Jump to content

Windows 7 x64 'Timed Restart'

peter_callback
 Share

Recommended Posts

peter_callback

peter_callback

Posted
Posted (edited)

Hello, I'm pulling my hair out here!

Each time the system is shut down (Start / Shut Down), there appears to be some sort of timer re-boot that automatically restarts Windows. It's takes this rogue timer approximately two~five minutes to activate.

I checked my settings:

System Properties / Advanced / Start Up and Recovery / Settings / Automatically Restart

This box was checked. I unchecked it a tested a re-boot. It didn't change the auto-restarting.

I thought it might have been a setting in the registry (Windows Forum).

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon

"PowerdownAfterShutdown"

Change it to "0" if it is "1" OR
Change it to "1" if it is "0".

I turned to more complex measures.

I downloaded malware bytes in the hope that a simple scan would be effective but it appears to have missed whatever is causing this frustrating behaviour. In an attempt to combat this, I have used tools that in the past have fixed any issues I came across; Hi-Jack this, Combo Fix and RogueKiller. Nothing seems to want to rid this system of this annoyance. I have the scan logs from all three software.

I'm looking for the right direction as to what I should do next, so if anyone would like to prevent my head going bold, please step forward.

This system is running Windows 7 x64 Professional (last Windows update ran on October 7th, 2017)

 

EDIT: I forgot to mention from reading posts, this issue could be caused by Windows Crashing on Shut Down. On checking the systems logs, I have an error which reads;

Log Name:      System
Source:        Service Control Manager
Date:          07/10/2017 09:43:04
Event ID:      7026
Task Category: None
Level:         Error
Keywords:      Classic
User:          N/A
Computer:      THIS PC
Description:
The following boot-start or system-start driver(s) failed to load:
MBAMSwissArmy
Event Xml:
<Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
  <System>
    <Provider Name="Service Control Manager" Guid="{555908d1-a6d7-4695-8e1e-26931d2012f4}" EventSourceName="Service Control Manager" />
    <EventID Qualifiers="49152">7026</EventID>
    <Version>0</Version>
    <Level>2</Level>
    <Task>0</Task>
    <Opcode>0</Opcode>
    <Keywords>0x8080000000000000</Keywords>
    <TimeCreated SystemTime="2017-10-07T00:43:04.087623900Z" />
    <EventRecordID>316685</EventRecordID>
    <Correlation />
    <Execution ProcessID="844" ThreadID="848" />
    <Channel>System</Channel>
    <Computer>mdgm-PC</Computer>
    <Security />
  </System>
  <EventData>
    <Data Name="param1">
MBAMSwissArmy</Data>
  </EventData>
</Event>

 

 

Edited by peter_callback
Link to post
Share on other sites
kevinf80

kevinf80

Posted
Posted
Hello peter_callback and welcome to Malwarebytes,

I assume you`ve posted to the Malware Removal forum so that infection can be discounted as a cause of the reboot issue.... Do the following:

Download Farbar Recovery Scan Tool and save it to your desktop.

Alternative download option: http://www.techspot.com/downloads/6731-farbar-recovery-scan-tool.html

Note: You need to run the version compatible with your system (32 bit or 64 bit). If you are not sure which version applies to your system download both of them and try to run them. Only one of them will run on your system, that will be the right version.

If your security alerts to FRST either, accept the alert or turn your security off to allow FRST to run. It is not malicious or infected in any way...

Be aware FRST must be run from an account with Administrator status...
 
  • Double-click to run it. When the tool opens click Yes to disclaimer.(Windows 8/10 users will be prompted about Windows SmartScreen protection - click More information and Run.)
  • Make sure Addition.txt is checkmarked under "Optional scans"
  • Press Scan button to run the tool....
  • It will make a log (FRST.txt) in the same directory the tool is run. Please copy and paste it to your reply.
  • The tool will also make a log named (Addition.txt) Please attach that log to your reply.


Thank you,

Kevin....
Link to post
Share on other sites
peter_callback

peter_callback

Posted
  • Author
Posted (edited)

Below is the FRST.txt (attached is the Addition.txt)

 

Scan result of Farbar Recovery Scan Tool (FRST) (x64) Version: 06-10-2017
Ran by mdgm (administrator) on  THIS PC (07-10-2017 19:29:13)
Running from C:\Users\THIS PC\Downloads
Loaded Profiles: mdgm (Available Profiles: THIS PC)
Platform: Windows 7 Professional Service Pack 1 (X64) Language: English (United States)
Internet Explorer Version 11 (Default browser: Opera)
Boot Mode: Normal
Tutorial for Farbar Recovery Scan Tool: http://www.geekstogo.com/forum/topic/335081-frst-tutorial-how-to-use-farbar-recovery-scan-tool/

==================== Processes (Whitelisted) =================

(If an entry is included in the fixlist, the process will be closed. The file will not be moved.)

(NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\Display.NvContainer\NVDisplay.Container.exe
(NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\Display\nvxdsync.exe
(Intel Corporation) C:\Windows\System32\igfxCUIService.exe
(Realtek Semiconductor) C:\Program Files\Realtek\Audio\HDA\RTKAUDIOSERVICE64.EXE
(Realtek Semiconductor) C:\Program Files\Realtek\Audio\HDA\RAVBg64.exe
(Check Point Software Technologies Ltd.) C:\Program Files (x86)\CheckPoint\ZoneAlarm\vsmon.exe
(cFos Software GmbH) C:\Program Files\ASRock\XFast LAN\spd.exe
(NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\GeForce Experience Service\GfExperienceService.exe
(Intel Corporation) C:\Windows\System32\IPROSetMonitor.exe
() C:\Program Files\Intel\Intel(R) Smart Connect Technology Agent\iSCTAgent.exe
(AO Kaspersky Lab) C:\Program Files (x86)\Kaspersky Lab\Kaspersky Security Scan\kss.exe
(NVIDIA Corporation) C:\Program Files (x86)\NVIDIA Corporation\NetService\NvNetworkService.exe
(Realtek Semiconductor) C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe
(NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\NvStreamSrv\NvStreamService.exe
(Qualcomm Atheros) C:\Program Files\Qualcomm Atheros\Network Manager\KillerService.exe
(Check Point Software Technologies Ltd.) C:\Program Files (x86)\CheckPoint\ZoneAlarm\ICM-Service.exe
(NVIDIA Corporation) C:\Program Files (x86)\NVIDIA Corporation\Update Core\NvBackend.exe
(Intel Corporation) C:\Program Files\Intel\Intel(R) Smart Connect Technology Agent\iSCTsysTray8.exe
(cFos Software GmbH) C:\Program Files\ASRock\XFast LAN\cfosspeed.exe
(Valve Corporation) C:\Program Files (x86)\Steam\Steam.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) USB 3.0 eXtensible Host Controller Driver\Application\iusb3mon.exe
() C:\Program Files\Qualcomm Atheros\Network Manager\NetworkManager.exe
(Check Point Software Technologies Ltd.) C:\Program Files (x86)\CheckPoint\ZoneAlarm\zatray.exe
(Microsoft Corporation) C:\Windows\Microsoft.NET\Framework64\v3.0\WPF\PresentationFontCache.exe
(NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\NvStreamSrv\NvStreamNetworkService.exe
(NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\Display\nvtray.exe
(Valve Corporation) C:\Program Files (x86)\Steam\bin\cef\cef.win7\steamwebhelper.exe
(Valve Corporation) C:\Program Files (x86)\Steam\bin\cef\cef.win7\steamwebhelper.exe
(NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\ShadowPlay\nvspcaps64.exe
(SoftPerfect) C:\Program Files\SoftPerfect Bandwidth Manager\BMCore.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\DAL\jhi_service.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\LMS\LMS.exe
(NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\NvStreamSrv\NvStreamUserAgent.exe
(Mozilla Corporation) C:\Program Files (x86)\Mozilla Firefox\firefox.exe

==================== Registry (Whitelisted) ===========================

(If an entry is included in the fixlist, the registry item will be restored to default or removed. The file will not be moved.)

HKLM\...\Run: [RTHDVCPL] => C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe [14040792 2015-07-15] (Realtek Semiconductor)
HKLM\...\Run: [NvBackend] => C:\Program Files (x86)\NVIDIA Corporation\Update Core\NvBackend.exe [2397120 2016-06-15] (NVIDIA Corporation)
HKLM\...\Run: [ShadowPlay] => "C:\Windows\system32\rundll32.exe" C:\Windows\system32\nvspcap64.dll,ShadowPlayOnSystemStart
HKLM\...\Run: [VIAxHCUtl] => C:\Program Files\VIA XHCI UASP Utility\usb3Monitor
HKLM\...\Run: [ISCT Tray] => C:\Program Files\Intel\Intel(R) Smart Connect Technology Agent\iSCTsysTray8.exe [5860656 2014-08-25] (Intel Corporation)
HKLM\...\Run: [XFast LAN] => C:\Program Files\ASRock\XFast LAN\cFosSpeed.exe [2009952 2013-05-31] (cFos Software GmbH)
HKLM-x32\...\Run: [USB3MON] => C:\Program Files (x86)\Intel\Intel(R) USB 3.0 eXtensible Host Controller Driver\Application\iusb3mon.exe [296216 2015-02-17] (Intel Corporation)
HKLM-x32\...\Run: [amd_dc_opt] => C:\Program Files (x86)\AMD\Dual-Core Optimizer\amd_dc_opt.exe [77824 2008-07-22] (AMD)
HKLM-x32\...\Run: [ZoneAlarm] => C:\Program Files (x86)\CheckPoint\ZoneAlarm\zatray.exe [144696 2017-02-14] (Check Point Software Technologies Ltd.)
HKU\S-1-5-21-2366040382-2050272407-207267677-1000\...\Run: [Steam] => C:\Program Files (x86)\Steam\steam.exe [3074336 2017-10-05] (Valve Corporation)
HKU\S-1-5-21-2366040382-2050272407-207267677-1000\Control Panel\Desktop\\SCRNSAVE.EXE -> C:\Windows\system32\PhotoScreensaver.scr [477696 2010-11-20] (Microsoft Corporation)
HKU\S-1-5-18\...\Run: [KSS] => C:\Program Files (x86)\Kaspersky Lab\Kaspersky Security Scan\kss.exe [1556448 2015-12-15] (AO Kaspersky Lab)
Startup: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\Adobe Acrobat Speed Launcher.lnk [2017-05-12]
ShortcutTarget: Adobe Acrobat Speed Launcher.lnk -> C:\Windows\Installer\{AC76BA86-1033-F400-7760-000000000003}\_SC_Acrobat.exe ()
Startup: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\Adobe Acrobat Synchronizer.lnk [2017-05-12]
ShortcutTarget: Adobe Acrobat Synchronizer.lnk -> C:\Program Files (x86)\Adobe\Acrobat 8.0\Acrobat\AdobeCollabSync.exe ()
Startup: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\Killer Network Manager.lnk [2014-08-09]
ShortcutTarget: Killer Network Manager.lnk -> C:\Windows\Installer\{401FADAA-1C16-4721-9F02-19067E1A1CA8}\NetworkManager.exe_130C27D738F34C89BDDF21BCFD74B56D.exe (Flexera Software LLC)
CHR HKLM\SOFTWARE\Policies\Google: Restriction <==== ATTENTION

==================== Internet (Whitelisted) ====================

(If an item is included in the fixlist, if it is a registry item it will be removed or restored to default.)

Tcpip\Parameters: [DhcpNameServer] 192.168.11.1
Tcpip\..\Interfaces\{8595F51F-B6D7-4460-A430-BD393D6D45CF}: [DhcpNameServer] 192.168.11.1
Tcpip\..\Interfaces\{BAEE240B-D78E-4AE0-993A-7889D183CE46}: [DhcpNameServer] 192.168.11.1
Tcpip\..\Interfaces\{D3ABE540-F1AA-40FB-96DB-D51DFA64D539}: [DhcpNameServer] 192.168.0.1
Tcpip\..\Interfaces\{DB675905-8EE8-4D2F-A2F6-6246EAF7B326}: [DhcpNameServer] 192.168.11.1

Internet Explorer:
==================
HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Start Page = www.google.com
HKU\.DEFAULT\Software\Microsoft\Internet Explorer\Main,Search Page = hxxp://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch
HKU\.DEFAULT\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://www.microsoft.com/isapi/redir.dll?prd=ie&ar=msnhome
HKU\S-1-5-21-2366040382-2050272407-207267677-1000\Software\Microsoft\Internet Explorer\Main,Search Page = hxxp://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch
SearchScopes: HKLM-x32 -> DefaultScope {BB82DE59-BC4C-4172-9AC4-73315F71CFFE} URL =
BHO: No Name -> {13D67BB7-DB5F-48AA-884D-7A5D94168509} -> No File
BHO-x32: Adobe PDF Reader Link Helper -> {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} -> C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll [2008-06-11] (Adobe Systems Incorporated)
BHO-x32: Adobe PDF Conversion Toolbar Helper -> {AE7CD045-E861-484f-8273-0445EE161910} -> C:\Program Files (x86)\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll [2006-10-22] (Adobe Systems Incorporated)
Toolbar: HKLM-x32 - Adobe PDF - {47833539-D0C5-4125-9FA8-0819E2EAAC93} - C:\Program Files (x86)\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll [2006-10-22] (Adobe Systems Incorporated)
Handler-x32: belarc - {6318E0AB-2E93-11D1-B8ED-00608CC9A71F} - C:\Program Files (x86)\Belarc\BelarcAdvisor\System\BAVoilaX.dll [2015-11-13] (Belarc, Inc.)
Handler-x32: cdo - {CD00020A-8B95-11D1-82DB-00C04FB1625D} - C:\Program Files (x86)\Common Files\Microsoft Shared\Web Folders\PKMCDO.DLL [2001-01-22] (Microsoft Corporation)
Handler: WSIEChrome - No CLSID Value

FireFox:
========
FF DefaultProfile: aclbyhhw.default
FF ProfilePath: C:\Users\THIS PC\AppData\Roaming\Mozilla\Firefox\Profiles\aclbyhhw.default [2017-10-07]
FF NewTab: Mozilla\Firefox\Profiles\aclbyhhw.default -> about:blank
FF Homepage: Mozilla\Firefox\Profiles\aclbyhhw.default -> www.google.com
FF Session Restore: Mozilla\Firefox\Profiles\aclbyhhw.default -> is enabled.
FF Extension: (Flash Video Downloader - YouTube HD Download [4K]) - C:\Users\THIS PC\AppData\Roaming\Mozilla\Firefox\Profiles\aclbyhhw.default\Extensions\artur.dubovoy@gmail.com [2017-08-16]
FF Extension: (British English Dictionary (Updated)) - C:\Users\THIS PC\AppData\Roaming\Mozilla\Firefox\Profiles\aclbyhhw.default\Extensions\en-gb@flyingtophat.co.uk [2015-06-12] [not signed]
FF Extension: (Spanish (Spain) Dictionary) - C:\Users\THIS PC\AppData\Roaming\Mozilla\Firefox\Profiles\aclbyhhw.default\Extensions\es-es@dictionaries.addons.mozilla.org [2017-01-29]
FF Extension: (Valence) - C:\Users\THIS PC\AppData\Roaming\Mozilla\Firefox\Profiles\aclbyhhw.default\Extensions\fxdevtools-adapters@mozilla.org [2017-08-04]
FF Extension: (Tabs On Bottom) - C:\Users\THIS PC\AppData\Roaming\Mozilla\Firefox\Profiles\aclbyhhw.default\Extensions\tabsonbottom@piro.sakura.ne.jp.xpi [2016-06-16]
FF Extension: (Lightshot (screenshot tool)) - C:\Users\THIS PC\AppData\Roaming\Mozilla\Firefox\Profiles\aclbyhhw.default\Extensions\{394DCBA4-1F92-4f8e-8EC9-8D2CB90CB69B} [2016-05-20]
FF Extension: (Cookie Monster) - C:\Users\THIS PC\AppData\Roaming\Mozilla\Firefox\Profiles\aclbyhhw.default\Extensions\{45d8ff86-d909-11db-9705-005056c00008} [2016-11-28]
FF Extension: (NoScript) - C:\Users\THIS PC\AppData\Roaming\Mozilla\Firefox\Profiles\aclbyhhw.default\Extensions\{73a6fe31-595d-460b-a920-fcc0f8843232}.xpi [2017-10-02]
FF Extension: (Adblock Plus) - C:\Users\THIS PC\AppData\Roaming\Mozilla\Firefox\Profiles\aclbyhhw.default\Extensions\{d10d0bf8-f5b5-c8b4-a8b2-2b9879e08c5d}.xpi [2017-06-09]
FF Extension: (FoxClocks) - C:\Users\THIS PC\AppData\Roaming\Mozilla\Firefox\Profiles\aclbyhhw.default\Extensions\{d37dc5d0-431d-44e5-8c91-49419370caa1}.xpi [2016-04-17]
FF Plugin: @adobe.com/FlashPlayer -> C:\Windows\system32\Macromed\Flash\NPSWF64_27_0_0_130.dll [2017-10-07] ()
FF Plugin: adobe.com/AdobeAAMDetect -> C:\Program Files (x86)\Common Files\Adobe\OOBE\PDApp\CCM\Utilities\npAdobeAAMDetect64.dll [2014-04-29] (Adobe Systems)
FF Plugin-x32: @adobe.com/FlashPlayer -> C:\Windows\SysWOW64\Macromed\Flash\NPSWF32_27_0_0_130.dll [2017-10-07] ()
FF Plugin-x32: @intel-webapi.intel.com/Intel WebAPI ipt;version=4.0.68 -> C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\IPT\npIntelWebAPIIPT.dll [2015-02-25] (Intel Corporation)
FF Plugin-x32: @intel-webapi.intel.com/Intel WebAPI updater -> C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\IPT\npIntelWebAPIUpdater.dll [2015-02-25] (Intel Corporation)
FF Plugin-x32: @nvidia.com/3DVision -> C:\Program Files (x86)\NVIDIA Corporation\3D Vision\npnv3dv.dll [2017-02-10] (NVIDIA Corporation)
FF Plugin-x32: @nvidia.com/3DVisionStreaming -> C:\Program Files (x86)\NVIDIA Corporation\3D Vision\npnv3dvstreaming.dll [2017-02-10] (NVIDIA Corporation)
FF Plugin-x32: @tools.google.com/Google Update;version=3 -> C:\Program Files (x86)\Google\Update\1.3.33.5\npGoogleUpdate3.dll [2017-04-29] (Google Inc.)
FF Plugin-x32: @tools.google.com/Google Update;version=9 -> C:\Program Files (x86)\Google\Update\1.3.33.5\npGoogleUpdate3.dll [2017-04-29] (Google Inc.)
FF Plugin-x32: @videolan.org/vlc,version=2.2.0 -> C:\Program Files (x86)\VideoLAN\VLC\npvlc.dll [2015-02-27] (VideoLAN)
FF Plugin-x32: adobe.com/AdobeAAMDetect -> C:\Program Files (x86)\Common Files\Adobe\OOBE\PDApp\CCM\Utilities\npAdobeAAMDetect32.dll [2014-04-29] (Adobe Systems)
FF Plugin HKU\S-1-5-21-2366040382-2050272407-207267677-1000: wacom.com/WacomTabletPlugin -> C:\Program Files\TabletPlugins\npWacomTabletPlugin.dll [No File]

Chrome:
=======
CHR DefaultProfile: Default
CHR Session Restore: Default -> is enabled.
CHR Profile: C:\Users\THIS PC\AppData\Local\Google\Chrome\User Data\Default [2017-10-07]
CHR Extension: (Adblock Plus) - C:\Users\THIS PC\AppData\Local\Google\Chrome\User Data\Default\Extensions\cfhdojbkjhnklbpkdaibdccddilifddb [2017-09-27]
CHR Extension: (Video Downloader GetThemAll) - C:\Users\THIS PC\AppData\Local\Google\Chrome\User Data\Default\Extensions\nbkekaeindpfpcoldfckljplboolgkfm [2017-08-01]
CHR Extension: (Chrome Web Store Payments) - C:\Users\THIS PC\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda [2017-08-23]
CHR Extension: (Chrome Media Router) - C:\Users\THIS PC\AppData\Local\Google\Chrome\User Data\Default\Extensions\pkedcjkdefgpdelpbcmbmeomcjbeemfm [2017-09-27]

Opera:
=======
OPR Extension: (Adblock Plus) - C:\Users\THIS PC\AppData\Roaming\Opera Software\Opera Stable\Extensions\oidhhegpmlfpoeialbgcdocjalghfpkp [2017-10-05]
StartMenuInternet: (HKLM) OperaStable - C:\Program Files\Opera\Launcher.exe

==================== Services (Whitelisted) ====================

(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)

R2 BMService; C:\Program Files\SoftPerfect Bandwidth Manager\BMCore.exe [10125128 2016-02-22] (SoftPerfect)
R2 cFosSpeedS; C:\Program Files\ASRock\XFast LAN\spd.exe [652640 2013-05-31] (cFos Software GmbH)
S3 FLEXnet Licensing Service; C:\Program Files (x86)\Common Files\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exe [654848 2015-08-25] (Macrovision Europe Ltd.) [File not signed]
R2 GfExperienceService; C:\Program Files\NVIDIA Corporation\GeForce Experience Service\GfExperienceService.exe [1163712 2016-06-15] (NVIDIA Corporation)
R2 igfxCUIService1.0.0.0; C:\Windows\system32\igfxCUIService.exe [355232 2015-08-09] (Intel Corporation)
S3 Intel(R) Capability Licensing Service TCP IP Interface; C:\Program Files\Intel\iCLS Client\SocketHeciServer.exe [881152 2014-10-03] (Intel(R) Corporation)
S3 intelsba; C:\Program Files\Intel\Intel(R) Small Business Advantage\Service\Intel.SmallBusinessAdvantage.WindowsService.exe [54976 2014-01-06] (Intel Corporation)
R2 ISCTAgent; C:\Program Files\Intel\Intel(R) Smart Connect Technology Agent\iSCTAgent.exe [209712 2014-08-25] ()
R2 jhi_service; C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\DAL\jhi_service.exe [156960 2015-02-25] (Intel Corporation)
R2 kss; C:\Program Files (x86)\Kaspersky Lab\Kaspersky Security Scan\kss.exe [1556448 2015-12-15] (AO Kaspersky Lab)
R2 NVDisplay.ContainerLocalSystem; C:\Program Files\NVIDIA Corporation\Display.NvContainer\NVDisplay.Container.exe [462784 2017-02-10] (NVIDIA Corporation)
R2 NvNetworkService; C:\Program Files (x86)\NVIDIA Corporation\NetService\NvNetworkService.exe [1879488 2016-06-15] (NVIDIA Corporation)
R3 NvStreamNetworkSvc; C:\Program Files\NVIDIA Corporation\NvStreamSrv\NvStreamNetworkService.exe [3632576 2016-06-15] (NVIDIA Corporation)
R2 NvStreamSvc; C:\Program Files\NVIDIA Corporation\NvStreamSrv\NvStreamService.exe [2521024 2016-06-15] (NVIDIA Corporation)
S3 PAExec; C:\Windows\PAExec.exe [189112 2016-07-25] (Power Admin LLC)
R2 Qualcomm Atheros Killer Service V2; C:\Program Files\Qualcomm Atheros\Network Manager\KillerService.exe [343040 2013-08-08] (Qualcomm Atheros) [File not signed]
R2 RtkAudioService; C:\Program Files\Realtek\Audio\HDA\RtkAudioService64.exe [294616 2015-05-22] (Realtek Semiconductor)
S3 SystemExplorerHelpService; C:\Program Files (x86)\System Explorer\service\SystemExplorerService64.exe [820960 2014-12-20] (Mister Group)
R2 vsmon; C:\Program Files (x86)\CheckPoint\ZoneAlarm\vsmon.exe [4076744 2017-02-14] (Check Point Software Technologies Ltd.)
R2 WinDefend; C:\Program Files\Windows Defender\mpsvc.dll [1011712 2013-05-27] (Microsoft Corporation)
S3 ZAPrivacyService; C:\Program Files (x86)\CheckPoint\ZoneAlarm\ZaPrivacyService.exe [114936 2016-11-01] (Check Point Software Technologies, Ltd.)
R2 ZoneAlarm ICM Service; C:\Program Files (x86)\CheckPoint\ZoneAlarm\ICM-Service.exe [1037624 2017-02-14] (Check Point Software Technologies Ltd.)

===================== Drivers (Whitelisted) ======================

(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)

S3 athrusb; C:\Windows\System32\DRIVERS\athrxusb.sys [1075712 2009-11-17] (Atheros Communications, Inc.)
R1 BfLwf; C:\Windows\System32\DRIVERS\bflwfx64.sys [67888 2013-02-13] (Qualcomm Atheros, Inc.)
R3 e1dexpress; C:\Windows\System32\DRIVERS\e1d62x64.sys [488216 2014-02-04] (Intel Corporation)
R3 ikbevent; C:\Windows\System32\DRIVERS\ikbevent.sys [22216 2014-05-27] ()
S3 iLokDrvr; C:\Windows\System32\DRIVERS\iLokDrvr.sys [25808 2013-04-11] ()
R3 imsevent; C:\Windows\System32\DRIVERS\imsevent.sys [22728 2014-05-27] ()
R3 INETMON; C:\Windows\System32\Drivers\INETMON.sys [25800 2014-05-27] ()
R3 ISCT; C:\Windows\System32\DRIVERS\ISCTD.sys [44744 2014-05-27] ()
S3 Ke2200; C:\Windows\System32\DRIVERS\e22w7x64.sys [154320 2013-03-20] (Qualcomm Atheros, Inc.)
S3 KORGUMDS; C:\Windows\System32\Drivers\KORGUM64.SYS [34184 2016-03-11] (KORG INC.)
R3 MEIx64; C:\Windows\System32\DRIVERS\TeeDriverx64.sys [129312 2014-09-30] (Intel Corporation)
R3 NIWinCDEmu; C:\Windows\System32\DRIVERS\NIWinCDEmu.sys [112408 2015-08-24] ()
R3 NvStreamKms; C:\Program Files\NVIDIA Corporation\NvStreamSrv\NvStreamKms.sys [26560 2016-06-15] (NVIDIA Corporation)
R3 nvvad_WaveExtensible; C:\Windows\System32\drivers\nvvad64v.sys [56384 2016-06-03] (NVIDIA Corporation)
S4 secdrv; C:\Windows\SysWow64\Drivers\secdrv.sys [18768 2016-01-29] () [File not signed]
R1 spfdrv; C:\Windows\System32\DRIVERS\spfdrv.sys [53688 2016-02-12] (SoftPerfect)
S3 teVirtualMIDI64; C:\Windows\System32\DRIVERS\teVirtualMIDI64.sys [41016 2015-07-12] (Tobias Erichsen)
S3 VBAudioHFVAIOMME; C:\Windows\System32\DRIVERS\vbaudio_hfvaio64_win7.sys [33512 2016-04-16] (Windows (R) Win 7 DDK provider)
R1 Vsdatant; C:\Windows\System32\DRIVERS\vsdatant.sys [461240 2017-03-16] (Check Point Software Technologies Ltd.)
R3 VUSB3HUB; C:\Windows\System32\DRIVERS\ViaHub3.sys [223744 2013-03-19] (VIA Technologies, Inc.)
R3 xhcdrv; C:\Windows\System32\DRIVERS\xhcdrv.sys [295424 2013-03-19] (VIA Technologies, Inc.)
S3 ZOOM_R16MTR; C:\Windows\System32\Drivers\zmr16usbaudio.sys [97792 2016-11-21] (Zoom Corporation.) [File not signed]
S3 catchme; \??\C:\ComboFix\catchme.sys [X]
S3 gdrv; \??\C:\Windows\gdrv.sys [X]
U3 iswSvc; no ImagePath
S3 MSICDSetup; \??\E:\CDriver64.sys [X]
S3 TASCAM_US122144; System32\Drivers\tascusb2.sys [X]
S3 TASCAM_US144_MIDI; system32\drivers\tscusb2m.sys [X]
S3 TASCAM_US144_WDM; system32\drivers\tscusb2a.sys [X]

==================== NetSvcs (Whitelisted) ===================

(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)


==================== One Month Created files and folders ========

(If an entry is included in the fixlist, the file/folder will be moved.)

2017-10-07 19:29 - 2017-10-07 19:29 - 000019596 _____ C:\Users\THIS PC\Downloads\FRST.txt
2017-10-07 19:25 - 2017-10-07 19:25 - 002400768 _____ (Farbar) C:\Users\THIS PC\Downloads\FRST64.exe
2017-10-07 19:25 - 2017-10-07 19:25 - 000019157 _____ C:\ComboFix.txt
2017-10-07 10:32 - 2017-10-07 10:32 - 000028272 _____ C:\Windows\system32\Drivers\TrueSight.sys
2017-10-07 10:31 - 2017-10-07 14:40 - 000000000 ____D C:\ProgramData\RogueKiller
2017-10-07 10:31 - 2017-10-07 10:31 - 000000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\RogueKiller
2017-10-07 10:31 - 2017-10-07 10:31 - 000000000 ____D C:\Program Files\RogueKiller
2017-10-07 08:58 - 2017-10-07 19:28 - 000000000 ____D C:\Qoobox
2017-10-07 08:58 - 2011-06-26 15:45 - 000256000 _____ C:\Windows\PEV.exe
2017-10-07 08:58 - 2010-11-08 02:20 - 000208896 _____ C:\Windows\MBR.exe
2017-10-07 08:58 - 2009-04-20 13:56 - 000060416 _____ (NirSoft) C:\Windows\NIRCMD.exe
2017-10-07 08:58 - 2000-08-31 09:00 - 000518144 _____ (SteelWerX) C:\Windows\SWREG.exe
2017-10-07 08:58 - 2000-08-31 09:00 - 000406528 _____ (SteelWerX) C:\Windows\SWSC.exe
2017-10-07 08:58 - 2000-08-31 09:00 - 000098816 _____ C:\Windows\sed.exe
2017-10-07 08:58 - 2000-08-31 09:00 - 000080412 _____ C:\Windows\grep.exe
2017-10-07 08:58 - 2000-08-31 09:00 - 000068096 _____ C:\Windows\zip.exe
2017-09-30 00:24 - 2017-09-30 00:24 - 000000000 ____D C:\Users\THIS PC\.android
2017-09-13 04:28 - 2017-08-20 00:28 - 000197120 _____ (Microsoft Corporation) C:\Windows\system32\shdocvw.dll
2017-09-13 04:28 - 2017-08-20 00:10 - 000180224 _____ (Microsoft Corporation) C:\Windows\SysWOW64\shdocvw.dll
2017-09-13 04:28 - 2017-08-17 00:29 - 000806912 _____ (Microsoft Corporation) C:\Windows\system32\usp10.dll
2017-09-13 04:28 - 2017-08-17 00:10 - 000629760 _____ (Microsoft Corporation) C:\Windows\SysWOW64\usp10.dll
2017-09-13 04:28 - 2017-08-16 23:57 - 003224576 _____ (Microsoft Corporation) C:\Windows\system32\win32k.sys
2017-09-13 04:28 - 2017-08-16 10:10 - 000395976 _____ (Microsoft Corporation) C:\Windows\system32\iedkcs32.dll
2017-09-13 04:28 - 2017-08-16 09:25 - 000347336 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iedkcs32.dll
2017-09-13 04:28 - 2017-08-16 00:29 - 014182400 _____ (Microsoft Corporation) C:\Windows\system32\shell32.dll
2017-09-13 04:28 - 2017-08-16 00:29 - 001867264 _____ (Microsoft Corporation) C:\Windows\system32\ExplorerFrame.dll
2017-09-13 04:28 - 2017-08-16 00:10 - 012880896 _____ (Microsoft Corporation) C:\Windows\SysWOW64\shell32.dll
2017-09-13 04:28 - 2017-08-16 00:10 - 001499648 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ExplorerFrame.dll
2017-09-13 04:28 - 2017-08-15 23:06 - 015260160 _____ (Microsoft Corporation) C:\Windows\system32\ieframe.dll
2017-09-13 04:28 - 2017-08-15 23:01 - 000416256 _____ (Microsoft Corporation) C:\Windows\SysWOW64\dxtmsft.dll
2017-09-13 04:28 - 2017-08-15 23:01 - 000279040 _____ (Microsoft Corporation) C:\Windows\SysWOW64\dxtrans.dll
2017-09-13 04:28 - 2017-08-15 23:01 - 000076288 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtmled.dll
2017-09-13 04:28 - 2017-08-15 22:58 - 013673984 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieframe.dll
2017-09-13 04:28 - 2017-08-15 02:35 - 003203584 _____ (Microsoft Corporation) C:\Windows\system32\mmcndmgr.dll
2017-09-13 04:28 - 2017-08-15 02:35 - 002150912 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mmcndmgr.dll
2017-09-13 04:28 - 2017-08-15 02:35 - 000355328 _____ (Microsoft Corporation) C:\Windows\system32\mmcbase.dll
2017-09-13 04:28 - 2017-08-15 02:35 - 000303104 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mmcbase.dll
2017-09-13 04:28 - 2017-08-15 02:35 - 000172544 _____ (Microsoft Corporation) C:\Windows\SysWOW64\cic.dll
2017-09-13 04:28 - 2017-08-15 02:35 - 000131072 _____ (Microsoft Corporation) C:\Windows\system32\mmcshext.dll
2017-09-13 04:28 - 2017-08-15 02:35 - 000128512 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mmcshext.dll
2017-09-13 04:28 - 2017-08-15 02:34 - 000211968 _____ (Microsoft Corporation) C:\Windows\system32\cic.dll
2017-09-13 04:28 - 2017-08-14 06:37 - 002144256 _____ (Microsoft Corporation) C:\Windows\system32\mmc.exe
2017-09-13 04:28 - 2017-08-14 06:30 - 001401344 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mmc.exe
2017-09-13 04:28 - 2017-08-14 03:58 - 025730560 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.dll
2017-09-13 04:28 - 2017-08-14 02:24 - 002724864 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.tlb
2017-09-13 04:28 - 2017-08-14 02:24 - 000004096 _____ (Microsoft Corporation) C:\Windows\system32\ieetwcollectorres.dll
2017-09-13 04:28 - 2017-08-14 02:06 - 000066560 _____ (Microsoft Corporation) C:\Windows\system32\iesetup.dll
2017-09-13 04:28 - 2017-08-14 02:05 - 000576512 _____ (Microsoft Corporation) C:\Windows\system32\vbscript.dll
2017-09-13 04:28 - 2017-08-14 02:05 - 000417792 _____ (Microsoft Corporation) C:\Windows\system32\html.iec
2017-09-13 04:28 - 2017-08-14 02:05 - 000088064 _____ (Microsoft Corporation) C:\Windows\system32\MshtmlDac.dll
2017-09-13 04:28 - 2017-08-14 02:05 - 000048640 _____ (Microsoft Corporation) C:\Windows\system32\ieetwproxystub.dll
2017-09-13 04:28 - 2017-08-14 02:04 - 002899968 _____ (Microsoft Corporation) C:\Windows\system32\iertutil.dll
2017-09-13 04:28 - 2017-08-14 01:56 - 000054784 _____ (Microsoft Corporation) C:\Windows\system32\jsproxy.dll
2017-09-13 04:28 - 2017-08-14 01:55 - 000034304 _____ (Microsoft Corporation) C:\Windows\system32\iernonce.dll
2017-09-13 04:28 - 2017-08-14 01:54 - 020269056 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.dll
2017-09-13 04:28 - 2017-08-14 01:52 - 000615936 _____ (Microsoft Corporation) C:\Windows\system32\ieui.dll
2017-09-13 04:28 - 2017-08-14 01:51 - 005981696 _____ (Microsoft Corporation) C:\Windows\system32\jscript9.dll
2017-09-13 04:28 - 2017-08-14 01:51 - 000144384 _____ (Microsoft Corporation) C:\Windows\system32\ieUnatt.exe
2017-09-13 04:28 - 2017-08-14 01:51 - 000116224 _____ (Microsoft Corporation) C:\Windows\system32\ieetwcollector.exe
2017-09-13 04:28 - 2017-08-14 01:50 - 000817664 _____ (Microsoft Corporation) C:\Windows\system32\jscript.dll
2017-09-13 04:28 - 2017-08-14 01:50 - 000814080 _____ (Microsoft Corporation) C:\Windows\system32\jscript9diag.dll
2017-09-13 04:28 - 2017-08-14 01:46 - 002724864 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.tlb
2017-09-13 04:28 - 2017-08-14 01:41 - 000968704 _____ (Microsoft Corporation) C:\Windows\system32\MsSpellCheckingFacility.exe
2017-09-13 04:28 - 2017-08-14 01:38 - 000489984 _____ (Microsoft Corporation) C:\Windows\system32\dxtmsft.dll
2017-09-13 04:28 - 2017-08-14 01:30 - 000062464 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iesetup.dll
2017-09-13 04:28 - 2017-08-14 01:29 - 000499200 _____ (Microsoft Corporation) C:\Windows\SysWOW64\vbscript.dll
2017-09-13 04:28 - 2017-08-14 01:29 - 000341504 _____ (Microsoft Corporation) C:\Windows\SysWOW64\html.iec
2017-09-13 04:28 - 2017-08-14 01:29 - 000087552 _____ (Microsoft Corporation) C:\Windows\system32\tdc.ocx
2017-09-13 04:28 - 2017-08-14 01:29 - 000077824 _____ (Microsoft Corporation) C:\Windows\system32\JavaScriptCollectionAgent.dll
2017-09-13 04:28 - 2017-08-14 01:29 - 000047616 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieetwproxystub.dll
2017-09-13 04:28 - 2017-08-14 01:28 - 000064000 _____ (Microsoft Corporation) C:\Windows\SysWOW64\MshtmlDac.dll
2017-09-13 04:28 - 2017-08-14 01:27 - 000107520 _____ (Microsoft Corporation) C:\Windows\system32\inseng.dll
2017-09-13 04:28 - 2017-08-14 01:24 - 002291200 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iertutil.dll
2017-09-13 04:28 - 2017-08-14 01:24 - 000199680 _____ (Microsoft Corporation) C:\Windows\system32\msrating.dll
2017-09-13 04:28 - 2017-08-14 01:23 - 000092160 _____ (Microsoft Corporation) C:\Windows\system32\mshtmled.dll
2017-09-13 04:28 - 2017-08-14 01:22 - 000047104 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jsproxy.dll
2017-09-13 04:28 - 2017-08-14 01:21 - 000030720 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iernonce.dll
2017-09-13 04:28 - 2017-08-14 01:20 - 000315392 _____ (Microsoft Corporation) C:\Windows\system32\dxtrans.dll
2017-09-13 04:28 - 2017-08-14 01:19 - 000476160 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieui.dll
2017-09-13 04:28 - 2017-08-14 01:18 - 000152064 _____ (Microsoft Corporation) C:\Windows\system32\occache.dll
2017-09-13 04:28 - 2017-08-14 01:17 - 000663552 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript.dll
2017-09-13 04:28 - 2017-08-14 01:17 - 000620032 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript9diag.dll
2017-09-13 04:28 - 2017-08-14 01:17 - 000115712 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieUnatt.exe
2017-09-13 04:28 - 2017-08-14 01:07 - 000262144 _____ (Microsoft Corporation) C:\Windows\system32\webcheck.dll
2017-09-13 04:28 - 2017-08-14 01:04 - 000807936 _____ (Microsoft Corporation) C:\Windows\system32\msfeeds.dll
2017-09-13 04:28 - 2017-08-14 01:04 - 000726528 _____ (Microsoft Corporation) C:\Windows\system32\ie4uinit.exe
2017-09-13 04:28 - 2017-08-14 01:02 - 001359360 _____ (Microsoft Corporation) C:\Windows\system32\mshtmlmedia.dll
2017-09-13 04:28 - 2017-08-14 01:01 - 002134528 _____ (Microsoft Corporation) C:\Windows\system32\inetcpl.cpl
2017-09-13 04:28 - 2017-08-14 01:01 - 000073216 _____ (Microsoft Corporation) C:\Windows\SysWOW64\tdc.ocx
2017-09-13 04:28 - 2017-08-14 01:01 - 000060416 _____ (Microsoft Corporation) C:\Windows\SysWOW64\JavaScriptCollectionAgent.dll
2017-09-13 04:28 - 2017-08-14 01:00 - 000091136 _____ (Microsoft Corporation) C:\Windows\SysWOW64\inseng.dll
2017-09-13 04:28 - 2017-08-14 00:57 - 000168960 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msrating.dll
2017-09-13 04:28 - 2017-08-14 00:53 - 000130048 _____ (Microsoft Corporation) C:\Windows\SysWOW64\occache.dll
2017-09-13 04:28 - 2017-08-14 00:48 - 004547072 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript9.dll
2017-09-13 04:28 - 2017-08-14 00:46 - 000230400 _____ (Microsoft Corporation) C:\Windows\SysWOW64\webcheck.dll
2017-09-13 04:28 - 2017-08-14 00:44 - 000694784 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msfeeds.dll
2017-09-13 04:28 - 2017-08-14 00:43 - 002058752 _____ (Microsoft Corporation) C:\Windows\SysWOW64\inetcpl.cpl
2017-09-13 04:28 - 2017-08-14 00:43 - 001155072 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtmlmedia.dll
2017-09-13 04:28 - 2017-08-14 00:40 - 003241472 _____ (Microsoft Corporation) C:\Windows\system32\wininet.dll
2017-09-13 04:28 - 2017-08-14 00:27 - 001544704 _____ (Microsoft Corporation) C:\Windows\system32\urlmon.dll
2017-09-13 04:28 - 2017-08-14 00:18 - 000800768 _____ (Microsoft Corporation) C:\Windows\system32\ieapfltr.dll
2017-09-13 04:28 - 2017-08-14 00:17 - 002767872 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wininet.dll
2017-09-13 04:28 - 2017-08-14 00:14 - 000710144 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieapfltr.dll
2017-09-13 04:28 - 2017-08-14 00:13 - 001314816 _____ (Microsoft Corporation) C:\Windows\SysWOW64\urlmon.dll
2017-09-13 04:28 - 2017-08-11 15:42 - 000631176 _____ (Microsoft Corporation) C:\Windows\system32\winresume.efi
2017-09-13 04:28 - 2017-08-11 15:38 - 005547752 _____ (Microsoft Corporation) C:\Windows\system32\ntoskrnl.exe
2017-09-13 04:28 - 2017-08-11 15:38 - 000706792 _____ (Microsoft Corporation) C:\Windows\system32\winload.efi
2017-09-13 04:28 - 2017-08-11 15:38 - 000154856 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\ksecpkg.sys
2017-09-13 04:28 - 2017-08-11 15:38 - 000095464 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\ksecdd.sys
2017-09-13 04:28 - 2017-08-11 15:36 - 001732864 _____ (Microsoft Corporation) C:\Windows\system32\ntdll.dll
2017-09-13 04:28 - 2017-08-11 15:35 - 002065408 _____ (Microsoft Corporation) C:\Windows\system32\ole32.dll
2017-09-13 04:28 - 2017-08-11 15:35 - 001212928 _____ (Microsoft Corporation) C:\Windows\system32\rpcrt4.dll
2017-09-13 04:28 - 2017-08-11 15:35 - 000757248 _____ (Microsoft Corporation) C:\Windows\system32\win32spl.dll
2017-09-13 04:28 - 2017-08-11 15:35 - 000512000 _____ (Microsoft Corporation) C:\Windows\system32\rpcss.dll
2017-09-13 04:28 - 2017-08-11 15:35 - 000503808 _____ (Microsoft Corporation) C:\Windows\system32\srcore.dll
2017-09-13 04:28 - 2017-08-11 15:35 - 000362496 _____ (Microsoft Corporation) C:\Windows\system32\wow64win.dll
2017-09-13 04:28 - 2017-08-11 15:35 - 000346112 _____ (Microsoft Corporation) C:\Windows\system32\ntprint.dll
2017-09-13 04:28 - 2017-08-11 15:35 - 000345600 _____ (Microsoft Corporation) C:\Windows\system32\schannel.dll
2017-09-13 04:28 - 2017-08-11 15:35 - 000313856 _____ (Microsoft Corporation) C:\Windows\system32\Wldap32.dll
2017-09-13 04:28 - 2017-08-11 15:35 - 000243712 _____ (Microsoft Corporation) C:\Windows\system32\wow64.dll
2017-09-13 04:28 - 2017-08-11 15:35 - 000215552 _____ (Microsoft Corporation) C:\Windows\system32\winsrv.dll
2017-09-13 04:28 - 2017-08-11 15:35 - 000210432 _____ (Microsoft Corporation) C:\Windows\system32\wdigest.dll
2017-09-13 04:28 - 2017-08-11 15:35 - 000190464 _____ (Microsoft Corporation) C:\Windows\system32\rpchttp.dll
2017-09-13 04:28 - 2017-08-11 15:35 - 000135680 _____ (Microsoft Corporation) C:\Windows\system32\sspicli.dll
2017-09-13 04:28 - 2017-08-11 15:35 - 000086528 _____ (Microsoft Corporation) C:\Windows\system32\TSpkg.dll
2017-09-13 04:28 - 2017-08-11 15:35 - 000063488 _____ (Microsoft Corporation) C:\Windows\system32\setbcdlocale.dll
2017-09-13 04:28 - 2017-08-11 15:35 - 000050176 _____ (Microsoft Corporation) C:\Windows\system32\srclient.dll
2017-09-13 04:28 - 2017-08-11 15:35 - 000028672 _____ (Microsoft Corporation) C:\Windows\system32\sspisrv.dll
2017-09-13 04:28 - 2017-08-11 15:35 - 000028160 _____ (Microsoft Corporation) C:\Windows\system32\secur32.dll
2017-09-13 04:28 - 2017-08-11 15:35 - 000026112 _____ (Microsoft Corporation) C:\Windows\system32\oleres.dll
2017-09-13 04:28 - 2017-08-11 15:35 - 000026112 _____ (Microsoft Corporation) C:\Windows\system32\nsisvc.dll
2017-09-13 04:28 - 2017-08-11 15:35 - 000025600 _____ (Microsoft Corporation) C:\Windows\system32\winnsi.dll
2017-09-13 04:28 - 2017-08-11 15:35 - 000016384 _____ (Microsoft Corporation) C:\Windows\system32\ntvdm64.dll
2017-09-13 04:28 - 2017-08-11 15:35 - 000013312 _____ (Microsoft Corporation) C:\Windows\system32\wow64cpu.dll
2017-09-13 04:28 - 2017-08-11 15:35 - 000013312 _____ (Microsoft Corporation) C:\Windows\system32\nsi.dll
2017-09-13 04:28 - 2017-08-11 15:34 - 001460736 _____ (Microsoft Corporation) C:\Windows\system32\lsasrv.dll
2017-09-13 04:28 - 2017-08-11 15:34 - 001163264 _____ (Microsoft Corporation) C:\Windows\system32\kernel32.dll
2017-09-13 04:28 - 2017-08-11 15:34 - 000971776 _____ (Microsoft Corporation) C:\Windows\system32\localspl.dll
2017-09-13 04:28 - 2017-08-11 15:34 - 000880640 _____ (Microsoft Corporation) C:\Windows\system32\advapi32.dll
2017-09-13 04:28 - 2017-08-11 15:34 - 000731648 _____ (Microsoft Corporation) C:\Windows\system32\kerberos.dll
2017-09-13 04:28 - 2017-08-11 15:34 - 000690688 _____ (Microsoft Corporation) C:\Windows\system32\adtschema.dll
2017-09-13 04:28 - 2017-08-11 15:34 - 000463872 _____ (Microsoft Corporation) C:\Windows\system32\certcli.dll
2017-09-13 04:28 - 2017-08-11 15:34 - 000419840 _____ (Microsoft Corporation) C:\Windows\system32\KernelBase.dll
2017-09-13 04:28 - 2017-08-11 15:34 - 000316928 _____ (Microsoft Corporation) C:\Windows\system32\msv1_0.dll
2017-09-13 04:28 - 2017-08-11 15:34 - 000312320 _____ (Microsoft Corporation) C:\Windows\system32\ncrypt.dll
2017-09-13 04:28 - 2017-08-11 15:34 - 000166400 _____ (Microsoft Corporation) C:\Windows\system32\inetpp.dll
2017-09-13 04:28 - 2017-08-11 15:34 - 000146432 _____ (Microsoft Corporation) C:\Windows\system32\msaudite.dll
2017-09-13 04:28 - 2017-08-11 15:34 - 000123904 _____ (Microsoft Corporation) C:\Windows\system32\bcrypt.dll
2017-09-13 04:28 - 2017-08-11 15:34 - 000060416 _____ (Microsoft Corporation) C:\Windows\system32\msobjs.dll
2017-09-13 04:28 - 2017-08-11 15:34 - 000059904 _____ (Microsoft Corporation) C:\Windows\system32\appidapi.dll
2017-09-13 04:28 - 2017-08-11 15:34 - 000044032 _____ (Microsoft Corporation) C:\Windows\system32\csrsrv.dll
2017-09-13 04:28 - 2017-08-11 15:34 - 000043520 _____ (Microsoft Corporation) C:\Windows\system32\cryptbase.dll
2017-09-13 04:28 - 2017-08-11 15:34 - 000034816 _____ (Microsoft Corporation) C:\Windows\system32\appidsvc.dll
2017-09-13 04:28 - 2017-08-11 15:34 - 000022528 _____ (Microsoft Corporation) C:\Windows\system32\inetppui.dll
2017-09-13 04:28 - 2017-08-11 15:34 - 000022016 _____ (Microsoft Corporation) C:\Windows\system32\credssp.dll
2017-09-13 04:28 - 2017-08-11 15:34 - 000008704 _____ (Microsoft Corporation) C:\Windows\system32\comcat.dll
2017-09-13 04:28 - 2017-08-11 15:34 - 000006656 _____ (Microsoft Corporation) C:\Windows\system32\apisetschema.dll
2017-09-13 04:28 - 2017-08-11 15:34 - 000006144 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-security-base-l1-1-0.dll
2017-09-13 04:28 - 2017-08-11 15:34 - 000005120 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-file-l1-1-0.dll
2017-09-13 04:28 - 2017-08-11 15:34 - 000004608 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-threadpool-l1-1-0.dll
2017-09-13 04:28 - 2017-08-11 15:34 - 000004608 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-processthreads-l1-1-0.dll
2017-09-13 04:28 - 2017-08-11 15:34 - 000004096 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-sysinfo-l1-1-0.dll
2017-09-13 04:28 - 2017-08-11 15:34 - 000004096 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-synch-l1-1-0.dll
2017-09-13 04:28 - 2017-08-11 15:34 - 000004096 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-localregistry-l1-1-0.dll
2017-09-13 04:28 - 2017-08-11 15:34 - 000004096 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-localization-l1-1-0.dll
2017-09-13 04:28 - 2017-08-11 15:34 - 000003584 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-rtlsupport-l1-1-0.dll
2017-09-13 04:28 - 2017-08-11 15:34 - 000003584 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-processenvironment-l1-1-0.dll
2017-09-13 04:28 - 2017-08-11 15:34 - 000003584 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-namedpipe-l1-1-0.dll
2017-09-13 04:28 - 2017-08-11 15:34 - 000003584 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-misc-l1-1-0.dll
2017-09-13 04:28 - 2017-08-11 15:34 - 000003584 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-memory-l1-1-0.dll
2017-09-13 04:28 - 2017-08-11 15:34 - 000003584 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-libraryloader-l1-1-0.dll
2017-09-13 04:28 - 2017-08-11 15:34 - 000003584 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-heap-l1-1-0.dll
2017-09-13 04:28 - 2017-08-11 15:34 - 000003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-xstate-l1-1-0.dll
2017-09-13 04:28 - 2017-08-11 15:34 - 000003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-util-l1-1-0.dll
2017-09-13 04:28 - 2017-08-11 15:34 - 000003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-string-l1-1-0.dll
2017-09-13 04:28 - 2017-08-11 15:34 - 000003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-profile-l1-1-0.dll
2017-09-13 04:28 - 2017-08-11 15:34 - 000003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-io-l1-1-0.dll
2017-09-13 04:28 - 2017-08-11 15:34 - 000003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-interlocked-l1-1-0.dll
2017-09-13 04:28 - 2017-08-11 15:34 - 000003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-handle-l1-1-0.dll
2017-09-13 04:28 - 2017-08-11 15:34 - 000003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-fibers-l1-1-0.dll
2017-09-13 04:28 - 2017-08-11 15:34 - 000003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-errorhandling-l1-1-0.dll
2017-09-13 04:28 - 2017-08-11 15:34 - 000003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-delayload-l1-1-0.dll
2017-09-13 04:28 - 2017-08-11 15:34 - 000003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-debug-l1-1-0.dll
2017-09-13 04:28 - 2017-08-11 15:34 - 000003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-datetime-l1-1-0.dll
2017-09-13 04:28 - 2017-08-11 15:34 - 000003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-console-l1-1-0.dll
2017-09-13 04:28 - 2017-08-11 15:24 - 004001000 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ntkrnlpa.exe
2017-09-13 04:28 - 2017-08-11 15:24 - 003945704 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ntoskrnl.exe
2017-09-13 04:28 - 2017-08-11 15:21 - 001314112 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ntdll.dll
2017-09-13 04:28 - 2017-08-11 15:20 - 000071680 _____ C:\Windows\system32\PrintBrmUi.exe
2017-09-13 04:28 - 2017-08-11 15:20 - 000061952 _____ (Microsoft Corporation) C:\Windows\system32\ntprint.exe
2017-09-13 04:28 - 2017-08-11 15:20 - 000048640 _____ (Microsoft Corporation) C:\Windows\system32\wpnpinst.exe
2017-09-13 04:28 - 2017-08-11 15:19 - 001417728 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ole32.dll
2017-09-13 04:28 - 2017-08-11 15:19 - 001114112 _____ (Microsoft Corporation) C:\Windows\SysWOW64\kernel32.dll
2017-09-13 04:28 - 2017-08-11 15:19 - 000690688 _____ (Microsoft Corporation) C:\Windows\SysWOW64\adtschema.dll
2017-09-13 04:28 - 2017-08-11 15:19 - 000666112 _____ (Microsoft Corporation) C:\Windows\SysWOW64\rpcrt4.dll
2017-09-13 04:28 - 2017-08-11 15:19 - 000644096 _____ (Microsoft Corporation) C:\Windows\SysWOW64\advapi32.dll
2017-09-13 04:28 - 2017-08-11 15:19 - 000554496 _____ (Microsoft Corporation) C:\Windows\SysWOW64\kerberos.dll
2017-09-13 04:28 - 2017-08-11 15:19 - 000497664 _____ (Microsoft Corporation) C:\Windows\SysWOW64\win32spl.dll
2017-09-13 04:28 - 2017-08-11 15:19 - 000342528 _____ (Microsoft Corporation) C:\Windows\SysWOW64\certcli.dll
2017-09-13 04:28 - 2017-08-11 15:19 - 000299008 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ntprint.dll
2017-09-13 04:28 - 2017-08-11 15:19 - 000275456 _____ (Microsoft Corporation) C:\Windows\SysWOW64\KernelBase.dll
2017-09-13 04:28 - 2017-08-11 15:19 - 000271360 _____ (Microsoft Corporation) C:\Windows\SysWOW64\Wldap32.dll
2017-09-13 04:28 - 2017-08-11 15:19 - 000261120 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msv1_0.dll
2017-09-13 04:28 - 2017-08-11 15:19 - 000254464 _____ (Microsoft Corporation) C:\Windows\SysWOW64\schannel.dll
2017-09-13 04:28 - 2017-08-11 15:19 - 000223232 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ncrypt.dll
2017-09-13 04:28 - 2017-08-11 15:19 - 000172032 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wdigest.dll
2017-09-13 04:28 - 2017-08-11 15:19 - 000146432 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msaudite.dll
2017-09-13 04:28 - 2017-08-11 15:19 - 000141312 _____ (Microsoft Corporation) C:\Windows\SysWOW64\rpchttp.dll
2017-09-13 04:28 - 2017-08-11 15:19 - 000096768 _____ (Microsoft Corporation) C:\Windows\SysWOW64\sspicli.dll
2017-09-13 04:28 - 2017-08-11 15:19 - 000082944 _____ (Microsoft Corporation) C:\Windows\SysWOW64\bcrypt.dll
2017-09-13 04:28 - 2017-08-11 15:19 - 000065536 _____ (Microsoft Corporation) C:\Windows\SysWOW64\TSpkg.dll
2017-09-13 04:28 - 2017-08-11 15:19 - 000060416 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msobjs.dll
2017-09-13 04:28 - 2017-08-11 15:19 - 000050688 _____ (Microsoft Corporation) C:\Windows\SysWOW64\appidapi.dll
2017-09-13 04:28 - 2017-08-11 15:19 - 000043008 _____ (Microsoft Corporation) C:\Windows\SysWOW64\srclient.dll
2017-09-13 04:28 - 2017-08-11 15:19 - 000026112 _____ (Microsoft Corporation) C:\Windows\SysWOW64\oleres.dll
2017-09-13 04:28 - 2017-08-11 15:19 - 000022016 _____ (Microsoft Corporation) C:\Windows\SysWOW64\secur32.dll
2017-09-13 04:28 - 2017-08-11 15:19 - 000017408 _____ (Microsoft Corporation) C:\Windows\SysWOW64\credssp.dll
2017-09-13 04:28 - 2017-08-11 15:19 - 000016384 _____ (Microsoft Corporation) C:\Windows\SysWOW64\winnsi.dll
2017-09-13 04:28 - 2017-08-11 15:19 - 000008704 _____ (Microsoft Corporation) C:\Windows\SysWOW64\nsi.dll
2017-09-13 04:28 - 2017-08-11 15:19 - 000006656 _____ (Microsoft Corporation) C:\Windows\SysWOW64\apisetschema.dll
2017-09-13 04:28 - 2017-08-11 15:19 - 000005120 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-file-l1-1-0.dll
2017-09-13 04:28 - 2017-08-11 15:19 - 000005120 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wow32.dll
2017-09-13 04:28 - 2017-08-11 15:19 - 000004608 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-processthreads-l1-1-0.dll
2017-09-13 04:28 - 2017-08-11 15:19 - 000004096 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-sysinfo-l1-1-0.dll
2017-09-13 04:28 - 2017-08-11 15:19 - 000004096 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-synch-l1-1-0.dll
2017-09-13 04:28 - 2017-08-11 15:19 - 000004096 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-misc-l1-1-0.dll
2017-09-13 04:28 - 2017-08-11 15:19 - 000004096 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-localregistry-l1-1-0.dll
2017-09-13 04:28 - 2017-08-11 15:19 - 000004096 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-localization-l1-1-0.dll
2017-09-13 04:28 - 2017-08-11 15:19 - 000003584 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-processenvironment-l1-1-0.dll
2017-09-13 04:28 - 2017-08-11 15:19 - 000003584 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-namedpipe-l1-1-0.dll
2017-09-13 04:28 - 2017-08-11 15:19 - 000003584 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-memory-l1-1-0.dll
2017-09-13 04:28 - 2017-08-11 15:19 - 000003584 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-libraryloader-l1-1-0.dll
2017-09-13 04:28 - 2017-08-11 15:19 - 000003584 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-interlocked-l1-1-0.dll
2017-09-13 04:28 - 2017-08-11 15:19 - 000003584 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-heap-l1-1-0.dll
2017-09-13 04:28 - 2017-08-11 15:19 - 000003072 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-string-l1-1-0.dll
2017-09-13 04:28 - 2017-08-11 15:19 - 000003072 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-rtlsupport-l1-1-0.dll
2017-09-13 04:28 - 2017-08-11 15:19 - 000003072 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-profile-l1-1-0.dll
2017-09-13 04:28 - 2017-08-11 15:19 - 000003072 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-io-l1-1-0.dll
2017-09-13 04:28 - 2017-08-11 15:19 - 000003072 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-handle-l1-1-0.dll
2017-09-13 04:28 - 2017-08-11 15:19 - 000003072 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-fibers-l1-1-0.dll
2017-09-13 04:28 - 2017-08-11 15:19 - 000003072 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-errorhandling-l1-1-0.dll
2017-09-13 04:28 - 2017-08-11 15:19 - 000003072 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-delayload-l1-1-0.dll
2017-09-13 04:28 - 2017-08-11 15:19 - 000003072 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-debug-l1-1-0.dll
2017-09-13 04:28 - 2017-08-11 15:19 - 000003072 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-datetime-l1-1-0.dll
2017-09-13 04:28 - 2017-08-11 15:19 - 000003072 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-console-l1-1-0.dll
2017-09-13 04:28 - 2017-08-11 15:12 - 000025088 _____ (Microsoft Corporation) C:\Windows\system32\netbtugc.exe
2017-09-13 04:28 - 2017-08-11 15:09 - 000061952 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ntprint.exe
2017-09-13 04:28 - 2017-08-11 15:07 - 000148480 _____ (Microsoft Corporation) C:\Windows\system32\appidpolicyconverter.exe
2017-09-13 04:28 - 2017-08-11 15:07 - 000062464 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\appid.sys
2017-09-13 04:28 - 2017-08-11 15:07 - 000017920 _____ (Microsoft Corporation) C:\Windows\system32\appidcertstorecheck.exe
2017-09-13 04:28 - 2017-08-11 15:06 - 000064000 _____ (Microsoft Corporation) C:\Windows\system32\auditpol.exe
2017-09-13 04:28 - 2017-08-11 15:03 - 000338432 _____ (Microsoft Corporation) C:\Windows\system32\conhost.exe
2017-09-13 04:28 - 2017-08-11 15:03 - 000026624 _____ (Microsoft Corporation) C:\Windows\SysWOW64\netbtugc.exe
2017-09-13 04:28 - 2017-08-11 15:02 - 000296960 _____ (Microsoft Corporation) C:\Windows\system32\rstrui.exe
2017-09-13 04:28 - 2017-08-11 15:01 - 000007168 _____ (Microsoft Corporation) C:\Windows\SysWOW64\comcat.dll
2017-09-13 04:28 - 2017-08-11 15:00 - 000262656 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\netbt.sys
2017-09-13 04:28 - 2017-08-11 15:00 - 000159744 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\mrxsmb.sys
2017-09-13 04:28 - 2017-08-11 15:00 - 000050176 _____ (Microsoft Corporation) C:\Windows\SysWOW64\auditpol.exe
2017-09-13 04:28 - 2017-08-11 14:59 - 000460800 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\srv.sys
2017-09-13 04:28 - 2017-08-11 14:59 - 000405504 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\srv2.sys
2017-09-13 04:28 - 2017-08-11 14:59 - 000291328 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\mrxsmb10.sys
2017-09-13 04:28 - 2017-08-11 14:59 - 000168448 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\srvnet.sys
2017-09-13 04:28 - 2017-08-11 14:59 - 000129536 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\mrxsmb20.sys
2017-09-13 04:28 - 2017-08-11 14:58 - 000112640 _____ (Microsoft Corporation) C:\Windows\system32\smss.exe
2017-09-13 04:28 - 2017-08-11 14:58 - 000030720 _____ (Microsoft Corporation) C:\Windows\system32\lsass.exe
2017-09-13 04:28 - 2017-08-11 14:58 - 000026112 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\nsiproxy.sys
2017-09-13 04:28 - 2017-08-11 14:56 - 000025600 _____ (Microsoft Corporation) C:\Windows\SysWOW64\setup16.exe
2017-09-13 04:28 - 2017-08-11 14:56 - 000014336 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ntvdm64.dll
2017-09-13 04:28 - 2017-08-11 14:56 - 000007680 _____ (Microsoft Corporation) C:\Windows\SysWOW64\instnm.exe
2017-09-13 04:28 - 2017-08-11 14:56 - 000002048 _____ (Microsoft Corporation) C:\Windows\SysWOW64\user.exe
2017-09-13 04:28 - 2017-08-11 14:55 - 000036352 _____ (Microsoft Corporation) C:\Windows\SysWOW64\cryptbase.dll
2017-09-13 04:28 - 2017-08-11 14:55 - 000006144 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-security-base-l1-1-0.dll
2017-09-13 04:28 - 2017-08-11 14:55 - 000004608 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-threadpool-l1-1-0.dll
2017-09-13 04:28 - 2017-08-11 14:55 - 000003584 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-xstate-l1-1-0.dll
2017-09-13 04:28 - 2017-08-11 14:55 - 000003072 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-util-l1-1-0.dll
2017-09-13 04:28 - 2017-07-08 00:29 - 001143296 _____ (Microsoft Corporation) C:\Windows\system32\DXPTaskRingtone.dll
2017-09-13 04:28 - 2017-07-08 00:10 - 000973312 _____ (Microsoft Corporation) C:\Windows\SysWOW64\DXPTaskRingtone.dll
2017-09-08 16:00 - 2017-09-08 16:00 - 000000000 ____D C:\Users\THIS PC\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Bethesda.net Launcher
2017-09-08 15:59 - 2017-09-08 15:59 - 000031598 _____ C:\Windows\SysWOW64\report.txt
2017-09-08 15:58 - 2017-09-08 17:09 - 000000000 ____D C:\Program Files (x86)\Bethesda.net Launcher
2017-09-08 15:58 - 2017-09-08 15:59 - 000000000 ____D C:\Users\THIS PC\AppData\Local\Bethesda.net Launcher
2017-09-08 15:58 - 2017-09-08 15:58 - 000000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Bethesda.net Launcher
2017-09-07 15:14 - 2017-09-07 15:14 - 000000000 ____D C:\Users\THIS PC\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\F4SE

==================== One Month Modified files and folders ========

(If an entry is included in the fixlist, the file/folder will be moved.)

2017-10-07 19:29 - 2016-08-04 01:05 - 000000000 ____D C:\FRST
2017-10-07 18:54 - 2009-07-14 11:34 - 000000215 _____ C:\Windows\system.ini
2017-10-07 17:47 - 2016-02-26 09:25 - 000000000 ____D C:\Users\THIS PC\AppData\Local\Apps\2.0
2017-10-07 17:47 - 2014-08-31 15:02 - 000000000 ___RD C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Utils
2017-10-07 17:38 - 2014-08-12 01:09 - 000000000 ____D C:\Users\THIS PC\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Utils
2017-10-07 17:11 - 2009-07-14 13:45 - 000035488 ____H C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0
2017-10-07 17:11 - 2009-07-14 13:45 - 000035488 ____H C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0
2017-10-07 17:11 - 2009-07-14 12:20 - 000000000 ____D C:\Windows\inf
2017-10-07 15:08 - 2009-07-14 14:13 - 000782682 _____ C:\Windows\system32\PerfStringBackup.INI
2017-10-07 15:02 - 2017-03-03 15:27 - 000000000 ____D C:\ProgramData\NVIDIA
2017-10-07 15:02 - 2015-08-16 15:48 - 000000000 ____D C:\Program Files (x86)\Steam
2017-10-07 15:02 - 2009-07-14 14:08 - 000000006 ____H C:\Windows\Tasks\SA.DAT
2017-10-07 10:10 - 2014-08-11 03:52 - 000000000 ____D C:\ProgramData\Malwarebytes
2017-10-07 09:33 - 2016-07-02 01:13 - 000000000 ____D C:\Users\THIS PC\AppData\Roaming\Notepad++
2017-10-07 09:33 - 2015-12-27 14:30 - 000000000 ____D C:\Users\THIS PC\AppData\Local\CrashDumps
2017-10-07 09:01 - 2015-09-05 07:04 - 000000000 ____D C:\Windows\erdnt
2017-10-07 08:53 - 2017-04-25 20:35 - 000803328 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerApp.exe
2017-10-07 08:53 - 2017-04-25 20:35 - 000144896 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerCPLApp.cpl
2017-10-07 08:53 - 2017-04-25 20:35 - 000004324 _____ C:\Windows\System32\Tasks\Adobe Flash Player Updater
2017-10-07 08:53 - 2015-05-18 11:05 - 000000000 ____D C:\Windows\system32\Macromed
2017-10-07 08:53 - 2014-08-11 00:38 - 000000000 ____D C:\Users\THIS PC\AppData\Local\Adobe
2017-10-07 08:52 - 2014-08-12 00:59 - 000000000 ____D C:\Windows\SysWOW64\Macromed
2017-10-07 07:59 - 2009-07-14 14:08 - 000032608 _____ C:\Windows\Tasks\SCHEDLGU.TXT
2017-10-07 06:59 - 2014-08-10 18:31 - 000000000 ____D C:\Users\THIS PC\AppData\Roaming\vlc
2017-10-07 03:33 - 2015-11-13 13:57 - 000000000 ____D C:\Users\THIS PC\AppData\Local\Fallout4
2017-10-06 14:01 - 2015-05-18 10:54 - 000000000 ____D C:\Program Files (x86)\Mozilla Maintenance Service
2017-10-05 21:18 - 2017-03-04 18:24 - 000003832 _____ C:\Windows\System32\Tasks\Opera scheduled Autoupdate 1488619447
2017-10-05 21:18 - 2017-03-04 18:23 - 000000000 ____D C:\Program Files\Opera
2017-10-05 18:31 - 2016-11-16 07:43 - 000000000 ____D C:\Program Files (x86)\Mozilla Firefox
2017-09-26 18:39 - 2014-08-10 23:39 - 000000000 ____D C:\Users\THIS PC\Documents\ACID Pro 7.0 Projects
2017-09-15 11:07 - 2009-07-14 12:20 - 000000000 ____D C:\Windows\rescache
2017-09-13 15:31 - 2009-07-14 13:45 - 000352680 _____ C:\Windows\system32\FNTCACHE.DAT
2017-09-13 04:32 - 2014-08-10 19:21 - 000000000 ____D C:\Windows\system32\MRT
2017-09-13 04:30 - 2014-08-10 19:21 - 138202976 ____C (Microsoft Corporation) C:\Windows\system32\MRT.exe
2017-09-13 04:29 - 2014-08-09 21:57 - 000766548 _____ C:\Windows\SysWOW64\PerfStringBackup.INI

==================== Files in the root of some directories =======

2016-11-24 20:37 - 2016-11-24 20:37 - 000046530 _____ () C:\Users\THIS PC\AppData\Roaming\DreamPlan.dmp
2015-09-18 12:47 - 2017-07-17 03:54 - 000001456 _____ () C:\Users\THIS PC\AppData\Local\Adobe Save for Web 13.0 Prefs
2017-06-18 06:19 - 2013-01-08 11:19 - 018158238 _____ () C:\Users\THIS PC\AppData\Local\OcrMap.bin
2017-05-31 17:23 - 2017-05-31 17:23 - 000000218 _____ () C:\Users\THIS PC\AppData\Local\recently-used.xbel
2015-01-25 22:02 - 2016-12-08 17:32 - 000007661 _____ () C:\Users\THIS PC\AppData\Local\Resmon.ResmonCfg
2017-05-29 19:38 - 2017-05-29 19:38 - 000000096 _____ () C:\ProgramData\Microsoft.SqlServer.Compact.400.32.bc
2014-09-27 13:09 - 2014-09-27 13:09 - 000004138 _____ () C:\ProgramData\updkbqqg.iqa

==================== Bamital & volsnap ======================

(There is no automatic fix for files that do not pass verification.)

C:\Windows\system32\winlogon.exe => File is digitally signed
C:\Windows\system32\wininit.exe => File is digitally signed
C:\Windows\SysWOW64\wininit.exe => File is digitally signed
C:\Windows\explorer.exe => File is digitally signed
C:\Windows\SysWOW64\explorer.exe => File is digitally signed
C:\Windows\system32\svchost.exe => File is digitally signed
C:\Windows\SysWOW64\svchost.exe => File is digitally signed
C:\Windows\system32\services.exe => File is digitally signed
C:\Windows\system32\User32.dll => File is digitally signed
C:\Windows\SysWOW64\User32.dll => File is digitally signed
C:\Windows\system32\userinit.exe => File is digitally signed
C:\Windows\SysWOW64\userinit.exe => File is digitally signed
C:\Windows\system32\rpcss.dll => File is digitally signed
C:\Windows\system32\dnsapi.dll => File is digitally signed
C:\Windows\SysWOW64\dnsapi.dll => File is digitally signed
C:\Windows\system32\Drivers\volsnap.sys => File is digitally signed

LastRegBack: 2017-09-30 08:27

==================== End of FRST.txt ============================

Addition.txt

Edited by peter_callback
Link to post
Share on other sites
kevinf80

kevinf80

Posted
Posted

Thanks for those logs, run the following fix:

Download attached fixlist.txt file (end of reply) and save it to the Desktop, or the folder you saved FRST into. "Do not open that file"
NOTE. It's important that both FRST and fixlist.txt are in the same location or the fix will not work.

Open FRST and press the Fix button just once and wait.
The tool will make a log on the Desktop (Fixlog.txt) or the folder it was ran from. Please post it to your reply.

Next,

Set your system up for a "Clean Boot" basically that is all none MS services disabled. Then try a shutdown and see if the reboot issue has ceased...

Full instructions for cean boot here: https://support.microsoft.com/en-gb/help/929135/how-to-perform-a-clean-boot-in-windows  Expand the option for Windows 7

Thanks,

Kevin

 

fixlist.txt

Link to post
Share on other sites
peter_callback

peter_callback

Posted
  • Author
Posted

Don't know what to say...

Right Click, Save Link as... https://forums.malwarebytes.com/applications/core/interface/file/attachment.php?id=232782

Re-name file from 'fixlist.txt.ce3d84d84df3e0d264d41ea1c08a7fc3.txt' to 'fixlist.txt'

Right click on 'FRST64.exe', run as administrator

Left Click 'Fix' in FRST

Upload Fixlog.txt

Upload screen shot of folder

01.png

Fixlog.txt

Link to post
Share on other sites
kevinf80

kevinf80

Posted
Posted

Due to the lack of feedback this topic is closed to prevent others from posting here. If you need this topic reopened, please send a Private Message to any one of the moderating team members. Please include a link to this thread with your request. This applies only to the originator of this thread.Other members who need assistance please start your own topic in a new thread. Thanks!

Link to post
Share on other sites
Guest
This topic is now closed to further replies.
 Share
Go to topic listing

  • Recently Browsing   0 members

    • No registered users viewing this page.
Back to top
×
×
  • Create New...

Important Information

This site uses cookies - We have placed cookies on your device to help make this website better. You can adjust your cookie settings, otherwise we'll assume you're okay to continue.

  I accept