jtsshieh Posted October 20, 2017 Author ID:1174335 Share Posted October 20, 2017 I accidentally clicked restart for ADW cleaner so now I have to run Malwarebytes again. But, I am also running Rogue Killer. Link to post Share on other sites More sharing options...
jtsshieh Posted October 20, 2017 Author ID:1174343 Share Posted October 20, 2017 (edited) Also, when I run AdwCleaner, it doesn't seem like it removed anything... Edited October 20, 2017 by jtsshieh Link to post Share on other sites More sharing options...
jtsshieh Posted October 20, 2017 Author ID:1174412 Share Posted October 20, 2017 RogueKiller V12.11.20.0 (x64) [Oct 16 2017] (Free) by Adlice Software mail : http://www.adlice.com/contact/ Feedback : https://forum.adlice.com Website : http://www.adlice.com/download/roguekiller/ Blog : http://www.adlice.com Operating System : Windows 10 (10.0.15063) 64 bits version Started in : Normal mode User : jtssh [Administrator] Started from : C:\Program Files\RogueKiller\RogueKiller64.exe Mode : Scan -- Date : 10/19/2017 21:05:35 (Duration : 02:19:50) ¤¤¤ Processes : 0 ¤¤¤ ¤¤¤ Registry : 3 ¤¤¤ [PUP.OnlineIO] (X86) HKEY_LOCAL_MACHINE\Software\Microleaves -> Found [PUM.HomePage] (X64) HKEY_USERS\S-1-5-21-1080822061-2706406846-2729724613-1001\Software\Microsoft\Internet Explorer\Main | Start Page : http://dell13.msn.com/ -> Found [PUM.HomePage] (X86) HKEY_USERS\S-1-5-21-1080822061-2706406846-2729724613-1001\Software\Microsoft\Internet Explorer\Main | Start Page : http://dell13.msn.com/ -> Found ¤¤¤ Tasks : 0 ¤¤¤ ¤¤¤ Files : 1 ¤¤¤ [Adw.IntManager|Tr.Gen0][Folder] C:\Users\jtssh\AppData\Local\intmanager -> Found ¤¤¤ WMI : 0 ¤¤¤ ¤¤¤ Hosts File : 0 ¤¤¤ ¤¤¤ Antirootkit : 0 (Driver: Loaded) ¤¤¤ ¤¤¤ Web browsers : 2 ¤¤¤ [PUP.Ask|PUP.Gen1|PUM.HomePage][Chrome:Config] Default [SecurePrefs] : homepage [http://www.trovi.com/?gd=&ctid=CT3333529&octid=EB_ORIGINAL_CTID&ISID=MF4737248-246D-480F-B7D0-DAF8E5E2AB67&SearchSource=55&CUI=&UM=8&UP=SP6CEC7EA2-AF62-49FC-B4DA-A0358909660C&D=061215&SSPV=] -> Found [PUM.HomePage][Chrome:Config] Default [SecurePrefs] : session.startup_urls [chrome://apps/|http://www.carryformation.com/club/] -> Found ¤¤¤ MBR Check : ¤¤¤ +++++ PhysicalDrive0: HDS725050KLA360 +++++ --- User --- [MBR] a2b7e0f75edeace2f027826a9f8ea7ef [BSP] 87a1e76eb629af3fed9df28fbc438ac0 : Windows Vista/7/8 MBR Code Partition table: 0 - [ACTIVE] NTFS (0x7) [VISIBLE] Offset (sectors): 2048 | Size: 476091 MB [Windows Vista/7/8 Bootstrap | Windows Vista/7/8 Bootloader] 1 - [XXXXXX] ACER (0x27) [VISIBLE] Offset (sectors): 975038464 | Size: 844 MB User = LL1 ... OK User = LL2 ... OK +++++ PhysicalDrive1: Generic Flash Disk USB Device +++++ --- User --- [MBR] eaed23184990f403a176efa2805280d7 [BSP] 0ce328fc99001bdb7ac4ff2910c666f0 : Legit.Unknown|VT.Unknown MBR Code Partition table: 0 - [ACTIVE] FAT32-LBA (0xc) [VISIBLE] Offset (sectors): 1568 | Size: 7799 MB User = LL1 ... OK Error reading LL2 MBR! ([32] The request is not supported. ) Link to post Share on other sites More sharing options...
Aura Posted October 20, 2017 ID:1174429 Share Posted October 20, 2017 You need to run only one scan at once, not multiple at the same time. So you'll need to run Malwarebytes, followed by AdwCleaner and finally RogueKiller. Link to post Share on other sites More sharing options...
jtsshieh Posted October 21, 2017 Author ID:1174666 Share Posted October 21, 2017 K, running RougueKiller by itself now.... Link to post Share on other sites More sharing options...
jtsshieh Posted October 21, 2017 Author ID:1174678 Share Posted October 21, 2017 RouguKiller has finished with no bad anything! Link to post Share on other sites More sharing options...
jtsshieh Posted October 21, 2017 Author ID:1174679 Share Posted October 21, 2017 But safesearch is still active Link to post Share on other sites More sharing options...
Aura Posted October 21, 2017 ID:1174739 Share Posted October 21, 2017 In that case, let's run a scan with FRST and see if we can remove it. Farbar Recovery Scan Tool (FRST) - Scan mode Follow the instructions below to download and execute a scan on your system with FRST, and provide the logs in your next reply. Right-click on the executable and select Run as Administrator (for Windows Vista, 7, 8, 8.1 and 10 users) Accept the disclaimer by clicking on Yes, and FRST will then do a back-up of your Registry which should take a few seconds Click on the Scan button On completion, two message box will open, saying that the results were saved to FRST.txt and Addition.txt, then open two Notepad files Copy and paste the content of both FRST.txt and Addition.txt in your next reply Link to post Share on other sites More sharing options...
jtsshieh Posted October 21, 2017 Author ID:1174760 Share Posted October 21, 2017 Additional scan result of Farbar Recovery Scan Tool (x64) Version: 21-10-2017 Ran by jtssh (21-10-2017 11:40:03) Running from C:\Users\jtssh\OneDrive\Documents\Setup Windows 10 Pro Version 1703 15063.674 (X64) (2017-10-16 22:16:32) Boot Mode: Normal ========================================================== ==================== Accounts: ============================= Administrator (S-1-5-21-1080822061-2706406846-2729724613-500 - Administrator - Disabled) DefaultAccount (S-1-5-21-1080822061-2706406846-2729724613-503 - Limited - Disabled) Guest (S-1-5-21-1080822061-2706406846-2729724613-501 - Limited - Disabled) jtssh (S-1-5-21-1080822061-2706406846-2729724613-1001 - Administrator - Enabled) => C:\Users\jtssh ==================== Security Center ======================== (If an entry is included in the fixlist, it will be removed.) AV: Windows Defender (Disabled - Up to date) {D68DDC3A-831F-4fae-9E44-DA132C1ACF46} AV: Malwarebytes (Enabled - Up to date) {23007AD3-69FE-687C-2629-D584AFFAF72B} AS: Malwarebytes (Enabled - Up to date) {98619B37-4FC4-67F2-1C99-EEF6D47DBD96} AS: Windows Defender (Disabled - Up to date) {D68DDC3A-831F-4fae-9E44-DA132C1ACF46} ==================== Installed Programs ====================== (Only the adware programs with "Hidden" flag could be added to the fixlist to unhide them. The adware programs should be uninstalled manually.) . . . (HKLM\...\{DB52A2D0-CAA1-4ED1-B122-29E7EDDE187F}) (Version: 2.1.28.3 - Intel) Hidden . . . (HKLM-x32\...\{06DA421D-EE23-487D-878F-F0AF97EF69AD}) (Version: 2.6.1.4 - Intel) Hidden .NET Core SDK 1.0.4 (x64) (HKLM\...\{11ACCE3C-C179-472C-A8CA-0F467702B2DA}) (Version: 4.1.5012 - Microsoft Corporation) Hidden .NET Core SDK 1.0.4 (x64) (HKLM-x32\...\{c56e80af-58a4-490b-a1cd-5718290133b9}) (Version: 1.0.4 - Microsoft Corporation) 7-Zip 16.04 (x64) (HKLM\...\7-Zip) (Version: 16.04 - Igor Pavlov) Active Directory Authentication Library for SQL Server (HKLM\...\{32C0D7B2-1046-43AC-98AD-B748E1910916}) (Version: 13.0.1601.5 - Microsoft Corporation) Hidden Active Directory Authentication Library for SQL Server (x86) (HKLM-x32\...\{F40FA676-46B1-4609-85EF-D2F1F79E0C0E}) (Version: 13.0.1601.5 - Microsoft Corporation) Hidden Adobe AIR (HKLM-x32\...\Adobe AIR) (Version: 23.0.0.257 - Adobe Systems Incorporated) Adobe Shockwave Player 12.2 (HKLM-x32\...\Adobe Shockwave Player) (Version: 12.2.5.195 - Adobe Systems, Inc.) Atom (HKU\S-1-5-21-1080822061-2706406846-2729724613-1001\...\atom) (Version: 1.21.1 - GitHub Inc.) Audacity 2.1.2 (HKLM-x32\...\Audacity®_is1) (Version: 2.1.2 - Audacity Team) CCleaner (HKLM\...\CCleaner) (Version: 5.35 - Piriform) ClickOnce Bootstrapper Package for Microsoft .NET Framework (HKLM-x32\...\{E598B692-764A-413C-8530-59163D6B4AE3}) (Version: 4.6.01590 - Microsoft Corporation) Hidden D3DX10 (HKLM-x32\...\{E09C4DB7-630C-4F06-A631-8EA7239923AF}) (Version: 15.4.2368.0902 - Microsoft) Hidden DiagnosticsHub_CollectionService (HKLM\...\{90A561D7-0C29-464D-94E1-2A7E1C553230}) (Version: 15.0.26208 - Microsoft Corporation) Hidden Discord (HKU\S-1-5-21-1080822061-2706406846-2729724613-1001\...\Discord) (Version: 0.0.298 - Discord Inc.) Discord Canary (HKU\S-1-5-21-1080822061-2706406846-2729724613-1001\...\DiscordCanary) (Version: 0.0.167 - Discord Inc.) Dropbox (HKLM-x32\...\Dropbox) (Version: 37.4.29 - Dropbox, Inc.) Dropbox Update Helper (HKLM-x32\...\{099218A5-A723-43DC-8DB5-6173656A1E94}) (Version: 1.3.59.1 - Dropbox, Inc.) Hidden Entity Framework 6.1.3 Tools for Visual Studio 15 (HKLM-x32\...\{F8C0447E-D45C-4E52-94E8-C6340AAC9DB8}) (Version: 6.1.60104.0 - Microsoft Corporation) Hidden FFmpeg (Windows) for Audacity version 2.2.2 (HKLM-x32\...\{9C7E31E3-017F-434C-AC40-24431A354A1E}_is1) (Version: 2.2.2 - ) FlashBack Express 5 (HKLM-x32\...\FlashBack Express 5) (Version: 5.26.0.4259 - Blueberry Software (UK) Ltd.) Git version 2.8.1 (HKLM\...\Git_is1) (Version: 2.8.1 - The Git Development Community) GitHub (HKU\S-1-5-21-1080822061-2706406846-2729724613-1001\...\5f7eb300e2ea4ebf) (Version: 3.3.4.0 - GitHub, Inc.) GitHub Desktop (HKU\S-1-5-21-1080822061-2706406846-2729724613-1001\...\GitHubDesktop) (Version: 0.7.2 - GitHub, Inc.) Google Chrome (HKLM-x32\...\Google Chrome) (Version: 61.0.3163.100 - Google Inc.) Google Update Helper (HKLM-x32\...\{60EC980A-BDA2-4CB6-A427-B07A5498B4CA}) (Version: 1.3.33.5 - Google Inc.) Hidden Groovy (HKLM-x32\...\Groovy) (Version: 1.1.2.3 - Groovy_Installer) Gtk# for .Net 2.12.26 (HKLM-x32\...\{BC25B808-A11C-4C9F-9C0A-6682E47AAB83}) (Version: 2.12.26 - Xamarin, Inc.) Heroku CLI (HKLM-x32\...\Heroku) (Version: - ) HitFilm 4 Express (HKLM\...\{F8BB3662-69A1-4EF1-8674-ADD90AAD3D08}) (Version: 4.0.5723.10801 - FXHOME) icecap_collection_neutral (HKLM-x32\...\{64F3E6FC-68E3-4062-9C2C-ABD93FDFF309}) (Version: 15.0.26208 - Microsoft Corporation) Hidden icecap_collection_x64 (HKLM\...\{0AD162D1-4973-4315-97E9-5DE9A92B4049}) (Version: 15.0.26208 - Microsoft Corporation) Hidden icecap_collectionresources (HKLM-x32\...\{12C50688-5919-4A7A-8784-B26A7238FCEE}) (Version: 15.0.26208 - Microsoft Corporation) Hidden icecap_collectionresourcesx64 (HKLM-x32\...\{400E7885-8851-43F1-849C-5A720CB4F001}) (Version: 15.0.26208 - Microsoft Corporation) Hidden IIS 10.0 Express (HKLM\...\{0148E8AA-4A50-4673-B532-DB9F30F804BE}) (Version: 10.0.1737 - Microsoft Corporation) IIS Express Application Compatibility Database for x64 (HKLM\...\{08274920-8908-45c2-9258-8ad67ff77b09}.sdb) (Version: - ) Hidden IIS Express Application Compatibility Database for x86 (HKLM\...\{ad846bae-d44b-4722-abad-f7420e08bcd9}.sdb) (Version: - ) Hidden Intel® Driver Update Utility (HKLM-x32\...\{fe2eebd3-ee15-4538-bb19-b627e3f2a911}) (Version: 2.6.1.4 - Intel) IntelliTraceProfilerProxy (HKLM-x32\...\{51783942-DFB0-4452-97CC-BDF2D4AB3A48}) (Version: 15.0.24.0 - Microsoft Corporation) Hidden Java 8 Update 151 (HKLM-x32\...\{26A24AE4-039D-4CA4-87B4-2F32180151F0}) (Version: 8.0.1510.12 - Oracle Corporation) Java 9 (64-bit) (HKLM\...\{DA69628A-2608-5BA9-8749-1EE90CB29D95}) (Version: 9.0.0.0 - Oracle Corporation) Java SE Development Kit 8 Update 101 (64-bit) (HKLM\...\{64A3A4F4-B792-11D6-A78A-00B0D0180101}) (Version: 8.0.1010.13 - Oracle Corporation) Java SE Development Kit 8 Update 101 (HKLM-x32\...\{32A3A4F4-B792-11D6-A78A-00B0D0180101}) (Version: 8.0.1010.13 - Oracle Corporation) Java SE Development Kit 8 Update 144 (64-bit) (HKLM\...\{64A3A4F4-B792-11D6-A78A-00B0D0180144}) (Version: 8.0.1440.1 - Oracle Corporation) Java(TM) SE Development Kit 9 (64-bit) (HKLM\...\{41150763-08D2-5FDA-90D8-20618BEA61D0}) (Version: 9.0.0.0 - Oracle Corporation) KB4023057 (HKLM\...\{0C050BEE-16BE-4998-8959-2A421433DB6E}) (Version: 2.5.0.0 - Microsoft Corporation) LAME v3.99.3 (for Windows) (HKLM-x32\...\LAME_is1) (Version: - ) Lightshot-5.4.0.10 (HKLM-x32\...\{30A5B3C9-2084-4063-A32A-628A98DE512B}_is1) (Version: 5.4.0.10 - Skillbrains) Malwarebytes version 3.2.2.2029 (HKLM\...\{35065F43-4BB2-439A-BFF7-0F1014F2E0CD}_is1) (Version: 3.2.2.2029 - Malwarebytes) Microsoft .NET Framework 4.5 Multi-Targeting Pack (HKLM-x32\...\{56E962F0-4FB0-3C67-88DB-9EAA6EEFC493}) (Version: 4.5.50710 - Microsoft Corporation) Microsoft .NET Framework 4.5.1 Multi-Targeting Pack (ENU) (HKLM-x32\...\{D3517C62-68A5-37CF-92F7-93C029A89681}) (Version: 4.5.50932 - Microsoft Corporation) Microsoft .NET Framework 4.5.1 Multi-Targeting Pack (HKLM-x32\...\{6A0C6700-EA93-372C-8871-DCCF13D160A4}) (Version: 4.5.50932 - Microsoft Corporation) Microsoft .NET Framework 4.5.2 Multi-Targeting Pack (HKLM-x32\...\{19E8AE59-4D4A-3534-B567-6CC08FA4102E}) (Version: 4.5.51651 - Microsoft Corporation) Microsoft .NET Framework 4.6 Targeting Pack (HKLM-x32\...\{2CC6A4A7-AAC2-46C9-9DBB-3727B5954F65}) (Version: 4.6.00081 - Microsoft Corporation) Microsoft .NET Framework 4.6.1 SDK (HKLM-x32\...\{2F0ECC80-B9E4-4485-8083-CD32F22ABD92}) (Version: 4.6.01055 - Microsoft Corporation) Microsoft .NET Framework 4.6.1 Targeting Pack (ENU) (HKLM-x32\...\{8EEB28EE-5141-411C-9CF0-9952264FE4AF}) (Version: 4.6.01055 - Microsoft Corporation) Microsoft .NET Framework 4.6.1 Targeting Pack (HKLM-x32\...\{8BC3EEC9-090F-4C53-A8DA-1BEC913040F9}) (Version: 4.6.01055 - Microsoft Corporation) Microsoft Help Viewer 2.2 (HKLM-x32\...\Microsoft Help Viewer 2.2) (Version: 2.2.25420 - Microsoft Corporation) Microsoft OneDrive (HKU\S-1-5-21-1080822061-2706406846-2729724613-1001\...\OneDriveSetup.exe) (Version: 17.3.6998.0830 - Microsoft Corporation) Microsoft Silverlight (HKLM\...\{89F4137D-6C26-4A84-BDB8-2E5A4BB71E00}) (Version: 5.1.50907.0 - Microsoft Corporation) Microsoft SQL Server 2005 Compact Edition [ENU] (HKLM-x32\...\{F0B430D1-B6AA-473D-9B06-AA3DD01FD0B8}) (Version: 3.1.0000 - Microsoft Corporation) Microsoft SQL Server 2012 Native Client (HKLM\...\{1385D3DB-8E80-427B-91D2-B7535862B8E4}) (Version: 11.3.6518.0 - Microsoft Corporation) Microsoft SQL Server 2014 Management Objects (HKLM-x32\...\{2774595F-BC2A-4B12-A25B-0C37A37049B0}) (Version: 12.0.2000.8 - Microsoft Corporation) Microsoft SQL Server 2014 Management Objects (x64) (HKLM\...\{1F9EB3B6-AED7-4AA7-B8F1-8E314B74B2A5}) (Version: 12.0.2000.8 - Microsoft Corporation) Microsoft SQL Server 2014 Transact-SQL ScriptDom (HKLM\...\{020CDFE0-C127-4047-B571-37C82396B662}) (Version: 12.0.2000.8 - Microsoft Corporation) Microsoft SQL Server 2014 T-SQL Language Service (HKLM-x32\...\{47D08E7A-92A1-489B-B0BF-415516497BCE}) (Version: 12.0.2000.8 - Microsoft Corporation) Microsoft SQL Server 2016 LocalDB (HKLM\...\{E359515A-92E6-4FA3-A2C9-E1BA02D8DE6E}) (Version: 13.0.1601.5 - Microsoft Corporation) Microsoft SQL Server 2016 Management Objects (HKLM-x32\...\{0F1C8E2F-199A-4946-B3BF-0906DACFD032}) (Version: 13.0.1601.5 - Microsoft Corporation) Microsoft SQL Server 2016 Management Objects (x64) (HKLM\...\{20EA85AA-2A1D-4F11-B09F-4BA2BF3C8989}) (Version: 13.0.1601.5 - Microsoft Corporation) Microsoft SQL Server 2016 T-SQL Language Service (HKLM-x32\...\{8BFDE775-C5B8-46DB-84EF-43FFC8A2E8AD}) (Version: 13.0.14500.10 - Microsoft Corporation) Microsoft SQL Server 2016 T-SQL ScriptDom (HKLM\...\{D091DE8C-EA0F-49AF-8DE3-BD6C79737C6E}) (Version: 13.0.1601.5 - Microsoft Corporation) Microsoft SQL Server Compact 4.0 SP1 x64 ENU (HKLM\...\{78909610-D229-459C-A936-25D92283D3FD}) (Version: 4.0.8876.1 - Microsoft Corporation) Microsoft SQL Server Data Tools - enu (14.0.60519.0) (HKLM-x32\...\{4E27B0EF-7BAB-432A-AF3D-3FC8F3F7353F}) (Version: 14.0.60519.0 - Microsoft Corporation) Microsoft System CLR Types for SQL Server 2014 (HKLM\...\{FC3BB979-AA54-4B60-BBA3-2C4DA6E08D80}) (Version: 12.0.2402.29 - Microsoft Corporation) Microsoft System CLR Types for SQL Server 2014 (HKLM-x32\...\{091CE6AA-2753-4F6E-AD1C-0E875744EB54}) (Version: 12.0.2402.29 - Microsoft Corporation) Microsoft System CLR Types for SQL Server 2016 (HKLM\...\{96EB5054-C775-4BEF-B7B9-AA96A295EDCD}) (Version: 13.0.1601.5 - Microsoft Corporation) Microsoft System CLR Types for SQL Server 2016 (HKLM-x32\...\{84C23ECA-FE4D-494F-9247-3EBAD57E7F0C}) (Version: 13.0.1601.5 - Microsoft Corporation) Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.4148 (HKLM\...\{4B6C7001-C7D6-3710-913E-5BC23FCE91E6}) (Version: 9.0.30729.4148 - Microsoft Corporation) Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.6161 (HKLM\...\{5FCE6D76-F5DC-37AB-B2B8-22AB8CEDB1D4}) (Version: 9.0.30729.6161 - Microsoft Corporation) Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.4148 (HKLM-x32\...\{1F1C2DFC-2D24-3E06-BCB8-725134ADF989}) (Version: 9.0.30729.4148 - Microsoft Corporation) Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161 (HKLM-x32\...\{9BE518E6-ECC6-35A9-88E4-87755C07200F}) (Version: 9.0.30729.6161 - Microsoft Corporation) Microsoft Visual C++ 2010 x64 Redistributable - 10.0.30319 (HKLM\...\{DA5E371C-6333-3D8A-93A4-6FD5B20BCC6E}) (Version: 10.0.30319 - Microsoft Corporation) Microsoft Visual C++ 2012 Redistributable (x64) - 11.0.60610 (HKLM-x32\...\{a1909659-0a08-4554-8af1-2175904903a1}) (Version: 11.0.60610.1 - Microsoft Corporation) Microsoft Visual C++ 2012 Redistributable (x86) - 11.0.60610 (HKLM-x32\...\{95716cce-fc71-413f-8ad5-56c2892d4b3a}) (Version: 11.0.60610.1 - Microsoft Corporation) Microsoft Visual C++ 2013 Redistributable (x64) - 12.0.30501 (HKLM-x32\...\{050d4fc8-5d48-4b8f-8972-47c82c46020f}) (Version: 12.0.30501.0 - Microsoft Corporation) Microsoft Visual C++ 2013 Redistributable (x86) - 12.0.30501 (HKLM-x32\...\{f65db027-aff3-4070-886a-0d87064aabb1}) (Version: 12.0.30501.0 - Microsoft Corporation) Microsoft Visual C++ 2017 Redistributable (x64) - 14.10.25008 (HKLM-x32\...\{f1e7e313-06df-4c56-96a9-99fdfd149c51}) (Version: 14.10.25008.0 - Microsoft Corporation) Microsoft Visual C++ 2017 Redistributable (x86) - 14.10.25008 (HKLM-x32\...\{c239cea1-d49e-4e16-8e87-8c055765f7ec}) (Version: 14.10.25008.0 - Microsoft Corporation) Microsoft Visual Studio 2017 (HKLM-x32\...\{6F320B93-EE3C-4826-85E0-ADF79F8D4C61}) (Version: 1.10.30640.0 - Microsoft Corporation) Microsoft Visual Studio Code (HKLM-x32\...\{F8A2A208-72B3-4D61-95FC-8A65D340689B}_is1) (Version: 1.15.0 - Microsoft Corporation) Microsoft Web Deploy 3.6 (HKLM\...\{5CB4DD27-6252-4C08-BFCF-22F6A110CBFA}) (Version: 10.0.1972 - Microsoft Corporation) Movie Maker (HKLM-x32\...\{38F03569-A636-4CF3-BDDE-032C8C251304}) (Version: 16.4.3528.0331 - Microsoft Corporation) Hidden Movie Maker (HKLM-x32\...\{DD67BE4B-7E62-4215-AFA3-F123A800A389}) (Version: 16.4.3528.0331 - Microsoft Corporation) Hidden Mozilla Firefox 55.0.3 (x86 en-US) (HKLM-x32\...\Mozilla Firefox 55.0.3 (x86 en-US)) (Version: 55.0.3 - Mozilla) Mozilla Maintenance Service (HKLM-x32\...\MozillaMaintenanceService) (Version: 55.0.3.6445 - Mozilla) Node.js (HKLM\...\{AF917D02-27BF-4822-AD0F-D287A1516D90}) (Version: 8.1.2 - Node.js Foundation) Notepad++ (32-bit x86) (HKLM-x32\...\Notepad++) (Version: 7.5.1 - Notepad++ Team) OBS Studio (HKLM-x32\...\OBS Studio) (Version: 19.0.3 - OBS Project) Oracle VM VirtualBox 5.1.26 (HKLM\...\{11A88BD5-F059-4743-81D9-1432AC9C3D4E}) (Version: 5.1.26 - Oracle Corporation) paint.net (HKLM\...\{F10AAD91-58DF-44EC-A647-810197141667}) (Version: 4.0.19 - dotPDN LLC) Paragraph version Alpha 1.0.1 (HKLM-x32\...\{89A27B2F-81D4-4654-8C91-4E128FF3B39E}_is1) (Version: Alpha 1.0.1 - Garamia) Prerequisites for SSDT (HKLM-x32\...\{21373064-AD95-48DB-A32E-0D9E08EF7355}) (Version: 12.0.2000.8 - Microsoft Corporation) Prerequisites for SSDT (HKLM-x32\...\{B7E94916-7AE6-4F7F-A377-7A410A42BA19}) (Version: 13.0.1601.5 - Microsoft Corporation) Python 3.6.0 (64-bit) (HKU\S-1-5-21-1080822061-2706406846-2729724613-1001\...\{37a4e38b-baf7-4500-97f1-0f7c51d9a395}) (Version: 3.6.150.0 - Python Software Foundation) Python 3.6.0 Core Interpreter (64-bit symbols) (HKLM\...\{DFAA81ED-540F-47B5-9113-814CC427CFD8}) (Version: 3.6.150.0 - Python Software Foundation) Hidden Python 3.6.0 Core Interpreter (64-bit) (HKLM\...\{1944B5D6-0FFB-47C0-BFEC-5C7A2F013FA7}) (Version: 3.6.150.0 - Python Software Foundation) Hidden Python 3.6.0 Development Libraries (64-bit) (HKLM\...\{A6A3184B-748E-46F4-9E28-6B5889506170}) (Version: 3.6.150.0 - Python Software Foundation) Hidden Python 3.6.0 Documentation (64-bit) (HKLM\...\{5D83032F-36B5-42E4-A114-D310119C6F51}) (Version: 3.6.150.0 - Python Software Foundation) Hidden Python 3.6.0 Executables (64-bit symbols) (HKLM\...\{4A928E09-6798-46AB-A4F7-1B52CD164B3B}) (Version: 3.6.150.0 - Python Software Foundation) Hidden Python 3.6.0 Executables (64-bit) (HKLM\...\{C0016766-8F63-4992-9E6F-ECFB2CB12BA6}) (Version: 3.6.150.0 - Python Software Foundation) Hidden Python 3.6.0 pip Bootstrap (64-bit) (HKLM\...\{F9C1C892-4908-41F4-900C-7B0DAAF2387B}) (Version: 3.6.150.0 - Python Software Foundation) Hidden Python 3.6.0 Standard Library (64-bit symbols) (HKLM\...\{90676013-5216-48EE-AC8D-07AC0C16DA50}) (Version: 3.6.150.0 - Python Software Foundation) Hidden Python 3.6.0 Standard Library (64-bit) (HKLM\...\{F3CB2257-C4C7-4C84-AF63-BADCED1E3273}) (Version: 3.6.150.0 - Python Software Foundation) Hidden Python 3.6.0 Tcl/Tk Support (64-bit symbols) (HKLM\...\{96C2F083-44B8-4388-B2A5-F48B75A25188}) (Version: 3.6.150.0 - Python Software Foundation) Hidden Python 3.6.0 Tcl/Tk Support (64-bit) (HKLM\...\{E24AA157-AD52-42ED-B484-CA5979D4A728}) (Version: 3.6.150.0 - Python Software Foundation) Hidden Python 3.6.0 Test Suite (64-bit symbols) (HKLM\...\{CFF9C3A7-86C3-410B-9DD1-F1617767D2D6}) (Version: 3.6.150.0 - Python Software Foundation) Hidden Python 3.6.0 Test Suite (64-bit) (HKLM\...\{631C7E77-5832-40D1-9D6D-7B3766D79BDF}) (Version: 3.6.150.0 - Python Software Foundation) Hidden Python 3.6.0 Utility Scripts (64-bit) (HKLM\...\{FE905DA4-0F23-4F99-9284-50BB4913CEB4}) (Version: 3.6.150.0 - Python Software Foundation) Hidden Python 3.6.3 (32-bit) (HKU\S-1-5-21-1080822061-2706406846-2729724613-1001\...\{1bb10b8c-6e63-4897-9fb2-3873ce30d7e1}) (Version: 3.6.3150.0 - Python Software Foundation) Python 3.6.3 Add to Path (32-bit) (HKLM-x32\...\{04AE65E4-FC7A-43A7-AC1E-E3E019EF07F5}) (Version: 3.6.3150.0 - Python Software Foundation) Hidden Python 3.6.3 Core Interpreter (32-bit) (HKLM-x32\...\{52D39C34-E5F5-41AE-88CD-5DE66C9150B4}) (Version: 3.6.3150.0 - Python Software Foundation) Hidden Python 3.6.3 Development Libraries (32-bit) (HKLM-x32\...\{F7D9BDE7-2C35-4F7E-AEBE-9F3028451087}) (Version: 3.6.3150.0 - Python Software Foundation) Hidden Python 3.6.3 Documentation (32-bit) (HKLM-x32\...\{20EB04A7-B5EF-485E-9440-F36214C5501D}) (Version: 3.6.3150.0 - Python Software Foundation) Hidden Python 3.6.3 Executables (32-bit) (HKLM-x32\...\{CA16E2AA-4499-4FE5-A88C-174612920734}) (Version: 3.6.3150.0 - Python Software Foundation) Hidden Python 3.6.3 pip Bootstrap (32-bit) (HKLM-x32\...\{DA64A828-F7A9-4A19-97BD-3A9A63CEB972}) (Version: 3.6.3150.0 - Python Software Foundation) Hidden Python 3.6.3 Standard Library (32-bit) (HKLM-x32\...\{14843392-E9B3-4031-BCF6-FC00D5791AA8}) (Version: 3.6.3150.0 - Python Software Foundation) Hidden Python 3.6.3 Tcl/Tk Support (32-bit) (HKLM-x32\...\{AE89BB1E-1C06-4556-AA05-A6628DE07BA9}) (Version: 3.6.3150.0 - Python Software Foundation) Hidden Python 3.6.3 Test Suite (32-bit) (HKLM-x32\...\{63208505-67AD-4AAC-BD7B-00DE5B83BAF0}) (Version: 3.6.3150.0 - Python Software Foundation) Hidden Python 3.6.3 Utility Scripts (32-bit) (HKLM-x32\...\{6CF91DC2-CED3-410B-88BB-E048C994AA1A}) (Version: 3.6.3150.0 - Python Software Foundation) Hidden Python Launcher (HKLM-x32\...\{C093353B-F9EE-4A06-923D-C1B340B82886}) (Version: 3.6.6119.0 - Python Software Foundation) RogueKiller version 12.11.20.0 (HKLM\...\8B3D7924-ED89-486B-8322-E8594065D5CB_is1) (Version: 12.11.20.0 - Adlice Software) Roslyn Language Services - x86 (HKLM-x32\...\{79B9BF33-93CC-37A3-9377-AEB7BEFA2C08}) (Version: 14.0.25424 - Microsoft Corporation) Hidden Skype™ 7.29 (HKLM-x32\...\{FC965A47-4839-40CA-B618-18F486F042C6}) (Version: 7.29.102 - Skype Technologies S.A.) Spotify (HKU\S-1-5-21-1080822061-2706406846-2729724613-1001\...\Spotify) (Version: 1.0.63.617.g5aca9a2a - Spotify AB) swMSM (HKLM-x32\...\{612C34C7-5E90-47D8-9B5C-0F717DD82726}) (Version: 12.0.0.1 - Adobe Systems, Inc) Hidden TypeScript Power Tool (HKLM-x32\...\{F0B4CA92-9642-4BE6-8449-A786AD4FA628}) (Version: 2.2.3.0 - Microsoft Corporation) Hidden TypeScript Tools for Microsoft Visual Studio 2015 (HKLM-x32\...\{00B079B8-3A55-4804-9D9F-3D47644827CB}) (Version: 1.8.35.0 - Microsoft Corporation) Hidden Update for (KB2504637) (HKLM-x32\...\{CFEF48A8-BFB8-3EAC-8BA5-DE4F8AA267CE}.KB2504637) (Version: 1 - Microsoft Corporation) vcpp_crt.redist.clickonce (HKLM-x32\...\{93FDC294-0726-48EA-989D-50E89C67ABF0}) (Version: 14.10.25008 - Microsoft Corporation) Hidden VLC media player (HKLM\...\VLC media player) (Version: 2.2.4 - VideoLAN) VS JIT Debugger (HKLM\...\{2901E697-0E9C-404B-B7D0-6E2D43F64CE5}) (Version: 16.0.59.0 - Microsoft Corporation) Hidden VS Script Debugging Common (HKLM\...\{3B64C68E-14E0-4214-A53D-502E9FBD32E7}) (Version: 16.0.59.0 - Microsoft Corporation) Hidden VS WCF Debugging (HKLM\...\{9E1EF6F7-ED70-4BD8-A1AE-83C5DEF0DA91}) (Version: 16.0.59.0 - Microsoft Corporation) Hidden vs_BlendMsi (HKLM-x32\...\{1070C8E8-4DFB-419F-984A-5C835828897E}) (Version: 15.0.26208 - Microsoft Corporation) Hidden vs_clickoncebootstrappermsi (HKLM-x32\...\{B9F4AA09-F4AC-4108-ADA0-27CDD45FCEC3}) (Version: 15.0.26208 - Microsoft Corporation) Hidden vs_clickoncebootstrappermsires (HKLM-x32\...\{AEF5E0F2-31D1-454A-A992-C523C0007B4D}) (Version: 15.0.26208 - Microsoft Corporation) Hidden vs_clickoncesigntoolmsi (HKLM-x32\...\{DE8B48BF-82B9-434A-B254-1EA2306E5FBA}) (Version: 15.0.26208 - Microsoft Corporation) Hidden vs_communitymsi (HKLM-x32\...\{A041943F-C97B-48F6-8F23-C5078F99BB3A}) (Version: 15.0.26323 - Microsoft Corporation) Hidden vs_communitymsires (HKLM-x32\...\{1210EE60-E253-407D-B537-D36898049CF0}) (Version: 15.0.26228 - Microsoft Corporation) Hidden vs_devenvmsi (HKLM-x32\...\{581E5656-26E2-4A02-9711-48C8E4998310}) (Version: 15.0.26208 - Microsoft Corporation) Hidden vs_filehandler_amd64 (HKLM-x32\...\{15D591B0-7B40-4957-B6C0-EB7452B5AAB6}) (Version: 15.0.26228 - Microsoft Corporation) Hidden vs_filehandler_x86 (HKLM-x32\...\{DC296244-0701-4EDE-9696-05B9C1D017B3}) (Version: 15.0.26228 - Microsoft Corporation) Hidden vs_FileTracker_Singleton (HKLM-x32\...\{11230C85-1813-4BC3-9C24-E0B74B59653E}) (Version: 15.0.26208 - Microsoft Corporation) Hidden vs_minshellinteropmsi (HKLM-x32\...\{9477F337-FD16-4ACA-8217-E2D7A0F92603}) (Version: 15.0.26301 - Microsoft Corporation) Hidden vs_minshellmsi (HKLM-x32\...\{497A5ACE-DA03-4412-A110-910B2C450720}) (Version: 15.0.26424 - Microsoft Corporation) Hidden vs_minshellmsires (HKLM-x32\...\{A8B77523-13AB-46B9-B54F-5483E09668F9}) (Version: 15.0.26228 - Microsoft Corporation) Hidden vs_SQLClickOnceBootstrappermsi (HKLM-x32\...\{D396CF10-5F2B-417D-9571-0B669B99440E}) (Version: 15.0.26208 - Microsoft Corporation) Hidden vs_tipsmsi (HKLM-x32\...\{A32A9CF6-E7AA-48B8-A3D3-50C157E69F53}) (Version: 15.0.26208 - Microsoft Corporation) Hidden WIDCOMM Bluetooth Software (HKLM\...\{C6D9ED03-6FCF-4410-9CB7-45CA285F9E11}) (Version: 12.0.1.940 - Broadcom Corporation) Windows 10 Update and Privacy Settings (HKLM\...\{4DFCD818-036A-4229-A67D-CF17DC461D92}) (Version: 1.0.14.0 - Microsoft Corporation) Windows Live Essentials (HKLM-x32\...\WinLiveSuite) (Version: 16.4.3528.0331 - Microsoft Corporation) XAMPP (HKLM-x32\...\xampp) (Version: 7.1.9-0 - Bitnami) ==================== Custom CLSID (Whitelisted): ========================== (If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.) ShellIconOverlayIdentifiers: [ DropboxExt01] -> {FB314ED9-A251-47B7-93E1-CDD82E34AF8B} => C:\Program Files (x86)\Dropbox\Client\DropboxExt64.19.0.dll [2017-10-17] (Dropbox, Inc.) ShellIconOverlayIdentifiers: [ DropboxExt02] -> {FB314EDF-A251-47B7-93E1-CDD82E34AF8B} => C:\Program Files (x86)\Dropbox\Client\DropboxExt64.19.0.dll [2017-10-17] (Dropbox, Inc.) ShellIconOverlayIdentifiers: [ DropboxExt03] -> {FB314EE1-A251-47B7-93E1-CDD82E34AF8B} => C:\Program Files (x86)\Dropbox\Client\DropboxExt64.19.0.dll [2017-10-17] (Dropbox, Inc.) ShellIconOverlayIdentifiers: [ DropboxExt04] -> {FB314EDB-A251-47B7-93E1-CDD82E34AF8B} => C:\Program Files (x86)\Dropbox\Client\DropboxExt64.19.0.dll [2017-10-17] (Dropbox, Inc.) ShellIconOverlayIdentifiers: [ DropboxExt05] -> {FB314EDA-A251-47B7-93E1-CDD82E34AF8B} => C:\Program Files (x86)\Dropbox\Client\DropboxExt64.19.0.dll [2017-10-17] (Dropbox, Inc.) ShellIconOverlayIdentifiers: [ DropboxExt06] -> {FB314EDC-A251-47B7-93E1-CDD82E34AF8B} => C:\Program Files (x86)\Dropbox\Client\DropboxExt64.19.0.dll [2017-10-17] (Dropbox, Inc.) ShellIconOverlayIdentifiers: [ DropboxExt07] -> {FB314EDD-A251-47B7-93E1-CDD82E34AF8B} => C:\Program Files (x86)\Dropbox\Client\DropboxExt64.19.0.dll [2017-10-17] (Dropbox, Inc.) ShellIconOverlayIdentifiers: [ DropboxExt08] -> {FB314EE0-A251-47B7-93E1-CDD82E34AF8B} => C:\Program Files (x86)\Dropbox\Client\DropboxExt64.19.0.dll [2017-10-17] (Dropbox, Inc.) ShellIconOverlayIdentifiers: [ DropboxExt09] -> {FB314EE2-A251-47B7-93E1-CDD82E34AF8B} => C:\Program Files (x86)\Dropbox\Client\DropboxExt64.19.0.dll [2017-10-17] (Dropbox, Inc.) ShellIconOverlayIdentifiers: [ DropboxExt10] -> {FB314EDE-A251-47B7-93E1-CDD82E34AF8B} => C:\Program Files (x86)\Dropbox\Client\DropboxExt64.19.0.dll [2017-10-17] (Dropbox, Inc.) ShellIconOverlayIdentifiers-x32: [ DropboxExt01] -> {FB314ED9-A251-47B7-93E1-CDD82E34AF8B} => C:\Program Files (x86)\Dropbox\Client\DropboxExt64.19.0.dll [2017-10-17] (Dropbox, Inc.) ShellIconOverlayIdentifiers-x32: [ DropboxExt02] -> {FB314EDF-A251-47B7-93E1-CDD82E34AF8B} => C:\Program Files (x86)\Dropbox\Client\DropboxExt64.19.0.dll [2017-10-17] (Dropbox, Inc.) ShellIconOverlayIdentifiers-x32: [ DropboxExt03] -> {FB314EE1-A251-47B7-93E1-CDD82E34AF8B} => C:\Program Files (x86)\Dropbox\Client\DropboxExt64.19.0.dll [2017-10-17] (Dropbox, Inc.) ShellIconOverlayIdentifiers-x32: [ DropboxExt04] -> {FB314EDB-A251-47B7-93E1-CDD82E34AF8B} => C:\Program Files (x86)\Dropbox\Client\DropboxExt64.19.0.dll [2017-10-17] (Dropbox, Inc.) ShellIconOverlayIdentifiers-x32: [ DropboxExt05] -> {FB314EDA-A251-47B7-93E1-CDD82E34AF8B} => C:\Program Files (x86)\Dropbox\Client\DropboxExt64.19.0.dll [2017-10-17] (Dropbox, Inc.) ShellIconOverlayIdentifiers-x32: [ DropboxExt06] -> {FB314EDC-A251-47B7-93E1-CDD82E34AF8B} => C:\Program Files (x86)\Dropbox\Client\DropboxExt64.19.0.dll [2017-10-17] (Dropbox, Inc.) ShellIconOverlayIdentifiers-x32: [ DropboxExt07] -> {FB314EDD-A251-47B7-93E1-CDD82E34AF8B} => C:\Program Files (x86)\Dropbox\Client\DropboxExt64.19.0.dll [2017-10-17] (Dropbox, Inc.) ShellIconOverlayIdentifiers-x32: [ DropboxExt08] -> {FB314EE0-A251-47B7-93E1-CDD82E34AF8B} => C:\Program Files (x86)\Dropbox\Client\DropboxExt64.19.0.dll [2017-10-17] (Dropbox, Inc.) ShellIconOverlayIdentifiers-x32: [ DropboxExt09] -> {FB314EE2-A251-47B7-93E1-CDD82E34AF8B} => C:\Program Files (x86)\Dropbox\Client\DropboxExt64.19.0.dll [2017-10-17] (Dropbox, Inc.) ShellIconOverlayIdentifiers-x32: [ DropboxExt10] -> {FB314EDE-A251-47B7-93E1-CDD82E34AF8B} => C:\Program Files (x86)\Dropbox\Client\DropboxExt64.19.0.dll [2017-10-17] (Dropbox, Inc.) ContextMenuHandlers1: [7-Zip] -> {23170F69-40C1-278A-1000-000100020000} => C:\Program Files\7-Zip\7-zip.dll [2016-10-04] (Igor Pavlov) ContextMenuHandlers1: [ANotepad++64] -> {B298D29A-A6ED-11DE-BA8C-A68E55D89593} => C:\Program Files (x86)\Notepad++\NppShell_06.dll [2016-10-15] () ContextMenuHandlers1: [BB FlashBack 2] -> {A8065B9E-193F-4797-B62D-8F6321E7FCCB} => -> No File ContextMenuHandlers1: [DropboxExt] -> {ECD97DE5-3C8F-4ACB-AEEE-CCAB78F7711C} => C:\Program Files (x86)\Dropbox\Client\DropboxExt64.19.0.dll [2017-10-17] (Dropbox, Inc.) ContextMenuHandlers1: [QuickShare] -> {A8065B9E-193F-4797-B62D-8F6321E7FCCB} => -> No File ContextMenuHandlers3: [MBAMShlExt] -> {57CE581A-0CB6-4266-9CA0-19364C90A0B3} => C:\Program Files\Malwarebytes\Anti-Malware\mbshlext.dll [2017-08-30] (Malwarebytes) ContextMenuHandlers4: [7-Zip] -> {23170F69-40C1-278A-1000-000100020000} => C:\Program Files\7-Zip\7-zip.dll [2016-10-04] (Igor Pavlov) ContextMenuHandlers4: [DropboxExt] -> {ECD97DE5-3C8F-4ACB-AEEE-CCAB78F7711C} => C:\Program Files (x86)\Dropbox\Client\DropboxExt64.19.0.dll [2017-10-17] (Dropbox, Inc.) ContextMenuHandlers5: [DropboxExt] -> {ECD97DE5-3C8F-4ACB-AEEE-CCAB78F7711C} => C:\Program Files (x86)\Dropbox\Client\DropboxExt64.19.0.dll [2017-10-17] (Dropbox, Inc.) ContextMenuHandlers6: [7-Zip] -> {23170F69-40C1-278A-1000-000100020000} => C:\Program Files\7-Zip\7-zip.dll [2016-10-04] (Igor Pavlov) ContextMenuHandlers6: [MBAMShlExt] -> {57CE581A-0CB6-4266-9CA0-19364C90A0B3} => C:\Program Files\Malwarebytes\Anti-Malware\mbshlext.dll [2017-08-30] (Malwarebytes) ==================== Scheduled Tasks (Whitelisted) ============= (If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.) Task: {0B570069-5C39-4C3D-A5E8-EC9A7CBDE20E} - System32\Tasks\FRAPS => C:\Fraps\fraps.exe Task: {0EE6D554-AF7B-4C44-A2BE-7B93503A11BD} - System32\Tasks\S-1-5-21-1080822061-2706406846-2729724613-1001\DataSenseLiveTileTask => C:\WINDOWS\System32\DataUsageLiveTileTask.exe [2017-03-18] (Microsoft Corporation) Task: {211C517F-81CB-4789-AF95-506D7C8758FC} - System32\Tasks\DropboxUpdateTaskMachineUA => C:\Program Files (x86)\Dropbox\Update\DropboxUpdate.exe [2016-07-29] (Dropbox, Inc.) Task: {2BB35CC2-4A90-43BA-BBA1-7EC64425D5BB} - System32\Tasks\Intel\Intel Telemetry 2 => C:\Program Files\Intel\Telemetry 2.0\lrio.exe [2016-03-17] (Intel Corporation) Task: {347381CE-9107-47FD-B6B2-D1B921DEEA8B} - System32\Tasks\Microsoft\VisualStudio\VSIX Auto Update 14 => C:\Program Files (x86)\Microsoft Visual Studio 14.0\Common7\IDE\VSIXAutoUpdate.exe Task: {52E3CE71-2D32-4515-AAE5-3A2F01F158D5} - \IntegrationManager -> No File <==== ATTENTION Task: {57FB5EA5-893D-4D83-8165-F49F53A121B8} - System32\Tasks\{DB809003-7B2F-44E7-83F1-49431DD04D9F} => C:\WINDOWS\system32\pcalua.exe -a "C:\Users\jtssh\AppData\Local\Uninstall Groovy\uninstall.exe" Task: {5F55561F-080F-48CC-B31D-6EC1CE4BA37B} - System32\Tasks\JavaUpdateSched => C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe [2017-08-02] (Oracle Corporation) Task: {63723301-D846-41ED-BE41-A063331E6980} - System32\Tasks\USER_ESRV_SVC_WILLAMETTE => "C:\Windows\System32\Wscript.exe" //B //NoLogo "C:\Program Files\Intel\SUR\WILLAMETTE\ESRV\task.vbs" Task: {6FD83A72-7E4A-496C-B6D6-6B6A543F7B9B} - System32\Tasks\{428BB90D-5CD7-4A7A-9D4B-96F59BEBAF19} => C:\WINDOWS\system32\pcalua.exe -a C:\Users\jtssh\AppData\Local\uninstallro.exe Task: {74907AC4-031A-469A-8234-50B909BF408E} - System32\Tasks\update-S-1-5-21-1080822061-2706406846-2729724613-1001 => C:\Program Files (x86)\Skillbrains\Updater\Updater.exe [2017-04-12] (TODO: <Company name>) Task: {7C223D8A-6A48-4180-A874-C3897016E9B7} - System32\Tasks\GoogleUpdateTaskMachineUA => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe [2016-10-21] (Google Inc.) Task: {81DF79A7-36FB-4BC8-8B41-D4B1854FED1A} - System32\Tasks\CCleanerSkipUAC => C:\Program Files\CCleaner\CCleaner.exe [2017-09-20] (Piriform Ltd) Task: {A412AE11-ADB8-4030-BFB5-17BDF0FDA490} - System32\Tasks\update-sys => C:\Program Files (x86)\Skillbrains\Updater\Updater.exe [2017-04-12] (TODO: <Company name>) Task: {AAD2F337-DB36-4DFE-B03F-49B90C889503} - System32\Tasks\DropboxUpdateTaskMachineCore => C:\Program Files (x86)\Dropbox\Update\DropboxUpdate.exe [2016-07-29] (Dropbox, Inc.) Task: {BB972551-76BF-486C-A928-B74D88E15DEC} - System32\Tasks\GoogleUpdateTaskMachineCore => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe [2016-10-21] (Google Inc.) (If an entry is included in the fixlist, the task (.job) file will be moved. The file which is running by the task will not be moved.) Task: C:\WINDOWS\Tasks\DropboxUpdateTaskMachineCore.job => C:\Program Files (x86)\Dropbox\Update\DropboxUpdate.exe Task: C:\WINDOWS\Tasks\DropboxUpdateTaskMachineUA.job => C:\Program Files (x86)\Dropbox\Update\DropboxUpdate.exe Task: C:\WINDOWS\Tasks\update-S-1-5-21-1080822061-2706406846-2729724613-1001.job => C:\Program Files (x86)\Skillbrains\Updater\Updater.exe Task: C:\WINDOWS\Tasks\update-sys.job => C:\Program Files (x86)\Skillbrains\Updater\Updater.exe ==================== Shortcuts & WMI ======================== (The entries could be listed to be restored or removed.) ==================== Loaded Modules (Whitelisted) ============== 2017-10-17 18:53 - 2017-10-04 13:15 - 002289096 _____ () C:\PROGRAM FILES\MALWAREBYTES\ANTI-MALWARE\SelfProtectionSdk.dll 2017-10-17 18:53 - 2017-10-04 13:15 - 002358728 _____ () C:\PROGRAM FILES\MALWAREBYTES\ANTI-MALWARE\MwacLib.dll 2016-02-17 09:43 - 2016-02-17 09:43 - 000049408 _____ () C:\Program Files\WIDCOMM\Bluetooth Software\btwleapi.dll 2017-03-18 16:58 - 2017-03-18 16:58 - 000138000 _____ () C:\WINDOWS\SYSTEM32\inputhost.dll 2016-10-15 21:19 - 2016-10-15 21:19 - 000230064 _____ () C:\Program Files (x86)\Notepad++\NppShell_06.dll 2017-10-14 19:18 - 2017-10-09 20:22 - 000319984 ____N () C:\Users\jtssh\OneDrive\Documents\Archives\UnZipped\eclipse\eclipse.exe 2017-10-14 19:18 - 2017-09-28 14:37 - 000057856 ____N () C:\Users\jtssh\OneDrive\Documents\Archives\UnZipped\eclipse\plugins\org.eclipse.equinox.launcher.win32.win32.x86_64_1.1.550.v20170928-1359\eclipse_1629.dll 2017-10-14 20:51 - 2017-10-14 20:51 - 000055296 _____ () C:\Users\jtssh\OneDrive\Documents\Archives\UnZipped\eclipse\configuration\org.eclipse.osgi\90\0\.cp\os\win32\x86_64\localfile_1_0_0.dll 2017-10-14 20:46 - 2017-10-14 20:46 - 000044032 _____ () C:\Users\jtssh\OneDrive\Documents\Archives\UnZipped\eclipse\configuration\org.eclipse.osgi\93\0\.cp\jWinHttp-1.0.0.dll 2017-09-26 20:04 - 2017-09-21 03:29 - 002692440 _____ () C:\Program Files (x86)\Google\Chrome\Application\61.0.3163.100\swiftshader\libglesv2.dll 2017-09-26 20:04 - 2017-09-21 03:29 - 000138584 _____ () C:\Program Files (x86)\Google\Chrome\Application\61.0.3163.100\swiftshader\libegl.dll 2017-03-18 16:59 - 2017-03-18 22:30 - 001731072 _____ () C:\Windows\SystemApps\Microsoft.Windows.Cortana_cw5n1h2txyewy\Cortana.Core.dll 2017-10-16 19:23 - 2017-10-16 19:31 - 000021504 _____ () C:\Program Files\WindowsApps\Microsoft.Windows.Photos_2017.39081.15820.0_x64__8wekyb3d8bbwe\Microsoft.Photos.exe 2017-10-16 19:23 - 2017-10-16 19:27 - 048839168 _____ () C:\Program Files\WindowsApps\Microsoft.Windows.Photos_2017.39081.15820.0_x64__8wekyb3d8bbwe\Microsoft.Photos.dll 2017-10-16 19:23 - 2017-10-16 19:31 - 002523136 _____ () C:\Program Files\WindowsApps\Microsoft.Windows.Photos_2017.39081.15820.0_x64__8wekyb3d8bbwe\UnityEngineDelegates.dll 2017-10-16 19:23 - 2017-10-16 19:31 - 000164352 _____ () C:\Program Files\WindowsApps\Microsoft.Windows.Photos_2017.39081.15820.0_x64__8wekyb3d8bbwe\VideoPlugin.dll 2017-10-16 19:23 - 2017-10-16 19:31 - 000352256 _____ () C:\Program Files\WindowsApps\Microsoft.Windows.Photos_2017.39081.15820.0_x64__8wekyb3d8bbwe\Microsoft.Photos.AGM.Native.Windows.dll 2017-10-16 19:23 - 2017-10-16 19:31 - 000675328 _____ () C:\Program Files\WindowsApps\Microsoft.Windows.Photos_2017.39081.15820.0_x64__8wekyb3d8bbwe\IPPNativePlugin.dll 2017-10-16 19:23 - 2017-10-16 19:31 - 002836480 _____ () C:\Program Files\WindowsApps\Microsoft.Windows.Photos_2017.39081.15820.0_x64__8wekyb3d8bbwe\MediaEngineCSWrapper.dll 2017-10-16 19:23 - 2017-10-16 19:31 - 020559872 _____ () C:\Program Files\WindowsApps\Microsoft.Windows.Photos_2017.39081.15820.0_x64__8wekyb3d8bbwe\PhotosApp.Windows.dll 2017-10-16 19:23 - 2017-10-16 19:31 - 002705408 _____ () C:\Program Files\WindowsApps\Microsoft.Windows.Photos_2017.39081.15820.0_x64__8wekyb3d8bbwe\MediaEngine.dll 2017-10-16 19:22 - 2017-10-16 19:28 - 003128320 _____ () C:\Program Files\WindowsApps\Microsoft.Windows.Photos_2017.39081.15820.0_x64__8wekyb3d8bbwe\AppCore.Windows.dll 2017-09-28 14:03 - 2017-09-28 18:37 - 003553704 _____ () C:\Program Files\WindowsApps\Microsoft.Windows.Photos_2017.39081.15820.0_x64__8wekyb3d8bbwe\Microsoft.UI.Xaml.dll 2017-10-16 19:23 - 2017-10-16 19:31 - 000118784 _____ () C:\Program Files\WindowsApps\Microsoft.Windows.Photos_2017.39081.15820.0_x64__8wekyb3d8bbwe\ExploreModel.dll 2017-10-16 19:23 - 2017-10-16 19:31 - 000046080 _____ () C:\Program Files\WindowsApps\Microsoft.Windows.Photos_2017.39081.15820.0_x64__8wekyb3d8bbwe\Microsoft.Photos.Edit.Services.dll 2017-10-16 19:23 - 2017-10-16 19:31 - 001380864 _____ () C:\Program Files\WindowsApps\Microsoft.Windows.Photos_2017.39081.15820.0_x64__8wekyb3d8bbwe\Microsoft.RichMedia.Ink.Controls.dll 2017-10-16 19:22 - 2017-10-16 19:28 - 000367616 _____ () C:\Program Files\WindowsApps\Microsoft.Windows.Photos_2017.39081.15820.0_x64__8wekyb3d8bbwe\AnimatedGIF.dll 2017-10-20 20:09 - 2017-10-17 11:48 - 000771904 _____ () C:\Program Files (x86)\Dropbox\Client\dropbox_watchdog.dll 2017-10-20 20:09 - 2017-10-17 11:48 - 001804608 _____ () C:\Program Files (x86)\Dropbox\Client\dropbox_crashpad.dll 2017-10-04 21:13 - 2017-10-17 11:47 - 000100296 _____ () C:\Program Files (x86)\Dropbox\Client\_ctypes.pyd 2017-10-04 21:13 - 2017-10-17 11:47 - 000018888 _____ () C:\Program Files (x86)\Dropbox\Client\select.pyd 2017-10-04 21:13 - 2017-10-17 11:50 - 000020800 _____ () C:\Program Files (x86)\Dropbox\Client\tornado.speedups.pyd 2017-10-04 21:13 - 2017-10-17 11:47 - 000035792 _____ () C:\Program Files (x86)\Dropbox\Client\_multiprocessing.pyd 2017-10-04 21:13 - 2017-10-17 11:47 - 000694224 _____ () C:\Program Files (x86)\Dropbox\Client\unicodedata.pyd 2017-10-20 20:09 - 2017-10-17 11:49 - 000021848 _____ () C:\Program Files (x86)\Dropbox\Client\cryptography.hazmat.bindings._constant_time.pyd 2017-10-04 21:13 - 2017-10-17 11:47 - 000130512 _____ () C:\Program Files (x86)\Dropbox\Client\_cffi_backend.pyd 2017-10-20 20:09 - 2017-10-17 11:49 - 001856848 _____ () C:\Program Files (x86)\Dropbox\Client\cryptography.hazmat.bindings._openssl.pyd 2017-10-20 20:09 - 2017-10-17 11:49 - 000022864 _____ () C:\Program Files (x86)\Dropbox\Client\cryptography.hazmat.bindings._padding.pyd 2017-10-20 20:09 - 2017-10-17 11:47 - 000145864 _____ () C:\Program Files (x86)\Dropbox\Client\pyexpat.pyd 2017-10-20 20:09 - 2017-10-17 11:48 - 000116688 _____ () C:\Program Files (x86)\Dropbox\Client\pywintypes27.dll 2017-10-04 21:13 - 2017-10-17 11:47 - 000105928 _____ () C:\Program Files (x86)\Dropbox\Client\win32api.pyd 2017-10-04 21:13 - 2017-10-17 11:50 - 000022864 _____ () C:\Program Files (x86)\Dropbox\Client\winffi.crt.compiled._winffi_crt.pyd 2017-10-20 20:09 - 2017-10-17 11:49 - 000062784 _____ () C:\Program Files (x86)\Dropbox\Client\psutil._psutil_windows.pyd 2017-10-04 21:13 - 2017-10-17 11:47 - 000024528 _____ () C:\Program Files (x86)\Dropbox\Client\win32event.pyd 2017-10-20 20:09 - 2017-10-17 11:49 - 000040248 _____ () C:\Program Files (x86)\Dropbox\Client\fastpath.pyd 2017-10-20 20:09 - 2017-10-17 11:47 - 000020936 _____ () C:\Program Files (x86)\Dropbox\Client\mmapfile.pyd 2017-10-04 21:13 - 2017-10-17 11:47 - 000124880 _____ () C:\Program Files (x86)\Dropbox\Client\win32file.pyd 2017-10-04 21:13 - 2017-10-17 11:47 - 000116176 _____ () C:\Program Files (x86)\Dropbox\Client\win32security.pyd 2017-10-20 20:09 - 2017-10-17 11:48 - 000392656 _____ () C:\Program Files (x86)\Dropbox\Client\pythoncom27.dll 2017-10-04 21:13 - 2017-10-17 11:50 - 000392512 _____ () C:\Program Files (x86)\Dropbox\Client\win32com.shell.shell.pyd 2017-10-04 21:13 - 2017-10-17 11:50 - 000026456 _____ () C:\Program Files (x86)\Dropbox\Client\winffi.kernel32.compiled._winffi_kernel32.pyd 2017-10-04 21:13 - 2017-10-17 11:47 - 000024016 _____ () C:\Program Files (x86)\Dropbox\Client\win32clipboard.pyd 2017-10-04 21:13 - 2017-10-17 11:47 - 000175560 _____ () C:\Program Files (x86)\Dropbox\Client\win32gui.pyd 2017-10-04 21:13 - 2017-10-17 11:47 - 000030160 _____ () C:\Program Files (x86)\Dropbox\Client\win32pipe.pyd 2017-10-04 21:13 - 2017-10-17 11:47 - 000043472 _____ () C:\Program Files (x86)\Dropbox\Client\win32process.pyd 2017-10-04 21:13 - 2017-10-17 11:47 - 000026056 _____ () C:\Program Files (x86)\Dropbox\Client\win32job.pyd 2017-10-04 21:13 - 2017-10-17 11:47 - 000048592 _____ () C:\Program Files (x86)\Dropbox\Client\win32service.pyd 2017-10-04 21:13 - 2017-10-17 11:47 - 000057808 _____ () C:\Program Files (x86)\Dropbox\Client\win32evtlog.pyd 2017-10-20 20:09 - 2017-10-17 11:49 - 000021824 _____ () C:\Program Files (x86)\Dropbox\Client\cpuid.compiled._cpuid.pyd 2017-10-04 21:13 - 2017-10-17 11:50 - 000023368 _____ () C:\Program Files (x86)\Dropbox\Client\winshell.compiled._winshell.pyd 2017-10-20 20:09 - 2017-10-17 11:49 - 000022856 _____ () C:\Program Files (x86)\Dropbox\Client\crashpad.compiled._Crashpad.pyd 2017-10-04 21:13 - 2017-10-17 11:50 - 000066392 _____ () C:\Program Files (x86)\Dropbox\Client\winenumhandles.compiled._WinEnumHandles.pyd 2017-10-20 20:09 - 2017-10-17 11:49 - 001796920 _____ () C:\Program Files (x86)\Dropbox\Client\PyQt5.QtCore.pyd 2017-10-04 21:13 - 2017-10-17 11:47 - 000084424 _____ () C:\Program Files (x86)\Dropbox\Client\sip.pyd 2017-10-20 20:09 - 2017-10-17 11:49 - 001956152 _____ () C:\Program Files (x86)\Dropbox\Client\PyQt5.QtGui.pyd 2017-10-20 20:09 - 2017-10-17 11:49 - 003859264 _____ () C:\Program Files (x86)\Dropbox\Client\PyQt5.QtWidgets.pyd 2017-10-20 20:09 - 2017-10-17 11:49 - 000154440 _____ () C:\Program Files (x86)\Dropbox\Client\PyQt5.QtWebEngineWidgets.pyd 2017-10-20 20:09 - 2017-10-17 11:49 - 000521024 _____ () C:\Program Files (x86)\Dropbox\Client\PyQt5.QtNetwork.pyd 2017-10-20 20:09 - 2017-10-17 11:49 - 000045888 _____ () C:\Program Files (x86)\Dropbox\Client\PyQt5.QtWebEngineCore.pyd 2017-10-20 20:09 - 2017-10-17 11:49 - 000042304 _____ () C:\Program Files (x86)\Dropbox\Client\PyQt5.QtWebChannel.pyd 2017-10-20 20:09 - 2017-10-17 11:49 - 000131384 _____ () C:\Program Files (x86)\Dropbox\Client\PyQt5.QtWebKit.pyd 2017-10-20 20:09 - 2017-10-17 11:49 - 000218944 _____ () C:\Program Files (x86)\Dropbox\Client\PyQt5.QtWebKitWidgets.pyd 2017-10-20 20:09 - 2017-10-17 11:49 - 000204096 _____ () C:\Program Files (x86)\Dropbox\Client\PyQt5.QtPrintSupport.pyd 2017-10-04 21:13 - 2017-10-17 11:50 - 000025432 _____ () C:\Program Files (x86)\Dropbox\Client\winscreenshot.compiled._CaptureScreenshot.pyd 2017-10-04 21:13 - 2017-10-17 11:47 - 000060880 _____ () C:\Program Files (x86)\Dropbox\Client\win32print.pyd 2017-10-04 21:13 - 2017-10-17 11:50 - 000054608 _____ () C:\Program Files (x86)\Dropbox\Client\winrpcserver.compiled._RPCServer.pyd 2017-10-04 21:13 - 2017-10-17 11:47 - 000024016 _____ () C:\Program Files (x86)\Dropbox\Client\win32profile.pyd 2017-10-04 21:13 - 2017-10-17 11:50 - 000022864 _____ () C:\Program Files (x86)\Dropbox\Client\winffi.user32.compiled._winffi_user32.pyd 2017-10-04 21:13 - 2017-10-17 11:50 - 000100688 _____ () C:\Program Files (x86)\Dropbox\Client\windisplaytoast.compiled._DisplayToast.pyd 2017-10-04 21:13 - 2017-10-17 11:47 - 000028616 _____ () C:\Program Files (x86)\Dropbox\Client\win32ts.pyd 2017-10-04 21:13 - 2017-10-17 11:50 - 000022360 _____ () C:\Program Files (x86)\Dropbox\Client\winffi.iphlpapi.compiled._winffi_iphlpapi.pyd 2017-10-04 21:13 - 2017-10-17 11:50 - 000021848 _____ () C:\Program Files (x86)\Dropbox\Client\winffi.winerror.compiled._winffi_winerror.pyd 2017-10-04 21:13 - 2017-10-17 11:50 - 000022360 _____ () C:\Program Files (x86)\Dropbox\Client\winffi.wininet.compiled._winffi_wininet.pyd 2017-10-20 20:09 - 2017-10-17 11:49 - 000027488 _____ () C:\Program Files (x86)\Dropbox\Client\dropbox.infinite.win.compiled._driverinstallation.pyd 2017-10-04 21:13 - 2017-10-17 11:47 - 000349128 _____ () C:\Program Files (x86)\Dropbox\Client\winxpgui.pyd 2017-10-20 20:09 - 2017-10-17 11:49 - 000101184 _____ () C:\Program Files (x86)\Dropbox\Client\PyQt5.QtWinExtras.pyd 2017-10-04 21:13 - 2017-10-17 11:50 - 000023896 _____ () C:\Program Files (x86)\Dropbox\Client\winverifysignature.compiled._VerifySignature.pyd 2017-10-20 20:09 - 2017-10-17 11:49 - 000025424 _____ () C:\Program Files (x86)\Dropbox\Client\librsyncffi.compiled._librsyncffi.pyd 2017-10-20 20:09 - 2017-10-17 11:48 - 000036296 _____ () C:\Program Files (x86)\Dropbox\Client\librsync.dll 2017-10-20 20:09 - 2017-10-17 11:49 - 000032600 _____ () C:\Program Files (x86)\Dropbox\Client\enterprise_data.compiled._enterprise_data.pyd 2017-10-20 20:09 - 2017-10-17 11:48 - 000293392 _____ () C:\Program Files (x86)\Dropbox\Client\EnterpriseDataAdapter.dll 2017-10-20 20:09 - 2017-10-17 11:49 - 000181056 _____ () C:\Program Files (x86)\Dropbox\Client\dropbox_sqlite_ext.DLL 2017-10-04 21:13 - 2017-10-17 11:50 - 000030536 _____ () C:\Program Files (x86)\Dropbox\Client\wind3d11.compiled._wind3d11.pyd 2017-10-20 20:09 - 2017-10-17 11:49 - 000024368 _____ () C:\Program Files (x86)\Dropbox\Client\libEGL.DLL 2017-10-20 20:09 - 2017-10-17 11:49 - 001638200 _____ () C:\Program Files (x86)\Dropbox\Client\libGLESv2.dll 2017-10-20 20:09 - 2017-10-17 11:48 - 014419408 _____ () C:\Program Files (x86)\Dropbox\Client\opengl32sw.dll 2017-10-04 21:13 - 2017-10-17 11:50 - 000026456 _____ () C:\Program Files (x86)\Dropbox\Client\winffi.winhttp.compiled._winffi_winhttp.pyd 2017-10-20 12:03 - 2017-10-20 08:35 - 001893880 _____ () C:\Users\jtssh\AppData\Local\DiscordCanary\app-0.0.167\ffmpeg.dll 2017-10-20 15:41 - 2017-10-21 11:40 - 001596920 _____ () \\?\C:\Users\jtssh\AppData\Roaming\discordcanary\0.0.167\modules\discord_toaster\discord_toaster.node 2017-10-20 15:41 - 2017-10-21 11:40 - 009722360 _____ () \\?\C:\Users\jtssh\AppData\Roaming\discordcanary\0.0.167\modules\discord_voice\discord_voice.node 2017-10-20 15:41 - 2017-10-21 11:40 - 001465336 _____ () \\?\C:\Users\jtssh\AppData\Roaming\discordcanary\0.0.167\modules\discord_utils\discord_utils.node 2017-10-21 11:41 - 2017-10-21 11:41 - 000148992 _____ () \\?\C:\Users\jtssh\AppData\Local\Temp\45AD.tmp.node 2017-10-20 15:41 - 2017-10-21 11:40 - 002658296 _____ () \\?\C:\Users\jtssh\AppData\Roaming\discordcanary\0.0.167\modules\discord_rpc\discord_rpc.node 2017-10-20 15:44 - 2017-10-21 11:40 - 002686456 _____ () \\?\C:\Users\jtssh\AppData\Roaming\discordcanary\0.0.167\modules\discord_contact_import\discord_contact_import.node ==================== Alternate Data Streams (Whitelisted) ========= (If an entry is included in the fixlist, only the ADS will be removed.) ==================== Safe Mode (Whitelisted) =================== (If an entry is included in the fixlist, it will be removed from the registry. The "AlternateShell" will be restored.) HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\MBAMService => ""="Service" HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\MBAMService => ""="Service" ==================== Association (Whitelisted) =============== (If an entry is included in the fixlist, the registry item will be restored to default or removed.) ==================== Internet Explorer trusted/restricted =============== (If an entry is included in the fixlist, it will be removed from the registry.) ==================== Hosts content: =============================== (If needed Hosts: directive could be included in the fixlist to reset Hosts.) 2015-10-30 03:24 - 2015-10-30 03:21 - 000000824 _____ C:\WINDOWS\system32\Drivers\etc\hosts ==================== Other Areas ============================ (Currently there is no automatic fix for this section.) HKU\S-1-5-21-1080822061-2706406846-2729724613-1001\Control Panel\Desktop\\Wallpaper -> C:\Users\jtssh\AppData\Roaming\Microsoft\Windows\Themes\TranscodedWallpaper DNS Servers: 192.168.1.1 HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System => (ConsentPromptBehaviorAdmin: 5) (ConsentPromptBehaviorUser: 3) (EnableLUA: 1) HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer => (SmartScreenEnabled: Off) Windows Firewall is enabled. ==================== MSCONFIG/TASK MANAGER disabled items == HKLM\...\StartupApproved\Run: => "iTunesHelper" HKU\S-1-5-21-1080822061-2706406846-2729724613-1001\...\StartupApproved\Run: => "OneDrive" HKU\S-1-5-21-1080822061-2706406846-2729724613-1001\...\StartupApproved\Run: => "Spotify" HKU\S-1-5-21-1080822061-2706406846-2729724613-1001\...\StartupApproved\Run: => "Spotify Web Helper" ==================== FirewallRules (Whitelisted) =============== (If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.) FirewallRules: [VIRT-MIGL-In-TCP-NoScope] => (Allow) %systemroot%\system32\vmms.exe FirewallRules: [VIRT-REMOTEDESKTOP-In-TCP-NoScope] => (Allow) %systemroot%\system32\vmms.exe FirewallRules: [UDP Query User{51527540-4309-4FE0-A068-1326B97D7E5F}C:\program files\java\jdk1.8.0_144\bin\java.exe] => (Allow) C:\program files\java\jdk1.8.0_144\bin\java.exe FirewallRules: [TCP Query User{7EF645B7-A28A-4A7E-9612-5EAE859E6B0C}C:\program files\java\jdk1.8.0_144\bin\java.exe] => (Allow) C:\program files\java\jdk1.8.0_144\bin\java.exe FirewallRules: [UDP Query User{F787923A-A812-4F17-9DA8-370D4C697903}C:\program files\java\jre-9\bin\java.exe] => (Allow) C:\program files\java\jre-9\bin\java.exe FirewallRules: [TCP Query User{08743B80-B695-485A-BFE1-F2CAF68B38EB}C:\program files\java\jre-9\bin\java.exe] => (Allow) C:\program files\java\jre-9\bin\java.exe FirewallRules: [UDP Query User{FE874C61-B8B0-4088-BF91-3BC5CF2EE9E0}C:\program files\java\jre1.8.0_144\bin\java.exe] => (Allow) C:\program files\java\jre1.8.0_144\bin\java.exe FirewallRules: [TCP Query User{6260AC70-E4B4-436F-9F10-DA9F4D0F12A8}C:\program files\java\jre1.8.0_144\bin\java.exe] => (Allow) C:\program files\java\jre1.8.0_144\bin\java.exe FirewallRules: [UDP Query User{F14F875B-9F27-4244-A0A5-86233741D856}C:\xampp\mysql\bin\mysqld.exe] => (Allow) C:\xampp\mysql\bin\mysqld.exe FirewallRules: [TCP Query User{B7F9BDE9-6022-4BD1-8972-20075EB78B79}C:\xampp\mysql\bin\mysqld.exe] => (Allow) C:\xampp\mysql\bin\mysqld.exe FirewallRules: [UDP Query User{D7FB7A89-937A-4FE0-AD2F-1C63E47A94D1}C:\xampp\apache\bin\httpd.exe] => (Allow) C:\xampp\apache\bin\httpd.exe FirewallRules: [TCP Query User{73D30D09-86C6-497C-9FE0-FBB907763A36}C:\xampp\apache\bin\httpd.exe] => (Allow) C:\xampp\apache\bin\httpd.exe FirewallRules: [{431AE09C-52EE-41EB-90CC-DA0A62D8AB23}] => (Allow) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe FirewallRules: [UDP Query User{B9179569-2CA4-4B91-8C02-87C015A74CDD}C:\program files\nodejs\node.exe] => (Allow) C:\program files\nodejs\node.exe FirewallRules: [TCP Query User{D6E7A29B-D8AE-499D-92BC-7AB0C3824458}C:\program files\nodejs\node.exe] => (Allow) C:\program files\nodejs\node.exe FirewallRules: [UDP Query User{C56ACF73-5399-4C71-84C9-397717D2B20A}C:\users\jtssh\onedrive\documents\shiftos\shiftos.server.exe] => (Block) C:\users\jtssh\onedrive\documents\shiftos\shiftos.server.exe FirewallRules: [TCP Query User{5670A1E2-97C3-46D7-9541-4401EDB3D075}C:\users\jtssh\onedrive\documents\shiftos\shiftos.server.exe] => (Block) C:\users\jtssh\onedrive\documents\shiftos\shiftos.server.exe FirewallRules: [{01788481-89ED-46E9-8D1D-CADE490BFB9A}] => (Allow) C:\Program Files (x86)\Mozilla Firefox\firefox.exe FirewallRules: [UDP Query User{74F17282-3177-4A6F-8C96-DE31331D4DCD}C:\program files (x86)\microsoft vs code\code.exe] => (Allow) C:\program files (x86)\microsoft vs code\code.exe FirewallRules: [TCP Query User{764F17B3-35B5-4711-8B2F-0BE889D084DB}C:\program files (x86)\microsoft vs code\code.exe] => (Allow) C:\program files (x86)\microsoft vs code\code.exe FirewallRules: [{410CC170-B0DD-4C8F-B270-4BC061904A78}] => (Allow) C:\WINDOWS\system32\rundll32.exe FirewallRules: [{5176D716-0A67-4CF8-8FB0-3D731B16F79D}] => (Allow) C:\Program Files (x86)\Skype\Phone\Skype.exe FirewallRules: [TCP Query User{ED41E0A7-08EF-4505-AD12-D98F60B36C08}C:\users\jtssh\appdata\roaming\spotify\spotify.exe] => (Allow) C:\users\jtssh\appdata\roaming\spotify\spotify.exe FirewallRules: [UDP Query User{62C5BE0A-7CFD-4056-A17E-FBBC970FE874}C:\users\jtssh\appdata\roaming\spotify\spotify.exe] => (Allow) C:\users\jtssh\appdata\roaming\spotify\spotify.exe FirewallRules: [{0D7AFA95-1DFA-48F1-9689-EC77FDBB9311}] => (Allow) C:\Program Files (x86)\Windows Live\Contacts\wlcomm.exe FirewallRules: [{4311A248-BAB2-4303-834F-F1913C70FFC9}] => (Allow) LPort=2869 FirewallRules: [{D3961733-6979-4D3A-B1FD-214B29EBC718}] => (Allow) LPort=1900 FirewallRules: [{721994F1-86B5-4038-BBF1-FFEEBDCE7BD7}] => (Allow) C:\Program Files (x86)\Dropbox\Client\Dropbox.exe ==================== Restore Points ========================= 16-10-2017 20:57:27 Windows Update ==================== Faulty Device Manager Devices ============= ==================== Event log errors: ========================= Application errors: ================== Error: (10/21/2017 08:55:47 AM) (Source: Microsoft-Windows-Immersive-Shell) (EventID: 5973) (User: JUSTIN-PC) Description: Activation of app Microsoft.Windows.ShellExperienceHost_cw5n1h2txyewy!App failed with error: -2144927142 See the Microsoft-Windows-TWinUI/Operational log for additional information. Error: (10/20/2017 09:57:47 PM) (Source: Microsoft Security Client) (EventID: 5000) (User: ) Description: Event-ID 5000 Error: (10/20/2017 09:57:47 PM) (Source: Microsoft Security Client) (EventID: 5000) (User: ) Description: Event-ID 5000 Error: (10/20/2017 09:57:13 PM) (Source: Microsoft Security Client) (EventID: 5000) (User: ) Description: Event-ID 5000 Error: (10/20/2017 09:33:30 PM) (Source: Microsoft-Windows-Immersive-Shell) (EventID: 2484) (User: JUSTIN-PC) Description: Package Microsoft.WindowsCamera_2017.727.40.0_x64__8wekyb3d8bbwe+App was terminated because it took too long to suspend. Error: (10/20/2017 03:49:40 PM) (Source: Microsoft-Windows-Immersive-Shell) (EventID: 2484) (User: JUSTIN-PC) Description: Package Microsoft.Windows.Cortana_1.8.12.15063_neutral_neutral_cw5n1h2txyewy+CortanaUI was terminated because it took too long to suspend. Error: (10/20/2017 03:48:25 PM) (Source: Application Hang) (EventID: 1002) (User: ) Description: The program mbam.exe version 3.0.0.1169 stopped interacting with Windows and was closed. To see if more information about the problem is available, check the problem history in the Security and Maintenance control panel. Process ID: 1d2c Start Time: 01d3493f0543a89b Termination Time: 5733 Application Path: C:\Program Files\Malwarebytes\Anti-Malware\mbam.exe Report Id: 71917303-3815-4b23-b306-ce021b0e76c0 Faulting package full name: Faulting package-relative application ID: Error: (10/20/2017 03:48:11 PM) (Source: Microsoft-Windows-Immersive-Shell) (EventID: 2484) (User: JUSTIN-PC) Description: Package Microsoft.Windows.ShellExperienceHost_10.0.15063.674_neutral_neutral_cw5n1h2txyewy+App was terminated because it took too long to suspend. Error: (10/20/2017 10:25:09 AM) (Source: Microsoft-Windows-Immersive-Shell) (EventID: 5973) (User: JUSTIN-PC) Description: Activation of app Microsoft.ZuneMusic_8wekyb3d8bbwe!Microsoft.ZuneMusic failed with error: -2144927142 See the Microsoft-Windows-TWinUI/Operational log for additional information. Error: (10/19/2017 11:25:10 PM) (Source: Microsoft Security Client) (EventID: 5000) (User: ) Description: Event-ID 5000 System errors: ============= Error: (10/21/2017 08:55:50 AM) (Source: NetBT) (EventID: 4321) (User: ) Description: The name "JUSTIN-PC :20" could not be registered on the interface with IP address 192.168.1.15. The computer with the IP address 192.168.1.11 did not allow the name to be claimed by this computer. Error: (10/21/2017 08:55:50 AM) (Source: NetBT) (EventID: 4321) (User: ) Description: The name "JUSTIN-PC :0" could not be registered on the interface with IP address 192.168.1.15. The computer with the IP address 192.168.1.11 did not allow the name to be claimed by this computer. Error: (10/21/2017 08:55:50 AM) (Source: Server) (EventID: 2505) (User: ) Description: The server could not bind to the transport \Device\NetBT_Tcpip_{B8E0A0D9-E8DE-43C8-8002-349F40B91070} because another computer on the network has the same name. The server could not start. Error: (10/21/2017 08:54:46 AM) (Source: DCOM) (EventID: 10016) (User: NT AUTHORITY) Description: The application-specific permission settings do not grant Local Activation permission for the COM Server application with CLSID {D63B10C5-BB46-4990-A94F-E40B9D520160} and APPID {9CA88EE3-ACB7-47C8-AFC4-AB702511C276} to the user NT AUTHORITY\SYSTEM SID (S-1-5-18) from address LocalHost (Using LRPC) running in the application container Unavailable SID (Unavailable). This security permission can be modified using the Component Services administrative tool. Error: (10/20/2017 10:35:35 PM) (Source: DCOM) (EventID: 10016) (User: JUSTIN-PC) Description: The machine-default permission settings do not grant Local Activation permission for the COM Server application with CLSID {C2F03A33-21F5-47FA-B4BB-156362A2F239} and APPID {316CDED5-E4AE-4B15-9113-7055D84DCC97} to the user JUSTIN-PC\jtssh SID (S-1-5-21-1080822061-2706406846-2729724613-1001) from address LocalHost (Using LRPC) running in the application container Microsoft.Windows.Cortana_1.8.12.15063_neutral_neutral_cw5n1h2txyewy SID (S-1-15-2-1861897761-1695161497-2927542615-642690995-327840285-2659745135-2630312742). This security permission can be modified using the Component Services administrative tool. Error: (10/20/2017 10:35:35 PM) (Source: DCOM) (EventID: 10016) (User: JUSTIN-PC) Description: The machine-default permission settings do not grant Local Activation permission for the COM Server application with CLSID {C2F03A33-21F5-47FA-B4BB-156362A2F239} and APPID {316CDED5-E4AE-4B15-9113-7055D84DCC97} to the user JUSTIN-PC\jtssh SID (S-1-5-21-1080822061-2706406846-2729724613-1001) from address LocalHost (Using LRPC) running in the application container Microsoft.Windows.Cortana_1.8.12.15063_neutral_neutral_cw5n1h2txyewy SID (S-1-15-2-1861897761-1695161497-2927542615-642690995-327840285-2659745135-2630312742). This security permission can be modified using the Component Services administrative tool. Error: (10/20/2017 09:56:54 PM) (Source: NetBT) (EventID: 4321) (User: ) Description: The name "JUSTIN-PC :0" could not be registered on the interface with IP address 192.168.1.15. The computer with the IP address 192.168.1.11 did not allow the name to be claimed by this computer. Error: (10/20/2017 09:56:53 PM) (Source: NetBT) (EventID: 4321) (User: ) Description: The name "JUSTIN-PC :0" could not be registered on the interface with IP address 192.168.1.15. The computer with the IP address 192.168.1.11 did not allow the name to be claimed by this computer. Error: (10/20/2017 09:56:53 PM) (Source: NetBT) (EventID: 4321) (User: ) Description: The name "JUSTIN-PC :0" could not be registered on the interface with IP address 192.168.1.15. The computer with the IP address 192.168.1.11 did not allow the name to be claimed by this computer. Error: (10/20/2017 08:43:02 PM) (Source: Service Control Manager) (EventID: 7022) (User: ) Description: The Delivery Optimization service hung on starting. ==================== Memory info =========================== Processor: Intel(R) Core(TM)2 Duo CPU E6750 @ 2.66GHz Percentage of memory in use: 49% Total physical RAM: 8052.61 MB Available physical RAM: 4096.24 MB Total Virtual: 9780.61 MB Available Virtual: 4504.83 MB ==================== Drives ================================ Drive c: () (Fixed) (Total:464.93 GB) (Free:244.97 GB) NTFS ==>[drive with boot components (obtained from BCD)] Drive d: (EXTRA FILES) (Removable) (Total:7.6 GB) (Free:7.6 GB) FAT32 ==================== MBR & Partition Table ================== ======================================================== Disk: 0 (MBR Code: Windows 7 or 8) (Size: 465.8 GB) (Disk ID: 00000081) Partition 1: (Active) - (Size=464.9 GB) - (Type=07 NTFS) Partition 2: (Not Active) - (Size=844 MB) - (Type=27) ======================================================== Disk: 1 (Size: 7.6 GB) (Disk ID: EC185C63) Partition 1: (Active) - (Size=7.6 GB) - (Type=0C) ==================== End of Addition.txt ============================ Link to post Share on other sites More sharing options...
jtsshieh Posted October 21, 2017 Author ID:1174761 Share Posted October 21, 2017 Scan result of Farbar Recovery Scan Tool (FRST) (x64) Version: 21-10-2017 Ran by jtssh (administrator) on JUSTIN-PC (21-10-2017 11:38:12) Running from C:\Users\jtssh\OneDrive\Documents\Setup Loaded Profiles: jtssh (Available Profiles: jtssh) Platform: Windows 10 Pro Version 1703 15063.674 (X64) Language: English (United States) Internet Explorer Version 11 (Default browser: Chrome) Boot Mode: Normal Tutorial for Farbar Recovery Scan Tool: http://www.geekstogo.com/forum/topic/335081-frst-tutorial-how-to-use-farbar-recovery-scan-tool/ ==================== Processes (Whitelisted) ================= (If an entry is included in the fixlist, the process will be closed. The file will not be moved.) (Microsoft Corporation) C:\Program Files\Microsoft SQL Server\90\Shared\sqlwriter.exe (Malwarebytes) C:\Program Files\Malwarebytes\Anti-Malware\MBAMService.exe (Broadcom Corporation.) C:\Program Files\WIDCOMM\Bluetooth Software\btwdins.exe (Broadcom Corporation.) C:\Windows\System32\BtwRSupportService.exe (Microsoft Corporation) C:\Windows\System32\vmms.exe (Dropbox, Inc.) C:\Windows\System32\DbxSvc.exe (Microsoft Corporation) C:\Windows\System32\vmcompute.exe (Microsoft Corporation) C:\Windows\System32\InputMethod\CHS\ChsIME.exe (Microsoft Corporation) C:\Program Files\Windows Defender\MSASCuiL.exe (Discord Inc.) C:\Users\jtssh\AppData\Local\DiscordCanary\app-0.0.167\DiscordCanary.exe (Broadcom Corporation.) C:\Program Files\WIDCOMM\Bluetooth Software\BTTray.exe (Piriform Ltd) C:\Program Files\CCleaner\CCleaner64.exe (Oracle Corporation) C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe (Broadcom Corporation.) C:\Program Files\WIDCOMM\Bluetooth Software\BTStackServer.exe (Dropbox, Inc.) C:\Program Files (x86)\Dropbox\Client\Dropbox.exe (Skillbrains) C:\Program Files (x86)\Skillbrains\lightshot\5.4.0.10\Lightshot.exe (Dropbox, Inc.) C:\Program Files (x86)\Dropbox\Client\Dropbox.exe (Dropbox, Inc.) C:\Program Files (x86)\Dropbox\Client\Dropbox.exe (Microsoft Corporation) C:\Windows\SysWOW64\rundll32.exe (Discord Inc.) C:\Users\jtssh\AppData\Local\DiscordCanary\app-0.0.167\DiscordCanary.exe (Malwarebytes) C:\Program Files\Malwarebytes\Anti-Malware\mbamtray.exe () C:\Users\jtssh\OneDrive\Documents\Archives\UnZipped\eclipse\eclipse.exe (Microsoft Corporation) C:\Windows\System32\Taskmgr.exe (Microsoft Corporation) C:\Windows\System32\dllhost.exe (Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe (Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe (Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe (Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe (Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe (Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe (Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe (Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe (Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe (Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe (Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe (Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe (Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe (Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe (Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe (Microsoft Corporation) C:\Windows\System32\dllhost.exe (Microsoft Corporation) C:\Program Files\Internet Explorer\iexplore.exe (Microsoft Corporation) C:\Windows\SystemApps\Microsoft.Windows.Cortana_cw5n1h2txyewy\RemindersServer.exe () C:\Program Files\WindowsApps\Microsoft.Windows.Photos_2017.39081.15820.0_x64__8wekyb3d8bbwe\Microsoft.Photos.exe (Microsoft Corporation) C:\Windows\ImmersiveControlPanel\SystemSettings.exe (Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe ==================== Registry (Whitelisted) =========================== (If an entry is included in the fixlist, the registry item will be restored to default or removed. The file will not be moved.) HKLM\...\Run: [SecurityHealth] => C:\Program Files\Windows Defender\MSASCuiL.exe [629152 2017-03-18] (Microsoft Corporation) HKLM-x32\...\Run: [Dropbox] => C:\Program Files (x86)\Dropbox\Client\Dropbox.exe [3566904 2017-10-17] (Dropbox, Inc.) HKLM-x32\...\Run: [Lightshot] => C:\Program Files (x86)\Skillbrains\lightshot\Lightshot.exe [225944 2017-04-11] () HKLM-x32\...\Run: [SunJavaUpdateSched] => C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe [648728 2017-08-02] (Oracle Corporation) HKU\S-1-5-21-1080822061-2706406846-2729724613-1001\...\Run: [Discord] => C:\Users\jtssh\AppData\Local\Discord\app-0.0.297\Discord.exe [64290304 2017-01-04] (Hammer & Chisel, Inc.) HKU\S-1-5-21-1080822061-2706406846-2729724613-1001\...\Run: [05AAFE247C06642A732F36B2CC3BD6871D1D4F2E._service_run] => C:\Program Files (x86)\Google\Chrome\Application\chrome.exe [1451352 2017-09-21] (Google Inc.) HKU\S-1-5-21-1080822061-2706406846-2729724613-1001\...\Run: [DiscordCanary] => C:\Users\jtssh\AppData\Local\DiscordCanary\app-0.0.167\DiscordCanary.exe [57481720 2017-10-20] (Discord Inc.) HKU\S-1-5-21-1080822061-2706406846-2729724613-1001\...\Run: [Spotify] => C:\Users\jtssh\AppData\Roaming\Spotify\Spotify.exe [20644976 2017-09-26] (Spotify Ltd) HKU\S-1-5-21-1080822061-2706406846-2729724613-1001\...\Run: [Spotify Web Helper] => C:\Users\jtssh\AppData\Roaming\Spotify\SpotifyWebHelper.exe [777840 2017-09-26] (Spotify Ltd) HKU\S-1-5-21-1080822061-2706406846-2729724613-1001\...\Run: [CCleaner Monitoring] => C:\Program Files\CCleaner\CCleaner64.exe [9856176 2017-09-20] (Piriform Ltd) HKU\S-1-5-21-1080822061-2706406846-2729724613-1001\...\Run: [GoogleChromeAutoLaunch_735E209D1D3D6DF22C891759DBA4771A] => C:\Program Files (x86)\Google\Chrome\Application\chrome.exe [1451352 2017-09-21] (Google Inc.) Startup: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\Bluetooth.lnk [2016-07-29] ShortcutTarget: Bluetooth.lnk -> C:\Program Files\WIDCOMM\Bluetooth Software\BTTray.exe (Broadcom Corporation.) GroupPolicy: Restriction - Chrome <==== ATTENTION GroupPolicy\User: Restriction <==== ATTENTION CHR HKLM\SOFTWARE\Policies\Google: Restriction <==== ATTENTION ==================== Internet (Whitelisted) ==================== (If an item is included in the fixlist, if it is a registry item it will be removed or restored to default.) Tcpip\Parameters: [DhcpNameServer] 192.168.1.1 Tcpip\..\Interfaces\{82249e0d-77e1-48d7-84eb-f73e7bdbb082}: [DhcpNameServer] 167.206.245.135 167.206.245.136 Tcpip\..\Interfaces\{b8e0a0d9-e8de-43c8-8002-349f40b91070}: [DhcpNameServer] 192.168.1.1 Internet Explorer: ================== HKU\S-1-5-21-1080822061-2706406846-2729724613-1001\SOFTWARE\Policies\Microsoft\Internet Explorer: Restriction <==== ATTENTION HKU\S-1-5-21-1080822061-2706406846-2729724613-1001\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://dell13.msn.com/ SearchScopes: HKLM -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = SearchScopes: HKLM-x32 -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = SearchScopes: HKU\S-1-5-21-1080822061-2706406846-2729724613-1001 -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = hxxps://www.bing.com/search?q={searchTerms}&src=IE-SearchBox&FORM=IESR02&pc=UE04 SearchScopes: HKU\S-1-5-21-1080822061-2706406846-2729724613-1001 -> {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = hxxps://www.bing.com/search?q={searchTerms}&src=IE-SearchBox&FORM=IESR02&pc=UE04 BHO: Java(tm) Plug-In SSV Helper -> {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} -> C:\Program Files\Java\jre-9\bin\ssv.dll => No File BHO: Java(tm) Plug-In 2 SSV Helper -> {DBC80044-A445-435b-BC74-9C25C1C588A9} -> C:\Program Files\Java\jre-9\bin\jp2ssv.dll [2017-10-14] (Oracle Corporation) BHO-x32: Java(tm) Plug-In SSV Helper -> {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} -> C:\Program Files (x86)\Java\jre1.8.0_151\bin\ssv.dll [2017-10-21] (Oracle Corporation) BHO-x32: Java(tm) Plug-In 2 SSV Helper -> {DBC80044-A445-435b-BC74-9C25C1C588A9} -> C:\Program Files (x86)\Java\jre1.8.0_151\bin\jp2ssv.dll [2017-10-21] (Oracle Corporation) FireFox: ======== FF DefaultProfile: c8s22hnd.default-1505852536080 FF ProfilePath: C:\Users\jtssh\AppData\Roaming\Mozilla\Firefox\Profiles\c8s22hnd.default-1505852536080 [2017-10-21] FF HKLM-x32\...\Firefox\Extensions: [{jid1-vS7biDmom8YxhA@jetpack}] - 5331800\extensions\{jid1-vS7biDmom8YxhA@jetpack} => not found FF Plugin: @java.com/DTPlugin,version=12.0.0.0 -> C:\Program Files\Java\jre-9\bin\dtplugin\npDeployJava1.dll [2017-10-14] (Oracle Corporation) FF Plugin: @java.com/JavaPlugin,version=12.0.0.0 -> C:\Program Files\Java\jre-9\bin\plugin2\npjp2.dll [2017-10-14] (Oracle Corporation) FF Plugin: @Microsoft.com/NpCtrl,version=1.0 -> c:\Program Files\Microsoft Silverlight\5.1.50907.0\npctrl.dll [2017-05-03] ( Microsoft Corporation) FF Plugin: @videolan.org/vlc,version=2.2.4 -> C:\Program Files\VideoLAN\VLC\npvlc.dll [2016-06-01] (VideoLAN) FF Plugin-x32: @adobe.com/ShockwavePlayer -> C:\WINDOWS\SysWOW64\Adobe\Director\np32dsw_1225195.dll [2016-09-20] (Adobe Systems, Inc.) FF Plugin-x32: @java.com/DTPlugin,version=11.151.2 -> C:\Program Files (x86)\Java\jre1.8.0_151\bin\dtplugin\npDeployJava1.dll [2017-10-21] (Oracle Corporation) FF Plugin-x32: @java.com/JavaPlugin,version=11.151.2 -> C:\Program Files (x86)\Java\jre1.8.0_151\bin\plugin2\npjp2.dll [2017-10-21] (Oracle Corporation) FF Plugin-x32: @Microsoft.com/NpCtrl,version=1.0 -> c:\Program Files (x86)\Microsoft Silverlight\5.1.50907.0\npctrl.dll [2017-05-03] ( Microsoft Corporation) FF Plugin-x32: @microsoft.com/WLPG,version=16.4.3528.0331 -> C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll [2014-03-31] (Microsoft Corporation) FF Plugin-x32: @tools.google.com/Google Update;version=3 -> C:\Program Files (x86)\Google\Update\1.3.33.5\npGoogleUpdate3.dll [2017-05-06] (Google Inc.) FF Plugin-x32: @tools.google.com/Google Update;version=9 -> C:\Program Files (x86)\Google\Update\1.3.33.5\npGoogleUpdate3.dll [2017-05-06] (Google Inc.) Chrome: ======= CHR DefaultProfile: Default CHR HomePage: Default -> hxxp://www.trovi.com/?gd=&ctid=CT3333529&octid=EB_ORIGINAL_CTID&ISID=MF4737248-246D-480F-B7D0-DAF8E5E2AB67&SearchSource=55&CUI=&UM=8&UP=SP6CEC7EA2-AF62-49FC-B4DA-A0358909660C&D=061215&SSPV= CHR StartupUrls: Default -> "chrome://apps/","hxxp://www.carryformation.com/club/" CHR Profile: C:\Users\jtssh\AppData\Local\Google\Chrome\User Data\Default [2017-10-21] CHR Extension: (Slides) - C:\Users\jtssh\AppData\Local\Google\Chrome\User Data\Default\Extensions\aapocclcgogkmnckokdopfmhonfmgoek [2017-10-14] CHR Extension: (Dark Theme for Google Chrome) - C:\Users\jtssh\AppData\Local\Google\Chrome\User Data\Default\Extensions\annfbnbieaamhaimclajlajpijgkdblo [2017-09-25] CHR Extension: (Docs) - C:\Users\jtssh\AppData\Local\Google\Chrome\User Data\Default\Extensions\aohghmighlieiainnegkcijnfilokake [2017-10-14] CHR Extension: (Google Drive) - C:\Users\jtssh\AppData\Local\Google\Chrome\User Data\Default\Extensions\apdfllckaahabafndbhieahigkjlhalf [2016-10-15] CHR Extension: (Turn Off the Lights) - C:\Users\jtssh\AppData\Local\Google\Chrome\User Data\Default\Extensions\bfbmjmiodbnnpllbbbfblcplfjjepjdn [2017-09-25] CHR Extension: (Adblock Plus) - C:\Users\jtssh\AppData\Local\Google\Chrome\User Data\Default\Extensions\cfhdojbkjhnklbpkdaibdccddilifddb [2017-09-29] CHR Extension: (Pushbullet) - C:\Users\jtssh\AppData\Local\Google\Chrome\User Data\Default\Extensions\chlffgpmiacpedhhbkiomidkjlcfhogd [2017-10-13] CHR Extension: (User-Agent Switcher for Chrome) - C:\Users\jtssh\AppData\Local\Google\Chrome\User Data\Default\Extensions\djflhoibgkdhkhhcedjiklpkjnoahfmg [2017-10-20] CHR Extension: (Gmail Offline) - C:\Users\jtssh\AppData\Local\Google\Chrome\User Data\Default\Extensions\ejidjjhkpiempkbhmpbfngldlkglhimk [2017-05-22] CHR Extension: (Google Calendar) - C:\Users\jtssh\AppData\Local\Google\Chrome\User Data\Default\Extensions\ejjicmeblgpmajnghnpcppodonldlgfn [2017-01-29] CHR Extension: (Google Apps Script) - C:\Users\jtssh\AppData\Local\Google\Chrome\User Data\Default\Extensions\eoieeedlomnegifmaghhjnghhmcldobl [2016-10-15] CHR Extension: (Sheets) - C:\Users\jtssh\AppData\Local\Google\Chrome\User Data\Default\Extensions\felcaaldnbdncclmgdcncolpebgiejap [2017-10-14] CHR Extension: (Chrome Remote Desktop) - C:\Users\jtssh\AppData\Local\Google\Chrome\User Data\Default\Extensions\gbchcmhmhahfdphkhkmpfmihenigjmpp [2017-10-14] CHR Extension: (Google Docs Offline) - C:\Users\jtssh\AppData\Local\Google\Chrome\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi [2016-10-16] CHR Extension: (OneNote Web Clipper) - C:\Users\jtssh\AppData\Local\Google\Chrome\User Data\Default\Extensions\gojbdfnpnhogfdgjbigejoaolejmgdhk [2017-05-22] CHR Extension: (Google Keep - notes and lists) - C:\Users\jtssh\AppData\Local\Google\Chrome\User Data\Default\Extensions\hmjkmjkepdijhoojdojkdfohbdgmmhki [2017-10-17] CHR Extension: (iChrome New Tab - A Fast, Productive New Tab) - C:\Users\jtssh\AppData\Local\Google\Chrome\User Data\Default\Extensions\iccjgbbjckehppnpajnmplcccjcgbdep [2017-07-31] CHR Extension: (Change Colors) - C:\Users\jtssh\AppData\Local\Google\Chrome\User Data\Default\Extensions\jbmkekhehjedonbhoikhhkmlapalklgn [2017-09-25] CHR Extension: (2048) - C:\Users\jtssh\AppData\Local\Google\Chrome\User Data\Default\Extensions\jcjbnkncddbeomhaacaeokhfnefibpde [2016-10-15] CHR Extension: (Google Forms) - C:\Users\jtssh\AppData\Local\Google\Chrome\User Data\Default\Extensions\jhknlonaankphkkbnmjdlpehkinifeeg [2016-10-16] CHR Extension: (Grammarly for Chrome) - C:\Users\jtssh\AppData\Local\Google\Chrome\User Data\Default\Extensions\kbfnbcaeplbcioakkpcpgfkobkghlhen [2017-10-20] CHR Extension: (Google Hangouts) - C:\Users\jtssh\AppData\Local\Google\Chrome\User Data\Default\Extensions\knipolnnllmklapflnccelgolnpehhpl [2017-05-06] CHR Extension: (Lightshot (screenshot tool)) - C:\Users\jtssh\AppData\Local\Google\Chrome\User Data\Default\Extensions\mbniclmhobmnbdlbpiphghaielnnpgdp [2017-09-09] CHR Extension: (Udacity Front End Feedback) - C:\Users\jtssh\AppData\Local\Google\Chrome\User Data\Default\Extensions\melpgahbngpgnbhhccnopmlmpbmdaeoi [2017-05-19] CHR Extension: (Google Drawings) - C:\Users\jtssh\AppData\Local\Google\Chrome\User Data\Default\Extensions\mkaakpdehdafacodkgkpghoibnmamcme [2016-10-15] CHR Extension: (Screencastify - Screen Video Recorder) - C:\Users\jtssh\AppData\Local\Google\Chrome\User Data\Default\Extensions\mmeijimgabbpbgpdklnllpncmdofkcpn [2017-10-13] CHR Extension: (Office Online) - C:\Users\jtssh\AppData\Local\Google\Chrome\User Data\Default\Extensions\ndjpnladcallmjemlbaebfadecfhkepb [2017-09-18] CHR Extension: (Chrome Web Store Payments) - C:\Users\jtssh\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda [2017-08-28] CHR Extension: (My Chrome Theme) - C:\Users\jtssh\AppData\Local\Google\Chrome\User Data\Default\Extensions\oehpjpccmlcalbenfhnacjeocbjdonic [2016-10-15] CHR Extension: (Bing) - C:\Users\jtssh\AppData\Local\Google\Chrome\User Data\Default\Extensions\ofgaflfnfknmefgjhlgkohmpekighhdi [2016-10-15] CHR Extension: (vidIQ Vision for YouTube) - C:\Users\jtssh\AppData\Local\Google\Chrome\User Data\Default\Extensions\pachckjkecffpdphbpmfolblodfkgbhl [2017-10-20] CHR Extension: (Gmail) - C:\Users\jtssh\AppData\Local\Google\Chrome\User Data\Default\Extensions\pjkljhegncpnkpknbcohdijeoejaedia [2016-10-15] CHR Extension: (Chrome Media Router) - C:\Users\jtssh\AppData\Local\Google\Chrome\User Data\Default\Extensions\pkedcjkdefgpdelpbcmbmeomcjbeemfm [2017-09-29] CHR Profile: C:\Users\jtssh\AppData\Local\Google\Chrome\User Data\Profile 1 [2017-10-17] CHR Extension: (Google Slides) - C:\Users\jtssh\AppData\Local\Google\Chrome\User Data\Profile 1\Extensions\aapocclcgogkmnckokdopfmhonfmgoek [2017-06-19] CHR Extension: (Google Docs) - C:\Users\jtssh\AppData\Local\Google\Chrome\User Data\Profile 1\Extensions\aohghmighlieiainnegkcijnfilokake [2017-06-19] CHR Extension: (Google Drive) - C:\Users\jtssh\AppData\Local\Google\Chrome\User Data\Profile 1\Extensions\apdfllckaahabafndbhieahigkjlhalf [2017-06-19] CHR Extension: (YouTube) - C:\Users\jtssh\AppData\Local\Google\Chrome\User Data\Profile 1\Extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo [2017-06-19] CHR Extension: (Google Sheets) - C:\Users\jtssh\AppData\Local\Google\Chrome\User Data\Profile 1\Extensions\felcaaldnbdncclmgdcncolpebgiejap [2017-06-19] CHR Extension: (Google Docs Offline) - C:\Users\jtssh\AppData\Local\Google\Chrome\User Data\Profile 1\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi [2017-06-22] CHR Extension: (Chrome Web Store Payments) - C:\Users\jtssh\AppData\Local\Google\Chrome\User Data\Profile 1\Extensions\nmmhkkegccagdldgiimedpiccmgmieda [2017-06-19] CHR Extension: (Gmail) - C:\Users\jtssh\AppData\Local\Google\Chrome\User Data\Profile 1\Extensions\pjkljhegncpnkpknbcohdijeoejaedia [2017-06-19] CHR Extension: (Chrome Media Router) - C:\Users\jtssh\AppData\Local\Google\Chrome\User Data\Profile 1\Extensions\pkedcjkdefgpdelpbcmbmeomcjbeemfm [2017-06-19] CHR Profile: C:\Users\jtssh\AppData\Local\Google\Chrome\User Data\System Profile [2017-10-17] CHR HKU\S-1-5-21-1080822061-2706406846-2729724613-1001\SOFTWARE\Google\Chrome\Extensions\...\Chrome\Extension: [gdfjhiclilbjdpeejgcgebmmihkkofji] - hxxps://clients2.google.com/service/update2/crx ==================== Services (Whitelisted) ==================== (If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.) R2 BcmBtRSupport; C:\Windows\system32\btwrsupportservice.exe [2278152 2015-07-03] (Broadcom Corporation.) S2 dbupdate; C:\Program Files (x86)\Dropbox\Update\DropboxUpdate.exe [143144 2016-07-29] (Dropbox, Inc.) S3 dbupdatem; C:\Program Files (x86)\Dropbox\Update\DropboxUpdate.exe [143144 2016-07-29] (Dropbox, Inc.) R2 DbxSvc; C:\WINDOWS\system32\DbxSvc.exe [51016 2017-10-17] (Dropbox, Inc.) S3 ESRV_SVC_WILLAMETTE; C:\Program Files\Intel\SUR\WILLAMETTE\ESRV\esrv_svc.exe [416408 2016-06-08] () R2 MBAMService; C:\Program Files\Malwarebytes\Anti-Malware\mbamservice.exe [6058960 2017-08-07] (Malwarebytes) S3 Sense; C:\Program Files\Windows Defender Advanced Threat Protection\MsSense.exe [3913064 2017-03-18] (Microsoft Corporation) S2 SystemUsageReportSvc_WILLAMETTE; C:\Program Files (x86)\Intel Driver Update Utility\SUR\SurSvc.exe [117400 2016-06-08] () S3 USER_ESRV_SVC_WILLAMETTE; C:\Program Files\Intel\SUR\WILLAMETTE\ESRV\esrv_svc.exe [416408 2016-06-08] () R3 vmcompute; C:\WINDOWS\system32\vmcompute.exe [2231296 2017-10-16] (Microsoft Corporation) R2 vmms; C:\WINDOWS\system32\vmms.exe [14415360 2017-10-16] (Microsoft Corporation) S3 VSStandardCollectorService140; C:\Program Files (x86)\Microsoft Visual Studio 14.0\Team Tools\DiagnosticsHub\Collector\StandardCollector.Service.exe [108776 2016-07-17] (Microsoft Corporation) S3 VSStandardCollectorService150; C:\Program Files (x86)\Microsoft Visual Studio\Shared\Common\DiagnosticsHub.Collection.Service\StandardCollector.Service.exe [128232 2017-02-08] (Microsoft Corporation) S3 WdNisSvc; C:\Program Files\Windows Defender\NisSrv.exe [342264 2017-03-18] (Microsoft Corporation) S3 WinDefend; C:\Program Files\Windows Defender\MsMpEng.exe [102816 2017-07-11] (Microsoft Corporation) ===================== Drivers (Whitelisted) ====================== (If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.) R3 bcbtums; C:\WINDOWS\system32\DRIVERS\bcbtums.sys [186152 2016-02-17] (Broadcom Corporation.) R1 ESProtectionDriver; C:\WINDOWS\system32\drivers\mbae64.sys [77440 2017-10-04] () R3 hvsocketcontrol; C:\WINDOWS\system32\drivers\hvsocketcontrol.sys [22016 2017-10-16] (Microsoft Corporation) S3 lunparser; C:\WINDOWS\System32\drivers\lunparser.sys [23552 2017-10-16] (Microsoft Corporation) R2 MBAMChameleon; C:\WINDOWS\System32\Drivers\MbamChameleon.sys [192952 2017-10-17] (Malwarebytes) R3 MBAMFarflt; C:\WINDOWS\system32\DRIVERS\farflt.sys [110016 2017-10-20] (Malwarebytes) R3 MBAMProtection; C:\WINDOWS\system32\DRIVERS\mbam.sys [45504 2017-10-20] (Malwarebytes) R0 MBAMSwissArmy; C:\WINDOWS\System32\Drivers\mbamswissarmy.sys [252232 2017-10-19] (Malwarebytes) R3 MBAMWebProtection; C:\WINDOWS\system32\DRIVERS\mwac.sys [94144 2017-10-21] (Malwarebytes) R3 netr28ux; C:\WINDOWS\System32\drivers\netr28ux.sys [2224128 2017-03-18] (MediaTek Inc.) S3 passthruparser; C:\WINDOWS\System32\drivers\passthruparser.sys [25088 2017-10-16] (Microsoft Corporation) S3 pcip; C:\WINDOWS\System32\drivers\pcip.sys [47616 2017-10-16] (Microsoft Corporation) S3 pvhdparser; C:\WINDOWS\System32\drivers\pvhdparser.sys [51712 2017-10-16] (Microsoft Corporation) S3 ramparser; C:\WINDOWS\System32\drivers\ramparser.sys [31232 2017-10-16] (Microsoft Corporation) S3 SDFRd; C:\WINDOWS\System32\drivers\SDFRd.sys [31128 2017-03-18] () S3 semav6msr64; C:\Windows\system32\drivers\semav6msr64.sys [21984 2015-06-04] () R3 Synth3dVsp; C:\WINDOWS\System32\drivers\synth3dvsp.sys [104448 2017-10-16] (Microsoft Corporation) S3 VBoxNetAdp; C:\WINDOWS\system32\DRIVERS\VBoxNetAdp6.sys [196040 2017-07-27] (Oracle Corporation) R1 VBoxNetLwf; C:\WINDOWS\system32\DRIVERS\VBoxNetLwf.sys [206976 2017-07-27] (Oracle Corporation) S3 vhdparser; C:\WINDOWS\System32\drivers\vhdparser.sys [31232 2017-10-16] (Microsoft Corporation) S3 WdBoot; C:\WINDOWS\system32\drivers\WdBoot.sys [44632 2017-03-18] (Microsoft Corporation) S3 WdFilter; C:\WINDOWS\system32\drivers\WdFilter.sys [294816 2017-03-18] (Microsoft Corporation) S3 WdNisDrv; C:\WINDOWS\System32\Drivers\WdNisDrv.sys [121248 2017-03-18] (Microsoft Corporation) ==================== NetSvcs (Whitelisted) =================== (If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.) ==================== One Month Created files and folders ======== (If an entry is included in the fixlist, the file/folder will be moved.) 2017-10-21 11:37 - 2017-10-21 11:38 - 000000000 ____D C:\FRST 2017-10-21 09:03 - 2017-10-21 09:03 - 000000000 ____D C:\Users\Default\AppData\Roaming\Sun 2017-10-21 09:03 - 2017-10-21 09:03 - 000000000 ____D C:\Users\Default User\AppData\Roaming\Sun 2017-10-20 20:09 - 2017-10-20 20:09 - 000000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Dropbox 2017-10-18 19:11 - 2017-10-18 19:11 - 000000000 ____D C:\Users\jtssh\AppData\LocalLow\MSLiveStickerWhiteList 2017-10-18 19:11 - 2017-10-18 19:11 - 000000000 ____D C:\Users\jtssh\AppData\LocalLow\MSLiveSticker 2017-10-18 17:32 - 2017-10-18 17:32 - 000000000 ____D C:\WINDOWS\System32\Tasks\S-1-5-21-1080822061-2706406846-2729724613-1001 2017-10-18 15:51 - 2017-10-20 20:42 - 000028272 _____ C:\WINDOWS\system32\Drivers\TrueSight.sys 2017-10-18 15:48 - 2017-10-18 15:55 - 000000000 ____D C:\ProgramData\RogueKiller 2017-10-18 15:48 - 2017-10-18 15:48 - 000000899 _____ C:\Users\Public\Desktop\RogueKiller.lnk 2017-10-18 15:48 - 2017-10-18 15:48 - 000000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\RogueKiller 2017-10-18 15:48 - 2017-10-18 15:48 - 000000000 ____D C:\Program Files\RogueKiller 2017-10-18 08:11 - 2017-10-20 20:36 - 000000000 ____D C:\AdwCleaner 2017-10-18 08:11 - 2017-10-18 08:11 - 008250832 _____ (Malwarebytes) C:\Users\jtssh\Desktop\AdwCleaner.exe 2017-10-17 22:11 - 2017-10-17 22:11 - 016338719 _____ C:\Users\jtssh\Desktop\Results.txt 2017-10-17 18:54 - 2017-10-21 08:56 - 000094144 _____ (Malwarebytes) C:\WINDOWS\system32\Drivers\mwac.sys 2017-10-17 18:54 - 2017-10-20 20:38 - 000110016 _____ (Malwarebytes) C:\WINDOWS\system32\Drivers\farflt.sys 2017-10-17 18:54 - 2017-10-17 18:54 - 000192952 _____ (Malwarebytes) C:\WINDOWS\system32\Drivers\MbamChameleon.sys 2017-10-17 18:53 - 2017-10-20 20:38 - 000045504 _____ (Malwarebytes) C:\WINDOWS\system32\Drivers\mbam.sys 2017-10-17 18:53 - 2017-10-19 16:51 - 000252232 _____ (Malwarebytes) C:\WINDOWS\system32\Drivers\mbamswissarmy.sys 2017-10-17 18:53 - 2017-10-17 18:53 - 000000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Malwarebytes 2017-10-17 18:53 - 2017-10-04 13:15 - 000077440 _____ C:\WINDOWS\system32\Drivers\mbae64.sys 2017-10-17 18:52 - 2017-10-19 21:39 - 000000000 ____D C:\ProgramData\Malwarebytes 2017-10-17 18:52 - 2017-10-17 18:52 - 000000000 ____D C:\Program Files\Malwarebytes 2017-10-17 11:48 - 2017-10-17 11:48 - 000051016 _____ (Dropbox, Inc.) C:\WINDOWS\system32\DbxSvc.exe 2017-10-17 11:48 - 2017-10-17 11:48 - 000045672 _____ (Dropbox, Inc.) C:\WINDOWS\system32\Drivers\dbx-dev.sys 2017-10-17 11:48 - 2017-10-17 11:48 - 000045640 _____ (Dropbox, Inc.) C:\WINDOWS\system32\Drivers\dbx-stable.sys 2017-10-17 11:48 - 2017-10-17 11:48 - 000045640 _____ (Dropbox, Inc.) C:\WINDOWS\system32\Drivers\dbx-canary.sys 2017-10-16 21:14 - 2017-10-16 21:14 - 000000000 ____D C:\Windows.old 2017-10-16 21:10 - 2017-10-16 21:10 - 023686144 _____ (Microsoft Corporation) C:\WINDOWS\system32\mshtml.dll 2017-10-16 21:10 - 2017-10-16 21:10 - 023678976 _____ (Microsoft Corporation) C:\WINDOWS\system32\edgehtml.dll 2017-10-16 21:10 - 2017-10-16 21:10 - 020511232 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\edgehtml.dll 2017-10-16 21:10 - 2017-10-16 21:10 - 020373408 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\shell32.dll 2017-10-16 21:10 - 2017-10-16 21:10 - 019337216 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\mshtml.dll 2017-10-16 21:10 - 2017-10-16 21:10 - 013844992 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\Windows.UI.Xaml.dll 2017-10-16 21:10 - 2017-10-16 21:10 - 012803072 _____ (Microsoft Corporation) C:\WINDOWS\system32\ieframe.dll 2017-10-16 21:10 - 2017-10-16 21:10 - 011888640 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\ieframe.dll 2017-10-16 21:10 - 2017-10-16 21:10 - 008199168 _____ (Microsoft Corporation) C:\WINDOWS\system32\Chakra.dll 2017-10-16 21:10 - 2017-10-16 21:10 - 006728192 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\twinui.dll 2017-10-16 21:10 - 2017-10-16 21:10 - 006557520 _____ (Microsoft Corporation) C:\WINDOWS\system32\Windows.Media.dll 2017-10-16 21:10 - 2017-10-16 21:10 - 006255616 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\Chakra.dll 2017-10-16 21:10 - 2017-10-16 21:10 - 005961728 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\Windows.Data.Pdf.dll 2017-10-16 21:10 - 2017-10-16 21:10 - 005827744 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\windows.storage.dll 2017-10-16 21:10 - 2017-10-16 21:10 - 005808640 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\Windows.Media.dll 2017-10-16 21:10 - 2017-10-16 21:10 - 005776384 _____ (Microsoft Corporation) C:\WINDOWS\system32\VsGraphicsDesktopEngine.exe 2017-10-16 21:10 - 2017-10-16 21:10 - 005721600 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\BingMaps.dll 2017-10-16 21:10 - 2017-10-16 21:10 - 005225984 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\d2d1.dll 2017-10-16 21:10 - 2017-10-16 21:10 - 005141504 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\d3d12warp.dll 2017-10-16 21:10 - 2017-10-16 21:10 - 004730368 _____ (Microsoft Corporation) C:\WINDOWS\system32\jscript9.dll 2017-10-16 21:10 - 2017-10-16 21:10 - 004708504 _____ (Microsoft Corporation) C:\WINDOWS\system32\mfcore.dll 2017-10-16 21:10 - 2017-10-16 21:10 - 004671832 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\mfcore.dll 2017-10-16 21:10 - 2017-10-16 21:10 - 004544000 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\VsGraphicsDesktopEngine.exe 2017-10-16 21:10 - 2017-10-16 21:10 - 004535296 _____ (Microsoft Corporation) C:\WINDOWS\system32\MFMediaEngine.dll 2017-10-16 21:10 - 2017-10-16 21:10 - 004417024 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\ExplorerFrame.dll 2017-10-16 21:10 - 2017-10-16 21:10 - 004330920 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\setupapi.dll 2017-10-16 21:10 - 2017-10-16 21:10 - 004056064 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\MFMediaEngine.dll 2017-10-16 21:10 - 2017-10-16 21:10 - 003995136 _____ (Microsoft Corporation) C:\WINDOWS\system32\UIRibbon.dll 2017-10-16 21:10 - 2017-10-16 21:10 - 003667456 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\D3DCompiler_47.dll 2017-10-16 21:10 - 2017-10-16 21:10 - 003654656 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\jscript9.dll 2017-10-16 21:10 - 2017-10-16 21:10 - 003464704 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\UIRibbon.dll 2017-10-16 21:10 - 2017-10-16 21:10 - 002859520 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\wininet.dll 2017-10-16 21:10 - 2017-10-16 21:10 - 002782720 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\msftedit.dll 2017-10-16 21:10 - 2017-10-16 21:10 - 002671616 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\tquery.dll 2017-10-16 21:10 - 2017-10-16 21:10 - 002617344 _____ (Microsoft Corporation) C:\WINDOWS\system32\d3d12SDKLayers.dll 2017-10-16 21:10 - 2017-10-16 21:10 - 002604248 _____ (Microsoft Corporation) C:\WINDOWS\system32\mfmp4srcsnk.dll 2017-10-16 21:10 - 2017-10-16 21:10 - 002603744 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\OneCoreUAPCommonProxyStub.dll 2017-10-16 21:10 - 2017-10-16 21:10 - 002476712 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\d3d10warp.dll 2017-10-16 21:10 - 2017-10-16 21:10 - 002424024 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\mfmp4srcsnk.dll 2017-10-16 21:10 - 2017-10-16 21:10 - 002340864 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\DWrite.dll 2017-10-16 21:10 - 2017-10-16 21:10 - 002239136 _____ (Microsoft Corporation) C:\WINDOWS\system32\mfsrcsnk.dll 2017-10-16 21:10 - 2017-10-16 21:10 - 002199552 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\Windows.UI.Xaml.Resources.dll 2017-10-16 21:10 - 2017-10-16 21:10 - 002166808 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\iertutil.dll 2017-10-16 21:10 - 2017-10-16 21:10 - 002102272 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\d3d12SDKLayers.dll 2017-10-16 21:10 - 2017-10-16 21:10 - 002078720 _____ (Microsoft Corporation) C:\WINDOWS\system32\inetcpl.cpl 2017-10-16 21:10 - 2017-10-16 21:10 - 002009600 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\inetcpl.cpl 2017-10-16 21:10 - 2017-10-16 21:10 - 001833984 _____ (Microsoft Corporation) C:\WINDOWS\system32\workfolderssvc.dll 2017-10-16 21:10 - 2017-10-16 21:10 - 001722880 _____ (Microsoft Corporation) C:\WINDOWS\system32\dui70.dll 2017-10-16 21:10 - 2017-10-16 21:10 - 001639936 _____ (Microsoft Corporation) C:\WINDOWS\system32\GdiPlus.dll 2017-10-16 21:10 - 2017-10-16 21:10 - 001627136 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\urlmon.dll 2017-10-16 21:10 - 2017-10-16 21:10 - 001620880 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\ntdll.dll 2017-10-16 21:10 - 2017-10-16 21:10 - 001595152 _____ (Microsoft Corporation) C:\WINDOWS\system32\gdi32full.dll 2017-10-16 21:10 - 2017-10-16 21:10 - 001583616 _____ (Microsoft Corporation) C:\WINDOWS\system32\ieapfltr.dll 2017-10-16 21:10 - 2017-10-16 21:10 - 001536512 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\Windows.UI.Immersive.dll 2017-10-16 21:10 - 2017-10-16 21:10 - 001506816 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\quartz.dll 2017-10-16 21:10 - 2017-10-16 21:10 - 001463296 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\ieapfltr.dll 2017-10-16 21:10 - 2017-10-16 21:10 - 001460736 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\wsp_fs.dll 2017-10-16 21:10 - 2017-10-16 21:10 - 001458320 _____ (Microsoft Corporation) C:\WINDOWS\system32\msctf.dll 2017-10-16 21:10 - 2017-10-16 21:10 - 001439032 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\mfsrcsnk.dll 2017-10-16 21:10 - 2017-10-16 21:10 - 001318912 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\wsp_health.dll 2017-10-16 21:10 - 2017-10-16 21:10 - 001291776 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\MSVPXENC.dll 2017-10-16 21:10 - 2017-10-16 21:10 - 001275904 _____ (Microsoft Corporation) C:\WINDOWS\system32\werconcpl.dll 2017-10-16 21:10 - 2017-10-16 21:10 - 001266544 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\twinapi.appcore.dll 2017-10-16 21:10 - 2017-10-16 21:10 - 001248768 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\AzureSettingSyncProvider.dll 2017-10-16 21:10 - 2017-10-16 21:10 - 001244160 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\Windows.UI.Xaml.Phone.dll 2017-10-16 21:10 - 2017-10-16 21:10 - 001150776 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\ucrtbase.dll 2017-10-16 21:10 - 2017-10-16 21:10 - 001146176 _____ (Microsoft Corporation) C:\WINDOWS\system32\mfds.dll 2017-10-16 21:10 - 2017-10-16 21:10 - 001135616 ____R (The ICU Project) C:\WINDOWS\SysWOW64\icuuc.dll 2017-10-16 21:10 - 2017-10-16 21:10 - 001106904 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\mfds.dll 2017-10-16 21:10 - 2017-10-16 21:10 - 001068208 _____ (Microsoft Corporation) C:\WINDOWS\system32\Windows.UI.dll 2017-10-16 21:10 - 2017-10-16 21:10 - 001060352 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\XpsPrint.dll 2017-10-16 21:10 - 2017-10-16 21:10 - 001033544 _____ (Microsoft Corporation) C:\WINDOWS\system32\DolbyDecMFT.dll 2017-10-16 21:10 - 2017-10-16 21:10 - 001019904 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\aadtb.dll 2017-10-16 21:10 - 2017-10-16 21:10 - 001013912 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\msvproc.dll 2017-10-16 21:10 - 2017-10-16 21:10 - 000988168 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\ole32.dll 2017-10-16 21:10 - 2017-10-16 21:10 - 000967584 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\ReAgent.dll 2017-10-16 21:10 - 2017-10-16 21:10 - 000958664 _____ (Microsoft Corporation) C:\WINDOWS\system32\msvproc.dll 2017-10-16 21:10 - 2017-10-16 21:10 - 000952832 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\comdlg32.dll 2017-10-16 21:10 - 2017-10-16 21:10 - 000932352 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\GamePanel.exe 2017-10-16 21:10 - 2017-10-16 21:10 - 000918528 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\Windows.Networking.Vpn.dll 2017-10-16 21:10 - 2017-10-16 21:10 - 000899584 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\twinui.appcore.dll 2017-10-16 21:10 - 2017-10-16 21:10 - 000893440 _____ (Microsoft Corporation) C:\WINDOWS\system32\clusapi.dll 2017-10-16 21:10 - 2017-10-16 21:10 - 000877056 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\autoconv.exe 2017-10-16 21:10 - 2017-10-16 21:10 - 000866808 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\DolbyDecMFT.dll 2017-10-16 21:10 - 2017-10-16 21:10 - 000853504 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\autofmt.exe 2017-10-16 21:10 - 2017-10-16 21:10 - 000852480 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\rasgcw.dll 2017-10-16 21:10 - 2017-10-16 21:10 - 000844288 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\rasdlg.dll 2017-10-16 21:10 - 2017-10-16 21:10 - 000841216 _____ (Microsoft Corporation) C:\WINDOWS\system32\fveapi.dll 2017-10-16 21:10 - 2017-10-16 21:10 - 000805888 _____ (Microsoft Corporation) C:\WINDOWS\system32\ieproxy.dll 2017-10-16 21:10 - 2017-10-16 21:10 - 000804864 _____ (Microsoft Corporation) C:\WINDOWS\system32\fvewiz.dll 2017-10-16 21:10 - 2017-10-16 21:10 - 000787712 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\rpcrt4.dll 2017-10-16 21:10 - 2017-10-16 21:10 - 000761344 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\rasapi32.dll 2017-10-16 21:10 - 2017-10-16 21:10 - 000756224 _____ (Microsoft Corporation) C:\WINDOWS\system32\jscript.dll 2017-10-16 21:10 - 2017-10-16 21:10 - 000752640 _____ (Microsoft Corporation) C:\WINDOWS\system32\msfeeds.dll 2017-10-16 21:10 - 2017-10-16 21:10 - 000750560 _____ (Microsoft Corporation) C:\WINDOWS\system32\fontdrvhost.exe 2017-10-16 21:10 - 2017-10-16 21:10 - 000750488 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\WWAHost.exe 2017-10-16 21:10 - 2017-10-16 21:10 - 000742912 _____ (Microsoft Corporation) C:\WINDOWS\system32\nshwfp.dll 2017-10-16 21:10 - 2017-10-16 21:10 - 000715168 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\fvevol.sys 2017-10-16 21:10 - 2017-10-16 21:10 - 000692736 _____ (Microsoft Corporation) C:\WINDOWS\system32\jscript9diag.dll 2017-10-16 21:10 - 2017-10-16 21:10 - 000681472 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\clusapi.dll 2017-10-16 21:10 - 2017-10-16 21:10 - 000664576 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\msfeeds.dll 2017-10-16 21:10 - 2017-10-16 21:10 - 000658944 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\jscript.dll 2017-10-16 21:10 - 2017-10-16 21:10 - 000648704 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\MbaeApiPublic.dll 2017-10-16 21:10 - 2017-10-16 21:10 - 000636416 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\WpcWebFilter.dll 2017-10-16 21:10 - 2017-10-16 21:10 - 000603136 _____ (Microsoft Corporation) C:\WINDOWS\system32\resutils.dll 2017-10-16 21:10 - 2017-10-16 21:10 - 000586240 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\nshwfp.dll 2017-10-16 21:10 - 2017-10-16 21:10 - 000584192 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\UIRibbonRes.dll 2017-10-16 21:10 - 2017-10-16 21:10 - 000584192 _____ (Microsoft Corporation) C:\WINDOWS\system32\UIRibbonRes.dll 2017-10-16 21:10 - 2017-10-16 21:10 - 000569264 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\SHCore.dll 2017-10-16 21:10 - 2017-10-16 21:10 - 000564224 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\shsvcs.dll 2017-10-16 21:10 - 2017-10-16 21:10 - 000559000 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\SettingSyncHost.exe 2017-10-16 21:10 - 2017-10-16 21:10 - 000551200 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\dxgi.dll 2017-10-16 21:10 - 2017-10-16 21:10 - 000508344 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\dnsapi.dll 2017-10-16 21:10 - 2017-10-16 21:10 - 000498176 _____ (Microsoft Corporation) C:\WINDOWS\system32\d2d1debug3.dll 2017-10-16 21:10 - 2017-10-16 21:10 - 000480920 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\advapi32.dll 2017-10-16 21:10 - 2017-10-16 21:10 - 000473088 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\resutils.dll 2017-10-16 21:10 - 2017-10-16 21:10 - 000463360 _____ (Microsoft Corporation) C:\WINDOWS\system32\werui.dll 2017-10-16 21:10 - 2017-10-16 21:10 - 000457728 _____ (Microsoft Corporation) C:\WINDOWS\system32\webplatstorageserver.dll 2017-10-16 21:10 - 2017-10-16 21:10 - 000452608 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\rasplap.dll 2017-10-16 21:10 - 2017-10-16 21:10 - 000446464 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\rastls.dll 2017-10-16 21:10 - 2017-10-16 21:10 - 000434176 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\twinapi.dll 2017-10-16 21:10 - 2017-10-16 21:10 - 000430592 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\winspool.drv 2017-10-16 21:10 - 2017-10-16 21:10 - 000430080 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\d2d1debug3.dll 2017-10-16 21:10 - 2017-10-16 21:10 - 000414208 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\srv.sys 2017-10-16 21:10 - 2017-10-16 21:10 - 000406544 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\policymanager.dll 2017-10-16 21:10 - 2017-10-16 21:10 - 000394240 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\Windows.Internal.Management.dll 2017-10-16 21:10 - 2017-10-16 21:10 - 000388096 _____ (Microsoft Corporation) C:\WINDOWS\system32\iedkcs32.dll 2017-10-16 21:10 - 2017-10-16 21:10 - 000387936 _____ (Microsoft Corporation) C:\WINDOWS\system32\wmpps.dll 2017-10-16 21:10 - 2017-10-16 21:10 - 000385536 _____ (Microsoft Corporation) C:\WINDOWS\system32\bdesvc.dll 2017-10-16 21:10 - 2017-10-16 21:10 - 000371200 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\daxexec.dll 2017-10-16 21:10 - 2017-10-16 21:10 - 000368128 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\InstallAgentUserBroker.exe 2017-10-16 21:10 - 2017-10-16 21:10 - 000364032 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\msIso.dll 2017-10-16 21:10 - 2017-10-16 21:10 - 000364032 _____ (Microsoft Corporation) C:\WINDOWS\system32\bdechangepin.exe 2017-10-16 21:10 - 2017-10-16 21:10 - 000358400 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\ieproxy.dll 2017-10-16 21:10 - 2017-10-16 21:10 - 000357888 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\ActivationManager.dll 2017-10-16 21:10 - 2017-10-16 21:10 - 000356864 _____ (Microsoft Corporation) C:\WINDOWS\system32\fveapibase.dll 2017-10-16 21:10 - 2017-10-16 21:10 - 000339968 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\iedkcs32.dll 2017-10-16 21:10 - 2017-10-16 21:10 - 000337920 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\InstallAgent.exe 2017-10-16 21:10 - 2017-10-16 21:10 - 000336320 _____ (Microsoft Corporation) C:\WINDOWS\system32\SecurityHealthService.exe 2017-10-16 21:10 - 2017-10-16 21:10 - 000331264 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\rastlsext.dll 2017-10-16 21:10 - 2017-10-16 21:10 - 000325120 _____ (Microsoft Corporation) C:\WINDOWS\system32\fvecpl.dll 2017-10-16 21:10 - 2017-10-16 21:10 - 000311296 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\ntprint.dll 2017-10-16 21:10 - 2017-10-16 21:10 - 000306688 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\Windows.Graphics.dll 2017-10-16 21:10 - 2017-10-16 21:10 - 000306176 _____ (Microsoft Corporation) C:\WINDOWS\system32\fveui.dll 2017-10-16 21:10 - 2017-10-16 21:10 - 000297984 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\mcbuilder.exe 2017-10-16 21:10 - 2017-10-16 21:10 - 000286208 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\mrxsmb10.sys 2017-10-16 21:10 - 2017-10-16 21:10 - 000277432 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\shlwapi.dll 2017-10-16 21:10 - 2017-10-16 21:10 - 000274944 _____ (Microsoft Corporation) C:\WINDOWS\system32\dxtrans.dll 2017-10-16 21:10 - 2017-10-16 21:10 - 000266240 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\dxtrans.dll 2017-10-16 21:10 - 2017-10-16 21:10 - 000257024 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\Phoneutil.dll 2017-10-16 21:10 - 2017-10-16 21:10 - 000257024 _____ (Microsoft Corporation) C:\WINDOWS\system32\webcheck.dll 2017-10-16 21:10 - 2017-10-16 21:10 - 000254176 _____ (Microsoft Corporation) C:\WINDOWS\system32\mfps.dll 2017-10-16 21:10 - 2017-10-16 21:10 - 000232960 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\webcheck.dll 2017-10-16 21:10 - 2017-10-16 21:10 - 000229376 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\scksp.dll 2017-10-16 21:10 - 2017-10-16 21:10 - 000225792 _____ (Microsoft Corporation) C:\WINDOWS\system32\ie4uinit.exe 2017-10-16 21:10 - 2017-10-16 21:10 - 000223744 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\shdocvw.dll 2017-10-16 21:10 - 2017-10-16 21:10 - 000215040 _____ (Microsoft Corporation) C:\WINDOWS\system32\manage-bde.exe 2017-10-16 21:10 - 2017-10-16 21:10 - 000184320 _____ (Microsoft Corporation) C:\WINDOWS\system32\DWWIN.EXE 2017-10-16 21:10 - 2017-10-16 21:10 - 000175616 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\RstrtMgr.dll 2017-10-16 21:10 - 2017-10-16 21:10 - 000175616 _____ (Microsoft Corporation) C:\WINDOWS\system32\t2embed.dll 2017-10-16 21:10 - 2017-10-16 21:10 - 000175512 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\basecsp.dll 2017-10-16 21:10 - 2017-10-16 21:10 - 000175104 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\dinput8.dll 2017-10-16 21:10 - 2017-10-16 21:10 - 000173568 _____ (Microsoft Corporation) C:\WINDOWS\system32\inetpp.dll 2017-10-16 21:10 - 2017-10-16 21:10 - 000157696 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\rpchttp.dll 2017-10-16 21:10 - 2017-10-16 21:10 - 000147456 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\VCardParser.dll 2017-10-16 21:10 - 2017-10-16 21:10 - 000142848 _____ (Microsoft Corporation) C:\WINDOWS\system32\dwmredir.dll 2017-10-16 21:10 - 2017-10-16 21:10 - 000142336 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\smartscreenps.dll 2017-10-16 21:10 - 2017-10-16 21:10 - 000141312 _____ (Microsoft Corporation) C:\WINDOWS\system32\BitLockerDeviceEncryption.exe 2017-10-16 21:10 - 2017-10-16 21:10 - 000140288 _____ (Microsoft Corporation) C:\WINDOWS\system32\iepeers.dll 2017-10-16 21:10 - 2017-10-16 21:10 - 000135680 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\qasf.dll 2017-10-16 21:10 - 2017-10-16 21:10 - 000134656 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\dinput.dll 2017-10-16 21:10 - 2017-10-16 21:10 - 000127488 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\fdeploy.dll 2017-10-16 21:10 - 2017-10-16 21:10 - 000124928 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\iepeers.dll 2017-10-16 21:10 - 2017-10-16 21:10 - 000124544 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\sspicli.dll 2017-10-16 21:10 - 2017-10-16 21:10 - 000110592 _____ (Microsoft Corporation) C:\WINDOWS\system32\Chakradiag.dll 2017-10-16 21:10 - 2017-10-16 21:10 - 000110080 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\BitLockerCsp.dll 2017-10-16 21:10 - 2017-10-16 21:10 - 000109056 _____ (Microsoft Corporation) C:\WINDOWS\system32\dab.dll 2017-10-16 21:10 - 2017-10-16 21:10 - 000104448 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\Robocopy.exe 2017-10-16 21:10 - 2017-10-16 21:10 - 000100352 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\rasman.dll 2017-10-16 21:10 - 2017-10-16 21:10 - 000100232 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\bcd.dll 2017-10-16 21:10 - 2017-10-16 21:10 - 000096648 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\dmcmnutils.dll 2017-10-16 21:10 - 2017-10-16 21:10 - 000096256 _____ (Microsoft Corporation) C:\WINDOWS\system32\mshtmled.dll 2017-10-16 21:10 - 2017-10-16 21:10 - 000093184 _____ (Microsoft Corporation) C:\WINDOWS\system32\wercplsupport.dll 2017-10-16 21:10 - 2017-10-16 21:10 - 000089088 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\olepro32.dll 2017-10-16 21:10 - 2017-10-16 21:10 - 000089088 _____ (Microsoft Corporation) C:\WINDOWS\system32\winsrvext.dll 2017-10-16 21:10 - 2017-10-16 21:10 - 000085784 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\CredentialUIBroker.exe 2017-10-16 21:10 - 2017-10-16 21:10 - 000084992 _____ (Microsoft Corporation) C:\WINDOWS\system32\MshtmlDac.dll 2017-10-16 21:10 - 2017-10-16 21:10 - 000083456 _____ (Microsoft Corporation) C:\WINDOWS\system32\wpdbusenum.dll 2017-10-16 21:10 - 2017-10-16 21:10 - 000080896 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\Chakradiag.dll 2017-10-16 21:10 - 2017-10-16 21:10 - 000080384 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\mshtmled.dll 2017-10-16 21:10 - 2017-10-16 21:10 - 000077824 _____ (Microsoft Corporation) C:\WINDOWS\system32\wsqmcons.exe 2017-10-16 21:10 - 2017-10-16 21:10 - 000077312 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\spbcd.dll 2017-10-16 21:10 - 2017-10-16 21:10 - 000064000 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\MshtmlDac.dll 2017-10-16 21:10 - 2017-10-16 21:10 - 000062464 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\ntprint.exe 2017-10-16 21:10 - 2017-10-16 21:10 - 000057856 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\offreg.dll 2017-10-16 21:10 - 2017-10-16 21:10 - 000052768 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\appidapi.dll 2017-10-16 21:10 - 2017-10-16 21:10 - 000049664 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\tetheringclient.dll 2017-10-16 21:10 - 2017-10-16 21:10 - 000040448 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\cipher.exe 2017-10-16 21:10 - 2017-10-16 21:10 - 000029184 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\cmintegrator.dll 2017-10-16 21:10 - 2017-10-16 21:10 - 000022016 _____ (Microsoft Corporation) C:\WINDOWS\system32\wpnpinst.exe 2017-10-16 21:10 - 2017-10-16 21:10 - 000018944 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\mgmtapi.dll 2017-10-16 21:10 - 2017-10-16 21:10 - 000018432 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\IpNatHlpClient.dll 2017-10-16 21:09 - 2017-10-16 21:09 - 021351760 _____ (Microsoft Corporation) C:\WINDOWS\system32\shell32.dll 2017-10-16 21:09 - 2017-10-16 21:09 - 017370624 _____ (Microsoft Corporation) C:\WINDOWS\system32\Windows.UI.Xaml.dll 2017-10-16 21:09 - 2017-10-16 21:09 - 014415360 _____ (Microsoft Corporation) C:\WINDOWS\system32\vmms.exe 2017-10-16 21:09 - 2017-10-16 21:09 - 008333312 _____ (Microsoft Corporation) C:\WINDOWS\system32\BingMaps.dll 2017-10-16 21:09 - 2017-10-16 21:09 - 008319384 _____ (Microsoft Corporation) C:\WINDOWS\system32\ntoskrnl.exe 2017-10-16 21:09 - 2017-10-16 21:09 - 008213504 _____ (Microsoft Corporation) C:\WINDOWS\system32\mstscax.dll 2017-10-16 21:09 - 2017-10-16 21:09 - 007931392 _____ (Microsoft Corporation) C:\WINDOWS\system32\twinui.dll 2017-10-16 21:09 - 2017-10-16 21:09 - 007910072 _____ (Microsoft Corporation) C:\WINDOWS\system32\Windows.Media.Protection.PlayReady.dll 2017-10-16 21:09 - 2017-10-16 21:09 - 007598080 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\mstscax.dll 2017-10-16 21:09 - 2017-10-16 21:09 - 007337472 _____ (Microsoft Corporation) C:\WINDOWS\system32\Windows.Data.Pdf.dll 2017-10-16 21:09 - 2017-10-16 21:09 - 007318888 _____ (Microsoft Corporation) C:\WINDOWS\system32\windows.storage.dll 2017-10-16 21:09 - 2017-10-16 21:09 - 006768288 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\Windows.Media.Protection.PlayReady.dll 2017-10-16 21:09 - 2017-10-16 21:09 - 005557760 _____ (Microsoft Corporation) C:\WINDOWS\system32\dbgeng.dll 2017-10-16 21:09 - 2017-10-16 21:09 - 005477600 _____ (Microsoft Corporation) C:\WINDOWS\system32\OneCoreUAPCommonProxyStub.dll 2017-10-16 21:09 - 2017-10-16 21:09 - 005304496 _____ (Microsoft Corporation) C:\WINDOWS\system32\Windows.StateRepository.dll 2017-10-16 21:09 - 2017-10-16 21:09 - 004848952 _____ (Microsoft Corporation) C:\WINDOWS\explorer.exe 2017-10-16 21:09 - 2017-10-16 21:09 - 004707840 _____ (Microsoft Corporation) C:\WINDOWS\system32\ExplorerFrame.dll 2017-10-16 21:09 - 2017-10-16 21:09 - 004559360 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\dbgeng.dll 2017-10-16 21:09 - 2017-10-16 21:09 - 004471368 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\explorer.exe 2017-10-16 21:09 - 2017-10-16 21:09 - 004462120 _____ (Microsoft Corporation) C:\WINDOWS\system32\setupapi.dll 2017-10-16 21:09 - 2017-10-16 21:09 - 004445696 _____ (Microsoft Corporation) C:\WINDOWS\system32\SettingsHandlers_nt.dll 2017-10-16 21:09 - 2017-10-16 21:09 - 004396032 _____ (Microsoft Corporation) C:\WINDOWS\system32\D3DCompiler_47.dll 2017-10-16 21:09 - 2017-10-16 21:09 - 004215184 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\Windows.StateRepository.dll 2017-10-16 21:09 - 2017-10-16 21:09 - 004175872 _____ (Microsoft Corporation) C:\WINDOWS\system32\StartTileData.dll 2017-10-16 21:09 - 2017-10-16 21:09 - 003669504 _____ (Microsoft Corporation) C:\WINDOWS\system32\win32kfull.sys 2017-10-16 21:09 - 2017-10-16 21:09 - 003377664 _____ (Microsoft Corporation) C:\WINDOWS\system32\tquery.dll 2017-10-16 21:09 - 2017-10-16 21:09 - 003307008 _____ (Microsoft Corporation) C:\WINDOWS\system32\wininet.dll 2017-10-16 21:09 - 2017-10-16 21:09 - 003304448 _____ (Microsoft Corporation) C:\WINDOWS\system32\mstsc.exe 2017-10-16 21:09 - 2017-10-16 21:09 - 003204608 _____ (Microsoft Corporation) C:\WINDOWS\system32\Microsoft.Bluetooth.Profiles.Gatt.dll 2017-10-16 21:09 - 2017-10-16 21:09 - 003140096 _____ (Microsoft Corporation) C:\WINDOWS\system32\msftedit.dll 2017-10-16 21:09 - 2017-10-16 21:09 - 003116184 _____ (Microsoft Corporation) C:\WINDOWS\system32\combase.dll 2017-10-16 21:09 - 2017-10-16 21:09 - 003107328 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\mstsc.exe 2017-10-16 21:09 - 2017-10-16 21:09 - 003059200 _____ (Microsoft Corporation) C:\WINDOWS\system32\NetworkMobileSettings.dll 2017-10-16 21:09 - 2017-10-16 21:09 - 002972552 _____ (Microsoft Corporation) C:\WINDOWS\system32\d3d10warp.dll 2017-10-16 21:09 - 2017-10-16 21:09 - 002969880 _____ (Microsoft Corporation) C:\WINDOWS\system32\CoreUIComponents.dll 2017-10-16 21:09 - 2017-10-16 21:09 - 002953216 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\win32kfull.sys 2017-10-16 21:09 - 2017-10-16 21:09 - 002939392 _____ (Microsoft Corporation) C:\WINDOWS\system32\InputService.dll 2017-10-16 21:09 - 2017-10-16 21:09 - 002829824 _____ (Microsoft Corporation) C:\WINDOWS\system32\DWrite.dll 2017-10-16 21:09 - 2017-10-16 21:09 - 002809344 _____ (Microsoft Corporation) C:\WINDOWS\system32\AppXDeploymentServer.dll 2017-10-16 21:09 - 2017-10-16 21:09 - 002760704 _____ (Microsoft Corporation) C:\WINDOWS\system32\Windows.Shell.UnifiedTile.CuratedTileCollections.dll 2017-10-16 21:09 - 2017-10-16 21:09 - 002730496 _____ (Microsoft Corporation) C:\WINDOWS\system32\smartscreen.exe 2017-10-16 21:09 - 2017-10-16 21:09 - 002680320 _____ (Microsoft Corporation) C:\WINDOWS\system32\Windows.CloudStore.dll 2017-10-16 21:09 - 2017-10-16 21:09 - 002672024 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\tcpip.sys 2017-10-16 21:09 - 2017-10-16 21:09 - 002647224 _____ (Microsoft Corporation) C:\WINDOWS\system32\iertutil.dll 2017-10-16 21:09 - 2017-10-16 21:09 - 002516480 _____ (Microsoft Corporation) C:\WINDOWS\system32\diagtrack.dll 2017-10-16 21:09 - 2017-10-16 21:09 - 002503680 _____ (Microsoft Corporation) C:\WINDOWS\system32\twinui.pcshell.dll 2017-10-16 21:09 - 2017-10-16 21:09 - 002446336 _____ (Microsoft Corporation) C:\WINDOWS\system32\wuaueng.dll 2017-10-16 21:09 - 2017-10-16 21:09 - 002442136 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\dxgkrnl.sys 2017-10-16 21:09 - 2017-10-16 21:09 - 002438656 _____ (Microsoft Corporation) C:\WINDOWS\system32\ResetEngine.dll 2017-10-16 21:09 - 2017-10-16 21:09 - 002399728 _____ (Microsoft Corporation) C:\WINDOWS\system32\KernelBase.dll 2017-10-16 21:09 - 2017-10-16 21:09 - 002377112 _____ (Microsoft Corporation) C:\WINDOWS\system32\Microsoft.Uev.AppAgent.dll 2017-10-16 21:09 - 2017-10-16 21:09 - 002330520 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\combase.dll 2017-10-16 21:09 - 2017-10-16 21:09 - 002327448 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\ntfs.sys 2017-10-16 21:09 - 2017-10-16 21:09 - 002259760 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\CoreUIComponents.dll 2017-10-16 21:09 - 2017-10-16 21:09 - 002229144 _____ (Microsoft Corporation) C:\WINDOWS\system32\AppVEntSubsystems64.dll 2017-10-16 21:09 - 2017-10-16 21:09 - 002211840 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\InputService.dll 2017-10-16 21:09 - 2017-10-16 21:09 - 002199552 _____ (Microsoft Corporation) C:\WINDOWS\system32\Windows.UI.Xaml.Resources.dll 2017-10-16 21:09 - 2017-10-16 21:09 - 002195968 _____ (Microsoft Corporation) C:\WINDOWS\system32\Microsoft.Uev.ModernAppAgent.dll 2017-10-16 21:09 - 2017-10-16 21:09 - 002177024 _____ (Microsoft Corporation) C:\WINDOWS\system32\OpcServices.dll 2017-10-16 21:09 - 2017-10-16 21:09 - 002153984 _____ (Microsoft Corporation) C:\WINDOWS\system32\wlidsvc.dll 2017-10-16 21:09 - 2017-10-16 21:09 - 002088448 _____ (Microsoft Corporation) C:\WINDOWS\system32\wsp_fs.dll 2017-10-16 21:09 - 2017-10-16 21:09 - 002086808 _____ (Microsoft Corporation) C:\WINDOWS\system32\UpdateAgent.dll 2017-10-16 21:09 - 2017-10-16 21:09 - 002055680 _____ (Microsoft Corporation) C:\WINDOWS\system32\win32kbase.sys 2017-10-16 21:09 - 2017-10-16 21:09 - 002006528 _____ (Microsoft Corporation) C:\WINDOWS\system32\LocationFramework.dll 2017-10-16 21:09 - 2017-10-16 21:09 - 001930840 _____ (Microsoft Corporation) C:\WINDOWS\system32\ntdll.dll 2017-10-16 21:09 - 2017-10-16 21:09 - 001887744 _____ (Microsoft Corporation) C:\WINDOWS\system32\FntCache.dll 2017-10-16 21:09 - 2017-10-16 21:09 - 001886208 _____ (Microsoft Corporation) C:\WINDOWS\system32\AppXDeploymentExtensions.onecore.dll 2017-10-16 21:09 - 2017-10-16 21:09 - 001878016 _____ (Microsoft Corporation) C:\WINDOWS\system32\AzureSettingSyncProvider.dll 2017-10-16 21:09 - 2017-10-16 21:09 - 001854872 _____ (Microsoft Corporation) C:\WINDOWS\system32\AppVEntVirtualization.dll 2017-10-16 21:09 - 2017-10-16 21:09 - 001839872 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\KernelBase.dll 2017-10-16 21:09 - 2017-10-16 21:09 - 001811456 _____ (Microsoft Corporation) C:\WINDOWS\system32\wsp_health.dll 2017-10-16 21:09 - 2017-10-16 21:09 - 001802240 _____ (Microsoft Corporation) C:\WINDOWS\system32\urlmon.dll 2017-10-16 21:09 - 2017-10-16 21:09 - 001736704 _____ (Microsoft Corporation) C:\WINDOWS\system32\wevtsvc.dll 2017-10-16 21:09 - 2017-10-16 21:09 - 001706496 _____ (Microsoft Corporation) C:\WINDOWS\system32\Windows.UI.Immersive.dll 2017-10-16 21:09 - 2017-10-16 21:09 - 001694104 _____ (Microsoft Corporation) C:\WINDOWS\system32\AppVIntegration.dll 2017-10-16 21:09 - 2017-10-16 21:09 - 001668344 _____ (Microsoft Corporation) C:\WINDOWS\system32\propsys.dll 2017-10-16 21:09 - 2017-10-16 21:09 - 001657344 _____ (Microsoft Corporation) C:\WINDOWS\system32\XpsPrint.dll 2017-10-16 21:09 - 2017-10-16 21:09 - 001628672 _____ (Microsoft Corporation) C:\WINDOWS\system32\UserDataService.dll 2017-10-16 21:09 - 2017-10-16 21:09 - 001624096 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\Microsoft.Uev.AppAgent.dll 2017-10-16 21:09 - 2017-10-16 21:09 - 001619816 _____ (Microsoft Corporation) C:\WINDOWS\system32\sppobjs.dll 2017-10-16 21:09 - 2017-10-16 21:09 - 001605632 _____ (Microsoft Corporation) C:\WINDOWS\system32\quartz.dll 2017-10-16 21:09 - 2017-10-16 21:09 - 001527296 _____ (Microsoft Corporation) C:\WINDOWS\system32\RecoveryDrive.exe 2017-10-16 21:09 - 2017-10-16 21:09 - 001517464 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\AppVEntSubsystems32.dll 2017-10-16 21:09 - 2017-10-16 21:09 - 001506712 _____ (Microsoft Corporation) C:\WINDOWS\system32\twinapi.appcore.dll 2017-10-16 21:09 - 2017-10-16 21:09 - 001468928 _____ (Microsoft Corporation) C:\WINDOWS\system32\AppXDeploymentExtensions.desktop.dll 2017-10-16 21:09 - 2017-10-16 21:09 - 001464728 _____ (Microsoft Corporation) C:\WINDOWS\system32\AppVEntSubsystemController.dll 2017-10-16 21:09 - 2017-10-16 21:09 - 001460224 _____ (Microsoft Corporation) C:\WINDOWS\system32\lsasrv.dll 2017-10-16 21:09 - 2017-10-16 21:09 - 001448960 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\GdiPlus.dll 2017-10-16 21:09 - 2017-10-16 21:09 - 001438208 _____ (Microsoft Corporation) C:\WINDOWS\system32\Windows.UI.Xaml.Phone.dll 2017-10-16 21:09 - 2017-10-16 21:09 - 001408536 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\gdi32full.dll 2017-10-16 21:09 - 2017-10-16 21:09 - 001398784 _____ (Microsoft Corporation) C:\WINDOWS\system32\wwansvc.dll 2017-10-16 21:09 - 2017-10-16 21:09 - 001395664 _____ (Microsoft Corporation) C:\WINDOWS\system32\winload.efi 2017-10-16 21:09 - 2017-10-16 21:09 - 001357312 _____ (Microsoft Corporation) C:\WINDOWS\system32\audiosrv.dll 2017-10-16 21:09 - 2017-10-16 21:09 - 001355264 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\OpcServices.dll 2017-10-16 21:09 - 2017-10-16 21:09 - 001349632 _____ (Microsoft Corporation) C:\WINDOWS\system32\vmuidevices.dll 2017-10-16 21:09 - 2017-10-16 21:09 - 001346112 _____ (Microsoft Corporation) C:\WINDOWS\system32\user32.dll 2017-10-16 21:09 - 2017-10-16 21:09 - 001337856 _____ (Microsoft Corporation) C:\WINDOWS\system32\AudioEng.dll 2017-10-16 21:09 - 2017-10-16 21:09 - 001333136 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\msctf.dll 2017-10-16 21:09 - 2017-10-16 21:09 - 001325968 _____ (Microsoft Corporation) C:\WINDOWS\system32\ole32.dll 2017-10-16 21:09 - 2017-10-16 21:09 - 001321984 ____R (The ICU Project) C:\WINDOWS\system32\icuuc.dll 2017-10-16 21:09 - 2017-10-16 21:09 - 001320344 _____ (Microsoft Corporation) C:\WINDOWS\system32\wpx.dll 2017-10-16 21:09 - 2017-10-16 21:09 - 001311744 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\msjet40.dll 2017-10-16 21:09 - 2017-10-16 21:09 - 001307648 _____ (Microsoft Corporation) C:\WINDOWS\system32\dosvc.dll 2017-10-16 21:09 - 2017-10-16 21:09 - 001298432 _____ (Microsoft Corporation) C:\WINDOWS\system32\lpasvc.dll 2017-10-16 21:09 - 2017-10-16 21:09 - 001293824 _____ (Microsoft Corporation) C:\WINDOWS\system32\aadtb.dll 2017-10-16 21:09 - 2017-10-16 21:09 - 001292872 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\user32.dll 2017-10-16 21:09 - 2017-10-16 21:09 - 001269760 _____ (Microsoft Corporation) C:\WINDOWS\system32\enterprisecsps.dll 2017-10-16 21:09 - 2017-10-16 21:09 - 001260544 _____ (Microsoft Corporation) C:\WINDOWS\system32\GamePanel.exe 2017-10-16 21:09 - 2017-10-16 21:09 - 001242528 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\ndis.sys 2017-10-16 21:09 - 2017-10-16 21:09 - 001201664 _____ (Microsoft Corporation) C:\WINDOWS\system32\AgentService.exe 2017-10-16 21:09 - 2017-10-16 21:09 - 001197568 _____ (Microsoft Corporation) C:\WINDOWS\system32\Microsoft.Uev.CommonBridge.dll 2017-10-16 21:09 - 2017-10-16 21:09 - 001195760 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\AudioEng.dll 2017-10-16 21:09 - 2017-10-16 21:09 - 001194792 _____ (Microsoft Corporation) C:\WINDOWS\system32\rpcrt4.dll 2017-10-16 21:09 - 2017-10-16 21:09 - 001186464 _____ (Microsoft Corporation) C:\WINDOWS\system32\winload.exe 2017-10-16 21:09 - 2017-10-16 21:09 - 001178624 _____ (Microsoft Corporation) C:\WINDOWS\system32\Windows.Networking.Vpn.dll 2017-10-16 21:09 - 2017-10-16 21:09 - 001147288 _____ (Microsoft Corporation) C:\WINDOWS\system32\hvix64.exe 2017-10-16 21:09 - 2017-10-16 21:09 - 001143296 _____ (Microsoft Corporation) C:\WINDOWS\system32\localspl.dll 2017-10-16 21:09 - 2017-10-16 21:09 - 001141760 _____ (Microsoft Corporation) C:\WINDOWS\system32\ApplySettingsTemplateCatalog.exe 2017-10-16 21:09 - 2017-10-16 21:09 - 001114528 _____ (Microsoft Corporation) C:\WINDOWS\system32\ReAgent.dll 2017-10-16 21:09 - 2017-10-16 21:09 - 001087488 _____ (Microsoft Corporation) C:\WINDOWS\system32\reseteng.dll 2017-10-16 21:09 - 2017-10-16 21:09 - 001085440 _____ (Microsoft Corporation) C:\WINDOWS\system32\rpcss.dll 2017-10-16 21:09 - 2017-10-16 21:09 - 001077248 _____ (Microsoft Corporation) C:\WINDOWS\system32\twinui.appcore.dll 2017-10-16 21:09 - 2017-10-16 21:09 - 001065104 _____ (Microsoft Corporation) C:\WINDOWS\system32\winresume.efi 2017-10-16 21:09 - 2017-10-16 21:09 - 001057824 _____ (Microsoft Corporation) C:\WINDOWS\system32\MrmCoreR.dll 2017-10-16 21:09 - 2017-10-16 21:09 - 001054280 _____ (Microsoft Corporation) C:\WINDOWS\system32\AudioSes.dll 2017-10-16 21:09 - 2017-10-16 21:09 - 001052672 _____ (Microsoft Corporation) C:\WINDOWS\system32\TokenBroker.dll 2017-10-16 21:09 - 2017-10-16 21:09 - 001051136 _____ (Microsoft Corporation) C:\WINDOWS\system32\nettrace.dll 2017-10-16 21:09 - 2017-10-16 21:09 - 001046016 _____ (Microsoft Corporation) C:\WINDOWS\system32\ngcsvc.dll 2017-10-16 21:09 - 2017-10-16 21:09 - 001046016 _____ (Microsoft Corporation) C:\WINDOWS\system32\comdlg32.dll 2017-10-16 21:09 - 2017-10-16 21:09 - 001028608 _____ (Microsoft Corporation) C:\WINDOWS\system32\modernexecserver.dll 2017-10-16 21:09 - 2017-10-16 21:09 - 001024920 _____ (Microsoft Corporation) C:\WINDOWS\system32\hvax64.exe 2017-10-16 21:09 - 2017-10-16 21:09 - 001018272 _____ (Microsoft Corporation) C:\WINDOWS\system32\SecConfig.efi 2017-10-16 21:09 - 2017-10-16 21:09 - 001015296 _____ (Microsoft Corporation) C:\WINDOWS\system32\XblAuthManager.dll 2017-10-16 21:09 - 2017-10-16 21:09 - 001004136 _____ (Microsoft Corporation) C:\WINDOWS\system32\ucrtbase.dll 2017-10-16 21:09 - 2017-10-16 21:09 - 000996864 _____ (Microsoft Corporation) C:\WINDOWS\system32\iphlpsvc.dll 2017-10-16 21:09 - 2017-10-16 21:09 - 000986624 _____ (Microsoft Corporation) C:\WINDOWS\system32\wuapi.dll 2017-10-16 21:09 - 2017-10-16 21:09 - 000982016 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\bthport.sys 2017-10-16 21:09 - 2017-10-16 21:09 - 000972288 _____ (Microsoft Corporation) C:\WINDOWS\system32\MPSSVC.dll 2017-10-16 21:09 - 2017-10-16 21:09 - 000971264 _____ (Microsoft Corporation) C:\WINDOWS\system32\autochk.exe 2017-10-16 21:09 - 2017-10-16 21:09 - 000965024 _____ (Microsoft Corporation) C:\WINDOWS\system32\hvloader.efi 2017-10-16 21:09 - 2017-10-16 21:09 - 000961944 _____ (Microsoft Corporation) C:\WINDOWS\system32\efscore.dll 2017-10-16 21:09 - 2017-10-16 21:09 - 000954368 _____ (Microsoft Corporation) C:\WINDOWS\system32\autoconv.exe 2017-10-16 21:09 - 2017-10-16 21:09 - 000946688 _____ (Microsoft Corporation) C:\WINDOWS\system32\rasgcw.dll 2017-10-16 21:09 - 2017-10-16 21:09 - 000942592 _____ (Microsoft Corporation) C:\WINDOWS\system32\wbiosrvc.dll 2017-10-16 21:09 - 2017-10-16 21:09 - 000926208 _____ (Microsoft Corporation) C:\WINDOWS\system32\autofmt.exe 2017-10-16 21:09 - 2017-10-16 21:09 - 000925696 _____ (Microsoft Corporation) C:\WINDOWS\system32\WpcWebFilter.dll 2017-10-16 21:09 - 2017-10-16 21:09 - 000923040 _____ (Microsoft Corporation) C:\WINDOWS\system32\CoreMessaging.dll 2017-10-16 21:09 - 2017-10-16 21:09 - 000922112 _____ (Microsoft Corporation) C:\WINDOWS\system32\kerberos.dll 2017-10-16 21:09 - 2017-10-16 21:09 - 000921600 _____ (Microsoft Corporation) C:\WINDOWS\system32\rasdlg.dll 2017-10-16 21:09 - 2017-10-16 21:09 - 000900376 _____ (Microsoft Corporation) C:\WINDOWS\system32\winresume.exe 2017-10-16 21:09 - 2017-10-16 21:09 - 000892928 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\autochk.exe 2017-10-16 21:09 - 2017-10-16 21:09 - 000874496 _____ (Microsoft Corporation) C:\WINDOWS\system32\rasmans.dll 2017-10-16 21:09 - 2017-10-16 21:09 - 000872472 _____ (Microsoft Corporation) C:\WINDOWS\system32\ClipSVC.dll 2017-10-16 21:09 - 2017-10-16 21:09 - 000871448 _____ (Microsoft Corporation) C:\WINDOWS\system32\winhttp.dll 2017-10-16 21:09 - 2017-10-16 21:09 - 000866816 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\mswdat10.dll 2017-10-16 21:09 - 2017-10-16 21:09 - 000864256 _____ (Microsoft Corporation) C:\WINDOWS\system32\NotificationController.dll 2017-10-16 21:09 - 2017-10-16 21:09 - 000864248 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\AudioSes.dll 2017-10-16 21:09 - 2017-10-16 21:09 - 000855960 _____ (Microsoft Corporation) C:\WINDOWS\system32\AppVOrchestration.dll 2017-10-16 21:09 - 2017-10-16 21:09 - 000849816 _____ (Microsoft Corporation) C:\WINDOWS\system32\AppVClient.exe 2017-10-16 21:09 - 2017-10-16 21:09 - 000847360 _____ (Microsoft Corporation) C:\WINDOWS\system32\bisrv.dll 2017-10-16 21:09 - 2017-10-16 21:09 - 000844704 _____ (Microsoft Corporation) C:\WINDOWS\system32\AppVEntStreamingManager.dll 2017-10-16 21:09 - 2017-10-16 21:09 - 000832000 _____ (Microsoft Corporation) C:\WINDOWS\system32\printfilterpipelinesvc.exe 2017-10-16 21:09 - 2017-10-16 21:09 - 000831488 _____ (Microsoft Corporation) C:\WINDOWS\system32\MbaeApiPublic.dll 2017-10-16 21:09 - 2017-10-16 21:09 - 000827904 _____ (Microsoft Corporation) C:\WINDOWS\system32\win32spl.dll 2017-10-16 21:09 - 2017-10-16 21:09 - 000821664 _____ (Microsoft Corporation) C:\WINDOWS\system32\hvloader.exe 2017-10-16 21:09 - 2017-10-16 21:09 - 000820120 _____ (Microsoft Corporation) C:\WINDOWS\system32\WWAHost.exe 2017-10-16 21:09 - 2017-10-16 21:09 - 000817664 _____ (Microsoft Corporation) C:\WINDOWS\system32\Windows.Security.Authentication.Web.Core.dll 2017-10-16 21:09 - 2017-10-16 21:09 - 000810496 _____ (Microsoft Corporation) C:\WINDOWS\system32\rasapi32.dll 2017-10-16 21:09 - 2017-10-16 21:09 - 000804784 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\Windows.UI.dll 2017-10-16 21:09 - 2017-10-16 21:09 - 000804312 _____ C:\WINDOWS\SysWOW64\locale.nls 2017-10-16 21:09 - 2017-10-16 21:09 - 000804312 _____ C:\WINDOWS\system32\locale.nls 2017-10-16 21:09 - 2017-10-16 21:09 - 000803328 _____ (Microsoft Corporation) C:\WINDOWS\system32\wcmsvc.dll 2017-10-16 21:09 - 2017-10-16 21:09 - 000798720 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\TokenBroker.dll 2017-10-16 21:09 - 2017-10-16 21:09 - 000787456 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\wuapi.dll 2017-10-16 21:09 - 2017-10-16 21:09 - 000778240 _____ C:\WINDOWS\system32\MBR2GPT.EXE 2017-10-16 21:09 - 2017-10-16 21:09 - 000778240 _____ (Microsoft Corporation) C:\WINDOWS\system32\DolbyHrtfEnc.dll 2017-10-16 21:09 - 2017-10-16 21:09 - 000777400 _____ (Microsoft Corporation) C:\WINDOWS\system32\oleaut32.dll 2017-10-16 21:09 - 2017-10-16 21:09 - 000774560 _____ (Microsoft Corporation) C:\WINDOWS\system32\AppVReporting.dll 2017-10-16 21:09 - 2017-10-16 21:09 - 000773120 _____ (Microsoft Corporation) C:\WINDOWS\system32\PhoneService.dll 2017-10-16 21:09 - 2017-10-16 21:09 - 000772096 _____ (Microsoft Corporation) C:\WINDOWS\system32\PCPKsp.dll 2017-10-16 21:09 - 2017-10-16 21:09 - 000772096 _____ (Microsoft Corporation) C:\WINDOWS\system32\netlogon.dll 2017-10-16 21:09 - 2017-10-16 21:09 - 000757760 _____ (Microsoft Corporation) C:\WINDOWS\system32\spoolsv.exe 2017-10-16 21:09 - 2017-10-16 21:09 - 000754176 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\kerberos.dll 2017-10-16 21:09 - 2017-10-16 21:09 - 000751616 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\Wnv.sys 2017-10-16 21:09 - 2017-10-16 21:09 - 000739840 _____ (Microsoft Corporation) C:\WINDOWS\system32\PhoneProviders.dll 2017-10-16 21:09 - 2017-10-16 21:09 - 000724992 _____ (Microsoft Corporation) C:\WINDOWS\system32\MusUpdateHandlers.dll 2017-10-16 21:09 - 2017-10-16 21:09 - 000724704 _____ (Microsoft Corporation) C:\WINDOWS\system32\wer.dll 2017-10-16 21:09 - 2017-10-16 21:09 - 000723360 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\acpi.sys 2017-10-16 21:09 - 2017-10-16 21:09 - 000722944 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\srv2.sys 2017-10-16 21:09 - 2017-10-16 21:09 - 000712600 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\dxgmms2.sys 2017-10-16 21:09 - 2017-10-16 21:09 - 000706560 _____ (Microsoft Corporation) C:\WINDOWS\system32\winlogon.exe 2017-10-16 21:09 - 2017-10-16 21:09 - 000703056 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\winhttp.dll 2017-10-16 21:09 - 2017-10-16 21:09 - 000701336 _____ (Microsoft Corporation) C:\WINDOWS\system32\AppVCatalog.dll 2017-10-16 21:09 - 2017-10-16 21:09 - 000699904 _____ (Microsoft Corporation) C:\WINDOWS\system32\FlightSettings.dll 2017-10-16 21:09 - 2017-10-16 21:09 - 000691712 _____ (Microsoft Corporation) C:\WINDOWS\system32\tdh.dll 2017-10-16 21:09 - 2017-10-16 21:09 - 000687616 _____ (Microsoft Corporation) C:\WINDOWS\system32\LogonController.dll 2017-10-16 21:09 - 2017-10-16 21:09 - 000685512 _____ (Microsoft Corporation) C:\WINDOWS\system32\SHCore.dll 2017-10-16 21:09 - 2017-10-16 21:09 - 000684032 _____ (Microsoft Corporation) C:\WINDOWS\system32\usocore.dll 2017-10-16 21:09 - 2017-10-16 21:09 - 000675224 _____ (Microsoft Corporation) C:\WINDOWS\system32\AppVPublishing.dll 2017-10-16 21:09 - 2017-10-16 21:09 - 000661224 _____ (Microsoft Corporation) C:\WINDOWS\system32\dnsapi.dll 2017-10-16 21:09 - 2017-10-16 21:09 - 000660680 _____ (Microsoft Corporation) C:\WINDOWS\system32\dxgi.dll 2017-10-16 21:09 - 2017-10-16 21:09 - 000657408 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\netlogon.dll 2017-10-16 21:09 - 2017-10-16 21:09 - 000654976 _____ (Microsoft Corporation) C:\WINDOWS\system32\AppXDeploymentClient.dll 2017-10-16 21:09 - 2017-10-16 21:09 - 000651672 _____ (Microsoft Corporation) C:\WINDOWS\system32\SettingSyncHost.exe 2017-10-16 21:09 - 2017-10-16 21:09 - 000647168 _____ (Microsoft Corporation) C:\WINDOWS\system32\RDXService.dll 2017-10-16 21:09 - 2017-10-16 21:09 - 000644696 _____ (Microsoft Corporation) C:\WINDOWS\system32\advapi32.dll 2017-10-16 21:09 - 2017-10-16 21:09 - 000642680 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\cng.sys 2017-10-16 21:09 - 2017-10-16 21:09 - 000640512 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\mswstr10.dll 2017-10-16 21:09 - 2017-10-16 21:09 - 000640512 _____ (Microsoft Corporation) C:\WINDOWS\system32\ngccredprov.dll 2017-10-16 21:09 - 2017-10-16 21:09 - 000627080 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\fontdrvhost.exe 2017-10-16 21:09 - 2017-10-16 21:09 - 000625152 _____ (Microsoft Corporation) C:\WINDOWS\system32\AudioEndpointBuilder.dll 2017-10-16 21:09 - 2017-10-16 21:09 - 000616960 _____ (Microsoft Corporation) C:\WINDOWS\system32\WindowManagement.dll 2017-10-16 21:09 - 2017-10-16 21:09 - 000616448 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\msrepl40.dll 2017-10-16 21:09 - 2017-10-16 21:09 - 000612864 _____ (Microsoft Corporation) C:\WINDOWS\system32\shsvcs.dll 2017-10-16 21:09 - 2017-10-16 21:09 - 000612120 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\wer.dll 2017-10-16 21:09 - 2017-10-16 21:09 - 000610720 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\afd.sys 2017-10-16 21:09 - 2017-10-16 21:09 - 000606072 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\oleaut32.dll 2017-10-16 21:09 - 2017-10-16 21:09 - 000600576 _____ (Microsoft Corporation) C:\WINDOWS\system32\FrameServer.dll 2017-10-16 21:09 - 2017-10-16 21:09 - 000593408 _____ (Microsoft Corporation) C:\WINDOWS\system32\BootMenuUX.dll 2017-10-16 21:09 - 2017-10-16 21:09 - 000590336 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\PCPKsp.dll 2017-10-16 21:09 - 2017-10-16 21:09 - 000586752 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\Windows.Security.Authentication.Web.Core.dll 2017-10-16 21:09 - 2017-10-16 21:09 - 000586240 _____ (Microsoft Corporation) C:\WINDOWS\system32\AppReadiness.dll 2017-10-16 21:09 - 2017-10-16 21:09 - 000583160 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\CoreMessaging.dll 2017-10-16 21:09 - 2017-10-16 21:09 - 000582656 _____ (Microsoft Corporation) C:\WINDOWS\system32\SmsRouterSvc.dll 2017-10-16 21:09 - 2017-10-16 21:09 - 000579072 _____ (Microsoft Corporation) C:\WINDOWS\system32\untfs.dll 2017-10-16 21:09 - 2017-10-16 21:09 - 000574464 _____ (Microsoft Corporation) C:\WINDOWS\system32\configmanager2.dll 2017-10-16 21:09 - 2017-10-16 21:09 - 000566784 _____ (Microsoft Corporation) C:\WINDOWS\system32\Windows.Networking.UX.EapRequestHandler.dll 2017-10-16 21:09 - 2017-10-16 21:09 - 000565760 _____ (Microsoft Corporation) C:\WINDOWS\system32\webio.dll 2017-10-16 21:09 - 2017-10-16 21:09 - 000564736 _____ (Microsoft Corporation) C:\WINDOWS\system32\dsreg.dll 2017-10-16 21:09 - 2017-10-16 21:09 - 000563200 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\tdh.dll 2017-10-16 21:09 - 2017-10-16 21:09 - 000558912 _____ (Microsoft Corporation) C:\WINDOWS\system32\Windows.ApplicationModel.dll 2017-10-16 21:09 - 2017-10-16 21:09 - 000556032 _____ (Microsoft Corporation) C:\WINDOWS\system32\TpmCoreProvisioning.dll 2017-10-16 21:09 - 2017-10-16 21:09 - 000554400 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\USBHUB3.SYS 2017-10-16 21:09 - 2017-10-16 21:09 - 000550400 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\nwifi.sys 2017-10-16 21:09 - 2017-10-16 21:09 - 000546816 _____ (Microsoft Corporation) C:\WINDOWS\system32\winspool.drv 2017-10-16 21:09 - 2017-10-16 21:09 - 000546208 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\storport.sys 2017-10-16 21:09 - 2017-10-16 21:09 - 000538624 _____ (Microsoft Corporation) C:\WINDOWS\system32\FirewallAPI.dll 2017-10-16 21:09 - 2017-10-16 21:09 - 000538112 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\untfs.dll 2017-10-16 21:09 - 2017-10-16 21:09 - 000536064 _____ (Microsoft Corporation) C:\WINDOWS\system32\Windows.Internal.Management.dll 2017-10-16 21:09 - 2017-10-16 21:09 - 000529992 _____ (Microsoft Corporation) C:\WINDOWS\system32\TextInputFramework.dll 2017-10-16 21:09 - 2017-10-16 21:09 - 000529408 _____ (Microsoft Corporation) C:\WINDOWS\system32\daxexec.dll 2017-10-16 21:09 - 2017-10-16 21:09 - 000527976 _____ (Microsoft Corporation) C:\WINDOWS\system32\services.exe 2017-10-16 21:09 - 2017-10-16 21:09 - 000527360 _____ (Microsoft Corporation) C:\WINDOWS\system32\aadcloudap.dll 2017-10-16 21:09 - 2017-10-16 21:09 - 000524800 _____ (Microsoft Corporation) C:\WINDOWS\system32\TileDataRepository.dll 2017-10-16 21:09 - 2017-10-16 21:09 - 000524288 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\ngccredprov.dll 2017-10-16 21:09 - 2017-10-16 21:09 - 000519680 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\AppXDeploymentClient.dll 2017-10-16 21:09 - 2017-10-16 21:09 - 000519584 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\netio.sys 2017-10-16 21:09 - 2017-10-16 21:09 - 000518144 _____ C:\WINDOWS\SysWOW64\msjetoledb40.dll 2017-10-16 21:09 - 2017-10-16 21:09 - 000512000 _____ (Microsoft Corporation) C:\WINDOWS\system32\twinapi.dll 2017-10-16 21:09 - 2017-10-16 21:09 - 000511896 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\usbhub.sys 2017-10-16 21:09 - 2017-10-16 21:09 - 000500224 _____ (Microsoft Corporation) C:\WINDOWS\system32\Windows.Shell.BlueLightReduction.dll 2017-10-16 21:09 - 2017-10-16 21:09 - 000499712 _____ (Microsoft Corporation) C:\WINDOWS\system32\nltest.exe 2017-10-16 21:09 - 2017-10-16 21:09 - 000498688 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\Microsoft.Uev.Office2013CustomActions.dll 2017-10-16 21:09 - 2017-10-16 21:09 - 000497152 _____ (Microsoft Corporation) C:\WINDOWS\system32\rastls.dll 2017-10-16 21:09 - 2017-10-16 21:09 - 000491520 _____ (Microsoft Corporation) C:\WINDOWS\system32\SettingsHandlers_Display.dll 2017-10-16 21:09 - 2017-10-16 21:09 - 000491520 _____ (Microsoft Corporation) C:\WINDOWS\system32\NgcCtnrSvc.dll 2017-10-16 21:09 - 2017-10-16 21:09 - 000482816 _____ (Microsoft Corporation) C:\WINDOWS\system32\dmenrollengine.dll 2017-10-16 21:09 - 2017-10-16 21:09 - 000477696 _____ (Microsoft Corporation) C:\WINDOWS\system32\rasplap.dll 2017-10-16 21:09 - 2017-10-16 21:09 - 000476160 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\dsreg.dll 2017-10-16 21:09 - 2017-10-16 21:09 - 000476160 _____ (Microsoft Corporation) C:\WINDOWS\system32\Windows.UI.Core.TextInput.dll 2017-10-16 21:09 - 2017-10-16 21:09 - 000475648 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\msxbde40.dll 2017-10-16 21:09 - 2017-10-16 21:09 - 000473240 _____ (Microsoft Corporation) C:\WINDOWS\system32\policymanager.dll 2017-10-16 21:09 - 2017-10-16 21:09 - 000471040 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\TpmCoreProvisioning.dll 2017-10-16 21:09 - 2017-10-16 21:09 - 000463360 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\webio.dll 2017-10-16 21:09 - 2017-10-16 21:09 - 000461824 _____ (Microsoft Corporation) C:\WINDOWS\system32\wlansec.dll 2017-10-16 21:09 - 2017-10-16 21:09 - 000458752 _____ (Microsoft Corporation) C:\WINDOWS\system32\NgcCtnr.dll 2017-10-16 21:09 - 2017-10-16 21:09 - 000455584 _____ (Microsoft Corporation) C:\WINDOWS\system32\hal.dll 2017-10-16 21:09 - 2017-10-16 21:09 - 000450048 _____ (Microsoft Corporation) C:\WINDOWS\system32\bcdedit.exe 2017-10-16 21:09 - 2017-10-16 21:09 - 000447488 _____ (Microsoft Corporation) C:\WINDOWS\system32\win32k.sys 2017-10-16 21:09 - 2017-10-16 21:09 - 000440320 _____ (Microsoft Corporation) C:\WINDOWS\system32\windows.immersiveshell.serviceprovider.dll 2017-10-16 21:09 - 2017-10-16 21:09 - 000438096 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\Windows.ApplicationModel.dll 2017-10-16 21:09 - 2017-10-16 21:09 - 000433152 _____ (Microsoft Corporation) C:\WINDOWS\system32\msIso.dll 2017-10-16 21:09 - 2017-10-16 21:09 - 000431616 _____ (Microsoft Corporation) C:\WINDOWS\system32\BthHFSrv.dll 2017-10-16 21:09 - 2017-10-16 21:09 - 000422400 _____ (Microsoft Corporation) C:\WINDOWS\system32\WpAXHolder.dll 2017-10-16 21:09 - 2017-10-16 21:09 - 000420864 _____ (Microsoft Corporation) C:\WINDOWS\system32\facecredentialprovider.dll 2017-10-16 21:09 - 2017-10-16 21:09 - 000417792 _____ (Microsoft Corporation) C:\WINDOWS\system32\InstallAgentUserBroker.exe 2017-10-16 21:09 - 2017-10-16 21:09 - 000414296 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\TextInputFramework.dll 2017-10-16 21:09 - 2017-10-16 21:09 - 000413184 _____ (Microsoft Corporation) C:\WINDOWS\system32\profsvc.dll 2017-10-16 21:09 - 2017-10-16 21:09 - 000412160 _____ (Microsoft Corporation) C:\WINDOWS\system32\updatehandlers.dll 2017-10-16 21:09 - 2017-10-16 21:09 - 000412160 _____ (Microsoft Corporation) C:\WINDOWS\system32\ActivationManager.dll 2017-10-16 21:09 - 2017-10-16 21:09 - 000410168 _____ (Microsoft Corporation) C:\WINDOWS\system32\Faultrep.dll 2017-10-16 21:09 - 2017-10-16 21:09 - 000409600 _____ (Microsoft Corporation) C:\WINDOWS\system32\cryptngc.dll 2017-10-16 21:09 - 2017-10-16 21:09 - 000408984 _____ (Microsoft Corporation) C:\WINDOWS\system32\msv1_0.dll 2017-10-16 21:09 - 2017-10-16 21:09 - 000407040 _____ (Microsoft Corporation) C:\WINDOWS\system32\wuuhext.dll 2017-10-16 21:09 - 2017-10-16 21:09 - 000406944 _____ (Microsoft Corporation) C:\WINDOWS\system32\AppVScripting.dll 2017-10-16 21:09 - 2017-10-16 21:09 - 000404480 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\werui.dll 2017-10-16 21:09 - 2017-10-16 21:09 - 000397312 _____ (Microsoft Corporation) C:\WINDOWS\system32\rascustom.dll 2017-10-16 21:09 - 2017-10-16 21:09 - 000385536 _____ (Microsoft Corporation) C:\WINDOWS\system32\tpmvsc.dll 2017-10-16 21:09 - 2017-10-16 21:09 - 000383488 _____ (Microsoft Corporation) C:\WINDOWS\system32\InstallAgent.exe 2017-10-16 21:09 - 2017-10-16 21:09 - 000382368 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\clfs.sys 2017-10-16 21:09 - 2017-10-16 21:09 - 000381824 _____ (Microsoft Corporation) C:\WINDOWS\system32\wevtapi.dll 2017-10-16 21:09 - 2017-10-16 21:09 - 000375808 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\mspbde40.dll 2017-10-16 21:09 - 2017-10-16 21:09 - 000370688 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\FirewallAPI.dll 2017-10-16 21:09 - 2017-10-16 21:09 - 000370688 _____ (Microsoft Corporation) C:\WINDOWS\system32\rastlsext.dll 2017-10-16 21:09 - 2017-10-16 21:09 - 000365056 _____ (Microsoft Corporation) C:\WINDOWS\system32\SettingsHandlers_Notifications.dll 2017-10-16 21:09 - 2017-10-16 21:09 - 000359560 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\Faultrep.dll 2017-10-16 21:09 - 2017-10-16 21:09 - 000353280 _____ (Microsoft Corporation) C:\WINDOWS\system32\ntprint.dll 2017-10-16 21:09 - 2017-10-16 21:09 - 000350720 _____ (Microsoft Corporation) C:\WINDOWS\system32\Windows.Graphics.dll 2017-10-16 21:09 - 2017-10-16 21:09 - 000347648 _____ (Microsoft Corporation) C:\WINDOWS\system32\mcbuilder.exe 2017-10-16 21:09 - 2017-10-16 21:09 - 000347544 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\msv1_0.dll 2017-10-16 21:09 - 2017-10-16 21:09 - 000345088 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\msexcl40.dll 2017-10-16 21:09 - 2017-10-16 21:09 - 000343552 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\msrd3x40.dll 2017-10-16 21:09 - 2017-10-16 21:09 - 000334336 _____ (Microsoft Corporation) C:\WINDOWS\system32\wc_storage.dll 2017-10-16 21:09 - 2017-10-16 21:09 - 000329728 _____ (Microsoft Corporation) C:\WINDOWS\system32\RasMediaManager.dll 2017-10-16 21:09 - 2017-10-16 21:09 - 000327168 _____ (Microsoft Corporation) C:\WINDOWS\system32\WinBioDataModel.dll 2017-10-16 21:09 - 2017-10-16 21:09 - 000324096 _____ (Microsoft Corporation) C:\WINDOWS\system32\DeviceEnroller.exe 2017-10-16 21:09 - 2017-10-16 21:09 - 000323936 _____ (Microsoft Corporation) C:\WINDOWS\system32\shlwapi.dll 2017-10-16 21:09 - 2017-10-16 21:09 - 000321024 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\Vid.sys 2017-10-16 21:09 - 2017-10-16 21:09 - 000318232 _____ (Microsoft Corporation) C:\WINDOWS\system32\wininit.exe 2017-10-16 21:09 - 2017-10-16 21:09 - 000316320 _____ (Microsoft Corporation) C:\WINDOWS\system32\WerFault.exe 2017-10-16 21:09 - 2017-10-16 21:09 - 000315904 _____ (Microsoft Corporation) C:\WINDOWS\system32\ncryptprov.dll 2017-10-16 21:09 - 2017-10-16 21:09 - 000312320 _____ (Microsoft Corporation) C:\WINDOWS\system32\Phoneutil.dll 2017-10-16 21:09 - 2017-10-16 21:09 - 000310272 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\msrd2x40.dll 2017-10-16 21:09 - 2017-10-16 21:09 - 000308224 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\cryptngc.dll 2017-10-16 21:09 - 2017-10-16 21:09 - 000306176 _____ (Microsoft Corporation) C:\WINDOWS\system32\MusNotification.exe 2017-10-16 21:09 - 2017-10-16 21:09 - 000305152 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\netbt.sys 2017-10-16 21:09 - 2017-10-16 21:09 - 000304640 _____ (Microsoft Corporation) C:\WINDOWS\system32\dusmsvc.dll 2017-10-16 21:09 - 2017-10-16 21:09 - 000303104 _____ (Microsoft Corporation) C:\WINDOWS\system32\srvsvc.dll 2017-10-16 21:09 - 2017-10-16 21:09 - 000301568 _____ (Microsoft Corporation) C:\WINDOWS\system32\VmSynthNic.dll 2017-10-16 21:09 - 2017-10-16 21:09 - 000293376 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\win32k.sys 2017-10-16 21:09 - 2017-10-16 21:09 - 000291904 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\wevtapi.dll 2017-10-16 21:09 - 2017-10-16 21:09 - 000290816 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\msjtes40.dll 2017-10-16 21:09 - 2017-10-16 21:09 - 000290816 _____ (Microsoft Corporation) C:\WINDOWS\system32\dmenterprisediagnostics.dll 2017-10-16 21:09 - 2017-10-16 21:09 - 000287648 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\sdbus.sys 2017-10-16 21:09 - 2017-10-16 21:09 - 000282112 _____ (Microsoft Corporation) C:\WINDOWS\system32\dnsrslvr.dll 2017-10-16 21:09 - 2017-10-16 21:09 - 000280480 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\WerFault.exe 2017-10-16 21:09 - 2017-10-16 21:09 - 000279968 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\msiscsi.sys 2017-10-16 21:09 - 2017-10-16 21:09 - 000274432 _____ (Microsoft Corporation) C:\WINDOWS\system32\authz.dll 2017-10-16 21:09 - 2017-10-16 21:09 - 000272896 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\mstext40.dll 2017-10-16 21:09 - 2017-10-16 21:09 - 000268288 _____ (Microsoft Corporation) C:\WINDOWS\system32\wisp.dll 2017-10-16 21:09 - 2017-10-16 21:09 - 000267264 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\ncryptprov.dll 2017-10-16 21:09 - 2017-10-16 21:09 - 000259400 _____ (Microsoft Corporation) C:\WINDOWS\system32\MusNotifyIcon.exe 2017-10-16 21:09 - 2017-10-16 21:09 - 000259072 _____ (Microsoft Corporation) C:\WINDOWS\system32\SettingsHandlers_Flights.dll 2017-10-16 21:09 - 2017-10-16 21:09 - 000257432 _____ (Microsoft Corporation) C:\WINDOWS\system32\AppxAllUserStore.dll 2017-10-16 21:09 - 2017-10-16 21:09 - 000256000 _____ (Microsoft Corporation) C:\WINDOWS\system32\domgmt.dll 2017-10-16 21:09 - 2017-10-16 21:09 - 000254976 _____ (Microsoft Corporation) C:\WINDOWS\system32\scksp.dll 2017-10-16 21:09 - 2017-10-16 21:09 - 000254976 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\srvnet.sys 2017-10-16 21:09 - 2017-10-16 21:09 - 000249344 _____ (Microsoft Corporation) C:\WINDOWS\system32\coredpus.dll 2017-10-16 21:09 - 2017-10-16 21:09 - 000243712 _____ (Microsoft Corporation) C:\WINDOWS\system32\shdocvw.dll 2017-10-16 21:09 - 2017-10-16 21:09 - 000240640 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\msltus40.dll 2017-10-16 21:09 - 2017-10-16 21:09 - 000235424 _____ (Microsoft Corporation) C:\WINDOWS\system32\AppVShNotify.exe 2017-10-16 21:09 - 2017-10-16 21:09 - 000231936 _____ (Microsoft Corporation) C:\WINDOWS\system32\DolbyMATEnc.dll 2017-10-16 21:09 - 2017-10-16 21:09 - 000229888 _____ (Microsoft Corporation) C:\WINDOWS\system32\SIHClient.exe 2017-10-16 21:09 - 2017-10-16 21:09 - 000228248 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\mrxsmb20.sys 2017-10-16 21:09 - 2017-10-16 21:09 - 000221696 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\wisp.dll 2017-10-16 21:09 - 2017-10-16 21:09 - 000213504 _____ (Microsoft Corporation) C:\WINDOWS\system32\dinput8.dll 2017-10-16 21:09 - 2017-10-16 21:09 - 000212384 _____ (Microsoft Corporation) C:\WINDOWS\system32\browserbroker.dll 2017-10-16 21:09 - 2017-10-16 21:09 - 000210432 _____ (Microsoft Corporation) C:\WINDOWS\system32\tetheringservice.dll 2017-10-16 21:09 - 2017-10-16 21:09 - 000209920 _____ (Microsoft Corporation) C:\WINDOWS\system32\smartscreenps.dll 2017-10-16 21:09 - 2017-10-16 21:09 - 000209408 _____ (Microsoft Corporation) C:\WINDOWS\system32\psmsrv.dll 2017-10-16 21:09 - 2017-10-16 21:09 - 000208896 _____ (Microsoft Corporation) C:\WINDOWS\system32\wscsvc.dll 2017-10-16 21:09 - 2017-10-16 21:09 - 000203680 _____ (Microsoft Corporation) C:\WINDOWS\system32\AppVStreamingUX.dll 2017-10-16 21:09 - 2017-10-16 21:09 - 000203672 _____ (Microsoft Corporation) C:\WINDOWS\system32\basecsp.dll 2017-10-16 21:09 - 2017-10-16 21:09 - 000201728 _____ (Microsoft Corporation) C:\WINDOWS\system32\RstrtMgr.dll 2017-10-16 21:09 - 2017-10-16 21:09 - 000197120 _____ (Microsoft Corporation) C:\WINDOWS\system32\bcdboot.exe 2017-10-16 21:09 - 2017-10-16 21:09 - 000194560 _____ (Microsoft Corporation) C:\WINDOWS\system32\rpchttp.dll 2017-10-16 21:09 - 2017-10-16 21:09 - 000194048 _____ (Microsoft Corporation) C:\WINDOWS\system32\mdmregistration.dll 2017-10-16 21:09 - 2017-10-16 21:09 - 000192264 _____ (Microsoft Corporation) C:\WINDOWS\system32\mfsensorgroup.dll 2017-10-16 21:09 - 2017-10-16 21:09 - 000189440 _____ (Microsoft Corporation) C:\WINDOWS\system32\BluetoothApis.dll 2017-10-16 21:09 - 2017-10-16 21:09 - 000189344 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\dumpsd.sys 2017-10-16 21:09 - 2017-10-16 21:09 - 000184832 _____ (Microsoft Corporation) C:\WINDOWS\system32\VCardParser.dll 2017-10-16 21:09 - 2017-10-16 21:09 - 000184728 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\appid.sys 2017-10-16 21:09 - 2017-10-16 21:09 - 000182688 _____ (Microsoft Corporation) C:\WINDOWS\system32\wermgr.exe 2017-10-16 21:09 - 2017-10-16 21:09 - 000182680 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\AppxAllUserStore.dll 2017-10-16 21:09 - 2017-10-16 21:09 - 000182272 _____ (Microsoft Corporation) C:\WINDOWS\system32\ngcrecovery.dll 2017-10-16 21:09 - 2017-10-16 21:09 - 000181912 _____ (Microsoft Corporation) C:\WINDOWS\system32\sspicli.dll 2017-10-16 21:09 - 2017-10-16 21:09 - 000181760 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\authz.dll 2017-10-16 21:09 - 2017-10-16 21:09 - 000180736 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\rfcomm.sys 2017-10-16 21:09 - 2017-10-16 21:09 - 000179200 _____ (Microsoft Corporation) C:\WINDOWS\system32\BitLockerCsp.dll 2017-10-16 21:09 - 2017-10-16 21:09 - 000176640 _____ (Microsoft Corporation) C:\WINDOWS\system32\wersvc.dll 2017-10-16 21:09 - 2017-10-16 21:09 - 000173976 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\usbccgp.sys 2017-10-16 21:09 - 2017-10-16 21:09 - 000173104 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\mfsensorgroup.dll 2017-10-16 21:09 - 2017-10-16 21:09 - 000169376 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\wermgr.exe 2017-10-16 21:09 - 2017-10-16 21:09 - 000168448 _____ (Microsoft Corporation) C:\WINDOWS\system32\MusNotificationUx.exe 2017-10-16 21:09 - 2017-10-16 21:09 - 000165888 _____ (Microsoft Corporation) C:\WINDOWS\system32\storewuauth.dll 2017-10-16 21:09 - 2017-10-16 21:09 - 000160768 _____ (Microsoft Corporation) C:\WINDOWS\system32\dinput.dll 2017-10-16 21:09 - 2017-10-16 21:09 - 000159648 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\partmgr.sys 2017-10-16 21:09 - 2017-10-16 21:09 - 000156160 _____ (Microsoft Corporation) C:\WINDOWS\system32\csplte.dll 2017-10-16 21:09 - 2017-10-16 21:09 - 000154624 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\DWWIN.EXE 2017-10-16 21:09 - 2017-10-16 21:09 - 000154624 _____ (Microsoft Corporation) C:\WINDOWS\system32\regsvc.dll 2017-10-16 21:09 - 2017-10-16 21:09 - 000153088 _____ (Microsoft Corporation) C:\WINDOWS\system32\fdeploy.dll 2017-10-16 21:09 - 2017-10-16 21:09 - 000150528 _____ (Microsoft Corporation) C:\WINDOWS\system32\qasf.dll 2017-10-16 21:09 - 2017-10-16 21:09 - 000150016 _____ (Microsoft Corporation) C:\WINDOWS\system32\iscsiexe.dll 2017-10-16 21:09 - 2017-10-16 21:09 - 000147456 _____ (Microsoft Corporation) C:\WINDOWS\system32\TabSvc.dll 2017-10-16 21:09 - 2017-10-16 21:09 - 000143872 _____ (Microsoft Corporation) C:\WINDOWS\system32\profsvcext.dll 2017-10-16 21:09 - 2017-10-16 21:09 - 000143736 _____ (Microsoft Corporation) C:\WINDOWS\system32\WerFaultSecure.exe 2017-10-16 21:09 - 2017-10-16 21:09 - 000142848 _____ (Microsoft Corporation) C:\WINDOWS\system32\srpapi.dll 2017-10-16 21:09 - 2017-10-16 21:09 - 000140800 _____ (Microsoft Corporation) C:\WINDOWS\system32\dmcsps.dll 2017-10-16 21:09 - 2017-10-16 21:09 - 000139776 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\BluetoothApis.dll 2017-10-16 21:09 - 2017-10-16 21:09 - 000138752 _____ (Microsoft Corporation) C:\WINDOWS\system32\appinfo.dll 2017-10-16 21:09 - 2017-10-16 21:09 - 000136192 _____ (Microsoft Corporation) C:\WINDOWS\system32\Windows.StateRepositoryUpgrade.dll 2017-10-16 21:09 - 2017-10-16 21:09 - 000135576 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\ksecdd.sys 2017-10-16 21:09 - 2017-10-16 21:09 - 000133904 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\WerFaultSecure.exe 2017-10-16 21:09 - 2017-10-16 21:09 - 000133632 _____ (Microsoft Corporation) C:\WINDOWS\system32\CfgSPCellular.dll 2017-10-16 21:09 - 2017-10-16 21:09 - 000133120 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\t2embed.dll 2017-10-16 21:09 - 2017-10-16 21:09 - 000131584 _____ (Microsoft Corporation) C:\WINDOWS\system32\EnterpriseAPNCsp.dll 2017-10-16 21:09 - 2017-10-16 21:09 - 000130560 _____ (Microsoft Corporation) C:\WINDOWS\system32\policymanagerprecheck.dll 2017-10-16 21:09 - 2017-10-16 21:09 - 000130560 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\bthpan.sys 2017-10-16 21:09 - 2017-10-16 21:09 - 000130048 _____ (Microsoft Corporation) C:\WINDOWS\system32\Robocopy.exe 2017-10-16 21:09 - 2017-10-16 21:09 - 000128512 _____ (Microsoft Corporation) C:\WINDOWS\system32\rasman.dll 2017-10-16 21:09 - 2017-10-16 21:09 - 000128512 _____ (Microsoft Corporation) C:\WINDOWS\system32\mssprxy.dll 2017-10-16 21:09 - 2017-10-16 21:09 - 000124928 _____ (Microsoft Corporation) C:\WINDOWS\system32\InputLocaleManager.dll 2017-10-16 21:09 - 2017-10-16 21:09 - 000124928 _____ (Microsoft Corporation) C:\WINDOWS\system32\httpprxm.dll 2017-10-16 21:09 - 2017-10-16 21:09 - 000123904 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\srpapi.dll 2017-10-16 21:09 - 2017-10-16 21:09 - 000119904 _____ (Microsoft Corporation) C:\WINDOWS\system32\dmcmnutils.dll 2017-10-16 21:09 - 2017-10-16 21:09 - 000119712 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\tdx.sys 2017-10-16 21:09 - 2017-10-16 21:09 - 000117760 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\Windows.StateRepositoryUpgrade.dll 2017-10-16 21:09 - 2017-10-16 21:09 - 000117248 _____ (Microsoft Corporation) C:\WINDOWS\system32\eShims.dll 2017-10-16 21:09 - 2017-10-16 21:09 - 000116280 _____ (Microsoft Corporation) C:\WINDOWS\system32\bcd.dll 2017-10-16 21:09 - 2017-10-16 21:09 - 000115792 _____ (Microsoft Corporation) C:\WINDOWS\system32\win32u.dll 2017-10-16 21:09 - 2017-10-16 21:09 - 000115712 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\bridge.sys 2017-10-16 21:09 - 2017-10-16 21:09 - 000113152 _____ (Microsoft Corporation) C:\WINDOWS\system32\wuuhosdeployment.dll 2017-10-16 21:09 - 2017-10-16 21:09 - 000112640 _____ (Microsoft Corporation) C:\WINDOWS\system32\MDMAppInstaller.exe 2017-10-16 21:09 - 2017-10-16 21:09 - 000107008 _____ (Microsoft Corporation) C:\WINDOWS\system32\ngcpopkeysrv.dll 2017-10-16 21:09 - 2017-10-16 21:09 - 000107008 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\hidbth.sys 2017-10-16 21:09 - 2017-10-16 21:09 - 000105472 _____ (Microsoft Corporation) C:\WINDOWS\system32\RjvMDMConfig.dll 2017-10-16 21:09 - 2017-10-16 21:09 - 000105472 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\bthenum.sys 2017-10-16 21:09 - 2017-10-16 21:09 - 000104960 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\UcmCx.sys 2017-10-16 21:09 - 2017-10-16 21:09 - 000104432 _____ (Microsoft Corporation) C:\WINDOWS\system32\msacm32.dll 2017-10-16 21:09 - 2017-10-16 21:09 - 000102912 _____ (Microsoft Corporation) C:\WINDOWS\system32\updatepolicy.dll 2017-10-16 21:09 - 2017-10-16 21:09 - 000102912 _____ (Microsoft Corporation) C:\WINDOWS\system32\officecsp.dll 2017-10-16 21:09 - 2017-10-16 21:09 - 000097792 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\bthhfenum.sys 2017-10-16 21:09 - 2017-10-16 21:09 - 000097280 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\Microsoft.Bluetooth.Legacy.LEEnumerator.sys 2017-10-16 21:09 - 2017-10-16 21:09 - 000095232 _____ (Microsoft Corporation) C:\WINDOWS\system32\wudriver.dll 2017-10-16 21:09 - 2017-10-16 21:09 - 000094624 _____ (Microsoft Corporation) C:\WINDOWS\system32\rdpudd.dll 2017-10-16 21:09 - 2017-10-16 21:09 - 000093696 _____ (Microsoft Corporation) C:\WINDOWS\system32\spbcd.dll 2017-10-16 21:09 - 2017-10-16 21:09 - 000090464 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\msacm32.dll 2017-10-16 21:09 - 2017-10-16 21:09 - 000090112 _____ (Microsoft Corporation) C:\WINDOWS\system32\ofdeploy.exe 2017-10-16 21:09 - 2017-10-16 21:09 - 000090112 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\vpcivsp.sys 2017-10-16 21:09 - 2017-10-16 21:09 - 000090112 _____ (Microsoft Corporation) C:\WINDOWS\system32\datamarketsvc.dll 2017-10-16 21:09 - 2017-10-16 21:09 - 000087040 _____ (Microsoft Corporation) C:\WINDOWS\system32\usoapi.dll 2017-10-16 21:09 - 2017-10-16 21:09 - 000086528 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\updatepolicy.dll 2017-10-16 21:09 - 2017-10-16 21:09 - 000083968 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\msjter40.dll 2017-10-16 21:09 - 2017-10-16 21:09 - 000083968 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\vmbkmclr.sys 2017-10-16 21:09 - 2017-10-16 21:09 - 000082336 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\vmbkmcl.sys 2017-10-16 21:09 - 2017-10-16 21:09 - 000081176 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\win32u.dll 2017-10-16 21:09 - 2017-10-16 21:09 - 000079872 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\wudriver.dll 2017-10-16 21:09 - 2017-10-16 21:09 - 000078848 _____ (Microsoft Corporation) C:\WINDOWS\system32\setbcdlocale.dll 2017-10-16 21:09 - 2017-10-16 21:09 - 000078848 _____ (Microsoft Corporation) C:\WINDOWS\system32\offreg.dll 2017-10-16 21:09 - 2017-10-16 21:09 - 000078240 _____ (Microsoft Corporation) C:\WINDOWS\system32\SyncAppvPublishingServer.exe 2017-10-16 21:09 - 2017-10-16 21:09 - 000074240 _____ (Microsoft Corporation) C:\WINDOWS\system32\EnterpriseDesktopAppMgmtCSP.dll 2017-10-16 21:09 - 2017-10-16 21:09 - 000072944 _____ (Microsoft Corporation) C:\WINDOWS\system32\easinvoker.exe 2017-10-16 21:09 - 2017-10-16 21:09 - 000071680 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\usbser.sys 2017-10-16 21:09 - 2017-10-16 21:09 - 000064680 _____ (Microsoft Corporation) C:\WINDOWS\system32\appidapi.dll 2017-10-16 21:09 - 2017-10-16 21:09 - 000064512 _____ (Microsoft Corporation) C:\WINDOWS\system32\winsrv.dll 2017-10-16 21:09 - 2017-10-16 21:09 - 000064512 _____ (Microsoft Corporation) C:\WINDOWS\system32\vmmsprox.dll 2017-10-16 21:09 - 2017-10-16 21:09 - 000064000 _____ (Microsoft Corporation) C:\WINDOWS\system32\wups.dll 2017-10-16 21:09 - 2017-10-16 21:09 - 000064000 _____ (Microsoft Corporation) C:\WINDOWS\system32\ntprint.exe 2017-10-16 21:09 - 2017-10-16 21:09 - 000061952 _____ (Microsoft Corporation) C:\WINDOWS\system32\vss_ps.dll 2017-10-16 21:09 - 2017-10-16 21:09 - 000060928 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\usoapi.dll 2017-10-16 21:09 - 2017-10-16 21:09 - 000060416 _____ (Microsoft Corporation) C:\WINDOWS\system32\tetheringclient.dll 2017-10-16 21:09 - 2017-10-16 21:09 - 000059392 _____ (Microsoft Corporation) C:\WINDOWS\system32\DmApiSetExtImplDesktop.dll 2017-10-16 21:09 - 2017-10-16 21:09 - 000057976 _____ (Microsoft Corporation) C:\WINDOWS\system32\lsass.exe 2017-10-16 21:09 - 2017-10-16 21:09 - 000057344 _____ (Microsoft Corporation) C:\WINDOWS\system32\efssvc.dll 2017-10-16 21:09 - 2017-10-16 21:09 - 000056832 _____ (Microsoft Corporation) C:\WINDOWS\system32\cldapi.dll 2017-10-16 21:09 - 2017-10-16 21:09 - 000052736 _____ (Microsoft Corporation) C:\WINDOWS\system32\ServiceWorkerHost.exe 2017-10-16 21:09 - 2017-10-16 21:09 - 000052736 _____ (Microsoft Corporation) C:\WINDOWS\system32\musdialoghandlers.dll 2017-10-16 21:09 - 2017-10-16 21:09 - 000051712 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\UcmUcsi.sys 2017-10-16 21:09 - 2017-10-16 21:09 - 000050176 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\cldapi.dll 2017-10-16 21:09 - 2017-10-16 21:09 - 000049720 _____ (Microsoft Corporation) C:\WINDOWS\system32\tbs.dll 2017-10-16 21:09 - 2017-10-16 21:09 - 000046592 _____ (Microsoft Corporation) C:\WINDOWS\system32\sscore.dll 2017-10-16 21:09 - 2017-10-16 21:09 - 000046592 _____ (Microsoft Corporation) C:\WINDOWS\system32\cipher.exe 2017-10-16 21:09 - 2017-10-16 21:09 - 000045056 _____ (Microsoft Corporation) C:\WINDOWS\system32\TokenBrokerUI.dll 2017-10-16 21:09 - 2017-10-16 21:09 - 000044032 _____ (Microsoft Corporation) C:\WINDOWS\system32\cmintegrator.dll 2017-10-16 21:09 - 2017-10-16 21:09 - 000043520 _____ (Microsoft Corporation) C:\WINDOWS\system32\TpmTasks.dll 2017-10-16 21:09 - 2017-10-16 21:09 - 000043520 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\nsiproxy.sys 2017-10-16 21:09 - 2017-10-16 21:09 - 000042496 _____ (Microsoft Corporation) C:\WINDOWS\system32\tokenbinding.dll 2017-10-16 21:09 - 2017-10-16 21:09 - 000042456 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\tbs.dll 2017-10-16 21:09 - 2017-10-16 21:09 - 000039424 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\buttonconverter.sys 2017-10-16 21:09 - 2017-10-16 21:09 - 000038400 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\TokenBrokerUI.dll 2017-10-16 21:09 - 2017-10-16 21:09 - 000037376 _____ (Microsoft Corporation) C:\WINDOWS\system32\SEMgrPS.dll 2017-10-16 21:09 - 2017-10-16 21:09 - 000035840 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\sscore.dll 2017-10-16 21:09 - 2017-10-16 21:09 - 000035840 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\BasicRender.sys 2017-10-16 21:09 - 2017-10-16 21:09 - 000034816 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\tokenbinding.dll 2017-10-16 21:09 - 2017-10-16 21:09 - 000031932 _____ C:\WINDOWS\system32\edgehtmlpluginpolicy.bin 2017-10-16 21:09 - 2017-10-16 21:09 - 000029696 _____ (Microsoft Corporation) C:\WINDOWS\system32\odbcconf.dll 2017-10-16 21:09 - 2017-10-16 21:09 - 000029184 _____ (Microsoft Corporation) C:\WINDOWS\system32\sspisrv.dll 2017-10-16 21:09 - 2017-10-16 21:09 - 000025088 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\odbcconf.dll 2017-10-16 21:09 - 2017-10-16 21:09 - 000023040 _____ (Microsoft Corporation) C:\WINDOWS\system32\mgmtapi.dll 2017-10-16 21:09 - 2017-10-16 21:09 - 000022528 _____ (Microsoft Corporation) C:\WINDOWS\system32\IpNatHlpClient.dll 2017-10-16 21:09 - 2017-10-16 21:09 - 000008704 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\msjint40.dll 2017-10-16 20:54 - 2017-03-18 02:48 - 000094720 _____ (Microsoft Corporation) C:\WINDOWS\system32\DxToolsReportGenerator.dll 2017-10-16 20:54 - 2017-03-18 02:08 - 017777152 _____ (Microsoft Corporation) C:\WINDOWS\system32\DXCaptureReplay.dll 2017-10-16 20:54 - 2017-03-18 02:05 - 000094720 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\DxToolsReportGenerator.dll 2017-10-16 20:54 - 2017-03-18 02:02 - 000393216 _____ (Windows (R) Win 7 DDK provider) C:\WINDOWS\system32\DXCpl.exe 2017-10-16 20:54 - 2017-03-18 02:00 - 002963968 _____ (Microsoft Corporation) C:\WINDOWS\system32\NL7Models0804.dll 2017-10-16 20:54 - 2017-03-18 02:00 - 000409600 _____ (Microsoft Corporation) C:\WINDOWS\system32\NL7Lexicons0804.dll 2017-10-16 20:54 - 2017-03-18 01:59 - 000091136 _____ (Microsoft Corporation) C:\WINDOWS\system32\VsGraphicsProxyStub.dll 2017-10-16 20:54 - 2017-03-18 01:59 - 000079872 _____ (Microsoft Corporation) C:\WINDOWS\system32\VSD3DWARP12Debug.dll 2017-10-16 20:54 - 2017-03-18 01:57 - 000059392 _____ (Microsoft Corporation) C:\WINDOWS\system32\VSD3DWARPDebug.dll 2017-10-16 20:54 - 2017-03-18 01:54 - 000708608 _____ (Microsoft Corporation) C:\WINDOWS\system32\MSWB70804.dll 2017-10-16 20:54 - 2017-03-18 01:53 - 000334848 _____ (Microsoft Corporation) C:\WINDOWS\system32\DXGIDebug.dll 2017-10-16 20:54 - 2017-03-18 01:52 - 004897280 _____ (Microsoft Corporation) C:\WINDOWS\system32\VsGraphicsRemoteEngine.exe 2017-10-16 20:54 - 2017-03-18 01:52 - 003423744 _____ (Microsoft Corporation) C:\WINDOWS\system32\NL7Data0804.dll 2017-10-16 20:54 - 2017-03-18 01:49 - 001309184 _____ (Microsoft Corporation) C:\WINDOWS\system32\d3d11_3SDKLayers.dll 2017-10-16 20:54 - 2017-03-18 01:48 - 013785600 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\DXCaptureReplay.dll 2017-10-16 20:54 - 2017-03-18 01:47 - 006806016 _____ (Microsoft Corporation) C:\WINDOWS\system32\d3d12warp.dll 2017-10-16 20:54 - 2017-03-18 01:46 - 000370176 _____ (Windows (R) Win 7 DDK provider) C:\WINDOWS\SysWOW64\DXCpl.exe 2017-10-16 20:54 - 2017-03-18 01:44 - 001977344 _____ (Microsoft Corporation) C:\WINDOWS\system32\DXToolsOfflineAnalysis.dll 2017-10-16 20:54 - 2017-03-18 01:44 - 001174528 _____ (Microsoft Corporation) C:\WINDOWS\system32\DXCap.exe 2017-10-16 20:54 - 2017-03-18 01:44 - 000283648 _____ (Microsoft Corporation) C:\WINDOWS\system32\VsGraphicsExperiment.dll 2017-10-16 20:54 - 2017-03-18 01:44 - 000163328 _____ (Microsoft Corporation) C:\WINDOWS\system32\VsGraphicsCapture.dll 2017-10-16 20:54 - 2017-03-18 01:43 - 000189952 _____ (Microsoft Corporation) C:\WINDOWS\system32\DXToolsMonitor.dll 2017-10-16 20:54 - 2017-03-18 01:43 - 000176128 _____ (Microsoft Corporation) C:\WINDOWS\system32\DXToolsReporting.dll 2017-10-16 20:54 - 2017-03-18 01:43 - 000061952 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\VSD3DWARP12Debug.dll 2017-10-16 20:54 - 2017-03-18 01:43 - 000041984 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\VsGraphicsProxyStub.dll 2017-10-16 20:54 - 2017-03-18 01:41 - 000058880 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\VSD3DWARPDebug.dll 2017-10-16 20:54 - 2017-03-18 01:39 - 000517632 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\MSWB70804.dll 2017-10-16 20:54 - 2017-03-18 01:39 - 000236544 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\DXGIDebug.dll 2017-10-16 20:54 - 2017-03-18 01:38 - 003356672 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\NL7Data0804.dll 2017-10-16 20:54 - 2017-03-18 01:38 - 000348672 _____ (Microsoft Corporation) C:\WINDOWS\system32\perf_gputiming.dll 2017-10-16 20:54 - 2017-03-18 01:35 - 001060864 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\d3d11_3SDKLayers.dll 2017-10-16 20:54 - 2017-03-18 01:33 - 003648000 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\VsGraphicsRemoteEngine.exe 2017-10-16 20:54 - 2017-03-18 01:30 - 001480704 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\DXToolsOfflineAnalysis.dll 2017-10-16 20:54 - 2017-03-18 01:30 - 000926208 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\DXCap.exe 2017-10-16 20:54 - 2017-03-18 01:30 - 000220160 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\VsGraphicsExperiment.dll 2017-10-16 20:54 - 2017-03-18 01:30 - 000123904 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\VsGraphicsCapture.dll 2017-10-16 20:54 - 2017-03-18 01:29 - 000145408 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\DXToolsMonitor.dll 2017-10-16 20:54 - 2017-03-18 01:29 - 000121344 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\DXToolsReporting.dll 2017-10-16 20:54 - 2017-03-18 01:25 - 000269824 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\perf_gputiming.dll 2017-10-16 20:54 - 2017-02-10 15:22 - 000001696 _____ C:\WINDOWS\system32\NOISE.CHS 2017-10-16 20:53 - 2017-10-16 17:22 - 000000000 ____D C:\WINDOWS\ServiceProfiles 2017-10-16 20:52 - 2017-10-16 20:52 - 000008192 _____ C:\WINDOWS\system32\config\userdiff 2017-10-16 20:51 - 2017-10-16 20:51 - 000002858 _____ C:\WINDOWS\System32\Tasks\CCleanerSkipUAC 2017-10-16 20:51 - 2017-10-16 20:51 - 000000863 _____ C:\Users\Public\Desktop\CCleaner.lnk 2017-10-16 20:51 - 2017-10-16 20:51 - 000000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\CCleaner 2017-10-16 20:51 - 2017-10-16 20:51 - 000000000 ____D C:\Program Files\CCleaner 2017-10-16 20:50 - 2017-10-16 21:12 - 000000000 ____D C:\Program Files\Hyper-V 2017-10-16 20:50 - 2017-10-16 20:50 - 000000000 ___SD C:\WINDOWS\system32\containers 2017-10-16 20:50 - 2017-10-16 20:50 - 000000000 ____D C:\WINDOWS\system32\BestPractices 2017-10-16 20:50 - 2017-10-16 20:50 - 000000000 ____D C:\Program Files\Reference Assemblies 2017-10-16 20:50 - 2017-10-16 20:50 - 000000000 ____D C:\Program Files\MSBuild 2017-10-16 20:50 - 2017-10-16 20:50 - 000000000 ____D C:\Program Files (x86)\Reference Assemblies 2017-10-16 20:50 - 2017-10-16 17:34 - 000000000 ____D C:\Program Files (x86)\MSBuild 2017-10-16 20:49 - 2017-02-10 15:26 - 001166520 _____ (Microsoft Corporation) C:\WINDOWS\system32\PresentationNative_v0300.dll 2017-10-16 20:49 - 2017-02-10 15:26 - 000124624 _____ (Microsoft Corporation) C:\WINDOWS\system32\PresentationCFFRasterizerNative_v0300.dll 2017-10-16 20:49 - 2017-02-10 15:26 - 000035480 _____ (Microsoft Corporation) C:\WINDOWS\system32\TsWpfWrp.exe 2017-10-16 20:49 - 2017-02-10 15:21 - 000778936 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\PresentationNative_v0300.dll 2017-10-16 20:49 - 2017-02-10 15:21 - 000103120 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\PresentationCFFRasterizerNative_v0300.dll 2017-10-16 20:49 - 2017-02-10 15:21 - 000035480 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\TsWpfWrp.exe 2017-10-16 18:57 - 2017-10-16 18:57 - 000000000 ____D C:\Users\jtssh\AppData\Local\DBG 2017-10-16 18:32 - 2017-10-16 18:32 - 000000000 ____D C:\ProgramData\Microsoft OneDrive 2017-10-16 18:29 - 2017-10-16 18:29 - 000000660 __RSH C:\Users\jtssh\ntuser.pol 2017-10-16 18:29 - 2017-10-16 18:29 - 000000020 ___SH C:\Users\jtssh\ntuser.ini 2017-10-16 18:11 - 2017-10-16 18:14 - 000007623 _____ C:\WINDOWS\diagwrn.xml 2017-10-16 18:11 - 2017-10-16 18:14 - 000007623 _____ C:\WINDOWS\diagerr.xml 2017-10-16 18:06 - 2017-10-20 20:37 - 000000006 ____H C:\WINDOWS\Tasks\SA.DAT 2017-10-16 18:06 - 2017-10-16 18:44 - 000003366 _____ C:\WINDOWS\System32\Tasks\OneDrive Standalone Update Task-S-1-5-21-1080822061-2706406846-2729724613-1001 2017-10-16 18:06 - 2017-10-16 18:06 - 000003452 _____ C:\WINDOWS\System32\Tasks\DropboxUpdateTaskMachineUA 2017-10-16 18:06 - 2017-10-16 18:06 - 000003344 _____ C:\WINDOWS\System32\Tasks\GoogleUpdateTaskMachineUA 2017-10-16 18:06 - 2017-10-16 18:06 - 000003228 _____ C:\WINDOWS\System32\Tasks\DropboxUpdateTaskMachineCore 2017-10-16 18:06 - 2017-10-16 18:06 - 000003120 _____ C:\WINDOWS\System32\Tasks\GoogleUpdateTaskMachineCore 2017-10-16 18:06 - 2017-10-16 18:06 - 000003044 _____ C:\WINDOWS\System32\Tasks\update-S-1-5-21-1080822061-2706406846-2729724613-1001 2017-10-16 18:06 - 2017-10-16 18:06 - 000002848 _____ C:\WINDOWS\System32\Tasks\JavaUpdateSched 2017-10-16 18:06 - 2017-10-16 18:06 - 000002788 _____ C:\WINDOWS\System32\Tasks\update-sys 2017-10-16 18:06 - 2017-10-16 18:06 - 000002532 _____ C:\WINDOWS\System32\Tasks\FRAPS 2017-10-16 18:06 - 2017-10-16 18:06 - 000002266 _____ C:\WINDOWS\System32\Tasks\{DB809003-7B2F-44E7-83F1-49431DD04D9F} 2017-10-16 18:06 - 2017-10-16 18:06 - 000002232 _____ C:\WINDOWS\System32\Tasks\{428BB90D-5CD7-4A7A-9D4B-96F59BEBAF19} 2017-10-16 18:06 - 2017-10-16 18:06 - 000002170 _____ C:\WINDOWS\System32\Tasks\USER_ESRV_SVC_WILLAMETTE 2017-10-16 18:06 - 2017-10-16 18:06 - 000000000 ____D C:\WINDOWS\System32\Tasks\Intel 2017-10-16 17:44 - 2017-10-16 17:44 - 000001576 _____ C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Windows Media Player.lnk 2017-10-16 17:34 - 2017-10-16 17:34 - 000000000 ____D C:\ProgramData\USOShared 2017-10-16 17:32 - 2017-10-16 17:45 - 000000000 ____D C:\WINDOWS\system32\config\bbimigrate 2017-10-16 17:29 - 2017-10-17 18:36 - 000000000 ____D C:\Users\jtssh 2017-10-16 17:28 - 2017-10-19 21:00 - 001055622 _____ C:\WINDOWS\system32\PerfStringBackup.INI 2017-10-16 17:28 - 2017-10-16 17:28 - 000939756 _____ C:\WINDOWS\SysWOW64\PerfStringBackup.INI 2017-10-16 17:27 - 2017-10-16 17:27 - 000000000 ____H C:\WINDOWS\system32\Drivers\Msft_User_WpdFs_01_11_00.Wdf 2017-10-16 17:27 - 2017-10-16 17:27 - 000000000 ____D C:\Program Files\Common Files\logishrd 2017-10-16 17:26 - 2017-03-18 16:56 - 002233344 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\PrintConfig.dll 2017-10-16 17:22 - 2017-10-21 11:29 - 000000000 ____D C:\WINDOWS\system32\SleepStudy 2017-10-16 17:22 - 2017-10-17 15:48 - 000245952 _____ C:\WINDOWS\system32\FNTCACHE.DAT 2017-10-16 00:10 - 2017-10-15 20:13 - 000000000 ____D C:\Users\jtssh\.idlerc 2017-10-15 23:57 - 2017-10-15 23:57 - 000000000 ____D C:\Users\jtssh\AppData\Local\pip 2017-10-15 23:52 - 2017-10-16 17:45 - 000000000 ____D C:\Users\jtssh\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Python 3.6 2017-10-15 23:49 - 2017-10-16 22:04 - 000000000 ____D C:\Users\jtssh\OneDrive\Documents\BonPon 2017-10-15 23:49 - 2017-10-15 23:49 - 000000000 ____D C:\Users\jtssh\OneDrive\Documents\New folder 2017-10-15 22:33 - 2017-10-16 21:08 - 000000000 ___DC C:\WINDOWS\Panther 2017-10-14 23:09 - 2017-10-14 23:09 - 000000000 ____D C:\Users\jtssh\.liclipse 2017-10-14 21:42 - 2017-10-14 21:43 - 000000000 ____D C:\Users\jtssh\.gradle 2017-10-14 20:48 - 2017-10-20 21:00 - 000000000 ____D C:\Users\jtssh\AppData\Local\Eclipse 2017-10-14 20:48 - 2017-10-20 21:00 - 000000000 ____D C:\Users\jtssh\.p2 2017-10-14 20:48 - 2017-10-14 20:48 - 000000000 ____D C:\Users\jtssh\.tooling 2017-10-14 20:47 - 2017-10-14 21:21 - 000000000 ____D C:\Users\jtssh\.eclipse 2017-10-14 20:45 - 2017-10-14 21:42 - 000000000 ____D C:\Users\jtssh\eclipse-workspace 2017-10-14 19:51 - 2017-10-20 15:35 - 000000000 ____D C:\ProgramData\Malwarebytes' Anti-Malware (portable) 2017-10-14 19:49 - 2017-10-20 15:35 - 000000000 ____D C:\Users\jtssh\Desktop\mbar 2017-10-14 19:44 - 2017-10-14 20:03 - 000144440 _____ (Oracle Corporation) C:\WINDOWS\system32\WindowsAccessBridge-64.dll 2017-10-14 10:07 - 2017-10-14 10:08 - 126925120 ____C (Microsoft Corporation) C:\WINDOWS\system32\MRT-KB890830.exe 2017-10-13 21:04 - 2017-10-13 21:04 - 000000000 ____D C:\Program Files (x86)\FFmpeg for Audacity 2017-10-11 20:54 - 2017-10-11 20:54 - 000000005 _____ C:\Users\jtssh\OneDrive\Documents\bongon-bot-export.json 2017-10-10 20:44 - 2017-10-10 20:44 - 000000180 _____ C:\Users\jtssh\.gitconfig 2017-10-06 22:41 - 2017-10-17 22:01 - 000000000 ____D C:\Users\jtssh\OneDrive\Documents\bongon 2017-10-05 19:49 - 2017-10-05 19:49 - 000000000 _____ C:\Users\jtssh\channel.type 2017-10-05 19:41 - 2017-10-05 19:50 - 000000000 _____ C:\Users\jtssh\{ 2017-10-03 17:27 - 2017-10-03 17:27 - 000890008 _____ (Python Software Foundation) C:\WINDOWS\pyw.exe 2017-10-03 17:27 - 2017-10-03 17:27 - 000889496 _____ (Python Software Foundation) C:\WINDOWS\py.exe 2017-09-29 07:47 - 2017-10-14 10:30 - 000000000 ____D C:\Program Files\rempl 2017-09-28 19:03 - 2017-10-16 17:45 - 000000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\XAMPP 2017-09-28 17:22 - 2017-09-28 23:36 - 000000000 ____D C:\xampp 2017-09-25 21:47 - 2017-10-14 14:40 - 000000000 ____D C:\Users\jtssh\AppData\Roaming\BetterDiscord 2017-09-23 19:13 - 2017-09-23 19:13 - 000221141 _____ C:\Users\jtssh\Desktop\GitHubLog.txt 2017-09-23 18:38 - 2017-10-16 18:44 - 000002367 _____ C:\Users\jtssh\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\OneDrive.lnk 2017-09-23 18:08 - 2017-09-23 18:24 - 000000000 ____D C:\Users\jtssh\OneDrive\Documents\ShiftBot 2017-09-23 12:16 - 2017-09-23 12:16 - 000000000 ____D C:\ShiftOS 2017-09-21 11:36 - 2017-09-21 11:36 - 000000000 ____D C:\Users\jtssh\AppData\LocalLow\Google ==================== One Month Modified files and folders ======== (If an entry is included in the fixlist, the file/folder will be moved.) 2017-10-21 11:38 - 2017-06-18 09:57 - 000000000 ____D C:\Users\jtssh\OneDrive\Documents\Setup 2017-10-21 09:03 - 2016-07-29 19:54 - 000000000 ____D C:\ProgramData\Oracle 2017-10-21 09:02 - 2017-09-19 15:51 - 000000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Java 2017-10-21 09:02 - 2016-07-29 20:06 - 000000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Java Development Kit 2017-10-21 09:02 - 2016-07-29 20:05 - 000000000 ____D C:\Program Files (x86)\Java 2017-10-21 09:01 - 2017-09-19 15:51 - 000097856 _____ (Oracle Corporation) C:\WINDOWS\SysWOW64\WindowsAccessBridge-32.dll 2017-10-20 20:37 - 2017-03-18 07:40 - 000786432 _____ C:\WINDOWS\system32\config\BBI 2017-10-20 20:10 - 2016-07-29 19:57 - 000000000 ____D C:\Program Files (x86)\Dropbox 2017-10-20 16:03 - 2017-09-01 07:09 - 000007605 _____ C:\Users\jtssh\AppData\Local\Resmon.ResmonCfg 2017-10-20 15:55 - 2017-03-18 17:03 - 000000000 ___HD C:\Program Files\WindowsApps 2017-10-20 15:55 - 2017-03-18 17:03 - 000000000 ____D C:\WINDOWS\AppReadiness 2017-10-20 15:41 - 2017-09-09 19:52 - 000000000 ____D C:\Users\jtssh\AppData\Roaming\discordcanary 2017-10-20 12:05 - 2017-09-09 19:52 - 000000000 ____D C:\Users\jtssh\AppData\Local\DiscordCanary 2017-10-20 12:04 - 2017-09-09 19:52 - 000002329 _____ C:\Users\jtssh\Desktop\Discord Canary.lnk 2017-10-20 12:04 - 2017-08-08 20:25 - 000000000 ____D C:\Users\jtssh\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Discord Inc 2017-10-19 23:24 - 2017-03-18 17:01 - 000000000 ____D C:\WINDOWS\INF 2017-10-19 21:04 - 2016-08-03 13:06 - 000000000 ____D C:\Users\jtssh\AppData\Local\CrashDumps 2017-10-19 20:35 - 2017-06-19 16:55 - 000002376 _____ C:\Users\jtssh\Desktop\Justin - Chrome.lnk 2017-10-19 17:04 - 2017-06-18 16:00 - 000000000 ____D C:\Users\jtssh\AppData\Roaming\discord 2017-10-18 18:39 - 2017-06-18 09:57 - 000000000 ____D C:\Users\jtssh\OneDrive\Documents\Other 2017-10-18 17:22 - 2017-06-20 16:46 - 000000102 _____ C:\Users\jtssh\.node_repl_history 2017-10-18 15:53 - 2016-07-16 07:47 - 000000000 ____D C:\WINDOWS\system32\Tasks_Migrated 2017-10-18 15:31 - 2016-07-30 16:21 - 000000000 ____D C:\Users\jtssh\AppData\Roaming\Notepad++ 2017-10-18 10:18 - 2016-07-29 21:05 - 000000000 ____D C:\Users\jtssh\Downloads\Setup's 2017-10-17 16:02 - 2017-03-18 16:51 - 000000000 ____D C:\WINDOWS\CbsTemp 2017-10-17 15:53 - 2016-10-02 08:06 - 000000000 ____D C:\Users\jtssh\AppData\Local\ConnectedDevicesPlatform 2017-10-17 15:47 - 2016-10-15 10:44 - 000002782 __RSH C:\ProgramData\ntuser.pol 2017-10-17 15:44 - 2017-09-19 16:29 - 000000000 ____D C:\Program Files (x86)\Mozilla Maintenance Service 2017-10-17 15:44 - 2017-09-19 16:29 - 000000000 ____D C:\Program Files (x86)\Mozilla Firefox 2017-10-17 15:42 - 2016-07-29 19:48 - 000000000 ___RD C:\Users\jtssh\OneDrive 2017-10-17 08:01 - 2017-03-18 17:03 - 000000000 ____D C:\WINDOWS\appcompat 2017-10-16 21:19 - 2017-03-18 17:03 - 000028672 _____ C:\WINDOWS\system32\config\BCD-Template 2017-10-16 21:14 - 2017-03-18 17:06 - 000000000 ____D C:\WINDOWS\Setup 2017-10-16 21:13 - 2017-03-18 17:03 - 000000000 ___SD C:\WINDOWS\SysWOW64\F12 2017-10-16 21:13 - 2017-03-18 17:03 - 000000000 ____D C:\WINDOWS\SysWOW64\WinMetadata 2017-10-16 21:13 - 2017-03-18 17:03 - 000000000 ____D C:\WINDOWS\SysWOW64\setup 2017-10-16 21:12 - 2017-03-18 17:03 - 000230400 _____ (Microsoft Corporation) C:\WINDOWS\system32\msclmd.dll 2017-10-16 21:12 - 2017-03-18 17:03 - 000207872 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\msclmd.dll 2017-10-16 21:12 - 2017-03-18 17:03 - 000000000 ___SD C:\WINDOWS\system32\F12 2017-10-16 21:12 - 2017-03-18 17:03 - 000000000 ____D C:\WINDOWS\system32\WinMetadata 2017-10-16 21:12 - 2017-03-18 17:03 - 000000000 ____D C:\WINDOWS\system32\WinBioPlugIns 2017-10-16 21:12 - 2017-03-18 17:03 - 000000000 ____D C:\WINDOWS\system32\setup 2017-10-16 21:12 - 2017-03-18 17:03 - 000000000 ____D C:\WINDOWS\system32\oobe 2017-10-16 21:12 - 2017-03-18 17:03 - 000000000 ____D C:\WINDOWS\ShellExperiences 2017-10-16 21:12 - 2017-03-18 17:03 - 000000000 ____D C:\WINDOWS\Provisioning 2017-10-16 21:12 - 2017-03-18 17:03 - 000000000 ____D C:\WINDOWS\PolicyDefinitions 2017-10-16 21:12 - 2017-03-18 17:03 - 000000000 ____D C:\Program Files\Windows Photo Viewer 2017-10-16 21:12 - 2017-03-18 17:03 - 000000000 ____D C:\Program Files (x86)\Windows Photo Viewer 2017-10-16 21:08 - 2017-03-18 17:03 - 000000000 ____D C:\WINDOWS\LiveKernelReports 2017-10-16 20:54 - 2017-03-18 22:30 - 000000000 ____D C:\WINDOWS\OCR 2017-10-16 20:50 - 2017-07-11 01:40 - 003856896 _____ (Microsoft Corporation) C:\WINDOWS\system32\vmchipset.dll 2017-10-16 20:50 - 2017-07-11 01:40 - 002231296 _____ (Microsoft Corporation) C:\WINDOWS\system32\vmcompute.exe 2017-10-16 20:50 - 2017-07-11 01:40 - 001652736 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\vmswitch.sys 2017-10-16 20:50 - 2017-07-11 01:40 - 000380416 _____ (Microsoft Corporation) C:\WINDOWS\system32\vmcompute.dll 2017-10-16 20:50 - 2017-07-11 01:40 - 000275456 _____ (Microsoft Corporation) C:\WINDOWS\system32\vmusrv.dll 2017-10-16 20:50 - 2017-07-11 01:40 - 000120320 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\storvsp.sys 2017-10-16 20:50 - 2017-03-18 17:03 - 000000000 ____D C:\WINDOWS\schemas 2017-10-16 20:50 - 2017-03-18 16:59 - 004525568 _____ (Microsoft Corporation) C:\WINDOWS\system32\rdvgm.exe 2017-10-16 20:50 - 2017-03-18 16:59 - 002008248 _____ (Microsoft Corporation) C:\WINDOWS\system32\vmwp.exe 2017-10-16 20:50 - 2017-03-18 16:59 - 001570212 _____ C:\WINDOWS\system32\WindowsVirtualization.V2.mof 2017-10-16 20:50 - 2017-03-18 16:59 - 001261568 _____ (Microsoft Corporation) C:\WINDOWS\system32\vmemulateddevices.dll 2017-10-16 20:50 - 2017-03-18 16:59 - 001149404 _____ C:\WINDOWS\system32\WindowsHyperVCluster.V2.mof 2017-10-16 20:50 - 2017-03-18 16:59 - 000785408 _____ (Microsoft Corporation) C:\WINDOWS\system32\vmconnect.exe 2017-10-16 20:50 - 2017-03-18 16:59 - 000698368 _____ (Microsoft Corporation) C:\WINDOWS\system32\vsconfig.dll 2017-10-16 20:50 - 2017-03-18 16:59 - 000451584 _____ (Microsoft Corporation) C:\WINDOWS\system32\VmEmulatedStorage.dll 2017-10-16 20:50 - 2017-03-18 16:59 - 000376320 _____ C:\WINDOWS\system32\VmDataStore.dll 2017-10-16 20:50 - 2017-03-18 16:59 - 000374784 _____ (Microsoft Corporation) C:\WINDOWS\system32\vmprox.dll 2017-10-16 20:50 - 2017-03-18 16:59 - 000352256 _____ (Microsoft Corporation) C:\WINDOWS\system32\vmicvdev.dll 2017-10-16 20:50 - 2017-03-18 16:59 - 000341512 _____ (Microsoft Corporation) C:\WINDOWS\system32\TpmEngUM.dll 2017-10-16 20:50 - 2017-03-18 16:59 - 000327168 _____ (Microsoft Corporation) C:\WINDOWS\system32\vmsynthstor.dll 2017-10-16 20:50 - 2017-03-18 16:59 - 000324096 _____ (Microsoft Corporation) C:\WINDOWS\system32\VmEmulatedNic.dll 2017-10-16 20:50 - 2017-03-18 16:59 - 000307200 _____ (Microsoft Corporation) C:\WINDOWS\system32\vmsmb.dll 2017-10-16 20:50 - 2017-03-18 16:59 - 000305152 _____ (Microsoft Corporation) C:\WINDOWS\system32\vmsynth3dvideo.dll 2017-10-16 20:50 - 2017-03-18 16:59 - 000247296 _____ (Microsoft Corporation) C:\WINDOWS\system32\RemoteFileBrowse.dll 2017-10-16 20:50 - 2017-03-18 16:59 - 000231424 _____ (Microsoft Corporation) C:\WINDOWS\system32\vmdynmem.dll 2017-10-16 20:50 - 2017-03-18 16:59 - 000221696 _____ (Microsoft Corporation) C:\WINDOWS\system32\vmserial.dll 2017-10-16 20:50 - 2017-03-18 16:59 - 000194048 _____ (Microsoft Corporation) C:\WINDOWS\system32\vmsynthfcvdev.dll 2017-10-16 20:50 - 2017-03-18 16:59 - 000184832 _____ (Microsoft Corporation) C:\WINDOWS\system32\vmicrdv.dll 2017-10-16 20:50 - 2017-03-18 16:59 - 000180224 _____ (Microsoft Corporation) C:\WINDOWS\system32\hcsdiag.exe 2017-10-16 20:50 - 2017-03-18 16:59 - 000178688 _____ (Microsoft Corporation) C:\WINDOWS\system32\vmsif.dll 2017-10-16 20:50 - 2017-03-18 16:59 - 000176640 _____ (Microsoft Corporation) C:\WINDOWS\system32\gpupvdev.dll 2017-10-16 20:50 - 2017-03-18 16:59 - 000153088 _____ (Microsoft Corporation) C:\WINDOWS\system32\vpcievdev.dll 2017-10-16 20:50 - 2017-03-18 16:59 - 000144967 _____ C:\WINDOWS\system32\virtmgmt.msc 2017-10-16 20:50 - 2017-03-18 16:59 - 000142336 _____ (Microsoft Corporation) C:\WINDOWS\system32\HgsClientWmi.dll 2017-10-16 20:50 - 2017-03-18 16:59 - 000141312 _____ (Microsoft Corporation) C:\WINDOWS\system32\vmtpm.dll 2017-10-16 20:50 - 2017-03-18 16:59 - 000137216 _____ (Microsoft Corporation) C:\WINDOWS\system32\vmdebug.dll 2017-10-16 20:50 - 2017-03-18 16:59 - 000135424 _____ (Microsoft Corporation) C:\WINDOWS\system32\vmsp.exe 2017-10-16 20:50 - 2017-03-18 16:59 - 000135168 _____ (Microsoft Corporation) C:\WINDOWS\system32\vmbusvdev.dll 2017-10-16 20:50 - 2017-03-18 16:59 - 000109568 _____ (Microsoft Corporation) C:\WINDOWS\system32\rdp4vs.dll 2017-10-16 20:50 - 2017-03-18 16:59 - 000091648 _____ (Microsoft Corporation) C:\WINDOWS\system32\CCG.exe 2017-10-16 20:50 - 2017-03-18 16:59 - 000090624 _____ (Microsoft Corporation) C:\WINDOWS\system32\CCGLaunchPad.dll 2017-10-16 20:50 - 2017-03-18 16:59 - 000074656 _____ (Microsoft Corporation) C:\WINDOWS\system32\rtpm.dll 2017-10-16 20:50 - 2017-03-18 16:59 - 000069632 _____ (Microsoft Corporation) C:\WINDOWS\system32\vmwpctrl.dll 2017-10-16 20:50 - 2017-03-18 16:59 - 000062976 _____ (Microsoft Corporation) C:\WINDOWS\system32\wnvapi.dll 2017-10-16 20:50 - 2017-03-18 16:59 - 000051712 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\pvhdparser.sys 2017-10-16 20:50 - 2017-03-18 16:59 - 000048128 _____ (Microsoft Corporation) C:\WINDOWS\system32\HyperVSysprepProvider.dll 2017-10-16 20:50 - 2017-03-18 16:59 - 000044544 _____ (Microsoft Corporation) C:\WINDOWS\system32\vid.dll 2017-10-16 20:50 - 2017-03-18 16:59 - 000036696 _____ (Microsoft Corporation) C:\WINDOWS\system32\sbresources.dll 2017-10-16 20:50 - 2017-03-18 16:59 - 000036352 _____ (Microsoft Corporation) C:\WINDOWS\system32\ActivationVdev.dll 2017-10-16 20:50 - 2017-03-18 16:59 - 000033696 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\vmsproxy.sys 2017-10-16 20:50 - 2017-03-18 16:59 - 000031232 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\vhdparser.sys 2017-10-16 20:50 - 2017-03-18 16:59 - 000031232 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\ramparser.sys 2017-10-16 20:50 - 2017-03-18 16:59 - 000027648 _____ (Microsoft Corporation) C:\WINDOWS\system32\RdvgmProxy.dll 2017-10-16 20:50 - 2017-03-18 16:59 - 000026624 _____ (Microsoft Corporation) C:\WINDOWS\system32\RdvGpuInfo.dll 2017-10-16 20:50 - 2017-03-18 16:59 - 000025088 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\passthruparser.sys 2017-10-16 20:50 - 2017-03-18 16:59 - 000023552 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\lunparser.sys 2017-10-16 20:50 - 2017-03-18 16:59 - 000022528 _____ (Microsoft Corporation) C:\WINDOWS\system32\vmcomputeeventlog.dll 2017-10-16 20:50 - 2017-03-18 16:59 - 000022016 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\hvsocketcontrol.sys 2017-10-16 20:50 - 2017-03-18 16:59 - 000020992 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\RdvgmProxy.dll 2017-10-16 20:50 - 2017-03-18 16:59 - 000019456 _____ (Microsoft Corporation) C:\WINDOWS\system32\synth3dvideoproxy.dll 2017-10-16 20:50 - 2017-03-18 16:59 - 000018944 _____ (Microsoft Corporation) C:\WINDOWS\system32\vmsifproxystub.dll 2017-10-16 20:50 - 2017-03-18 16:59 - 000013312 _____ (Microsoft Corporation) C:\WINDOWS\system32\HostGuardianServiceClientResources.dll 2017-10-16 20:50 - 2017-03-18 16:59 - 000012192 _____ (Microsoft Corporation) C:\WINDOWS\system32\e517e4cd-0fde-406b-b1cf-56cd97edd483_hyperv.dll 2017-10-16 20:50 - 2017-03-18 16:56 - 000155136 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\vmbusr.sys 2017-10-16 20:50 - 2017-03-18 16:56 - 000104448 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\Synth3dVsp.sys 2017-10-16 20:50 - 2017-03-18 16:56 - 000047616 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\pcip.sys 2017-10-16 20:50 - 2017-03-18 16:56 - 000016384 _____ (Microsoft Corporation) C:\WINDOWS\system32\vmbuspiper.dll 2017-10-16 19:50 - 2017-06-20 20:19 - 000000000 ____D C:\Users\jtssh\AppData\LocalLow\Mozilla 2017-10-16 19:39 - 2016-07-29 19:43 - 000000000 ____D C:\Users\jtssh\AppData\Local\Packages 2017-10-16 18:29 - 2017-03-18 17:03 - 000000000 ___RD C:\WINDOWS\ImmersiveControlPanel 2017-10-16 18:29 - 2016-04-27 02:42 - 000000000 __RHD C:\Users\Public\AccountPictures 2017-10-16 18:17 - 2017-03-18 17:03 - 000000000 ____D C:\WINDOWS\rescache 2017-10-16 18:14 - 2017-03-18 17:03 - 000000000 ____D C:\WINDOWS\system32\WinBioDatabase 2017-10-16 18:14 - 2017-03-18 07:40 - 000032768 _____ C:\WINDOWS\system32\config\ELAM 2017-10-16 18:11 - 2017-03-18 17:03 - 000000000 ____D C:\WINDOWS\Registration 2017-10-16 18:07 - 2017-03-18 22:31 - 000000000 ____D C:\WINDOWS\HoloShell 2017-10-16 18:06 - 2016-10-02 07:07 - 000022840 _____ C:\WINDOWS\system32\emptyregdb.dat 2017-10-16 18:05 - 2017-03-18 17:03 - 000000000 __RHD C:\Users\Public\Libraries 2017-10-16 17:51 - 2016-10-21 17:39 - 000002272 _____ C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Google Chrome.lnk 2017-10-16 17:45 - 2017-09-18 20:17 - 000000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Notepad++ 2017-10-16 17:45 - 2017-09-09 15:13 - 000000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Lightshot 2017-10-16 17:45 - 2017-09-01 07:01 - 000000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Oracle VM VirtualBox 2017-10-16 17:45 - 2017-08-27 15:05 - 000000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\HitFilm 4 Express 2017-10-16 17:45 - 2017-08-09 18:28 - 000000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Git 2017-10-16 17:45 - 2017-07-08 12:21 - 000000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Python 3.6 2017-10-16 17:45 - 2017-07-08 11:44 - 000000000 ____D C:\WINDOWS\SysWOW64\3082 2017-10-16 17:45 - 2017-07-08 11:44 - 000000000 ____D C:\WINDOWS\SysWOW64\1055 2017-10-16 17:45 - 2017-07-08 11:44 - 000000000 ____D C:\WINDOWS\SysWOW64\1049 2017-10-16 17:45 - 2017-07-08 11:44 - 000000000 ____D C:\WINDOWS\SysWOW64\1046 2017-10-16 17:45 - 2017-07-08 11:44 - 000000000 ____D C:\WINDOWS\SysWOW64\1045 2017-10-16 17:45 - 2017-07-08 11:44 - 000000000 ____D C:\WINDOWS\SysWOW64\1040 2017-10-16 17:45 - 2017-07-08 11:44 - 000000000 ____D C:\WINDOWS\SysWOW64\1036 2017-10-16 17:45 - 2017-07-08 11:44 - 000000000 ____D C:\WINDOWS\SysWOW64\1029 2017-10-16 17:45 - 2017-07-08 11:44 - 000000000 ____D C:\WINDOWS\system32\3082 2017-10-16 17:45 - 2017-07-08 11:44 - 000000000 ____D C:\WINDOWS\system32\1055 2017-10-16 17:45 - 2017-07-08 11:44 - 000000000 ____D C:\WINDOWS\system32\1049 2017-10-16 17:45 - 2017-07-08 11:44 - 000000000 ____D C:\WINDOWS\system32\1046 2017-10-16 17:45 - 2017-07-08 11:44 - 000000000 ____D C:\WINDOWS\system32\1045 2017-10-16 17:45 - 2017-07-08 11:44 - 000000000 ____D C:\WINDOWS\system32\1040 2017-10-16 17:45 - 2017-07-08 11:44 - 000000000 ____D C:\WINDOWS\system32\1036 2017-10-16 17:45 - 2017-07-08 11:44 - 000000000 ____D C:\WINDOWS\system32\1029 2017-10-16 17:45 - 2017-06-28 23:17 - 000000000 ____D C:\WINDOWS\system32\UNP 2017-10-16 17:45 - 2017-06-19 16:35 - 000000000 ____D C:\Users\jtssh\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\GitHub, Inc 2017-10-16 17:45 - 2017-06-18 20:16 - 000000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Node.js 2017-10-16 17:45 - 2017-06-18 16:10 - 000000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Visual Studio Code 2017-10-16 17:45 - 2016-09-06 16:27 - 000000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Intel Driver Update Utility 2017-10-16 17:45 - 2016-08-03 13:23 - 000000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Unity 5.4.0f3 (64-bit) 2017-10-16 17:45 - 2016-08-01 10:51 - 000000000 ____D C:\WINDOWS\en 2017-10-16 17:45 - 2016-07-30 08:17 - 000000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\OBS Studio 2017-10-16 17:45 - 2016-07-30 08:07 - 000000000 ____D C:\Users\jtssh\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps 2017-10-16 17:45 - 2016-07-29 20:21 - 000000000 ____D C:\WINDOWS\SysWOW64\1033 2017-10-16 17:45 - 2016-07-29 20:18 - 000000000 ____D C:\WINDOWS\system32\1033 2017-10-16 17:45 - 2016-07-29 19:57 - 000000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\VideoLAN 2017-10-16 17:45 - 2016-07-29 19:56 - 000000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\7-Zip 2017-10-16 17:45 - 2016-07-29 19:53 - 000000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Microsoft Silverlight 2017-10-16 17:36 - 2017-08-05 13:20 - 000000000 ____D C:\WINDOWS\SysWOW64\MTSLog 2017-10-16 17:36 - 2017-03-18 17:03 - 000000000 ____D C:\WINDOWS\SysWOW64\GroupPolicy 2017-10-16 17:36 - 2017-03-18 17:03 - 000000000 ____D C:\WINDOWS\system32\spool 2017-10-16 17:36 - 2017-03-18 17:03 - 000000000 ____D C:\WINDOWS\system32\NDF 2017-10-16 17:36 - 2016-07-29 19:56 - 000000000 ____D C:\WINDOWS\SysWOW64\Adobe 2017-10-16 17:34 - 2017-08-05 13:20 - 000000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Blueberry Software 2017-10-16 17:34 - 2017-07-08 10:32 - 000000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Visual Studio 2017 2017-10-16 17:34 - 2017-03-18 17:03 - 000000000 ____D C:\ProgramData\USOPrivate 2017-10-16 17:34 - 2017-03-18 17:03 - 000000000 ____D C:\ProgramData\regid.1991-06.com.microsoft 2017-10-16 17:34 - 2017-03-18 17:03 - 000000000 ____D C:\Program Files\Common Files\microsoft shared 2017-10-16 17:34 - 2016-10-21 17:36 - 000000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Skype 2017-10-16 17:34 - 2016-10-21 17:27 - 000000000 ____D C:\WINDOWS\system32\appmgmt 2017-10-16 17:34 - 2016-09-06 16:26 - 000000000 ____D C:\Program Files\Intel 2017-10-16 17:34 - 2016-07-30 08:02 - 000000000 ____D C:\Program Files\IIS 2017-10-16 17:32 - 2015-10-30 03:24 - 000000000 ___HD C:\WINDOWS\system32\GroupPolicy 2017-10-16 17:31 - 2017-06-18 16:01 - 000000000 ____D C:\Users\jtssh\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Hammer & Chisel, Inc 2017-10-16 17:28 - 2017-03-18 07:40 - 000000000 ____D C:\WINDOWS\system32\Sysprep 2017-10-16 16:30 - 2015-12-25 20:58 - 000008192 __RSH C:\BOOTSECT.BAK 2017-10-16 16:21 - 2017-07-11 02:54 - 000000000 ___HD C:\$WINDOWS.~BT 2017-10-15 23:51 - 2017-07-08 12:21 - 000000000 ____D C:\Users\jtssh\AppData\Local\Package Cache 2017-10-15 23:51 - 2016-07-29 20:10 - 000000000 ____D C:\ProgramData\Package Cache 2017-10-14 22:48 - 2016-07-29 20:08 - 000000000 ____D C:\Program Files\Java 2017-10-14 22:19 - 2016-07-29 20:11 - 000000000 ____D C:\Program Files (x86)\Malwarebytes Anti-Malware 2017-10-14 21:45 - 2017-02-25 18:29 - 000000000 ____D C:\Program Files (x86)\winscr 2017-10-14 10:14 - 2016-07-30 19:29 - 000000000 ____D C:\WINDOWS\system32\MRT 2017-10-14 10:07 - 2016-07-30 19:29 - 126925120 ____C (Microsoft Corporation) C:\WINDOWS\system32\MRT.exe 2017-10-13 21:11 - 2016-07-31 15:07 - 000000000 ____D C:\Users\jtssh\AppData\Roaming\Audacity 2017-10-13 21:03 - 2017-06-19 15:51 - 000000000 ____D C:\FFMPEG 2017-10-13 21:01 - 2016-10-16 13:48 - 000000000 ____D C:\Program Files (x86)\Lame For Audacity 2017-10-12 21:45 - 2017-08-09 18:37 - 000000000 ____D C:\Users\jtssh\AppData\Local\heroku 2017-10-12 20:21 - 2017-03-18 17:06 - 000835576 _____ (Adobe Systems Incorporated) C:\WINDOWS\SysWOW64\FlashPlayerApp.exe 2017-10-12 20:21 - 2017-03-18 17:06 - 000177656 _____ (Adobe Systems Incorporated) C:\WINDOWS\SysWOW64\FlashPlayerCPLApp.cpl 2017-10-12 17:07 - 2017-08-07 17:28 - 000000000 ____D C:\Users\jtssh\AppData\Local\atom 2017-10-12 15:44 - 2017-06-18 15:59 - 000000000 ____D C:\Users\jtssh\AppData\Local\SquirrelTemp 2017-10-10 20:44 - 2017-08-04 09:29 - 000000000 ____D C:\Users\jtssh\AppData\Roaming\GitHub 2017-10-10 20:44 - 2017-08-04 09:29 - 000000000 ____D C:\Users\jtssh\AppData\Local\GitHub 2017-10-10 16:32 - 2016-07-29 19:57 - 000000000 ____D C:\Users\jtssh\AppData\Roaming\Spotify 2017-10-10 16:32 - 2016-07-29 19:57 - 000000000 ____D C:\Users\jtssh\AppData\Local\Spotify 2017-10-08 19:21 - 2016-07-29 20:03 - 000001104 _____ C:\ProgramData\Microsoft\Windows\Start Menu\Programs\paint.net.lnk 2017-10-08 19:21 - 2016-07-29 20:03 - 000001092 _____ C:\Users\Public\Desktop\paint.net.lnk 2017-10-08 19:21 - 2016-07-29 20:03 - 000000000 ____D C:\Program Files\paint.net 2017-10-06 22:41 - 2017-06-19 16:06 - 000000201 _____ C:\Users\jtssh\_netrc 2017-10-05 18:25 - 2016-07-29 19:51 - 000000000 ____D C:\Program Files (x86)\Google 2017-09-30 19:37 - 2017-08-04 09:26 - 000000000 ____D C:\Users\jtssh\AppData\Local\Apps\2.0 2017-09-26 20:07 - 2016-10-21 17:39 - 000002260 _____ C:\Users\Public\Desktop\Google Chrome.lnk 2017-09-23 21:53 - 2017-08-04 09:29 - 000000000 ____D C:\Users\jtssh\OneDrive\Documents\GitHub 2017-09-22 20:25 - 2017-04-01 11:52 - 000000000 ____D C:\Users\jtssh\OneDrive\Documents\Visual Studio 2017 ==================== Files in the root of some directories ======= 2016-10-08 15:48 - 2016-10-08 15:48 - 000479681 _____ () C:\Users\jtssh\AppData\Local\debuggee.mdmp 2017-09-01 07:09 - 2017-10-20 16:03 - 000007605 _____ () C:\Users\jtssh\AppData\Local\Resmon.ResmonCfg 2017-09-09 15:13 - 2017-09-09 15:13 - 000000003 _____ () C:\Users\jtssh\AppData\Local\updater.log 2017-09-09 15:13 - 2017-09-09 15:13 - 000000425 _____ () C:\Users\jtssh\AppData\Local\UserProducts.xml Some files in TEMP: ==================== 2017-10-18 15:49 - 2017-10-16 21:09 - 001930840 _____ (Microsoft Corporation) C:\Users\jtssh\AppData\Local\Temp\dllnt_dump.dll 2017-10-17 18:32 - 2017-10-17 18:28 - 071535032 _____ (Malwarebytes ) C:\Users\jtssh\AppData\Local\Temp\mb3-setup-consumer-3.2.2.2029-1.0.212-1.0.2951.exe ==================== Bamital & volsnap ====================== (There is no automatic fix for files that do not pass verification.) C:\WINDOWS\system32\winlogon.exe => File is digitally signed C:\WINDOWS\system32\wininit.exe => File is digitally signed C:\WINDOWS\explorer.exe => File is digitally signed C:\WINDOWS\SysWOW64\explorer.exe => File is digitally signed C:\WINDOWS\system32\svchost.exe => File is digitally signed C:\WINDOWS\SysWOW64\svchost.exe => File is digitally signed C:\WINDOWS\system32\services.exe => File is digitally signed C:\WINDOWS\system32\User32.dll => File is digitally signed C:\WINDOWS\SysWOW64\User32.dll => File is digitally signed C:\WINDOWS\system32\userinit.exe => File is digitally signed C:\WINDOWS\SysWOW64\userinit.exe => File is digitally signed C:\WINDOWS\system32\rpcss.dll => File is digitally signed C:\WINDOWS\system32\dnsapi.dll => File is digitally signed C:\WINDOWS\SysWOW64\dnsapi.dll => File is digitally signed C:\WINDOWS\system32\Drivers\volsnap.sys => File is digitally signed LastRegBack: 2017-10-16 17:21 ==================== End of FRST.txt ============================ Link to post Share on other sites More sharing options...
Aura Posted October 21, 2017 ID:1174764 Share Posted October 21, 2017 Almost done. Farbar Recovery Scan Tool (FRST) - Fix mode Follow the instructions below to execute a fix on your system using FRST, and provide the log in your next reply. Download the attached fixlist.txt file, and save it on your Desktop (or wherever your FRST.exe/FRST64.exe executable is located) Right-click on the FRST executable and select Run as Administrator (for Windows Vista, 7, 8, 8.1 and 10 users) Click on the Fix button On completion, a message will come up saying that the fix has been completed and it'll open a log in Notepad Copy and paste its content in your next reply How's your system behaving now? Are there any other issues to address? fixlist.txt Link to post Share on other sites More sharing options...
jtsshieh Posted October 21, 2017 Author ID:1174766 Share Posted October 21, 2017 Do i copy the fixlog? It just told me to restart. Link to post Share on other sites More sharing options...
Aura Posted October 21, 2017 ID:1174769 Share Posted October 21, 2017 You can attach the fixlog.txt here so I can review it. Link to post Share on other sites More sharing options...
jtsshieh Posted October 21, 2017 Author ID:1174793 Share Posted October 21, 2017 Fix result of Farbar Recovery Scan Tool (x64) Version: 21-10-2017 Ran by jtssh (21-10-2017 12:18:09) Run:1 Running from C:\Users\jtssh\OneDrive\Documents\Setup Loaded Profiles: jtssh (Available Profiles: jtssh) Boot Mode: Normal ============================================== fixlist content: ***************** CloseProcesses: CreateRestorePoint: DeleteKey: HKU\S-1-5-21-1080822061-2706406846-2729724613-1001\SOFTWARE\Google\Chrome\Extensions\gdfjhiclilbjdpeejgcgebmmihkkofji HKU\S-1-5-21-1080822061-2706406846-2729724613-1001\...\Run: [05AAFE247C06642A732F36B2CC3BD6871D1D4F2E._service_run] => C:\Program Files (x86)\Google\Chrome\Application\chrome.exe [1451352 2017-09-21] (Google Inc.) HKU\S-1-5-21-1080822061-2706406846-2729724613-1001\...\Run: [GoogleChromeAutoLaunch_735E209D1D3D6DF22C891759DBA4771A] => C:\Program Files (x86)\Google\Chrome\Application\chrome.exe [1451352 2017-09-21] (Google Inc.) GroupPolicy: Restriction - Chrome <==== ATTENTION GroupPolicy\User: Restriction <==== ATTENTION CHR HKLM\SOFTWARE\Policies\Google: Restriction <==== ATTENTION HKU\S-1-5-21-1080822061-2706406846-2729724613-1001\SOFTWARE\Policies\Microsoft\Internet Explorer: Restriction <==== ATTENTION CHR HomePage: Default -> hxxp://www.trovi.com/?gd=&ctid=CT3333529&octid=EB_ORIGINAL_CTID&ISID=MF4737248-246D-480F-B7D0-DAF8E5E2AB67&SearchSource=55&CUI=&UM=8&UP=SP6CEC7EA2-AF62-49FC-B4DA-A0358909660C&D=061215&SSPV= CHR StartupUrls: Default -> "chrome://apps/","hxxp://www.carryformation.com/club/" Task: {52E3CE71-2D32-4515-AAE5-3A2F01F158D5} - \IntegrationManager -> No File <==== ATTENTION Task: {Task: {6FD83A72-7E4A-496C-B6D6-6B6A543F7B9B} - System32\Tasks\{428BB90D-5CD7-4A7A-9D4B-96F59BEBAF19} => C:\WINDOWS\system32\pcalua.exe -a C:\Users\jtssh\AppData\Local\uninstallro.exe 57FB5EA5-893D-4D83-8165-F49F53A121B8} - System32\Tasks\{DB809003-7B2F-44E7-83F1-49431DD04D9F} => C:\WINDOWS\system32\pcalua.exe -a "C:\Users\jtssh\AppData\Local\Uninstall Groovy\uninstall.exe" C:\ProgramData\ntuser.pol C:\Users\jtssh\ntuser.pol EmptyTemp: ***************** Processes closed successfully. Restore point was successfully created. HKU\S-1-5-21-1080822061-2706406846-2729724613-1001\SOFTWARE\Google\Chrome\Extensions\gdfjhiclilbjdpeejgcgebmmihkkofji => key removed successfully HKU\S-1-5-21-1080822061-2706406846-2729724613-1001\Software\Microsoft\Windows\CurrentVersion\Run\\05AAFE247C06642A732F36B2CC3BD6871D1D4F2E._service_run => value removed successfully HKU\S-1-5-21-1080822061-2706406846-2729724613-1001\Software\Microsoft\Windows\CurrentVersion\Run\\GoogleChromeAutoLaunch_735E209D1D3D6DF22C891759DBA4771A => value removed successfully C:\WINDOWS\system32\GroupPolicy\Machine => moved successfully C:\WINDOWS\system32\GroupPolicy\GPT.ini => moved successfully C:\WINDOWS\SysWOW64\GroupPolicy\GPT.ini => moved successfully C:\WINDOWS\system32\GroupPolicy\User => moved successfully HKLM\SOFTWARE\Policies\Google => key removed successfully HKU\S-1-5-21-1080822061-2706406846-2729724613-1001\SOFTWARE\Policies\Microsoft\Internet Explorer => key removed successfully Chrome HomePage => removed successfully Chrome StartupUrls => removed successfully HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Logon\{52E3CE71-2D32-4515-AAE5-3A2F01F158D5} => key removed successfully HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\{52E3CE71-2D32-4515-AAE5-3A2F01F158D5} => key removed successfully HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tree\IntegrationManager => key not found. HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\Task: {{6FD83A72-7E4A-496C-B6D6-6B6A543F7B9B} => key not found. C:\WINDOWS\Task: {System32\Tasks\{428BB90D-5CD7-4A7A-9D4B-96F59BEBAF19} => not found. HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tree\{428BB90D-5CD7-4A7A-9D4B-96F59BEBAF19} => key removed successfully 57FB5EA5-893D-4D83-8165-F49F53A121B8} - System32\Tasks\{DB809003-7B2F-44E7-83F1-49431DD04D9F} => C:\WINDOWS\system32\pcalua.exe -a "C:\Users\jtssh\AppData\Local\Uninstall Groovy\uninstall.exe" => Error: No automatic fix found for this entry. C:\ProgramData\ntuser.pol => moved successfully C:\Users\jtssh\ntuser.pol => moved successfully =========== EmptyTemp: ========== BITS transfer queue => 7364608 B DOMStore, IE Recovery, AppCache, Feeds Cache, Thumbcache, IconCache => 48806557 B Java, Flash, Steam htmlcache => 506 B Windows/system/drivers => 135215 B Edge => 2601 B Chrome => 279209317 B Firefox => 17135698 B Opera => 0 B Temp, IE cache, history, cookies, recent: Default => 0 B Users => 0 B ProgramData => 0 B Public => 0 B systemprofile => 128 B systemprofile32 => 1034 B LocalService => 6610 B NetworkService => 29648864 B jtssh => 113969259 B RecycleBin => 35967884 B EmptyTemp: => 507.6 MB temporary data Removed. ================================ The system needed a reboot. ==== End of Fixlog 12:19:42 ==== Link to post Share on other sites More sharing options...
Aura Posted October 21, 2017 ID:1174814 Share Posted October 21, 2017 How's your system behaving now? Are there any other issues to address? Link to post Share on other sites More sharing options...
jtsshieh Posted October 21, 2017 Author ID:1174827 Share Posted October 21, 2017 I see two applications, "Traffic Exchange" and "Online.io.Application". They seem a bit sketchy... Can i uninstall them? Link to post Share on other sites More sharing options...
Aura Posted October 21, 2017 ID:1174858 Share Posted October 21, 2017 Where do you see them? They aren't listed as installed programs in your logs. Link to post Share on other sites More sharing options...
jtsshieh Posted October 22, 2017 Author ID:1174865 Share Posted October 22, 2017 In CCleaner Link to post Share on other sites More sharing options...
Aura Posted October 22, 2017 ID:1174943 Share Posted October 22, 2017 Yes, you can uninstall them. Let me know once it's done. Link to post Share on other sites More sharing options...
jtsshieh Posted October 22, 2017 Author ID:1174997 Share Posted October 22, 2017 K done! Link to post Share on other sites More sharing options...
Aura Posted October 22, 2017 ID:1175031 Share Posted October 22, 2017 Alright How's your system behaving now? Are there any other issues to address? Link to post Share on other sites More sharing options...
jtsshieh Posted October 23, 2017 Author ID:1175146 Share Posted October 23, 2017 Nope, its woking fine! THanks Link to post Share on other sites More sharing options...
Aura Posted October 23, 2017 ID:1175150 Share Posted October 23, 2017 Awesome! Since there are no signs of infection anymore in your logs, and you just told me that there are no more issues left to address, I guess we're done here. We'll wrap it up by running DelFix to delete the tools and logs that were used in this clean-up. DelFix Follow the instructions below to download and execute DelFix. Download DelFix and move the executable to your Desktop Right-click on DelFix.exe and select Run as Administrator (for Windows Vista, 7, 8, 8.1 and 10 users) Check the following options :Activate UAC Remove disinfection tools Create registry backup Purge system restore Reset system settings Once all the options mentionned above are checked, click on Run After DelFix is done running, a log will open. Please copy/paste the content of the output log in your next reply Tips, tricks, advice and recommendations Now it's time to give you some tips, tricks, advice and recommendations on how to protect your system and prevent you from being infected in the future. This is where I'll explain basic security measures that you should take to protect and harden your system, and also make sure it stays as safe and secure as possible against hackers and malware. You are free to ignore the recommendations listed below, although I obviously do not recommend it. If you have any questions about one of the points covered in the speech below, feel free to ask me your questions here directly so I can answer them and guide you. Windows Updates Keeping Windows up to date is one of the first steps in having a safe and secure system. The Security Updates that Windows receives are meant to fix exploits and flaws in it that makes it more secure and not exploitable by hackers. In order to do that, you should always install the Security Updates, known as "Important Updates" on your Windows system. These updates are released on the second Tuesday of every month, but some are also released before if they are emergency/critical Security Updates. Let's make sure that you have all your Important Updates and Recommended Updates installed and that your Windows Updates are set to be installed automatically. How To Change Windows Update Settings How To Check For & Install Windows Updates Keeping your programs up-to-date Like keeping Windows updated, keeping your installed programs up-to-date is another important step in having a safe and secure system. Outdated programs can be exploited by hackers and malware to infect a system and take it over. This is especially true today with the rise of Exploit Kits (and also 0-days) which is one of the biggest attack vectors to distribute malware. Therefore, you should always keep vulnerable programs like Adobe Flash Player, Adobe Shockwave Player, Java, Silverlight, Google Chrome, Mozilla Firefox, VLC Media Player, etc. updated to their most recent version (even better, you don't have to install them if you don't use them). Programs like UCheck, SecuniaPSI and Heimdal Free will scan your system for outdated programs, and help you identify them, as well as update them. UCheck Documentation How to detect vulnerable and out-dated programs using Secunia Personal Software Inspector (PSI) Anti-Virus Note: The programs listed below are all free to use or they have some sort of trial. Some of them have a paid version that provides more features, while a lot of other good programs only have a paid version but aren't listed there (such as Kaspersky and ESET Antivirus products). Sophos Home Bitdefender Free Antivirus Emsisoft Anti-Malware - Free 30 day trial. Once it expires, EAM enters into a freeware mode where it is still considered an Antivirus program, but without real-time protection Avira Free Antivirus avast! Free Antivirus Anti-Malware, Anti-Exploit and Anti-Ransomware Having a decent security setup (which also includes an Antivirus) is the most crucial step to protect a system. These programs are additional layers of defence that will prevent a system from being infected, or if it somehow ends up infected, help mitigate the infection and remediate it. Fortunately, the new Malwarebytes 3 bundle all these layers in one, easy to use and efficient product. Malwarebytes 3 offers Malware, Web, Exploit and Ransomware protection modules that works together in order to keep your system protected and stop an infection at multiple level. Malwarebytes - Comes with a free trial of the Premium version for 14 days, after which it reverts back to the Free version Note: Please note that only the Premium version of Malwarebytes 3 offers real-time protection (Malware, Web, Exploit and Ransomware). The free version only allows you to scan your system for threats and remove them. Firewall Starting in Windows Vista, the Windows Firewall greatly improved and will satisfy the needs of most users. If you do not have an Internet Suite Antivirus program (which includes a firewall) and you want to use a 3rd party firewall, you can consider the options below. GlassWire - Has both a free and paid version (with different packages) Windows Firewall Control - Gives you more control over your Windows Firewall TinyWall - Lightweight firewall implementing the Windows Firewall and giving you more control over it Web Browsers and Web Browsing Web Browsers could be considered as the closest door between a malware and your system. This is where most malware goes through to infect a system, and therefore it should be the program(s) you want to secure the most. There are two ways of going about it: hardening your web browser via extensions, and having good browsing habits. Hardening your web browser means to install extensions that will help it protect itself (and your system on the same occasion) against Exploit Kits, MiTM attacks, etc. but also you at the same time. Here are a few extensions that I recommend you to install. uBlock Origin: Efficient multi-purpose blocker that is lightweight on RAM and CPU usage (Google Chrome, Mozilla Firefox, Microsoft Edge, Opera and most Chromium and Firefox-based browsers) HTTPS Everywhere: Extension that converts your HTTP (unencrypted) requests to HTTPS (encrypted) ones (Google Chrome, Mozilla Firefox and Opera) Web of Trust: Website reputation, rating and review extension that will help you quickly identify bad and suspicious sites from good ones (every web browsers) NoScript: NoScript is a script blocker (Java, Flash, JavaScript, etc.) for Mozilla Firefox and Firefox-based browsers (Mozilla Firefox and Firefox-based web browsers) uMatrix: For advanced users, a point and click matrix-like extensions that allow you to control requests done on a webpage (based on source, destination and type) (Google Chrome, Mozilla Firefox and Opera) LastPass: Secure password manager allowing you to create, manage, and use passwords you save in your LastPass account (every web browser) As for safe browsing habits, you can find tons of guides, tutorials, articles, etc. online that will highlight the basics you need to follow (only visit websites you trust, do not click on ads, do not download files from untrusted sources, use a password manager, always verify the URL of a website and make sure it's correctly typed, etc.), and even what you can do if you want to take it a step further (create a fake email address for spam emails, browse the web in a privacy mode, etc.). Here are a few: The Ultimate Guide to Secure your Online Browsing: Chrome, Firefox and Internet Explorer on Heimdal Security Seven Useful Habits For A Safer Internet on Kapsersky Blog Tips for Secure Web Browsing: Cybersecurity 101 on VeraCode Safe browsing habits on Internet Safety Project Wiki As you can see, there are plenty of resources out there. Simply Googling "good browsing habits" or "safe browsing habits" should allow you to find a lot of them. Other recommendations Even if you follow every recommendation that I listed here, in the end, it's also your job to be careful when browsing the web and downloading files if you don't want to get infected. Therefore, if you use your brain (common sense) when browsing the web, downloading programs and files, etc., you have far less chances to get infected by a malware. If for example you're not sure if a website is legitimate or not, or if a file is safe to download and execute, or if a program looks "too good" to be free, I suggest you to avoid going to that website, downloading that file or using that program. Here are a few guides, tutorials, articles, etc. that you could read in order to learn more about computer protection and security to improve your current computer protection setup but also improve your good web browsing and computer usage practices : Answers to common security questions - Best Practices by quietman7 How Malware Spreads - How did I get infected by quietman7 Simple and easy ways to keep your computer safe and secure on the Internet by Lawrence Abrams (aka Grinler) How to Prevent Malware by miekiemoes Tips & Advice on StaySafeOnline.org The End! And that's it! Now that you know more about how to protect your computer and secure it, you're good to go back to your online activities, but in a safe and secure way! You are also free to stay on the forums and ask for help in different topics if you ever need to. Just make sure that you post your question/issue in the right section to get the best assistance possible. And if you ever get infected again (which I hope you wont!), you can always comeback in this section to get another checkup with one of our trained malware removal member. Do you have any questions before I close this thread? Link to post Share on other sites More sharing options...
jtsshieh Posted October 23, 2017 Author ID:1175365 Share Posted October 23, 2017 # DelFix v1.013 - Logfile created 23/10/2017 at 16:20:42 # Updated 17/04/2016 by Xplode # Username : jtssh - JUSTIN-PC # Operating System : Windows 10 Pro (64 bits) ~ Activating UAC ... OK ~ Removing disinfection tools ... Deleted : C:\FRST Deleted : C:\AdwCleaner Deleted : C:\Users\jtssh\Desktop\mbar Deleted : C:\log.txt Deleted : C:\Users\jtssh\Desktop\AdwCleaner.exe Deleted : C:\Users\Public\Desktop\RogueKiller.lnk ~ Creating registry backup ... OK ~ Cleaning system restore ... New restore point created ! ~ Resetting system settings ... OK ########## - EOF - ########## Link to post Share on other sites More sharing options...
Aura Posted October 23, 2017 ID:1175433 Share Posted October 23, 2017 Good Any questions before I close this thread? Link to post Share on other sites More sharing options...
Recommended Posts