Jump to content

Malwarebytes freezes midway scan. (vmx client)

Kayla2233
 Share

Recommended Posts

Kayla2233

Kayla2233

Posted
Posted

Hello. I've been having quite a difficult time trying to remove the wmx (svcmx) malware on my computer. I cannot run any malware downloads because I get the error (the requested resource is in use). I downloaded malwarebytes to a folder to extract it and and finally got it to open. Now my problem is, it freezes midway through scan. I've tired safemode, and it wont even load up on there. I really don't want to get a new computer. I have too much important information on here. 

Link to post
Share on other sites
Kayla2233

Kayla2233

Posted
  • Author
Posted

Scan result of Farbar Recovery Scan Tool (FRST) (x64) Version: 05-06-2017
Ran by Macaiyla (administrator) on MACAIYLA-PC (05-06-2017 23:28:23)
Running from C:\Users\Macaiyla\Downloads
Loaded Profiles: Macaiyla &  (Available Profiles: Macaiyla)
Platform: Windows 7 Home Premium Service Pack 1 (X64) Language: English (United States)
Internet Explorer Version 11 (Default browser: Chrome)
Boot Mode: Normal
Tutorial for Farbar Recovery Scan Tool: http://www.geekstogo.com/forum/topic/335081-frst-tutorial-how-to-use-farbar-recovery-scan-tool/

==================== Processes (Whitelisted) =================

(If an entry is included in the fixlist, the process will be closed. The file will not be moved.)

(Microsoft Corporation) C:\Program Files\Microsoft Security Client\MsMpEng.exe
() C:\Windows\System32\tprdpw64.exe
(Intel Corporation) C:\Windows\System32\IPROSetMonitor.exe
(Logitech Inc.) C:\Program Files\Logitech Gaming Software\Drivers\APOService\LogiRegistryService.exe
( Rsupport Corporation) C:\Program Files (x86)\RSUPPORT\MobizenService\MobizenService.exe
(NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\NvContainer\nvcontainer.exe
(NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\Display.NvContainer\NVDisplay.Container.exe
(NVIDIA Corporation) C:\Program Files (x86)\NVIDIA Corporation\NvTelemetry\NvTelemetryContainer.exe
(NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\Display.NvContainer\NVDisplay.Container.exe
(NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\Display\nvtray.exe
(Microsoft Corporation) C:\Program Files\Microsoft Security Client\NisSrv.exe
(Realtek Semiconductor) C:\Program Files\Realtek\Audio\HDA\RtkNGUI64.exe
(Microsoft Corporation) C:\Windows\System32\dllhost.exe
(NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\ShadowPlay\nvspcaps64.exe
(NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\ShadowPlay\nvsphelper64.exe
() C:\Program Files (x86)\dataup\dataup.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\DAL\jhi_service.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\LMS\LMS.exe
() C:\Program Files (x86)\RSUPPORT\MobizenService\dat\adb.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Emsisoft Ltd) C:\EEK\bin64\a2emergencykit.exe
(NVIDIA Corporation) C:\Program Files (x86)\NVIDIA Corporation\NvContainer\nvcontainer.exe
(NVIDIA Corporation) C:\Program Files (x86)\NVIDIA Corporation\NVIDIA GeForce Experience\NVIDIA Share.exe
(NVIDIA Corporation) C:\Program Files (x86)\NVIDIA Corporation\NVIDIA GeForce Experience\NVIDIA Share.exe
(Node.js) C:\Program Files (x86)\NVIDIA Corporation\NvNode\NVIDIA Web Helper.exe
(Microsoft Corporation) C:\Windows\System32\cmd.exe
(Microsoft Corporation) C:\Windows\System32\rundll32.exe
(Microsoft Corporation) C:\Windows\SysWOW64\rundll32.exe
() C:\Users\Macaiyla\AppData\Local\ntuserlitelist\svcvmx\svcvmx.exe
() C:\Users\Macaiyla\AppData\Local\ntuserlitelist\svcvmx\vmxclient.exe
() C:\Users\Macaiyla\AppData\Local\ntuserlitelist\svcvmx\vmxclient.exe
() C:\Riot Games\League of Legends\RADS\projects\league_client\releases\0.0.0.78\deploy\LeagueClient.exe
() C:\Riot Games\League of Legends\RADS\projects\league_client\releases\0.0.0.78\deploy\LeagueClientUx.exe
() C:\Riot Games\League of Legends\RADS\projects\league_client\releases\0.0.0.78\deploy\LeagueClientUxRender.exe
() C:\Riot Games\League of Legends\RADS\projects\league_client\releases\0.0.0.78\deploy\LeagueClientUxRender.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Microsoft Corporation) C:\Windows\System32\taskmgr.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
() C:\Users\Macaiyla\AppData\Local\ntuserlitelist\svcvmx\vmxclient.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
() C:\Users\Macaiyla\AppData\Local\ntuserlitelist\svcvmx\vmxclient.exe
() C:\Users\Macaiyla\AppData\Local\ntuserlitelist\svcvmx\vmxclient.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
() C:\Riot Games\League of Legends\RADS\solutions\lol_game_client_sln\releases\0.0.1.176\deploy\League of Legends.exe
() C:\Users\Macaiyla\AppData\Local\ntuserlitelist\svcvmx\vmxclient.exe
(Microsoft Corporation) C:\Windows\System32\dllhost.exe

==================== Registry (Whitelisted) ====================

(If an entry is included in the fixlist, the registry item will be restored to default or removed. The file will not be moved.)

HKLM\...\Run: [Launch LCore] => C:\Program Files\Logitech Gaming Software\LCore.exe [15120504 2016-02-17] (Logitech Inc.)
HKLM\...\Run: [RTHDVCPL] => C:\Program Files\Realtek\Audio\HDA\RtkNGUI64.exe [9197568 2017-01-11] (Realtek Semiconductor)
HKLM\...\Run: [ShadowPlay] => "C:\Windows\system32\rundll32.exe" C:\Windows\system32\nvspcap64.dll,ShadowPlayOnSystemStart
HKLM-x32\...\Run: [USB3MON] => C:\Program Files (x86)\Intel\Intel(R) USB 3.0 eXtensible Host Controller Driver\Application\iusb3mon.exe [296216 2015-06-15] (Intel Corporation)
HKU\S-1-5-21-2444583048-3021673881-1256095731-1000\...\Run: [Zoom] => [X]
HKU\S-1-5-18\...\RunOnce: [SPReview] => C:\Windows\System32\SPReview\SPReview.exe [301568 2016-01-20] (Microsoft Corporation)
ShellIconOverlayIdentifiers: [  GoogleDriveBlacklisted] -> {81539FE6-33C7-4CE7-90C7-1C7B8F2F2D42} => C:\Program Files (x86)\Google\Drive\googledrivesync64.dll [2017-03-21] (Google)
ShellIconOverlayIdentifiers: [  GoogleDriveSynced] -> {81539FE6-33C7-4CE7-90C7-1C7B8F2F2D40} => C:\Program Files (x86)\Google\Drive\googledrivesync64.dll [2017-03-21] (Google)
ShellIconOverlayIdentifiers: [  GoogleDriveSyncing] -> {81539FE6-33C7-4CE7-90C7-1C7B8F2F2D41} => C:\Program Files (x86)\Google\Drive\googledrivesync64.dll [2017-03-21] (Google)
ShellIconOverlayIdentifiers: [ AccExtIco1] -> {AB9CF9F8-8A96-4F9D-BF21-CE85714C3A47} => C:\Program Files (x86)\Adobe\Adobe Creative Cloud\CoreSyncExtension\CoreSync_x64.dll [2016-10-25] ()
ShellIconOverlayIdentifiers: [ AccExtIco2] -> {853B7E05-C47D-4985-909A-D0DC5C6D7303} => C:\Program Files (x86)\Adobe\Adobe Creative Cloud\CoreSyncExtension\CoreSync_x64.dll [2016-10-25] ()
ShellIconOverlayIdentifiers: [ AccExtIco3] -> {42D38F2E-98E9-4382-B546-E24E4D6D04BB} => C:\Program Files (x86)\Adobe\Adobe Creative Cloud\CoreSyncExtension\CoreSync_x64.dll [2016-10-25] ()
ShellIconOverlayIdentifiers: [00asw] -> {472083B0-C522-11CF-8763-00608CC02F24} =>  -> No File
ShellIconOverlayIdentifiers: [00avast] -> {472083B0-C522-11CF-8763-00608CC02F24} =>  -> No File
ShellIconOverlayIdentifiers: [GDriveSharedOverlay] -> {81539FE6-33C7-4CE7-90C7-1C7B8F2F2D43} =>  -> No File
BootExecute: autocheck autochk * aswBoot.exe /M:1b1c575c1b /wow /dir:"C:\Program Files\AVAST Software\Avast"bootdeletebootdeleteC:\Windows\system32\eamclean.exe \??\C:\Windows\system32\eamclean.dat eamclean

==================== Internet (Whitelisted) ====================

(If an item is included in the fixlist, if it is a registry item it will be removed or restored to default.)

Hosts: 127.0.0.1    localhost
Tcpip\Parameters: [DhcpNameServer] 192.168.1.1
Tcpip\..\Interfaces\{01F23EE2-02F8-4FF6-85C8-894E2BD8E7E3}: [DhcpNameServer] 192.168.1.1
Tcpip\..\Interfaces\{233E3C32-E87B-4DBE-ACDD-C94B1B46502B}: [DhcpNameServer] 192.168.1.1
Tcpip\..\Interfaces\{2407FD94-0E0B-48E6-A439-46C4C713591D}: [DhcpNameServer] 192.168.1.1

Internet Explorer:
==================
HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://go.microsoft.com/fwlink/?LinkID=617911&ResetID=131176047459926501&GUID=B9273E30-88F1-4FE7-A4C6-7480590E9B59
HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Start Page = hxxp://go.microsoft.com/fwlink/?LinkID=617911&ResetID=131176047459931501&GUID=B9273E30-88F1-4FE7-A4C6-7480590E9B59
HKU\S-1-5-21-2444583048-3021673881-1256095731-1000\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://go.microsoft.com/fwlink/?LinkID=617911&ResetID=131176047459936501&GUID=B9273E30-88F1-4FE7-A4C6-7480590E9B59
BHO-x32: Java(tm) Plug-In SSV Helper -> {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} -> C:\Program Files (x86)\Java\jre1.8.0_131\bin\ssv.dll [2017-05-05] (Oracle Corporation)
BHO-x32: Java(tm) Plug-In 2 SSV Helper -> {DBC80044-A445-435b-BC74-9C25C1C588A9} -> C:\Program Files (x86)\Java\jre1.8.0_131\bin\jp2ssv.dll [2017-05-05] (Oracle Corporation)

FireFox:
========
FF HKLM-x32\...\Firefox\Extensions: [jid1-xNAj4KGyf5wyhg@jetpack] - C:\Program Files (x86)\Faster Web\faster-web.xpi => not found
FF Plugin: @microsoft.com/GENUINE -> disabled [No File]
FF Plugin: @Microsoft.com/NpCtrl,version=1.0 -> c:\Program Files\Microsoft Silverlight\5.1.50906.0\npctrl.dll [2017-03-09] ( Microsoft Corporation)
FF Plugin: adobe.com/AdobeAAMDetect -> C:\Program Files (x86)\Adobe\Adobe Creative Cloud\Utils\npAdobeAAMDetect64.dll [2017-03-27] (Adobe Systems)
FF Plugin-x32: @Apple.com/iTunes,version=1.0 -> C:\Program Files (x86)\iTunes\Mozilla Plugins\npitunes.dll [2015-12-18] ()
FF Plugin-x32: @intel-webapi.intel.com/Intel WebAPI ipt;version=4.0.68 -> C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\IPT\npIntelWebAPIIPT.dll [2015-04-21] (Intel Corporation)
FF Plugin-x32: @intel-webapi.intel.com/Intel WebAPI updater -> C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\IPT\npIntelWebAPIUpdater.dll [2015-04-21] (Intel Corporation)
FF Plugin-x32: @java.com/DTPlugin,version=11.131.2 -> C:\Program Files (x86)\Java\jre1.8.0_131\bin\dtplugin\npDeployJava1.dll [2017-05-05] (Oracle Corporation)
FF Plugin-x32: @java.com/JavaPlugin,version=11.131.2 -> C:\Program Files (x86)\Java\jre1.8.0_131\bin\plugin2\npjp2.dll [2017-05-05] (Oracle Corporation)
FF Plugin-x32: @microsoft.com/GENUINE -> disabled [No File]
FF Plugin-x32: @Microsoft.com/NpCtrl,version=1.0 -> c:\Program Files (x86)\Microsoft Silverlight\5.1.50906.0\npctrl.dll [2017-03-09] ( Microsoft Corporation)
FF Plugin-x32: @nvidia.com/3DVision -> C:\Program Files (x86)\NVIDIA Corporation\3D Vision\npnv3dv.dll [2017-05-01] (NVIDIA Corporation)
FF Plugin-x32: @nvidia.com/3DVisionStreaming -> C:\Program Files (x86)\NVIDIA Corporation\3D Vision\npnv3dvstreaming.dll [2017-05-01] (NVIDIA Corporation)
FF Plugin-x32: @tools.google.com/Google Update;version=3 -> C:\Program Files (x86)\Google\Update\1.3.33.5\npGoogleUpdate3.dll [2017-04-27] (Google Inc.)
FF Plugin-x32: @tools.google.com/Google Update;version=9 -> C:\Program Files (x86)\Google\Update\1.3.33.5\npGoogleUpdate3.dll [2017-04-27] (Google Inc.)
FF Plugin-x32: adobe.com/AdobeAAMDetect -> C:\Program Files (x86)\Adobe\Adobe Creative Cloud\Utils\npAdobeAAMDetect32.dll [2017-03-27] (Adobe Systems)
FF Plugin HKU\S-1-5-21-2444583048-3021673881-1256095731-1000: @zoom.us/ZoomVideoPlugin -> C:\Users\Macaiyla\AppData\Roaming\Zoom\bin\npzoomplugin.dll [2016-07-13] (Zoom Video Communications, Inc.)

Chrome: 
=======
CHR DefaultProfile: Profile 2
CHR Profile: C:\Users\Macaiyla\AppData\Local\Google\Chrome\User Data\Profile 2 [2017-06-05]
CHR Extension: (Google Slides) - C:\Users\Macaiyla\AppData\Local\Google\Chrome\User Data\Profile 2\Extensions\aapocclcgogkmnckokdopfmhonfmgoek [2017-05-08]
CHR Extension: (BetterTTV) - C:\Users\Macaiyla\AppData\Local\Google\Chrome\User Data\Profile 2\Extensions\ajopnjidmegmdimjlfnijceegpefgped [2017-05-09]
CHR Extension: (Google Docs) - C:\Users\Macaiyla\AppData\Local\Google\Chrome\User Data\Profile 2\Extensions\aohghmighlieiainnegkcijnfilokake [2017-05-08]
CHR Extension: (Google Drive) - C:\Users\Macaiyla\AppData\Local\Google\Chrome\User Data\Profile 2\Extensions\apdfllckaahabafndbhieahigkjlhalf [2017-05-08]
CHR Extension: (YouTube) - C:\Users\Macaiyla\AppData\Local\Google\Chrome\User Data\Profile 2\Extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo [2017-05-08]
CHR Extension: (uBlock Origin) - C:\Users\Macaiyla\AppData\Local\Google\Chrome\User Data\Profile 2\Extensions\cjpalhdlnbpafiamejdnhcphjbkeiagm [2017-05-20]
CHR Extension: (Google Sheets) - C:\Users\Macaiyla\AppData\Local\Google\Chrome\User Data\Profile 2\Extensions\felcaaldnbdncclmgdcncolpebgiejap [2017-05-08]
CHR Extension: (Google Docs Offline) - C:\Users\Macaiyla\AppData\Local\Google\Chrome\User Data\Profile 2\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi [2017-05-08]
CHR Extension: (Skype) - C:\Users\Macaiyla\AppData\Local\Google\Chrome\User Data\Profile 2\Extensions\lifbcibllhkdhoafpjfnlhfpfgnpldfl [2017-05-08]
CHR Extension: (Chrome Web Store Payments) - C:\Users\Macaiyla\AppData\Local\Google\Chrome\User Data\Profile 2\Extensions\nmmhkkegccagdldgiimedpiccmgmieda [2017-05-08]
CHR Extension: (Global Twitch Emotes) - C:\Users\Macaiyla\AppData\Local\Google\Chrome\User Data\Profile 2\Extensions\pgniedifoejifjkndekolimjeclnokkb [2017-05-09]
CHR Extension: (Gmail) - C:\Users\Macaiyla\AppData\Local\Google\Chrome\User Data\Profile 2\Extensions\pjkljhegncpnkpknbcohdijeoejaedia [2017-05-08]
CHR Extension: (Chrome Media Router) - C:\Users\Macaiyla\AppData\Local\Google\Chrome\User Data\Profile 2\Extensions\pkedcjkdefgpdelpbcmbmeomcjbeemfm [2017-05-20]
CHR HKLM-x32\...\Chrome\Extension: [lifbcibllhkdhoafpjfnlhfpfgnpldfl] - hxxps://clients2.google.com/service/update2/crx

==================== Services (Whitelisted) ====================

(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)

"drmkpro64" => service could not be unlocked. <===== ATTENTION

S4 AdobeUpdateService; C:\Program Files (x86)\Common Files\Adobe\Adobe Desktop Common\ElevationManager\AdobeUpdateService.exe [771672 2017-03-14] (Adobe Systems Incorporated)
S4 AGSService; C:\Program Files (x86)\Common Files\Adobe\AdobeGCClient\AGSService.exe [2246256 2017-05-18] (Adobe Systems, Incorporated)
S2 asComSvc; C:\Program Files (x86)\ASUS\AXSP\1.02.00\atkexComSvc.exe [936728 2015-05-08] ()
S2 AsSysCtrlService; C:\Program Files (x86)\ASUS\AsSysCtrlService\1.00.22\AsSysCtrlService.exe [1360016 2014-04-24] () [File not signed]
S4 BEService; C:\Program Files (x86)\Common Files\BattlEye\BEService.exe [1522184 2017-02-26] ()
R2 Dataup; C:\Program Files (x86)\dataup\dataup.exe [77824 2015-08-06] () [File not signed] <==== ATTENTION
S4 IDriverT; C:\Program Files (x86)\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe [69632 2005-04-04] (Macrovision Corporation) [File not signed]
S3 Intel(R) Capability Licensing Service TCP IP Interface; C:\Program Files\Intel\iCLS Client\SocketHeciServer.exe [881152 2015-05-22] (Intel(R) Corporation)
R2 jhi_service; C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\DAL\jhi_service.exe [223008 2015-06-02] (Intel Corporation)
R2 LogiRegistryService; C:\Program Files\Logitech Gaming Software\Drivers\APOService\LogiRegistryService.exe [193656 2016-02-17] (Logitech Inc.)
R2 Mobizen plugin; C:\Program Files (x86)\RSUPPORT\MobizenService\MobizenService.exe [1277768 2017-02-01] ( Rsupport Corporation)
R2 MsMpSvc; c:\Program Files\Microsoft Security Client\MsMpEng.exe [119864 2016-11-14] (Microsoft Corporation)
R3 NisSrv; c:\Program Files\Microsoft Security Client\NisSrv.exe [361816 2016-11-14] (Microsoft Corporation)
R2 NvContainerLocalSystem; C:\Program Files\NVIDIA Corporation\NvContainer\nvcontainer.exe [495224 2017-05-03] (NVIDIA Corporation)
S3 NvContainerNetworkService; C:\Program Files\NVIDIA Corporation\NvContainer\nvcontainer.exe [495224 2017-05-03] (NVIDIA Corporation)
R2 NVDisplay.ContainerLocalSystem; C:\Program Files\NVIDIA Corporation\Display.NvContainer\NVDisplay.Container.exe [462968 2017-05-01] (NVIDIA Corporation)
R2 NvTelemetryContainer; C:\Program Files (x86)\NVIDIA Corporation\NvTelemetry\NvTelemetryContainer.exe [450168 2017-05-03] (NVIDIA Corporation)
S4 PlaysService; C:\Program Files (x86)\Raptr Inc\PlaysTV\plays_service.exe [55000 2017-05-05] (Copyright (c) 2017 Plays.tv, LLC)
S4 Razer Game Scanner Service; C:\Program Files (x86)\Razer\Razer Services\GSS\GameScannerService.exe [190120 2016-01-29] ()
S4 RzKLService; C:\Program Files (x86)\Razer\Razer Cortex\RzKLService.exe [132864 2016-02-26] (Razer Inc.)
S3 WinDefend; C:\Program Files\Windows Defender\mpsvc.dll [1011712 2013-05-27] (Microsoft Corporation)
S4 WSWNA3100; C:\Program Files (x86)\NETGEAR\WNA3100\WifiSvc.exe [316120 2014-08-18] ()
S4 SpyHunter 4 Service; "C:\Program Files\Enigma Software Group\SpyHunter\Sh4Service.exe" [X]
S2 Update service; C:\Program Files (x86)\Popcorn Time\Updater.exe [X]

===================== Drivers (Whitelisted) ======================

(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)

R1 AsIO; C:\Windows\SysWow64\drivers\AsIO.sys [15232 2014-09-08] ()
R0 asstor64; C:\Windows\System32\DRIVERS\asstor64.sys [81208 2014-10-23] (Asmedia Technology)
S3 CCVI; C:\Windows\System32\drivers\CCVI.sys [16384 2012-06-25] (Silicon Laboratories)
R3 e1dexpress; C:\Windows\System32\DRIVERS\e1d62x64.sys [501216 2015-06-17] (Intel Corporation)
R1 epp; C:\EEK\bin64\epp.sys [124552 2016-11-23] (Emsisoft Ltd)
S3 EsgScanner; C:\Windows\System32\DRIVERS\EsgScanner.sys [22704 2017-05-03] ()
S3 GVTDrv64; C:\Windows\GVTDrv64.sys [30528 2016-07-28] ()
S3 hitmanpro37; C:\Windows\system32\drivers\hitmanpro37.sys [54736 2017-05-04] ()
S3 hmatap; C:\Windows\System32\DRIVERS\hmatap.sys [27136 2016-09-01] (The OpenVPN Project)
R0 iaStorF; C:\Windows\System32\DRIVERS\iaStorF.sys [31144 2015-06-21] (Intel Corporation)
S4 IObitUnlocker; C:\Program Files (x86)\IObit\IObit Unlocker\IObitUnlocker.sys [36568 2013-09-30] (IObit)
R3 ladfGSS; C:\Windows\System32\drivers\ladfGSS.sys [45200 2016-02-15] (Logitech Inc.)
R2 LGCoreTemp; C:\Program Files\Logitech Gaming Software\Drivers\LgCoreTemp\lgcoretemp.sys [14184 2015-06-21] (Logitech)
R3 LGJoyXlCore; C:\Windows\System32\drivers\LGJoyXlCore.sys [68384 2015-06-10] (Logitech Inc.)
S3 LGSHidFilt; C:\Windows\System32\DRIVERS\LGSHidFilt.Sys [64280 2013-05-30] (Logitech Inc.)
S3 ManyCam; C:\Windows\System32\DRIVERS\mcvidrv.sys [49304 2014-12-29] (Visicom Media Inc.)
R3 MBAMSwissArmy; C:\Windows\system32\drivers\MBAMSwissArmy.sys [192216 2017-06-05] (Malwarebytes)
S3 mcaudrv_simple; C:\Windows\System32\drivers\mcaudrv_x64.sys [35992 2014-12-28] (Visicom Media Inc.)
R3 MEIx64; C:\Windows\System32\DRIVERS\TeeDriverx64.sys [172832 2015-05-09] (Intel Corporation)
R0 MpFilter; C:\Windows\System32\DRIVERS\MpFilter.sys [295000 2016-08-25] (Microsoft Corporation)
R1 MpKsl5cfd6ea7; c:\ProgramData\Microsoft\Microsoft Antimalware\Definition Updates\{E43EF248-5099-44DB-99C0-1F24D50D3B95}\MpKsl5cfd6ea7.sys [44928 2017-06-05] (Microsoft Corporation)
S3 netr28x; C:\Windows\System32\DRIVERS\netr28x.sys [2473616 2014-12-10] (MediaTek Inc.)
R3 NisDrv; C:\Windows\System32\DRIVERS\NisDrvWFP.sys [135928 2016-08-25] (Microsoft Corporation)
S3 NPF; C:\Windows\System32\DRIVERS\npf.sys [47632 2010-02-03] (CACE Technologies, Inc.)
S3 NvStreamKms; C:\Program Files\NVIDIA Corporation\NvStreamSrv\NvStreamKms.sys [30328 2017-05-03] (NVIDIA Corporation)
R3 nvvad_WaveExtensible; C:\Windows\System32\drivers\nvvad64v.sys [48248 2017-05-03] (NVIDIA Corporation)
R3 nvvhci; C:\Windows\System32\DRIVERS\nvvhci.sys [76840 2017-03-31] (NVIDIA Corporation)
R2 rzpmgrk; C:\Windows\system32\drivers\rzpmgrk.sys [37184 2015-09-22] (Razer, Inc.)
R2 rzpnk; C:\Windows\system32\drivers\rzpnk.sys [130880 2016-02-23] (Razer, Inc.)
S3 tapSF0901; C:\Windows\System32\DRIVERS\tapSF0901.sys [39104 2015-07-31] (Spotflux, Inc.)
S3 USBPcap; C:\Windows\System32\DRIVERS\USBPcap.sys [48344 2016-04-05] (USBPcap)
S3 USBPNPA; C:\Windows\System32\drivers\CM10864.sys [1308160 2010-02-02] (C-Media Electronics Inc) [File not signed]
S3 VBAudioVMVAIOMME; C:\Windows\System32\DRIVERS\vbaudio_vmvaio64_win7.sys [41192 2016-03-23] (Windows (R) Win 7 DDK provider)
R1 VBoxUSBMon; C:\Windows\System32\DRIVERS\VBoxUSBMon.sys [127432 2015-09-16] (BigNox Corporation)
U5 xhcdrv; C:\Windows\System32\Drivers\xhcdrv.sys [305664 2014-10-31] (VIA Technologies, Inc.)
R1 XQHDrv; C:\Windows\System32\DRIVERS\XQHDrv.sys [253384 2015-09-15] (BigNox Corporation)
R1 XQHDrv; C:\Windows\SysWOW64\DRIVERS\XQHDrv.sys [253384 2015-09-15] (BigNox Corporation)
R5 drmkpro64;  <===== ATTENTION: Locked Service
S3 esgiguard; \??\C:\Program Files\Enigma Software Group\SpyHunter\esgiguard.sys [X]
S3 mbamchameleon; \??\C:\Windows\system32\drivers\mbamchameleon.sys [X]
S3 MSICDSetup; \??\D:\CDriver64.sys [X]
S3 NTIOLib_1_0_C; \??\D:\NTIOLib_X64.sys [X]
S1 SvThLSNS; \??\C:\Program Files (x86)\SAVITECH\SVLoadSense\SvThLSNS.sys [X]

==================== NetSvcs (Whitelisted) ===================

(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)


==================== One Month Created files and folders ========

(If an entry is included in the fixlist, the file/folder will be moved.)

2017-06-05 23:28 - 2017-06-05 23:29 - 00021990 _____ C:\Users\Macaiyla\Downloads\FRST.txt
2017-06-05 23:28 - 2017-06-05 23:28 - 00000000 ____D C:\FRST
2017-06-05 23:27 - 2017-06-05 23:27 - 02433536 _____ (Farbar) C:\Users\Macaiyla\Downloads\FRST64.exe
2017-06-05 23:27 - 2017-06-05 23:27 - 01774080 _____ (Farbar) C:\Users\Macaiyla\Downloads\FRST.exe
2017-06-05 09:20 - 2017-06-05 09:20 - 00184136 _____ (Emsisoft Ltd) C:\Windows\system32\eamclean.exe
2017-06-05 09:20 - 2017-06-05 09:20 - 00000210 _____ C:\Windows\system32\eamclean.dat
2017-06-05 07:21 - 2017-06-05 07:21 - 00000000 ____D C:\ProgramData\Emsisoft
2017-06-05 07:20 - 2017-06-05 09:19 - 00000000 ____D C:\EEK
2017-06-05 07:19 - 2017-06-05 07:19 - 00448512 _____ (OldTimer Tools) C:\Users\Macaiyla\Downloads\TFC.exe
2017-06-05 07:18 - 2017-06-05 07:18 - 09551280 _____ (Piriform Ltd) C:\Users\Macaiyla\Downloads\ccsetup530.exe
2017-06-05 07:17 - 2017-06-05 07:18 - 46525608 _____ (Safer-Networking Ltd. ) C:\Users\Macaiyla\Downloads\spybot-2.4.exe
2017-06-05 07:16 - 2017-06-05 07:19 - 305415160 _____ C:\Users\Macaiyla\Downloads\EmsisoftEmergencyKit.exe
2017-06-05 07:16 - 2017-06-05 07:16 - 08465984 _____ C:\Users\Macaiyla\Downloads\bitdefender_online (1).exe
2017-06-05 07:13 - 2017-06-05 07:13 - 02527376 _____ (Trend Micro Inc.) C:\Users\Macaiyla\Downloads\HousecallLauncher64.exe
2017-06-05 07:13 - 2017-06-05 07:13 - 00388608 _____ (Trend Micro Inc.) C:\Users\Macaiyla\Downloads\HijackThis.exe
2017-06-05 07:13 - 2017-06-05 07:13 - 00000000 ____D C:\Users\Macaiyla\Downloads\AU
2017-06-05 07:13 - 2016-01-18 03:01 - 00001497 _____ C:\Users\Macaiyla\Downloads\DLConfig.xml
2017-06-05 07:13 - 2012-10-22 04:26 - 00256554 _____ C:\Users\Macaiyla\Downloads\HouseCall_downloader.bmp
2017-06-05 07:13 - 2009-11-17 04:04 - 00001664 _____ C:\Users\Macaiyla\Downloads\dlstr.xml
2017-06-05 07:12 - 2017-06-05 07:13 - 10095064 _____ (Trend Micro Inc.) C:\Users\Macaiyla\Downloads\RootkitBusterV5.0-1203.exe
2017-06-05 03:48 - 2017-06-05 03:48 - 00000000 ____D C:\Users\Macaiyla\Desktop\New folder (2)
2017-06-05 03:46 - 2017-06-05 03:46 - 00000000 ____D C:\Users\Macaiyla\Desktop\New folder
2017-06-04 22:59 - 2017-06-05 09:25 - 00192216 _____ (Malwarebytes) C:\Windows\system32\Drivers\MBAMSwissArmy.sys
2017-06-04 22:34 - 2017-06-04 22:34 - 00000000 ____D C:\Users\Macaiyla\Downloads\mbar
2017-06-04 01:12 - 2017-06-04 01:12 - 04110280 _____ C:\Users\Macaiyla\Downloads\AdwCleaner.exe
2017-06-04 01:11 - 2017-06-04 01:11 - 02030536 _____ (Bleeping Computer, LLC) C:\Users\Macaiyla\Downloads\rkill (1).com
2017-06-04 01:09 - 2017-06-04 01:10 - 64025992 _____ (Malwarebytes ) C:\Users\Macaiyla\Downloads\mb3-setup-SEMFD.100SEM-3.1.2.1733-1.0.139-1.0.2060.exe
2017-06-04 01:09 - 2017-06-04 01:10 - 11007936 _____ (SurfRight B.V.) C:\Users\Macaiyla\Downloads\HitmanPro.exe
2017-06-04 01:04 - 2017-06-04 01:04 - 64025992 _____ (Malwarebytes ) C:\Users\Macaiyla\Downloads\mb3-setup-consumer-3.1.2.1733-1.0.139-1.0.2060.exe
2017-06-02 18:17 - 2017-06-02 18:17 - 00000000 ____D C:\Users\Macaiyla\AppData\Roaming\PDAppFlex
2017-06-02 18:17 - 2017-06-02 18:17 - 00000000 ____D C:\Users\Macaiyla\AppData\Local\Tempzxpsignd67d7ee6ff17c203
2017-06-02 18:17 - 2017-06-02 18:17 - 00000000 ____D C:\Users\Macaiyla\AppData\Local\Tempzxpsigna3b308864fe82eaa
2017-06-02 18:17 - 2017-06-02 18:17 - 00000000 ____D C:\ProgramData\regid.1986-12.com.adobe
2017-05-30 23:04 - 2017-06-05 12:59 - 00000000 ____D C:\Users\Macaiyla\AppData\Local\CrashDumps
2017-05-30 22:50 - 2017-04-27 21:14 - 05547240 _____ (Microsoft Corporation) C:\Windows\system32\ntoskrnl.exe
2017-05-30 22:50 - 2017-04-27 21:09 - 00880640 _____ (Microsoft Corporation) C:\Windows\system32\advapi32.dll
2017-05-30 22:50 - 2017-04-27 20:36 - 04000488 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ntkrnlpa.exe
2017-05-30 22:50 - 2017-04-27 20:36 - 03945192 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ntoskrnl.exe
2017-05-30 22:50 - 2017-04-27 20:32 - 00644096 _____ (Microsoft Corporation) C:\Windows\SysWOW64\advapi32.dll
2017-05-30 22:50 - 2017-04-26 10:59 - 03220992 _____ (Microsoft Corporation) C:\Windows\system32\win32k.sys
2017-05-30 22:50 - 2017-04-19 19:16 - 00346320 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iedkcs32.dll
2017-05-30 22:50 - 2017-04-17 11:37 - 02065408 _____ (Microsoft Corporation) C:\Windows\system32\ole32.dll
2017-05-30 22:50 - 2017-04-17 11:37 - 00876544 _____ (Microsoft Corporation) C:\Windows\system32\oleaut32.dll
2017-05-30 22:50 - 2017-04-17 11:37 - 00512000 _____ (Microsoft Corporation) C:\Windows\system32\rpcss.dll
2017-05-30 22:50 - 2017-04-17 11:12 - 01417728 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ole32.dll
2017-05-30 22:50 - 2017-04-17 11:12 - 00581632 _____ (Microsoft Corporation) C:\Windows\SysWOW64\oleaut32.dll
2017-05-30 22:50 - 2017-04-16 04:54 - 00576512 _____ (Microsoft Corporation) C:\Windows\system32\vbscript.dll
2017-05-30 22:50 - 2017-04-16 04:51 - 02899456 _____ (Microsoft Corporation) C:\Windows\system32\iertutil.dll
2017-05-30 22:50 - 2017-04-16 04:37 - 00116224 _____ (Microsoft Corporation) C:\Windows\system32\ieetwcollector.exe
2017-05-30 22:50 - 2017-04-16 04:35 - 25741312 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.dll
2017-05-30 22:50 - 2017-04-16 04:25 - 00968704 _____ (Microsoft Corporation) C:\Windows\system32\MsSpellCheckingFacility.exe
2017-05-30 22:50 - 2017-04-16 04:18 - 05977600 _____ (Microsoft Corporation) C:\Windows\system32\jscript9.dll
2017-05-30 22:50 - 2017-04-16 04:10 - 00087552 _____ (Microsoft Corporation) C:\Windows\system32\tdc.ocx
2017-05-30 22:50 - 2017-04-16 04:01 - 00499200 _____ (Microsoft Corporation) C:\Windows\SysWOW64\vbscript.dll
2017-05-30 22:50 - 2017-04-16 03:53 - 02290176 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iertutil.dll
2017-05-30 22:50 - 2017-04-16 03:49 - 20278272 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.dll
2017-05-30 22:50 - 2017-04-16 03:40 - 00806912 _____ (Microsoft Corporation) C:\Windows\system32\msfeeds.dll
2017-05-30 22:50 - 2017-04-16 03:37 - 02132992 _____ (Microsoft Corporation) C:\Windows\system32\inetcpl.cpl
2017-05-30 22:50 - 2017-04-16 03:29 - 00073216 _____ (Microsoft Corporation) C:\Windows\SysWOW64\tdc.ocx
2017-05-30 22:50 - 2017-04-16 03:10 - 15250944 _____ (Microsoft Corporation) C:\Windows\system32\ieframe.dll
2017-05-30 22:50 - 2017-04-16 03:08 - 04548608 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript9.dll
2017-05-30 22:50 - 2017-04-16 03:08 - 02057216 _____ (Microsoft Corporation) C:\Windows\SysWOW64\inetcpl.cpl
2017-05-30 22:50 - 2017-04-16 03:04 - 03241472 _____ (Microsoft Corporation) C:\Windows\system32\wininet.dll
2017-05-30 22:50 - 2017-04-16 02:53 - 13661184 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieframe.dll
2017-05-30 22:50 - 2017-04-16 02:50 - 01544704 _____ (Microsoft Corporation) C:\Windows\system32\urlmon.dll
2017-05-30 22:50 - 2017-04-16 02:37 - 02767872 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wininet.dll
2017-05-30 22:50 - 2017-04-16 02:34 - 01314816 _____ (Microsoft Corporation) C:\Windows\SysWOW64\urlmon.dll
2017-05-30 22:50 - 2017-04-12 11:32 - 01483776 _____ (Microsoft Corporation) C:\Windows\system32\crypt32.dll
2017-05-30 22:50 - 2017-04-12 11:25 - 01176064 _____ (Microsoft Corporation) C:\Windows\SysWOW64\crypt32.dll
2017-05-30 22:50 - 2017-04-07 11:34 - 00986856 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\dxgkrnl.sys
2017-05-30 22:50 - 2017-04-07 11:22 - 00312832 _____ (Microsoft Corporation) C:\Windows\SysWOW64\gdi32.dll
2017-05-30 22:50 - 2017-04-05 10:55 - 00460800 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\srv.sys
2017-05-30 22:50 - 2017-04-05 10:55 - 00405504 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\srv2.sys
2017-05-30 22:50 - 2017-04-04 11:34 - 01895656 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\tcpip.sys
2017-05-30 22:50 - 2017-04-04 10:53 - 00496128 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\afd.sys
2017-05-30 22:50 - 2017-04-04 10:53 - 00117760 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\tdx.sys
2017-05-30 22:50 - 2017-03-10 12:32 - 01389056 _____ (Microsoft Corporation) C:\Windows\system32\pla.dll
2017-05-30 22:50 - 2017-03-10 12:32 - 00300544 _____ (Microsoft Corporation) C:\Windows\system32\pdh.dll
2017-05-30 22:50 - 2017-03-10 12:20 - 01508352 _____ (Microsoft Corporation) C:\Windows\SysWOW64\pla.dll
2017-05-30 22:50 - 2017-03-10 12:20 - 00237056 _____ (Microsoft Corporation) C:\Windows\SysWOW64\pdh.dll
2017-05-30 22:50 - 2017-03-10 11:55 - 00205312 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\fastfat.sys
2017-05-30 22:50 - 2017-03-10 11:55 - 00195584 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\exfat.sys
2017-05-30 22:49 - 2017-04-27 21:14 - 00706792 _____ (Microsoft Corporation) C:\Windows\system32\winload.efi
2017-05-30 22:49 - 2017-04-27 21:14 - 00631176 _____ (Microsoft Corporation) C:\Windows\system32\winresume.efi
2017-05-30 22:49 - 2017-04-27 21:14 - 00154856 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\ksecpkg.sys
2017-05-30 22:49 - 2017-04-27 21:14 - 00095464 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\ksecdd.sys
2017-05-30 22:49 - 2017-04-27 21:11 - 01732864 _____ (Microsoft Corporation) C:\Windows\system32\ntdll.dll
2017-05-30 22:49 - 2017-04-27 21:10 - 01460736 _____ (Microsoft Corporation) C:\Windows\system32\lsasrv.dll
2017-05-30 22:49 - 2017-04-27 21:10 - 01212928 _____ (Microsoft Corporation) C:\Windows\system32\rpcrt4.dll
2017-05-30 22:49 - 2017-04-27 21:10 - 01163264 _____ (Microsoft Corporation) C:\Windows\system32\kernel32.dll
2017-05-30 22:49 - 2017-04-27 21:10 - 00730624 _____ (Microsoft Corporation) C:\Windows\system32\kerberos.dll
2017-05-30 22:49 - 2017-04-27 21:10 - 00503808 _____ (Microsoft Corporation) C:\Windows\system32\srcore.dll
2017-05-30 22:49 - 2017-04-27 21:10 - 00419840 _____ (Microsoft Corporation) C:\Windows\system32\KernelBase.dll
2017-05-30 22:49 - 2017-04-27 21:10 - 00362496 _____ (Microsoft Corporation) C:\Windows\system32\wow64win.dll
2017-05-30 22:49 - 2017-04-27 21:10 - 00345600 _____ (Microsoft Corporation) C:\Windows\system32\schannel.dll
2017-05-30 22:49 - 2017-04-27 21:10 - 00316928 _____ (Microsoft Corporation) C:\Windows\system32\msv1_0.dll
2017-05-30 22:49 - 2017-04-27 21:10 - 00312320 _____ (Microsoft Corporation) C:\Windows\system32\ncrypt.dll
2017-05-30 22:49 - 2017-04-27 21:10 - 00243712 _____ (Microsoft Corporation) C:\Windows\system32\wow64.dll
2017-05-30 22:49 - 2017-04-27 21:10 - 00215552 _____ (Microsoft Corporation) C:\Windows\system32\winsrv.dll
2017-05-30 22:49 - 2017-04-27 21:10 - 00210432 _____ (Microsoft Corporation) C:\Windows\system32\wdigest.dll
2017-05-30 22:49 - 2017-04-27 21:10 - 00190464 _____ (Microsoft Corporation) C:\Windows\system32\rpchttp.dll
2017-05-30 22:49 - 2017-04-27 21:10 - 00146432 _____ (Microsoft Corporation) C:\Windows\system32\msaudite.dll
2017-05-30 22:49 - 2017-04-27 21:10 - 00135680 _____ (Microsoft Corporation) C:\Windows\system32\sspicli.dll
2017-05-30 22:49 - 2017-04-27 21:10 - 00086528 _____ (Microsoft Corporation) C:\Windows\system32\TSpkg.dll
2017-05-30 22:49 - 2017-04-27 21:10 - 00063488 _____ (Microsoft Corporation) C:\Windows\system32\setbcdlocale.dll
2017-05-30 22:49 - 2017-04-27 21:10 - 00060416 _____ (Microsoft Corporation) C:\Windows\system32\msobjs.dll
2017-05-30 22:49 - 2017-04-27 21:10 - 00050176 _____ (Microsoft Corporation) C:\Windows\system32\srclient.dll
2017-05-30 22:49 - 2017-04-27 21:10 - 00028672 _____ (Microsoft Corporation) C:\Windows\system32\sspisrv.dll
2017-05-30 22:49 - 2017-04-27 21:10 - 00028160 _____ (Microsoft Corporation) C:\Windows\system32\secur32.dll
2017-05-30 22:49 - 2017-04-27 21:10 - 00016384 _____ (Microsoft Corporation) C:\Windows\system32\ntvdm64.dll
2017-05-30 22:49 - 2017-04-27 21:10 - 00013312 _____ (Microsoft Corporation) C:\Windows\system32\wow64cpu.dll
2017-05-30 22:49 - 2017-04-27 21:09 - 00690688 _____ (Microsoft Corporation) C:\Windows\system32\adtschema.dll
2017-05-30 22:49 - 2017-04-27 21:09 - 00463872 _____ (Microsoft Corporation) C:\Windows\system32\certcli.dll
2017-05-30 22:49 - 2017-04-27 21:09 - 00123904 _____ (Microsoft Corporation) C:\Windows\system32\bcrypt.dll
2017-05-30 22:49 - 2017-04-27 21:09 - 00059904 _____ (Microsoft Corporation) C:\Windows\system32\appidapi.dll
2017-05-30 22:49 - 2017-04-27 21:09 - 00044032 _____ (Microsoft Corporation) C:\Windows\system32\csrsrv.dll
2017-05-30 22:49 - 2017-04-27 21:09 - 00043520 _____ (Microsoft Corporation) C:\Windows\system32\cryptbase.dll
2017-05-30 22:49 - 2017-04-27 21:09 - 00034816 _____ (Microsoft Corporation) C:\Windows\system32\appidsvc.dll
2017-05-30 22:49 - 2017-04-27 21:09 - 00022016 _____ (Microsoft Corporation) C:\Windows\system32\credssp.dll
2017-05-30 22:49 - 2017-04-27 21:09 - 00006656 _____ (Microsoft Corporation) C:\Windows\system32\apisetschema.dll
2017-05-30 22:49 - 2017-04-27 21:09 - 00006144 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-security-base-l1-1-0.dll
2017-05-30 22:49 - 2017-04-27 21:09 - 00005120 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-file-l1-1-0.dll
2017-05-30 22:49 - 2017-04-27 21:09 - 00004608 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-threadpool-l1-1-0.dll
2017-05-30 22:49 - 2017-04-27 21:09 - 00004608 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-processthreads-l1-1-0.dll
2017-05-30 22:49 - 2017-04-27 21:09 - 00004096 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-sysinfo-l1-1-0.dll
2017-05-30 22:49 - 2017-04-27 21:09 - 00004096 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-synch-l1-1-0.dll
2017-05-30 22:49 - 2017-04-27 21:09 - 00004096 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-localregistry-l1-1-0.dll
2017-05-30 22:49 - 2017-04-27 21:09 - 00004096 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-localization-l1-1-0.dll
2017-05-30 22:49 - 2017-04-27 21:09 - 00003584 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-rtlsupport-l1-1-0.dll
2017-05-30 22:49 - 2017-04-27 21:09 - 00003584 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-processenvironment-l1-1-0.dll
2017-05-30 22:49 - 2017-04-27 21:09 - 00003584 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-namedpipe-l1-1-0.dll
2017-05-30 22:49 - 2017-04-27 21:09 - 00003584 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-misc-l1-1-0.dll
2017-05-30 22:49 - 2017-04-27 21:09 - 00003584 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-memory-l1-1-0.dll
2017-05-30 22:49 - 2017-04-27 21:09 - 00003584 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-libraryloader-l1-1-0.dll
2017-05-30 22:49 - 2017-04-27 21:09 - 00003584 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-heap-l1-1-0.dll
2017-05-30 22:49 - 2017-04-27 21:09 - 00003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-xstate-l1-1-0.dll
2017-05-30 22:49 - 2017-04-27 21:09 - 00003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-util-l1-1-0.dll
2017-05-30 22:49 - 2017-04-27 21:09 - 00003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-string-l1-1-0.dll
2017-05-30 22:49 - 2017-04-27 21:09 - 00003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-profile-l1-1-0.dll
2017-05-30 22:49 - 2017-04-27 21:09 - 00003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-io-l1-1-0.dll
2017-05-30 22:49 - 2017-04-27 21:09 - 00003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-interlocked-l1-1-0.dll
2017-05-30 22:49 - 2017-04-27 21:09 - 00003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-handle-l1-1-0.dll
2017-05-30 22:49 - 2017-04-27 21:09 - 00003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-fibers-l1-1-0.dll
2017-05-30 22:49 - 2017-04-27 21:09 - 00003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-errorhandling-l1-1-0.dll
2017-05-30 22:49 - 2017-04-27 21:09 - 00003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-delayload-l1-1-0.dll
2017-05-30 22:49 - 2017-04-27 21:09 - 00003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-debug-l1-1-0.dll
2017-05-30 22:49 - 2017-04-27 21:09 - 00003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-datetime-l1-1-0.dll
2017-05-30 22:49 - 2017-04-27 21:09 - 00003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-console-l1-1-0.dll
2017-05-30 22:49 - 2017-04-27 20:34 - 01314112 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ntdll.dll
2017-05-30 22:49 - 2017-04-27 20:32 - 01114112 _____ (Microsoft Corporation) C:\Windows\SysWOW64\kernel32.dll
2017-05-30 22:49 - 2017-04-27 20:32 - 00690688 _____ (Microsoft Corporation) C:\Windows\SysWOW64\adtschema.dll
2017-05-30 22:49 - 2017-04-27 20:32 - 00666112 _____ (Microsoft Corporation) C:\Windows\SysWOW64\rpcrt4.dll
2017-05-30 22:49 - 2017-04-27 20:32 - 00553472 _____ (Microsoft Corporation) C:\Windows\SysWOW64\kerberos.dll
2017-05-30 22:49 - 2017-04-27 20:32 - 00342528 _____ (Microsoft Corporation) C:\Windows\SysWOW64\certcli.dll
2017-05-30 22:49 - 2017-04-27 20:32 - 00275456 _____ (Microsoft Corporation) C:\Windows\SysWOW64\KernelBase.dll
2017-05-30 22:49 - 2017-04-27 20:32 - 00261120 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msv1_0.dll
2017-05-30 22:49 - 2017-04-27 20:32 - 00254464 _____ (Microsoft Corporation) C:\Windows\SysWOW64\schannel.dll
2017-05-30 22:49 - 2017-04-27 20:32 - 00223232 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ncrypt.dll
2017-05-30 22:49 - 2017-04-27 20:32 - 00172032 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wdigest.dll
2017-05-30 22:49 - 2017-04-27 20:32 - 00146432 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msaudite.dll
2017-05-30 22:49 - 2017-04-27 20:32 - 00141312 _____ (Microsoft Corporation) C:\Windows\SysWOW64\rpchttp.dll
2017-05-30 22:49 - 2017-04-27 20:32 - 00096768 _____ (Microsoft Corporation) C:\Windows\SysWOW64\sspicli.dll
2017-05-30 22:49 - 2017-04-27 20:32 - 00082944 _____ (Microsoft Corporation) C:\Windows\SysWOW64\bcrypt.dll
2017-05-30 22:49 - 2017-04-27 20:32 - 00065536 _____ (Microsoft Corporation) C:\Windows\SysWOW64\TSpkg.dll
2017-05-30 22:49 - 2017-04-27 20:32 - 00060416 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msobjs.dll
2017-05-30 22:49 - 2017-04-27 20:32 - 00050688 _____ (Microsoft Corporation) C:\Windows\SysWOW64\appidapi.dll
2017-05-30 22:49 - 2017-04-27 20:32 - 00043008 _____ (Microsoft Corporation) C:\Windows\SysWOW64\srclient.dll
2017-05-30 22:49 - 2017-04-27 20:32 - 00022016 _____ (Microsoft Corporation) C:\Windows\SysWOW64\secur32.dll
2017-05-30 22:49 - 2017-04-27 20:32 - 00017408 _____ (Microsoft Corporation) C:\Windows\SysWOW64\credssp.dll
2017-05-30 22:49 - 2017-04-27 20:32 - 00006656 _____ (Microsoft Corporation) C:\Windows\SysWOW64\apisetschema.dll
2017-05-30 22:49 - 2017-04-27 20:32 - 00005120 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-file-l1-1-0.dll
2017-05-30 22:49 - 2017-04-27 20:32 - 00005120 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wow32.dll
2017-05-30 22:49 - 2017-04-27 20:32 - 00004608 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-processthreads-l1-1-0.dll
2017-05-30 22:49 - 2017-04-27 20:32 - 00004096 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-sysinfo-l1-1-0.dll
2017-05-30 22:49 - 2017-04-27 20:32 - 00004096 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-synch-l1-1-0.dll
2017-05-30 22:49 - 2017-04-27 20:32 - 00004096 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-misc-l1-1-0.dll
2017-05-30 22:49 - 2017-04-27 20:32 - 00004096 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-localregistry-l1-1-0.dll
2017-05-30 22:49 - 2017-04-27 20:32 - 00004096 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-localization-l1-1-0.dll
2017-05-30 22:49 - 2017-04-27 20:32 - 00003584 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-processenvironment-l1-1-0.dll
2017-05-30 22:49 - 2017-04-27 20:32 - 00003584 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-namedpipe-l1-1-0.dll
2017-05-30 22:49 - 2017-04-27 20:32 - 00003584 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-memory-l1-1-0.dll
2017-05-30 22:49 - 2017-04-27 20:32 - 00003584 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-libraryloader-l1-1-0.dll
2017-05-30 22:49 - 2017-04-27 20:32 - 00003584 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-interlocked-l1-1-0.dll
2017-05-30 22:49 - 2017-04-27 20:32 - 00003584 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-heap-l1-1-0.dll
2017-05-30 22:49 - 2017-04-27 20:32 - 00003072 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-string-l1-1-0.dll
2017-05-30 22:49 - 2017-04-27 20:32 - 00003072 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-rtlsupport-l1-1-0.dll
2017-05-30 22:49 - 2017-04-27 20:32 - 00003072 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-profile-l1-1-0.dll
2017-05-30 22:49 - 2017-04-27 20:32 - 00003072 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-io-l1-1-0.dll
2017-05-30 22:49 - 2017-04-27 20:32 - 00003072 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-handle-l1-1-0.dll
2017-05-30 22:49 - 2017-04-27 20:32 - 00003072 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-fibers-l1-1-0.dll
2017-05-30 22:49 - 2017-04-27 20:32 - 00003072 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-errorhandling-l1-1-0.dll
2017-05-30 22:49 - 2017-04-27 20:32 - 00003072 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-delayload-l1-1-0.dll
2017-05-30 22:49 - 2017-04-27 20:32 - 00003072 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-debug-l1-1-0.dll
2017-05-30 22:49 - 2017-04-27 20:32 - 00003072 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-datetime-l1-1-0.dll
2017-05-30 22:49 - 2017-04-27 20:32 - 00003072 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-console-l1-1-0.dll
2017-05-30 22:49 - 2017-04-27 20:19 - 00148480 _____ (Microsoft Corporation) C:\Windows\system32\appidpolicyconverter.exe
2017-05-30 22:49 - 2017-04-27 20:19 - 00062464 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\appid.sys
2017-05-30 22:49 - 2017-04-27 20:19 - 00017920 _____ (Microsoft Corporation) C:\Windows\system32\appidcertstorecheck.exe
2017-05-30 22:49 - 2017-04-27 20:18 - 00064000 _____ (Microsoft Corporation) C:\Windows\system32\auditpol.exe
2017-05-30 22:49 - 2017-04-27 20:15 - 00338432 _____ (Microsoft Corporation) C:\Windows\system32\conhost.exe
2017-05-30 22:49 - 2017-04-27 20:14 - 00296960 _____ (Microsoft Corporation) C:\Windows\system32\rstrui.exe
2017-05-30 22:49 - 2017-04-27 20:12 - 00159744 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\mrxsmb.sys
2017-05-30 22:49 - 2017-04-27 20:11 - 00291328 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\mrxsmb10.sys
2017-05-30 22:49 - 2017-04-27 20:11 - 00129536 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\mrxsmb20.sys
2017-05-30 22:49 - 2017-04-27 20:11 - 00050176 _____ (Microsoft Corporation) C:\Windows\SysWOW64\auditpol.exe
2017-05-30 22:49 - 2017-04-27 20:10 - 00112640 _____ (Microsoft Corporation) C:\Windows\system32\smss.exe
2017-05-30 22:49 - 2017-04-27 20:10 - 00030720 _____ (Microsoft Corporation) C:\Windows\system32\lsass.exe
2017-05-30 22:49 - 2017-04-27 20:08 - 00025600 _____ (Microsoft Corporation) C:\Windows\SysWOW64\setup16.exe
2017-05-30 22:49 - 2017-04-27 20:08 - 00014336 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ntvdm64.dll
2017-05-30 22:49 - 2017-04-27 20:08 - 00007680 _____ (Microsoft Corporation) C:\Windows\SysWOW64\instnm.exe
2017-05-30 22:49 - 2017-04-27 20:08 - 00002048 _____ (Microsoft Corporation) C:\Windows\SysWOW64\user.exe
2017-05-30 22:49 - 2017-04-27 20:07 - 00036352 _____ (Microsoft Corporation) C:\Windows\SysWOW64\cryptbase.dll
2017-05-30 22:49 - 2017-04-27 20:07 - 00006144 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-security-base-l1-1-0.dll
2017-05-30 22:49 - 2017-04-27 20:07 - 00004608 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-threadpool-l1-1-0.dll
2017-05-30 22:49 - 2017-04-27 20:07 - 00003584 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-xstate-l1-1-0.dll
2017-05-30 22:49 - 2017-04-27 20:07 - 00003072 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-util-l1-1-0.dll
2017-05-30 22:49 - 2017-04-21 11:34 - 01133568 _____ (Microsoft Corporation) C:\Windows\system32\cdosys.dll
2017-05-30 22:49 - 2017-04-21 11:15 - 00805376 _____ (Microsoft Corporation) C:\Windows\SysWOW64\cdosys.dll
2017-05-30 22:49 - 2017-04-19 20:00 - 00394448 _____ (Microsoft Corporation) C:\Windows\system32\iedkcs32.dll
2017-05-30 22:49 - 2017-04-17 11:37 - 00026112 _____ (Microsoft Corporation) C:\Windows\system32\oleres.dll
2017-05-30 22:49 - 2017-04-17 11:37 - 00008704 _____ (Microsoft Corporation) C:\Windows\system32\comcat.dll
2017-05-30 22:49 - 2017-04-17 11:12 - 00026112 _____ (Microsoft Corporation) C:\Windows\SysWOW64\oleres.dll
2017-05-30 22:49 - 2017-04-17 10:54 - 00007168 _____ (Microsoft Corporation) C:\Windows\SysWOW64\comcat.dll
2017-05-30 22:49 - 2017-04-16 05:17 - 02724864 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.tlb
2017-05-30 22:49 - 2017-04-16 05:16 - 00004096 _____ (Microsoft Corporation) C:\Windows\system32\ieetwcollectorres.dll
2017-05-30 22:49 - 2017-04-16 04:57 - 00066560 _____ (Microsoft Corporation) C:\Windows\system32\iesetup.dll
2017-05-30 22:49 - 2017-04-16 04:55 - 00417792 _____ (Microsoft Corporation) C:\Windows\system32\html.iec
2017-05-30 22:49 - 2017-04-16 04:55 - 00048640 _____ (Microsoft Corporation) C:\Windows\system32\ieetwproxystub.dll
2017-05-30 22:49 - 2017-04-16 04:54 - 00088064 _____ (Microsoft Corporation) C:\Windows\system32\MshtmlDac.dll
2017-05-30 22:49 - 2017-04-16 04:44 - 00054784 _____ (Microsoft Corporation) C:\Windows\system32\jsproxy.dll
2017-05-30 22:49 - 2017-04-16 04:43 - 00034304 _____ (Microsoft Corporation) C:\Windows\system32\iernonce.dll
2017-05-30 22:49 - 2017-04-16 04:38 - 00615936 _____ (Microsoft Corporation) C:\Windows\system32\ieui.dll
2017-05-30 22:49 - 2017-04-16 04:37 - 00144384 _____ (Microsoft Corporation) C:\Windows\system32\ieUnatt.exe
2017-05-30 22:49 - 2017-04-16 04:36 - 00817664 _____ (Microsoft Corporation) C:\Windows\system32\jscript.dll
2017-05-30 22:49 - 2017-04-16 04:36 - 00814080 _____ (Microsoft Corporation) C:\Windows\system32\jscript9diag.dll
2017-05-30 22:49 - 2017-04-16 04:21 - 00489984 _____ (Microsoft Corporation) C:\Windows\system32\dxtmsft.dll
2017-05-30 22:49 - 2017-04-16 04:19 - 02724864 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.tlb
2017-05-30 22:49 - 2017-04-16 04:11 - 00077824 _____ (Microsoft Corporation) C:\Windows\system32\JavaScriptCollectionAgent.dll
2017-05-30 22:49 - 2017-04-16 04:09 - 00107520 _____ (Microsoft Corporation) C:\Windows\system32\inseng.dll
2017-05-30 22:49 - 2017-04-16 04:04 - 00199680 _____ (Microsoft Corporation) C:\Windows\system32\msrating.dll
2017-05-30 22:49 - 2017-04-16 04:03 - 00092160 _____ (Microsoft Corporation) C:\Windows\system32\mshtmled.dll
2017-05-30 22:49 - 2017-04-16 04:02 - 00062464 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iesetup.dll
2017-05-30 22:49 - 2017-04-16 04:01 - 00341504 _____ (Microsoft Corporation) C:\Windows\SysWOW64\html.iec
2017-05-30 22:49 - 2017-04-16 04:01 - 00047616 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieetwproxystub.dll
2017-05-30 22:49 - 2017-04-16 04:00 - 00315392 _____ (Microsoft Corporation) C:\Windows\system32\dxtrans.dll
2017-05-30 22:49 - 2017-04-16 04:00 - 00064000 _____ (Microsoft Corporation) C:\Windows\SysWOW64\MshtmlDac.dll
2017-05-30 22:49 - 2017-04-16 03:57 - 00152064 _____ (Microsoft Corporation) C:\Windows\system32\occache.dll
2017-05-30 22:49 - 2017-04-16 03:52 - 00047104 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jsproxy.dll
2017-05-30 22:49 - 2017-04-16 03:52 - 00030720 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iernonce.dll
2017-05-30 22:49 - 2017-04-16 03:48 - 00476160 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieui.dll
2017-05-30 22:49 - 2017-04-16 03:47 - 00663552 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript.dll
2017-05-30 22:49 - 2017-04-16 03:47 - 00115712 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieUnatt.exe
2017-05-30 22:49 - 2017-04-16 03:46 - 00620032 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript9diag.dll
2017-05-30 22:49 - 2017-04-16 03:43 - 00262144 _____ (Microsoft Corporation) C:\Windows\system32\webcheck.dll
2017-05-30 22:49 - 2017-04-16 03:40 - 00725504 _____ (Microsoft Corporation) C:\Windows\system32\ie4uinit.exe
2017-05-30 22:49 - 2017-04-16 03:37 - 01359360 _____ (Microsoft Corporation) C:\Windows\system32\mshtmlmedia.dll
2017-05-30 22:49 - 2017-04-16 03:35 - 00416256 _____ (Microsoft Corporation) C:\Windows\SysWOW64\dxtmsft.dll
2017-05-30 22:49 - 2017-04-16 03:30 - 00060416 _____ (Microsoft Corporation) C:\Windows\SysWOW64\JavaScriptCollectionAgent.dll
2017-05-30 22:49 - 2017-04-16 03:28 - 00091136 _____ (Microsoft Corporation) C:\Windows\SysWOW64\inseng.dll
2017-05-30 22:49 - 2017-04-16 03:25 - 00168960 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msrating.dll
2017-05-30 22:49 - 2017-04-16 03:24 - 00076288 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtmled.dll
2017-05-30 22:49 - 2017-04-16 03:22 - 00279040 _____ (Microsoft Corporation) C:\Windows\SysWOW64\dxtrans.dll
2017-05-30 22:49 - 2017-04-16 03:20 - 00130048 _____ (Microsoft Corporation) C:\Windows\SysWOW64\occache.dll
2017-05-30 22:49 - 2017-04-16 03:12 - 00230400 _____ (Microsoft Corporation) C:\Windows\SysWOW64\webcheck.dll
2017-05-30 22:49 - 2017-04-16 03:10 - 00693248 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msfeeds.dll
2017-05-30 22:49 - 2017-04-16 03:08 - 01155072 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtmlmedia.dll
2017-05-30 22:49 - 2017-04-16 02:40 - 00800768 _____ (Microsoft Corporation) C:\Windows\system32\ieapfltr.dll
2017-05-30 22:49 - 2017-04-16 02:34 - 00710144 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieapfltr.dll
2017-05-30 22:49 - 2017-04-12 11:32 - 00229376 _____ (Microsoft Corporation) C:\Windows\system32\wintrust.dll
2017-05-30 22:49 - 2017-04-12 11:32 - 00190976 _____ (Microsoft Corporation) C:\Windows\system32\cryptsvc.dll
2017-05-30 22:49 - 2017-04-12 11:32 - 00141824 _____ (Microsoft Corporation) C:\Windows\system32\cryptnet.dll
2017-05-30 22:49 - 2017-04-12 11:26 - 00179200 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wintrust.dll
2017-05-30 22:49 - 2017-04-12 11:25 - 00145920 _____ (Microsoft Corporation) C:\Windows\SysWOW64\cryptsvc.dll
2017-05-30 22:49 - 2017-04-12 11:25 - 00106496 _____ (Microsoft Corporation) C:\Windows\SysWOW64\cryptnet.dll
2017-05-30 22:49 - 2017-04-07 11:34 - 00265448 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\dxgmms1.sys
2017-05-30 22:49 - 2017-04-07 11:30 - 00405504 _____ (Microsoft Corporation) C:\Windows\system32\gdi32.dll
2017-05-30 22:49 - 2017-04-07 11:30 - 00144384 _____ (Microsoft Corporation) C:\Windows\system32\cdd.dll
2017-05-30 22:49 - 2017-04-05 10:55 - 00168960 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\srvnet.sys
2017-05-30 22:49 - 2017-04-04 11:34 - 00377576 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\netio.sys
2017-05-30 22:49 - 2017-04-04 11:34 - 00287976 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\FWPKCLNT.SYS
2017-05-30 22:49 - 2017-03-10 11:57 - 00009216 _____ (Microsoft Corporation) C:\Windows\system32\plasrv.exe
2017-05-30 22:49 - 2017-03-09 12:34 - 00002048 _____ (Microsoft Corporation) C:\Windows\system32\tzres.dll
2017-05-30 22:49 - 2017-03-09 12:19 - 00002048 _____ (Microsoft Corporation) C:\Windows\SysWOW64\tzres.dll
2017-05-30 22:30 - 2017-05-30 22:30 - 00072688 _____ C:\Users\Macaiyla\AppData\Local\GDIPFONTCACHEV1.DAT
2017-05-30 22:23 - 2017-05-30 22:23 - 00000000 ____D C:\Users\Macaiyla\AppData\Local\NPE
2017-05-30 22:13 - 2017-05-30 22:13 - 00000000 ____D C:\Users\Macaiyla\AppData\Local\CEF
2017-05-30 22:12 - 2017-06-05 00:46 - 00007607 _____ C:\Users\Macaiyla\AppData\Local\Resmon.ResmonCfg
2017-05-30 21:58 - 2017-05-30 21:58 - 00006125 _____ C:\Users\Macaiyla\Downloads\LOL_OPGG_Observer_2512755195_spectate (1).bat
2017-05-30 21:57 - 2017-05-30 21:57 - 00006125 _____ C:\Users\Macaiyla\Downloads\LOL_OPGG_Observer_2512755195_spectate.bat
2017-05-30 21:26 - 2017-05-30 21:26 - 00006125 _____ C:\Users\Macaiyla\Downloads\LOL_OPGG_Observer_2512750399_spectate.bat
2017-05-29 20:49 - 2017-05-29 20:49 - 00006125 _____ C:\Users\Macaiyla\Downloads\LOL_OPGG_Observer_2512096918_spectate (1).bat
2017-05-29 20:47 - 2017-05-29 20:47 - 00006125 _____ C:\Users\Macaiyla\Downloads\LOL_OPGG_Observer_2512096918_spectate.bat
2017-05-29 20:16 - 2017-05-29 20:16 - 00006125 _____ C:\Users\Macaiyla\Downloads\LOL_OPGG_Observer_2512092213_spectate.bat
2017-05-28 00:49 - 2017-05-28 00:51 - 111530782 _____ C:\Users\Macaiyla\Downloads\Xd (1).zip
2017-05-28 00:05 - 2017-05-28 00:06 - 55645441 _____ C:\Users\Macaiyla\Downloads\Video May 24, 12 35 05 PM.mov
2017-05-24 15:51 - 2017-05-27 19:37 - 00000000 __RHD C:\Users\Macaiyla\Creative Cloud Files
2017-05-24 15:47 - 2017-05-24 15:47 - 00001225 _____ C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Adobe Creative Cloud.lnk
2017-05-24 15:47 - 2017-05-24 15:47 - 00001213 _____ C:\Users\Public\Desktop\Adobe Creative Cloud.lnk
2017-05-24 15:43 - 2017-05-24 15:43 - 00814168 _____ (Adobe Systems Incorporated) C:\Users\Macaiyla\Downloads\CreativeCloudSet-Up.exe
2017-05-24 15:23 - 2017-06-02 18:16 - 00000000 ____D C:\Users\Macaiyla\AppData\Roaming\Adobe
2017-05-23 23:15 - 2017-05-23 23:15 - 00000112 ____H C:\D78FEFBC05D8
2017-05-23 13:51 - 2017-05-23 13:51 - 00000000 ____D C:\Users\Macaiyla\AppData\Roaming\Adobe-Backup
2017-05-23 13:51 - 2017-05-23 13:51 - 00000000 ____D C:\Program Files\Common Files\Adobe-Backup
2017-05-23 13:13 - 2017-05-23 13:13 - 00003814 _____ C:\Windows\System32\Tasks\NVIDIA GeForce Experience SelfUpdate_{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}
2017-05-23 13:11 - 2017-05-03 16:21 - 00175736 _____ (NVIDIA Corporation) C:\Windows\system32\nvaudcap64v.dll
2017-05-23 13:11 - 2017-05-03 16:21 - 00143480 _____ (NVIDIA Corporation) C:\Windows\SysWOW64\nvaudcap32v.dll
2017-05-23 13:11 - 2017-05-03 16:21 - 00048248 _____ (NVIDIA Corporation) C:\Windows\system32\Drivers\nvvad64v.sys
2017-05-22 19:42 - 2017-05-22 19:42 - 00008141 _____ C:\Users\Macaiyla\Downloads\download.htm
2017-05-22 00:34 - 2017-05-22 00:34 - 00003514 _____ C:\Windows\System32\Tasks\AdobeAAMUpdater-1.0-Macaiyla-PC-Macaiyla
2017-05-22 00:33 - 2017-05-24 16:02 - 00001106 _____ C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Adobe Premiere Pro CC 2017.lnk
2017-05-22 00:33 - 2017-05-22 00:33 - 00000000 ____D C:\Users\Public\Documents\Adobe
2017-05-22 00:12 - 2017-05-22 00:13 - 02113760 _____ (Adobe Systems Incorporated) C:\Users\Macaiyla\Downloads\Premiere_Pro_Set-Up (2).exe
2017-05-21 22:33 - 2017-05-27 19:36 - 00000000 ____D C:\ProgramData\boost_interprocess
2017-05-21 22:33 - 2017-05-22 00:22 - 00000000 ___RD C:\Users\Macaiyla\Creative Cloud Files (archived) (1)
2017-05-21 19:31 - 2017-05-21 19:31 - 00000000 ____D C:\Users\Public\Documents\AdobeInstalledCodecs
2017-05-21 19:25 - 2017-05-21 19:25 - 00000000 ____D C:\Program Files (x86)\Adobe
2017-05-21 19:11 - 2017-05-21 19:12 - 00442036 _____ C:\Users\Macaiyla\Downloads\Premiere_Pro_Set-Up (1).exe
2017-05-21 19:10 - 2017-05-21 19:12 - 02113760 _____ (Adobe Systems Incorporated) C:\Users\Macaiyla\Downloads\Premiere_Pro_Set-Up.exe
2017-05-21 15:34 - 2017-05-21 15:35 - 68582904 _____ (obsproject.com) C:\Users\Macaiyla\Downloads\OBS_0_659b_With_Browser_Installer.exe
2017-05-15 19:24 - 2017-05-15 19:24 - 00006125 _____ C:\Users\Macaiyla\Downloads\LOL_OPGG_Observer_2501117115_spectate.bat
2017-05-15 16:06 - 2017-05-15 16:06 - 00006125 _____ C:\Users\Macaiyla\Downloads\LOL_OPGG_Observer_2501001589_spectate.bat
2017-05-12 19:41 - 2017-05-12 19:41 - 00071281 _____ C:\Users\Macaiyla\Desktop\greekkk.jpg-large
2017-05-10 04:06 - 2017-05-10 04:06 - 00006129 _____ C:\Users\Macaiyla\Downloads\LOL_OPGG_Observer_2489712914_replay (2).bat
2017-05-08 23:05 - 2017-05-16 20:39 - 00001497 _____ C:\Users\Macaiyla\Desktop\iExplore - Shortcut.lnk
2017-05-08 23:05 - 2017-05-08 23:05 - 02030536 _____ (Bleeping Computer, LLC) C:\Users\Macaiyla\Downloads\iExplore.exe
2017-05-08 23:05 - 2017-05-08 23:05 - 01106888 _____ (Bleeping Computer, LLC) C:\Users\Macaiyla\Downloads\iExplore64.exe
2017-05-08 21:36 - 2017-05-08 21:36 - 00000040 ____H C:\B640ED1A73B1
2017-05-08 17:27 - 2017-05-08 17:28 - 16086472 _____ (CyberGhost S.R.L. ) C:\Users\Macaiyla\Downloads\CG_6.0.526951.exe
2017-05-08 04:05 - 2017-05-08 04:05 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\zztoy.exe
2017-05-08 04:05 - 2017-05-08 04:05 - 00000000 ____D C:\Program Files\Malwarebytes
2017-05-08 04:05 - 2017-03-22 11:02 - 00077440 _____ C:\Windows\system32\Drivers\mbae64.sys
2017-05-08 03:58 - 2017-05-08 03:58 - 00000000 ____D C:\.jagex_cache_32
2017-05-07 23:52 - 2017-05-07 23:52 - 00006125 _____ C:\Users\Macaiyla\Downloads\LOL_OPGG_Observer_2495150385_spectate.bat
2017-05-07 20:07 - 2017-05-07 20:07 - 00000000 ____D C:\Users\Macaiyla\AppData\Local\Red Giant
2017-05-07 20:07 - 2017-05-07 20:07 - 00000000 ____D C:\Users\Macaiyla\AppData\Local\LooksBuilder
2017-05-07 20:02 - 2017-05-07 20:02 - 00000000 ____D C:\ProgramData\goodasnew
2017-05-07 20:02 - 2017-05-07 20:02 - 00000000 _____ C:\Users\Macaiyla\updater_output.txt
2017-05-07 19:58 - 2017-05-07 20:02 - 00000000 ____D C:\Program Files (x86)\Red Giant Link
2017-05-07 19:58 - 2017-05-07 19:58 - 00003672 _____ C:\Windows\System32\Tasks\Red Giant Link
2017-05-07 19:58 - 2017-05-07 19:58 - 00000000 ____D C:\Users\Macaiyla\AppData\Roaming\Red Giant
2017-05-07 19:58 - 2017-05-07 19:58 - 00000000 ____D C:\ProgramData\Red Giant
2017-05-07 19:57 - 2017-05-07 19:58 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Red Giant
2017-05-07 19:56 - 2017-05-22 00:33 - 00000000 ____D C:\Program Files\Adobe
2017-05-07 19:56 - 2017-05-07 19:56 - 00000000 ____D C:\Program Files (x86)\Red Giant
2017-05-07 19:56 - 2017-05-07 19:56 - 00000000 ____D C:\Program Files (x86)\LooksBuilder
2017-05-07 19:56 - 2014-07-28 14:10 - 19939328 _____ (Red Giant LLC) C:\Windows\system32\MBLooksUI_x64.dll
2017-05-07 19:55 - 2017-05-07 19:55 - 00000000 ____D C:\ProgramData\RedGiant
2017-05-07 19:53 - 2017-05-07 19:54 - 87900255 _____ C:\Users\Macaiyla\Downloads\CSuite_Win_Full.rar
2017-05-06 16:52 - 2017-05-06 16:52 - 00029153 _____ C:\ProgramData\agent.1494103927.bdinstall.bin

==================== One Month Modified files and folders ========

(If an entry is included in the fixlist, the file/folder will be moved.)

2017-06-05 21:44 - 2016-01-23 01:17 - 00000394 _____ C:\Windows\Tasks\update-sys.job
2017-06-05 20:47 - 2016-01-23 01:17 - 00000394 _____ C:\Windows\Tasks\update-S-1-5-21-2444583048-3021673881-1256095731-1000.job
2017-06-05 12:25 - 2016-01-20 18:51 - 00000000 ____D C:\ProgramData\NVIDIA
2017-06-05 10:35 - 2017-05-04 00:27 - 00000000 ____D C:\ProgramData\Malwarebytes' Anti-Malware (portable)
2017-06-05 08:19 - 2009-07-14 00:45 - 00015344 ____H C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0
2017-06-05 08:19 - 2009-07-14 00:45 - 00015344 ____H C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0
2017-06-05 08:10 - 2009-07-14 01:08 - 00000006 ____H C:\Windows\Tasks\SA.DAT
2017-06-05 05:22 - 2016-08-12 22:14 - 00683930 _____ C:\Windows\ntbtlog.txt
2017-06-05 02:00 - 2017-02-17 19:41 - 00000000 ____D C:\Users\Macaiyla\AppData\Local\Adobe
2017-06-03 20:39 - 2017-05-03 16:49 - 00028272 _____ C:\Windows\system32\Drivers\TrueSight.sys
2017-05-31 16:29 - 2016-01-20 19:50 - 00000000 ____D C:\Program Files (x86)\Steam
2017-05-31 13:32 - 2009-07-14 01:13 - 00782470 _____ C:\Windows\system32\PerfStringBackup.INI
2017-05-31 13:32 - 2009-07-13 23:20 - 00000000 ____D C:\Windows\inf
2017-05-31 13:24 - 2009-07-14 00:45 - 00315904 _____ C:\Windows\system32\FNTCACHE.DAT
2017-05-31 03:24 - 2009-07-13 23:20 - 00000000 ____D C:\Windows\PolicyDefinitions
2017-05-31 03:07 - 2016-01-20 20:09 - 00774592 _____ C:\Windows\SysWOW64\PerfStringBackup.INI
2017-05-31 03:05 - 2016-01-20 18:49 - 00000000 ____D C:\Windows\system32\MRT
2017-05-31 03:02 - 2016-01-20 18:49 - 132223576 ____C (Microsoft Corporation) C:\Windows\system32\MRT.exe
2017-05-31 02:46 - 2017-02-17 19:40 - 00000000 ____D C:\ProgramData\Adobe
2017-05-30 22:22 - 2016-08-12 22:07 - 00000000 ____D C:\Program Files (x86)\dataup
2017-05-30 16:45 - 2016-01-20 18:29 - 00565416 ____N (Microsoft Corporation) C:\Windows\system32\MpSigStub.exe
2017-05-28 15:27 - 2016-02-02 23:40 - 00001456 _____ C:\Users\Macaiyla\AppData\Local\Adobe Save for Web 13.0 Prefs
2017-05-25 15:35 - 2016-01-25 22:20 - 00000000 ____D C:\Users\Macaiyla\AppData\Roaming\OBS
2017-05-24 16:40 - 2017-05-05 22:01 - 00000000 ____D C:\Users\Macaiyla\Desktop\yt
2017-05-24 16:12 - 2017-02-17 20:25 - 00000000 ____D C:\Users\Macaiyla\Desktop\newnew
2017-05-24 15:51 - 2016-01-20 00:56 - 00000000 ____D C:\Users\Macaiyla
2017-05-24 15:28 - 2017-02-27 23:40 - 00000000 ____D C:\Users\Macaiyla\Desktop\Data
2017-05-23 13:14 - 2016-12-05 17:19 - 00001416 _____ C:\Users\Public\Desktop\GeForce Experience.lnk
2017-05-23 13:14 - 2016-01-20 18:51 - 00000000 ____D C:\ProgramData\NVIDIA Corporation
2017-05-23 13:13 - 2017-05-05 02:10 - 00004146 _____ C:\Windows\System32\Tasks\NvDriverUpdateCheckDaily_{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}
2017-05-23 13:13 - 2017-05-05 02:10 - 00003852 _____ C:\Windows\System32\Tasks\NvNodeLauncher_{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}
2017-05-23 13:13 - 2016-01-20 18:51 - 00000000 ____D C:\Program Files\NVIDIA Corporation
2017-05-23 13:13 - 2016-01-20 18:51 - 00000000 ____D C:\Program Files (x86)\NVIDIA Corporation
2017-05-23 13:12 - 2017-05-05 02:09 - 00003738 _____ C:\Windows\System32\Tasks\NvTmRep_{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}
2017-05-23 13:12 - 2017-05-05 02:09 - 00003738 _____ C:\Windows\System32\Tasks\NvProfileUpdaterDaily_{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}
2017-05-23 13:12 - 2017-05-05 02:09 - 00003730 _____ C:\Windows\System32\Tasks\NvTmMon_{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}
2017-05-23 13:12 - 2017-05-05 02:09 - 00003554 _____ C:\Windows\System32\Tasks\NvTmRepOnLogon_{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}
2017-05-23 13:12 - 2017-05-05 02:09 - 00003494 _____ C:\Windows\System32\Tasks\NvProfileUpdaterOnLogon_{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}
2017-05-22 00:33 - 2016-09-24 21:53 - 00000000 ____D C:\Users\Macaiyla\Documents\Adobe
2017-05-21 15:34 - 2016-02-04 23:28 - 00000000 ____D C:\Users\Macaiyla\AppData\Roaming\obs-studio
2017-05-21 15:28 - 2017-02-27 21:02 - 00000000 ____D C:\Users\Macaiyla\Desktop\lol
2017-05-17 01:31 - 2016-01-20 18:48 - 00002195 _____ C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Google Chrome.lnk
2017-05-12 21:39 - 2017-05-04 18:33 - 00000000 ____D C:\Users\Macaiyla\Desktop\virus stuff
2017-05-08 23:37 - 2016-08-31 18:35 - 00000000 ____D C:\Program Files (x86)\Epic Games
2017-05-08 23:36 - 2016-11-25 15:00 - 00000000 ____D C:\Users\Macaiyla\Desktop\programs and games
2017-05-08 23:28 - 2016-08-12 22:08 - 00000000 ____D C:\Program Files (x86)\cpx
2017-05-08 23:15 - 2017-05-04 18:16 - 00002120 _____ C:\Users\Macaiyla\Desktop\Rkill.txt
2017-05-08 17:51 - 2017-01-08 04:27 - 00006610 _____ C:\Windows\TEMPcoral.vbs
2017-05-08 04:06 - 2017-05-03 16:46 - 00000000 ____D C:\ProgramData\RogueKiller
2017-05-08 04:05 - 2017-05-03 16:45 - 00000000 ____D C:\ProgramData\Malwarebytes
2017-05-08 03:59 - 2016-11-19 18:30 - 00000024 _____ C:\Users\Macaiyla\random.dat
2017-05-08 03:58 - 2016-11-19 18:30 - 00000047 _____ C:\Users\Macaiyla\jagex_cl_oldschool_LIVE.dat
2017-05-08 03:52 - 2016-03-06 17:01 - 00000000 ____D C:\Users\Macaiyla\AppData\Roaming\Spotify
2017-05-08 03:51 - 2016-03-06 17:01 - 00000000 ____D C:\Users\Macaiyla\AppData\Local\Spotify
2017-05-08 03:37 - 2017-05-03 17:06 - 00000000 ____D C:\Windows\pss
2017-05-08 00:18 - 2016-08-04 03:11 - 00000000 ____D C:\Users\Macaiyla\AppData\Roaming\PlaysTV
2017-05-07 19:48 - 2017-03-15 02:41 - 00000000 ____D C:\Users\Macaiyla\Desktop\intro stuff
2017-05-06 17:47 - 2016-03-15 09:52 - 00000000 ____D C:\Users\Macaiyla\AppData\Local\Ubisoft Game Launcher
2017-05-06 16:56 - 2016-01-20 22:33 - 00000000 ____D C:\ProgramData\Package Cache
2017-05-06 16:50 - 2016-01-20 19:45 - 00000000 ____D C:\Users\Macaiyla\AppData\Roaming\Skype

==================== Files in the root of some directories =======

2016-03-24 13:08 - 2016-03-24 13:08 - 0000132 _____ () C:\Users\Macaiyla\AppData\Roaming\Adobe IllExport Filter CS6 Prefs
2016-08-01 12:39 - 2016-08-01 12:39 - 0698862 _____ () C:\Users\Macaiyla\AppData\Roaming\Cookies[01 August (12;39)].txt
2016-08-01 12:39 - 2016-08-01 12:39 - 0020437 _____ () C:\Users\Macaiyla\AppData\Roaming\Data[01 August (12;39)].txt
2016-08-17 22:26 - 2016-08-17 22:26 - 0212452 _____ () C:\Users\Macaiyla\AppData\Roaming\deleter.exe
2016-08-01 13:39 - 2016-08-01 13:39 - 0000015 _____ () C:\Users\Macaiyla\AppData\Roaming\ds.txt
2015-04-24 19:16 - 2015-04-24 19:16 - 0212553 _____ () C:\Users\Macaiyla\AppData\Roaming\ip.exe
2016-07-07 18:50 - 2016-07-07 18:50 - 0021554 _____ () C:\Users\Macaiyla\AppData\Roaming\pass.txt
2016-04-08 00:40 - 2016-06-30 03:09 - 0003223 _____ () C:\Users\Macaiyla\AppData\Roaming\VoiceMeeterDefault.xml
2016-02-02 23:40 - 2017-05-28 15:27 - 0001456 _____ () C:\Users\Macaiyla\AppData\Local\Adobe Save for Web 13.0 Prefs
2017-05-30 22:12 - 2017-06-05 00:46 - 0007607 _____ () C:\Users\Macaiyla\AppData\Local\Resmon.ResmonCfg
2017-05-05 05:17 - 2017-05-05 05:17 - 0047012 _____ () C:\ProgramData\agent.1493975861.bdinstall.bin
2017-05-06 16:52 - 2017-05-06 16:52 - 0029153 _____ () C:\ProgramData\agent.1494103927.bdinstall.bin
2016-07-28 22:14 - 2016-07-28 22:14 - 0000016 _____ () C:\ProgramData\mntemp

Files to move or delete:
====================
C:\Users\Macaiyla\before.cmd
C:\Users\Macaiyla\fort.cmd
C:\Users\Macaiyla\fort2.cmd
C:\Users\Macaiyla\start2.js


==================== Bamital & volsnap ======================

(There is no automatic fix for files that do not pass verification.)

C:\Windows\system32\winlogon.exe => File is digitally signed
C:\Windows\system32\wininit.exe => File is digitally signed
C:\Windows\SysWOW64\wininit.exe => File is digitally signed
C:\Windows\explorer.exe => File is digitally signed
C:\Windows\SysWOW64\explorer.exe => File is digitally signed
C:\Windows\system32\svchost.exe => File is digitally signed
C:\Windows\SysWOW64\svchost.exe => File is digitally signed
C:\Windows\system32\services.exe => File is digitally signed
C:\Windows\system32\User32.dll => File is digitally signed
C:\Windows\SysWOW64\User32.dll => File is digitally signed
C:\Windows\system32\userinit.exe => File is digitally signed
C:\Windows\SysWOW64\userinit.exe => File is digitally signed
C:\Windows\system32\rpcss.dll => File is digitally signed
C:\Windows\system32\dnsapi.dll => File is digitally signed
C:\Windows\SysWOW64\dnsapi.dll => File is digitally signed
C:\Windows\system32\Drivers\volsnap.sys => File is digitally signed

LastRegBack: 2016-01-20 17:39

==================== End of FRST.txt ============================

Addition.txt

Link to post
Share on other sites
Aura

Aura

Posted
Posted

Hi Kayla :)

My name is Aura and I'll be assisting you with your malware issue. Since we'll be working together, you can call me Aura or Yoan, which is my real name, it's up to you! Now that we've broke the ice, I'll just ask you a few things during the time we'll be working together to clean your system and get it back to an operational state.

  • As you'll notice, the logs we are asking for here are quite lenghty, so it's normal for me to not reply exactly after you post them. This is because I need some time to analyse them and then act accordingly. However, I'll always reply within 24 hours, 48 hours at most if something unexpected happens;
  • As long as I'm assisting you on Malwarebytes Forums, in this thread, I'll ask you to not seek assistance anywhere else for any issue related to the system we are working on. If you have an issue, question, etc. about your computer, please ask it in this thread and I'll assist you;
  • The same principle applies to any modifications you make to your system, I would like you to ask me before you do any manipulations that aren't in the instructions I posted. This is to ensure that we are operating in sync and I know exactly what's happening on your system;
  • If you aren't sure about an instruction I'm giving you, ask me about it. This is to ensure that the clean-up process goes without any issue. I'll answer you and even give you more precise instructions/explanations if you need. There's no shame in asking questions here, better be safe than sorry!;
  • If you don't reply to your thread within 3 days, I'll bump this thread to let you know that I'm waiting for you. If you don't reply after 5 days, it'll be closed. If you return after that period, you can send me a PM to get it unlocked and we'll continue where we left off;
  • Since malware can work quickly, we want to get rid of them as fast as we can, before they make unknown changes to the system. This being said, I would appreciate if you could reply to this thread within 24 hours of me posting. This way, we'll have a good clean-up rhythm and the chances of complications will be reduced;
  • I'm against any form of pirated, illegal and counterfeit software and material. So if you have any installed on your system, I'll ask you to uninstall them right now. You don't have to tell me if you indeed had some or not, I'll give you the benefit of the doubt. Plus, this would be against Malwarebytes Forums's rules;
  • In the end, you are the one asking for assistance here. So if you wish to go a different way during the clean-up, like format and reinstall Windows, you are free to do so. I would appreciate you to let me know about it first, and if you need, I can also assist you in the process;
  • I would appreciate if you were to stay with me until the end, which means, until I declare your system clean. Just because your system isn't behaving weirdly anymore, or is running better than before, it doesn't mean that the infection is completely gone;
    This being said, I have a full time job so sometimes it'll take longer for me to reply to you. Don't worry, you'll be my first priority as soon as I get home and have time to look at your thread;


This being said, it's time to clean-up some malware, so let's get started, shall we? :)

Go inside the following folders and deleting everything you can. 

C:\Users\Macaiyla\AppData\Local\ntuserlitelist
C:\Users\Macaiyla\AppData\Local\llssoft

Once done, do not reboot your computer and try to run MBAR again. This time, it should go through.

Link to post
Share on other sites
Kayla2233

Kayla2233

Posted
  • Author
Posted

@Aura I appreciate you looking into this for me! I got rid of the entire llssoft folder, but couldn't get rid of anything in the ntuserlitelist due to the error "You need permission to perform this action". Still, malwarebytes was finally able to do a full scan with no freezes. Thank you so much! I believe it is all gone now :)

Link to post
Share on other sites
Aura

Aura

Posted
Posted

Due to the lack of feedback this topic is closed to prevent others from posting here. If you need this topic reopened, please send a Private Message to any one of the moderating team members. Please include a link to this thread with your request. This applies only to the originator of this thread.Other members who need assistance please start your own topic in a new thread. Thanks!

Link to post
Share on other sites
Guest
This topic is now closed to further replies.
 Share
Go to topic listing

  • Recently Browsing   0 members

    • No registered users viewing this page.
Back to top
×
×
  • Create New...

Important Information

This site uses cookies - We have placed cookies on your device to help make this website better. You can adjust your cookie settings, otherwise we'll assume you're okay to continue.