peter_callback

Don't know what to say... Right Click, Save Link as... https://forums.malwarebytes.com/applications/core/interface/file/attachment.php?id=232782 Re-name file from 'fixlist.txt.ce3d84d84df3e0d264d41ea1c08a7fc3.txt' to 'fixlist.txt' Right click on 'FRST64.exe', run as administrator Left Click 'Fix' in FRST Upload Fixlog.txt Upload screen shot of folder Fixlog.txt

Hello ShutterbugMomTN, How much space was left (approx.) on the drive before the issue started?

Downloading and using the attachment requires; 'right click' / 'save as' re-name 'fixlist.txt.ce3d84d84df3e0d264d41ea1c08a7fc3.txt' to 'fixlist.txt' Firefox / noscript Fixlog.txt

OK. Below is the fixlog text file creared following your instructions. I will look at a clean boot now. Fixlog.txt

Below is the FRST.txt (attached is the Addition.txt) Scan result of Farbar Recovery Scan Tool (FRST) (x64) Version: 06-10-2017 Ran by mdgm (administrator) on THIS PC (07-10-2017 19:29:13) Running from C:\Users\THIS PC\Downloads Loaded Profiles: mdgm (Available Profiles: THIS PC) Platform: Windows 7 Professional Service Pack 1 (X64) Language: English (United States) Internet Explorer Version 11 (Default browser: Opera) Boot Mode: Normal Tutorial for Farbar Recovery Scan Tool: http://www.geekstogo.com/forum/topic/335081-frst-tutorial-how-to-use-farbar-recovery-scan-tool/ ==================== Processes (Whitelisted) ================= (If an entry is included in the fixlist, the process will be closed. The file will not be moved.) (NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\Display.NvContainer\NVDisplay.Container.exe (NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\Display\nvxdsync.exe (Intel Corporation) C:\Windows\System32\igfxCUIService.exe (Realtek Semiconductor) C:\Program Files\Realtek\Audio\HDA\RTKAUDIOSERVICE64.EXE (Realtek Semiconductor) C:\Program Files\Realtek\Audio\HDA\RAVBg64.exe (Check Point Software Technologies Ltd.) C:\Program Files (x86)\CheckPoint\ZoneAlarm\vsmon.exe (cFos Software GmbH) C:\Program Files\ASRock\XFast LAN\spd.exe (NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\GeForce Experience Service\GfExperienceService.exe (Intel Corporation) C:\Windows\System32\IPROSetMonitor.exe () C:\Program Files\Intel\Intel(R) Smart Connect Technology Agent\iSCTAgent.exe (AO Kaspersky Lab) C:\Program Files (x86)\Kaspersky Lab\Kaspersky Security Scan\kss.exe (NVIDIA Corporation) C:\Program Files (x86)\NVIDIA Corporation\NetService\NvNetworkService.exe (Realtek Semiconductor) C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe (NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\NvStreamSrv\NvStreamService.exe (Qualcomm Atheros) C:\Program Files\Qualcomm Atheros\Network Manager\KillerService.exe (Check Point Software Technologies Ltd.) C:\Program Files (x86)\CheckPoint\ZoneAlarm\ICM-Service.exe (NVIDIA Corporation) C:\Program Files (x86)\NVIDIA Corporation\Update Core\NvBackend.exe (Intel Corporation) C:\Program Files\Intel\Intel(R) Smart Connect Technology Agent\iSCTsysTray8.exe (cFos Software GmbH) C:\Program Files\ASRock\XFast LAN\cfosspeed.exe (Valve Corporation) C:\Program Files (x86)\Steam\Steam.exe (Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) USB 3.0 eXtensible Host Controller Driver\Application\iusb3mon.exe () C:\Program Files\Qualcomm Atheros\Network Manager\NetworkManager.exe (Check Point Software Technologies Ltd.) C:\Program Files (x86)\CheckPoint\ZoneAlarm\zatray.exe (Microsoft Corporation) C:\Windows\Microsoft.NET\Framework64\v3.0\WPF\PresentationFontCache.exe (NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\NvStreamSrv\NvStreamNetworkService.exe (NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\Display\nvtray.exe (Valve Corporation) C:\Program Files (x86)\Steam\bin\cef\cef.win7\steamwebhelper.exe (Valve Corporation) C:\Program Files (x86)\Steam\bin\cef\cef.win7\steamwebhelper.exe (NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\ShadowPlay\nvspcaps64.exe (SoftPerfect) C:\Program Files\SoftPerfect Bandwidth Manager\BMCore.exe (Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\DAL\jhi_service.exe (Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\LMS\LMS.exe (NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\NvStreamSrv\NvStreamUserAgent.exe (Mozilla Corporation) C:\Program Files (x86)\Mozilla Firefox\firefox.exe ==================== Registry (Whitelisted) =========================== (If an entry is included in the fixlist, the registry item will be restored to default or removed. The file will not be moved.) HKLM\...\Run: [RTHDVCPL] => C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe [14040792 2015-07-15] (Realtek Semiconductor) HKLM\...\Run: [NvBackend] => C:\Program Files (x86)\NVIDIA Corporation\Update Core\NvBackend.exe [2397120 2016-06-15] (NVIDIA Corporation) HKLM\...\Run: [ShadowPlay] => "C:\Windows\system32\rundll32.exe" C:\Windows\system32\nvspcap64.dll,ShadowPlayOnSystemStart HKLM\...\Run: [VIAxHCUtl] => C:\Program Files\VIA XHCI UASP Utility\usb3Monitor HKLM\...\Run: [ISCT Tray] => C:\Program Files\Intel\Intel(R) Smart Connect Technology Agent\iSCTsysTray8.exe [5860656 2014-08-25] (Intel Corporation) HKLM\...\Run: [XFast LAN] => C:\Program Files\ASRock\XFast LAN\cFosSpeed.exe [2009952 2013-05-31] (cFos Software GmbH) HKLM-x32\...\Run: [USB3MON] => C:\Program Files (x86)\Intel\Intel(R) USB 3.0 eXtensible Host Controller Driver\Application\iusb3mon.exe [296216 2015-02-17] (Intel Corporation) HKLM-x32\...\Run: [amd_dc_opt] => C:\Program Files (x86)\AMD\Dual-Core Optimizer\amd_dc_opt.exe [77824 2008-07-22] (AMD) HKLM-x32\...\Run: [ZoneAlarm] => C:\Program Files (x86)\CheckPoint\ZoneAlarm\zatray.exe [144696 2017-02-14] (Check Point Software Technologies Ltd.) HKU\S-1-5-21-2366040382-2050272407-207267677-1000\...\Run: [Steam] => C:\Program Files (x86)\Steam\steam.exe [3074336 2017-10-05] (Valve Corporation) HKU\S-1-5-21-2366040382-2050272407-207267677-1000\Control Panel\Desktop\\SCRNSAVE.EXE -> C:\Windows\system32\PhotoScreensaver.scr [477696 2010-11-20] (Microsoft Corporation) HKU\S-1-5-18\...\Run: [KSS] => C:\Program Files (x86)\Kaspersky Lab\Kaspersky Security Scan\kss.exe [1556448 2015-12-15] (AO Kaspersky Lab) Startup: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\Adobe Acrobat Speed Launcher.lnk [2017-05-12] ShortcutTarget: Adobe Acrobat Speed Launcher.lnk -> C:\Windows\Installer\{AC76BA86-1033-F400-7760-000000000003}\_SC_Acrobat.exe () Startup: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\Adobe Acrobat Synchronizer.lnk [2017-05-12] ShortcutTarget: Adobe Acrobat Synchronizer.lnk -> C:\Program Files (x86)\Adobe\Acrobat 8.0\Acrobat\AdobeCollabSync.exe () Startup: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\Killer Network Manager.lnk [2014-08-09] ShortcutTarget: Killer Network Manager.lnk -> C:\Windows\Installer\{401FADAA-1C16-4721-9F02-19067E1A1CA8}\NetworkManager.exe_130C27D738F34C89BDDF21BCFD74B56D.exe (Flexera Software LLC) CHR HKLM\SOFTWARE\Policies\Google: Restriction <==== ATTENTION ==================== Internet (Whitelisted) ==================== (If an item is included in the fixlist, if it is a registry item it will be removed or restored to default.) Tcpip\Parameters: [DhcpNameServer] 192.168.11.1 Tcpip\..\Interfaces\{8595F51F-B6D7-4460-A430-BD393D6D45CF}: [DhcpNameServer] 192.168.11.1 Tcpip\..\Interfaces\{BAEE240B-D78E-4AE0-993A-7889D183CE46}: [DhcpNameServer] 192.168.11.1 Tcpip\..\Interfaces\{D3ABE540-F1AA-40FB-96DB-D51DFA64D539}: [DhcpNameServer] 192.168.0.1 Tcpip\..\Interfaces\{DB675905-8EE8-4D2F-A2F6-6246EAF7B326}: [DhcpNameServer] 192.168.11.1 Internet Explorer: ================== HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Start Page = www.google.com HKU\.DEFAULT\Software\Microsoft\Internet Explorer\Main,Search Page = hxxp://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch HKU\.DEFAULT\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://www.microsoft.com/isapi/redir.dll?prd=ie&ar=msnhome HKU\S-1-5-21-2366040382-2050272407-207267677-1000\Software\Microsoft\Internet Explorer\Main,Search Page = hxxp://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch SearchScopes: HKLM-x32 -> DefaultScope {BB82DE59-BC4C-4172-9AC4-73315F71CFFE} URL = BHO: No Name -> {13D67BB7-DB5F-48AA-884D-7A5D94168509} -> No File BHO-x32: Adobe PDF Reader Link Helper -> {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} -> C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll [2008-06-11] (Adobe Systems Incorporated) BHO-x32: Adobe PDF Conversion Toolbar Helper -> {AE7CD045-E861-484f-8273-0445EE161910} -> C:\Program Files (x86)\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll [2006-10-22] (Adobe Systems Incorporated) Toolbar: HKLM-x32 - Adobe PDF - {47833539-D0C5-4125-9FA8-0819E2EAAC93} - C:\Program Files (x86)\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll [2006-10-22] (Adobe Systems Incorporated) Handler-x32: belarc - {6318E0AB-2E93-11D1-B8ED-00608CC9A71F} - C:\Program Files (x86)\Belarc\BelarcAdvisor\System\BAVoilaX.dll [2015-11-13] (Belarc, Inc.) Handler-x32: cdo - {CD00020A-8B95-11D1-82DB-00C04FB1625D} - C:\Program Files (x86)\Common Files\Microsoft Shared\Web Folders\PKMCDO.DLL [2001-01-22] (Microsoft Corporation) Handler: WSIEChrome - No CLSID Value FireFox: ======== FF DefaultProfile: aclbyhhw.default FF ProfilePath: C:\Users\THIS PC\AppData\Roaming\Mozilla\Firefox\Profiles\aclbyhhw.default [2017-10-07] FF NewTab: Mozilla\Firefox\Profiles\aclbyhhw.default -> about:blank FF Homepage: Mozilla\Firefox\Profiles\aclbyhhw.default -> www.google.com FF Session Restore: Mozilla\Firefox\Profiles\aclbyhhw.default -> is enabled. FF Extension: (Flash Video Downloader - YouTube HD Download [4K]) - C:\Users\THIS PC\AppData\Roaming\Mozilla\Firefox\Profiles\aclbyhhw.default\Extensions\artur.dubovoy@gmail.com [2017-08-16] FF Extension: (British English Dictionary (Updated)) - C:\Users\THIS PC\AppData\Roaming\Mozilla\Firefox\Profiles\aclbyhhw.default\Extensions\en-gb@flyingtophat.co.uk [2015-06-12] [not signed] FF Extension: (Spanish (Spain) Dictionary) - C:\Users\THIS PC\AppData\Roaming\Mozilla\Firefox\Profiles\aclbyhhw.default\Extensions\es-es@dictionaries.addons.mozilla.org [2017-01-29] FF Extension: (Valence) - C:\Users\THIS PC\AppData\Roaming\Mozilla\Firefox\Profiles\aclbyhhw.default\Extensions\fxdevtools-adapters@mozilla.org [2017-08-04] FF Extension: (Tabs On Bottom) - C:\Users\THIS PC\AppData\Roaming\Mozilla\Firefox\Profiles\aclbyhhw.default\Extensions\tabsonbottom@piro.sakura.ne.jp.xpi [2016-06-16] FF Extension: (Lightshot (screenshot tool)) - C:\Users\THIS PC\AppData\Roaming\Mozilla\Firefox\Profiles\aclbyhhw.default\Extensions\{394DCBA4-1F92-4f8e-8EC9-8D2CB90CB69B} [2016-05-20] FF Extension: (Cookie Monster) - C:\Users\THIS PC\AppData\Roaming\Mozilla\Firefox\Profiles\aclbyhhw.default\Extensions\{45d8ff86-d909-11db-9705-005056c00008} [2016-11-28] FF Extension: (NoScript) - C:\Users\THIS PC\AppData\Roaming\Mozilla\Firefox\Profiles\aclbyhhw.default\Extensions\{73a6fe31-595d-460b-a920-fcc0f8843232}.xpi [2017-10-02] FF Extension: (Adblock Plus) - C:\Users\THIS PC\AppData\Roaming\Mozilla\Firefox\Profiles\aclbyhhw.default\Extensions\{d10d0bf8-f5b5-c8b4-a8b2-2b9879e08c5d}.xpi [2017-06-09] FF Extension: (FoxClocks) - C:\Users\THIS PC\AppData\Roaming\Mozilla\Firefox\Profiles\aclbyhhw.default\Extensions\{d37dc5d0-431d-44e5-8c91-49419370caa1}.xpi [2016-04-17] FF Plugin: @adobe.com/FlashPlayer -> C:\Windows\system32\Macromed\Flash\NPSWF64_27_0_0_130.dll [2017-10-07] () FF Plugin: adobe.com/AdobeAAMDetect -> C:\Program Files (x86)\Common Files\Adobe\OOBE\PDApp\CCM\Utilities\npAdobeAAMDetect64.dll [2014-04-29] (Adobe Systems) FF Plugin-x32: @adobe.com/FlashPlayer -> C:\Windows\SysWOW64\Macromed\Flash\NPSWF32_27_0_0_130.dll [2017-10-07] () FF Plugin-x32: @intel-webapi.intel.com/Intel WebAPI ipt;version=4.0.68 -> C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\IPT\npIntelWebAPIIPT.dll [2015-02-25] (Intel Corporation) FF Plugin-x32: @intel-webapi.intel.com/Intel WebAPI updater -> C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\IPT\npIntelWebAPIUpdater.dll [2015-02-25] (Intel Corporation) FF Plugin-x32: @nvidia.com/3DVision -> C:\Program Files (x86)\NVIDIA Corporation\3D Vision\npnv3dv.dll [2017-02-10] (NVIDIA Corporation) FF Plugin-x32: @nvidia.com/3DVisionStreaming -> C:\Program Files (x86)\NVIDIA Corporation\3D Vision\npnv3dvstreaming.dll [2017-02-10] (NVIDIA Corporation) FF Plugin-x32: @tools.google.com/Google Update;version=3 -> C:\Program Files (x86)\Google\Update\1.3.33.5\npGoogleUpdate3.dll [2017-04-29] (Google Inc.) FF Plugin-x32: @tools.google.com/Google Update;version=9 -> C:\Program Files (x86)\Google\Update\1.3.33.5\npGoogleUpdate3.dll [2017-04-29] (Google Inc.) FF Plugin-x32: @videolan.org/vlc,version=2.2.0 -> C:\Program Files (x86)\VideoLAN\VLC\npvlc.dll [2015-02-27] (VideoLAN) FF Plugin-x32: adobe.com/AdobeAAMDetect -> C:\Program Files (x86)\Common Files\Adobe\OOBE\PDApp\CCM\Utilities\npAdobeAAMDetect32.dll [2014-04-29] (Adobe Systems) FF Plugin HKU\S-1-5-21-2366040382-2050272407-207267677-1000: wacom.com/WacomTabletPlugin -> C:\Program Files\TabletPlugins\npWacomTabletPlugin.dll [No File] Chrome: ======= CHR DefaultProfile: Default CHR Session Restore: Default -> is enabled. CHR Profile: C:\Users\THIS PC\AppData\Local\Google\Chrome\User Data\Default [2017-10-07] CHR Extension: (Adblock Plus) - C:\Users\THIS PC\AppData\Local\Google\Chrome\User Data\Default\Extensions\cfhdojbkjhnklbpkdaibdccddilifddb [2017-09-27] CHR Extension: (Video Downloader GetThemAll) - C:\Users\THIS PC\AppData\Local\Google\Chrome\User Data\Default\Extensions\nbkekaeindpfpcoldfckljplboolgkfm [2017-08-01] CHR Extension: (Chrome Web Store Payments) - C:\Users\THIS PC\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda [2017-08-23] CHR Extension: (Chrome Media Router) - C:\Users\THIS PC\AppData\Local\Google\Chrome\User Data\Default\Extensions\pkedcjkdefgpdelpbcmbmeomcjbeemfm [2017-09-27] Opera: ======= OPR Extension: (Adblock Plus) - C:\Users\THIS PC\AppData\Roaming\Opera Software\Opera Stable\Extensions\oidhhegpmlfpoeialbgcdocjalghfpkp [2017-10-05] StartMenuInternet: (HKLM) OperaStable - C:\Program Files\Opera\Launcher.exe ==================== Services (Whitelisted) ==================== (If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.) R2 BMService; C:\Program Files\SoftPerfect Bandwidth Manager\BMCore.exe [10125128 2016-02-22] (SoftPerfect) R2 cFosSpeedS; C:\Program Files\ASRock\XFast LAN\spd.exe [652640 2013-05-31] (cFos Software GmbH) S3 FLEXnet Licensing Service; C:\Program Files (x86)\Common Files\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exe [654848 2015-08-25] (Macrovision Europe Ltd.) [File not signed] R2 GfExperienceService; C:\Program Files\NVIDIA Corporation\GeForce Experience Service\GfExperienceService.exe [1163712 2016-06-15] (NVIDIA Corporation) R2 igfxCUIService1.0.0.0; C:\Windows\system32\igfxCUIService.exe [355232 2015-08-09] (Intel Corporation) S3 Intel(R) Capability Licensing Service TCP IP Interface; C:\Program Files\Intel\iCLS Client\SocketHeciServer.exe [881152 2014-10-03] (Intel(R) Corporation) S3 intelsba; C:\Program Files\Intel\Intel(R) Small Business Advantage\Service\Intel.SmallBusinessAdvantage.WindowsService.exe [54976 2014-01-06] (Intel Corporation) R2 ISCTAgent; C:\Program Files\Intel\Intel(R) Smart Connect Technology Agent\iSCTAgent.exe [209712 2014-08-25] () R2 jhi_service; C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\DAL\jhi_service.exe [156960 2015-02-25] (Intel Corporation) R2 kss; C:\Program Files (x86)\Kaspersky Lab\Kaspersky Security Scan\kss.exe [1556448 2015-12-15] (AO Kaspersky Lab) R2 NVDisplay.ContainerLocalSystem; C:\Program Files\NVIDIA Corporation\Display.NvContainer\NVDisplay.Container.exe [462784 2017-02-10] (NVIDIA Corporation) R2 NvNetworkService; C:\Program Files (x86)\NVIDIA Corporation\NetService\NvNetworkService.exe [1879488 2016-06-15] (NVIDIA Corporation) R3 NvStreamNetworkSvc; C:\Program Files\NVIDIA Corporation\NvStreamSrv\NvStreamNetworkService.exe [3632576 2016-06-15] (NVIDIA Corporation) R2 NvStreamSvc; C:\Program Files\NVIDIA Corporation\NvStreamSrv\NvStreamService.exe [2521024 2016-06-15] (NVIDIA Corporation) S3 PAExec; C:\Windows\PAExec.exe [189112 2016-07-25] (Power Admin LLC) R2 Qualcomm Atheros Killer Service V2; C:\Program Files\Qualcomm Atheros\Network Manager\KillerService.exe [343040 2013-08-08] (Qualcomm Atheros) [File not signed] R2 RtkAudioService; C:\Program Files\Realtek\Audio\HDA\RtkAudioService64.exe [294616 2015-05-22] (Realtek Semiconductor) S3 SystemExplorerHelpService; C:\Program Files (x86)\System Explorer\service\SystemExplorerService64.exe [820960 2014-12-20] (Mister Group) R2 vsmon; C:\Program Files (x86)\CheckPoint\ZoneAlarm\vsmon.exe [4076744 2017-02-14] (Check Point Software Technologies Ltd.) R2 WinDefend; C:\Program Files\Windows Defender\mpsvc.dll [1011712 2013-05-27] (Microsoft Corporation) S3 ZAPrivacyService; C:\Program Files (x86)\CheckPoint\ZoneAlarm\ZaPrivacyService.exe [114936 2016-11-01] (Check Point Software Technologies, Ltd.) R2 ZoneAlarm ICM Service; C:\Program Files (x86)\CheckPoint\ZoneAlarm\ICM-Service.exe [1037624 2017-02-14] (Check Point Software Technologies Ltd.) ===================== Drivers (Whitelisted) ====================== (If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.) S3 athrusb; C:\Windows\System32\DRIVERS\athrxusb.sys [1075712 2009-11-17] (Atheros Communications, Inc.) R1 BfLwf; C:\Windows\System32\DRIVERS\bflwfx64.sys [67888 2013-02-13] (Qualcomm Atheros, Inc.) R3 e1dexpress; C:\Windows\System32\DRIVERS\e1d62x64.sys [488216 2014-02-04] (Intel Corporation) R3 ikbevent; C:\Windows\System32\DRIVERS\ikbevent.sys [22216 2014-05-27] () S3 iLokDrvr; C:\Windows\System32\DRIVERS\iLokDrvr.sys [25808 2013-04-11] () R3 imsevent; C:\Windows\System32\DRIVERS\imsevent.sys [22728 2014-05-27] () R3 INETMON; C:\Windows\System32\Drivers\INETMON.sys [25800 2014-05-27] () R3 ISCT; C:\Windows\System32\DRIVERS\ISCTD.sys [44744 2014-05-27] () S3 Ke2200; C:\Windows\System32\DRIVERS\e22w7x64.sys [154320 2013-03-20] (Qualcomm Atheros, Inc.) S3 KORGUMDS; C:\Windows\System32\Drivers\KORGUM64.SYS [34184 2016-03-11] (KORG INC.) R3 MEIx64; C:\Windows\System32\DRIVERS\TeeDriverx64.sys [129312 2014-09-30] (Intel Corporation) R3 NIWinCDEmu; C:\Windows\System32\DRIVERS\NIWinCDEmu.sys [112408 2015-08-24] () R3 NvStreamKms; C:\Program Files\NVIDIA Corporation\NvStreamSrv\NvStreamKms.sys [26560 2016-06-15] (NVIDIA Corporation) R3 nvvad_WaveExtensible; C:\Windows\System32\drivers\nvvad64v.sys [56384 2016-06-03] (NVIDIA Corporation) S4 secdrv; C:\Windows\SysWow64\Drivers\secdrv.sys [18768 2016-01-29] () [File not signed] R1 spfdrv; C:\Windows\System32\DRIVERS\spfdrv.sys [53688 2016-02-12] (SoftPerfect) S3 teVirtualMIDI64; C:\Windows\System32\DRIVERS\teVirtualMIDI64.sys [41016 2015-07-12] (Tobias Erichsen) S3 VBAudioHFVAIOMME; C:\Windows\System32\DRIVERS\vbaudio_hfvaio64_win7.sys [33512 2016-04-16] (Windows (R) Win 7 DDK provider) R1 Vsdatant; C:\Windows\System32\DRIVERS\vsdatant.sys [461240 2017-03-16] (Check Point Software Technologies Ltd.) R3 VUSB3HUB; C:\Windows\System32\DRIVERS\ViaHub3.sys [223744 2013-03-19] (VIA Technologies, Inc.) R3 xhcdrv; C:\Windows\System32\DRIVERS\xhcdrv.sys [295424 2013-03-19] (VIA Technologies, Inc.) S3 ZOOM_R16MTR; C:\Windows\System32\Drivers\zmr16usbaudio.sys [97792 2016-11-21] (Zoom Corporation.) [File not signed] S3 catchme; \??\C:\ComboFix\catchme.sys [X] S3 gdrv; \??\C:\Windows\gdrv.sys [X] U3 iswSvc; no ImagePath S3 MSICDSetup; \??\E:\CDriver64.sys [X] S3 TASCAM_US122144; System32\Drivers\tascusb2.sys [X] S3 TASCAM_US144_MIDI; system32\drivers\tscusb2m.sys [X] S3 TASCAM_US144_WDM; system32\drivers\tscusb2a.sys [X] ==================== NetSvcs (Whitelisted) =================== (If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.) ==================== One Month Created files and folders ======== (If an entry is included in the fixlist, the file/folder will be moved.) 2017-10-07 19:29 - 2017-10-07 19:29 - 000019596 _____ C:\Users\THIS PC\Downloads\FRST.txt 2017-10-07 19:25 - 2017-10-07 19:25 - 002400768 _____ (Farbar) C:\Users\THIS PC\Downloads\FRST64.exe 2017-10-07 19:25 - 2017-10-07 19:25 - 000019157 _____ C:\ComboFix.txt 2017-10-07 10:32 - 2017-10-07 10:32 - 000028272 _____ C:\Windows\system32\Drivers\TrueSight.sys 2017-10-07 10:31 - 2017-10-07 14:40 - 000000000 ____D C:\ProgramData\RogueKiller 2017-10-07 10:31 - 2017-10-07 10:31 - 000000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\RogueKiller 2017-10-07 10:31 - 2017-10-07 10:31 - 000000000 ____D C:\Program Files\RogueKiller 2017-10-07 08:58 - 2017-10-07 19:28 - 000000000 ____D C:\Qoobox 2017-10-07 08:58 - 2011-06-26 15:45 - 000256000 _____ C:\Windows\PEV.exe 2017-10-07 08:58 - 2010-11-08 02:20 - 000208896 _____ C:\Windows\MBR.exe 2017-10-07 08:58 - 2009-04-20 13:56 - 000060416 _____ (NirSoft) C:\Windows\NIRCMD.exe 2017-10-07 08:58 - 2000-08-31 09:00 - 000518144 _____ (SteelWerX) C:\Windows\SWREG.exe 2017-10-07 08:58 - 2000-08-31 09:00 - 000406528 _____ (SteelWerX) C:\Windows\SWSC.exe 2017-10-07 08:58 - 2000-08-31 09:00 - 000098816 _____ C:\Windows\sed.exe 2017-10-07 08:58 - 2000-08-31 09:00 - 000080412 _____ C:\Windows\grep.exe 2017-10-07 08:58 - 2000-08-31 09:00 - 000068096 _____ C:\Windows\zip.exe 2017-09-30 00:24 - 2017-09-30 00:24 - 000000000 ____D C:\Users\THIS PC\.android 2017-09-13 04:28 - 2017-08-20 00:28 - 000197120 _____ (Microsoft Corporation) C:\Windows\system32\shdocvw.dll 2017-09-13 04:28 - 2017-08-20 00:10 - 000180224 _____ (Microsoft Corporation) C:\Windows\SysWOW64\shdocvw.dll 2017-09-13 04:28 - 2017-08-17 00:29 - 000806912 _____ (Microsoft Corporation) C:\Windows\system32\usp10.dll 2017-09-13 04:28 - 2017-08-17 00:10 - 000629760 _____ (Microsoft Corporation) C:\Windows\SysWOW64\usp10.dll 2017-09-13 04:28 - 2017-08-16 23:57 - 003224576 _____ (Microsoft Corporation) C:\Windows\system32\win32k.sys 2017-09-13 04:28 - 2017-08-16 10:10 - 000395976 _____ (Microsoft Corporation) C:\Windows\system32\iedkcs32.dll 2017-09-13 04:28 - 2017-08-16 09:25 - 000347336 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iedkcs32.dll 2017-09-13 04:28 - 2017-08-16 00:29 - 014182400 _____ (Microsoft Corporation) C:\Windows\system32\shell32.dll 2017-09-13 04:28 - 2017-08-16 00:29 - 001867264 _____ (Microsoft Corporation) C:\Windows\system32\ExplorerFrame.dll 2017-09-13 04:28 - 2017-08-16 00:10 - 012880896 _____ (Microsoft Corporation) C:\Windows\SysWOW64\shell32.dll 2017-09-13 04:28 - 2017-08-16 00:10 - 001499648 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ExplorerFrame.dll 2017-09-13 04:28 - 2017-08-15 23:06 - 015260160 _____ (Microsoft Corporation) C:\Windows\system32\ieframe.dll 2017-09-13 04:28 - 2017-08-15 23:01 - 000416256 _____ (Microsoft Corporation) C:\Windows\SysWOW64\dxtmsft.dll 2017-09-13 04:28 - 2017-08-15 23:01 - 000279040 _____ (Microsoft Corporation) C:\Windows\SysWOW64\dxtrans.dll 2017-09-13 04:28 - 2017-08-15 23:01 - 000076288 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtmled.dll 2017-09-13 04:28 - 2017-08-15 22:58 - 013673984 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieframe.dll 2017-09-13 04:28 - 2017-08-15 02:35 - 003203584 _____ (Microsoft Corporation) C:\Windows\system32\mmcndmgr.dll 2017-09-13 04:28 - 2017-08-15 02:35 - 002150912 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mmcndmgr.dll 2017-09-13 04:28 - 2017-08-15 02:35 - 000355328 _____ (Microsoft Corporation) C:\Windows\system32\mmcbase.dll 2017-09-13 04:28 - 2017-08-15 02:35 - 000303104 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mmcbase.dll 2017-09-13 04:28 - 2017-08-15 02:35 - 000172544 _____ (Microsoft Corporation) C:\Windows\SysWOW64\cic.dll 2017-09-13 04:28 - 2017-08-15 02:35 - 000131072 _____ (Microsoft Corporation) C:\Windows\system32\mmcshext.dll 2017-09-13 04:28 - 2017-08-15 02:35 - 000128512 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mmcshext.dll 2017-09-13 04:28 - 2017-08-15 02:34 - 000211968 _____ (Microsoft Corporation) C:\Windows\system32\cic.dll 2017-09-13 04:28 - 2017-08-14 06:37 - 002144256 _____ (Microsoft Corporation) C:\Windows\system32\mmc.exe 2017-09-13 04:28 - 2017-08-14 06:30 - 001401344 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mmc.exe 2017-09-13 04:28 - 2017-08-14 03:58 - 025730560 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.dll 2017-09-13 04:28 - 2017-08-14 02:24 - 002724864 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.tlb 2017-09-13 04:28 - 2017-08-14 02:24 - 000004096 _____ (Microsoft Corporation) C:\Windows\system32\ieetwcollectorres.dll 2017-09-13 04:28 - 2017-08-14 02:06 - 000066560 _____ (Microsoft Corporation) C:\Windows\system32\iesetup.dll 2017-09-13 04:28 - 2017-08-14 02:05 - 000576512 _____ (Microsoft Corporation) C:\Windows\system32\vbscript.dll 2017-09-13 04:28 - 2017-08-14 02:05 - 000417792 _____ (Microsoft Corporation) C:\Windows\system32\html.iec 2017-09-13 04:28 - 2017-08-14 02:05 - 000088064 _____ (Microsoft Corporation) C:\Windows\system32\MshtmlDac.dll 2017-09-13 04:28 - 2017-08-14 02:05 - 000048640 _____ (Microsoft Corporation) C:\Windows\system32\ieetwproxystub.dll 2017-09-13 04:28 - 2017-08-14 02:04 - 002899968 _____ (Microsoft Corporation) C:\Windows\system32\iertutil.dll 2017-09-13 04:28 - 2017-08-14 01:56 - 000054784 _____ (Microsoft Corporation) C:\Windows\system32\jsproxy.dll 2017-09-13 04:28 - 2017-08-14 01:55 - 000034304 _____ (Microsoft Corporation) C:\Windows\system32\iernonce.dll 2017-09-13 04:28 - 2017-08-14 01:54 - 020269056 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.dll 2017-09-13 04:28 - 2017-08-14 01:52 - 000615936 _____ (Microsoft Corporation) C:\Windows\system32\ieui.dll 2017-09-13 04:28 - 2017-08-14 01:51 - 005981696 _____ (Microsoft Corporation) C:\Windows\system32\jscript9.dll 2017-09-13 04:28 - 2017-08-14 01:51 - 000144384 _____ (Microsoft Corporation) C:\Windows\system32\ieUnatt.exe 2017-09-13 04:28 - 2017-08-14 01:51 - 000116224 _____ (Microsoft Corporation) C:\Windows\system32\ieetwcollector.exe 2017-09-13 04:28 - 2017-08-14 01:50 - 000817664 _____ (Microsoft Corporation) C:\Windows\system32\jscript.dll 2017-09-13 04:28 - 2017-08-14 01:50 - 000814080 _____ (Microsoft Corporation) C:\Windows\system32\jscript9diag.dll 2017-09-13 04:28 - 2017-08-14 01:46 - 002724864 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.tlb 2017-09-13 04:28 - 2017-08-14 01:41 - 000968704 _____ (Microsoft Corporation) C:\Windows\system32\MsSpellCheckingFacility.exe 2017-09-13 04:28 - 2017-08-14 01:38 - 000489984 _____ (Microsoft Corporation) C:\Windows\system32\dxtmsft.dll 2017-09-13 04:28 - 2017-08-14 01:30 - 000062464 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iesetup.dll 2017-09-13 04:28 - 2017-08-14 01:29 - 000499200 _____ (Microsoft Corporation) C:\Windows\SysWOW64\vbscript.dll 2017-09-13 04:28 - 2017-08-14 01:29 - 000341504 _____ (Microsoft Corporation) C:\Windows\SysWOW64\html.iec 2017-09-13 04:28 - 2017-08-14 01:29 - 000087552 _____ (Microsoft Corporation) C:\Windows\system32\tdc.ocx 2017-09-13 04:28 - 2017-08-14 01:29 - 000077824 _____ (Microsoft Corporation) C:\Windows\system32\JavaScriptCollectionAgent.dll 2017-09-13 04:28 - 2017-08-14 01:29 - 000047616 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieetwproxystub.dll 2017-09-13 04:28 - 2017-08-14 01:28 - 000064000 _____ (Microsoft Corporation) C:\Windows\SysWOW64\MshtmlDac.dll 2017-09-13 04:28 - 2017-08-14 01:27 - 000107520 _____ (Microsoft Corporation) C:\Windows\system32\inseng.dll 2017-09-13 04:28 - 2017-08-14 01:24 - 002291200 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iertutil.dll 2017-09-13 04:28 - 2017-08-14 01:24 - 000199680 _____ (Microsoft Corporation) C:\Windows\system32\msrating.dll 2017-09-13 04:28 - 2017-08-14 01:23 - 000092160 _____ (Microsoft Corporation) C:\Windows\system32\mshtmled.dll 2017-09-13 04:28 - 2017-08-14 01:22 - 000047104 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jsproxy.dll 2017-09-13 04:28 - 2017-08-14 01:21 - 000030720 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iernonce.dll 2017-09-13 04:28 - 2017-08-14 01:20 - 000315392 _____ (Microsoft Corporation) C:\Windows\system32\dxtrans.dll 2017-09-13 04:28 - 2017-08-14 01:19 - 000476160 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieui.dll 2017-09-13 04:28 - 2017-08-14 01:18 - 000152064 _____ (Microsoft Corporation) C:\Windows\system32\occache.dll 2017-09-13 04:28 - 2017-08-14 01:17 - 000663552 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript.dll 2017-09-13 04:28 - 2017-08-14 01:17 - 000620032 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript9diag.dll 2017-09-13 04:28 - 2017-08-14 01:17 - 000115712 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieUnatt.exe 2017-09-13 04:28 - 2017-08-14 01:07 - 000262144 _____ (Microsoft Corporation) C:\Windows\system32\webcheck.dll 2017-09-13 04:28 - 2017-08-14 01:04 - 000807936 _____ (Microsoft Corporation) C:\Windows\system32\msfeeds.dll 2017-09-13 04:28 - 2017-08-14 01:04 - 000726528 _____ (Microsoft Corporation) C:\Windows\system32\ie4uinit.exe 2017-09-13 04:28 - 2017-08-14 01:02 - 001359360 _____ (Microsoft Corporation) C:\Windows\system32\mshtmlmedia.dll 2017-09-13 04:28 - 2017-08-14 01:01 - 002134528 _____ (Microsoft Corporation) C:\Windows\system32\inetcpl.cpl 2017-09-13 04:28 - 2017-08-14 01:01 - 000073216 _____ (Microsoft Corporation) C:\Windows\SysWOW64\tdc.ocx 2017-09-13 04:28 - 2017-08-14 01:01 - 000060416 _____ (Microsoft Corporation) C:\Windows\SysWOW64\JavaScriptCollectionAgent.dll 2017-09-13 04:28 - 2017-08-14 01:00 - 000091136 _____ (Microsoft Corporation) C:\Windows\SysWOW64\inseng.dll 2017-09-13 04:28 - 2017-08-14 00:57 - 000168960 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msrating.dll 2017-09-13 04:28 - 2017-08-14 00:53 - 000130048 _____ (Microsoft Corporation) C:\Windows\SysWOW64\occache.dll 2017-09-13 04:28 - 2017-08-14 00:48 - 004547072 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript9.dll 2017-09-13 04:28 - 2017-08-14 00:46 - 000230400 _____ (Microsoft Corporation) C:\Windows\SysWOW64\webcheck.dll 2017-09-13 04:28 - 2017-08-14 00:44 - 000694784 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msfeeds.dll 2017-09-13 04:28 - 2017-08-14 00:43 - 002058752 _____ (Microsoft Corporation) C:\Windows\SysWOW64\inetcpl.cpl 2017-09-13 04:28 - 2017-08-14 00:43 - 001155072 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtmlmedia.dll 2017-09-13 04:28 - 2017-08-14 00:40 - 003241472 _____ (Microsoft Corporation) C:\Windows\system32\wininet.dll 2017-09-13 04:28 - 2017-08-14 00:27 - 001544704 _____ (Microsoft Corporation) C:\Windows\system32\urlmon.dll 2017-09-13 04:28 - 2017-08-14 00:18 - 000800768 _____ (Microsoft Corporation) C:\Windows\system32\ieapfltr.dll 2017-09-13 04:28 - 2017-08-14 00:17 - 002767872 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wininet.dll 2017-09-13 04:28 - 2017-08-14 00:14 - 000710144 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieapfltr.dll 2017-09-13 04:28 - 2017-08-14 00:13 - 001314816 _____ (Microsoft Corporation) C:\Windows\SysWOW64\urlmon.dll 2017-09-13 04:28 - 2017-08-11 15:42 - 000631176 _____ (Microsoft Corporation) C:\Windows\system32\winresume.efi 2017-09-13 04:28 - 2017-08-11 15:38 - 005547752 _____ (Microsoft Corporation) C:\Windows\system32\ntoskrnl.exe 2017-09-13 04:28 - 2017-08-11 15:38 - 000706792 _____ (Microsoft Corporation) C:\Windows\system32\winload.efi 2017-09-13 04:28 - 2017-08-11 15:38 - 000154856 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\ksecpkg.sys 2017-09-13 04:28 - 2017-08-11 15:38 - 000095464 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\ksecdd.sys 2017-09-13 04:28 - 2017-08-11 15:36 - 001732864 _____ (Microsoft Corporation) C:\Windows\system32\ntdll.dll 2017-09-13 04:28 - 2017-08-11 15:35 - 002065408 _____ (Microsoft Corporation) C:\Windows\system32\ole32.dll 2017-09-13 04:28 - 2017-08-11 15:35 - 001212928 _____ (Microsoft Corporation) C:\Windows\system32\rpcrt4.dll 2017-09-13 04:28 - 2017-08-11 15:35 - 000757248 _____ (Microsoft Corporation) C:\Windows\system32\win32spl.dll 2017-09-13 04:28 - 2017-08-11 15:35 - 000512000 _____ (Microsoft Corporation) C:\Windows\system32\rpcss.dll 2017-09-13 04:28 - 2017-08-11 15:35 - 000503808 _____ (Microsoft Corporation) C:\Windows\system32\srcore.dll 2017-09-13 04:28 - 2017-08-11 15:35 - 000362496 _____ (Microsoft Corporation) C:\Windows\system32\wow64win.dll 2017-09-13 04:28 - 2017-08-11 15:35 - 000346112 _____ (Microsoft Corporation) C:\Windows\system32\ntprint.dll 2017-09-13 04:28 - 2017-08-11 15:35 - 000345600 _____ (Microsoft Corporation) C:\Windows\system32\schannel.dll 2017-09-13 04:28 - 2017-08-11 15:35 - 000313856 _____ (Microsoft Corporation) C:\Windows\system32\Wldap32.dll 2017-09-13 04:28 - 2017-08-11 15:35 - 000243712 _____ (Microsoft Corporation) C:\Windows\system32\wow64.dll 2017-09-13 04:28 - 2017-08-11 15:35 - 000215552 _____ (Microsoft Corporation) C:\Windows\system32\winsrv.dll 2017-09-13 04:28 - 2017-08-11 15:35 - 000210432 _____ (Microsoft Corporation) C:\Windows\system32\wdigest.dll 2017-09-13 04:28 - 2017-08-11 15:35 - 000190464 _____ (Microsoft Corporation) C:\Windows\system32\rpchttp.dll 2017-09-13 04:28 - 2017-08-11 15:35 - 000135680 _____ (Microsoft Corporation) C:\Windows\system32\sspicli.dll 2017-09-13 04:28 - 2017-08-11 15:35 - 000086528 _____ (Microsoft Corporation) C:\Windows\system32\TSpkg.dll 2017-09-13 04:28 - 2017-08-11 15:35 - 000063488 _____ (Microsoft Corporation) C:\Windows\system32\setbcdlocale.dll 2017-09-13 04:28 - 2017-08-11 15:35 - 000050176 _____ (Microsoft Corporation) C:\Windows\system32\srclient.dll 2017-09-13 04:28 - 2017-08-11 15:35 - 000028672 _____ (Microsoft Corporation) C:\Windows\system32\sspisrv.dll 2017-09-13 04:28 - 2017-08-11 15:35 - 000028160 _____ (Microsoft Corporation) C:\Windows\system32\secur32.dll 2017-09-13 04:28 - 2017-08-11 15:35 - 000026112 _____ (Microsoft Corporation) C:\Windows\system32\oleres.dll 2017-09-13 04:28 - 2017-08-11 15:35 - 000026112 _____ (Microsoft Corporation) C:\Windows\system32\nsisvc.dll 2017-09-13 04:28 - 2017-08-11 15:35 - 000025600 _____ (Microsoft Corporation) C:\Windows\system32\winnsi.dll 2017-09-13 04:28 - 2017-08-11 15:35 - 000016384 _____ (Microsoft Corporation) C:\Windows\system32\ntvdm64.dll 2017-09-13 04:28 - 2017-08-11 15:35 - 000013312 _____ (Microsoft Corporation) C:\Windows\system32\wow64cpu.dll 2017-09-13 04:28 - 2017-08-11 15:35 - 000013312 _____ (Microsoft Corporation) C:\Windows\system32\nsi.dll 2017-09-13 04:28 - 2017-08-11 15:34 - 001460736 _____ (Microsoft Corporation) C:\Windows\system32\lsasrv.dll 2017-09-13 04:28 - 2017-08-11 15:34 - 001163264 _____ (Microsoft Corporation) C:\Windows\system32\kernel32.dll 2017-09-13 04:28 - 2017-08-11 15:34 - 000971776 _____ (Microsoft Corporation) C:\Windows\system32\localspl.dll 2017-09-13 04:28 - 2017-08-11 15:34 - 000880640 _____ (Microsoft Corporation) C:\Windows\system32\advapi32.dll 2017-09-13 04:28 - 2017-08-11 15:34 - 000731648 _____ (Microsoft Corporation) C:\Windows\system32\kerberos.dll 2017-09-13 04:28 - 2017-08-11 15:34 - 000690688 _____ (Microsoft Corporation) C:\Windows\system32\adtschema.dll 2017-09-13 04:28 - 2017-08-11 15:34 - 000463872 _____ (Microsoft Corporation) C:\Windows\system32\certcli.dll 2017-09-13 04:28 - 2017-08-11 15:34 - 000419840 _____ (Microsoft Corporation) C:\Windows\system32\KernelBase.dll 2017-09-13 04:28 - 2017-08-11 15:34 - 000316928 _____ (Microsoft Corporation) C:\Windows\system32\msv1_0.dll 2017-09-13 04:28 - 2017-08-11 15:34 - 000312320 _____ (Microsoft Corporation) C:\Windows\system32\ncrypt.dll 2017-09-13 04:28 - 2017-08-11 15:34 - 000166400 _____ (Microsoft Corporation) C:\Windows\system32\inetpp.dll 2017-09-13 04:28 - 2017-08-11 15:34 - 000146432 _____ (Microsoft Corporation) C:\Windows\system32\msaudite.dll 2017-09-13 04:28 - 2017-08-11 15:34 - 000123904 _____ (Microsoft Corporation) C:\Windows\system32\bcrypt.dll 2017-09-13 04:28 - 2017-08-11 15:34 - 000060416 _____ (Microsoft Corporation) C:\Windows\system32\msobjs.dll 2017-09-13 04:28 - 2017-08-11 15:34 - 000059904 _____ (Microsoft Corporation) C:\Windows\system32\appidapi.dll 2017-09-13 04:28 - 2017-08-11 15:34 - 000044032 _____ (Microsoft Corporation) C:\Windows\system32\csrsrv.dll 2017-09-13 04:28 - 2017-08-11 15:34 - 000043520 _____ (Microsoft Corporation) C:\Windows\system32\cryptbase.dll 2017-09-13 04:28 - 2017-08-11 15:34 - 000034816 _____ (Microsoft Corporation) C:\Windows\system32\appidsvc.dll 2017-09-13 04:28 - 2017-08-11 15:34 - 000022528 _____ (Microsoft Corporation) C:\Windows\system32\inetppui.dll 2017-09-13 04:28 - 2017-08-11 15:34 - 000022016 _____ (Microsoft Corporation) C:\Windows\system32\credssp.dll 2017-09-13 04:28 - 2017-08-11 15:34 - 000008704 _____ (Microsoft Corporation) C:\Windows\system32\comcat.dll 2017-09-13 04:28 - 2017-08-11 15:34 - 000006656 _____ (Microsoft Corporation) C:\Windows\system32\apisetschema.dll 2017-09-13 04:28 - 2017-08-11 15:34 - 000006144 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-security-base-l1-1-0.dll 2017-09-13 04:28 - 2017-08-11 15:34 - 000005120 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-file-l1-1-0.dll 2017-09-13 04:28 - 2017-08-11 15:34 - 000004608 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-threadpool-l1-1-0.dll 2017-09-13 04:28 - 2017-08-11 15:34 - 000004608 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-processthreads-l1-1-0.dll 2017-09-13 04:28 - 2017-08-11 15:34 - 000004096 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-sysinfo-l1-1-0.dll 2017-09-13 04:28 - 2017-08-11 15:34 - 000004096 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-synch-l1-1-0.dll 2017-09-13 04:28 - 2017-08-11 15:34 - 000004096 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-localregistry-l1-1-0.dll 2017-09-13 04:28 - 2017-08-11 15:34 - 000004096 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-localization-l1-1-0.dll 2017-09-13 04:28 - 2017-08-11 15:34 - 000003584 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-rtlsupport-l1-1-0.dll 2017-09-13 04:28 - 2017-08-11 15:34 - 000003584 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-processenvironment-l1-1-0.dll 2017-09-13 04:28 - 2017-08-11 15:34 - 000003584 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-namedpipe-l1-1-0.dll 2017-09-13 04:28 - 2017-08-11 15:34 - 000003584 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-misc-l1-1-0.dll 2017-09-13 04:28 - 2017-08-11 15:34 - 000003584 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-memory-l1-1-0.dll 2017-09-13 04:28 - 2017-08-11 15:34 - 000003584 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-libraryloader-l1-1-0.dll 2017-09-13 04:28 - 2017-08-11 15:34 - 000003584 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-heap-l1-1-0.dll 2017-09-13 04:28 - 2017-08-11 15:34 - 000003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-xstate-l1-1-0.dll 2017-09-13 04:28 - 2017-08-11 15:34 - 000003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-util-l1-1-0.dll 2017-09-13 04:28 - 2017-08-11 15:34 - 000003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-string-l1-1-0.dll 2017-09-13 04:28 - 2017-08-11 15:34 - 000003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-profile-l1-1-0.dll 2017-09-13 04:28 - 2017-08-11 15:34 - 000003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-io-l1-1-0.dll 2017-09-13 04:28 - 2017-08-11 15:34 - 000003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-interlocked-l1-1-0.dll 2017-09-13 04:28 - 2017-08-11 15:34 - 000003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-handle-l1-1-0.dll 2017-09-13 04:28 - 2017-08-11 15:34 - 000003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-fibers-l1-1-0.dll 2017-09-13 04:28 - 2017-08-11 15:34 - 000003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-errorhandling-l1-1-0.dll 2017-09-13 04:28 - 2017-08-11 15:34 - 000003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-delayload-l1-1-0.dll 2017-09-13 04:28 - 2017-08-11 15:34 - 000003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-debug-l1-1-0.dll 2017-09-13 04:28 - 2017-08-11 15:34 - 000003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-datetime-l1-1-0.dll 2017-09-13 04:28 - 2017-08-11 15:34 - 000003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-console-l1-1-0.dll 2017-09-13 04:28 - 2017-08-11 15:24 - 004001000 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ntkrnlpa.exe 2017-09-13 04:28 - 2017-08-11 15:24 - 003945704 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ntoskrnl.exe 2017-09-13 04:28 - 2017-08-11 15:21 - 001314112 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ntdll.dll 2017-09-13 04:28 - 2017-08-11 15:20 - 000071680 _____ C:\Windows\system32\PrintBrmUi.exe 2017-09-13 04:28 - 2017-08-11 15:20 - 000061952 _____ (Microsoft Corporation) C:\Windows\system32\ntprint.exe 2017-09-13 04:28 - 2017-08-11 15:20 - 000048640 _____ (Microsoft Corporation) C:\Windows\system32\wpnpinst.exe 2017-09-13 04:28 - 2017-08-11 15:19 - 001417728 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ole32.dll 2017-09-13 04:28 - 2017-08-11 15:19 - 001114112 _____ (Microsoft Corporation) C:\Windows\SysWOW64\kernel32.dll 2017-09-13 04:28 - 2017-08-11 15:19 - 000690688 _____ (Microsoft Corporation) C:\Windows\SysWOW64\adtschema.dll 2017-09-13 04:28 - 2017-08-11 15:19 - 000666112 _____ (Microsoft Corporation) C:\Windows\SysWOW64\rpcrt4.dll 2017-09-13 04:28 - 2017-08-11 15:19 - 000644096 _____ (Microsoft Corporation) C:\Windows\SysWOW64\advapi32.dll 2017-09-13 04:28 - 2017-08-11 15:19 - 000554496 _____ (Microsoft Corporation) C:\Windows\SysWOW64\kerberos.dll 2017-09-13 04:28 - 2017-08-11 15:19 - 000497664 _____ (Microsoft Corporation) C:\Windows\SysWOW64\win32spl.dll 2017-09-13 04:28 - 2017-08-11 15:19 - 000342528 _____ (Microsoft Corporation) C:\Windows\SysWOW64\certcli.dll 2017-09-13 04:28 - 2017-08-11 15:19 - 000299008 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ntprint.dll 2017-09-13 04:28 - 2017-08-11 15:19 - 000275456 _____ (Microsoft Corporation) C:\Windows\SysWOW64\KernelBase.dll 2017-09-13 04:28 - 2017-08-11 15:19 - 000271360 _____ (Microsoft Corporation) C:\Windows\SysWOW64\Wldap32.dll 2017-09-13 04:28 - 2017-08-11 15:19 - 000261120 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msv1_0.dll 2017-09-13 04:28 - 2017-08-11 15:19 - 000254464 _____ (Microsoft Corporation) C:\Windows\SysWOW64\schannel.dll 2017-09-13 04:28 - 2017-08-11 15:19 - 000223232 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ncrypt.dll 2017-09-13 04:28 - 2017-08-11 15:19 - 000172032 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wdigest.dll 2017-09-13 04:28 - 2017-08-11 15:19 - 000146432 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msaudite.dll 2017-09-13 04:28 - 2017-08-11 15:19 - 000141312 _____ (Microsoft Corporation) C:\Windows\SysWOW64\rpchttp.dll 2017-09-13 04:28 - 2017-08-11 15:19 - 000096768 _____ (Microsoft Corporation) C:\Windows\SysWOW64\sspicli.dll 2017-09-13 04:28 - 2017-08-11 15:19 - 000082944 _____ (Microsoft Corporation) C:\Windows\SysWOW64\bcrypt.dll 2017-09-13 04:28 - 2017-08-11 15:19 - 000065536 _____ (Microsoft Corporation) C:\Windows\SysWOW64\TSpkg.dll 2017-09-13 04:28 - 2017-08-11 15:19 - 000060416 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msobjs.dll 2017-09-13 04:28 - 2017-08-11 15:19 - 000050688 _____ (Microsoft Corporation) C:\Windows\SysWOW64\appidapi.dll 2017-09-13 04:28 - 2017-08-11 15:19 - 000043008 _____ (Microsoft Corporation) C:\Windows\SysWOW64\srclient.dll 2017-09-13 04:28 - 2017-08-11 15:19 - 000026112 _____ (Microsoft Corporation) C:\Windows\SysWOW64\oleres.dll 2017-09-13 04:28 - 2017-08-11 15:19 - 000022016 _____ (Microsoft Corporation) C:\Windows\SysWOW64\secur32.dll 2017-09-13 04:28 - 2017-08-11 15:19 - 000017408 _____ (Microsoft Corporation) C:\Windows\SysWOW64\credssp.dll 2017-09-13 04:28 - 2017-08-11 15:19 - 000016384 _____ (Microsoft Corporation) C:\Windows\SysWOW64\winnsi.dll 2017-09-13 04:28 - 2017-08-11 15:19 - 000008704 _____ (Microsoft Corporation) C:\Windows\SysWOW64\nsi.dll 2017-09-13 04:28 - 2017-08-11 15:19 - 000006656 _____ (Microsoft Corporation) C:\Windows\SysWOW64\apisetschema.dll 2017-09-13 04:28 - 2017-08-11 15:19 - 000005120 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-file-l1-1-0.dll 2017-09-13 04:28 - 2017-08-11 15:19 - 000005120 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wow32.dll 2017-09-13 04:28 - 2017-08-11 15:19 - 000004608 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-processthreads-l1-1-0.dll 2017-09-13 04:28 - 2017-08-11 15:19 - 000004096 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-sysinfo-l1-1-0.dll 2017-09-13 04:28 - 2017-08-11 15:19 - 000004096 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-synch-l1-1-0.dll 2017-09-13 04:28 - 2017-08-11 15:19 - 000004096 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-misc-l1-1-0.dll 2017-09-13 04:28 - 2017-08-11 15:19 - 000004096 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-localregistry-l1-1-0.dll 2017-09-13 04:28 - 2017-08-11 15:19 - 000004096 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-localization-l1-1-0.dll 2017-09-13 04:28 - 2017-08-11 15:19 - 000003584 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-processenvironment-l1-1-0.dll 2017-09-13 04:28 - 2017-08-11 15:19 - 000003584 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-namedpipe-l1-1-0.dll 2017-09-13 04:28 - 2017-08-11 15:19 - 000003584 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-memory-l1-1-0.dll 2017-09-13 04:28 - 2017-08-11 15:19 - 000003584 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-libraryloader-l1-1-0.dll 2017-09-13 04:28 - 2017-08-11 15:19 - 000003584 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-interlocked-l1-1-0.dll 2017-09-13 04:28 - 2017-08-11 15:19 - 000003584 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-heap-l1-1-0.dll 2017-09-13 04:28 - 2017-08-11 15:19 - 000003072 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-string-l1-1-0.dll 2017-09-13 04:28 - 2017-08-11 15:19 - 000003072 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-rtlsupport-l1-1-0.dll 2017-09-13 04:28 - 2017-08-11 15:19 - 000003072 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-profile-l1-1-0.dll 2017-09-13 04:28 - 2017-08-11 15:19 - 000003072 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-io-l1-1-0.dll 2017-09-13 04:28 - 2017-08-11 15:19 - 000003072 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-handle-l1-1-0.dll 2017-09-13 04:28 - 2017-08-11 15:19 - 000003072 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-fibers-l1-1-0.dll 2017-09-13 04:28 - 2017-08-11 15:19 - 000003072 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-errorhandling-l1-1-0.dll 2017-09-13 04:28 - 2017-08-11 15:19 - 000003072 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-delayload-l1-1-0.dll 2017-09-13 04:28 - 2017-08-11 15:19 - 000003072 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-debug-l1-1-0.dll 2017-09-13 04:28 - 2017-08-11 15:19 - 000003072 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-datetime-l1-1-0.dll 2017-09-13 04:28 - 2017-08-11 15:19 - 000003072 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-console-l1-1-0.dll 2017-09-13 04:28 - 2017-08-11 15:12 - 000025088 _____ (Microsoft Corporation) C:\Windows\system32\netbtugc.exe 2017-09-13 04:28 - 2017-08-11 15:09 - 000061952 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ntprint.exe 2017-09-13 04:28 - 2017-08-11 15:07 - 000148480 _____ (Microsoft Corporation) C:\Windows\system32\appidpolicyconverter.exe 2017-09-13 04:28 - 2017-08-11 15:07 - 000062464 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\appid.sys 2017-09-13 04:28 - 2017-08-11 15:07 - 000017920 _____ (Microsoft Corporation) C:\Windows\system32\appidcertstorecheck.exe 2017-09-13 04:28 - 2017-08-11 15:06 - 000064000 _____ (Microsoft Corporation) C:\Windows\system32\auditpol.exe 2017-09-13 04:28 - 2017-08-11 15:03 - 000338432 _____ (Microsoft Corporation) C:\Windows\system32\conhost.exe 2017-09-13 04:28 - 2017-08-11 15:03 - 000026624 _____ (Microsoft Corporation) C:\Windows\SysWOW64\netbtugc.exe 2017-09-13 04:28 - 2017-08-11 15:02 - 000296960 _____ (Microsoft Corporation) C:\Windows\system32\rstrui.exe 2017-09-13 04:28 - 2017-08-11 15:01 - 000007168 _____ (Microsoft Corporation) C:\Windows\SysWOW64\comcat.dll 2017-09-13 04:28 - 2017-08-11 15:00 - 000262656 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\netbt.sys 2017-09-13 04:28 - 2017-08-11 15:00 - 000159744 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\mrxsmb.sys 2017-09-13 04:28 - 2017-08-11 15:00 - 000050176 _____ (Microsoft Corporation) C:\Windows\SysWOW64\auditpol.exe 2017-09-13 04:28 - 2017-08-11 14:59 - 000460800 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\srv.sys 2017-09-13 04:28 - 2017-08-11 14:59 - 000405504 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\srv2.sys 2017-09-13 04:28 - 2017-08-11 14:59 - 000291328 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\mrxsmb10.sys 2017-09-13 04:28 - 2017-08-11 14:59 - 000168448 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\srvnet.sys 2017-09-13 04:28 - 2017-08-11 14:59 - 000129536 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\mrxsmb20.sys 2017-09-13 04:28 - 2017-08-11 14:58 - 000112640 _____ (Microsoft Corporation) C:\Windows\system32\smss.exe 2017-09-13 04:28 - 2017-08-11 14:58 - 000030720 _____ (Microsoft Corporation) C:\Windows\system32\lsass.exe 2017-09-13 04:28 - 2017-08-11 14:58 - 000026112 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\nsiproxy.sys 2017-09-13 04:28 - 2017-08-11 14:56 - 000025600 _____ (Microsoft Corporation) C:\Windows\SysWOW64\setup16.exe 2017-09-13 04:28 - 2017-08-11 14:56 - 000014336 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ntvdm64.dll 2017-09-13 04:28 - 2017-08-11 14:56 - 000007680 _____ (Microsoft Corporation) C:\Windows\SysWOW64\instnm.exe 2017-09-13 04:28 - 2017-08-11 14:56 - 000002048 _____ (Microsoft Corporation) C:\Windows\SysWOW64\user.exe 2017-09-13 04:28 - 2017-08-11 14:55 - 000036352 _____ (Microsoft Corporation) C:\Windows\SysWOW64\cryptbase.dll 2017-09-13 04:28 - 2017-08-11 14:55 - 000006144 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-security-base-l1-1-0.dll 2017-09-13 04:28 - 2017-08-11 14:55 - 000004608 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-threadpool-l1-1-0.dll 2017-09-13 04:28 - 2017-08-11 14:55 - 000003584 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-xstate-l1-1-0.dll 2017-09-13 04:28 - 2017-08-11 14:55 - 000003072 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-util-l1-1-0.dll 2017-09-13 04:28 - 2017-07-08 00:29 - 001143296 _____ (Microsoft Corporation) C:\Windows\system32\DXPTaskRingtone.dll 2017-09-13 04:28 - 2017-07-08 00:10 - 000973312 _____ (Microsoft Corporation) C:\Windows\SysWOW64\DXPTaskRingtone.dll 2017-09-08 16:00 - 2017-09-08 16:00 - 000000000 ____D C:\Users\THIS PC\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Bethesda.net Launcher 2017-09-08 15:59 - 2017-09-08 15:59 - 000031598 _____ C:\Windows\SysWOW64\report.txt 2017-09-08 15:58 - 2017-09-08 17:09 - 000000000 ____D C:\Program Files (x86)\Bethesda.net Launcher 2017-09-08 15:58 - 2017-09-08 15:59 - 000000000 ____D C:\Users\THIS PC\AppData\Local\Bethesda.net Launcher 2017-09-08 15:58 - 2017-09-08 15:58 - 000000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Bethesda.net Launcher 2017-09-07 15:14 - 2017-09-07 15:14 - 000000000 ____D C:\Users\THIS PC\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\F4SE ==================== One Month Modified files and folders ======== (If an entry is included in the fixlist, the file/folder will be moved.) 2017-10-07 19:29 - 2016-08-04 01:05 - 000000000 ____D C:\FRST 2017-10-07 18:54 - 2009-07-14 11:34 - 000000215 _____ C:\Windows\system.ini 2017-10-07 17:47 - 2016-02-26 09:25 - 000000000 ____D C:\Users\THIS PC\AppData\Local\Apps\2.0 2017-10-07 17:47 - 2014-08-31 15:02 - 000000000 ___RD C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Utils 2017-10-07 17:38 - 2014-08-12 01:09 - 000000000 ____D C:\Users\THIS PC\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Utils 2017-10-07 17:11 - 2009-07-14 13:45 - 000035488 ____H C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0 2017-10-07 17:11 - 2009-07-14 13:45 - 000035488 ____H C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0 2017-10-07 17:11 - 2009-07-14 12:20 - 000000000 ____D C:\Windows\inf 2017-10-07 15:08 - 2009-07-14 14:13 - 000782682 _____ C:\Windows\system32\PerfStringBackup.INI 2017-10-07 15:02 - 2017-03-03 15:27 - 000000000 ____D C:\ProgramData\NVIDIA 2017-10-07 15:02 - 2015-08-16 15:48 - 000000000 ____D C:\Program Files (x86)\Steam 2017-10-07 15:02 - 2009-07-14 14:08 - 000000006 ____H C:\Windows\Tasks\SA.DAT 2017-10-07 10:10 - 2014-08-11 03:52 - 000000000 ____D C:\ProgramData\Malwarebytes 2017-10-07 09:33 - 2016-07-02 01:13 - 000000000 ____D C:\Users\THIS PC\AppData\Roaming\Notepad++ 2017-10-07 09:33 - 2015-12-27 14:30 - 000000000 ____D C:\Users\THIS PC\AppData\Local\CrashDumps 2017-10-07 09:01 - 2015-09-05 07:04 - 000000000 ____D C:\Windows\erdnt 2017-10-07 08:53 - 2017-04-25 20:35 - 000803328 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerApp.exe 2017-10-07 08:53 - 2017-04-25 20:35 - 000144896 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerCPLApp.cpl 2017-10-07 08:53 - 2017-04-25 20:35 - 000004324 _____ C:\Windows\System32\Tasks\Adobe Flash Player Updater 2017-10-07 08:53 - 2015-05-18 11:05 - 000000000 ____D C:\Windows\system32\Macromed 2017-10-07 08:53 - 2014-08-11 00:38 - 000000000 ____D C:\Users\THIS PC\AppData\Local\Adobe 2017-10-07 08:52 - 2014-08-12 00:59 - 000000000 ____D C:\Windows\SysWOW64\Macromed 2017-10-07 07:59 - 2009-07-14 14:08 - 000032608 _____ C:\Windows\Tasks\SCHEDLGU.TXT 2017-10-07 06:59 - 2014-08-10 18:31 - 000000000 ____D C:\Users\THIS PC\AppData\Roaming\vlc 2017-10-07 03:33 - 2015-11-13 13:57 - 000000000 ____D C:\Users\THIS PC\AppData\Local\Fallout4 2017-10-06 14:01 - 2015-05-18 10:54 - 000000000 ____D C:\Program Files (x86)\Mozilla Maintenance Service 2017-10-05 21:18 - 2017-03-04 18:24 - 000003832 _____ C:\Windows\System32\Tasks\Opera scheduled Autoupdate 1488619447 2017-10-05 21:18 - 2017-03-04 18:23 - 000000000 ____D C:\Program Files\Opera 2017-10-05 18:31 - 2016-11-16 07:43 - 000000000 ____D C:\Program Files (x86)\Mozilla Firefox 2017-09-26 18:39 - 2014-08-10 23:39 - 000000000 ____D C:\Users\THIS PC\Documents\ACID Pro 7.0 Projects 2017-09-15 11:07 - 2009-07-14 12:20 - 000000000 ____D C:\Windows\rescache 2017-09-13 15:31 - 2009-07-14 13:45 - 000352680 _____ C:\Windows\system32\FNTCACHE.DAT 2017-09-13 04:32 - 2014-08-10 19:21 - 000000000 ____D C:\Windows\system32\MRT 2017-09-13 04:30 - 2014-08-10 19:21 - 138202976 ____C (Microsoft Corporation) C:\Windows\system32\MRT.exe 2017-09-13 04:29 - 2014-08-09 21:57 - 000766548 _____ C:\Windows\SysWOW64\PerfStringBackup.INI ==================== Files in the root of some directories ======= 2016-11-24 20:37 - 2016-11-24 20:37 - 000046530 _____ () C:\Users\THIS PC\AppData\Roaming\DreamPlan.dmp 2015-09-18 12:47 - 2017-07-17 03:54 - 000001456 _____ () C:\Users\THIS PC\AppData\Local\Adobe Save for Web 13.0 Prefs 2017-06-18 06:19 - 2013-01-08 11:19 - 018158238 _____ () C:\Users\THIS PC\AppData\Local\OcrMap.bin 2017-05-31 17:23 - 2017-05-31 17:23 - 000000218 _____ () C:\Users\THIS PC\AppData\Local\recently-used.xbel 2015-01-25 22:02 - 2016-12-08 17:32 - 000007661 _____ () C:\Users\THIS PC\AppData\Local\Resmon.ResmonCfg 2017-05-29 19:38 - 2017-05-29 19:38 - 000000096 _____ () C:\ProgramData\Microsoft.SqlServer.Compact.400.32.bc 2014-09-27 13:09 - 2014-09-27 13:09 - 000004138 _____ () C:\ProgramData\updkbqqg.iqa ==================== Bamital & volsnap ====================== (There is no automatic fix for files that do not pass verification.) C:\Windows\system32\winlogon.exe => File is digitally signed C:\Windows\system32\wininit.exe => File is digitally signed C:\Windows\SysWOW64\wininit.exe => File is digitally signed C:\Windows\explorer.exe => File is digitally signed C:\Windows\SysWOW64\explorer.exe => File is digitally signed C:\Windows\system32\svchost.exe => File is digitally signed C:\Windows\SysWOW64\svchost.exe => File is digitally signed C:\Windows\system32\services.exe => File is digitally signed C:\Windows\system32\User32.dll => File is digitally signed C:\Windows\SysWOW64\User32.dll => File is digitally signed C:\Windows\system32\userinit.exe => File is digitally signed C:\Windows\SysWOW64\userinit.exe => File is digitally signed C:\Windows\system32\rpcss.dll => File is digitally signed C:\Windows\system32\dnsapi.dll => File is digitally signed C:\Windows\SysWOW64\dnsapi.dll => File is digitally signed C:\Windows\system32\Drivers\volsnap.sys => File is digitally signed LastRegBack: 2017-09-30 08:27 ==================== End of FRST.txt ============================ Addition.txt

Good Afternoon Kevin, thanks for the reply! OK, I'll follow your steps.

Hello, I'm pulling my hair out here! Each time the system is shut down (Start / Shut Down), there appears to be some sort of timer re-boot that automatically restarts Windows. It's takes this rogue timer approximately two~five minutes to activate. I checked my settings: System Properties / Advanced / Start Up and Recovery / Settings / Automatically Restart This box was checked. I unchecked it a tested a re-boot. It didn't change the auto-restarting. I thought it might have been a setting in the registry (Windows Forum). HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon "PowerdownAfterShutdown" Change it to "0" if it is "1" OR Change it to "1" if it is "0". I turned to more complex measures. I downloaded malware bytes in the hope that a simple scan would be effective but it appears to have missed whatever is causing this frustrating behaviour. In an attempt to combat this, I have used tools that in the past have fixed any issues I came across; Hi-Jack this, Combo Fix and RogueKiller. Nothing seems to want to rid this system of this annoyance. I have the scan logs from all three software. I'm looking for the right direction as to what I should do next, so if anyone would like to prevent my head going bold, please step forward. This system is running Windows 7 x64 Professional (last Windows update ran on October 7th, 2017) EDIT: I forgot to mention from reading posts, this issue could be caused by Windows Crashing on Shut Down. On checking the systems logs, I have an error which reads; Log Name: System Source: Service Control Manager Date: 07/10/2017 09:43:04 Event ID: 7026 Task Category: None Level: Error Keywords: Classic User: N/A Computer: THIS PC Description: The following boot-start or system-start driver(s) failed to load: MBAMSwissArmy Event Xml: <Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event"> <System> <Provider Name="Service Control Manager" Guid="{555908d1-a6d7-4695-8e1e-26931d2012f4}" EventSourceName="Service Control Manager" /> <EventID Qualifiers="49152">7026</EventID> <Version>0</Version> <Level>2</Level> <Task>0</Task> <Opcode>0</Opcode> <Keywords>0x8080000000000000</Keywords> <TimeCreated SystemTime="2017-10-07T00:43:04.087623900Z" /> <EventRecordID>316685</EventRecordID> <Correlation /> <Execution ProcessID="844" ThreadID="848" /> <Channel>System</Channel> <Computer>mdgm-PC</Computer> <Security /> </System> <EventData> <Data Name="param1"> MBAMSwissArmy</Data> </EventData> </Event>