Jump to content

saundm

Members
  • Posts

    4
  • Joined

  • Last visited

Reputation

0 Neutral
  1. Sorry Nasdaq, I thought we were done....?
  2. Hi Nasdaq Fix applied and file attached. On restart I have had the same popup. And this one too. If there is no problem with malware I will run the crosscheck - I presume that it is a genuine popup. Thanks for your help.
  3. Hi Nasdaq and thank you in advance! Here is the content of FRST Scan result of Farbar Recovery Scan Tool (FRST) (x64) Version: 17.03.2019 Ran by matth (administrator) on MATTHEW-SURFACE (26-03-2019 20:10:39) Running from C:\Users\matth\Downloads Loaded Profiles: matth & (Available Profiles: matth & Linus & .NET v4.5 & DefaultAppPool & .NET v4.5 Classic) Platform: Windows 10 Pro Version 1803 17134.648 (X64) Language: English (United Kingdom) Default browser: IE Boot Mode: Normal Tutorial for Farbar Recovery Scan Tool: http://www.geekstogo.com/forum/topic/335081-frst-tutorial-how-to-use-farbar-recovery-scan-tool/ ==================== Processes (Whitelisted) ================= (If an entry is included in the fixlist, the process will be closed. The file will not be moved.) (NVIDIA Corporation -> NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\Display.NvContainer\NVDisplay.Container.exe (NVIDIA Corporation -> NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\Display.NvContainer\NVDisplay.Container.exe (Adobe Systems, Incorporated -> Adobe Systems Incorporated) C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe (Adobe Systems Incorporated -> Adobe Systems, Incorporated) C:\Program Files (x86)\Common Files\Adobe\AdobeGCClient\AGMService.exe (Adobe Systems Incorporated -> Adobe Systems, Incorporated) C:\Program Files (x86)\Common Files\Adobe\AdobeGCClient\AGSService.exe (Adobe Systems Incorporated -> Adobe Inc.) C:\Program Files (x86)\Common Files\Adobe\Adobe Desktop Common\ElevationManager\AdobeUpdateService.exe (Apple Inc. -> Apple Inc.) C:\Program Files\Bonjour\mDNSResponder.exe (Cisco WebEx LLC -> Cisco WebEx LLC) C:\Windows\SysWOW64\atashost.exe (Apple Inc. -> Apple Inc.) C:\Program Files\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe (Microsoft Corporation -> Microsoft Corporation) C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeClickToRun.exe (Dropbox, Inc -> Dropbox, Inc.) C:\Windows\System32\DbxSvc.exe (Intel(R) pGFX -> Intel Corporation) C:\Windows\System32\DriverStore\FileRepository\64gh6293.inf_amd64_22fd8f9659edd17f\IntelCpHDCPSvc.exe (devolo AG -> devolo AG) C:\Program Files (x86)\devolo\dlan\devolonetsvc.exe (McAfee, Inc. -> McAfee, Inc.) C:\Program Files\McAfee\WebAdvisor\servicehost.exe (McAfee, Inc. -> McAfee, LLC) C:\Program Files\Common Files\McAfee\SystemCore\mfemms.exe (McAfee, Inc. -> McAfee, Inc.) C:\Program Files\Common Files\McAfee\ModuleCore\ModuleCoreService.exe (Microsoft Windows -> Microsoft Corporation) C:\Windows\System32\mqsvc.exe () [File not signed] C:\Program Files\MySQL\MySQL Server 8.0\bin\mysqld.exe (Nitro Software, Inc. -> Nitro Software, Inc.) C:\Program Files\Nitro\Pro 10\NitroPDFDriverService10x64.exe (Microsoft Corporation -> Microsoft Corporation) C:\Windows\Microsoft.NET\Framework64\v4.0.30319\SMSvcHost.exe (Nitro Software, Inc. -> ) C:\Program Files\Nitro\Pro 10\Nitro_UpdateService.exe (Nitro Software, Inc. -> Nalpeiron Ltd.) C:\Windows\SysWOW64\NLSSRV32.EXE (NVIDIA Corporation -> NVIDIA Corporation) C:\Program Files (x86)\NVIDIA Corporation\NvTelemetry\NvTelemetryContainer.exe (McAfee, Inc. -> McAfee, Inc.) C:\Program Files\Common Files\McAfee\PEF\CORE\PEFService.exe (Sage (UK) Ltd.) [File not signed] C:\Program Files (x86)\Sage\AccountsServiceV24\sg50CtrlSvc_v24.exe (Sage (UK) Ltd.) [File not signed] C:\Program Files (x86)\Sage\AccountsServiceV24\sg50svc_v24.exe (Microsoft) [File not signed] C:\Program Files (x86)\Common Files\Sage\Central\AutoUpdateClient\Sage.Central.AutoUpdateManager.Service.exe (Sage UK Limited) [File not signed] C:\Program Files (x86)\Common Files\Sage\Shared\AutoUpdateManager\v2\Sage.Central.AutoUpdateManager.Service.exe (Sage (UK) Limited) [File not signed] C:\Program Files (x86)\Common Files\Sage SData\Sage.SData.Service.exe (Microsoft Corporation -> Microsoft Corporation) C:\Windows\System32\SurfaceDtxService.exe (Microsoft Corporation -> Microsoft Corporation) C:\Windows\System32\SurfaceUsbHubFwUpdateService.exe (TeamViewer GmbH -> TeamViewer GmbH) C:\Program Files (x86)\TeamViewer\TeamViewer_Service.exe (Malwarebytes Corporation -> Malwarebytes) C:\Program Files\Malwarebytes\Anti-Malware\MBAMService.exe (McAfee, Inc. -> McAfee, LLC) C:\Windows\System32\mfevtps.exe () [File not signed] C:\Program Files\MySQL\MySQL Server 8.0\bin\mysqld.exe (Intel(R) pGFX -> Intel Corporation) C:\Windows\System32\DriverStore\FileRepository\64gh6293.inf_amd64_22fd8f9659edd17f\IntelCpHeciSvc.exe (McAfee, Inc. -> McAfee, Inc.) C:\Program Files\Common Files\McAfee\MMSSHost\MMSSHOST.exe (McAfee, Inc. -> McAfee, LLC) C:\Windows\System32\mfevtps.exe (Microsoft Corporation -> Microsoft Corporation) C:\Windows\Microsoft.NET\Framework64\v4.0.30319\SMSvcHost.exe (McAfee, Inc. -> McAfee, Inc.) C:\Program Files\McAfee\MfeAV\MfeAVSvc.exe (McAfee, Inc. -> McAfee, Inc.) C:\Program Files\McAfee\WebAdvisor\uihost.exe (McAfee, Inc. -> McAfee, LLC) C:\Program Files\Common Files\McAfee\SystemCore\mfefire.exe (McAfee, Inc. -> McAfee, Inc.) C:\Program Files\Common Files\McAfee\VSCore_18_5\mcapexe.exe (McAfee, Inc. -> McAfee, Inc.) C:\Program Files\Common Files\McAfee\CSP\2.9.175.0\McCSPServiceHost.exe (Microsoft Windows -> Microsoft Corporation) C:\Windows\System32\dllhost.exe (McAfee, Inc. -> McAfee LLC.) C:\Program Files\Common Files\McAfee\AMCore\mcshield.exe (Microsoft Windows -> Microsoft Corporation) C:\Windows\System32\dllhost.exe () [File not signed] C:\Program Files\WindowsApps\Microsoft.SkypeApp_14.41.54.0_x64__kzf8qxf38zg5c\SkypeBackgroundHost.exe (Microsoft Windows -> Microsoft Corporation) C:\Windows\System32\Speech_OneCore\common\SpeechRuntime.exe (Microsoft Corporation) [File not signed] C:\Program Files\WindowsApps\Microsoft.SkypeApp_14.41.54.0_x64__kzf8qxf38zg5c\SkypeApp.exe (Microsoft Windows -> Microsoft Corporation) C:\Windows\SystemApps\Microsoft.Windows.Cortana_cw5n1h2txyewy\RemindersServer.exe (Microsoft Windows -> Microsoft Corporation) C:\Windows\System32\smartscreen.exe (Google Inc -> Google Inc.) C:\Program Files (x86)\Google\Update\1.3.33.23\GoogleCrashHandler.exe (Google Inc -> Google Inc.) C:\Program Files (x86)\Google\Update\1.3.33.23\GoogleCrashHandler64.exe (Malwarebytes Corporation -> Malwarebytes) C:\Program Files\Malwarebytes\Anti-Malware\mbamtray.exe (Microsoft Windows -> Microsoft Corporation) C:\Windows\SysWOW64\dllhost.exe (Microsoft Windows -> Microsoft Corporation) C:\Program Files\Windows Defender\MSASCuiL.exe (Microsoft Corporation -> ) C:\Windows\System32\SurfaceDTX.exe (Microsoft Corporation -> Microsoft Corporation) C:\Windows\WindowsMobile\wmdc.exe (Adobe Systems, Incorporated -> Adobe Systems Incorporated) C:\Program Files (x86)\Adobe\Acrobat DC\Acrobat\AdobeCollabSync.exe (Adobe Systems, Incorporated -> Adobe Systems Incorporated) C:\Program Files (x86)\Adobe\Acrobat DC\Acrobat\AdobeCollabSync.exe (Microsoft Corporation -> Microsoft Corporation) C:\Users\matth\AppData\Local\Microsoft\OneDrive\OneDrive.exe (TeamViewer GmbH -> TeamViewer GmbH) C:\Program Files (x86)\TeamViewer\TeamViewer.exe (McAfee, Inc. -> McAfee, Inc.) C:\Program Files\Common Files\McAfee\ModuleCore\ModuleCoreService.exe (Valve -> Valve Corporation) C:\Program Files (x86)\Steam\Steam.exe (Open-Xchange GmbH -> OX Software GmbH) C:\Users\matth\AppData\Local\Open-Xchange\OXUpdater\OXUpdater.exe (Siber Systems -> Siber Systems) C:\Program Files (x86)\Siber Systems\AI RoboForm\robotaskbaricon.exe (TeamViewer GmbH -> TeamViewer GmbH) C:\Program Files (x86)\TeamViewer\tv_w32.exe (TeamViewer GmbH -> TeamViewer GmbH) C:\Program Files (x86)\TeamViewer\tv_x64.exe (Spotify AB -> Spotify Ltd) C:\Program Files\WindowsApps\SpotifyAB.SpotifyMusic_1.101.348.0_x86__zpdnekdrzrea0\Spotify.exe (Valve -> Valve Corporation) C:\Program Files (x86)\Steam\bin\cef\cef.win7x64\steamwebhelper.exe (Valve -> Valve Corporation) C:\Program Files (x86)\Common Files\Steam\SteamService.exe (PFU Limited) [File not signed] C:\Program Files (x86)\PFU\ScanSnap\CardMinder\CardLauncher.exe (Adobe Systems Incorporated -> Adobe Inc.) C:\Program Files (x86)\Adobe\Adobe Creative Cloud\ACC\Creative Cloud.exe (Valve -> Valve Corporation) C:\Program Files (x86)\Steam\bin\cef\cef.win7x64\steamwebhelper.exe (Adobe Systems Incorporated -> Adobe Systems Incorporated) C:\Program Files (x86)\Common Files\Adobe\Adobe Desktop Common\IPCBox\AdobeIPCBroker.exe (Valve -> Valve Corporation) C:\Program Files (x86)\Steam\bin\cef\cef.win7x64\steamwebhelper.exe (PFU Limited) [File not signed] C:\Program Files (x86)\PFU\ScanSnap\Driver\PfuSsMon.exe (Spotify AB -> Spotify Ltd) C:\Program Files\WindowsApps\SpotifyAB.SpotifyMusic_1.101.348.0_x86__zpdnekdrzrea0\Spotify.exe (Adobe Systems, Incorporated -> Adobe Systems Inc.) C:\Program Files (x86)\Adobe\Acrobat DC\Acrobat\acrotray.exe (PFU LIMITED) [File not signed] C:\Program Files (x86)\PFU\ScanSnap\SSFolder\SSFolderTray.exe (Dropbox, Inc -> Dropbox, Inc.) C:\Program Files (x86)\Dropbox\Client\Dropbox.exe (Dropbox, Inc -> Dropbox, Inc.) C:\Program Files (x86)\Dropbox\Client\Dropbox.exe (Dropbox, Inc -> Dropbox, Inc.) C:\Program Files (x86)\Dropbox\Client\Dropbox.exe (Spotify AB -> Spotify Ltd) C:\Program Files\WindowsApps\SpotifyAB.SpotifyMusic_1.101.348.0_x86__zpdnekdrzrea0\Spotify.exe (Evernote Corporation -> Evernote Corp., 305 Walnut Street, Redwood City, CA 94063) C:\Program Files (x86)\Evernote\Evernote\EvernoteClipper.exe (Spotify AB -> Spotify Ltd) C:\Program Files\WindowsApps\SpotifyAB.SpotifyMusic_1.101.348.0_x86__zpdnekdrzrea0\Spotify.exe (Adobe Systems Incorporated -> Adobe Inc.) C:\Program Files (x86)\Common Files\Adobe\Adobe Desktop Common\ADS\Adobe Desktop Service.exe (Adobe Systems Incorporated -> Adobe Inc.) C:\Program Files (x86)\Common Files\Adobe\Adobe Desktop Common\HEX\Adobe CEF Helper.exe () [File not signed] C:\Users\matth\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Shortcuts.exe (PFU LIMITED) [File not signed] C:\Program Files (x86)\PFU\ScanSnap\Driver\SSDriver\fi5110\SsWiaChecker.exe (PFU Limited) [File not signed] C:\Program Files (x86)\PFU\ScanSnap\Update\SsUWatcher.exe (PFU) [File not signed] C:\Program Files (x86)\PFU\ScanSnapCloud\SSCloud\sCloudWatch.exe (Adobe Systems Incorporated -> ) C:\Program Files (x86)\Adobe\Adobe Sync\CoreSync\CoreSync.exe (Microsoft Corporation -> Microsoft Corp.) C:\Program Files (x86)\Microsoft\BingDesktop\BingDesktop.exe (Adobe Inc. -> Adobe Systems Incorporated) C:\Program Files (x86)\Adobe\Adobe Creative Cloud Experience\CCXProcess.exe (Node.js Foundation -> Node.js) C:\Program Files (x86)\Adobe\Adobe Creative Cloud Experience\libs\node.exe (Valve -> Valve Corporation) C:\Program Files (x86)\Steam\bin\cef\cef.win7x64\steamwebhelper.exe (Valve -> Valve Corporation) C:\Program Files (x86)\Steam\bin\cef\cef.win7x64\steamwebhelper.exe (Dropbox, Inc -> The Qt Company Ltd.) C:\Program Files (x86)\Dropbox\Client\QtWebEngineProcess.exe (Adobe Systems Incorporated -> Adobe Systems Incorporated) C:\Program Files (x86)\Common Files\Adobe\Creative Cloud Libraries\CCLibrary.exe (Node.js Foundation -> Node.js) C:\Program Files (x86)\Common Files\Adobe\Creative Cloud Libraries\libs\node.exe (Microsoft Corporation -> Microsoft Corporation) C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdge.exe (Microsoft Windows -> Microsoft Corporation) C:\Windows\System32\browser_broker.exe (Microsoft Windows -> Microsoft Corporation) C:\Windows\System32\dllhost.exe (Microsoft Corporation -> Microsoft Corporation) C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe (Microsoft Corporation -> Microsoft Corporation) C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe (Microsoft Corporation -> Microsoft Corporation) C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe (Dropbox, Inc -> The Qt Company Ltd.) C:\Program Files (x86)\Dropbox\Client\QtWebEngineProcess.exe (Microsoft Corporation -> Microsoft Corp.) C:\Program Files (x86)\Microsoft\BingDesktop\BDExtHost.exe () [File not signed] C:\Program Files\WindowsApps\SiberSystemsInc.RoboFormEdge_8.5.6.0_x86__7kk3kr9e0p1np\RoboFormCompanion.exe (Microsoft Corporation -> Microsoft Corp.) C:\Program Files (x86)\Microsoft\BingDesktop\BDAppHost.exe (Microsoft Corporation -> Microsoft Corporation) C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe (Microsoft Corporation -> Microsoft Corporation) C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe (McAfee, Inc. -> McAfee, Inc.) C:\Program Files\Common Files\McAfee\Platform\McUICnt.exe (Microsoft Corporation -> Microsoft Corp.) C:\Program Files (x86)\Microsoft\BingDesktop\BDRuntimeHost.exe (Siber Systems Inc.) [File not signed] C:\Program Files\WindowsApps\SiberSystemsInc.RoboFormEdge_8.5.6.0_x86__7kk3kr9e0p1np\DesktopBridge\rf-edge-nm-host.exe (Microsoft Corporation -> Microsoft Corporation) C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe (Microsoft Corporation -> Microsoft Corporation) C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe (Microsoft Corporation -> Microsoft Corporation) C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe (SAP SE -> SAP SE) C:\Program Files (x86)\SAP\SapSetup\setup\Updater\NwSapAutoWorkstationUpdateService.exe (Microsoft Windows -> Microsoft Corporation) C:\Program Files\rempl\sedsvc.exe (Microsoft Corporation -> Microsoft Corporation) C:\Windows\System32\SurfaceService.exe (Microsoft Corporation -> Microsoft Corporation) C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe (Microsoft Corporation -> Microsoft Corporation) C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe (Microsoft Corporation -> Microsoft Corporation) C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe ==================== Registry (Whitelisted) =========================== (If an entry is included in the fixlist, the registry item will be restored to default or removed. The file will not be moved.) HKLM\...\Run: [SecurityHealth] => C:\Program Files\Windows Defender\MSASCuiL.exe [638872 2018-04-11] (Microsoft Windows -> Microsoft Corporation) HKLM\...\Run: [SurfaceDTX.exe] => C:\WINDOWS\System32\SurfaceDTX.exe [804744 2017-11-01] (Microsoft Corporation -> ) HKLM\...\Run: [AdobeAAMUpdater-1.0] => C:\Program Files (x86)\Common Files\Adobe\OOBE\PDApp\UWA\UpdaterStartupUtility.exe [509936 2018-04-11] (Adobe Systems Incorporated -> Adobe Systems Incorporated) HKLM\...\Run: [AdobeGCInvoker-1.0] => C:\Program Files (x86)\Common Files\Adobe\AdobeGCClient\AGCInvokerUtility.exe [2675176 2018-12-13] (Adobe Systems Incorporated -> Adobe Systems, Incorporated) HKLM\...\Run: [iTunesHelper] => C:\Program Files\iTunes\iTunesHelper.exe [301880 2018-10-22] (Apple Inc. -> Apple Inc.) HKLM\...\Run: [Windows Mobile Device Center] => C:\WINDOWS\WindowsMobile\wmdc.exe [660360 2007-05-31] (Microsoft Corporation -> Microsoft Corporation) HKLM-x32\...\Run: [Adobe Creative Cloud] => C:\Program Files (x86)\Adobe\Adobe Creative Cloud\ACC\Creative Cloud.exe [2410960 2019-03-01] (Adobe Systems Incorporated -> Adobe Inc.) HKLM-x32\...\Run: [Acrobat Assistant 8.0] => C:\Program Files (x86)\Adobe\Acrobat DC\Acrobat\Acrotray.exe [4810224 2019-02-18] (Adobe Systems, Incorporated -> Adobe Systems Inc.) HKLM-x32\...\Run: [Dropbox] => C:\Program Files (x86)\Dropbox\Client\Dropbox.exe [4426560 2019-03-19] (Dropbox, Inc -> Dropbox, Inc.) HKLM-x32\...\Run: [ScanSnap WIA Service Checker] => C:\Program Files (x86)\PFU\ScanSnap\Driver\SSDriver\fi5110\SsWiaChecker.exe [86016 2016-02-18] (PFU LIMITED) [File not signed] HKLM-x32\...\Run: [ScanSnap OnlineUpdate Watcher] => C:\Program Files (x86)\PFU\ScanSnap\Update\SsUWatcher.exe [454144 2016-09-06] (PFU Limited) [File not signed] HKLM-x32\...\Run: [ScanSnap Cloud Watcher] => C:\Program Files (x86)\PFU\ScanSnapCloud\SSCloud\sCloudWatch.exe [114688 2017-04-26] (PFU) [File not signed] HKLM-x32\...\Run: [BingDesktop] => C:\Program Files (x86)\Microsoft\BingDesktop\BingDesktop.exe [2372800 2014-11-26] (Microsoft Corporation -> Microsoft Corp.) HKLM-x32\...\Run: [] => [X] HKU\S-1-5-19\...\RunOnce: [WAB Migrate] => C:\Program Files\Windows Mail\wab.exe [518144 2018-04-11] (Microsoft Windows -> Microsoft Corporation) HKU\S-1-5-19-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-03262019195843019\...\RunOnce: [WAB Migrate] => C:\Program Files\Windows Mail\wab.exe [518144 2018-04-11] (Microsoft Windows -> Microsoft Corporation) HKU\S-1-5-20\...\RunOnce: [WAB Migrate] => C:\Program Files\Windows Mail\wab.exe [518144 2018-04-11] (Microsoft Windows -> Microsoft Corporation) HKU\S-1-5-20-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-03262019195843048\...\RunOnce: [WAB Migrate] => C:\Program Files\Windows Mail\wab.exe [518144 2018-04-11] (Microsoft Windows -> Microsoft Corporation) HKU\S-1-5-21-306283558-555091848-1802614870-1001\...\Run: [Adobe Acrobat Synchronizer] => C:\Program Files (x86)\Adobe\Acrobat DC\Acrobat\AdobeCollabSync.exe [5933552 2019-02-18] (Adobe Systems, Incorporated -> Adobe Systems Incorporated) HKU\S-1-5-21-306283558-555091848-1802614870-1001\...\Run: [Lync] => "C:\Program Files (x86)\Microsoft Office\root\Office16\lync.exe" /fromrunkey HKU\S-1-5-21-306283558-555091848-1802614870-1001\...\Run: [Steam] => C:\Program Files (x86)\Steam\steam.exe [3146016 2019-03-05] (Valve -> Valve Corporation) HKU\S-1-5-21-306283558-555091848-1802614870-1001\...\Run: [OXUpdater] => C:\Users\matth\AppData\Local\Open-Xchange\OXUpdater\OXUpdater.exe [2477536 2016-05-09] (Open-Xchange GmbH -> OX Software GmbH) HKU\S-1-5-21-306283558-555091848-1802614870-1001\...\Run: [RoboForm] => C:\Program Files (x86)\Siber Systems\AI RoboForm\RoboTaskBarIcon.exe [145704 2019-03-22] (Siber Systems -> Siber Systems) HKU\S-1-5-21-306283558-555091848-1802614870-1001\Control Panel\Desktop\\SCRNSAVE.EXE -> C:\WINDOWS\system32\Ribbons.scr [148480 2018-04-11] (Microsoft Windows -> Microsoft Corporation) HKU\S-1-5-21-306283558-555091848-1802614870-1001-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-03262019195843088\...\Run: [Adobe Acrobat Synchronizer] => C:\Program Files (x86)\Adobe\Acrobat DC\Acrobat\AdobeCollabSync.exe [5933552 2019-02-18] (Adobe Systems, Incorporated -> Adobe Systems Incorporated) HKU\S-1-5-21-306283558-555091848-1802614870-1001-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-03262019195843088\...\Run: [Lync] => "C:\Program Files (x86)\Microsoft Office\root\Office16\lync.exe" /fromrunkey HKU\S-1-5-21-306283558-555091848-1802614870-1001-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-03262019195843088\...\Run: [Steam] => C:\Program Files (x86)\Steam\steam.exe [3146016 2019-03-05] (Valve -> Valve Corporation) HKU\S-1-5-21-306283558-555091848-1802614870-1001-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-03262019195843088\...\Run: [OXUpdater] => C:\Users\matth\AppData\Local\Open-Xchange\OXUpdater\OXUpdater.exe [2477536 2016-05-09] (Open-Xchange GmbH -> OX Software GmbH) HKU\S-1-5-21-306283558-555091848-1802614870-1001-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-03262019195843088\...\Run: [RoboForm] => C:\Program Files (x86)\Siber Systems\AI RoboForm\RoboTaskBarIcon.exe [145704 2019-03-22] (Siber Systems -> Siber Systems) HKU\S-1-5-21-306283558-555091848-1802614870-1001-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-03262019195843088\Control Panel\Desktop\\SCRNSAVE.EXE -> C:\WINDOWS\system32\Ribbons.scr [148480 2018-04-11] (Microsoft Windows -> Microsoft Corporation) HKU\S-1-5-82-271721585-897601226-2024613209-625570482-296978595-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-03262019195842809\...\RunOnce: [WAB Migrate] => C:\Program Files\Windows Mail\wab.exe [518144 2018-04-11] (Microsoft Windows -> Microsoft Corporation) HKU\S-1-5-82-271721585-897601226-2024613209-625570482-296978595-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-03262019195843795\...\RunOnce: [WAB Migrate] => C:\Program Files\Windows Mail\wab.exe [518144 2018-04-11] (Microsoft Windows -> Microsoft Corporation) HKU\S-1-5-82-3006700770-424185619-1745488364-794895919-4004696415-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-03262019195842853\...\RunOnce: [WAB Migrate] => C:\Program Files\Windows Mail\wab.exe [518144 2018-04-11] (Microsoft Windows -> Microsoft Corporation) HKU\S-1-5-82-3006700770-424185619-1745488364-794895919-4004696415-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-03262019195843828\...\RunOnce: [WAB Migrate] => C:\Program Files\Windows Mail\wab.exe [518144 2018-04-11] (Microsoft Windows -> Microsoft Corporation) HKU\S-1-5-82-3876422241-1344743610-1729199087-774402673-2621913236-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-03262019195842921\...\RunOnce: [WAB Migrate] => C:\Program Files\Windows Mail\wab.exe [518144 2018-04-11] (Microsoft Windows -> Microsoft Corporation) HKU\S-1-5-82-3876422241-1344743610-1729199087-774402673-2621913236-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-03262019195843860\...\RunOnce: [WAB Migrate] => C:\Program Files\Windows Mail\wab.exe [518144 2018-04-11] (Microsoft Windows -> Microsoft Corporation) HKLM\Software\Microsoft\Active Setup\Installed Components: [{8A69D345-D564-463c-AFF1-A69D9E530F96}] -> C:\Program Files (x86)\Google\Chrome\Application\73.0.3683.86\Installer\chrmstp.exe [2019-03-26] (Google LLC -> Google Inc.) Startup: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\CardMinder Viewer.lnk [2017-04-24] ShortcutTarget: CardMinder Viewer.lnk -> C:\Program Files (x86)\PFU\ScanSnap\CardMinder\CardLauncher.exe (PFU Limited) [File not signed] Startup: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\Conversion to PDF with ScanSnap Organizer.lnk [2017-04-24] ShortcutTarget: Conversion to PDF with ScanSnap Organizer.lnk -> C:\Program Files (x86)\PFU\ScanSnap\Organizer\PfuSsOrgOcrChk.exe (PFU LIMITED) [File not signed] Startup: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\ScanSnap Manager.lnk [2018-06-11] ShortcutTarget: ScanSnap Manager.lnk -> C:\Program Files (x86)\PFU\ScanSnap\Driver\PfuSsMon.exe (PFU Limited) [File not signed] Startup: C:\Users\matth\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\EvernoteClipper.lnk [2016-05-18] ShortcutTarget: EvernoteClipper.lnk -> C:\Program Files (x86)\Evernote\Evernote\EvernoteClipper.exe (Evernote Corporation -> Evernote Corp., 305 Walnut Street, Redwood City, CA 94063) Startup: C:\Users\matth\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\OneDrive for Business.lnk [2016-05-17] ShortcutTarget: OneDrive for Business.lnk -> C:\Program Files (x86)\Microsoft Office\root\Office16\GROOVE.EXE (No File) Startup: C:\Users\matth\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Send to OneNote.lnk [2018-09-25] ShortcutTarget: Send to OneNote.lnk -> C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTEM.EXE (No File) Startup: C:\Users\matth\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Shortcuts.exe [2017-10-21] () [File not signed] ==================== Internet (Whitelisted) ==================== (If an item is included in the fixlist, if it is a registry item it will be removed or restored to default.) Tcpip\Parameters: [DhcpNameServer] 192.168.0.1 Tcpip\..\Interfaces\{166640f9-e636-47b3-ae13-3f4becb235ec}: [DhcpNameServer] 192.168.0.1 Tcpip\..\Interfaces\{8d30f2dc-43ae-453d-be7d-063e7bfa3e45}: [DhcpNameServer] 192.168.16.2 Tcpip\..\Interfaces\{9c43cef1-7010-4b35-a6fc-5ade36c2b390}: [DhcpNameServer] 172.20.10.1 Internet Explorer: ================== BHO: Skype for Business Browser Helper -> {31D09BA0-12F5-4CCE-BE8A-2923E76605DA} -> C:\Program Files (x86)\Microsoft Office\root\VFS\ProgramFilesX64\Microsoft Office\Office16\OCHelper.dll [2019-03-19] (Microsoft Corporation -> Microsoft Corporation) BHO: RoboForm Toolbar Helper -> {724d43a9-0d85-11d4-9908-00400523e39a} -> C:\Program Files (x86)\Siber Systems\AI RoboForm\RoboForm-x64.dll [2019-03-22] (Siber Systems -> Siber Systems Inc.) BHO: Adobe Acrobat Create PDF Helper -> {AE7CD045-E861-484f-8273-0445EE161910} -> C:\Program Files (x86)\Common Files\Adobe\Acrobat\WCIEActiveX\DC\x64\AcroIEFavStub.dll [2016-05-03] (Adobe Systems, Incorporated -> Adobe Systems Incorporated) BHO: McAfee WebAdvisor -> {B164E929-A1B6-4A06-B104-2CD0E90A88FF} -> C:\Program Files\McAfee\WebAdvisor\x64\IEPlugin.dll [2019-02-21] (McAfee, Inc. -> McAfee, Inc.) BHO: No Name -> {D0498E0A-45B7-42AE-A9AA-ABA463DBD3BF} -> No File BHO: Adobe Acrobat Create PDF from Selection -> {F4971EE7-DAA0-4053-9964-665D8EE6A077} -> C:\Program Files (x86)\Common Files\Adobe\Acrobat\WCIEActiveX\DC\x64\AcroIEFavStub.dll [2016-05-03] (Adobe Systems, Incorporated -> Adobe Systems Incorporated) BHO-x32: No Name -> {31D09BA0-12F5-4CCE-BE8A-2923E76605DA} -> No File BHO-x32: RoboForm Toolbar Helper -> {724d43a9-0d85-11d4-9908-00400523e39a} -> C:\Program Files (x86)\Siber Systems\AI RoboForm\roboform.dll [2019-03-22] (Siber Systems -> Siber Systems Inc.) BHO-x32: Evernote extension -> {92EF2EAD-A7CE-4424-B0DB-499CF856608E} -> C:\Program Files (x86)\Evernote\Evernote\EvernoteIE.dll [2018-03-30] (Evernote Corporation -> Evernote Corp., 305 Walnut Street, Redwood City, CA 94063) BHO-x32: Adobe Acrobat Create PDF Helper -> {AE7CD045-E861-484f-8273-0445EE161910} -> C:\Program Files (x86)\Common Files\Adobe\Acrobat\WCIEActiveX\DC\AcroIEFavStub.dll [2016-05-03] (Adobe Systems, Incorporated -> Adobe Systems Incorporated) BHO-x32: McAfee WebAdvisor -> {B164E929-A1B6-4A06-B104-2CD0E90A88FF} -> C:\Program Files\McAfee\WebAdvisor\win32\IEPlugin.dll [2019-02-21] (McAfee, Inc. -> McAfee, Inc.) BHO-x32: Microsoft OneDrive for Business Browser Helper -> {D0498E0A-45B7-42AE-A9AA-ABA463DBD3BF} -> C:\Program Files (x86)\Microsoft Office\root\Office16\GROOVEEX.DLL => No File BHO-x32: Adobe Acrobat Create PDF from Selection -> {F4971EE7-DAA0-4053-9964-665D8EE6A077} -> C:\Program Files (x86)\Common Files\Adobe\Acrobat\WCIEActiveX\DC\AcroIEFavStub.dll [2016-05-03] (Adobe Systems, Incorporated -> Adobe Systems Incorporated) Toolbar: HKLM - &RoboForm Toolbar - {724d43a0-0d85-11d4-9908-00400523e39a} - C:\Program Files (x86)\Siber Systems\AI RoboForm\RoboForm-x64.dll [2019-03-22] (Siber Systems -> Siber Systems Inc.) Toolbar: HKLM - Adobe Acrobat Create PDF Toolbar - {47833539-D0C5-4125-9FA8-0819E2EAAC93} - C:\Program Files (x86)\Common Files\Adobe\Acrobat\WCIEActiveX\DC\x64\AcroIEFavStub.dll [2016-05-03] (Adobe Systems, Incorporated -> Adobe Systems Incorporated) Toolbar: HKLM-x32 - &RoboForm Toolbar - {724d43a0-0d85-11d4-9908-00400523e39a} - C:\Program Files (x86)\Siber Systems\AI RoboForm\roboform.dll [2019-03-22] (Siber Systems -> Siber Systems Inc.) Toolbar: HKLM-x32 - Adobe Acrobat Create PDF Toolbar - {47833539-D0C5-4125-9FA8-0819E2EAAC93} - C:\Program Files (x86)\Common Files\Adobe\Acrobat\WCIEActiveX\DC\AcroIEFavStub.dll [2016-05-03] (Adobe Systems, Incorporated -> Adobe Systems Incorporated) Toolbar: HKU\S-1-5-21-306283558-555091848-1802614870-1001 -> &RoboForm Toolbar - {724D43A0-0D85-11D4-9908-00400523E39A} - C:\Program Files (x86)\Siber Systems\AI RoboForm\RoboForm-x64.dll [2019-03-22] (Siber Systems -> Siber Systems Inc.) Toolbar: HKU\S-1-5-21-306283558-555091848-1802614870-1001 -> Adobe Acrobat Create PDF Toolbar - {47833539-D0C5-4125-9FA8-0819E2EAAC93} - C:\Program Files (x86)\Common Files\Adobe\Acrobat\WCIEActiveX\DC\x64\AcroIEFavStub.dll [2016-05-03] (Adobe Systems, Incorporated -> Adobe Systems Incorporated) Toolbar: HKU\S-1-5-21-306283558-555091848-1802614870-1001-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-03262019195843088 -> &RoboForm Toolbar - {724D43A0-0D85-11D4-9908-00400523E39A} - C:\Program Files (x86)\Siber Systems\AI RoboForm\RoboForm-x64.dll [2019-03-22] (Siber Systems -> Siber Systems Inc.) Toolbar: HKU\S-1-5-21-306283558-555091848-1802614870-1001-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-03262019195843088 -> Adobe Acrobat Create PDF Toolbar - {47833539-D0C5-4125-9FA8-0819E2EAAC93} - C:\Program Files (x86)\Common Files\Adobe\Acrobat\WCIEActiveX\DC\x64\AcroIEFavStub.dll [2016-05-03] (Adobe Systems, Incorporated -> Adobe Systems Incorporated) DPF: HKLM-x32 {E06E2E99-0AA1-11D4-ABA6-0060082AA75C} hxxps://cpgs.webex.com/client/WBXclient-T30L10NSP6-10050/webex/ieatgpc1.cab Handler-x32: mso-minsb-roaming.16 - {83C25742-A9F7-49FB-9138-434302C88D07} - C:\Program Files (x86)\Microsoft Office\root\Office16\MSOSB.DLL [2019-03-19] (Microsoft Corporation -> Microsoft Corporation) Handler-x32: mso-minsb.16 - {42089D2D-912D-4018-9087-2B87803E93FB} - C:\Program Files (x86)\Microsoft Office\root\Office16\MSOSB.DLL [2019-03-19] (Microsoft Corporation -> Microsoft Corporation) Handler-x32: osf-roaming.16 - {42089D2D-912D-4018-9087-2B87803E93FB} - C:\Program Files (x86)\Microsoft Office\root\Office16\MSOSB.DLL [2019-03-19] (Microsoft Corporation -> Microsoft Corporation) Handler-x32: osf.16 - {5504BE45-A83B-4808-900A-3A5C36E7F77A} - C:\Program Files (x86)\Microsoft Office\root\Office16\MSOSB.DLL [2019-03-19] (Microsoft Corporation -> Microsoft Corporation) Handler: sacore - {5513F07E-936B-4E52-9B00-067394E91CC5} - c:\PROGRA~2\mcafee\SITEAD~1\mcieplg.dll No File Handler-x32: saphtmlp - {D1F8BD1E-7967-11D2-B43A-006094B9EADB} - c:\program files (x86)\sap\frontend\sapgui\saphtmlp.dll [2015-12-28] (SAP SE -> SAP, Walldorf) Handler-x32: sapr3 - {D1F8BD1E-7967-11D2-B43A-006094B9EADB} - c:\program files (x86)\sap\frontend\sapgui\saphtmlp.dll [2015-12-28] (SAP SE -> SAP, Walldorf) Filter: application/x-mfe-ipt - {3EF5086B-5478-4598-A054-786C45D75692} - c:\Program Files\McAfee\MSC\McSnIePl64.dll [2018-06-15] (McAfee, Inc. -> McAfee, Inc.) Filter-x32: application/x-mfe-ipt - {3EF5086B-5478-4598-A054-786C45D75692} - c:\Program Files (x86)\McAfee\MSC\McSnIePl.dll [2018-06-15] (McAfee, Inc. -> McAfee, Inc.) Edge: ====== Edge Extension: (RoboForm) -> EdgeExtension_SiberSystemsIncRoboFormEdge_7kk3kr9e0p1np => C:\Program Files\WindowsApps\SiberSystemsInc.RoboFormEdge_8.5.6.0_x86__7kk3kr9e0p1np [2019-03-02] FireFox: ======== FF HKLM\...\Firefox\Extensions: [web2pdfextension.17@acrobat.adobe.com] - C:\Program Files (x86)\Adobe\Acrobat DC\Acrobat\Browser\WCFirefoxExtn\WebExtn\signed_extn\adobe_acrobat-1.0-windows.xpi FF Extension: (Adobe Acrobat) - C:\Program Files (x86)\Adobe\Acrobat DC\Acrobat\Browser\WCFirefoxExtn\WebExtn\signed_extn\adobe_acrobat-1.0-windows.xpi [2018-09-20] FF HKLM\...\Firefox\Extensions: [{4ED1F68A-5463-4931-9384-8FFF5ED91D92}] - C:\Program Files\McAfee\WebAdvisor\e10ssaffplg.xpi FF Extension: (McAfee® WebAdvisor) - C:\Program Files\McAfee\WebAdvisor\e10ssaffplg.xpi [2019-03-20] FF HKLM-x32\...\Firefox\Extensions: [web2pdfextension.17@acrobat.adobe.com] - C:\Program Files (x86)\Adobe\Acrobat DC\Acrobat\Browser\WCFirefoxExtn\WebExtn\signed_extn\adobe_acrobat-1.0-windows.xpi FF HKLM-x32\...\Firefox\Extensions: [{4ED1F68A-5463-4931-9384-8FFF5ED91D92}] - C:\Program Files\McAfee\WebAdvisor\e10ssaffplg.xpi FF HKLM-x32\...\Thunderbird\Extensions: [msktbird@mcafee.com] - C:\Program Files\McAfee\MSK FF Extension: (McAfee Anti-Spam Thunderbird Extension) - C:\Program Files\McAfee\MSK [2018-08-02] [Legacy] [not signed] FF Plugin: @mcafee.com/MSC,version=10 -> c:\PROGRA~1\mcafee\msc\NPMCSN~1.DLL [2018-06-15] (McAfee, Inc. -> ) FF Plugin: @Microsoft.com/NpCtrl,version=1.0 -> c:\Program Files\Microsoft Silverlight\5.1.50918.0\npctrl.dll [2018-10-23] (Microsoft Corporation -> Microsoft Corporation) FF Plugin: adobe.com/AdobeAAMDetect -> C:\Program Files (x86)\Adobe\Adobe Creative Cloud\Utils\npAdobeAAMDetect64.dll [2019-03-01] (Adobe Systems Incorporated -> Adobe Systems) FF Plugin-x32: @mcafee.com/MSC,version=10 -> c:\PROGRA~2\mcafee\msc\NPMCSN~1.DLL [2018-06-15] (McAfee, Inc. -> ) FF Plugin-x32: @Microsoft.com/NpCtrl,version=1.0 -> c:\Program Files (x86)\Microsoft Silverlight\5.1.50918.0\npctrl.dll [2018-10-23] (Microsoft Corporation -> Microsoft Corporation) FF Plugin-x32: @microsoft.com/SharePoint,version=14.0 -> C:\Program Files (x86)\Microsoft Office\root\Office16\NPSPWRAP.DLL [2019-03-19] (Microsoft Corporation -> Microsoft Corporation) FF Plugin-x32: @nitropdf.com/NitroPDF -> C:\Program Files (x86)\Nitro\Pro 10\npnitromozilla.dll [2016-07-22] (Nitro Software, Inc. -> Nitro PDF) FF Plugin-x32: @tools.google.com/Google Update;version=3 -> C:\Program Files (x86)\Google\Update\1.3.33.23\npGoogleUpdate3.dll [2019-01-23] (Google Inc -> Google Inc.) FF Plugin-x32: @tools.google.com/Google Update;version=9 -> C:\Program Files (x86)\Google\Update\1.3.33.23\npGoogleUpdate3.dll [2019-01-23] (Google Inc -> Google Inc.) FF Plugin-x32: Adobe Acrobat -> C:\Program Files (x86)\Adobe\Acrobat DC\Acrobat\Air\nppdf32.dll [2019-02-18] (Adobe Systems, Incorporated -> Adobe Systems Inc.) FF Plugin-x32: adobe.com/AdobeAAMDetect -> C:\Program Files (x86)\Adobe\Adobe Creative Cloud\Utils\npAdobeAAMDetect32.dll [2019-03-01] (Adobe Systems Incorporated -> Adobe Systems) FF Plugin HKU\S-1-5-21-306283558-555091848-1802614870-1001: @citrixonline.com/appdetectorplugin -> C:\Users\matth\AppData\Local\Citrix\Plugins\104\npappdetector.dll [2016-07-14] (Citrix Online -> Citrix Online) FF Plugin HKU\S-1-5-21-306283558-555091848-1802614870-1001-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-03262019195843088: @citrixonline.com/appdetectorplugin -> C:\Users\matth\AppData\Local\Citrix\Plugins\104\npappdetector.dll [2016-07-14] (Citrix Online -> Citrix Online) Chrome: ======= CHR Profile: C:\Users\matth\AppData\Local\Google\Chrome\User Data\Default [2018-09-25] CHR Extension: (Slides) - C:\Users\matth\AppData\Local\Google\Chrome\User Data\Default\Extensions\aapocclcgogkmnckokdopfmhonfmgoek [2018-02-15] CHR Extension: (Docs) - C:\Users\matth\AppData\Local\Google\Chrome\User Data\Default\Extensions\aohghmighlieiainnegkcijnfilokake [2018-02-15] CHR Extension: (Google Drive) - C:\Users\matth\AppData\Local\Google\Chrome\User Data\Default\Extensions\apdfllckaahabafndbhieahigkjlhalf [2018-02-15] CHR Extension: (YouTube) - C:\Users\matth\AppData\Local\Google\Chrome\User Data\Default\Extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo [2018-02-15] CHR Extension: (Adobe Acrobat) - C:\Users\matth\AppData\Local\Google\Chrome\User Data\Default\Extensions\efaidnbmnnnibpcajpcglclefindmkaj [2018-02-15] CHR Extension: (Sheets) - C:\Users\matth\AppData\Local\Google\Chrome\User Data\Default\Extensions\felcaaldnbdncclmgdcncolpebgiejap [2018-02-15] CHR Extension: (McAfee® WebAdvisor) - C:\Users\matth\AppData\Local\Google\Chrome\User Data\Default\Extensions\fheoggkfdfchfphceeifdbepaooicaho [2018-09-25] CHR Extension: (Google Docs Offline) - C:\Users\matth\AppData\Local\Google\Chrome\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi [2018-09-25] CHR Extension: (Skype) - C:\Users\matth\AppData\Local\Google\Chrome\User Data\Default\Extensions\lifbcibllhkdhoafpjfnlhfpfgnpldfl [2018-02-15] CHR Extension: (Chrome Web Store Payments) - C:\Users\matth\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda [2018-04-25] CHR Extension: (Gmail) - C:\Users\matth\AppData\Local\Google\Chrome\User Data\Default\Extensions\pjkljhegncpnkpknbcohdijeoejaedia [2018-02-15] CHR Extension: (Chrome Media Router) - C:\Users\matth\AppData\Local\Google\Chrome\User Data\Default\Extensions\pkedcjkdefgpdelpbcmbmeomcjbeemfm [2018-09-25] CHR Extension: (RoboForm Password Manager) - C:\Users\matth\AppData\Local\Google\Chrome\User Data\Default\Extensions\pnlccmojcmeohlpggmfnbbiapkmbliob [2018-09-25] CHR HKLM\...\Chrome\Extension: [fheoggkfdfchfphceeifdbepaooicaho] - hxxp://clients2.google.com/service/update2/crx CHR HKLM\...\Chrome\Extension: [pnlccmojcmeohlpggmfnbbiapkmbliob] - C:\Program Files (x86)\Siber Systems\AI RoboForm\Chrome\rf-chrome.crx [2016-05-17] CHR HKLM-x32\...\Chrome\Extension: [efaidnbmnnnibpcajpcglclefindmkaj] - hxxps://clients2.google.com/service/update2/crx CHR HKLM-x32\...\Chrome\Extension: [fheoggkfdfchfphceeifdbepaooicaho] - hxxp://clients2.google.com/service/update2/crx CHR HKLM-x32\...\Chrome\Extension: [lifbcibllhkdhoafpjfnlhfpfgnpldfl] - hxxps://clients2.google.com/service/update2/crx CHR HKLM-x32\...\Chrome\Extension: [pnlccmojcmeohlpggmfnbbiapkmbliob] - C:\Program Files (x86)\Siber Systems\AI RoboForm\Chrome\rf-chrome.crx [2016-05-17] ==================== Services (Whitelisted) ==================== (If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.) R2 AdobeUpdateService; C:\Program Files (x86)\Common Files\Adobe\Adobe Desktop Common\ElevationManager\AdobeUpdateService.exe [818128 2019-03-01] (Adobe Systems Incorporated -> Adobe Inc.) R2 AGMService; C:\Program Files (x86)\Common Files\Adobe\AdobeGCClient\AGMService.exe [2917864 2018-12-13] (Adobe Systems Incorporated -> Adobe Systems, Incorporated) R2 AGSService; C:\Program Files (x86)\Common Files\Adobe\AdobeGCClient\AGSService.exe [2709480 2018-12-13] (Adobe Systems Incorporated -> Adobe Systems, Incorporated) R2 Apple Mobile Device Service; C:\Program Files\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe [85304 2018-10-16] (Apple Inc. -> Apple Inc.) S2 BingDesktopUpdate; C:\Program Files (x86)\Microsoft\BingDesktop\BingDesktopUpdater.exe [173248 2014-11-26] (Microsoft Corporation -> Microsoft Corp.) R2 ClickToRunSvc; C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe [11129928 2019-03-06] (Microsoft Corporation -> Microsoft Corporation) S3 ClientAnalyticsService; C:\Program Files\Common Files\McAfee\ClientAnalytics\Legacy\McClientAnalytics.exe [1508656 2018-05-31] (McAfee, Inc. -> McAfee, Inc.) S2 dbupdate; C:\Program Files (x86)\Dropbox\Update\DropboxUpdate.exe [143144 2016-05-21] (Dropbox, Inc -> Dropbox, Inc.) S3 dbupdatem; C:\Program Files (x86)\Dropbox\Update\DropboxUpdate.exe [143144 2016-05-21] (Dropbox, Inc -> Dropbox, Inc.) R2 DbxSvc; C:\WINDOWS\system32\DbxSvc.exe [51024 2019-03-19] (Dropbox, Inc -> Dropbox, Inc.) R2 DevoloNetworkService; C:\Program Files (x86)\devolo\dlan\devolonetsvc.exe [3885592 2017-03-03] (devolo AG -> devolo AG) S3 Intel(R) Capability Licensing Service TCP IP Interface; C:\WINDOWS\System32\Intel\iCLS Client\lib\SocketHeciServer.exe [765112 2018-04-25] (Intel(R) Trust Services -> Intel(R) Corporation) S2 Intel(R) TPM Provisioning Service; C:\WINDOWS\System32\Intel\iCLS Client\lib\TPMProvisioningService.exe [731832 2018-04-25] (Intel(R) Trust Services -> Intel(R) Corporation) S2 IntelAudioService; C:\WINDOWS\system32\cAVS\Intel(R) Audio Service\IntelAudioService.exe [207416 2018-02-15] (Intel(R) Smart Sound Technology -> Intel) R2 MBAMService; C:\Program Files\Malwarebytes\Anti-Malware\mbamservice.exe [6562472 2019-02-01] (Malwarebytes Corporation -> Malwarebytes) R2 McAfee WebAdvisor; C:\Program Files\McAfee\WebAdvisor\ServiceHost.exe [899640 2019-02-21] (McAfee, Inc. -> McAfee, Inc.) R2 McAPExe; C:\Program Files\Common Files\McAfee\VSCore_18_5\McApExe.exe [728808 2018-06-12] (McAfee, Inc. -> McAfee, Inc.) R2 mccspsvc; C:\Program Files\Common Files\McAfee\CSP\2.9.175.0\\McCSPServiceHost.exe [2141912 2018-04-06] (McAfee, Inc. -> McAfee, Inc.) S3 mfefire; C:\Program Files\Common Files\McAfee\SystemCore\mfefire.exe [359888 2018-04-24] (McAfee, Inc. -> McAfee, LLC) R2 mfemms; C:\Program Files\Common Files\McAfee\SystemCore\mfemms.exe [519120 2018-04-24] (McAfee, Inc. -> McAfee, LLC) R2 mfevtp; C:\WINDOWS\system32\mfevtps.exe [473552 2018-04-24] (McAfee, Inc. -> McAfee, LLC) R2 ModuleCoreService; C:\Program Files\Common Files\McAfee\ModuleCore\ModuleCoreService.exe [1689952 2018-06-05] (McAfee, Inc. -> McAfee, Inc.) R2 MySQL80; C:\Program Files\MySQL\MySQL Server 8.0\bin\mysqld.exe [45210624 2018-06-28] () [File not signed] S3 MySQLRouter; C:\Program Files\MySQL\MySQL Router 8.0\bin\mysqlrouter.exe [538112 2018-06-27] () [File not signed] R2 NitroDriverReadSpool10; C:\Program Files\Nitro\Pro 10\NitroPDFDriverService10x64.exe [327320 2016-07-22] (Nitro Software, Inc. -> Nitro Software, Inc.) R2 NitroUpdateService; C:\Program Files\Nitro\Pro 10\Nitro_UpdateService.exe [417944 2016-07-22] (Nitro Software, Inc. -> ) R2 nlsX86cc; C:\WINDOWS\SysWOW64\NLSSRV32.EXE [71832 2016-07-22] (Nitro Software, Inc. -> Nalpeiron Ltd.) R2 NWSAPAutoWorkstationUpdateSvc; C:\Program Files (x86)\SAP\SAPsetup\Setup\Updater\NwSapAutoWorkstationUpdateService.exe [197840 2015-12-27] (SAP SE -> SAP SE) R2 PEFService; C:\Program Files\Common Files\McAfee\PEF\CORE\PEFService.exe [1047448 2018-05-30] (McAfee, Inc. -> McAfee, Inc.) R2 RapiMgr; C:\WINDOWS\WindowsMobile\rapimgr.dll [225672 2007-05-31] (Microsoft Corporation -> Microsoft Corporation) R2 Sage 50 Accounts Control v24; C:\Program Files (x86)\Sage\AccountsServiceV24\sg50CtrlSvc_v24.exe [2831872 2018-05-15] (Sage (UK) Ltd.) [File not signed] R2 Sage 50 Accounts Service v24; C:\Program Files (x86)\Sage\AccountsServiceV24\sg50svc_v24.exe [4794368 2018-05-15] (Sage (UK) Ltd.) [File not signed] R2 Sage AutoUpdate Manager Service; C:\Program Files (x86)\Common Files\Sage\Central\AutoUpdateClient\Sage.Central.AutoUpdateManager.Service.exe [8192 2013-06-04] (Microsoft) [File not signed] R2 Sage AutoUpdate Manager Service v2; C:\Program Files (x86)\Common Files\Sage\Shared\AutoUpdateManager\v2\Sage.Central.AutoUpdateManager.Service.exe [8192 2017-10-12] (Sage UK Limited) [File not signed] R2 Sage SData Service; C:\Program Files (x86)\Common Files\Sage SData\Sage.SData.Service.exe [43008 2017-06-30] (Sage (UK) Limited) [File not signed] S3 Sense; C:\Program Files\Windows Defender Advanced Threat Protection\MsSense.exe [4737560 2019-02-16] (Microsoft Windows Publisher -> Microsoft Corporation) R2 SurfaceDtxService; C:\WINDOWS\system32\SurfaceDtxService.exe [91016 2017-11-01] (Microsoft Corporation -> Microsoft Corporation) R2 SurfaceUsbHubFwUpdateService; C:\WINDOWS\System32\SurfaceUsbHubFwUpdateService.exe [951056 2017-02-09] (Microsoft Corporation -> Microsoft Corporation) R2 TeamViewer; C:\Program Files (x86)\TeamViewer\TeamViewer_Service.exe [11791704 2019-03-18] (TeamViewer GmbH -> TeamViewer GmbH) R2 WcesComm; C:\WINDOWS\WindowsMobile\wcescomm.dll [443784 2007-05-31] (Microsoft Corporation -> Microsoft Corporation) S3 WdNisSvc; C:\Program Files\Windows Defender\NisSrv.exe [4403496 2019-01-09] (Microsoft Corporation -> Microsoft Corporation) S3 WinDefend; C:\Program Files\Windows Defender\MsMpEng.exe [107160 2019-02-16] (Microsoft Corporation -> Microsoft Corporation) S2 0312231538387431mcinstcleanup; C:\WINDOWS\TEMP\031223~1.EXE -cleanup -nolog [X] R2 NVDisplay.ContainerLocalSystem; "C:\Program Files\NVIDIA Corporation\Display.NvContainer\NVDisplay.Container.exe" -s NVDisplay.ContainerLocalSystem -f "C:\ProgramData\NVIDIA\NVDisplay.ContainerLocalSystem.log" -l 3 -d "C:\Program Files\NVIDIA Corporation\Display.NvContainer\plugins\LocalSystem" -r -p 30000 R2 NvTelemetryContainer; "C:\Program Files (x86)\NVIDIA Corporation\NvTelemetry\NvTelemetryContainer.exe" -s NvTelemetryContainer -f "C:\ProgramData\NVIDIA\NvTelemetryContainer.log" -l 3 -d "C:\Program Files (x86)\NVIDIA Corporation\NvTelemetry\plugins" -r ===================== Drivers (Whitelisted) ====================== (If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.) R3 cfwids; C:\WINDOWS\System32\drivers\cfwids.sys [77216 2018-05-16] (McAfee, Inc. -> McAfee, LLC) R3 CSI2HostControllerDriver; C:\WINDOWS\System32\drivers\CSI2HostControllerDriver.sys [114096 2018-03-20] (Microsoft Corporation -> Intel(R) Corporation) R1 ESProtectionDriver; C:\WINDOWS\system32\drivers\mbae64.sys [153328 2019-03-24] (Malwarebytes Corporation -> Malwarebytes) S3 HipShieldK; C:\WINDOWS\System32\drivers\HipShieldK.sys [226984 2018-05-02] (McAfee, Inc. -> McAfee, Inc.) R3 iacamera64; C:\WINDOWS\system32\DRIVERS\iacamera64.sys [2405296 2018-03-20] (Microsoft Corporation -> Intel(R) Corporation) R3 iactrllogic; C:\WINDOWS\System32\drivers\iactrllogic64.sys [182184 2018-03-20] (Microsoft Corporation -> Intel(R) Corporation) S3 iaLPSS2_GPIO2; C:\WINDOWS\System32\drivers\iaLPSS2_GPIO2.sys [83768 2016-01-29] (Intel Corporation - Embedded Subsystems and IP Blocks Group -> Windows (R) Win 7 DDK provider) R2 MBAMChameleon; C:\WINDOWS\System32\Drivers\MbamChameleon.sys [198512 2019-03-24] (Malwarebytes Corporation -> Malwarebytes) S0 MbamElam; C:\WINDOWS\System32\DRIVERS\MbamElam.sys [20936 2019-02-01] (Microsoft Windows Early Launch Anti-malware Publisher -> Malwarebytes) R3 MBAMFarflt; C:\WINDOWS\System32\DRIVERS\farflt.sys [127136 2019-03-26] (Malwarebytes Corporation -> Malwarebytes) R3 MBAMProtection; C:\WINDOWS\system32\DRIVERS\mbam.sys [73912 2019-03-26] (Malwarebytes Corporation -> Malwarebytes) R3 MBAMSwissArmy; C:\WINDOWS\System32\Drivers\mbamswissarmy.sys [274416 2019-03-26] (Malwarebytes Corporation -> Malwarebytes) R3 MBAMWebProtection; C:\WINDOWS\system32\DRIVERS\mwac.sys [114040 2019-03-26] (Malwarebytes Corporation -> Malwarebytes) R3 mfeaack; C:\WINDOWS\System32\drivers\mfeaack.sys [497568 2018-05-16] (McAfee, Inc. -> McAfee, LLC) R3 mfeavfk; C:\WINDOWS\System32\drivers\mfeavfk.sys [361888 2018-05-16] (McAfee, Inc. -> McAfee, LLC) U3 mfeavfk01; no ImagePath S0 mfeelamk; C:\WINDOWS\System32\drivers\mfeelamk.sys [83952 2018-05-16] (Microsoft Windows Early Launch Anti-malware Publisher -> McAfee, LLC) R3 mfefirek; C:\WINDOWS\System32\drivers\mfefirek.sys [533408 2018-05-16] (McAfee, Inc. -> McAfee, LLC) R0 mfehidk; C:\WINDOWS\System32\drivers\mfehidk.sys [954784 2018-05-16] (McAfee, Inc. -> McAfee, LLC) R3 mfencbdc; C:\WINDOWS\System32\DRIVERS\mfencbdc.sys [550288 2018-05-03] (McAfee, Inc. -> McAfee LLC.) S3 mfencrk; C:\WINDOWS\System32\DRIVERS\mfencrk.sys [108944 2018-05-03] (McAfee, Inc. -> McAfee LLC.) R3 mfeplk; C:\WINDOWS\System32\drivers\mfeplk.sys [115616 2018-05-16] (McAfee, Inc. -> McAfee, LLC) R0 mfewfpk; C:\WINDOWS\System32\drivers\mfewfpk.sys [252832 2018-05-16] (McAfee, Inc. -> McAfee, LLC) S3 MOSUMAC; C:\WINDOWS\System32\drivers\MOSUMAC.sys [57208 2014-04-02] (WDKTestCert Alex,130389727012273971 -> ASIX Electronics Corp.) R3 mrvlpcie8897; C:\WINDOWS\System32\drivers\mrvlpcie8897.sys [1079784 2018-06-08] (Microsoft Windows Hardware Compatibility Publisher -> Marvell Semiconductors Inc.) S3 Netaapl; C:\WINDOWS\System32\drivers\netaapl64.sys [23040 2015-11-05] (Microsoft Windows Hardware Compatibility Publisher -> Apple Inc.) R2 NPF_devolo; C:\WINDOWS\sysWOW64\drivers\npf_devolo.sys [36496 2017-02-20] (devolo AG -> Riverbed Technology, Inc.) R3 nvlddmkm; C:\WINDOWS\System32\DriverStore\FileRepository\nvmso.inf_amd64_8461c3207f0421af\nvlddmkm.sys [17545472 2018-04-26] (NVIDIA Corporation -> NVIDIA Corporation) R3 ov5693; C:\WINDOWS\System32\drivers\ov5693.sys [165816 2018-03-20] (Microsoft Corporation -> Intel(R) Corporation) R3 ov7251; C:\WINDOWS\System32\drivers\ov7251.sys [166832 2018-03-20] (Microsoft Corporation -> Intel Corporation) R3 ov8865; C:\WINDOWS\System32\drivers\ov8865.sys [164272 2018-03-20] (Microsoft Corporation -> Intel Corporation) R3 PTPFilter; C:\WINDOWS\System32\drivers\PTPFilter.sys [51032 2016-08-29] (WDKTestCert tguni.kim,130826319441063508 -> Samsung) S3 Ser2pl; C:\WINDOWS\system32\DRIVERS\ser2pl64.sys [191504 2015-10-07] (Microsoft Windows Hardware Compatibility Publisher -> Prolific Technology Inc.) S1 subvgaproduct64; C:\WINDOWS\System32\drivers\subvga64.sys [5120 2009-12-29] (Microsoft Windows Hardware Compatibility Publisher -> Windows (R) Win 7 DDK provider) S1 subvgaproductmirr64; C:\WINDOWS\System32\drivers\subvgamirr64.sys [5120 2009-12-29] (Microsoft Windows Hardware Compatibility Publisher -> Windows (R) Win 7 DDK provider) R3 supportdriver; C:\WINDOWS\System32\drivers\iaisp64.sys [44968 2018-03-20] (Microsoft Corporation -> Intel(R) Corporation) R3 SurfaceBaseIntegration; C:\WINDOWS\System32\drivers\SurfaceBaseIntegration.sys [59448 2015-09-25] (Microsoft Corporation -> Microsoft Corporation) R0 SurfaceUsbHubFwUpdate; C:\WINDOWS\System32\drivers\SurfaceUsbHubFwUpdate.sys [80144 2017-02-09] (Microsoft Corporation -> Microsoft Corporation) S3 USBAAPL64; C:\WINDOWS\System32\Drivers\usbaapl64.sys [54784 2015-11-05] (Microsoft Windows Hardware Compatibility Publisher -> Apple, Inc.) S3 usbezdisplay64; C:\WINDOWS\system32\drivers\usbezdisplay64.sys [31336 2009-09-26] (Actions Microelectronics Co.,Ltd. -> Windows (R) Codename Longhorn DDK provider) R3 VBoxNetAdp; C:\WINDOWS\system32\DRIVERS\VBoxNetAdp6.sys [216080 2019-01-28] (Oracle Corporation -> Oracle Corporation) R1 VBoxNetLwf; C:\WINDOWS\system32\DRIVERS\VBoxNetLwf.sys [227008 2019-01-28] (Oracle Corporation -> Oracle Corporation) S3 WdBoot; C:\WINDOWS\system32\drivers\WdBoot.sys [44616 2018-04-11] (Microsoft Windows Early Launch Anti-malware Publisher -> Microsoft Corporation) S3 WdFilter; C:\WINDOWS\system32\drivers\WdFilter.sys [331680 2018-04-11] (Microsoft Windows -> Microsoft Corporation) S3 WdNisDrv; C:\WINDOWS\System32\Drivers\WdNisDrv.sys [44032 2018-04-11] (Microsoft Windows -> Microsoft Corporation) ==================== NetSvcs (Whitelisted) =================== (If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.) ==================== One month (created) ======== (If an entry is included in the fixlist, the file/folder will be moved.) 2019-03-26 20:10 - 2019-03-26 20:11 - 000049466 _____ C:\Users\matth\Downloads\FRST.txt 2019-03-26 20:10 - 2019-03-26 20:10 - 000000000 ____D C:\FRST 2019-03-26 20:09 - 2019-03-26 20:09 - 007316688 _____ (Malwarebytes) C:\Users\matth\Downloads\AdwCleaner.exe 2019-03-26 20:07 - 2019-03-26 20:07 - 002434048 _____ (Farbar) C:\Users\matth\Downloads\FRST64.exe 2019-03-26 20:00 - 2019-03-26 20:00 - 000073912 _____ (Malwarebytes) C:\WINDOWS\system32\Drivers\mbam.sys 2019-03-26 19:58 - 2019-03-26 19:58 - 000274416 _____ (Malwarebytes) C:\WINDOWS\system32\Drivers\mbamswissarmy.sys 2019-03-26 19:58 - 2019-03-26 19:58 - 000127136 _____ (Malwarebytes) C:\WINDOWS\system32\Drivers\farflt.sys 2019-03-26 19:58 - 2019-03-26 19:58 - 000114040 _____ (Malwarebytes) C:\WINDOWS\system32\Drivers\mwac.sys 2019-03-26 19:23 - 2019-03-26 19:57 - 000000000 ____D C:\AdwCleaner 2019-03-26 19:21 - 2019-03-26 19:22 - 007316688 _____ (Malwarebytes) C:\Users\matth\Downloads\adwcleaner_7.2.7.0.exe 2019-03-25 07:28 - 2019-03-25 07:29 - 002739340 _____ C:\WINDOWS\Minidump\032519-12328-01.dmp 2019-03-24 15:35 - 2019-03-25 07:28 - 2576596509 _____ C:\WINDOWS\MEMORY.DMP 2019-03-24 15:35 - 2019-03-24 15:35 - 002801708 _____ C:\WINDOWS\Minidump\032419-14500-01.dmp 2019-03-24 10:07 - 2019-03-24 10:07 - 000210622 _____ C:\Users\matth\OneDrive\Documents\Matthew Saunders CV 051018.pdf 2019-03-24 05:06 - 2019-03-24 05:06 - 000198512 _____ (Malwarebytes) C:\WINDOWS\system32\Drivers\MbamChameleon.sys 2019-03-20 19:40 - 2019-03-20 19:40 - 000000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Dropbox 2019-03-20 18:30 - 2019-03-20 18:30 - 000001156 _____ C:\Users\Public\Desktop\Oracle VM VirtualBox.lnk 2019-03-20 18:30 - 2019-03-20 18:30 - 000000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Oracle VM VirtualBox 2019-03-20 18:26 - 2019-03-20 18:26 - 114463232 _____ (Oracle Corporation) C:\Users\matth\Downloads\VirtualBox-5.2.26-128414-Win.exe 2019-03-19 19:48 - 2019-03-19 19:48 - 000051024 _____ (Dropbox, Inc.) C:\WINDOWS\system32\DbxSvc.exe 2019-03-19 19:48 - 2019-03-19 19:48 - 000047800 _____ (Dropbox, Inc.) C:\WINDOWS\system32\Drivers\dbx-stable.sys 2019-03-19 19:48 - 2019-03-19 19:48 - 000047600 _____ (Dropbox, Inc.) C:\WINDOWS\system32\Drivers\dbx-dev.sys 2019-03-19 19:48 - 2019-03-19 19:48 - 000047600 _____ (Dropbox, Inc.) C:\WINDOWS\system32\Drivers\dbx-canary.sys 2019-03-19 19:47 - 2019-03-06 09:03 - 007519896 _____ (Microsoft Corporation) C:\WINDOWS\system32\Windows.Media.Protection.PlayReady.dll 2019-03-19 19:47 - 2019-03-06 08:44 - 025856512 _____ (Microsoft Corporation) C:\WINDOWS\system32\edgehtml.dll 2019-03-19 19:47 - 2019-03-06 08:36 - 022716928 _____ (Microsoft Corporation) C:\WINDOWS\system32\mshtml.dll 2019-03-19 19:47 - 2019-03-06 08:28 - 004937728 _____ (Microsoft Corporation) C:\WINDOWS\system32\wininet.dll 2019-03-19 19:47 - 2019-03-06 06:14 - 006568528 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\Windows.Media.Protection.PlayReady.dll 2019-03-19 19:47 - 2019-03-06 06:05 - 022018048 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\edgehtml.dll 2019-03-19 19:47 - 2019-03-06 05:49 - 004516352 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\wininet.dll 2019-03-19 19:47 - 2019-02-16 10:24 - 023862272 _____ (Microsoft Corporation) C:\WINDOWS\system32\Hydrogen.dll 2019-03-19 19:47 - 2019-02-16 10:22 - 019525120 _____ (Microsoft Corporation) C:\WINDOWS\system32\HologramCompositor.dll 2019-03-19 19:46 - 2019-03-06 15:39 - 000720536 _____ (Microsoft Corporation) C:\WINDOWS\system32\kernel32.dll 2019-03-19 19:46 - 2019-03-06 15:37 - 001616608 _____ (Microsoft Corporation) C:\WINDOWS\system32\sppobjs.dll 2019-03-19 19:46 - 2019-03-06 15:36 - 001047352 _____ (Microsoft Corporation) C:\WINDOWS\system32\ReAgent.dll 2019-03-19 19:46 - 2019-03-06 15:20 - 000064000 _____ (Microsoft Corporation) C:\WINDOWS\system32\iemigplugin.dll 2019-03-19 19:46 - 2019-03-06 15:19 - 000058368 _____ (Microsoft Corporation) C:\WINDOWS\system32\mf3216.dll 2019-03-19 19:46 - 2019-03-06 15:17 - 012730368 _____ (Microsoft Corporation) C:\WINDOWS\system32\ieframe.dll 2019-03-19 19:46 - 2019-03-06 15:17 - 000810496 _____ C:\WINDOWS\system32\MBR2GPT.EXE 2019-03-19 19:46 - 2019-03-06 15:17 - 000116736 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\bridge.sys 2019-03-19 19:46 - 2019-03-06 15:14 - 001180672 _____ (Microsoft Corporation) C:\WINDOWS\system32\localspl.dll 2019-03-19 19:46 - 2019-03-06 15:14 - 000522240 _____ (Microsoft Corporation) C:\WINDOWS\system32\winspool.drv 2019-03-19 19:46 - 2019-03-06 15:14 - 000488448 _____ (Microsoft Corporation) C:\WINDOWS\system32\werui.dll 2019-03-19 19:46 - 2019-03-06 15:13 - 004053504 _____ (Microsoft Corporation) C:\WINDOWS\system32\msi.dll 2019-03-19 19:46 - 2019-03-06 15:13 - 001856512 _____ (Microsoft Corporation) C:\WINDOWS\system32\msxml3.dll 2019-03-19 19:46 - 2019-03-06 15:13 - 001662976 _____ (Microsoft Corporation) C:\WINDOWS\system32\GdiPlus.dll 2019-03-19 19:46 - 2019-03-06 15:13 - 001364992 _____ (Microsoft Corporation) C:\WINDOWS\system32\bcastdvruserservice.dll 2019-03-19 19:46 - 2019-03-06 15:12 - 001180672 _____ (Microsoft Corporation) C:\WINDOWS\system32\reseteng.dll 2019-03-19 19:46 - 2019-03-06 12:18 - 000918032 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\ReAgent.dll 2019-03-19 19:46 - 2019-03-06 12:18 - 000607744 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\kernel32.dll 2019-03-19 19:46 - 2019-03-06 12:10 - 000044544 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\mf3216.dll 2019-03-19 19:46 - 2019-03-06 12:09 - 011919360 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\ieframe.dll 2019-03-19 19:46 - 2019-03-06 12:06 - 000425472 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\werui.dll 2019-03-19 19:46 - 2019-03-06 12:05 - 004054016 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\msi.dll 2019-03-19 19:46 - 2019-03-06 12:05 - 001586176 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\msxml3.dll 2019-03-19 19:46 - 2019-03-06 12:04 - 001471488 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\GdiPlus.dll 2019-03-19 19:46 - 2019-03-06 12:04 - 000423936 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\winspool.drv 2019-03-19 19:46 - 2019-03-06 11:59 - 001008640 _____ (Microsoft Corporation) C:\WINDOWS\system32\Windows.Media.MixedRealityCapture.dll 2019-03-19 19:46 - 2019-03-06 09:29 - 001035040 _____ (Microsoft Corporation) C:\WINDOWS\system32\ApplyTrustOffline.exe 2019-03-19 19:46 - 2019-03-06 09:16 - 002822456 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\dxgkrnl.sys 2019-03-19 19:46 - 2019-03-06 09:16 - 001457032 _____ (Microsoft Corporation) C:\WINDOWS\system32\winload.efi 2019-03-19 19:46 - 2019-03-06 09:16 - 001188000 _____ (Microsoft Corporation) C:\WINDOWS\system32\rpcrt4.dll 2019-03-19 19:46 - 2019-03-06 09:16 - 000776792 _____ (Microsoft Corporation) C:\WINDOWS\system32\wer.dll 2019-03-19 19:46 - 2019-03-06 09:16 - 000722744 _____ (Microsoft Corporation) C:\WINDOWS\system32\wimgapi.dll 2019-03-19 19:46 - 2019-03-06 09:16 - 000566568 _____ (Microsoft Corporation) C:\WINDOWS\system32\tcblaunch.exe 2019-03-19 19:46 - 2019-03-06 09:16 - 000527160 _____ (Microsoft Corporation) C:\WINDOWS\system32\wimserv.exe 2019-03-19 19:46 - 2019-03-06 09:11 - 000493880 _____ (Microsoft Corporation) C:\WINDOWS\system32\WerFault.exe 2019-03-19 19:46 - 2019-03-06 09:10 - 000248880 _____ (Microsoft Corporation) C:\WINDOWS\system32\weretw.dll 2019-03-19 19:46 - 2019-03-06 09:07 - 001219896 _____ (Microsoft Corporation) C:\WINDOWS\system32\hvix64.exe 2019-03-19 19:46 - 2019-03-06 09:07 - 001023800 _____ (Microsoft Corporation) C:\WINDOWS\system32\hvax64.exe 2019-03-19 19:46 - 2019-03-06 09:07 - 000376120 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\fastfat.sys 2019-03-19 19:46 - 2019-03-06 09:06 - 009084216 _____ (Microsoft Corporation) C:\WINDOWS\system32\ntoskrnl.exe 2019-03-19 19:46 - 2019-03-06 09:06 - 000134968 _____ (Microsoft Corporation) C:\WINDOWS\system32\hvloader.dll 2019-03-19 19:46 - 2019-03-06 09:06 - 000076088 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\hvservice.sys 2019-03-19 19:46 - 2019-03-06 09:05 - 000439224 _____ (Microsoft Corporation) C:\WINDOWS\system32\Faultrep.dll 2019-03-19 19:46 - 2019-03-06 09:05 - 000436240 _____ (Microsoft Corporation) C:\WINDOWS\system32\msv1_0.dll 2019-03-19 19:46 - 2019-03-06 09:05 - 000159864 _____ (Microsoft Corporation) C:\WINDOWS\system32\WerFaultSecure.exe 2019-03-19 19:46 - 2019-03-06 09:04 - 002765856 _____ (Microsoft Corporation) C:\WINDOWS\system32\iertutil.dll 2019-03-19 19:46 - 2019-03-06 09:04 - 000945464 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\refsv1.sys 2019-03-19 19:46 - 2019-03-06 09:04 - 000628024 _____ (Microsoft Corporation) C:\WINDOWS\system32\dpx.dll 2019-03-19 19:46 - 2019-03-06 09:03 - 002719544 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\tcpip.sys 2019-03-19 19:46 - 2019-03-06 09:03 - 002465784 _____ (Microsoft Corporation) C:\WINDOWS\system32\msxml6.dll 2019-03-19 19:46 - 2019-03-06 09:03 - 001921848 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\refs.sys 2019-03-19 19:46 - 2019-03-06 09:03 - 000793400 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\dxgmms2.sys 2019-03-19 19:46 - 2019-03-06 09:03 - 000412984 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\dxgmms1.sys 2019-03-19 19:46 - 2019-03-06 09:03 - 000375608 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\msrpc.sys 2019-03-19 19:46 - 2019-03-06 09:02 - 002421048 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\ntfs.sys 2019-03-19 19:46 - 2019-03-06 09:02 - 001257672 _____ (Microsoft Corporation) C:\WINDOWS\system32\winload.exe 2019-03-19 19:46 - 2019-03-06 09:02 - 001140480 _____ (Microsoft Corporation) C:\WINDOWS\system32\winresume.efi 2019-03-19 19:46 - 2019-03-06 09:02 - 000982912 _____ (Microsoft Corporation) C:\WINDOWS\system32\winresume.exe 2019-03-19 19:46 - 2019-03-06 09:02 - 000626488 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\afd.sys 2019-03-19 19:46 - 2019-03-06 08:36 - 004383744 _____ (Microsoft Corporation) C:\WINDOWS\system32\EdgeContent.dll 2019-03-19 19:46 - 2019-03-06 08:34 - 004866048 _____ (Microsoft Corporation) C:\WINDOWS\system32\jscript9.dll 2019-03-19 19:46 - 2019-03-06 08:33 - 000046080 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\hidparse.sys 2019-03-19 19:46 - 2019-03-06 08:32 - 003399168 _____ (Microsoft Corporation) C:\WINDOWS\system32\AppXDeploymentServer.dll 2019-03-19 19:46 - 2019-03-06 08:32 - 000358912 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\exfat.sys 2019-03-19 19:46 - 2019-03-06 08:32 - 000209408 _____ (Microsoft Corporation) C:\WINDOWS\system32\AppXApplicabilityBlob.dll 2019-03-19 19:46 - 2019-03-06 08:31 - 007598592 _____ (Microsoft Corporation) C:\WINDOWS\system32\Chakra.dll 2019-03-19 19:46 - 2019-03-06 08:31 - 002368512 _____ (Microsoft Corporation) C:\WINDOWS\system32\WebRuntimeManager.dll 2019-03-19 19:46 - 2019-03-06 08:31 - 001826816 _____ (Microsoft Corporation) C:\WINDOWS\system32\Windows.CloudStore.dll 2019-03-19 19:46 - 2019-03-06 08:31 - 000894464 _____ (Microsoft Corporation) C:\WINDOWS\system32\webplatstorageserver.dll 2019-03-19 19:46 - 2019-03-06 08:31 - 000808448 _____ (Microsoft Corporation) C:\WINDOWS\system32\EdgeManager.dll 2019-03-19 19:46 - 2019-03-06 08:31 - 000726528 _____ (Microsoft Corporation) C:\WINDOWS\system32\jscript9diag.dll 2019-03-19 19:46 - 2019-03-06 08:31 - 000353792 _____ (Microsoft Corporation) C:\WINDOWS\system32\dhcpcore.dll 2019-03-19 19:46 - 2019-03-06 08:31 - 000324608 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\udfs.sys 2019-03-19 19:46 - 2019-03-06 08:31 - 000279552 _____ (Microsoft Corporation) C:\WINDOWS\system32\dhcpcore6.dll 2019-03-19 19:46 - 2019-03-06 08:31 - 000266752 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\srvnet.sys 2019-03-19 19:46 - 2019-03-06 08:31 - 000154112 _____ (Microsoft Corporation) C:\WINDOWS\system32\Chakradiag.dll 2019-03-19 19:46 - 2019-03-06 08:29 - 002364928 _____ (Microsoft Corporation) C:\WINDOWS\system32\OpcServices.dll 2019-03-19 19:46 - 2019-03-06 08:29 - 002174976 _____ (Microsoft Corporation) C:\WINDOWS\system32\AppXDeploymentExtensions.onecore.dll 2019-03-19 19:46 - 2019-03-06 08:29 - 001559552 _____ (Microsoft Corporation) C:\WINDOWS\system32\AppXDeploymentExtensions.desktop.dll 2019-03-19 19:46 - 2019-03-06 08:29 - 000736256 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\srv2.sys 2019-03-19 19:46 - 2019-03-06 08:28 - 001803776 _____ (Microsoft Corporation) C:\WINDOWS\system32\urlmon.dll 2019-03-19 19:46 - 2019-03-06 08:27 - 002224640 _____ (Microsoft Corporation) C:\WINDOWS\system32\win32kbase.sys 2019-03-19 19:46 - 2019-03-06 08:27 - 000776192 _____ (Microsoft Corporation) C:\WINDOWS\system32\jscript.dll 2019-03-19 19:46 - 2019-03-06 08:27 - 000542720 _____ (Microsoft Corporation) C:\WINDOWS\system32\vbscript.dll 2019-03-19 19:46 - 2019-03-06 08:27 - 000507392 _____ (Microsoft Corporation) C:\WINDOWS\system32\edgeIso.dll 2019-03-19 19:46 - 2019-03-06 08:26 - 000868864 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\Windows.Media.MixedRealityCapture.dll 2019-03-19 19:46 - 2019-03-06 08:26 - 000073216 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\npfs.sys 2019-03-19 19:46 - 2019-03-06 08:26 - 000031232 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\msfs.sys 2019-03-19 19:46 - 2019-03-06 08:25 - 000093696 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\cdfs.sys 2019-03-19 19:46 - 2019-03-06 07:08 - 000001310 _____ C:\WINDOWS\system32\tcbres.wim 2019-03-19 19:46 - 2019-03-06 06:17 - 001989040 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\msxml6.dll 2019-03-19 19:46 - 2019-03-06 06:17 - 000146712 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\WerFaultSecure.exe 2019-03-19 19:46 - 2019-03-06 06:15 - 002253488 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\iertutil.dll 2019-03-19 19:46 - 2019-03-06 06:15 - 000434488 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\WerFault.exe 2019-03-19 19:46 - 2019-03-06 06:14 - 000785568 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\rpcrt4.dll 2019-03-19 19:46 - 2019-03-06 06:14 - 000665224 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\wer.dll 2019-03-19 19:46 - 2019-03-06 06:14 - 000450872 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\dpx.dll 2019-03-19 19:46 - 2019-03-06 06:14 - 000380728 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\msv1_0.dll 2019-03-19 19:46 - 2019-03-06 06:13 - 000607248 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\wimgapi.dll 2019-03-19 19:46 - 2019-03-06 05:56 - 019404288 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\mshtml.dll 2019-03-19 19:46 - 2019-03-06 05:53 - 005307392 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\d2d1.dll 2019-03-19 19:46 - 2019-03-06 05:53 - 003711488 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\jscript9.dll 2019-03-19 19:46 - 2019-03-06 05:52 - 005790720 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\Chakra.dll 2019-03-19 19:46 - 2019-03-06 05:52 - 000608768 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\EdgeManager.dll 2019-03-19 19:46 - 2019-03-06 05:52 - 000261632 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\dhcpcore6.dll 2019-03-19 19:46 - 2019-03-06 05:51 - 000561152 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\jscript9diag.dll 2019-03-19 19:46 - 2019-03-06 05:51 - 000333824 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\edgeIso.dll 2019-03-19 19:46 - 2019-03-06 05:51 - 000032768 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\werdiagcontroller.dll 2019-03-19 19:46 - 2019-03-06 05:50 - 001628160 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\urlmon.dll 2019-03-19 19:46 - 2019-03-06 05:50 - 001347584 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\OpcServices.dll 2019-03-19 19:46 - 2019-03-06 05:50 - 000578560 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\webplatstorageserver.dll 2019-03-19 19:46 - 2019-03-06 05:49 - 000318464 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\dhcpcore.dll 2019-03-19 19:46 - 2019-03-06 05:49 - 000251904 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\msIso.dll 2019-03-19 19:46 - 2019-03-06 05:48 - 000669696 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\jscript.dll 2019-03-19 19:46 - 2019-03-06 05:48 - 000533504 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\vbscript.dll 2019-03-19 19:46 - 2019-02-21 03:26 - 000313344 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\msrd2x40.dll 2019-03-19 19:46 - 2019-02-16 13:02 - 002871304 _____ (Microsoft Corporation) C:\WINDOWS\system32\aitstatic.exe 2019-03-19 19:46 - 2019-02-16 13:02 - 001644040 _____ (Microsoft Corporation) C:\WINDOWS\system32\appraiser.dll 2019-03-19 19:46 - 2019-02-16 13:02 - 000808456 _____ (Microsoft Corporation) C:\WINDOWS\system32\generaltel.dll 2019-03-19 19:46 - 2019-02-16 13:02 - 000735752 _____ (Microsoft Corporation) C:\WINDOWS\system32\aeinv.dll 2019-03-19 19:46 - 2019-02-16 13:02 - 000620040 _____ (Microsoft Corporation) C:\WINDOWS\system32\devinv.dll 2019-03-19 19:46 - 2019-02-16 13:02 - 000460296 _____ (Microsoft Corporation) C:\WINDOWS\system32\invagent.dll 2019-03-19 19:46 - 2019-02-16 13:02 - 000322568 _____ (Microsoft Corporation) C:\WINDOWS\system32\acmigration.dll 2019-03-19 19:46 - 2019-02-16 13:02 - 000147464 _____ (Microsoft Corporation) C:\WINDOWS\system32\CompatTelRunner.exe 2019-03-19 19:46 - 2019-02-16 13:02 - 000071176 _____ (Microsoft Corporation) C:\WINDOWS\system32\win32appinventorycsp.dll 2019-03-19 19:46 - 2019-02-16 12:57 - 002266936 _____ (Microsoft Corporation) C:\WINDOWS\system32\AppVEntSubsystems64.dll 2019-03-19 19:46 - 2019-02-16 12:57 - 001786672 _____ (Microsoft Corporation) C:\WINDOWS\system32\AppVEntVirtualization.dll 2019-03-19 19:46 - 2019-02-16 12:57 - 001627448 _____ (Microsoft Corporation) C:\WINDOWS\system32\AppVIntegration.dll 2019-03-19 19:46 - 2019-02-16 12:57 - 001424696 _____ (Microsoft Corporation) C:\WINDOWS\system32\AppVEntSubsystemController.dll 2019-03-19 19:46 - 2019-02-16 12:57 - 001048472 _____ (Microsoft Corporation) C:\WINDOWS\system32\Windows.Internal.Shell.Broker.dll 2019-03-19 19:46 - 2019-02-16 12:57 - 001038136 _____ (Microsoft Corporation) C:\WINDOWS\system32\AppVPolicy.dll 2019-03-19 19:46 - 2019-02-16 12:57 - 000954168 _____ (Microsoft Corporation) C:\WINDOWS\system32\AppVManifest.dll 2019-03-19 19:46 - 2019-02-16 12:57 - 000830264 _____ (Microsoft Corporation) C:\WINDOWS\system32\AppVOrchestration.dll 2019-03-19 19:46 - 2019-02-16 12:57 - 000825144 _____ (Microsoft Corporation) C:\WINDOWS\system32\AppVEntStreamingManager.dll 2019-03-19 19:46 - 2019-02-16 12:57 - 000749880 _____ (Microsoft Corporation) C:\WINDOWS\system32\AppVReporting.dll 2019-03-19 19:46 - 2019-02-16 12:57 - 000670008 _____ (Microsoft Corporation) C:\WINDOWS\system32\AppVCatalog.dll 2019-03-19 19:46 - 2019-02-16 12:57 - 000652088 _____ (Microsoft Corporation) C:\WINDOWS\system32\AppVPublishing.dll 2019-03-19 19:46 - 2019-02-16 12:57 - 000506088 _____ (Microsoft Corporation) C:\WINDOWS\system32\systemreset.exe 2019-03-19 19:46 - 2019-02-16 12:57 - 000495416 _____ (Microsoft Corporation) C:\WINDOWS\system32\TransportDSA.dll 2019-03-19 19:46 - 2019-02-16 12:57 - 000399672 _____ (Microsoft Corporation) C:\WINDOWS\system32\AppVScripting.dll 2019-03-19 19:46 - 2019-02-16 12:57 - 000257848 _____ (Microsoft Corporation) C:\WINDOWS\system32\AppVFileSystemMetadata.dll 2019-03-19 19:46 - 2019-02-16 12:57 - 000231224 _____ (Microsoft Corporation) C:\WINDOWS\system32\AppVShNotify.exe 2019-03-19 19:46 - 2019-02-16 12:57 - 000228152 _____ (Microsoft Corporation) C:\WINDOWS\system32\AppVStreamMap.dll 2019-03-19 19:46 - 2019-02-16 12:57 - 000201528 _____ (Microsoft Corporation) C:\WINDOWS\system32\AppVStreamingUX.dll 2019-03-19 19:46 - 2019-02-16 12:57 - 000183608 _____ (Microsoft Corporation) C:\WINDOWS\system32\mavinject.exe 2019-03-19 19:46 - 2019-02-16 12:57 - 000180528 _____ (Microsoft Corporation) C:\WINDOWS\system32\AppVDllSurrogate.exe 2019-03-19 19:46 - 2019-02-16 12:57 - 000172856 _____ (Microsoft Corporation) C:\WINDOWS\system32\AppVNice.exe 2019-03-19 19:46 - 2019-02-16 12:57 - 000034104 _____ C:\WINDOWS\system32\SyncAppvPublishingServer.exe 2019-03-19 19:46 - 2019-02-16 12:56 - 000549520 _____ (Microsoft Corporation) C:\WINDOWS\system32\AppResolver.dll 2019-03-19 19:46 - 2019-02-16 12:56 - 000540984 _____ (Microsoft Corporation) C:\WINDOWS\system32\pcasvc.dll 2019-03-19 19:46 - 2019-02-16 12:53 - 001516416 _____ (Microsoft Corporation) C:\WINDOWS\system32\msctf.dll 2019-03-19 19:46 - 2019-02-16 12:36 - 000127488 _____ (Microsoft Corporation) C:\WINDOWS\system32\AppxSysprep.dll 2019-03-19 19:46 - 2019-02-16 12:34 - 004718080 _____ (Microsoft Corporation) C:\WINDOWS\system32\twinui.pcshell.dll 2019-03-19 19:46 - 2019-02-16 12:34 - 001725952 _____ (Microsoft Corporation) C:\WINDOWS\system32\Windows.UI.Immersive.dll 2019-03-19 19:46 - 2019-02-16 12:34 - 000302080 _____ (Microsoft Corporation) C:\WINDOWS\system32\AcLayers.dll 2019-03-19 19:46 - 2019-02-16 12:33 - 002194432 _____ (Microsoft Corporation) C:\WINDOWS\system32\Microsoft.Uev.ModernAppAgent.dll 2019-03-19 19:46 - 2019-02-16 12:33 - 001786880 _____ (Microsoft Corporation) C:\WINDOWS\system32\wsp_health.dll 2019-03-19 19:46 - 2019-02-16 12:32 - 003646976 _____ (Microsoft Corporation) C:\WINDOWS\system32\win32kfull.sys 2019-03-19 19:46 - 2019-02-16 12:32 - 002051072 _____ (Microsoft Corporation) C:\WINDOWS\system32\wsp_fs.dll 2019-03-19 19:46 - 2019-02-16 12:32 - 001127936 _____ (Microsoft Corporation) C:\WINDOWS\system32\ApplySettingsTemplateCatalog.exe 2019-03-19 19:46 - 2019-02-16 12:31 - 001271808 _____ (Microsoft Corporation) C:\WINDOWS\system32\gpsvc.dll 2019-03-19 19:46 - 2019-02-16 12:31 - 001186816 _____ (Microsoft Corporation) C:\WINDOWS\system32\Microsoft.Uev.CommonBridge.dll 2019-03-19 19:46 - 2019-02-16 12:31 - 001003520 _____ (Microsoft Corporation) C:\WINDOWS\system32\clusapi.dll 2019-03-19 19:46 - 2019-02-16 12:31 - 000861184 _____ (Microsoft Corporation) C:\WINDOWS\system32\mprddm.dll 2019-03-19 19:46 - 2019-02-16 12:31 - 000615424 _____ (Microsoft Corporation) C:\WINDOWS\system32\resutils.dll 2019-03-19 19:46 - 2019-02-16 12:30 - 002019840 _____ (Microsoft Corporation) C:\WINDOWS\system32\ResetEngine.dll 2019-03-19 19:46 - 2019-02-16 12:30 - 000877568 _____ (Microsoft Corporation) C:\WINDOWS\system32\RecoveryDrive.exe 2019-03-19 19:46 - 2019-02-16 12:29 - 000174080 _____ (Microsoft Corporation) C:\WINDOWS\system32\ResetEngOnline.dll 2019-03-19 19:46 - 2019-02-16 12:29 - 000091136 _____ (Microsoft Corporation) C:\WINDOWS\system32\mcbuilder.exe 2019-03-19 19:46 - 2019-02-16 12:25 - 001539896 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\AppVEntSubsystems32.dll 2019-03-19 19:46 - 2019-02-16 12:25 - 000148784 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\mavinject.exe 2019-03-19 19:46 - 2019-02-16 12:24 - 000444176 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\AppResolver.dll 2019-03-19 19:46 - 2019-02-16 12:22 - 001322176 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\msctf.dll 2019-03-19 19:46 - 2019-02-16 12:08 - 000373760 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\AcLayers.dll 2019-03-19 19:46 - 2019-02-16 12:07 - 001307648 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\wsp_health.dll 2019-03-19 19:46 - 2019-02-16 12:07 - 000484352 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\resutils.dll 2019-03-19 19:46 - 2019-02-16 12:06 - 002890752 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\win32kfull.sys 2019-03-19 19:46 - 2019-02-16 12:06 - 001530880 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\Windows.UI.Immersive.dll 2019-03-19 19:46 - 2019-02-16 12:06 - 001451520 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\wsp_fs.dll 2019-03-19 19:46 - 2019-02-16 12:06 - 000774656 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\clusapi.dll 2019-03-19 19:46 - 2019-02-16 12:06 - 000765952 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\mprddm.dll 2019-03-19 19:46 - 2019-02-16 12:04 - 000080384 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\mcbuilder.exe 2019-03-19 19:46 - 2019-02-16 12:02 - 000055808 _____ (Microsoft Corporation) C:\WINDOWS\system32\UevAppMonitor.exe 2019-03-19 19:46 - 2019-02-16 11:55 - 000070656 _____ (Microsoft Corporation) C:\WINDOWS\system32\Microsoft.Uev.Common.dll 2019-03-19 19:46 - 2019-02-16 08:16 - 000511800 _____ (Microsoft Corporation) C:\WINDOWS\system32\aepic.dll 2019-03-19 19:46 - 2019-02-16 08:15 - 000505656 _____ (Microsoft Corporation) C:\WINDOWS\system32\dcntel.dll 2019-03-19 19:46 - 2019-02-16 08:15 - 000035640 _____ (Microsoft Corporation) C:\WINDOWS\system32\DeviceCensus.exe 2019-03-19 19:46 - 2019-02-16 08:05 - 000087800 _____ (Microsoft Corporation) C:\WINDOWS\system32\taskhostw.exe 2019-03-19 19:46 - 2019-02-16 08:04 - 000193032 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\appid.sys 2019-03-19 19:46 - 2019-02-16 08:03 - 007901392 _____ (Microsoft Corporation) C:\WINDOWS\system32\d3d10warp.dll 2019-03-19 19:46 - 2019-02-16 08:03 - 005625360 _____ (Microsoft Corporation) C:\WINDOWS\system32\StartTileData.dll 2019-03-19 19:46 - 2019-02-16 08:03 - 000510288 _____ (Microsoft Corporation) C:\WINDOWS\system32\policymanager.dll 2019-03-19 19:46 - 2019-02-16 08:02 - 005821440 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\d3d10warp.dll 2019-03-19 19:46 - 2019-02-16 08:02 - 003291632 _____ (Microsoft Corporation) C:\WINDOWS\system32\combase.dll 2019-03-19 19:46 - 2019-02-16 08:02 - 001934800 _____ (Microsoft Corporation) C:\WINDOWS\system32\AudioEng.dll 2019-03-19 19:46 - 2019-02-16 08:02 - 001792712 _____ (Microsoft Corporation) C:\WINDOWS\system32\propsys.dll 2019-03-19 19:46 - 2019-02-16 08:02 - 000705848 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\vhdmp.sys 2019-03-19 19:46 - 2019-02-16 08:02 - 000432952 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\rdbss.sys 2019-03-19 19:46 - 2019-02-16 08:02 - 000413712 _____ (Microsoft Corporation) C:\WINDOWS\system32\AUDIOKSE.dll 2019-03-19 19:46 - 2019-02-16 08:01 - 001285424 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\ndis.sys 2019-03-19 19:46 - 2019-02-16 08:01 - 001209696 _____ (Microsoft Corporation) C:\WINDOWS\system32\AudioSes.dll 2019-03-19 19:46 - 2019-02-16 08:01 - 001098056 _____ (Microsoft Corporation) C:\WINDOWS\system32\msvproc.dll 2019-03-19 19:46 - 2019-02-16 08:01 - 001028920 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\http.sys 2019-03-19 19:46 - 2019-02-16 08:01 - 001014344 _____ (Microsoft Corporation) C:\WINDOWS\system32\ucrtbase.dll 2019-03-19 19:46 - 2019-02-16 08:01 - 000735464 _____ (Microsoft Corporation) C:\WINDOWS\system32\AppXDeploymentClient.dll 2019-03-19 19:46 - 2019-02-16 08:01 - 000641984 _____ (Microsoft Corporation) C:\WINDOWS\system32\msvcp_win.dll 2019-03-19 19:46 - 2019-02-16 08:01 - 000594024 _____ (Microsoft Corporation) C:\WINDOWS\system32\audiodg.exe 2019-03-19 19:46 - 2019-02-16 08:01 - 000527160 _____ (Microsoft Corporation) C:\WINDOWS\system32\hal.dll 2019-03-19 19:46 - 2019-02-16 08:01 - 000480840 _____ (Microsoft Corporation) C:\WINDOWS\system32\ucrtbase_enclave.dll 2019-03-19 19:46 - 2019-02-16 08:01 - 000335672 _____ (Microsoft Corporation) C:\WINDOWS\system32\moshostcore.dll 2019-03-19 19:46 - 2019-02-16 08:01 - 000161664 _____ (Microsoft Corporation) C:\WINDOWS\system32\RTWorkQ.dll 2019-03-19 19:46 - 2019-02-16 07:57 - 000383288 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\aepic.dll 2019-03-19 19:46 - 2019-02-16 07:53 - 000443632 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\policymanager.dll 2019-03-19 19:46 - 2019-02-16 07:51 - 002479168 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\combase.dll 2019-03-19 19:46 - 2019-02-16 07:51 - 001584536 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\propsys.dll 2019-03-19 19:46 - 2019-02-16 07:51 - 000170952 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\RTWorkQ.dll 2019-03-19 19:46 - 2019-02-16 07:50 - 001805648 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\AudioEng.dll 2019-03-19 19:46 - 2019-02-16 07:50 - 001171336 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\ucrtbase.dll 2019-03-19 19:46 - 2019-02-16 07:50 - 001130568 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\msvproc.dll 2019-03-19 19:46 - 2019-02-16 07:50 - 001011872 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\AudioSes.dll 2019-03-19 19:46 - 2019-02-16 07:50 - 000560384 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\AppXDeploymentClient.dll 2019-03-19 19:46 - 2019-02-16 07:50 - 000504072 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\msvcp_win.dll 2019-03-19 19:46 - 2019-02-16 07:37 - 009084928 _____ (Microsoft Corporation) C:\WINDOWS\system32\BingMaps.dll 2019-03-19 19:46 - 2019-02-16 07:36 - 007057408 _____ (Microsoft Corporation) C:\WINDOWS\system32\mos.dll 2019-03-19 19:46 - 2019-02-16 07:36 - 000144384 _____ (Microsoft Corporation) C:\WINDOWS\system32\fcon.dll 2019-03-19 19:46 - 2019-02-16 07:35 - 008188928 _____ (Microsoft Corporation) C:\WINDOWS\system32\Windows.Data.Pdf.dll 2019-03-19 19:46 - 2019-02-16 07:35 - 006661632 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\Windows.Data.Pdf.dll 2019-03-19 19:46 - 2019-02-16 07:34 - 005883904 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\mos.dll 2019-03-19 19:46 - 2019-02-16 07:34 - 000095232 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\UserDataTimeUtil.dll 2019-03-19 19:46 - 2019-02-16 07:34 - 000002560 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\tzres.dll 2019-03-19 19:46 - 2019-02-16 07:33 - 006646784 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\BingMaps.dll 2019-03-19 19:46 - 2019-02-16 07:33 - 004708864 _____ (Microsoft Corporation) C:\WINDOWS\system32\cdp.dll 2019-03-19 19:46 - 2019-02-16 07:33 - 000119808 _____ (Microsoft Corporation) C:\WINDOWS\system32\UserDataTimeUtil.dll 2019-03-19 19:46 - 2019-02-16 07:33 - 000054272 _____ (Microsoft Corporation) C:\WINDOWS\system32\CredentialMigrationHandler.dll 2019-03-19 19:46 - 2019-02-16 07:33 - 000043520 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\CredentialMigrationHandler.dll 2019-03-19 19:46 - 2019-02-16 07:33 - 000002560 _____ (Microsoft Corporation) C:\WINDOWS\system32\tzres.dll 2019-03-19 19:46 - 2019-02-16 07:32 - 002969088 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\cdp.dll 2019-03-19 19:46 - 2019-02-16 07:32 - 000173568 _____ (Microsoft Corporation) C:\WINDOWS\system32\EnterpriseModernAppMgmtCSP.dll 2019-03-19 19:46 - 2019-02-16 07:31 - 002825728 _____ (Microsoft Corporation) C:\WINDOWS\system32\MapGeocoder.dll 2019-03-19 19:46 - 2019-02-16 07:31 - 000392704 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\MapConfiguration.dll 2019-03-19 19:46 - 2019-02-16 07:31 - 000141312 _____ (Microsoft Corporation) C:\WINDOWS\system32\AppointmentActivation.dll 2019-03-19 19:46 - 2019-02-16 07:31 - 000126976 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\srpapi.dll 2019-03-19 19:46 - 2019-02-16 07:30 - 002449408 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\MapRouter.dll 2019-03-19 19:46 - 2019-02-16 07:30 - 001986560 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\MapGeocoder.dll 2019-03-19 19:46 - 2019-02-16 07:30 - 001124352 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\cdprt.dll 2019-03-19 19:46 - 2019-02-16 07:30 - 000530432 _____ (Microsoft Corporation) C:\WINDOWS\system32\MapConfiguration.dll 2019-03-19 19:46 - 2019-02-16 07:30 - 000357888 _____ (Microsoft Corporation) C:\WINDOWS\system32\AppLockerCSP.dll 2019-03-19 19:46 - 2019-02-16 07:30 - 000254464 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\AppLockerCSP.dll 2019-03-19 19:46 - 2019-02-16 07:30 - 000145920 _____ (Microsoft Corporation) C:\WINDOWS\system32\srpapi.dll 2019-03-19 19:46 - 2019-02-16 07:29 - 001768448 _____ (Microsoft Corporation) C:\WINDOWS\system32\audiosrv.dll 2019-03-19 19:46 - 2019-02-16 07:29 - 000304128 _____ (Microsoft Corporation) C:\WINDOWS\system32\domgmt.dll 2019-03-19 19:46 - 2019-02-16 07:28 - 003381248 _____ (Microsoft Corporation) C:\WINDOWS\system32\MapRouter.dll 2019-03-19 19:46 - 2019-02-16 07:28 - 002585600 _____ (Microsoft Corporation) C:\WINDOWS\system32\wlansvc.dll 2019-03-19 19:46 - 2019-02-16 07:28 - 001668096 _____ (Microsoft Corporation) C:\WINDOWS\system32\cdprt.dll 2019-03-19 19:46 - 2019-02-16 07:28 - 000713216 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\BingOnlineServices.dll 2019-03-19 19:46 - 2019-02-16 07:28 - 000705024 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\MapControlCore.dll 2019-03-19 19:46 - 2019-02-16 07:28 - 000528384 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\ActivationManager.dll 2019-03-19 19:46 - 2019-02-16 07:27 - 001364992 _____ (Microsoft Corporation) C:\WINDOWS\system32\lpasvc.dll 2019-03-19 19:46 - 2019-02-16 07:27 - 000729088 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\NMAA.dll 2019-03-19 19:46 - 2019-02-16 07:27 - 000686592 _____ (Microsoft Corporation) C:\WINDOWS\system32\AudioEndpointBuilder.dll 2019-03-19 19:46 - 2019-02-16 07:26 - 001459712 _____ (Microsoft Corporation) C:\WINDOWS\system32\dosvc.dll 2019-03-19 19:46 - 2019-02-16 07:26 - 001225216 _____ (Microsoft Corporation) C:\WINDOWS\system32\MapsStore.dll 2019-03-19 19:46 - 2019-02-16 07:26 - 000943616 _____ (Microsoft Corporation) C:\WINDOWS\system32\BingOnlineServices.dll 2019-03-19 19:46 - 2019-02-16 07:26 - 000935424 _____ (Microsoft Corporation) C:\WINDOWS\system32\rasmans.dll 2019-03-19 19:46 - 2019-02-16 07:26 - 000401920 _____ (Microsoft Corporation) C:\WINDOWS\system32\rascustom.dll 2019-03-19 19:46 - 2019-02-16 07:25 - 000884224 _____ (Microsoft Corporation) C:\WINDOWS\system32\NMAA.dll 2019-03-19 19:46 - 2019-02-16 07:25 - 000652800 _____ (Microsoft Corporation) C:\WINDOWS\system32\ActivationManager.dll 2019-03-19 19:29 - 2019-03-19 19:40 - 573980852 _____ C:\Users\matth\Downloads\linuxmint-19.1-cinnamon-64bit.iso 2019-03-19 19:25 - 2019-03-19 19:25 - 000002500 _____ C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Word.lnk 2019-03-19 19:25 - 2019-03-19 19:25 - 000002499 _____ C:\ProgramData\Microsoft\Windows\Start Menu\Programs\PowerPoint.lnk 2019-03-19 19:25 - 2019-03-19 19:25 - 000002463 _____ C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Access.lnk 2019-03-19 19:25 - 2019-03-19 19:25 - 000002462 _____ C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Excel.lnk 2019-03-19 19:25 - 2019-03-19 19:25 - 000002456 _____ C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Outlook.lnk 2019-03-19 19:25 - 2019-03-19 19:25 - 000002450 _____ C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Publisher.lnk 2019-03-19 19:25 - 2019-03-19 19:25 - 000000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Microsoft Office Tools 2019-03-19 19:06 - 2019-03-19 19:06 - 000001413 _____ C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Adobe Creative Cloud.lnk 2019-03-19 19:06 - 2019-03-19 19:06 - 000001401 _____ C:\Users\Public\Desktop\Adobe Creative Cloud.lnk 2019-03-02 16:45 - 2019-03-02 16:45 - 000002019 _____ C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Nitro Pro 10.lnk 2019-03-02 16:45 - 2019-03-02 16:45 - 000002007 _____ C:\Users\Public\Desktop\Nitro Pro 10.lnk 2019-03-02 16:45 - 2019-03-02 16:45 - 000000000 ____D C:\Program Files\Nitro 2019-03-02 16:45 - 2019-03-02 16:45 - 000000000 ____D C:\Program Files\Common Files\Nitro 2019-03-02 16:45 - 2019-03-02 16:45 - 000000000 ____D C:\Program Files (x86)\Nitro 2019-03-02 16:45 - 2016-07-22 17:26 - 000031896 _____ (Nitro Software, Inc.) C:\WINDOWS\system32\nitrolocalmon10.dll 2019-03-02 16:45 - 2016-07-22 17:26 - 000020120 _____ (Nitro Software, Inc.) C:\WINDOWS\system32\nitrolocalui10.dll 2019-03-02 16:43 - 2019-03-02 16:43 - 000000000 ____D C:\Users\matth\AppData\Roaming\Downloaded Installations 2019-03-02 15:33 - 2019-03-02 15:33 - 000000000 ____D C:\Users\matth\AppData\Roaming\Nitro 2019-03-02 15:33 - 2019-03-02 15:33 - 000000000 ____D C:\ProgramData\Nitro 2019-03-02 15:33 - 2018-01-06 01:50 - 000749664 _____ (Nitro Software, Inc.) C:\WINDOWS\system32\NxPrinterMonitor11.dll ==================== One month (modified) ======== (If an entry is included in the fixlist, the file/folder will be moved.) 2019-03-26 20:06 - 2018-05-21 09:12 - 000969288 _____ C:\WINDOWS\system32\PerfStringBackup.INI 2019-03-26 20:06 - 2018-04-11 23:36 - 000000000 ____D C:\WINDOWS\INF 2019-03-26 20:05 - 2018-04-11 23:38 - 000000000 ____D C:\WINDOWS\AppReadiness 2019-03-26 19:59 - 2019-02-09 15:57 - 000000000 ____D C:\Users\matth\AppData\Local\OXSTORE2 2019-03-26 19:59 - 2018-08-24 13:50 - 000000000 ____D C:\Program Files (x86)\Steam 2019-03-26 19:59 - 2016-05-21 06:31 - 000000000 ___RD C:\Users\matth\Dropbox 2019-03-26 19:59 - 2016-05-17 15:15 - 000000000 ___RD C:\Users\matth\Creative Cloud Files 2019-03-26 19:59 - 2016-05-17 14:42 - 000000000 ____D C:\Users\matth\AppData\Local\Adobe 2019-03-26 19:59 - 2016-05-17 11:29 - 000000000 ___RD C:\Users\matth\OneDrive 2019-03-26 19:58 - 2018-05-21 09:26 - 000000006 ____H C:\WINDOWS\Tasks\SA.DAT 2019-03-26 19:58 - 2018-04-11 23:38 - 000000000 ____D C:\WINDOWS\system32\WinBioDatabase 2019-03-26 19:58 - 2018-04-11 23:38 - 000000000 ____D C:\ProgramData\regid.1991-06.com.microsoft 2019-03-26 19:58 - 2018-04-11 21:04 - 001310720 _____ C:\WINDOWS\system32\config\BBI 2019-03-26 19:58 - 2018-04-11 21:04 - 000032768 _____ C:\WINDOWS\system32\config\ELAM 2019-03-26 19:58 - 2017-06-15 10:34 - 000041448 _____ C:\WINDOWS\system32\OV5693_FRONT.aiqd 2019-03-26 19:58 - 2017-05-17 17:14 - 000000000 ____D C:\ProgramData\NVIDIA 2019-03-26 19:58 - 2016-08-07 07:26 - 000041448 _____ C:\WINDOWS\system32\OV7251_FRONT.aiqd 2019-03-26 19:58 - 2016-05-18 08:47 - 000000000 ____D C:\Program Files (x86)\TeamViewer 2019-03-26 19:51 - 2018-05-21 09:10 - 000000000 ____D C:\WINDOWS\system32\SleepStudy 2019-03-26 18:18 - 2018-04-11 23:38 - 000000000 ___HD C:\Program Files\WindowsApps 2019-03-26 18:16 - 2018-02-15 10:41 - 000002308 _____ C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Google Chrome.lnk 2019-03-26 18:16 - 2018-02-15 10:41 - 000002267 _____ C:\Users\Public\Desktop\Google Chrome.lnk 2019-03-26 18:11 - 2018-05-21 09:17 - 000000000 ____D C:\Users\matth 2019-03-25 07:28 - 2018-06-01 15:21 - 000000000 ____D C:\WINDOWS\Minidump 2019-03-24 20:04 - 2018-08-17 08:42 - 000000000 ___HD C:\OneDriveTemp 2019-03-24 20:01 - 2017-05-17 17:13 - 000000000 ____D C:\WINDOWS\Firmware 2019-03-24 10:08 - 2016-05-17 11:27 - 000000000 ____D C:\Users\matth\AppData\Roaming\Adobe 2019-03-24 10:07 - 2016-05-18 09:32 - 000000000 ____D C:\Users\matth\AppData\LocalLow\Adobe 2019-03-24 10:07 - 2016-05-17 15:42 - 000000000 ____D C:\ProgramData\regid.1986-12.com.adobe 2019-03-24 05:06 - 2019-02-23 19:06 - 000153328 _____ (Malwarebytes) C:\WINDOWS\system32\Drivers\mbae64.sys 2019-03-23 11:37 - 2017-05-22 18:45 - 000000000 ____D C:\Users\matth\.VirtualBox 2019-03-22 17:42 - 2018-05-21 09:26 - 000004396 _____ C:\WINDOWS\System32\Tasks\Open URL by RoboForm 2019-03-22 17:42 - 2018-05-21 09:26 - 000003800 _____ C:\WINDOWS\System32\Tasks\Run RoboForm TaskBar Icon 2019-03-22 17:42 - 2016-05-17 14:18 - 000000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\RoboForm 2019-03-21 22:15 - 2018-04-11 23:38 - 000000000 ____D C:\WINDOWS\LiveKernelReports 2019-03-20 19:41 - 2018-01-13 04:56 - 000000000 ____D C:\Program Files\rempl 2019-03-20 19:40 - 2016-05-21 06:25 - 000000000 ____D C:\Program Files (x86)\Dropbox 2019-03-20 19:35 - 2018-08-24 19:54 - 000000000 ____D C:\Users\Linus 2019-03-20 19:35 - 2018-05-21 09:10 - 001701536 _____ C:\WINDOWS\system32\FNTCACHE.DAT 2019-03-20 19:34 - 2018-04-12 16:19 - 000000000 ____D C:\Program Files\Windows Defender Advanced Threat Protection 2019-03-20 19:34 - 2018-04-11 23:38 - 000000000 ___SD C:\WINDOWS\system32\UNP 2019-03-20 19:34 - 2018-04-11 23:38 - 000000000 ___RD C:\Program Files\Windows Defender 2019-03-20 19:34 - 2018-04-11 23:38 - 000000000 ____D C:\WINDOWS\TextInput 2019-03-20 19:34 - 2018-04-11 23:38 - 000000000 ____D C:\WINDOWS\system32\oobe 2019-03-20 19:34 - 2018-04-11 23:38 - 000000000 ____D C:\WINDOWS\system32\appraiser 2019-03-20 19:34 - 2018-04-11 23:38 - 000000000 ____D C:\WINDOWS\ShellExperiences 2019-03-20 19:34 - 2018-04-11 23:38 - 000000000 ____D C:\WINDOWS\bcastdvr 2019-03-20 19:34 - 2018-04-11 23:38 - 000000000 ____D C:\Program Files (x86)\Windows Defender 2019-03-20 19:32 - 2016-07-14 11:34 - 000000666 _____ C:\WINDOWS\Tasks\G2MUploadTask-S-1-5-21-306283558-555091848-1802614870-1001.job 2019-03-20 19:32 - 2016-07-14 11:34 - 000000570 _____ C:\WINDOWS\Tasks\G2MUpdateTask-S-1-5-21-306283558-555091848-1802614870-1001.job 2019-03-19 19:50 - 2018-04-11 23:30 - 000000000 ____D C:\WINDOWS\CbsTemp 2019-03-19 19:49 - 2017-05-22 19:20 - 000000000 ____D C:\Users\matth\VirtualBox VMs 2019-03-19 19:46 - 2016-05-18 10:45 - 000000000 ____D C:\WINDOWS\system32\MRT 2019-03-19 19:37 - 2019-02-05 18:58 - 000001047 _____ C:\ProgramData\Microsoft\Windows\Start Menu\Programs\TeamViewer 14.lnk 2019-03-19 19:37 - 2019-02-05 18:58 - 000001035 _____ C:\Users\Public\Desktop\TeamViewer 14.lnk 2019-03-19 19:37 - 2018-05-21 09:17 - 000000000 ____D C:\Users\DefaultAppPool 2019-03-19 19:37 - 2018-05-21 09:17 - 000000000 ____D C:\Users\.NET v4.5 Classic 2019-03-19 19:37 - 2018-05-21 09:17 - 000000000 ____D C:\Users\.NET v4.5 2019-03-19 19:30 - 2017-07-10 02:33 - 000000000 ____D C:\Users\matth\AppData\Local\GoToMeeting 2019-03-19 19:24 - 2016-05-17 11:57 - 000000000 ____D C:\Program Files (x86)\Microsoft Office 2019-03-19 19:21 - 2016-05-18 10:45 - 127411920 ____C (Microsoft Corporation) C:\WINDOWS\system32\MRT.exe 2019-03-19 19:19 - 2018-07-13 21:57 - 000003374 _____ C:\WINDOWS\System32\Tasks\OneDrive Standalone Update Task-S-1-5-21-306283558-555091848-1802614870-1001 2019-03-19 19:19 - 2018-07-13 21:55 - 000002370 _____ C:\Users\matth\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\OneDrive.lnk 2019-03-19 19:06 - 2016-05-17 15:01 - 000000000 ____D C:\Program Files (x86)\Adobe 2019-03-19 19:02 - 2018-05-21 09:26 - 000003832 _____ C:\WINDOWS\System32\Tasks\G2MUploadTask-S-1-5-21-306283558-555091848-1802614870-1001 2019-03-19 19:02 - 2018-05-21 09:26 - 000003736 _____ C:\WINDOWS\System32\Tasks\G2MUpdateTask-S-1-5-21-306283558-555091848-1802614870-1001 2019-03-03 16:54 - 2018-09-27 11:22 - 000835480 _____ (Adobe Systems Incorporated) C:\WINDOWS\SysWOW64\FlashPlayerApp.exe 2019-03-03 16:54 - 2018-09-27 11:22 - 000179608 _____ (Adobe Systems Incorporated) C:\WINDOWS\SysWOW64\FlashPlayerCPLApp.cpl 2019-03-02 16:43 - 2016-02-12 02:15 - 000000000 ____D C:\ProgramData\Package Cache 2019-03-02 15:33 - 2017-04-24 11:00 - 000000000 ____D C:\Users\matth\AppData\Local\Downloaded Installations ==================== Files in the root of some directories ======= 2018-10-08 10:35 - 2018-10-08 10:35 - 000000000 _____ () C:\Users\matth\AppData\Local\oobelibMkey.log 2018-03-14 19:20 - 2018-03-14 19:20 - 000007627 _____ () C:\Users\matth\AppData\Local\Resmon.ResmonCfg ==================== Bamital & volsnap ====================== (There is no automatic fix for files that do not pass verification.) C:\WINDOWS\system32\winlogon.exe => File is digitally signed C:\WINDOWS\system32\wininit.exe => File is digitally signed C:\WINDOWS\explorer.exe => File is digitally signed C:\WINDOWS\SysWOW64\explorer.exe => File is digitally signed C:\WINDOWS\system32\svchost.exe => File is digitally signed C:\WINDOWS\SysWOW64\svchost.exe => File is digitally signed C:\WINDOWS\system32\services.exe => File is digitally signed C:\WINDOWS\system32\User32.dll => File is digitally signed C:\WINDOWS\SysWOW64\User32.dll => File is digitally signed C:\WINDOWS\system32\userinit.exe => File is digitally signed C:\WINDOWS\SysWOW64\userinit.exe => File is digitally signed C:\WINDOWS\system32\rpcss.dll => File is digitally signed C:\WINDOWS\system32\dnsapi.dll => File is digitally signed C:\WINDOWS\SysWOW64\dnsapi.dll => File is digitally signed C:\WINDOWS\system32\dllhost.exe => File is digitally signed C:\WINDOWS\SysWOW64\dllhost.exe => File is digitally signed C:\WINDOWS\system32\Drivers\volsnap.sys => File is digitally signed LastRegBack: 2018-05-21 09:10 ==================== End of FRST.txt ============================ Addition.txt
  4. The attached popup has appeared but I cannot find anything online to say it is safe or not. The process was listed as COM Surrogate (32bit) and the details said dllhost.exe I do not want to click on OK as I cannot verify the message (I have never seen a message like it before) Thanks
Back to top
×
×
  • Create New...

Important Information

This site uses cookies - We have placed cookies on your device to help make this website better. You can adjust your cookie settings, otherwise we'll assume you're okay to continue.