.Storage.ApplicationData.dll
2018-01-08 23:42 - 2018-01-01 03:45 - 006092152 ____N (Microsoft Corporation) C:\WINDOWS\SysWOW64\windows.storage.dll
2018-01-08 23:42 - 2018-01-01 03:45 - 000450928 ____N (Microsoft Corporation) C:\WINDOWS\SysWOW64\WWanAPI.dll
2018-01-08 23:42 - 2018-01-01 03:43 - 020286120 ____N (Microsoft Corporation) C:\WINDOWS\SysWOW64\shell32.dll
2018-01-08 23:42 - 2018-01-01 03:42 - 001003152 ____N (Microsoft Corporation) C:\WINDOWS\SysWOW64\ole32.dll
2018-01-08 23:42 - 2018-01-01 03:42 - 000386424 ____N (Microsoft Corporation) C:\WINDOWS\SysWOW64\AUDIOKSE.dll
2018-01-08 23:42 - 2018-01-01 03:42 - 000129184 ____N (Microsoft Corporation) C:\WINDOWS\SysWOW64\mfps.dll
2018-01-08 23:42 - 2018-01-01 03:42 - 000074992 ____N (Microsoft Corporation) C:\WINDOWS\SysWOW64\remoteaudioendpoint.dll
2018-01-08 23:42 - 2018-01-01 03:37 - 025247232 ____N (Microsoft Corporation) C:\WINDOWS\system32\edgehtml.dll
2018-01-08 23:42 - 2018-01-01 03:25 - 001008640 ____N (Microsoft Corporation) C:\WINDOWS\SysWOW64\InstallService.dll
2018-01-08 23:42 - 2018-01-01 03:25 - 000475648 ____N (Microsoft Corporation) C:\WINDOWS\SysWOW64\ieui.dll
2018-01-08 23:42 - 2018-01-01 03:25 - 000097792 ____N C:\WINDOWS\system32\runexehelper.exe
2018-01-08 23:42 - 2018-01-01 03:24 - 000240640 ____N (Microsoft Corporation) C:\WINDOWS\system32\AboutSettingsHandlers.dll
2018-01-08 23:42 - 2018-01-01 03:24 - 000096256 ____N (Microsoft Corporation) C:\WINDOWS\SysWOW64\fontsub.dll
2018-01-08 23:42 - 2018-01-01 03:24 - 000038912 ____N (Adobe Systems) C:\WINDOWS\SysWOW64\atmlib.dll
2018-01-08 23:42 - 2018-01-01 03:23 - 001313792 ____N (Microsoft Corporation) C:\WINDOWS\system32\InstallService.dll
2018-01-08 23:42 - 2018-01-01 03:23 - 000561152 ____N (Microsoft Corporation) C:\WINDOWS\system32\ieui.dll
2018-01-08 23:42 - 2018-01-01 03:23 - 000385024 ____N (Microsoft Corporation) C:\WINDOWS\system32\Drivers\cldflt.sys
2018-01-08 23:42 - 2018-01-01 03:23 - 000250368 ____N (Microsoft Corporation) C:\WINDOWS\system32\AppxAllUserStore.dll
2018-01-08 23:42 - 2018-01-01 03:23 - 000232960 ____N (Microsoft Corporation) C:\WINDOWS\system32\convertvhd.exe
2018-01-08 23:42 - 2018-01-01 03:23 - 000121344 ____N (Microsoft Corporation) C:\WINDOWS\system32\fontsub.dll
2018-01-08 23:42 - 2018-01-01 03:23 - 000080384 ____N (Microsoft Corporation) C:\WINDOWS\system32\Drivers\vmbkmclr.sys
2018-01-08 23:42 - 2018-01-01 03:23 - 000047104 ____N (Adobe Systems) C:\WINDOWS\system32\atmlib.dll
2018-01-08 23:42 - 2018-01-01 03:22 - 000031744 ____N (Microsoft Corporation) C:\WINDOWS\system32\Windows.Management.Provisioning.ProxyStub.dll
2018-01-08 23:42 - 2018-01-01 03:22 - 000025600 ____N (Microsoft Corporation) C:\WINDOWS\system32\Drivers\Dumpstorport.sys
2018-01-08 23:42 - 2018-01-01 03:22 - 000017408 ____N (Microsoft Corporation) C:\WINDOWS\system32\VmApplicationHealthMonitorProxy.dll
2018-01-08 23:42 - 2018-01-01 03:21 - 000268288 ____N (Microsoft Corporation) C:\WINDOWS\SysWOW64\dxtrans.dll
2018-01-08 23:42 - 2018-01-01 03:21 - 000233984 ____N (Microsoft Corporation) C:\WINDOWS\SysWOW64\AppLockerCSP.dll
2018-01-08 23:42 - 2018-01-01 03:21 - 000133632 ____N (Microsoft Corporation) C:\WINDOWS\system32\wificonnapi.dll
2018-01-08 23:42 - 2018-01-01 03:21 - 000097280 ____N (Microsoft Corporation) C:\WINDOWS\SysWOW64\WcnApi.dll
2018-01-08 23:42 - 2018-01-01 03:21 - 000097280 ____N (Microsoft Corporation) C:\WINDOWS\system32\Drivers\raspptp.sys
2018-01-08 23:42 - 2018-01-01 03:21 - 000080896 ____N (Microsoft Corporation) C:\WINDOWS\system32\Drivers\wanarp.sys
2018-01-08 23:42 - 2018-01-01 03:21 - 000062976 ____N (Microsoft Corporation) C:\WINDOWS\system32\Drivers\ndproxy.sys
2018-01-08 23:42 - 2018-01-01 03:20 - 000524288 ____N (Microsoft Corporation) C:\WINDOWS\system32\daxexec.dll
2018-01-08 23:42 - 2018-01-01 03:20 - 000459776 ____N (Microsoft Corporation) C:\WINDOWS\SysWOW64\webplatstorageserver.dll
2018-01-08 23:42 - 2018-01-01 03:20 - 000397824 ____N (Microsoft Corporation) C:\WINDOWS\SysWOW64\dxtmsft.dll
2018-01-08 23:42 - 2018-01-01 03:20 - 000225792 ____N (Microsoft Corporation) C:\WINDOWS\system32\Drivers\winnat.sys
2018-01-08 23:42 - 2018-01-01 03:20 - 000215552 ____N (Microsoft Corporation) C:\WINDOWS\system32\fwpolicyiomgr.dll
2018-01-08 23:42 - 2018-01-01 03:20 - 000212992 ____N (Microsoft Corporation) C:\WINDOWS\system32\container.dll
2018-01-08 23:42 - 2018-01-01 03:20 - 000204288 ____N (Microsoft Corporation) C:\WINDOWS\system32\provisioningcsp.dll
2018-01-08 23:42 - 2018-01-01 03:20 - 000186368 ____N (Microsoft Corporation) C:\WINDOWS\system32\ACPBackgroundManagerPolicy.dll
2018-01-08 23:42 - 2018-01-01 03:20 - 000175616 ____N (Microsoft Corporation) C:\WINDOWS\SysWOW64\fwpolicyiomgr.dll
2018-01-08 23:42 - 2018-01-01 03:20 - 000134656 ____N (Microsoft Corporation) C:\WINDOWS\system32\WcnApi.dll
2018-01-08 23:42 - 2018-01-01 03:20 - 000133632 ____N (Microsoft Corporation) C:\WINDOWS\SysWOW64\iepeers.dll
2018-01-08 23:42 - 2018-01-01 03:20 - 000104960 ____N (Microsoft Corporation) C:\WINDOWS\system32\rasauto.dll
2018-01-08 23:42 - 2018-01-01 03:20 - 000082432 ____N (Microsoft Corporation) C:\WINDOWS\system32\SCardDlg.dll
2018-01-08 23:42 - 2018-01-01 03:20 - 000043008 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\RfxVmt.sys
2018-01-08 23:42 - 2018-01-01 03:20 - 000035328 ____N (Microsoft Corporation) C:\WINDOWS\SysWOW64\nshhttp.dll
2018-01-08 23:42 - 2018-01-01 03:19 - 008014848 ____N (Microsoft Corporation) C:\WINDOWS\system32\Windows.Data.Pdf.dll
2018-01-08 23:42 - 2018-01-01 03:19 - 000795136 ____N (Microsoft Corporation) C:\WINDOWS\system32\NaturalAuth.dll
2018-01-08 23:42 - 2018-01-01 03:19 - 000675328 ____N (Microsoft Corporation) C:\WINDOWS\system32\webplatstorageserver.dll
2018-01-08 23:42 - 2018-01-01 03:19 - 000461312 ____N (Microsoft Corporation) C:\WINDOWS\system32\wlansec.dll
2018-01-08 23:42 - 2018-01-01 03:19 - 000450048 ____N (Microsoft Corporation) C:\WINDOWS\SysWOW64\TileDataRepository.dll
2018-01-08 23:42 - 2018-01-01 03:19 - 000430080 ____N (Microsoft Corporation) C:\WINDOWS\SysWOW64\Windows.Internal.Bluetooth.dll
2018-01-08 23:42 - 2018-01-01 03:19 - 000416768 ____N (Microsoft Corporation) C:\WINDOWS\system32\html.iec
2018-01-08 23:42 - 2018-01-01 03:19 - 000366080 ____N (Microsoft Corporation) C:\WINDOWS\SysWOW64\daxexec.dll
2018-01-08 23:42 - 2018-01-01 03:19 - 000340480 ____N (Microsoft Corporation) C:\WINDOWS\SysWOW64\html.iec
2018-01-08 23:42 - 2018-01-01 03:19 - 000334848 ____N (Microsoft Corporation) C:\WINDOWS\system32\dusmsvc.dll
2018-01-08 23:42 - 2018-01-01 03:19 - 000316928 ____N (Microsoft Corporation) C:\WINDOWS\system32\Drivers\netbt.sys
2018-01-08 23:42 - 2018-01-01 03:19 - 000188416 ____N (Microsoft Corporation) C:\WINDOWS\system32\PimIndexMaintenance.dll
2018-01-08 23:42 - 2018-01-01 03:19 - 000174592 ____N (Microsoft Corporation) C:\WINDOWS\SysWOW64\P2P.dll
2018-01-08 23:42 - 2018-01-01 03:19 - 000149504 ____N (Microsoft Corporation) C:\WINDOWS\SysWOW64\container.dll
2018-01-08 23:42 - 2018-01-01 03:19 - 000142848 ____N (Microsoft Corporation) C:\WINDOWS\system32\iepeers.dll
2018-01-08 23:42 - 2018-01-01 03:19 - 000097792 ____N (Microsoft Corporation) C:\WINDOWS\SysWOW64\msoert2.dll
2018-01-08 23:42 - 2018-01-01 03:19 - 000093696 ____N (Microsoft Corporation) C:\WINDOWS\system32\mshtmled.dll
2018-01-08 23:42 - 2018-01-01 03:19 - 000079872 ____N (Microsoft Corporation) C:\WINDOWS\system32\nlaapi.dll
2018-01-08 23:42 - 2018-01-01 03:19 - 000073216 ____N (Microsoft Corporation) C:\WINDOWS\system32\provtool.exe
2018-01-08 23:42 - 2018-01-01 03:19 - 000063488 ____N (Microsoft Corporation) C:\WINDOWS\SysWOW64\nlaapi.dll
2018-01-08 23:42 - 2018-01-01 03:19 - 000043008 ____N (Microsoft Corporation) C:\WINDOWS\system32\nshhttp.dll
2018-01-08 23:42 - 2018-01-01 03:18 - 000748032 ____N (Microsoft Corporation) C:\WINDOWS\system32\PhoneProviders.dll
2018-01-08 23:42 - 2018-01-01 03:18 - 000699904 ____N (Microsoft Corporation) C:\WINDOWS\SysWOW64\CPFilters.dll
2018-01-08 23:42 - 2018-01-01 03:18 - 000588800 ____N (Microsoft Corporation) C:\WINDOWS\system32\SmsRouterSvc.dll
2018-01-08 23:42 - 2018-01-01 03:18 - 000465920 ____N (Microsoft Corporation) C:\WINDOWS\system32\wcncsvc.dll
2018-01-08 23:42 - 2018-01-01 03:18 - 000436224 ____N (Microsoft Corporation) C:\WINDOWS\system32\PsmServiceExtHost.dll
2018-01-08 23:42 - 2018-01-01 03:18 - 000432640 ____N (Microsoft Corporation) C:\WINDOWS\system32\provengine.dll
2018-01-08 23:42 - 2018-01-01 03:18 - 000431616 ____N (Microsoft Corporation) C:\WINDOWS\system32\msIso.dll
2018-01-08 23:42 - 2018-01-01 03:18 - 000427008 ____N (Microsoft Corporation) C:\WINDOWS\system32\provhandlers.dll
2018-01-08 23:42 - 2018-01-01 03:18 - 000425984 ____N (Microsoft Corporation) C:\WINDOWS\system32\vmrdvcore.dll
2018-01-08 23:42 - 2018-01-01 03:18 - 000391168 ____N (Microsoft Corporation) C:\WINDOWS\system32\iedkcs32.dll
2018-01-08 23:42 - 2018-01-01 03:18 - 000380928 ____N (Microsoft Corporation) C:\WINDOWS\SysWOW64\EncDec.dll
2018-01-08 23:42 - 2018-01-01 03:18 - 000369664 ____N (Microsoft Corporation) C:\WINDOWS\system32\APHostService.dll
2018-01-08 23:42 - 2018-01-01 03:18 - 000343040 ____N (Microsoft Corporation) C:\WINDOWS\SysWOW64\iedkcs32.dll
2018-01-08 23:42 - 2018-01-01 03:18 - 000336896 ____N (Microsoft Corporation) C:\WINDOWS\system32\AppLockerCSP.dll
2018-01-08 23:42 - 2018-01-01 03:18 - 000276480 ____N (Microsoft Corporation) C:\WINDOWS\system32\dxtrans.dll
2018-01-08 23:42 - 2018-01-01 03:18 - 000259072 ____N (Microsoft Corporation) C:\WINDOWS\system32\SCardSvr.dll
2018-01-08 23:42 - 2018-01-01 03:18 - 000210944 ____N (Microsoft Corporation) C:\WINDOWS\system32\P2P.dll
2018-01-08 23:42 - 2018-01-01 03:18 - 000144896 ____N (Microsoft Corporation) C:\WINDOWS\system32\appinfo.dll
2018-01-08 23:42 - 2018-01-01 03:18 - 000082944 ____N (Microsoft Corporation) C:\WINDOWS\system32\provdatastore.dll
2018-01-08 23:42 - 2018-01-01 03:17 - 006564864 ____N (Microsoft Corporation) C:\WINDOWS\SysWOW64\Windows.Data.Pdf.dll
2018-01-08 23:42 - 2018-01-01 03:17 - 001485312 ____N (Microsoft Corporation) C:\WINDOWS\SysWOW64\rdpserverbase.dll
2018-01-08 23:42 - 2018-01-01 03:17 - 000791552 ____N (Microsoft Corporation) C:\WINDOWS\system32\PhoneService.dll
2018-01-08 23:42 - 2018-01-01 03:17 - 000616960 ____N (Microsoft Corporation) C:\WINDOWS\system32\Windows.Internal.Bluetooth.dll
2018-01-08 23:42 - 2018-01-01 03:17 - 000594432 ____N (Microsoft Corporation) C:\WINDOWS\SysWOW64\Windows.Security.Authentication.Web.Core.dll
2018-01-08 23:42 - 2018-01-01 03:17 - 000568832 ____N (Microsoft Corporation) C:\WINDOWS\system32\TileDataRepository.dll
2018-01-08 23:42 - 2018-01-01 03:17 - 000555520 ____N (Microsoft Corporation) C:\WINDOWS\system32\SensorService.dll
2018-01-08 23:42 - 2018-01-01 03:17 - 000456704 ____N (Microsoft Corporation) C:\WINDOWS\system32\dxtmsft.dll
2018-01-08 23:42 - 2018-01-01 03:17 - 000423936 ____N (Microsoft Corporation) C:\WINDOWS\system32\p2psvc.dll
2018-01-08 23:42 - 2018-01-01 03:17 - 000341504 ____N (Microsoft Corporation) C:\WINDOWS\system32\pnrpsvc.dll
2018-01-08 23:42 - 2018-01-01 03:17 - 000228352 ____N (Microsoft Corporation) C:\WINDOWS\system32\ie4uinit.exe
2018-01-08 23:42 - 2018-01-01 03:17 - 000112640 ____N (Microsoft Corporation) C:\WINDOWS\system32\msoert2.dll
2018-01-08 23:42 - 2018-01-01 03:16 - 005833216 ____N (Microsoft Corporation) C:\WINDOWS\system32\dbgeng.dll
2018-01-08 23:42 - 2018-01-01 03:16 - 004839424 ____N (Microsoft Corporation) C:\WINDOWS\SysWOW64\dbgeng.dll
2018-01-08 23:42 - 2018-01-01 03:16 - 000966656 ____N (Microsoft Corporation) C:\WINDOWS\SysWOW64\Unistore.dll
2018-01-08 23:42 - 2018-01-01 03:16 - 000956928 ____N (Microsoft Corporation) C:\WINDOWS\SysWOW64\rdpbase.dll
2018-01-08 23:42 - 2018-01-01 03:16 - 000831488 ____N (Microsoft Corporation) C:\WINDOWS\system32\Windows.Security.Authentication.Web.Core.dll
2018-01-08 23:42 - 2018-01-01 03:16 - 000812544 ____N (Microsoft Corporation) C:\WINDOWS\system32\bisrv.dll
2018-01-08 23:42 - 2018-01-01 03:16 - 000720896 ____N (Microsoft Corporation) C:\WINDOWS\system32\LogonController.dll
2018-01-08 23:42 - 2018-01-01 03:16 - 000668160 ____N (Microsoft Corporation) C:\WINDOWS\SysWOW64\msfeeds.dll
2018-01-08 23:42 - 2018-01-01 03:16 - 000624128 ____N (Microsoft Corporation) C:\WINDOWS\system32\SyncController.dll
2018-01-08 23:42 - 2018-01-01 03:16 - 000401920 ____N (Microsoft Corporation) C:\WINDOWS\system32\ncsi.dll
2018-01-08 23:42 - 2018-01-01 03:16 - 000235008 ____N (Microsoft Corporation) C:\WINDOWS\SysWOW64\webcheck.dll
2018-01-08 23:42 - 2018-01-01 03:16 - 000086528 ____N (Microsoft Corporation) C:\WINDOWS\system32\cldapi.dll
2018-01-08 23:42 - 2018-01-01 03:16 - 000076288 ____N (Microsoft Corporation) C:\WINDOWS\SysWOW64\cldapi.dll
2018-01-08 23:42 - 2018-01-01 03:15 - 002349568 ____N (Microsoft Corporation) C:\WINDOWS\SysWOW64\InputService.dll
2018-01-08 23:42 - 2018-01-01 03:15 - 001657856 ____N (Microsoft Corporation) C:\WINDOWS\system32\rdpserverbase.dll
2018-01-08 23:42 - 2018-01-01 03:15 - 001245184 ____N (Microsoft Corporation) C:\WINDOWS\system32\Unistore.dll
2018-01-08 23:42 - 2018-01-01 03:15 - 000970240 ____N (Microsoft Corporation) C:\WINDOWS\system32\sysmain.dll
2018-01-08 23:42 - 2018-01-01 03:15 - 000951808 ____N (Microsoft Corporation) C:\WINDOWS\system32\usermgr.dll
2018-01-08 23:42 - 2018-01-01 03:15 - 000756736 ____N (Microsoft Corporation) C:\WINDOWS\system32\msfeeds.dll
2018-01-08 23:42 - 2018-01-01 03:15 - 000434176 ____N (Microsoft Corporation) C:\WINDOWS\system32\EncDec.dll
2018-01-08 23:42 - 2018-01-01 03:15 - 000366080 ____N (Microsoft Corporation) C:\WINDOWS\system32\nlasvc.dll
2018-01-08 23:42 - 2018-01-01 03:15 - 000258560 ____N (Microsoft Corporation) C:\WINDOWS\system32\webcheck.dll
2018-01-08 23:42 - 2018-01-01 03:14 - 023655936 ____N (Microsoft Corporation) C:\WINDOWS\system32\mshtml.dll
2018-01-08 23:42 - 2018-01-01 03:14 - 001495040 ____N (Microsoft Corporation) C:\WINDOWS\system32\AppXDeploymentExtensions.desktop.dll
2018-01-08 23:42 - 2018-01-01 03:14 - 001097728 ____N (Microsoft Corporation) C:\WINDOWS\system32\rdpbase.dll
2018-01-08 23:42 - 2018-01-01 03:14 - 001003008 ____N (Microsoft Corporation) C:\WINDOWS\system32\modernexecserver.dll
2018-01-08 23:42 - 2018-01-01 03:14 - 000985600 ____N (Microsoft Corporation) C:\WINDOWS\system32\inetcomm.dll
2018-01-08 23:42 - 2018-01-01 03:14 - 000917504 ____N (Microsoft Corporation) C:\WINDOWS\SysWOW64\TokenBroker.dll
2018-01-08 23:42 - 2018-01-01 03:14 - 000870912 ____N (Microsoft Corporation) C:\WINDOWS\system32\CPFilters.dll
2018-01-08 23:42 - 2018-01-01 03:13 - 013657600 ____N (Microsoft Corporation) C:\WINDOWS\system32\wmp.dll
2018-01-08 23:42 - 2018-01-01 03:13 - 003121664 ____N (Microsoft Corporation) C:\WINDOWS\system32\Microsoft.Bluetooth.Profiles.Gatt.dll
2018-01-08 23:42 - 2018-01-01 03:13 - 002013184 ____N (Microsoft Corporation) C:\WINDOWS\SysWOW64\inetcpl.cpl
2018-01-08 23:42 - 2018-01-01 03:13 - 001559552 ____N (Microsoft Corporation) C:\WINDOWS\SysWOW64\urlmon.dll
2018-01-08 23:42 - 2018-01-01 03:13 - 001474560 ____N (Microsoft Corporation) C:\WINDOWS\SysWOW64\ieapfltr.dll
2018-01-08 23:42 - 2018-01-01 03:13 - 000897024 ____N (Microsoft Corporation) C:\WINDOWS\SysWOW64\inetcomm.dll
2018-01-08 23:42 - 2018-01-01 03:12 - 002633216 ____N (Microsoft Corporation) C:\WINDOWS\system32\diagtrack.dll
2018-01-08 23:42 - 2018-01-01 03:12 - 002208768 ____N (Microsoft Corporation) C:\WINDOWS\system32\AppXDeploymentExtensions.onecore.dll
2018-01-08 23:42 - 2018-01-01 03:12 - 001573376 ____N (Microsoft Corporation) C:\WINDOWS\system32\UserDataService.dll
2018-01-08 23:42 - 2018-01-01 03:12 - 001424896 ____N (Microsoft Corporation) C:\WINDOWS\system32\wwansvc.dll
2018-01-08 23:42 - 2018-01-01 03:12 - 000760320 ____N (Microsoft Corporation) C:\WINDOWS\system32\spoolsv.exe
2018-01-08 23:42 - 2018-01-01 03:12 - 000464384 ____N (Microsoft Corporation) C:\WINDOWS\SysWOW64\Windows.UI.Core.TextInput.dll
2018-01-08 23:42 - 2018-01-01 03:11 - 003334144 ____N (Microsoft Corporation) C:\WINDOWS\system32\wininet.dll
2018-01-08 23:42 - 2018-01-01 03:11 - 003165696 ____N (Microsoft Corporation) C:\WINDOWS\system32\AppXDeploymentServer.dll
2018-01-08 23:42 - 2018-01-01 03:11 - 002859520 ____N (Microsoft Corporation) C:\WINDOWS\system32\dwmcore.dll
2018-01-08 23:42 - 2018-01-01 03:11 - 002082304 ____N (Microsoft Corporation) C:\WINDOWS\system32\inetcpl.cpl
2018-01-08 23:42 - 2018-01-01 03:11 - 001822208 ____N (Microsoft Corporation) C:\WINDOWS\system32\urlmon.dll
2018-01-08 23:42 - 2018-01-01 03:11 - 001816576 ____N (Microsoft Corporation) C:\WINDOWS\system32\wevtsvc.dll
2018-01-08 23:42 - 2018-01-01 03:11 - 001597952 ____N (Microsoft Corporation) C:\WINDOWS\system32\ieapfltr.dll
2018-01-08 23:42 - 2018-01-01 03:11 - 001343488 ____N (Microsoft Corporation) C:\WINDOWS\system32\wifinetworkmanager.dll
2018-01-08 23:42 - 2018-01-01 03:11 - 001231872 ____N (Microsoft Corporation) C:\WINDOWS\system32\TokenBroker.dll
2018-01-08 23:42 - 2018-01-01 03:11 - 000880640 ____N (Microsoft Corporation) C:\WINDOWS\system32\schedsvc.dll
2018-01-08 23:42 - 2018-01-01 03:11 - 000715776 ____N (Microsoft Corporation) C:\WINDOWS\system32\winlogon.exe
2018-01-08 23:42 - 2018-01-01 03:10 - 003126272 ____N (Microsoft Corporation) C:\WINDOWS\system32\InputService.dll
2018-01-08 23:42 - 2018-01-01 03:10 - 002528256 ____N (Microsoft Corporation) C:\WINDOWS\system32\wlansvc.dll
2018-01-08 23:42 - 2018-01-01 03:10 - 000012800 ____N (Microsoft Corporation) C:\WINDOWS\SysWOW64\wscproxystub.dll
2018-01-08 23:42 - 2018-01-01 03:09 - 000925184 ____N (Microsoft Corporation) C:\WINDOWS\system32\MPSSVC.dll
2018-01-08 23:42 - 2018-01-01 03:09 - 000666624 ____N (Microsoft Corporation) C:\WINDOWS\system32\DbgModel.dll
2018-01-08 23:42 - 2018-01-01 03:09 - 000599552 ____N (Microsoft Corporation) C:\WINDOWS\system32\Windows.UI.Core.TextInput.dll
2018-01-08 23:42 - 2018-01-01 03:08 - 000963072 ____N (Microsoft Corporation) C:\WINDOWS\system32\StorSvc.dll
2018-01-08 23:42 - 2018-01-01 03:08 - 000726016 ____N (Microsoft Corporation) C:\WINDOWS\system32\Drivers\srv2.sys
2018-01-08 23:42 - 2018-01-01 03:08 - 000505344 ____N (Microsoft Corporation) C:\WINDOWS\system32\taskcomp.dll
2018-01-08 23:42 - 2018-01-01 03:06 - 000018944 ____N (Microsoft Corporation) C:\WINDOWS\system32\wscproxystub.dll
2018-01-08 23:42 - 2018-01-01 03:05 - 002510848 ____N (Microsoft Corporation) C:\WINDOWS\system32\ResetEngine.dll
2018-01-08 23:42 - 2018-01-01 03:05 - 001160704 ____N (Microsoft Corporation) C:\WINDOWS\system32\reseteng.dll
2018-01-08 23:42 - 2018-01-01 03:05 - 000050176 ____N (Microsoft Corporation) C:\WINDOWS\system32\pcalua.exe
2017-12-22 12:02 - 2017-09-28 15:50 - 001166520 ____N (Microsoft Corporation) C:\WINDOWS\system32\PresentationNative_v0300.dll
2017-12-22 12:02 - 2017-09-28 15:50 - 000124624 ____N (Microsoft Corporation) C:\WINDOWS\system32\PresentationCFFRasterizerNative_v0300.dll
2017-12-22 12:02 - 2017-09-28 15:50 - 000035456 ____N (Microsoft Corporation) C:\WINDOWS\system32\TsWpfWrp.exe
2017-12-22 12:02 - 2017-09-22 18:19 - 000778936 ____N (Microsoft Corporation) C:\WINDOWS\SysWOW64\PresentationNative_v0300.dll
2017-12-22 12:02 - 2017-09-22 18:19 - 000103120 ____N (Microsoft Corporation) C:\WINDOWS\SysWOW64\PresentationCFFRasterizerNative_v0300.dll
2017-12-22 12:02 - 2017-09-22 18:19 - 000035456 ____N (Microsoft Corporation) C:\WINDOWS\SysWOW64\TsWpfWrp.exe

==================== One Month Modified files and folders ========

(If an entry is included in the fixlist, the file/folder will be moved.)

2018-01-18 17:23 - 2015-09-08 00:49 - 000945440 _____ C:\WINDOWS\system32\PerfStringBackup.INI
2018-01-18 16:59 - 2015-09-08 00:50 - 000000000 ____D C:\ProgramData\McAfee
2018-01-18 16:58 - 2015-09-08 00:48 - 000000000 ____D C:\ProgramData\Acer
2018-01-18 16:55 - 2015-09-08 00:48 - 000000000 ____D C:\ProgramData\OEM
2018-01-18 16:46 - 2015-11-04 15:50 - 000000000 ____D C:\Program Files (x86)\Amazon
2018-01-18 16:46 - 2015-09-08 00:48 - 000000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Acer
2018-01-18 16:43 - 2015-09-08 00:50 - 000000000 ____D C:\Program Files (x86)\McAfee
2018-01-18 16:31 - 2015-09-08 01:31 - 000000000 ___HD C:\OEM
2018-01-18 16:27 - 2015-09-08 00:46 - 000000000 __RHD C:\Users\Public\AccountPictures
2018-01-18 16:22 - 2015-07-10 03:04 - 000000000 ____D C:\WINDOWS\system32\Tasks_Migrated
2018-01-18 16:21 - 2015-11-04 15:44 - 000000000 ____D C:\WINDOWS\system32\ihvmanager
2018-01-18 16:21 - 2015-11-04 15:36 - 000000000 ____D C:\WINDOWS\LastGood.Tmp
2018-01-18 16:21 - 2015-11-04 15:02 - 000000000 ____D C:\WINDOWS\NAPP_Dism_Log
2018-01-18 16:21 - 2015-07-10 03:04 - 000000000 ___RD C:\WINDOWS\PurchaseDialog
2018-01-18 16:20 - 2015-11-04 15:56 - 000000000 ____D C:\Users\Public\Foxit Software
2018-01-18 16:20 - 2015-11-04 15:56 - 000000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Foxit PhantomPDF
2018-01-18 16:20 - 2015-11-04 15:56 - 000000000 ____D C:\Program Files (x86)\Foxit PhantomPDF
2018-01-18 16:20 - 2015-11-04 15:52 - 000000000 __HDC C:\ProgramData\{2B89F58C-32F7-46EC-A448-AECDF1F22B7B}
2018-01-18 16:20 - 2015-11-04 15:52 - 000000000 ____D C:\Program Files (x86)\Dashlane
2018-01-18 16:20 - 2015-11-04 15:49 - 000000000 ____D C:\Program Files (x86)\Windows Store Promo
2018-01-18 16:20 - 2015-11-04 15:46 - 000000000 ____D C:\Program Files\Common Files\QCA_Bluetooth
2018-01-18 16:20 - 2015-11-04 15:44 - 000000000 ____D C:\Program Files (x86)\Qualcomm Atheros
2018-01-18 16:20 - 2015-11-04 15:40 - 000000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Dolby
2018-01-18 16:20 - 2015-11-04 15:39 - 000000000 ___HD C:\Program Files (x86)\InstallShield Installation Information
2018-01-18 16:20 - 2015-11-04 15:29 - 000000000 ____D C:\ProgramData\Package Cache
2018-01-18 16:20 - 2015-11-04 15:27 - 000000000 ____D C:\Program Files (x86)\Intel
2018-01-18 16:20 - 2015-11-04 15:26 - 000000000 ___RD C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Intel
2018-01-18 16:20 - 2015-11-04 15:26 - 000000000 ____D C:\ProgramData\Intel
2018-01-18 16:20 - 2015-11-04 15:23 - 000000000 ____D C:\Program Files (x86)\Microsoft Office
2018-01-18 16:20 - 2015-09-08 00:50 - 000000000 ____D C:\Program Files\mcafee.com
2018-01-18 16:20 - 2015-09-08 00:50 - 000000000 ____D C:\Program Files\mcafee
2018-01-18 16:20 - 2015-09-08 00:50 - 000000000 ____D C:\Program Files\Common Files\McAfee
2018-01-18 16:20 - 2015-09-08 00:50 - 000000000 ____D C:\Program Files\Acer
2018-01-18 16:20 - 2015-09-08 00:50 - 000000000 ____D C:\Program Files (x86)\mcafee.com
2018-01-18 16:20 - 2015-09-08 00:49 - 000000000 ____D C:\ProgramData\Mozilla
2018-01-18 16:20 - 2015-09-08 00:49 - 000000000 ____D C:\Program Files (x86)\Mozilla Maintenance Service
2018-01-18 16:20 - 2015-09-08 00:49 - 000000000 ____D C:\Program Files (x86)\Mozilla Firefox
2018-01-18 16:20 - 2015-09-08 00:48 - 000000000 ___RD C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Games
2018-01-18 16:20 - 2015-09-08 00:48 - 000000000 ____D C:\ProgramData\WildTangent
2018-01-18 16:20 - 2015-09-08 00:48 - 000000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\AVAST Software
2018-01-18 16:20 - 2015-09-08 00:48 - 000000000 ____D C:\ProgramData\AVAST Software
2018-01-18 16:20 - 2015-09-08 00:48 - 000000000 ____D C:\Program Files\AVAST Software
2018-01-18 16:20 - 2015-09-08 00:48 - 000000000 ____D C:\Program Files (x86)\WildTangent Games
2018-01-18 16:20 - 2015-09-08 00:48 - 000000000 ____D C:\Program Files (x86)\WildGames
2018-01-18 16:20 - 2015-09-08 00:48 - 000000000 ____D C:\Program Files (x86)\Acer
2018-01-18 16:20 - 2015-09-08 00:47 - 000000000 ____D C:\ProgramData\Microsoft OneDrive
2018-01-18 16:20 - 2015-07-10 05:14 - 000000000 ____D C:\Program Files\Windows Journal
2018-01-18 16:20 - 2015-07-10 04:22 - 000000000 ____D C:\ProgramData\USOShared
2018-01-18 16:20 - 2015-07-10 03:04 - 000000000 ___RD C:\WINDOWS\DesktopTileResources
2018-01-13 02:03 - 2017-09-29 05:40 - 000067584 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\bthmodem.sys
2018-01-08 23:45 - 2017-09-29 05:41 - 000403968 ____N (Microsoft Corporation) C:\WINDOWS\system32\WpAXHolder.dll
2018-01-08 23:45 - 2017-09-29 05:41 - 000140800 ____N (Microsoft Corporation) C:\WINDOWS\system32\Chakradiag.dll
2018-01-08 23:45 - 2017-09-29 05:41 - 000106496 ____N (Microsoft Corporation) C:\WINDOWS\SysWOW64\Chakradiag.dll

==================== Bamital & volsnap ======================

(There is no automatic fix for files that do not pass verification.)

C:\WINDOWS\system32\winlogon.exe => File is digitally signed
C:\WINDOWS\system32\wininit.exe => File is digitally signed
C:\WINDOWS\explorer.exe => File is digitally signed
C:\WINDOWS\SysWOW64\explorer.exe => File is digitally signed
C:\WINDOWS\system32\svchost.exe => File is digitally signed
C:\WINDOWS\SysWOW64\svchost.exe => File is digitally signed
C:\WINDOWS\system32\services.exe => File is digitally signed
C:\WINDOWS\system32\User32.dll => File is digitally signed
C:\WINDOWS\SysWOW64\User32.dll => File is digitally signed
C:\WINDOWS\system32\userinit.exe => File is digitally signed
C:\WINDOWS\SysWOW64\userinit.exe => File is digitally signed
C:\WINDOWS\system32\rpcss.dll => File is digitally signed
C:\WINDOWS\system32\dnsapi.dll => File is digitally signed
C:\WINDOWS\SysWOW64\dnsapi.dll => File is digitally signed
C:\WINDOWS\system32\Drivers\volsnap.sys => File is digitally signed

LastRegBack: 2018-01-18 16:17

==================== End of FRST.txt ============================
Additional scan result of Farbar Recovery Scan Tool (x64) Version: 17.01.2018 01
Ran by drpmc (18-01-2018 20:52:44)
Running from C:\Users\drpmc\Downloads
Windows 10 Home Version 1709 16299.192 (X64) (2018-01-19 00:23:49)
Boot Mode: Normal
==========================================================


==================== Accounts: =============================

Administrator (S-1-5-21-703669745-1628820323-22978762-500 - Administrator - Disabled)
DefaultAccount (S-1-5-21-703669745-1628820323-22978762-503 - Limited - Disabled)
drpmc (S-1-5-21-703669745-1628820323-22978762-1001 - Administrator - Enabled) => C:\Users\drpmc
Guest (S-1-5-21-703669745-1628820323-22978762-501 - Limited - Disabled)
WDAGUtilityAccount (S-1-5-21-703669745-1628820323-22978762-504 - Limited - Disabled)

==================== Security Center ========================

(If an entry is included in the fixlist, it will be removed.)

AV: Windows Defender (Disabled - Up to date) {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
AV: Norton Internet Security (Enabled - Up to date) {30744133-1E94-7B35-F4A3-82A5AEF1CBAA}
AV: Malwarebytes (Enabled - Up to date) {23007AD3-69FE-687C-2629-D584AFFAF72B}
AV: McAfee Anti-Virus and Anti-Spyware (Enabled - Up to date) {DA9F8ED0-D0DE-39CC-F55A-51AB4CC1B556}
AS: Malwarebytes (Enabled - Up to date) {98619B37-4FC4-67F2-1C99-EEF6D47DBD96}
AS: Windows Defender (Disabled - Up to date) {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
AS: Norton Internet Security (Enabled - Up to date) {8B15A0D7-38AE-74BB-CE13-B9D7D5768117}
AS: McAfee Anti-Virus and Anti-Spyware (Enabled - Up to date) {61FE6F34-F6E4-3642-CFEA-6AD93746FFEB}
FW: McAfee Firewall (Enabled) {E2A40FF5-9AB1-3894-DE05-F89EB212F22D}
FW: Norton Internet Security (Enabled) {084FC016-54FB-7A6D-DFFC-2B9050228CD1}

==================== Installed Programs ======================

(Only the adware programs with "Hidden" flag could be added to the fixlist to unhide them. The adware programs should be uninstalled manually.)

12 Labours of Hercules III: Girl Power (HKLM-x32\...\WTA-abfc5b8b-1f09-4bed-add0-97007e04b003) (Version: 3.0.2.118 - WildTangent) Hidden
abFiles (HKLM-x32\...\{13885028-098C-4799-9B71-27DAC96502D5}) (Version: 2.03.2003 - Acer Incorporated)
abPhoto (HKLM-x32\...\{B5AD89F2-03D3-4206-8487-018298007DD0}) (Version: 4.00.2001.1 - Acer Incorporated)
Acer Audio Invert Utility (HKLM-x32\...\{11086334-4198-44C7-8C67-7B49E4AC925A}) (Version: 1.00.3002 - Acer Incorporated)
Acer Care Center (HKLM\...\{1AF41E84-3408-499A-8C93-8891F0612719}) (Version: 2.00.3005 - Acer Incorporated)
Acer Explorer Agent (HKLM\...\{4D0F42CF-1693-43D9-BDC8-19141D023EE0}) (Version: 2.00.3001 - Acer Incorporated)
Acer Portal (HKLM-x32\...\{A5AD0B17-F34D-49BE-A157-C8B3D52ACD13}) (Version: 3.12.2006 - Acer Incorporated)
Acer Power Management (HKLM\...\{91F52DE4-B789-42B0-9311-A349F10E5479}) (Version: 7.00.8109 - Acer Incorporated)
Acer Quick Access (HKLM\...\{E3678E72-78E3-4F91-A9FB-913876FF6DA2}) (Version: 2.00.3008 - Acer Incorporated)
Acer UEIP Framework (HKLM\...\{12A718F2-2357-4D41-9E1F-18583A4745F7}) (Version: 2.01.3002 - Acer Incorporated)
AOP Framework (HKLM-x32\...\{4A37A114-702F-4055-A4B6-16571D4A5353}) (Version: 3.25.2001.0 - Acer Incorporated)
Avast SecureLine (HKLM\...\{2CD3C92F-EDC5-4B02-9B0A-9C1D37C58EF5}_is1) (Version: 1.0.239.4 - AVAST Software)
Bonjour (HKLM\...\{B91110FB-33B4-468B-90C2-4D5E8AE3FAE1}) (Version: 2.0.2.0 - Apple Inc.)
Dashlane Upgrade Service (HKLM-x32\...\Dashlane Upgrade Service) (Version: 1.0.13.0 - Dashlane SAS)
Dolby Audio X2 Windows API SDK (HKLM\...\{6A478BF2-F67F-4ABC-A7F1-B6B5BA862371}) (Version: 0.5.2.33 - Dolby Laboratories, Inc.)
Dolby Audio X2 Windows APP (HKLM\...\{7DA57EF8-9D20-4126-AF15-D0CC97D0C017}) (Version: 0.5.2.30 - Dolby Laboratories, Inc.)
eBay Worldwide (HKLM-x32\...\{3DC26EA7-03E3-4353-9424-EEB7A34A7504}) (Version: 2.5.0427 - OEM)
Foxit PhantomPDF (HKLM-x32\...\{A4023BDF-82D5-412D-9D58-8C2819EBFE2E}) (Version: 7.0.410.326 - Foxit Software Inc.)
Game Explorer Categories - genres (HKLM-x32\...\WildTangentGameProvider-acer-genres) (Version: 13.0.0.6 - WildTangent, Inc.)
Game Explorer Categories - main (HKLM-x32\...\WildTangentGameProvider-acer-main) (Version: 13.0.0.6 - WildTangent, Inc.)
Google Chrome (HKLM-x32\...\Google Chrome) (Version: 63.0.3239.132 - Google Inc.)
Google Update Helper (HKLM-x32\...\{60EC980A-BDA2-4CB6-A427-B07A5498B4CA}) (Version: 1.3.33.7 - Google Inc.) Hidden
Home Makeover (HKLM-x32\...\WTA-f3f31ee5-d658-45ea-9d90-3a307a2fa4b4) (Version: 3.0.2.59 - WildTangent) Hidden
Intel® Chipset Device Software (HKLM-x32\...\{60c073df-e736-4210-9c3a-5fc2b651cef3}) (Version: 10.1.1.7 - Intel® Corporation) Hidden
Intel® Management Engine Components (HKLM\...\{1CEAC85D-2590-4760-800F-8DE5E91F3700}) (Version: 11.0.0.1162 - Intel Corporation)
Intel® Processor Graphics (HKLM-x32\...\{F0E3AD40-2BBD-4360-9C76-B9AC9A5886EA}) (Version: 20.19.15.4300 - Intel Corporation)
Intel® Rapid Storage Technology (HKLM\...\{409CB30E-E457-4008-9B1A-ED1B9EA21140}) (Version: 14.6.0.1029 - Intel Corporation)
Intel® Serial IO (HKLM\...\{9FD91C5C-44AE-4D9D-85BE-AE52816B0294}) (Version: 30.100.1519.7 - Intel Corporation)
Intel® Virtual Buttons (HKLM-x32\...\1992736F-C90A-481C-B21B-EE34CAD07387) (Version: 1.1.0.21 - Intel Corporation)
Intel® Security Assist (HKLM-x32\...\{4B230374-6475-4A73-BA6E-41015E9C5013}) (Version: 1.0.0.532 - Intel Corporation)
Jewel Match 3 (HKLM-x32\...\WTA-05ef033f-3fc6-410a-8299-fef37160d456) (Version: 2.2.0.97 - WildTangent) Hidden
Jewel Match Snowscapes (HKLM-x32\...\WTA-8ebc43e2-f1a6-4e36-a974-985be9e27776) (Version: 3.0.2.118 - WildTangent) Hidden
Magic Academy (HKLM-x32\...\WTA-7ad3d7b6-dfc7-434d-881a-0790a6acd6b1) (Version: 2.2.0.97 - WildTangent) Hidden
Malwarebytes version 3.3.1.2183 (HKLM\...\{35065F43-4BB2-439A-BFF7-0F1014F2E0CD}_is1) (Version: 3.3.1.2183 - Malwarebytes)
McAfee LiveSafe – Internet Security (HKLM-x32\...\MSC) (Version: 14.0.1122 - McAfee, Inc.)
Microsoft Office (HKLM-x32\...\{90150000-0138-0409-0000-0000000FF1CE}) (Version: 15.0.4693.1005 - Microsoft Corporation)
Microsoft OneDrive (HKU\S-1-5-21-703669745-1628820323-22978762-1001\...\OneDriveSetup.exe) (Version: 17.3.7131.1115 - Microsoft Corporation)
Microsoft Visual C++ 2010 x64 Redistributable - 10.0.30319 (HKLM\...\{DA5E371C-6333-3D8A-93A4-6FD5B20BCC6E}) (Version: 10.0.30319 - Microsoft Corporation)
Microsoft Visual C++ 2010 x86 Redistributable - 10.0.30319 (HKLM-x32\...\{196BB40D-1578-3D01-B289-BEFC77A11A1E}) (Version: 10.0.30319 - Microsoft Corporation)
Mozilla Firefox 38.0.1 (x86 en-US) (HKLM-x32\...\Mozilla Firefox 38.0.1 (x86 en-US)) (Version: 38.0.1 - Mozilla)
Mozilla Maintenance Service (HKLM-x32\...\MozillaMaintenanceService) (Version: 38.0.1 - Mozilla)
Norton Internet Security (HKLM-x32\...\NIS) (Version: 22.11.2.7 - Symantec Corporation)
Polar Bowler 1st Frame (HKLM-x32\...\WTA-63754197-a389-4dc3-8095-cb833fbaa6dc) (Version: 3.0.2.59 - WildTangent) Hidden
Qualcomm Atheros 11ac Wireless LAN&Bluetooth Installer (HKLM-x32\...\{3241744A-BA36-41F0-B4AA-EF3946D00632}) (Version: 11.0.0.0097 - Qualcomm Atheros)
Realtek Card Reader (HKLM-x32\...\{5BC2B5AB-80DE-4E83-B8CF-426902051D0A}) (Version: 10.0.10586.31225 - Realtek Semiconductor Corp.)
Realtek High Definition Audio Driver (HKLM-x32\...\{F132AF7F-7BCA-4EDE-8A7C-958108FE7DBC}) (Version: 6.0.1.7628 - Realtek Semiconductor Corp.)
Rory's Restaurant (HKLM-x32\...\WTA-4f5f0a40-e305-4e37-a21f-57e89c5d404c) (Version: 3.0.2.126 - WildTangent) Hidden
Runefall (HKLM-x32\...\WTA-976cd8b2-747a-4fd0-b2c7-8db3d48b1473) (Version: 3.0.2.126 - WildTangent) Hidden
Update Installer for WildTangent Games App (HKLM-x32\...\{2FA94A64-C84E-49d1-97DD-7BF06C7BBFB2}.WildTangent Games App) (Version: - WildTangent) Hidden
Vegas World (HKLM-x32\...\WildTangentGDF-acer-vegasworld) (Version: 13.0.0.6 - WildTangent) Hidden
Villagers and Heroes (HKLM-x32\...\WildTangentGDF-acer-villagersandheroes) (Version: 13.0.0.6 - WildTangent) Hidden
WildTangent Games (HKLM-x32\...\WildTangent wildgames Master Uninstall) (Version: 1.0.4.0 - WildTangent)
WildTangent Games App (HKLM-x32\...\{70B446D1-E03B-4ab0-9B3C-0832142C9AA8}.WildTangent Games App-acer) (Version: 4.0.11.16 - WildTangent) Hidden
Windows Store Gift Card Promo (HKLM-x32\...\{FF74AA30-FF56-4197-8B64-5D63F367BC02}) (Version: 1.0.0.1 - Microsoft Corporation)

==================== Custom CLSID (Whitelisted): ==========================

(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)

ShellIconOverlayIdentifiers: [ OverlayExcluded] -> {4433A54A-1AC8-432F-90FC-85F045CF383C} => C:\Program Files\Norton Internet Security\Engine\22.11.2.7\buShell.dll [2017-11-10] (Symantec Corporation)
ShellIconOverlayIdentifiers: [ OverlayPending] -> {F17C0B1E-EF8E-4AD4-8E1B-7D7E8CB23225} => C:\Program Files\Norton Internet Security\Engine\22.11.2.7\buShell.dll [2017-11-10] (Symantec Corporation)
ShellIconOverlayIdentifiers: [ OverlayProtected] -> {476D0EA3-80F9-48B5-B70B-05E677C9C148} => C:\Program Files\Norton Internet Security\Engine\22.11.2.7\buShell.dll [2017-11-10] (Symantec Corporation)
ShellIconOverlayIdentifiers: [ ACloudSynced] -> {5CCE71FA-9F61-4F24-9CD1-98D819B40D68} => C:\Program Files (x86)\Acer\shellext\x64\shellext_win.dll [2015-05-05] (Acer Incorporated)
ShellIconOverlayIdentifiers: [ ACloudSyncing] -> {C1E1456F-C2D8-4C96-870D-35F1E13941EE} => C:\Program Files (x86)\Acer\shellext\x64\shellext_win.dll [2015-05-05] (Acer Incorporated)
ShellIconOverlayIdentifiers: [ ACloudToBeSynced] -> {307523FA-DDC0-4068-983F-2A6B34627744} => C:\Program Files (x86)\Acer\shellext\x64\shellext_win.dll [2015-05-05] (Acer Incorporated)
ShellIconOverlayIdentifiers-x32: [ OverlayExcluded] -> {4433A54A-1AC8-432F-90FC-85F045CF383C} => C:\Program Files\Norton Internet Security\Engine\22.11.2.7\buShell.dll [2017-11-10] (Symantec Corporation)
ShellIconOverlayIdentifiers-x32: [ OverlayPending] -> {F17C0B1E-EF8E-4AD4-8E1B-7D7E8CB23225} => C:\Program Files\Norton Internet Security\Engine\22.11.2.7\buShell.dll [2017-11-10] (Symantec Corporation)
ShellIconOverlayIdentifiers-x32: [ OverlayProtected] -> {476D0EA3-80F9-48B5-B70B-05E677C9C148} => C:\Program Files\Norton Internet Security\Engine\22.11.2.7\buShell.dll [2017-11-10] (Symantec Corporation)
ContextMenuHandlers1: [BUContextMenu] -> {F7CAA2A1-67A2-44BB-B20F-202FD8EB1DAB} => C:\Program Files\Norton Internet Security\Engine\22.11.2.7\buShell.dll [2017-11-10] (Symantec Corporation)
ContextMenuHandlers1: [Foxit_ConvertToPDF] -> {C5269811-4A29-4818-A4BB-111F9FC63A5F} => C:\Program Files (x86)\Foxit PhantomPDF\plugins\ConvertToPDFShellExtension_x64.dll [2015-01-27] (Foxit Software Inc.)
ContextMenuHandlers1: [McCtxMenuFrmWrk] -> {CCA9EFD3-29ED-430A-BA6D-E6BBFF0A60C2} => c:\Program Files\mcafee\msc\McCtxMenuFrmWrk.dll [2015-07-16] (McAfee, Inc.)
ContextMenuHandlers1: [Symantec.Norton.Antivirus.IEContextMenu] -> {FAD61B3D-699D-49B2-BE16-7F82CB4C59CA} => C:\Program Files\Norton Internet Security\Engine\22.11.2.7\NavShExt.dll [2017-11-10] (Symantec Corporation)
ContextMenuHandlers2: [Symantec.Norton.Antivirus.IEContextMenu] -> {FAD61B3D-699D-49B2-BE16-7F82CB4C59CA} => C:\Program Files\Norton Internet Security\Engine\22.11.2.7\NavShExt.dll [2017-11-10] (Symantec Corporation)
ContextMenuHandlers3: [MBAMShlExt] -> {57CE581A-0CB6-4266-9CA0-19364C90A0B3} => C:\Program Files\Malwarebytes\Anti-Malware\mbshlext.dll [2017-11-01] (Malwarebytes)
ContextMenuHandlers5: [igfxcui] -> {3AB1675A-CCFF-11D2-8B20-00A0C93CB1F4} => -> No File
ContextMenuHandlers5: [igfxDTCM] -> {9B5F5829-A529-4B12-814A-E81BCB8D93FC} => C:\WINDOWS\system32\igfxDTCM.dll [2016-05-19] (Intel Corporation)
ContextMenuHandlers6: [BUContextMenu] -> {F7CAA2A1-67A2-44BB-B20F-202FD8EB1DAB} => C:\Program Files\Norton Internet Security\Engine\22.11.2.7\buShell.dll [2017-11-10] (Symantec Corporation)
ContextMenuHandlers6: [MBAMShlExt] -> {57CE581A-0CB6-4266-9CA0-19364C90A0B3} => C:\Program Files\Malwarebytes\Anti-Malware\mbshlext.dll [2017-11-01] (Malwarebytes)
ContextMenuHandlers6: [McCtxMenuFrmWrk] -> {CCA9EFD3-29ED-430A-BA6D-E6BBFF0A60C2} => c:\Program Files\mcafee\msc\McCtxMenuFrmWrk.dll [2015-07-16] (McAfee, Inc.)
ContextMenuHandlers6: [Symantec.Norton.Antivirus.IEContextMenu] -> {FAD61B3D-699D-49B2-BE16-7F82CB4C59CA} => C:\Program Files\Norton Internet Security\Engine\22.11.2.7\NavShExt.dll [2017-11-10] (Symantec Corporation)

==================== Scheduled Tasks (Whitelisted) =============

(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)

Task: {56B5C8E6-9EA7-4311-B29D-7BB2F029345C} - System32\Tasks\Remediation\AntimalwareMigrationTask => C:\Program Files\Common Files\AV\Norton Internet Security\Upgrade.exe [2017-11-10] (Symantec Corporation)
Task: {597346AE-17A2-4C9C-BD9C-59DA53D99053} - System32\Tasks\Power Management => C:\Program Files\Acer\Acer Power Management\ePowerTrayLauncher.exe [2015-05-14] (Acer Incorporated)
Task: {629DB1B0-7855-4527-A528-05A1471390C3} - System32\Tasks\WindowsStoreGiftCardPromoBackgroundTaskX86 => C:\Program Files (x86)\Windows Store Promo\wsgcpromoback.exe [2015-07-15] (Microsoft Corporation)
Task: {6A4BB78F-1BD1-4BF8-A450-6477BBE992F5} - System32\Tasks\FUBTrackingByPLD => C:\OEM\Preload\FubTracking\FubTracking.exe [2015-05-13] ()
Task: {731DE8BC-997E-4BEE-8BC4-2835DAD9943C} - System32\Tasks\Microsoft\Office\Microsoft Office Touchless Attach Notification => C:\Program Files (x86)\Microsoft Office\Office15\FirstRun.exe [2015-03-14] (Microsoft Corporation)
Task: {7EA16EEF-1494-41F3-AF70-EE2BAF285CB8} - System32\Tasks\GoogleUpdateTaskMachineCore => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe [2018-01-18] (Google Inc.)
Task: {93CD5FEC-8FFF-445A-B88F-BA308679D51B} - System32\Tasks\Norton Internet Security\Norton Internet Security Error Processor => C:\Program Files\Norton Internet Security\Engine\22.11.2.7\SymErr.exe [2017-11-10] (Symantec Corporation)
Task: {9C5EC263-076B-490F-999F-F138962922F2} - System32\Tasks\GoogleUpdateTaskMachineUA => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe [2018-01-18] (Google Inc.)
Task: {A1E7F2F0-A78D-4827-AD21-C8593C1D3B36} - System32\Tasks\Avast SecureLine => C:\Program Files\AVAST Software\SecureLine\SecureLine.exe [2018-01-18] (AVAST Software)
Task: {AC7B2403-B317-49E8-97A8-82C2B3544FAC} - System32\Tasks\ACCBackgroundApplication => C:\Program Files (x86)\Acer\Care Center\ACCStd.exe [2015-07-10] ()
Task: {B144931B-0702-429D-9715-A4BA0A7D6008} - System32\Tasks\Software Update Application => C:\ProgramData\OEM\UpgradeTool\ListCheck.exe [2015-09-04] (Acer Incorporated)
Task: {C0399E3E-80C6-47DB-8688-27127DA521F4} - System32\Tasks\Audio Invert Utility => C:\Program Files (x86)\Acer\Acer Audio Invert Utility\Launcher.exe [2014-12-29] (Acer Incorporated)
Task: {C151CD63-E8B2-4414-AF95-944ACA2ADEB3} - System32\Tasks\Norton WSC Integration => C:\Program Files\Norton Internet Security\Engine\22.11.2.7\WSCStub.exe [2017-11-10] (Symantec Corporation)
Task: {C2CAA1B6-9C74-49B7-893D-0B7598BC1037} - System32\Tasks\BacKGroundAgent => C:\Program Files (x86)\Acer\AOP Framework\BackgroundAgent.exe [2017-03-20] (Acer Incorporated)
Task: {C88E24B6-D671-403E-8914-7DCD4B055351} - System32\Tasks\ACCAgent => C:\Program Files (x86)\Acer\Care Center\LiveUpdateAgent.exe [2015-07-10] ()
Task: {C9019E08-21F1-43D7-BF44-3CA221F11EA8} - System32\Tasks\Norton Internet Security\Norton Internet Security Error Analyzer => C:\Program Files\Norton Internet Security\Engine\22.11.2.7\SymErr.exe [2017-11-10] (Symantec Corporation)
Task: {CA59D5F5-1552-4D88-9247-0604C66BF9C5} - System32\Tasks\UbtFrameworkService => C:\Program Files\Acer\User Experience Improvement Program\Framework\TriggerFramework.exe [2014-03-12] (TODO: <Company name>)
Task: {D6CADD1F-A614-4869-9E62-3D1541A047E7} - System32\Tasks\avast! SL Update => C:\Program Files\AVAST Software\SecureLine\SLUpdate.exe [2018-01-18] (AVAST Software)
Task: {E0616173-AD7F-4EF0-9DF8-969B96A9D52C} - System32\Tasks\ACC => C:\Program Files (x86)\Acer\Care Center\LiveUpdateChecker.exe [2015-07-10] ()
Task: {E1C04D7F-899E-4952-9457-F632A87E42F0} - System32\Tasks\Norton Internet Security\Norton Internet Security Autofix => C:\Program Files\Norton Internet Security\Engine\22.11.2.7\SymErr.exe [2017-11-10] (Symantec Corporation)
Task: {ED1AD678-37C2-40AD-8354-757FD4318DFF} - System32\Tasks\AcerCloud => C:\Program Files (x86)\Acer\Acer Portal\AcerPortal.exe [2017-10-02] (Acer)
Task: {FC6923A0-972E-4735-A107-0FACB324C04D} - System32\Tasks\Quick Access => C:\Program Files\Acer\Acer Quick Access\QALauncher.exe [2015-09-04] (Acer Incorporated)

(If an entry is included in the fixlist, the task (.job) file will be moved. The file which is running by the task will not be moved.)


==================== Shortcuts & WMI ========================

(The entries could be listed to be restored or removed.)


==================== Loaded Modules (Whitelisted) ==============

2017-09-29 05:41 - 2017-09-29 05:41 - 000184432 ____N () C:\WINDOWS\SYSTEM32\inputhost.dll
2015-09-22 09:17 - 2015-09-22 09:17 - 005570064 _____ () C:\WINDOWS\system32\IntelSSTAPO\ParameterService\libxml2-2.dll
2016-05-19 20:37 - 2016-05-19 20:37 - 000410600 _____ () C:\WINDOWS\system32\igfxTray.exe
2017-12-13 17:33 - 2017-12-13 17:33 - 011044864 ____N () C:\Windows\SystemApps\Microsoft.Windows.Cortana_cw5n1h2txyewy\CortanaApi.dll
2017-12-13 17:33 - 2017-12-13 17:33 - 001804288 ____N () C:\Windows\SystemApps\Microsoft.Windows.Cortana_cw5n1h2txyewy\Cortana.Core.dll
2015-09-22 20:37 - 2015-09-22 20:37 - 000176640 _____ () C:\Program Files\Dolby\Dolby DAX2\DAX2_API\DolbyDAX2API.exe
2018-01-18 16:33 - 2017-11-29 09:11 - 002358728 _____ () C:\PROGRAM FILES\MALWAREBYTES\ANTI-MALWARE\MwacLib.dll
2018-01-18 16:33 - 2017-11-29 09:11 - 002301384 _____ () C:\PROGRAM FILES\MALWAREBYTES\ANTI-MALWARE\SelfProtectionSdk.dll
2018-01-18 16:27 - 2018-01-18 16:28 - 000592392 _____ () C:\Program Files\AVAST Software\SecureLine\VpnSvc.exe
2015-09-22 20:40 - 2015-09-22 20:40 - 000628736 _____ () C:\Program Files\Dolby\Dolby DAX2\DAX2_APP\DolbyDAX2TrayIcon.exe
2015-07-10 02:38 - 2015-07-10 02:38 - 004580704 _____ () C:\Program Files (x86)\Acer\Care Center\ACCStd.exe
2018-01-18 17:46 - 2018-01-18 17:47 - 004698840 _____ () C:\Program Files\WindowsApps\Microsoft.WindowsStore_11712.1001.11.0_x64__8wekyb3d8bbwe\Microsoft.UI.Xaml.dll
2018-01-18 17:49 - 2018-01-18 17:49 - 000086528 _____ () C:\Program Files\WindowsApps\Microsoft.SkypeApp_12.13.274.0_x64__kzf8qxf38zg5c\SkypeHost.exe
2018-01-18 17:49 - 2018-01-18 17:49 - 000195072 _____ () C:\Program Files\WindowsApps\Microsoft.SkypeApp_12.13.274.0_x64__kzf8qxf38zg5c\SkypeBackgroundTasks.dll
2018-01-18 17:49 - 2018-01-18 17:49 - 024677376 _____ () C:\Program Files\WindowsApps\Microsoft.SkypeApp_12.13.274.0_x64__kzf8qxf38zg5c\SkyWrap.dll
2018-01-18 17:49 - 2018-01-18 17:49 - 002550272 _____ () C:\Program Files\WindowsApps\Microsoft.SkypeApp_12.13.274.0_x64__kzf8qxf38zg5c\skypert.dll
2018-01-18 17:49 - 2018-01-18 17:49 - 000667648 _____ () C:\Program Files\WindowsApps\Microsoft.SkypeApp_12.13.274.0_x64__kzf8qxf38zg5c\RtmMvrUap.dll
2018-01-18 16:30 - 2018-01-03 01:20 - 004063064 _____ () C:\Program Files (x86)\Google\Chrome\Application\63.0.3239.132\libglesv2.dll
2018-01-18 16:30 - 2018-01-03 01:20 - 000099672 _____ () C:\Program Files (x86)\Google\Chrome\Application\63.0.3239.132\libegl.dll
2018-01-18 16:30 - 2018-01-18 16:30 - 000102088 _____ () C:\Users\drpmc\AppData\Local\Microsoft\OneDrive\17.3.7131.1115\UpdateRingSettings.dll
2017-09-22 15:14 - 2017-09-22 15:14 - 000202528 _____ () C:\Program Files (x86)\Acer\abPhoto\curllib.dll
2017-09-22 15:17 - 2017-09-22 15:17 - 000654072 _____ () C:\Program Files (x86)\Acer\abPhoto\sqlite3.dll
2017-09-22 15:17 - 2017-09-22 15:17 - 000641312 _____ () C:\Program Files (x86)\Acer\abPhoto\tag.dll
2017-09-22 15:16 - 2017-09-22 15:16 - 000119072 _____ () C:\Program Files (x86)\Acer\abPhoto\OpenLDAP.dll
2018-01-18 16:31 - 2018-01-18 16:31 - 000015064 _____ () C:\WINDOWS\assembly\GAC_MSIL\MyService\1.0.0.1__2dfa3f50f0bed57d\MyService.dll
2017-03-20 14:24 - 2017-03-20 14:24 - 000013016 _____ () C:\Program Files (x86)\Acer\AOP Framework\ServiceInterface.dll
2017-03-20 14:21 - 2017-03-20 14:21 - 000277856 _____ () C:\Program Files (x86)\Acer\AOP Framework\libcurl.dll
2018-01-18 16:28 - 2018-01-18 16:28 - 038907672 _____ () C:\Program Files\AVAST Software\SecureLine\libcef.dll
2017-10-02 14:56 - 2017-10-02 14:56 - 000202456 _____ () C:\Program Files (x86)\Acer\Acer Portal\curllib.dll
2017-10-02 14:56 - 2017-10-02 14:56 - 000119000 _____ () C:\Program Files (x86)\Acer\Acer Portal\OpenLDAP.dll
2015-08-07 01:09 - 2015-08-07 01:09 - 001243936 _____ () C:\Program Files (x86)\Intel\Intel® Management Engine Components\LMS\ACE.dll

==================== Alternate Data Streams (Whitelisted) =========

==================== Safe Mode (Whitelisted) ===================

(If an entry is included in the fixlist, it will be removed from the registry. The "AlternateShell" will be restored.)

HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\MBAMService => ""="Service"
HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\MCODS => ""="Service"
HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\mcpltsvc => ""="Service"
HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\MBAMService => ""="Service"
HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\McMPFSvc => ""="Service"
HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\MCODS => ""="Service"
HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\mcpltsvc => ""="Service"

==================== Association (Whitelisted) ===============

(If an entry is included in the fixlist, the registry item will be restored to default or removed.)


==================== Internet Explorer trusted/restricted ===============

(If an entry is included in the fixlist, it will be removed from the registry.)


==================== Hosts content: ===============================

(If needed Hosts: directive could be included in the fixlist to reset Hosts.)

2015-07-10 03:04 - 2015-07-10 03:02 - 000000824 _____ C:\WINDOWS\system32\Drivers\etc\hosts


==================== Other Areas ============================

(Currently there is no automatic fix for this section.)

HKU\S-1-5-21-703669745-1628820323-22978762-1001\Control Panel\Desktop\\Wallpaper -> C:\Users\drpmc\AppData\Local\Microsoft\Windows\Themes\RoamedThemeFiles\DesktopBackground\img13.jpg
DNS Servers: 75.75.75.75 - 75.75.76.76
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System => (ConsentPromptBehaviorAdmin: 5) (ConsentPromptBehaviorUser: 3) (EnableLUA: 1)
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer => (SmartScreenEnabled: )
Windows Firewall is enabled.

==================== MSCONFIG/TASK MANAGER disabled items ==


==================== FirewallRules (Whitelisted) ===============

(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)

FirewallRules: [{35DB134B-8D44-4415-A141-53523DF731A8}] => (Allow) C:\Program Files (x86)\Acer\abPhoto\WindowsUpnp.exe
FirewallRules: [{E298802C-9FD8-47F3-B013-294314EFDB2F}] => (Allow) C:\Program Files (x86)\Acer\abPhoto\WindowsUpnp.exe
FirewallRules: [{7D2D63CC-D5DE-4936-A160-0F1C68A9AE16}] => (Allow) C:\Program Files (x86)\Acer\abPhoto\DMCDaemon.exe
FirewallRules: [{AEAFCC99-AD7F-4BB8-AA5F-012EE8CEEFFC}] => (Allow) C:\Program Files (x86)\Acer\abPhoto\DMCDaemon.exe
FirewallRules: [{7DC4B2BF-3D2A-4C5D-AE4F-AF85CCEEC13C}] => (Allow) C:\Program Files (x86)\Acer\AOP Framework\acer\ccd.exe
FirewallRules: [{3C08743C-B168-4536-987B-0323C0791260}] => (Allow) C:\Program Files (x86)\Acer\AOP Framework\acer\ccd.exe
FirewallRules: [{32E40FA6-514A-4B5B-A1B0-3B3D80AC6884}] => (Allow) C:\Program Files\Common Files\McAfee\Platform\McSvcHost\McSvHost.exe
FirewallRules: [{E0DB4407-DACE-4D7D-8355-F125186B8FF8}] => (Allow) C:\Program Files (x86)\Mozilla Firefox\firefox.exe
FirewallRules: [{A6C68F37-DCA7-456F-9D94-AD18E4CB520E}] => (Allow) C:\Program Files (x86)\Mozilla Firefox\firefox.exe
FirewallRules: [{026476D0-A723-4B9B-A394-2D49D3CD56CF}] => (Allow) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
FirewallRules: [{5585A92B-1000-4168-946B-7B725ACAEA69}] => (Allow) C:\Program Files (x86)\Bonjour\mDNSResponder.exe
FirewallRules: [{0737B935-6406-441F-B1F2-F9DEADDAC1F2}] => (Allow) C:\Program Files (x86)\Bonjour\mDNSResponder.exe

==================== Restore Points =========================


==================== Faulty Device Manager Devices =============


==================== Event log errors: =========================

Application errors:
==================
Error: (01/18/2018 08:52:51 PM) (Source: Bonjour Service) (EventID: 100) (User: )
Description: GetLargeResourceRecord: opt 65001 optlen 5 wrong

Error: (01/18/2018 08:52:50 PM) (Source: Bonjour Service) (EventID: 100) (User: )
Description: GetLargeResourceRecord: opt 65001 optlen 5 wrong

Error: (01/18/2018 08:52:45 PM) (Source: Bonjour Service) (EventID: 100) (User: )
Description: GetLargeResourceRecord: opt 65001 optlen 5 wrong

Error: (01/18/2018 08:52:42 PM) (Source: Bonjour Service) (EventID: 100) (User: )
Description: GetLargeResourceRecord: opt 65001 optlen 5 wrong

Error: (01/18/2018 08:52:41 PM) (Source: Bonjour Service) (EventID: 100) (User: )
Description: GetLargeResourceRecord: opt 65001 optlen 5 wrong

Error: (01/18/2018 08:49:46 PM) (Source: Bonjour Service) (EventID: 100) (User: )
Description: GetLargeResourceRecord: opt 65001 optlen 5 wrong

Error: (01/18/2018 08:49:37 PM) (Source: Bonjour Service) (EventID: 100) (User: )
Description: GetLargeResourceRecord: opt 65001 optlen 5 wrong

Error: (01/18/2018 08:49:34 PM) (Source: Bonjour Service) (EventID: 100) (User: )
Description: GetLargeResourceRecord: opt 65001 optlen 5 wrong

Error: (01/18/2018 08:49:33 PM) (Source: Bonjour Service) (EventID: 100) (User: )
Description: GetLargeResourceRecord: opt 65001 optlen 5 wrong

Error: (01/18/2018 08:48:54 PM) (Source: Bonjour Service) (EventID: 100) (User: )
Description: GetLargeResourceRecord: opt 65001 optlen 5 wrong


System errors:
=============
Error: (01/18/2018 07:45:56 PM) (Source: DCOM) (EventID: 10016) (User: DESKTOP-N7204RC)
Description: The application-specific permission settings do not grant Local Activation permission for the COM Server application with CLSID
{D63B10C5-BB46-4990-A94F-E40B9D520160}
and APPID
{9CA88EE3-ACB7-47C8-AFC4-AB702511C276}
to the user DESKTOP-N7204RC\drpmc SID (S-1-5-21-703669745-1628820323-22978762-1001) from address LocalHost (Using LRPC) running in the application container Unavailable SID (Unavailable). This security permission can be modified using the Component Services administrative tool.

Error: (01/18/2018 05:47:50 PM) (Source: DCOM) (EventID: 10016) (User: NT AUTHORITY)
Description: The application-specific permission settings do not grant Local Activation permission for the COM Server application with CLSID
{D63B10C5-BB46-4990-A94F-E40B9D520160}
and APPID
{9CA88EE3-ACB7-47C8-AFC4-AB702511C276}
to the user NT AUTHORITY\LOCAL SERVICE SID (S-1-5-19) from address LocalHost (Using LRPC) running in the application container Unavailable SID (Unavailable). This security permission can be modified using the Component Services administrative tool.

Error: (01/18/2018 05:32:02 PM) (Source: DCOM) (EventID: 10016) (User: NT AUTHORITY)
Description: The application-specific permission settings do not grant Local Activation permission for the COM Server application with CLSID
{D63B10C5-BB46-4990-A94F-E40B9D520160}
and APPID
{9CA88EE3-ACB7-47C8-AFC4-AB702511C276}
to the user NT AUTHORITY\LOCAL SERVICE SID (S-1-5-19) from address LocalHost (Using LRPC) running in the application container Unavailable SID (Unavailable). This security permission can be modified using the Component Services administrative tool.

Error: (01/18/2018 05:26:58 PM) (Source: DCOM) (EventID: 10016) (User: NT AUTHORITY)
Description: The application-specific permission settings do not grant Local Activation permission for the COM Server application with CLSID
{D63B10C5-BB46-4990-A94F-E40B9D520160}
and APPID
{9CA88EE3-ACB7-47C8-AFC4-AB702511C276}
to the user NT AUTHORITY\LOCAL SERVICE SID (S-1-5-19) from address LocalHost (Using LRPC) running in the application container Unavailable SID (Unavailable). This security permission can be modified using the Component Services administrative tool.

Error: (01/18/2018 05:17:17 PM) (Source: DCOM) (EventID: 10016) (User: DESKTOP-N7204RC)
Description: The application-specific permission settings do not grant Local Activation permission for the COM Server application with CLSID
{D63B10C5-BB46-4990-A94F-E40B9D520160}
and APPID
{9CA88EE3-ACB7-47C8-AFC4-AB702511C276}
to the user DESKTOP-N7204RC\drpmc SID (S-1-5-21-703669745-1628820323-22978762-1001) from address LocalHost (Using LRPC) running in the application container Unavailable SID (Unavailable). This security permission can be modified using the Component Services administrative tool.

Error: (01/18/2018 05:16:48 PM) (Source: DCOM) (EventID: 10016) (User: NT AUTHORITY)
Description: The application-specific permission settings do not grant Local Activation permission for the COM Server application with CLSID
{6B3B8D23-FA8D-40B9-8DBD-B950333E2C52}
and APPID
{4839DDB7-58C2-48F5-8283-E1D1807D0D7D}
to the user NT AUTHORITY\LOCAL SERVICE SID (S-1-5-19) from address LocalHost (Using LRPC) running in the application container Unavailable SID (Unavailable). This security permission can be modified using the Component Services administrative tool.

Error: (01/18/2018 05:16:48 PM) (Source: DCOM) (EventID: 10016) (User: NT AUTHORITY)
Description: The application-specific permission settings do not grant Local Activation permission for the COM Server application with CLSID
{6B3B8D23-FA8D-40B9-8DBD-B950333E2C52}
and APPID
{4839DDB7-58C2-48F5-8283-E1D1807D0D7D}
to the user NT AUTHORITY\LOCAL SERVICE SID (S-1-5-19) from address LocalHost (Using LRPC) running in the application container Unavailable SID (Unavailable). This security permission can be modified using the Component Services administrative tool.

Error: (01/18/2018 05:12:03 PM) (Source: DCOM) (EventID: 10016) (User: NT AUTHORITY)
Description: The application-specific permission settings do not grant Local Activation permission for the COM Server application with CLSID
{D63B10C5-BB46-4990-A94F-E40B9D520160}
and APPID
{9CA88EE3-ACB7-47C8-AFC4-AB702511C276}
to the user NT AUTHORITY\LOCAL SERVICE SID (S-1-5-19) from address LocalHost (Using LRPC) running in the application container Unavailable SID (Unavailable). This security permission can be modified using the Component Services administrative tool.

Error: (01/18/2018 05:02:36 PM) (Source: DCOM) (EventID: 10016) (User: DESKTOP-N7204RC)
Description: The application-specific permission settings do not grant Local Activation permission for the COM Server application with CLSID
{D63B10C5-BB46-4990-A94F-E40B9D520160}
and APPID
{9CA88EE3-ACB7-47C8-AFC4-AB702511C276}
to the user DESKTOP-N7204RC\drpmc SID (S-1-5-21-703669745-1628820323-22978762-1001) from address LocalHost (Using LRPC) running in the application container Unavailable SID (Unavailable). This security permission can be modified using the Component Services administrative tool.

Error: (01/18/2018 05:01:59 PM) (Source: DCOM) (EventID: 10016) (User: NT AUTHORITY)
Description: The application-specific permission settings do not grant Local Activation permission for the COM Server application with CLSID
{6B3B8D23-FA8D-40B9-8DBD-B950333E2C52}
and APPID
{4839DDB7-58C2-48F5-8283-E1D1807D0D7D}
to the user NT AUTHORITY\LOCAL SERVICE SID (S-1-5-19) from address LocalHost (Using LRPC) running in the application container Unavailable SID (Unavailable). This security permission can be modified using the Component Services administrative tool.


CodeIntegrity:
===================================
Date: 2018-01-18 20:51:40.793
Description: Code Integrity determined that a process (\Device\HarddiskVolume3\Windows\System32\svchost.exe) attempted to load \Device\HarddiskVolume3\Program Files\Bonjour\mdnsNSP.dll that did not meet the Microsoft signing level requirements.

Date: 2018-01-18 20:51:40.790
Description: Code Integrity determined that a process (\Device\HarddiskVolume3\Windows\System32\svchost.exe) attempted to load \Device\HarddiskVolume3\Program Files\Bonjour\mdnsNSP.dll that did not meet the Microsoft signing level requirements.

Date: 2018-01-18 20:44:22.921
Description: Code Integrity determined that a process (\Device\HarddiskVolume3\Windows\System32\svchost.exe) attempted to load \Device\HarddiskVolume3\Program Files\Bonjour\mdnsNSP.dll that did not meet the Microsoft signing level requirements.

Date: 2018-01-18 20:44:22.917
Description: Code Integrity determined that a process (\Device\HarddiskVolume3\Windows\System32\svchost.exe) attempted to load \Device\HarddiskVolume3\Program Files\Bonjour\mdnsNSP.dll that did not meet the Microsoft signing level requirements.

Date: 2018-01-18 20:36:26.581
Description: Code Integrity determined that a process (\Device\HarddiskVolume3\Windows\System32\svchost.exe) attempted to load \Device\HarddiskVolume3\Program Files\Bonjour\mdnsNSP.dll that did not meet the Microsoft signing level requirements.

Date: 2018-01-18 20:36:26.577
Description: Code Integrity determined that a process (\Device\HarddiskVolume3\Windows\System32\svchost.exe) attempted to load \Device\HarddiskVolume3\Program Files\Bonjour\mdnsNSP.dll that did not meet the Microsoft signing level requirements.

Date: 2018-01-18 20:29:22.426
Description: Code Integrity determined that a process (\Device\HarddiskVolume3\Windows\System32\svchost.exe) attempted to load \Device\HarddiskVolume3\Program Files\Bonjour\mdnsNSP.dll that did not meet the Microsoft signing level requirements.

Date: 2018-01-18 20:29:22.422
Description: Code Integrity determined that a process (\Device\HarddiskVolume3\Windows\System32\svchost.exe) attempted to load \Device\HarddiskVolume3\Program Files\Bonjour\mdnsNSP.dll that did not meet the Microsoft signing level requirements.

Date: 2018-01-18 20:14:45.615
Description: Code Integrity determined that a process (\Device\HarddiskVolume3\Windows\System32\svchost.exe) attempted to load \Device\HarddiskVolume3\Program Files\Bonjour\mdnsNSP.dll that did not meet the Microsoft signing level requirements.

Date: 2018-01-18 20:14:45.611
Description: Code Integrity determined that a process (\Device\HarddiskVolume3\Windows\System32\svchost.exe) attempted to load \Device\HarddiskVolume3\Program Files\Bonjour\mdnsNSP.dll that did not meet the Microsoft signing level requirements.


==================== Memory info ===========================

Processor: Intel® Core™ i5-6200U CPU @ 2.30GHz
Percentage of memory in use: 58%
Total physical RAM: 8073.91 MB
Available physical RAM: 3352.02 MB
Total Virtual: 9993.91 MB
Available Virtual: 5269.72 MB

==================== Drives ================================

Drive c: (Acer) (Fixed) (Total:237.52 GB) (Free:209.58 GB) NTFS

==================== MBR & Partition Table ==================

========================================================
Disk: 0 (Size: 238.5 GB) (Disk ID: BC7991E4)

Partition: GPT.

==================== End of Addition.txt ============================

Attached Files


Edited by Oh My!, 19 January 2018 - 09:49 AM.


BC AdBot (Login to Remove)

 


#2 Oh My!

Oh My!

    Adware and Spyware and Malware.....


  • Malware Response Instructor
  • 36,798 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:California
  • Local time:10:00 PM

Posted 19 January 2018 - 09:50 AM

Greetings Spextrun and :welcome: to BleepingComputer's Virus/Trojan/Spyware/Malware Removal forum.

My name is Oh My! and I am here to help you! Now that we are "friends" please call me Gary.

If you would allow me to call you by your first name I would prefer to do that.

===================================================

Ground Rules:
  • First, I would like to inform you that most of us here at Bleeping Computer offer our expert assistance out of the goodness of our hearts. Please try to match our commitment to you with your patience toward us. If this was easy we would never have met.
  • Please do not run any tools or take any steps other than those I will provide for you while we work on your computer together. I need to be certain about the state of your computer in order to provide appropriate and effective steps for you to take. Most often "well intentioned" (and usually panic driven!) independent efforts can make things much worse for both of us. If at any point you would prefer to take your own steps please let me know, I will not be offended. I would be happy to focus on the many others who are waiting in line for assistance.
  • Please perform all steps in the order they are listed in each set of instructions. Some steps may be a bit complicated. If things are not clear, be sure to stop and let me know. We need to work on this together with confidence.
  • Please copy and paste all logs into your post unless directed otherwise. Please do not re-run any programs I suggest. If you encounter problems simply stop and tell me.
  • If you do not reply to your topic after 5 days we assume it has been abandoned and I will close it.
  • When your computer is clean I will alert you of such. I will also provide for you detailed information about how you can combat future infections.
  • I would like to remind you to make no further changes to your computer unless I direct you to do so.
===================================================

Now that I am assisting you, you can expect that I will be very responsive to your situation. If you are able, I would request you check this thread at least once per day so that we can try to resolve your issues effectively and efficiently. If you are going to be delayed please be considerate and post that information so that I know you are still with me. Unfortunately, there are many people waiting to be assisted and not enough of us at BleepingComputer to go around. I appreciate your understanding and diligence.

Thank you for your patience thus far. Please allow me just a bit of time to review what you have posted.
Gary
 
If I do not reply within 24 hours please send me a Personal Message.

"Lord, to whom would we go? You have the words that give eternal life. We believe, and we know you are the Holy One of God."

#3 Oh My!

Oh My!

    Adware and Spyware and Malware.....


  • Malware Response Instructor
  • 36,798 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:California
  • Local time:10:00 PM

Posted 19 January 2018 - 04:45 PM

Greetings.

Thank you for your patience.

Having more than one antivirus program on your computer can result in performance issues. I am going to ask that you remove some programs as instructed below then we will reinstall one when we are ready to do so.

Please do these things.

===================================================

Uninstalling Programs Using Revo Uninstaller Free

--------------------

I recommend uninstalling the below listed program(s) from your computer.
  • Please download and install Revo Uninstaller Free
  • Right click Revo Uninstaller and select Run as administrator
  • From the list of programs double click on the listed program(s), or anything similar, to remove it (if it exists)
McAfee LiveSafe
Norton Internet Security
  • Click Yes to any warning screen that may appear
  • If presented with the program uninstall option click Uninstall
  • If asked to restart now click No
  • Under Scanning Modes select Advanced then select Scan
  • On the Found leftover Registry items window click Select All, Delete, then Yes
  • If prompted click on Next
  • On the Found leftover files and folders window click on Select all, Delete, Yes, OK on any warning screen, then Finish
  • Reboot your computer into Normal Boot and check the performance
===================================================

Download and run the Avast Uninstall Utility.

===================================================

Farbar's Recovery Scan Tool - Run Fix in Normal or Safe Mode

--------------------
  • Right click on the FRST icon and select Run as administrator
  • Highlight the below information then hit the Ctrl + C keys at the same time
Start::
CreateRestorePoint:
CloseProcesses:
cmd: sfc /scannow
File: C:\WINDOWS\system32\hvax64.exe
File: C:\WINDOWS\system32\Drivers\bam.sys
emptytemp:
End::
  • Click Fix
  • When completed he tool will create a log on the desktop called Fixlog.txt. Please copy and paste the contents of the file in your reply.
===================================================

Things I would like to see in your next reply. Please be sure to copy and paste any requested log information unless you are asked to attach it. :thumbsup2:
  • Programs uninstall?
  • Fixlog
  • Update on computer performance

Gary
 
If I do not reply within 24 hours please send me a Personal Message.

"Lord, to whom would we go? You have the words that give eternal life. We believe, and we know you are the Holy One of God."

#4 Spextrun

Spextrun
  • Topic Starter

  • Members
  • 5 posts
  • OFFLINE
  •  
  • Local time:09:00 PM

Posted 19 January 2018 - 09:14 PM

Hi Gary, my name is Paul.. those are old and outdated logs. I am super sorry but would you mind checking these? I am terribly sorry for making you look through this. Thank you!
 
 - Paul
Scan result of Farbar Recovery Scan Tool (FRST) (x64) Version: 17.01.2018 01
Ran by drpmc (administrator) on DESKTOP-DVAB5JQ (19-01-2018 18:05:50)
Running from C:\Users\drpmc\Downloads
Loaded Profiles: drpmc (Available Profiles: drpmc)
Platform: Windows 10 Home Version 1709 16299.192 (X64) Language: English (United States)
Internet Explorer Version 11 (Default browser: Edge)
Boot Mode: Normal
Tutorial for Farbar Recovery Scan Tool: http://www.geekstogo.com/forum/topic/335081-frst-tutorial-how-to-use-farbar-recovery-scan-tool/

==================== Processes (Whitelisted) =================

(If an entry is included in the fixlist, the process will be closed. The file will not be moved.)

(Intel Corporation) C:\Windows\System32\igfxCUIService.exe
(Intel Corporation) C:\Windows\System32\IntelSSTAPO\ParameterService\ParameterService.exe
(Malwarebytes) C:\Program Files\Malwarebytes\Anti-Malware\MBAMService.exe
() C:\Program Files\Dolby\Dolby DAX2\DAX2_API\DolbyDAX2API.exe
() C:\Program Files (x86)\Intel\Intel® Security Assist\isaHelperService.exe
(Symantec Corporation) C:\Program Files\Norton Internet Security\Engine\22.11.2.7\NIS.exe
() C:\Program Files\AVAST Software\SecureLine\vpnsvc.exe
(Acer Incorporated) C:\Program Files (x86)\Acer\AOP Framework\CCDMonitorService.exe
(Windows ® Win 7 DDK provider) C:\Windows\System32\AdminService.exe
(Apple Inc.) C:\Program Files (x86)\Bonjour\mDNSResponder.exe
(McAfee, Inc.) C:\Program Files\Common Files\McAfee\SystemCore\mfemms.exe
(McAfee, Inc.) C:\Windows\System32\mfevtps.exe
(McAfee, Inc.) C:\Windows\System32\mfevtps.exe
(McAfee, Inc.) C:\Program Files\Common Files\McAfee\SystemCore\mfefire.exe
(McAfee, Inc.) C:\Program Files\Common Files\McAfee\platform\McSvcHost\McSvHost.exe
(Malwarebytes) C:\Program Files\Malwarebytes\Anti-Malware\mbamtray.exe
(Symantec Corporation) C:\Program Files\Norton Internet Security\Engine\22.11.2.7\NIS.exe
(Microsoft Corporation) C:\Windows\Microsoft.NET\Framework64\v3.0\WPF\PresentationFontCache.exe
(Intel Corporation) C:\Windows\System32\igfxEM.exe
(Intel Corporation) C:\Windows\System32\igfxHK.exe
() C:\Windows\System32\igfxTray.exe
(Microsoft Corporation) C:\Windows\System32\dllhost.exe
(Google Inc.) C:\Program Files (x86)\Google\Update\1.3.33.7\GoogleCrashHandler.exe
(Google Inc.) C:\Program Files (x86)\Google\Update\1.3.33.7\GoogleCrashHandler64.exe
(Acer Incorporated) C:\Program Files\Acer\Acer Quick Access\QASvc.exe
() C:\Program Files\WindowsApps\Microsoft.SkypeApp_11.18.596.0_x64__kzf8qxf38zg5c\SkypeHost.exe
(Acer Incorporated) C:\Program Files\Acer\Acer Quick Access\QALSvc.exe
(Acer Incorporated) C:\Program Files\Acer\Acer Quick Access\QAAgent.exe
(Acer Incorporated) C:\Program Files\Acer\Acer Quick Access\QALockHandler.exe
(Acer Incorporated) C:\Program Files\Acer\Acer Quick Access\QAAdminAgent.exe
(Microsoft Corporation) C:\Windows\System32\smartscreen.exe
(Microsoft Corporation) C:\Program Files\Windows Defender\MSASCuiL.exe
(Realtek Semiconductor) C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe
(Realtek Semiconductor) C:\Program Files\Realtek\Audio\HDA\RAVBg64.exe
() C:\Program Files\Dolby\Dolby DAX2\DAX2_APP\DolbyDAX2TrayIcon.exe
(Intel Corporation) C:\Program Files\Intel\Intel® Rapid Storage Technology\IAStorIconLaunch.exe
(McAfee, Inc.) C:\Program Files\Common Files\McAfee\platform\McUICnt.exe
(McAfee, Inc.) C:\Program Files\Common Files\McAfee\CSP\1.5.471.0\McCSPServiceHost.exe

==================== Registry (Whitelisted) ===========================

(If an entry is included in the fixlist, the registry item will be restored to default or removed. The file will not be moved.)

HKLM\...\Run: [SecurityHealth] => C:\Program Files\Windows Defender\MSASCuiL.exe [630168 2017-09-29] (Microsoft Corporation)
HKLM\...\Run: [RTHDVCPL] => C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe [16407296 2015-10-06] (Realtek Semiconductor)
HKLM\...\Run: [RtHDVBg_Dolby] => C:\Program Files\Realtek\Audio\HDA\RAVBg64.exe [1407744 2015-10-06] (Realtek Semiconductor)
HKLM\...\Run: [DAX2_APP] => C:\Program Files\Dolby\Dolby DAX2\DAX2_APP\DolbyDAX2TrayIcon.exe [628736 2015-09-22] ()
HKLM\...\Run: [IAStorIcon] => C:\Program Files\Intel\Intel® Rapid Storage Technology\IAStorIcon.exe [322472 2015-07-27] (Intel Corporation)
HKLM-x32\...\Run: [mcpltui_exe] => C:\Program Files\Common Files\McAfee\Platform\mcuicnt.exe [719272 2015-04-02] (McAfee, Inc.)

==================== Internet (Whitelisted) ====================

(If an item is included in the fixlist, if it is a registry item it will be removed or restored to default.)

Tcpip\Parameters: [DhcpNameServer] 75.75.75.75 75.75.76.76
Tcpip\..\Interfaces\{41b253f2-a1d0-48ef-a07f-9c37eaad9bb6}: [DhcpNameServer] 192.168.184.1
Tcpip\..\Interfaces\{ebf99745-6ae8-4a3a-b6ec-d90ede0c9601}: [DhcpNameServer] 75.75.75.75 75.75.76.76

Internet Explorer:
==================
HKU\S-1-5-21-193851962-1471604701-2205269352-1001\Software\Microsoft\Internet Explorer\Main,Start Page = about:blank
HKU\S-1-5-21-193851962-1471604701-2205269352-1001\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = hxxp://acer15.msn.com/?pc=ACTE
SearchScopes: HKLM -> {AA9A4890-4262-4441-8977-E2FFCBFB706C} URL = hxxp://us.yhs4.search.yahoo.com/yhs/search?hspart=acer&hsimp=yhs-acer_001&p={searchTerms}
SearchScopes: HKLM-x32 -> {AA9A4890-4262-4441-8977-E2FFCBFB706C} URL = hxxp://us.yhs4.search.yahoo.com/yhs/search?hspart=acer&hsimp=yhs-acer_001&p={searchTerms}
SearchScopes: HKU\S-1-5-21-193851962-1471604701-2205269352-1001 -> {AA9A4890-4262-4441-8977-E2FFCBFB706C} URL = hxxp://us.yhs4.search.yahoo.com/yhs/search?hspart=acer&hsimp=yhs-acer_001&p={searchTerms}
BHO: Norton Identity Safety -> {602ADB0E-4AFF-4217-8AA1-95DAC4DFA408} -> C:\Program Files\Norton Internet Security\Engine\22.11.2.7\coIEPlg.dll [2017-11-10] (Symantec Corporation)
BHO-x32: Norton Identity Safety -> {602ADB0E-4AFF-4217-8AA1-95DAC4DFA408} -> C:\Program Files\Norton Internet Security\Engine32\22.11.2.7\coIEPlg.dll [2017-11-10] (Symantec Corporation)
Toolbar: HKLM - Norton Toolbar - {7FEBEFE3-6B19-4349-98D2-FFB09D4B49CA} - C:\Program Files\Norton Internet Security\Engine\22.11.2.7\coIEPlg.dll [2017-11-10] (Symantec Corporation)
Toolbar: HKLM-x32 - Norton Toolbar - {7FEBEFE3-6B19-4349-98D2-FFB09D4B49CA} - C:\Program Files\Norton Internet Security\Engine32\22.11.2.7\coIEPlg.dll [2017-11-10] (Symantec Corporation)
Filter: application/x-mfe-ipt - {3EF5086B-5478-4598-A054-786C45D75692} - c:\Program Files\mcafee\msc\McSnIePl64.dll [2015-07-16] (McAfee, Inc.)
Filter-x32: application/x-mfe-ipt - {3EF5086B-5478-4598-A054-786C45D75692} - c:\Program Files (x86)\McAfee\msc\McSnIePl.dll [2015-07-16] (McAfee, Inc.)

FireFox:
========
FF Extension: (Amazon 1Button App for Firefox) - C:\Program Files (x86)\Mozilla Firefox\distribution\extensions\abb@amazon.com [2018-01-19] [Legacy] [not signed]
FF Extension: (English (US) Language Pack) - C:\Program Files (x86)\Mozilla Firefox\distribution\extensions\langpack-en-US@firefox.mozilla.org [2018-01-19] [Legacy] [not signed]
FF HKLM-x32\...\Thunderbird\Extensions: [msktbird@mcafee.com] - C:\Program Files\McAfee\MSK
FF Extension: (McAfee Anti-Spam Thunderbird Extension) - C:\Program Files\McAfee\MSK [2018-01-19] [Legacy] [not signed]
FF Plugin: @mcafee.com/MSC,version=10 -> c:\PROGRA~1\mcafee\msc\NPMCSN~1.DLL [2015-07-16] ()
FF Plugin-x32: @foxitsoftware.com/Foxit PhantomPDF Plugin,version=1.0,application/pdf -> C:\Program Files (x86)\Foxit PhantomPDF\plugins\npFoxitPhantomPDFPlugin.dll [2014-10-20] (Foxit Corporation)
FF Plugin-x32: @foxitsoftware.com/Foxit PhantomPDF Plugin,version=1.0,application/vnd.fdf -> C:\Program Files (x86)\Foxit PhantomPDF\plugins\npFoxitPhantomPDFPlugin.dll [2014-10-20] (Foxit Corporation)
FF Plugin-x32: @foxitsoftware.com/Foxit PhantomPDF Plugin,version=1.0,application/vnd.xdp -> C:\Program Files (x86)\Foxit PhantomPDF\plugins\npFoxitPhantomPDFPlugin.dll [2014-10-20] (Foxit Corporation)
FF Plugin-x32: @foxitsoftware.com/Foxit PhantomPDF Plugin,version=1.0,application/vnd.xfdf -> C:\Program Files (x86)\Foxit PhantomPDF\plugins\npFoxitPhantomPDFPlugin.dll [2014-10-20] (Foxit Corporation)
FF Plugin-x32: @intel-webapi.intel.com/Intel WebAPI ipt;version=4.0.68 -> C:\Program Files (x86)\Intel\Intel® Management Engine Components\IPT\npIntelWebAPIIPT.dll [2015-04-21] (Intel Corporation)
FF Plugin-x32: @intel-webapi.intel.com/Intel WebAPI updater -> C:\Program Files (x86)\Intel\Intel® Management Engine Components\IPT\npIntelWebAPIUpdater.dll [2015-04-21] (Intel Corporation)
FF Plugin-x32: @mcafee.com/MSC,version=10 -> c:\PROGRA~2\mcafee\msc\NPMCSN~1.DLL [2015-07-16] ()
FF Plugin-x32: @tools.google.com/Google Update;version=3 -> C:\Program Files (x86)\Google\Update\1.3.33.7\npGoogleUpdate3.dll [2018-01-19] (Google Inc.)
FF Plugin-x32: @tools.google.com/Google Update;version=9 -> C:\Program Files (x86)\Google\Update\1.3.33.7\npGoogleUpdate3.dll [2018-01-19] (Google Inc.)
FF Plugin-x32: @WildTangent.com/GamesAppPresenceDetector,Version=1.0 -> C:\Program Files (x86)\WildTangent Games\App\BrowserIntegration\Registered\0\NP_wtapp.dll [2014-11-14] ()

Chrome:
=======
CHR Profile: C:\Users\drpmc\AppData\Local\Google\Chrome\User Data\Default [2018-01-19]
CHR Extension: (Slides) - C:\Users\drpmc\AppData\Local\Google\Chrome\User Data\Default\Extensions\aapocclcgogkmnckokdopfmhonfmgoek [2018-01-19]
CHR Extension: (Docs) - C:\Users\drpmc\AppData\Local\Google\Chrome\User Data\Default\Extensions\aohghmighlieiainnegkcijnfilokake [2018-01-19]
CHR Extension: (Google Drive) - C:\Users\drpmc\AppData\Local\Google\Chrome\User Data\Default\Extensions\apdfllckaahabafndbhieahigkjlhalf [2018-01-19]
CHR Extension: (YouTube) - C:\Users\drpmc\AppData\Local\Google\Chrome\User Data\Default\Extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo [2018-01-19]
CHR Extension: (Norton Security Toolbar) - C:\Users\drpmc\AppData\Local\Google\Chrome\User Data\Default\Extensions\cjabmdjcfcfdmffimndhafhblfmpjdpe [2018-01-19]
CHR Extension: (Sheets) - C:\Users\drpmc\AppData\Local\Google\Chrome\User Data\Default\Extensions\felcaaldnbdncclmgdcncolpebgiejap [2018-01-19]
CHR Extension: (Google Docs Offline) - C:\Users\drpmc\AppData\Local\Google\Chrome\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi [2018-01-19]
CHR Extension: (Norton Identity Safe) - C:\Users\drpmc\AppData\Local\Google\Chrome\User Data\Default\Extensions\iikflkcanblccfahdhdonehdalibjnif [2018-01-19]
CHR Extension: (Chrome Web Store Payments) - C:\Users\drpmc\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda [2018-01-19]
CHR Extension: (Gmail) - C:\Users\drpmc\AppData\Local\Google\Chrome\User Data\Default\Extensions\pjkljhegncpnkpknbcohdijeoejaedia [2018-01-19]
CHR Extension: (Chrome Media Router) - C:\Users\drpmc\AppData\Local\Google\Chrome\User Data\Default\Extensions\pkedcjkdefgpdelpbcmbmeomcjbeemfm [2018-01-19]
CHR HKLM\...\Chrome\Extension: [cjabmdjcfcfdmffimndhafhblfmpjdpe] - C:\Program Files\Norton Internet Security\Engine\22.11.2.7\Exts\Chrome.crx <not found>
CHR HKLM\...\Chrome\Extension: [iikflkcanblccfahdhdonehdalibjnif] - hxxps://clients2.google.com/service/update2/crx
CHR HKLM-x32\...\Chrome\Extension: [cjabmdjcfcfdmffimndhafhblfmpjdpe] - C:\Program Files\Norton Internet Security\Engine\22.11.2.7\Exts\Chrome.crx <not found>
CHR HKLM-x32\...\Chrome\Extension: [iikflkcanblccfahdhdonehdalibjnif] - hxxps://clients2.google.com/service/update2/crx

==================== Services (Whitelisted) ====================

(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)

R2 CCDMonitorService; C:\Program Files (x86)\Acer\AOP Framework\CCDMonitorService.exe [2278616 2017-03-19] (Acer Incorporated)
S3 cplspcon; C:\WINDOWS\system32\IntelCpHDCPSvc.exe [630752 2016-05-19] (Intel Corporation)
S2 Dashlane Upgrade Service; C:\Program Files (x86)\Dashlane\Upgrade\DashlaneUpgradeService.exe [75056 2015-06-24] (Dashlane SAS)
R2 DAX2API; C:\Program Files\Dolby\Dolby DAX2\DAX2_API\DolbyDAX2API.exe [176640 2015-09-22] () [File not signed]
R3 ePowerSvc; C:\Program Files\Acer\Acer Power Management\ePowerSvc.exe [2573568 2015-05-14] (Acer Incorporated)
S2 GamesAppIntegrationService; C:\Program Files (x86)\WildTangent Games\App\GamesAppIntegrationService.exe [373312 2015-04-14] (WildTangent)
S2 HomeNetSvc; C:\Program Files\Common Files\McAfee\Platform\McSvcHost\McSvHost.exe [340744 2015-04-02] (McAfee, Inc.)
S2 IAStorDataMgrSvc; C:\Program Files\Intel\Intel® Rapid Storage Technology\IAStorDataMgrSvc.exe [18856 2015-07-27] (Intel Corporation)
R2 igfxCUIService2.0.0.0; C:\WINDOWS\system32\igfxCUIService.exe [382424 2016-05-19] (Intel Corporation)
S3 Intel® Capability Licensing Service TCP IP Interface; C:\Program Files\Intel\iCLS Client\SocketHeciServer.exe [881152 2015-05-22] (Intel® Corporation)
S3 Intel® Security Assist; C:\Program Files (x86)\Intel\Intel® Security Assist\isa.exe [335872 2015-05-19] (Intel Corporation) [File not signed]
R2 IntelSSTSvc; C:\WINDOWS\system32\IntelSSTAPO\ParameterService\ParameterService.exe [25928 2015-09-22] (Intel Corporation)
R2 isaHelperSvc; C:\Program Files (x86)\Intel\Intel® Security Assist\isaHelperService.exe [7680 2015-05-19] () [File not signed]
S2 jhi_service; C:\Program Files (x86)\Intel\Intel® Management Engine Components\DAL\jhi_service.exe [207648 2015-08-07] (Intel Corporation)
R2 MBAMService; C:\Program Files\Malwarebytes\Anti-Malware\mbamservice.exe [6234056 2017-11-01] (Malwarebytes)
R2 McAPExe; C:\Program Files\McAfee\MSC\McAPExe.exe [754792 2015-07-16] (McAfee, Inc.)
S3 McAWFwk; C:\Program Files\Common Files\McAfee\ActWiz\McAWFwk.exe [338208 2015-03-19] (McAfee, Inc.)
R2 mcbootdelaystartsvc; C:\Program Files\Common Files\McAfee\platform\McSvcHost\McSvHost.exe [340744 2015-04-02] (McAfee, Inc.)
R2 mccspsvc; C:\Program Files\Common Files\McAfee\CSP\1.5.471.0\McCSPServiceHost.exe [207344 2015-04-27] (McAfee, Inc.)
R2 McMPFSvc; C:\Program Files\Common Files\McAfee\Platform\McSvcHost\McSvHost.exe [340744 2015-04-02] (McAfee, Inc.)
R2 McNaiAnn; C:\Program Files\Common Files\McAfee\platform\McSvcHost\McSvHost.exe [340744 2015-04-02] (McAfee, Inc.)
S3 McODS; C:\Program Files\mcafee\VirusScan\mcods.exe [612688 2015-04-09] (McAfee, Inc.)
S4 McOobeSv2; C:\Program Files\Common Files\McAfee\platform\McSvcHost\McSvHost.exe [340744 2015-04-02] (McAfee, Inc.)
R2 mcpltsvc; C:\Program Files\Common Files\McAfee\platform\McSvcHost\McSvHost.exe [340744 2015-04-02] (McAfee, Inc.)
R2 McProxy; C:\Program Files\Common Files\McAfee\platform\McSvcHost\McSvHost.exe [340744 2015-04-02] (McAfee, Inc.)
R3 mfefire; C:\Program Files\Common Files\McAfee\SystemCore\\mfefire.exe [232656 2015-06-29] (McAfee, Inc.)
R2 mfemms; C:\Program Files\Common Files\McAfee\SystemCore\\mfemms.exe [373704 2015-07-30] (McAfee, Inc.)
R3 mfevtp; C:\Windows\system32\mfevtps.exe [254792 2015-06-29] (McAfee, Inc.)
R2 MSK80Service; C:\Program Files\Common Files\McAfee\Platform\McSvcHost\McSvHost.exe [340744 2015-04-02] (McAfee, Inc.)
R2 NIS; C:\Program Files\Norton Internet Security\Engine\22.11.2.7\NIS.exe [326144 2017-11-10] (Symantec Corporation)
R3 QALSvc; C:\Program Files\Acer\Acer Quick Access\QALSvc.exe [401248 2015-09-04] (Acer Incorporated)
R3 QASvc; C:\Program Files\Acer\Acer Quick Access\QASvc.exe [453984 2015-09-04] (Acer Incorporated)
R2 SecureLine; C:\Program Files\AVAST Software\SecureLine\VpnSvc.exe [592392 2018-01-19] ()
S3 UEIPSvc; C:\Program Files\Acer\User Experience Improvement Program\Framework\UBTService.exe [247040 2015-05-26] (acer)
S3 WdNisSvc; C:\Program Files\Windows Defender\NisSrv.exe [355304 2017-09-29] (Microsoft Corporation)
S3 WinDefend; C:\Program Files\Windows Defender\MsMpEng.exe [105944 2017-09-29] (Microsoft Corporation)

===================== Drivers (Whitelisted) ======================

(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)

R1 BHDrvx64; C:\Program Files\Norton Internet Security\NortonData\22.11.2.7\Definitions\BASHDefs\20171016.001\BHDrvx64.sys [1872024 2017-11-10] (Symantec Corporation)
R1 ccSet_NIS; C:\WINDOWS\system32\drivers\NISx64\160B020.007\ccSetx64.sys [187544 2017-11-10] (Symantec Corporation)
R3 cfwids; C:\WINDOWS\System32\drivers\cfwids.sys [77536 2015-07-02] (McAfee, Inc.)
S3 dg_ssudbus; C:\WINDOWS\System32\drivers\ssudbus.sys [131712 2016-09-05] (Samsung Electronics Co., Ltd.)
R1 eeCtrl; C:\Program Files (x86)\Common Files\Symantec Shared\EENGINE\eeCtrl64.sys [507984 2017-12-27] (Symantec Corporation)
R3 EraserUtilRebootDrv; C:\Program Files (x86)\Common Files\Symantec Shared\EENGINE\EraserUtilRebootDrv.sys [152656 2017-12-27] (Symantec Corporation)
R1 ESProtectionDriver; C:\WINDOWS\system32\drivers\mbae64.sys [77432 2017-11-29] ()
S3 HipShieldK; C:\WINDOWS\System32\drivers\HipShieldK.sys [207208 2015-05-19] (McAfee, Inc.)
S3 iaLPSS2_GPIO2; C:\WINDOWS\System32\drivers\iaLPSS2_GPIO2.sys [84264 2015-06-16] (Intel Corporation)
R1 IDSVia64; C:\Program Files\Norton Internet Security\NortonData\22.11.2.7\Definitions\IPSDefs\20171013.101\IDSVia64.sys [1056920 2017-11-10] (Symantec Corporation)
R3 LMDriver; C:\WINDOWS\System32\drivers\LMDriver.sys [21344 2015-09-04] (Acer Incorporated)
R2 MBAMChameleon; C:\WINDOWS\System32\Drivers\MbamChameleon.sys [193968 2018-01-19] (Malwarebytes)
R3 MBAMFarflt; C:\WINDOWS\system32\DRIVERS\farflt.sys [110016 2018-01-19] (Malwarebytes)
R3 MBAMProtection; C:\WINDOWS\system32\DRIVERS\mbam.sys [46008 2018-01-19] (Malwarebytes)
R0 MBAMSwissArmy; C:\WINDOWS\System32\Drivers\mbamswissarmy.sys [253880 2018-01-19] (Malwarebytes)
R3 MBAMWebProtection; C:\WINDOWS\system32\DRIVERS\mwac.sys [94144 2018-01-19] (Malwarebytes)
R2 mfeaack; C:\WINDOWS\System32\drivers\mfeaack.sys [412440 2015-07-02] (McAfee, Inc.)
R2 mfeavfk; C:\WINDOWS\System32\drivers\mfeavfk.sys [347800 2015-07-02] (McAfee, Inc.)
S0 mfeelamk; C:\WINDOWS\System32\drivers\mfeelamk.sys [80920 2015-07-02] (McAfee, Inc.)
R3 mfefirek; C:\WINDOWS\System32\drivers\mfefirek.sys [496888 2015-07-02] (McAfee, Inc.)
R2 mfehidk; C:\WINDOWS\System32\drivers\mfehidk.sys [875928 2015-07-02] (McAfee, Inc.)
R3 mfencbdc; C:\WINDOWS\System32\DRIVERS\mfencbdc.sys [492000 2015-05-27] (McAfee, Inc.)
S3 mfencrk; C:\WINDOWS\System32\DRIVERS\mfencrk.sys [109480 2015-05-27] (McAfee, Inc.)
R2 mfewfpk; C:\WINDOWS\System32\drivers\mfewfpk.sys [344704 2015-07-02] (McAfee, Inc.)
S3 pelmouse; C:\WINDOWS\System32\drivers\pelmouse.sys [26880 2016-07-11] (TPMX Electronics Ltd.)
S3 pelusblf; C:\WINDOWS\System32\drivers\pelusblf.sys [33048 2016-07-11] ()
S3 pelvendr; C:\WINDOWS\System32\drivers\pelvendr.sys [15032 2016-07-11] (TPMX Electronics Ltd.)
S3 phidmice; C:\WINDOWS\System32\drivers\phidmice.sys [33048 2016-07-11] ()
S3 pmouself; C:\WINDOWS\System32\drivers\pmouself.sys [26880 2016-07-11] (TPMX Electronics Ltd.)
S3 pvendrlf; C:\WINDOWS\System32\drivers\pvendrlf.sys [15032 2016-07-11] (TPMX Electronics Ltd.)
R3 RadioShim; C:\WINDOWS\System32\drivers\RadioShim.sys [14688 2015-09-04] (Acer Incorporated)
R3 RTSUER; C:\WINDOWS\system32\Drivers\RtsUer.sys [433912 2016-08-03] (Realsil Semiconductor Corporation)
R3 SRTSP; C:\WINDOWS\system32\drivers\NISx64\160B020.007\SRTSP64.SYS [812696 2017-11-10] (Symantec Corporation)
R1 SRTSPX; C:\WINDOWS\system32\drivers\NISx64\160B020.007\SRTSPX64.SYS [49304 2017-11-10] (Symantec Corporation)
S3 ssudqcfilter; C:\WINDOWS\System32\drivers\ssudqcfilter.sys [64640 2016-09-05] (QUALCOMM Incorporated)
R0 SymEFASI; C:\WINDOWS\System32\drivers\NISx64\160B020.007\SYMEFASI64.SYS [1938584 2017-11-10] (Symantec Corporation)
S0 SymELAM; C:\WINDOWS\System32\drivers\NISx64\160B020.007\SymELAM.sys [24608 2017-11-10] (Symantec Corporation)
R3 SymEvent; C:\WINDOWS\system32\Drivers\SYMEVENT64x86.SYS [102600 2018-01-19] (Symantec Corporation)
R1 SymIRON; C:\WINDOWS\system32\drivers\NISx64\160B020.007\Ironx64.SYS [309984 2017-11-10] (Symantec Corporation)
R1 SymNetS; C:\WINDOWS\system32\drivers\NISx64\160B020.007\SYMNETS.SYS [566936 2017-11-10] (Symantec Corporation)
R3 VirtualButtons; C:\WINDOWS\System32\drivers\VirtualButtons.sys [41992 2017-03-31] (Intel Corporation)
S3 WdBoot; C:\WINDOWS\system32\drivers\WdBoot.sys [44608 2017-09-29] (Microsoft Corporation)
S3 WdFilter; C:\WINDOWS\system32\drivers\WdFilter.sys [309144 2017-09-29] (Microsoft Corporation)
S3 WdNisDrv; C:\WINDOWS\System32\Drivers\WdNisDrv.sys [119192 2017-09-29] (Microsoft Corporation)

==================== NetSvcs (Whitelisted) ===================

(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)


==================== One Month Created files and folders ========

(If an entry is included in the fixlist, the file/folder will be moved.)

2018-01-19 18:05 - 2018-01-19 18:06 - 000020899 _____ C:\Users\drpmc\Downloads\FRST.txt
2018-01-19 18:05 - 2018-01-19 18:05 - 000000000 ____D C:\FRST
2018-01-19 18:02 - 2018-01-19 18:02 - 000001244 _____ C:\Users\drpmc\Documents\MbamScan1.txt
2018-01-19 17:57 - 2018-01-19 17:57 - 000001433 _____ C:\Users\drpmc\Desktop\Roblox Player.lnk
2018-01-19 17:57 - 2018-01-19 17:57 - 000001248 _____ C:\Users\drpmc\Desktop\Roblox Studio.lnk
2018-01-19 17:57 - 2018-01-19 17:57 - 000000000 ____D C:\Users\drpmc\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Roblox
2018-01-19 17:56 - 2018-01-19 17:57 - 000000096 _____ C:\Users\drpmc\AppData\LocalLow\rbxcsettings.rbx
2018-01-19 17:56 - 2018-01-19 17:57 - 000000000 ____D C:\Users\drpmc\AppData\Local\Roblox
2018-01-19 17:55 - 2018-01-19 17:55 - 000822328 _____ (Roblox Corporation) C:\Users\drpmc\Downloads\RobloxPlayerLauncher.exe
2018-01-19 17:55 - 2018-01-19 17:55 - 000000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\McAfee
2018-01-19 17:48 - 2018-01-19 17:48 - 000001244 _____ C:\Users\drpmc\Downloads\MalwarebytesScan.txt
2018-01-19 17:40 - 2018-01-19 17:40 - 000001244 _____ C:\Users\drpmc\Downloads\MBAM.txt
2018-01-19 17:21 - 2018-01-19 18:04 - 000000000 ____D C:\AdwCleaner
2018-01-19 17:19 - 2018-01-19 17:19 - 000000000 ____D C:\Users\drpmc\AppData\Roaming\AVAST Software
2018-01-19 17:13 - 2018-01-19 17:43 - 000000000 ____D C:\Users\drpmc\AppData\Local\PlaceholderTileLogoFolder
2018-01-19 17:12 - 2018-01-19 17:13 - 000000000 ____D C:\Users\drpmc\AppData\Local\PackageStaging
2018-01-19 17:12 - 2018-01-19 17:12 - 000000000 ____D C:\Users\drpmc\AppData\Local\Comms
2018-01-19 17:08 - 2018-01-19 17:08 - 008206624 _____ (Malwarebytes) C:\Users\drpmc\Downloads\adwcleaner_7.0.7.0.exe
2018-01-19 17:04 - 2018-01-19 17:59 - 000000000 ____D C:\WINDOWS\System32\Tasks\Norton Internet Security
2018-01-19 17:04 - 2018-01-19 17:04 - 002393088 _____ (Farbar) C:\Users\drpmc\Downloads\FRST64.exe
2018-01-19 17:03 - 2018-01-19 17:03 - 000102600 _____ (Symantec Corporation) C:\WINDOWS\system32\Drivers\SYMEVENT64x86.SYS
2018-01-19 17:03 - 2018-01-19 17:03 - 000008471 _____ C:\WINDOWS\system32\Drivers\SYMEVENT64x86.CAT
2018-01-19 17:03 - 2018-01-19 17:03 - 000003392 _____ C:\WINDOWS\System32\Tasks\Norton WSC Integration
2018-01-19 17:03 - 2018-01-19 17:03 - 000002325 _____ C:\Users\Public\Desktop\Norton Internet Security.lnk
2018-01-19 17:03 - 2018-01-19 17:03 - 000000000 ____D C:\Program Files\Common Files\Symantec Shared
2018-01-19 17:02 - 2018-01-19 17:03 - 000000000 ___RD C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Norton Internet Security
2018-01-19 17:02 - 2018-01-19 17:02 - 000000000 ____D C:\WINDOWS\system32\Drivers\NISx64
2018-01-19 17:02 - 2018-01-19 17:02 - 000000000 ____D C:\ProgramData\NortonInstaller
2018-01-19 17:02 - 2018-01-19 17:02 - 000000000 ____D C:\Program Files\Norton Internet Security
2018-01-19 17:02 - 2018-01-19 17:02 - 000000000 ____D C:\Program Files (x86)\NortonInstaller
2018-01-19 17:01 - 2018-01-19 17:06 - 000000000 ____D C:\ProgramData\Norton
2018-01-19 17:01 - 2018-01-19 17:01 - 001120240 _____ (Symantec Corporation) C:\Users\drpmc\Downloads\NortonNISDownloader.exe
2018-01-19 17:01 - 2018-01-19 17:01 - 000001341 _____ C:\Users\drpmc\Desktop\Norton Installation Files.lnk
2018-01-19 17:01 - 2018-01-19 17:01 - 000000000 ____D C:\Users\Public\Downloads\Norton
2018-01-19 17:00 - 2018-01-19 17:00 - 000003508 _____ C:\WINDOWS\System32\Tasks\BacKGroundAgent
2018-01-19 17:00 - 2018-01-19 17:00 - 000000000 ____D C:\Users\drpmc\AppData\Local\CareCenter
2018-01-19 16:59 - 2018-01-19 16:59 - 000193968 _____ (Malwarebytes) C:\WINDOWS\system32\Drivers\MbamChameleon.sys
2018-01-19 16:59 - 2018-01-19 16:59 - 000002348 _____ C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Google Chrome.lnk
2018-01-19 16:59 - 2018-01-19 16:59 - 000002336 _____ C:\Users\Public\Desktop\Google Chrome.lnk
2018-01-19 16:59 - 2018-01-19 16:59 - 000000000 ____D C:\Users\drpmc\AppData\Roaming\Macromedia
2018-01-19 16:59 - 2018-01-19 16:59 - 000000000 ____D C:\ProgramData\Apple
2018-01-19 16:59 - 2018-01-19 16:59 - 000000000 ____D C:\Program Files\Bonjour
2018-01-19 16:59 - 2018-01-19 16:59 - 000000000 ____D C:\Program Files (x86)\Bonjour
2018-01-19 16:58 - 2018-01-19 18:04 - 000110016 _____ (Malwarebytes) C:\WINDOWS\system32\Drivers\farflt.sys
2018-01-19 16:58 - 2018-01-19 18:04 - 000094144 _____ (Malwarebytes) C:\WINDOWS\system32\Drivers\mwac.sys
2018-01-19 16:58 - 2018-01-19 18:04 - 000046008 _____ (Malwarebytes) C:\WINDOWS\system32\Drivers\mbam.sys
2018-01-19 16:58 - 2018-01-19 17:16 - 000253880 _____ (Malwarebytes) C:\WINDOWS\system32\Drivers\mbamswissarmy.sys
2018-01-19 16:58 - 2018-01-19 16:58 - 000003416 _____ C:\WINDOWS\System32\Tasks\GoogleUpdateTaskMachineUA
2018-01-19 16:58 - 2018-01-19 16:58 - 000003376 _____ C:\WINDOWS\System32\Tasks\OneDrive Standalone Update Task-S-1-5-21-193851962-1471604701-2205269352-1001
2018-01-19 16:58 - 2018-01-19 16:58 - 000003292 _____ C:\WINDOWS\System32\Tasks\GoogleUpdateTaskMachineCore
2018-01-19 16:58 - 2018-01-19 16:58 - 000001916 _____ C:\Users\Public\Desktop\Malwarebytes.lnk
2018-01-19 16:58 - 2018-01-19 16:58 - 000000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Malwarebytes
2018-01-19 16:58 - 2018-01-19 16:58 - 000000000 ____D C:\ProgramData\Malwarebytes
2018-01-19 16:58 - 2018-01-19 16:58 - 000000000 ____D C:\Program Files\Malwarebytes
2018-01-19 16:58 - 2018-01-19 16:58 - 000000000 ____D C:\Program Files (x86)\Google
2018-01-19 16:58 - 2017-11-29 09:11 - 000077432 _____ C:\WINDOWS\system32\Drivers\mbae64.sys
2018-01-19 16:57 - 2018-01-19 16:59 - 000000000 ____D C:\Users\drpmc\AppData\Local\Google
2018-01-19 16:57 - 2018-01-19 16:58 - 000002367 _____ C:\Users\drpmc\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\OneDrive.lnk
2018-01-19 16:57 - 2018-01-19 16:58 - 000000000 ___RD C:\Users\drpmc\OneDrive
2018-01-19 16:57 - 2018-01-19 16:57 - 000000000 ____D C:\Users\drpmc\PicStream
2018-01-19 16:57 - 2018-01-19 16:57 - 000000000 ____D C:\Users\drpmc\AppData\Roaming\Intel Corporation
2018-01-19 16:56 - 2018-01-19 17:37 - 000000000 ____D C:\Users\drpmc\AppData\Local\clear.fi
2018-01-19 16:56 - 2018-01-19 16:56 - 000001333 _____ C:\Users\drpmc\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\HD Audio Manager.lnk
2018-01-19 16:56 - 2018-01-19 16:56 - 000000000 ____D C:\Program Files (x86)\OEM
2018-01-19 16:55 - 2018-01-19 18:05 - 000000000 __SHD C:\Users\drpmc\IntelGraphicsProfiles
2018-01-19 16:55 - 2018-01-19 17:43 - 000000000 ____D C:\Users\drpmc\AppData\Local\Packages
2018-01-19 16:55 - 2018-01-19 16:57 - 000000000 ____D C:\Users\drpmc\AppData\Local\MicrosoftEdge
2018-01-19 16:55 - 2018-01-19 16:57 - 000000000 ____D C:\Users\drpmc\AppData\Local\AOP SDK
2018-01-19 16:55 - 2018-01-19 16:56 - 000000000 ____D C:\Users\drpmc\AppData\Local\ConnectedDevicesPlatform
2018-01-19 16:55 - 2018-01-19 16:55 - 000002170 _____ C:\Users\drpmc\Desktop\Dashlane Password Manager.lnk
2018-01-19 16:55 - 2018-01-19 16:55 - 000001786 _____ C:\Users\Public\Desktop\Acer Store.lnk
2018-01-19 16:55 - 2018-01-19 16:55 - 000000000 ___RD C:\Users\drpmc\3D Objects
2018-01-19 16:55 - 2018-01-19 16:55 - 000000000 ___HD C:\Users\drpmc\MicrosoftEdgeBackups
2018-01-19 16:55 - 2018-01-19 16:55 - 000000000 ____D C:\Users\drpmc\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Dashlane
2018-01-19 16:55 - 2018-01-19 16:55 - 000000000 ____D C:\Users\drpmc\AppData\Roaming\Adobe
2018-01-19 16:55 - 2018-01-19 16:55 - 000000000 ____D C:\Users\drpmc\AppData\Local\VirtualStore
2018-01-19 16:55 - 2018-01-19 16:55 - 000000000 ____D C:\Users\drpmc\AppData\Local\Publishers
2018-01-19 16:55 - 2018-01-19 16:55 - 000000000 ____D C:\ProgramData\OEM_YAHOO
2018-01-19 16:55 - 2018-01-19 16:55 - 000000000 ____D C:\Program Files\Accessory Store
2018-01-19 16:54 - 2018-01-19 17:20 - 000000000 ____D C:\Users\drpmc
2018-01-19 16:54 - 2018-01-19 16:54 - 000000020 ___SH C:\Users\drpmc\ntuser.ini
2018-01-19 16:53 - 2018-01-19 16:53 - 000000000 ____D C:\ProgramData\Dashlane
2018-01-19 16:52 - 2018-01-19 16:52 - 000000000 _SHDL C:\Users\Default User
2018-01-19 16:52 - 2018-01-19 16:52 - 000000000 _SHDL C:\Users\All Users
2018-01-19 16:52 - 2018-01-19 16:52 - 000000000 ____D C:\WINDOWS\oem
2018-01-19 16:51 - 2018-01-19 18:04 - 000000006 ____H C:\WINDOWS\Tasks\SA.DAT
2018-01-19 16:51 - 2018-01-19 17:42 - 000003388 _____ C:\WINDOWS\System32\Tasks\AcerCloud
2018-01-19 16:51 - 2018-01-19 16:51 - 000022744 _____ C:\WINDOWS\system32\emptyregdb.dat
2018-01-19 16:51 - 2018-01-19 16:51 - 000004302 _____ C:\WINDOWS\System32\Tasks\Software Update Application
2018-01-19 16:51 - 2018-01-19 16:51 - 000003852 _____ C:\WINDOWS\System32\Tasks\ACCAgent
2018-01-19 16:51 - 2018-01-19 16:51 - 000002926 _____ C:\WINDOWS\System32\Tasks\avast! SL Update
2018-01-19 16:51 - 2018-01-19 16:51 - 000002888 _____ C:\WINDOWS\System32\Tasks\ACC
2018-01-19 16:51 - 2018-01-19 16:51 - 000002780 _____ C:\WINDOWS\System32\Tasks\WindowsStoreGiftCardPromoBackgroundTaskX86
2018-01-19 16:51 - 2018-01-19 16:51 - 000002706 _____ C:\WINDOWS\System32\Tasks\UbtFrameworkService
2018-01-19 16:51 - 2018-01-19 16:51 - 000002654 _____ C:\WINDOWS\System32\Tasks\Avast SecureLine
2018-01-19 16:51 - 2018-01-19 16:51 - 000002328 _____ C:\WINDOWS\System32\Tasks\ACCBackgroundApplication
2018-01-19 16:51 - 2018-01-19 16:51 - 000002238 _____ C:\WINDOWS\System32\Tasks\Audio Invert Utility
2018-01-19 16:51 - 2018-01-19 16:51 - 000002222 _____ C:\WINDOWS\System32\Tasks\Power Management
2018-01-19 16:51 - 2018-01-19 16:51 - 000002180 _____ C:\WINDOWS\System32\Tasks\Quick Access
2018-01-19 16:51 - 2018-01-19 16:51 - 000002074 _____ C:\WINDOWS\System32\Tasks\FUBTrackingByPLD
2018-01-19 16:51 - 2017-09-29 05:41 - 002241024 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\PrintConfig.dll
2018-01-19 16:50 - 2018-01-19 16:50 - 000001576 _____ C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Windows Media Player.lnk
2018-01-19 16:48 - 2018-01-19 16:48 - 000000000 ____D C:\WINDOWS\system32\config\bbimigrate
2018-01-19 16:46 - 2018-01-19 18:05 - 000000180 _____ C:\WINDOWS\system32\{A6D608F0-0BDE-491A-97AE-5C4B05D86E01}.bat
2018-01-19 16:46 - 2018-01-19 16:49 - 000000000 ____D C:\Program Files (x86)\Realtek
2018-01-19 16:46 - 2018-01-19 16:48 - 000000000 ____D C:\Program Files\Intel
2018-01-19 16:46 - 2018-01-19 16:48 - 000000000 ____D C:\Intel
2018-01-19 16:46 - 2018-01-19 16:46 - 001151965 _____ C:\WINDOWS\system32\Drivers\rtkhdasetting.zip
2018-01-19 16:46 - 2018-01-19 16:46 - 000000200 _____ C:\WINDOWS\system32\{EC94D02F-D200-4428-9531-05AF7F9799CB}.bat
2018-01-19 16:46 - 2018-01-19 16:46 - 000000102 _____ C:\ProgramData\Microsoft.SqlServer.Compact.400.64.bc
2018-01-19 16:46 - 2018-01-19 16:46 - 000000000 ____H C:\ProgramData\DP45977C.lfl
2018-01-19 16:46 - 2018-01-19 16:46 - 000000000 ____D C:\WINDOWS\SysWOW64\RTCOM
2018-01-19 16:46 - 2018-01-19 16:46 - 000000000 ____D C:\WINDOWS\system32\IntelSSTAPO
2018-01-19 16:46 - 2018-01-19 16:46 - 000000000 ____D C:\WINDOWS\system32\DAX2
2018-01-19 16:46 - 2018-01-19 16:46 - 000000000 ____D C:\ProgramData\rtkSSTSetting
2018-01-19 16:46 - 2018-01-19 16:46 - 000000000 ____D C:\ProgramData\Dolby
2018-01-19 16:46 - 2018-01-19 16:46 - 000000000 ____D C:\Program Files\Realtek
2018-01-19 16:46 - 2018-01-19 16:46 - 000000000 ____D C:\Program Files\Dolby
2018-01-19 16:46 - 2018-01-19 16:46 - 000000000 ____D C:\Program Files\Common Files\Atheros
2018-01-19 16:46 - 2018-01-19 16:46 - 000000000 _____ C:\WINDOWS\system32\GfxValDisplayLog.bin
2018-01-19 16:46 - 2016-05-19 20:37 - 000112648 _____ (Khronos Group) C:\WINDOWS\SysWOW64\OpenCL.DLL
2018-01-19 16:46 - 2016-05-19 20:37 - 000108560 _____ (Khronos Group) C:\WINDOWS\system32\OpenCL.DLL
2018-01-19 16:46 - 2015-10-06 11:24 - 003154607 _____ C:\WINDOWS\system32\Drivers\rtkSSTSetting.zip
2018-01-19 16:45 - 2018-01-19 17:20 - 000000000 ____D C:\WINDOWS\system32\SleepStudy
2018-01-19 16:45 - 2018-01-19 16:50 - 000222608 _____ C:\WINDOWS\system32\FNTCACHE.DAT
2018-01-19 16:45 - 2018-01-19 16:46 - 000000000 ____D C:\WINDOWS\ServiceProfiles
2018-01-19 16:28 - 2018-01-19 16:29 - 000000000 ____D C:\Windows.old
2018-01-19 16:28 - 2018-01-19 16:28 - 000000000 ____D C:\WINDOWS\InfusedApps
2018-01-19 16:27 - 2018-01-19 16:27 - 000008192 _____ C:\WINDOWS\system32\config\userdiff
2018-01-19 16:27 - 2018-01-19 16:27 - 000000000 ____D C:\WINDOWS\SysWOW64\sda
2018-01-19 16:27 - 2018-01-19 16:27 - 000000000 ____D C:\WINDOWS\Setup
2018-01-19 16:27 - 2018-01-19 16:27 - 000000000 ____D C:\Program Files\Lenovo
2018-01-19 16:25 - 2018-01-19 16:27 - 000000000 ____D C:\WINDOWS\SysWOW64\zu-ZA
2018-01-19 16:25 - 2018-01-19 16:27 - 000000000 ____D C:\WINDOWS\SysWOW64\yo-NG
2018-01-19 16:25 - 2018-01-19 16:27 - 000000000 ____D C:\WINDOWS\SysWOW64\xh-ZA
2018-01-19 16:25 - 2018-01-19 16:27 - 000000000 ____D C:\WINDOWS\SysWOW64\wo-SN
2018-01-19 16:25 - 2018-01-19 16:27 - 000000000 ____D C:\WINDOWS\SysWOW64\vi-VN
2018-01-19 16:25 - 2018-01-19 16:27 - 000000000 ____D C:\WINDOWS\SysWOW64\uz-Latn-UZ
2018-01-19 16:25 - 2018-01-19 16:27 - 000000000 ____D C:\WINDOWS\SysWOW64\ur-PK
2018-01-19 16:25 - 2018-01-19 16:27 - 000000000 ____D C:\WINDOWS\SysWOW64\ug-CN
2018-01-19 16:25 - 2018-01-19 16:27 - 000000000 ____D C:\WINDOWS\SysWOW64\tt-RU
2018-01-19 16:25 - 2018-01-19 16:27 - 000000000 ____D C:\WINDOWS\SysWOW64\tn-ZA
2018-01-19 16:25 - 2018-01-19 16:27 - 000000000 ____D C:\WINDOWS\SysWOW64\tk-TM
2018-01-19 16:25 - 2018-01-19 16:27 - 000000000 ____D C:\WINDOWS\SysWOW64\ti-ET
2018-01-19 16:25 - 2018-01-19 16:27 - 000000000 ____D C:\WINDOWS\SysWOW64\tg-Cyrl-TJ
2018-01-19 16:25 - 2018-01-19 16:27 - 000000000 ____D C:\WINDOWS\SysWOW64\te-IN
2018-01-19 16:25 - 2018-01-19 16:27 - 000000000 ____D C:\WINDOWS\SysWOW64\ta-IN
2018-01-19 16:25 - 2018-01-19 16:27 - 000000000 ____D C:\WINDOWS\SysWOW64\sw-KE
2018-01-19 16:25 - 2018-01-19 16:27 - 000000000 ____D C:\WINDOWS\SysWOW64\sr-Cyrl-RS
2018-01-19 16:25 - 2018-01-19 16:27 - 000000000 ____D C:\WINDOWS\SysWOW64\sr-Cyrl-BA
2018-01-19 16:25 - 2018-01-19 16:27 - 000000000 ____D C:\WINDOWS\SysWOW64\sq-AL
2018-01-19 16:25 - 2018-01-19 16:27 - 000000000 ____D C:\WINDOWS\SysWOW64\si-LK
2018-01-19 16:25 - 2018-01-19 16:27 - 000000000 ____D C:\WINDOWS\SysWOW64\sd-Arab-PK
2018-01-19 16:25 - 2018-01-19 16:27 - 000000000 ____D C:\WINDOWS\SysWOW64\rw-RW
2018-01-19 16:25 - 2018-01-19 16:27 - 000000000 ____D C:\WINDOWS\SysWOW64\quz-PE
2018-01-19 16:25 - 2018-01-19 16:27 - 000000000 ____D C:\WINDOWS\SysWOW64\quc-Latn-GT
2018-01-19 16:25 - 2018-01-19 16:27 - 000000000 ____D C:\WINDOWS\SysWOW64\prs-AF
2018-01-19 16:25 - 2018-01-19 16:27 - 000000000 ____D C:\WINDOWS\SysWOW64\pa-IN
2018-01-19 16:25 - 2018-01-19 16:27 - 000000000 ____D C:\WINDOWS\SysWOW64\pa-Arab-PK
2018-01-19 16:25 - 2018-01-19 16:27 - 000000000 ____D C:\WINDOWS\SysWOW64\or-IN
2018-01-19 16:25 - 2018-01-19 16:27 - 000000000 ____D C:\WINDOWS\SysWOW64\nso-ZA
2018-01-19 16:25 - 2018-01-19 16:27 - 000000000 ____D C:\WINDOWS\SysWOW64\nn-NO
2018-01-19 16:25 - 2018-01-19 16:27 - 000000000 ____D C:\WINDOWS\SysWOW64\ne-NP
2018-01-19 16:25 - 2018-01-19 16:27 - 000000000 ____D C:\WINDOWS\SysWOW64\mt-MT
2018-01-19 16:25 - 2018-01-19 16:27 - 000000000 ____D C:\WINDOWS\SysWOW64\mr-IN
2018-01-19 16:25 - 2018-01-19 16:27 - 000000000 ____D C:\WINDOWS\SysWOW64\mn-MN
2018-01-19 16:25 - 2018-01-19 16:27 - 000000000 ____D C:\WINDOWS\SysWOW64\ml-IN
2018-01-19 16:25 - 2018-01-19 16:27 - 000000000 ____D C:\WINDOWS\SysWOW64\mk-MK
2018-01-19 16:25 - 2018-01-19 16:27 - 000000000 ____D C:\WINDOWS\SysWOW64\mi-NZ
2018-01-19 16:25 - 2018-01-19 16:27 - 000000000 ____D C:\WINDOWS\SysWOW64\lo-LA
2018-01-19 16:25 - 2018-01-19 16:27 - 000000000 ____D C:\WINDOWS\SysWOW64\lb-LU
2018-01-19 16:25 - 2018-01-19 16:27 - 000000000 ____D C:\WINDOWS\SysWOW64\ky-KG
2018-01-19 16:25 - 2018-01-19 16:27 - 000000000 ____D C:\WINDOWS\SysWOW64\ku-Arab-IQ
2018-01-19 16:25 - 2018-01-19 16:27 - 000000000 ____D C:\WINDOWS\SysWOW64\kok-IN
2018-01-19 16:25 - 2018-01-19 16:27 - 000000000 ____D C:\WINDOWS\SysWOW64\kn-IN
2018-01-19 16:25 - 2018-01-19 16:27 - 000000000 ____D C:\WINDOWS\SysWOW64\km-KH
2018-01-19 16:25 - 2018-01-19 16:27 - 000000000 ____D C:\WINDOWS\SysWOW64\kk-KZ
2018-01-19 16:25 - 2018-01-19 16:27 - 000000000 ____D C:\WINDOWS\SysWOW64\ka-GE
2018-01-19 16:25 - 2018-01-19 16:27 - 000000000 ____D C:\WINDOWS\SysWOW64\is-IS
2018-01-19 16:25 - 2018-01-19 16:27 - 000000000 ____D C:\WINDOWS\SysWOW64\ig-NG
2018-01-19 16:25 - 2018-01-19 16:27 - 000000000 ____D C:\WINDOWS\SysWOW64\id-ID
2018-01-19 16:25 - 2018-01-19 16:27 - 000000000 ____D C:\WINDOWS\SysWOW64\hy-AM
2018-01-19 16:25 - 2018-01-19 16:27 - 000000000 ____D C:\WINDOWS\SysWOW64\ha-Latn-NG
2018-01-19 16:25 - 2018-01-19 16:27 - 000000000 ____D C:\WINDOWS\SysWOW64\gu-IN
2018-01-19 16:25 - 2018-01-19 16:27 - 000000000 ____D C:\WINDOWS\SysWOW64\gd-GB
2018-01-19 16:25 - 2018-01-19 16:27 - 000000000 ____D C:\WINDOWS\SysWOW64\ga-IE
2018-01-19 16:25 - 2018-01-19 16:27 - 000000000 ____D C:\WINDOWS\SysWOW64\fil-PH
2018-01-19 16:25 - 2018-01-19 16:27 - 000000000 ____D C:\WINDOWS\SysWOW64\fa-IR
2018-01-19 16:25 - 2018-01-19 16:27 - 000000000 ____D C:\WINDOWS\SysWOW64\cy-GB
2018-01-19 16:25 - 2018-01-19 16:27 - 000000000 ____D C:\WINDOWS\SysWOW64\chr-CHER-US
2018-01-19 16:25 - 2018-01-19 16:27 - 000000000 ____D C:\WINDOWS\SysWOW64\ca-ES-valencia
2018-01-19 16:25 - 2018-01-19 16:27 - 000000000 ____D C:\WINDOWS\SysWOW64\bs-Latn-BA
2018-01-19 16:25 - 2018-01-19 16:27 - 000000000 ____D C:\WINDOWS\SysWOW64\bn-IN
2018-01-19 16:25 - 2018-01-19 16:27 - 000000000 ____D C:\WINDOWS\SysWOW64\bn-BD
2018-01-19 16:25 - 2018-01-19 16:27 - 000000000 ____D C:\WINDOWS\SysWOW64\be-BY
2018-01-19 16:25 - 2018-01-19 16:27 - 000000000 ____D C:\WINDOWS\SysWOW64\az-Latn-AZ
2018-01-19 16:25 - 2018-01-19 16:27 - 000000000 ____D C:\WINDOWS\SysWOW64\as-IN
2018-01-19 16:25 - 2018-01-19 16:27 - 000000000 ____D C:\WINDOWS\SysWOW64\am-ET
2018-01-19 16:25 - 2018-01-19 16:27 - 000000000 ____D C:\WINDOWS\SysWOW64\af-ZA
2018-01-19 16:25 - 2018-01-19 16:27 - 000000000 ____D C:\WINDOWS\system32\zu-ZA
2018-01-19 16:25 - 2018-01-19 16:27 - 000000000 ____D C:\WINDOWS\system32\yo-NG
2018-01-19 16:25 - 2018-01-19 16:27 - 000000000 ____D C:\WINDOWS\system32\xh-ZA
2018-01-19 16:25 - 2018-01-19 16:27 - 000000000 ____D C:\WINDOWS\system32\wo-SN
2018-01-19 16:25 - 2018-01-19 16:27 - 000000000 ____D C:\WINDOWS\system32\vi-VN
2018-01-19 16:25 - 2018-01-19 16:27 - 000000000 ____D C:\WINDOWS\system32\uz-Latn-UZ
2018-01-19 16:25 - 2018-01-19 16:27 - 000000000 ____D C:\WINDOWS\system32\ur-PK
2018-01-19 16:25 - 2018-01-19 16:27 - 000000000 ____D C:\WINDOWS\system32\ug-CN
2018-01-19 16:25 - 2018-01-19 16:27 - 000000000 ____D C:\WINDOWS\system32\tt-RU
2018-01-19 16:25 - 2018-01-19 16:27 - 000000000 ____D C:\WINDOWS\system32\tn-ZA
2018-01-19 16:25 - 2018-01-19 16:27 - 000000000 ____D C:\WINDOWS\system32\tk-TM
2018-01-19 16:25 - 2018-01-19 16:27 - 000000000 ____D C:\WINDOWS\system32\ti-ET
2018-01-19 16:25 - 2018-01-19 16:27 - 000000000 ____D C:\WINDOWS\system32\tg-Cyrl-TJ
2018-01-19 16:25 - 2018-01-19 16:27 - 000000000 ____D C:\WINDOWS\system32\te-IN
2018-01-19 16:25 - 2018-01-19 16:27 - 000000000 ____D C:\WINDOWS\system32\ta-IN
2018-01-19 16:25 - 2018-01-19 16:27 - 000000000 ____D C:\WINDOWS\system32\sw-KE
2018-01-19 16:25 - 2018-01-19 16:27 - 000000000 ____D C:\WINDOWS\system32\sr-Cyrl-RS
2018-01-19 16:25 - 2018-01-19 16:27 - 000000000 ____D C:\WINDOWS\system32\sr-Cyrl-BA
2018-01-19 16:25 - 2018-01-19 16:27 - 000000000 ____D C:\WINDOWS\system32\sq-AL
2018-01-19 16:25 - 2018-01-19 16:27 - 000000000 ____D C:\WINDOWS\system32\si-LK
2018-01-19 16:25 - 2018-01-19 16:27 - 000000000 ____D C:\WINDOWS\system32\sd-Arab-PK
2018-01-19 16:25 - 2018-01-19 16:27 - 000000000 ____D C:\WINDOWS\system32\rw-RW
2018-01-19 16:25 - 2018-01-19 16:27 - 000000000 ____D C:\WINDOWS\system32\quz-PE
2018-01-19 16:25 - 2018-01-19 16:27 - 000000000 ____D C:\WINDOWS\system32\quc-Latn-GT
2018-01-19 16:25 - 2018-01-19 16:27 - 000000000 ____D C:\WINDOWS\system32\prs-AF
2018-01-19 16:25 - 2018-01-19 16:27 - 000000000 ____D C:\WINDOWS\system32\pa-IN
2018-01-19 16:25 - 2018-01-19 16:27 - 000000000 ____D C:\WINDOWS\system32\pa-Arab-PK
2018-01-19 16:25 - 2018-01-19 16:27 - 000000000 ____D C:\WINDOWS\system32\or-IN
2018-01-19 16:25 - 2018-01-19 16:27 - 000000000 ____D C:\WINDOWS\system32\nso-ZA
2018-01-19 16:25 - 2018-01-19 16:27 - 000000000 ____D C:\WINDOWS\system32\nn-NO
2018-01-19 16:25 - 2018-01-19 16:27 - 000000000 ____D C:\WINDOWS\system32\ne-NP
2018-01-19 16:25 - 2018-01-19 16:27 - 000000000 ____D C:\WINDOWS\system32\mt-MT
2018-01-19 16:25 - 2018-01-19 16:27 - 000000000 ____D C:\WINDOWS\system32\mr-IN
2018-01-19 16:25 - 2018-01-19 16:27 - 000000000 ____D C:\WINDOWS\system32\mn-MN
2018-01-19 16:25 - 2018-01-19 16:27 - 000000000 ____D C:\WINDOWS\system32\ml-IN
2018-01-19 16:25 - 2018-01-19 16:27 - 000000000 ____D C:\WINDOWS\system32\mk-MK
2018-01-19 16:25 - 2018-01-19 16:27 - 000000000 ____D C:\WINDOWS\system32\mi-NZ
2018-01-19 16:25 - 2018-01-19 16:27 - 000000000 ____D C:\WINDOWS\system32\lo-LA
2018-01-19 16:25 - 2018-01-19 16:27 - 000000000 ____D C:\WINDOWS\system32\lb-LU
2018-01-19 16:25 - 2018-01-19 16:27 - 000000000 ____D C:\WINDOWS\system32\ky-KG
2018-01-19 16:25 - 2018-01-19 16:27 - 000000000 ____D C:\WINDOWS\system32\ku-Arab-IQ
2018-01-19 16:25 - 2018-01-19 16:27 - 000000000 ____D C:\WINDOWS\system32\kok-IN
2018-01-19 16:25 - 2018-01-19 16:27 - 000000000 ____D C:\WINDOWS\system32\kn-IN
2018-01-19 16:25 - 2018-01-19 16:27 - 000000000 ____D C:\WINDOWS\system32\km-KH
2018-01-19 16:25 - 2018-01-19 16:27 - 000000000 ____D C:\WINDOWS\system32\kk-KZ
2018-01-19 16:25 - 2018-01-19 16:27 - 000000000 ____D C:\WINDOWS\system32\ka-GE
2018-01-19 16:25 - 2018-01-19 16:27 - 000000000 ____D C:\WINDOWS\system32\is-IS
2018-01-19 16:25 - 2018-01-19 16:27 - 000000000 ____D C:\WINDOWS\system32\ig-NG
2018-01-19 16:25 - 2018-01-19 16:27 - 000000000 ____D C:\WINDOWS\system32\id-ID
2018-01-19 16:25 - 2018-01-19 16:27 - 000000000 ____D C:\WINDOWS\system32\hy-AM
2018-01-19 16:25 - 2018-01-19 16:27 - 000000000 ____D C:\WINDOWS\system32\ha-Latn-NG
2018-01-19 16:25 - 2018-01-19 16:27 - 000000000 ____D C:\WINDOWS\system32\gu-IN
2018-01-19 16:25 - 2018-01-19 16:27 - 000000000 ____D C:\WINDOWS\system32\gd-GB
2018-01-19 16:25 - 2018-01-19 16:27 - 000000000 ____D C:\WINDOWS\system32\ga-IE
2018-01-19 16:25 - 2018-01-19 16:27 - 000000000 ____D C:\WINDOWS\system32\fil-PH
2018-01-19 16:25 - 2018-01-19 16:27 - 000000000 ____D C:\WINDOWS\system32\fa-IR
2018-01-19 16:25 - 2018-01-19 16:27 - 000000000 ____D C:\WINDOWS\system32\cy-GB
2018-01-19 16:25 - 2018-01-19 16:27 - 000000000 ____D C:\WINDOWS\system32\chr-CHER-US
2018-01-19 16:25 - 2018-01-19 16:27 - 000000000 ____D C:\WINDOWS\system32\ca-ES-valencia
2018-01-19 16:25 - 2018-01-19 16:27 - 000000000 ____D C:\WINDOWS\system32\bs-Latn-BA
2018-01-19 16:25 - 2018-01-19 16:27 - 000000000 ____D C:\WINDOWS\system32\bn-IN
2018-01-19 16:25 - 2018-01-19 16:27 - 000000000 ____D C:\WINDOWS\system32\bn-BD
2018-01-19 16:25 - 2018-01-19 16:27 - 000000000 ____D C:\WINDOWS\system32\be-BY
2018-01-19 16:25 - 2018-01-19 16:27 - 000000000 ____D C:\WINDOWS\system32\az-Latn-AZ
2018-01-19 16:25 - 2018-01-19 16:27 - 000000000 ____D C:\WINDOWS\system32\as-IN
2018-01-19 16:25 - 2018-01-19 16:27 - 000000000 ____D C:\WINDOWS\system32\am-ET
2018-01-19 16:25 - 2018-01-19 16:27 - 000000000 ____D C:\WINDOWS\system32\af-ZA
2018-01-19 16:25 - 2018-01-19 16:25 - 000000000 ____D C:\WINDOWS\SysWOW64\winrm
2018-01-19 16:25 - 2018-01-19 16:25 - 000000000 ____D C:\WINDOWS\SysWOW64\WCN
2018-01-19 16:25 - 2018-01-19 16:25 - 000000000 ____D C:\WINDOWS\SysWOW64\sysprep
2018-01-19 16:25 - 2018-01-19 16:25 - 000000000 ____D C:\WINDOWS\SysWOW64\slmgr
2018-01-19 16:25 - 2018-01-19 16:25 - 000000000 ____D C:\WINDOWS\SysWOW64\Printing_Admin_Scripts
2018-01-19 16:25 - 2018-01-19 16:25 - 000000000 ____D C:\WINDOWS\SysWOW64\MailContactsCalendarSync
2018-01-19 16:25 - 2018-01-19 16:25 - 000000000 ____D C:\WINDOWS\SysWOW64\hi-IN
2018-01-19 16:25 - 2018-01-19 16:25 - 000000000 ____D C:\WINDOWS\SysWOW64\gl-ES
2018-01-19 16:25 - 2018-01-19 16:25 - 000000000 ____D C:\WINDOWS\SysWOW64\eu-ES
2018-01-19 16:25 - 2018-01-19 16:25 - 000000000 ____D C:\WINDOWS\SysWOW64\ca-ES
2018-01-19 16:25 - 2018-01-19 16:25 - 000000000 ____D C:\WINDOWS\SysWOW64\0409
2018-01-19 16:25 - 2018-01-19 16:25 - 000000000 ____D C:\WINDOWS\system32\winrm
2018-01-19 16:25 - 2018-01-19 16:25 - 000000000 ____D C:\WINDOWS\system32\WCN
2018-01-19 16:25 - 2018-01-19 16:25 - 000000000 ____D C:\WINDOWS\system32\slmgr
2018-01-19 16:25 - 2018-01-19 16:25 - 000000000 ____D C:\WINDOWS\system32\Printing_Admin_Scripts
2018-01-19 16:25 - 2018-01-19 16:25 - 000000000 ____D C:\WINDOWS\system32\MailContactsCalendarSync
2018-01-19 16:25 - 2018-01-19 16:25 - 000000000 ____D C:\WINDOWS\system32\hi-IN
2018-01-19 16:25 - 2018-01-19 16:25 - 000000000 ____D C:\WINDOWS\system32\gl-ES
2018-01-19 16:25 - 2018-01-19 16:25 - 000000000 ____D C:\WINDOWS\system32\eu-ES
2018-01-19 16:25 - 2018-01-19 16:25 - 000000000 ____D C:\WINDOWS\system32\ca-ES
2018-01-19 16:25 - 2018-01-19 16:25 - 000000000 ____D C:\WINDOWS\system32\0409
2018-01-19 16:25 - 2018-01-19 16:25 - 000000000 ____D C:\WINDOWS\OCR
2018-01-19 16:25 - 2018-01-19 16:25 - 000000000 ____D C:\WINDOWS\DigitalLocker
2018-01-19 16:25 - 2018-01-19 16:25 - 000000000 ____D C:\Program Files\Reference Assemblies
2018-01-19 16:25 - 2018-01-19 16:25 - 000000000 ____D C:\Program Files\MSBuild
2018-01-19 16:25 - 2018-01-19 16:25 - 000000000 ____D C:\Program Files (x86)\Reference Assemblies
2018-01-19 16:25 - 2018-01-19 16:25 - 000000000 ____D C:\Program Files (x86)\MSBuild
2018-01-19 16:24 - 2017-12-22 05:45 - 000835576 _____ (Adobe Systems Incorporated) C:\WINDOWS\SysWOW64\FlashPlayerApp.exe
2018-01-19 16:24 - 2017-12-22 05:45 - 000177648 _____ (Adobe Systems Incorporated) C:\WINDOWS\SysWOW64\FlashPlayerCPLApp.cpl
2018-01-19 16:22 - 2018-01-19 17:44 - 000000000 ____D C:\WINDOWS\AppReadiness
2018-01-19 16:22 - 2018-01-19 17:43 - 000000000 ___HD C:\Program Files\WindowsApps
2018-01-19 16:22 - 2018-01-19 17:43 - 000000000 ____D C:\WINDOWS\DeliveryOptimization
2018-01-19 16:22 - 2018-01-19 17:03 - 000000000 ___HD C:\WINDOWS\ELAMBKUP
2018-01-19 16:22 - 2018-01-19 17:02 - 000000000 ___RD C:\Program Files (x86)
2018-01-19 16:22 - 2018-01-19 16:52 - 000000000 ____D C:\WINDOWS\system32\WinBioDatabase
2018-01-19 16:22 - 2018-01-19 16:52 - 000000000 ____D C:\WINDOWS\Registration
2018-01-19 16:22 - 2018-01-19 16:51 - 000000000 __RHD C:\Users\Public\Libraries
2018-01-19 16:22 - 2018-01-19 16:51 - 000000000 ____D C:\WINDOWS\system32\FxsTmp
2018-01-19 16:22 - 2018-01-19 16:49 - 000000000 ____D C:\WINDOWS\system32\spool
2018-01-19 16:22 - 2018-01-19 16:49 - 000000000 ____D C:\ProgramData\USOPrivate
2018-01-19 16:22 - 2018-01-19 16:49 - 000000000 ____D C:\ProgramData\regid.1991-06.com.microsoft
2018-01-19 16:22 - 2018-01-19 16:48 - 000000000 ____D C:\WINDOWS\system32\Sysprep
2018-01-19 16:22 - 2018-01-19 16:48 - 000000000 ____D C:\WINDOWS\appcompat
2018-01-19 16:22 - 2018-01-19 16:48 - 000000000 ____D C:\Program Files\Common Files\microsoft shared
2018-01-19 16:22 - 2018-01-19 16:47 - 000000000 ___RD C:\WINDOWS\PrintDialog
2018-01-19 16:22 - 2018-01-19 16:47 - 000000000 ___RD C:\WINDOWS\ImmersiveControlPanel
2018-01-19 16:22 - 2018-01-19 16:28 - 000028672 _____ C:\WINDOWS\system32\config\BCD-Template
2018-01-19 16:22 - 2018-01-19 16:28 - 000000000 ____D C:\WINDOWS\system32\oobe
2018-01-19 16:22 - 2018-01-19 16:27 - 000000000 ___SD C:\WINDOWS\SysWOW64\F12
2018-01-19 16:22 - 2018-01-19 16:27 - 000000000 ___SD C:\WINDOWS\system32\F12
2018-01-19 16:22 - 2018-01-19 16:27 - 000000000 ____D C:\WINDOWS\TextInput
2018-01-19 16:22 - 2018-01-19 16:27 - 000000000 ____D C:\WINDOWS\SysWOW64\WinMetadata
2018-01-19 16:22 - 2018-01-19 16:27 - 000000000 ____D C:\WINDOWS\SysWOW64\Dism
2018-01-19 16:22 - 2018-01-19 16:27 - 000000000 ____D C:\WINDOWS\system32\WinMetadata
2018-01-19 16:22 - 2018-01-19 16:27 - 000000000 ____D C:\WINDOWS\system32\WinBioPlugIns
2018-01-19 16:22 - 2018-01-19 16:27 - 000000000 ____D C:\WINDOWS\system32\migwiz
2018-01-19 16:22 - 2018-01-19 16:27 - 000000000 ____D C:\WINDOWS\system32\Dism
2018-01-19 16:22 - 2018-01-19 16:27 - 000000000 ____D C:\WINDOWS\system32\appraiser
2018-01-19 16:22 - 2018-01-19 16:27 - 000000000 ____D C:\WINDOWS\ShellExperiences
2018-01-19 16:22 - 2018-01-19 16:27 - 000000000 ____D C:\WINDOWS\Provisioning
2018-01-19 16:22 - 2018-01-19 16:27 - 000000000 ____D C:\Program Files\Windows Defender
2018-01-19 16:22 - 2018-01-19 16:25 - 000000000 ___SD C:\WINDOWS\SysWOW64\DiagSvcs
2018-01-19 16:22 - 2018-01-19 16:25 - 000000000 ___SD C:\WINDOWS\system32\dsc
2018-01-19 16:22 - 2018-01-19 16:25 - 000000000 ___SD C:\WINDOWS\system32\DiagSvcs
2018-01-19 16:22 - 2018-01-19 16:25 - 000000000 ____D C:\WINDOWS\SysWOW64\setup
2018-01-19 16:22 - 2018-01-19 16:25 - 000000000 ____D C:\WINDOWS\SysWOW64\oobe
2018-01-19 16:22 - 2018-01-19 16:25 - 000000000 ____D C:\WINDOWS\SysWOW64\MUI
2018-01-19 16:22 - 2018-01-19 16:25 - 000000000 ____D C:\WINDOWS\SysWOW64\com
2018-01-19 16:22 - 2018-01-19 16:25 - 000000000 ____D C:\WINDOWS\system32\SystemResetPlatform
2018-01-19 16:22 - 2018-01-19 16:25 - 000000000 ____D C:\WINDOWS\system32\setup
2018-01-19 16:22 - 2018-01-19 16:25 - 000000000 ____D C:\WINDOWS\system32\MUI
2018-01-19 16:22 - 2018-01-19 16:25 - 000000000 ____D C:\WINDOWS\system32\com
2018-01-19 16:22 - 2018-01-19 16:25 - 000000000 ____D C:\WINDOWS\PolicyDefinitions
2018-01-19 16:22 - 2018-01-19 16:25 - 000000000 ____D C:\WINDOWS\IME
2018-01-19 16:22 - 2018-01-19 16:25 - 000000000 ____D C:\WINDOWS\Help
2018-01-19 16:22 - 2018-01-19 16:25 - 000000000 ____D C:\Program Files\Windows Photo Viewer
2018-01-19 16:22 - 2018-01-19 16:25 - 000000000 ____D C:\Program Files\Common Files\system
2018-01-19 16:22 - 2018-01-19 16:25 - 000000000 ____D C:\Program Files (x86)\Windows Photo Viewer
2018-01-19 16:22 - 2018-01-19 16:25 - 000000000 ____D C:\Program Files (x86)\Windows Defender
2018-01-19 16:22 - 2018-01-19 16:22 - 000000000 __SHD C:\Program Files\Windows Sidebar
2018-01-19 16:22 - 2018-01-19 16:22 - 000000000 __SHD C:\Program Files (x86)\Windows Sidebar
2018-01-19 16:22 - 2018-01-19 16:22 - 000000000 __RSD C:\WINDOWS\media
2018-01-19 16:22 - 2018-01-19 16:22 - 000000000 ___SD C:\WINDOWS\SysWOW64\Nui
2018-01-19 16:22 - 2018-01-19 16:22 - 000000000 ___SD C:\WINDOWS\SysWOW64\Configuration
2018-01-19 16:22 - 2018-01-19 16:22 - 000000000 ___SD C:\WINDOWS\system32\UNP
2018-01-19 16:22 - 2018-01-19 16:22 - 000000000 ___SD C:\WINDOWS\system32\Nui
2018-01-19 16:22 - 2018-01-19 16:22 - 000000000 ___SD C:\WINDOWS\system32\Configuration
2018-01-19 16:22 - 2018-01-19 16:22 - 000000000 ___SD C:\WINDOWS\Downloaded Program Files
2018-01-19 16:22 - 2018-01-19 16:22 - 000000000 ___RD C:\WINDOWS\Offline Web Pages
2018-01-19 16:22 - 2018-01-19 16:22 - 000000000 ____D C:\WINDOWS\Web
2018-01-19 16:22 - 2018-01-19 16:22 - 000000000 ____D C:\WINDOWS\Vss
2018-01-19 16:22 - 2018-01-19 16:22 - 000000000 ____D C:\WINDOWS\tracing
2018-01-19 16:22 - 2018-01-19 16:22 - 000000000 ____D C:\WINDOWS\TAPI
2018-01-19 16:22 - 2018-01-19 16:22 - 000000000 ____D C:\WINDOWS\SysWOW64\SMI
2018-01-19 16:22 - 2018-01-19 16:22 - 000000000 ____D C:\WINDOWS\SysWOW64\ras
2018-01-19 16:22 - 2018-01-19 16:22 - 000000000 ____D C:\WINDOWS\SysWOW64\NDF
2018-01-19 16:22 - 2018-01-19 16:22 - 000000000 ____D C:\WINDOWS\SysWOW64\Msdtc
2018-01-19 16:22 - 2018-01-19 16:22 - 000000000 ____D C:\WINDOWS\SysWOW64\migwiz
2018-01-19 16:22 - 2018-01-19 16:22 - 000000000 ____D C:\WINDOWS\SysWOW64\Macromed
2018-01-19 16:22 - 2018-01-19 16:22 - 000000000 ____D C:\WINDOWS\SysWOW64\Ipmi
2018-01-19 16:22 - 2018-01-19 16:22 - 000000000 ____D C:\WINDOWS\SysWOW64\InputMethod
2018-01-19 16:22 - 2018-01-19 16:22 - 000000000 ____D C:\WINDOWS\SysWOW64\inetsrv
2018-01-19 16:22 - 2018-01-19 16:22 - 000000000 ____D C:\WINDOWS\SysWOW64\IME
2018-01-19 16:22 - 2018-01-19 16:22 - 000000000 ____D C:\WINDOWS\SysWOW64\icsxml
2018-01-19 16:22 - 2018-01-19 16:22 - 000000000 ____D C:\WINDOWS\SysWOW64\GroupPolicyUsers
2018-01-19 16:22 - 2018-01-19 16:22 - 000000000 ____D C:\WINDOWS\SysWOW64\GroupPolicy
2018-01-19 16:22 - 2018-01-19 16:22 - 000000000 ____D C:\WINDOWS\SysWOW64\FxsTmp
2018-01-19 16:22 - 2018-01-19 16:22 - 000000000 ____D C:\WINDOWS\SysWOW64\downlevel
2018-01-19 16:22 - 2018-01-19 16:22 - 000000000 ____D C:\WINDOWS\SysWOW64\Bthprops
2018-01-19 16:22 - 2018-01-19 16:22 - 000000000 ____D C:\WINDOWS\SysWOW64\AppLocker
2018-01-19 16:22 - 2018-01-19 16:22 - 000000000 ____D C:\WINDOWS\SysWOW64\AdvancedInstallers
2018-01-19 16:22 - 2018-01-19 16:22 - 000000000 ____D C:\WINDOWS\SystemResources
2018-01-19 16:22 - 2018-01-19 16:22 - 000000000 ____D C:\WINDOWS\SystemApps
2018-01-19 16:22 - 2018-01-19 16:22 - 000000000 ____D C:\WINDOWS\system32\winevt
2018-01-19 16:22 - 2018-01-19 16:22 - 000000000 ____D C:\WINDOWS\system32\SecureBootUpdates
2018-01-19 16:22 - 2018-01-19 16:22 - 000000000 ____D C:\WINDOWS\system32\ras
2018-01-19 16:22 - 2018-01-19 16:22 - 000000000 ____D C:\WINDOWS\system32\ProximityToast
2018-01-19 16:22 - 2018-01-19 16:22 - 000000000 ____D C:\WINDOWS\system32\PointOfService
2018-01-19 16:22 - 2018-01-19 16:22 - 000000000 ____D C:\WINDOWS\system32\NDF
2018-01-19 16:22 - 2018-01-19 16:22 - 000000000 ____D C:\WINDOWS\system32\MsDtc
2018-01-19 16:22 - 2018-01-19 16:22 - 000000000 ____D C:\WINDOWS\system32\Macromed
2018-01-19 16:22 - 2018-01-19 16:22 - 000000000 ____D C:\WINDOWS\system32\Ipmi
2018-01-19 16:22 - 2018-01-19 16:22 - 000000000 ____D C:\WINDOWS\system32\InputMethod
2018-01-19 16:22 - 2018-01-19 16:22 - 000000000 ____D C:\WINDOWS\system32\inetsrv
2018-01-19 16:22 - 2018-01-19 16:22 - 000000000 ____D C:\WINDOWS\system32\IME
2018-01-19 16:22 - 2018-01-19 16:22 - 000000000 ____D C:\WINDOWS\system32\icsxml
2018-01-19 16:22 - 2018-01-19 16:22 - 000000000 ____D C:\WINDOWS\system32\ias
2018-01-19 16:22 - 2018-01-19 16:22 - 000000000 ____D C:\WINDOWS\system32\hydrogen
2018-01-19 16:22 - 2018-01-19 16:22 - 000000000 ____D C:\WINDOWS\system32\GroupPolicyUsers
2018-01-19 16:22 - 2018-01-19 16:22 - 000000000 ____D C:\WINDOWS\system32\GroupPolicy
2018-01-19 16:22 - 2018-01-19 16:22 - 000000000 ____D C:\WINDOWS\system32\downlevel
2018-01-19 16:22 - 2018-01-19 16:22 - 000000000 ____D C:\WINDOWS\system32\DDFs
2018-01-19 16:22 - 2018-01-19 16:22 - 000000000 ____D C:\WINDOWS\system32\config\TxR
2018-01-19 16:22 - 2018-01-19 16:22 - 000000000 ____D C:\WINDOWS\system32\config\systemprofile
2018-01-19 16:22 - 2018-01-19 16:22 - 000000000 ____D C:\WINDOWS\system32\config\RegBack
2018-01-19 16:22 - 2018-01-19 16:22 - 000000000 ____D C:\WINDOWS\system32\config\Journal
2018-01-19 16:22 - 2018-01-19 16:22 - 000000000 ____D C:\WINDOWS\system32\Bthprops
2018-01-19 16:22 - 2018-01-19 16:22 - 000000000 ____D C:\WINDOWS\system32\AppLocker
2018-01-19 16:22 - 2018-01-19 16:22 - 000000000 ____D C:\WINDOWS\system32\AdvancedInstallers
2018-01-19 16:22 - 2018-01-19 16:22 - 000000000 ____D C:\WINDOWS\System
2018-01-19 16:22 - 2018-01-19 16:22 - 000000000 ____D C:\WINDOWS\SKB
2018-01-19 16:22 - 2018-01-19 16:22 - 000000000 ____D C:\WINDOWS\security
2018-01-19 16:22 - 2018-01-19 16:22 - 000000000 ____D C:\WINDOWS\schemas
2018-01-19 16:22 - 2018-01-19 16:22 - 000000000 ____D C:\WINDOWS\SchCache
2018-01-19 16:22 - 2018-01-19 16:22 - 000000000 ____D C:\WINDOWS\Resources
2018-01-19 16:22 - 2018-01-19 16:22 - 000000000 ____D C:\WINDOWS\rescache
2018-01-19 16:22 - 2018-01-19 16:22 - 000000000 ____D C:\WINDOWS\PLA
2018-01-19 16:22 - 2018-01-19 16:22 - 000000000 ____D C:\WINDOWS\Performance
2018-01-19 16:22 - 2018-01-19 16:22 - 000000000 ____D C:\WINDOWS\ModemLogs
2018-01-19 16:22 - 2018-01-19 16:22 - 000000000 ____D C:\WINDOWS\LiveKernelReports
2018-01-19 16:22 - 2018-01-19 16:22 - 000000000 ____D C:\WINDOWS\L2Schemas
2018-01-19 16:22 - 2018-01-19 16:22 - 000000000 ____D C:\WINDOWS\InputMethod
2018-01-19 16:22 - 2018-01-19 16:22 - 000000000 ____D C:\WINDOWS\Globalization
2018-01-19 16:22 - 2018-01-19 16:22 - 000000000 ____D C:\WINDOWS\GameBarPresenceWriter
2018-01-19 16:22 - 2018-01-19 16:22 - 000000000 ____D C:\WINDOWS\Cursors
2018-01-19 16:22 - 2018-01-19 16:22 - 000000000 ____D C:\WINDOWS\Branding
2018-01-19 16:22 - 2018-01-19 16:22 - 000000000 ____D C:\WINDOWS\bcastdvr
2018-01-19 16:22 - 2018-01-19 16:22 - 000000000 ____D C:\WINDOWS\addins
2018-01-19 16:22 - 2018-01-19 16:22 - 000000000 ____D C:\ProgramData\WindowsHolographicDevices
2018-01-19 16:22 - 2018-01-19 16:22 - 000000000 ____D C:\Program Files\Windows Security
2018-01-19 16:22 - 2018-01-19 16:22 - 000000000 ____D C:\Program Files\Windows Portable Devices
2018-01-19 16:22 - 2018-01-19 16:22 - 000000000 ____D C:\Program Files\windows nt
2018-01-19 16:22 - 2018-01-19 16:22 - 000000000 ____D C:\Program Files\Windows Multimedia Platform
2018-01-19 16:22 - 2018-01-19 16:22 - 000000000 ____D C:\Program Files\Common Files\Services
2018-01-19 16:22 - 2018-01-19 16:22 - 000000000 ____D C:\Program Files (x86)\Windows Portable Devices
2018-01-19 16:22 - 2018-01-19 16:22 - 000000000 ____D C:\Program Files (x86)\windows nt
2018-01-19 16:22 - 2018-01-19 16:22 - 000000000 ____D C:\Program Files (x86)\Windows Multimedia Platform
2018-01-19 16:22 - 2018-01-19 16:21 - 000229376 _____ (Microsoft Corporation) C:\WINDOWS\system32\msclmd.dll
2018-01-19 16:22 - 2018-01-19 16:21 - 000215943 _____ C:\WINDOWS\SysWOW64\dssec.dat
2018-01-19 16:22 - 2018-01-19 16:21 - 000215943 _____ C:\WINDOWS\system32\dssec.dat
2018-01-19 16:22 - 2018-01-19 16:21 - 000208384 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\msclmd.dll
2018-01-19 16:22 - 2018-01-19 16:21 - 000017572 _____ C:\WINDOWS\system32\OEMDefaultAssociations.xml
2018-01-19 16:22 - 2018-01-19 16:21 - 000004096 _____ C:\WINDOWS\system32\config\VSMIDK
2018-01-19 16:22 - 2018-01-19 16:21 - 000003683 _____ C:\WINDOWS\system32\Drivers\etc\lmhosts.sam
2018-01-19 16:22 - 2018-01-19 16:21 - 000000858 _____ C:\WINDOWS\system32\DefaultQuestions.json
2018-01-19 16:22 - 2018-01-19 16:21 - 000000741 _____ C:\WINDOWS\SysWOW64\NOISE.DAT
2018-01-19 16:22 - 2018-01-19 16:21 - 000000741 _____ C:\WINDOWS\system32\NOISE.DAT
2018-01-19 16:21 - 2018-01-19 16:59 - 000000000 ____D C:\WINDOWS\INF
2018-01-19 16:20 - 2018-01-19 17:14 - 000000000 ____D C:\WINDOWS\CbsTemp
2018-01-19 16:19 - 2018-01-19 18:04 - 077594624 _____ C:\WINDOWS\system32\config\SOFTWARE
2018-01-19 16:19 - 2018-01-19 18:04 - 020185088 _____ C:\WINDOWS\system32\config\SYSTEM
2018-01-19 16:19 - 2018-01-19 18:04 - 000524288 _____ C:\WINDOWS\system32\config\DEFAULT
2018-01-19 16:19 - 2018-01-19 18:04 - 000524288 _____ C:\WINDOWS\system32\config\BBI
2018-01-19 16:19 - 2018-01-19 18:04 - 000032768 _____ C:\WINDOWS\system32\config\SECURITY
2018-01-19 16:19 - 2018-01-19 17:03 - 000032768 _____ C:\WINDOWS\system32\config\ELAM
2018-01-19 16:19 - 2018-01-19 16:52 - 000000000 ____D C:\WINDOWS\Panther
2018-01-19 16:19 - 2018-01-19 16:25 - 000000000 ____D C:\WINDOWS\servicing
2018-01-19 16:19 - 2018-01-19 16:24 - 000131072 _____ C:\WINDOWS\system32\config\SAM
2018-01-19 16:19 - 2018-01-19 16:22 - 000000000 ____D C:\WINDOWS\system32\SMI
2018-01-19 16:15 - 2018-01-19 16:28 - 000000000 ___HD C:\$SysReset
2018-01-08 23:43 - 2018-01-01 04:51 - 001055128 ____N (Microsoft Corporation) C:\WINDOWS\system32\hvax64.exe
2018-01-08 23:43 - 2018-01-01 04:51 - 000059800 ____N (Microsoft Corporation) C:\WINDOWS\system32\Drivers\bam.sys
2018-01-08 23:43 - 2018-01-01 04:49 - 008605080 ____N (Microsoft Corporation) C:\WINDOWS\system32\ntoskrnl.exe
2018-01-08 23:43 - 2018-01-01 04:48 - 001954048 ____N (Microsoft Corporation) C:\WINDOWS\system32\ntdll.dll
2018-01-08 23:43 - 2018-01-01 04:47 - 000082840 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\volmgr.sys
2018-01-08 23:43 - 2018-01-01 04:46 - 002709704 ____N (Microsoft Corporation) C:\WINDOWS\system32\iertutil.dll
2018-01-08 23:43 - 2018-01-01 04:46 - 000471960 ____N (Microsoft Corporation) C:\WINDOWS\system32\hal.dll
2018-01-08 23:43 - 2018-01-01 04:45 - 000398744 ____N (Microsoft Corporation) C:\WINDOWS\system32\Drivers\fltMgr.sys
2018-01-08 23:43 - 2018-01-01 04:42 - 000571288 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\spaceport.sys
2018-01-08 23:43 - 2018-01-01 04:39 - 000902416 ____N (Microsoft Corporation) C:\WINDOWS\system32\winhttp.dll
2018-01-08 23:43 - 2018-01-01 04:39 - 000362904 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\pci.sys
2018-01-08 23:43 - 2018-01-01 04:39 - 000129432 ____N (Microsoft Corporation) C:\WINDOWS\system32\Drivers\hvsocket.sys
2018-01-08 23:43 - 2018-01-01 04:37 - 001426664 ____N (Microsoft Corporation) C:\WINDOWS\system32\AudioEng.dll
2018-01-08 23:43 - 2018-01-01 04:36 - 000166296 ____N (Microsoft Corporation) C:\WINDOWS\system32\Drivers\partmgr.sys
2018-01-08 23:43 - 2018-01-01 04:35 - 001170008 ____N (Microsoft Corporation) C:\WINDOWS\system32\AudioSes.dll
2018-01-08 23:43 - 2018-01-01 04:34 - 007385088 ____N (Microsoft Corporation) C:\WINDOWS\system32\Windows.Media.Protection.PlayReady.dll
2018-01-08 23:43 - 2018-01-01 04:33 - 000603920 ____N (Microsoft Corporation) C:\WINDOWS\system32\audiodg.exe
2018-01-08 23:43 - 2018-01-01 04:26 - 000428952 ____N (Microsoft Corporation) C:\WINDOWS\system32\Drivers\rdbss.sys
2018-01-08 23:43 - 2018-01-01 04:25 - 000147864 ____N (Microsoft Corporation) C:\WINDOWS\system32\Drivers\wcifs.sys
2018-01-08 23:43 - 2018-01-01 03:53 - 001615712 ____N (Microsoft Corporation) C:\WINDOWS\SysWOW64\ntdll.dll
2018-01-08 23:43 - 2018-01-01 03:45 - 005615968 ____N (Microsoft Corporation) C:\WINDOWS\SysWOW64\d3d10warp.dll
2018-01-08 23:43 - 2018-01-01 03:45 - 002192624 ____N (Microsoft Corporation) C:\WINDOWS\SysWOW64\iertutil.dll
2018-01-08 23:43 - 2018-01-01 03:42 - 006479552 ____N (Microsoft Corporation) C:\WINDOWS\SysWOW64\Windows.Media.Protection.PlayReady.dll
2018-01-08 23:43 - 2018-01-01 03:42 - 004644912 ____N (Microsoft Corporation) C:\WINDOWS\SysWOW64\mfcore.dll
2018-01-08 23:43 - 2018-01-01 03:42 - 001246432 ____N (Microsoft Corporation) C:\WINDOWS\SysWOW64\AudioEng.dll
2018-01-08 23:43 - 2018-01-01 03:42 - 000982528 ____N (Microsoft Corporation) C:\WINDOWS\SysWOW64\AudioSes.dll
2018-01-08 23:43 - 2018-01-01 03:34 - 000703568 ____N (Microsoft Corporation) C:\WINDOWS\SysWOW64\winhttp.dll
2018-01-08 23:43 - 2018-01-01 03:25 - 002905600 ____N (Microsoft Corporation) C:\WINDOWS\SysWOW64\win32kfull.sys
2018-01-08 23:43 - 2018-01-01 03:25 - 000344576 ____N (Microsoft Corporation) C:\WINDOWS\SysWOW64\edgeIso.dll
2018-01-08 23:43 - 2018-01-01 03:24 - 003668480 ____N (Microsoft Corporation) C:\WINDOWS\system32\win32kfull.sys
2018-01-08 23:43 - 2018-01-01 03:24 - 000202240 ____N (Microsoft Corporation) C:\WINDOWS\SysWOW64\AppxAllUserStore.dll
2018-01-08 23:43 - 2018-01-01 03:23 - 000536576 ____N (Microsoft Corporation) C:\WINDOWS\system32\edgeIso.dll
2018-01-08 23:43 - 2018-01-01 03:21 - 000192512 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\netvsc.sys
2018-01-08 23:43 - 2018-01-01 03:20 - 019337216 ____N (Microsoft Corporation) C:\WINDOWS\SysWOW64\mshtml.dll
2018-01-08 23:43 - 2018-01-01 03:20 - 018917888 ____N (Microsoft Corporation) C:\WINDOWS\SysWOW64\edgehtml.dll
2018-01-08 23:43 - 2018-01-01 03:19 - 000369152 ____N (Microsoft Corporation) C:\WINDOWS\SysWOW64\msIso.dll
2018-01-08 23:43 - 2018-01-01 03:19 - 000365568 ____N (Microsoft Corporation) C:\WINDOWS\SysWOW64\ieproxy.dll
2018-01-08 23:43 - 2018-01-01 03:18 - 000374784 ____N (Microsoft Corporation) C:\WINDOWS\SysWOW64\FirewallAPI.dll
2018-01-08 23:43 - 2018-01-01 03:18 - 000261632 ____N (Microsoft Corporation) C:\WINDOWS\SysWOW64\actxprxy.dll
2018-01-08 23:43 - 2018-01-01 03:17 - 011923968 ____N (Microsoft Corporation) C:\WINDOWS\SysWOW64\ieframe.dll
2018-01-08 23:43 - 2018-01-01 03:17 - 000708096 ____N (Microsoft Corporation) C:\WINDOWS\system32\jscript9diag.dll
2018-01-08 23:43 - 2018-01-01 03:17 - 000559104 ____N (Microsoft Corporation) C:\WINDOWS\SysWOW64\jscript9diag.dll
2018-01-08 23:43 - 2018-01-01 03:17 - 000542208 ____N (Microsoft Corporation) C:\WINDOWS\system32\FirewallAPI.dll
2018-01-08 23:43 - 2018-01-01 03:16 - 003676672 ____N (Microsoft Corporation) C:\WINDOWS\SysWOW64\jscript9.dll
2018-01-08 23:43 - 2018-01-01 03:16 - 000815616 ____N (Microsoft Corporation) C:\WINDOWS\system32\ieproxy.dll
2018-01-08 23:43 - 2018-01-01 03:16 - 000664576 ____N (Microsoft Corporation) C:\WINDOWS\SysWOW64\jscript.dll
2018-01-08 23:43 - 2018-01-01 03:16 - 000594944 ____N (Microsoft Corporation) C:\WINDOWS\system32\vbscript.dll
2018-01-08 23:43 - 2018-01-01 03:16 - 000463360 ____N (Microsoft Corporation) C:\WINDOWS\SysWOW64\vbscript.dll
2018-01-08 23:43 - 2018-01-01 03:15 - 012687872 ____N (Microsoft Corporation) C:\WINDOWS\SysWOW64\wmp.dll
2018-01-08 23:43 - 2018-01-01 03:15 - 006029312 ____N (Microsoft Corporation) C:\WINDOWS\SysWOW64\Chakra.dll
2018-01-08 23:43 - 2018-01-01 03:15 - 000588800 ____N (Microsoft Corporation) C:\WINDOWS\system32\actxprxy.dll
2018-01-08 23:43 - 2018-01-01 03:14 - 002465280 ____N (Microsoft Corporation) C:\WINDOWS\SysWOW64\dwmcore.dll
2018-01-08 23:43 - 2018-01-01 03:13 - 012830208 ____N (Microsoft Corporation) C:\WINDOWS\system32\ieframe.dll
2018-01-08 23:43 - 2018-01-01 03:13 - 002869760 ____N (Microsoft Corporation) C:\WINDOWS\SysWOW64\wininet.dll
2018-01-08 23:43 - 2018-01-01 03:12 - 001547776 ____N (Microsoft Corporation) C:\WINDOWS\system32\lsasrv.dll
2018-01-08 23:43 - 2018-01-01 03:11 - 008108544 ____N (Microsoft Corporation) C:\WINDOWS\system32\Chakra.dll
2018-01-08 23:43 - 2018-01-01 03:11 - 004748288 ____N (Microsoft Corporation) C:\WINDOWS\system32\jscript9.dll
2018-01-08 23:43 - 2018-01-01 03:11 - 000812032 ____N (Microsoft Corporation) C:\WINDOWS\system32\jscript.dll
2018-01-08 23:43 - 2018-01-01 03:09 - 001487872 ____N (Microsoft Corporation) C:\WINDOWS\system32\audiosrv.dll
2018-01-08 23:43 - 2018-01-01 03:08 - 000685056 ____N (Microsoft Corporation) C:\WINDOWS\system32\AudioEndpointBuilder.dll
2018-01-08 23:42 - 2018-01-01 09:15 - 000956416 ____N (Microsoft Corporation) C:\WINDOWS\system32\Spectrum.exe
2018-01-08 23:42 - 2018-01-01 04:54 - 000924648 ____N (Microsoft Corporation) C:\WINDOWS\system32\winresume.exe
2018-01-08 23:42 - 2018-01-01 04:53 - 001090984 ____N (Microsoft Corporation) C:\WINDOWS\system32\winresume.efi
2018-01-08 23:42 - 2018-01-01 04:52 - 000066712 ____N (Microsoft Corporation) C:\WINDOWS\system32\iumcrypt.dll
2018-01-08 23:42 - 2018-01-01 04:51 - 001414784 ____N (Microsoft Corporation) C:\WINDOWS\system32\winload.efi
2018-01-08 23:42 - 2018-01-01 04:51 - 001209240 ____N (Microsoft Corporation) C:\WINDOWS\system32\winload.exe
2018-01-08 23:42 - 2018-01-01 04:51 - 000191816 ____N (Microsoft Corporation) C:\WINDOWS\system32\skci.dll
2018-01-08 23:42 - 2018-01-01 04:50 - 005905752 ____N (Microsoft Corporation) C:\WINDOWS\system32\StartTileData.dll
2018-01-08 23:42 - 2018-01-01 04:50 - 000780464 ____N (Microsoft Corporation) C:\WINDOWS\system32\fontdrvhost.exe
2018-01-08 23:42 - 2018-01-01 04:50 - 000479912 ____N (Microsoft Corporation) C:\WINDOWS\system32\ucrtbase_enclave.dll
2018-01-08 23:42 - 2018-01-01 04:50 - 000077208 ____N (Microsoft Corporation) C:\WINDOWS\system32\hvloader.dll
2018-01-08 23:42 - 2018-01-01 04:49 - 000599448 ____N (Microsoft Corporation) C:\WINDOWS\system32\securekernel.exe
2018-01-08 23:42 - 2018-01-01 04:49 - 000319352 ____N (Microsoft Corporation) C:\WINDOWS\system32\wow64.dll
2018-01-08 23:42 - 2018-01-01 04:49 - 000292376 ____N (Microsoft Corporation) C:\WINDOWS\system32\wscapi.dll
2018-01-08 23:42 - 2018-01-01 04:48 - 007831760 ____N (Microsoft Corporation) C:\WINDOWS\system32\d3d10warp.dll
2018-01-08 23:42 - 2018-01-01 04:48 - 000382360 ____N (Adobe Systems Incorporated) C:\WINDOWS\system32\atmfd.dll
2018-01-08 23:42 - 2018-01-01 04:47 - 000649304 ____N (Microsoft Corporation) C:\WINDOWS\system32\advapi32.dll
2018-01-08 23:42 - 2018-01-01 04:46 - 000898216 ____N (Microsoft Corporation) C:\WINDOWS\system32\CoreMessaging.dll
2018-01-08 23:42 - 2018-01-01 04:46 - 000733592 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\acpi.sys
2018-01-08 23:42 - 2018-01-01 04:45 - 002395032 ____N (Microsoft Corporation) C:\WINDOWS\system32\Drivers\ntfs.sys
2018-01-08 23:42 - 2018-01-01 04:45 - 001277848 ____N (Microsoft Corporation) C:\WINDOWS\system32\Drivers\ndis.sys
2018-01-08 23:42 - 2018-01-01 04:43 - 001173576 ____N (Microsoft Corporation) C:\WINDOWS\system32\rpcrt4.dll
2018-01-08 23:42 - 2018-01-01 04:43 - 000367336 ____N (Microsoft Corporation) C:\WINDOWS\system32\Windows.Storage.ApplicationData.dll
2018-01-08 23:42 - 2018-01-01 04:43 - 000062872 ____N (Microsoft Corporation) C:\WINDOWS\system32\Drivers\fsdepends.sys
2018-01-08 23:42 - 2018-01-01 04:42 - 001029016 ____N (Microsoft Corporation) C:\WINDOWS\system32\efscore.dll
2018-01-08 23:42 - 2018-01-01 04:42 - 000494488 ____N (Microsoft Corporation) C:\WINDOWS\system32\pcasvc.dll
2018-01-08 23:42 - 2018-01-01 04:42 - 000184984 ____N (Microsoft Corporation) C:\WINDOWS\system32\sspicli.dll
2018-01-08 23:42 - 2018-01-01 04:42 - 000109976 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\vmbus.sys
2018-01-08 23:42 - 2018-01-01 04:41 - 007676296 ____N (Microsoft Corporation) C:\WINDOWS\system32\windows.storage.dll
2018-01-08 23:42 - 2018-01-01 04:41 - 000559512 ____N (Microsoft Corporation) C:\WINDOWS\system32\Drivers\storport.sys
2018-01-08 23:42 - 2018-01-01 04:41 - 000549552 ____N (Microsoft Corporation) C:\WINDOWS\system32\WWanAPI.dll
2018-01-08 23:42 - 2018-01-01 04:40 - 001206680 ____N (Microsoft Corporation) C:\WINDOWS\system32\hvix64.exe
2018-01-08 23:42 - 2018-01-01 04:39 - 000677784 ____N (Microsoft Corporation) C:\WINDOWS\system32\Drivers\cng.sys
2018-01-08 23:42 - 2018-01-01 04:39 - 000508264 ____N (Microsoft Corporation) C:\WINDOWS\system32\systemreset.exe
2018-01-08 23:42 - 2018-01-01 04:38 - 003904808 ____N (Microsoft Corporation) C:\WINDOWS\explorer.exe
2018-01-08 23:42 - 2018-01-01 04:38 - 000727448 ____N (Microsoft Corporation) C:\WINDOWS\system32\Drivers\fvevol.sys
2018-01-08 23:42 - 2018-01-01 04:38 - 000519152 ____N (Microsoft Corporation) C:\WINDOWS\system32\SecurityHealthService.exe
2018-01-08 23:42 - 2018-01-01 04:38 - 000103320 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\stornvme.sys
2018-01-08 23:42 - 2018-01-01 04:38 - 000038808 ____N (Microsoft Corporation) C:\WINDOWS\system32\Drivers\Diskdump.sys
2018-01-08 23:42 - 2018-01-01 04:37 - 000461720 ____N (Microsoft Corporation) C:\WINDOWS\system32\wifitask.exe
2018-01-08 23:42 - 2018-01-01 04:36 - 000413888 ____N (Microsoft Corporation) C:\WINDOWS\system32\AUDIOKSE.dll
2018-01-08 23:42 - 2018-01-01 04:36 - 000374032 ____N (Microsoft Corporation) C:\WINDOWS\system32\vac.exe
2018-01-08 23:42 - 2018-01-01 04:36 - 000113560 ____N (Microsoft Corporation) C:\WINDOWS\system32\icfupgd.dll
2018-01-08 23:42 - 2018-01-01 04:36 - 000057752 ____N (Microsoft Corporation) C:\WINDOWS\system32\Drivers\netbios.sys
2018-01-08 23:42 - 2018-01-01 04:35 - 000075160 ____N (Microsoft Corporation) C:\WINDOWS\system32\SecurityHealthProxyStub.dll
2018-01-08 23:42 - 2018-01-01 04:34 - 001336344 ____N (Microsoft Corporation) C:\WINDOWS\system32\ole32.dll
2018-01-08 23:42 - 2018-01-01 04:34 - 000260896 ____N (Microsoft Corporation) C:\WINDOWS\system32\mfps.dll
2018-01-08 23:42 - 2018-01-01 04:34 - 000087384 ____N (Microsoft Corporation) C:\WINDOWS\system32\remoteaudioendpoint.dll
2018-01-08 23:42 - 2018-01-01 04:33 - 002773400 ____N (Microsoft Corporation) C:\WINDOWS\system32\Drivers\tcpip.sys
2018-01-08 23:42 - 2018-01-01 04:32 - 004481240 ____N (Microsoft Corporation) C:\WINDOWS\system32\mfcore.dll
2018-01-08 23:42 - 2018-01-01 04:32 - 000617304 ____N (Microsoft Corporation) C:\WINDOWS\system32\TextInputFramework.dll
2018-01-08 23:42 - 2018-01-01 04:27 - 000713624 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\vhdmp.sys
2018-01-08 23:42 - 2018-01-01 04:27 - 000163736 ____N (Microsoft Corporation) C:\WINDOWS\system32\Drivers\wfplwfs.sys
2018-01-08 23:42 - 2018-01-01 04:26 - 000081304 ____N (Microsoft Corporation) C:\WINDOWS\system32\Drivers\vmbkmcl.sys
2018-01-08 23:42 - 2018-01-01 04:25 - 000615768 ____N (Microsoft Corporation) C:\WINDOWS\system32\services.exe
2018-01-08 23:42 - 2018-01-01 04:23 - 021352144 ____N (Microsoft Corporation) C:\WINDOWS\system32\shell32.dll
2018-01-08 23:42 - 2018-01-01 04:21 - 001103768 ____N (Microsoft Corporation) C:\WINDOWS\system32\Drivers\http.sys
2018-01-08 23:42 - 2018-01-01 04:21 - 000614296 ____N (Microsoft Corporation) C:\WINDOWS\system32\Drivers\afd.sys
2018-01-08 23:42 - 2018-01-01 04:06 - 000311192 ____N (Adobe Systems Incorporated) C:\WINDOWS\SysWOW64\atmfd.dll
2018-01-08 23:42 - 2018-01-01 04:03 - 000777904 ____N (Microsoft Corporation) C:\WINDOWS\SysWOW64\rpcrt4.dll
2018-01-08 23:42 - 2018-01-01 04:03 - 000650328 ____N (Microsoft Corporation) C:\WINDOWS\SysWOW64\fontdrvhost.exe
2018-01-08 23:42 - 2018-01-01 04:03 - 000566664 ____N (Microsoft Corporation) C:\WINDOWS\SysWOW64\CoreMessaging.dll
2018-01-08 23:42 - 2018-01-01 04:03 - 000123512 ____N (Microsoft Corporation) C:\WINDOWS\SysWOW64\sspicli.dll
2018-01-08 23:42 - 2018-01-01 03:49 - 000481464 ____N (Microsoft Corporation) C:\WINDOWS\SysWOW64\advapi32.dll
2018-01-08 23:42 - 2018-01-01 03:49 - 000258808 ____N (Microsoft Corporation) C:\WINDOWS\SysWOW64\wscapi.dll
2018-01-08 23:42 - 2018-01-01 03:46 - 003485392 ____N (Microsoft Corporation) C:\WINDOWS\SysWOW64\explorer.exe
2018-01-08 23:42 - 2018-01-01 03:46 - 000289816 ____N (Microsoft Corporation) C:\WINDOWS\SysWOW64\Windows.Storage.ApplicationData.dll
2018-01-08 23:42 - 2018-01-01 03:45 - 006092152 ____N (Microsoft Corporation) C:\WINDOWS\SysWOW64\windows.storage.dll
2018-01-08 23:42 - 2018-01-01 03:45 - 000450928 ____N (Microsoft Corporation) C:\WINDOWS\SysWOW64\WWanAPI.dll
2018-01-08 23:42 - 2018-01-01 03:43 - 020286120 ____N (Microsoft Corporation) C:\WINDOWS\SysWOW64\shell32.dll
2018-01-08 23:42 - 2018-01-01 03:42 - 001003152 ____N (Microsoft Corporation) C:\WINDOWS\SysWOW64\ole32.dll
2018-01-08 23:42 - 2018-01-01 03:42 - 000386424 ____N (Microsoft Corporation) C:\WINDOWS\SysWOW64\AUDIOKSE.dll
2018-01-08 23:42 - 2018-01-01 03:42 - 000129184 ____N (Microsoft Corporation) C:\WINDOWS\SysWOW64\mfps.dll
2018-01-08 23:42 - 2018-01-01 03:42 - 000074992 ____N (Microsoft Corporation) C:\WINDOWS\SysWOW64\remoteaudioendpoint.dll
2018-01-08 23:42 - 2018-01-01 03:37 - 025247232 ____N (Microsoft Corporation) C:\WINDOWS\system32\edgehtml.dll
2018-01-08 23:42 - 2018-01-01 03:25 - 001008640 ____N (Microsoft Corporation) C:\WINDOWS\SysWOW64\InstallService.dll
2018-01-08 23:42 - 2018-01-01 03:25 - 000475648 ____N (Microsoft Corporation) C:\WINDOWS\SysWOW64\ieui.dll
2018-01-08 23:42 - 2018-01-01 03:25 - 000097792 ____N C:\WINDOWS\system32\runexehelper.exe
2018-01-08 23:42 - 2018-01-01 03:24 - 000240640 ____N (Microsoft Corporation) C:\WINDOWS\system32\AboutSettingsHandlers.dll
2018-01-08 23:42 - 2018-01-01 03:24 - 000096256 ____N (Microsoft Corporation) C:\WINDOWS\SysWOW64\fontsub.dll
2018-01-08 23:42 - 2018-01-01 03:24 - 000038912 ____N (Adobe Systems) C:\WINDOWS\SysWOW64\atmlib.dll
2018-01-08 23:42 - 2018-01-01 03:23 - 001313792 ____N (Microsoft Corporation) C:\WINDOWS\system32\InstallService.dll
2018-01-08 23:42 - 2018-01-01 03:23 - 000561152 ____N (Microsoft Corporation) C:\WINDOWS\system32\ieui.dll
2018-01-08 23:42 - 2018-01-01 03:23 - 000385024 ____N (Microsoft Corporation) C:\WINDOWS\system32\Drivers\cldflt.sys
2018-01-08 23:42 - 2018-01-01 03:23 - 000250368 ____N (Microsoft Corporation) C:\WINDOWS\system32\AppxAllUserStore.dll
2018-01-08 23:42 - 2018-01-01 03:23 - 000232960 ____N (Microsoft Corporation) C:\WINDOWS\system32\convertvhd.exe
2018-01-08 23:42 - 2018-01-01 03:23 - 000121344 ____N (Microsoft Corporation) C:\WINDOWS\system32\fontsub.dll
2018-01-08 23:42 - 2018-01-01 03:23 - 000080384 ____N (Microsoft Corporation) C:\WINDOWS\system32\Drivers\vmbkmclr.sys
2018-01-08 23:42 - 2018-01-01 03:23 - 000047104 ____N (Adobe Systems) C:\WINDOWS\system32\atmlib.dll
2018-01-08 23:42 - 2018-01-01 03:22 - 000031744 ____N (Microsoft Corporation) C:\WINDOWS\system32\Windows.Management.Provisioning.ProxyStub.dll
2018-01-08 23:42 - 2018-01-01 03:22 - 000025600 ____N (Microsoft Corporation) C:\WINDOWS\system32\Drivers\Dumpstorport.sys
2018-01-08 23:42 - 2018-01-01 03:22 - 000017408 ____N (Microsoft Corporation) C:\WINDOWS\system32\VmApplicationHealthMonitorProxy.dll
2018-01-08 23:42 - 2018-01-01 03:21 - 000268288 ____N (Microsoft Corporation) C:\WINDOWS\SysWOW64\dxtrans.dll
2018-01-08 23:42 - 2018-01-01 03:21 - 000233984 ____N (Microsoft Corporation) C:\WINDOWS\SysWOW64\AppLockerCSP.dll
2018-01-08 23:42 - 2018-01-01 03:21 - 000133632 ____N (Microsoft Corporation) C:\WINDOWS\system32\wificonnapi.dll
2018-01-08 23:42 - 2018-01-01 03:21 - 000097280 ____N (Microsoft Corporation) C:\WINDOWS\SysWOW64\WcnApi.dll
2018-01-08 23:42 - 2018-01-01 03:21 - 000097280 ____N (Microsoft Corporation) C:\WINDOWS\system32\Drivers\raspptp.sys
2018-01-08 23:42 - 2018-01-01 03:21 - 000080896 ____N (Microsoft Corporation) C:\WINDOWS\system32\Drivers\wanarp.sys
2018-01-08 23:42 - 2018-01-01 03:21 - 000062976 ____N (Microsoft Corporation) C:\WINDOWS\system32\Drivers\ndproxy.sys
2018-01-08 23:42 - 2018-01-01 03:20 - 000524288 ____N (Microsoft Corporation) C:\WINDOWS\system32\daxexec.dll
2018-01-08 23:42 - 2018-01-01 03:20 - 000459776 ____N (Microsoft Corporation) C:\WINDOWS\SysWOW64\webplatstorageserver.dll
2018-01-08 23:42 - 2018-01-01 03:20 - 000397824 ____N (Microsoft Corporation) C:\WINDOWS\SysWOW64\dxtmsft.dll
2018-01-08 23:42 - 2018-01-01 03:20 - 000225792 ____N (Microsoft Corporation) C:\WINDOWS\system32\Drivers\winnat.sys
2018-01-08 23:42 - 2018-01-01 03:20 - 000215552 ____N (Microsoft Corporation) C:\WINDOWS\system32\fwpolicyiomgr.dll
2018-01-08 23:42 - 2018-01-01 03:20 - 000212992 ____N (Microsoft Corporation) C:\WINDOWS\system32\container.dll
2018-01-08 23:42 - 2018-01-01 03:20 - 000204288 ____N (Microsoft Corporation) C:\WINDOWS\system32\provisioningcsp.dll
2018-01-08 23:42 - 2018-01-01 03:20 - 000186368 ____N (Microsoft Corporation) C:\WINDOWS\system32\ACPBackgroundManagerPolicy.dll
2018-01-08 23:42 - 2018-01-01 03:20 - 000175616 ____N (Microsoft Corporation) C:\WINDOWS\SysWOW64\fwpolicyiomgr.dll
2018-01-08 23:42 - 2018-01-01 03:20 - 000134656 ____N (Microsoft Corporation) C:\WINDOWS\system32\WcnApi.dll
2018-01-08 23:42 - 2018-01-01 03:20 - 000133632 ____N (Microsoft Corporation) C:\WINDOWS\SysWOW64\iepeers.dll
2018-01-08 23:42 - 2018-01-01 03:20 - 000104960 ____N (Microsoft Corporation) C:\WINDOWS\system32\rasauto.dll
2018-01-08 23:42 - 2018-01-01 03:20 - 000082432 ____N (Microsoft Corporation) C:\WINDOWS\system32\SCardDlg.dll
2018-01-08 23:42 - 2018-01-01 03:20 - 000043008 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\RfxVmt.sys
2018-01-08 23:42 - 2018-01-01 03:20 - 000035328 ____N (Microsoft Corporation) C:\WINDOWS\SysWOW64\nshhttp.dll
2018-01-08 23:42 - 2018-01-01 03:19 - 008014848 ____N (Microsoft Corporation) C:\WINDOWS\system32\Windows.Data.Pdf.dll
2018-01-08 23:42 - 2018-01-01 03:19 - 000795136 ____N (Microsoft Corporation) C:\WINDOWS\system32\NaturalAuth.dll
2018-01-08 23:42 - 2018-01-01 03:19 - 000675328 ____N (Microsoft Corporation) C:\WINDOWS\system32\webplatstorageserver.dll
2018-01-08 23:42 - 2018-01-01 03:19 - 000461312 ____N (Microsoft Corporation) C:\WINDOWS\system32\wlansec.dll
2018-01-08 23:42 - 2018-01-01 03:19 - 000450048 ____N (Microsoft Corporation) C:\WINDOWS\SysWOW64\TileDataRepository.dll
2018-01-08 23:42 - 2018-01-01 03:19 - 000430080 ____N (Microsoft Corporation) C:\WINDOWS\SysWOW64\Windows.Internal.Bluetooth.dll
2018-01-08 23:42 - 2018-01-01 03:19 - 000416768 ____N (Microsoft Corporation) C:\WINDOWS\system32\html.iec
2018-01-08 23:42 - 2018-01-01 03:19 - 000366080 ____N (Microsoft Corporation) C:\WINDOWS\SysWOW64\daxexec.dll
2018-01-08 23:42 - 2018-01-01 03:19 - 000340480 ____N (Microsoft Corporation) C:\WINDOWS\SysWOW64\html.iec
2018-01-08 23:42 - 2018-01-01 03:19 - 000334848 ____N (Microsoft Corporation) C:\WINDOWS\system32\dusmsvc.dll
2018-01-08 23:42 - 2018-01-01 03:19 - 000316928 ____N (Microsoft Corporation) C:\WINDOWS\system32\Drivers\netbt.sys
2018-01-08 23:42 - 2018-01-01 03:19 - 000188416 ____N (Microsoft Corporation) C:\WINDOWS\system32\PimIndexMaintenance.dll
2018-01-08 23:42 - 2018-01-01 03:19 - 000174592 ____N (Microsoft Corporation) C:\WINDOWS\SysWOW64\P2P.dll
2018-01-08 23:42 - 2018-01-01 03:19 - 000149504 ____N (Microsoft Corporation) C:\WINDOWS\SysWOW64\container.dll
2018-01-08 23:42 - 2018-01-01 03:19 - 000142848 ____N (Microsoft Corporation) C:\WINDOWS\system32\iepeers.dll
2018-01-08 23:42 - 2018-01-01 03:19 - 000097792 ____N (Microsoft Corporation) C:\WINDOWS\SysWOW64\msoert2.dll
2018-01-08 23:42 - 2018-01-01 03:19 - 000093696 ____N (Microsoft Corporation) C:\WINDOWS\system32\mshtmled.dll
2018-01-08 23:42 - 2018-01-01 03:19 - 000079872 ____N (Microsoft Corporation) C:\WINDOWS\system32\nlaapi.dll
2018-01-08 23:42 - 2018-01-01 03:19 - 000073216 ____N (Microsoft Corporation) C:\WINDOWS\system32\provtool.exe
2018-01-08 23:42 - 2018-01-01 03:19 - 000063488 ____N (Microsoft Corporation) C:\WINDOWS\SysWOW64\nlaapi.dll
2018-01-08 23:42 - 2018-01-01 03:19 - 000043008 ____N (Microsoft Corporation) C:\WINDOWS\system32\nshhttp.dll
2018-01-08 23:42 - 2018-01-01 03:18 - 000748032 ____N (Microsoft Corporation) C:\WINDOWS\system32\PhoneProviders.dll
2018-01-08 23:42 - 2018-01-01 03:18 - 000699904 ____N (Microsoft Corporation) C:\WINDOWS\SysWOW64\CPFilters.dll
2018-01-08 23:42 - 2018-01-01 03:18 - 000588800 ____N (Microsoft Corporation) C:\WINDOWS\system32\SmsRouterSvc.dll
2018-01-08 23:42 - 2018-01-01 03:18 - 000465920 ____N (Microsoft Corporation) C:\WINDOWS\system32\wcncsvc.dll
2018-01-08 23:42 - 2018-01-01 03:18 - 000436224 ____N (Microsoft Corporation) C:\WINDOWS\system32\PsmServiceExtHost.dll
2018-01-08 23:42 - 2018-01-01 03:18 - 000432640 ____N (Microsoft Corporation) C:\WINDOWS\system32\provengine.dll
2018-01-08 23:42 - 2018-01-01 03:18 - 000431616 ____N (Microsoft Corporation) C:\WINDOWS\system32\msIso.dll
2018-01-08 23:42 - 2018-01-01 03:18 - 000427008 ____N (Microsoft Corporation) C:\WINDOWS\system32\provhandlers.dll
2018-01-08 23:42 - 2018-01-01 03:18 - 000425984 ____N (Microsoft Corporation) C:\WINDOWS\system32\vmrdvcore.dll
2018-01-08 23:42 - 2018-01-01 03:18 - 000391168 ____N (Microsoft Corporation) C:\WINDOWS\system32\iedkcs32.dll
2018-01-08 23:42 - 2018-01-01 03:18 - 000380928 ____N (Microsoft Corporation) C:\WINDOWS\SysWOW64\EncDec.dll
2018-01-08 23:42 - 2018-01-01 03:18 - 000369664 ____N (Microsoft Corporation) C:\WINDOWS\system32\APHostService.dll
2018-01-08 23:42 - 2018-01-01 03:18 - 000343040 ____N (Microsoft Corporation) C:\WINDOWS\SysWOW64\iedkcs32.dll
2018-01-08 23:42 - 2018-01-01 03:18 - 000336896 ____N (Microsoft Corporation) C:\WINDOWS\system32\AppLockerCSP.dll
2018-01-08 23:42 - 2018-01-01 03:18 - 000276480 ____N (Microsoft Corporation) C:\WINDOWS\system32\dxtrans.dll
2018-01-08 23:42 - 2018-01-01 03:18 - 000259072 ____N (Microsoft Corporation) C:\WINDOWS\system32\SCardSvr.dll
2018-01-08 23:42 - 2018-01-01 03:18 - 000210944 ____N (Microsoft Corporation) C:\WINDOWS\system32\P2P.dll
2018-01-08 23:42 - 2018-01-01 03:18 - 000144896 ____N (Microsoft Corporation) C:\WINDOWS\system32\appinfo.dll
2018-01-08 23:42 - 2018-01-01 03:18 - 000082944 ____N (Microsoft Corporation) C:\WINDOWS\system32\provdatastore.dll
2018-01-08 23:42 - 2018-01-01 03:17 - 006564864 ____N (Microsoft Corporation) C:\WINDOWS\SysWOW64\Windows.Data.Pdf.dll
2018-01-08 23:42 - 2018-01-01 03:17 - 001485312 ____N (Microsoft Corporation) C:\WINDOWS\SysWOW64\rdpserverbase.dll
2018-01-08 23:42 - 2018-01-01 03:17 - 000791552 ____N (Microsoft Corporation) C:\WINDOWS\system32\PhoneService.dll
2018-01-08 23:42 - 2018-01-01 03:17 - 000616960 ____N (Microsoft Corporation) C:\WINDOWS\system32\Windows.Internal.Bluetooth.dll
2018-01-08 23:42 - 2018-01-01 03:17 - 000594432 ____N (Microsoft Corporation) C:\WINDOWS\SysWOW64\Windows.Security.Authentication.Web.Core.dll
2018-01-08 23:42 - 2018-01-01 03:17 - 000568832 ____N (Microsoft Corporation) C:\WINDOWS\system32\TileDataRepository.dll
2018-01-08 23:42 - 2018-01-01 03:17 - 000555520 ____N (Microsoft Corporation) C:\WINDOWS\system32\SensorService.dll
2018-01-08 23:42 - 2018-01-01 03:17 - 000456704 ____N (Microsoft Corporation) C:\WINDOWS\system32\dxtmsft.dll
2018-01-08 23:42 - 2018-01-01 03:17 - 000423936 ____N (Microsoft Corporation) C:\WINDOWS\system32\p2psvc.dll
2018-01-08 23:42 - 2018-01-01 03:17 - 000341504 ____N (Microsoft Corporation) C:\WINDOWS\system32\pnrpsvc.dll
2018-01-08 23:42 - 2018-01-01 03:17 - 000228352 ____N (Microsoft Corporation) C:\WINDOWS\system32\ie4uinit.exe
2018-01-08 23:42 - 2018-01-01 03:17 - 000112640 ____N (Microsoft Corporation) C:\WINDOWS\system32\msoert2.dll
2018-01-08 23:42 - 2018-01-01 03:16 - 005833216 ____N (Microsoft Corporation) C:\WINDOWS\system32\dbgeng.dll
2018-01-08 23:42 - 2018-01-01 03:16 - 004839424 ____N (Microsoft Corporation) C:\WINDOWS\SysWOW64\dbgeng.dll
2018-01-08 23:42 - 2018-01-01 03:16 - 000966656 ____N (Microsoft Corporation) C:\WINDOWS\SysWOW64\Unistore.dll
2018-01-08 23:42 - 2018-01-01 03:16 - 000956928 ____N (Microsoft Corporation) C:\WINDOWS\SysWOW64\rdpbase.dll
2018-01-08 23:42 - 2018-01-01 03:16 - 000831488 ____N (Microsoft Corporation) C:\WINDOWS\system32\Windows.Security.Authentication.Web.Core.dll
2018-01-08 23:42 - 2018-01-01 03:16 - 000812544 ____N (Microsoft Corporation) C:\WINDOWS\system32\bisrv.dll
2018-01-08 23:42 - 2018-01-01 03:16 - 000720896 ____N (Microsoft Corporation) C:\WINDOWS\system32\LogonController.dll
2018-01-08 23:42 - 2018-01-01 03:16 - 000668160 ____N (Microsoft Corporation) C:\WINDOWS\SysWOW64\msfeeds.dll
2018-01-08 23:42 - 2018-01-01 03:16 - 000624128 ____N (Microsoft Corporation) C:\WINDOWS\system32\SyncController.dll
2018-01-08 23:42 - 2018-01-01 03:16 - 000401920 ____N (Microsoft Corporation) C:\WINDOWS\system32\ncsi.dll
2018-01-08 23:42 - 2018-01-01 03:16 - 000235008 ____N (Microsoft Corporation) C:\WINDOWS\SysWOW64\webcheck.dll
2018-01-08 23:42 - 2018-01-01 03:16 - 000086528 ____N (Microsoft Corporation) C:\WINDOWS\system32\cldapi.dll
2018-01-08 23:42 - 2018-01-01 03:16 - 000076288 ____N (Microsoft Corporation) C:\WINDOWS\SysWOW64\cldapi.dll
2018-01-08 23:42 - 2018-01-01 03:15 - 002349568 ____N (Microsoft Corporation) C:\WINDOWS\SysWOW64\InputService.dll
2018-01-08 23:42 - 2018-01-01 03:15 - 001657856 ____N (Microsoft Corporation) C:\WINDOWS\system32\rdpserverbase.dll
2018-01-08 23:42 - 2018-01-01 03:15 - 001245184 ____N (Microsoft Corporation) C:\WINDOWS\system32\Unistore.dll
2018-01-08 23:42 - 2018-01-01 03:15 - 000970240 ____N (Microsoft Corporation) C:\WINDOWS\system32\sysmain.dll
2018-01-08 23:42 - 2018-01-01 03:15 - 000951808 ____N (Microsoft Corporation) C:\WINDOWS\system32\usermgr.dll
2018-01-08 23:42 - 2018-01-01 03:15 - 000756736 ____N (Microsoft Corporation) C:\WINDOWS\system32\msfeeds.dll
2018-01-08 23:42 - 2018-01-01 03:15 - 000434176 ____N (Microsoft Corporation) C:\WINDOWS\system32\EncDec.dll
2018-01-08 23:42 - 2018-01-01 03:15 - 000366080 ____N (Microsoft Corporation) C:\WINDOWS\system32\nlasvc.dll
2018-01-08 23:42 - 2018-01-01 03:15 - 000258560 ____N (Microsoft Corporation) C:\WINDOWS\system32\webcheck.dll
2018-01-08 23:42 - 2018-01-01 03:14 - 023655936 ____N (Microsoft Corporation) C:\WINDOWS\system32\mshtml.dll
2018-01-08 23:42 - 2018-01-01 03:14 - 001495040 ____N (Microsoft Corporation) C:\WINDOWS\system32\AppXDeploymentExtensions.desktop.dll
2018-01-08 23:42 - 2018-01-01 03:14 - 001097728 ____N (Microsoft Corporation) C:\WINDOWS\system32\rdpbase.dll
2018-01-08 23:42 - 2018-01-01 03:14 - 001003008 ____N (Microsoft Corporation) C:\WINDOWS\system32\modernexecserver.dll
2018-01-08 23:42 - 2018-01-01 03:14 - 000985600 ____N (Microsoft Corporation) C:\WINDOWS\system32\inetcomm.dll
2018-01-08 23:42 - 2018-01-01 03:14 - 000917504 ____N (Microsoft Corporation) C:\WINDOWS\SysWOW64\TokenBroker.dll
2018-01-08 23:42 - 2018-01-01 03:14 - 000870912 ____N (Microsoft Corporation) C:\WINDOWS\system32\CPFilters.dll
2018-01-08 23:42 - 2018-01-01 03:13 - 013657600 ____N (Microsoft Corporation) C:\WINDOWS\system32\wmp.dll
2018-01-08 23:42 - 2018-01-01 03:13 - 003121664 ____N (Microsoft Corporation) C:\WINDOWS\system32\Microsoft.Bluetooth.Profiles.Gatt.dll
2018-01-08 23:42 - 2018-01-01 03:13 - 002013184 ____N (Microsoft Corporation) C:\WINDOWS\SysWOW64\inetcpl.cpl
2018-01-08 23:42 - 2018-01-01 03:13 - 001559552 ____N (Microsoft Corporation) C:\WINDOWS\SysWOW64\urlmon.dll
2018-01-08 23:42 - 2018-01-01 03:13 - 001474560 ____N (Microsoft Corporation) C:\WINDOWS\SysWOW64\ieapfltr.dll
2018-01-08 23:42 - 2018-01-01 03:13 - 000897024 ____N (Microsoft Corporation) C:\WINDOWS\SysWOW64\inetcomm.dll
2018-01-08 23:42 - 2018-01-01 03:12 - 002633216 ____N (Microsoft Corporation) C:\WINDOWS\system32\diagtrack.dll
2018-01-08 23:42 - 2018-01-01 03:12 - 002208768 ____N (Microsoft Corporation) C:\WINDOWS\system32\AppXDeploymentExtensions.onecore.dll
2018-01-08 23:42 - 2018-01-01 03:12 - 001573376 ____N (Microsoft Corporation) C:\WINDOWS\system32\UserDataService.dll
2018-01-08 23:42 - 2018-01-01 03:12 - 001424896 ____N (Microsoft Corporation) C:\WINDOWS\system32\wwansvc.dll
2018-01-08 23:42 - 2018-01-01 03:12 - 000760320 ____N (Microsoft Corporation) C:\WINDOWS\system32\spoolsv.exe
2018-01-08 23:42 - 2018-01-01 03:12 - 000464384 ____N (Microsoft Corporation) C:\WINDOWS\SysWOW64\Windows.UI.Core.TextInput.dll
2018-01-08 23:42 - 2018-01-01 03:11 - 003334144 ____N (Microsoft Corporation) C:\WINDOWS\system32\wininet.dll
2018-01-08 23:42 - 2018-01-01 03:11 - 003165696 ____N (Microsoft Corporation) C:\WINDOWS\system32\AppXDeploymentServer.dll
2018-01-08 23:42 - 2018-01-01 03:11 - 002859520 ____N (Microsoft Corporation) C:\WINDOWS\system32\dwmcore.dll
2018-01-08 23:42 - 2018-01-01 03:11 - 002082304 ____N (Microsoft Corporation) C:\WINDOWS\system32\inetcpl.cpl
2018-01-08 23:42 - 2018-01-01 03:11 - 001822208 ____N (Microsoft Corporation) C:\WINDOWS\system32\urlmon.dll
2018-01-08 23:42 - 2018-01-01 03:11 - 001816576 ____N (Microsoft Corporation) C:\WINDOWS\system32\wevtsvc.dll
2018-01-08 23:42 - 2018-01-01 03:11 - 001597952 ____N (Microsoft Corporation) C:\WINDOWS\system32\ieapfltr.dll
2018-01-08 23:42 - 2018-01-01 03:11 - 001343488 ____N (Microsoft Corporation) C:\WINDOWS\system32\wifinetworkmanager.dll
2018-01-08 23:42 - 2018-01-01 03:11 - 001231872 ____N (Microsoft Corporation) C:\WINDOWS\system32\TokenBroker.dll
2018-01-08 23:42 - 2018-01-01 03:11 - 000880640 ____N (Microsoft Corporation) C:\WINDOWS\system32\schedsvc.dll
2018-01-08 23:42 - 2018-01-01 03:11 - 000715776 ____N (Microsoft Corporation) C:\WINDOWS\system32\winlogon.exe
2018-01-08 23:42 - 2018-01-01 03:10 - 003126272 ____N (Microsoft Corporation) C:\WINDOWS\system32\InputService.dll
2018-01-08 23:42 - 2018-01-01 03:10 - 002528256 ____N (Microsoft Corporation) C:\WINDOWS\system32\wlansvc.dll
2018-01-08 23:42 - 2018-01-01 03:10 - 000012800 ____N (Microsoft Corporation) C:\WINDOWS\SysWOW64\wscproxystub.dll
2018-01-08 23:42 - 2018-01-01 03:09 - 000925184 ____N (Microsoft Corporation) C:\WINDOWS\system32\MPSSVC.dll
2018-01-08 23:42 - 2018-01-01 03:09 - 000666624 ____N (Microsoft Corporation) C:\WINDOWS\system32\DbgModel.dll
2018-01-08 23:42 - 2018-01-01 03:09 - 000599552 ____N (Microsoft Corporation) C:\WINDOWS\system32\Windows.UI.Core.TextInput.dll
2018-01-08 23:42 - 2018-01-01 03:08 - 000963072 ____N (Microsoft Corporation) C:\WINDOWS\system32\StorSvc.dll
2018-01-08 23:42 - 2018-01-01 03:08 - 000726016 ____N (Microsoft Corporation) C:\WINDOWS\system32\Drivers\srv2.sys
2018-01-08 23:42 - 2018-01-01 03:08 - 000505344 ____N (Microsoft Corporation) C:\WINDOWS\system32\taskcomp.dll
2018-01-08 23:42 - 2018-01-01 03:06 - 000018944 ____N (Microsoft Corporation) C:\WINDOWS\system32\wscproxystub.dll
2018-01-08 23:42 - 2018-01-01 03:05 - 002510848 ____N (Microsoft Corporation) C:\WINDOWS\system32\ResetEngine.dll
2018-01-08 23:42 - 2018-01-01 03:05 - 001160704 ____N (Microsoft Corporation) C:\WINDOWS\system32\reseteng.dll
2018-01-08 23:42 - 2018-01-01 03:05 - 000050176 ____N (Microsoft Corporation) C:\WINDOWS\system32\pcalua.exe
2017-12-22 12:02 - 2017-09-28 15:50 - 001166520 ____N (Microsoft Corporation) C:\WINDOWS\system32\PresentationNative_v0300.dll
2017-12-22 12:02 - 2017-09-28 15:50 - 000124624 ____N (Microsoft Corporation) C:\WINDOWS\system32\PresentationCFFRasterizerNative_v0300.dll
2017-12-22 12:02 - 2017-09-28 15:50 - 000035456 ____N (Microsoft Corporation) C:\WINDOWS\system32\TsWpfWrp.exe
2017-12-22 12:02 - 2017-09-22 18:19 - 000778936 ____N (Microsoft Corporation) C:\WINDOWS\SysWOW64\PresentationNative_v0300.dll
2017-12-22 12:02 - 2017-09-22 18:19 - 000103120 ____N (Microsoft Corporation) C:\WINDOWS\SysWOW64\PresentationCFFRasterizerNative_v0300.dll
2017-12-22 12:02 - 2017-09-22 18:19 - 000035456 ____N (Microsoft Corporation) C:\WINDOWS\SysWOW64\TsWpfWrp.exe

==================== One Month Modified files and folders ========

(If an entry is included in the fixlist, the file/folder will be moved.)

2018-01-19 17:58 - 2015-09-08 00:49 - 000945440 _____ C:\WINDOWS\system32\PerfStringBackup.INI
2018-01-19 17:42 - 2015-09-08 00:48 - 000000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Acer
2018-01-19 17:40 - 2015-09-08 00:50 - 000000000 ____D C:\ProgramData\McAfee
2018-01-19 17:40 - 2015-09-08 00:48 - 000000000 ____D C:\ProgramData\Acer
2018-01-19 17:20 - 2015-11-04 15:50 - 000000000 ____D C:\Program Files (x86)\Amazon
2018-01-19 17:16 - 2015-09-08 00:50 - 000000000 ____D C:\Program Files (x86)\McAfee
2018-01-19 17:00 - 2015-09-08 01:31 - 000000000 ___HD C:\OEM
2018-01-19 16:59 - 2015-09-08 00:48 - 000000000 ____D C:\ProgramData\OEM
2018-01-19 16:55 - 2015-09-08 00:46 - 000000000 __RHD C:\Users\Public\AccountPictures
2018-01-19 16:51 - 2015-07-10 03:04 - 000000000 ____D C:\WINDOWS\system32\Tasks_Migrated
2018-01-19 16:49 - 2015-11-04 15:56 - 000000000 ____D C:\Users\Public\Foxit Software
2018-01-19 16:49 - 2015-11-04 15:56 - 000000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Foxit PhantomPDF
2018-01-19 16:49 - 2015-11-04 15:56 - 000000000 ____D C:\Program Files (x86)\Foxit PhantomPDF
2018-01-19 16:49 - 2015-11-04 15:52 - 000000000 __HDC C:\ProgramData\{2B89F58C-32F7-46EC-A448-AECDF1F22B7B}
2018-01-19 16:49 - 2015-11-04 15:52 - 000000000 ____D C:\Program Files (x86)\Dashlane
2018-01-19 16:49 - 2015-11-04 15:49 - 000000000 ____D C:\Program Files (x86)\Windows Store Promo
2018-01-19 16:49 - 2015-11-04 15:44 - 000000000 ____D C:\WINDOWS\system32\ihvmanager
2018-01-19 16:49 - 2015-11-04 15:44 - 000000000 ____D C:\Program Files (x86)\Qualcomm Atheros
2018-01-19 16:49 - 2015-11-04 15:40 - 000000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Dolby
2018-01-19 16:49 - 2015-11-04 15:39 - 000000000 ___HD C:\Program Files (x86)\InstallShield Installation Information
2018-01-19 16:49 - 2015-11-04 15:36 - 000000000 ____D C:\WINDOWS\LastGood.Tmp
2018-01-19 16:49 - 2015-11-04 15:29 - 000000000 ____D C:\ProgramData\Package Cache
2018-01-19 16:49 - 2015-11-04 15:27 - 000000000 ____D C:\Program Files (x86)\Intel
2018-01-19 16:49 - 2015-11-04 15:26 - 000000000 ___RD C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Intel
2018-01-19 16:49 - 2015-11-04 15:26 - 000000000 ____D C:\ProgramData\Intel
2018-01-19 16:49 - 2015-11-04 15:23 - 000000000 ____D C:\Program Files (x86)\Microsoft Office
2018-01-19 16:49 - 2015-11-04 15:02 - 000000000 ____D C:\WINDOWS\NAPP_Dism_Log
2018-01-19 16:49 - 2015-09-08 00:50 - 000000000 ____D C:\Program Files (x86)\mcafee.com
2018-01-19 16:49 - 2015-09-08 00:49 - 000000000 ____D C:\ProgramData\Mozilla
2018-01-19 16:49 - 2015-09-08 00:49 - 000000000 ____D C:\Program Files (x86)\Mozilla Maintenance Service
2018-01-19 16:49 - 2015-09-08 00:49 - 000000000 ____D C:\Program Files (x86)\Mozilla Firefox
2018-01-19 16:49 - 2015-09-08 00:48 - 000000000 ___RD C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Games
2018-01-19 16:49 - 2015-09-08 00:48 - 000000000 ____D C:\ProgramData\WildTangent
2018-01-19 16:49 - 2015-09-08 00:48 - 000000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\AVAST Software
2018-01-19 16:49 - 2015-09-08 00:48 - 000000000 ____D C:\ProgramData\AVAST Software
2018-01-19 16:49 - 2015-09-08 00:48 - 000000000 ____D C:\Program Files (x86)\WildTangent Games
2018-01-19 16:49 - 2015-09-08 00:48 - 000000000 ____D C:\Program Files (x86)\WildGames
2018-01-19 16:49 - 2015-09-08 00:48 - 000000000 ____D C:\Program Files (x86)\Acer
2018-01-19 16:49 - 2015-09-08 00:47 - 000000000 ____D C:\ProgramData\Microsoft OneDrive
2018-01-19 16:49 - 2015-07-10 04:22 - 000000000 ____D C:\ProgramData\USOShared
2018-01-19 16:49 - 2015-07-10 03:04 - 000000000 ___RD C:\WINDOWS\PurchaseDialog
2018-01-19 16:49 - 2015-07-10 03:04 - 000000000 ___RD C:\WINDOWS\DesktopTileResources
2018-01-19 16:48 - 2015-11-04 15:46 - 000000000 ____D C:\Program Files\Common Files\QCA_Bluetooth
2018-01-19 16:48 - 2015-09-08 00:50 - 000000000 ____D C:\Program Files\mcafee.com
2018-01-19 16:48 - 2015-09-08 00:50 - 000000000 ____D C:\Program Files\mcafee
2018-01-19 16:48 - 2015-09-08 00:50 - 000000000 ____D C:\Program Files\Common Files\McAfee
2018-01-19 16:48 - 2015-09-08 00:50 - 000000000 ____D C:\Program Files\Acer
2018-01-19 16:48 - 2015-09-08 00:48 - 000000000 ____D C:\Program Files\AVAST Software
2018-01-19 16:48 - 2015-07-10 05:14 - 000000000 ____D C:\Program Files\Windows Journal
2018-01-13 02:03 - 2017-09-29 05:40 - 000067584 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\bthmodem.sys
2018-01-08 23:45 - 2017-09-29 05:41 - 000403968 ____N (Microsoft Corporation) C:\WINDOWS\system32\WpAXHolder.dll
2018-01-08 23:45 - 2017-09-29 05:41 - 000140800 ____N (Microsoft Corporation) C:\WINDOWS\system32\Chakradiag.dll
2018-01-08 23:45 - 2017-09-29 05:41 - 000106496 ____N (Microsoft Corporation) C:\WINDOWS\SysWOW64\Chakradiag.dll

==================== Bamital & volsnap ======================

(There is no automatic fix for files that do not pass verification.)

C:\WINDOWS\system32\winlogon.exe => File is digitally signed
C:\WINDOWS\system32\wininit.exe => File is digitally signed
C:\WINDOWS\explorer.exe => File is digitally signed
C:\WINDOWS\SysWOW64\explorer.exe => File is digitally signed
C:\WINDOWS\system32\svchost.exe => File is digitally signed
C:\WINDOWS\SysWOW64\svchost.exe => File is digitally signed
C:\WINDOWS\system32\services.exe => File is digitally signed
C:\WINDOWS\system32\User32.dll => File is digitally signed
C:\WINDOWS\SysWOW64\User32.dll => File is digitally signed
C:\WINDOWS\system32\userinit.exe => File is digitally signed
C:\WINDOWS\SysWOW64\userinit.exe => File is digitally signed
C:\WINDOWS\system32\rpcss.dll => File is digitally signed
C:\WINDOWS\system32\dnsapi.dll => File is digitally signed
C:\WINDOWS\SysWOW64\dnsapi.dll => File is digitally signed
C:\WINDOWS\system32\Drivers\volsnap.sys => File is digitally signed

LastRegBack: 2018-01-19 16:45

==================== End of FRST.txt ============================
Additional scan result of Farbar Recovery Scan Tool (x64) Version: 17.01.2018 01
Ran by drpmc (19-01-2018 18:06:39)
Running from C:\Users\drpmc\Downloads
Windows 10 Home Version 1709 16299.192 (X64) (2018-01-20 00:52:30)
Boot Mode: Normal
==========================================================


==================== Accounts: =============================

Administrator (S-1-5-21-193851962-1471604701-2205269352-500 - Administrator - Disabled)
DefaultAccount (S-1-5-21-193851962-1471604701-2205269352-503 - Limited - Disabled)
drpmc (S-1-5-21-193851962-1471604701-2205269352-1001 - Administrator - Enabled) => C:\Users\drpmc
Guest (S-1-5-21-193851962-1471604701-2205269352-501 - Limited - Disabled)
WDAGUtilityAccount (S-1-5-21-193851962-1471604701-2205269352-504 - Limited - Disabled)

==================== Security Center ========================

(If an entry is included in the fixlist, it will be removed.)

AV: Windows Defender (Disabled - Up to date) {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
AV: Norton Internet Security (Enabled - Up to date) {30744133-1E94-7B35-F4A3-82A5AEF1CBAA}
AV: Malwarebytes (Enabled - Up to date) {23007AD3-69FE-687C-2629-D584AFFAF72B}
AV: McAfee Anti-Virus and Anti-Spyware (Enabled - Up to date) {DA9F8ED0-D0DE-39CC-F55A-51AB4CC1B556}
AS: Malwarebytes (Enabled - Up to date) {98619B37-4FC4-67F2-1C99-EEF6D47DBD96}
AS: Windows Defender (Disabled - Up to date) {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
AS: Norton Internet Security (Enabled - Up to date) {8B15A0D7-38AE-74BB-CE13-B9D7D5768117}
AS: McAfee Anti-Virus and Anti-Spyware (Enabled - Up to date) {61FE6F34-F6E4-3642-CFEA-6AD93746FFEB}
FW: McAfee Firewall (Enabled) {E2A40FF5-9AB1-3894-DE05-F89EB212F22D}
FW: Norton Internet Security (Enabled) {084FC016-54FB-7A6D-DFFC-2B9050228CD1}

==================== Installed Programs ======================

(Only the adware programs with "Hidden" flag could be added to the fixlist to unhide them. The adware programs should be uninstalled manually.)

12 Labours of Hercules III: Girl Power (HKLM-x32\...\WTA-abfc5b8b-1f09-4bed-add0-97007e04b003) (Version: 3.0.2.118 - WildTangent) Hidden
abFiles (HKLM-x32\...\{13885028-098C-4799-9B71-27DAC96502D5}) (Version: 2.03.2003 - Acer Incorporated)
abPhoto (HKLM-x32\...\{B5AD89F2-03D3-4206-8487-018298007DD0}) (Version: 4.00.2001.1 - Acer Incorporated)
Acer Audio Invert Utility (HKLM-x32\...\{11086334-4198-44C7-8C67-7B49E4AC925A}) (Version: 1.00.3002 - Acer Incorporated)
Acer Care Center (HKLM\...\{1AF41E84-3408-499A-8C93-8891F0612719}) (Version: 2.00.3005 - Acer Incorporated)
Acer Explorer Agent (HKLM\...\{4D0F42CF-1693-43D9-BDC8-19141D023EE0}) (Version: 2.00.3001 - Acer Incorporated)
Acer Portal (HKLM-x32\...\{A5AD0B17-F34D-49BE-A157-C8B3D52ACD13}) (Version: 3.12.2006 - Acer Incorporated)
Acer Power Management (HKLM\...\{91F52DE4-B789-42B0-9311-A349F10E5479}) (Version: 7.00.8109 - Acer Incorporated)
Acer Quick Access (HKLM\...\{E3678E72-78E3-4F91-A9FB-913876FF6DA2}) (Version: 2.00.3008 - Acer Incorporated)
Acer UEIP Framework (HKLM\...\{12A718F2-2357-4D41-9E1F-18583A4745F7}) (Version: 2.01.3002 - Acer Incorporated)
AOP Framework (HKLM-x32\...\{4A37A114-702F-4055-A4B6-16571D4A5353}) (Version: 3.25.2001.0 - Acer Incorporated)
Avast SecureLine (HKLM\...\{2CD3C92F-EDC5-4B02-9B0A-9C1D37C58EF5}_is1) (Version: 1.0.239.4 - AVAST Software)
Bonjour (HKLM\...\{B91110FB-33B4-468B-90C2-4D5E8AE3FAE1}) (Version: 2.0.2.0 - Apple Inc.)
Dashlane Upgrade Service (HKLM-x32\...\Dashlane Upgrade Service) (Version: 1.0.13.0 - Dashlane SAS)
Dolby Audio X2 Windows API SDK (HKLM\...\{6A478BF2-F67F-4ABC-A7F1-B6B5BA862371}) (Version: 0.5.2.33 - Dolby Laboratories, Inc.)
Dolby Audio X2 Windows APP (HKLM\...\{7DA57EF8-9D20-4126-AF15-D0CC97D0C017}) (Version: 0.5.2.30 - Dolby Laboratories, Inc.)
eBay Worldwide (HKLM-x32\...\{3DC26EA7-03E3-4353-9424-EEB7A34A7504}) (Version: 2.5.0427 - OEM)
Foxit PhantomPDF (HKLM-x32\...\{A4023BDF-82D5-412D-9D58-8C2819EBFE2E}) (Version: 7.0.410.326 - Foxit Software Inc.)
Game Explorer Categories - genres (HKLM-x32\...\WildTangentGameProvider-acer-genres) (Version: 13.0.0.6 - WildTangent, Inc.)
Game Explorer Categories - main (HKLM-x32\...\WildTangentGameProvider-acer-main) (Version: 13.0.0.6 - WildTangent, Inc.)
Google Chrome (HKLM-x32\...\Google Chrome) (Version: 63.0.3239.132 - Google Inc.)
Google Update Helper (HKLM-x32\...\{60EC980A-BDA2-4CB6-A427-B07A5498B4CA}) (Version: 1.3.33.7 - Google Inc.) Hidden
Home Makeover (HKLM-x32\...\WTA-f3f31ee5-d658-45ea-9d90-3a307a2fa4b4) (Version: 3.0.2.59 - WildTangent) Hidden
Intel® Chipset Device Software (HKLM-x32\...\{60c073df-e736-4210-9c3a-5fc2b651cef3}) (Version: 10.1.1.7 - Intel® Corporation) Hidden
Intel® Management Engine Components (HKLM\...\{1CEAC85D-2590-4760-800F-8DE5E91F3700}) (Version: 11.0.0.1162 - Intel Corporation)
Intel® Processor Graphics (HKLM-x32\...\{F0E3AD40-2BBD-4360-9C76-B9AC9A5886EA}) (Version: 20.19.15.4300 - Intel Corporation)
Intel® Rapid Storage Technology (HKLM\...\{409CB30E-E457-4008-9B1A-ED1B9EA21140}) (Version: 14.6.0.1029 - Intel Corporation)
Intel® Serial IO (HKLM\...\{9FD91C5C-44AE-4D9D-85BE-AE52816B0294}) (Version: 30.100.1519.7 - Intel Corporation)
Intel® Virtual Buttons (HKLM-x32\...\1992736F-C90A-481C-B21B-EE34CAD07387) (Version: 1.1.0.21 - Intel Corporation)
Intel® Security Assist (HKLM-x32\...\{4B230374-6475-4A73-BA6E-41015E9C5013}) (Version: 1.0.0.532 - Intel Corporation)
Jewel Match 3 (HKLM-x32\...\WTA-05ef033f-3fc6-410a-8299-fef37160d456) (Version: 2.2.0.97 - WildTangent) Hidden
Jewel Match Snowscapes (HKLM-x32\...\WTA-8ebc43e2-f1a6-4e36-a974-985be9e27776) (Version: 3.0.2.118 - WildTangent) Hidden
Magic Academy (HKLM-x32\...\WTA-7ad3d7b6-dfc7-434d-881a-0790a6acd6b1) (Version: 2.2.0.97 - WildTangent) Hidden
Malwarebytes version 3.3.1.2183 (HKLM\...\{35065F43-4BB2-439A-BFF7-0F1014F2E0CD}_is1) (Version: 3.3.1.2183 - Malwarebytes)
McAfee LiveSafe – Internet Security (HKLM-x32\...\MSC) (Version: 14.0.1122 - McAfee, Inc.)
Microsoft Office (HKLM-x32\...\{90150000-0138-0409-0000-0000000FF1CE}) (Version: 15.0.4693.1005 - Microsoft Corporation)
Microsoft OneDrive (HKU\S-1-5-21-193851962-1471604701-2205269352-1001\...\OneDriveSetup.exe) (Version: 17.3.7131.1115 - Microsoft Corporation)
Microsoft Visual C++ 2010 x64 Redistributable - 10.0.30319 (HKLM\...\{DA5E371C-6333-3D8A-93A4-6FD5B20BCC6E}) (Version: 10.0.30319 - Microsoft Corporation)
Microsoft Visual C++ 2010 x86 Redistributable - 10.0.30319 (HKLM-x32\...\{196BB40D-1578-3D01-B289-BEFC77A11A1E}) (Version: 10.0.30319 - Microsoft Corporation)
Mozilla Firefox 38.0.1 (x86 en-US) (HKLM-x32\...\Mozilla Firefox 38.0.1 (x86 en-US)) (Version: 38.0.1 - Mozilla)
Mozilla Maintenance Service (HKLM-x32\...\MozillaMaintenanceService) (Version: 38.0.1 - Mozilla)
Norton Internet Security (HKLM-x32\...\NIS) (Version: 22.11.2.7 - Symantec Corporation)
Polar Bowler 1st Frame (HKLM-x32\...\WTA-63754197-a389-4dc3-8095-cb833fbaa6dc) (Version: 3.0.2.59 - WildTangent) Hidden
Qualcomm Atheros 11ac Wireless LAN&Bluetooth Installer (HKLM-x32\...\{3241744A-BA36-41F0-B4AA-EF3946D00632}) (Version: 11.0.0.0097 - Qualcomm Atheros)
Realtek Card Reader (HKLM-x32\...\{5BC2B5AB-80DE-4E83-B8CF-426902051D0A}) (Version: 10.0.10586.31225 - Realtek Semiconductor Corp.)
Realtek High Definition Audio Driver (HKLM-x32\...\{F132AF7F-7BCA-4EDE-8A7C-958108FE7DBC}) (Version: 6.0.1.7628 - Realtek Semiconductor Corp.)
Roblox Player for drpmc (HKU\S-1-5-21-193851962-1471604701-2205269352-1001\...\{373B1718-8CC5-4567-8EE2-9033AD08A680}) (Version: - Roblox Corporation)
Rory's Restaurant (HKLM-x32\...\WTA-4f5f0a40-e305-4e37-a21f-57e89c5d404c) (Version: 3.0.2.126 - WildTangent) Hidden
Runefall (HKLM-x32\...\WTA-976cd8b2-747a-4fd0-b2c7-8db3d48b1473) (Version: 3.0.2.126 - WildTangent) Hidden
Update Installer for WildTangent Games App (HKLM-x32\...\{2FA94A64-C84E-49d1-97DD-7BF06C7BBFB2}.WildTangent Games App) (Version: - WildTangent) Hidden
Vegas World (HKLM-x32\...\WildTangentGDF-acer-vegasworld) (Version: 13.0.0.6 - WildTangent) Hidden
Villagers and Heroes (HKLM-x32\...\WildTangentGDF-acer-villagersandheroes) (Version: 13.0.0.6 - WildTangent) Hidden
WildTangent Games (HKLM-x32\...\WildTangent wildgames Master Uninstall) (Version: 1.0.4.0 - WildTangent)
WildTangent Games App (HKLM-x32\...\{70B446D1-E03B-4ab0-9B3C-0832142C9AA8}.WildTangent Games App-acer) (Version: 4.0.11.16 - WildTangent) Hidden
Windows Store Gift Card Promo (HKLM-x32\...\{FF74AA30-FF56-4197-8B64-5D63F367BC02}) (Version: 1.0.0.1 - Microsoft Corporation)

==================== Custom CLSID (Whitelisted): ==========================

(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)

ShellIconOverlayIdentifiers: [ OverlayExcluded] -> {4433A54A-1AC8-432F-90FC-85F045CF383C} => C:\Program Files\Norton Internet Security\Engine\22.11.2.7\buShell.dll [2017-11-10] (Symantec Corporation)
ShellIconOverlayIdentifiers: [ OverlayPending] -> {F17C0B1E-EF8E-4AD4-8E1B-7D7E8CB23225} => C:\Program Files\Norton Internet Security\Engine\22.11.2.7\buShell.dll [2017-11-10] (Symantec Corporation)
ShellIconOverlayIdentifiers: [ OverlayProtected] -> {476D0EA3-80F9-48B5-B70B-05E677C9C148} => C:\Program Files\Norton Internet Security\Engine\22.11.2.7\buShell.dll [2017-11-10] (Symantec Corporation)
ShellIconOverlayIdentifiers: [ ACloudSynced] -> {5CCE71FA-9F61-4F24-9CD1-98D819B40D68} => C:\Program Files (x86)\Acer\shellext\x64\shellext_win.dll [2015-05-05] (Acer Incorporated)
ShellIconOverlayIdentifiers: [ ACloudSyncing] -> {C1E1456F-C2D8-4C96-870D-35F1E13941EE} => C:\Program Files (x86)\Acer\shellext\x64\shellext_win.dll [2015-05-05] (Acer Incorporated)
ShellIconOverlayIdentifiers: [ ACloudToBeSynced] -> {307523FA-DDC0-4068-983F-2A6B34627744} => C:\Program Files (x86)\Acer\shellext\x64\shellext_win.dll [2015-05-05] (Acer Incorporated)
ShellIconOverlayIdentifiers-x32: [ OverlayExcluded] -> {4433A54A-1AC8-432F-90FC-85F045CF383C} => C:\Program Files\Norton Internet Security\Engine\22.11.2.7\buShell.dll [2017-11-10] (Symantec Corporation)
ShellIconOverlayIdentifiers-x32: [ OverlayPending] -> {F17C0B1E-EF8E-4AD4-8E1B-7D7E8CB23225} => C:\Program Files\Norton Internet Security\Engine\22.11.2.7\buShell.dll [2017-11-10] (Symantec Corporation)
ShellIconOverlayIdentifiers-x32: [ OverlayProtected] -> {476D0EA3-80F9-48B5-B70B-05E677C9C148} => C:\Program Files\Norton Internet Security\Engine\22.11.2.7\buShell.dll [2017-11-10] (Symantec Corporation)
ContextMenuHandlers1: [BUContextMenu] -> {F7CAA2A1-67A2-44BB-B20F-202FD8EB1DAB} => C:\Program Files\Norton Internet Security\Engine\22.11.2.7\buShell.dll [2017-11-10] (Symantec Corporation)
ContextMenuHandlers1: [Foxit_ConvertToPDF] -> {C5269811-4A29-4818-A4BB-111F9FC63A5F} => C:\Program Files (x86)\Foxit PhantomPDF\plugins\ConvertToPDFShellExtension_x64.dll [2015-01-27] (Foxit Software Inc.)
ContextMenuHandlers1: [McCtxMenuFrmWrk] -> {CCA9EFD3-29ED-430A-BA6D-E6BBFF0A60C2} => c:\Program Files\mcafee\msc\McCtxMenuFrmWrk.dll [2015-07-16] (McAfee, Inc.)
ContextMenuHandlers1: [Symantec.Norton.Antivirus.IEContextMenu] -> {FAD61B3D-699D-49B2-BE16-7F82CB4C59CA} => C:\Program Files\Norton Internet Security\Engine\22.11.2.7\NavShExt.dll [2017-11-10] (Symantec Corporation)
ContextMenuHandlers2: [Symantec.Norton.Antivirus.IEContextMenu] -> {FAD61B3D-699D-49B2-BE16-7F82CB4C59CA} => C:\Program Files\Norton Internet Security\Engine\22.11.2.7\NavShExt.dll [2017-11-10] (Symantec Corporation)
ContextMenuHandlers3: [MBAMShlExt] -> {57CE581A-0CB6-4266-9CA0-19364C90A0B3} => C:\Program Files\Malwarebytes\Anti-Malware\mbshlext.dll [2017-11-01] (Malwarebytes)
ContextMenuHandlers5: [igfxcui] -> {3AB1675A-CCFF-11D2-8B20-00A0C93CB1F4} => -> No File
ContextMenuHandlers5: [igfxDTCM] -> {9B5F5829-A529-4B12-814A-E81BCB8D93FC} => C:\WINDOWS\system32\igfxDTCM.dll [2016-05-19] (Intel Corporation)
ContextMenuHandlers6: [BUContextMenu] -> {F7CAA2A1-67A2-44BB-B20F-202FD8EB1DAB} => C:\Program Files\Norton Internet Security\Engine\22.11.2.7\buShell.dll [2017-11-10] (Symantec Corporation)
ContextMenuHandlers6: [MBAMShlExt] -> {57CE581A-0CB6-4266-9CA0-19364C90A0B3} => C:\Program Files\Malwarebytes\Anti-Malware\mbshlext.dll [2017-11-01] (Malwarebytes)
ContextMenuHandlers6: [McCtxMenuFrmWrk] -> {CCA9EFD3-29ED-430A-BA6D-E6BBFF0A60C2} => c:\Program Files\mcafee\msc\McCtxMenuFrmWrk.dll [2015-07-16] (McAfee, Inc.)
ContextMenuHandlers6: [Symantec.Norton.Antivirus.IEContextMenu] -> {FAD61B3D-699D-49B2-BE16-7F82CB4C59CA} => C:\Program Files\Norton Internet Security\Engine\22.11.2.7\NavShExt.dll [2017-11-10] (Symantec Corporation)

==================== Scheduled Tasks (Whitelisted) =============

(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)

Task: {4B1A3871-3442-47C4-9EED-586DAF0F6786} - System32\Tasks\BacKGroundAgent => C:\Program Files (x86)\Acer\AOP Framework\BackgroundAgent.exe [2017-03-20] (Acer Incorporated)
Task: {4DFE61EB-B5D8-451C-B68C-429C43F859ED} - System32\Tasks\GoogleUpdateTaskMachineCore => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe [2018-01-19] (Google Inc.)
Task: {597346AE-17A2-4C9C-BD9C-59DA53D99053} - System32\Tasks\Power Management => C:\Program Files\Acer\Acer Power Management\ePowerTrayLauncher.exe [2015-05-14] (Acer Incorporated)
Task: {629DB1B0-7855-4527-A528-05A1471390C3} - System32\Tasks\WindowsStoreGiftCardPromoBackgroundTaskX86 => C:\Program Files (x86)\Windows Store Promo\wsgcpromoback.exe [2015-07-15] (Microsoft Corporation)
Task: {6A4BB78F-1BD1-4BF8-A450-6477BBE992F5} - System32\Tasks\FUBTrackingByPLD => C:\OEM\Preload\FubTracking\FubTracking.exe [2015-05-13] ()
Task: {6E994AAA-17AA-4E1A-8310-479C76106F4D} - System32\Tasks\Norton Internet Security\Norton Internet Security Autofix => C:\Program Files\Norton Internet Security\Engine\22.11.2.7\SymErr.exe [2017-11-10] (Symantec Corporation)
Task: {731DE8BC-997E-4BEE-8BC4-2835DAD9943C} - System32\Tasks\Microsoft\Office\Microsoft Office Touchless Attach Notification => C:\Program Files (x86)\Microsoft Office\Office15\FirstRun.exe [2015-03-14] (Microsoft Corporation)
Task: {815DC775-54CF-43D6-84C0-0C9B8E7B7944} - System32\Tasks\GoogleUpdateTaskMachineUA => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe [2018-01-19] (Google Inc.)
Task: {8FD161D4-85ED-449F-814C-9C7F24629B88} - System32\Tasks\Norton WSC Integration => C:\Program Files\Norton Internet Security\Engine\22.11.2.7\WSCStub.exe [2017-11-10] (Symantec Corporation)
Task: {A1E7F2F0-A78D-4827-AD21-C8593C1D3B36} - System32\Tasks\Avast SecureLine => C:\Program Files\AVAST Software\SecureLine\SecureLine.exe [2018-01-19] (AVAST Software)
Task: {AC7B2403-B317-49E8-97A8-82C2B3544FAC} - System32\Tasks\ACCBackgroundApplication => C:\Program Files (x86)\Acer\Care Center\ACCStd.exe [2015-07-10] ()
Task: {B144931B-0702-429D-9715-A4BA0A7D6008} - System32\Tasks\Software Update Application => C:\ProgramData\OEM\UpgradeTool\ListCheck.exe [2015-09-04] (Acer Incorporated)
Task: {BADE8038-4640-4B21-8C1A-B11D956048D0} - System32\Tasks\Norton Internet Security\Norton Internet Security Error Processor => C:\Program Files\Norton Internet Security\Engine\22.11.2.7\SymErr.exe [2017-11-10] (Symantec Corporation)
Task: {C0399E3E-80C6-47DB-8688-27127DA521F4} - System32\Tasks\Audio Invert Utility => C:\Program Files (x86)\Acer\Acer Audio Invert Utility\Launcher.exe [2014-12-29] (Acer Incorporated)
Task: {C88E24B6-D671-403E-8914-7DCD4B055351} - System32\Tasks\ACCAgent => C:\Program Files (x86)\Acer\Care Center\LiveUpdateAgent.exe [2015-07-10] ()
Task: {CA59D5F5-1552-4D88-9247-0604C66BF9C5} - System32\Tasks\UbtFrameworkService => C:\Program Files\Acer\User Experience Improvement Program\Framework\TriggerFramework.exe [2014-03-12] (TODO: <Company name>)
Task: {D6CADD1F-A614-4869-9E62-3D1541A047E7} - System32\Tasks\avast! SL Update => C:\Program Files\AVAST Software\SecureLine\SLUpdate.exe [2018-01-19] (AVAST Software)
Task: {DF8E583B-7D3F-41DF-8B8D-19A9885A0F20} - System32\Tasks\Norton Internet Security\Norton Internet Security Error Analyzer => C:\Program Files\Norton Internet Security\Engine\22.11.2.7\SymErr.exe [2017-11-10] (Symantec Corporation)
Task: {E0616173-AD7F-4EF0-9DF8-969B96A9D52C} - System32\Tasks\ACC => C:\Program Files (x86)\Acer\Care Center\LiveUpdateChecker.exe [2015-07-10] ()
Task: {ED1AD678-37C2-40AD-8354-757FD4318DFF} - System32\Tasks\AcerCloud => C:\Program Files (x86)\Acer\Acer Portal\AcerPortal.exe [2017-10-02] (Acer)
Task: {FC6923A0-972E-4735-A107-0FACB324C04D} - System32\Tasks\Quick Access => C:\Program Files\Acer\Acer Quick Access\QALauncher.exe [2015-09-04] (Acer Incorporated)

(If an entry is included in the fixlist, the task (.job) file will be moved. The file which is running by the task will not be moved.)


==================== Shortcuts & WMI ========================

(The entries could be listed to be restored or removed.)


==================== Loaded Modules (Whitelisted) ==============

2017-09-29 05:41 - 2017-09-29 05:41 - 000184432 ____N () C:\WINDOWS\SYSTEM32\inputhost.dll
2015-09-22 09:17 - 2015-09-22 09:17 - 005570064 _____ () C:\WINDOWS\system32\IntelSSTAPO\ParameterService\libxml2-2.dll
2018-01-19 16:58 - 2017-11-29 09:11 - 002358728 _____ () C:\PROGRAM FILES\MALWAREBYTES\ANTI-MALWARE\MwacLib.dll
2018-01-19 16:58 - 2017-11-29 09:11 - 002301384 _____ () C:\PROGRAM FILES\MALWAREBYTES\ANTI-MALWARE\SelfProtectionSdk.dll
2015-09-22 20:37 - 2015-09-22 20:37 - 000176640 _____ () C:\Program Files\Dolby\Dolby DAX2\DAX2_API\DolbyDAX2API.exe
2015-05-19 09:11 - 2015-05-19 09:11 - 000007680 _____ () C:\Program Files (x86)\Intel\Intel® Security Assist\isaHelperService.exe
2018-01-19 16:56 - 2018-01-19 16:56 - 000592392 _____ () C:\Program Files\AVAST Software\SecureLine\VpnSvc.exe
2016-05-19 20:37 - 2016-05-19 20:37 - 000410600 _____ () C:\WINDOWS\system32\igfxTray.exe
2017-12-13 17:33 - 2017-12-13 17:33 - 011044864 ____N () C:\Windows\SystemApps\Microsoft.Windows.Cortana_cw5n1h2txyewy\CortanaApi.dll
2017-12-13 17:33 - 2017-12-13 17:33 - 001804288 ____N () C:\Windows\SystemApps\Microsoft.Windows.Cortana_cw5n1h2txyewy\Cortana.Core.dll
2017-09-29 06:43 - 2017-09-29 06:43 - 000074752 _____ () C:\Program Files\WindowsApps\Microsoft.SkypeApp_11.18.596.0_x64__kzf8qxf38zg5c\SkypeHost.exe
2017-09-29 06:43 - 2017-09-29 06:43 - 000203264 _____ () C:\Program Files\WindowsApps\Microsoft.SkypeApp_11.18.596.0_x64__kzf8qxf38zg5c\SkypeBackgroundTasks.dll
2017-09-29 06:43 - 2017-09-29 06:43 - 043452928 _____ () C:\Program Files\WindowsApps\Microsoft.SkypeApp_11.18.596.0_x64__kzf8qxf38zg5c\SkyWrap.dll
2017-09-29 06:43 - 2017-09-29 06:43 - 002437120 _____ () C:\Program Files\WindowsApps\Microsoft.SkypeApp_11.18.596.0_x64__kzf8qxf38zg5c\skypert.dll
2015-09-22 20:40 - 2015-09-22 20:40 - 000628736 _____ () C:\Program Files\Dolby\Dolby DAX2\DAX2_APP\DolbyDAX2TrayIcon.exe
2018-01-19 16:58 - 2018-01-19 16:58 - 000102088 _____ () C:\Users\drpmc\AppData\Local\Microsoft\OneDrive\17.3.7131.1115\UpdateRingSettings.dll

==================== Alternate Data Streams (Whitelisted) =========

==================== Safe Mode (Whitelisted) ===================

(If an entry is included in the fixlist, it will be removed from the registry. The "AlternateShell" will be restored.)

HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\MBAMService => ""="Service"
HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\MCODS => ""="Service"
HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\mcpltsvc => ""="Service"
HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\MBAMService => ""="Service"
HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\McMPFSvc => ""="Service"
HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\MCODS => ""="Service"
HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\mcpltsvc => ""="Service"

==================== Association (Whitelisted) ===============

(If an entry is included in the fixlist, the registry item will be restored to default or removed.)


==================== Internet Explorer trusted/restricted ===============

(If an entry is included in the fixlist, it will be removed from the registry.)


==================== Hosts content: ===============================

(If needed Hosts: directive could be included in the fixlist to reset Hosts.)

2015-07-10 03:04 - 2015-07-10 03:02 - 000000824 _____ C:\WINDOWS\system32\Drivers\etc\hosts


==================== Other Areas ============================

(Currently there is no automatic fix for this section.)

HKU\S-1-5-21-193851962-1471604701-2205269352-1001\Control Panel\Desktop\\Wallpaper -> C:\Users\drpmc\AppData\Local\Microsoft\Windows\Themes\RoamedThemeFiles\DesktopBackground\img13.jpg
DNS Servers: 75.75.75.75 - 75.75.76.76
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System => (ConsentPromptBehaviorAdmin: 5) (ConsentPromptBehaviorUser: 3) (EnableLUA: 1)
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer => (SmartScreenEnabled: )
Windows Firewall is enabled.

==================== MSCONFIG/TASK MANAGER disabled items ==


==================== FirewallRules (Whitelisted) ===============

(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)

FirewallRules: [{35DB134B-8D44-4415-A141-53523DF731A8}] => (Allow) C:\Program Files (x86)\Acer\abPhoto\WindowsUpnp.exe
FirewallRules: [{E298802C-9FD8-47F3-B013-294314EFDB2F}] => (Allow) C:\Program Files (x86)\Acer\abPhoto\WindowsUpnp.exe
FirewallRules: [{7D2D63CC-D5DE-4936-A160-0F1C68A9AE16}] => (Allow) C:\Program Files (x86)\Acer\abPhoto\DMCDaemon.exe
FirewallRules: [{AEAFCC99-AD7F-4BB8-AA5F-012EE8CEEFFC}] => (Allow) C:\Program Files (x86)\Acer\abPhoto\DMCDaemon.exe
FirewallRules: [{7DC4B2BF-3D2A-4C5D-AE4F-AF85CCEEC13C}] => (Allow) C:\Program Files (x86)\Acer\AOP Framework\acer\ccd.exe
FirewallRules: [{3C08743C-B168-4536-987B-0323C0791260}] => (Allow) C:\Program Files (x86)\Acer\AOP Framework\acer\ccd.exe
FirewallRules: [{32E40FA6-514A-4B5B-A1B0-3B3D80AC6884}] => (Allow) C:\Program Files\Common Files\McAfee\Platform\McSvcHost\McSvHost.exe
FirewallRules: [{E0DB4407-DACE-4D7D-8355-F125186B8FF8}] => (Allow) C:\Program Files (x86)\Mozilla Firefox\firefox.exe
FirewallRules: [{A6C68F37-DCA7-456F-9D94-AD18E4CB520E}] => (Allow) C:\Program Files (x86)\Mozilla Firefox\firefox.exe
FirewallRules: [{02434223-FAA2-4A17-8B74-DDA1F3659AAD}] => (Allow) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
FirewallRules: [{87D1AA14-EDD2-4EC4-AB5D-EA6335AA4489}] => (Allow) C:\Program Files (x86)\Bonjour\mDNSResponder.exe
FirewallRules: [{82507027-EBDC-4246-ABE5-91EFC695E0CC}] => (Allow) C:\Program Files (x86)\Bonjour\mDNSResponder.exe
FirewallRules: [{915E92DE-3D44-4BD2-840D-A7013D814A65}] => (Allow) C:\Program Files\WindowsApps\SpotifyAB.SpotifyMusic_1.72.117.0_x86__zpdnekdrzrea0\Spotify.exe
FirewallRules: [{A58CB9DE-C3C4-4954-A72D-CA44E30D9692}] => (Allow) C:\Program Files\WindowsApps\SpotifyAB.SpotifyMusic_1.72.117.0_x86__zpdnekdrzrea0\Spotify.exe
FirewallRules: [{22C2C4EF-5DC3-40A4-A319-B8B65749839A}] => (Allow) C:\Program Files\WindowsApps\SpotifyAB.SpotifyMusic_1.72.117.0_x86__zpdnekdrzrea0\Spotify.exe
FirewallRules: [{5B70FE20-8667-4FE4-91C3-1E8A0447D2C3}] => (Allow) C:\Program Files\WindowsApps\SpotifyAB.SpotifyMusic_1.72.117.0_x86__zpdnekdrzrea0\Spotify.exe
FirewallRules: [{9AFF98F5-08AE-4CD8-94E5-560D79B4EC6F}] => (Allow) C:\Program Files\WindowsApps\SpotifyAB.SpotifyMusic_1.72.117.0_x86__zpdnekdrzrea0\Spotify.exe
FirewallRules: [{7BDA9B45-FAAD-4888-B0B6-994B68E808C2}] => (Allow) C:\Program Files\WindowsApps\SpotifyAB.SpotifyMusic_1.72.117.0_x86__zpdnekdrzrea0\Spotify.exe
FirewallRules: [{2CA2E6C8-FB7D-4638-99FE-C7A1D2EB6452}] => (Allow) C:\Program Files\WindowsApps\SpotifyAB.SpotifyMusic_1.72.117.0_x86__zpdnekdrzrea0\Spotify.exe
FirewallRules: [{82ED868F-7979-41B6-899D-01E6B6376508}] => (Allow) C:\Program Files\WindowsApps\SpotifyAB.SpotifyMusic_1.72.117.0_x86__zpdnekdrzrea0\Spotify.exe
FirewallRules: [{6A73549F-F7E9-4807-B47A-6B20B1DE26CB}] => (Allow) C:\Program Files\WindowsApps\SpotifyAB.SpotifyMusic_1.72.117.0_x86__zpdnekdrzrea0\SpotifyWebHelper.exe
FirewallRules: [{8A4F691D-9F35-47B5-A8D9-5FEB0DF0828A}] => (Allow) C:\Program Files\WindowsApps\SpotifyAB.SpotifyMusic_1.72.117.0_x86__zpdnekdrzrea0\SpotifyWebHelper.exe

==================== Restore Points =========================

ATTENTION: System Restore is disabled

==================== Faulty Device Manager Devices =============


==================== Event log errors: =========================

Application errors:
==================
Error: (01/19/2018 06:04:52 PM) (Source: Bonjour Service) (EventID: 100) (User: )
Description: Local Hostname DESKTOP-DVAB5JQ.local already in use; will try DESKTOP-DVAB5JQ-2.local instead

Error: (01/19/2018 06:04:52 PM) (Source: Bonjour Service) (EventID: 100) (User: )
Description: mDNSCoreReceiveResponse: ProbeCount 2; will rename 4 DESKTOP-DVAB5JQ.local. Addr 10.0.0.31

Error: (01/19/2018 06:04:52 PM) (Source: Bonjour Service) (EventID: 100) (User: )
Description: mDNSCoreReceiveResponse: Received from 10.0.0.31:5353 16 DESKTOP-DVAB5JQ.local. AAAA 2601:0647:4C01:2B10:0000:0000:0000:A3FF

Error: (01/19/2018 05:51:26 PM) (Source: Bonjour Service) (EventID: 100) (User: )
Description: Local Hostname DESKTOP-DVAB5JQ.local already in use; will try DESKTOP-DVAB5JQ-2.local instead

Error: (01/19/2018 05:51:26 PM) (Source: Bonjour Service) (EventID: 100) (User: )
Description: mDNSCoreReceiveResponse: ProbeCount 2; will rename 4 DESKTOP-DVAB5JQ.local. Addr 10.0.0.31

Error: (01/19/2018 05:51:26 PM) (Source: Bonjour Service) (EventID: 100) (User: )
Description: mDNSCoreReceiveResponse: Received from 10.0.0.31:5353 16 DESKTOP-DVAB5JQ.local. AAAA 2601:0647:4C01:2B10:0000:0000:0000:A3FF

Error: (01/19/2018 05:44:25 PM) (Source: Bonjour Service) (EventID: 100) (User: )
Description: Local Hostname DESKTOP-DVAB5JQ.local already in use; will try DESKTOP-DVAB5JQ-2.local instead

Error: (01/19/2018 05:44:25 PM) (Source: Bonjour Service) (EventID: 100) (User: )
Description: mDNSCoreReceiveResponse: ProbeCount 1; will rename 4 DESKTOP-DVAB5JQ.local. Addr 10.0.0.31

Error: (01/19/2018 05:44:25 PM) (Source: Bonjour Service) (EventID: 100) (User: )
Description: mDNSCoreReceiveResponse: Received from 10.0.0.31:5353 16 DESKTOP-DVAB5JQ.local. AAAA 2601:0647:4C01:2B10:0000:0000:0000:A3FF

Error: (01/19/2018 05:34:29 PM) (Source: Bonjour Service) (EventID: 100) (User: )
Description: Local Hostname DESKTOP-DVAB5JQ.local already in use; will try DESKTOP-DVAB5JQ-2.local instead


System errors:
=============
Error: (01/19/2018 06:05:56 PM) (Source: DCOM) (EventID: 10016) (User: DESKTOP-DVAB5JQ)
Description: The application-specific permission settings do not grant Local Activation permission for the COM Server application with CLSID
{D63B10C5-BB46-4990-A94F-E40B9D520160}
and APPID
{9CA88EE3-ACB7-47C8-AFC4-AB702511C276}
to the user DESKTOP-DVAB5JQ\drpmc SID (S-1-5-21-193851962-1471604701-2205269352-1001) from address LocalHost (Using LRPC) running in the application container Unavailable SID (Unavailable). This security permission can be modified using the Component Services administrative tool.

Error: (01/19/2018 06:05:26 PM) (Source: DCOM) (EventID: 10016) (User: NT AUTHORITY)
Description: The application-specific permission settings do not grant Local Activation permission for the COM Server application with CLSID
{6B3B8D23-FA8D-40B9-8DBD-B950333E2C52}
and APPID
{4839DDB7-58C2-48F5-8283-E1D1807D0D7D}
to the user NT AUTHORITY\LOCAL SERVICE SID (S-1-5-19) from address LocalHost (Using LRPC) running in the application container Unavailable SID (Unavailable). This security permission can be modified using the Component Services administrative tool.

Error: (01/19/2018 06:05:26 PM) (Source: DCOM) (EventID: 10016) (User: NT AUTHORITY)
Description: The application-specific permission settings do not grant Local Activation permission for the COM Server application with CLSID
{6B3B8D23-FA8D-40B9-8DBD-B950333E2C52}
and APPID
{4839DDB7-58C2-48F5-8283-E1D1807D0D7D}
to the user NT AUTHORITY\LOCAL SERVICE SID (S-1-5-19) from address LocalHost (Using LRPC) running in the application container Unavailable SID (Unavailable). This security permission can be modified using the Component Services administrative tool.

Error: (01/19/2018 06:04:18 PM) (Source: Service Control Manager) (EventID: 7034) (User: )
Description: The User Experience Improvement Program service terminated unexpectedly. It has done this 1 time(s).

Error: (01/19/2018 06:04:18 PM) (Source: Service Control Manager) (EventID: 7034) (User: )
Description: The Intel® Dynamic Application Loader Host Interface Service service terminated unexpectedly. It has done this 1 time(s).

Error: (01/19/2018 06:04:18 PM) (Source: Service Control Manager) (EventID: 7034) (User: )
Description: The GamesAppIntegrationService service terminated unexpectedly. It has done this 1 time(s).

Error: (01/19/2018 06:04:18 PM) (Source: Service Control Manager) (EventID: 7034) (User: )
Description: The Dashlane Upgrade Service service terminated unexpectedly. It has done this 1 time(s).

Error: (01/19/2018 06:04:18 PM) (Source: Service Control Manager) (EventID: 7034) (User: )
Description: The ePower Service service terminated unexpectedly. It has done this 1 time(s).

Error: (01/19/2018 06:04:18 PM) (Source: Service Control Manager) (EventID: 7034) (User: )
Description: The Quick Access Local Service service terminated unexpectedly. It has done this 1 time(s).

Error: (01/19/2018 06:04:18 PM) (Source: Service Control Manager) (EventID: 7034) (User: )
Description: The Quick Access Service service terminated unexpectedly. It has done this 1 time(s).


CodeIntegrity:
===================================
Date: 2018-01-19 18:05:47.501
Description: Code Integrity determined that a process (\Device\HarddiskVolume3\Windows\System32\svchost.exe) attempted to load \Device\HarddiskVolume3\Program Files\Bonjour\mdnsNSP.dll that did not meet the Microsoft signing level requirements.

Date: 2018-01-19 18:05:47.498
Description: Code Integrity determined that a process (\Device\HarddiskVolume3\Windows\System32\svchost.exe) attempted to load \Device\HarddiskVolume3\Program Files\Bonjour\mdnsNSP.dll that did not meet the Microsoft signing level requirements.

Date: 2018-01-19 18:05:28.065
Description: Code Integrity determined that a process (\Device\HarddiskVolume3\Windows\System32\svchost.exe) attempted to load \Device\HarddiskVolume3\Program Files\Bonjour\mdnsNSP.dll that did not meet the Microsoft signing level requirements.

Date: 2018-01-19 18:05:28.061
Description: Code Integrity determined that a process (\Device\HarddiskVolume3\Windows\System32\svchost.exe) attempted to load \Device\HarddiskVolume3\Program Files\Bonjour\mdnsNSP.dll that did not meet the Microsoft signing level requirements.

Date: 2018-01-19 18:05:03.457
Description: Code Integrity determined that a process (\Device\HarddiskVolume3\Windows\System32\svchost.exe) attempted to load \Device\HarddiskVolume3\Program Files\Bonjour\mdnsNSP.dll that did not meet the Microsoft signing level requirements.

Date: 2018-01-19 18:05:03.454
Description: Code Integrity determined that a process (\Device\HarddiskVolume3\Windows\System32\svchost.exe) attempted to load \Device\HarddiskVolume3\Program Files\Bonjour\mdnsNSP.dll that did not meet the Microsoft signing level requirements.

Date: 2018-01-19 17:55:56.430
Description: Code Integrity determined that a process (\Device\HarddiskVolume3\Windows\System32\svchost.exe) attempted to load \Device\HarddiskVolume3\Program Files\Bonjour\mdnsNSP.dll that did not meet the Microsoft signing level requirements.

Date: 2018-01-19 17:55:56.420
Description: Code Integrity determined that a process (\Device\HarddiskVolume3\Windows\System32\svchost.exe) attempted to load \Device\HarddiskVolume3\Program Files\Bonjour\mdnsNSP.dll that did not meet the Microsoft signing level requirements.

Date: 2018-01-19 17:53:41.239
Description: Code Integrity determined that a process (\Device\HarddiskVolume3\Windows\System32\svchost.exe) attempted to load \Device\HarddiskVolume3\Program Files\Bonjour\mdnsNSP.dll that did not meet the Microsoft signing level requirements.

Date: 2018-01-19 17:53:41.236
Description: Code Integrity determined that a process (\Device\HarddiskVolume3\Windows\System32\svchost.exe) attempted to load \Device\HarddiskVolume3\Program Files\Bonjour\mdnsNSP.dll that did not meet the Microsoft signing level requirements.


==================== Memory info ===========================

Processor: Intel® Core™ i5-6200U CPU @ 2.30GHz
Percentage of memory in use: 36%
Total physical RAM: 8073.91 MB
Available physical RAM: 5152.09 MB
Total Virtual: 9993.91 MB
Available Virtual: 7182.28 MB

==================== Drives ================================

Drive c: (Acer) (Fixed) (Total:237.52 GB) (Free:210.17 GB) NTFS

==================== MBR & Partition Table ==================

========================================================
Disk: 0 (Size: 238.5 GB) (Disk ID: BC7991E4)

Partition: GPT.

==================== End of Addition.txt ============================

Attached Files


Edited by Oh My!, 19 January 2018 - 09:17 PM.


#5 Oh My!

Oh My!

    Adware and Spyware and Malware.....


  • Malware Response Instructor
  • 36,798 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:California
  • Local time:10:00 PM

Posted 19 January 2018 - 09:20 PM

Hi Paul.

Can you run the steps I provided above? We need to do that.
Gary
 
If I do not reply within 24 hours please send me a Personal Message.

"Lord, to whom would we go? You have the words that give eternal life. We believe, and we know you are the Holy One of God."

#6 Spextrun

Spextrun
  • Topic Starter

  • Members
  • 5 posts
  • OFFLINE
  •  
  • Local time:09:00 PM

Posted 19 January 2018 - 10:35 PM

Can I keep Norton as my main antivirus and Malwarebytes as a second opinion scanner? I have uninstalled McAfee.


Edited by Spextrun, 20 January 2018 - 12:07 AM.


#7 Oh My!

Oh My!

    Adware and Spyware and Malware.....


  • Malware Response Instructor
  • 36,798 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:California
  • Local time:10:00 PM

Posted 20 January 2018 - 08:03 AM

You can leave it for now but please run the rest of the instructions and let me know how your computer is performing.
Gary
 
If I do not reply within 24 hours please send me a Personal Message.

"Lord, to whom would we go? You have the words that give eternal life. We believe, and we know you are the Holy One of God."

#8 Spextrun

Spextrun
  • Topic Starter

  • Members
  • 5 posts
  • OFFLINE
  •  
  • Local time:09:00 PM

Posted 20 January 2018 - 11:47 AM

Ok, great. I got this log out of the Farbar fix thing.

 

Fix result of Farbar Recovery Scan Tool (x64) Version: 17.01.2018 01
Ran by drpmc (20-01-2018 08:29:20) Run:1
Running from C:\Users\drpmc\Downloads
Loaded Profiles: drpmc (Available Profiles: drpmc)
Boot Mode: Normal
==============================================

fixlist content:
*****************
CreateRestorePoint:
CloseProcesses:
cmd: sfc /scannow
File: C:\WINDOWS\system32\hvax64.exe
File: C:\WINDOWS\system32\Drivers\bam.sys
emptytemp:

*****************

Restore point was successfully created.
Processes closed successfully.

========= sfc /scannow =========



Beginning system scan.  This process will take some time.



Beginning verification phase of system scan.


Verification 0% complete.
Verification 1% complete.
Verification 1% complete.
Verification 2% complete.
Verification 2% complete.
Verification 3% complete.
Verification 3% complete.
Verification 4% complete.
Verification 4% complete.
Verification 5% complete.
Verification 5% complete.
Verification 6% complete.
Verification 6% complete.
Verification 7% complete.
Verification 7% complete.
Verification 8% complete.
Verification 9% complete.
Verification 9% complete.
Verification 10% complete.
Verification 10% complete.
Verification 11% complete.
Verification 11% complete.
Verification 12% complete.
Verification 12% complete.
Verification 13% complete.
Verification 13% complete.
Verification 14% complete.
Verification 14% complete.
Verification 15% complete.
Verification 15% complete.
Verification 16% complete.
Verification 17% complete.
Verification 17% complete.
Verification 18% complete.
Verification 18% complete.
Verification 19% complete.
Verification 19% complete.
Verification 20% complete.
Verification 20% complete.
Verification 21% complete.
Verification 21% complete.
Verification 22% complete.
Verification 22% complete.
Verification 23% complete.
Verification 23% complete.
Verification 24% complete.
Verification 25% complete.
Verification 25% complete.
Verification 26% complete.
Verification 26% complete.
Verification 27% complete.
Verification 27% complete.
Verification 28% complete.
Verification 28% complete.
Verification 29% complete.
Verification 29% complete.
Verification 30% complete.
Verification 30% complete.
Verification 31% complete.
Verification 31% complete.
Verification 32% complete.
Verification 33% complete.
Verification 33% complete.
Verification 34% complete.
Verification 34% complete.
Verification 35% complete.
Verification 35% complete.
Verification 36% complete.
Verification 36% complete.
Verification 37% complete.
Verification 37% complete.
Verification 38% complete.
Verification 38% complete.
Verification 39% complete.
Verification 39% complete.
Verification 40% complete.
Verification 41% complete.
Verification 41% complete.
Verification 42% complete.
Verification 42% complete.
Verification 43% complete.
Verification 43% complete.
Verification 44% complete.
Verification 44% complete.
Verification 45% complete.
Verification 45% complete.
Verification 46% complete.
Verification 46% complete.
Verification 47% complete.
Verification 47% complete.
Verification 48% complete.
Verification 48% complete.
Verification 49% complete.
Verification 50% complete.
Verification 50% complete.
Verification 51% complete.
Verification 51% complete.
Verification 52% complete.
Verification 52% complete.
Verification 53% complete.
Verification 53% complete.
Verification 54% complete.
Verification 54% complete.
Verification 55% complete.
Verification 55% complete.
Verification 56% complete.
Verification 56% complete.
Verification 57% complete.
Verification 58% complete.
Verification 58% complete.
Verification 59% complete.
Verification 59% complete.
Verification 60% complete.
Verification 60% complete.
Verification 61% complete.
Verification 61% complete.
Verification 62% complete.
Verification 62% complete.
Verification 63% complete.
Verification 63% complete.
Verification 64% complete.
Verification 64% complete.
Verification 65% complete.
Verification 66% complete.
Verification 66% complete.
Verification 67% complete.
Verification 67% complete.
Verification 68% complete.
Verification 68% complete.
Verification 69% complete.
Verification 69% complete.
Verification 70% complete.
Verification 70% complete.
Verification 71% complete.
Verification 71% complete.
Verification 72% complete.
Verification 72% complete.
Verification 73% complete.
Verification 74% complete.
Verification 74% complete.
Verification 75% complete.
Verification 75% complete.
Verification 76% complete.
Verification 76% complete.
Verification 77% complete.
Verification 77% complete.
Verification 78% complete.
Verification 78% complete.
Verification 79% complete.
Verification 79% complete.
Verification 80% complete.
Verification 80% complete.
Verification 81% complete.
Verification 82% complete.
Verification 82% complete.
Verification 83% complete.
Verification 83% complete.
Verification 84% complete.
Verification 84% complete.
Verification 85% complete.
Verification 85% complete.
Verification 86% complete.
Verification 86% complete.
Verification 87% complete.
Verification 87% complete.
Verification 88% complete.
Verification 88% complete.
Verification 89% complete.
Verification 89% complete.
Verification 90% complete.
Verification 91% complete.
Verification 91% complete.
Verification 92% complete.
Verification 92% complete.
Verification 93% complete.
Verification 93% complete.
Verification 94% complete.
Verification 94% complete.
Verification 95% complete.
Verification 95% complete.
Verification 96% complete.
Verification 96% complete.
Verification 97% complete.
Verification 97% complete.
Verification 98% complete.
Verification 99% complete.
Verification 99% complete.
Verification 100% complete.


Windows Resource Protection did not find any integrity violations.


========= End of CMD: =========


========================= File: C:\WINDOWS\system32\hvax64.exe ========================

C:\WINDOWS\system32\hvax64.exe
File is digitally signed
MD5: 71DEC3FC40F1402060BD8B54C7064D84
Creation and modification date: 2018-01-08 23:43 - 2018-01-01 04:51
Size: 001055128
Attributes: ----N
Company Name: Microsoft Corporation
Internal Name: hvax64.exe
Original Name: hvax64.exe
Product: Microsoft® Windows® Operating System
Description: Hypervisor V2.0
File Version: 10.0.16299.192 (WinBuild.160101.0800)
Product Version: 10.0.16299.192
Copyright: © Microsoft Corporation. All rights reserved.
VirusTotal: https://www.virustotal.com/file/31327761b81a34d17b53261e780247a6fa75a1c91c5d6fff839fb0e1616328a7/analysis/1515823683/

====== End of File: ======


========================= File: C:\WINDOWS\system32\Drivers\bam.sys ========================

C:\WINDOWS\system32\Drivers\bam.sys
File is digitally signed
MD5: 763CF81762483E244BAEB83DEFFC53F3
Creation and modification date: 2018-01-08 23:43 - 2018-01-01 04:51
Size: 000059800
Attributes: ----N
Company Name: Microsoft Corporation
Internal Name: bam.sys
Original Name: bam.sys
Product: Microsoft® Windows® Operating System
Description: BAM Kernel Driver
File Version: 10.0.16299.192 (WinBuild.160101.0800)
Product Version: 10.0.16299.192
Copyright: © Microsoft Corporation. All rights reserved.
VirusTotal: https://www.virustotal.com/file/7445168b30a892871019583534f59efda4bc997b3c605ea724dbd1732f320812/analysis/1516202597/

====== End of File: ======


=========== EmptyTemp: ==========

BITS transfer queue => 6578176 B
DOMStore, IE Recovery, AppCache, Feeds Cache, Thumbcache, IconCache => 14795415 B
Java, Flash, Steam htmlcache => 543 B
Windows/system/drivers => 83934654 B
Edge => 9903363 B
Chrome => 163947846 B
Firefox => 0 B
Opera => 0 B

Temp, IE cache, history, cookies, recent:
Default => 0 B
Users => 0 B
ProgramData => 0 B
Public => 0 B
systemprofile => 0 B
systemprofile32 => 0 B
LocalService => 8178 B
NetworkService => 826 B
drpmc => 158189507 B

RecycleBin => 140370 B
EmptyTemp: => 417.2 MB temporary data Removed.

================================


The system needed a reboot.

==== End of Fixlog 08:37:47 ====

Attached Files


Edited by Oh My!, 20 January 2018 - 03:22 PM.


#9 Oh My!

Oh My!

    Adware and Spyware and Malware.....


  • Malware Response Instructor
  • 36,798 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:California
  • Local time:10:00 PM

Posted 20 January 2018 - 03:22 PM

Greetings.

 

Please copy and paste report information in your reply unless asked to attach a file.

 

Did you run the Avast Uninstall Utility?

 

Can you update me on your system performance?


Edited by Oh My!, 20 January 2018 - 03:25 PM.

Gary
 
If I do not reply within 24 hours please send me a Personal Message.

"Lord, to whom would we go? You have the words that give eternal life. We believe, and we know you are the Holy One of God."

#10 Spextrun

Spextrun
  • Topic Starter

  • Members
  • 5 posts
  • OFFLINE
  •  
  • Local time:09:00 PM

Posted 20 January 2018 - 03:41 PM

Yes, my computer is running well. 40% RAM and 6% CPU doing normal things. Also McAfee is poof gone from my computer right now. Sorry if I do not understand english is not my mother language. Also a question can I get a virus from just watching a YouTube video without clicking on any ads or anything? Also, can you get a virus from just watching a YouTube video? Not clicking on ads, not clicking on anything just simply watching a YouTube video.


Edited by Spextrun, 20 January 2018 - 04:19 PM.


#11 Oh My!

Oh My!

    Adware and Spyware and Malware.....


  • Malware Response Instructor
  • 36,798 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:California
  • Local time:10:00 PM

Posted 20 January 2018 - 03:48 PM

No problem at all, just want to make sure we are both clear on things.

Please do this.

===================================================

ESET Online Scanner

--------------------

I'd like us to scan your machine with ESET OnlineScan This process may may take several hours, that is normal.
  • Download esetsmartinstaller_enu.exe and save it to your Desktop
  • Double click the icon
  • Check YES, I accept the Terms of Use
  • Click the Start button
  • Accept any security warnings from your browser
  • Click Advanced settings
  • Check the following items

Enable detection of potentially unwanted applications
Remove found threats
Scan archives
Scan for potentially unsafe applications
Enable Anti-Stealth technology

  • Click Start
  • ESET will then download updates and begin scanning your computer
  • If no threats are found simply click Uninstall application on close and hit Finish
  • If threats are found click List of found threats
  • Click Export to text file
  • Save the file on your Desktop as ESET.txt
  • Click Back
  • Review the list of entries and if there are any you want to keep stop and copy/paste the ESET.txt report in your reply for my review
  • If you do not wish to keep any of the entries check Uninstall application on close and Delete quarantined files
  • Click Finish
  • Close the ESET Online Scanner window
  • Copy and paste the contents of ESET.txt in your reply
===================================================

Security Analysis by Rocket Grannie

--------------------
  • Please download Security Analysis by Rocket Grannie and save it to your Desktop
  • Right click on the icon and select Run as admnistrator
  • Click OK on the disclaimer and ignore any security warnings that may appear
  • In your reply, please copy and paste the contents of the Notepad document that will appear on your desktop
===================================================

Things I would like to see in your next reply. Please be sure to copy and paste any requested log information unless you are asked to attach it. :thumbsup2:
  • ESET log
  • Security Analysis log
  • How is your computer running?

Gary
 
If I do not reply within 24 hours please send me a Personal Message.

"Lord, to whom would we go? You have the words that give eternal life. We believe, and we know you are the Holy One of God."

#12 Oh My!

Oh My!

    Adware and Spyware and Malware.....


  • Malware Response Instructor
  • 36,798 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:California
  • Local time:10:00 PM

Posted 23 January 2018 - 10:10 PM

Sorry I forgot to answer your YouTube question. Just watching the video should be OK. But clicking on other links, like a description, could pose a potential risk.


Gary
 
If I do not reply within 24 hours please send me a Personal Message.

"Lord, to whom would we go? You have the words that give eternal life. We believe, and we know you are the Holy One of God."

#13 Oh My!

Oh My!

    Adware and Spyware and Malware.....


  • Malware Response Instructor
  • 36,798 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:California
  • Local time:10:00 PM

Posted 24 January 2018 - 10:17 AM

Greetings,

===================================================

Do You Still Need Help?

It has been 3 days since my last post.
  • Do you still need help with this?
  • If you have not replied within 48 hours I will assume you have abandoned the Topic and it will be closed.

Gary
 
If I do not reply within 24 hours please send me a Personal Message.

"Lord, to whom would we go? You have the words that give eternal life. We believe, and we know you are the Holy One of God."

#14 Oh My!

Oh My!

    Adware and Spyware and Malware.....


  • Malware Response Instructor
  • 36,798 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:California
  • Local time:10:00 PM

Posted 26 January 2018 - 10:04 AM

Due to the lack of feedback, this topic is now closed.

In the event you still have problems, please send me or any Moderator a Private Message and ask them to reopen this topic within the next 5 days.

Please include a link to your topic in the Private Message. Thank you.
Gary
 
If I do not reply within 24 hours please send me a Personal Message.

"Lord, to whom would we go? You have the words that give eternal life. We believe, and we know you are the Holy One of God."




0 user(s) are reading this topic

0 members, 0 guests, 0 anonymous users