Jump to content


 


Register a free account to unlock additional features at BleepingComputer.com
Welcome to BleepingComputer, a free community where people like yourself come together to discuss and learn how to use their computers. Using the site is easy and fun. As a guest, you can browse and view the various discussions in the forums, but can not create a new topic or reply to an existing one unless you are logged in. Other benefits of registering an account are subscribing to topics and forums, creating a blog, and having no ads shown anywhere on the site.


Click here to Register a free account now! or read our Welcome Guide to learn how to use this site.

Photo

New tab occasionally opens in Google Chrome & redirects me through "pqiera.net"


  • This topic is locked This topic is locked
3 replies to this topic

#1 Pqiera

Pqiera

  • Members
  • 2 posts
  • OFFLINE
  •  
  • Local time:08:18 AM

Posted 18 May 2018 - 08:45 AM

Google Chrome will occasionally open a new tab which will start with "pqiera.net" then redirect me to a "f*** free" site or some other dodgy ad website. I can't search for terms such as "adware", "malware", or "farbar" without Google Chrome closing. Also can't open a link with those key terms in them. AdwCleaner and farbar won't open unless I'm in safe mode, which is the only way I could run them. AdwCleaner hasn't detected anything recently, but did in the early stages of having this problem. Clearing whatever AdwCleaner detected didn't help.

 

Scan result of Farbar Recovery Scan Tool (FRST) (x64) Version: 16.05.2018 01
Ran by kyron (administrator) on KENTUCKYSP (18-05-2018 23:21:32)
Running from C:\Users\kyron\Desktop
Loaded Profiles: kyron (Available Profiles: kyron)
Platform: Windows 10 Pro Version 1803 17134.48 (X64) Language: English (United Kingdom)
Internet Explorer Version 11 (Default browser: Chrome)
Boot Mode: Safe Mode (minimal)
 
==================== Processes (Whitelisted) =================
 
(If an entry is included in the fixlist, the process will be closed. The file will not be moved.)
 
(Microsoft Corporation) C:\Windows\System32\dllhost.exe
(Microsoft Corporation) C:\Windows\System32\dllhost.exe
(Microsoft Corporation) C:\Windows\HelpPane.exe
() C:\Program Files\WindowsApps\Microsoft.SkypeApp_12.1813.286.0_x64__kzf8qxf38zg5c\SkypeHost.exe
(Microsoft Corporation) C:\Windows\System32\smartscreen.exe
 
==================== Registry (Whitelisted) ===========================
 
(If an entry is included in the fixlist, the registry item will be restored to default or removed. The file will not be moved.)
 
HKLM\...\Run: [SecurityHealth] => C:\Program Files\Windows Defender\MSASCuiL.exe [638872 2018-04-12] (Microsoft Corporation)
HKLM\...\Run: [AvastUI.exe] => C:\Program Files\AVAST Software\Avast\AvLaunch.exe [242904 2018-05-18] (AVAST Software)
HKLM\...\Run: [DigidesignMMERefresh] => C:\Program Files\Avid\Pro Tools First\MMERefresh.exe [117760 2018-04-03] (Avid Technology, Inc.)
HKLM-x32\...\Run: [IJNetworkScannerSelectorEX] => C:\Program Files (x86)\Canon\IJ Network Scanner Selector EX\CNMNSST.exe [235624 2015-01-09] (CANON INC.)
HKLM-x32\...\Run: [SunJavaUpdateSched] => C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe [588704 2018-03-28] (Oracle Corporation)
HKLM-x32\...\Run: [SDTray] => C:\Program Files (x86)\Spybot - Search & Destroy 2\SDTray.exe [6788032 2018-04-20] (Safer-Networking Ltd.)
HKLM Group Policy restriction on software: %systemroot%\system32\mrt.exe <==== ATTENTION
Winlogon\Notify\SDWinLogon-x32: SDWinLogon.dll [X]
HKU\S-1-5-19\...\RunOnce: [WAB Migrate] => C:\Program Files\Windows Mail\wab.exe [518144 2018-04-12] (Microsoft Corporation)
HKU\S-1-5-20\...\RunOnce: [WAB Migrate] => C:\Program Files\Windows Mail\wab.exe [518144 2018-04-12] (Microsoft Corporation)
Startup: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\Avid Application Manager.lnk [2018-05-09]
ShortcutTarget: Avid Application Manager.lnk -> C:\Program Files\Avid\Application Manager\AvidApplicationManager.exe (Avid Technology, Inc.)
Startup: C:\Users\kyron\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Send to OneNote.lnk [2018-04-15]
ShortcutTarget: Send to OneNote.lnk -> C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTEM.EXE (Microsoft Corporation)
Startup: C:\Users\kyron\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Stickies.lnk [2018-05-15]
ShortcutTarget: Stickies.lnk -> C:\Program Files (x86)\Stickies\stickies.exe (Zhorn Software)
BootExecute: autocheck autochk * sdnclean64.exe
GroupPolicy: Restriction ? <==== ATTENTION
 
==================== Internet (Whitelisted) ====================
 
(If an item is included in the fixlist, if it is a registry item it will be removed or restored to default.)
 
Tcpip\Parameters: [DhcpNameServer] 10.0.0.138
Tcpip\..\Interfaces\{39455ee6-1da3-496b-9c14-739150a95477}: [DhcpNameServer] 10.0.0.138
Tcpip\..\Interfaces\{b03b855d-b00d-406d-942e-bb1d07a79f50}: [DhcpNameServer] 10.0.0.138
Tcpip\..\Interfaces\{bc03c7fc-3761-41dd-8490-7913e1a3d21c}: [DhcpNameServer] 10.0.0.138
Tcpip\..\Interfaces\{e8b7f8c7-a979-4f21-8209-09ff533e7b29}: [DhcpNameServer] 10.0.0.138
 
Internet Explorer:
==================
HKU\S-1-5-21-1795529150-3527648200-2130702207-1001\Software\Microsoft\Internet Explorer\Main,Start Page = about:blank
BHO: Lync Browser Helper -> {31D09BA0-12F5-4CCE-BE8A-2923E76605DA} -> C:\Program Files (x86)\Microsoft Office\root\VFS\ProgramFilesX64\Microsoft Office\Office16\OCHelper.dll [2018-05-18] (Microsoft Corporation)
BHO: Microsoft OneDrive for Business Browser Helper -> {D0498E0A-45B7-42AE-A9AA-ABA463DBD3BF} -> C:\Program Files (x86)\Microsoft Office\root\VFS\ProgramFilesX64\Microsoft Office\Office16\GROOVEEX.DLL [2018-05-18] (Microsoft Corporation)
BHO-x32: Lync Browser Helper -> {31D09BA0-12F5-4CCE-BE8A-2923E76605DA} -> C:\Program Files (x86)\Microsoft Office\root\Office16\OCHelper.dll [2018-01-19] (Microsoft Corporation)
BHO-x32: Java™ Plug-In SSV Helper -> {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} -> C:\Program Files (x86)\Java\jre1.8.0_171\bin\ssv.dll [2018-04-18] (Oracle Corporation)
BHO-x32: Microsoft OneDrive for Business Browser Helper -> {D0498E0A-45B7-42AE-A9AA-ABA463DBD3BF} -> C:\Program Files (x86)\Microsoft Office\root\Office16\GROOVEEX.DLL [2018-01-19] (Microsoft Corporation)
BHO-x32: Java™ Plug-In 2 SSV Helper -> {DBC80044-A445-435b-BC74-9C25C1C588A9} -> C:\Program Files (x86)\Java\jre1.8.0_171\bin\jp2ssv.dll [2018-04-18] (Oracle Corporation)
Handler-x32: mso-minsb-roaming.16 - {83C25742-A9F7-49FB-9138-434302C88D07} - C:\Program Files (x86)\Microsoft Office\root\Office16\MSOSB.DLL [2018-01-19] (Microsoft Corporation)
Handler-x32: mso-minsb.16 - {42089D2D-912D-4018-9087-2B87803E93FB} - C:\Program Files (x86)\Microsoft Office\root\Office16\MSOSB.DLL [2018-01-19] (Microsoft Corporation)
Handler-x32: osf-roaming.16 - {42089D2D-912D-4018-9087-2B87803E93FB} - C:\Program Files (x86)\Microsoft Office\root\Office16\MSOSB.DLL [2018-01-19] (Microsoft Corporation)
Handler-x32: osf.16 - {5504BE45-A83B-4808-900A-3A5C36E7F77A} - C:\Program Files (x86)\Microsoft Office\root\Office16\MSOSB.DLL [2018-01-19] (Microsoft Corporation)
 
FireFox:
========
FF DefaultProfile: km7v8lq6.default
FF ProfilePath: C:\Users\kyron\AppData\Roaming\Mozilla\Firefox\Profiles\km7v8lq6.default [2018-05-18]
FF Extension: (Avast SafePrice) - C:\Users\kyron\AppData\Roaming\Mozilla\Firefox\Profiles\km7v8lq6.default\Extensions\sp@avast.com.xpi [2018-03-21]
FF Extension: (Avast Online Security) - C:\Users\kyron\AppData\Roaming\Mozilla\Firefox\Profiles\km7v8lq6.default\Extensions\wrc@avast.com.xpi [2017-11-13]
FF Plugin-x32: @java.com/DTPlugin,version=11.171.2 -> C:\Program Files (x86)\Java\jre1.8.0_171\bin\dtplugin\npDeployJava1.dll [2018-04-18] (Oracle Corporation)
FF Plugin-x32: @java.com/JavaPlugin,version=11.171.2 -> C:\Program Files (x86)\Java\jre1.8.0_171\bin\plugin2\npjp2.dll [2018-04-18] (Oracle Corporation)
FF Plugin-x32: @microsoft.com/Lync,version=15.0 -> C:\Program Files (x86)\Microsoft Office\root\VFS\ProgramFilesX86\Mozilla Firefox\plugins\npmeetingjoinpluginoc.dll [2018-01-19] (Microsoft Corporation)
FF Plugin-x32: @microsoft.com/SharePoint,version=14.0 -> C:\Program Files (x86)\Microsoft Office\root\Office16\NPSPWRAP.DLL [2018-01-19] (Microsoft Corporation)
FF Plugin-x32: @tools.google.com/Google Update;version=3 -> C:\Program Files (x86)\Google\Update\1.3.33.17\npGoogleUpdate3.dll [2018-05-17] (Google Inc.)
FF Plugin-x32: @tools.google.com/Google Update;version=9 -> C:\Program Files (x86)\Google\Update\1.3.33.17\npGoogleUpdate3.dll [2018-05-17] (Google Inc.)
FF Plugin-x32: Adobe Reader -> C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AIR\nppdf32.dll [2018-05-11] (Adobe Systems Inc.)
 
Chrome: 
=======
CHR DefaultProfile: Profile 2
CHR HomePage: Profile 2 -> hxxp://mail.google.com/
CHR Profile: C:\Users\kyron\AppData\Local\Google\Chrome\User Data\ChromeDefaultData [2017-11-30] <==== ATTENTION
CHR Profile: C:\Users\kyron\AppData\Local\Google\Chrome\User Data\Default [2018-05-18]
CHR Extension: (Google Docs) - C:\Users\kyron\AppData\Local\Google\Chrome\User Data\Default\Extensions\aohghmighlieiainnegkcijnfilokake [2017-06-24]
CHR Extension: (Google Drive) - C:\Users\kyron\AppData\Local\Google\Chrome\User Data\Default\Extensions\apdfllckaahabafndbhieahigkjlhalf [2017-06-24]
CHR Extension: (YouTube) - C:\Users\kyron\AppData\Local\Google\Chrome\User Data\Default\Extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo [2017-06-24]
CHR Extension: (Tampermonkey) - C:\Users\kyron\AppData\Local\Google\Chrome\User Data\Default\Extensions\dhdgffkkebhmkfjojejmpbldmpobfkfo [2018-05-17]
CHR Extension: (Adobe Acrobat) - C:\Users\kyron\AppData\Local\Google\Chrome\User Data\Default\Extensions\efaidnbmnnnibpcajpcglclefindmkaj [2017-06-24]
CHR Extension: (Google Sheets) - C:\Users\kyron\AppData\Local\Google\Chrome\User Data\Default\Extensions\felcaaldnbdncclmgdcncolpebgiejap [2017-06-24]
CHR Extension: (Google Docs Offline) - C:\Users\kyron\AppData\Local\Google\Chrome\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi [2017-06-24]
CHR Extension: (ScriptMonkey) - C:\Users\kyron\AppData\Local\Google\Chrome\User Data\Default\Extensions\lblbnlfhhblmfconjalikamamlgoobbe [2018-05-17]
CHR Extension: (Chrome Web Store Payments) - C:\Users\kyron\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda [2017-06-24]
CHR Extension: (Gmail) - C:\Users\kyron\AppData\Local\Google\Chrome\User Data\Default\Extensions\pjkljhegncpnkpknbcohdijeoejaedia [2017-06-24]
CHR Profile: C:\Users\kyron\AppData\Local\Google\Chrome\User Data\Profile 2 [2018-05-18]
CHR Extension: (Slides) - C:\Users\kyron\AppData\Local\Google\Chrome\User Data\Profile 2\Extensions\aapocclcgogkmnckokdopfmhonfmgoek [2017-10-13]
CHR Extension: (Duolingo on the Web) - C:\Users\kyron\AppData\Local\Google\Chrome\User Data\Profile 2\Extensions\aiahmijlpehemcpleichkcokhegllfjl [2016-09-13]
CHR Extension: (Docs) - C:\Users\kyron\AppData\Local\Google\Chrome\User Data\Profile 2\Extensions\aohghmighlieiainnegkcijnfilokake [2017-10-13]
CHR Extension: (My Social Media Custom Theme) - C:\Users\kyron\AppData\Local\Google\Chrome\User Data\Profile 2\Extensions\aoplmgafblbhcgmbcgdjlgckefefmpbg [2017-04-15]
CHR Extension: (Google Drive) - C:\Users\kyron\AppData\Local\Google\Chrome\User Data\Profile 2\Extensions\apdfllckaahabafndbhieahigkjlhalf [2016-09-10]
CHR Extension: (YouTube) - C:\Users\kyron\AppData\Local\Google\Chrome\User Data\Profile 2\Extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo [2016-09-10]
CHR Extension: (Advanced Font Settings) - C:\Users\kyron\AppData\Local\Google\Chrome\User Data\Profile 2\Extensions\caclkomlalccbpcdllchkeecicepbmbm [2017-05-21]
CHR Extension: (Adblock Plus) - C:\Users\kyron\AppData\Local\Google\Chrome\User Data\Profile 2\Extensions\cfhdojbkjhnklbpkdaibdccddilifddb [2018-05-16]
CHR Extension: (Adobe Acrobat) - C:\Users\kyron\AppData\Local\Google\Chrome\User Data\Profile 2\Extensions\efaidnbmnnnibpcajpcglclefindmkaj [2017-03-05]
CHR Extension: (Sheets) - C:\Users\kyron\AppData\Local\Google\Chrome\User Data\Profile 2\Extensions\felcaaldnbdncclmgdcncolpebgiejap [2017-10-13]
CHR Extension: (NationStates++) - C:\Users\kyron\AppData\Local\Google\Chrome\User Data\Profile 2\Extensions\gcgdpgjockahmkhjgcfidmlahiicmagj [2017-10-22]
CHR Extension: (Google Docs Offline) - C:\Users\kyron\AppData\Local\Google\Chrome\User Data\Profile 2\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi [2016-09-10]
CHR Extension: (Tumblr Optimiser) - C:\Users\kyron\AppData\Local\Google\Chrome\User Data\Profile 2\Extensions\ilaebdchnmobmcalandfmfmlneeghoag [2018-04-02]
CHR Extension: (Reddit Enhancement Suite) - C:\Users\kyron\AppData\Local\Google\Chrome\User Data\Profile 2\Extensions\kbmfpngjjgdllneeigpgjifpgocmfgmb [2018-05-06]
CHR Extension: (F.B.(FluffBusting)Purity) - C:\Users\kyron\AppData\Local\Google\Chrome\User Data\Profile 2\Extensions\nmkinhboiljjkhaknpaeaicmdjhagpep [2018-05-17]
CHR Extension: (Chrome Web Store Payments) - C:\Users\kyron\AppData\Local\Google\Chrome\User Data\Profile 2\Extensions\nmmhkkegccagdldgiimedpiccmgmieda [2018-04-03]
CHR Extension: (Gmail) - C:\Users\kyron\AppData\Local\Google\Chrome\User Data\Profile 2\Extensions\pjkljhegncpnkpknbcohdijeoejaedia [2016-09-10]
CHR Extension: (Chrome Media Router) - C:\Users\kyron\AppData\Local\Google\Chrome\User Data\Profile 2\Extensions\pkedcjkdefgpdelpbcmbmeomcjbeemfm [2018-04-29]
CHR Profile: C:\Users\kyron\AppData\Local\Google\Chrome\User Data\System Profile [2016-09-10]
CHR HKLM-x32\...\Chrome\Extension: [efaidnbmnnnibpcajpcglclefindmkaj] - hxxps://clients2.google.com/service/update2/crx
CHR HKLM-x32\...\Chrome\Extension: [eofcbnmajmjmplflapaojjnihcjkigck] - hxxps://clients2.google.com/service/update2/crx
CHR HKLM-x32\...\Chrome\Extension: [gomekmidlodglbbmalcneegieacbdmki] - hxxps://clients2.google.com/service/update2/crx
 
==================== Services (Whitelisted) ====================
 
(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)
 
S3 aswbIDSAgent; C:\Program Files\AVAST Software\Avast\x64\aswidsagenta.exe [7620096 2018-05-18] (AVAST Software)
S2 avast; C:\Program Files (x86)\AVAST Software\Browser\Update\AvastBrowserUpdate.exe [164984 2018-04-07] (AVAST Software)
S2 avast! Antivirus; C:\Program Files\AVAST Software\Avast\AvastSvc.exe [317280 2018-05-18] (AVAST Software)
S3 avastm; C:\Program Files (x86)\AVAST Software\Browser\Update\AvastBrowserUpdate.exe [164984 2018-04-07] (AVAST Software)
S2 AvidHubService; C:\Program Files\Avid\Cloud Client Services\Hub.exe [2299208 2017-11-09] (Avid Technology, Inc.)
S2 AvidTransportClient; C:\Program Files\Avid\Cloud Client Services\TransportClient.exe [7067464 2017-11-09] (Avid Technology, Inc.)
S2 ClickToRunSvc; C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe [7761584 2018-04-27] (Microsoft Corporation)
S2 DigiRefresh; C:\Program Files\Avid\Pro Tools First\MMERefresh.exe [117760 2018-04-03] (Avid Technology, Inc.) [File not signed]
S3 digiSPTIService64; C:\Program Files\Avid\Pro Tools First\digisptiservice64.exe [197632 2018-04-03] (Avid Technology, Inc.) [File not signed]
S2 MBAMService; C:\Program Files\Malwarebytes\Anti-Malware\mbamservice.exe [6479136 2018-03-27] (Malwarebytes)
S3 Origin Client Service; C:\Program Files (x86)\Origin\OriginClientService.exe [2158400 2018-04-25] (Electronic Arts)
S2 Origin Web Helper Service; C:\Program Files (x86)\Origin\OriginWebHelperService.exe [3028808 2018-04-25] (Electronic Arts)
S2 SDScannerService; C:\Program Files (x86)\Spybot - Search & Destroy 2\SDFSSvc.exe [3892256 2018-04-20] (Safer-Networking Ltd.)
S2 SDUpdateService; C:\Program Files (x86)\Spybot - Search & Destroy 2\SDUpdSvc.exe [3943664 2018-04-20] (Safer-Networking Ltd.)
S2 SDWSCService; C:\Program Files (x86)\Spybot - Search & Destroy 2\SDWSCSvc.exe [233712 2018-02-06] (Safer-Networking Ltd.)
S3 Sense; C:\Program Files\Windows Defender Advanced Threat Protection\MsSense.exe [4737448 2018-04-13] (Microsoft Corporation)
S3 ssh-agent; C:\WINDOWS\System32\OpenSSH\ssh-agent.exe [495616 2018-03-11] ()
S3 WdNisSvc; C:\Program Files\Windows Defender\NisSrv.exe [4451616 2018-04-12] (Microsoft Corporation)
S3 WinDefend; C:\Program Files\Windows Defender\MsMpEng.exe [105344 2018-04-12] (Microsoft Corporation)
S2 igfxCUIService2.0.0.0; C:\WINDOWS\system32\igfxCUIService.exe [X]
S2 PaceLicenseDServices; "C:\Program Files (x86)\Common Files\PACE\Services\LicenseServices\LDSvc.exe" -u https://activation.paceap.com/InitiateActivation [X] <==== ATTENTION
 
===================== Drivers (Whitelisted) ======================
 
(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)
 
S1 aswArPot; C:\WINDOWS\System32\drivers\aswArPot.sys [196640 2018-05-18] (AVAST Software)
S1 aswbidsdriver; C:\WINDOWS\System32\drivers\aswbidsdrivera.sys [227504 2018-03-17] (AVAST Software)
S0 aswbidsh; C:\WINDOWS\System32\drivers\aswbidsha.sys [199440 2018-03-17] (AVAST Software)
S0 aswblog; C:\WINDOWS\System32\drivers\aswbloga.sys [343752 2018-03-17] (AVAST Software)
S0 aswbuniv; C:\WINDOWS\System32\drivers\aswbuniva.sys [57680 2018-03-17] (AVAST Software)
S1 aswHdsKe; C:\WINDOWS\System32\drivers\aswHdsKe.sys [234560 2018-05-18] (AVAST Software)
S3 aswHwid; C:\WINDOWS\System32\drivers\aswHwid.sys [46968 2018-05-18] (AVAST Software)
S2 aswMonFlt; C:\WINDOWS\System32\drivers\aswMonFlt.sys [159120 2018-05-18] (AVAST Software)
S1 aswRdr; C:\WINDOWS\System32\drivers\aswRdr2.sys [111360 2018-05-18] (AVAST Software)
S0 aswRvrt; C:\WINDOWS\System32\drivers\aswRvrt.sys [85968 2018-05-18] (AVAST Software)
S1 aswSnx; C:\WINDOWS\System32\drivers\aswSnx.sys [1027720 2018-05-18] (AVAST Software)
S1 aswSP; C:\WINDOWS\System32\drivers\aswSP.sys [460520 2018-05-18] (AVAST Software)
S2 aswStm; C:\WINDOWS\System32\drivers\aswStm.sys [205976 2018-05-18] (AVAST Software)
S0 aswVmm; C:\WINDOWS\System32\drivers\aswVmm.sys [381552 2018-05-18] (AVAST Software)
S3 dg_ssudbus; C:\WINDOWS\system32\DRIVERS\ssudbus.sys [131712 2016-09-05] (Samsung Electronics Co., Ltd.)
R3 iactrllogic; C:\WINDOWS\System32\drivers\iactrllogic64.sys [183184 2017-10-12] (Intel® Corporation)
R0 MBAMSwissArmy; C:\WINDOWS\System32\Drivers\mbamswissarmy.sys [253664 2018-05-18] (Malwarebytes)
S3 Microsoft_Bluetooth_AvrcpTransport; C:\WINDOWS\system32\DRIVERS\Microsoft.Bluetooth.AvrcpTransport.sys [46592 2018-04-12] (Microsoft Corporation)
S3 ssudmdm; C:\WINDOWS\system32\DRIVERS\ssudmdm.sys [165504 2016-09-05] (Samsung Electronics Co., Ltd.)
S3 WdBoot; C:\WINDOWS\system32\drivers\WdBoot.sys [44616 2018-04-12] (Microsoft Corporation)
S3 WdFilter; C:\WINDOWS\system32\drivers\WdFilter.sys [331680 2018-04-12] (Microsoft Corporation)
S3 WdNisDrv; C:\WINDOWS\System32\Drivers\WdNisDrv.sys [44032 2018-04-12] (Microsoft Corporation)
S1 ZAM_Guard; C:\WINDOWS\System32\drivers\zamguard64.sys [203680 2016-09-11] (Zemana Ltd.)
 
==================== NetSvcs (Whitelisted) ===================
 
(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)
 
 
==================== One Month Created files and folders ========
 
(If an entry is included in the fixlist, the file/folder will be moved.)
 
2018-05-18 23:21 - 2018-05-18 23:21 - 000018069 _____ C:\Users\kyron\Desktop\FRST.txt
2018-05-18 23:21 - 2018-05-18 23:21 - 000000000 ____D C:\FRST
2018-05-18 23:18 - 2018-05-18 23:11 - 002413056 _____ (Farbar) C:\Users\kyron\Desktop\FRST64.exe
2018-05-18 16:48 - 2018-05-18 22:41 - 000000000 ____D C:\WINDOWS\Minidump
2018-05-18 16:30 - 2018-05-18 16:30 - 000121663 _____ C:\Users\kyron\OneDrive\Documents\Roots_English_Rouns_2018-05-12 (2).pdf
2018-05-18 16:30 - 2018-05-18 16:30 - 000121046 _____ C:\Users\kyron\OneDrive\Documents\Roots_English_Rouns_2018-05-12 (1).pdf
2018-05-18 16:29 - 2018-05-18 16:29 - 000119743 _____ C:\Users\kyron\OneDrive\Documents\Roots_English_Rouns_2018-05-12.pdf
2018-05-18 15:04 - 2018-05-18 23:17 - 000000000 ____D C:\Program Files (x86)\Spybot - Search & Destroy 2
2018-05-18 15:04 - 2018-05-18 15:38 - 000000000 ____D C:\ProgramData\Spybot - Search & Destroy
2018-05-18 15:04 - 2018-05-18 15:04 - 000001471 _____ C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Spybot-S&D Start Center.lnk
2018-05-18 15:04 - 2018-05-18 15:04 - 000001459 _____ C:\Users\Public\Desktop\Spybot-S&D Start Center.lnk
2018-05-18 15:04 - 2018-05-18 15:04 - 000000656 _____ C:\WINDOWS\Tasks\Check for updates (Spybot - Search & Destroy).job
2018-05-18 15:04 - 2018-05-18 15:04 - 000000628 _____ C:\WINDOWS\Tasks\Refresh immunization (Spybot - Search & Destroy).job
2018-05-18 15:04 - 2018-05-18 15:04 - 000000458 _____ C:\WINDOWS\Tasks\Scan the system (Spybot - Search & Destroy).job
2018-05-18 15:04 - 2018-05-18 15:04 - 000000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Spybot - Search & Destroy 2
2018-05-18 15:04 - 2018-02-06 19:04 - 000032168 _____ (Safer-Networking Ltd.) C:\WINDOWS\system32\sdnclean64.exe
2018-05-18 15:00 - 2018-05-18 15:01 - 069910960 _____ (Safer-Networking Ltd. ) C:\Users\kyron\OneDrive\Documents\spybotsd-2.7.64.0.exe
2018-05-18 14:10 - 2018-05-18 14:10 - 003861056 _____ C:\Users\kyron\Downloads\adwcleaner_6.020.exe
2018-05-18 12:42 - 2018-05-18 12:42 - 000376536 _____ (AVAST Software) C:\WINDOWS\system32\aswBoot.exe
2018-05-17 18:56 - 2018-05-17 20:01 - 000001226 _____ C:\Users\kyron\Desktop\Sid Meiers Civilization VI Rise and Fall.lnk
2018-05-17 17:54 - 2018-05-17 17:54 - 000003880 _____ C:\WINDOWS\System32\Tasks\{67E0B68F-0151-BE0A-131C-1F78450D9CD1}
2018-05-17 17:54 - 2018-05-17 17:54 - 000003722 _____ C:\WINDOWS\System32\Tasks\{AB14743F-D9FE-687A-6964-FF7296FEEA1B}
2018-05-17 17:54 - 2018-05-17 17:54 - 000003526 _____ C:\WINDOWS\System32\Tasks\{813DD28E-3776-67DA-B3B1-FC471BF531A4}
2018-05-17 17:54 - 2018-05-17 17:54 - 000000002 _____ C:\Users\kyron\AppData\Local\WMI.ini
2018-05-17 17:24 - 2018-05-18 22:41 - 000000000 ____D C:\Users\kyron\AppData\Local\D3DSCache
2018-05-16 18:23 - 2018-05-16 22:24 - 000000000 ____D C:\Users\kyron\AppData\Local\PlaceholderTileLogoFolder
2018-05-16 14:47 - 2018-05-16 04:58 - 000000000 ____D C:\Windows.old
2018-05-16 14:43 - 2018-05-16 14:47 - 000000000 ____D C:\WINDOWS\system32\config\bbimigrate
2018-05-16 14:42 - 2018-05-16 14:43 - 000000000 ____D C:\WINDOWS\ServiceProfiles
2018-05-16 14:42 - 2018-05-16 14:42 - 000008192 _____ C:\WINDOWS\system32\config\userdiff
2018-05-16 14:40 - 2018-05-16 14:40 - 025848832 _____ (Microsoft Corporation) C:\WINDOWS\system32\edgehtml.dll
2018-05-16 14:40 - 2018-05-16 14:40 - 023862272 _____ (Microsoft Corporation) C:\WINDOWS\system32\Hydrogen.dll
2018-05-16 14:40 - 2018-05-16 14:40 - 022707712 _____ (Microsoft Corporation) C:\WINDOWS\system32\mshtml.dll
2018-05-16 14:40 - 2018-05-16 14:40 - 022002688 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\edgehtml.dll
2018-05-16 14:40 - 2018-05-16 14:40 - 021389360 _____ (Microsoft Corporation) C:\WINDOWS\system32\shell32.dll
2018-05-16 14:40 - 2018-05-16 14:40 - 020383720 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\shell32.dll
2018-05-16 14:40 - 2018-05-16 14:40 - 019525120 _____ (Microsoft Corporation) C:\WINDOWS\system32\HologramCompositor.dll
2018-05-16 14:40 - 2018-05-16 14:40 - 019399168 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\mshtml.dll
2018-05-16 14:40 - 2018-05-16 14:40 - 013570560 _____ (Microsoft Corporation) C:\WINDOWS\system32\wmp.dll
2018-05-16 14:40 - 2018-05-16 14:40 - 012712960 _____ (Microsoft Corporation) C:\WINDOWS\system32\ieframe.dll
2018-05-16 14:40 - 2018-05-16 14:40 - 012500992 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\wmp.dll
2018-05-16 14:40 - 2018-05-16 14:40 - 011903488 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\ieframe.dll
2018-05-16 14:40 - 2018-05-16 14:40 - 009159064 _____ (Microsoft Corporation) C:\WINDOWS\system32\ntoskrnl.exe
2018-05-16 14:40 - 2018-05-16 14:40 - 008623104 _____ (Microsoft Corporation) C:\WINDOWS\system32\mstscax.dll
2018-05-16 14:40 - 2018-05-16 14:40 - 008188928 _____ (Microsoft Corporation) C:\WINDOWS\system32\Windows.Data.Pdf.dll
2018-05-16 14:40 - 2018-05-16 14:40 - 007987712 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\mstscax.dll
2018-05-16 14:40 - 2018-05-16 14:40 - 007583232 _____ (Microsoft Corporation) C:\WINDOWS\system32\Chakra.dll
2018-05-16 14:40 - 2018-05-16 14:40 - 007519992 _____ (Microsoft Corporation) C:\WINDOWS\system32\Windows.Media.Protection.PlayReady.dll
2018-05-16 14:40 - 2018-05-16 14:40 - 007436624 _____ (Microsoft Corporation) C:\WINDOWS\system32\windows.storage.dll
2018-05-16 14:40 - 2018-05-16 14:40 - 006661632 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\Windows.Data.Pdf.dll
2018-05-16 14:40 - 2018-05-16 14:40 - 006569952 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\Windows.Media.Protection.PlayReady.dll
2018-05-16 14:40 - 2018-05-16 14:40 - 006044104 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\windows.storage.dll
2018-05-16 14:40 - 2018-05-16 14:40 - 005951488 _____ (Microsoft Corporation) C:\WINDOWS\system32\dbgeng.dll
2018-05-16 14:40 - 2018-05-16 14:40 - 005782528 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\Chakra.dll
2018-05-16 14:40 - 2018-05-16 14:40 - 004929024 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\dbgeng.dll
2018-05-16 14:40 - 2018-05-16 14:40 - 004867072 _____ (Microsoft Corporation) C:\WINDOWS\system32\jscript9.dll
2018-05-16 14:40 - 2018-05-16 14:40 - 004706816 _____ (Microsoft Corporation) C:\WINDOWS\system32\cdp.dll
2018-05-16 14:40 - 2018-05-16 14:40 - 004372992 _____ (Microsoft Corporation) C:\WINDOWS\system32\EdgeContent.dll
2018-05-16 14:40 - 2018-05-16 14:40 - 004070400 _____ (Microsoft Corporation) C:\WINDOWS\system32\msi.dll
2018-05-16 14:40 - 2018-05-16 14:40 - 003732800 _____ C:\WINDOWS\system32\Windows.Mirage.dll
2018-05-16 14:40 - 2018-05-16 14:40 - 003712000 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\jscript9.dll
2018-05-16 14:40 - 2018-05-16 14:40 - 003655168 _____ (Microsoft Corporation) C:\WINDOWS\system32\win32kfull.sys
2018-05-16 14:40 - 2018-05-16 14:40 - 003440640 _____ (Microsoft Corporation) C:\WINDOWS\system32\wininet.dll
2018-05-16 14:40 - 2018-05-16 14:40 - 003392512 _____ (Microsoft Corporation) C:\WINDOWS\system32\tquery.dll
2018-05-16 14:40 - 2018-05-16 14:40 - 003389952 _____ (Microsoft Corporation) C:\WINDOWS\system32\AppXDeploymentServer.dll
2018-05-16 14:40 - 2018-05-16 14:40 - 003320320 _____ (Microsoft Corporation) C:\WINDOWS\system32\dwmcore.dll
2018-05-16 14:40 - 2018-05-16 14:40 - 003283400 _____ (Microsoft Corporation) C:\WINDOWS\system32\CoreUIComponents.dll
2018-05-16 14:40 - 2018-05-16 14:40 - 003086336 _____ (Microsoft Corporation) C:\WINDOWS\system32\diagtrack.dll
2018-05-16 14:40 - 2018-05-16 14:40 - 003015168 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\wininet.dll
2018-05-16 14:40 - 2018-05-16 14:40 - 002961408 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\cdp.dll
2018-05-16 14:40 - 2018-05-16 14:40 - 002902528 _____ (Microsoft Corporation) C:\WINDOWS\system32\wuaueng.dll
2018-05-16 14:40 - 2018-05-16 14:40 - 002900992 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\dwmcore.dll
2018-05-16 14:40 - 2018-05-16 14:40 - 002897408 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\win32kfull.sys
2018-05-16 14:40 - 2018-05-16 14:40 - 002841312 _____ C:\WINDOWS\SysWOW64\Windows.Mirage.dll
2018-05-16 14:40 - 2018-05-16 14:40 - 002835864 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\dxgkrnl.sys
2018-05-16 14:40 - 2018-05-16 14:40 - 002753040 _____ (Microsoft Corporation) C:\WINDOWS\system32\iertutil.dll
2018-05-16 14:40 - 2018-05-16 14:40 - 002700800 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\tquery.dll
2018-05-16 14:40 - 2018-05-16 14:40 - 002486976 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\CoreUIComponents.dll
2018-05-16 14:40 - 2018-05-16 14:40 - 002422168 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\ntfs.sys
2018-05-16 14:40 - 2018-05-16 14:40 - 002366976 _____ (Microsoft Corporation) C:\WINDOWS\system32\WebRuntimeManager.dll
2018-05-16 14:40 - 2018-05-16 14:40 - 002242208 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\iertutil.dll
2018-05-16 14:40 - 2018-05-16 14:40 - 002236928 _____ (Microsoft Corporation) C:\WINDOWS\system32\win32kbase.sys
2018-05-16 14:40 - 2018-05-16 14:40 - 002170368 _____ (Microsoft Corporation) C:\WINDOWS\system32\AppXDeploymentExtensions.onecore.dll
2018-05-16 14:40 - 2018-05-16 14:40 - 001953280 _____ C:\WINDOWS\system32\rdpnano.dll
2018-05-16 14:40 - 2018-05-16 14:40 - 001855488 _____ (Microsoft Corporation) C:\WINDOWS\system32\msxml3.dll
2018-05-16 14:40 - 2018-05-16 14:40 - 001817088 _____ (Microsoft Corporation) C:\WINDOWS\system32\urlmon.dll
2018-05-16 14:40 - 2018-05-16 14:40 - 001664512 _____ (Microsoft Corporation) C:\WINDOWS\system32\comsvcs.dll
2018-05-16 14:40 - 2018-05-16 14:40 - 001636352 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\urlmon.dll
2018-05-16 14:40 - 2018-05-16 14:40 - 001634800 _____ (Microsoft Corporation) C:\WINDOWS\system32\gdi32full.dll
2018-05-16 14:40 - 2018-05-16 14:40 - 001586176 _____ (Microsoft Corporation) C:\WINDOWS\system32\ieapfltr.dll
2018-05-16 14:40 - 2018-05-16 14:40 - 001585664 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\msxml3.dll
2018-05-16 14:40 - 2018-05-16 14:40 - 001565592 _____ (Microsoft Corporation) C:\WINDOWS\system32\AppxPackaging.dll
2018-05-16 14:40 - 2018-05-16 14:40 - 001550848 _____ (Microsoft Corporation) C:\WINDOWS\system32\AppXDeploymentExtensions.desktop.dll
2018-05-16 14:40 - 2018-05-16 14:40 - 001534976 _____ (Microsoft Corporation) C:\WINDOWS\system32\lsasrv.dll
2018-05-16 14:40 - 2018-05-16 14:40 - 001466368 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\ieapfltr.dll
2018-05-16 14:40 - 2018-05-16 14:40 - 001456616 _____ (Microsoft Corporation) C:\WINDOWS\system32\winload.efi
2018-05-16 14:40 - 2018-05-16 14:40 - 001454016 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\gdi32full.dll
2018-05-16 14:40 - 2018-05-16 14:40 - 001426328 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\AppxPackaging.dll
2018-05-16 14:40 - 2018-05-16 14:40 - 001421312 _____ (Microsoft Corporation) C:\WINDOWS\system32\rdpbase.dll
2018-05-16 14:40 - 2018-05-16 14:40 - 001380864 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\comsvcs.dll
2018-05-16 14:40 - 2018-05-16 14:40 - 001258280 _____ (Microsoft Corporation) C:\WINDOWS\system32\winload.exe
2018-05-16 14:40 - 2018-05-16 14:40 - 001235968 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\rdpbase.dll
2018-05-16 14:40 - 2018-05-16 14:40 - 001191168 _____ (Microsoft Corporation) C:\WINDOWS\system32\rpcrt4.dll
2018-05-16 14:40 - 2018-05-16 14:40 - 001174424 _____ (Microsoft Corporation) C:\WINDOWS\system32\hvix64.exe
2018-05-16 14:40 - 2018-05-16 14:40 - 001160192 _____ (Microsoft Corporation) C:\WINDOWS\system32\rpcss.dll
2018-05-16 14:40 - 2018-05-16 14:40 - 001063320 _____ (Microsoft Corporation) C:\WINDOWS\system32\SecConfig.efi
2018-05-16 14:40 - 2018-05-16 14:40 - 001034624 _____ (Microsoft Corporation) C:\WINDOWS\system32\ApplyTrustOffline.exe
2018-05-16 14:40 - 2018-05-16 14:40 - 001012120 _____ (Microsoft Corporation) C:\WINDOWS\system32\hvax64.exe
2018-05-16 14:40 - 2018-05-16 14:40 - 000976384 _____ (Microsoft Corporation) C:\WINDOWS\system32\Spectrum.exe
2018-05-16 14:40 - 2018-05-16 14:40 - 000960512 _____ (Microsoft Corporation) C:\WINDOWS\system32\StorSvc.dll
2018-05-16 14:40 - 2018-05-16 14:40 - 000944640 _____ (Microsoft Corporation) C:\WINDOWS\system32\Windows.Mirage.Internal.dll
2018-05-16 14:40 - 2018-05-16 14:40 - 000933376 _____ (Microsoft Corporation) C:\WINDOWS\system32\rasapi32.dll
2018-05-16 14:40 - 2018-05-16 14:40 - 000917504 _____ (Microsoft Corporation) C:\WINDOWS\system32\wuapi.dll
2018-05-16 14:40 - 2018-05-16 14:40 - 000898560 _____ (Microsoft Corporation) C:\WINDOWS\system32\WpcWebFilter.dll
2018-05-16 14:40 - 2018-05-16 14:40 - 000894464 _____ (Microsoft Corporation) C:\WINDOWS\system32\webplatstorageserver.dll
2018-05-16 14:40 - 2018-05-16 14:40 - 000885848 _____ (Microsoft Corporation) C:\WINDOWS\system32\CoreMessaging.dll
2018-05-16 14:40 - 2018-05-16 14:40 - 000860160 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\rasapi32.dll
2018-05-16 14:40 - 2018-05-16 14:40 - 000836608 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\wuapi.dll
2018-05-16 14:40 - 2018-05-16 14:40 - 000826776 _____ (Microsoft Corporation) C:\WINDOWS\system32\AppVClient.exe
2018-05-16 14:40 - 2018-05-16 14:40 - 000814592 _____ (Microsoft Corporation) C:\WINDOWS\system32\EdgeManager.dll
2018-05-16 14:40 - 2018-05-16 14:40 - 000788216 _____ (Microsoft Corporation) C:\WINDOWS\system32\oleaut32.dll
2018-05-16 14:40 - 2018-05-16 14:40 - 000786168 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\rpcrt4.dll
2018-05-16 14:40 - 2018-05-16 14:40 - 000776880 _____ (Microsoft Corporation) C:\WINDOWS\system32\wer.dll
2018-05-16 14:40 - 2018-05-16 14:40 - 000775680 _____ (Microsoft Corporation) C:\WINDOWS\system32\jscript.dll
2018-05-16 14:40 - 2018-05-16 14:40 - 000758272 _____ (Microsoft Corporation) C:\WINDOWS\system32\msfeeds.dll
2018-05-16 14:40 - 2018-05-16 14:40 - 000749976 _____ (Microsoft Corporation) C:\WINDOWS\system32\AppVReporting.dll
2018-05-16 14:40 - 2018-05-16 14:40 - 000733992 _____ (Microsoft Corporation) C:\WINDOWS\system32\AppXDeploymentClient.dll
2018-05-16 14:40 - 2018-05-16 14:40 - 000726528 _____ (Microsoft Corporation) C:\WINDOWS\system32\jscript9diag.dll
2018-05-16 14:40 - 2018-05-16 14:40 - 000709816 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\cng.sys
2018-05-16 14:40 - 2018-05-16 14:40 - 000705944 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\vhdmp.sys
2018-05-16 14:40 - 2018-05-16 14:40 - 000695296 _____ (Microsoft Corporation) C:\WINDOWS\system32\hhctrl.ocx
2018-05-16 14:40 - 2018-05-16 14:40 - 000669184 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\jscript.dll
2018-05-16 14:40 - 2018-05-16 14:40 - 000668672 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\msfeeds.dll
2018-05-16 14:40 - 2018-05-16 14:40 - 000665320 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\wer.dll
2018-05-16 14:40 - 2018-05-16 14:40 - 000658432 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\Windows.Mirage.Internal.dll
2018-05-16 14:40 - 2018-05-16 14:40 - 000652184 _____ (Microsoft Corporation) C:\WINDOWS\system32\AppVPublishing.dll
2018-05-16 14:40 - 2018-05-16 14:40 - 000624128 _____ (Microsoft Corporation) C:\WINDOWS\system32\PsmServiceExtHost.dll
2018-05-16 14:40 - 2018-05-16 14:40 - 000619520 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\WpcWebFilter.dll
2018-05-16 14:40 - 2018-05-16 14:40 - 000615424 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\EdgeManager.dll
2018-05-16 14:40 - 2018-05-16 14:40 - 000613376 _____ (Microsoft Corporation) C:\WINDOWS\system32\Windows.UI.Xaml.Resources.rs4.dll
2018-05-16 14:40 - 2018-05-16 14:40 - 000606448 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\oleaut32.dll
2018-05-16 14:40 - 2018-05-16 14:40 - 000604568 _____ (Microsoft Corporation) C:\WINDOWS\system32\securekernel.exe
2018-05-16 14:40 - 2018-05-16 14:40 - 000596480 _____ (Microsoft Corporation) C:\WINDOWS\system32\updatehandlers.dll
2018-05-16 14:40 - 2018-05-16 14:40 - 000585728 _____ (Microsoft Corporation) C:\WINDOWS\system32\Windows.UI.Xaml.Resources.rs3.dll
2018-05-16 14:40 - 2018-05-16 14:40 - 000584192 _____ (Microsoft Corporation) C:\WINDOWS\system32\UIRibbonRes.dll
2018-05-16 14:40 - 2018-05-16 14:40 - 000581120 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\hhctrl.ocx
2018-05-16 14:40 - 2018-05-16 14:40 - 000578560 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\webplatstorageserver.dll
2018-05-16 14:40 - 2018-05-16 14:40 - 000567136 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\CoreMessaging.dll
2018-05-16 14:40 - 2018-05-16 14:40 - 000561664 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\jscript9diag.dll
2018-05-16 14:40 - 2018-05-16 14:40 - 000559968 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\AppXDeploymentClient.dll
2018-05-16 14:40 - 2018-05-16 14:40 - 000553984 _____ (Microsoft Corporation) C:\WINDOWS\system32\PerceptionSimulationExtensions.dll
2018-05-16 14:40 - 2018-05-16 14:40 - 000543744 _____ (Microsoft Corporation) C:\WINDOWS\system32\vbscript.dll
2018-05-16 14:40 - 2018-05-16 14:40 - 000524800 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\vbscript.dll
2018-05-16 14:40 - 2018-05-16 14:40 - 000494488 _____ (Microsoft Corporation) C:\WINDOWS\system32\WerFault.exe
2018-05-16 14:40 - 2018-05-16 14:40 - 000474624 _____ (Microsoft Corporation) C:\WINDOWS\system32\Windows.UI.Xaml.Resources.rs2.dll
2018-05-16 14:40 - 2018-05-16 14:40 - 000473496 _____ (Microsoft Corporation) C:\WINDOWS\system32\dcntel.dll
2018-05-16 14:40 - 2018-05-16 14:40 - 000444416 _____ (Microsoft Corporation) C:\WINDOWS\system32\Windows.UI.Xaml.Resources.rs1.dll
2018-05-16 14:40 - 2018-05-16 14:40 - 000434584 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\WerFault.exe
2018-05-16 14:40 - 2018-05-16 14:40 - 000399768 _____ (Microsoft Corporation) C:\WINDOWS\system32\AppVScripting.dll
2018-05-16 14:40 - 2018-05-16 14:40 - 000392192 _____ (Microsoft Corporation) C:\WINDOWS\system32\iedkcs32.dll
2018-05-16 14:40 - 2018-05-16 14:40 - 000382872 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\clfs.sys
2018-05-16 14:40 - 2018-05-16 14:40 - 000344064 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\iedkcs32.dll
2018-05-16 14:40 - 2018-05-16 14:40 - 000288256 _____ (Microsoft Corporation) C:\WINDOWS\system32\Windows.UI.Xaml.Resources.th.dll
2018-05-16 14:40 - 2018-05-16 14:40 - 000272288 _____ (Microsoft Corporation) C:\WINDOWS\system32\SgrmEnclave.dll
2018-05-16 14:40 - 2018-05-16 14:40 - 000269216 _____ (Microsoft Corporation) C:\WINDOWS\system32\SgrmEnclave_secure.dll
2018-05-16 14:40 - 2018-05-16 14:40 - 000256000 _____ (Microsoft Corporation) C:\WINDOWS\system32\MixedReality.Broker.dll
2018-05-16 14:40 - 2018-05-16 14:40 - 000241664 _____ (Microsoft Corporation) C:\WINDOWS\system32\Windows.UI.Xaml.Resources.win81.dll
2018-05-16 14:40 - 2018-05-16 14:40 - 000171520 _____ (Microsoft Corporation) C:\WINDOWS\system32\itss.dll
2018-05-16 14:40 - 2018-05-16 14:40 - 000170904 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\ksecpkg.sys
2018-05-16 14:40 - 2018-05-16 14:40 - 000159744 _____ (Microsoft Corporation) C:\WINDOWS\system32\Windows.Cortana.Analog.dll
2018-05-16 14:40 - 2018-05-16 14:40 - 000154112 _____ (Microsoft Corporation) C:\WINDOWS\system32\Chakradiag.dll
2018-05-16 14:40 - 2018-05-16 14:40 - 000150528 _____ (Microsoft Corporation) C:\WINDOWS\system32\SharedPCCSP.dll
2018-05-16 14:40 - 2018-05-16 14:40 - 000150016 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\itss.dll
2018-05-16 14:40 - 2018-05-16 14:40 - 000144384 _____ (Microsoft Corporation) C:\WINDOWS\system32\mssprxy.dll
2018-05-16 14:40 - 2018-05-16 14:40 - 000143360 _____ (Microsoft Corporation) C:\WINDOWS\system32\TSpkg.dll
2018-05-16 14:40 - 2018-05-16 14:40 - 000142336 _____ (Microsoft Corporation) C:\WINDOWS\system32\Windows.UI.Xaml.Resources.win8rtm.dll
2018-05-16 14:40 - 2018-05-16 14:40 - 000134552 _____ (Microsoft Corporation) C:\WINDOWS\system32\hvloader.dll
2018-05-16 14:40 - 2018-05-16 14:40 - 000117760 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\TSpkg.dll
2018-05-16 14:40 - 2018-05-16 14:40 - 000046592 _____ (Microsoft Corporation) C:\WINDOWS\system32\wcimage.dll
2018-05-16 14:40 - 2018-05-16 14:40 - 000023552 _____ (Microsoft Corporation) C:\WINDOWS\system32\credssp.dll
2018-05-16 14:40 - 2018-05-16 14:40 - 000019968 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\credssp.dll
2018-05-16 14:40 - 2018-05-16 14:40 - 000002560 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\tzres.dll
2018-05-16 14:40 - 2018-05-16 14:40 - 000002560 _____ (Microsoft Corporation) C:\WINDOWS\system32\tzres.dll
2018-05-16 14:40 - 2018-05-16 14:40 - 000001312 _____ C:\WINDOWS\system32\tcbres.wim
2018-05-16 14:36 - 2018-05-16 14:36 - 008628736 _____ (Microsoft Corporation) C:\WINDOWS\system32\prm0019.dll
2018-05-16 14:36 - 2018-05-16 14:36 - 007702016 _____ (Microsoft Corporation) C:\WINDOWS\system32\NL7Models0011.dll
2018-05-16 14:36 - 2018-05-16 14:36 - 007406080 _____ (Microsoft Corporation) C:\WINDOWS\system32\NL7Data0011.dll
2018-05-16 14:36 - 2018-05-16 14:36 - 007242240 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\NL7Data0011.dll
2018-05-16 14:36 - 2018-05-16 14:36 - 002454528 _____ (Microsoft Corporation) C:\WINDOWS\system32\NL7Lexicons0011.dll
2018-05-16 14:36 - 2018-05-16 14:36 - 000712704 _____ (Microsoft Corporation) C:\WINDOWS\system32\MSWB70011.dll
2018-05-16 14:36 - 2018-05-16 14:36 - 000516096 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\MSWB70011.dll
2018-05-16 14:36 - 2018-05-16 14:36 - 000002060 _____ C:\WINDOWS\system32\noise.jpn
2018-05-16 14:36 - 2018-05-16 14:36 - 000000000 ____D C:\Program Files\Reference Assemblies
2018-05-16 14:36 - 2018-05-16 14:36 - 000000000 ____D C:\Program Files\MSBuild
2018-05-16 14:36 - 2018-05-16 14:36 - 000000000 ____D C:\Program Files (x86)\Reference Assemblies
2018-05-16 14:36 - 2018-05-16 14:36 - 000000000 ____D C:\Program Files (x86)\MSBuild
2018-05-16 14:35 - 2018-05-16 14:35 - 004492288 _____ (Microsoft Corporation) C:\WINDOWS\system32\xpsrchvw.exe
2018-05-16 14:35 - 2018-05-16 14:35 - 003398144 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\xpsrchvw.exe
2018-05-16 14:35 - 2018-05-16 14:35 - 001166520 _____ (Microsoft Corporation) C:\WINDOWS\system32\PresentationNative_v0300.dll
2018-05-16 14:35 - 2018-05-16 14:35 - 000925696 _____ (Microsoft Corporation) C:\WINDOWS\system32\XpsFilt.dll
2018-05-16 14:35 - 2018-05-16 14:35 - 000778936 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\PresentationNative_v0300.dll
2018-05-16 14:35 - 2018-05-16 14:35 - 000575488 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\XpsFilt.dll
2018-05-16 14:35 - 2018-05-16 14:35 - 000124624 _____ (Microsoft Corporation) C:\WINDOWS\system32\PresentationCFFRasterizerNative_v0300.dll
2018-05-16 14:35 - 2018-05-16 14:35 - 000103120 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\PresentationCFFRasterizerNative_v0300.dll
2018-05-16 14:35 - 2018-05-16 14:35 - 000100352 _____ (Microsoft Corporation) C:\WINDOWS\system32\XPSSHHDR.dll
2018-05-16 14:35 - 2018-05-16 14:35 - 000082432 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\XPSSHHDR.dll
2018-05-16 14:35 - 2018-05-16 14:35 - 000076060 _____ C:\WINDOWS\SysWOW64\xpsrchvw.xml
2018-05-16 14:35 - 2018-05-16 14:35 - 000076060 _____ C:\WINDOWS\system32\xpsrchvw.xml
2018-05-16 14:35 - 2018-05-16 14:35 - 000035456 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\TsWpfWrp.exe
2018-05-16 14:35 - 2018-05-16 14:35 - 000035456 _____ (Microsoft Corporation) C:\WINDOWS\system32\TsWpfWrp.exe
2018-05-16 14:34 - 2018-05-16 14:34 - 000000000 ____D C:\WINDOWS\system32\Intel
2018-05-16 14:34 - 2018-05-16 14:34 - 000000000 ____D C:\WINDOWS\system32\cAVS
2018-05-16 05:00 - 2018-05-18 18:01 - 000838560 _____ C:\WINDOWS\system32\PerfStringBackup.INI
2018-05-16 05:00 - 2018-05-16 05:00 - 000001417 _____ C:\Users\kyron\Desktop\Microsoft Edge.lnk
2018-05-16 05:00 - 2018-05-16 05:00 - 000000000 ____D C:\ProgramData\Microsoft OneDrive
2018-05-16 04:58 - 2018-05-18 23:19 - 000000006 ____H C:\WINDOWS\Tasks\SA.DAT
2018-05-16 04:58 - 2018-05-18 14:36 - 000004264 _____ C:\WINDOWS\System32\Tasks\Avast Emergency Update
2018-05-16 04:58 - 2018-05-17 21:08 - 000004562 _____ C:\WINDOWS\System32\Tasks\Adobe Acrobat Update Task
2018-05-16 04:58 - 2018-05-17 19:01 - 000003418 _____ C:\WINDOWS\System32\Tasks\GoogleUpdateTaskMachineUA
2018-05-16 04:58 - 2018-05-17 19:01 - 000003294 _____ C:\WINDOWS\System32\Tasks\GoogleUpdateTaskMachineCore
2018-05-16 04:58 - 2018-05-16 04:58 - 000003386 _____ C:\WINDOWS\System32\Tasks\AvastUpdateTaskMachineUA
2018-05-16 04:58 - 2018-05-16 04:58 - 000003162 _____ C:\WINDOWS\System32\Tasks\AvastUpdateTaskMachineCore
2018-05-16 04:58 - 2018-05-16 04:58 - 000002860 _____ C:\WINDOWS\System32\Tasks\OneDrive Standalone Update Task-S-1-5-21-1795529150-3527648200-2130702207-1001
2018-05-16 04:58 - 2018-05-16 04:58 - 000002316 _____ C:\WINDOWS\System32\Tasks\{D96A74AE-F83E-4FBF-B345-76796DA391B1}
2018-05-16 04:58 - 2018-05-16 04:58 - 000002316 _____ C:\WINDOWS\System32\Tasks\{D919DA4B-3671-465C-B4AA-3567BB550450}
2018-05-16 04:58 - 2018-05-16 04:58 - 000002316 _____ C:\WINDOWS\System32\Tasks\{C0E32415-2FD3-4420-B82C-05F317195593}
2018-05-16 04:58 - 2018-05-16 04:58 - 000002316 _____ C:\WINDOWS\System32\Tasks\{A11F6704-A7E8-4EC5-9017-5845439F52BF}
2018-05-16 04:58 - 2018-05-16 04:58 - 000002316 _____ C:\WINDOWS\System32\Tasks\{8C8957D5-B712-4D6D-BAEE-C3EB14C50244}
2018-05-16 04:58 - 2018-05-16 04:58 - 000002316 _____ C:\WINDOWS\System32\Tasks\{8B383D6E-1FA5-4659-A3C0-10B7671A2AE4}
2018-05-16 04:58 - 2018-05-16 04:58 - 000002316 _____ C:\WINDOWS\System32\Tasks\{65398F09-5781-4067-8E69-C70051AB0C4B}
2018-05-16 04:58 - 2018-05-16 04:58 - 000002316 _____ C:\WINDOWS\System32\Tasks\{4A825F61-8C5A-483E-88BF-AAABE6413B9C}
2018-05-16 04:58 - 2018-05-16 04:58 - 000002316 _____ C:\WINDOWS\System32\Tasks\{3C313D76-2347-41F2-97B3-6B9D762E244C}
2018-05-16 04:58 - 2018-05-16 04:58 - 000000020 ___SH C:\Users\kyron\ntuser.ini
2018-05-16 04:58 - 2018-05-16 04:58 - 000000000 ____D C:\WINDOWS\System32\Tasks\AVAST Software
2018-05-16 04:57 - 2018-05-16 04:58 - 000007623 _____ C:\WINDOWS\diagwrn.xml
2018-05-16 04:57 - 2018-05-16 04:58 - 000007623 _____ C:\WINDOWS\diagerr.xml
2018-05-16 04:51 - 2018-05-16 04:51 - 000001576 _____ C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Windows Media Player.lnk
2018-05-16 04:51 - 2018-05-16 04:51 - 000000000 ____D C:\ProgramData\USOShared
2018-05-16 04:51 - 2018-04-12 09:33 - 002752000 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\PrintConfig.dll
2018-05-16 04:50 - 2018-05-18 16:58 - 000000000 ____D C:\Users\kyron
2018-05-16 04:50 - 2018-04-12 09:34 - 000001105 _____ C:\Users\kyron\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\OneDrive.lnk
2018-05-16 04:49 - 2017-08-01 18:22 - 000114304 _____ (Khronos Group) C:\WINDOWS\system32\OpenCL.DLL
2018-05-16 04:48 - 2018-05-18 17:53 - 000000000 ____D C:\WINDOWS\system32\SleepStudy
2018-05-16 04:48 - 2018-05-16 04:53 - 014457280 _____ C:\WINDOWS\system32\FNTCACHE.DAT
2018-05-15 21:47 - 2018-05-15 21:51 - 000000000 ____D C:\Users\kyron\OneDrive\Documents\Stickies Skins
2018-05-15 13:14 - 2018-05-18 23:19 - 000000000 ____D C:\Users\kyron\AppData\Roaming\stickies
2018-05-15 13:14 - 2018-05-16 04:50 - 000000000 ____D C:\Users\kyron\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Stickies
2018-05-15 13:14 - 2018-05-15 13:14 - 000000862 _____ C:\WINDOWS\uninstallstickies.bat
2018-05-15 13:14 - 2018-05-15 13:14 - 000000000 ____D C:\Program Files (x86)\Stickies
2018-05-15 13:13 - 2018-05-15 13:13 - 001681408 _____ (Zhorn Software) C:\Users\kyron\OneDrive\Documents\stickies_setup_9.0e.exe
2018-05-15 08:39 - 2018-05-15 08:39 - 000006899 _____ C:\Users\kyron\OneDrive\Documents\2611QCM Statement of Effort(2).pdf
2018-05-15 08:39 - 2018-05-15 08:39 - 000006475 _____ C:\Users\kyron\OneDrive\Documents\2611QCM Verbal Explanation.pdf
2018-05-13 23:32 - 2018-05-16 04:58 - 000000000 ___DC C:\WINDOWS\Panther
2018-05-11 20:48 - 2018-05-11 20:48 - 000120771 _____ C:\Users\kyron\OneDrive\Documents\Roots_English_Rouns_2018-05-08.pdf
2018-05-09 22:14 - 2018-05-09 22:14 - 000001218 _____ C:\Users\kyron\Desktop\ASIO4ALL v2 Instruction Manual.lnk
2018-05-09 22:14 - 2018-05-09 22:14 - 000000000 ____D C:\Program Files (x86)\ASIO4ALL v2
2018-05-09 22:08 - 2018-05-09 22:08 - 000002081 _____ C:\Users\Public\Desktop\iLok License Manager.lnk
2018-05-09 22:08 - 2018-05-09 22:08 - 000000000 ____D C:\Program Files (x86)\iLok License Manager
2018-05-09 22:07 - 2018-05-09 22:07 - 000000000 ____D C:\Users\kyron\Downloads\HD_Driver_11_3_1_Win_84150
2018-05-09 22:04 - 2018-05-09 22:06 - 138733062 _____ C:\Users\kyron\Downloads\HD_Driver_11_3_1_Win_84150.zip
2018-05-09 21:57 - 2018-05-09 21:57 - 000002078 _____ C:\Users\Public\Desktop\Pro Tools First.lnk
2018-05-09 21:57 - 2018-05-09 21:57 - 000000000 ____D C:\Program Files (x86)\QuickTime
2018-05-09 21:57 - 2018-05-09 21:57 - 000000000 ____D C:\Program Files (x86)\Avid
2018-05-09 21:52 - 2018-05-09 21:52 - 000000000 ____D C:\Users\kyron\Downloads\Pro_Tools_First_2018_4_Win_102391
2018-05-08 16:10 - 2018-05-08 16:10 - 000109877 _____ C:\Users\kyron\Downloads\Earth-like Atmospheres 3.0.xlsx
2018-05-07 21:16 - 2018-05-07 21:16 - 000003855 _____ C:\Users\kyron\AppData\Local\recently-used.xbel
2018-05-06 00:25 - 2018-05-06 00:25 - 000462251 _____ C:\Users\kyron\OneDrive\Documents\ASIO4ALL_2_14_English (1).exe
2018-05-04 22:46 - 2018-05-04 22:46 - 000462251 _____ C:\Users\kyron\OneDrive\Documents\ASIO4ALL_2_14_English.exe
2018-05-04 22:27 - 2011-03-24 21:41 - 000836096 _____ (PACE Anti-Piracy) C:\WINDOWS\SysWOW64\ilinet.dll
2018-05-04 22:23 - 2018-05-04 22:24 - 109262271 _____ C:\Users\kyron\OneDrive\Documents\Avid_HD_Driver_10_Installer_73495.zip
2018-05-04 14:51 - 2018-05-04 14:52 - 138733062 _____ C:\Users\kyron\OneDrive\Documents\HD_Driver_11_3_1_Win_84150.zip
2018-05-03 13:18 - 2018-05-03 13:21 - 000000000 ____D C:\Users\kyron\OneDrive\Documents\SoloPyannerRecordings
2018-05-02 21:53 - 2018-05-16 04:51 - 000000000 ____D C:\Users\kyron\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\ASIO4ALL v2
2018-05-02 21:53 - 2018-05-02 21:53 - 000462251 _____ C:\Users\kyron\Downloads\ASIO4ALL_2_14_English.exe
2018-05-02 21:51 - 2018-05-17 13:58 - 000000000 ____D C:\Users\Public\Pro Tools
2018-05-02 04:08 - 2018-05-16 04:53 - 000000000 ____D C:\ProgramData\PACE
2018-05-01 00:30 - 2018-05-01 00:30 - 001973957 _____ C:\Users\kyron\OneDrive\Documents\Heart_Foundation__Does_density_matter_FINAL2014.pdf
2018-04-30 21:44 - 2018-05-09 21:57 - 000000000 ____D C:\Users\kyron\OneDrive\Documents\Pro Tools
2018-04-30 21:44 - 2018-05-09 21:57 - 000000000 ____D C:\Program Files\Common Files\Avid
2018-04-30 21:44 - 2018-04-30 21:44 - 000000000 ____D C:\Program Files\AIR Music Technology
2018-04-30 21:42 - 2018-05-09 22:09 - 000000000 ____D C:\Program Files (x86)\InstallShield Installation Information
2018-04-30 21:42 - 2018-05-09 22:08 - 000002093 _____ C:\ProgramData\Microsoft\Windows\Start Menu\Programs\iLok License Manager.lnk
2018-04-30 21:41 - 2018-04-30 21:41 - 000000000 ____D C:\ProgramData\Apple
2018-04-30 21:41 - 2018-04-30 21:41 - 000000000 ____D C:\Program Files\Bonjour
2018-04-30 21:41 - 2018-04-30 21:41 - 000000000 ____D C:\Program Files (x86)\Bonjour
2018-04-30 20:10 - 2018-04-30 20:20 - 2918422174 _____ C:\Users\kyron\Downloads\Pro_Tools_First_2018_4_Win_102391.zip
2018-04-29 04:21 - 2018-04-29 04:21 - 000400277 _____ C:\Users\kyron\OneDrive\Documents\LockhartsLament.pdf
2018-04-18 19:32 - 2018-04-18 19:32 - 001248221 _____ C:\Users\kyron\OneDrive\Documents\Strings.pdf
 
==================== One Month Modified files and folders ========
 
(If an entry is included in the fixlist, the file/folder will be moved.)
 
2018-05-18 23:21 - 2018-01-21 23:14 - 001153488 _____ C:\WINDOWS\ntbtlog.txt
2018-05-18 23:21 - 2018-01-21 23:14 - 000000214 _____ C:\WINDOWS\Tasks\CreateExplorerShellUnelevatedTask.job
2018-05-18 23:19 - 2018-04-12 07:04 - 000524288 _____ C:\WINDOWS\system32\config\BBI
2018-05-18 23:19 - 2017-02-26 19:02 - 000025998 _____ C:\WINDOWS\ZAM_Guard.krnl.trace
2018-05-18 23:19 - 2016-09-04 11:05 - 000041448 _____ C:\WINDOWS\system32\OV5693_FRONT.aiqd
2018-05-18 23:19 - 2016-09-04 11:05 - 000040190 _____ C:\WINDOWS\system32\OV8865_REAR.aiqd
2018-05-18 23:17 - 2018-04-12 09:38 - 000000000 ____D C:\WINDOWS\AppReadiness
2018-05-18 23:17 - 2018-04-12 09:38 - 000000000 ____D C:\ProgramData\regid.1991-06.com.microsoft
2018-05-18 23:15 - 2018-04-12 09:36 - 000000000 ____D C:\WINDOWS\INF
2018-05-18 18:11 - 2018-04-12 09:38 - 000000000 ___HD C:\Program Files\WindowsApps
2018-05-18 17:06 - 2016-09-10 10:14 - 000000000 ____D C:\AdwCleaner
2018-05-18 16:48 - 2018-04-16 00:44 - 000253664 _____ (Malwarebytes) C:\WINDOWS\system32\Drivers\mbamswissarmy.sys
2018-05-18 14:30 - 2018-04-12 09:38 - 000000000 ____D C:\WINDOWS\system32\NDF
2018-05-18 13:02 - 2016-02-28 20:44 - 000000000 ____D C:\Program Files (x86)\Microsoft Office
2018-05-18 12:43 - 2017-07-28 19:07 - 000000000 ____D C:\Program Files (x86)\Mozilla Maintenance Service
2018-05-18 12:43 - 2017-07-28 19:07 - 000000000 ____D C:\Program Files (x86)\Mozilla Firefox
2018-05-18 12:42 - 2017-11-13 09:09 - 000196640 _____ (AVAST Software) C:\WINDOWS\system32\Drivers\aswArPot.sys
2018-05-18 12:42 - 2017-11-02 01:46 - 001027720 _____ (AVAST Software) C:\WINDOWS\system32\Drivers\aswSnx.sys
2018-05-18 12:42 - 2017-11-02 01:46 - 000460520 _____ (AVAST Software) C:\WINDOWS\system32\Drivers\aswSP.sys
2018-05-18 12:42 - 2017-11-02 01:46 - 000381552 _____ (AVAST Software) C:\WINDOWS\system32\Drivers\aswVmm.sys
2018-05-18 12:42 - 2017-11-02 01:46 - 000205976 _____ (AVAST Software) C:\WINDOWS\system32\Drivers\aswStm.sys
2018-05-18 12:42 - 2017-11-02 01:46 - 000159120 _____ (AVAST Software) C:\WINDOWS\system32\Drivers\aswMonFlt.sys
2018-05-18 12:42 - 2017-11-02 01:46 - 000111360 _____ (AVAST Software) C:\WINDOWS\system32\Drivers\aswRdr2.sys
2018-05-18 12:42 - 2017-11-02 01:46 - 000085968 _____ (AVAST Software) C:\WINDOWS\system32\Drivers\aswRvrt.sys
2018-05-18 12:42 - 2017-11-02 01:46 - 000046968 _____ (AVAST Software) C:\WINDOWS\system32\Drivers\aswHwid.sys
2018-05-18 12:42 - 2017-09-17 09:57 - 000234560 _____ (AVAST Software) C:\WINDOWS\system32\Drivers\aswHdsKe.sys
2018-05-18 12:41 - 2017-07-28 19:07 - 000000000 ____D C:\Users\kyron\AppData\LocalLow\Mozilla
2018-05-18 12:40 - 2017-07-28 19:07 - 000001239 _____ C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Firefox.lnk
2018-05-18 11:04 - 2016-02-28 15:15 - 000002308 _____ C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Google Chrome.lnk
2018-05-18 11:04 - 2016-02-28 15:15 - 000002267 _____ C:\Users\Public\Desktop\Google Chrome.lnk
2018-05-18 11:03 - 2018-04-12 09:38 - 000000000 ____D C:\WINDOWS\appcompat
2018-05-17 21:08 - 2016-09-14 22:00 - 000002457 _____ C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Acrobat Reader DC.lnk
2018-05-17 20:03 - 2018-02-13 01:37 - 000000000 ____D C:\Users\kyron\AppData\Roaming\FiraxisLive
2018-05-17 20:03 - 2016-09-11 19:31 - 000000000 ____D C:\Users\kyron\AppData\Roaming\BitTorrent
2018-05-17 03:53 - 2016-01-31 21:40 - 000000000 ____D C:\WINDOWS\system32\MRT
2018-05-17 03:52 - 2018-04-12 09:30 - 000000000 ____D C:\WINDOWS\CbsTemp
2018-05-17 03:52 - 2017-10-11 23:22 - 141696960 ____C (Microsoft Corporation) C:\WINDOWS\system32\MRT-KB890830.exe
2018-05-17 03:52 - 2016-01-31 21:40 - 141696960 ____C (Microsoft Corporation) C:\WINDOWS\system32\MRT.exe
2018-05-16 22:25 - 2018-04-12 09:38 - 000000000 ____D C:\WINDOWS\LiveKernelReports
2018-05-16 18:50 - 2016-11-27 23:27 - 000000000 ____D C:\Users\kyron\AppData\Roaming\Audacity
2018-05-16 18:23 - 2017-11-02 21:30 - 000000000 ____D C:\Users\kyron\AppData\Local\Packages
2018-05-16 14:47 - 2018-04-12 09:41 - 000000000 ____D C:\WINDOWS\Setup
2018-05-16 14:47 - 2018-04-12 09:38 - 000028672 _____ C:\WINDOWS\system32\config\BCD-Template
2018-05-16 14:47 - 2018-04-12 09:38 - 000000000 __RHD C:\Users\Public\Libraries
2018-05-16 14:47 - 2018-04-12 09:38 - 000000000 ____D C:\WINDOWS\system32\WinBioDatabase
2018-05-16 14:47 - 2018-04-12 09:38 - 000000000 ____D C:\WINDOWS\system32\spool
2018-05-16 14:47 - 2018-04-12 09:38 - 000000000 ____D C:\WINDOWS\system32\oobe
2018-05-16 14:47 - 2018-04-12 09:38 - 000000000 ____D C:\WINDOWS\PolicyDefinitions
2018-05-16 14:47 - 2018-04-12 09:38 - 000000000 ____D C:\Program Files\Common Files\microsoft shared
2018-05-16 14:47 - 2018-02-04 03:44 - 000000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Inkscape 0.91
2018-05-16 14:47 - 2018-01-28 20:53 - 000000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Canon MG5700 series Manual
2018-05-16 14:47 - 2018-01-28 20:31 - 000000000 ____D C:\WINDOWS\system32\STRING
2018-05-16 14:47 - 2017-09-29 23:46 - 000000000 ____D C:\WINDOWS\system32\Tasks_Migrated
2018-05-16 14:47 - 2017-05-02 04:52 - 000000000 ____D C:\Program Files\UNP
2018-05-16 14:47 - 2017-04-23 02:30 - 000000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Skype
2018-05-16 14:47 - 2017-04-22 00:27 - 000000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Java
2018-05-16 14:47 - 2016-11-30 12:00 - 000000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Papers, Please [GOG.com]
2018-05-16 14:47 - 2016-10-05 20:44 - 000000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Hearthstone
2018-05-16 14:47 - 2016-10-05 19:57 - 000000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Battle.net
2018-05-16 14:47 - 2016-09-12 19:36 - 000000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Avid
2018-05-16 14:47 - 2016-09-04 23:11 - 000000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Minecraft
2018-05-16 14:47 - 2016-08-31 22:05 - 000000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\7-Zip
2018-05-16 14:47 - 2016-05-08 13:59 - 000000000 ____D C:\WINDOWS\system32\appmgmt
2018-05-16 14:47 - 2016-03-06 14:01 - 000000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Auralia 5
2018-05-16 14:47 - 2016-02-28 21:04 - 000000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Microsoft Office 2016 Tools
2018-05-16 14:47 - 2015-07-10 21:04 - 000000000 ___HD C:\WINDOWS\system32\GroupPolicy
2018-05-16 14:43 - 2018-04-13 02:14 - 000000000 ____D C:\WINDOWS\SysWOW64\slmgr
2018-05-16 14:43 - 2018-04-13 02:14 - 000000000 ____D C:\WINDOWS\system32\slmgr
2018-05-16 14:43 - 2018-01-28 20:31 - 000000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Canon Utilities
2018-05-16 14:43 - 2018-01-02 14:28 - 000000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Spike Chunsoft
2018-05-16 14:43 - 2017-05-03 14:18 - 000000000 ____D C:\Program Files\Intel
2018-05-16 14:43 - 2016-09-11 21:12 - 000000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Paradox Interactive
2018-05-16 14:41 - 2018-04-13 02:36 - 000000000 ____D C:\WINDOWS\Containers
2018-05-16 14:41 - 2018-04-13 02:18 - 000000000 ____D C:\WINDOWS\SysWOW64\zu-ZA
2018-05-16 14:41 - 2018-04-13 02:18 - 000000000 ____D C:\WINDOWS\SysWOW64\yo-NG
2018-05-16 14:41 - 2018-04-13 02:18 - 000000000 ____D C:\WINDOWS\SysWOW64\xh-ZA
2018-05-16 14:41 - 2018-04-13 02:18 - 000000000 ____D C:\WINDOWS\SysWOW64\wo-SN
2018-05-16 14:41 - 2018-04-13 02:18 - 000000000 ____D C:\WINDOWS\SysWOW64\vi-VN
2018-05-16 14:41 - 2018-04-13 02:18 - 000000000 ____D C:\WINDOWS\SysWOW64\uz-Latn-UZ
2018-05-16 14:41 - 2018-04-13 02:18 - 000000000 ____D C:\WINDOWS\SysWOW64\ur-PK
2018-05-16 14:41 - 2018-04-13 02:18 - 000000000 ____D C:\WINDOWS\SysWOW64\ug-CN
2018-05-16 14:41 - 2018-04-13 02:18 - 000000000 ____D C:\WINDOWS\SysWOW64\tt-RU
2018-05-16 14:41 - 2018-04-13 02:18 - 000000000 ____D C:\WINDOWS\SysWOW64\tn-ZA
2018-05-16 14:41 - 2018-04-13 02:18 - 000000000 ____D C:\WINDOWS\SysWOW64\tk-TM
2018-05-16 14:41 - 2018-04-13 02:18 - 000000000 ____D C:\WINDOWS\SysWOW64\ti-ET
2018-05-16 14:41 - 2018-04-13 02:18 - 000000000 ____D C:\WINDOWS\SysWOW64\tg-Cyrl-TJ
2018-05-16 14:41 - 2018-04-13 02:18 - 000000000 ____D C:\WINDOWS\SysWOW64\te-IN
2018-05-16 14:41 - 2018-04-13 02:18 - 000000000 ____D C:\WINDOWS\SysWOW64\ta-IN
2018-05-16 14:41 - 2018-04-13 02:18 - 000000000 ____D C:\WINDOWS\SysWOW64\sw-KE
2018-05-16 14:41 - 2018-04-13 02:18 - 000000000 ____D C:\WINDOWS\SysWOW64\sr-Cyrl-RS
2018-05-16 14:41 - 2018-04-13 02:18 - 000000000 ____D C:\WINDOWS\SysWOW64\sr-Cyrl-BA
2018-05-16 14:41 - 2018-04-13 02:18 - 000000000 ____D C:\WINDOWS\SysWOW64\sq-AL
2018-05-16 14:41 - 2018-04-13 02:18 - 000000000 ____D C:\WINDOWS\SysWOW64\si-LK
2018-05-16 14:41 - 2018-04-13 02:18 - 000000000 ____D C:\WINDOWS\SysWOW64\sd-Arab-PK
2018-05-16 14:41 - 2018-04-13 02:18 - 000000000 ____D C:\WINDOWS\SysWOW64\rw-RW
2018-05-16 14:41 - 2018-04-13 02:18 - 000000000 ____D C:\WINDOWS\SysWOW64\quz-PE
2018-05-16 14:41 - 2018-04-13 02:18 - 000000000 ____D C:\WINDOWS\SysWOW64\quc-Latn-GT
2018-05-16 14:41 - 2018-04-13 02:18 - 000000000 ____D C:\WINDOWS\SysWOW64\prs-AF
2018-05-16 14:41 - 2018-04-13 02:18 - 000000000 ____D C:\WINDOWS\SysWOW64\pa-IN
2018-05-16 14:41 - 2018-04-13 02:18 - 000000000 ____D C:\WINDOWS\SysWOW64\pa-Arab-PK
2018-05-16 14:41 - 2018-04-13 02:18 - 000000000 ____D C:\WINDOWS\SysWOW64\or-IN
2018-05-16 14:41 - 2018-04-13 02:18 - 000000000 ____D C:\WINDOWS\SysWOW64\nso-ZA
2018-05-16 14:41 - 2018-04-13 02:18 - 000000000 ____D C:\WINDOWS\SysWOW64\nn-NO
2018-05-16 14:41 - 2018-04-13 02:18 - 000000000 ____D C:\WINDOWS\SysWOW64\ne-NP
2018-05-16 14:41 - 2018-04-13 02:18 - 000000000 ____D C:\WINDOWS\SysWOW64\mt-MT
2018-05-16 14:41 - 2018-04-13 02:18 - 000000000 ____D C:\WINDOWS\SysWOW64\mr-IN
2018-05-16 14:41 - 2018-04-13 02:18 - 000000000 ____D C:\WINDOWS\SysWOW64\mn-MN
2018-05-16 14:41 - 2018-04-13 02:18 - 000000000 ____D C:\WINDOWS\SysWOW64\ml-IN
2018-05-16 14:41 - 2018-04-13 02:18 - 000000000 ____D C:\WINDOWS\SysWOW64\mk-MK
2018-05-16 14:41 - 2018-04-13 02:18 - 000000000 ____D C:\WINDOWS\SysWOW64\mi-NZ
2018-05-16 14:41 - 2018-04-13 02:18 - 000000000 ____D C:\WINDOWS\SysWOW64\lo-LA
2018-05-16 14:41 - 2018-04-13 02:18 - 000000000 ____D C:\WINDOWS\SysWOW64\lb-LU
2018-05-16 14:41 - 2018-04-13 02:18 - 000000000 ____D C:\WINDOWS\SysWOW64\ky-KG
2018-05-16 14:41 - 2018-04-13 02:18 - 000000000 ____D C:\WINDOWS\SysWOW64\ku-Arab-IQ
2018-05-16 14:41 - 2018-04-13 02:18 - 000000000 ____D C:\WINDOWS\SysWOW64\kok-IN
2018-05-16 14:41 - 2018-04-13 02:18 - 000000000 ____D C:\WINDOWS\SysWOW64\kn-IN
2018-05-16 14:41 - 2018-04-13 02:18 - 000000000 ____D C:\WINDOWS\SysWOW64\km-KH
2018-05-16 14:41 - 2018-04-13 02:18 - 000000000 ____D C:\WINDOWS\SysWOW64\kk-KZ
2018-05-16 14:41 - 2018-04-13 02:18 - 000000000 ____D C:\WINDOWS\SysWOW64\ka-GE
2018-05-16 14:41 - 2018-04-13 02:18 - 000000000 ____D C:\WINDOWS\SysWOW64\is-IS
2018-05-16 14:41 - 2018-04-13 02:18 - 000000000 ____D C:\WINDOWS\SysWOW64\ig-NG
2018-05-16 14:41 - 2018-04-13 02:18 - 000000000 ____D C:\WINDOWS\SysWOW64\id-ID
2018-05-16 14:41 - 2018-04-13 02:18 - 000000000 ____D C:\WINDOWS\SysWOW64\hy-AM
2018-05-16 14:41 - 2018-04-13 02:18 - 000000000 ____D C:\WINDOWS\SysWOW64\ha-Latn-NG
2018-05-16 14:41 - 2018-04-13 02:18 - 000000000 ____D C:\WINDOWS\SysWOW64\gu-IN
2018-05-16 14:41 - 2018-04-13 02:18 - 000000000 ____D C:\WINDOWS\SysWOW64\gd-GB
2018-05-16 14:41 - 2018-04-13 02:18 - 000000000 ____D C:\WINDOWS\SysWOW64\ga-IE
2018-05-16 14:41 - 2018-04-13 02:18 - 000000000 ____D C:\WINDOWS\SysWOW64\fil-PH
2018-05-16 14:41 - 2018-04-13 02:18 - 000000000 ____D C:\WINDOWS\SysWOW64\fa-IR
2018-05-16 14:41 - 2018-04-13 02:18 - 000000000 ____D C:\WINDOWS\SysWOW64\cy-GB
2018-05-16 14:41 - 2018-04-13 02:18 - 000000000 ____D C:\WINDOWS\SysWOW64\chr-CHER-US
2018-05-16 14:41 - 2018-04-13 02:18 - 000000000 ____D C:\WINDOWS\SysWOW64\ca-ES-valencia
2018-05-16 14:41 - 2018-04-13 02:18 - 000000000 ____D C:\WINDOWS\SysWOW64\bs-Latn-BA
2018-05-16 14:41 - 2018-04-13 02:18 - 000000000 ____D C:\WINDOWS\SysWOW64\bn-IN
2018-05-16 14:41 - 2018-04-13 02:18 - 000000000 ____D C:\WINDOWS\SysWOW64\bn-BD
2018-05-16 14:41 - 2018-04-13 02:18 - 000000000 ____D C:\WINDOWS\SysWOW64\be-BY
2018-05-16 14:41 - 2018-04-13 02:18 - 000000000 ____D C:\WINDOWS\SysWOW64\az-Latn-AZ
2018-05-16 14:41 - 2018-04-13 02:18 - 000000000 ____D C:\WINDOWS\SysWOW64\as-IN
2018-05-16 14:41 - 2018-04-13 02:18 - 000000000 ____D C:\WINDOWS\SysWOW64\am-ET
2018-05-16 14:41 - 2018-04-13 02:18 - 000000000 ____D C:\WINDOWS\SysWOW64\af-ZA
2018-05-16 14:41 - 2018-04-13 02:18 - 000000000 ____D C:\WINDOWS\system32\zu-ZA
2018-05-16 14:41 - 2018-04-13 02:18 - 000000000 ____D C:\WINDOWS\system32\yo-NG
2018-05-16 14:41 - 2018-04-13 02:18 - 000000000 ____D C:\WINDOWS\system32\xh-ZA
2018-05-16 14:41 - 2018-04-13 02:18 - 000000000 ____D C:\WINDOWS\system32\wo-SN
2018-05-16 14:41 - 2018-04-13 02:18 - 000000000 ____D C:\WINDOWS\system32\vi-VN
2018-05-16 14:41 - 2018-04-13 02:18 - 000000000 ____D C:\WINDOWS\system32\uz-Latn-UZ
2018-05-16 14:41 - 2018-04-13 02:18 - 000000000 ____D C:\WINDOWS\system32\ur-PK
2018-05-16 14:41 - 2018-04-13 02:18 - 000000000 ____D C:\WINDOWS\system32\ug-CN
2018-05-16 14:41 - 2018-04-13 02:18 - 000000000 ____D C:\WINDOWS\system32\tt-RU
2018-05-16 14:41 - 2018-04-13 02:18 - 000000000 ____D C:\WINDOWS\system32\tn-ZA
2018-05-16 14:41 - 2018-04-13 02:18 - 000000000 ____D C:\WINDOWS\system32\tk-TM
2018-05-16 14:41 - 2018-04-13 02:18 - 000000000 ____D C:\WINDOWS\system32\ti-ET
2018-05-16 14:41 - 2018-04-13 02:18 - 000000000 ____D C:\WINDOWS\system32\tg-Cyrl-TJ
2018-05-16 14:41 - 2018-04-13 02:18 - 000000000 ____D C:\WINDOWS\system32\te-IN
2018-05-16 14:41 - 2018-04-13 02:18 - 000000000 ____D C:\WINDOWS\system32\sw-KE
2018-05-16 14:41 - 2018-04-13 02:18 - 000000000 ____D C:\WINDOWS\system32\sr-Cyrl-RS
2018-05-16 14:41 - 2018-04-13 02:18 - 000000000 ____D C:\WINDOWS\system32\sr-Cyrl-BA
2018-05-16 14:41 - 2018-04-13 02:18 - 000000000 ____D C:\WINDOWS\system32\sq-AL
2018-05-16 14:41 - 2018-04-13 02:18 - 000000000 ____D C:\WINDOWS\system32\sd-Arab-PK
2018-05-16 14:41 - 2018-04-13 02:18 - 000000000 ____D C:\WINDOWS\system32\rw-RW
2018-05-16 14:41 - 2018-04-13 02:18 - 000000000 ____D C:\WINDOWS\system32\quz-PE
2018-05-16 14:41 - 2018-04-13 02:18 - 000000000 ____D C:\WINDOWS\system32\quc-Latn-GT
2018-05-16 14:41 - 2018-04-13 02:18 - 000000000 ____D C:\WINDOWS\system32\prs-AF
2018-05-16 14:41 - 2018-04-13 02:18 - 000000000 ____D C:\WINDOWS\system32\pa-IN
2018-05-16 14:41 - 2018-04-13 02:18 - 000000000 ____D C:\WINDOWS\system32\pa-Arab-PK
2018-05-16 14:41 - 2018-04-13 02:18 - 000000000 ____D C:\WINDOWS\system32\or-IN
2018-05-16 14:41 - 2018-04-13 02:18 - 000000000 ____D C:\WINDOWS\system32\nso-ZA
2018-05-16 14:41 - 2018-04-13 02:18 - 000000000 ____D C:\WINDOWS\system32\nn-NO
2018-05-16 14:41 - 2018-04-13 02:18 - 000000000 ____D C:\WINDOWS\system32\ne-NP
2018-05-16 14:41 - 2018-04-13 02:18 - 000000000 ____D C:\WINDOWS\system32\mt-MT
2018-05-16 14:41 - 2018-04-13 02:18 - 000000000 ____D C:\WINDOWS\system32\mr-IN
2018-05-16 14:41 - 2018-04-13 02:18 - 000000000 ____D C:\WINDOWS\system32\mn-MN
2018-05-16 14:41 - 2018-04-13 02:18 - 000000000 ____D C:\WINDOWS\system32\ml-IN
2018-05-16 14:41 - 2018-04-13 02:18 - 000000000 ____D C:\WINDOWS\system32\mk-MK
2018-05-16 14:41 - 2018-04-13 02:18 - 000000000 ____D C:\WINDOWS\system32\mi-NZ
2018-05-16 14:41 - 2018-04-13 02:18 - 000000000 ____D C:\WINDOWS\system32\lo-LA
2018-05-16 14:41 - 2018-04-13 02:18 - 000000000 ____D C:\WINDOWS\system32\lb-LU
2018-05-16 14:41 - 2018-04-13 02:18 - 000000000 ____D C:\WINDOWS\system32\ky-KG
2018-05-16 14:41 - 2018-04-13 02:18 - 000000000 ____D C:\WINDOWS\system32\ku-Arab-IQ
2018-05-16 14:41 - 2018-04-13 02:18 - 000000000 ____D C:\WINDOWS\system32\kok-IN
2018-05-16 14:41 - 2018-04-13 02:18 - 000000000 ____D C:\WINDOWS\system32\kn-IN
2018-05-16 14:41 - 2018-04-13 02:18 - 000000000 ____D C:\WINDOWS\system32\km-KH
2018-05-16 14:41 - 2018-04-13 02:18 - 000000000 ____D C:\WINDOWS\system32\kk-KZ
2018-05-16 14:41 - 2018-04-13 02:18 - 000000000 ____D C:\WINDOWS\system32\ka-GE
2018-05-16 14:41 - 2018-04-13 02:18 - 000000000 ____D C:\WINDOWS\system32\is-IS
2018-05-16 14:41 - 2018-04-13 02:18 - 000000000 ____D C:\WINDOWS\system32\ig-NG
2018-05-16 14:41 - 2018-04-13 02:18 - 000000000 ____D C:\WINDOWS\system32\id-ID
2018-05-16 14:41 - 2018-04-13 02:18 - 000000000 ____D C:\WINDOWS\system32\hy-AM
2018-05-16 14:41 - 2018-04-13 02:18 - 000000000 ____D C:\WINDOWS\system32\ha-Latn-NG
2018-05-16 14:41 - 2018-04-13 02:18 - 000000000 ____D C:\WINDOWS\system32\gu-IN
2018-05-16 14:41 - 2018-04-13 02:18 - 000000000 ____D C:\WINDOWS\system32\gd-GB
2018-05-16 14:41 - 2018-04-13 02:18 - 000000000 ____D C:\WINDOWS\system32\ga-IE
2018-05-16 14:41 - 2018-04-13 02:18 - 000000000 ____D C:\WINDOWS\system32\fil-PH
2018-05-16 14:41 - 2018-04-13 02:18 - 000000000 ____D C:\WINDOWS\system32\fa-IR
2018-05-16 14:41 - 2018-04-13 02:18 - 000000000 ____D C:\WINDOWS\system32\cy-GB
2018-05-16 14:41 - 2018-04-13 02:18 - 000000000 ____D C:\WINDOWS\system32\chr-CHER-US
2018-05-16 14:41 - 2018-04-13 02:18 - 000000000 ____D C:\WINDOWS\system32\ca-ES-valencia
2018-05-16 14:41 - 2018-04-13 02:18 - 000000000 ____D C:\WINDOWS\system32\bs-Latn-BA
2018-05-16 14:41 - 2018-04-13 02:18 - 000000000 ____D C:\WINDOWS\system32\bn-IN
2018-05-16 14:41 - 2018-04-13 02:18 - 000000000 ____D C:\WINDOWS\system32\bn-BD
2018-05-16 14:41 - 2018-04-13 02:18 - 000000000 ____D C:\WINDOWS\system32\be-BY
2018-05-16 14:41 - 2018-04-13 02:18 - 000000000 ____D C:\WINDOWS\system32\az-Latn-AZ
2018-05-16 14:41 - 2018-04-13 02:18 - 000000000 ____D C:\WINDOWS\system32\as-IN
2018-05-16 14:41 - 2018-04-13 02:18 - 000000000 ____D C:\WINDOWS\system32\af-ZA
2018-05-16 14:41 - 2018-04-12 09:38 - 000000000 ____D C:\WINDOWS\TextInput
2018-05-16 14:41 - 2018-04-12 09:38 - 000000000 ____D C:\WINDOWS\SysWOW64\setup
2018-05-16 14:41 - 2018-04-12 09:38 - 000000000 ____D C:\WINDOWS\SysWOW64\en-GB
2018-05-16 14:41 - 2018-04-12 09:38 - 000000000 ____D C:\WINDOWS\system32\ta-in
2018-05-16 14:41 - 2018-04-12 09:38 - 000000000 ____D C:\WINDOWS\system32\si-lk
2018-05-16 14:41 - 2018-04-12 09:38 - 000000000 ____D C:\WINDOWS\system32\setup
2018-05-16 14:41 - 2018-04-12 09:38 - 000000000 ____D C:\WINDOWS\system32\en-GB
2018-05-16 14:41 - 2018-04-12 09:38 - 000000000 ____D C:\WINDOWS\system32\appraiser
2018-05-16 14:41 - 2018-04-12 09:38 - 000000000 ____D C:\WINDOWS\system32\am-et
2018-05-16 14:41 - 2018-04-12 09:38 - 000000000 ____D C:\WINDOWS\Provisioning
2018-05-16 14:41 - 2018-04-12 09:38 - 000000000 ____D C:\WINDOWS\bcastdvr
2018-05-16 14:41 - 2018-04-12 09:38 - 000000000 ____D C:\Program Files\Windows Photo Viewer
2018-05-16 14:41 - 2018-04-12 09:38 - 000000000 ____D C:\Program Files (x86)\Windows Photo Viewer
2018-05-16 14:38 - 2018-04-13 02:19 - 000000000 ____D C:\Program Files\Windows Defender Advanced Threat Protection
2018-05-16 14:38 - 2018-04-13 02:14 - 000000000 ____D C:\WINDOWS\SysWOW64\WCN
2018-05-16 14:38 - 2018-04-13 02:14 - 000000000 ____D C:\WINDOWS\system32\WCN
2018-05-16 14:38 - 2018-04-12 09:38 - 000000000 ___SD C:\WINDOWS\SysWOW64\F12
2018-05-16 14:38 - 2018-04-12 09:38 - 000000000 ___SD C:\WINDOWS\system32\F12
2018-05-16 14:38 - 2018-04-12 09:38 - 000000000 ____D C:\WINDOWS\system32\SystemResetPlatform
2018-05-16 14:38 - 2018-04-12 09:38 - 000000000 ____D C:\WINDOWS\system32\migwiz
2018-05-16 14:38 - 2018-04-12 09:38 - 000000000 ____D C:\Program Files (x86)\Windows Defender
2018-05-16 14:35 - 2018-04-13 02:18 - 000000000 ____D C:\WINDOWS\OCR
2018-05-16 14:35 - 2018-04-12 09:38 - 000000000 ____D C:\WINDOWS\SysWOW64\lv-LV
2018-05-16 14:35 - 2018-04-12 09:38 - 000000000 ____D C:\WINDOWS\SysWOW64\lt-LT
2018-05-16 14:35 - 2018-04-12 09:38 - 000000000 ____D C:\WINDOWS\SysWOW64\et-EE
2018-05-16 14:35 - 2018-04-12 09:38 - 000000000 ____D C:\WINDOWS\SysWOW64\es-MX
2018-05-16 14:35 - 2018-04-12 09:38 - 000000000 ____D C:\WINDOWS\system32\lv-LV
2018-05-16 14:35 - 2018-04-12 09:38 - 000000000 ____D C:\WINDOWS\system32\lt-LT
2018-05-16 14:35 - 2018-04-12 09:38 - 000000000 ____D C:\WINDOWS\system32\et-EE
2018-05-16 14:35 - 2018-04-12 09:38 - 000000000 ____D C:\WINDOWS\system32\es-MX
2018-05-16 04:58 - 2018-04-12 07:04 - 000032768 _____ C:\WINDOWS\system32\config\ELAM
2018-05-16 04:58 - 2018-02-20 01:02 - 000000398 __RSH C:\ProgramData\ntuser.pol
2018-05-16 04:58 - 2017-11-02 21:39 - 000000000 ___RD C:\Users\kyron\3D Objects
2018-05-16 04:58 - 2015-10-31 16:52 - 000000000 __RHD C:\Users\Public\AccountPictures
2018-05-16 04:57 - 2018-04-12 09:38 - 000000000 ____D C:\WINDOWS\Registration
2018-05-16 04:55 - 2018-04-12 09:38 - 000000000 ___RD C:\WINDOWS\ImmersiveControlPanel
2018-05-16 04:55 - 2018-04-07 00:11 - 000002505 _____ C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Avast Secure Browser.lnk
2018-05-16 04:55 - 2018-04-07 00:11 - 000002470 _____ C:\Users\Public\Desktop\Avast Secure Browser.lnk
2018-05-16 04:55 - 2016-02-03 23:34 - 000022840 _____ C:\WINDOWS\system32\emptyregdb.dat
2018-05-16 04:54 - 2018-04-12 09:38 - 000000000 __RSD C:\WINDOWS\media
2018-05-16 04:51 - 2018-04-12 09:38 - 000000000 ____D C:\ProgramData\USOPrivate
2018-05-16 04:51 - 2018-02-15 20:50 - 000000000 ____D C:\Users\kyron\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\MuseScore 2
2018-05-16 04:51 - 2018-02-12 23:43 - 000000000 ____D C:\Users\kyron\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\WinDirStat
2018-05-16 04:51 - 2017-05-11 23:10 - 000000000 ____D C:\Users\kyron\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Citra Development Team
2018-05-16 04:50 - 2016-12-09 14:50 - 000000000 ____D C:\Users\kyron\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Hammer & Chisel, Inc
2018-05-16 04:49 - 2017-05-03 14:17 - 000000000 ____D C:\WINDOWS\Firmware
2018-05-14 13:13 - 2017-05-03 14:18 - 000000180 _____ C:\WINDOWS\system32\{A6D608F0-0BDE-491A-97AE-5C4B05D86E01}.bat
2018-05-11 18:57 - 2016-12-09 14:50 - 000002244 _____ C:\Users\kyron\Desktop\Discord.lnk
2018-05-11 18:57 - 2016-12-09 14:50 - 000000000 ____D C:\Users\kyron\AppData\Roaming\discord
2018-05-11 18:57 - 2016-12-09 14:50 - 000000000 ____D C:\Users\kyron\AppData\Local\Discord
2018-05-11 11:17 - 2018-02-15 20:50 - 000000000 ____D C:\Users\kyron\AppData\Roaming\MuseScore
2018-05-09 22:20 - 2016-05-08 13:44 - 000000000 ____D C:\Users\kyron\AppData\Roaming\Avid
2018-05-09 22:09 - 2016-09-12 19:36 - 000000000 ____D C:\Program Files\Avid
2018-05-09 21:55 - 2016-05-08 13:44 - 000000000 ____D C:\ProgramData\Avid
2018-05-08 16:05 - 2017-10-15 22:58 - 000000000 ____D C:\Program Files (x86)\Origin
2018-05-02 22:08 - 2016-05-11 19:28 - 000000000 ____D C:\Users\kyron\AppData\Local\ElevatedDiagnostics
2018-05-02 21:30 - 2016-09-05 20:37 - 000000000 ____D C:\Users\kyron\AppData\Local\Avid
2018-05-02 09:59 - 2016-05-08 13:45 - 000000000 ____D C:\Users\kyron\OneDrive\Documents\Scores
2018-05-02 07:22 - 2018-04-12 09:41 - 000835064 _____ (Adobe Systems Incorporated) C:\WINDOWS\SysWOW64\FlashPlayerApp.exe
2018-05-02 07:22 - 2018-04-12 09:41 - 000179704 _____ (Adobe Systems Incorporated) C:\WINDOWS\SysWOW64\FlashPlayerCPLApp.cpl
2018-04-30 21:43 - 2015-10-31 17:16 - 000000000 ____D C:\ProgramData\Package Cache
2018-04-30 21:42 - 2017-12-07 21:05 - 000033544 _____ C:\WINDOWS\system32\Drivers\iLokDrvr.sys
2018-04-26 12:40 - 2016-01-31 17:53 - 000000000 ___RD C:\Users\kyron\OneDrive
2018-04-18 20:45 - 2018-04-17 21:11 - 000000000 ____D C:\Users\kyron\OneDrive\Documents\CarScans
2018-04-18 14:55 - 2017-03-18 20:30 - 000000000 ____D C:\Users\kyron\OneDrive\Documents\ConUni
2018-04-18 13:26 - 2017-04-22 00:26 - 000000000 ____D C:\Program Files (x86)\Java
2018-04-18 13:23 - 2017-04-22 00:27 - 000098760 _____ (Oracle Corporation) C:\WINDOWS\SysWOW64\WindowsAccessBridge-32.dll
 
==================== Files in the root of some directories =======
 
2018-04-12 09:34 - 2018-04-12 09:34 - 000059904 ____N (Microsoft Corporation) C:\Users\kyron\dunis.exe
2016-09-05 20:37 - 2016-09-05 20:37 - 000000604 _____ () C:\Program Files (x86)\Br1S
2016-02-28 15:06 - 2016-02-28 15:06 - 006871040 _____ () C:\Program Files (x86)\GUT507D.tmp
2016-05-08 13:46 - 2016-05-08 13:46 - 000000604 _____ () C:\Program Files (x86)\_43_S
2016-09-05 20:33 - 2016-09-12 19:36 - 001561838 _____ () C:\Users\kyron\AppData\Roaming\AvidApplicationManager_Install.log
2018-04-30 21:42 - 2018-05-09 21:54 - 000000865 _____ () C:\Users\kyron\AppData\Roaming\Avid_CCS_Service_Stop.log
2018-05-07 21:16 - 2018-05-07 21:16 - 000003855 _____ () C:\Users\kyron\AppData\Local\recently-used.xbel
2018-05-17 17:54 - 2018-05-17 17:54 - 000000002 _____ () C:\Users\kyron\AppData\Local\WMI.ini
 
Some files in TEMP:
====================
2018-05-18 14:57 - 2018-05-18 14:57 - 000152576 _____ () C:\Users\kyron\AppData\Local\Temp\ext1704056874732403768.dll
2018-05-18 15:09 - 2018-05-18 15:09 - 000152576 _____ () C:\Users\kyron\AppData\Local\Temp\ext1765788104522864324.dll
2018-05-18 16:14 - 2018-05-18 16:14 - 000152576 _____ () C:\Users\kyron\AppData\Local\Temp\ext1785844503528990320.dll
2018-05-16 22:25 - 2018-05-16 22:25 - 000152576 _____ () C:\Users\kyron\AppData\Local\Temp\ext1795023675138647525.dll
2018-05-16 05:01 - 2018-05-16 05:01 - 000152576 _____ () C:\Users\kyron\AppData\Local\Temp\ext1943591586089203202.dll
2018-05-17 17:25 - 2018-05-17 17:25 - 000152576 _____ () C:\Users\kyron\AppData\Local\Temp\ext2045936555931394932.dll
2018-05-18 16:49 - 2018-05-18 16:49 - 000152576 _____ () C:\Users\kyron\AppData\Local\Temp\ext3612158717587240336.dll
2018-05-18 21:28 - 2018-05-18 21:28 - 000152576 _____ () C:\Users\kyron\AppData\Local\Temp\ext5187520356305387603.dll
2018-05-18 14:23 - 2018-05-18 14:23 - 000152576 _____ () C:\Users\kyron\AppData\Local\Temp\ext5813216771868755203.dll
2018-05-18 17:56 - 2018-05-18 17:56 - 000152576 _____ () C:\Users\kyron\AppData\Local\Temp\ext6552143995738411169.dll
2018-05-18 23:19 - 2018-05-18 23:19 - 000152576 _____ () C:\Users\kyron\AppData\Local\Temp\ext6890042405943896683.dll
2018-05-18 12:44 - 2018-05-18 12:44 - 000152576 _____ () C:\Users\kyron\AppData\Local\Temp\ext7757269608825605427.dll
2018-05-18 16:59 - 2018-05-18 16:59 - 000152576 _____ () C:\Users\kyron\AppData\Local\Temp\ext8020217407568829957.dll
2018-05-17 17:26 - 2018-05-17 17:26 - 000152576 _____ () C:\Users\kyron\AppData\Local\Temp\ext8637228978114558877.dll
2018-05-18 14:15 - 2018-05-18 14:15 - 000152576 _____ () C:\Users\kyron\AppData\Local\Temp\ext8979269938725116158.dll
2016-09-15 10:00 - 2016-09-15 10:00 - 002458672 _____ (The OpenSSL Project, http://www.openssl.org/) C:\Users\kyron\AppData\Local\Temp\libeay32.dll
2016-09-15 10:00 - 2016-09-15 10:00 - 000970912 _____ (Microsoft Corporation) C:\Users\kyron\AppData\Local\Temp\msvcr120.dll
2016-09-15 10:00 - 2016-09-15 10:00 - 000772672 _____ () C:\Users\kyron\AppData\Local\Temp\sqlite3.dll
 
==================== Bamital & volsnap ======================
 
(There is no automatic fix for files that do not pass verification.)
 
C:\WINDOWS\system32\winlogon.exe => File is digitally signed
C:\WINDOWS\system32\wininit.exe => File is digitally signed
C:\WINDOWS\explorer.exe => File is digitally signed
C:\WINDOWS\SysWOW64\explorer.exe => File is digitally signed
C:\WINDOWS\system32\svchost.exe => File is digitally signed
C:\WINDOWS\SysWOW64\svchost.exe => File is digitally signed
C:\WINDOWS\system32\services.exe => File is digitally signed
C:\WINDOWS\system32\User32.dll => File is digitally signed
C:\WINDOWS\SysWOW64\User32.dll => File is digitally signed
C:\WINDOWS\system32\userinit.exe => File is digitally signed
C:\WINDOWS\SysWOW64\userinit.exe => File is digitally signed
C:\WINDOWS\system32\rpcss.dll => File is digitally signed
C:\WINDOWS\system32\dnsapi.dll => File is digitally signed
C:\WINDOWS\SysWOW64\dnsapi.dll => File is digitally signed
C:\WINDOWS\system32\Drivers\volsnap.sys => File is digitally signed
 
LastRegBack: 2018-05-16 04:48
 
==================== End of FRST.txt ============================
 
Additional scan result of Farbar Recovery Scan Tool (x64) Version: 16.05.2018 01
Ran by kyron (18-05-2018 23:22:10)
Running from C:\Users\kyron\Desktop
Windows 10 Pro Version 1803 17134.48 (X64) (2018-05-15 18:58:28)
Boot Mode: Safe Mode (minimal)
==========================================================
 
 
==================== Accounts: =============================
 
620BA50BD18B4F2082ED (S-1-5-21-1795529150-3527648200-2130702207-1005 - Limited - Enabled)
Administrator (S-1-5-21-1795529150-3527648200-2130702207-500 - Administrator - Disabled)
DefaultAccount (S-1-5-21-1795529150-3527648200-2130702207-503 - Limited - Disabled)
Guest (S-1-5-21-1795529150-3527648200-2130702207-501 - Limited - Disabled)
kyron (S-1-5-21-1795529150-3527648200-2130702207-1001 - Administrator - Enabled) => C:\Users\kyron
WDAGUtilityAccount (S-1-5-21-1795529150-3527648200-2130702207-504 - Limited - Disabled)
 
==================== Security Center ========================
 
(If an entry is included in the fixlist, it will be removed.)
 
AV: Avast Antivirus (Enabled - Up to date) {8EA8924E-BC81-DC44-8BB0-8BAE75D86EBF}
AV: Windows Defender (Disabled - Up to date) {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
AS: Spybot - Search and Destroy (Enabled - Up to date) {4C1D9672-63FE-5C90-371E-8FDA591C5B75}
AS: Windows Defender (Disabled - Up to date) {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
AS: Avast Antivirus (Enabled - Up to date) {35C973AA-9ABB-D3CA-B100-B0DC0E5F2402}
 
==================== Installed Programs ======================
 
(Only the adware programs with "Hidden" flag could be added to the fixlist to unhide them. The adware programs should be uninstalled manually.)
 
7-Zip 16.02 (x64) (HKLM\...\7-Zip) (Version: 16.02 - Igor Pavlov)
7-Zip 16.04 (x64 edition) (HKLM\...\{23170F69-40C1-2702-1604-000001000000}) (Version: 16.04.00.0 - Igor Pavlov)
Ableton Live 10 Trial (HKLM\...\{D9E0D052-6589-4B6A-984B-E839C52D4B47}) (Version: 10.0.0.0 - Ableton)
Adobe Acrobat Reader DC (HKLM-x32\...\{AC76BA86-7AD7-1033-7B44-AC0F074E4100}) (Version: 18.011.20040 - Adobe Systems Incorporated)
Adobe Digital Editions 4.5 (HKLM-x32\...\Adobe Digital Editions 4.5) (Version: 4.5.7 - Adobe Systems Incorporated)
AIR Xpand!2 (HKLM\...\{69A89482-FEC4-4E34-97F9-46BB287D0953}) (Version: 2018.1.0.1440 - AIR Music Technology)
ASIO4ALL (HKLM-x32\...\ASIO4ALL) (Version: 2.14 - Michael Tippach)
Audacity 2.1.2 (HKLM-x32\...\Audacity®_is1) (Version: 2.1.2 - Audacity Team)
Auralia 5 Cloud (HKLM-x32\...\{E86BF33D-BCCC-4FAC-995E-E87D0F61BBCB}_is1) (Version:  - Rising Software Australia)
Avast Free Antivirus (HKLM-x32\...\Avast Antivirus) (Version: 18.4.2338 - AVAST Software)
Avast Secure Browser (HKLM-x32\...\Avast Secure Browser) (Version: 64.0.387.186 - AVAST Software)
Avast Update Helper (HKLM-x32\...\{A92DAB39-4E2C-4304-9AB6-BC44E68B55E2}) (Version: 1.4.136.333 - AVAST Software) Hidden
Avid Application Manager (HKLM\...\{DB470A08-EBBF-40F8-8950-0355F1E2F256}) (Version: 18.3.0.17995 - Avid Technology, Inc.)
Avid Cloud Client Services (HKLM\...\{66E7D4F4-F044-428D-A734-59138A626A52}) (Version: 2.4.0.15 - Avid Technology, Inc.)
Avid Effects (HKLM\...\{F53B2C5A-9739-425A-B74C-E8D94DF2EFB5}) (Version: 18.4.0.317 - Avid Technology, Inc.)
Avid HD Driver (x64) (HKLM\...\{658E112A-8776-4430-A275-D9248732DFB9}) (Version: 11.3.1 - Avid Technology, Inc.)
Avid Pro Tools First (HKLM\...\{71F2FFB9-F4A3-49D4-AFF7-7B3B40CF61B6}) (Version: 18.4.0.317 - Avid Technology, Inc.)
Battle.net (HKLM-x32\...\Battle.net) (Version:  - Blizzard Entertainment)
BitTorrent (HKU\S-1-5-21-1795529150-3527648200-2130702207-1001\...\BitTorrent) (Version: 7.10.0.43917 - BitTorrent Inc.)
Bonjour (HKLM\...\{6E3610B2-430D-4EB0-81E3-2B57E8B9DE8D}) (Version: 3.0.0.10 - Apple Inc.)
Canon IJ Network Scanner Selector EX (HKLM-x32\...\Canon_IJ_Network_Scanner_Selector_EX) (Version: 1.5.4.4 - Canon Inc.)
Canon IJ Network Tool (HKLM-x32\...\Canon_IJ_Network_UTILITY) (Version: 3.7.0 - Canon Inc.)
Canon IJ Scan Utility (HKLM-x32\...\Canon_IJ_Scan_Utility) (Version: 1.1.20.13 - Canon Inc.)
Canon MG5700 series MP Drivers (HKLM\...\{1199FAD5-9546-44f3-81CF-FFDB8040B7BF}_Canon_MG5700_series) (Version: 1.00 - Canon Inc.)
Canon MG5700 series On-screen Manual (HKLM-x32\...\Canon MG5700 series On-screen Manual) (Version: 7.8.0 - Canon Inc.)
Canon My Printer (HKLM-x32\...\CanonMyPrinter) (Version: 3.3.0 - Canon Inc.)
Citra (HKLM-x32\...\Citra) (Version: 0.9.5.2 - 3dsemulator.org)
Citra Edge (HKU\S-1-5-21-1795529150-3527648200-2130702207-1001\...\citra) (Version: 0.1.304 - Citra Development Team)
Danganronpa - Trigger Happy Havoc (HKLM-x32\...\Danganronpa - Trigger Happy Havoc_is1) (Version:  - )
Danganronpa 2 Goodbye Despair (HKLM-x32\...\Danganronpa 2 Goodbye Despair_is1) (Version:  - )
Discord (HKU\S-1-5-21-1795529150-3527648200-2130702207-1001\...\Discord) (Version: 0.0.301 - Discord Inc.)
Europa Universalis IV Mare Nostrum (HKLM-x32\...\Europa Universalis IV Mare Nostrum_is1) (Version:  - )
Google Chrome (HKLM-x32\...\Google Chrome) (Version: 66.0.3359.181 - Google Inc.)
Google Update Helper (HKLM-x32\...\{60EC980A-BDA2-4CB6-A427-B07A5498B4CA}) (Version: 1.3.33.17 - Google Inc.) Hidden
Hearthstone (HKLM-x32\...\Hearthstone) (Version:  - Blizzard Entertainment)
Inkscape 0.91 (HKLM\...\{81922150-317E-4BB0-A31D-FF1C14F707C5}) (Version: 0.91 - inkscape.org)
Intel® Processor Graphics (HKLM-x32\...\{F0E3AD40-2BBD-4360-9C76-B9AC9A5886EA}) (Version: 20.19.15.4409 - Intel Corporation)
Java 8 Update 171 (HKLM-x32\...\{26A24AE4-039D-4CA4-87B4-2F32180171F0}) (Version: 8.0.1710.11 - Oracle Corporation)
LAME v3.99.3 (for Windows) (HKLM-x32\...\LAME_is1) (Version:  - )
Malwarebytes version 3.4.5.2467 (HKLM\...\{35065F43-4BB2-439A-BFF7-0F1014F2E0CD}_is1) (Version: 3.4.5.2467 - Malwarebytes)
Microsoft Office 365 ProPlus - en-us (HKLM\...\O365ProPlusRetail - en-us) (Version: 16.0.8431.2250 - Microsoft Corporation)
Microsoft OneDrive (HKU\S-1-5-21-1795529150-3527648200-2130702207-1001\...\OneDriveSetup.exe) (Version: 18.065.0329.0002 - Microsoft Corporation)
Microsoft Visual C++ 2005 Redistributable - KB2467175 (HKLM-x32\...\{a0fe116e-9a8a-466f-aee0-625cb7c207e3}) (Version: 8.0.51011 - Microsoft Corporation)
Microsoft Visual C++ 2005 Redistributable (HKLM-x32\...\{7299052b-02a4-4627-81f2-1818da5d550d}) (Version: 8.0.56336 - Microsoft Corporation)
Microsoft Visual C++ 2005 Redistributable (x64) - KB2467175 (HKLM\...\{aac9fcc4-dd9e-4add-901c-b5496a07ab2e}) (Version: 8.0.51011 - Microsoft Corporation)
Microsoft Visual C++ 2005 Redistributable (x64) (HKLM\...\{071c9b48-7c32-4621-a0ac-3f809523288f}) (Version: 8.0.56336 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.17 (HKLM\...\{8220EEFE-38CD-377E-8595-13398D740ACE}) (Version: 9.0.30729 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.4148 (HKLM\...\{4B6C7001-C7D6-3710-913E-5BC23FCE91E6}) (Version: 9.0.30729.4148 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.6161 (HKLM\...\{5FCE6D76-F5DC-37AB-B2B8-22AB8CEDB1D4}) (Version: 9.0.30729.6161 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17 (HKLM-x32\...\{9A25302D-30C0-39D9-BD6F-21E6EC160475}) (Version: 9.0.30729 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.4148 (HKLM-x32\...\{1F1C2DFC-2D24-3E06-BCB8-725134ADF989}) (Version: 9.0.30729.4148 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161 (HKLM-x32\...\{9BE518E6-ECC6-35A9-88E4-87755C07200F}) (Version: 9.0.30729.6161 - Microsoft Corporation)
Microsoft Visual C++ 2010  x64 Redistributable - 10.0.40219 (HKLM\...\{1D8E6291-B0D5-35EC-8441-6616F567A0F7}) (Version: 10.0.40219 - Microsoft Corporation)
Microsoft Visual C++ 2010  x86 Redistributable - 10.0.30319 (HKLM-x32\...\{196BB40D-1578-3D01-B289-BEFC77A11A1E}) (Version: 10.0.30319 - Microsoft Corporation)
Microsoft Visual C++ 2012 Redistributable (x64) - 11.0.61030 (HKLM-x32\...\{ca67548a-5ebe-413a-b50c-4b9ceb6d66c6}) (Version: 11.0.61030.0 - Microsoft Corporation)
Microsoft Visual C++ 2012 Redistributable (x86) - 11.0.61030 (HKLM-x32\...\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}) (Version: 11.0.61030.0 - Microsoft Corporation)
Microsoft Visual C++ 2013 Redistributable (x64) - 12.0.30501 (HKLM-x32\...\{050d4fc8-5d48-4b8f-8972-47c82c46020f}) (Version: 12.0.30501.0 - Microsoft Corporation)
Microsoft Visual C++ 2013 Redistributable (x64) - 12.0.40660 (HKLM-x32\...\{ef6b00ec-13e1-4c25-9064-b2f383cb8412}) (Version: 12.0.40660.0 - Microsoft Corporation)
Microsoft Visual C++ 2013 Redistributable (x86) - 12.0.30501 (HKLM-x32\...\{f65db027-aff3-4070-886a-0d87064aabb1}) (Version: 12.0.30501.0 - Microsoft Corporation)
Microsoft Visual C++ 2013 Redistributable (x86) - 12.0.40660 (HKLM-x32\...\{61087a79-ac85-455c-934d-1fa22cc64f36}) (Version: 12.0.40660.0 - Microsoft Corporation)
Microsoft Visual C++ 2015 Redistributable (x64) - 14.0.24212 (HKLM-x32\...\{323dad84-0974-4d90-a1c1-e006c7fdbb7d}) (Version: 14.0.24212.0 - Microsoft Corporation)
Microsoft Visual C++ 2015 Redistributable (x86) - 14.0.24215 (HKLM-x32\...\{e2803110-78b3-4664-a479-3611a381656a}) (Version: 14.0.24215.1 - Microsoft Corporation)
Minecraft (HKLM-x32\...\{1C16BCA3-EBC1-49F6-8623-8FBFB9CCC872}) (Version: 1.0.3.0 - Mojang)
Mozilla Firefox 59.0.2 (x64 en-US) (HKLM\...\Mozilla Firefox 59.0.2 (x64 en-US)) (Version: 59.0.2 - Mozilla)
Mozilla Maintenance Service (HKLM\...\MozillaMaintenanceService) (Version: 54.0.1 - Mozilla)
MuseScore 2 (HKLM-x32\...\{DC8A2B29-D9A7-4D67-A049-BC0A659A2B57}) (Version: 2.1.0 - Werner Schweer and Others)
Office 16 Click-to-Run Extensibility Component (HKLM-x32\...\{90160000-008C-0000-0000-0000000FF1CE}) (Version: 16.0.8431.2250 - Microsoft Corporation) Hidden
Office 16 Click-to-Run Extensibility Component 64-bit Registration (HKLM\...\{90160000-00DD-0000-1000-0000000FF1CE}) (Version: 16.0.8431.2250 - Microsoft Corporation) Hidden
Office 16 Click-to-Run Licensing Component (HKLM\...\{90160000-008F-0000-1000-0000000FF1CE}) (Version: 16.0.8431.2250 - Microsoft Corporation) Hidden
Office 16 Click-to-Run Localization Component (HKLM-x32\...\{90160000-008C-0409-0000-0000000FF1CE}) (Version: 16.0.8326.2076 - Microsoft Corporation) Hidden
Origin (HKLM-x32\...\Origin) (Version: 10.5.18.58059 - Electronic Arts, Inc.)
PACE License Support Win64 (HKLM\...\{15ADFA42-BA79-47e4-945F-A8A997FB990C}) (Version: 4.0.3.2024 - PACE Anti-Piracy, Inc.) Hidden
PACE License Support Win64 (HKLM\...\{72ad9d51-0903-4fe7-af5d-33b3185fa6e9}) (Version: 2.4.3.0756 - PACE Anti-Piracy, Inc.) Hidden
PACE License Support Win64 (HKLM-x32\...\InstallShield_{15ADFA42-BA79-47e4-945F-A8A997FB990C}) (Version: 4.0.3.2024 - PACE Anti-Piracy, Inc.)
PACE License Support Win64 (HKLM-x32\...\InstallShield_{72ad9d51-0903-4fe7-af5d-33b3185fa6e9}) (Version: 2.4.3.0756 - PACE Anti-Piracy, Inc.)
paint.net (HKLM\...\{E8FA8815-3817-4128-A814-E2EAC456ADF0}) (Version: 4.0.21 - dotPDN LLC)
Papers, Please (HKLM-x32\...\GOGPACKPAPERSPLEASE_is1) (Version: 2.0.0.4 - GOG.com)
Realtek High Definition Audio Driver (HKLM-x32\...\{F132AF7F-7BCA-4EDE-8A7C-958108FE7DBC}) (Version: 6.0.1.7424 - Realtek Semiconductor Corp.)
Runic - Anglo-Saxon Futhorc (BabelStone) (HKLM\...\{658CA197-381C-4569-94FF-E424371ABA15}) (Version: 1.0.3.40 - BabelStone)
Sibelius (HKLM\...\{6420DC80-3BCF-4C96-A209-B0C5D26E140D}) (Version: 8.2.0.89 - Avid Technology)
Sibelius 7 OpenType Fonts (HKLM-x32\...\{623C2BD8-1B28-4F98-B578-E9D139827269}) (Version: 7.1.3 - Avid)
Sid Meiers Civilization VI Rise and Fall (HKLM\...\c2lkbWVpZXJzY2l2aWxpemF0aW9udmk_is1) (Version: 1 - )
Sid Meiers Civilization VI Rise and Fall (HKLM-x32\...\Sid Meiers Civilization VI Rise and Fall_is1) (Version:  - )
Skype™ 7.40 (HKLM-x32\...\{3B7E914A-93D5-4A29-92BB-AF8C3F66C431}) (Version: 7.40.151 - Skype Technologies S.A.)
Spybot - Search & Destroy (HKLM-x32\...\{B4092C6D-E886-4CB2-BA68-FE5A99D31DE7}_is1) (Version: 2.7.64.0 - Safer-Networking Ltd.)
Stickies 9.0e (HKLM-x32\...\ZhornStickies) (Version:  - Zhorn Software)
The Sims™ 4 Create A Sim Demo (HKLM-x32\...\{6908ED99-F02B-4E99-A202-3FAC99C510ED}) (Version: 1.0.293.1110 - Electronic Arts Inc.)
Visual C++ 64-bit Redistributables (HKLM-x32\...\InstallShield_{5B0E60DB-7741-412F-88B3-E6975D30D019}) (Version: 1.1.0.0929 - PACE Anti-Piracy, Inc.)
Visual C++ Redistributables (HKLM-x32\...\InstallShield_{C2AF7B2D-7018-414B-9B8B-D3C9F3BED04F}) (Version: 1.1.0.0929 - PACE Anti-Piracy, Inc.)
WinDirStat 1.1.2 (HKU\S-1-5-21-1795529150-3527648200-2130702207-1001\...\WinDirStat) (Version:  - )
Windows 10 Update Assistant (HKLM-x32\...\{D5C69738-B486-402E-85AC-2456D98A64E4}) (Version: 1.4.9200.22334 - Microsoft Corporation)
 
==================== Custom CLSID (Whitelisted): ==========================
 
(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)
 
ShellIconOverlayIdentifiers: [00asw] -> {472083B0-C522-11CF-8763-00608CC02F24} => C:\Program Files\AVAST Software\Avast\ashShA64.dll [2018-05-18] (AVAST Software)
ShellIconOverlayIdentifiers: [00avast] -> {472083B0-C522-11CF-8763-00608CC02F24} => C:\Program Files\AVAST Software\Avast\ashShA64.dll [2018-05-18] (AVAST Software)
ContextMenuHandlers1: [7-Zip] -> {23170F69-40C1-278A-1000-000100020000} => C:\Program Files\7-Zip\7-zip.dll [2016-10-04] (Igor Pavlov)
ContextMenuHandlers1: [avast] -> {472083B0-C522-11CF-8763-00608CC02F24} => C:\Program Files\AVAST Software\Avast\ashShA64.dll [2018-05-18] (AVAST Software)
ContextMenuHandlers1: [SDECon32] -> {44176360-2BBF-4EC1-93CE-384B8681A0BC} => C:\Program Files (x86)\Spybot - Search & Destroy 2\SDECon64.dll [2018-03-23] (Safer-Networking Ltd.)
ContextMenuHandlers1: [SDECon64] -> {44176360-2BBF-4EC1-93CE-384B8681A0BC} => C:\Program Files (x86)\Spybot - Search & Destroy 2\SDECon64.dll [2018-03-23] (Safer-Networking Ltd.)
ContextMenuHandlers3: [00asw] -> {472083B0-C522-11CF-8763-00608CC02F24} => C:\Program Files\AVAST Software\Avast\ashShA64.dll [2018-05-18] (AVAST Software)
ContextMenuHandlers3: [MBAMShlExt] -> {57CE581A-0CB6-4266-9CA0-19364C90A0B3} => C:\Program Files\Malwarebytes\Anti-Malware\mbshlext.dll [2018-03-27] (Malwarebytes)
ContextMenuHandlers4: [7-Zip] -> {23170F69-40C1-278A-1000-000100020000} => C:\Program Files\7-Zip\7-zip.dll [2016-10-04] (Igor Pavlov)
ContextMenuHandlers5: [igfxcui] -> {3AB1675A-CCFF-11D2-8B20-00A0C93CB1F4} =>  -> No File
ContextMenuHandlers5: [igfxDTCM] -> {9B5F5829-A529-4B12-814A-E81BCB8D93FC} => C:\WINDOWS\system32\igfxDTCM.dll -> No File
ContextMenuHandlers6: [7-Zip] -> {23170F69-40C1-278A-1000-000100020000} => C:\Program Files\7-Zip\7-zip.dll [2016-10-04] (Igor Pavlov)
ContextMenuHandlers6: [avast] -> {472083B0-C522-11CF-8763-00608CC02F24} => C:\Program Files\AVAST Software\Avast\ashShA64.dll [2018-05-18] (AVAST Software)
ContextMenuHandlers6: [MBAMShlExt] -> {57CE581A-0CB6-4266-9CA0-19364C90A0B3} => C:\Program Files\Malwarebytes\Anti-Malware\mbshlext.dll [2018-03-27] (Malwarebytes)
ContextMenuHandlers6: [SDECon32] -> {44176360-2BBF-4EC1-93CE-384B8681A0BC} => C:\Program Files (x86)\Spybot - Search & Destroy 2\SDECon64.dll [2018-03-23] (Safer-Networking Ltd.)
ContextMenuHandlers6: [SDECon64] -> {44176360-2BBF-4EC1-93CE-384B8681A0BC} => C:\Program Files (x86)\Spybot - Search & Destroy 2\SDECon64.dll [2018-03-23] (Safer-Networking Ltd.)
 
==================== Scheduled Tasks (Whitelisted) =============
 
(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)
 
Task: {0310BFF9-68B3-41CE-8B7F-CAEF4E7BD45F} - System32\Tasks\GoogleUpdateTaskMachineUA => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe [2016-02-28] (Google Inc.)
Task: {10ADB115-D69C-4B36-8CB7-3061191C7733} - System32\Tasks\Avast Software\Overseer => C:\Program Files\Common Files\Avast Software\Overseer\overseer.exe [2018-04-15] (AVAST Software)
Task: {184DA052-2F11-401F-B276-053078D11259} - System32\Tasks\{8B383D6E-1FA5-4659-A3C0-10B7671A2AE4} => C:\WINDOWS\system32\pcalua.exe -a C:\Users\kyron\Downloads\t6\06 東方紅魔郷\th06e.exe -d C:\Users\kyron\Downloads\t6\06 東方紅魔郷
Task: {22D44A40-A394-4A4B-A4AD-484DFC70D0AC} - System32\Tasks\Microsoft\Office\Office ClickToRun Service Monitor => C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeC2RClient.exe [2018-04-27] (Microsoft Corporation)
Task: {3480BE99-C029-48BB-81EE-CDE3B61E16CE} - System32\Tasks\Avast Emergency Update => C:\Program Files\AVAST Software\Avast\AvEmUpdate.exe [2018-05-18] (AVAST Software)
Task: {38154817-EBA9-4891-92A8-0CF33A2C1D18} - System32\Tasks\{AB14743F-D9FE-687A-6964-FF7296FEEA1B} => C:\WINDOWS\syThhbb.exe [2018-04-12] (Microsoft Corporation)
Task: {43E670D4-A427-4E42-BE6E-E5A25D055082} - System32\Tasks\{67E0B68F-0151-BE0A-131C-1F78450D9CD1} => "C:\Program Files (x86)\Google\Chrome\Application\chrome.exe" hxxp://pqiera.net/cl/?guid=5m24qkm0u42whgz03sr1qwifka1n6sr1&prid=1&pid=4_1324_0
Task: {445D667B-3EE7-4E99-96C8-B48FF2E45962} - System32\Tasks\{813DD28E-3776-67DA-B3B1-FC471BF531A4} => C:\Users\kyron\dunis.exe [2018-04-12] (Microsoft Corporation)
Task: {45EBD574-6F5D-4CAF-AD7B-CF33706B23F6} - System32\Tasks\AVAST Software\Avast settings backup => C:\Program Files\Common Files\AV\avast! Antivirus\backup.exe
Task: {59D66217-FE57-479E-BCAF-476C49264ED5} - System32\Tasks\{3C313D76-2347-41F2-97B3-6B9D762E244C} => C:\WINDOWS\system32\pcalua.exe -a C:\Users\kyron\Downloads\t6\06 東方紅魔郷\th06e.exe -d C:\Users\kyron\Downloads\t6\06 東方紅魔郷
Task: {5F057D3F-E68B-493F-B972-47CFDC6634D2} - \Microsoft\Windows\UNP\RunCampaignManager -> No File <==== ATTENTION
Task: {5FF8C8DC-817B-4BEB-A3DA-00CE3CDD53B2} - System32\Tasks\{D96A74AE-F83E-4FBF-B345-76796DA391B1} => C:\WINDOWS\system32\pcalua.exe -a C:\Users\kyron\Downloads\t6\06 東方紅魔郷\th06e.exe -d C:\Users\kyron\Downloads\t6\06 東方紅魔郷
Task: {61E77FE2-4FBE-4D8F-92E0-298F2635D772} - System32\Tasks\Microsoft\Office\OfficeBackgroundTaskHandlerRegistration => C:\Program Files (x86)\Microsoft Office\root\Office16\officebackgroundtaskhandler.exe [2018-01-19] ()
Task: {63F99C63-3E9A-48A2-B2FA-83699081C2C1} - System32\Tasks\AvastUpdateTaskMachineUA => C:\Program Files (x86)\AVAST Software\Browser\Update\AvastBrowserUpdate.exe [2018-04-07] (AVAST Software)
Task: {65B85F6F-35B3-4459-A179-28255D5B7B25} - System32\Tasks\Microsoft\Windows\HelloFace\FODCleanupTask => C:\WINDOWS\System32\WinBioPlugIns\FaceFodUninstaller.exe [2018-04-12] ()
Task: {693B0907-26F6-446B-BAE6-4873E8A55772} - System32\Tasks\Microsoft\Office\OfficeTelemetryAgentFallBack2016 => C:\Program Files (x86)\Microsoft Office\root\Office16\msoia.exe [2018-05-18] (Microsoft Corporation)
Task: {774CF552-2E76-4F34-9FDC-5855360025F6} - System32\Tasks\Microsoft\Office\OfficeTelemetryAgentLogOn2016 => C:\Program Files (x86)\Microsoft Office\root\Office16\msoia.exe [2018-05-18] (Microsoft Corporation)
Task: {7C6CAD97-4D52-44D6-9473-F6F597458983} - System32\Tasks\AvastUpdateTaskMachineCore => C:\Program Files (x86)\AVAST Software\Browser\Update\AvastBrowserUpdate.exe [2018-04-07] (AVAST Software)
Task: {8E90A246-2AA0-41AD-B7D9-E3995F97DC31} - System32\Tasks\{A11F6704-A7E8-4EC5-9017-5845439F52BF} => C:\WINDOWS\system32\pcalua.exe -a C:\Users\kyron\Downloads\t6\06 東方紅魔郷\th06e.exe -d C:\Users\kyron\Downloads\t6\06 東方紅魔郷
Task: {9B216CD5-780D-4B35-A652-4E263EC42954} - System32\Tasks\Microsoft\Office\OfficeBackgroundTaskHandlerLogon => C:\Program Files (x86)\Microsoft Office\root\Office16\officebackgroundtaskhandler.exe [2018-01-19] ()
Task: {A6499432-D4E0-437E-8E0A-4CCAD78C9282} - System32\Tasks\{8C8957D5-B712-4D6D-BAEE-C3EB14C50244} => C:\WINDOWS\system32\pcalua.exe -a C:\Users\kyron\Downloads\t6\06 東方紅魔郷\th06e.exe -d C:\Users\kyron\Downloads\t6\06 東方紅魔郷
Task: {C17B00C6-A718-4D66-853F-C72F8A750CEA} - System32\Tasks\{65398F09-5781-4067-8E69-C70051AB0C4B} => C:\WINDOWS\system32\pcalua.exe -a C:\Users\kyron\Downloads\t6\06 東方紅魔郷\th06e.exe -d C:\Users\kyron\Downloads\t6\06 東方紅魔郷
Task: {CD95A3E7-83F4-4049-A1C0-0A4EB0839FFD} - System32\Tasks\GoogleUpdateTaskMachineCore => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe [2016-02-28] (Google Inc.)
Task: {D0314930-8327-41D3-8050-F4CF0D503F94} - System32\Tasks\{4A825F61-8C5A-483E-88BF-AAABE6413B9C} => C:\WINDOWS\system32\pcalua.exe -a C:\Users\kyron\Downloads\t6\06 東方紅魔郷\th06e.exe -d C:\Users\kyron\Downloads\t6\06 東方紅魔郷
Task: {E178AF4D-5939-40CC-B023-AB8A6DA866D8} - System32\Tasks\Adobe Acrobat Update Task => C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe [2018-02-09] (Adobe Systems Incorporated)
Task: {E31D0C08-07D6-4396-B19B-CAAA18C20987} - System32\Tasks\Microsoft\Office\Office Subscription Maintenance => C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonx86\Microsoft Shared\Office16\OLicenseHeartbeat.exe [2018-05-18] (Microsoft Corporation)
Task: {EA158F5E-15B4-45D3-8DCC-256547D21885} - System32\Tasks\{D919DA4B-3671-465C-B4AA-3567BB550450} => C:\WINDOWS\system32\pcalua.exe -a C:\Users\kyron\Downloads\t6\06 東方紅魔郷\th06e.exe -d C:\Users\kyron\Downloads\t6\06 東方紅魔郷
Task: {F2224056-2A94-4A09-AC87-B314897CC4A8} - System32\Tasks\Microsoft\Office\Office Automatic Updates => C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeC2RClient.exe [2018-04-27] (Microsoft Corporation)
Task: {F86331A4-F66E-48EE-9F40-C9E5C348126D} - System32\Tasks\{C0E32415-2FD3-4420-B82C-05F317195593} => C:\WINDOWS\system32\pcalua.exe -a C:\Users\kyron\Downloads\t6\06 東方紅魔郷\東方紅魔郷.exe -d C:\Users\kyron\Downloads\t6\06 東方紅魔郷
 
(If an entry is included in the fixlist, the task (.job) file will be moved. The file which is running by the task will not be moved.)
 
Task: C:\WINDOWS\Tasks\Check for updates (Spybot - Search & Destroy).job => C:\Program Files (x86)\Spybot - Search & Destroy 2\SDUpdate.exe
Task: C:\WINDOWS\Tasks\CreateExplorerShellUnelevatedTask.job => C:\WINDOWS\explorer.exe
Task: C:\WINDOWS\Tasks\Refresh immunization (Spybot - Search & Destroy).job => C:\Program Files (x86)\Spybot - Search & Destroy 2\SDImmunize.exe
Task: C:\WINDOWS\Tasks\Scan the system (Spybot - Search & Destroy).job => C:\Program Files (x86)\Spybot - Search & Destroy 2\SDScan.exe
 
==================== Shortcuts & WMI ========================
 
(The entries could be listed to be restored or removed.)
 
 
ShortcutWithArgument: C:\Users\kyron\Desktop\Mididoom - Chrome.lnk -> C:\Program Files (x86)\Google\Chrome\Application\chrome.exe (Google Inc.) -> --profile-directory="Profile 2"
ShortcutWithArgument: C:\Users\kyron\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\User Pinned\ImplicitAppShortcuts\9501e18d7c2ab92e\Google Chrome.lnk -> C:\Program Files (x86)\Google\Chrome\Application\chrome.exe (Google Inc.) -> --profile-directory="Profile 2"
 
==================== Loaded Modules (Whitelisted) ==============
 
2018-04-12 09:34 - 2018-04-12 09:34 - 000491744 _____ () C:\Windows\System32\InputHost.dll
2016-06-06 20:23 - 2018-01-19 05:09 - 008929480 _____ () C:\Program Files (x86)\Microsoft Office\root\VFS\ProgramFilesX64\Microsoft Office\Office16\1033\GrooveIntlResource.dll
2018-04-12 09:35 - 2018-04-13 02:19 - 002184704 _____ () C:\Windows\SystemApps\Microsoft.Windows.Cortana_cw5n1h2txyewy\Cortana.Core.dll
2018-04-27 01:02 - 2018-04-27 01:02 - 000086528 _____ () C:\Program Files\WindowsApps\Microsoft.SkypeApp_12.1813.286.0_x64__kzf8qxf38zg5c\SkypeHost.exe
2018-04-27 01:02 - 2018-04-27 01:02 - 000195072 _____ () C:\Program Files\WindowsApps\Microsoft.SkypeApp_12.1813.286.0_x64__kzf8qxf38zg5c\SkypeBackgroundTasks.dll
 
==================== Alternate Data Streams (Whitelisted) =========
 
(If an entry is included in the fixlist, only the ADS will be removed.)
 
AlternateDataStreams: C:\ProgramData\PACE:F66A6B7D73A7F51B [217]
 
==================== Safe Mode (Whitelisted) ===================
 
(If an entry is included in the fixlist, it will be removed from the registry. The "AlternateShell" will be restored.)
 
HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Option => "OptionValue"="1"
 
==================== Association (Whitelisted) ===============
 
(If an entry is included in the fixlist, the registry item will be restored to default or removed.)
 
 
==================== Internet Explorer trusted/restricted ===============
 
(If an entry is included in the fixlist, it will be removed from the registry.)
 
 
==================== Hosts content: ===============================
 
(If needed Hosts: directive could be included in the fixlist to reset Hosts.)
 
2015-07-10 21:04 - 2015-07-10 21:02 - 000000824 _____ C:\WINDOWS\system32\Drivers\etc\hosts
 
 
==================== Other Areas ============================
 
(Currently there is no automatic fix for this section.)
 
HKU\S-1-5-21-1795529150-3527648200-2130702207-1001\Control Panel\Desktop\\Wallpaper -> C:\Users\kyron\OneDrive\Pictures\Thomas Cole - The Voyage of Life--Childhood.jpg
DNS Servers: Media is not connected to internet.
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System => (ConsentPromptBehaviorAdmin: 5) (ConsentPromptBehaviorUser: 3) (EnableLUA: 1)
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer => (SmartScreenEnabled: RequireAdmin)
 
==================== MSCONFIG/TASK MANAGER disabled items ==
 
MSCONFIG\Services: wercplsupport => 3
MSCONFIG\Services: WerSvc => 3
HKU\S-1-5-21-1795529150-3527648200-2130702207-1001\...\StartupApproved\StartupFolder: => "Send to OneNote.lnk"
 
==================== FirewallRules (Whitelisted) ===============
 
(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)
 
FirewallRules: [{317B5C21-C98E-430F-9C94-C6EF05EDF870}] => (Allow) C:\Program Files\Avid\Pro Tools FirstProToolsFirst.exe
FirewallRules: [{11795E2C-31FD-4922-A24F-CCA9F0A54DA9}] => (Allow) C:\Program Files\Avid\Application Manager\AvidAppManHelper.exe
FirewallRules: [{4DA4185F-F496-4835-B7E4-FED58DD559D0}] => (Allow) C:\Program Files\Avid\Application Manager\AvidApplicationManager.exe
FirewallRules: [{072E6158-F50F-4405-8BAA-152E63C18532}] => (Allow) C:\Program Files\Avid\Application Manager\jre\bin\java.exe
FirewallRules: [{D099F078-2384-403F-951B-E524A94881E4}] => (Allow) C:\Program Files\Avid\Cloud Client Services\TransportClient.exe
FirewallRules: [{47D83921-B688-4FD2-8FE5-0897564C94D0}] => (Allow) C:\Program Files\Avid\Cloud Client Services\Hub.exe
FirewallRules: [UDP Query User{97578D09-C3F8-4C6D-A77C-4FB81ACD84A9}C:\program files\avid\application manager\avidappmanhelper.exe] => (Allow) C:\program files\avid\application manager\avidappmanhelper.exe
FirewallRules: [TCP Query User{BAAAC707-B8CC-4B62-A088-82BF5B679FB9}C:\program files\avid\application manager\avidappmanhelper.exe] => (Allow) C:\program files\avid\application manager\avidappmanhelper.exe
FirewallRules: [{583F135C-CD1A-4C41-A312-079BD836CB1D}] => (Allow) C:\Program Files (x86)\Bonjour\mDNSResponder.exe
FirewallRules: [{6A3A2700-E755-48F2-B1B0-994777F77946}] => (Allow) C:\Program Files (x86)\Bonjour\mDNSResponder.exe
FirewallRules: [{39799D2B-94D6-4E55-ADC2-DAE4E308B585}] => (Allow) C:\Program Files\Bonjour\mDNSResponder.exe
FirewallRules: [{2EF90799-DD7D-4E99-AA0F-29BA690DD9BA}] => (Allow) C:\Program Files\Bonjour\mDNSResponder.exe
FirewallRules: [{D2286985-1B02-44BA-9DE6-191AAB2E532B}] => (Allow) C:\Program Files (x86)\AVAST Software\Browser\Application\AvastBrowser.exe
FirewallRules: [{90AA471E-16FA-47F2-8364-C3CC4FD2CADF}] => (Allow) C:\Program Files (x86)\Microsoft Office\root\Office16\outlook.exe
FirewallRules: [DNS Server Forward Rule - UDP - a5d7d3b1-17e2-4220-9e71-f78448b8dd80 - 0] => (Allow) LPort=53
FirewallRules: [DNS Server Forward Rule - TCP - a5d7d3b1-17e2-4220-9e71-f78448b8dd80 - 0] => (Allow) LPort=53
FirewallRules: [DNS Server Forward Rule - UDP - f94927b5-7f11-4a2c-b007-e0c14c4e6f51 - 0] => (Allow) LPort=53
FirewallRules: [DNS Server Forward Rule - TCP - f94927b5-7f11-4a2c-b007-e0c14c4e6f51 - 0] => (Allow) LPort=53
FirewallRules: [UDP Query User{DBEBB563-5B46-42F8-B309-59829A62B9D3}C:\program files (x86)\hearthstone\hearthstone.exe] => (Allow) C:\program files (x86)\hearthstone\hearthstone.exe
FirewallRules: [TCP Query User{2821735B-63EF-4C68-BCE7-73B09585E6E9}C:\program files (x86)\hearthstone\hearthstone.exe] => (Allow) C:\program files (x86)\hearthstone\hearthstone.exe
FirewallRules: [{FA2E9270-D778-4723-A94B-52FD97B2DD33}] => (Allow) C:\Users\kyron\AppData\Roaming\BitTorrent\BitTorrent.exe
FirewallRules: [{0747EAC7-AC10-4403-BC22-9CC3C4B0A285}] => (Allow) C:\Users\kyron\AppData\Roaming\BitTorrent\BitTorrent.exe
FirewallRules: [{9EBEBFE0-7ABD-4179-93B2-CAA1FE2BEFA4}] => (Allow) C:\Users\kyron\AppData\Roaming\BitTorrent\BitTorrent.exe
FirewallRules: [{9A9F5598-DBBB-4003-B6BC-349614936324}] => (Allow) C:\Users\kyron\AppData\Roaming\BitTorrent\BitTorrent.exe
FirewallRules: [{2D01C921-D588-4AE6-974B-95C6C6A4015C}] => (Allow) C:\Users\kyron\AppData\Roaming\BitTorrent\BitTorrent.exe
FirewallRules: [{F2341FC5-5FC8-4D25-83EA-7964F75F723F}] => (Allow) C:\Users\kyron\AppData\Roaming\BitTorrent\BitTorrent.exe
FirewallRules: [UDP Query User{27590672-26E3-4A4A-A7AE-A0E6460B16F3}C:\program files (x86)\minecraft\runtime\jre-x64\1.8.0_25\bin\javaw.exe] => (Allow) C:\program files (x86)\minecraft\runtime\jre-x64\1.8.0_25\bin\javaw.exe
FirewallRules: [TCP Query User{61D048E8-B6E2-49BD-BEF3-4FA306954461}C:\program files (x86)\minecraft\runtime\jre-x64\1.8.0_25\bin\javaw.exe] => (Allow) C:\program files (x86)\minecraft\runtime\jre-x64\1.8.0_25\bin\javaw.exe
FirewallRules: [UDP Query User{C55A65A0-D470-47DD-AE25-4D513CA3A459}C:\windows\system32\wuapihost.exe] => (Block) C:\windows\system32\wuapihost.exe
FirewallRules: [TCP Query User{B5B07CFB-6502-4BDB-8061-0FB8F6346B0A}C:\windows\system32\wuapihost.exe] => (Block) C:\windows\system32\wuapihost.exe
FirewallRules: [{CA87A5EB-767B-4A54-BB8C-06DD6A20A735}] => (Allow) C:\Program Files (x86)\Microsoft Office\root\Office16\Lync.exe
FirewallRules: [{63FD9B66-66EB-4335-8701-D8EB9D3165DE}] => (Allow) C:\Program Files (x86)\Microsoft Office\root\Office16\UcMapi.exe
FirewallRules: [{FAF8EDFA-E167-41CE-BD50-909E40BAF334}] => (Allow) C:\Program Files (x86)\Skype\Phone\Skype.exe
FirewallRules: [TCP Query User{2F1B95E2-68E2-4765-BBCB-F848B4125F93}C:\users\kyron\downloads\3dsemu\citra-qt.exe] => (Allow) C:\users\kyron\downloads\3dsemu\citra-qt.exe
FirewallRules: [UDP Query User{52C17AAE-0EEA-42BD-B043-0A96574439AD}C:\users\kyron\downloads\3dsemu\citra-qt.exe] => (Allow) C:\users\kyron\downloads\3dsemu\citra-qt.exe
FirewallRules: [{623AAB5A-8905-472F-90D4-644416A378CC}] => (Allow) C:\Program Files (x86)\Microsoft Office\root\Office16\Lync.exe
FirewallRules: [{5F60A402-498D-4D5E-8762-9F004633CCA4}] => (Allow) C:\Program Files (x86)\Microsoft Office\root\Office16\UcMapi.exe
FirewallRules: [{42E625EB-4FA3-48CC-8254-4E7FCA028A29}] => (Allow) C:\Program Files (x86)\Mozilla Firefox\firefox.exe
FirewallRules: [{B8049CC3-FDC6-480B-B9CA-4733C4EA26F4}] => (Allow) C:\Program Files (x86)\Mozilla Firefox\firefox.exe
FirewallRules: [{9B784469-AEA3-45A0-8AE8-822BB86DCED0}] => (Allow) C:\Program Files (x86)\Origin Games\The Sims 4 Create A Sim Demo\Game\Bin\TS4CAS.exe
FirewallRules: [{9C8F608C-3A20-45BB-9997-EEE77EABD408}] => (Allow) C:\Program Files (x86)\Origin Games\The Sims 4 Create A Sim Demo\Game\Bin\TS4CAS.exe
FirewallRules: [{1385213C-9D49-4096-9E8C-6019863EEFE6}] => (Allow) C:\WINDOWS\SysWOW64\msiexec.exe
FirewallRules: [{42B852F0-0D92-4DE1-9F17-9B24A65E34D4}] => (Allow) C:\WINDOWS\syThhbb.exe
FirewallRules: [{CE6D2B1D-D52D-49C2-BE76-8E79C0585F78}] => (Allow) C:\Users\kyron\dunis.exe
FirewallRules: [{6368C7CC-6B49-42F7-9E1D-6385652E602F}] => (Allow) C:\WINDOWS\SysWOW64\svchost.exe
FirewallRules: [{897D25D0-54E7-4726-B718-845ECB1182E4}] => (Allow) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
StandardProfile\AuthorizedApplications: [C:\Program Files (x86)\Spybot - Search & Destroy 2\SDTray.exe] => Enabled:Spybot - Search & Destroy tray access
StandardProfile\AuthorizedApplications: [C:\Program Files (x86)\Spybot - Search & Destroy 2\SDFSSvc.exe] => Enabled:Spybot-S&D 2 Scanner Service
StandardProfile\AuthorizedApplications: [C:\Program Files (x86)\Spybot - Search & Destroy 2\SDUpdate.exe] => Enabled:Spybot-S&D 2 Updater
StandardProfile\AuthorizedApplications: [C:\Program Files (x86)\Spybot - Search & Destroy 2\SDUpdSvc.exe] => Enabled:Spybot-S&D 2 Background update service
 
==================== Restore Points =========================
 
ATTENTION: System Restore is disabled
 
==================== Faulty Device Manager Devices =============
 
Name: Surface Dial Detection
Description: Surface Dial Detection
Class Guid: {4d36e97d-e325-11ce-bfc1-08002be10318}
Manufacturer: Surface
Service: WUDFRd
Problem: : This device is not working properly because Windows cannot load the drivers required for this device. (Code 31)
Resolution: Update the driver
 
Name: Realtek High Definition Audio(SST)
Description: Realtek High Definition Audio(SST)
Class Guid: {4d36e96c-e325-11ce-bfc1-08002be10318}
Manufacturer: Realtek
Service: IntcAzAudAddService
Problem: : This device is not working properly because Windows cannot load the drivers required for this device. (Code 31)
Resolution: Update the driver
 
Name: Surface Pen Pairing
Description: Surface Pen Pairing
Class Guid: {4d36e97d-e325-11ce-bfc1-08002be10318}
Manufacturer: Surface
Service: WUDFRd
Problem: : This device is not working properly because Windows cannot load the drivers required for this device. (Code 31)
Resolution: Update the driver
 
Name: Intel® Display Audio
Description: Intel® Display Audio
Class Guid: {4d36e96c-e325-11ce-bfc1-08002be10318}
Manufacturer: Intel® Corporation
Service: IntcDAud
Problem: : This device is not working properly because Windows cannot load the drivers required for this device. (Code 31)
Resolution: Update the driver
 
 
==================== Event log errors: =========================
 
Application errors:
==================
Error: (05/18/2018 03:09:44 PM) (Source: Application Error) (EventID: 1000) (User: )
Description: Faulting application name: svchost.exe, version: 10.0.17134.1, time stamp: 0x5acb9a85
Faulting module name: svchost.exe, version: 10.0.17134.1, time stamp: 0x5acb9a85
Exception code: 0xc0000005
Fault offset: 0x00125054
Faulting process ID: 0x19d4
Faulting application start time: 0x01d3ee666cf2a9e8
Faulting application path: C:\WINDOWS\SysWOW64\svchost.exe
Faulting module path: C:\WINDOWS\SysWOW64\svchost.exe
Report ID: 711c74f2-3566-4d4a-b4e2-f69687e80cf5
Faulting package full name: 
Faulting package-relative application ID:
 
Error: (05/18/2018 03:09:03 PM) (Source: Bonjour Service) (EventID: 100) (User: )
Description: Local Hostname KentuckySP.local already in use; will try KentuckySP-2.local instead
 
Error: (05/18/2018 03:09:03 PM) (Source: Bonjour Service) (EventID: 100) (User: )
Description: mDNSCoreReceiveResponse: ProbeCount 2; will deregister    4 KentuckySP.local. Addr 10.0.0.2
 
Error: (05/18/2018 03:09:03 PM) (Source: Bonjour Service) (EventID: 100) (User: )
Description: mDNSCoreReceiveResponse: Received from 10.0.0.2:5353   16 KentuckySP.local. AAAA 2001:8003:6402:B600:6551:06B6:D04C:75E8
 
Error: (05/18/2018 03:09:03 PM) (Source: Bonjour Service) (EventID: 100) (User: )
Description: mDNSCoreReceiveResponse: Resetting to Probing:   16 KentuckySP.local. AAAA FE80:0000:0000:0000:6551:06B6:D04C:75E8
 
Error: (05/18/2018 03:09:03 PM) (Source: Bonjour Service) (EventID: 100) (User: )
Description: mDNSCoreReceiveResponse: Received from 10.0.0.2:5353   16 KentuckySP.local. AAAA 2001:8003:6402:B600:6551:06B6:D04C:75E8
 
Error: (05/18/2018 03:09:03 PM) (Source: Bonjour Service) (EventID: 100) (User: )
Description: mDNSCoreReceiveResponse: Resetting to Probing:    4 KentuckySP.local. Addr 10.0.0.2
 
Error: (05/18/2018 03:09:03 PM) (Source: Bonjour Service) (EventID: 100) (User: )
Description: mDNSCoreReceiveResponse: Received from 10.0.0.2:5353   16 KentuckySP.local. AAAA 2001:8003:6402:B600:6551:06B6:D04C:75E8
 
 
System errors:
=============
Error: (05/18/2018 11:22:19 PM) (Source: DCOM) (EventID: 10005) (User: NT AUTHORITY)
Description: DCOM got error "1084" attempting to start the service EventSystem with arguments "Unavailable" in order to run the server:
{1BE1F766-5536-11D1-B726-00C04FB926AF}
 
Error: (05/18/2018 11:22:15 PM) (Source: DCOM) (EventID: 10005) (User: KENTUCKYSP)
Description: DCOM got error "1084" attempting to start the service ShellHWDetection with arguments "Unavailable" in order to run the server:
{DD522ACC-F821-461A-A407-50B198B896DC}
 
Error: (05/18/2018 11:22:10 PM) (Source: DCOM) (EventID: 10005) (User: KENTUCKYSP)
Description: DCOM got error "1084" attempting to start the service ShellHWDetection with arguments "Unavailable" in order to run the server:
{DD522ACC-F821-461A-A407-50B198B896DC}
 
Error: (05/18/2018 11:21:47 PM) (Source: DCOM) (EventID: 10005) (User: KENTUCKYSP)
Description: DCOM got error "1084" attempting to start the service ShellHWDetection with arguments "Unavailable" in order to run the server:
{DD522ACC-F821-461A-A407-50B198B896DC}
 
Error: (05/18/2018 11:21:33 PM) (Source: DCOM) (EventID: 10005) (User: KENTUCKYSP)
Description: DCOM got error "1084" attempting to start the service ShellHWDetection with arguments "Unavailable" in order to run the server:
{DD522ACC-F821-461A-A407-50B198B896DC}
 
Error: (05/18/2018 11:21:17 PM) (Source: DCOM) (EventID: 10005) (User: KENTUCKYSP)
Description: DCOM got error "1084" attempting to start the service ShellHWDetection with arguments "Unavailable" in order to run the server:
{DD522ACC-F821-461A-A407-50B198B896DC}
 
Error: (05/18/2018 11:21:12 PM) (Source: DCOM) (EventID: 10005) (User: KENTUCKYSP)
Description: DCOM got error "1084" attempting to start the service TokenBroker with arguments "Unavailable" in order to run the server:
Windows.Internal.Security.Authentication.Web.TokenBrokerInternal
 
Error: (05/18/2018 11:21:12 PM) (Source: DCOM) (EventID: 10005) (User: KENTUCKYSP)
Description: DCOM got error "1084" attempting to start the service TokenBroker with arguments "Unavailable" in order to run the server:
Windows.Internal.Security.Authentication.Web.WamProviderRegistration
 
 
CodeIntegrity:
===================================
 
Date: 2018-05-18 23:21:04.765
Description: 
Code Integrity determined that a process (\Device\HarddiskVolume3\Windows\System32\wininit.exe) attempted to load \Device\HarddiskVolume3\Windows\System32\Runic_AS.dll that did not meet the Windows signing level requirements.
 
Date: 2018-05-18 23:17:48.183
Description: 
Code Integrity determined that a process (\Device\HarddiskVolume3\Windows\System32\wininit.exe) attempted to load \Device\HarddiskVolume3\Windows\System32\Runic_AS.dll that did not meet the Windows signing level requirements.
 
Date: 2018-05-18 17:55:07.090
Description: 
Code Integrity determined that a process (\Device\HarddiskVolume3\Windows\System32\wininit.exe) attempted to load \Device\HarddiskVolume3\Windows\System32\Runic_AS.dll that did not meet the Windows signing level requirements.
 
Date: 2018-05-18 17:02:20.833
Description: 
Code Integrity determined that a process (\Device\HarddiskVolume3\Windows\System32\wininit.exe) attempted to load \Device\HarddiskVolume3\Windows\System32\Runic_AS.dll that did not meet the Windows signing level requirements.
 
Date: 2018-05-18 16:59:03.086
Description: 
Code Integrity determined that a process (\Device\HarddiskVolume3\Windows\System32\wininit.exe) attempted to load \Device\HarddiskVolume3\Windows\System32\Runic_AS.dll that did not meet the Windows signing level requirements.
 
Date: 2018-05-18 16:48:10.579
Description: 
Code Integrity determined that a process (\Device\HarddiskVolume3\Windows\System32\wininit.exe) attempted to load \Device\HarddiskVolume3\Windows\System32\Runic_AS.dll that did not meet the Windows signing level requirements.
 
Date: 2018-05-18 16:13:37.084
Description: 
Code Integrity determined that a process (\Device\HarddiskVolume3\Windows\System32\wininit.exe) attempted to load \Device\HarddiskVolume3\Windows\System32\Runic_AS.dll that did not meet the Windows signing level requirements.
 
Date: 2018-05-18 15:44:23.891
Description: 
Code Integrity determined that a process (\Device\HarddiskVolume3\Windows\System32\wininit.exe) attempted to load \Device\HarddiskVolume3\Windows\System32\Runic_AS.dll that did not meet the Windows signing level requirements.
 
==================== Memory info =========================== 
 
Processor: Intel® Core™ i5-6300U CPU @ 2.40GHz
Percentage of memory in use: 47%
Total physical RAM: 4021.09 MB
Available physical RAM: 2121.47 MB
Total Virtual: 5429.09 MB
Available Virtual: 3767.39 MB
 
==================== Drives ================================
 
Drive c: (Windows) (Fixed) (Total:116.33 GB) (Free:22.09 GB) NTFS
 
\\?\Volume{d334f3a2-1777-4bc4-b9a0-3aeea5c09034}\ (Windows RE tools) (Fixed) (Total:2.53 GB) (Free:2.11 GB) NTFS
\\?\Volume{fcb82dce-a93e-4ebd-b2af-39b8960b4043}\ (SYSTEM) (Fixed) (Total:0.25 GB) (Free:0.22 GB) FAT32
 
==================== MBR & Partition Table ==================
 
========================================================
Disk: 0 (Size: 119.2 GB) (Disk ID: 831050BB)
 
Partition: GPT.
 
==================== End of Addition.txt ============================

 



BC AdBot (Login to Remove)

 


#2 nasdaq

nasdaq

  • Malware Response Team
  • 40,171 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:Montreal, QC. Canada
  • Local time:06:18 PM

Posted 19 May 2018 - 07:39 AM

Hello, Welcome to BleepingComputer.
I'm nasdaq and will be helping you.

If you can please print this topic it will make it easier for you to follow the instructions and complete all of the necessary steps in the order listed.
===

ATTENTION: System Restore is disabled
Turn System Restore On for Drives in Windows 10
http://www.tenforums.com/tutorials/4533-system-protection-turn-off-drives-windows-10-a.html
===

Press the Windows key + r on your keyboard at the same time. This will open the RUN BOX.
Type Notepad and and click the OK key.
Please copy the entire contents of the code box below to the a new file.
 
start

CreateRestorePoint:
EmptyTemp:
CloseProcesses:

HKLM Group Policy restriction on software: %systemroot%\system32\mrt.exe <==== ATTENTION
Winlogon\Notify\SDWinLogon-x32: SDWinLogon.dll [X]
GroupPolicy: Restriction ? <==== ATTENTION
CHR Profile: C:\Users\kyron\AppData\Local\Google\Chrome\User Data\ChromeDefaultData [2017-11-30] <==== ATTENTION
CHR HKLM-x32\...\Chrome\Extension: [eofcbnmajmjmplflapaojjnihcjkigck] - hxxps://clients2.google.com/service/update2/crx
S2 igfxCUIService2.0.0.0; C:\WINDOWS\system32\igfxCUIService.exe [X]
S2 PaceLicenseDServices; "C:\Program Files (x86)\Common Files\PACE\Services\LicenseServices\LDSvc.exe" -u https://activation.paceap.com/InitiateActivation [X] <==== ATTENTION

ContextMenuHandlers5: [igfxcui] -> {3AB1675A-CCFF-11D2-8B20-00A0C93CB1F4} =>  -> No File
ContextMenuHandlers5: [igfxDTCM] -> {9B5F5829-A529-4B12-814A-E81BCB8D93FC} => C:\WINDOWS\system32\igfxDTCM.dll -> No File
Task: {38154817-EBA9-4891-92A8-0CF33A2C1D18} - System32\Tasks\{AB14743F-D9FE-687A-6964-FF7296FEEA1B} => C:\WINDOWS\syThhbb.exe [2018-04-12] (Microsoft Corporation)
Task: {445D667B-3EE7-4E99-96C8-B48FF2E45962} - System32\Tasks\{813DD28E-3776-67DA-B3B1-FC471BF531A4} => C:\Users\kyron\dunis.exe [2018-04-12] (Microsoft Corporation)
AlternateDataStreams: C:\ProgramData\PACE:F66A6B7D73A7F51B [217]

C:\Windows\System32\Tasks\{AB14743F-D9FE-687A-6964-FF7296FEEA1B}
C:\WINDOWS\syThhbb.exe
C:\Windows\System32\Tasks\{813DD28E-3776-67DA-B3B1-FC471BF531A4}
C:\Users\kyron\dunis.exe [2018-04-12] (Microsoft Corporation)
2018-05-18 14:57 - 2018-05-18 14:57 - 000152576 _____ () C:\Users\kyron\AppData\Local\Temp\ext1704056874732403768.dll
2018-05-18 15:09 - 2018-05-18 15:09 - 000152576 _____ () C:\Users\kyron\AppData\Local\Temp\ext1765788104522864324.dll
2018-05-18 16:14 - 2018-05-18 16:14 - 000152576 _____ () C:\Users\kyron\AppData\Local\Temp\ext1785844503528990320.dll
2018-05-16 22:25 - 2018-05-16 22:25 - 000152576 _____ () C:\Users\kyron\AppData\Local\Temp\ext1795023675138647525.dll
2018-05-16 05:01 - 2018-05-16 05:01 - 000152576 _____ () C:\Users\kyron\AppData\Local\Temp\ext1943591586089203202.dll
2018-05-17 17:25 - 2018-05-17 17:25 - 000152576 _____ () C:\Users\kyron\AppData\Local\Temp\ext2045936555931394932.dll
2018-05-18 16:49 - 2018-05-18 16:49 - 000152576 _____ () C:\Users\kyron\AppData\Local\Temp\ext3612158717587240336.dll
2018-05-18 21:28 - 2018-05-18 21:28 - 000152576 _____ () C:\Users\kyron\AppData\Local\Temp\ext5187520356305387603.dll
2018-05-18 14:23 - 2018-05-18 14:23 - 000152576 _____ () C:\Users\kyron\AppData\Local\Temp\ext5813216771868755203.dll
2018-05-18 17:56 - 2018-05-18 17:56 - 000152576 _____ () C:\Users\kyron\AppData\Local\Temp\ext6552143995738411169.dll
2018-05-18 23:19 - 2018-05-18 23:19 - 000152576 _____ () C:\Users\kyron\AppData\Local\Temp\ext6890042405943896683.dll
2018-05-18 12:44 - 2018-05-18 12:44 - 000152576 _____ () C:\Users\kyron\AppData\Local\Temp\ext7757269608825605427.dll
2018-05-18 16:59 - 2018-05-18 16:59 - 000152576 _____ () C:\Users\kyron\AppData\Local\Temp\ext8020217407568829957.dll
2018-05-17 17:26 - 2018-05-17 17:26 - 000152576 _____ () C:\Users\kyron\AppData\Local\Temp\ext8637228978114558877.dll
2018-05-18 14:15 - 2018-05-18 14:15 - 000152576 _____ () C:\Users\kyron\AppData\Local\Temp\ext8979269938725116158.dll

End
Save the file as fixlist.txt in the same folder where the Farbar tool is running from.
The location is listed in the 3rd line of the Farbar log you have submitted.

Run FRST and click Fix only once and wait.

The tool will create a log (Fixlog.txt) please post it to your reply.
===

Reset Chrome...
Open Google Chrome, click on menu icon google-chrome-setting-icon.png or the 3 vertical dots located right side top of the google chrome.
 
Click "Settings" then "Show advanced settings" at the bottom of the screen.
 
Click "Reset browser settings" button.
 
Restart Chrome.
<<<>>>

Please post the log and let me kown of any remaining issues?

#3 Pqiera

Pqiera
  • Topic Starter

  • Members
  • 2 posts
  • OFFLINE
  •  
  • Local time:08:18 AM

Posted 19 May 2018 - 09:10 AM

Everything seems to be fixed so far. Thank you so much! Here's the log:
 

Fix result of Farbar Recovery Scan Tool (x64) Version: 16.05.2018 01
Ran by kyron (20-05-2018 00:07:01) Run:1
Running from C:\Users\kyron\Desktop
Loaded Profiles: kyron (Available Profiles: kyron)
Boot Mode: Safe Mode (minimal)
==============================================
 
fixlist content:
*****************
start
 
CreateRestorePoint:
EmptyTemp:
CloseProcesses:
 
HKLM Group Policy restriction on software: %systemroot%\system32\mrt.exe <==== ATTENTION
Winlogon\Notify\SDWinLogon-x32: SDWinLogon.dll [X]
GroupPolicy: Restriction ? <==== ATTENTION
CHR Profile: C:\Users\kyron\AppData\Local\Google\Chrome\User Data\ChromeDefaultData [2017-11-30] <==== ATTENTION
CHR HKLM-x32\...\Chrome\Extension: [eofcbnmajmjmplflapaojjnihcjkigck] - hxxps://clients2.google.com/service/update2/crx
S2 igfxCUIService2.0.0.0; C:\WINDOWS\system32\igfxCUIService.exe [X]
S2 PaceLicenseDServices; "C:\Program Files (x86)\Common Files\PACE\Services\LicenseServices\LDSvc.exe" -u https://activation.paceap.com/InitiateActivation [X] <==== ATTENTION
 
ContextMenuHandlers5: [igfxcui] -> {3AB1675A-CCFF-11D2-8B20-00A0C93CB1F4} =>  -> No File
ContextMenuHandlers5: [igfxDTCM] -> {9B5F5829-A529-4B12-814A-E81BCB8D93FC} => C:\WINDOWS\system32\igfxDTCM.dll -> No File
Task: {38154817-EBA9-4891-92A8-0CF33A2C1D18} - System32\Tasks\{AB14743F-D9FE-687A-6964-FF7296FEEA1B} => C:\WINDOWS\syThhbb.exe [2018-04-12] (Microsoft Corporation)
Task: {445D667B-3EE7-4E99-96C8-B48FF2E45962} - System32\Tasks\{813DD28E-3776-67DA-B3B1-FC471BF531A4} => C:\Users\kyron\dunis.exe [2018-04-12] (Microsoft Corporation)
AlternateDataStreams: C:\ProgramData\PACE:F66A6B7D73A7F51B [217]
 
C:\Windows\System32\Tasks\{AB14743F-D9FE-687A-6964-FF7296FEEA1B}
C:\WINDOWS\syThhbb.exe
C:\Windows\System32\Tasks\{813DD28E-3776-67DA-B3B1-FC471BF531A4}
C:\Users\kyron\dunis.exe [2018-04-12] (Microsoft Corporation)
2018-05-18 14:57 - 2018-05-18 14:57 - 000152576 _____ () C:\Users\kyron\AppData\Local\Temp\ext1704056874732403768.dll
2018-05-18 15:09 - 2018-05-18 15:09 - 000152576 _____ () C:\Users\kyron\AppData\Local\Temp\ext1765788104522864324.dll
2018-05-18 16:14 - 2018-05-18 16:14 - 000152576 _____ () C:\Users\kyron\AppData\Local\Temp\ext1785844503528990320.dll
2018-05-16 22:25 - 2018-05-16 22:25 - 000152576 _____ () C:\Users\kyron\AppData\Local\Temp\ext1795023675138647525.dll
2018-05-16 05:01 - 2018-05-16 05:01 - 000152576 _____ () C:\Users\kyron\AppData\Local\Temp\ext1943591586089203202.dll
2018-05-17 17:25 - 2018-05-17 17:25 - 000152576 _____ () C:\Users\kyron\AppData\Local\Temp\ext2045936555931394932.dll
2018-05-18 16:49 - 2018-05-18 16:49 - 000152576 _____ () C:\Users\kyron\AppData\Local\Temp\ext3612158717587240336.dll
2018-05-18 21:28 - 2018-05-18 21:28 - 000152576 _____ () C:\Users\kyron\AppData\Local\Temp\ext5187520356305387603.dll
2018-05-18 14:23 - 2018-05-18 14:23 - 000152576 _____ () C:\Users\kyron\AppData\Local\Temp\ext5813216771868755203.dll
2018-05-18 17:56 - 2018-05-18 17:56 - 000152576 _____ () C:\Users\kyron\AppData\Local\Temp\ext6552143995738411169.dll
2018-05-18 23:19 - 2018-05-18 23:19 - 000152576 _____ () C:\Users\kyron\AppData\Local\Temp\ext6890042405943896683.dll
2018-05-18 12:44 - 2018-05-18 12:44 - 000152576 _____ () C:\Users\kyron\AppData\Local\Temp\ext7757269608825605427.dll
2018-05-18 16:59 - 2018-05-18 16:59 - 000152576 _____ () C:\Users\kyron\AppData\Local\Temp\ext8020217407568829957.dll
2018-05-17 17:26 - 2018-05-17 17:26 - 000152576 _____ () C:\Users\kyron\AppData\Local\Temp\ext8637228978114558877.dll
2018-05-18 14:15 - 2018-05-18 14:15 - 000152576 _____ () C:\Users\kyron\AppData\Local\Temp\ext8979269938725116158.dll
 
End
*****************
 
Error: Restore point can only be created in normal mode.
Processes closed successfully.
HKLM Group Policy restriction on software: %systemroot%\system32\mrt.exe <==== ATTENTION => restored successfully
"HKLM\Software\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\SDWinLogon" => removed successfully
C:\WINDOWS\system32\GroupPolicy\Machine => moved successfully
C:\WINDOWS\system32\GroupPolicy\GPT.ini => moved successfully
C:\Users\kyron\AppData\Local\Google\Chrome\User Data\ChromeDefaultData => moved successfully
"HKLM\SOFTWARE\Wow6432Node\Google\Chrome\Extensions\eofcbnmajmjmplflapaojjnihcjkigck" => removed successfully
"HKLM\System\CurrentControlSet\Services\igfxCUIService2.0.0.0" => removed successfully
igfxCUIService2.0.0.0 => service removed successfully
"HKLM\System\CurrentControlSet\Services\PaceLicenseDServices" => removed successfully
PaceLicenseDServices => service removed successfully
"HKLM\Software\Classes\Directory\Background\ShellEx\ContextMenuHandlers\igfxcui" => removed successfully
HKLM\Software\Classes\CLSID\{3AB1675A-CCFF-11D2-8B20-00A0C93CB1F4} => not found
"HKLM\Software\Classes\Directory\Background\ShellEx\ContextMenuHandlers\igfxDTCM" => removed successfully
"HKLM\Software\Classes\CLSID\{9B5F5829-A529-4B12-814A-E81BCB8D93FC}" => removed successfully
"HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Plain\{38154817-EBA9-4891-92A8-0CF33A2C1D18}" => removed successfully
"HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\{38154817-EBA9-4891-92A8-0CF33A2C1D18}" => removed successfully
C:\WINDOWS\System32\Tasks\{AB14743F-D9FE-687A-6964-FF7296FEEA1B} => moved successfully
"HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tree\{AB14743F-D9FE-687A-6964-FF7296FEEA1B}" => removed successfully
"HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Logon\{445D667B-3EE7-4E99-96C8-B48FF2E45962}" => removed successfully
"HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\{445D667B-3EE7-4E99-96C8-B48FF2E45962}" => removed successfully
C:\WINDOWS\System32\Tasks\{813DD28E-3776-67DA-B3B1-FC471BF531A4} => moved successfully
"HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tree\{813DD28E-3776-67DA-B3B1-FC471BF531A4}" => removed successfully
C:\ProgramData\PACE => ":F66A6B7D73A7F51B" ADS removed successfully
"C:\Windows\System32\Tasks\{AB14743F-D9FE-687A-6964-FF7296FEEA1B}" => not found
C:\WINDOWS\syThhbb.exe => moved successfully
"C:\Windows\System32\Tasks\{813DD28E-3776-67DA-B3B1-FC471BF531A4}" => not found
"C:\Users\kyron\dunis.exe [2018-04-12] (Microsoft Corporation)" => not found
C:\Users\kyron\AppData\Local\Temp\ext1704056874732403768.dll => moved successfully
C:\Users\kyron\AppData\Local\Temp\ext1765788104522864324.dll => moved successfully
C:\Users\kyron\AppData\Local\Temp\ext1785844503528990320.dll => moved successfully
C:\Users\kyron\AppData\Local\Temp\ext1795023675138647525.dll => moved successfully
C:\Users\kyron\AppData\Local\Temp\ext1943591586089203202.dll => moved successfully
C:\Users\kyron\AppData\Local\Temp\ext2045936555931394932.dll => moved successfully
C:\Users\kyron\AppData\Local\Temp\ext3612158717587240336.dll => moved successfully
C:\Users\kyron\AppData\Local\Temp\ext5187520356305387603.dll => moved successfully
C:\Users\kyron\AppData\Local\Temp\ext5813216771868755203.dll => moved successfully
C:\Users\kyron\AppData\Local\Temp\ext6552143995738411169.dll => moved successfully
C:\Users\kyron\AppData\Local\Temp\ext6890042405943896683.dll => moved successfully
C:\Users\kyron\AppData\Local\Temp\ext7757269608825605427.dll => moved successfully
C:\Users\kyron\AppData\Local\Temp\ext8020217407568829957.dll => moved successfully
C:\Users\kyron\AppData\Local\Temp\ext8637228978114558877.dll => moved successfully
C:\Users\kyron\AppData\Local\Temp\ext8979269938725116158.dll => moved successfully
 
=========== EmptyTemp: ==========
 
BITS transfer queue => 7888896 B
DOMStore, IE Recovery, AppCache, Feeds Cache, Thumbcache, IconCache => 14928610 B
Java, Flash, Steam htmlcache => 0 B
Windows/system/drivers => 680555 B
Edge => 1328280 B
Chrome => 662411076 B
Firefox => 253483521 B
Opera => 0 B
 
Temp, IE cache, history, cookies, recent:
Default => 0 B
Users => 0 B
ProgramData => 0 B
Public => 0 B
systemprofile => 0 B
systemprofile32 => 0 B
LocalService => 11838 B
LocalService => 0 B
NetworkService => 638 B
NetworkService => 0 B
kyron => 70628704 B
 
RecycleBin => 2617426063 B
EmptyTemp: => 3.4 GB temporary data Removed.
 
================================
 
 
The system needed a reboot.
 
==== End of Fixlog 00:07:16 ====


#4 nasdaq

nasdaq

  • Malware Response Team
  • 40,171 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:Montreal, QC. Canada
  • Local time:06:18 PM

Posted 20 May 2018 - 06:42 AM

Hi,

If all is well.

To learn more about how to protect yourself while on the internet read this little guide best security practices keep safe.
http://www.bleepingcomputer.com/forums/t/407147/answers-to-common-security-questions-best-practices/


https://www.bleepingcomputer.com/tutorials/keep-your-computer-safe-online/
Simple and easy ways to keep your computer safe and secure on the Internet.
===




0 user(s) are reading this topic

0 members, 0 guests, 0 anonymous users