Jump to content


 


Register a free account to unlock additional features at BleepingComputer.com
Welcome to BleepingComputer, a free community where people like yourself come together to discuss and learn how to use their computers. Using the site is easy and fun. As a guest, you can browse and view the various discussions in the forums, but can not create a new topic or reply to an existing one unless you are logged in. Other benefits of registering an account are subscribing to topics and forums, creating a blog, and having no ads shown anywhere on the site.


Click here to Register a free account now! or read our Welcome Guide to learn how to use this site.

Photo

Random cmd on boot and random loading circle near cursor frequently


  • Please log in to reply
14 replies to this topic

#1 broman400

broman400

  • Members
  • 40 posts
  • OFFLINE
  •  
  • Gender:Male
  • Local time:09:42 AM

Posted 09 October 2018 - 11:49 PM

Hello, everytime I boot up my pc I have a random command prompt window pop up for a few seconds and disapear. Also, theres a loading circle near my cursor frequently and randomly. Even though I am not doing anything or loading anything. Also not sure if this is an issue, my cursor jumps sometimes. If I move it it jumps away a little. Thank you!



BC AdBot (Login to Remove)

 


#2 Oh My!

Oh My!

    Adware and Spyware and Malware.....


  • Malware Response Instructor
  • 37,724 posts
  • ONLINE
  •  
  • Gender:Male
  • Location:California
  • Local time:06:42 AM

Posted 10 October 2018 - 01:05 PM

Greetings broman400 and :welcome: to BleepingComputer's Virus/Trojan/Spyware/Malware Removal forum.

My name is Oh My! and I am here to help you! Now that we are "friends" please call me Gary.

If you would allow me to call you by your first name I would prefer to do that.

===================================================

Ground Rules:
  • First, please keep in mind most of us at BleepingComputer volunteer our assistance for your benefit in your time of need. Please try to match our commitment to you with your patience toward us.
  • It is important to not run any tools or take any steps other than those I will provide for you.
  • Please perform all steps in the order they are listed. If things are not clear or you experience problems be sure to stop and let me know.
  • Please copy and paste all logs into your post unless otherwise requested.
  • When your computer is clean I will let you know, provide instructions to remove tools and reports, and offer you information about how you can combat future infections.
  • If you do not reply to your topic after 5 days I will assume it has been abandoned and I will close it.
===================================================

Now that I am assisting you, you can expect that I will be very responsive to your situation. If you are able, I would request you check this thread at least once per day so that we can try to resolve your issues effectively and efficiently. If you are going to be delayed please be considerate and let me know.

Thank you for your patience thus far.

Please do this. If necessary, download the below program onto a USB device from a clean computer and transfer it over to the infected computer.

===================================================

Farbar Recovery Scan Tool (FRST)

--------------------
  • Download Farbar Recover Scan Tool for either 32 bit or 64 bit systems and save it to your Desktop. <<< Important
  • Right click on the icon and select Run as administrator
  • Click Yes to the disclaimer
  • Click Scan and allow the program to run
  • Click OK on the Scan complete screen, then OK on the Addition.txt pop up screen
  • 2 Notepad documents should now be open on your desktop.
  • Please copy and paste the contents of each report in separate reply windows
===================================================

Things I would like to see in your next reply. Please be sure to copy and paste any requested log information unless you are asked to attach it. :thumbsup2:
  • FRST results
  • Addition log

Gary
 
If I do not reply within 24 hours please send me a Personal Message.

"Lord, to whom would we go? You have the words that give eternal life. We believe, and we know you are the Holy One of God."

#3 broman400

broman400
  • Topic Starter

  • Members
  • 40 posts
  • OFFLINE
  •  
  • Gender:Male
  • Local time:09:42 AM

Posted 10 October 2018 - 06:40 PM

Hello, thank you for helping me out. Here are the results and an error I received as well. I ran the program in safe mode with networking because it would not run in regular mode.

 

Scan result of Farbar Recovery Scan Tool (FRST) (x64) Version: 10.10.2018
Ran by Brian (administrator) on BRIAN-PC (10-10-2018 19:38:06)
Running from C:\Users\broma_000\Desktop
Loaded Profiles: Brian (Available Profiles: Brian & User)
Platform: Windows 10 Home Version 1803 17134.345 (X64) Language: English (United States)
Internet Explorer Version 11 (Default browser: Edge)
Boot Mode: Safe Mode (with Networking)
 
==================== Processes (Whitelisted) =================
 
(If an entry is included in the fixlist, the process will be closed. The file will not be moved.)
 
(Microsoft Corporation) C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.1809.2-0\MsMpEng.exe
(Microsoft Corporation) C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdge.exe
(Microsoft Corporation) C:\Windows\System32\browser_broker.exe
(Microsoft Corporation) C:\Windows\System32\dllhost.exe
(Microsoft Corporation) C:\Windows\System32\dllhost.exe
(Microsoft Corporation) C:\Windows\HelpPane.exe
(Microsoft Corporation) C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
(Microsoft Corporation) C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
(Microsoft Corporation) C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
(Microsoft Corporation) C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google) C:\Users\broma_000\AppData\Local\Google\Chrome\User Data\SwReporter\34.174.200\software_reporter_tool.exe
(Google) C:\Users\broma_000\AppData\Local\Google\Chrome\User Data\SwReporter\34.174.200\software_reporter_tool.exe
(Google) C:\Users\broma_000\AppData\Local\Google\Chrome\User Data\SwReporter\34.174.200\software_reporter_tool.exe
(Microsoft Corporation) C:\Windows\System32\rundll32.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Farbar) C:\Users\broma_000\Desktop\FRST64 (1).exe
 
==================== Registry (Whitelisted) ===========================
 
(If an entry is included in the fixlist, the registry item will be restored to default or removed. The file will not be moved.)
 
HKLM\...\Run: [SecurityHealth] => C:\Program Files\Windows Defender\MSASCuiL.exe [638872 2018-04-11] (Microsoft Corporation)
HKLM\...\Run: [IAStorIcon] => C:\Program Files\Intel\Intel® Rapid Storage Technology\IAStorIcon.exe [287592 2013-08-22] (Intel Corporation)
HKLM\...\Run: [AdobeGCInvoker-1.0] => C:\Program Files (x86)\Common Files\Adobe\AdobeGCClient\AGCInvokerUtility.exe [2670056 2018-09-10] (Adobe Systems, Incorporated)
HKLM\...\Run: [AdobeAAMUpdater-1.0] => C:\Program Files (x86)\Common Files\Adobe\OOBE\PDApp\UWA\UpdaterStartupUtility.exe [509936 2018-04-11] (Adobe Systems Incorporated)
HKLM\...\Run: [SysTrayApp] => C:\Program Files\IDT\WDM\sttray64.exe [1703424 2013-08-16] (IDT, Inc.)
HKLM\...\Run: [Fences] => C:\Program Files (x86)\Stardock\Fences\Fences.exe [4854200 2018-05-25] (Stardock Corporation)
HKLM\...\Run: [iTunesHelper] => C:\Program Files\iTunes\iTunesHelper.exe [298296 2018-07-06] (Apple Inc.)
HKLM\...\Run: [SynTPEnh] => C:\Program Files\Synaptics\SynTP\SynTPEnh.exe [3954352 2016-04-28] (Synaptics Incorporated)
HKLM-x32\...\Run: [Adobe Creative Cloud] => C:\Program Files (x86)\Adobe\Adobe Creative Cloud\ACC\Creative Cloud.exe [2409936 2018-02-14] (Adobe Systems Incorporated)
HKLM-x32\...\Run: [SunJavaUpdateSched] => C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe [588704 2018-03-28] (Oracle Corporation)
HKLM\...\Policies\Explorer: [NoRecentDocsNetHood] 0
HKLM\...\Policies\Explorer: [NoChangeStartMenu] 0
HKLM\SOFTWARE\Policies\Microsoft\Windows Defender: Restriction <==== ATTENTION
HKU\S-1-5-19\...\RunOnce: [WAB Migrate] => C:\Program Files\Windows Mail\wab.exe [518144 2018-04-11] (Microsoft Corporation)
HKU\S-1-5-20\...\RunOnce: [WAB Migrate] => C:\Program Files\Windows Mail\wab.exe [518144 2018-04-11] (Microsoft Corporation)
HKU\S-1-5-21-4254226789-487654737-2996639702-1001\...\Run: [Google Update] => C:\Users\broma_000\AppData\Local\Google\Update\1.3.33.17\GoogleUpdateCore.exe [601680 2018-05-16] (Google Inc.)
HKU\S-1-5-21-4254226789-487654737-2996639702-1001\...\Run: [Fences] => c:\program files (x86)\stardock\fences\Fences.exe [4854200 2018-05-25] (Stardock Corporation)
HKU\S-1-5-21-4254226789-487654737-2996639702-1001\...\Run: [CCleaner Monitoring] => C:\Program Files\CCleaner\CCleaner64.exe [18630056 2018-10-06] (Piriform Ltd)
HKU\S-1-5-21-4254226789-487654737-2996639702-1001\...\Run: [Spotify Web Helper] => C:\Users\broma_000\AppData\Roaming\Spotify\SpotifyWebHelper.exe [1449584 2017-05-15] (Spotify Ltd)
HKU\S-1-5-21-4254226789-487654737-2996639702-1001\...\Run: [GlassWire] => C:\Program Files (x86)\GlassWire\glasswire.exe [5453776 2018-06-22] (SecureMix LLC)
HKU\S-1-5-21-4254226789-487654737-2996639702-1001\...\Policies\system: [NoDispAppearancePage] 0
HKU\S-1-5-21-4254226789-487654737-2996639702-1001\...\Policies\Explorer: [NoPreviewPane] 0
HKU\S-1-5-21-4254226789-487654737-2996639702-1001\...\Policies\Explorer: [NoTrayContextMenu] 0
HKU\S-1-5-21-4254226789-487654737-2996639702-1001\...\Policies\Explorer: [NoSetTaskbar] 0
HKU\S-1-5-21-4254226789-487654737-2996639702-1001\...\Policies\Explorer: [NoViewContextMenu] 0
HKU\S-1-5-21-4254226789-487654737-2996639702-1001\...\Policies\Explorer: [NoWinkeys] 0
HKU\S-1-5-21-4254226789-487654737-2996639702-1001\...\Policies\Explorer: [NoTrayItemsDisplay] 0
HKU\S-1-5-21-4254226789-487654737-2996639702-1001\...\Policies\Explorer: [HideClock] 0
HKU\S-1-5-21-4254226789-487654737-2996639702-1001\...\Policies\Explorer: [HideSCANetwork] 0
HKU\S-1-5-21-4254226789-487654737-2996639702-1001\...\Policies\Explorer: [HideSCAVolume] 0
SSODL: EldosMountNotificator - {5FF49FE8-B332-4CB9-B102-FB6951629E55} - C:\WINDOWS\system32\CbFsMntNtf3.dll (EldoS Corporation)
SSODL-x32: EldosMountNotificator - {5FF49FE8-B332-4CB9-B102-FB6951629E55} - C:\WINDOWS\SysWow64\CbFsMntNtf3.dll (EldoS Corporation)
Startup: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\Cylance Desktop.lnk [2018-09-25]
ShortcutTarget: Cylance Desktop.lnk -> C:\Program Files\Cylance\Desktop\CylanceUI.exe (Cylance, Inc.)
Startup: C:\Users\Default\Start Menu\Programs\Startup\SynRemoveUserSettings.bat [2018-02-23] ()
Startup: C:\Users\Default User\Start Menu\Programs\Startup\SynRemoveUserSettings.bat [2018-02-23] ()
Startup: C:\Users\User\Start Menu\Programs\Startup\SynRemoveUserSettings.bat [2018-02-23] ()
 
==================== Internet (Whitelisted) ====================
 
(If an item is included in the fixlist, if it is a registry item it will be removed or restored to default.)
 
Hosts: There are more than one entry in Hosts. See Hosts section of Addition.txt
Tcpip\Parameters: [DhcpNameServer] 192.168.1.1
Tcpip\..\Interfaces\{57dfc737-03c8-417b-92a8-ca76f962e126}: [DhcpNameServer] 192.168.1.1
Tcpip\..\Interfaces\{bca978ae-d8b2-4551-a675-cc65ec006d5f}: [DhcpNameServer] 192.168.1.1
Tcpip\..\Interfaces\{f50e203f-dd9a-499f-8f59-8fd871ec2d11}: [DhcpNameServer] 103.86.99.99 103.86.96.96 103.86.96.100 103.86.99.100
 
Internet Explorer:
==================
HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = about:blank
SearchScopes: HKU\.DEFAULT -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = 
SearchScopes: HKU\S-1-5-21-4254226789-487654737-2996639702-1001 -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = hxxps://www.bing.com/search?q={searchTerms}&src=IE-SearchBox&FORM=IESR02&pc=UE00
SearchScopes: HKU\S-1-5-21-4254226789-487654737-2996639702-1001 -> {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = hxxps://www.bing.com/search?q={searchTerms}&src=IE-SearchBox&FORM=IESR02&pc=UE00
BHO: Skype for Business Browser Helper -> {31D09BA0-12F5-4CCE-BE8A-2923E76605DA} -> C:\Program Files\Microsoft Office\Office16\OCHelper.dll [2018-04-11] (Microsoft Corporation)
BHO: Microsoft OneDrive for Business Browser Helper -> {D0498E0A-45B7-42AE-A9AA-ABA463DBD3BF} -> C:\Program Files\Microsoft Office\Office16\GROOVEEX.DLL [2018-07-20] (Microsoft Corporation)
BHO-x32: Skype for Business Browser Helper -> {31D09BA0-12F5-4CCE-BE8A-2923E76605DA} -> C:\Program Files (x86)\Microsoft Office\Office16\OCHelper.dll [2018-04-11] (Microsoft Corporation)
BHO-x32: Java™ Plug-In SSV Helper -> {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} -> C:\Program Files (x86)\Java\jre1.8.0_171\bin\ssv.dll [2018-06-23] (Oracle Corporation)
BHO-x32: Microsoft OneDrive for Business Browser Helper -> {D0498E0A-45B7-42AE-A9AA-ABA463DBD3BF} -> C:\Program Files (x86)\Microsoft Office\Office16\GROOVEEX.DLL [2018-07-22] (Microsoft Corporation)
BHO-x32: Java™ Plug-In 2 SSV Helper -> {DBC80044-A445-435b-BC74-9C25C1C588A9} -> C:\Program Files (x86)\Java\jre1.8.0_171\bin\jp2ssv.dll [2018-06-23] (Oracle Corporation)
Toolbar: HKU\S-1-5-21-4254226789-487654737-2996639702-1001 -> No Name - {47833539-D0C5-4125-9FA8-0819E2EAAC93} -  No File
Handler: mso-minsb.16 - {3459B272-CC19-4448-86C9-DDC3B4B2FAD3} - C:\Program Files\Microsoft Office\Office16\MSOSB.DLL [2018-02-14] (Microsoft Corporation)
Handler-x32: mso-minsb.16 - {3459B272-CC19-4448-86C9-DDC3B4B2FAD3} - C:\Program Files (x86)\Microsoft Office\Office16\MSOSB.DLL [2018-04-10] (Microsoft Corporation)
Handler: osf.16 - {5504BE45-A83B-4808-900A-3A5C36E7F77A} - C:\Program Files\Microsoft Office\Office16\MSOSB.DLL [2018-02-14] (Microsoft Corporation)
Handler-x32: osf.16 - {5504BE45-A83B-4808-900A-3A5C36E7F77A} - C:\Program Files (x86)\Microsoft Office\Office16\MSOSB.DLL [2018-04-10] (Microsoft Corporation)
 
Edge: 
======
Edge Extension: (uBlock Origin) -> EdgeExtension_37833NikRollsuBlockOrigin_f8jsg5mm64m62 => C:\Program Files\WindowsApps\37833NikRolls.uBlockOrigin_1.15.24.0_neutral__f8jsg5mm64m62 [2018-06-30]
Edge Extension: (AdGuard AdBlocker) -> EdgeExtension_AdguardAdguardAdBlocker_m055xr0c82818 => C:\Program Files\WindowsApps\Adguard.AdguardAdBlocker_2.10.8.0_neutral__m055xr0c82818 [2018-09-26]
 
FireFox:
========
FF DefaultProfile: arx9uih2.default-1494196778229
FF ProfilePath: C:\Users\broma_000\AppData\Roaming\Mozilla\Firefox\Profiles\arx9uih2.default-1494196778229 [2018-09-29]
FF Session Restore: Mozilla\Firefox\Profiles\arx9uih2.default-1494196778229 -> is enabled.
FF Extension: (AdGuard AdBlocker) - C:\Users\broma_000\AppData\Roaming\Mozilla\Firefox\Profiles\arx9uih2.default-1494196778229\Extensions\adguardadblocker@adguard.com.xpi [2018-04-10]
FF Extension: (Session Sync) - C:\Users\broma_000\AppData\Roaming\Mozilla\Firefox\Profiles\arx9uih2.default-1494196778229\Extensions\session-sync@gabrielivanica.com.xpi [2018-05-12]
FF Plugin: @divx.com/DivX VOD Helper,version=1.0.0 -> C:\Program Files\DivX\DivX OVS Helper\npovshelper.dll [2014-05-22] (DivX, LLC.)
FF Plugin: @Microsoft.com/NpCtrl,version=1.0 -> c:\Program Files\Microsoft Silverlight\5.1.50907.0\npctrl.dll [2017-05-03] ( Microsoft Corporation)
FF Plugin: @microsoft.com/SharePoint,version=14.0 -> C:\Program Files\Microsoft Office\Office16\NPSPWRAP.DLL [2015-07-31] (Microsoft Corporation)
FF Plugin: adobe.com/AdobeAAMDetect -> C:\Program Files (x86)\Adobe\Adobe Creative Cloud\Utils\npAdobeAAMDetect64.dll [2018-02-14] (Adobe Systems)
FF Plugin-x32: @adobe.com/ShockwavePlayer -> C:\WINDOWS\SysWOW64\Adobe\Director\np32dsw_1229199.dll [2017-03-31] (Adobe Systems, Inc.)
FF Plugin-x32: @intel-webapi.intel.com/Intel WebAPI ipt;version=2.1.42 -> C:\Program Files (x86)\Intel\Intel® Management Engine Components\IPT\npIntelWebAPIIPT.dll [2012-06-06] (Intel Corporation)
FF Plugin-x32: @intel-webapi.intel.com/Intel WebAPI updater -> C:\Program Files (x86)\Intel\Intel® Management Engine Components\IPT\npIntelWebAPIUpdater.dll [2012-06-06] (Intel Corporation)
FF Plugin-x32: @java.com/DTPlugin,version=11.171.2 -> C:\Program Files (x86)\Java\jre1.8.0_171\bin\dtplugin\npDeployJava1.dll [2018-06-23] (Oracle Corporation)
FF Plugin-x32: @java.com/JavaPlugin,version=11.171.2 -> C:\Program Files (x86)\Java\jre1.8.0_171\bin\plugin2\npjp2.dll [2018-06-23] (Oracle Corporation)
FF Plugin-x32: @microsoft.com/Lync,version=15.0 -> C:\Program Files (x86)\Mozilla Firefox\plugins\npmeetingjoinpluginoc.dll [2018-04-10] (Microsoft Corporation)
FF Plugin-x32: @Microsoft.com/NpCtrl,version=1.0 -> c:\Program Files (x86)\Microsoft Silverlight\5.1.50907.0\npctrl.dll [2017-05-03] ( Microsoft Corporation)
FF Plugin-x32: @microsoft.com/SharePoint,version=14.0 -> C:\Program Files (x86)\Microsoft Office\Office16\NPSPWRAP.DLL [2015-07-31] (Microsoft Corporation)
FF Plugin-x32: @microsoft.com/WLPG,version=16.4.3528.0331 -> C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll [2014-03-31] (Microsoft Corporation)
FF Plugin-x32: @tools.google.com/Google Update;version=3 -> C:\Program Files (x86)\Google\Update\1.3.33.17\npGoogleUpdate3.dll [2018-05-16] (Google Inc.)
FF Plugin-x32: @tools.google.com/Google Update;version=9 -> C:\Program Files (x86)\Google\Update\1.3.33.17\npGoogleUpdate3.dll [2018-05-16] (Google Inc.)
FF Plugin-x32: adobe.com/AdobeAAMDetect -> C:\Program Files (x86)\Adobe\Adobe Creative Cloud\Utils\npAdobeAAMDetect32.dll [2018-02-14] (Adobe Systems)
FF Plugin HKU\S-1-5-21-4254226789-487654737-2996639702-1001: @tools.google.com/Google Update;version=3 -> C:\Users\broma_000\AppData\Local\Google\Update\1.3.33.17\npGoogleUpdate3.dll [2018-05-16] (Google Inc.)
FF Plugin HKU\S-1-5-21-4254226789-487654737-2996639702-1001: @tools.google.com/Google Update;version=9 -> C:\Users\broma_000\AppData\Local\Google\Update\1.3.33.17\npGoogleUpdate3.dll [2018-05-16] (Google Inc.)
 
Chrome: 
=======
CHR DefaultProfile: Default
CHR HomePage: Default -> hxxp://www.google.com/
CHR Session Restore: Default -> is enabled.
CHR Profile: C:\Users\broma_000\AppData\Local\Google\Chrome\User Data\Default [2018-10-10]
CHR Extension: (Slides) - C:\Users\broma_000\AppData\Local\Google\Chrome\User Data\Default\Extensions\aapocclcgogkmnckokdopfmhonfmgoek [2017-10-23]
CHR Extension: (Docs) - C:\Users\broma_000\AppData\Local\Google\Chrome\User Data\Default\Extensions\aohghmighlieiainnegkcijnfilokake [2017-10-23]
CHR Extension: (Google Drive) - C:\Users\broma_000\AppData\Local\Google\Chrome\User Data\Default\Extensions\apdfllckaahabafndbhieahigkjlhalf [2016-05-30]
CHR Extension: (Turn Off the Lights) - C:\Users\broma_000\AppData\Local\Google\Chrome\User Data\Default\Extensions\bfbmjmiodbnnpllbbbfblcplfjjepjdn [2018-09-26]
CHR Extension: (YouTube) - C:\Users\broma_000\AppData\Local\Google\Chrome\User Data\Default\Extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo [2016-05-30]
CHR Extension: (Google Cast) - C:\Users\broma_000\AppData\Local\Google\Chrome\User Data\Default\Extensions\boadgeojelhgndaghljhdicfkmllpafd [2018-10-10]
CHR Extension: (uBlock Origin) - C:\Users\broma_000\AppData\Local\Google\Chrome\User Data\Default\Extensions\cjpalhdlnbpafiamejdnhcphjbkeiagm [2018-09-27]
CHR Extension: (Sheets) - C:\Users\broma_000\AppData\Local\Google\Chrome\User Data\Default\Extensions\felcaaldnbdncclmgdcncolpebgiejap [2017-10-23]
CHR Extension: (HTTPS Everywhere) - C:\Users\broma_000\AppData\Local\Google\Chrome\User Data\Default\Extensions\gcbommkclmclpchllfjekcdonpmejbdp [2018-10-04]
CHR Extension: (Google Docs Offline) - C:\Users\broma_000\AppData\Local\Google\Chrome\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi [2018-09-09]
CHR Extension: (Google Keep - notes and lists) - C:\Users\broma_000\AppData\Local\Google\Chrome\User Data\Default\Extensions\hmjkmjkepdijhoojdojkdfohbdgmmhki [2018-10-08]
CHR Extension: (Ubiquiti Device Discovery Tool) - C:\Users\broma_000\AppData\Local\Google\Chrome\User Data\Default\Extensions\hmpigflbjeapnknladcfphgkemopofig [2018-09-26]
CHR Extension: (Bookmarks) - C:\Users\broma_000\AppData\Local\Google\Chrome\User Data\Default\Extensions\ihaibgdemjcpnllmndlpdkfiggadlcgi [2016-05-30]
CHR Extension: (Google Dictionary (by Google)) - C:\Users\broma_000\AppData\Local\Google\Chrome\User Data\Default\Extensions\mgijmajocgfcbeboacabfgobmjgjcoja [2017-08-07]
CHR Extension: (FreshStart - Cross Browser Session Manager) - C:\Users\broma_000\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmidkjogcjnnlfimjcedenagjfacpobb [2018-09-10]
CHR Extension: (Chrome Web Store Payments) - C:\Users\broma_000\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda [2018-04-15]
CHR Extension: (Recently Closed Tabs) - C:\Users\broma_000\AppData\Local\Google\Chrome\User Data\Default\Extensions\opefiliglgllmponlmoajkfbcaigocfc [2016-05-30]
CHR Extension: (Click&Clean App) - C:\Users\broma_000\AppData\Local\Google\Chrome\User Data\Default\Extensions\pdabfienifkbhoihedcgeogidfmibmhp [2018-10-06]
CHR Extension: (Gmail) - C:\Users\broma_000\AppData\Local\Google\Chrome\User Data\Default\Extensions\pjkljhegncpnkpknbcohdijeoejaedia [2016-05-30]
CHR Extension: (Chrome Media Router) - C:\Users\broma_000\AppData\Local\Google\Chrome\User Data\Default\Extensions\pkedcjkdefgpdelpbcmbmeomcjbeemfm [2018-09-25]
CHR Extension: (Privacy Badger) - C:\Users\broma_000\AppData\Local\Google\Chrome\User Data\Default\Extensions\pkehgijcmpdhfbdbbnkijodmdjhbjlgp [2018-10-05]
CHR Profile: C:\Users\broma_000\AppData\Local\Google\Chrome\User Data\System Profile [2018-09-29]
CHR HKLM\...\Chrome\Extension: [iikflkcanblccfahdhdonehdalibjnif] - hxxps://clients2.google.com/service/update2/crx
CHR HKLM-x32\...\Chrome\Extension: [iikflkcanblccfahdhdonehdalibjnif] - hxxps://clients2.google.com/service/update2/crx
 
==================== Services (Whitelisted) ====================
 
(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)
 
S2 AdobeUpdateService; C:\Program Files (x86)\Common Files\Adobe\Adobe Desktop Common\ElevationManager\AdobeUpdateService.exe [818128 2018-02-14] (Adobe Systems Incorporated)
S2 AGMService; C:\Program Files (x86)\Common Files\Adobe\AdobeGCClient\AGMService.exe [2910696 2018-09-10] (Adobe Systems, Incorporated)
S2 AGSService; C:\Program Files (x86)\Common Files\Adobe\AdobeGCClient\AGSService.exe [2704872 2018-09-10] (Adobe Systems, Incorporated)
S2 Apple Mobile Device Service; C:\Program Files\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe [83768 2018-07-05] (Apple Inc.)
S2 CylanceSvc; C:\Program Files\Cylance\Desktop\CylanceSvc.exe [1656984 2018-06-21] (Cylance, Inc.)
S2 ftpsvc; C:\WINDOWS\system32\inetsrv\ftpsvc.dll [377856 2018-04-12] (Microsoft Corporation)
S2 GlassWire; C:\Program Files (x86)\GlassWire\GWCtlSrv.exe [4328400 2018-06-22] (SecureMix LLC)
S4 HTCMonitorService; C:\Program Files (x86)\HTC\HTC Sync Manager\HSMServiceEntry.exe [87368 2014-06-27] (Nero AG)
S3 iaStorAfsService; C:\WINDOWS\IAStorAfsService\iaStorAfsService.exe [2413720 2017-06-09] (Intel Corporation)
S4 IAStorDataMgrSvc; C:\Program Files\Intel\Intel® Rapid Storage Technology\IAStorDataMgrSvc.exe [15720 2013-08-22] (Intel Corporation)
S4 ibtsiva.exe; C:\Program Files (x86)\Intel\Bluetooth\utilities\ibtsiva.exe [135408 2015-06-18] (Intel Corporation)
S2 igfxCUIService1.0.0.0; C:\WINDOWS\system32\igfxCUIService.exe [319096 2017-04-24] (Intel Corporation)
S2 irstrtsv; C:\Windows\SysWOW64\irstrtsv.exe [193576 2012-07-20] (Intel Corporation)
S4 jhi_service; C:\Program Files (x86)\Intel\Intel® Management Engine Components\DAL\jhi_service.exe [165760 2012-07-17] (Intel Corporation)
S3 MBAMService; C:\Program Files\Malwarebytes\Anti-Malware\mbamservice.exe [6541008 2018-05-09] (Malwarebytes)
S2 nordvpn-service; C:\Program Files (x86)\NordVPN\nordvpn-service.exe [431568 2018-06-22] ()
S3 rpcapd; C:\Program Files (x86)\WinPcap\rpcapd.exe [118520 2013-02-28] (Riverbed Technology, Inc.)
S2 Secunia PSI Agent; C:\Program Files (x86)\Secunia\PSI\PSIA.exe [1570520 2016-02-02] (Secunia)
S4 ssh-agent; C:\WINDOWS\System32\OpenSSH\ssh-agent.exe [495616 2018-03-10] ()
S2 STacSV; C:\Program Files\IDT\WDM\STacSV64.exe [339456 2013-08-16] (IDT, Inc.) [File not signed]
S2 SynTPEnhService; C:\Program Files\Synaptics\SynTP\SynTPEnhService.exe [253960 2016-04-28] (Synaptics Incorporated)
S4 TeamViewer; C:\Program Files (x86)\TeamViewer\TeamViewer_Service.exe [11644144 2018-07-23] (TeamViewer GmbH)
S3 WdNisSvc; C:\ProgramData\Microsoft\Windows Defender\platform\4.18.1809.2-0\NisSrv.exe [3847376 2018-10-06] (Microsoft Corporation)
R2 WinDefend; C:\ProgramData\Microsoft\Windows Defender\platform\4.18.1809.2-0\MsMpEng.exe [114200 2018-10-06] (Microsoft Corporation)
 
===================== Drivers (Whitelisted) ======================
 
(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)
 
S3 cbfs3; C:\WINDOWS\System32\drivers\cbfs3.sys [352144 2012-04-09] (EldoS Corporation)
S3 clwvd6; C:\WINDOWS\system32\DRIVERS\clwvd6.sys [41704 2013-10-29] (CyberLink Corporation)
S1 CyProtectDrv; C:\WINDOWS\System32\DRIVERS\CyProtectDrv64.sys [203800 2018-06-21] (Cylance, Inc.)
S3 ETDSMBus; C:\WINDOWS\System32\drivers\ETDSMBus.sys [32848 2017-04-18] (ELAN Microelectronic Corp.)
R0 fsbts; C:\WINDOWS\System32\Drivers\fsbts.sys [73928 2018-04-27] ()
R1 gwdrv; C:\WINDOWS\system32\DRIVERS\gwdrv.sys [33152 2015-05-29] (SecureMix LLC)
R3 HpqKbFiltr; C:\WINDOWS\System32\drivers\HpqKbFiltr64.sys [37112 2015-06-17] (Hewlett-Packard Company)
S3 HtcVCom32; C:\WINDOWS\system32\DRIVERS\HtcVComV64.sys [121800 2010-03-09] (QUALCOMM Incorporated)
S3 iaStorAfs; C:\WINDOWS\System32\drivers\iaStorAfs.sys [70632 2017-06-09] (Intel Corporation)
R3 irstrtdv; C:\WINDOWS\System32\drivers\irstrtdv.sys [43800 2012-07-20] (Intel Corporation)
R3 ISCT; C:\WINDOWS\System32\drivers\ISCTD64.sys [47008 2013-07-30] ()
S3 libusb0; C:\WINDOWS\system32\DRIVERS\libusb0.sys [52832 2014-06-17] (hxxp://libusb-win32.sourceforge.net)
S3 ManyCam; C:\WINDOWS\system32\DRIVERS\mcvidrv_x64.sys [44544 2013-01-14] (ManyCam LLC)
S3 MBAMSwissArmy; C:\WINDOWS\System32\Drivers\mbamswissarmy.sys [253664 2018-10-10] (Malwarebytes)
R0 MBRFilter; C:\WINDOWS\System32\DRIVERS\MBRFilter.sys [19600 2016-10-05] ()
S3 mcaudrv_simple; C:\WINDOWS\system32\drivers\mcaudrv_x64.sys [28160 2013-01-31] (ManyCam LLC)
S3 Microsoft_Bluetooth_AvrcpTransport; C:\WINDOWS\system32\DRIVERS\Microsoft.Bluetooth.AvrcpTransport.sys [46592 2018-04-11] (Microsoft Corporation)
R3 NETwNe64; C:\WINDOWS\system32\DRIVERS\Netwew01.sys [3363112 2015-08-30] (Intel Corporation)
S3 NPF; C:\WINDOWS\System32\drivers\npf.sys [36600 2013-02-28] (Riverbed Technology, Inc.)
S3 PSI; C:\WINDOWS\System32\DRIVERS\psi_mf_amd64.sys [18456 2016-02-02] (Secunia)
S3 ptun0901; C:\WINDOWS\System32\drivers\ptun0901.sys [27136 2014-08-08] (The OpenVPN Project)
R0 PxHlpa64; C:\WINDOWS\System32\Drivers\PxHlpa64.sys [56336 2012-08-12] (Corel Corporation)
S3 Rockusb; C:\WINDOWS\System32\drivers\rockusb.sys [66704 2014-09-22] (Fuzhou Rockchip Electronics Co,Ltd.)
S3 RSP2STOR; C:\WINDOWS\System32\drivers\RtsP2Stor.sys [329664 2017-10-26] (Realtek Semiconductor Corp.)
R3 rt640x64; C:\WINDOWS\System32\drivers\rt640x64.sys [984032 2017-06-20] (Realtek )
S3 semav6msr64; C:\WINDOWS\system32\drivers\semav6msr64.sys [21984 2016-10-18] ()
S3 SIVDriver; C:\WINDOWS\system32\Drivers\SIVX64.sys [181904 2018-02-14] (Ray Hinchliffe)
R3 SmbDrvI; C:\WINDOWS\system32\DRIVERS\Smb_driver_Intel.sys [52904 2016-04-28] (Synaptics Incorporated)
S3 tap0901; C:\WINDOWS\System32\drivers\tap0901.sys [31232 2015-01-18] (The OpenVPN Project) [File not signed]
R3 tapnordvpn; C:\WINDOWS\System32\drivers\tapnordvpn.sys [44896 2018-06-13] (The OpenVPN Project)
R3 USBPcap; C:\WINDOWS\system32\DRIVERS\USBPcap.sys [50224 2017-08-20] (USBPcap)
S0 WdBoot; C:\WINDOWS\System32\drivers\wd\WdBoot.sys [46184 2018-10-06] (Microsoft Corporation)
S0 WdFilter; C:\WINDOWS\System32\drivers\wd\WdFilter.sys [352424 2018-10-06] (Microsoft Corporation)
S3 WdNisDrv; C:\WINDOWS\System32\drivers\wd\WdNisDrv.sys [60584 2018-10-06] (Microsoft Corporation)
R3 WirelessButtonDriver64; C:\WINDOWS\System32\drivers\WirelessButtonDriver64.sys [34944 2018-05-11] (HP)
S3 wpCtrlDrv_NGC; C:\WINDOWS\system32\drivers\NGCx64\160E000.036\wpCtrlDrv.sys [1007592 2018-04-03] (Symantec Corporation)
S1 YSDrv; C:\Program Files (x86)\Bignox\BigNoxVM\RT\YSDrv.sys [310536 2018-10-08] (BigNox Corporation)
S1 ZAM; C:\WINDOWS\System32\drivers\zam64.sys [203680 2017-05-10] (Zemana Ltd.)
S1 ZAM_Guard; C:\WINDOWS\System32\drivers\zamguard64.sys [203680 2017-03-07] (Zemana Ltd.)
S0 b06bdrv; System32\drivers\bxvbda.sys [X]
 
==================== NetSvcs (Whitelisted) ===================
 
(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)
 
 
==================== One Month Created files and folders ========
 
(If an entry is included in the fixlist, the file/folder will be moved.)
 
2018-10-10 19:38 - 2018-10-10 19:38 - 000026165 _____ C:\Users\broma_000\Desktop\FRST.txt
2018-10-10 19:29 - 2018-10-10 19:29 - 000000214 _____ C:\WINDOWS\Tasks\CreateExplorerShellUnelevatedTask.job
2018-10-10 19:28 - 2018-10-10 19:33 - 000202554 _____ C:\WINDOWS\ntbtlog.txt
2018-10-10 19:26 - 2018-10-10 19:26 - 002414592 _____ (Farbar) C:\Users\broma_000\Desktop\FRST64 (1).exe
2018-10-10 19:21 - 2018-10-10 19:21 - 002414592 _____ (Farbar) C:\Users\broma_000\Desktop\FRST64.exe
2018-10-10 02:01 - 2018-10-10 02:01 - 000004562 _____ C:\WINDOWS\System32\Tasks\Adobe Acrobat Update Task
2018-10-10 01:21 - 2018-10-10 01:21 - 000000000 ____D C:\Users\broma_000\Desktop\the.equalizer.2.(2018).eng.1cd.(7475046)
2018-10-10 01:20 - 2018-09-09 20:23 - 000076410 _____ C:\Users\broma_000\Desktop\The Equalizer 2 2018 NEW HD-TS X264-24HD.srt
2018-10-10 01:17 - 2018-10-10 01:17 - 000000000 ____D C:\Users\broma_000\AppData\Local\GlassWire
2018-10-10 01:12 - 2018-10-10 01:12 - 000001972 _____ C:\Users\Public\Desktop\GlassWire.lnk
2018-10-10 01:12 - 2018-10-10 01:12 - 000000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\GlassWire
2018-10-10 01:12 - 2018-10-10 01:12 - 000000000 ____D C:\ProgramData\GlassWire
2018-10-10 01:12 - 2018-10-10 01:12 - 000000000 ____D C:\Program Files (x86)\GlassWire
2018-10-10 01:12 - 2015-05-29 00:30 - 000008392 _____ C:\WINDOWS\system32\Drivers\gwdrv.cat
2018-10-10 01:12 - 2015-05-29 00:15 - 000033152 _____ (SecureMix LLC) C:\WINDOWS\system32\Drivers\gwdrv.sys
2018-10-10 00:53 - 2018-10-10 01:02 - 000000000 ____D C:\Users\broma_000\Desktop\livetcpudpwatch-x64
2018-10-10 00:44 - 2018-10-10 00:44 - 000253664 _____ (Malwarebytes) C:\WINDOWS\system32\Drivers\mbamswissarmy.sys
2018-10-10 00:39 - 2018-10-10 19:27 - 000147736 _____ C:\WINDOWS\ZAM.krnl.trace
2018-10-10 00:39 - 2018-10-10 19:27 - 000114175 _____ C:\WINDOWS\ZAM_Guard.krnl.trace
2018-10-09 23:52 - 2018-09-20 00:29 - 006569856 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\Windows.Media.Protection.PlayReady.dll
2018-10-09 23:52 - 2018-09-20 00:09 - 007520096 _____ (Microsoft Corporation) C:\WINDOWS\system32\Windows.Media.Protection.PlayReady.dll
2018-10-09 23:51 - 2018-09-21 05:18 - 021386888 _____ (Microsoft Corporation) C:\WINDOWS\system32\shell32.dll
2018-10-09 23:51 - 2018-09-21 05:01 - 000171520 _____ (Microsoft Corporation) C:\WINDOWS\system32\itss.dll
2018-10-09 23:51 - 2018-09-21 04:22 - 020381784 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\shell32.dll
2018-10-09 23:51 - 2018-09-21 04:12 - 000150016 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\itss.dll
2018-10-09 23:51 - 2018-09-21 00:14 - 000661056 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\evr.dll
2018-10-09 23:51 - 2018-09-21 00:13 - 000480568 _____ (Microsoft Corporation) C:\WINDOWS\system32\dcntel.dll
2018-10-09 23:51 - 2018-09-21 00:12 - 001035256 _____ (Microsoft Corporation) C:\WINDOWS\system32\ApplyTrustOffline.exe
2018-10-09 23:51 - 2018-09-21 00:11 - 000753056 _____ (Microsoft Corporation) C:\WINDOWS\system32\evr.dll
2018-10-09 23:51 - 2018-09-21 00:09 - 004790160 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\mfcore.dll
2018-10-09 23:51 - 2018-09-21 00:09 - 002253696 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\iertutil.dll
2018-10-09 23:51 - 2018-09-21 00:09 - 001427968 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\AppxPackaging.dll
2018-10-09 23:51 - 2018-09-21 00:09 - 001062920 _____ (Microsoft Corporation) C:\WINDOWS\system32\SecConfig.efi
2018-10-09 23:51 - 2018-09-21 00:09 - 000129088 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\mfps.dll
2018-10-09 23:51 - 2018-09-21 00:08 - 004404720 _____ (Microsoft Corporation) C:\WINDOWS\system32\mfcore.dll
2018-10-09 23:51 - 2018-09-21 00:08 - 002765344 _____ (Microsoft Corporation) C:\WINDOWS\system32\iertutil.dll
2018-10-09 23:51 - 2018-09-21 00:08 - 001566720 _____ (Microsoft Corporation) C:\WINDOWS\system32\AppxPackaging.dll
2018-10-09 23:51 - 2018-09-21 00:08 - 001456720 _____ (Microsoft Corporation) C:\WINDOWS\system32\winload.efi
2018-10-09 23:51 - 2018-09-21 00:08 - 001257864 _____ (Microsoft Corporation) C:\WINDOWS\system32\winload.exe
2018-10-09 23:51 - 2018-09-21 00:08 - 001140672 _____ (Microsoft Corporation) C:\WINDOWS\system32\winresume.efi
2018-10-09 23:51 - 2018-09-21 00:08 - 000982600 _____ (Microsoft Corporation) C:\WINDOWS\system32\winresume.exe
2018-10-09 23:51 - 2018-09-21 00:08 - 000709936 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\cng.sys
2018-10-09 23:51 - 2018-09-21 00:08 - 000261008 _____ (Microsoft Corporation) C:\WINDOWS\system32\mfps.dll
2018-10-09 23:51 - 2018-09-21 00:08 - 000170808 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\ksecpkg.sys
2018-10-09 23:51 - 2018-09-21 00:07 - 000604664 _____ (Microsoft Corporation) C:\WINDOWS\system32\securekernel.exe
2018-10-09 23:51 - 2018-09-20 23:58 - 005307392 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\d2d1.dll
2018-10-09 23:51 - 2018-09-20 23:57 - 002900992 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\dwmcore.dll
2018-10-09 23:51 - 2018-09-20 23:57 - 001361408 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\MSPhotography.dll
2018-10-09 23:51 - 2018-09-20 23:56 - 000331264 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\edgeIso.dll
2018-10-09 23:51 - 2018-09-20 23:54 - 000251904 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\msIso.dll
2018-10-09 23:51 - 2018-09-20 23:53 - 001006080 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\wpnapps.dll
2018-10-09 23:51 - 2018-09-20 23:43 - 001627136 _____ (Microsoft Corporation) C:\WINDOWS\system32\enterprisecsps.dll
2018-10-09 23:51 - 2018-09-20 23:42 - 000209408 _____ (Microsoft Corporation) C:\WINDOWS\system32\AppXApplicabilityBlob.dll
2018-10-09 23:51 - 2018-09-20 23:41 - 003396096 _____ (Microsoft Corporation) C:\WINDOWS\system32\AppXDeploymentServer.dll
2018-10-09 23:51 - 2018-09-20 23:40 - 002368000 _____ (Microsoft Corporation) C:\WINDOWS\system32\WebRuntimeManager.dll
2018-10-09 23:51 - 2018-09-20 23:39 - 003320320 _____ (Microsoft Corporation) C:\WINDOWS\system32\dwmcore.dll
2018-10-09 23:51 - 2018-09-20 23:39 - 001708544 _____ (Microsoft Corporation) C:\WINDOWS\system32\MSPhotography.dll
2018-10-09 23:51 - 2018-09-20 23:39 - 001535488 _____ (Microsoft Corporation) C:\WINDOWS\system32\lsasrv.dll
2018-10-09 23:51 - 2018-09-20 23:39 - 000625152 _____ (Microsoft Corporation) C:\WINDOWS\system32\PsmServiceExtHost.dll
2018-10-09 23:51 - 2018-09-20 23:38 - 002172928 _____ (Microsoft Corporation) C:\WINDOWS\system32\AppXDeploymentExtensions.onecore.dll
2018-10-09 23:51 - 2018-09-20 23:38 - 001551360 _____ (Microsoft Corporation) C:\WINDOWS\system32\AppXDeploymentExtensions.desktop.dll
2018-10-09 23:51 - 2018-09-20 23:37 - 002904064 _____ (Microsoft Corporation) C:\WINDOWS\system32\wuaueng.dll
2018-10-09 23:51 - 2018-09-20 23:37 - 002236928 _____ (Microsoft Corporation) C:\WINDOWS\system32\win32kbase.sys
2018-10-09 23:51 - 2018-09-20 23:37 - 001211904 _____ (Microsoft Corporation) C:\WINDOWS\system32\wpnapps.dll
2018-10-09 23:51 - 2018-09-20 23:37 - 000604160 _____ (Microsoft Corporation) C:\WINDOWS\system32\updatehandlers.dll
2018-10-09 23:51 - 2018-09-20 23:36 - 001159680 _____ (Microsoft Corporation) C:\WINDOWS\system32\rpcss.dll
2018-10-09 23:51 - 2018-09-20 23:36 - 001034240 _____ (Microsoft Corporation) C:\WINDOWS\system32\modernexecserver.dll
2018-10-09 23:51 - 2018-09-20 23:36 - 000932352 _____ (Microsoft Corporation) C:\WINDOWS\system32\rasmans.dll
2018-10-09 23:51 - 2018-09-20 23:36 - 000505344 _____ (Microsoft Corporation) C:\WINDOWS\system32\edgeIso.dll
2018-10-09 23:51 - 2018-09-20 23:36 - 000401920 _____ (Microsoft Corporation) C:\WINDOWS\system32\rascustom.dll
2018-10-09 23:51 - 2018-09-20 05:40 - 000348160 _____ (Microsoft Corporation) C:\WINDOWS\system32\MusNotifyIcon.exe
2018-10-09 23:51 - 2018-09-20 05:37 - 001634944 _____ (Microsoft Corporation) C:\WINDOWS\system32\gdi32full.dll
2018-10-09 23:51 - 2018-09-20 05:23 - 006602240 _____ (Microsoft Corporation) C:\WINDOWS\system32\twinui.dll
2018-10-09 23:51 - 2018-09-20 05:22 - 013572096 _____ (Microsoft Corporation) C:\WINDOWS\system32\wmp.dll
2018-10-09 23:51 - 2018-09-20 05:19 - 001121792 _____ (Microsoft Corporation) C:\WINDOWS\system32\TSWorkspace.dll
2018-10-09 23:51 - 2018-09-20 05:18 - 003649024 _____ (Microsoft Corporation) C:\WINDOWS\system32\win32kfull.sys
2018-10-09 23:51 - 2018-09-20 05:18 - 000392192 _____ (Microsoft Corporation) C:\WINDOWS\system32\iedkcs32.dll
2018-10-09 23:51 - 2018-09-20 05:17 - 002874368 _____ (Microsoft Corporation) C:\WINDOWS\system32\themeui.dll
2018-10-09 23:51 - 2018-09-20 05:17 - 001856000 _____ (Microsoft Corporation) C:\WINDOWS\system32\msxml3.dll
2018-10-09 23:51 - 2018-09-20 05:17 - 001364992 _____ (Microsoft Corporation) C:\WINDOWS\system32\bcastdvruserservice.dll
2018-10-09 23:51 - 2018-09-20 05:16 - 000127488 _____ (Microsoft Corporation) C:\WINDOWS\system32\wmpshell.dll
2018-10-09 23:51 - 2018-09-20 04:46 - 001454440 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\gdi32full.dll
2018-10-09 23:51 - 2018-09-20 04:35 - 005669888 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\twinui.dll
2018-10-09 23:51 - 2018-09-20 04:34 - 012500992 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\wmp.dll
2018-10-09 23:51 - 2018-09-20 04:30 - 000344576 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\iedkcs32.dll
2018-10-09 23:51 - 2018-09-20 04:29 - 002891776 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\win32kfull.sys
2018-10-09 23:51 - 2018-09-20 04:29 - 002824704 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\themeui.dll
2018-10-09 23:51 - 2018-09-20 04:29 - 001586176 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\msxml3.dll
2018-10-09 23:51 - 2018-09-20 04:28 - 000102400 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\wmpshell.dll
2018-10-09 23:51 - 2018-09-20 02:43 - 001008640 _____ (Microsoft Corporation) C:\WINDOWS\system32\Windows.Media.MixedRealityCapture.dll
2018-10-09 23:51 - 2018-09-20 01:52 - 000868864 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\Windows.Media.MixedRealityCapture.dll
2018-10-09 23:51 - 2018-09-20 00:29 - 006039368 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\windows.storage.dll
2018-10-09 23:51 - 2018-09-20 00:29 - 001989232 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\msxml6.dll
2018-10-09 23:51 - 2018-09-20 00:29 - 001513032 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\WindowsCodecs.dll
2018-10-09 23:51 - 2018-09-20 00:29 - 000357056 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\bcryptprimitives.dll
2018-10-09 23:51 - 2018-09-20 00:28 - 001129544 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\msvproc.dll
2018-10-09 23:51 - 2018-09-20 00:28 - 000581792 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\MSVideoDSP.dll
2018-10-09 23:51 - 2018-09-20 00:28 - 000567256 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\CoreMessaging.dll
2018-10-09 23:51 - 2018-09-20 00:21 - 022013440 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\edgehtml.dll
2018-10-09 23:51 - 2018-09-20 00:17 - 006661632 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\Windows.Data.Pdf.dll
2018-10-09 23:51 - 2018-09-20 00:15 - 019404288 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\mshtml.dll
2018-10-09 23:51 - 2018-09-20 00:13 - 003711488 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\jscript9.dll
2018-10-09 23:51 - 2018-09-20 00:12 - 000272200 _____ (Microsoft Corporation) C:\WINDOWS\system32\SgrmEnclave.dll
2018-10-09 23:51 - 2018-09-20 00:12 - 000269128 _____ (Microsoft Corporation) C:\WINDOWS\system32\SgrmEnclave_secure.dll
2018-10-09 23:51 - 2018-09-20 00:11 - 005777920 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\Chakra.dll
2018-10-09 23:51 - 2018-09-20 00:11 - 000608768 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\EdgeManager.dll
2018-10-09 23:51 - 2018-09-20 00:11 - 000578560 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\webplatstorageserver.dll
2018-10-09 23:51 - 2018-09-20 00:11 - 000561152 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\jscript9diag.dll
2018-10-09 23:51 - 2018-09-20 00:11 - 000074240 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\dtdump.exe
2018-10-09 23:51 - 2018-09-20 00:10 - 002719032 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\tcpip.sys
2018-10-09 23:51 - 2018-09-20 00:10 - 001221128 _____ (Microsoft Corporation) C:\WINDOWS\system32\hvix64.exe
2018-10-09 23:51 - 2018-09-20 00:10 - 001029432 _____ (Microsoft Corporation) C:\WINDOWS\system32\hvax64.exe
2018-10-09 23:51 - 2018-09-20 00:10 - 000566800 _____ (Microsoft Corporation) C:\WINDOWS\system32\tcblaunch.exe
2018-10-09 23:51 - 2018-09-20 00:10 - 000500536 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\mrxsmb.sys
2018-10-09 23:51 - 2018-09-20 00:10 - 000355840 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\PhotoMetadataHandler.dll
2018-10-09 23:51 - 2018-09-20 00:10 - 000134968 _____ (Microsoft Corporation) C:\WINDOWS\system32\hvloader.dll
2018-10-09 23:51 - 2018-09-20 00:10 - 000076088 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\hvservice.sys
2018-10-09 23:51 - 2018-09-20 00:09 - 009089848 _____ (Microsoft Corporation) C:\WINDOWS\system32\ntoskrnl.exe
2018-10-09 23:51 - 2018-09-20 00:09 - 007432136 _____ (Microsoft Corporation) C:\WINDOWS\system32\windows.storage.dll
2018-10-09 23:51 - 2018-09-20 00:09 - 002825232 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\dxgkrnl.sys
2018-10-09 23:51 - 2018-09-20 00:09 - 002462888 _____ (Microsoft Corporation) C:\WINDOWS\system32\msxml6.dll
2018-10-09 23:51 - 2018-09-20 00:09 - 002421248 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\ntfs.sys
2018-10-09 23:51 - 2018-09-20 00:09 - 001767096 _____ (Microsoft Corporation) C:\WINDOWS\system32\WindowsCodecs.dll
2018-10-09 23:51 - 2018-09-20 00:09 - 001540096 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\rdpserverbase.dll
2018-10-09 23:51 - 2018-09-20 00:09 - 001097744 _____ (Microsoft Corporation) C:\WINDOWS\system32\msvproc.dll
2018-10-09 23:51 - 2018-09-20 00:09 - 000885952 _____ (Microsoft Corporation) C:\WINDOWS\system32\CoreMessaging.dll
2018-10-09 23:51 - 2018-09-20 00:09 - 000793088 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\dxgmms2.sys
2018-10-09 23:51 - 2018-09-20 00:09 - 000713472 _____ (Microsoft Corporation) C:\WINDOWS\system32\MSVideoDSP.dll
2018-10-09 23:51 - 2018-09-20 00:09 - 000412984 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\dxgmms1.sys
2018-10-09 23:51 - 2018-09-20 00:08 - 004191232 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\wininet.dll
2018-10-09 23:51 - 2018-09-20 00:08 - 001627648 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\urlmon.dll
2018-10-09 23:51 - 2018-09-19 23:53 - 025851392 _____ (Microsoft Corporation) C:\WINDOWS\system32\edgehtml.dll
2018-10-09 23:51 - 2018-09-19 23:46 - 022715392 _____ (Microsoft Corporation) C:\WINDOWS\system32\mshtml.dll
2018-10-09 23:51 - 2018-09-19 23:44 - 008188928 _____ (Microsoft Corporation) C:\WINDOWS\system32\Windows.Data.Pdf.dll
2018-10-09 23:51 - 2018-09-19 23:44 - 004383744 _____ (Microsoft Corporation) C:\WINDOWS\system32\EdgeContent.dll
2018-10-09 23:51 - 2018-09-19 23:43 - 000052736 _____ C:\WINDOWS\system32\runexehelper.exe
2018-10-09 23:51 - 2018-09-19 23:42 - 004866560 _____ (Microsoft Corporation) C:\WINDOWS\system32\jscript9.dll
2018-10-09 23:51 - 2018-09-19 23:42 - 000433664 _____ (Microsoft Corporation) C:\WINDOWS\system32\MusNotification.exe
2018-10-09 23:51 - 2018-09-19 23:42 - 000099328 _____ (Microsoft Corporation) C:\WINDOWS\system32\utcutil.dll
2018-10-09 23:51 - 2018-09-19 23:41 - 007577088 _____ (Microsoft Corporation) C:\WINDOWS\system32\Chakra.dll
2018-10-09 23:51 - 2018-09-19 23:41 - 000898560 _____ (Microsoft Corporation) C:\WINDOWS\system32\MusUpdateHandlers.dll
2018-10-09 23:51 - 2018-09-19 23:41 - 000894464 _____ (Microsoft Corporation) C:\WINDOWS\system32\webplatstorageserver.dll
2018-10-09 23:51 - 2018-09-19 23:41 - 000319488 _____ (Microsoft Corporation) C:\WINDOWS\system32\MusNotificationUx.exe
2018-10-09 23:51 - 2018-09-19 23:41 - 000154112 _____ (Microsoft Corporation) C:\WINDOWS\system32\Chakradiag.dll
2018-10-09 23:51 - 2018-09-19 23:40 - 003090432 _____ (Microsoft Corporation) C:\WINDOWS\system32\diagtrack.dll
2018-10-09 23:51 - 2018-09-19 23:40 - 000808448 _____ (Microsoft Corporation) C:\WINDOWS\system32\EdgeManager.dll
2018-10-09 23:51 - 2018-09-19 23:40 - 000726528 _____ (Microsoft Corporation) C:\WINDOWS\system32\jscript9diag.dll
2018-10-09 23:51 - 2018-09-19 23:38 - 001724416 _____ (Microsoft Corporation) C:\WINDOWS\system32\rdpserverbase.dll
2018-10-09 23:51 - 2018-09-19 23:38 - 000433664 _____ (Microsoft Corporation) C:\WINDOWS\system32\PhotoMetadataHandler.dll
2018-10-09 23:51 - 2018-09-19 23:37 - 004615680 _____ (Microsoft Corporation) C:\WINDOWS\system32\wininet.dll
2018-10-09 23:51 - 2018-09-19 23:37 - 001804288 _____ (Microsoft Corporation) C:\WINDOWS\system32\urlmon.dll
2018-10-09 23:51 - 2018-09-19 23:36 - 001375232 _____ (Microsoft Corporation) C:\WINDOWS\system32\usocore.dll
2018-10-09 23:51 - 2018-09-19 22:21 - 000001312 _____ C:\WINDOWS\system32\tcbres.wim
2018-10-09 23:51 - 2018-09-19 21:28 - 000343552 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\msrd3x40.dll
2018-10-09 23:51 - 2018-09-08 04:12 - 000452112 _____ (Microsoft Corporation) C:\WINDOWS\system32\invagent.dll
2018-10-09 23:51 - 2018-09-08 04:07 - 002868536 _____ (Microsoft Corporation) C:\WINDOWS\system32\aitstatic.exe
2018-10-09 23:51 - 2018-09-08 04:07 - 001610552 _____ (Microsoft Corporation) C:\WINDOWS\system32\appraiser.dll
2018-10-09 23:51 - 2018-09-08 04:07 - 000792376 _____ (Microsoft Corporation) C:\WINDOWS\system32\generaltel.dll
2018-10-09 23:51 - 2018-09-08 04:07 - 000689464 _____ (Microsoft Corporation) C:\WINDOWS\system32\aeinv.dll
2018-10-09 23:51 - 2018-09-08 04:07 - 000612360 _____ (Microsoft Corporation) C:\WINDOWS\system32\devinv.dll
2018-10-09 23:51 - 2018-09-08 04:07 - 000309560 _____ (Microsoft Corporation) C:\WINDOWS\system32\acmigration.dll
2018-10-09 23:51 - 2018-09-08 04:07 - 000144696 _____ (Microsoft Corporation) C:\WINDOWS\system32\CompatTelRunner.exe
2018-10-09 23:51 - 2018-09-08 04:07 - 000069944 _____ (Microsoft Corporation) C:\WINDOWS\system32\win32appinventorycsp.dll
2018-10-09 23:51 - 2018-09-08 04:02 - 000645112 _____ (Microsoft Corporation) C:\WINDOWS\system32\advapi32.dll
2018-10-09 23:51 - 2018-09-08 04:02 - 000540984 _____ (Microsoft Corporation) C:\WINDOWS\system32\pcasvc.dll
2018-10-09 23:51 - 2018-09-08 03:58 - 001639352 _____ (Microsoft Corporation) C:\WINDOWS\system32\user32.dll
2018-10-09 23:51 - 2018-09-08 03:58 - 001520744 _____ (Microsoft Corporation) C:\WINDOWS\system32\msctf.dll
2018-10-09 23:51 - 2018-09-08 03:57 - 000204800 _____ (Microsoft Corporation) C:\WINDOWS\system32\basecsp.dll
2018-10-09 23:51 - 2018-09-08 03:44 - 000068096 _____ (Microsoft Corporation) C:\WINDOWS\system32\fdBth.dll
2018-10-09 23:51 - 2018-09-08 03:43 - 000085504 _____ (Microsoft Corporation) C:\WINDOWS\system32\INETRES.dll
2018-10-09 23:51 - 2018-09-08 03:43 - 000047616 _____ (Microsoft Corporation) C:\WINDOWS\system32\SCardBi.dll
2018-10-09 23:51 - 2018-09-08 03:42 - 000256000 _____ (Microsoft Corporation) C:\WINDOWS\system32\scksp.dll
2018-10-09 23:51 - 2018-09-08 03:42 - 000188928 _____ (Microsoft Corporation) C:\WINDOWS\system32\certprop.dll
2018-10-09 23:51 - 2018-09-08 03:42 - 000169984 _____ (Microsoft Corporation) C:\WINDOWS\system32\Windows.UI.XamlHost.dll
2018-10-09 23:51 - 2018-09-08 03:42 - 000114176 _____ (Microsoft Corporation) C:\WINDOWS\system32\bthci.dll
2018-10-09 23:51 - 2018-09-08 03:41 - 000258560 _____ (Microsoft Corporation) C:\WINDOWS\system32\SCardSvr.dll
2018-10-09 23:51 - 2018-09-08 03:40 - 001724928 _____ (Microsoft Corporation) C:\WINDOWS\system32\Windows.UI.Immersive.dll
2018-10-09 23:51 - 2018-09-08 03:40 - 000677888 _____ (Microsoft Corporation) C:\WINDOWS\system32\winlogon.exe
2018-10-09 23:51 - 2018-09-08 03:40 - 000593408 _____ (Microsoft Corporation) C:\WINDOWS\system32\cryptui.dll
2018-10-09 23:51 - 2018-09-08 03:40 - 000522240 _____ (Microsoft Corporation) C:\WINDOWS\system32\winspool.drv
2018-10-09 23:51 - 2018-09-08 03:40 - 000402944 _____ (Microsoft Corporation) C:\WINDOWS\system32\bdesvc.dll
2018-10-09 23:51 - 2018-09-08 03:40 - 000249344 _____ (Microsoft Corporation) C:\WINDOWS\system32\bthprops.cpl
2018-10-09 23:51 - 2018-09-08 03:39 - 005505024 _____ (Microsoft Corporation) C:\WINDOWS\system32\aclui.dll
2018-10-09 23:51 - 2018-09-08 03:39 - 002052096 _____ (Microsoft Corporation) C:\WINDOWS\system32\wsp_fs.dll
2018-10-09 23:51 - 2018-09-08 03:39 - 001787904 _____ (Microsoft Corporation) C:\WINDOWS\system32\wsp_health.dll
2018-10-09 23:51 - 2018-09-08 03:39 - 000615936 _____ (Microsoft Corporation) C:\WINDOWS\system32\resutils.dll
2018-10-09 23:51 - 2018-09-08 03:38 - 001288192 _____ (Microsoft Corporation) C:\WINDOWS\system32\SystemSettings.Handlers.dll
2018-10-09 23:51 - 2018-09-08 03:38 - 001004544 _____ (Microsoft Corporation) C:\WINDOWS\system32\clusapi.dll
2018-10-09 23:51 - 2018-09-08 03:38 - 000986112 _____ (Microsoft Corporation) C:\WINDOWS\system32\inetcomm.dll
2018-10-09 23:51 - 2018-09-08 03:38 - 000882688 _____ (Microsoft Corporation) C:\WINDOWS\system32\SmartcardCredentialProvider.dll
2018-10-09 23:51 - 2018-09-08 03:38 - 000836608 _____ (Microsoft Corporation) C:\WINDOWS\system32\win32spl.dll
2018-10-09 23:51 - 2018-09-08 03:37 - 000091136 _____ (Microsoft Corporation) C:\WINDOWS\system32\mcbuilder.exe
2018-10-09 23:51 - 2018-09-08 03:16 - 000482080 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\advapi32.dll
2018-10-09 23:51 - 2018-09-08 03:14 - 001328056 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\msctf.dll
2018-10-09 23:51 - 2018-09-08 03:13 - 001626656 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\user32.dll
2018-10-09 23:51 - 2018-09-08 03:13 - 000181288 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\basecsp.dll
2018-10-09 23:51 - 2018-09-08 03:03 - 000084992 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\INETRES.dll
2018-10-09 23:51 - 2018-09-08 03:03 - 000059392 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\fdBth.dll
2018-10-09 23:51 - 2018-09-08 03:02 - 000236032 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\scksp.dll
2018-10-09 23:51 - 2018-09-08 03:00 - 000548864 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\cryptui.dll
2018-10-09 23:51 - 2018-09-08 02:59 - 001530368 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\Windows.UI.Immersive.dll
2018-10-09 23:51 - 2018-09-08 02:59 - 001452544 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\wsp_fs.dll
2018-10-09 23:51 - 2018-09-08 02:59 - 000485376 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\resutils.dll
2018-10-09 23:51 - 2018-09-08 02:59 - 000133632 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\Windows.UI.XamlHost.dll
2018-10-09 23:51 - 2018-09-08 02:58 - 001308672 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\wsp_health.dll
2018-10-09 23:51 - 2018-09-08 02:58 - 000897536 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\inetcomm.dll
2018-10-09 23:51 - 2018-09-08 02:58 - 000775680 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\clusapi.dll
2018-10-09 23:51 - 2018-09-08 02:57 - 005391360 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\aclui.dll
2018-10-09 23:51 - 2018-09-08 02:57 - 000625664 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\SmartcardCredentialProvider.dll
2018-10-09 23:51 - 2018-09-08 02:57 - 000423936 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\winspool.drv
2018-10-09 23:51 - 2018-09-08 02:57 - 000223744 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\bthprops.cpl
2018-10-09 23:51 - 2018-09-08 02:56 - 000080384 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\mcbuilder.exe
2018-10-09 23:51 - 2018-09-08 00:08 - 000462880 _____ (Microsoft Corporation) C:\WINDOWS\system32\aepic.dll
2018-10-09 23:51 - 2018-09-07 23:59 - 000433664 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\rdbss.sys
2018-10-09 23:51 - 2018-09-07 23:59 - 000361544 _____ (Microsoft Corporation) C:\WINDOWS\system32\Windows.Storage.ApplicationData.dll
2018-10-09 23:51 - 2018-09-07 23:58 - 000744976 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\fvevol.sys
2018-10-09 23:51 - 2018-09-07 23:58 - 000376120 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\fastfat.sys
2018-10-09 23:51 - 2018-09-07 23:58 - 000368440 _____ (Microsoft Corporation) C:\WINDOWS\system32\thumbcache.dll
2018-10-09 23:51 - 2018-09-07 23:57 - 002571128 _____ (Microsoft Corporation) C:\WINDOWS\system32\KernelBase.dll
2018-10-09 23:51 - 2018-09-07 23:57 - 001016984 _____ (Microsoft Corporation) C:\WINDOWS\system32\ucrtbase.dll
2018-10-09 23:51 - 2018-09-07 23:57 - 000930616 _____ (Microsoft Corporation) C:\WINDOWS\system32\WWAHost.exe
2018-10-09 23:51 - 2018-09-07 23:57 - 000482384 _____ (Microsoft Corporation) C:\WINDOWS\system32\ucrtbase_enclave.dll
2018-10-09 23:51 - 2018-09-07 23:57 - 000368448 _____ (Microsoft Corporation) C:\WINDOWS\system32\sechost.dll
2018-10-09 23:51 - 2018-09-07 23:57 - 000267576 _____ (Microsoft Corporation) C:\WINDOWS\system32\browserbroker.dll
2018-10-09 23:51 - 2018-09-07 23:51 - 000380728 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\aepic.dll
2018-10-09 23:51 - 2018-09-07 23:45 - 000295416 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\thumbcache.dll
2018-10-09 23:51 - 2018-09-07 23:45 - 000286824 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\Windows.Storage.ApplicationData.dll
2018-10-09 23:51 - 2018-09-07 23:44 - 001980984 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\KernelBase.dll
2018-10-09 23:51 - 2018-09-07 23:44 - 000829752 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\WWAHost.exe
2018-10-09 23:51 - 2018-09-07 23:43 - 001174448 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\ucrtbase.dll
2018-10-09 23:51 - 2018-09-07 23:43 - 000269104 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\sechost.dll
2018-10-09 23:51 - 2018-09-07 23:32 - 000025600 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\Dumpstorport.sys
2018-10-09 23:51 - 2018-09-07 23:31 - 000342528 _____ (Microsoft Corporation) C:\WINDOWS\system32\browserexport.exe
2018-10-09 23:51 - 2018-09-07 23:31 - 000272384 _____ (Microsoft Corporation) C:\WINDOWS\system32\Microsoft.Bluetooth.Proxy.dll
2018-10-09 23:51 - 2018-09-07 23:30 - 003601920 _____ (Microsoft Corporation) C:\WINDOWS\system32\Microsoft.Bluetooth.Service.dll
2018-10-09 23:51 - 2018-09-07 23:30 - 000189440 _____ (Microsoft Corporation) C:\WINDOWS\system32\BluetoothApis.dll
2018-10-09 23:51 - 2018-09-07 23:30 - 000137728 _____ (Microsoft Corporation) C:\WINDOWS\system32\InputLocaleManager.dll
2018-10-09 23:51 - 2018-09-07 23:30 - 000115200 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\hidbth.sys
2018-10-09 23:51 - 2018-09-07 23:30 - 000101888 _____ (Microsoft Corporation) C:\WINDOWS\system32\BthRadioMedia.dll
2018-10-09 23:51 - 2018-09-07 23:29 - 004771840 _____ (Microsoft Corporation) C:\WINDOWS\system32\InputService.dll
2018-10-09 23:51 - 2018-09-07 23:29 - 000358912 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\exfat.sys
2018-10-09 23:51 - 2018-09-07 23:29 - 000241152 _____ (Microsoft Corporation) C:\WINDOWS\system32\HttpsDataSource.dll
2018-10-09 23:51 - 2018-09-07 23:29 - 000183808 _____ (Microsoft Corporation) C:\WINDOWS\system32\bthserv.dll
2018-10-09 23:51 - 2018-09-07 23:29 - 000174080 _____ (Microsoft Corporation) C:\WINDOWS\system32\wuuhosdeployment.dll
2018-10-09 23:51 - 2018-09-07 23:28 - 000481280 _____ (Microsoft Corporation) C:\WINDOWS\system32\ngccredprov.dll
2018-10-09 23:51 - 2018-09-07 23:28 - 000473088 _____ (Microsoft Corporation) C:\WINDOWS\system32\schannel.dll
2018-10-09 23:51 - 2018-09-07 23:28 - 000273408 _____ (Microsoft Corporation) C:\WINDOWS\system32\ubpm.dll
2018-10-09 23:51 - 2018-09-07 23:28 - 000265728 _____ (Microsoft Corporation) C:\WINDOWS\system32\psmsrv.dll
2018-10-09 23:51 - 2018-09-07 23:28 - 000153088 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\Microsoft.Bluetooth.Proxy.dll
2018-10-09 23:51 - 2018-09-07 23:27 - 003348992 _____ (Microsoft Corporation) C:\WINDOWS\system32\msftedit.dll
2018-10-09 23:51 - 2018-09-07 23:27 - 000983040 _____ (Microsoft Corporation) C:\WINDOWS\system32\wbiosrvc.dll
2018-10-09 23:51 - 2018-09-07 23:27 - 000596992 _____ (Microsoft Corporation) C:\WINDOWS\system32\TileDataRepository.dll
2018-10-09 23:51 - 2018-09-07 23:27 - 000499200 _____ (Microsoft Corporation) C:\WINDOWS\system32\winipcfile.dll
2018-10-09 23:51 - 2018-09-07 23:27 - 000301056 _____ (Microsoft Corporation) C:\WINDOWS\system32\ProximityService.dll
2018-10-09 23:51 - 2018-09-07 23:27 - 000271872 _____ (Microsoft Corporation) C:\WINDOWS\system32\dafBth.dll
2018-10-09 23:51 - 2018-09-07 23:26 - 002328064 _____ (Microsoft Corporation) C:\WINDOWS\system32\winmsipc.dll
2018-10-09 23:51 - 2018-09-07 23:26 - 000814592 _____ (Microsoft Corporation) C:\WINDOWS\system32\ieproxy.dll
2018-10-09 23:51 - 2018-09-07 23:26 - 000784896 _____ (Microsoft Corporation) C:\WINDOWS\system32\ngcsvc.dll
2018-10-09 23:51 - 2018-09-07 23:26 - 000471552 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\TileDataRepository.dll
2018-10-09 23:51 - 2018-09-07 23:26 - 000387584 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\ngccredprov.dll
2018-10-09 23:51 - 2018-09-07 23:26 - 000365568 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\ieproxy.dll
2018-10-09 23:51 - 2018-09-07 23:26 - 000359424 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\winipcfile.dll
2018-10-09 23:51 - 2018-09-07 23:26 - 000142848 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\BluetoothApis.dll
2018-10-09 23:51 - 2018-09-07 23:25 - 003553792 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\InputService.dll
2018-10-09 23:51 - 2018-09-07 23:25 - 002789376 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\msftedit.dll
2018-10-09 23:51 - 2018-09-07 23:25 - 000882688 _____ (Microsoft Corporation) C:\WINDOWS\system32\winipcsecproc.dll
2018-10-09 23:51 - 2018-09-07 23:25 - 000466432 _____ (Microsoft Corporation) C:\WINDOWS\system32\wuuhext.dll
2018-10-09 23:51 - 2018-09-07 23:25 - 000415744 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\schannel.dll
2018-10-09 23:51 - 2018-09-07 23:25 - 000341504 _____ (Microsoft Corporation) C:\WINDOWS\system32\Windows.Networking.Proximity.dll
2018-10-09 23:51 - 2018-09-07 23:24 - 001457664 _____ (Microsoft Corporation) C:\WINDOWS\system32\dosvc.dll
2018-10-09 23:51 - 2018-09-07 23:24 - 001096704 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\bthport.sys
2018-10-09 23:51 - 2018-09-07 23:24 - 000899072 _____ (Microsoft Corporation) C:\WINDOWS\system32\kerberos.dll
2018-10-09 23:51 - 2018-09-07 23:24 - 000845824 _____ (Microsoft Corporation) C:\WINDOWS\system32\fveapi.dll
2018-10-09 23:51 - 2018-09-07 23:24 - 000463360 _____ (Microsoft Corporation) C:\WINDOWS\system32\das.dll
2018-10-09 23:51 - 2018-09-07 23:23 - 001655296 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\winmsipc.dll
2018-10-09 23:51 - 2018-09-07 23:23 - 000807936 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\winipcsecproc.dll
2018-10-09 23:51 - 2018-09-07 23:23 - 000667136 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\fveapi.dll
2018-10-09 23:51 - 2018-09-07 23:23 - 000314368 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\Windows.Networking.Proximity.dll
2018-10-09 23:51 - 2018-09-07 23:22 - 000778240 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\kerberos.dll
2018-10-09 02:28 - 2018-10-09 02:28 - 000001922 _____ C:\Users\Public\Desktop\Malwarebytes.lnk
2018-10-09 02:28 - 2018-10-09 02:28 - 000000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Malwarebytes
2018-10-09 02:28 - 2018-04-26 05:36 - 000152184 _____ (Malwarebytes) C:\WINDOWS\system32\Drivers\mbae64.sys
2018-10-08 21:31 - 2016-04-28 00:53 - 000052904 _____ (Synaptics Incorporated) C:\WINDOWS\system32\Drivers\Smb_driver_Intel.sys
2018-10-08 17:36 - 2018-10-08 17:36 - 000000000 ____D C:\Users\broma_000\AppData\Local\NoxInsPackFileder
2018-10-08 17:34 - 2018-10-08 17:34 - 000000066 _____ C:\Users\broma_000\inittk.ini
2018-10-08 17:34 - 2018-10-08 17:34 - 000000045 _____ C:\Users\broma_000\nuuid.ini
2018-10-08 17:34 - 2018-10-08 17:34 - 000000041 _____ C:\Users\broma_000\inst.ini
2018-10-08 17:34 - 2018-10-08 17:34 - 000000000 ____D C:\Users\broma_000\Nox_share
2018-10-08 17:33 - 2018-10-08 17:50 - 000000000 ____D C:\Users\broma_000\vmlogs
2018-10-08 17:33 - 2018-10-08 17:50 - 000000000 ____D C:\Users\broma_000\.BigNox
2018-10-08 17:33 - 2018-10-08 17:33 - 000000918 _____ C:\Users\broma_000\Desktop\Multi-Drive.lnk
2018-10-08 17:33 - 2018-10-08 17:33 - 000000827 _____ C:\Users\broma_000\Desktop\Nox.lnk
2018-10-08 17:33 - 2018-10-08 17:33 - 000000000 ____D C:\Users\broma_000\AppData\Roaming\Microsoft\Windows\Start Menu\Nox
2018-10-08 17:33 - 2018-10-08 17:33 - 000000000 ____D C:\Program Files (x86)\Bignox
2018-10-08 17:32 - 2018-10-08 17:57 - 000000000 ____D C:\Users\broma_000\AppData\Local\Nox
2018-10-08 17:32 - 2018-10-08 17:32 - 000000000 ____D C:\Program Files\Nox
2018-10-07 15:41 - 2018-08-31 03:27 - 000178176 _____ (Microsoft Corporation) C:\WINDOWS\system32\t2embed.dll
2018-10-07 15:41 - 2018-08-31 03:27 - 000056320 _____ (Microsoft Corporation) C:\WINDOWS\system32\mf3216.dll
2018-10-07 15:41 - 2018-08-31 03:26 - 000101888 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\bowser.sys
2018-10-07 15:41 - 2018-08-31 03:25 - 000270336 _____ (Microsoft Corporation) C:\WINDOWS\system32\spp.dll
2018-10-07 15:41 - 2018-08-31 03:24 - 001127936 _____ (Microsoft Corporation) C:\WINDOWS\system32\nettrace.dll
2018-10-07 15:41 - 2018-08-31 03:24 - 000482304 _____ (Microsoft Corporation) C:\WINDOWS\system32\srcore.dll
2018-10-07 15:41 - 2018-08-31 03:23 - 000765440 _____ (Microsoft Corporation) C:\WINDOWS\system32\tdh.dll
2018-10-07 15:41 - 2018-08-31 03:22 - 001661440 _____ (Microsoft Corporation) C:\WINDOWS\system32\GdiPlus.dll
2018-10-07 15:41 - 2018-08-31 02:41 - 000138752 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\t2embed.dll
2018-10-07 15:41 - 2018-08-31 02:41 - 000043008 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\mf3216.dll
2018-10-07 15:41 - 2018-08-31 02:40 - 000216576 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\spp.dll
2018-10-07 15:41 - 2018-08-31 02:37 - 000622080 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\tdh.dll
2018-10-07 15:41 - 2018-08-31 02:36 - 001469952 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\GdiPlus.dll
2018-10-07 15:41 - 2018-08-30 23:43 - 000722880 _____ (Microsoft Corporation) C:\WINDOWS\system32\ci.dll
2018-10-07 15:41 - 2018-08-30 23:42 - 000632296 _____ (Microsoft Corporation) C:\WINDOWS\system32\dpx.dll
2018-10-07 15:41 - 2018-08-30 23:42 - 000527328 _____ (Microsoft Corporation) C:\WINDOWS\system32\hal.dll
2018-10-07 15:41 - 2018-08-30 23:42 - 000155112 _____ (Microsoft Corporation) C:\WINDOWS\system32\gdi32.dll
2018-10-07 15:41 - 2018-08-30 23:28 - 000453104 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\dpx.dll
2018-10-07 15:41 - 2018-08-30 23:28 - 000134936 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\gdi32.dll
2018-10-07 15:41 - 2018-08-30 23:15 - 003392512 _____ (Microsoft Corporation) C:\WINDOWS\system32\tquery.dll
2018-10-07 15:41 - 2018-08-30 23:15 - 000395776 _____ (Microsoft Corporation) C:\WINDOWS\system32\Search.ProtocolHandler.MAPI2.dll
2018-10-07 15:41 - 2018-08-30 23:15 - 000075776 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\mpsdrv.sys
2018-10-07 15:41 - 2018-08-30 23:14 - 002700288 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\tquery.dll
2018-10-07 15:41 - 2018-08-30 23:14 - 000898560 _____ (Microsoft Corporation) C:\WINDOWS\system32\WpcWebFilter.dll
2018-10-07 15:41 - 2018-08-30 23:13 - 002738688 _____ (Microsoft Corporation) C:\WINDOWS\system32\mssrch.dll
2018-10-07 15:41 - 2018-08-30 23:13 - 000402432 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\ks.sys
2018-10-07 15:41 - 2018-08-30 23:12 - 000736256 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\srv2.sys
2018-10-07 15:41 - 2018-08-30 23:11 - 001854976 _____ (Microsoft Corporation) C:\WINDOWS\system32\wevtsvc.dll
2018-10-07 15:41 - 2018-08-30 23:11 - 001057792 _____ (Microsoft Corporation) C:\WINDOWS\system32\SearchIndexer.exe
2018-10-07 15:41 - 2018-08-30 23:11 - 000796672 _____ (Microsoft Corporation) C:\WINDOWS\system32\mssvp.dll
2018-10-07 15:41 - 2018-08-30 23:11 - 000406528 _____ (Microsoft Corporation) C:\WINDOWS\system32\SearchProtocolHost.exe
2018-10-07 15:41 - 2018-08-30 23:10 - 000889344 _____ (Microsoft Corporation) C:\WINDOWS\system32\schedsvc.dll
2018-10-07 15:41 - 2018-08-30 23:10 - 000176640 _____ (Microsoft Corporation) C:\WINDOWS\system32\mssph.dll
2018-10-07 15:41 - 2018-08-30 23:09 - 002258944 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\mssrch.dll
2018-10-07 15:41 - 2018-08-30 23:08 - 000619520 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\WpcWebFilter.dll
2018-10-07 15:41 - 2018-08-30 23:07 - 000856064 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\SearchIndexer.exe
2018-10-07 15:41 - 2018-08-30 23:07 - 000735744 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\mssvp.dll
2018-10-07 15:41 - 2018-08-30 23:06 - 000345088 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\SearchProtocolHost.exe
2018-10-07 15:41 - 2018-08-28 03:17 - 023862784 _____ (Microsoft Corporation) C:\WINDOWS\system32\Hydrogen.dll
2018-10-07 15:41 - 2018-08-28 02:49 - 000677376 _____ (Microsoft Corporation) C:\WINDOWS\system32\HeadTrackerStorage.dll
2018-10-07 15:41 - 2018-08-28 02:48 - 001274368 _____ (Microsoft Corporation) C:\WINDOWS\system32\HoloSI.PCShell.dll
2018-10-07 15:41 - 2018-08-28 02:45 - 000713216 _____ (Microsoft Corporation) C:\WINDOWS\system32\SharedRealitySvc.dll
2018-10-07 15:41 - 2018-08-13 22:14 - 001311744 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\msjet40.dll
2018-10-07 15:41 - 2018-08-13 22:14 - 000340480 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\msexcl40.dll
2018-10-07 15:41 - 2018-08-09 05:32 - 004527680 _____ (Microsoft Corporation) C:\WINDOWS\system32\sppsvc.exe
2018-10-07 15:41 - 2018-08-09 05:31 - 001617728 _____ (Microsoft Corporation) C:\WINDOWS\system32\sppobjs.dll
2018-10-07 15:41 - 2018-08-09 05:31 - 000766872 _____ (Microsoft Corporation) C:\WINDOWS\system32\LicensingWinRT.dll
2018-10-07 15:41 - 2018-08-09 05:31 - 000253544 _____ (Microsoft Corporation) C:\WINDOWS\system32\sppwinob.dll
2018-10-07 15:41 - 2018-08-09 05:31 - 000236624 _____ (Microsoft Corporation) C:\WINDOWS\system32\EditionUpgradeManagerObj.dll
2018-10-07 15:41 - 2018-08-09 05:17 - 000064000 _____ (Microsoft Corporation) C:\WINDOWS\system32\iemigplugin.dll
2018-10-07 15:41 - 2018-08-09 05:16 - 004491264 _____ (Microsoft Corporation) C:\WINDOWS\system32\xpsrchvw.exe
2018-10-07 15:41 - 2018-08-09 05:14 - 012709376 _____ (Microsoft Corporation) C:\WINDOWS\system32\ieframe.dll
2018-10-07 15:41 - 2018-08-09 05:14 - 000466944 _____ (Microsoft Corporation) C:\WINDOWS\system32\DscCore.dll
2018-10-07 15:41 - 2018-08-09 05:14 - 000326144 _____ (Microsoft Corporation) C:\WINDOWS\system32\CertEnrollUI.dll
2018-10-07 15:41 - 2018-08-09 05:13 - 000517120 _____ (Microsoft Corporation) C:\WINDOWS\system32\certreq.exe
2018-10-07 15:41 - 2018-08-09 05:13 - 000340992 _____ (Microsoft Corporation) C:\WINDOWS\system32\AcGenral.dll
2018-10-07 15:41 - 2018-08-09 05:12 - 002084864 _____ (Microsoft Corporation) C:\WINDOWS\system32\inetcpl.cpl
2018-10-07 15:41 - 2018-08-09 05:12 - 000221184 _____ (Microsoft Corporation) C:\WINDOWS\system32\ie4uinit.exe
2018-10-07 15:41 - 2018-08-09 05:11 - 000181248 _____ (Microsoft Corporation) C:\WINDOWS\system32\EditionUpgradeHelper.dll
2018-10-07 15:41 - 2018-08-09 05:10 - 001557504 _____ (Microsoft Corporation) C:\WINDOWS\system32\certutil.exe
2018-10-07 15:41 - 2018-08-09 05:10 - 000757248 _____ (Microsoft Corporation) C:\WINDOWS\system32\msfeeds.dll
2018-10-07 15:41 - 2018-08-09 05:09 - 000217088 _____ (Microsoft Corporation) C:\WINDOWS\system32\dinput8.dll
2018-10-07 15:41 - 2018-08-09 05:09 - 000165376 _____ (Microsoft Corporation) C:\WINDOWS\system32\dinput.dll
2018-10-07 15:41 - 2018-08-09 04:36 - 000660896 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\LicensingWinRT.dll
2018-10-07 15:41 - 2018-08-09 04:36 - 000221120 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\EditionUpgradeManagerObj.dll
2018-10-07 15:41 - 2018-08-09 04:24 - 011901952 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\ieframe.dll
2018-10-07 15:41 - 2018-08-09 04:24 - 000131072 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\fdeploy.dll
2018-10-07 15:41 - 2018-08-09 04:23 - 003397632 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\xpsrchvw.exe
2018-10-07 15:41 - 2018-08-09 04:23 - 000291328 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\CertEnrollUI.dll
2018-10-07 15:41 - 2018-08-09 04:22 - 000668160 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\msfeeds.dll
2018-10-07 15:41 - 2018-08-09 04:22 - 000429568 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\certreq.exe
2018-10-07 15:41 - 2018-08-09 04:21 - 002016768 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\inetcpl.cpl
2018-10-07 15:41 - 2018-08-09 04:21 - 001274368 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\certutil.exe
2018-10-07 15:41 - 2018-08-09 04:20 - 002401792 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\AcGenral.dll
2018-10-07 15:41 - 2018-08-09 04:20 - 000178688 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\dinput8.dll
2018-10-07 15:41 - 2018-08-09 04:20 - 000138752 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\dinput.dll
2018-10-07 15:41 - 2018-08-09 01:01 - 000777400 _____ (Microsoft Corporation) C:\WINDOWS\system32\pkeyhelper.dll
2018-10-07 15:41 - 2018-08-09 00:55 - 000230304 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\tpm.sys
2018-10-07 15:41 - 2018-08-09 00:54 - 000375704 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\pci.sys
2018-10-07 15:41 - 2018-08-09 00:54 - 000203568 _____ (Microsoft Corporation) C:\WINDOWS\system32\rsaenh.dll
2018-10-07 15:41 - 2018-08-09 00:53 - 001947720 _____ (Microsoft Corporation) C:\WINDOWS\system32\ntdll.dll
2018-10-07 15:41 - 2018-08-09 00:53 - 001026456 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\http.sys
2018-10-07 15:41 - 2018-08-09 00:53 - 000125600 _____ (Microsoft Corporation) C:\WINDOWS\system32\cryptxml.dll
2018-10-07 15:41 - 2018-08-09 00:30 - 000183992 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\rsaenh.dll
2018-10-07 15:41 - 2018-08-09 00:29 - 001620880 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\ntdll.dll
2018-10-07 15:41 - 2018-08-09 00:29 - 000099208 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\cryptxml.dll
2018-10-07 15:41 - 2018-08-09 00:28 - 001589248 _____ (Microsoft Corporation) C:\WINDOWS\system32\Windows.Globalization.dll
2018-10-07 15:41 - 2018-08-09 00:27 - 000117248 _____ (Microsoft Corporation) C:\WINDOWS\system32\eShims.dll
2018-10-07 15:41 - 2018-08-09 00:27 - 000051200 _____ (Microsoft Corporation) C:\WINDOWS\system32\CertEnrollCtrl.exe
2018-10-07 15:41 - 2018-08-09 00:26 - 000990720 _____ (Microsoft Corporation) C:\WINDOWS\system32\IKEEXT.DLL
2018-10-07 15:41 - 2018-08-09 00:26 - 000572416 _____ (Microsoft Corporation) C:\WINDOWS\system32\Windows.Networking.UX.EapRequestHandler.dll
2018-10-07 15:41 - 2018-08-09 00:26 - 000528384 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\nwifi.sys
2018-10-07 15:41 - 2018-08-09 00:26 - 000238592 _____ (Microsoft Corporation) C:\WINDOWS\system32\TtlsAuth.dll
2018-10-07 15:41 - 2018-08-09 00:25 - 000797184 _____ (Microsoft Corporation) C:\WINDOWS\system32\certca.dll
2018-10-07 15:41 - 2018-08-09 00:25 - 000460288 _____ (Microsoft Corporation) C:\WINDOWS\system32\certcli.dll
2018-10-07 15:41 - 2018-08-09 00:25 - 000392704 _____ (Microsoft Corporation) C:\WINDOWS\system32\WaaSMedicSvc.dll
2018-10-07 15:41 - 2018-08-09 00:25 - 000145408 _____ (Microsoft Corporation) C:\WINDOWS\system32\updatepolicy.dll
2018-10-07 15:41 - 2018-08-09 00:23 - 003148288 _____ (Microsoft Corporation) C:\WINDOWS\system32\CertEnroll.dll
2018-10-07 15:41 - 2018-08-09 00:23 - 000916992 _____ (Microsoft Corporation) C:\WINDOWS\system32\wuapi.dll
2018-10-07 15:41 - 2018-08-09 00:22 - 001586176 _____ (Microsoft Corporation) C:\WINDOWS\system32\ieapfltr.dll
2018-10-07 15:41 - 2018-08-09 00:22 - 000316928 _____ (Microsoft Corporation) C:\WINDOWS\system32\GlobCollationHost.dll
2018-10-07 15:41 - 2018-08-09 00:13 - 001189376 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\Windows.Globalization.dll
2018-10-07 15:41 - 2018-08-09 00:13 - 000042496 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\CertEnrollCtrl.exe
2018-10-07 15:41 - 2018-08-09 00:12 - 000652288 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\certca.dll
2018-10-07 15:41 - 2018-08-09 00:11 - 000350208 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\certcli.dll
2018-10-07 15:41 - 2018-08-09 00:11 - 000178176 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\TtlsAuth.dll
2018-10-07 15:41 - 2018-08-09 00:11 - 000122368 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\updatepolicy.dll
2018-10-07 15:41 - 2018-08-09 00:10 - 002893824 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\CertEnroll.dll
2018-10-07 15:41 - 2018-08-09 00:10 - 000835584 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\wuapi.dll
2018-10-07 15:41 - 2018-08-09 00:09 - 001466368 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\ieapfltr.dll
2018-10-07 15:41 - 2018-08-09 00:08 - 000195584 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\GlobCollationHost.dll
2018-10-07 15:41 - 2018-08-08 23:08 - 000806416 _____ C:\WINDOWS\SysWOW64\locale.nls
2018-10-07 15:41 - 2018-08-08 23:08 - 000806416 _____ C:\WINDOWS\system32\locale.nls
2018-10-07 15:40 - 2018-08-31 03:25 - 000266752 _____ (Microsoft Corporation) C:\WINDOWS\system32\rstrui.exe
2018-10-07 15:40 - 2018-08-30 23:17 - 000144384 _____ (Microsoft Corporation) C:\WINDOWS\system32\mssprxy.dll
2018-10-07 15:40 - 2018-08-30 23:17 - 000020480 _____ (Microsoft Corporation) C:\WINDOWS\system32\netevent.dll
2018-10-07 15:40 - 2018-08-30 23:12 - 000020480 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\netevent.dll
2018-10-07 15:40 - 2018-08-30 23:10 - 000288768 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\Search.ProtocolHandler.MAPI2.dll
2018-10-07 15:40 - 2018-08-09 05:14 - 000158720 _____ (Microsoft Corporation) C:\WINDOWS\system32\fdeploy.dll
2018-10-07 15:40 - 2018-08-09 05:13 - 000223232 _____ (Microsoft Corporation) C:\WINDOWS\system32\TtlsExt.dll
2018-10-07 15:40 - 2018-08-09 00:26 - 000221184 _____ (Microsoft Corporation) C:\WINDOWS\system32\TtlsCfg.dll
2018-10-07 15:40 - 2018-08-09 00:11 - 000164864 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\TtlsCfg.dll
2018-10-07 03:22 - 2018-10-07 03:22 - 000000000 ____D C:\ProgramData\Synaptics
2018-10-07 03:19 - 2018-10-07 03:19 - 000003080 _____ C:\WINDOWS\System32\Tasks\Synaptics TouchPad Enhancements
2018-10-07 03:19 - 2018-10-07 03:19 - 000000000 ____D C:\Program Files\Synaptics
2018-10-07 02:56 - 2018-09-04 19:04 - 000835144 _____ (Adobe Systems Incorporated) C:\WINDOWS\SysWOW64\FlashPlayerApp.exe
2018-10-07 02:56 - 2018-09-04 19:04 - 000179808 _____ (Adobe Systems Incorporated) C:\WINDOWS\SysWOW64\FlashPlayerCPLApp.cpl
2018-10-07 02:52 - 2018-10-07 03:07 - 000000000 ____D C:\Users\broma_000\AppData\Roaming\Wireshark
2018-10-07 01:04 - 2018-10-10 19:28 - 123207680 _____ C:\WINDOWS\system32\config\SOFTWARE
2018-10-07 00:56 - 2018-10-07 01:04 - 000000000 ____D C:\WINDOWS\Microsoft Antimalware
2018-10-06 22:45 - 2018-09-19 23:32 - 000195888 _____ (Microsoft Corporation) C:\WINDOWS\system32\msvcp140_2.dll
2018-10-06 22:45 - 2018-09-19 23:32 - 000032048 _____ (Microsoft Corporation) C:\WINDOWS\system32\msvcp140_1.dll
2018-10-06 21:30 - 2018-10-06 21:30 - 000000000 ____D C:\Users\broma_000\AppData\Roaming\VS Revo Group
2018-10-06 20:24 - 2018-10-06 20:24 - 000004770 _____ C:\Users\broma_000\Desktop\RK2.txt
2018-10-06 20:22 - 2018-10-06 20:22 - 000387265 _____ C:\Users\broma_000\Desktop\RK1.html
2018-10-06 20:22 - 2018-10-06 20:22 - 000004734 _____ C:\Users\broma_000\Desktop\RK.txt
2018-10-06 02:08 - 2018-10-09 21:54 - 000004210 _____ C:\WINDOWS\System32\Tasks\CCleaner Update
2018-10-06 02:08 - 2018-10-07 03:06 - 000000000 ____D C:\Users\broma_000\Desktop\executedprogramslist
2018-10-06 01:58 - 2018-10-06 01:58 - 000028272 _____ C:\WINDOWS\system32\Drivers\TrueSight.sys
2018-10-06 01:48 - 2018-10-06 01:48 - 000001829 _____ C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Wireshark.lnk
2018-10-06 01:47 - 2018-10-06 01:48 - 000000000 ____D C:\Program Files\USBPcap
2018-10-06 01:46 - 2018-10-06 01:48 - 000000000 ____D C:\Program Files\Wireshark
2018-10-06 01:41 - 2018-10-06 01:41 - 000034851 _____ C:\ProgramData\dm.uninstall.1538804475.bdinstall.bin
2018-10-06 01:18 - 2018-10-06 01:18 - 000255928 _____ (Malwarebytes) C:\WINDOWS\system32\Drivers\411FE285.sys
2018-10-03 15:00 - 2018-10-03 15:00 - 000000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\WinPcap
2018-10-03 15:00 - 2018-10-03 15:00 - 000000000 ____D C:\Program Files (x86)\WinPcap
2018-10-03 14:59 - 2018-10-03 14:59 - 000003017 _____ C:\Users\broma_000\Desktop\Suricata 4.0.5-1-32bit IDS-IPS.lnk
2018-10-03 14:59 - 2018-10-03 14:59 - 000000000 ____D C:\Users\broma_000\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Suricata
2018-10-03 14:59 - 2018-10-03 14:59 - 000000000 ____D C:\Program Files (x86)\Suricata
2018-10-02 21:23 - 2018-10-02 21:24 - 000000000 ____D C:\Users\broma_000\AppData\Local\Deployment
2018-09-29 19:00 - 2018-09-29 19:00 - 000059794 _____ C:\ProgramData\dm.1538262028.bdinstall.bin
2018-09-29 19:00 - 2018-09-29 19:00 - 000000000 ____D C:\Users\broma_000\AppData\Roaming\Bitdefender
2018-09-28 23:31 - 2018-09-28 23:31 - 000000000 ____D C:\Users\broma_000\Desktop\mpv-x86_64-20180916-git-6eb59fe
2018-09-28 23:29 - 2018-09-28 23:29 - 000000000 ____D C:\Users\broma_000\Desktop\mpv-x86_64-20180731
2018-09-27 22:36 - 2018-09-27 22:36 - 000001389 _____ C:\Users\Public\Desktop\Skype.lnk
2018-09-27 22:36 - 2018-09-27 22:36 - 000000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Skype
2018-09-27 19:58 - 2018-09-27 19:58 - 000052009 _____ C:\Users\broma_000\Documents\Thank you for your payment - NYC CityPay _ City of New York.pdf
2018-09-26 21:18 - 2018-09-26 21:18 - 000000000 ____D C:\Users\broma_000\AppData\Roaming\Opera Software
2018-09-25 23:24 - 2018-09-25 23:24 - 000000000 ____D C:\Users\broma_000\AppData\Local\Cylance
2018-09-25 23:23 - 2018-10-10 19:18 - 002979386 _____ C:\WINDOWS\CyProtect.cache
2018-09-25 23:23 - 2018-09-25 23:23 - 000000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Cylance
2018-09-25 23:23 - 2018-09-25 23:23 - 000000000 ____D C:\ProgramData\Cylance
2018-09-25 23:23 - 2018-09-25 23:23 - 000000000 ____D C:\Program Files\Cylance
2018-09-25 23:23 - 2018-06-21 21:16 - 000203800 _____ (Cylance, Inc.) C:\WINDOWS\system32\Drivers\CyProtectDrv64.sys
2018-09-25 23:01 - 2018-09-25 23:22 - 145245616 _____ (Cylance, Inc.) C:\Users\broma_000\Documents\CylanceProtectSetup.exe
2018-09-25 22:39 - 2018-09-25 22:39 - 000183770 _____ C:\ProgramData\cl.uninstall.1537929522.bdinstall.bin
 
==================== One Month Modified files and folders ========
 
(If an entry is included in the fixlist, the file/folder will be moved.)
 
2018-10-10 19:38 - 2014-12-09 00:34 - 000000000 ____D C:\FRST
2018-10-10 19:35 - 2018-05-11 20:47 - 001965698 _____ C:\WINDOWS\system32\PerfStringBackup.INI
2018-10-10 19:35 - 2018-05-11 18:52 - 000829696 _____ C:\WINDOWS\system32\perfh019.dat
2018-10-10 19:35 - 2018-05-11 18:52 - 000175462 _____ C:\WINDOWS\system32\perfc019.dat
2018-10-10 19:35 - 2018-04-11 19:36 - 000000000 ____D C:\WINDOWS\INF
2018-10-10 19:29 - 2018-05-11 20:41 - 005121040 _____ C:\WINDOWS\system32\FNTCACHE.DAT
2018-10-10 19:28 - 2018-04-11 17:04 - 001310720 _____ C:\WINDOWS\system32\config\BBI
2018-10-10 19:27 - 2018-05-11 21:07 - 000000006 ____H C:\WINDOWS\Tasks\SA.DAT
2018-10-10 19:10 - 2018-05-11 20:41 - 000000000 ____D C:\WINDOWS\system32\SleepStudy
2018-10-10 02:10 - 2012-10-23 22:18 - 000000000 ____D C:\Program Files (x86)\Adobe
2018-10-10 02:07 - 2012-10-23 22:16 - 000000000 ____D C:\ProgramData\Adobe
2018-10-10 02:06 - 2018-04-11 19:38 - 000000000 ____D C:\WINDOWS\AppReadiness
2018-10-10 02:06 - 2018-04-11 19:38 - 000000000 ____D C:\ProgramData\regid.1991-06.com.microsoft
2018-10-10 00:41 - 2018-04-11 19:38 - 000000000 ____D C:\WINDOWS\system32\NDF
2018-10-10 00:41 - 2015-11-24 01:06 - 000000000 ___RD C:\Users\broma_000\3D Objects
2018-10-10 00:41 - 2013-03-15 22:24 - 000000000 __RHD C:\Users\Public\AccountPictures
2018-10-10 00:40 - 2018-05-11 20:45 - 000000000 ____D C:\Intel
2018-10-10 00:38 - 2018-04-11 19:38 - 000000000 ___RD C:\WINDOWS\ImmersiveControlPanel
2018-10-10 00:38 - 2018-04-11 19:38 - 000000000 ___RD C:\Program Files\Windows Defender
2018-10-10 00:38 - 2018-04-11 19:38 - 000000000 ____D C:\WINDOWS\TextInput
2018-10-10 00:38 - 2018-04-11 19:38 - 000000000 ____D C:\WINDOWS\system32\ShellExperiences
2018-10-10 00:38 - 2018-04-11 19:38 - 000000000 ____D C:\WINDOWS\bcastdvr
2018-10-10 00:38 - 2018-04-11 19:38 - 000000000 ____D C:\Program Files (x86)\Windows Defender
2018-10-10 00:02 - 2018-02-19 20:38 - 000000600 _____ C:\Users\broma_000\AppData\Local\PUTTY.RND
2018-10-09 23:57 - 2018-04-11 19:30 - 000000000 ____D C:\WINDOWS\CbsTemp
2018-10-08 18:27 - 2018-05-12 00:40 - 000000000 ____D C:\Windows.old
2018-10-08 17:51 - 2014-08-22 23:37 - 000000000 ____D C:\Users\broma_000\.android
2018-10-08 17:34 - 2018-05-11 20:48 - 000000000 ____D C:\Users\broma_000
2018-10-08 17:33 - 2018-04-11 19:38 - 000000000 ____D C:\WINDOWS\Registration
2018-10-07 22:17 - 2017-06-24 23:43 - 000000000 ____D C:\Users\broma_000\Ubiquiti UniFi
2018-10-07 20:04 - 2018-04-11 19:38 - 000000000 ____D C:\WINDOWS\system32\WinBioPlugIns
2018-10-07 19:46 - 2017-03-06 02:54 - 000003902 _____ C:\Users\broma_000\Desktop\Rkill.txt
2018-10-07 19:14 - 2018-04-11 19:38 - 000000000 ____D C:\WINDOWS\SysWOW64\Dism
2018-10-07 19:14 - 2018-04-11 19:38 - 000000000 ____D C:\WINDOWS\system32\oobe
2018-10-07 19:14 - 2018-04-11 17:04 - 000000000 ____D C:\WINDOWS\system32\Dism
2018-10-07 19:11 - 2013-08-22 09:25 - 000000167 _____ C:\WINDOWS\win.ini
2018-10-07 15:37 - 2018-05-11 21:07 - 000003362 _____ C:\WINDOWS\System32\Tasks\User_Feed_Synchronization-{B000433B-7E62-4CEB-8985-C26030689D7E}
2018-10-07 15:37 - 2016-10-04 20:29 - 000000000 ____D C:\WINDOWS\system32\MpEngineStore
2018-10-07 15:37 - 2013-07-13 19:56 - 000000000 ____D C:\WINDOWS\system32\MRT
2018-10-07 15:32 - 2013-03-15 17:43 - 139184408 ____C (Microsoft Corporation) C:\WINDOWS\system32\MRT.exe
2018-10-07 03:06 - 2015-10-13 18:32 - 000000000 ____D C:\Users\broma_000\AppData\Local\Spotify
2018-10-07 03:06 - 2015-10-13 18:31 - 000000000 ____D C:\Users\broma_000\AppData\Roaming\Spotify
2018-10-06 21:25 - 2014-12-14 04:08 - 000007624 _____ C:\Users\broma_000\AppData\Local\Resmon.ResmonCfg
2018-10-06 21:05 - 2013-03-15 19:12 - 000000000 ____D C:\Program Files (x86)\TeamViewer
2018-10-06 20:53 - 2018-05-07 23:53 - 000000000 ____D C:\Program Files\CCleaner
2018-10-06 20:52 - 2017-05-14 03:52 - 000000000 ____D C:\Users\broma_000\AppData\Roaming\IObit
2018-10-06 02:22 - 2018-04-11 19:38 - 000000000 ____D C:\WINDOWS\system32\Macromed
2018-10-06 02:14 - 2018-04-11 19:38 - 000000000 ____D C:\WINDOWS\SysWOW64\Macromed
2018-10-06 01:58 - 2017-05-14 03:53 - 000000000 ____D C:\ProgramData\IObit
2018-10-06 01:50 - 2017-03-06 02:59 - 000000000 ____D C:\Users\broma_000\Desktop\mbar
2018-10-06 01:50 - 2017-03-06 02:59 - 000000000 ____D C:\ProgramData\Malwarebytes' Anti-Malware (portable)
2018-10-06 01:21 - 2018-05-06 20:34 - 000000000 ____D C:\WINDOWS\system32\Drivers\wd
2018-10-06 01:18 - 2018-04-20 22:01 - 000000000 ____D C:\ProgramData\Malwarebytes
2018-10-06 01:18 - 2018-04-11 17:04 - 000065536 _____ C:\WINDOWS\system32\config\ELAM
2018-10-04 22:27 - 2018-05-13 20:43 - 000000000 ____D C:\Users\broma_000\AppData\Roaming\qBittorrent
2018-10-02 01:58 - 2013-03-16 20:13 - 000000000 ____D C:\Users\broma_000\AppData\Local\CrashDumps
2018-10-01 01:35 - 2015-03-05 22:26 - 000000000 ____D C:\Fraps
2018-09-30 21:07 - 2017-03-02 02:53 - 000000000 ____D C:\Users\broma_000\Desktop\RKBatchTool v1.7
2018-09-30 20:41 - 2017-03-02 02:46 - 000000000 ____D C:\Users\broma_000\Desktop\DriverAssitant_v4.4
2018-09-30 20:40 - 2016-11-12 22:47 - 000000000 ____D C:\Users\broma_000\Desktop\blackbird_v0.9.98_64
2018-09-30 01:51 - 2013-03-15 17:33 - 000000000 ____D C:\Program Files (x86)\FileHippo.com
2018-09-29 23:25 - 2018-04-11 19:38 - 000000000 ___HD C:\Program Files\WindowsApps
2018-09-29 21:10 - 2013-03-15 15:30 - 000000000 ____D C:\Users\broma_000\AppData\Local\Bandizip
2018-09-29 19:28 - 2018-05-11 17:15 - 000000000 ___DC C:\WINDOWS\Panther
2018-09-29 19:28 - 2013-08-23 15:07 - 000000000 ____D C:\Users\broma_000\AppData\Roaming\TeamViewer
2018-09-29 19:26 - 2017-10-29 05:25 - 000000000 ____D C:\Users\broma_000\AppData\Local\Packages
2018-09-29 19:25 - 2017-03-04 17:43 - 000000000 ____D C:\Users\broma_000\AppData\LocalLow\Mozilla
2018-09-29 19:01 - 2013-09-08 05:44 - 000000000 ____D C:\Users\broma_000\AppData\LocalLow\Temp
2018-09-27 22:36 - 2015-12-11 02:11 - 000000000 ___RD C:\Program Files (x86)\Skype
2018-09-27 22:36 - 2013-03-19 16:49 - 000000000 ____D C:\ProgramData\Skype
2018-09-27 22:35 - 2013-03-19 16:49 - 000000000 ____D C:\Users\broma_000\AppData\Roaming\Skype
2018-09-26 21:18 - 2018-07-05 14:20 - 000000000 ____D C:\Users\broma_000\Desktop\Opera
2018-09-26 18:24 - 2017-11-02 23:56 - 000000000 ____D C:\Users\broma_000\AppData\Local\PlaceholderTileLogoFolder
2018-09-25 23:23 - 2013-01-30 14:21 - 000000000 ____D C:\ProgramData\Package Cache
2018-09-25 23:00 - 2016-05-30 15:11 - 000002305 _____ C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Google Chrome.lnk
2018-09-25 23:00 - 2016-05-30 15:11 - 000002264 _____ C:\Users\Public\Desktop\Google Chrome.lnk
2018-09-25 23:00 - 2015-03-16 16:57 - 000563832 ____N (Microsoft Corporation) C:\WINDOWS\system32\MpSigStub.exe
2018-09-25 22:46 - 2018-04-11 19:38 - 000000000 ____D C:\WINDOWS\ELAMBKUP
2018-09-25 22:44 - 2018-04-11 19:38 - 000000000 ___SD C:\WINDOWS\SysWOW64\F12
2018-09-25 22:44 - 2018-04-11 19:38 - 000000000 ___SD C:\WINDOWS\system32\UNP
2018-09-25 22:44 - 2018-04-11 19:38 - 000000000 ___SD C:\WINDOWS\system32\F12
2018-09-25 22:44 - 2018-04-11 19:38 - 000000000 ___SD C:\WINDOWS\system32\DiagSvcs
2018-09-25 22:44 - 2018-04-11 19:38 - 000000000 ___RD C:\WINDOWS\PrintDialog
2018-09-25 22:44 - 2018-04-11 19:38 - 000000000 ____D C:\WINDOWS\ShellExperiences
2018-09-25 22:39 - 2018-04-21 23:03 - 000014305 _____ C:\bdlog.txt
 
==================== Files in the root of some directories =======
 
2016-10-02 00:17 - 2016-10-02 00:17 - 000000259 _____ () C:\ProgramData\fontcacheev1.dat
2013-03-15 14:33 - 2014-03-22 17:21 - 000043128 _____ () C:\Users\broma_000\AppData\Roaming\AbsoluteReminder.xml
2013-03-15 17:23 - 2013-05-08 21:23 - 000000096 _____ () C:\Users\broma_000\AppData\Roaming\Camdata.ini
2013-03-15 17:23 - 2013-05-08 21:23 - 000000408 _____ () C:\Users\broma_000\AppData\Roaming\CamLayout.ini
2013-03-15 17:23 - 2013-05-08 21:23 - 000000408 _____ () C:\Users\broma_000\AppData\Roaming\CamShapes.ini
2013-03-15 17:23 - 2013-05-08 21:23 - 000004520 _____ () C:\Users\broma_000\AppData\Roaming\CamStudio.cfg
2018-03-07 05:38 - 2018-03-20 13:39 - 000000600 _____ () C:\Users\broma_000\AppData\Roaming\winscp.rnd
2013-06-26 14:33 - 2013-06-26 14:33 - 000000037 ___SH () C:\Users\broma_000\AppData\Local\70149b02515b3bb20dd492.47983420
2014-12-24 17:37 - 2014-12-24 17:37 - 000001456 _____ () C:\Users\broma_000\AppData\Local\Adobe Save for Web 13.0 Prefs
2018-09-28 20:48 - 2018-09-28 20:48 - 000000000 _____ () C:\Users\broma_000\AppData\Local\oobelibMkey.log
2018-02-19 20:38 - 2018-10-10 00:02 - 000000600 _____ () C:\Users\broma_000\AppData\Local\PUTTY.RND
2014-12-14 04:08 - 2018-10-06 21:25 - 000007624 _____ () C:\Users\broma_000\AppData\Local\Resmon.ResmonCfg
2014-03-22 17:22 - 2014-03-22 17:22 - 006274864 _____ (Absolute Software Corp.) C:\Users\broma_000\AppData\Local\Setup.exe
2013-03-15 18:42 - 2013-03-15 18:46 - 000027024 _____ () C:\Users\broma_000\AppData\Local\WiDiSetupLog.20130315.184213.txt
2013-06-27 21:01 - 2013-06-27 21:07 - 000036914 _____ () C:\Users\broma_000\AppData\Local\WiDiSetupLog.20130627.210108.wdl
2013-12-11 17:31 - 2013-12-11 17:31 - 000015459 _____ () C:\Users\broma_000\AppData\Local\WiDiSetupLog.20131211.163127.wdl
 
Some files in TEMP:
====================
2018-10-06 01:47 - 2018-08-02 23:38 - 001945792 _____ (Microsoft Corporation) C:\Users\broma_000\AppData\Local\Temp\dllnt_dump.dll
2018-10-07 22:10 - 2018-10-07 22:10 - 000450560 ____N () C:\Users\broma_000\AppData\Local\Temp\snappy-1.1.4-4f1428ff-a623-45ec-aa86-aba994d71733-snappyjava.dll
 
Some zero byte size files/folders:
==========================
C:\Windows\System32\mfc120jpn.dll
 
==================== Bamital & volsnap ======================
 
(There is no automatic fix for files that do not pass verification.)
 
C:\WINDOWS\system32\winlogon.exe => File is digitally signed
C:\WINDOWS\system32\wininit.exe => File is digitally signed
C:\WINDOWS\explorer.exe => File is digitally signed
C:\WINDOWS\SysWOW64\explorer.exe => File is digitally signed
C:\WINDOWS\system32\svchost.exe => File is digitally signed
C:\WINDOWS\SysWOW64\svchost.exe => File is digitally signed
C:\WINDOWS\system32\services.exe => File is digitally signed
C:\WINDOWS\system32\User32.dll => File is digitally signed
C:\WINDOWS\SysWOW64\User32.dll => File is digitally signed
C:\WINDOWS\system32\userinit.exe => File is digitally signed
C:\WINDOWS\SysWOW64\userinit.exe => File is digitally signed
C:\WINDOWS\system32\rpcss.dll => File is digitally signed
C:\WINDOWS\system32\dnsapi.dll => File is digitally signed
C:\WINDOWS\SysWOW64\dnsapi.dll => File is digitally signed
C:\WINDOWS\system32\Drivers\volsnap.sys => File is digitally signed
 
LastRegBack: 2018-05-11 20:41
 
==================== End of FRST.txt ============================

Additional scan result of Farbar Recovery Scan Tool (x64) Version: 10.10.2018
Ran by Brian (10-10-2018 19:39:15)
Running from C:\Users\broma_000\Desktop
Windows 10 Home Version 1803 17134.345 (X64) (2018-05-12 01:08:39)
Boot Mode: Safe Mode (with Networking)
==========================================================
 
 
==================== Accounts: =============================
 
Administrator (S-1-5-21-4254226789-487654737-2996639702-500 - Administrator - Disabled)
Brian (S-1-5-21-4254226789-487654737-2996639702-1001 - Administrator - Enabled) => C:\Users\broma_000
DefaultAccount (S-1-5-21-4254226789-487654737-2996639702-503 - Limited - Disabled)
Guest (S-1-5-21-4254226789-487654737-2996639702-501 - Limited - Disabled)
HomeGroupUser$ (S-1-5-21-4254226789-487654737-2996639702-1009 - Limited - Enabled)
User (S-1-5-21-4254226789-487654737-2996639702-1019 - Limited - Enabled) => C:\Users\User
WDAGUtilityAccount (S-1-5-21-4254226789-487654737-2996639702-504 - Limited - Disabled)
 
==================== Security Center ========================
 
(If an entry is included in the fixlist, it will be removed.)
 
AV: CylancePROTECT (Enabled - Up to date) {B0D0C4F4-7F0B-0434-B825-1213C45DAE01}
AV: Windows Defender (Disabled - Up to date) {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
AS: Windows Defender (Disabled - Up to date) {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
AS: CylancePROTECT (Enabled - Up to date) {0BB12510-5931-0BBA-8295-2961BFDAE4BC}
 
==================== Installed Programs ======================
 
(Only the adware programs with "Hidden" flag could be added to the fixlist to unhide them. The adware programs should be uninstalled manually.)
 
Acrylic Wi-Fi Home v3.1 (HKU\S-1-5-21-4254226789-487654737-2996639702-1001\...\{3706FB7A-11FB-44C4-AD94-2B29878D75DC}_is1) (Version: 3.1 - Tarlogic Security S.L.)
Adobe AIR (HKLM-x32\...\Adobe AIR) (Version: 25.0.0.134 - Adobe Systems Incorporated)
Adobe Creative Cloud (HKLM-x32\...\Adobe Creative Cloud) (Version: 4.4.1.298 - Adobe Systems Incorporated)
Adobe Media Encoder CC 2018 (HKLM-x32\...\AME_12_0_0) (Version: 12.0.0 - Adobe Systems Incorporated)
Adobe Photoshop CC 2018 (HKLM-x32\...\PHSP_19_1_2) (Version: 19.1.2 - Adobe Systems Incorporated)
Adobe Premiere Pro CC 2018 (HKLM-x32\...\PPRO_12_0_0) (Version: 12.0.0 - Adobe Systems Incorporated)
Adobe Shockwave Player 12.2 (HKLM-x32\...\Adobe Shockwave Player) (Version: 12.2.9.199 - Adobe Systems, Inc.)
AirDroid 3.0.0 (HKLM-x32\...\AirDroid) (Version: 3.0.0 - Sand Studio)
Apple Application Support (32-bit) (HKLM-x32\...\{E5347310-C82F-4833-AA36-8D11E5A8A86A}) (Version: 6.6 - Apple Inc.)
Apple Application Support (64-bit) (HKLM\...\{D745E014-74DD-43A3-98DF-E7D38164B681}) (Version: 6.6 - Apple Inc.)
Apple Mobile Device Support (HKLM\...\{C29B636B-9015-4ED1-A12F-6375A337F23B}) (Version: 11.4.1.46 - Apple Inc.)
Apple Software Update (HKLM-x32\...\{A30EA700-5515-48F0-88B0-9E99DC356B88}) (Version: 2.6.0.1 - Apple Inc.)
Audacity 2.2.1 (HKLM-x32\...\Audacity_is1) (Version: 2.2.1 - Audacity Team)
AVIGenerator2.0 2.0.0.4 (HKLM-x32\...\AVIGenerator2.0) (Version: 2.0.0.4 - )
Bandizip (HKLM\...\Bandizip) (Version: 6.16 - Bandisoft.com)
CCleaner (HKLM\...\CCleaner) (Version: 5.46 - Piriform)
ChromecastApp (HKU\S-1-5-21-4254226789-487654737-2996639702-1001\...\{079ede36-133d-44b0-8053-c7c1fa8d2e0d}_is1) (Version: 1.5.1693.0 - Google Inc.)
Cylance Smart Antivirus (HKLM\...\{2E64FC5C-9286-4A31-916B-0D8AE4B22954}) (Version: 2.0.1483.7 - Cylance, Inc.) Hidden
Cylance Smart Antivirus (HKLM-x32\...\{e501278d-fed7-465d-b7d2-3f4fa966eeda}) (Version: 2.0.1483.7 - Cylance, Inc.)
D3DX10 (HKLM-x32\...\{E09C4DB7-630C-4F06-A631-8EA7239923AF}) (Version: 15.4.2368.0902 - Microsoft) Hidden
Etcher 1.3.1 (only current user) (HKU\S-1-5-21-4254226789-487654737-2996639702-1001\...\573339af-d9e1-5dd3-804c-e0162fac1f41) (Version: 1.3.1 - Resin Inc.)
FileHippo App Manager (HKLM-x32\...\FileHippo.com) (Version:  - FileHippo.com)
GlassWire 2.0 (remove only) (HKLM-x32\...\GlassWire 2.0) (Version: 2.0.123 - SecureMix LLC)
Google Chrome (HKLM-x32\...\Google Chrome) (Version: 69.0.3497.100 - Google Inc.)
Google Update Helper (HKLM-x32\...\{60EC980A-BDA2-4CB6-A427-B07A5498B4CA}) (Version: 1.3.33.17 - Google Inc.) Hidden
Herramientas de corrección de Microsoft Office 2016: español (HKLM\...\{90160000-001F-0C0A-1000-0000000FF1CE}) (Version: 16.0.4266.1001 - Microsoft Corporation) Hidden
HP Connected Music (Meridian - player) (HKU\S-1-5-21-4254226789-487654737-2996639702-1001\...\HPConnectedMusic) (Version: 1.1 (build 112) hp - Meridian Audio Ltd)
HP PC Hardware Diagnostics Windows (HKLM-x32\...\{BD2CDEAF-8D83-4553-A3B3-8B614CC6C96E}) (Version: 1.1.0.0 - HP Inc)
HP Quick Launch (HKLM-x32\...\{77CC64F2-74CE-47D7-A4B0-5AEBA688FC69}) (Version: 3.0.5 - Hewlett-Packard Company)
HP Wireless Button Driver (HKLM-x32\...\{30B2D1D8-0A07-4B71-9553-0710C5D31E35}) (Version: 1.1.2.1 - Hewlett-Packard Company)
HTC Driver Installer (HKLM-x32\...\{4CEEE5D0-F905-4688-B9F9-ECC710507796}) (Version: 4.17.0.001 - HTC Corporation)
HTC Sync Manager (HKLM-x32\...\{231D0C79-98A6-4693-A366-36DE7D7346EC}) (Version: 3.1.69.5 - HTC)
Icecream Screen Recorder version 1.37 (HKLM-x32\...\{7ADEC622-3230-4C9A-9DCE-9BD462B74095}_is1) (Version: 1.37 - Icecream Apps)
IDT Audio (HKLM-x32\...\{E3A5A8AB-58F6-45FF-AFCB-C9AE18C05001}) (Version: 1.0.6491.0 - IDT)
Intel Media SDK DLLs 7.16.5.13 (HKLM-x32\...\libmfxsw_is1) (Version: 7.16.5.13 - )
Intel® Control Center (HKLM-x32\...\{F8A9085D-4C7A-41a9-8A77-C8998A96C421}) (Version: 1.2.1.1008 - Intel Corporation)
Intel® Management Engine Components (HKLM-x32\...\{65153EA5-8B6E-43B6-857B-C6E4FC25798A}) (Version: 8.1.0.1252 - Intel Corporation)
Intel® Processor Graphics (HKLM-x32\...\{F0E3AD40-2BBD-4360-9C76-B9AC9A5886EA}) (Version: 10.18.10.4653 - Intel Corporation)
Intel® Processor Identification Utility (HKLM-x32\...\{A92A4DB0-CD37-42D1-BE1D-603D53C24328}) (Version: 1.0.0.0 - Intel Corporation)
Intel® PROSet/Wireless Software for Bluetooth® Technology (HKLM\...\{DA2600C1-6BDF-4FD1-1211-148929CC1385}) (Version: 2.6.1211.0294 - Intel Corporation)
Intel® Rapid Start Technology (HKLM-x32\...\3D073343-CEEB-4ce7-85AC-A69A7631B5D6) (Version: 2.1.0.1002 - Intel Corporation)
Intel® SDK for OpenCL - CPU Only Runtime Package (HKLM-x32\...\{FCB3772C-B7D0-4933-B1A9-3707EBACC573}) (Version: 2.0.0.37149 - Intel Corporation)
Intel® PROSet/Wireless Software (HKLM-x32\...\{8e41467d-297e-496d-8b0f-e771b6c87c06}) (Version: 16.11.0 - Intel Corporation)
iTunes (HKLM\...\{36F365B3-05C2-455D-9D96-B73829DE046D}) (Version: 12.8.0.150 - Apple Inc.)
Java 8 Update 171 (HKLM-x32\...\{26A24AE4-039D-4CA4-87B4-2F32180171F0}) (Version: 8.0.1710.11 - Oracle Corporation)
LADSPA_plugins-win-0.4.15 (HKLM-x32\...\LADSPA_plugins-win_is1) (Version:  - Audacity Team)
LAME v3.99.3 (for Windows) (HKLM-x32\...\LAME_is1) (Version:  - )
magicJack (HKU\S-1-5-21-4254226789-487654737-2996639702-1001\...\magicJack) (Version: 4.1.7574.5297 - magicJack L.P.)
Malwarebytes version 3.5.1.2522 (HKLM\...\{35065F43-4BB2-439A-BFF7-0F1014F2E0CD}_is1) (Version: 3.5.1.2522 - Malwarebytes)
Microsoft Office Professional Plus 2016 (HKLM\...\Office16.PROPLUS) (Version: 16.0.4266.1001 - Microsoft Corporation)
Microsoft Silverlight (HKLM\...\{89F4137D-6C26-4A84-BDB8-2E5A4BB71E00}) (Version: 5.1.50907.0 - Microsoft Corporation)
Microsoft SQL Server 2005 Compact Edition [ENU] (HKLM-x32\...\{F0B430D1-B6AA-473D-9B06-AA3DD01FD0B8}) (Version: 3.1.0000 - Microsoft Corporation)
Microsoft Visual C++ 2005 Redistributable (HKLM-x32\...\{710f4c1c-cc18-4c49-8cbf-51240c89a1a2}) (Version: 8.0.61001 - Microsoft Corporation)
Microsoft Visual C++ 2005 Redistributable (HKLM-x32\...\{7299052b-02a4-4627-81f2-1818da5d550d}) (Version: 8.0.56336 - Microsoft Corporation)
Microsoft Visual C++ 2005 Redistributable (HKLM-x32\...\{837b34e3-7c30-493c-8f6a-2b0f04e2912c}) (Version: 8.0.59193 - Microsoft Corporation)
Microsoft Visual C++ 2005 Redistributable (x64) (HKLM\...\{071c9b48-7c32-4621-a0ac-3f809523288f}) (Version: 8.0.56336 - Microsoft Corporation)
Microsoft Visual C++ 2005 Redistributable (x64) (HKLM\...\{6ce5bae9-d3ca-4b99-891a-1dc6c118a5fc}) (Version: 8.0.59192 - Microsoft Corporation)
Microsoft Visual C++ 2005 Redistributable (x64) (HKLM\...\{ad8a2fa1-06e7-4b0d-927d-6e54b3d31028}) (Version: 8.0.61000 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.17 (HKLM\...\{8220EEFE-38CD-377E-8595-13398D740ACE}) (Version: 9.0.30729 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.4148 (HKLM\...\{4B6C7001-C7D6-3710-913E-5BC23FCE91E6}) (Version: 9.0.30729.4148 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.6161 (HKLM\...\{5FCE6D76-F5DC-37AB-B2B8-22AB8CEDB1D4}) (Version: 9.0.30729.6161 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.21022 (HKLM-x32\...\{FF66E9F6-83E7-3A3E-AF14-8DE9A809A6A4}) (Version: 9.0.21022 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17 (HKLM-x32\...\{9A25302D-30C0-39D9-BD6F-21E6EC160475}) (Version: 9.0.30729 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.4148 (HKLM-x32\...\{1F1C2DFC-2D24-3E06-BCB8-725134ADF989}) (Version: 9.0.30729.4148 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161 (HKLM-x32\...\{9BE518E6-ECC6-35A9-88E4-87755C07200F}) (Version: 9.0.30729.6161 - Microsoft Corporation)
Microsoft Visual C++ 2010  x64 Redistributable - 10.0.40219 (HKLM\...\{1D8E6291-B0D5-35EC-8441-6616F567A0F7}) (Version: 10.0.40219 - Microsoft Corporation)
Microsoft Visual C++ 2010  x86 Redistributable - 10.0.40219 (HKLM-x32\...\{F0C3E5D1-1ADE-321E-8167-68EF0DE699A5}) (Version: 10.0.40219 - Microsoft Corporation)
Microsoft Visual C++ 2012 Redistributable (x64) - 11.0.51106 (HKLM-x32\...\{6e8f74e0-43bd-4dce-8477-6ff6828acc07}) (Version: 11.0.51106.1 - Microsoft Corporation)
Microsoft Visual C++ 2012 Redistributable (x64) - 11.0.61030 (HKLM-x32\...\{ca67548a-5ebe-413a-b50c-4b9ceb6d66c6}) (Version: 11.0.61030.0 - Microsoft Corporation)
Microsoft Visual C++ 2012 Redistributable (x86) - 11.0.51106 (HKLM-x32\...\{8e70e4e1-06d7-470b-9f74-a51bef21088e}) (Version: 11.0.51106.1 - Microsoft Corporation)
Microsoft Visual C++ 2012 Redistributable (x86) - 11.0.61030 (HKLM-x32\...\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}) (Version: 11.0.61030.0 - Microsoft Corporation)
Microsoft Visual C++ 2013 Redistributable (x64) - 12.0.21005 (HKLM-x32\...\{7f51bdb9-ee21-49ee-94d6-90afc321780e}) (Version: 12.0.21005.1 - Microsoft Corporation)
Microsoft Visual C++ 2013 Redistributable (x64) - 12.0.30501 (HKLM-x32\...\{050d4fc8-5d48-4b8f-8972-47c82c46020f}) (Version: 12.0.30501.0 - Microsoft Corporation)
Microsoft Visual C++ 2013 Redistributable (x86) - 12.0.21005 (HKLM-x32\...\{ce085a78-074e-4823-8dc1-8a721b94b76d}) (Version: 12.0.21005.1 - Microsoft Corporation)
Microsoft Visual C++ 2013 Redistributable (x86) - 12.0.30501 (HKLM-x32\...\{f65db027-aff3-4070-886a-0d87064aabb1}) (Version: 12.0.30501.0 - Microsoft Corporation)
Microsoft Visual C++ 2017 Redistributable (x64) - 14.12.25810 (HKLM-x32\...\{e2ee15e2-a480-4bc5-bfb7-e9803d1d9823}) (Version: 14.12.25810.0 - Microsoft Corporation)
Microsoft Visual C++ 2017 Redistributable (x86) - 14.12.25810 (HKLM-x32\...\{56e11d69-7cc9-40a5-a4f9-8f6190c4d84d}) (Version: 14.12.25810.0 - Microsoft Corporation)
Microsoft Visual Studio 2010 Tools for Office Runtime (x64) (HKLM\...\Microsoft Visual Studio 2010 Tools for Office Runtime (x64)) (Version: 10.0.50903 - Microsoft Corporation)
Microsoft Xbox 360 Accessories 1.2 (HKLM\...\{D9C50188-12D5-4D3E-8F00-682346C2AA5F}) (Version: 1.20.146.0 - Microsoft)
Movie Maker (HKLM-x32\...\{38F03569-A636-4CF3-BDDE-032C8C251304}) (Version: 16.4.3528.0331 - Microsoft Corporation) Hidden
Movie Maker (HKLM-x32\...\{DD67BE4B-7E62-4215-AFA3-F123A800A389}) (Version: 16.4.3528.0331 - Microsoft Corporation) Hidden
Mozilla Firefox 60.0 (x64 en-US) (HKLM\...\Mozilla Firefox 60.0 (x64 en-US)) (Version: 60.0 - Mozilla)
Mozilla Maintenance Service (HKLM-x32\...\MozillaMaintenanceService) (Version: 60.0.0.6697 - Mozilla)
NetSpot (HKU\S-1-5-21-4254226789-487654737-2996639702-1001\...\a6e43da6e76c5494) (Version: 2.6.1.570 - Etwok LLC)
NetViewer 2.1.348.0 (HKLM-x32\...\NetViewer) (Version: 2.1.348.0 - )
NextWindow Voltron Driver 3.1.6.0.f (HKLM-x32\...\NextWindow Voltron Driver) (Version: 3.1.6.0.f - NextWindow, Ltd.)
NordVPN (HKLM-x32\...\{7B3BB796-50F9-4330-B2B9-91AF9C2C343B}) (Version: 6.14.31 - NordVPN) Hidden
NordVPN (HKLM-x32\...\NordVPN 6.14.31) (Version: 6.14.31 - NordVPN)
NordVPN network TAP (HKLM-x32\...\{97DEC5D6-2BE9-45BB-BFC5-274B851B486B}) (Version: 1.0.1 - NordVPN)
Nox APP Player (HKLM-x32\...\Nox) (Version: 6.2.3.1 - Duodian Technology Co. Ltd.)
Optimum (HKU\S-1-5-21-4254226789-487654737-2996639702-1001\...\3216476263.optimumapp.iptv.optimum.net) (Version:  - optimumapp.iptv.optimum.net)
Optimum App for Laptop 4.5 (HKLM\...\{6082AB31-92B1-4832-AC89-3B2E6D8C14FE}) (Version: 4.5 - Cablevision)
Outils de vérification linguistique 2016 de Microsoft Office - Français (HKLM\...\{90160000-001F-040C-1000-0000000FF1CE}) (Version: 16.0.4266.1001 - Microsoft Corporation) Hidden
PuTTY release 0.70 (64-bit) (HKLM\...\{45B3032F-22CC-40CD-9E97-4DA7095FA5A2}) (Version: 0.70.0.0 - Simon Tatham)
qBittorrent 4.1.2 (HKLM-x32\...\qBittorrent) (Version: 4.1.2 - The qBittorrent project)
Realtek Ethernet Controller Driver (HKLM-x32\...\{8833FFB6-5B0C-4764-81AA-06DFEED9A476}) (Version: 8.3.730.2012 - Realtek)
Realtek PCIE Card Reader (HKLM-x32\...\{C1594429-8296-4652-BF54-9DBE4932A44C}) (Version: 6.2.9200.29038 - Realtek Semiconductor Corp.)
Recuva (HKLM\...\Recuva) (Version: 1.52 - Piriform)
rekordbox 3.2.0 (HKLM-x32\...\Pioneer rekordbox 3.2.0) (Version: 3.2.0.3059 - Pioneer)
Revo Uninstaller Pro 3.2.1 (HKLM\...\{67579783-0FB7-4F7B-B881-E5BE47C9DBE0}_is1) (Version: 3.2.1 - VS Revo Group, Ltd.)
Samsung Magician (HKLM-x32\...\{29AE3F9F-7158-4ca7-B1ED-28A73ECDB215}_is1) (Version: 5.0.0.790 - Samsung Electronics)
SeaTools for Windows 1.4.0.4 (HKLM-x32\...\SeaTools for Windows) (Version: 1.4.0.4 - Seagate Technology)
Secunia PSI (3.0.0.11005) (HKLM-x32\...\Secunia PSI) (Version: 3.0.0.11005 - Secunia)
Skype version 8.30 (HKLM-x32\...\Skype_is1) (Version: 8.30 - Skype Technologies S.A.)
Spotify (HKU\S-1-5-21-4254226789-487654737-2996639702-1001\...\Spotify) (Version: 1.0.54.1079.g3809528e - Spotify AB)
SSD Tweaker version 3.7.0 (HKLM-x32\...\{83FA601A-241A-4956-8A21-F7D525C4422F}_is1) (Version: 3.7.0 - Elpamsoft.com)
SSDlife for Ultrabook (HKLM-x32\...\{4D60B699-9788-46B3-A4D1-28236E1B6EFE}) (Version: 2.5.82 - BinarySense Inc.)
Stardock Fences 3 (HKLM-x32\...\Stardock Fences 3) (Version: 3.09 - Stardock Software, Inc.)
Suricata IDS/IPS 4.0.5-1-32bit (HKLM-x32\...\{42AB4288-8940-4B7D-97E2-75901A1D188F}) (Version: 4.0.5 - Open Information Security Foundation)
Synaptics ClickPad Driver (HKLM\...\SynTPDeinstKey) (Version: 19.0.12.98 - Synaptics Incorporated)
System Requirements Lab (HKLM-x32\...\{A92D0DBB-834A-4CAD-A434-F2232C692516}) (Version: 6.1.4.0 - Husdawg, LLC)
System Requirements Lab Detection (HKLM-x32\...\{B2F60CE5-240E-465D-92A9-0394EAF227A1}) (Version: 6.1.6.0 - Husdawg, LLC)
Tag&Rename 3.8 (HKLM-x32\...\Tag&Rename_is1) (Version: 3.8 - Softpointer Inc)
TAP-NordVPN 9.21.2 (HKLM\...\TAP-NordVPN) (Version: 9.21.2 - NordVPN.com)
TeamViewer 13 (HKLM-x32\...\TeamViewer) (Version: 13.2.5287 - TeamViewer)
Ubiquiti UniFi (remove only) (HKLM-x32\...\Ubiquiti UniFi) (Version:  - )
UnCleaner (HKLM\...\UnCleaner) (Version: 1.7 - Josh Cell Softwares Corporation)
Universal Adb Driver (HKLM-x32\...\{C0E08D8D-6076-4117-B644-2AF34F35B757}) (Version: 1.0.4 - ClockworkMod)
Update for Skype for Business 2016 (KB4032255) 64-Bit Edition (HKLM\...\{90160000-0011-0000-1000-0000000FF1CE}_Office16.PROPLUS_{053B38B6-9400-4CCD-BD0C-95E28A4D5BC4}) (Version:  - Microsoft)
Update for Skype for Business 2016 (KB4032255) 64-Bit Edition (HKLM\...\{90160000-00C1-0000-1000-0000000FF1CE}_Office16.PROPLUS_{053B38B6-9400-4CCD-BD0C-95E28A4D5BC4}) (Version:  - Microsoft)
Update for Skype for Business 2016 (KB4032255) 64-Bit Edition (HKLM\...\{90160000-012B-0409-1000-0000000FF1CE}_Office16.PROPLUS_{053B38B6-9400-4CCD-BD0C-95E28A4D5BC4}) (Version:  - Microsoft)
USB_Burning_Tool (HKLM-x32\...\{0F91E44C-2FAD-4298-8051-40E52C7E1341}_is1) (Version: 1.0.96 - Amlogic, Inc.)
USBPcap 1.2.0.4 (HKLM\...\USBPcap) (Version: 1.2.0.4 - Tomasz Mon)
VC80CRTRedist - 8.0.50727.6195 (HKLM-x32\...\{933B4015-4618-4716-A828-5289FC03165F}) (Version: 1.2.0 - DivX, Inc) Hidden
WinDirStat 1.1.2 (HKU\S-1-5-21-4254226789-487654737-2996639702-1001\...\WinDirStat) (Version:  - )
Windows 10 Upgrade Assistant (HKLM-x32\...\{D5C69738-B486-402E-85AC-2456D98A64E4}) (Version: 1.4.9200.17384 - Microsoft Corporation)
Windows Driver Package - Intel Corporation (iagpioe) System  (05/21/2015 604.10120.2652.361) (HKLM\...\AF9226384B030787C4D0F761A23F48F7649D6D17) (Version: 05/21/2015 604.10120.2652.361 - Intel Corporation)
Windows Driver Package - Intel Corporation (iai2ce) System  (06/30/2015 604.10146.2643.2818) (HKLM\...\42CFE5B10021C15BFC08687E1D339C8BB3D32DDA) (Version: 06/30/2015 604.10146.2643.2818 - Intel Corporation)
Windows Driver Package - Intel Corporation (iauarte) System  (05/21/2015 604.10120.2653.391) (HKLM\...\1D4FF76A05A14FF5BA3636A41E0AB237F3A55E14) (Version: 05/21/2015 604.10120.2653.391 - Intel Corporation)
Windows Driver Package - NextWindow (NWVoltron) HIDClass  (06/23/2011 3.1.6.0) (HKLM\...\1A85AC5851A15316E49DEB3A05005DC569B79E59) (Version: 06/23/2011 3.1.6.0 - NextWindow)
Windows Driver Package - NextWindow (NWVoltron) HIDClass  (10/06/2011 3.1.12.0) (HKLM\...\ABDE90E097F508DE8C34ABA7FB81AFFE04432AFA) (Version: 10/06/2011 3.1.12.0 - NextWindow)
Windows Live Essentials (HKLM-x32\...\WinLiveSuite) (Version: 16.4.3528.0331 - Microsoft Corporation)
WinPcap 4.1.3 (HKLM-x32\...\WinPcapInst) (Version: 4.1.0.2980 - Riverbed Technology, Inc.)
Wireshark 2.6.3 64-bit (HKLM-x32\...\Wireshark) (Version: 2.6.3 - The Wireshark developer community, hxxps://www.wireshark.org)
 
==================== Custom CLSID (Whitelisted): ==========================
 
(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)
 
CustomCLSID: HKU\S-1-5-21-4254226789-487654737-2996639702-1001_Classes\CLSID\{00020420-0000-0000-C000-000000000046}\InprocServer32 -> C:\WINDOWS\system32\oleaut32.dll (Microsoft Corporation)
CustomCLSID: HKU\S-1-5-21-4254226789-487654737-2996639702-1001_Classes\CLSID\{00020421-0000-0000-C000-000000000046}\InprocServer32 -> C:\WINDOWS\system32\oleaut32.dll (Microsoft Corporation)
CustomCLSID: HKU\S-1-5-21-4254226789-487654737-2996639702-1001_Classes\CLSID\{00020422-0000-0000-C000-000000000046}\InprocServer32 -> C:\WINDOWS\system32\oleaut32.dll (Microsoft Corporation)
CustomCLSID: HKU\S-1-5-21-4254226789-487654737-2996639702-1001_Classes\CLSID\{00020423-0000-0000-C000-000000000046}\InprocServer32 -> C:\WINDOWS\system32\oleaut32.dll (Microsoft Corporation)
CustomCLSID: HKU\S-1-5-21-4254226789-487654737-2996639702-1001_Classes\CLSID\{00020424-0000-0000-C000-000000000046}\InprocServer32 -> C:\WINDOWS\system32\oleaut32.dll (Microsoft Corporation)
CustomCLSID: HKU\S-1-5-21-4254226789-487654737-2996639702-1001_Classes\CLSID\{00020425-0000-0000-C000-000000000046}\InprocServer32 -> C:\WINDOWS\system32\oleaut32.dll (Microsoft Corporation)
CustomCLSID: HKU\S-1-5-21-4254226789-487654737-2996639702-1001_Classes\CLSID\{5B69A6B4-393B-459C-8EBB-214237A9E7AC}\InprocServer32 -> C:\Users\broma_000\AppData\Local\Bandizip\bdzshl64.dll (Bandisoft.com)
CustomCLSID: HKU\S-1-5-21-4254226789-487654737-2996639702-1001_Classes\CLSID\{820D63D5-8CFF-46DE-86AF-4997DEDD6DB5}\localserver32 -> C:\WINDOWS\system32\igfxEM.exe (Intel Corporation)
CustomCLSID: HKU\S-1-5-21-4254226789-487654737-2996639702-1001_Classes\CLSID\{9219263a-9853-40d3-b3f0-081c35780302}\InprocServer32 -> C:\WINDOWS\system32\dfshim.dll (Microsoft Corporation)
CustomCLSID: HKU\S-1-5-21-4254226789-487654737-2996639702-1001_Classes\CLSID\{e8c77137-e224-5791-b6e9-ff0305797a13}\InprocServer32 -> C:\Program Files (x86)\Adobe\Adobe Creative Cloud\Utils\npAdobeAAMDetect64.dll (Adobe Systems)
CustomCLSID: HKU\S-1-5-21-4254226789-487654737-2996639702-1001_Classes\CLSID\{E8CF3E55-F919-49D9-ABC0-948E6CB34B9F}\InprocServer32 -> C:\Users\broma_000\AppData\Local\Google\Update\1.3.33.17\psuser_64.dll (Google Inc.)
CustomCLSID: HKU\S-1-5-21-4254226789-487654737-2996639702-1001_Classes\CLSID\{EA724FD3-844D-43A9-A8C9-A5BC35FC20E4}\InprocServer32 -> C:\Users\broma_000\AppData\Local\Google\Update\1.3.33.17\psuser_64.dll (Google Inc.)
ShellIconOverlayIdentifiers: [   AccExtIco1] -> {AB9CF9F8-8A96-4F9D-BF21-CE85714C3A47} => C:\Program Files (x86)\Common Files\Adobe\CoreSyncExtension\CoreSync_x64.dll [2018-02-10] ()
ShellIconOverlayIdentifiers: [   AccExtIco2] -> {853B7E05-C47D-4985-909A-D0DC5C6D7303} => C:\Program Files (x86)\Common Files\Adobe\CoreSyncExtension\CoreSync_x64.dll [2018-02-10] ()
ShellIconOverlayIdentifiers: [   AccExtIco3] -> {42D38F2E-98E9-4382-B546-E24E4D6D04BB} => C:\Program Files (x86)\Common Files\Adobe\CoreSyncExtension\CoreSync_x64.dll [2018-02-10] ()
ShellIconOverlayIdentifiers: [EldosIconOverlay] -> {5BB532A2-BF14-4CCC-86B7-71B81EF6F8BC} => C:\WINDOWS\system32\CbFsMntNtf3.dll [2012-04-09] (EldoS Corporation)
ShellIconOverlayIdentifiers-x32: [EldosIconOverlay] -> {5BB532A2-BF14-4CCC-86B7-71B81EF6F8BC} => C:\WINDOWS\system32\CbFsMntNtf3.dll [2012-04-09] (EldoS Corporation)
ContextMenuHandlers1: [AABdzCtx] -> {5B69A6B4-393B-459C-8EBB-214237A9E7AC} => C:\Users\broma_000\AppData\Local\Bandizip\bdzshl64.dll [2018-09-29] (Bandisoft.com)
ContextMenuHandlers1: [AccExt] -> {2A118EB5-5797-4F5E-8B3D-F4ECBA3C98E4} => C:\Program Files (x86)\Common Files\Adobe\CoreSyncExtension\CoreSync_x64.dll [2018-02-10] ()
ContextMenuHandlers1: [FencesShellExt] -> {1984DD45-52CF-49cd-AB77-18F378FEA264} => C:\Program Files (x86)\Stardock\Fences\FencesMenu64.dll [2018-05-25] (Stardock)
ContextMenuHandlers1: [TagRenameShellExt] -> {B806EC81-446D-40C8-A955-315B8519E938} => C:\Program Files (x86)\TagRename\TRShell64.dll [2014-06-03] (Sofpointer Inc)
ContextMenuHandlers2: [AABdzCtx] -> {5B69A6B4-393B-459C-8EBB-214237A9E7AC} => C:\Users\broma_000\AppData\Local\Bandizip\bdzshl64.dll [2018-09-29] (Bandisoft.com)
ContextMenuHandlers4: [AABdzCtx] -> {5B69A6B4-393B-459C-8EBB-214237A9E7AC} => C:\Users\broma_000\AppData\Local\Bandizip\bdzshl64.dll [2018-09-29] (Bandisoft.com)
ContextMenuHandlers4: [FencesShellExt] -> {1984DD45-52CF-49cd-AB77-18F378FEA264} => C:\Program Files (x86)\Stardock\Fences\FencesMenu64.dll [2018-05-25] (Stardock)
ContextMenuHandlers4: [RecuvaShellExt] -> {435E5DF5-2510-463C-B223-BDA47006D002} => C:\Program Files\Recuva\RecuvaShell64.dll [2014-03-14] (Piriform Ltd)
ContextMenuHandlers5: [AABdzCtx] -> {5B69A6B4-393B-459C-8EBB-214237A9E7AC} => C:\Users\broma_000\AppData\Local\Bandizip\bdzshl64.dll [2018-09-29] (Bandisoft.com)
ContextMenuHandlers5: [FencesShellExt] -> {1984DD45-52CF-49cd-AB77-18F378FEA264} => C:\Program Files (x86)\Stardock\Fences\FencesMenu64.dll [2018-05-25] (Stardock)
ContextMenuHandlers5: [igfxDTCM] -> {9B5F5829-A529-4B12-814A-E81BCB8D93FC} => C:\WINDOWS\system32\igfxDTCM.dll [2017-04-24] (Intel Corporation)
ContextMenuHandlers5: [igfxOSP] -> {FA507C3F-30C6-4DCA-9EE5-2656072EEC14} => C:\WINDOWS\system32\igfxOSP.dll [2017-04-24] (Intel Corporation)
ContextMenuHandlers6: [AccExt] -> {2A118EB5-5797-4F5E-8B3D-F4ECBA3C98E4} => C:\Program Files (x86)\Common Files\Adobe\CoreSyncExtension\CoreSync_x64.dll [2018-02-10] ()
ContextMenuHandlers6: [FencesShellExt] -> {1984DD45-52CF-49cd-AB77-18F378FEA264} => C:\Program Files (x86)\Stardock\Fences\FencesMenu64.dll [2018-05-25] (Stardock)
ContextMenuHandlers6: [RecuvaShellExt] -> {435E5DF5-2510-463C-B223-BDA47006D002} => C:\Program Files\Recuva\RecuvaShell64.dll [2014-03-14] (Piriform Ltd)
ContextMenuHandlers6: [RUShellExt] -> {2C5515DC-2A7E-4BFD-B813-CACC2B685EB7} => C:\Program Files\VS Revo Group\Revo Uninstaller Pro\RUExt.dll [2012-12-29] (VS Revo Group)
ContextMenuHandlers6: [TagRenameShellExt] -> {B806EC81-446D-40C8-A955-315B8519E938} => C:\Program Files (x86)\TagRename\TRShell64.dll [2014-06-03] (Sofpointer Inc)
ContextMenuHandlers1_S-1-5-21-4254226789-487654737-2996639702-1001: [AABdzCtx] -> {5B69A6B4-393B-459C-8EBB-214237A9E7AC} => C:\Users\broma_000\AppData\Local\Bandizip\bdzshl64.dll [2018-09-29] (Bandisoft.com)
ContextMenuHandlers2_S-1-5-21-4254226789-487654737-2996639702-1001: [AABdzCtx] -> {5B69A6B4-393B-459C-8EBB-214237A9E7AC} => C:\Users\broma_000\AppData\Local\Bandizip\bdzshl64.dll [2018-09-29] (Bandisoft.com)
ContextMenuHandlers4_S-1-5-21-4254226789-487654737-2996639702-1001: [AABdzCtx] -> {5B69A6B4-393B-459C-8EBB-214237A9E7AC} => C:\Users\broma_000\AppData\Local\Bandizip\bdzshl64.dll [2018-09-29] (Bandisoft.com)
ContextMenuHandlers5_S-1-5-21-4254226789-487654737-2996639702-1001: [AABdzCtx] -> {5B69A6B4-393B-459C-8EBB-214237A9E7AC} => C:\Users\broma_000\AppData\Local\Bandizip\bdzshl64.dll [2018-09-29] (Bandisoft.com)
 
==================== Scheduled Tasks (Whitelisted) =============
 
(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)
 
Task: {00BCBEDA-FA33-43DA-99EB-81E38B8A53BC} - System32\Tasks\Norton Security\Norton Security Error Processor => C:\Program Files\Norton Security\Engine\22.12.0.104\SymErr.exe
Task: {0103A4FE-3BE8-4AD0-BAB7-FBF9B417542C} - System32\Tasks\GoogleUpdateTaskUserS-1-5-21-4254226789-487654737-2996639702-1001UA => C:\Users\broma_000\AppData\Local\Google\Update\GoogleUpdate.exe [2015-08-29] (Google Inc.)
Task: {0367B416-AA88-4E44-A7A3-55907262CBD2} - System32\Tasks\Norton Security with Backup\Norton Security Error Analyzer => C:\Program Files\Norton Security\Engine\22.14.0.54\SymErr.exe
Task: {03EBBB67-A237-44AD-8821-3D8422DF6284} - System32\Tasks\AdobeGCInvoker-1.0-BRIAN-PC-User => C:\Program Files (x86)\Common Files\Adobe\AdobeGCClient\AGCInvokerUtility.exe [2018-09-10] (Adobe Systems, Incorporated)
Task: {0998BB26-148D-4BF3-B2BE-CDE39E52C0D2} - System32\Tasks\Microsoft\Windows\PLA\System\{C36685B4-CE9E-421B-B8CC-171E1DA69732}_System Diagnostics => Command(1): C:\WINDOWS\system32\rundll32.exe -> C:\WINDOWS\system32\pla.dll,PlaHost "system\System Diagnostics" "$(Arg0)"
Task: {0998BB26-148D-4BF3-B2BE-CDE39E52C0D2} - System32\Tasks\Microsoft\Windows\PLA\System\{C36685B4-CE9E-421B-B8CC-171E1DA69732}_System Diagnostics => Command(2): C:\WINDOWS\system32\schtasks.exe -> /delete /f /tn "\Microsoft\Windows\PLA\System\{C36685B4-CE9E-421B-B8CC-171E1DA69732}_System Diagnostics"
Task: {0FFD6D1D-B473-47D3-A2B0-E0218117C0B7} - System32\Tasks\Apple\AppleSoftwareUpdate => C:\Program Files (x86)\Apple Software Update\SoftwareUpdate.exe [2018-01-08] (Apple Inc.)
Task: {125BFD6A-045C-4CC2-A976-70C4F7F456BC} - System32\Tasks\Synaptics TouchPad Enhancements => Program Files\Synaptics\SynTP\SynTPEnh.exe
Task: {17925127-3B0D-4C66-9145-43395674F216} - System32\Tasks\GoogleUpdateTaskMachineUA => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe [2016-05-30] (Google Inc.)
Task: {1D0ECDE5-9F7D-4155-9E42-B6E83D91D9A6} - System32\Tasks\Microsoft\Office\OfficeTelemetryAgentLogOn2016 => C:\Program Files\Microsoft Office\Office16\msoia.exe [2015-07-31] (Microsoft Corporation)
Task: {3B1ADA4B-6A7F-4D42-9B2E-38D33812A8D9} - System32\Tasks\Norton Security with Backup\Norton Security Error Processor => C:\Program Files\Norton Security\Engine\22.14.0.54\SymErr.exe
Task: {596F9C2D-B972-4DFF-9A91-593491207412} - System32\Tasks\Microsoft\Office\OfficeTelemetryAgentFallBack2016 => C:\Program Files\Microsoft Office\Office16\msoia.exe [2015-07-31] (Microsoft Corporation)
Task: {61EFF3CE-D0FB-48D0-94B8-1874C9BA7474} - System32\Tasks\GoogleUpdateTaskMachineCore => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe [2016-05-30] (Google Inc.)
Task: {65B85F6F-35B3-4459-A179-28255D5B7B25} - System32\Tasks\Microsoft\Windows\HelloFace\FODCleanupTask => C:\WINDOWS\System32\WinBioPlugIns\FaceFodUninstaller.exe [2018-04-11] ()
Task: {6DD0ACDE-4E9E-45C8-97BB-1F269061509F} - System32\Tasks\Microsoft\Windows\Windows Defender\Windows Defender Cache Maintenance => C:\ProgramData\Microsoft\Windows Defender\platform\4.18.1809.2-0\MpCmdRun.exe [2018-10-06] (Microsoft Corporation)
Task: {81E4A8E5-1A1F-4075-A485-207F84E80B93} - System32\Tasks\GoogleUpdateTaskUserS-1-5-21-4254226789-487654737-2996639702-1001Core => C:\Users\broma_000\AppData\Local\Google\Update\GoogleUpdate.exe [2015-08-29] (Google Inc.)
Task: {8322959E-EE17-4882-A1E8-E67951A71185} - System32\Tasks\GoogleUpdateTaskUserS-1-5-21-4254226789-487654737-2996639702-1001UA1d25a5d408b5952 => C:\Users\broma_000\AppData\Local\Google\Update\GoogleUpdate.exe [2015-08-29] (Google Inc.)
Task: {88BB366D-3BEE-43F2-B223-F67217BCEDF8} - System32\Tasks\AdobeGCInvoker-1.0-BRIAN-PC-Brian => C:\Program Files (x86)\Common Files\Adobe\AdobeGCClient\AGCInvokerUtility.exe [2018-09-10] (Adobe Systems, Incorporated)
Task: {91629CED-16DE-4674-BBA0-69C2BF0182A1} - System32\Tasks\SamsungMagician => C:\Program Files (x86)\Samsung\Samsung Magician\SamsungMagician.exe [2016-11-23] (Samsung Electronics Co. Ltd.)
Task: {9CDEE0AA-B99D-43C3-99C4-140D3A1718F8} - System32\Tasks\Norton Security with Backup\Norton Security Autofix => C:\Program Files\Norton Security\Engine\22.14.0.54\SymErr.exe
Task: {B1A038D4-13CD-493D-A798-5449F30E7FBC} - System32\Tasks\CreateExplorerShellUnelevatedTask => C:\WINDOWS\explorer.exe /NOUACCHECK
Task: {BF50FFF7-3D6B-4C14-97BE-744F0D780CE8} - System32\Tasks\GoogleUpdateTaskUserS-1-5-21-4254226789-487654737-2996639702-1001Core1d25a5d3fd632c0 => C:\Users\broma_000\AppData\Local\Google\Update\GoogleUpdate.exe [2015-08-29] (Google Inc.)
Task: {C6A09B0E-59CA-4215-9895-FA0B2A7E74D0} - System32\Tasks\Microsoft\Windows\Windows Defender\Windows Defender Verification => C:\ProgramData\Microsoft\Windows Defender\platform\4.18.1809.2-0\MpCmdRun.exe [2018-10-06] (Microsoft Corporation)
Task: {CB1F1E01-B92A-4542-AFD2-251D62E7460E} - System32\Tasks\Norton Security\Norton Security Error Analyzer => C:\Program Files\Norton Security\Engine\22.12.0.104\SymErr.exe
Task: {CE14AF82-292B-4FF9-955E-DC99579A4048} - System32\Tasks\Microsoft\Office\Office 15 Subscription Heartbeat => C:\Program Files\Common Files\Microsoft Shared\Office16\OLicenseHeartbeat.exe [2015-07-31] (Microsoft Corporation)
Task: {DDE7211B-D024-47BC-9C85-B1443D215FCA} - System32\Tasks\CCleanerSkipUAC => C:\Program Files\CCleaner\CCleaner.exe [2018-10-06] (Piriform Ltd)
Task: {DF6CC5A2-5F47-4284-ABC4-42185763BDC9} - System32\Tasks\OneDrive Standalone Update Task v2 => C:\Users\broma_000\AppData\Local\Microsoft\OneDrive\OneDriveStandaloneUpdater.exe
Task: {E2C3C3B2-2A96-4614-9E5B-7BCB8DB647E2} - System32\Tasks\Adobe Acrobat Update Task => C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe [2018-08-14] (Adobe Systems Incorporated)
Task: {E538A798-52DF-40E2-9C2C-3AFE4E49C06C} - System32\Tasks\Microsoft\Windows\Windows Defender\Windows Defender Scheduled Scan => C:\ProgramData\Microsoft\Windows Defender\platform\4.18.1809.2-0\MpCmdRun.exe [2018-10-06] (Microsoft Corporation)
Task: {ED14D991-A033-432B-901E-93F591257C97} - System32\Tasks\Microsoft\Windows\Windows Defender\Windows Defender Cleanup => C:\ProgramData\Microsoft\Windows Defender\platform\4.18.1809.2-0\MpCmdRun.exe [2018-10-06] (Microsoft Corporation)
Task: {F63150F1-0FF7-469E-B828-C11E827F890B} - System32\Tasks\S-1-5-21-4254226789-487654737-2996639702-1001\DataSenseLiveTileTask => C:\WINDOWS\System32\DataUsageLiveTileTask.exe [2018-04-11] (Microsoft Corporation)
Task: {F9957490-FADC-454A-8544-8A9570621C92} - System32\Tasks\Norton WSC Integration => C:\Program Files\Norton Security\Engine\22.14.0.54\WSCStub.exe
Task: {FA8721AB-1368-4156-9ED9-228544CC4ADA} - System32\Tasks\CCleaner Update => C:\Program Files\CCleaner\CCUpdate.exe [2018-10-06] (Piriform Ltd)
Task: {FD4484A1-7679-4C08-8F36-215C55F3A9C8} - System32\Tasks\Remediation\AntimalwareMigrationTask => C:\Program Files\Common Files\AV\Norton Security\Upgrade.exe
Task: {FFF6BD63-525B-4215-A333-9FFC4600F750} - System32\Tasks\Norton Security\Norton Security Autofix => C:\Program Files\Norton Security\Engine\22.12.0.104\SymErr.exe
 
(If an entry is included in the fixlist, the task (.job) file will be moved. The file which is running by the task will not be moved.)
 
Task: C:\WINDOWS\Tasks\CreateExplorerShellUnelevatedTask.job => C:\WINDOWS\explorer.exe
Task: C:\WINDOWS\Tasks\GoogleUpdateTaskUserS-1-5-21-4254226789-487654737-2996639702-1001Core.job => C:\Users\broma_000\AppData\Local\Google\Update\GoogleUpdate.exe
Task: C:\WINDOWS\Tasks\GoogleUpdateTaskUserS-1-5-21-4254226789-487654737-2996639702-1001UA.job => C:\Users\broma_000\AppData\Local\Google\Update\GoogleUpdate.exe
 
==================== Shortcuts & WMI ========================
 
(The entries could be listed to be restored or removed.)
 
 
ShortcutWithArgument: C:\Users\broma_000\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Google Keep - notes and lists.lnk -> C:\Program Files (x86)\Google\Chrome\Application\chrome.exe (Google Inc.) ->  --profile-directory=Default --app-id=hmjkmjkepdijhoojdojkdfohbdgmmhki
ShortcutWithArgument: C:\Users\broma_000\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Ubiquiti Device Discovery Tool.lnk -> C:\Program Files (x86)\Google\Chrome\Application\chrome.exe (Google Inc.) ->  --profile-directory=Default --app-id=hmpigflbjeapnknladcfphgkemopofig
 
==================== Loaded Modules (Whitelisted) ==============
 
2018-04-11 19:34 - 2018-04-11 19:34 - 000491744 _____ () C:\Windows\System32\InputHost.dll
2018-04-11 19:34 - 2018-04-11 19:34 - 000472064 _____ () C:\Windows\ShellExperiences\TileControl.dll
2018-04-11 19:34 - 2018-04-11 19:34 - 002759168 _____ () C:\Windows\ShellComponents\TaskFlowUI.dll
2018-02-10 01:12 - 2018-02-10 01:12 - 000614856 _____ () C:\Program Files (x86)\Common Files\Adobe\CoreSyncExtension\CoreSync_x64.dll
2017-02-22 23:56 - 2017-02-22 23:56 - 008911560 _____ () C:\Program Files\Microsoft Office\Office16\1033\GrooveIntlResource.dll
2018-10-09 23:51 - 2018-09-19 23:38 - 002185728 _____ () C:\Windows\SystemApps\Microsoft.Windows.Cortana_cw5n1h2txyewy\Cortana.Core.dll
2018-09-25 23:00 - 2018-09-15 04:26 - 005110616 _____ () C:\Program Files (x86)\Google\Chrome\Application\69.0.3497.100\libglesv2.dll
2018-09-25 23:00 - 2018-09-15 04:26 - 000116056 _____ () C:\Program Files (x86)\Google\Chrome\Application\69.0.3497.100\libegl.dll
 
==================== Alternate Data Streams (Whitelisted) =========
 
(If an entry is included in the fixlist, only the ADS will be removed.)
 
 
==================== Safe Mode (Whitelisted) ===================
 
(If an entry is included in the fixlist, it will be removed from the registry. The "AlternateShell" will be restored.)
 
HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\MBAMService => ""="Service"
HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\MBAMService => ""="Service"
HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Option => "OptionValue"="2"
 
==================== Association (Whitelisted) ===============
 
(If an entry is included in the fixlist, the registry item will be restored to default or removed.)
 
 
==================== Internet Explorer trusted/restricted ===============
 
(If an entry is included in the fixlist, it will be removed from the registry.)
 
 
==================== Hosts content: ==========================
 
(If needed Hosts: directive could be included in the fixlist to reset Hosts.)
 
2017-08-17 22:18 - 2018-09-25 22:36 - 000004603 _____ C:\WINDOWS\system32\Drivers\etc\hosts
 
0.0.0.0 a.ads1.msn.com
0.0.0.0 a.ads2.msads.net
0.0.0.0 a.ads2.msn.com
0.0.0.0 a.rad.msn.com
0.0.0.0 a-0001.a-msedge.net
0.0.0.0 a-0002.a-msedge.net
0.0.0.0 a-0003.a-msedge.net
0.0.0.0 a-0004.a-msedge.net
0.0.0.0 a-0005.a-msedge.net
0.0.0.0 a-0006.a-msedge.net
0.0.0.0 a-0007.a-msedge.net
0.0.0.0 a-0008.a-msedge.net
0.0.0.0 a-0009.a-msedge.net
0.0.0.0 ac3.msn.com
0.0.0.0 ad.doubleclick.net
0.0.0.0 adnexus.net
0.0.0.0 adnxs.com
0.0.0.0 ads.msn.com
0.0.0.0 ads1.msads.net
0.0.0.0 ads1.msn.com
0.0.0.0 aidps.atdmt.com
0.0.0.0 aka-cdn-ns.adtech.de
0.0.0.0 a-msedge.net
0.0.0.0 az361816.vo.msecnd.net
0.0.0.0 az512334.vo.msecnd.net
0.0.0.0 b.ads1.msn.com
0.0.0.0 b.ads2.msads.net
0.0.0.0 b.rad.msn.com
0.0.0.0 bs.serving-sys.com
0.0.0.0 c.atdmt.com
 
There are 77 more lines.
 
 
==================== Other Areas ============================
 
(Currently there is no automatic fix for this section.)
 
HKU\S-1-5-21-4254226789-487654737-2996639702-1001\Control Panel\Desktop\\Wallpaper -> C:\Users\broma_000\AppData\Roaming\Microsoft\Windows\Themes\TranscodedWallpaper
DNS Servers: 192.168.1.1
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System => (ConsentPromptBehaviorAdmin: 5) (ConsentPromptBehaviorUser: 3) (EnableLUA: 1)
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer => (SmartScreenEnabled: Off)
HKLM\software\microsoft\Windows\CurrentVersion\Telephony\Providers => ProviderFileName2 -> ndptsp.tsp (No File)
Windows Firewall is enabled.
 
==================== MSCONFIG/TASK MANAGER disabled items ==
 
If an entry is included in the fixlist, it will be removed.
 
MSCONFIG\Services: AdobeARMservice => 2
MSCONFIG\Services: AdobeFlashPlayerUpdateSvc => 3
MSCONFIG\Services: AdobeUpdateService => 2
MSCONFIG\Services: AGSService => 2
MSCONFIG\Services: cphs => 3
MSCONFIG\Services: ESRV_SVC_QUEENCREEK => 3
MSCONFIG\Services: gupdate => 2
MSCONFIG\Services: gupdatem => 3
MSCONFIG\Services: HitmanProScheduler => 2
MSCONFIG\Services: hpqcaslwmiex => 3
MSCONFIG\Services: hpqwmiex => 3
MSCONFIG\Services: hpsrv => 2
MSCONFIG\Services: HPSupportSolutionsFrameworkService => 2
MSCONFIG\Services: HPWMISVC => 2
MSCONFIG\Services: HTCMonitorService => 2
MSCONFIG\Services: IAStorDataMgrSvc => 2
MSCONFIG\Services: ibtsiva.exe => 2
MSCONFIG\Services: ICCS => 3
MSCONFIG\Services: IconMan_R => 2
MSCONFIG\Services: igfxCUIService1.0.0.0 => 2
MSCONFIG\Services: Intel® Capability Licensing Service Interface => 2
MSCONFIG\Services: irstrtsv => 2
MSCONFIG\Services: jhi_service => 2
MSCONFIG\Services: LMS => 2
MSCONFIG\Services: MBAMScheduler => 2
MSCONFIG\Services: MBAMService => 2
MSCONFIG\Services: MozillaMaintenance => 3
MSCONFIG\Services: PassThru Service => 2
MSCONFIG\Services: rpcapd => 3
MSCONFIG\Services: SkypeUpdate => 2
MSCONFIG\Services: SynTPEnhService => 2
MSCONFIG\Services: SystemUsageReportSvc_QUEENCREEK => 2
MSCONFIG\Services: TeamViewer => 2
MSCONFIG\Services: Unchecky => 2
MSCONFIG\Services: UNS => 2
MSCONFIG\Services: USER_ESRV_SVC_QUEENCREEK => 3
MSCONFIG\Services: XblAuthManager => 3
MSCONFIG\Services: XblGameSave => 3
MSCONFIG\Services: XboxNetApiSvc => 3
HKLM\...\StartupApproved\StartupFolder: => "iSCTsysTray.lnk"
HKLM\...\StartupApproved\StartupFolder: => "Secunia PSI Tray.lnk"
HKLM\...\StartupApproved\Run: => "SetDefault"
HKLM\...\StartupApproved\Run: => "AdobeAAMUpdater-1.0"
HKLM\...\StartupApproved\Run: => "XboxStat"
HKLM\...\StartupApproved\Run: => "TouchPalKeyboard"
HKLM\...\StartupApproved\Run: => "TouchPalToolBar"
HKLM\...\StartupApproved\Run: => "IAStorIcon"
HKLM\...\StartupApproved\Run: => "Andy"
HKLM\...\StartupApproved\Run: => "AdobeGCInvoker-1.0"
HKLM\...\StartupApproved\Run: => "CL-22-FF904622-63F5-4325-87FD-D8610D9C5EFA"
HKLM\...\StartupApproved\Run32: => "RemoteControl10"
HKLM\...\StartupApproved\Run32: => "HP Quick Launch"
HKLM\...\StartupApproved\Run32: => "Acrobat Assistant 8.0"
HKLM\...\StartupApproved\Run32: => "Adobe ARM"
HKLM\...\StartupApproved\Run32: => "SunJavaUpdateSched"
HKLM\...\StartupApproved\Run32: => "Reader Application Helper"
HKLM\...\StartupApproved\Run32: => "AdobeCS6ServiceManager"
HKLM\...\StartupApproved\Run32: => "YouCam Service"
HKLM\...\StartupApproved\Run32: => "DivXUpdate"
HKLM\...\StartupApproved\Run32: => "BlueStacks Agent"
HKLM\...\StartupApproved\Run32: => "iTunesHelper"
HKLM\...\StartupApproved\Run32: => "MessengerPlusForSkypeService"
HKLM\...\StartupApproved\Run32: => "YouCam Service6"
HKLM\...\StartupApproved\Run32: => "Adobe Creative Cloud"
HKLM\...\StartupApproved\Run32: => "WD Quick View"
HKLM\...\StartupApproved\Run32: => "DriveUtilitiesHelper"
HKLM\...\StartupApproved\Run32: => "WD Drive Unlocker"
HKLM\...\StartupApproved\Run32: => "Syncios device service"
HKLM\...\StartupApproved\Run32: => "Trend Micro RUBotted V2.0 Beta"
HKLM\...\StartupApproved\Run32: => "Sophos AutoUpdate Monitor"
HKU\S-1-5-21-4254226789-487654737-2996639702-1001\...\StartupApproved\StartupFolder: => "Facebook Messenger.lnk"
HKU\S-1-5-21-4254226789-487654737-2996639702-1001\...\StartupApproved\StartupFolder: => "Dropbox.lnk"
HKU\S-1-5-21-4254226789-487654737-2996639702-1001\...\StartupApproved\StartupFolder: => "EventGhost.lnk"
HKU\S-1-5-21-4254226789-487654737-2996639702-1001\...\StartupApproved\Run: => "Facebook Update"
HKU\S-1-5-21-4254226789-487654737-2996639702-1001\...\StartupApproved\Run: => "Steam"
HKU\S-1-5-21-4254226789-487654737-2996639702-1001\...\StartupApproved\Run: => "DAEMON Tools Ultra Agent"
HKU\S-1-5-21-4254226789-487654737-2996639702-1001\...\StartupApproved\Run: => "cdloader"
HKU\S-1-5-21-4254226789-487654737-2996639702-1001\...\StartupApproved\Run: => "ooVoo.exe"
HKU\S-1-5-21-4254226789-487654737-2996639702-1001\...\StartupApproved\Run: => "Skype"
HKU\S-1-5-21-4254226789-487654737-2996639702-1001\...\StartupApproved\Run: => "CAHeadless"
HKU\S-1-5-21-4254226789-487654737-2996639702-1001\...\StartupApproved\Run: => "msnmsgr"
HKU\S-1-5-21-4254226789-487654737-2996639702-1001\...\StartupApproved\Run: => "CCleaner Monitoring"
HKU\S-1-5-21-4254226789-487654737-2996639702-1001\...\StartupApproved\Run: => "A33370FB2F9A25C73A12ED957E6DE30584F34FC5._service_run"
HKU\S-1-5-21-4254226789-487654737-2996639702-1001\...\StartupApproved\Run: => "Google Update"
HKU\S-1-5-21-4254226789-487654737-2996639702-1001\...\StartupApproved\Run: => "GarminExpressTrayApp"
HKU\S-1-5-21-4254226789-487654737-2996639702-1001\...\StartupApproved\Run: => "Spotify"
HKU\S-1-5-21-4254226789-487654737-2996639702-1001\...\StartupApproved\Run: => "Spotify Web Helper"
HKU\S-1-5-21-4254226789-487654737-2996639702-1001\...\StartupApproved\Run: => "FileHippo.com"
HKU\S-1-5-21-4254226789-487654737-2996639702-1001\...\StartupApproved\Run: => "Adobe Acrobat Synchronizer"
HKU\S-1-5-21-4254226789-487654737-2996639702-1001\...\StartupApproved\Run: => "OneDriveSetup"
HKU\S-1-5-21-4254226789-487654737-2996639702-1001\...\StartupApproved\Run: => "NordVPN"
 
==================== FirewallRules (Whitelisted) ===============
 
(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)
 
FirewallRules: [{A9440BAC-EE97-4E95-9DE1-9ECB15257253}] => (Allow) C:\Program Files (x86)\GlassWire\GWCtlSrv.exe
FirewallRules: [{52112AE6-BD10-4E5D-A1BA-C72475CC767F}] => (Allow) C:\Program Files (x86)\GlassWire\GWCtlSrv.exe
FirewallRules: [TCP Query User{8498385A-AA65-46B7-9424-5644852B5A62}C:\program files (x86)\google\chrome\application\chrome.exe] => (Allow) C:\program files (x86)\google\chrome\application\chrome.exe
FirewallRules: [UDP Query User{3DBBDA24-AD35-4931-BC26-8E58F288AD76}C:\program files (x86)\google\chrome\application\chrome.exe] => (Allow) C:\program files (x86)\google\chrome\application\chrome.exe
FirewallRules: [TCP Query User{42A8D076-F505-4DE9-8AC1-44BB1490C585}C:\program files (x86)\google\chrome\application\chrome.exe] => (Allow) C:\program files (x86)\google\chrome\application\chrome.exe
FirewallRules: [UDP Query User{BC7311FA-9876-4886-8C9A-F5306503929B}C:\program files (x86)\google\chrome\application\chrome.exe] => (Allow) C:\program files (x86)\google\chrome\application\chrome.exe
StandardProfile\AuthorizedApplications: [C:\Program Files\River Past\Video Cleaner Pro\VideoCleaner.exe] => Enabled:River Past Video Cleaner Pro
 
==================== Restore Points =========================
 
03-10-2018 14:59:20 Installed Suricata IDS/IPS 4.0.5-1-32bit
06-10-2018 21:31:58 Removed Bonjour
07-10-2018 03:15:21 Windows Modules Installer
08-10-2018 17:16:58 Windows Modules Installer
09-10-2018 22:06:58 Windows Modules Installer
10-10-2018 02:05:44 Removed Adobe Acrobat DC.
 
==================== Faulty Device Manager Devices =============
 
Name: Intel® Display Audio
Description: Intel® Display Audio
Class Guid: {4d36e96c-e325-11ce-bfc1-08002be10318}
Manufacturer: Intel® Corporation
Service: IntcDAud
Problem: : This device is not working properly because Windows cannot load the drivers required for this device. (Code 31)
Resolution: Update the driver
 
Name: IDT High Definition Audio CODEC
Description: IDT High Definition Audio CODEC
Class Guid: {4d36e96c-e325-11ce-bfc1-08002be10318}
Manufacturer: IDT
Service: STHDA
Problem: : This device is not working properly because Windows cannot load the drivers required for this device. (Code 31)
Resolution: Update the driver
 
 
==================== Event log errors: =========================
 
Application errors:
==================
Error: (10/10/2018 07:29:22 PM) (Source: SideBySide) (EventID: 78) (User: )
Description: Activation context generation failed for "C:\Program Files (x86)\Audacity\audacity.exe".Error in manifest or policy file "" on line .
A component version required by the application conflicts with another component version already active.
Conflicting components are:.
Component 1: C:\WINDOWS\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.17134.345_none_fb429a5930656358.manifest.
Component 2: C:\WINDOWS\WinSxS\manifests\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.17134.345_none_42efd13044e18c5e.manifest.
 
Error: (10/10/2018 07:29:12 PM) (Source: SideBySide) (EventID: 78) (User: )
Description: Activation context generation failed for "C:\Program Files (x86)\Audacity\audacity.exe".Error in manifest or policy file "" on line .
A component version required by the application conflicts with another component version already active.
Conflicting components are:.
Component 1: C:\WINDOWS\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.17134.345_none_fb429a5930656358.manifest.
Component 2: C:\WINDOWS\WinSxS\manifests\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.17134.345_none_42efd13044e18c5e.manifest.
 
Error: (10/10/2018 07:26:58 PM) (Source: Software Protection Platform Service) (EventID: 16385) (User: )
Description: Failed to schedule Software Protection service for re-start at 2018-11-09T23:15:58Z. Error Code: 0x80070005.
 
Error: (10/10/2018 07:26:28 PM) (Source: Software Protection Platform Service) (EventID: 16385) (User: )
Description: Failed to schedule Software Protection service for re-start at 2018-11-09T23:15:28Z. Error Code: 0x80070005.
 
Error: (10/10/2018 07:25:58 PM) (Source: Software Protection Platform Service) (EventID: 16385) (User: )
Description: Failed to schedule Software Protection service for re-start at 2018-11-09T23:15:58Z. Error Code: 0x80070005.
 
Error: (10/10/2018 07:25:28 PM) (Source: Software Protection Platform Service) (EventID: 16385) (User: )
Description: Failed to schedule Software Protection service for re-start at 2018-11-09T23:15:28Z. Error Code: 0x80070005.
 
Error: (10/10/2018 07:24:58 PM) (Source: Software Protection Platform Service) (EventID: 16385) (User: )
Description: Failed to schedule Software Protection service for re-start at 2018-11-09T23:15:58Z. Error Code: 0x80070005.
 
Error: (10/10/2018 07:24:28 PM) (Source: Software Protection Platform Service) (EventID: 16385) (User: )
Description: Failed to schedule Software Protection service for re-start at 2018-11-09T23:15:28Z. Error Code: 0x80070005.
 
 
System errors:
=============
Error: (10/10/2018 07:39:31 PM) (Source: DCOM) (EventID: 10005) (User: NT AUTHORITY)
Description: DCOM got error "1084" attempting to start the service EventSystem with arguments "Unavailable" in order to run the server:
{1BE1F766-5536-11D1-B726-00C04FB926AF}
 
Error: (10/10/2018 07:39:26 PM) (Source: DCOM) (EventID: 10005) (User: BRIAN-PC)
Description: DCOM got error "1084" attempting to start the service ShellHWDetection with arguments "Unavailable" in order to run the server:
{DD522ACC-F821-461A-A407-50B198B896DC}
 
Error: (10/10/2018 07:39:14 PM) (Source: DCOM) (EventID: 10005) (User: BRIAN-PC)
Description: DCOM got error "1084" attempting to start the service ShellHWDetection with arguments "Unavailable" in order to run the server:
{DD522ACC-F821-461A-A407-50B198B896DC}
 
Error: (10/10/2018 07:38:57 PM) (Source: DCOM) (EventID: 10005) (User: NT AUTHORITY)
Description: DCOM got error "1084" attempting to start the service wuauserv with arguments "Unavailable" in order to run the server:
{E60687F7-01A1-40AA-86AC-DB1CBF673334}
 
Error: (10/10/2018 07:38:57 PM) (Source: DCOM) (EventID: 10005) (User: NT AUTHORITY)
Description: DCOM got error "1084" attempting to start the service wuauserv with arguments "Unavailable" in order to run the server:
{E60687F7-01A1-40AA-86AC-DB1CBF673334}
 
Error: (10/10/2018 07:38:33 PM) (Source: DCOM) (EventID: 10005) (User: BRIAN-PC)
Description: DCOM got error "1084" attempting to start the service ShellHWDetection with arguments "Unavailable" in order to run the server:
{DD522ACC-F821-461A-A407-50B198B896DC}
 
Error: (10/10/2018 07:38:16 PM) (Source: DCOM) (EventID: 10005) (User: BRIAN-PC)
Description: DCOM got error "1084" attempting to start the service ShellHWDetection with arguments "Unavailable" in order to run the server:
{DD522ACC-F821-461A-A407-50B198B896DC}
 
Error: (10/10/2018 07:38:10 PM) (Source: DCOM) (EventID: 10005) (User: BRIAN-PC)
Description: DCOM got error "1084" attempting to start the service ShellHWDetection with arguments "Unavailable" in order to run the server:
{DD522ACC-F821-461A-A407-50B198B896DC}
 
 
Windows Defender:
===================================
Date: 2018-10-09 23:50:17.416
Description: 
Windows Defender Antivirus scan has been stopped before completion.
Scan ID: {CCE86FBA-E970-4FBB-B2F4-BADE423DED0A}
Scan Type: Antimalware
Scan Parameters: Quick Scan
 
Date: 2018-10-09 23:04:30.661
Description: 
Windows Defender Antivirus scan has been stopped before completion.
Scan ID: {C9DE03F7-0723-4FC7-96E1-59B839DB0990}
Scan Type: Antimalware
Scan Parameters: Quick Scan
 
Date: 2018-10-09 22:24:05.832
Description: 
Windows Defender Antivirus scan has been stopped before completion.
Scan ID: {D7F908BC-C226-40AD-8D4B-79E54C600256}
Scan Type: Antimalware
Scan Parameters: Quick Scan
 
Date: 2018-10-07 20:16:29.022
Description: 
Windows Defender Antivirus scan has been stopped before completion.
Scan ID: {52DBF466-6B61-40CD-A7A3-4C4141A82A9B}
Scan Type: Antimalware
Scan Parameters: Quick Scan
 
Date: 2018-10-06 21:46:27.266
Description: 
Windows Defender Antivirus scan has been stopped before completion.
Scan ID: {68BD396A-89A9-45B5-8708-380E5024FA9D}
Scan Type: Antimalware
Scan Parameters: Full Scan
 
Date: 2018-10-10 19:38:57.055
Description: 
Windows Defender Antivirus has encountered an error trying to update signatures.
New Signature Version: 
Previous Signature Version: 1.277.853.0
Update Source: Microsoft Update Server
Signature Type: AntiVirus
Update Type: Full
Current Engine Version: 
Previous Engine Version: 1.1.15300.6
Error code: 0x8007043c
Error description: This service cannot be started in Safe Mode 
 
Date: 2018-10-10 19:28:54.397
Description: 
Windows Defender Antivirus Real-Time Protection feature has encountered an error and failed.
Feature: On Access
Error Code: 0x8007043c
Error description: This service cannot be started in Safe Mode 
Reason: Antimalware protection has stopped functioning for an unknown reason. In some instances, restarting the service may resolve the problem.
 
Date: 2018-10-09 22:16:55.302
Description: 
Windows Defender Antivirus has encountered an error trying to update signatures.
New Signature Version: 
Previous Signature Version: 1.277.787.0
Update Source: Microsoft Update Server
Signature Type: AntiVirus
Update Type: Full
Current Engine Version: 
Previous Engine Version: 1.1.15300.6
Error code: 0x80240438
Error description: An unexpected problem occurred while checking for updates. For information on installing or troubleshooting updates, see Help and Support. 
 
Date: 2018-10-07 03:31:48.558
Description: 
Windows Defender Antivirus has encountered an error trying to update signatures.
New Signature Version: 
Previous Signature Version: 1.277.700.0
Update Source: Microsoft Update Server
Signature Type: AntiVirus
Update Type: Full
Current Engine Version: 
Previous Engine Version: 1.1.15300.6
Error code: 0x80240438
Error description: An unexpected problem occurred while checking for updates. For information on installing or troubleshooting updates, see Help and Support. 
 
Date: 2018-10-06 21:15:52.672
Description: 
Windows Defender Antivirus has encountered an error trying to update signatures.
New Signature Version: 
Previous Signature Version: 1.277.679.0
Update Source: Microsoft Update Server
Signature Type: AntiVirus
Update Type: Full
Current Engine Version: 
Previous Engine Version: 1.1.15300.6
Error code: 0x80240438
Error description: An unexpected problem occurred while checking for updates. For information on installing or troubleshooting updates, see Help and Support. 
 
CodeIntegrity:
===================================
 
Date: 2018-10-01 01:27:13.817
Description: 
Windows is unable to verify the image integrity of the file \Device\HarddiskVolume4\Windows.old\WINDOWS\WinSxS\wow64_microsoft-windows-s..-credentialprovider_31bf3856ad364e35_10.0.16299.15_none_1057d35f60b828e4\BioCredProv.dll because file hash could not be found on the system. A recent hardware or software change might have installed a file that is signed incorrectly or damaged, or that might be malicious software from an unknown source.
 
Date: 2018-10-01 01:27:13.814
Description: 
Windows is unable to verify the image integrity of the file \Device\HarddiskVolume4\Windows.old\WINDOWS\WinSxS\wow64_microsoft-windows-s..-credentialprovider_31bf3856ad364e35_10.0.16299.15_none_1057d35f60b828e4\BioCredProv.dll because file hash could not be found on the system. A recent hardware or software change might have installed a file that is signed incorrectly or damaged, or that might be malicious software from an unknown source.
 
Date: 2018-10-01 01:27:13.812
Description: 
Windows is unable to verify the image integrity of the file \Device\HarddiskVolume4\Windows.old\WINDOWS\WinSxS\wow64_microsoft-windows-s..-credentialprovider_31bf3856ad364e35_10.0.16299.15_none_1057d35f60b828e4\BioCredProv.dll because file hash could not be found on the system. A recent hardware or software change might have installed a file that is signed incorrectly or damaged, or that might be malicious software from an unknown source.
 
Date: 2018-10-01 01:27:13.808
Description: 
Windows is unable to verify the image integrity of the file \Device\HarddiskVolume4\Windows.old\WINDOWS\WinSxS\wow64_microsoft-windows-s..-credentialprovider_31bf3856ad364e35_10.0.16299.15_none_1057d35f60b828e4\BioCredProv.dll because file hash could not be found on the system. A recent hardware or software change might have installed a file that is signed incorrectly or damaged, or that might be malicious software from an unknown source.
 
Date: 2018-10-01 01:27:01.481
Description: 
Windows is unable to verify the image integrity of the file \Device\HarddiskVolume4\Windows.old\WINDOWS\WinSxS\wow64_microsoft-windows-security-spp-clientext_31bf3856ad364e35_10.0.16299.125_none_e4bdfa665037ae02\sppcext.dll because file hash could not be found on the system. A recent hardware or software change might have installed a file that is signed incorrectly or damaged, or that might be malicious software from an unknown source.
 
Date: 2018-10-01 01:27:01.477
Description: 
Windows is unable to verify the image integrity of the file \Device\HarddiskVolume4\Windows.old\WINDOWS\WinSxS\wow64_microsoft-windows-security-spp-clientext_31bf3856ad364e35_10.0.16299.125_none_e4bdfa665037ae02\sppcext.dll because file hash could not be found on the system. A recent hardware or software change might have installed a file that is signed incorrectly or damaged, or that might be malicious software from an unknown source.
 
Date: 2018-10-01 01:27:01.473
Description: 
Windows is unable to verify the image integrity of the file \Device\HarddiskVolume4\Windows.old\WINDOWS\WinSxS\wow64_microsoft-windows-security-spp-clientext_31bf3856ad364e35_10.0.16299.125_none_e4bdfa665037ae02\sppcext.dll because file hash could not be found on the system. A recent hardware or software change might have installed a file that is signed incorrectly or damaged, or that might be malicious software from an unknown source.
 
Date: 2018-10-01 01:27:01.469
Description: 
Windows is unable to verify the image integrity of the file \Device\HarddiskVolume4\Windows.old\WINDOWS\WinSxS\wow64_microsoft-windows-security-spp-clientext_31bf3856ad364e35_10.0.16299.125_none_e4bdfa665037ae02\sppcext.dll because file hash could not be found on the system. A recent hardware or software change might have installed a file that is signed incorrectly or damaged, or that might be malicious software from an unknown source.
 
==================== Memory info =========================== 
 
Processor: Intel® Core™ i7-3517U CPU @ 1.90GHz
Percentage of memory in use: 30%
Total physical RAM: 8088.28 MB
Available physical RAM: 5644.71 MB
Total Virtual: 8984.28 MB
Available Virtual: 6583.67 MB
 
==================== Drives ================================
 
Drive c: (OS) (Fixed) (Total:442.52 GB) (Free:130.44 GB) NTFS ==>[system with boot components (obtained from drive)]
Drive d: (RECOVERY) (Fixed) (Total:21.19 GB) (Free:2.54 GB) NTFS ==>[system with boot components (obtained from drive)]
 
\\?\Volume{fa94c900-3525-4fb7-863d-c1b65aa41686}\ (WINRE) (Fixed) (Total:0.39 GB) (Free:0.16 GB) NTFS
\\?\Volume{6c269d01-0452-4fe2-bb33-5bed18212601}\ () (Fixed) (Total:0.93 GB) (Free:0.34 GB) NTFS
\\?\Volume{4ef75fc9-67b0-4504-bd8e-a3e4f2cef5b6}\ () (Fixed) (Total:0.34 GB) (Free:0.31 GB) NTFS
\\?\Volume{ed64cd91-54f7-4cc2-b935-cee25e9fb367}\ () (Fixed) (Total:0.25 GB) (Free:0.15 GB) FAT32
 
==================== MBR & Partition Table ==================
 
========================================================
Disk: 0 (Size: 465.8 GB) (Disk ID: 15180F5C)
 
Partition: GPT.
 
========================================================
Disk: 1 (Size: 8 GB) (Disk ID: FEECBF9A)
 
Partition: GPT.
 
==================== End of Addition.txt ============================


#4 broman400

broman400
  • Topic Starter

  • Members
  • 40 posts
  • OFFLINE
  •  
  • Gender:Male
  • Local time:09:42 AM

Posted 10 October 2018 - 06:45 PM

Also here is a screenshot of the error I recieved: 

 

https://imgur.com/a/FmcPXbo



#5 Oh My!

Oh My!

    Adware and Spyware and Malware.....


  • Malware Response Instructor
  • 37,724 posts
  • ONLINE
  •  
  • Gender:Male
  • Location:California
  • Local time:06:42 AM

Posted 10 October 2018 - 06:52 PM

Thank you,

 

Please allow me some time to review the information.


Gary
 
If I do not reply within 24 hours please send me a Personal Message.

"Lord, to whom would we go? You have the words that give eternal life. We believe, and we know you are the Holy One of God."

#6 Oh My!

Oh My!

    Adware and Spyware and Malware.....


  • Malware Response Instructor
  • 37,724 posts
  • ONLINE
  •  
  • Gender:Male
  • Location:California
  • Local time:06:42 AM

Posted 10 October 2018 - 07:12 PM

Thank you,
 

pop up for a few seconds

 
Are you able to take a quick screen shot of the cmd screen that appears for a few seconds?Please consider and do this.

===================================================

Peer to Peer (P2P) Warning

--------------------

Going over your logs I noticed that you have Peer 2 Peer (torrent) program(s) installed. It is pretty much certain that if you continue to use P2P programs, you will get infected again.
  • Avoid gaming sites, pirated software, cracking tools, keygens, and peer-to-peer (P2P) file sharing programs.
  • They are a security risk which can make your computer susceptible to a smörgåsbord of malware infections, remote attacks, exposure of personal information, and identity theft. Many malicious worms and Trojans spread across P2P file sharing networks, gaming and underground sites.
  • Users visiting such pages may see innocuous-looking banner ads containing code which can trigger pop-up ads and malicious Flash ads that install viruses, Trojans and spyware. Ads are a target for hackers because they offer a stealthy way to distribute malware to a wide range of Internet users.
  • The best way to reduce the risk of infection is to avoid these types of web sites and not use any P2P applications.
I would recommend that you uninstall Peer 2 Peer programs, however that choice is up to you. If you choose to remove the program, you can do so via Start > Control Panel > Add/Remove Programs.

If you are still leaning toward using this program, please take a look at this information about CryptoLocker Ransomware, a type of Ransomware which can be delivered via P2P file transfers. The newest variation of Ransomware can make it impossible to recover the files this malicious software encrypts. In other words, you will probably lose most if not all of your valuable information, including pictures. In addition it has recently been reported that P2P downloads may be tracked resulting in your IP address being monitored by copyright authorities.

If you wish to keep it, please do not use it until we are completely done and your machine is determined to be clean and updated.

===================================================

Farbar's Recovery Scan Tool Fix

--------------------
  • Right click on the FRST icon and select Run as administrator
  • Highlight the below information then hit the Ctrl + C keys at the same time
  • The information will be copied invisibly and will be "pasted" into FRST automatically when you click Fix as instructed below
Start::
CreateRestorePoint:
CloseProcesses:
Toolbar: HKU\S-1-5-21-4254226789-487654737-2996639702-1001 -> No Name - {47833539-D0C5-4125-9FA8-0819E2EAAC93} -  No File
C:\Windows\System32\mfc120jpn.dll
Task: {00BCBEDA-FA33-43DA-99EB-81E38B8A53BC} - System32\Tasks\Norton Security\Norton Security Error Processor => C:\Program Files\Norton Security\Engine\22.12.0.104\SymErr.exe
C:\Program Files\Norton Security
Task: {0367B416-AA88-4E44-A7A3-55907262CBD2} - System32\Tasks\Norton Security with Backup\Norton Security Error Analyzer => C:\Program Files\Norton Security\Engine\22.14.0.54\SymErr.exe
Task: {3B1ADA4B-6A7F-4D42-9B2E-38D33812A8D9} - System32\Tasks\Norton Security with Backup\Norton Security Error Processor => C:\Program Files\Norton Security\Engine\22.14.0.54\SymErr.exe
Task: {9CDEE0AA-B99D-43C3-99C4-140D3A1718F8} - System32\Tasks\Norton Security with Backup\Norton Security Autofix => C:\Program Files\Norton Security\Engine\22.14.0.54\SymErr.exe
Task: {CB1F1E01-B92A-4542-AFD2-251D62E7460E} - System32\Tasks\Norton Security\Norton Security Error Analyzer => C:\Program Files\Norton Security\Engine\22.12.0.104\SymErr.exe
Task: {F9957490-FADC-454A-8544-8A9570621C92} - System32\Tasks\Norton WSC Integration => C:\Program Files\Norton Security\Engine\22.14.0.54\WSCStub.exe
Task: {FD4484A1-7679-4C08-8F36-215C55F3A9C8} - System32\Tasks\Remediation\AntimalwareMigrationTask => C:\Program Files\Common Files\AV\Norton Security\Upgrade.exe
Task: {FFF6BD63-525B-4215-A333-9FFC4600F750} - System32\Tasks\Norton Security\Norton Security Autofix => C:\Program Files\Norton Security\Engine\22.12.0.104\SymErr.exe
C:\Program Files\Common Files\AV\Norton Security
Cmd: tasklist /m /fi "IMAGENAME eq cmd.exe"
emptytemp:
End::
  • Click Fix
  • When completed he tool will create a log on the desktop called Fixlog.txt. Copy and paste the report in your reply.
===================================================

Things I would like to see in your next reply. Please be sure to copy and paste any requested log information unless you are asked to attach it. :thumbsup2:
  • Screen shot?
  • Fixlog

Edited by Oh My!, 10 October 2018 - 07:48 PM.

Gary
 
If I do not reply within 24 hours please send me a Personal Message.

"Lord, to whom would we go? You have the words that give eternal life. We believe, and we know you are the Holy One of God."

#7 broman400

broman400
  • Topic Starter

  • Members
  • 40 posts
  • OFFLINE
  •  
  • Gender:Male
  • Local time:09:42 AM

Posted 11 October 2018 - 04:40 PM

Here is my fixlog:

 

Fix result of Farbar Recovery Scan Tool (x64) Version: 10.10.2018
Ran by Brian (10-10-2018 22:42:20) Run:1
Running from C:\Users\broma_000\Desktop
Loaded Profiles: Brian (Available Profiles: Brian & User & DefaultAppPool)
Boot Mode: Normal
==============================================
 
fixlist content:
*****************
CreateRestorePoint:
CloseProcesses:
Toolbar: HKU\S-1-5-21-4254226789-487654737-2996639702-1001 -> No Name - {47833539-D0C5-4125-9FA8-0819E2EAAC93} -  No File
C:\Windows\System32\mfc120jpn.dll
Task: {00BCBEDA-FA33-43DA-99EB-81E38B8A53BC} - System32\Tasks\Norton Security\Norton Security Error Processor => C:\Program Files\Norton Security\Engine\22.12.0.104\SymErr.exe
C:\Program Files\Norton Security
Task: {0367B416-AA88-4E44-A7A3-55907262CBD2} - System32\Tasks\Norton Security with Backup\Norton Security Error Analyzer => C:\Program Files\Norton Security\Engine\22.14.0.54\SymErr.exe
Task: {3B1ADA4B-6A7F-4D42-9B2E-38D33812A8D9} - System32\Tasks\Norton Security with Backup\Norton Security Error Processor => C:\Program Files\Norton Security\Engine\22.14.0.54\SymErr.exe
Task: {9CDEE0AA-B99D-43C3-99C4-140D3A1718F8} - System32\Tasks\Norton Security with Backup\Norton Security Autofix => C:\Program Files\Norton Security\Engine\22.14.0.54\SymErr.exe
Task: {CB1F1E01-B92A-4542-AFD2-251D62E7460E} - System32\Tasks\Norton Security\Norton Security Error Analyzer => C:\Program Files\Norton Security\Engine\22.12.0.104\SymErr.exe
Task: {F9957490-FADC-454A-8544-8A9570621C92} - System32\Tasks\Norton WSC Integration => C:\Program Files\Norton Security\Engine\22.14.0.54\WSCStub.exe
Task: {FD4484A1-7679-4C08-8F36-215C55F3A9C8} - System32\Tasks\Remediation\AntimalwareMigrationTask => C:\Program Files\Common Files\AV\Norton Security\Upgrade.exe
Task: {FFF6BD63-525B-4215-A333-9FFC4600F750} - System32\Tasks\Norton Security\Norton Security Autofix => C:\Program Files\Norton Security\Engine\22.12.0.104\SymErr.exe
C:\Program Files\Common Files\AV\Norton Security
Cmd: tasklist /m /fi "IMAGENAME eq cmd.exe"
emptytemp:
 
*****************
 
Restore point was successfully created.
Processes closed successfully.
"HKU\S-1-5-21-4254226789-487654737-2996639702-1001\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser\\{47833539-D0C5-4125-9FA8-0819E2EAAC93}" => removed successfully
HKLM\Software\Classes\CLSID\{47833539-D0C5-4125-9FA8-0819E2EAAC93} => not found
C:\Windows\System32\mfc120jpn.dll => moved successfully
"HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Plain\{00BCBEDA-FA33-43DA-99EB-81E38B8A53BC}" => removed successfully
"HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\{00BCBEDA-FA33-43DA-99EB-81E38B8A53BC}" => removed successfully
C:\WINDOWS\System32\Tasks\Norton Security\Norton Security Error Processor => moved successfully
"HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tree\Norton Security\Norton Security Error Processor" => removed successfully
"C:\Program Files\Norton Security" => not found
"HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Plain\{0367B416-AA88-4E44-A7A3-55907262CBD2}" => removed successfully
"HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\{0367B416-AA88-4E44-A7A3-55907262CBD2}" => removed successfully
C:\WINDOWS\System32\Tasks\Norton Security with Backup\Norton Security Error Analyzer => moved successfully
"HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tree\Norton Security with Backup\Norton Security Error Analyzer" => removed successfully
"HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Plain\{3B1ADA4B-6A7F-4D42-9B2E-38D33812A8D9}" => removed successfully
"HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\{3B1ADA4B-6A7F-4D42-9B2E-38D33812A8D9}" => removed successfully
C:\WINDOWS\System32\Tasks\Norton Security with Backup\Norton Security Error Processor => moved successfully
"HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tree\Norton Security with Backup\Norton Security Error Processor" => removed successfully
"HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Plain\{9CDEE0AA-B99D-43C3-99C4-140D3A1718F8}" => removed successfully
"HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\{9CDEE0AA-B99D-43C3-99C4-140D3A1718F8}" => removed successfully
C:\WINDOWS\System32\Tasks\Norton Security with Backup\Norton Security Autofix => moved successfully
"HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tree\Norton Security with Backup\Norton Security Autofix" => removed successfully
"HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Plain\{CB1F1E01-B92A-4542-AFD2-251D62E7460E}" => removed successfully
"HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\{CB1F1E01-B92A-4542-AFD2-251D62E7460E}" => removed successfully
C:\WINDOWS\System32\Tasks\Norton Security\Norton Security Error Analyzer => moved successfully
"HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tree\Norton Security\Norton Security Error Analyzer" => removed successfully
"HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Plain\{F9957490-FADC-454A-8544-8A9570621C92}" => removed successfully
"HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\{F9957490-FADC-454A-8544-8A9570621C92}" => removed successfully
C:\WINDOWS\System32\Tasks\Norton WSC Integration => moved successfully
"HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tree\Norton WSC Integration" => removed successfully
"HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Logon\{FD4484A1-7679-4C08-8F36-215C55F3A9C8}" => removed successfully
"HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\{FD4484A1-7679-4C08-8F36-215C55F3A9C8}" => removed successfully
C:\WINDOWS\System32\Tasks\Remediation\AntimalwareMigrationTask => moved successfully
"HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tree\Remediation\AntimalwareMigrationTask" => removed successfully
"HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Plain\{FFF6BD63-525B-4215-A333-9FFC4600F750}" => removed successfully
"HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\{FFF6BD63-525B-4215-A333-9FFC4600F750}" => removed successfully
C:\WINDOWS\System32\Tasks\Norton Security\Norton Security Autofix => moved successfully
"HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tree\Norton Security\Norton Security Autofix" => removed successfully
"C:\Program Files\Common Files\AV\Norton Security" => not found
 
========= tasklist /m /fi "IMAGENAME eq cmd.exe" =========
 
 
Image Name                     PID Modules                                     
========================= ======== ============================================
cmd.exe                        812 ntdll.dll, KERNEL32.DLL, KERNELBASE.dll,    
                                   apphelp.dll, msvcrt.dll                     
 
========= End of CMD: =========
 
 
=========== EmptyTemp: ==========
 
BITS transfer queue => 7888896 B
DOMStore, IE Recovery, AppCache, Feeds Cache, Thumbcache, IconCache => 16865432 B
Java, Flash, Steam htmlcache => 0 B
Windows/system/drivers => 20574420 B
Edge => 201621550 B
Chrome => 765248773 B
Firefox => 8103824 B
Opera => 0 B
 
Temp, IE cache, history, cookies, recent:
Default => 0 B
Users => 0 B
ProgramData => 0 B
Public => 0 B
systemprofile => 0 B
systemprofile32 => 0 B
LocalService => 11808 B
LocalService => 0 B
NetworkService => 24102 B
NetworkService => 0 B
broma_000 => 3334472 B
User => 7220942 B
DefaultAppPool => 0 B
 
RecycleBin => 0 B
EmptyTemp: => 983.1 MB temporary data Removed.
 
================================
 
 
The system needed a reboot.
 
==== End of Fixlog 22:43:20 ====
 
The CMD is I believe stopped popping up on boot, it popped up for less than a second and disappeared before. 


#8 Oh My!

Oh My!

    Adware and Spyware and Malware.....


  • Malware Response Instructor
  • 37,724 posts
  • ONLINE
  •  
  • Gender:Male
  • Location:California
  • Local time:06:42 AM

Posted 11 October 2018 - 07:54 PM

Thank you.

Let's monitor your computer for a bit and while doing so please do this.

===================================================

ESET Online Scanner

--------------------

I'd like us to scan your machine with ESET OnlineScan This process may may take several hours, that is normal.
  • Download esetsmartinstaller_enu.exe and save it to your Desktop
  • Double click the icon
  • Check YES, I accept the Terms of Use
  • Click the Start button
  • Accept any security warnings from your browser
  • Click Advanced settings
  • Check the following items

Enable detection of potentially unwanted applications
Remove found threats
Scan archives
Scan for potentially unsafe applications
Enable Anti-Stealth technology

  • Click Start
  • ESET will then download updates and begin scanning your computer
  • If no threats are found simply click Uninstall application on close and hit Finish
  • If threats are found click List of found threats
  • Click Export to text file
  • Save the file on your Desktop as ESET.txt
  • Click Back
  • Review the list of entries and if there are any you want to keep stop and copy/paste the ESET.txt report in your reply for my review
  • If you do not wish to keep any of the entries check Uninstall application on close and Delete quarantined files
  • Click Finish
  • Close the ESET Online Scanner window
  • Copy and paste the contents of ESET.txt in your reply
===================================================

Security Analysis by Rocket Grannie

--------------------
  • Please download Security Analysis by Rocket Grannie and save it to your Desktop
  • Right click on the icon and select Run as admnistrator
  • Click OK on the disclaimer and ignore any security warnings that may appear
  • In your reply, please copy and paste the contents of the Notepad document that will appear on your desktop
===================================================

Things I would like to see in your next reply. Please be sure to copy and paste any requested log information unless you are asked to attach it. :thumbsup2:
  • ESET log
  • Security Analysis log
  • How is your computer running?

Gary
 
If I do not reply within 24 hours please send me a Personal Message.

"Lord, to whom would we go? You have the words that give eternal life. We believe, and we know you are the Holy One of God."

#9 broman400

broman400
  • Topic Starter

  • Members
  • 40 posts
  • OFFLINE
  •  
  • Gender:Male
  • Local time:09:42 AM

Posted 13 October 2018 - 10:55 PM

Trying to run Security Analysis I get this error: https://imgur.com/a/ljNL8nn

 

Edit: Just realized my antivirus Cylance keeps deleting it


Edited by broman400, 13 October 2018 - 11:30 PM.


#10 Oh My!

Oh My!

    Adware and Spyware and Malware.....


  • Malware Response Instructor
  • 37,724 posts
  • ONLINE
  •  
  • Gender:Male
  • Location:California
  • Local time:06:42 AM

Posted 14 October 2018 - 02:12 PM

You can skip that step.
Gary
 
If I do not reply within 24 hours please send me a Personal Message.

"Lord, to whom would we go? You have the words that give eternal life. We believe, and we know you are the Holy One of God."

#11 broman400

broman400
  • Topic Starter

  • Members
  • 40 posts
  • OFFLINE
  •  
  • Gender:Male
  • Local time:09:42 AM

Posted 14 October 2018 - 05:38 PM

C:\Users\broma_000\Desktop\HTC\HTC Backups\HTC One M8 Backup\TitaniumBackup\com.ea.games.simsfreeplay_na-fda11e55bb373d2270a0ef437df537ed.apk.gz a variant of Android/Inmobi.A potentially unsafe application deleted
C:\Users\broma_000\Desktop\HTC\HTC Backups\One X+ July Backup\TitaniumBackup\com.ea.games.simsfreeplay_na-fda11e55bb373d2270a0ef437df537ed.apk.gz a variant of Android/Inmobi.A potentially unsafe application deleted
C:\Users\broma_000\Desktop\HTC\HTC Backups\One X+ October Backup\TitaniumBackup\com.ea.games.simsfreeplay_na-fda11e55bb373d2270a0ef437df537ed.apk.gz a variant of Android/Inmobi.A potentially unsafe application deleted
C:\Windows\System32\SppExtComObjHook.dll a variant of Win64/HackKMS.I potentially unsafe application cleaned by deleting
 
This is the ESET log

Result of Security Analysis by Rocket Grannie (x86) Updated: 06th, October 2018
Running from:C:\Users\broma_000\Desktop (18:37:18 - 10/14/2018)
***---------------------------------------------------------***
Microsoft Windows 10 Home X64
UAC is Enabled
Internet Explorer 11
Default Browser: Microsoft Edge
***------------Antivirus - Antispyware - Firewall-----------***
CylancePROTECT (Enabled - up to Date)
Windows Defender (Disabled - up to Date)
Windows Defender (Disabled - up to Date)
CylancePROTECT (Enabled - up to Date)
Windows Firewall (Enabled)
No other Firewall Installed
***-------Security Programs - Browsers - Miscellaneous------***
Adobe Flash Player NPAPI is not installed
CCleaner (5.47)
Google Chrome (69.0.3497.100)
Java (8.0.1710.11) ==> is out of Date
Malwarebytes (3.5.1.2522) ==> is out of Date
Microsoft Silverlight (5.1.50907.0)
Mozilla Firefox (60.0) ==> is out of Date
Windows Live Essentials (16.4.3528.0331) ==> is no longer supported
 
***----------------Analysis Complete-------------------------***
 
This is the SALog


#12 broman400

broman400
  • Topic Starter

  • Members
  • 40 posts
  • OFFLINE
  •  
  • Gender:Male
  • Local time:09:42 AM

Posted 14 October 2018 - 05:43 PM

Another thing, I downloaded GlassWire to monitor everything that runs on my computer. A few days ago it detected 4 random Windows Installer instances one after another. Nothing appeared in the background. Running a virustotal.com scan of all of them appears to be called EGAAxy.exe which I have no idea what it is, but virustotal marks it as safe.



#13 Oh My!

Oh My!

    Adware and Spyware and Malware.....


  • Malware Response Instructor
  • 37,724 posts
  • ONLINE
  •  
  • Gender:Male
  • Location:California
  • Local time:06:42 AM

Posted 14 October 2018 - 08:07 PM

Thank you for the information.

Do you have a Virustotal link of the scan results?

We should update some programs to make your system more secure. Please do this.

Please update Malwarebytes and Firefox.

===================================================

Updating Java Using Internet Explorer

-------------------

Note: Use Internet Explorer for these steps.
  • Click Start, type Internet Explorer, then hit Enter
  • Copy and paste http://java.com/en/download/testjava.jsp in the address bar then hit Enter
  • If you are notified your Java version is out of date click Update (recommended)
  • Click Agree and Start Free Java Download
  • Click Run
  • Click Install
  • Click Next
  • Once completed you should be notified You have successfully installed Java
  • If Java notifies you older versions of the program need to be removed check each of the versions and click Uninstall
  • Verify the older version(s) was uninstalled then click Next
  • Click Close
===================================================

Things I would like to see in your next reply. Please be sure to copy and paste any requested log information unless you are asked to attach it. :thumbsup2:
  • Virustotal link
  • Programs update?

Gary
 
If I do not reply within 24 hours please send me a Personal Message.

"Lord, to whom would we go? You have the words that give eternal life. We believe, and we know you are the Holy One of God."

#14 broman400

broman400
  • Topic Starter

  • Members
  • 40 posts
  • OFFLINE
  •  
  • Gender:Male
  • Local time:09:42 AM

Posted 14 October 2018 - 10:49 PM

Here is the virustotal link: https://www.virustotal.com/en/file/6f55350ad77606c65c755dd2eec985c6969fcf30d3f03d308b9c4f555b3edda4/analysis/1539060041/

 

The file did not appear anywhere and I did not even see a Windows Installer start installing anything, Glasswire only alerted me that 4 insances of it started. 

 

I was reading this article which got me a little paranoid lol: https://blog.trendmicro.com/trendlabs-security-intelligence/attack-using-windows-installer-msiexec-exe-leads-lokibot/


Edited by broman400, 14 October 2018 - 10:51 PM.


#15 Oh My!

Oh My!

    Adware and Spyware and Malware.....


  • Malware Response Instructor
  • 37,724 posts
  • ONLINE
  •  
  • Gender:Male
  • Location:California
  • Local time:06:42 AM

Posted 15 October 2018 - 08:40 AM

Greetings.

Windows Installer activity is not uncommon. The Windows Installer file itself (renamed EGAAxy.exe in our case) is legitimate and is used for installing or removing software. In order to determine the exact purpose for a particular instance it is necessary to enable logging for the Installer feature. As far as I can tell there is no easy way to evaluate historic Installer activity if logging has not already been enabled.

The next best evaluation approach it to look for suspicious behavior or other evidence of potential malware to see if the Installer activity should be of concern. I see no evidence of malicious activity in general, nor do I see anything similar to what is detailed in the link you provided. Unless you detect other suspicious activity there is no reason to be concerned.

Were you able to successfully update the 3 programs?
Gary
 
If I do not reply within 24 hours please send me a Personal Message.

"Lord, to whom would we go? You have the words that give eternal life. We believe, and we know you are the Holy One of God."




0 user(s) are reading this topic

0 members, 0 guests, 0 anonymous users