twinpeaks Posted July 2, 2018 ID:1254172 Share Posted July 2, 2018 Hey experts, I believe someone has taken remote control of my Cortana seems like when I am on my laptop and I reach for my face I hear yelling coming from my neighbors, this is a stuff situation I know its not outside the realm of plausibility, wanted to see if you guys could help me to check and see if indeed my cortana is being hacked. Sorry if I unironically sound like a quack but there's just been too many happenings confirmed Appreciate any support you guys are a1 Link to post Share on other sites More sharing options...
nasdaq Posted July 3, 2018 ID:1254380 Share Posted July 3, 2018 Hello, Welcome to Malwarebytes. I'm nasdaq and will be helping you. If you can please print this topic it will make it easier for you to follow the instructions and complete all of the necessary steps in the order listed. === Please download Malwarebytes Anti-Malware from here Right-click on the MBAM icon and select Run as administrator to run the tool. Click Yes to accept any security warnings that may appear. Once the MBAM dashboard opens, on the right detail pane click on the word "Current" under the Scan Status to update the tool database. On the left menu pane click the Settings tab, and then select the Protection tab on the top. Under the Scan Options, turn on the button Scan for rootkits and Scan within archives. Click the Scan tab on the right detail pane, select Threat Scan and click the Start Scan button Note: The scan may take some time to finish, so please be patient. If potential threats are detected, ensure to checkmark all the listed items, and click the Quarantine Selected button. While still on the Scan tab, click the View Report button, and in the window that opens click the Export button, select Text file (*.txt), and save the log to your Desktop. The log can also be viewed by clicking the log to select it, then clicking the View Report button. Please post the log for my review. Note: If asked to restart the computer, please do so immediately. === Please download AdwCleaner by Xplode onto your Desktop. Close all open programs and internet browsers. Double click on AdwCleaner.exe to run the tool. Click the Scan button and wait for the process to complete. Click the LogFile button and the report will open in Notepad. IMPORTANT If you click the Clean button all items listed in the report will be removed. If you find some false positive items or programs that you wish to keep, Close the AdwCleaner windows. Close all open programs and internet browsers. Double click on AdwCleaner.exe to run the tool. Click the Scan button and wait for the process to complete. Check off the element(s) you wish to keep. Click on the Clean button follow the prompts. A log file will automatically open after the scan has finished. Please post the content of that log file with your next answer. You can find the log file at C:\AdwCleanerCx.txt (x is a number). === Download the version of this tool for your operating system.Farbar Recovery Scan Tool (64 bit)Farbar Recovery Scan Tool (32 bit) and save it to a folder on your computer's Desktop. Double-click to run it. When the tool opens click Yes to disclaimer. Press Scan button. It will make a log (FRST.txt) in the same directory the tool is run. Please copy and paste it to your reply. The first time the tool is run, it makes also another log (Addition.txt). Please attach it to your reply. How to attach a file to your reply: In the Reply section in the bottom of the topic Click the "more reply Options" button. Attach the file. Select the "Choose a File" navigate to the location of the File.Click the file you wish to Attach.Click Attach this file.Click the Add reply button. === Please post the logs for my review. Wait for further instructions. ============================== Link to post Share on other sites More sharing options...
twinpeaks Posted July 8, 2018 Author ID:1255513 Share Posted July 8, 2018 Here's my logfile contents from ADwCleaner. With 6 detections for the pup.optional.legacy # ------------------------------- # Malwarebytes AdwCleaner 7.2.1.1 # ------------------------------- # Build: 07-04-2018 # Database: 2018-07-04.1 # Support: https://www.malwarebytes.com/support # # ------------------------------- # Mode: Clean # ------------------------------- # Start: 07-08-2018 # Duration: 00:00:05 # OS: Windows 10 Home # Cleaned: 6 # Failed: 0 ***** [ Services ] ***** No malicious services cleaned. ***** [ Folders ] ***** No malicious folders cleaned. ***** [ Files ] ***** No malicious files cleaned. ***** [ DLL ] ***** No malicious DLLs cleaned. ***** [ WMI ] ***** No malicious WMI cleaned. ***** [ Shortcuts ] ***** No malicious shortcuts cleaned. ***** [ Tasks ] ***** No malicious tasks cleaned. ***** [ Registry ] ***** Deleted HKCU\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\Internet Explorer\DOMStorage\st.chatango.com Deleted HKCU\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\Internet Explorer\DOMStorage\chatango.com Deleted HKCU\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\Internet Explorer\EdpDomStorage\st.chatango.com Deleted HKCU\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\Internet Explorer\EdpDomStorage\chatango.com ***** [ Chromium (and derivatives) ] ***** No malicious Chromium entries cleaned. ***** [ Chromium URLs ] ***** Deleted Ask Deleted AOL ***** [ Firefox (and derivatives) ] ***** No malicious Firefox entries cleaned. ***** [ Firefox URLs ] ***** No malicious Firefox URLs cleaned. ************************* [+] Delete Tracing Keys [+] Reset Winsock ************************* AdwCleaner[S00].txt - [2159 octets] - [08/07/2018 15:58:28] ########## EOF - C:\AdwCleaner\Logs\AdwCleaner[C00].txt ########## Link to post Share on other sites More sharing options...
twinpeaks Posted July 8, 2018 Author ID:1255516 Share Posted July 8, 2018 Here's is the FRST.txt as requested Scan result of Farbar Recovery Scan Tool (FRST) (x64) Version: 20.06.2018 Ran by Mike (administrator) on DESKTOP-5QB6ES4 (08-07-2018 16:34:02) Running from C:\Users\Mike\Downloads Loaded Profiles: Mike (Available Profiles: Mike) Platform: Windows 10 Home Version 1803 17134.112 (X64) Language: English (United States) Internet Explorer Version 11 (Default browser: Opera) Boot Mode: Normal Tutorial for Farbar Recovery Scan Tool: http://www.geekstogo.com/forum/topic/335081-frst-tutorial-how-to-use-farbar-recovery-scan-tool/ ==================== Processes (Whitelisted) ================= (If an entry is included in the fixlist, the process will be closed. The file will not be moved.) (Intel Corporation) C:\Windows\System32\DriverStore\FileRepository\ki126577.inf_amd64_ae71f87c8938d56a\igfxCUIService.exe (Realtek Semiconductor) C:\Program Files\Realtek\Audio\HDA\RtkAudioService64.exe (Realtek Semiconductor) C:\Program Files\Realtek\Audio\HDA\RAVBg64.exe (AVAST Software) C:\Program Files\AVAST Software\Avast\AvastSvc.exe (AVAST Software) C:\Program Files\AVAST Software\Avast\afwServ.exe () C:\Program Files (x86)\Canon\IJPLM\ijplmsvc.exe (Apple Inc.) C:\Program Files\Bonjour\mDNSResponder.exe (HP Inc.) C:\Program Files\HPCommRecovery\HPCommRecovery.exe (McAfee, Inc.) C:\Program Files\Common Files\McAfee\ModuleCore\ModuleCoreService.exe (McAfee, Inc.) C:\Windows\System32\mfevtps.exe (Apple Inc.) C:\Program Files\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe (HP Inc.) C:\Program Files (x86)\HP\HP System Event\HPWMISVC.exe (Intel Corporation) C:\Windows\System32\ibtsiva.exe (SUPERAntiSpyware.com) C:\Program Files\SUPERAntiSpyware\SASCORE64.EXE (Intel Corporation) C:\Windows\SysWOW64\esif_uf.exe (McAfee, Inc.) C:\Program Files\Common Files\McAfee\SystemCore\mfemms.exe (Microsoft Corporation) C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeClickToRun.exe (Intel Security, Inc.) C:\Program Files\Common Files\Intel Security\PEF\CORE\PEFService.exe () C:\Program Files\CyberLink\Shared files\RichVideo64.exe () C:\Program Files\AVAST Software\SecureLine\VpnSvc.exe (Synaptics Incorporated) C:\Program Files\Synaptics\SynTP\SynTPEnhService.exe (Malwarebytes) C:\Program Files\Malwarebytes\Anti-Malware\MBAMService.exe (McAfee, Inc.) C:\Windows\System32\mfevtps.exe (AVAST Software) C:\Program Files\AVAST Software\Avast\x64\aswidsagenta.exe (McAfee, Inc.) C:\Program Files\Common Files\McAfee\SystemCore\mfefire.exe (Intel Corporation) C:\Windows\Temp\DPTF\esif_assist_64.exe (Malwarebytes) C:\Program Files\Malwarebytes\Anti-Malware\mbamtray.exe (Dropbox, Inc.) C:\Program Files (x86)\Dropbox\Update\DropboxUpdate.exe (AVAST Software) C:\Program Files (x86)\AVAST Software\Browser\Update\1.4.141.333\AvastBrowserCrashHandler.exe (McAfee, Inc.) C:\Program Files\Common Files\McAfee\platform\McSvcHost\McSvHost.exe (AVAST Software) C:\Program Files (x86)\AVAST Software\Browser\Update\1.4.141.333\AvastBrowserCrashHandler64.exe (Synaptics Incorporated) C:\Program Files\Synaptics\SynTP\SynTPEnh.exe (Microsoft Corporation) C:\Windows\Microsoft.NET\Framework64\v3.0\WPF\PresentationFontCache.exe (McAfee, Inc.) C:\Program Files\Common Files\McAfee\SystemCore\mfefire.exe (McAfee, Inc.) C:\Program Files\Common Files\McAfee\VSCore_15_6\mcapexe.exe (Synaptics Incorporated) C:\Program Files\Synaptics\SynTP\SynTPHelper.exe (McAfee, Inc.) C:\Program Files\Common Files\McAfee\AMCore\mcshield.exe (McAfee, Inc.) C:\Program Files\Common Files\McAfee\ModuleCore\ModuleCoreService.exe (McAfee, Inc.) C:\Program Files\Common Files\McAfee\CSP\2.3.290.0\McCSPServiceHost.exe (Microsoft Corporation) C:\Windows\System32\dllhost.exe (HP Development Company, L.P.) C:\Program Files (x86)\HP\HP CoolSense\CoolSense.exe (Intel Corporation) C:\Windows\System32\DriverStore\FileRepository\ki126577.inf_amd64_ae71f87c8938d56a\igfxEM.exe (McAfee, Inc.) C:\Program Files\Common Files\McAfee\platform\McUICnt.exe (Microsoft Corporation) C:\Program Files\Windows Defender\MSASCuiL.exe (Realtek Semiconductor) C:\Program Files\Realtek\Audio\HDA\RtkNGUI64.exe (Apple Inc.) C:\Program Files\iTunes\iTunesHelper.exe (AVAST Software) C:\Program Files\AVAST Software\Avast\AvastUI.exe (SUPERAntiSpyware) C:\Program Files\SUPERAntiSpyware\SUPERANTISPYWARE.EXE (McAfee, Inc.) C:\Program Files\McAfee Security Scan\3.11.747\SSScheduler.exe (Microsoft Corporation) C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTEM.EXE (HP Inc.) C:\Program Files (x86)\HP\HP System Event\HPMSGSVC.exe (Apple Inc.) C:\Program Files\iPod\bin\iPodService.exe (CANON INC.) C:\Program Files (x86)\Canon\IJ Network Scanner Selector EX\CNMNSST.exe (Sharpeware) C:\Program Files (x86)\NETWatch\NWATCH.EXE (CANON INC.) C:\Program Files (x86)\Canon\Quick Menu\CNQMMAIN.EXE (HP) C:\Program Files (x86)\HP\HP 3D DriveGuard\AccelerometerSt.exe (Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe (Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe (Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe (Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe (Opera Software) C:\Users\Mike\AppData\Local\Programs\Opera\53.0.2907.99\opera.exe (Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe (Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe (Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe (Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe (Opera Software) C:\Users\Mike\AppData\Local\Programs\Opera\53.0.2907.99\opera_crashreporter.exe (Opera Software) C:\Users\Mike\AppData\Local\Programs\Opera\53.0.2907.99\opera.exe (Opera Software) C:\Users\Mike\AppData\Local\Programs\Opera\53.0.2907.99\opera.exe (Opera Software) C:\Users\Mike\AppData\Local\Programs\Opera\53.0.2907.99\opera.exe (Opera Software) C:\Users\Mike\AppData\Local\Programs\Opera\53.0.2907.99\opera.exe (Opera Software) C:\Users\Mike\AppData\Local\Programs\Opera\53.0.2907.99\opera.exe (Opera Software) C:\Users\Mike\AppData\Local\Programs\Opera\53.0.2907.99\opera.exe (AVAST Software) C:\Program Files\AVAST Software\SecureLine\SecureLine.exe (Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe (Opera Software) C:\Users\Mike\AppData\Local\Programs\Opera\53.0.2907.99\opera.exe (Opera Software) C:\Users\Mike\AppData\Local\Programs\Opera\53.0.2907.99\opera.exe (Microsoft Corporation) C:\Windows\splwow64.exe (Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe (Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe (CANON INC.) C:\Program Files (x86)\Canon\Quick Menu\CNQMUPDT.EXE (WildTangent) C:\Program Files (x86)\WildTangent Games\App\GamesAppIntegrationService.exe (Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe (Hewlett-Packard Company) C:\Program Files (x86)\Hewlett-Packard\Shared\hpqwmiex.exe (HP Inc.) C:\Program Files (x86)\Hewlett-Packard\HP Support Solutions\HPSupportSolutionsFrameworkService.exe (Microsoft Corporation) C:\Windows\SysWOW64\notepad.exe (HP Inc.) C:\Program Files\HP\HP Touchpoint Analytics Client\TouchpointAnalyticsClientService.exe (Intel Corporation) C:\Program Files\Intel\Intel(R) Rapid Storage Technology\IAStorDataMgrSvc.exe (Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\DAL\jhi_service.exe (Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\LMS\LMS.exe (Opera Software) C:\Users\Mike\AppData\Local\Programs\Opera\53.0.2907.99\opera.exe (Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe (Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe (Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe (Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe (Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe (Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe (Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe (Microsoft Corporation) C:\Windows\System32\smartscreen.exe ==================== Registry (Whitelisted) =========================== (If an entry is included in the fixlist, the registry item will be restored to default or removed. The file will not be moved.) HKLM\...\Run: [SecurityHealth] => C:\Program Files\Windows Defender\MSASCuiL.exe [638872 2018-04-11] (Microsoft Corporation) HKLM\...\Run: [RTHDVCPL] => C:\Program Files\Realtek\Audio\HDA\RtkNGUI64.exe [8853760 2016-03-28] (Realtek Semiconductor) HKLM\...\Run: [AvastUI.exe] => C:\Program Files\AVAST Software\Avast\AvLaunch.exe [242904 2018-07-05] (AVAST Software) HKLM\...\Run: [iTunesHelper] => C:\Program Files\iTunes\iTunesHelper.exe [298296 2018-01-22] (Apple Inc.) HKLM-x32\...\Run: [HPMessageService] => C:\Program Files (x86)\HP\HP System Event\HPMSGSVC.exe [657424 2016-01-11] (HP Inc.) HKLM-x32\...\Run: [PowerDVD14Agent] => C:\Program Files (x86)\CyberLink\PowerDVD14\PowerDVD14Agent.exe [795336 2016-01-28] (CyberLink Corp.) HKLM-x32\...\Run: [IJNetworkScannerSelectorEX] => C:\Program Files (x86)\Canon\IJ Network Scanner Selector EX\CNMNSST.exe [449168 2012-03-26] (CANON INC.) HKLM-x32\...\Run: [CanonQuickMenu] => C:\Program Files (x86)\Canon\Quick Menu\CNQMMAIN.EXE [1314432 2016-06-09] (CANON INC.) HKLM-x32\...\Run: [AccelerometerSysTrayApplet] => C:\Program Files (x86)\HP\HP 3D DriveGuard\AccelerometerST.exe [133952 2016-09-28] (HP) HKU\S-1-5-19\...\RunOnce: [WAB Migrate] => C:\Program Files\Windows Mail\wab.exe [518144 2018-04-11] (Microsoft Corporation) HKU\S-1-5-20\...\RunOnce: [WAB Migrate] => C:\Program Files\Windows Mail\wab.exe [518144 2018-04-11] (Microsoft Corporation) HKU\S-1-5-21-3765602466-2649139181-4260510445-1001\...\Run: [SUPERAntiSpyware] => C:\Program Files\SUPERAntiSpyware\SUPERAntiSpyware.exe [8887216 2018-03-24] (SUPERAntiSpyware) Startup: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\McAfee Security Scan Plus.lnk [2018-06-21] ShortcutTarget: McAfee Security Scan Plus.lnk -> C:\Program Files\McAfee Security Scan\3.11.747\SSScheduler.exe (McAfee, Inc.) Startup: C:\Users\Mike\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Send to OneNote.lnk [2018-02-23] ShortcutTarget: Send to OneNote.lnk -> C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTEM.EXE (Microsoft Corporation) Startup: C:\Users\Mike\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Start NETWatch.lnk [2017-02-22] ShortcutTarget: Start NETWatch.lnk -> C:\Users\Mike\AppData\Roaming\Microsoft\Installer\{7415AD3D-BDF6-4CD5-87AE-7237FAAACECF}\_36431d89.exe () ==================== Internet (Whitelisted) ==================== (If an item is included in the fixlist, if it is a registry item it will be removed or restored to default.) Hosts: 0.0.0.1 mssplus.mcafee.com Tcpip\Parameters: [DhcpNameServer] 209.18.47.62 209.18.47.61 209.18.47.63 Tcpip\..\Interfaces\{7c7671c3-aeb7-463c-89db-aa1183236ecf}: [DhcpNameServer] 209.18.47.62 209.18.47.61 209.18.47.63 Tcpip\..\Interfaces\{8beb7780-219a-45c1-b4cb-b481b9c83daf}: [DhcpNameServer] 172.168.0.7 Internet Explorer: ================== HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://hp15-comm.msn.com/?pc=HRTE HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = hxxp://hp15-comm.msn.com/?pc=HRTE HKU\.DEFAULT\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://hp15-comm.msn.com/?pc=HRTE HKU\.DEFAULT\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = hxxp://hp15-comm.msn.com/?pc=HRTE HKU\S-1-5-21-3765602466-2649139181-4260510445-1001\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://hp15-comm.msn.com/?pc=HRTE HKU\S-1-5-21-3765602466-2649139181-4260510445-1001\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = hxxp://hp15-comm.msn.com/?pc=HRTE BHO: Lync Browser Helper -> {31D09BA0-12F5-4CCE-BE8A-2923E76605DA} -> C:\Program Files (x86)\Microsoft Office\root\VFS\ProgramFilesX64\Microsoft Office\Office16\OCHelper.dll [2018-07-02] (Microsoft Corporation) BHO: Canon Easy-WebPrint EX BHO -> {3785D0AD-BFFF-47F6-BF5B-A587C162FED9} -> C:\Program Files\Canon\Easy-WebPrint EX\ewpexbho.dll [2016-02-23] (CANON INC.) BHO-x32: Canon Easy-WebPrint EX BHO -> {3785D0AD-BFFF-47F6-BF5B-A587C162FED9} -> C:\Program Files (x86)\Canon\Easy-WebPrint EX\ewpexbho.dll [2016-02-23] (CANON INC.) BHO-x32: HP Network Check Helper -> {E76FD755-C1BA-4DCB-9F13-99BD91223ADE} -> C:\Program Files (x86)\Hewlett-Packard\HP Support Framework\Resources\HPNetworkCheck\HPNetworkCheckPlugin.dll [2016-07-21] (HP Inc.) Toolbar: HKLM - Canon Easy-WebPrint EX - {759D9886-0C6F-4498-BAB6-4A5F47C6C72F} - C:\Program Files\Canon\Easy-WebPrint EX\ewpexhlp.dll [2016-02-23] (CANON INC.) Toolbar: HKLM-x32 - Canon Easy-WebPrint EX - {759D9886-0C6F-4498-BAB6-4A5F47C6C72F} - C:\Program Files (x86)\Canon\Easy-WebPrint EX\ewpexhlp.dll [2016-02-23] (CANON INC.) Handler-x32: mso-minsb-roaming.16 - {83C25742-A9F7-49FB-9138-434302C88D07} - C:\Program Files (x86)\Microsoft Office\root\Office16\MSOSB.DLL [2018-07-02] (Microsoft Corporation) Handler-x32: mso-minsb.16 - {42089D2D-912D-4018-9087-2B87803E93FB} - C:\Program Files (x86)\Microsoft Office\root\Office16\MSOSB.DLL [2018-07-02] (Microsoft Corporation) Handler-x32: osf-roaming.16 - {42089D2D-912D-4018-9087-2B87803E93FB} - C:\Program Files (x86)\Microsoft Office\root\Office16\MSOSB.DLL [2018-07-02] (Microsoft Corporation) Handler-x32: osf.16 - {5504BE45-A83B-4808-900A-3A5C36E7F77A} - C:\Program Files (x86)\Microsoft Office\root\Office16\MSOSB.DLL [2018-07-02] (Microsoft Corporation) Filter: application/x-mfe-ipt - {3EF5086B-5478-4598-A054-786C45D75692} - C:\Program Files\mcafee\msc\McSnIePl64.dll [2017-03-03] (McAfee, Inc.) Filter-x32: application/x-mfe-ipt - {3EF5086B-5478-4598-A054-786C45D75692} - C:\Program Files (x86)\McAfee\msc\McSnIePl.dll [2017-03-03] (McAfee, Inc.) FireFox: ======== FF DefaultProfile: 7y03i3ng.default FF ProfilePath: C:\Users\Mike\AppData\Roaming\Mozilla\Firefox\Profiles\7y03i3ng.default [2018-07-08] FF Extension: (ADB Helper) - C:\Users\Mike\AppData\Roaming\Mozilla\Firefox\Profiles\7y03i3ng.default\Extensions\adbhelper@mozilla.org.xpi [2018-02-23] [Legacy] FF Extension: (Blackout) - C:\Users\Mike\AppData\Roaming\Mozilla\Firefox\Profiles\7y03i3ng.default\Extensions\blackout-ext@skyweb.hu.xpi [2016-11-23] [Legacy] FF Extension: (Valence) - C:\Users\Mike\AppData\Roaming\Mozilla\Firefox\Profiles\7y03i3ng.default\Extensions\fxdevtools-adapters@mozilla.org [2017-08-02] [Legacy] FF Extension: (AdBlock) - C:\Users\Mike\AppData\Roaming\Mozilla\Firefox\Profiles\7y03i3ng.default\Extensions\jid1-NIfFY2CA8fy1tg@jetpack.xpi [2018-05-25] FF Extension: (Avast SafePrice) - C:\Users\Mike\AppData\Roaming\Mozilla\Firefox\Profiles\7y03i3ng.default\Extensions\sp@avast.com.xpi [2018-06-29] FF Extension: (Avast Online Security) - C:\Users\Mike\AppData\Roaming\Mozilla\Firefox\Profiles\7y03i3ng.default\Extensions\wrc@avast.com.xpi [2018-05-25] FF Extension: (Browser Backgrounds) - C:\Users\Mike\AppData\Roaming\Mozilla\Firefox\Profiles\7y03i3ng.default\Extensions\{3e0c7f3a-3f50-4730-beb5-4a9a10e2831c} [2016-11-23] [Legacy] FF Extension: (WebCompat Reporter) - C:\Program Files (x86)\Mozilla Firefox\browser\features\webcompat-reporter@mozilla.org.xpi [2018-07-06] [Legacy] [not signed] FF HKLM-x32\...\Thunderbird\Extensions: [msktbird@mcafee.com] - C:\Program Files\McAfee\MSK FF Extension: (McAfee Anti-Spam Thunderbird Extension) - C:\Program Files\McAfee\MSK [2017-03-05] [Legacy] [not signed] FF Plugin: @mcafee.com/MSC,version=10 -> C:\Program Files\mcafee\msc\npMcSnFFPl64.dll [2017-03-03] () FF Plugin-x32: @adobe.com/ShockwavePlayer -> C:\WINDOWS\SysWOW64\Adobe\Director\np32dsw_1229199.dll [2017-03-31] (Adobe Systems, Inc.) FF Plugin-x32: @canon.com/EPPEX -> C:\Program Files (x86)\Canon\My Image Garden\AddOn\CIG\npmigfpi.dll [2015-10-29] (CANON INC.) FF Plugin-x32: @mcafee.com/MSC,version=10 -> C:\Program Files (x86)\McAfee\msc\npMcSnFFPl.dll [2017-03-03] () FF Plugin-x32: @microsoft.com/SharePoint,version=14.0 -> C:\Program Files (x86)\Microsoft Office\root\Office16\NPSPWRAP.DLL [2018-03-04] (Microsoft Corporation) FF Plugin-x32: @tools.google.com/Google Update;version=3 -> C:\Program Files (x86)\Google\Update\1.3.33.17\npGoogleUpdate3.dll [2018-05-16] (Google Inc.) FF Plugin-x32: @tools.google.com/Google Update;version=9 -> C:\Program Files (x86)\Google\Update\1.3.33.17\npGoogleUpdate3.dll [2018-05-16] (Google Inc.) FF Plugin-x32: @WildTangent.com/GamesAppPresenceDetector,Version=1.0 -> C:\Program Files (x86)\WildTangent Games\App\BrowserIntegration\Registered\0\NP_wtapp.dll [2015-12-21] () FF Plugin-x32: Adobe Reader -> C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AIR\nppdf32.dll [2018-05-10] (Adobe Systems Inc.) Chrome: ======= CHR DefaultSearchURL: Default -> hxxps://duckduckgo.com/?q={searchTerms} CHR DefaultSearchKeyword: Default -> duckduckgo.com CHR DefaultSuggestURL: Default -> hxxps://duckduckgo.com/ac/?q={searchTerms}&type=list CHR Profile: C:\Users\Mike\AppData\Local\Google\Chrome\User Data\Default [2018-07-08] CHR Extension: (Slides) - C:\Users\Mike\AppData\Local\Google\Chrome\User Data\Default\Extensions\aapocclcgogkmnckokdopfmhonfmgoek [2017-10-14] CHR Extension: (Docs) - C:\Users\Mike\AppData\Local\Google\Chrome\User Data\Default\Extensions\aohghmighlieiainnegkcijnfilokake [2017-10-14] CHR Extension: (Google Drive) - C:\Users\Mike\AppData\Local\Google\Chrome\User Data\Default\Extensions\apdfllckaahabafndbhieahigkjlhalf [2016-11-23] CHR Extension: (Ledger Manager) - C:\Users\Mike\AppData\Local\Google\Chrome\User Data\Default\Extensions\beimhnaefocolcplfimocfiaiefpkgbf [2018-07-01] CHR Extension: (DuckDuckGo) - C:\Users\Mike\AppData\Local\Google\Chrome\User Data\Default\Extensions\bkdgflcldnnnapblkhphbgpggdiikppg [2018-07-01] CHR Extension: (YouTube) - C:\Users\Mike\AppData\Local\Google\Chrome\User Data\Default\Extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo [2016-11-23] CHR Extension: (Sheets) - C:\Users\Mike\AppData\Local\Google\Chrome\User Data\Default\Extensions\felcaaldnbdncclmgdcncolpebgiejap [2017-10-14] CHR Extension: (Google Docs Offline) - C:\Users\Mike\AppData\Local\Google\Chrome\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi [2016-11-26] CHR Extension: (Avast Online Security) - C:\Users\Mike\AppData\Local\Google\Chrome\User Data\Default\Extensions\gomekmidlodglbbmalcneegieacbdmki [2018-04-20] CHR Extension: (Ledger Wallet Ethereum) - C:\Users\Mike\AppData\Local\Google\Chrome\User Data\Default\Extensions\hmlhkialjkaldndjnlcdfdphcgeadkkm [2018-04-02] CHR Extension: (Ledger Wallet Bitcoin) - C:\Users\Mike\AppData\Local\Google\Chrome\User Data\Default\Extensions\kkdpmhnladdopljabkgpacgpliggeeaf [2018-04-26] CHR Extension: (MetaMask) - C:\Users\Mike\AppData\Local\Google\Chrome\User Data\Default\Extensions\nkbihfbeogaeaoehlefnkodbefgpgknn [2018-06-21] CHR Extension: (MyEtherWallet) - C:\Users\Mike\AppData\Local\Google\Chrome\User Data\Default\Extensions\nlbmnnijcnlegkjjpcfjclmcfggfefdm [2018-04-13] CHR Extension: (Chrome Web Store Payments) - C:\Users\Mike\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda [2018-04-05] CHR Extension: (AdBlocker Ultimate) - C:\Users\Mike\AppData\Local\Google\Chrome\User Data\Default\Extensions\ohahllgiabjaoigichmmfljhkcfikeof [2017-07-29] CHR Extension: (Gmail) - C:\Users\Mike\AppData\Local\Google\Chrome\User Data\Default\Extensions\pjkljhegncpnkpknbcohdijeoejaedia [2016-11-23] CHR Extension: (Chrome Media Router) - C:\Users\Mike\AppData\Local\Google\Chrome\User Data\Default\Extensions\pkedcjkdefgpdelpbcmbmeomcjbeemfm [2018-06-12] CHR HKLM-x32\...\Chrome\Extension: [gomekmidlodglbbmalcneegieacbdmki] - hxxps://clients2.google.com/service/update2/crx ==================== Services (Whitelisted) ==================== (If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.) R2 !SASCORE; C:\Program Files\SUPERAntiSpyware\SASCORE64.EXE [173472 2017-06-07] (SUPERAntiSpyware.com) R2 Apple Mobile Device Service; C:\Program Files\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe [83768 2018-01-05] (Apple Inc.) R3 aswbIDSAgent; C:\Program Files\AVAST Software\Avast\x64\aswidsagenta.exe [7780400 2018-07-05] (AVAST Software) S2 avast; C:\Program Files (x86)\AVAST Software\Browser\Update\AvastBrowserUpdate.exe [164984 2018-07-03] (AVAST Software) R2 avast! Antivirus; C:\Program Files\AVAST Software\Avast\AvastSvc.exe [322464 2018-07-05] (AVAST Software) R2 avast! Firewall; C:\Program Files\AVAST Software\Avast\afwServ.exe [435248 2018-07-05] (AVAST Software) S3 avastm; C:\Program Files (x86)\AVAST Software\Browser\Update\AvastBrowserUpdate.exe [164984 2018-07-03] (AVAST Software) R2 ClickToRunSvc; C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe [8765104 2018-06-20] (Microsoft Corporation) S3 ClientAnalyticsService; C:\Program Files\Common Files\McAfee\ClientAnalytics\Legacy\McClientAnalytics.exe [1747800 2017-02-16] (Intel Security) S2 dbupdate; C:\Program Files (x86)\Dropbox\Update\DropboxUpdate.exe [143144 2016-11-23] (Dropbox, Inc.) S3 dbupdatem; C:\Program Files (x86)\Dropbox\Update\DropboxUpdate.exe [143144 2016-11-23] (Dropbox, Inc.) R2 esifsvc; C:\WINDOWS\SysWOW64\esif_uf.exe [1392792 2016-03-01] (Intel Corporation) R2 GamesAppIntegrationService; C:\Program Files (x86)\WildTangent Games\App\GamesAppIntegrationService.exe [349728 2015-12-21] (WildTangent) R2 HomeNetSvc; C:\Program Files\Common Files\McAfee\Platform\McSvcHost\McSvHost.exe [641520 2016-12-09] (McAfee, Inc.) R2 HP Comm Recover; c:\Program Files\HPCommRecovery\HPCommRecovery.exe [44032 2016-03-02] (HP Inc.) [File not signed] R2 HPSupportSolutionsFrameworkService; C:\Program Files (x86)\Hewlett-Packard\HP Support Solutions\HPSupportSolutionsFrameworkService.exe [332656 2018-05-02] (HP Inc.) R2 HPTouchpointAnalyticsService; C:\Program Files\HP\HP Touchpoint Analytics Client\TouchpointAnalyticsClientService.exe [332216 2017-11-23] (HP Inc.) R2 HPWMISVC; c:\Program Files (x86)\HP\HP System Event\HPWMISVC.exe [606224 2016-01-11] (HP Inc.) R2 IAStorDataMgrSvc; C:\Program Files\Intel\Intel(R) Rapid Storage Technology\IAStorDataMgrSvc.exe [19440 2015-11-04] (Intel Corporation) R2 ibtsiva; C:\WINDOWS\system32\ibtsiva.exe [542320 2017-12-06] (Intel Corporation) R2 IJPLMSVC; C:\Program Files (x86)\Canon\IJPLM\IJPLMSVC.EXE [84616 2014-05-15] () S3 Intel(R) Capability Licensing Service TCP IP Interface; C:\Program Files\Intel\iCLS Client\SocketHeciServer.exe [742704 2017-10-11] (Intel(R) Corporation) S2 Intel(R) TPM Provisioning Service; C:\Program Files\Intel\iCLS Client\TPMProvisioningService.exe [668472 2017-10-11] (Intel(R) Corporation) S3 Intel(R) WiDi SAM; C:\Program Files (x86)\Intel Corporation\Intel WiDi\Intel(R) Software Asset Manager\bin\IntelSoftwareAssetManagerService.exe [19088 2015-09-17] (Intel Corporation) R2 jhi_service; C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\DAL\jhi_service.exe [213648 2017-11-09] (Intel Corporation) R2 MBAMService; C:\Program Files\Malwarebytes\Anti-Malware\mbamservice.exe [6541008 2018-05-09] (Malwarebytes) R2 McAPExe; C:\Program Files\Common Files\McAfee\VSCore_15_6\McApExe.exe [989632 2017-01-23] (McAfee, Inc.) S3 McAWFwk; C:\Program Files\Common Files\McAfee\ActWiz\McAWFwk.exe [352104 2015-09-29] (McAfee, Inc.) R2 mcbootdelaystartsvc; C:\Program Files\Common Files\McAfee\platform\McSvcHost\McSvHost.exe [641520 2016-12-09] (McAfee, Inc.) S3 McComponentHostService; C:\Program Files\McAfee Security Scan\3.11.747\McCHSvc.exe [405400 2018-06-18] (McAfee, Inc.) R2 mccspsvc; C:\Program Files\Common Files\McAfee\CSP\2.3.290.0\\McCSPServiceHost.exe [2054080 2017-02-03] (McAfee, Inc.) R2 McMPFSvc; C:\Program Files\Common Files\McAfee\Platform\McSvcHost\McSvHost.exe [641520 2016-12-09] (McAfee, Inc.) R2 McNaiAnn; C:\Program Files\Common Files\McAfee\platform\McSvcHost\McSvHost.exe [641520 2016-12-09] (McAfee, Inc.) S3 McODS; C:\Program Files\mcafee\VirusScan\mcods.exe [1342904 2017-02-01] (McAfee, Inc.) S4 McOobeSv2; C:\Program Files\Common Files\McAfee\platform\McSvcHost\McSvHost.exe [641520 2016-12-09] (McAfee, Inc.) R2 mcpltsvc; C:\Program Files\Common Files\McAfee\platform\McSvcHost\McSvHost.exe [641520 2016-12-09] (McAfee, Inc.) R2 McProxy; C:\Program Files\Common Files\McAfee\platform\McSvcHost\McSvHost.exe [641520 2016-12-09] (McAfee, Inc.) R3 mfefire; C:\Program Files\Common Files\McAfee\SystemCore\\mfefire.exe [241040 2016-11-14] (McAfee, Inc.) R2 mfemms; C:\Program Files\Common Files\McAfee\SystemCore\\mfemms.exe [383032 2016-11-14] (McAfee, Inc.) R3 mfevtp; C:\windows\system32\mfevtps.exe [342768 2016-11-14] (McAfee, Inc.) R2 ModuleCoreService; C:\Program Files\Common Files\McAfee\ModuleCore\ModuleCoreService.exe [1465840 2016-12-22] (McAfee, Inc.) S3 MSK80Service; C:\Program Files\Common Files\McAfee\Platform\McSvcHost\McSvHost.exe [641520 2016-12-09] (McAfee, Inc.) R2 PEFService; C:\Program Files\Common Files\Intel Security\PEF\CORE\PEFService.exe [1104304 2016-11-15] (Intel Security, Inc.) R2 RichVideo64; C:\Program Files\CyberLink\Shared files\RichVideo64.exe [389896 2014-04-14] () R2 RtkAudioService; C:\Program Files\Realtek\Audio\HDA\RtkAudioService64.exe [310016 2016-03-28] (Realtek Semiconductor) R2 SecureLine; C:\Program Files\AVAST Software\SecureLine\VpnSvc.exe [452456 2015-12-08] () S4 ssh-agent; C:\WINDOWS\System32\OpenSSH\ssh-agent.exe [495616 2018-03-10] () R2 SynTPEnhService; C:\Program Files\Synaptics\SynTP\SynTPEnhService.exe [278616 2017-08-18] (Synaptics Incorporated) S3 WdNisSvc; C:\ProgramData\Microsoft\Windows Defender\platform\4.18.1806.18062-0\NisSrv.exe [3925648 2018-07-01] (Microsoft Corporation) S3 WinDefend; C:\ProgramData\Microsoft\Windows Defender\platform\4.18.1806.18062-0\MsMpEng.exe [100080 2018-07-01] (Microsoft Corporation) S2 0272531528723126mcinstcleanup; C:\WINDOWS\TEMP\027253~1.EXE -cleanup -nolog [X] ===================== Drivers (Whitelisted) ====================== (If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.) R3 Accelerometer; C:\WINDOWS\System32\drivers\Accelerometer.sys [53760 2017-12-18] (HP) R1 aswArPot; C:\WINDOWS\System32\drivers\aswArPot.sys [197160 2018-07-05] (AVAST Software) R1 aswbidsdriver; C:\WINDOWS\System32\drivers\aswbidsdrivera.sys [229392 2018-07-05] (AVAST Software) R0 aswbidsh; C:\WINDOWS\System32\drivers\aswbidsha.sys [201328 2018-07-05] (AVAST Software) R0 aswblog; C:\WINDOWS\System32\drivers\aswbloga.sys [346664 2018-07-05] (AVAST Software) R0 aswbuniv; C:\WINDOWS\System32\drivers\aswbuniva.sys [59592 2018-07-05] (AVAST Software) S3 aswElam; C:\WINDOWS\System32\drivers\aswElam.sys [15360 2018-07-05] (AVAST Software) R3 aswHwid; C:\WINDOWS\System32\drivers\aswHwid.sys [46976 2018-07-05] (AVAST Software) R2 aswMonFlt; C:\WINDOWS\System32\drivers\aswMonFlt.sys [159640 2018-07-05] (AVAST Software) R1 aswNetSec; C:\WINDOWS\System32\drivers\aswNetSec.sys [647488 2018-07-05] (AVAST Software) R1 aswRdr; C:\WINDOWS\System32\drivers\aswRdr2.sys [111872 2018-07-05] (AVAST Software) R0 aswRvrt; C:\WINDOWS\System32\drivers\aswRvrt.sys [85968 2018-07-05] (AVAST Software) R1 aswSnx; C:\WINDOWS\System32\drivers\aswSnx.sys [1027728 2018-07-05] (AVAST Software) R1 aswSP; C:\WINDOWS\System32\drivers\aswSP.sys [463080 2018-07-05] (AVAST Software) R2 aswStm; C:\WINDOWS\System32\drivers\aswStm.sys [211160 2018-07-05] (AVAST Software) R0 aswVmm; C:\WINDOWS\System32\drivers\aswVmm.sys [381584 2018-07-05] (AVAST Software) R3 cfwids; C:\WINDOWS\System32\drivers\cfwids.sys [88456 2016-11-18] (McAfee, Inc.) R3 dptf_acpi; C:\WINDOWS\System32\drivers\dptf_acpi.sys [55784 2016-03-01] (Intel Corporation) R3 dptf_cpu; C:\WINDOWS\System32\drivers\dptf_cpu.sys [52200 2016-03-01] (Intel Corporation) R3 esif_lf; C:\WINDOWS\system32\DRIVERS\esif_lf.sys [260072 2016-03-01] (Intel Corporation) R3 HID_PCI; C:\WINDOWS\System32\drivers\HID_PCI.sys [49456 2015-08-20] (Intel) S3 HipShieldK; C:\WINDOWS\System32\drivers\HipShieldK.sys [216704 2016-08-02] (McAfee, Inc.) R0 hpdskflt; C:\WINDOWS\System32\drivers\hpdskflt.sys [39936 2017-12-18] (HP) R3 ibtusb; C:\WINDOWS\system32\DRIVERS\ibtusb.sys [136128 2017-12-06] (Intel Corporation) R3 ISH; C:\WINDOWS\System32\drivers\ISH.sys [134456 2015-08-31] (Intel) R3 ISH_BusDriver; C:\WINDOWS\System32\drivers\ISH_BusDriver.sys [69936 2015-08-31] (Intel) R3 MBAMSwissArmy; C:\WINDOWS\System32\Drivers\mbamswissarmy.sys [253664 2018-07-08] (Malwarebytes) R3 mfeaack; C:\WINDOWS\System32\drivers\mfeaack.sys [484576 2016-11-18] (McAfee, Inc.) R3 mfeavfk; C:\WINDOWS\System32\drivers\mfeavfk.sys [366320 2016-11-18] (McAfee, Inc.) S0 mfeelamk; C:\WINDOWS\System32\drivers\mfeelamk.sys [85048 2016-11-18] (McAfee, Inc.) R3 mfefirek; C:\WINDOWS\System32\drivers\mfefirek.sys [518184 2016-11-18] (McAfee, Inc.) R0 mfehidk; C:\WINDOWS\System32\drivers\mfehidk.sys [916432 2016-11-18] (McAfee, Inc.) R3 mfencbdc; C:\WINDOWS\System32\DRIVERS\mfencbdc.sys [498152 2016-10-24] (McAfee, Inc.) S3 mfencrk; C:\WINDOWS\System32\DRIVERS\mfencrk.sys [109336 2016-10-24] (McAfee, Inc.) R3 mfeplk; C:\WINDOWS\System32\drivers\mfeplk.sys [110248 2016-11-18] (McAfee, Inc.) R0 mfewfpk; C:\WINDOWS\System32\drivers\mfewfpk.sys [254800 2016-11-18] (McAfee, Inc.) R3 Microsoft_Bluetooth_AvrcpTransport; C:\WINDOWS\system32\DRIVERS\Microsoft.Bluetooth.AvrcpTransport.sys [46592 2018-04-11] (Microsoft Corporation) R3 Netwtw04; C:\WINDOWS\system32\DRIVERS\Netwtw04.sys [8623040 2018-02-05] (Intel Corporation) S3 pmxdrv; C:\WINDOWS\system32\drivers\pmxdrv.sys [31152 2018-02-15] () R3 rt640x64; C:\WINDOWS\System32\drivers\rt640x64.sys [935168 2016-03-01] (Realtek ) R3 RTSPER; C:\WINDOWS\system32\DRIVERS\RtsPer.sys [758488 2016-03-01] (Realsil Semiconductor Corporation) R1 SASDIFSV; C:\Program Files\SUPERAntiSpyware\SASDIFSV64.SYS [14928 2011-07-22] (SUPERAdBlocker.com and SUPERAntiSpyware.com) R1 SASKUTIL; C:\Program Files\SUPERAntiSpyware\SASKUTIL64.SYS [12368 2011-07-12] (SUPERAdBlocker.com and SUPERAntiSpyware.com) S3 SmbDrv; C:\WINDOWS\System32\drivers\Smb_driver_AMDASF.sys [58984 2016-02-25] (Synaptics Incorporated) R3 SmbDrvI; C:\WINDOWS\system32\DRIVERS\Smb_driver_Intel.sys [55384 2017-08-18] (Synaptics Incorporated) R3 VirtualButtons; C:\WINDOWS\System32\drivers\VirtualButtons.sys [41992 2017-03-31] (Intel Corporation) S3 WdBoot; C:\WINDOWS\system32\drivers\wd\WdBoot.sys [46592 2018-07-01] (Microsoft Corporation) S3 WdFilter; C:\WINDOWS\system32\drivers\wd\WdFilter.sys [340008 2018-07-01] (Microsoft Corporation) S3 WdNisDrv; C:\WINDOWS\System32\drivers\wd\WdNisDrv.sys [59944 2018-07-01] (Microsoft Corporation) R3 WirelessButtonDriver64; C:\WINDOWS\System32\drivers\WirelessButtonDriver64.sys [34960 2018-02-02] (HP) ==================== NetSvcs (Whitelisted) =================== (If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.) ==================== One Month Created files and folders ======== (If an entry is included in the fixlist, the file/folder will be moved.) 2018-07-08 16:34 - 2018-07-08 16:35 - 000031539 _____ C:\Users\Mike\Downloads\FRST.txt 2018-07-08 16:33 - 2018-07-08 16:33 - 002412544 _____ (Farbar) C:\Users\Mike\Downloads\FRST64.exe 2018-07-08 16:17 - 2018-07-08 16:23 - 001066844 _____ C:\WINDOWS\Minidump\070818-37062-01.dmp 2018-07-08 16:17 - 2018-07-08 16:17 - 778946306 _____ C:\WINDOWS\MEMORY.DMP 2018-07-08 15:59 - 2018-07-08 15:59 - 000000045 _____ C:\Users\Mike\Desktop\virus.txt 2018-07-08 15:55 - 2018-07-08 15:55 - 000001310 _____ C:\Users\Mike\Desktop\Malwarebytes anti malware.txt 2018-07-07 14:56 - 2018-07-07 17:46 - 000003297 _____ C:\Users\Mike\Desktop\Dr Rhonda Patrick #901.txt 2018-07-07 14:23 - 2018-07-08 15:59 - 000000000 ____D C:\AdwCleaner 2018-07-07 14:23 - 2018-07-07 14:23 - 007402192 _____ (Malwarebytes) C:\Users\Mike\Downloads\adwcleaner_7.2.1 (1).exe 2018-07-07 14:22 - 2018-07-07 14:22 - 007402192 _____ (Malwarebytes) C:\Users\Mike\Downloads\adwcleaner_7.2.1.exe 2018-07-05 14:45 - 2018-07-05 14:44 - 000015360 _____ (AVAST Software) C:\WINDOWS\system32\Drivers\aswElam.sys 2018-07-05 14:44 - 2018-07-05 14:44 - 000378072 _____ (AVAST Software) C:\WINDOWS\system32\aswBoot.exe 2018-07-05 14:39 - 2018-07-08 16:17 - 000253664 _____ (Malwarebytes) C:\WINDOWS\system32\Drivers\mbamswissarmy.sys 2018-07-03 10:32 - 2018-07-08 11:41 - 000003333 _____ C:\Users\Mike\Desktop\dr rhonda patrick.txt 2018-07-03 00:10 - 2018-07-03 00:10 - 000002581 _____ C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Avast Secure Browser.lnk 2018-07-03 00:10 - 2018-07-03 00:10 - 000002546 _____ C:\Users\Public\Desktop\Avast Secure Browser.lnk 2018-07-03 00:07 - 2018-07-08 16:21 - 000000000 ____D C:\Users\Mike\AppData\Local\AVAST Software 2018-07-03 00:07 - 2018-07-03 00:07 - 000003458 _____ C:\WINDOWS\System32\Tasks\AvastUpdateTaskMachineUA 2018-07-03 00:07 - 2018-07-03 00:07 - 000003334 _____ C:\WINDOWS\System32\Tasks\AvastUpdateTaskMachineCore 2018-07-03 00:07 - 2018-07-03 00:07 - 000000000 ____D C:\Program Files (x86)\AVAST Software 2018-07-02 19:12 - 2018-07-08 15:57 - 000000180 _____ C:\Users\Mike\Desktop\msm.txt 2018-07-02 10:51 - 2018-07-02 10:51 - 000002442 _____ C:\ProgramData\Microsoft\Windows\Start Menu\Programs\OneNote 2016.lnk 2018-07-02 10:51 - 2018-07-02 10:51 - 000000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Microsoft Office Tools 2018-06-29 10:33 - 2018-06-29 11:06 - 000000455 _____ C:\Users\Mike\Desktop\TUES JUL 10 11 15 OIL CHANGE HUYNDAI.txt 2018-06-29 02:21 - 2018-06-29 02:46 - 000001804 _____ C:\Users\Mike\Desktop\dope gene expression thru food.txt 2018-06-23 08:08 - 2018-06-23 08:09 - 000118004 _____ C:\Users\Mike\Downloads\message (1).html 2018-06-23 08:08 - 2018-06-23 08:08 - 000118004 _____ C:\Users\Mike\Downloads\message.html 2018-06-23 08:07 - 2018-06-23 08:07 - 000487810 _____ C:\Users\Mike\Downloads\Traditioanl IRA direct transfer.pdf 2018-06-23 08:06 - 2018-06-23 08:06 - 000129650 _____ C:\Users\Mike\Downloads\Traditional IRA post 70 1.5 payment election form.pdf 2018-06-23 08:03 - 2018-06-23 08:03 - 003130048 _____ C:\Users\Mike\Downloads\Traditional IRA application.pdf 2018-06-21 14:10 - 2018-06-21 14:10 - 000000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\McAfee Security Scan Plus 2018-06-21 14:09 - 2018-07-05 13:49 - 000000000 ____D C:\ProgramData\McAfee Security Scan 2018-06-20 06:41 - 2018-06-20 06:41 - 023746762 _____ C:\Users\Mike\Downloads\06122018_0001.pdf 2018-06-19 10:35 - 2018-06-19 11:41 - 000000392 _____ C:\Users\Mike\Desktop\DMV APPT SEPT5 115 PHONE.txt 2018-06-15 20:00 - 2018-07-04 12:05 - 000004846 _____ C:\Users\Mike\Desktop\rubber & energy coconut oil magnesium lib.txt 2018-06-13 10:31 - 2018-06-08 12:02 - 004527680 _____ (Microsoft Corporation) C:\WINDOWS\system32\sppsvc.exe 2018-06-13 10:31 - 2018-06-08 11:45 - 012712448 _____ (Microsoft Corporation) C:\WINDOWS\system32\ieframe.dll 2018-06-13 10:31 - 2018-06-08 11:43 - 002922496 _____ (Microsoft Corporation) C:\WINDOWS\system32\Windows.UI.Logon.dll 2018-06-13 10:31 - 2018-06-08 09:51 - 011903488 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\ieframe.dll 2018-06-13 10:31 - 2018-06-08 03:31 - 007900984 _____ (Microsoft Corporation) C:\WINDOWS\system32\d3d10warp.dll 2018-06-13 10:31 - 2018-06-08 02:30 - 009148320 _____ (Microsoft Corporation) C:\WINDOWS\system32\ntoskrnl.exe 2018-06-13 10:31 - 2018-06-08 02:30 - 001017080 _____ (Microsoft Corporation) C:\WINDOWS\system32\msmpeg2adec.dll 2018-06-13 10:31 - 2018-06-08 02:29 - 007520000 _____ (Microsoft Corporation) C:\WINDOWS\system32\Windows.Media.Protection.PlayReady.dll 2018-06-13 10:31 - 2018-06-08 02:29 - 002371392 _____ (Microsoft Corporation) C:\WINDOWS\system32\msmpeg2vdec.dll 2018-06-13 10:31 - 2018-06-08 02:13 - 025846784 _____ (Microsoft Corporation) C:\WINDOWS\system32\edgehtml.dll 2018-06-13 10:31 - 2018-06-08 02:12 - 000861616 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\msmpeg2adec.dll 2018-06-13 10:31 - 2018-06-08 02:10 - 002331584 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\msmpeg2vdec.dll 2018-06-13 10:31 - 2018-06-08 02:09 - 006569960 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\Windows.Media.Protection.PlayReady.dll 2018-06-13 10:31 - 2018-06-08 02:04 - 004706816 _____ (Microsoft Corporation) C:\WINDOWS\system32\cdp.dll 2018-06-13 10:31 - 2018-06-08 02:03 - 022005760 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\edgehtml.dll 2018-06-13 10:31 - 2018-06-08 02:02 - 022713856 _____ (Microsoft Corporation) C:\WINDOWS\system32\mshtml.dll 2018-06-13 10:31 - 2018-06-08 02:00 - 019404288 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\mshtml.dll 2018-06-13 10:31 - 2018-06-08 02:00 - 004372992 _____ (Microsoft Corporation) C:\WINDOWS\system32\EdgeContent.dll 2018-06-13 10:31 - 2018-06-08 01:59 - 004867072 _____ (Microsoft Corporation) C:\WINDOWS\system32\jscript9.dll 2018-06-13 10:31 - 2018-06-08 01:59 - 003392512 _____ (Microsoft Corporation) C:\WINDOWS\system32\AppXDeploymentServer.dll 2018-06-13 10:31 - 2018-06-08 01:58 - 007581696 _____ (Microsoft Corporation) C:\WINDOWS\system32\Chakra.dll 2018-06-13 10:31 - 2018-05-20 12:43 - 021389360 _____ (Microsoft Corporation) C:\WINDOWS\system32\shell32.dll 2018-06-13 10:31 - 2018-05-20 09:59 - 023862784 _____ (Microsoft Corporation) C:\WINDOWS\system32\Hydrogen.dll 2018-06-13 10:31 - 2018-05-20 04:52 - 007436632 _____ (Microsoft Corporation) C:\WINDOWS\system32\windows.storage.dll 2018-06-13 10:31 - 2018-05-20 04:34 - 016592384 _____ (Microsoft Corporation) C:\WINDOWS\system32\Windows.UI.Xaml.dll 2018-06-13 10:31 - 2018-05-20 04:30 - 008188928 _____ (Microsoft Corporation) C:\WINDOWS\system32\Windows.Data.Pdf.dll 2018-06-13 10:31 - 2018-05-20 04:26 - 003392512 _____ (Microsoft Corporation) C:\WINDOWS\system32\tquery.dll 2018-06-13 10:31 - 2018-05-20 04:23 - 002366976 _____ (Microsoft Corporation) C:\WINDOWS\system32\WebRuntimeManager.dll 2018-06-13 10:31 - 2018-05-20 04:16 - 006661120 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\Windows.Data.Pdf.dll 2018-06-13 10:30 - 2018-06-08 12:07 - 000506184 _____ (Microsoft Corporation) C:\WINDOWS\system32\systemreset.exe 2018-06-13 10:30 - 2018-06-08 12:02 - 001634808 _____ (Microsoft Corporation) C:\WINDOWS\system32\gdi32full.dll 2018-06-13 10:30 - 2018-06-08 12:02 - 000661160 _____ (Microsoft Corporation) C:\WINDOWS\system32\GenValObj.exe 2018-06-13 10:30 - 2018-06-08 12:01 - 002395056 _____ (Microsoft Corporation) C:\WINDOWS\system32\WMVCORE.DLL 2018-06-13 10:30 - 2018-06-08 12:01 - 001046944 _____ (Microsoft Corporation) C:\WINDOWS\system32\ReAgent.dll 2018-06-13 10:30 - 2018-06-08 11:45 - 004392448 _____ (Microsoft Corporation) C:\WINDOWS\system32\SettingsHandlers_nt.dll 2018-06-13 10:30 - 2018-06-08 11:44 - 001121792 _____ (Microsoft Corporation) C:\WINDOWS\system32\TSWorkspace.dll 2018-06-13 10:30 - 2018-06-08 11:44 - 000340992 _____ (Microsoft Corporation) C:\WINDOWS\system32\AcGenral.dll 2018-06-13 10:30 - 2018-06-08 11:43 - 001719808 _____ (Microsoft Corporation) C:\WINDOWS\system32\dui70.dll 2018-06-13 10:30 - 2018-06-08 11:43 - 001659904 _____ (Microsoft Corporation) C:\WINDOWS\system32\XpsPrint.dll 2018-06-13 10:30 - 2018-06-08 11:43 - 001543680 _____ (Microsoft Corporation) C:\WINDOWS\system32\msdtctm.dll 2018-06-13 10:30 - 2018-06-08 11:43 - 001364992 _____ (Microsoft Corporation) C:\WINDOWS\system32\bcastdvruserservice.dll 2018-06-13 10:30 - 2018-06-08 11:42 - 003999232 _____ (Microsoft Corporation) C:\WINDOWS\system32\UIRibbon.dll 2018-06-13 10:30 - 2018-06-08 11:42 - 003653120 _____ (Microsoft Corporation) C:\WINDOWS\system32\win32kfull.sys 2018-06-13 10:30 - 2018-06-08 11:42 - 001605632 _____ (Microsoft Corporation) C:\WINDOWS\system32\rdpcorets.dll 2018-06-13 10:30 - 2018-06-08 11:41 - 001180672 _____ (Microsoft Corporation) C:\WINDOWS\system32\reseteng.dll 2018-06-13 10:30 - 2018-06-08 11:41 - 000878080 _____ (Microsoft Corporation) C:\WINDOWS\system32\CPFilters.dll 2018-06-13 10:30 - 2018-06-08 11:41 - 000758272 _____ (Microsoft Corporation) C:\WINDOWS\system32\msfeeds.dll 2018-06-13 10:30 - 2018-06-08 11:41 - 000577024 _____ (Microsoft Corporation) C:\WINDOWS\system32\SppExtComObj.Exe 2018-06-13 10:30 - 2018-06-08 11:40 - 000465920 _____ (Microsoft Corporation) C:\WINDOWS\system32\DXP.dll 2018-06-13 10:30 - 2018-06-08 10:04 - 001454024 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\gdi32full.dll 2018-06-13 10:30 - 2018-06-08 09:58 - 002206544 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\WMVCORE.DLL 2018-06-13 10:30 - 2018-06-08 09:58 - 000917408 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\ReAgent.dll 2018-06-13 10:30 - 2018-06-08 09:47 - 003492864 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\UIRibbon.dll 2018-06-13 10:30 - 2018-06-08 09:47 - 002895872 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\win32kfull.sys 2018-06-13 10:30 - 2018-06-08 09:47 - 001462784 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\dui70.dll 2018-06-13 10:30 - 2018-06-08 09:47 - 000703488 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\CPFilters.dll 2018-06-13 10:30 - 2018-06-08 09:45 - 002401280 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\AcGenral.dll 2018-06-13 10:30 - 2018-06-08 09:06 - 000976384 _____ (Microsoft Corporation) C:\WINDOWS\system32\Spectrum.exe 2018-06-13 10:30 - 2018-06-08 09:05 - 000944640 _____ (Microsoft Corporation) C:\WINDOWS\system32\Windows.Mirage.Internal.dll 2018-06-13 10:30 - 2018-06-08 07:00 - 000658432 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\Windows.Mirage.Internal.dll 2018-06-13 10:30 - 2018-06-08 03:38 - 005821544 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\d3d10warp.dll 2018-06-13 10:30 - 2018-06-08 03:37 - 002417840 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\d3d11.dll 2018-06-13 10:30 - 2018-06-08 03:35 - 001613200 _____ (Microsoft Corporation) C:\WINDOWS\system32\D3D12.dll 2018-06-13 10:30 - 2018-06-08 03:35 - 000613144 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\dxgi.dll 2018-06-13 10:30 - 2018-06-08 03:34 - 001299056 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\D3D12.dll 2018-06-13 10:30 - 2018-06-08 03:34 - 000748512 _____ (Microsoft Corporation) C:\WINDOWS\system32\dxgi.dll 2018-06-13 10:30 - 2018-06-08 03:31 - 003180176 _____ (Microsoft Corporation) C:\WINDOWS\system32\d3d11.dll 2018-06-13 10:30 - 2018-06-08 03:31 - 000029600 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\uefi.sys 2018-06-13 10:30 - 2018-06-08 03:30 - 000705440 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\vhdmp.sys 2018-06-13 10:30 - 2018-06-08 02:34 - 001140576 _____ (Microsoft Corporation) C:\WINDOWS\system32\winresume.efi 2018-06-13 10:30 - 2018-06-08 02:34 - 000983016 _____ (Microsoft Corporation) C:\WINDOWS\system32\winresume.exe 2018-06-13 10:30 - 2018-06-08 02:33 - 001034632 _____ (Microsoft Corporation) C:\WINDOWS\system32\ApplyTrustOffline.exe 2018-06-13 10:30 - 2018-06-08 02:33 - 000269224 _____ (Microsoft Corporation) C:\WINDOWS\system32\SgrmEnclave_secure.dll 2018-06-13 10:30 - 2018-06-08 02:31 - 001174432 _____ (Microsoft Corporation) C:\WINDOWS\system32\hvix64.exe 2018-06-13 10:30 - 2018-06-08 02:31 - 001012640 _____ (Microsoft Corporation) C:\WINDOWS\system32\hvax64.exe 2018-06-13 10:30 - 2018-06-08 02:30 - 003296896 _____ (Microsoft Corporation) C:\WINDOWS\system32\combase.dll 2018-06-13 10:30 - 2018-06-08 02:30 - 001798552 _____ (Microsoft Corporation) C:\WINDOWS\system32\twinapi.appcore.dll 2018-06-13 10:30 - 2018-06-08 02:30 - 001363632 _____ (Microsoft Corporation) C:\WINDOWS\system32\WinTypes.dll 2018-06-13 10:30 - 2018-06-08 02:30 - 001063328 _____ (Microsoft Corporation) C:\WINDOWS\system32\SecConfig.efi 2018-06-13 10:30 - 2018-06-08 02:30 - 000723360 _____ (Microsoft Corporation) C:\WINDOWS\system32\wimgapi.dll 2018-06-13 10:30 - 2018-06-08 02:30 - 000722808 _____ (Microsoft Corporation) C:\WINDOWS\system32\ci.dll 2018-06-13 10:30 - 2018-06-08 02:30 - 000567184 _____ (Microsoft Corporation) C:\WINDOWS\system32\tcblaunch.exe 2018-06-13 10:30 - 2018-06-08 02:30 - 000565152 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\USBHUB3.SYS 2018-06-13 10:30 - 2018-06-08 02:30 - 000527264 _____ (Microsoft Corporation) C:\WINDOWS\system32\wimserv.exe 2018-06-13 10:30 - 2018-06-08 02:30 - 000491328 _____ (Microsoft Corporation) C:\WINDOWS\system32\mf.dll 2018-06-13 10:30 - 2018-06-08 02:30 - 000194456 _____ (Microsoft Corporation) C:\WINDOWS\system32\skci.dll 2018-06-13 10:30 - 2018-06-08 02:29 - 006817384 _____ (Microsoft Corporation) C:\WINDOWS\system32\Windows.Media.dll 2018-06-13 10:30 - 2018-06-08 02:29 - 004970360 _____ (Microsoft Corporation) C:\WINDOWS\system32\Windows.StateRepository.dll 2018-06-13 10:30 - 2018-06-08 02:29 - 004403280 _____ (Microsoft Corporation) C:\WINDOWS\system32\mfcore.dll 2018-06-13 10:30 - 2018-06-08 02:29 - 003283408 _____ (Microsoft Corporation) C:\WINDOWS\system32\CoreUIComponents.dll 2018-06-13 10:30 - 2018-06-08 02:29 - 002836384 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\dxgkrnl.sys 2018-06-13 10:30 - 2018-06-08 02:29 - 002753048 _____ (Microsoft Corporation) C:\WINDOWS\system32\iertutil.dll 2018-06-13 10:30 - 2018-06-08 02:29 - 002590400 _____ (Microsoft Corporation) C:\WINDOWS\system32\WMVDECOD.DLL 2018-06-13 10:30 - 2018-06-08 02:29 - 002570712 _____ (Microsoft Corporation) C:\WINDOWS\system32\KernelBase.dll 2018-06-13 10:30 - 2018-06-08 02:29 - 002564984 _____ (Microsoft Corporation) C:\WINDOWS\system32\mfmp4srcsnk.dll 2018-06-13 10:30 - 2018-06-08 02:29 - 002546592 _____ (Microsoft Corporation) C:\WINDOWS\system32\UpdateAgent.dll 2018-06-13 10:30 - 2018-06-08 02:29 - 002462272 _____ (Microsoft Corporation) C:\WINDOWS\system32\msxml6.dll 2018-06-13 10:30 - 2018-06-08 02:29 - 002422688 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\ntfs.sys 2018-06-13 10:30 - 2018-06-08 02:29 - 001946328 _____ (Microsoft Corporation) C:\WINDOWS\system32\ntdll.dll 2018-06-13 10:30 - 2018-06-08 02:29 - 001934400 _____ (Microsoft Corporation) C:\WINDOWS\system32\AudioEng.dll 2018-06-13 10:30 - 2018-06-08 02:29 - 001921952 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\refs.sys 2018-06-13 10:30 - 2018-06-08 02:29 - 001792808 _____ (Microsoft Corporation) C:\WINDOWS\system32\propsys.dll 2018-06-13 10:30 - 2018-06-08 02:29 - 001784584 _____ (Microsoft Corporation) C:\WINDOWS\system32\mfasfsrcsnk.dll 2018-06-13 10:30 - 2018-06-08 02:29 - 001611592 _____ (Microsoft Corporation) C:\WINDOWS\system32\mfnetsrc.dll 2018-06-13 10:30 - 2018-06-08 02:29 - 001457136 _____ (Microsoft Corporation) C:\WINDOWS\system32\winload.efi 2018-06-13 10:30 - 2018-06-08 02:29 - 001364184 _____ (Microsoft Corporation) C:\WINDOWS\system32\webservices.dll 2018-06-13 10:30 - 2018-06-08 02:29 - 001288816 _____ (Microsoft Corporation) C:\WINDOWS\system32\mfmpeg2srcsnk.dll 2018-06-13 10:30 - 2018-06-08 02:29 - 001258288 _____ (Microsoft Corporation) C:\WINDOWS\system32\winload.exe 2018-06-13 10:30 - 2018-06-08 02:29 - 001209800 _____ (Microsoft Corporation) C:\WINDOWS\system32\AudioSes.dll 2018-06-13 10:30 - 2018-06-08 02:29 - 001190152 _____ (Microsoft Corporation) C:\WINDOWS\system32\rpcrt4.dll 2018-06-13 10:30 - 2018-06-08 02:29 - 001150416 _____ (Microsoft Corporation) C:\WINDOWS\system32\MSVP9DEC.dll 2018-06-13 10:30 - 2018-06-08 02:29 - 001148808 _____ (Microsoft Corporation) C:\WINDOWS\system32\mfsvr.dll 2018-06-13 10:30 - 2018-06-08 02:29 - 001112608 _____ (Microsoft Corporation) C:\WINDOWS\system32\mfds.dll 2018-06-13 10:30 - 2018-06-08 02:29 - 001097648 _____ (Microsoft Corporation) C:\WINDOWS\system32\msvproc.dll 2018-06-13 10:30 - 2018-06-08 02:29 - 001026976 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\http.sys 2018-06-13 10:30 - 2018-06-08 02:29 - 000678840 _____ (Microsoft Corporation) C:\WINDOWS\system32\SHCore.dll 2018-06-13 10:30 - 2018-06-08 02:29 - 000594128 _____ (Microsoft Corporation) C:\WINDOWS\system32\audiodg.exe 2018-06-13 10:30 - 2018-06-08 02:29 - 000416144 _____ (Microsoft Corporation) C:\WINDOWS\system32\MSAudDecMFT.dll 2018-06-13 10:30 - 2018-06-08 02:29 - 000375712 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\msrpc.sys 2018-06-13 10:30 - 2018-06-08 02:29 - 000313592 _____ (Microsoft Corporation) C:\WINDOWS\system32\mfsensorgroup.dll 2018-06-13 10:30 - 2018-06-08 02:29 - 000266656 _____ (Microsoft Corporation) C:\WINDOWS\system32\browserbroker.dll 2018-06-13 10:30 - 2018-06-08 02:29 - 000260896 _____ (Microsoft Corporation) C:\WINDOWS\system32\mfps.dll 2018-06-13 10:30 - 2018-06-08 02:29 - 000164768 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\wfplwfs.sys 2018-06-13 10:30 - 2018-06-08 02:29 - 000158720 _____ (Microsoft Corporation) C:\WINDOWS\system32\vertdll.dll 2018-06-13 10:30 - 2018-06-08 02:29 - 000084288 _____ (Microsoft Corporation) C:\WINDOWS\system32\LanguageOverlayUtil.dll 2018-06-13 10:30 - 2018-06-08 02:29 - 000057960 _____ (Microsoft Corporation) C:\WINDOWS\system32\kernel.appcore.dll 2018-06-13 10:30 - 2018-06-08 02:12 - 000786176 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\rpcrt4.dll 2018-06-13 10:30 - 2018-06-08 02:11 - 001461744 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\twinapi.appcore.dll 2018-06-13 10:30 - 2018-06-08 02:11 - 000550616 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\mf.dll 2018-06-13 10:30 - 2018-06-08 02:10 - 002479272 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\combase.dll 2018-06-13 10:30 - 2018-06-08 02:10 - 002307336 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\WMVDECOD.DLL 2018-06-13 10:30 - 2018-06-08 02:10 - 001988072 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\msxml6.dll 2018-06-13 10:30 - 2018-06-08 02:10 - 001397200 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\MSVP9DEC.dll 2018-06-13 10:30 - 2018-06-08 02:10 - 001011992 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\AudioSes.dll 2018-06-13 10:30 - 2018-06-08 02:10 - 000880152 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\WinTypes.dll 2018-06-13 10:30 - 2018-06-08 02:10 - 000457152 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\MSAudDecMFT.dll 2018-06-13 10:30 - 2018-06-08 02:09 - 006527064 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\Windows.Media.dll 2018-06-13 10:30 - 2018-06-08 02:09 - 004788512 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\mfcore.dll 2018-06-13 10:30 - 2018-06-08 02:09 - 004469832 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\Windows.StateRepository.dll 2018-06-13 10:30 - 2018-06-08 02:09 - 002535552 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\mfmp4srcsnk.dll 2018-06-13 10:30 - 2018-06-08 02:09 - 002486992 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\CoreUIComponents.dll 2018-06-13 10:30 - 2018-06-08 02:09 - 002242216 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\iertutil.dll 2018-06-13 10:30 - 2018-06-08 02:09 - 001980872 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\KernelBase.dll 2018-06-13 10:30 - 2018-06-08 02:09 - 001805776 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\AudioEng.dll 2018-06-13 10:30 - 2018-06-08 02:09 - 001709720 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\mfnetsrc.dll 2018-06-13 10:30 - 2018-06-08 02:09 - 001620880 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\ntdll.dll 2018-06-13 10:30 - 2018-06-08 02:09 - 001584128 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\propsys.dll 2018-06-13 10:30 - 2018-06-08 02:09 - 001380200 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\mfasfsrcsnk.dll 2018-06-13 10:30 - 2018-06-08 02:09 - 001129648 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\msvproc.dll 2018-06-13 10:30 - 2018-06-08 02:09 - 001077504 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\webservices.dll 2018-06-13 10:30 - 2018-06-08 02:09 - 001020168 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\mfmpeg2srcsnk.dll 2018-06-13 10:30 - 2018-06-08 02:09 - 000988136 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\mfsvr.dll 2018-06-13 10:30 - 2018-06-08 02:09 - 000770160 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\mfds.dll 2018-06-13 10:30 - 2018-06-08 02:09 - 000607648 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\wimgapi.dll 2018-06-13 10:30 - 2018-06-08 02:09 - 000567144 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\CoreMessaging.dll 2018-06-13 10:30 - 2018-06-08 02:09 - 000553248 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\SHCore.dll 2018-06-13 10:30 - 2018-06-08 02:09 - 000356960 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\bcryptprimitives.dll 2018-06-13 10:30 - 2018-06-08 02:09 - 000064648 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\LanguageOverlayUtil.dll 2018-06-13 10:30 - 2018-06-08 02:09 - 000050208 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\kernel.appcore.dll 2018-06-13 10:30 - 2018-06-08 02:01 - 004563456 _____ (Microsoft Corporation) C:\WINDOWS\system32\MFMediaEngine.dll 2018-06-13 10:30 - 2018-06-08 02:01 - 002961408 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\cdp.dll 2018-06-13 10:30 - 2018-06-08 02:00 - 003320320 _____ (Microsoft Corporation) C:\WINDOWS\system32\dwmcore.dll 2018-06-13 10:30 - 2018-06-08 02:00 - 001285120 _____ (Microsoft Corporation) C:\WINDOWS\system32\Windows.UI.Xaml.Maps.dll 2018-06-13 10:30 - 2018-06-08 02:00 - 000329216 _____ (Microsoft Corporation) C:\WINDOWS\system32\credprovs.dll 2018-06-13 10:30 - 2018-06-08 01:59 - 006032384 _____ (Microsoft Corporation) C:\WINDOWS\system32\d2d1.dll 2018-06-13 10:30 - 2018-06-08 01:59 - 001767936 _____ (Microsoft Corporation) C:\WINDOWS\system32\audiosrv.dll 2018-06-13 10:30 - 2018-06-08 01:59 - 001318400 _____ (Microsoft Corporation) C:\WINDOWS\system32\ISM.dll 2018-06-13 10:30 - 2018-06-08 01:59 - 000673792 _____ (Microsoft Corporation) C:\WINDOWS\system32\FrameServer.dll 2018-06-13 10:30 - 2018-06-08 01:59 - 000564736 _____ (Microsoft Corporation) C:\WINDOWS\system32\daxexec.dll 2018-06-13 10:30 - 2018-06-08 01:58 - 003712512 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\jscript9.dll 2018-06-13 10:30 - 2018-06-08 01:58 - 001676800 _____ (Microsoft Corporation) C:\WINDOWS\system32\CoreShell.dll 2018-06-13 10:30 - 2018-06-08 01:58 - 000898560 _____ (Microsoft Corporation) C:\WINDOWS\system32\WpcWebFilter.dll 2018-06-13 10:30 - 2018-06-08 01:58 - 000894464 _____ (Microsoft Corporation) C:\WINDOWS\system32\webplatstorageserver.dll 2018-06-13 10:30 - 2018-06-08 01:58 - 000813568 _____ (Microsoft Corporation) C:\WINDOWS\system32\EdgeManager.dll 2018-06-13 10:30 - 2018-06-08 01:57 - 003348992 _____ (Microsoft Corporation) C:\WINDOWS\system32\msftedit.dll 2018-06-13 10:30 - 2018-06-08 01:57 - 002172416 _____ (Microsoft Corporation) C:\WINDOWS\system32\AppXDeploymentExtensions.onecore.dll 2018-06-13 10:30 - 2018-06-08 01:57 - 001708544 _____ (Microsoft Corporation) C:\WINDOWS\system32\MSPhotography.dll 2018-06-13 10:30 - 2018-06-08 01:57 - 001485312 _____ (Microsoft Corporation) C:\WINDOWS\system32\InstallService.dll 2018-06-13 10:30 - 2018-06-08 01:57 - 000483328 _____ (Microsoft Corporation) C:\WINDOWS\system32\RTMediaFrame.dll 2018-06-13 10:30 - 2018-06-08 01:56 - 005780992 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\Chakra.dll 2018-06-13 10:30 - 2018-06-08 01:56 - 005307392 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\d2d1.dll 2018-06-13 10:30 - 2018-06-08 01:56 - 004336128 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\MFMediaEngine.dll 2018-06-13 10:30 - 2018-06-08 01:56 - 003293696 _____ (Microsoft Corporation) C:\WINDOWS\system32\esent.dll 2018-06-13 10:30 - 2018-06-08 01:56 - 002902016 _____ (Microsoft Corporation) C:\WINDOWS\system32\wuaueng.dll 2018-06-13 10:30 - 2018-06-08 01:56 - 002900480 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\dwmcore.dll 2018-06-13 10:30 - 2018-06-08 01:56 - 002364928 _____ (Microsoft Corporation) C:\WINDOWS\system32\OpcServices.dll 2018-06-13 10:30 - 2018-06-08 01:56 - 001804288 _____ (Microsoft Corporation) C:\WINDOWS\system32\urlmon.dll 2018-06-13 10:30 - 2018-06-08 01:56 - 001550848 _____ (Microsoft Corporation) C:\WINDOWS\system32\AppXDeploymentExtensions.desktop.dll 2018-06-13 10:30 - 2018-06-08 01:56 - 001395200 _____ (Microsoft Corporation) C:\WINDOWS\system32\TokenBroker.dll 2018-06-13 10:30 - 2018-06-08 01:56 - 000916480 _____ (Microsoft Corporation) C:\WINDOWS\system32\Windows.Security.Authentication.Web.Core.dll 2018-06-13 10:30 - 2018-06-08 01:56 - 000908800 _____ (Microsoft Corporation) C:\WINDOWS\system32\MSMPEG2ENC.DLL 2018-06-13 10:30 - 2018-06-08 01:56 - 000871424 _____ (Microsoft Corporation) C:\WINDOWS\system32\Windows.Media.BackgroundMediaPlayback.dll 2018-06-13 10:30 - 2018-06-08 01:56 - 000869376 _____ (Microsoft Corporation) C:\WINDOWS\system32\Windows.Media.Playback.BackgroundMediaPlayer.dll 2018-06-13 10:30 - 2018-06-08 01:56 - 000858112 _____ (Microsoft Corporation) C:\WINDOWS\system32\FlightSettings.dll 2018-06-13 10:30 - 2018-06-08 01:56 - 000684544 _____ (Microsoft Corporation) C:\WINDOWS\system32\AudioEndpointBuilder.dll 2018-06-13 10:30 - 2018-06-08 01:56 - 000615424 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\EdgeManager.dll 2018-06-13 10:30 - 2018-06-08 01:56 - 000389632 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\daxexec.dll 2018-06-13 10:30 - 2018-06-08 01:56 - 000331264 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\edgeIso.dll 2018-06-13 10:30 - 2018-06-08 01:56 - 000264704 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\credprovs.dll 2018-06-13 10:30 - 2018-06-08 01:55 - 003441152 _____ (Microsoft Corporation) C:\WINDOWS\system32\wininet.dll 2018-06-13 10:30 - 2018-06-08 01:55 - 002248192 _____ (Microsoft Corporation) C:\WINDOWS\system32\wlidsvc.dll 2018-06-13 10:30 - 2018-06-08 01:55 - 002236928 _____ (Microsoft Corporation) C:\WINDOWS\system32\win32kbase.sys 2018-06-13 10:30 - 2018-06-08 01:55 - 002061824 _____ (Microsoft Corporation) C:\WINDOWS\system32\UIAutomationCore.dll 2018-06-13 10:30 - 2018-06-08 01:55 - 001854976 _____ (Microsoft Corporation) C:\WINDOWS\system32\wevtsvc.dll 2018-06-13 10:30 - 2018-06-08 01:55 - 001371648 _____ (Microsoft Corporation) C:\WINDOWS\system32\usocore.dll 2018-06-13 10:30 - 2018-06-08 01:55 - 001242112 _____ (Microsoft Corporation) C:\WINDOWS\system32\mfmkvsrcsnk.dll 2018-06-13 10:30 - 2018-06-08 01:55 - 001192448 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\Windows.UI.Xaml.Maps.dll 2018-06-13 10:30 - 2018-06-08 01:55 - 001171968 _____ (Microsoft Corporation) C:\WINDOWS\system32\SettingSyncCore.dll 2018-06-13 10:30 - 2018-06-08 01:55 - 001160192 _____ (Microsoft Corporation) C:\WINDOWS\system32\rpcss.dll 2018-06-13 10:30 - 2018-06-08 01:55 - 001070080 _____ (Microsoft Corporation) C:\WINDOWS\system32\Windows.Media.Streaming.dll 2018-06-13 10:30 - 2018-06-08 01:55 - 001033728 _____ (Microsoft Corporation) C:\WINDOWS\system32\modernexecserver.dll 2018-06-13 10:30 - 2018-06-08 01:55 - 000776192 _____ (Microsoft Corporation) C:\WINDOWS\system32\jscript.dll 2018-06-13 10:30 - 2018-06-08 01:55 - 000667648 _____ (Microsoft Corporation) C:\WINDOWS\system32\AppReadiness.dll 2018-06-13 10:30 - 2018-06-08 01:55 - 000652800 _____ (Microsoft Corporation) C:\WINDOWS\system32\ActivationManager.dll 2018-06-13 10:30 - 2018-06-08 01:55 - 000578560 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\webplatstorageserver.dll 2018-06-13 10:30 - 2018-06-08 01:54 - 003016192 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\wininet.dll 2018-06-13 10:30 - 2018-06-08 01:54 - 002789376 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\msftedit.dll 2018-06-13 10:30 - 2018-06-08 01:54 - 001627136 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\urlmon.dll 2018-06-13 10:30 - 2018-06-08 01:54 - 001586176 _____ (Microsoft Corporation) C:\WINDOWS\system32\ieapfltr.dll 2018-06-13 10:30 - 2018-06-08 01:54 - 001128448 _____ (Microsoft Corporation) C:\WINDOWS\system32\MbaeApiPublic.dll 2018-06-13 10:30 - 2018-06-08 01:54 - 000999936 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\TokenBroker.dll 2018-06-13 10:30 - 2018-06-08 01:54 - 000950272 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\SettingSyncCore.dll 2018-06-13 10:30 - 2018-06-08 01:54 - 000646656 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\Windows.Media.Playback.BackgroundMediaPlayer.dll 2018-06-13 10:30 - 2018-06-08 01:54 - 000619520 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\WpcWebFilter.dll 2018-06-13 10:30 - 2018-06-08 01:54 - 000593408 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\Windows.Web.dll 2018-06-13 10:30 - 2018-06-08 01:54 - 000505344 _____ (Microsoft Corporation) C:\WINDOWS\system32\edgeIso.dll 2018-06-13 10:30 - 2018-06-08 01:54 - 000375808 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\RTMediaFrame.dll 2018-06-13 10:30 - 2018-06-08 01:53 - 001675264 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\UIAutomationCore.dll 2018-06-13 10:30 - 2018-06-08 01:53 - 001466368 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\ieapfltr.dll 2018-06-13 10:30 - 2018-06-08 01:53 - 001108992 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\InstallService.dll 2018-06-13 10:30 - 2018-06-08 01:53 - 000873472 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\Windows.Media.Streaming.dll 2018-06-13 10:30 - 2018-06-08 01:53 - 000669696 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\jscript.dll 2018-06-13 10:30 - 2018-06-06 11:57 - 003733320 _____ C:\WINDOWS\system32\Windows.Mirage.dll 2018-06-13 10:30 - 2018-06-05 21:20 - 002841312 _____ C:\WINDOWS\SysWOW64\Windows.Mirage.dll 2018-06-13 10:30 - 2018-05-20 12:45 - 000308408 _____ (Microsoft Corporation) C:\WINDOWS\system32\acmigration.dll 2018-06-13 10:30 - 2018-05-20 12:42 - 001649760 _____ (Microsoft Corporation) C:\WINDOWS\system32\d3d9.dll 2018-06-13 10:30 - 2018-05-20 12:42 - 000759192 _____ (Microsoft Corporation) C:\WINDOWS\system32\LicensingWinRT.dll 2018-06-13 10:30 - 2018-05-20 12:26 - 000486912 _____ (Microsoft Corporation) C:\WINDOWS\system32\rasplap.dll 2018-06-13 10:30 - 2018-05-20 12:23 - 000947712 _____ (Microsoft Corporation) C:\WINDOWS\system32\mmsys.cpl 2018-06-13 10:30 - 2018-05-20 12:23 - 000899072 _____ (Microsoft Corporation) C:\WINDOWS\system32\uDWM.dll 2018-06-13 10:30 - 2018-05-20 12:22 - 001665024 _____ (Microsoft Corporation) C:\WINDOWS\system32\comsvcs.dll 2018-06-13 10:30 - 2018-05-20 12:22 - 000804352 _____ (Microsoft Corporation) C:\WINDOWS\system32\SndVolSSO.dll 2018-06-13 10:30 - 2018-05-20 11:14 - 020383712 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\shell32.dll 2018-06-13 10:30 - 2018-05-20 11:14 - 001490144 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\d3d9.dll 2018-06-13 10:30 - 2018-05-20 11:00 - 000864768 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\mmsys.cpl 2018-06-13 10:30 - 2018-05-20 10:59 - 000747520 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\SndVolSSO.dll 2018-06-13 10:30 - 2018-05-20 09:45 - 001271296 _____ (Microsoft Corporation) C:\WINDOWS\system32\HoloSI.PCShell.dll 2018-06-13 10:30 - 2018-05-20 09:35 - 000677376 _____ (Microsoft Corporation) C:\WINDOWS\system32\HeadTrackerStorage.dll 2018-06-13 10:30 - 2018-05-20 09:34 - 000238592 _____ (Microsoft Corporation) C:\WINDOWS\system32\HoloShellRuntime.dll 2018-06-13 10:30 - 2018-05-20 05:33 - 000105368 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\stornvme.sys 2018-06-13 10:30 - 2018-05-20 04:53 - 002178136 _____ (Microsoft Corporation) C:\WINDOWS\system32\Windows.ApplicationModel.Store.dll 2018-06-13 10:30 - 2018-05-20 04:53 - 001947808 _____ (Microsoft Corporation) C:\WINDOWS\system32\mfplat.dll 2018-06-13 10:30 - 2018-05-20 04:53 - 001017088 _____ (Microsoft Corporation) C:\WINDOWS\system32\DolbyDecMFT.dll 2018-06-13 10:30 - 2018-05-20 04:53 - 001012408 _____ (Microsoft Corporation) C:\WINDOWS\system32\mfreadwrite.dll 2018-06-13 10:30 - 2018-05-20 04:53 - 000088472 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\crashdmp.sys 2018-06-13 10:30 - 2018-05-20 04:52 - 000735560 _____ (Microsoft Corporation) C:\WINDOWS\system32\AppXDeploymentClient.dll 2018-06-13 10:30 - 2018-05-20 04:52 - 000347704 _____ (Microsoft Corporation) C:\WINDOWS\system32\wintrust.dll 2018-06-13 10:30 - 2018-05-20 04:52 - 000130456 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\hvsocket.sys 2018-06-13 10:30 - 2018-05-20 04:34 - 000861096 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\DolbyDecMFT.dll 2018-06-13 10:30 - 2018-05-20 04:33 - 001665920 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\Windows.ApplicationModel.Store.dll 2018-06-13 10:30 - 2018-05-20 04:32 - 006044104 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\windows.storage.dll 2018-06-13 10:30 - 2018-05-20 04:32 - 001034096 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\mfreadwrite.dll 2018-06-13 10:30 - 2018-05-20 04:32 - 000560488 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\AppXDeploymentClient.dll 2018-06-13 10:30 - 2018-05-20 04:32 - 000286200 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\wintrust.dll 2018-06-13 10:30 - 2018-05-20 04:31 - 001456640 _____ (Microsoft Corporation) C:\WINDOWS\system32\WpcDesktopMonSvc.dll 2018-06-13 10:30 - 2018-05-20 04:28 - 000111616 _____ (Microsoft Corporation) C:\WINDOWS\system32\AppHostRegistrationVerifier.exe 2018-06-13 10:30 - 2018-05-20 04:26 - 001307648 _____ (Microsoft Corporation) C:\WINDOWS\system32\MSVPXENC.dll 2018-06-13 10:30 - 2018-05-20 04:26 - 000356352 _____ (Microsoft Corporation) C:\WINDOWS\system32\dafWfdProvider.dll 2018-06-13 10:30 - 2018-05-20 04:26 - 000266752 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\srvnet.sys 2018-06-13 10:30 - 2018-05-20 04:26 - 000236032 _____ (Microsoft Corporation) C:\WINDOWS\system32\wevtutil.exe 2018-06-13 10:30 - 2018-05-20 04:26 - 000098816 _____ (Microsoft Corporation) C:\WINDOWS\system32\TelephonyInteractiveUser.dll 2018-06-13 10:30 - 2018-05-20 04:24 - 000625152 _____ (Microsoft Corporation) C:\WINDOWS\system32\PsmServiceExtHost.dll 2018-06-13 10:30 - 2018-05-20 04:24 - 000234496 _____ (Microsoft Corporation) C:\WINDOWS\system32\DolbyMATEnc.dll 2018-06-13 10:30 - 2018-05-20 04:23 - 013873152 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\Windows.UI.Xaml.dll 2018-06-13 10:30 - 2018-05-20 04:23 - 000933376 _____ (Microsoft Corporation) C:\WINDOWS\system32\rasapi32.dll 2018-06-13 10:30 - 2018-05-20 04:23 - 000847360 _____ (Microsoft Corporation) C:\WINDOWS\system32\bisrv.dll 2018-06-13 10:30 - 2018-05-20 04:21 - 001303040 _____ (Microsoft Corporation) C:\WINDOWS\system32\Windows.Networking.Vpn.dll 2018-06-13 10:30 - 2018-05-20 04:21 - 001210880 _____ (Microsoft Corporation) C:\WINDOWS\system32\wpnapps.dll 2018-06-13 10:30 - 2018-05-20 04:21 - 000960512 _____ (Microsoft Corporation) C:\WINDOWS\system32\StorSvc.dll 2018-06-13 10:30 - 2018-05-20 04:21 - 000783360 _____ (Microsoft Corporation) C:\WINDOWS\system32\DolbyHrtfEnc.dll 2018-06-13 10:30 - 2018-05-20 04:17 - 002699776 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\tquery.dll 2018-06-13 10:30 - 2018-05-20 04:16 - 000094720 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\UserDataTimeUtil.dll 2018-06-13 10:30 - 2018-05-20 04:14 - 001295360 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\MSVPXENC.dll 2018-06-13 10:30 - 2018-05-20 04:12 - 000992768 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\Windows.Networking.Vpn.dll 2018-06-13 10:30 - 2018-05-20 04:12 - 000860160 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\rasapi32.dll 2018-06-13 10:30 - 2018-05-20 04:11 - 001005568 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\wpnapps.dll 2018-06-13 10:29 - 2018-06-08 12:05 - 000094112 _____ (Microsoft Corporation) C:\WINDOWS\system32\rdpudd.dll 2018-06-13 10:29 - 2018-06-08 11:48 - 000064000 _____ (Microsoft Corporation) C:\WINDOWS\system32\iemigplugin.dll 2018-06-13 10:29 - 2018-06-08 11:47 - 000144384 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\mrxdav.sys 2018-06-13 10:29 - 2018-06-08 11:46 - 000584192 _____ (Microsoft Corporation) C:\WINDOWS\system32\UIRibbonRes.dll 2018-06-13 10:29 - 2018-06-08 11:45 - 001560576 _____ (Microsoft Corporation) C:\WINDOWS\system32\msdt.exe 2018-06-13 10:29 - 2018-06-08 11:45 - 000808960 _____ C:\WINDOWS\system32\MBR2GPT.EXE 2018-06-13 10:29 - 2018-06-08 11:44 - 000625152 _____ (Microsoft Corporation) C:\WINDOWS\system32\BootMenuUX.dll 2018-06-13 10:29 - 2018-06-08 11:44 - 000285184 _____ (Microsoft Corporation) C:\WINDOWS\system32\wlidcredprov.dll 2018-06-13 10:29 - 2018-06-08 11:43 - 003640832 _____ (Microsoft Corporation) C:\WINDOWS\system32\mstsc.exe 2018-06-13 10:29 - 2018-06-08 11:43 - 000392192 _____ (Microsoft Corporation) C:\WINDOWS\system32\iedkcs32.dll 2018-06-13 10:29 - 2018-06-08 11:42 - 002084864 _____ (Microsoft Corporation) C:\WINDOWS\system32\inetcpl.cpl 2018-06-13 10:29 - 2018-06-08 11:42 - 000503296 _____ (Microsoft Corporation) C:\WINDOWS\system32\sppcext.dll 2018-06-13 10:29 - 2018-06-08 11:41 - 002019840 _____ (Microsoft Corporation) C:\WINDOWS\system32\ResetEngine.dll 2018-06-13 10:29 - 2018-06-08 11:41 - 000182272 _____ (Microsoft Corporation) C:\WINDOWS\system32\easwrt.dll 2018-06-13 10:29 - 2018-06-08 09:50 - 001508352 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\msdt.exe 2018-06-13 10:29 - 2018-06-08 09:48 - 000668672 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\msfeeds.dll 2018-06-13 10:29 - 2018-06-08 09:48 - 000344064 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\iedkcs32.dll 2018-06-13 10:29 - 2018-06-08 09:47 - 001032704 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\XpsPrint.dll 2018-06-13 10:29 - 2018-06-08 09:47 - 000231936 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\wlidcredprov.dll 2018-06-13 10:29 - 2018-06-08 09:46 - 003444224 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\mstsc.exe 2018-06-13 10:29 - 2018-06-08 09:46 - 002016256 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\inetcpl.cpl 2018-06-13 10:29 - 2018-06-08 09:46 - 000908288 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\TSWorkspace.dll 2018-06-13 10:29 - 2018-06-08 09:05 - 001008640 _____ (Microsoft Corporation) C:\WINDOWS\system32\Windows.Media.MixedRealityCapture.dll 2018-06-13 10:29 - 2018-06-08 07:00 - 000868864 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\Windows.Media.MixedRealityCapture.dll 2018-06-13 10:29 - 2018-06-08 02:33 - 001213368 _____ (Microsoft Corporation) C:\WINDOWS\system32\ClipUp.exe 2018-06-13 10:29 - 2018-06-08 02:33 - 000272296 _____ (Microsoft Corporation) C:\WINDOWS\system32\SgrmEnclave.dll 2018-06-13 10:29 - 2018-06-08 02:31 - 000226720 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\Ucx01000.sys 2018-06-13 10:29 - 2018-06-08 02:30 - 000709824 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\cng.sys 2018-06-13 10:29 - 2018-06-08 02:30 - 000170912 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\ksecpkg.sys 2018-06-13 10:29 - 2018-06-08 02:30 - 000137568 _____ (Microsoft Corporation) C:\WINDOWS\system32\bcrypt.dll 2018-06-13 10:29 - 2018-06-08 02:30 - 000134584 _____ (Microsoft Corporation) C:\WINDOWS\system32\hvloader.dll 2018-06-13 10:29 - 2018-06-08 02:29 - 000945568 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\refsv1.sys 2018-06-13 10:29 - 2018-06-08 02:29 - 000885880 _____ (Microsoft Corporation) C:\WINDOWS\system32\CoreMessaging.dll 2018-06-13 10:29 - 2018-06-08 02:29 - 000792992 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\dxgmms2.sys 2018-06-13 10:29 - 2018-06-08 02:29 - 000659096 _____ (Microsoft Corporation) C:\WINDOWS\system32\StateRepository.Core.dll 2018-06-13 10:29 - 2018-06-08 02:29 - 000413824 _____ (Microsoft Corporation) C:\WINDOWS\system32\AUDIOKSE.dll 2018-06-13 10:29 - 2018-06-08 02:29 - 000413088 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\dxgmms1.sys 2018-06-13 10:29 - 2018-06-08 02:10 - 000097176 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\bcrypt.dll 2018-06-13 10:29 - 2018-06-08 02:09 - 000568720 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\Windows.StateRepositoryPS.dll 2018-06-13 10:29 - 2018-06-08 02:03 - 000906752 _____ (Microsoft Corporation) C:\WINDOWS\system32\Windows.Globalization.PhoneNumberFormatting.dll 2018-06-13 10:29 - 2018-06-08 02:03 - 000185344 _____ (Microsoft Corporation) C:\WINDOWS\system32\InstallServiceTasks.dll 2018-06-13 10:29 - 2018-06-08 02:03 - 000038400 _____ (Microsoft Corporation) C:\WINDOWS\system32\Windows.StateRepositoryCore.dll 2018-06-13 10:29 - 2018-06-08 02:03 - 000032256 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\mskssrv.sys 2018-06-13 10:29 - 2018-06-08 02:02 - 000096768 _____ (Microsoft Corporation) C:\WINDOWS\system32\usoapi.dll 2018-06-13 10:29 - 2018-06-08 02:02 - 000059904 _____ (Microsoft Corporation) C:\WINDOWS\system32\edpnotify.exe 2018-06-13 10:29 - 2018-06-08 02:02 - 000035840 _____ (Microsoft Corporation) C:\WINDOWS\system32\TokenBrokerCookies.exe 2018-06-13 10:29 - 2018-06-08 02:01 - 000342528 _____ (Microsoft Corporation) C:\WINDOWS\system32\browserexport.exe 2018-06-13 10:29 - 2018-06-08 02:01 - 000295424 _____ (Microsoft Corporation) C:\WINDOWS\system32\FSClient.dll 2018-06-13 10:29 - 2018-06-08 02:01 - 000294912 _____ (Microsoft Corporation) C:\WINDOWS\system32\TDLMigration.dll 2018-06-13 10:29 - 2018-06-08 02:01 - 000209408 _____ (Microsoft Corporation) C:\WINDOWS\system32\AppXApplicabilityBlob.dll 2018-06-13 10:29 - 2018-06-08 02:01 - 000182272 _____ (Microsoft Corporation) C:\WINDOWS\system32\BitLockerCsp.dll 2018-06-13 10:29 - 2018-06-08 02:01 - 000046080 _____ (Microsoft Corporation) C:\WINDOWS\system32\tbauth.dll 2018-06-13 10:29 - 2018-06-08 02:01 - 000046080 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\hidparse.sys 2018-06-13 10:29 - 2018-06-08 02:00 - 000275456 _____ (Microsoft Corporation) C:\WINDOWS\system32\SIHClient.exe 2018-06-13 10:29 - 2018-06-08 02:00 - 000149504 _____ (Microsoft Corporation) C:\WINDOWS\system32\dssvc.dll 2018-06-13 10:29 - 2018-06-08 02:00 - 000100864 _____ (Microsoft Corporation) C:\WINDOWS\system32\CapabilityAccessManagerClient.dll 2018-06-13 10:29 - 2018-06-08 02:00 - 000075776 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\mpsdrv.sys 2018-06-13 10:29 - 2018-06-08 01:59 - 000983040 _____ (Microsoft Corporation) C:\WINDOWS\system32\wbiosrvc.dll 2018-06-13 10:29 - 2018-06-08 01:59 - 000456704 _____ (Microsoft Corporation) C:\WINDOWS\system32\MDEServer.exe 2018-06-13 10:29 - 2018-06-08 01:59 - 000177152 _____ (Microsoft Corporation) C:\WINDOWS\system32\Windows.StateRepositoryUpgrade.dll 2018-06-13 10:29 - 2018-06-08 01:59 - 000174080 _____ (Microsoft Corporation) C:\WINDOWS\system32\wuuhosdeployment.dll 2018-06-13 10:29 - 2018-06-08 01:58 - 000781824 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\WdiWiFi.sys 2018-06-13 10:29 - 2018-06-08 01:58 - 000266752 _____ (Microsoft Corporation) C:\WINDOWS\system32\CapabilityAccessManager.dll 2018-06-13 10:29 - 2018-06-08 01:58 - 000239104 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\FSClient.dll 2018-06-13 10:29 - 2018-06-08 01:58 - 000029184 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\TokenBrokerCookies.exe 2018-06-13 10:29 - 2018-06-08 01:57 - 000401920 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\ks.sys 2018-06-13 10:29 - 2018-06-08 01:57 - 000310272 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\wincorlib.dll 2018-06-13 10:29 - 2018-06-08 01:57 - 000150016 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\Windows.StateRepositoryUpgrade.dll 2018-06-13 10:29 - 2018-06-08 01:57 - 000038400 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\tbauth.dll 2018-06-13 10:29 - 2018-06-08 01:56 - 001361408 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\MSPhotography.dll 2018-06-13 10:29 - 2018-06-08 01:56 - 000715776 _____ (Microsoft Corporation) C:\WINDOWS\system32\Windows.Web.dll 2018-06-13 10:29 - 2018-06-08 01:56 - 000466432 _____ (Microsoft Corporation) C:\WINDOWS\system32\wuuhext.dll 2018-06-13 10:29 - 2018-06-08 01:55 - 000932352 _____ (Microsoft Corporation) C:\WINDOWS\system32\rasmans.dll 2018-06-13 10:29 - 2018-06-08 01:55 - 000849408 _____ (Microsoft Corporation) C:\WINDOWS\system32\Windows.Media.Playback.MediaPlayer.dll 2018-06-13 10:29 - 2018-06-08 01:55 - 000778752 _____ (Microsoft Corporation) C:\WINDOWS\system32\BFE.DLL 2018-06-13 10:29 - 2018-06-08 01:55 - 000630784 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\Windows.Media.Playback.MediaPlayer.dll 2018-06-13 10:29 - 2018-06-08 01:55 - 000401920 _____ (Microsoft Corporation) C:\WINDOWS\system32\rascustom.dll 2018-06-13 10:29 - 2018-06-08 01:54 - 001348096 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\OpcServices.dll 2018-06-13 10:29 - 2018-06-08 01:54 - 000857088 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\MSMPEG2ENC.DLL 2018-06-13 10:29 - 2018-06-08 01:54 - 000842240 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\mfmkvsrcsnk.dll 2018-06-13 10:29 - 2018-06-08 01:54 - 000729088 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\FlightSettings.dll 2018-06-13 10:29 - 2018-06-08 01:54 - 000251904 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\msIso.dll 2018-06-13 10:29 - 2018-06-08 01:54 - 000208384 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\MSAC3ENC.DLL 2018-06-13 10:29 - 2018-06-08 01:53 - 000677888 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\Windows.Security.Authentication.Web.Core.dll 2018-06-13 10:29 - 2018-06-08 01:53 - 000648192 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\Windows.Media.BackgroundMediaPlayback.dll 2018-06-13 10:29 - 2018-06-08 01:53 - 000528384 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\ActivationManager.dll 2018-06-13 10:29 - 2018-06-08 00:41 - 000001310 _____ C:\WINDOWS\system32\tcbres.wim 2018-06-13 10:29 - 2018-06-01 16:24 - 000713376 _____ (Microsoft Corporation) C:\WINDOWS\system32\MSVideoDSP.dll 2018-06-13 10:29 - 2018-06-01 15:54 - 001825792 _____ (Microsoft Corporation) C:\WINDOWS\system32\Windows.CloudStore.dll 2018-06-13 10:29 - 2018-05-24 20:24 - 000340480 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\msexcl40.dll 2018-06-13 10:29 - 2018-05-20 12:23 - 004070400 _____ (Microsoft Corporation) C:\WINDOWS\system32\msi.dll 2018-06-13 10:29 - 2018-05-20 12:22 - 001292288 _____ (Microsoft Corporation) C:\WINDOWS\system32\GamePanel.exe 2018-06-13 10:29 - 2018-05-20 12:22 - 000941056 _____ (Microsoft Corporation) C:\WINDOWS\system32\rasdlg.dll 2018-06-13 10:29 - 2018-05-20 11:15 - 000653208 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\LicensingWinRT.dll 2018-06-13 10:29 - 2018-05-20 11:02 - 000461312 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\rasplap.dll 2018-06-13 10:29 - 2018-05-20 10:59 - 000863232 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\rasdlg.dll 2018-06-13 10:29 - 2018-05-20 09:39 - 000788480 _____ (Microsoft Corporation) C:\WINDOWS\system32\DHolographicDisplay.dll 2018-06-13 10:29 - 2018-05-20 07:54 - 000184320 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\HoloShellRuntime.dll 2018-06-13 10:29 - 2018-05-20 04:53 - 000131232 _____ (Microsoft Corporation) C:\WINDOWS\system32\rmclient.dll 2018-06-13 10:29 - 2018-05-20 04:52 - 000089984 _____ (Microsoft Corporation) C:\WINDOWS\system32\CompPkgSup.dll 2018-06-13 10:29 - 2018-05-20 04:33 - 000101288 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\rmclient.dll 2018-06-13 10:29 - 2018-05-20 04:32 - 001559368 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\mfplat.dll 2018-06-13 10:29 - 2018-05-20 04:32 - 000077040 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\CompPkgSup.dll 2018-06-13 10:29 - 2018-05-20 04:28 - 000119296 _____ (Microsoft Corporation) C:\WINDOWS\system32\UserDataTimeUtil.dll 2018-06-13 10:29 - 2018-05-20 04:28 - 000002560 _____ (Microsoft Corporation) C:\WINDOWS\system32\tzres.dll 2018-06-13 10:29 - 2018-05-20 04:27 - 000344576 _____ (Microsoft Corporation) C:\WINDOWS\system32\RasMediaManager.dll 2018-06-13 10:29 - 2018-05-20 04:27 - 000109568 _____ (Microsoft Corporation) C:\WINDOWS\system32\ApiSetHost.AppExecutionAlias.dll 2018-06-13 10:29 - 2018-05-20 04:26 - 000154112 _____ (Microsoft Corporation) C:\WINDOWS\system32\Chakradiag.dll 2018-06-13 10:29 - 2018-05-20 04:26 - 000033792 _____ (Microsoft Corporation) C:\WINDOWS\system32\MSHEIF.dll 2018-06-13 10:29 - 2018-05-20 04:25 - 000835584 _____ (Microsoft Corporation) C:\WINDOWS\system32\PhoneService.dll 2018-06-13 10:29 - 2018-05-20 04:25 - 000384000 _____ (Microsoft Corporation) C:\WINDOWS\system32\Phoneutil.dll 2018-06-13 10:29 - 2018-05-20 04:24 - 000726528 _____ (Microsoft Corporation) C:\WINDOWS\system32\jscript9diag.dll 2018-06-13 10:29 - 2018-05-20 04:23 - 005951488 _____ (Microsoft Corporation) C:\WINDOWS\system32\dbgeng.dll 2018-06-13 10:29 - 2018-05-20 04:21 - 001371136 _____ (Microsoft Corporation) C:\WINDOWS\system32\aadtb.dll 2018-06-13 10:29 - 2018-05-20 04:16 - 000081920 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\ApiSetHost.AppExecutionAlias.dll 2018-06-13 10:29 - 2018-05-20 04:16 - 000002560 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\tzres.dll 2018-06-13 10:29 - 2018-05-20 04:15 - 000142848 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\InstallServiceTasks.dll 2018-06-13 10:29 - 2018-05-20 04:15 - 000026112 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\MSHEIF.dll 2018-06-13 10:29 - 2018-05-20 04:14 - 000167936 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\wevtutil.exe 2018-06-13 10:29 - 2018-05-20 04:13 - 004929024 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\dbgeng.dll 2018-06-13 10:29 - 2018-05-20 04:13 - 000317440 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\Phoneutil.dll 2018-06-13 10:29 - 2018-05-20 04:11 - 001036288 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\aadtb.dll 2018-06-13 10:29 - 2018-05-20 01:26 - 000018716 _____ C:\WINDOWS\system32\srms-apr.dat 2018-06-13 10:29 - 2018-05-18 10:08 - 000018716 _____ C:\WINDOWS\SysWOW64\srms-apr.dat 2018-06-12 09:37 - 2018-07-05 15:42 - 000152184 _____ (Malwarebytes) C:\WINDOWS\system32\Drivers\mbae64.sys 2018-06-12 09:37 - 2018-06-12 09:37 - 000001919 _____ C:\Users\Public\Desktop\Malwarebytes.lnk 2018-06-12 09:37 - 2018-06-12 09:37 - 000000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Malwarebytes 2018-06-12 09:30 - 2018-06-12 09:30 - 000002328 _____ C:\Users\Mike\Desktop\section 8 nikola tesla anti aging.txt ==================== One Month Modified files and folders ======== (If an entry is included in the fixlist, the file/folder will be moved.) 2018-07-08 16:34 - 2018-05-09 08:53 - 000000000 ____D C:\FRST 2018-07-08 16:31 - 2018-04-11 16:38 - 000000000 ____D C:\ProgramData\regid.1991-06.com.microsoft 2018-07-08 16:23 - 2017-11-19 21:02 - 000000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\McAfee 2018-07-08 16:18 - 2018-05-24 17:23 - 000000000 ____D C:\Users\Mike 2018-07-08 16:18 - 2016-11-23 17:35 - 000000000 __SHD C:\Users\Mike\IntelGraphicsProfiles 2018-07-08 16:17 - 2018-05-25 17:14 - 000000000 ____D C:\WINDOWS\Minidump 2018-07-08 16:17 - 2018-05-24 17:45 - 000000006 ____H C:\WINDOWS\Tasks\SA.DAT 2018-07-08 16:17 - 2018-05-24 17:16 - 000000000 ____D C:\WINDOWS\system32\SleepStudy 2018-07-08 16:09 - 2018-05-24 17:22 - 000933324 _____ C:\WINDOWS\system32\PerfStringBackup.INI 2018-07-08 16:09 - 2018-04-11 16:36 - 000000000 ____D C:\WINDOWS\INF 2018-07-08 16:03 - 2018-04-11 16:38 - 000000000 ____D C:\WINDOWS\AppReadiness 2018-07-08 16:01 - 2018-04-11 14:04 - 000032768 _____ C:\WINDOWS\system32\config\ELAM 2018-07-08 16:01 - 2018-01-25 20:02 - 000000360 _____ C:\WINDOWS\Tasks\HPCeeScheduleForMike.job 2018-07-08 16:00 - 2018-04-11 14:04 - 000524288 _____ C:\WINDOWS\system32\config\BBI 2018-07-07 14:24 - 2018-05-24 17:45 - 000003248 _____ C:\WINDOWS\System32\Tasks\HPCeeScheduleForMike 2018-07-06 19:46 - 2018-04-11 16:38 - 000000000 ___HD C:\Program Files\WindowsApps 2018-07-06 19:40 - 2016-11-23 17:44 - 000000000 ____D C:\Users\Mike\AppData\LocalLow\Mozilla 2018-07-06 05:15 - 2018-04-11 16:38 - 000000000 ____D C:\WINDOWS\LiveKernelReports 2018-07-06 05:06 - 2017-08-16 19:39 - 000000000 ____D C:\Program Files (x86)\Mozilla Firefox 2018-07-06 05:06 - 2016-11-23 17:44 - 000000000 ____D C:\Program Files (x86)\Mozilla Maintenance Service 2018-07-06 04:59 - 2016-11-23 17:44 - 000001239 _____ C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Firefox.lnk 2018-07-05 20:52 - 2017-10-19 23:07 - 000000000 ____D C:\Users\Mike\Desktop\memes 2018-07-05 14:45 - 2018-05-24 17:45 - 000003990 _____ C:\WINDOWS\System32\Tasks\Avast Emergency Update 2018-07-05 14:44 - 2018-04-11 16:38 - 000000000 ___HD C:\WINDOWS\ELAMBKUP 2018-07-05 14:44 - 2017-11-20 12:18 - 000197160 _____ (AVAST Software) C:\WINDOWS\system32\Drivers\aswArPot.sys 2018-07-05 14:44 - 2017-08-09 20:44 - 000463080 _____ (AVAST Software) C:\WINDOWS\system32\Drivers\aswSP.sys 2018-07-05 14:44 - 2017-08-09 20:44 - 000381584 _____ (AVAST Software) C:\WINDOWS\system32\Drivers\aswVmm.sys 2018-07-05 14:44 - 2017-08-09 20:44 - 000211160 _____ (AVAST Software) C:\WINDOWS\system32\Drivers\aswStm.sys 2018-07-05 14:44 - 2017-08-09 20:44 - 000159640 _____ (AVAST Software) C:\WINDOWS\system32\Drivers\aswMonFlt.sys 2018-07-05 14:44 - 2017-08-09 20:44 - 000111872 _____ (AVAST Software) C:\WINDOWS\system32\Drivers\aswRdr2.sys 2018-07-05 14:44 - 2017-08-09 20:44 - 000085968 _____ (AVAST Software) C:\WINDOWS\system32\Drivers\aswRvrt.sys 2018-07-05 14:44 - 2017-08-09 20:44 - 000046976 _____ (AVAST Software) C:\WINDOWS\system32\Drivers\aswHwid.sys 2018-07-05 14:42 - 2017-10-03 12:24 - 000647488 _____ (AVAST Software) C:\WINDOWS\system32\Drivers\aswNetSec.sys 2018-07-05 14:42 - 2017-08-09 20:44 - 001027728 _____ (AVAST Software) C:\WINDOWS\system32\Drivers\aswSnx.sys 2018-07-05 14:42 - 2017-08-09 20:44 - 000346664 _____ (AVAST Software) C:\WINDOWS\system32\Drivers\aswbloga.sys 2018-07-05 14:42 - 2017-08-09 20:44 - 000229392 _____ (AVAST Software) C:\WINDOWS\system32\Drivers\aswbidsdrivera.sys 2018-07-05 14:42 - 2017-08-09 20:44 - 000201328 _____ (AVAST Software) C:\WINDOWS\system32\Drivers\aswbidsha.sys 2018-07-05 14:42 - 2017-08-09 20:44 - 000059592 _____ (AVAST Software) C:\WINDOWS\system32\Drivers\aswbuniva.sys 2018-07-05 14:09 - 2017-06-01 18:06 - 000017564 _____ C:\WINDOWS\system32\Drivers\rtkhdasetting.zip 2018-07-03 00:13 - 2016-07-30 12:15 - 000000000 ____D C:\ProgramData\AVAST Software 2018-07-02 10:51 - 2016-05-10 09:02 - 000002500 _____ C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Word.lnk 2018-07-02 10:51 - 2016-05-10 09:02 - 000002499 _____ C:\ProgramData\Microsoft\Windows\Start Menu\Programs\PowerPoint.lnk 2018-07-02 10:51 - 2016-05-10 09:02 - 000002463 _____ C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Access.lnk 2018-07-02 10:51 - 2016-05-10 09:02 - 000002462 _____ C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Excel.lnk 2018-07-02 10:51 - 2016-05-10 09:02 - 000002456 _____ C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Outlook.lnk 2018-07-02 10:51 - 2016-05-10 09:02 - 000002450 _____ C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Publisher.lnk 2018-07-02 10:50 - 2016-05-10 09:00 - 000000000 ____D C:\Program Files (x86)\Microsoft Office 2018-07-01 07:58 - 2018-05-24 17:45 - 000000000 ____D C:\WINDOWS\system32\Drivers\wd 2018-07-01 07:58 - 2018-04-11 16:38 - 000000000 ___RD C:\Program Files\Windows Defender 2018-07-01 05:33 - 2017-02-26 08:40 - 000548000 ____N (Microsoft Corporation) C:\WINDOWS\system32\MpSigStub.exe 2018-06-29 21:32 - 2018-01-24 19:08 - 000000768 _____ C:\Users\Mike\Desktop\sce care program.txt 2018-06-29 09:26 - 2017-11-12 20:16 - 000003266 _____ C:\Users\Mike\Desktop\Hollistic research.txt 2018-06-26 09:03 - 2018-06-07 15:10 - 000000804 _____ C:\Users\Mike\Desktop\ace program.txt 2018-06-25 20:13 - 2017-07-28 03:27 - 000002308 _____ C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Google Chrome.lnk 2018-06-25 20:13 - 2017-07-28 03:27 - 000002267 _____ C:\Users\Public\Desktop\Google Chrome.lnk 2018-06-23 08:04 - 2017-10-23 09:33 - 000000000 ____D C:\ProgramData\CanonIJPLM 2018-06-22 16:22 - 2018-05-24 17:45 - 000003376 _____ C:\WINDOWS\System32\Tasks\OneDrive Standalone Update Task-S-1-5-21-3765602466-2649139181-4260510445-1001 2018-06-22 16:22 - 2018-05-24 17:23 - 000002371 _____ C:\Users\Mike\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\OneDrive.lnk 2018-06-22 16:22 - 2016-11-23 17:40 - 000000000 ___RD C:\Users\Mike\OneDrive 2018-06-22 03:11 - 2018-04-07 10:06 - 000003745 _____ C:\Users\Mike\Desktop\april 2018.txt 2018-06-21 14:10 - 2018-01-25 18:30 - 000002016 _____ C:\Users\Public\Desktop\McAfee Security Scan Plus.lnk 2018-06-21 14:10 - 2017-09-01 14:18 - 000000000 ____D C:\Program Files\McAfee Security Scan 2018-06-21 08:56 - 2017-06-07 16:08 - 000000000 ____D C:\Program Files\SUPERAntiSpyware 2018-06-21 08:44 - 2018-06-05 14:23 - 000003909 _____ C:\Users\Mike\Desktop\pads.txt 2018-06-20 01:45 - 2018-05-24 17:45 - 000004252 _____ C:\WINDOWS\System32\Tasks\avast! SL Update 2018-06-19 12:36 - 2016-11-26 13:59 - 000000000 ____D C:\Users\Mike\AppData\Local\ElevatedDiagnostics 2018-06-17 10:29 - 2018-03-21 15:31 - 000003227 _____ C:\Users\Mike\Desktop\agenda 3212018.txt 2018-06-14 01:44 - 2018-05-24 17:45 - 000004198 _____ C:\WINDOWS\System32\Tasks\Opera scheduled Autoupdate 1484841711 2018-06-14 01:44 - 2017-06-30 15:52 - 000001362 _____ C:\Users\Mike\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Opera Browser.lnk 2018-06-14 01:37 - 2017-10-16 10:57 - 000000000 ___RD C:\Users\Mike\3D Objects 2018-06-14 01:37 - 2015-11-02 11:02 - 000000000 __RHD C:\Users\Public\AccountPictures 2018-06-14 01:33 - 2018-05-24 17:16 - 000414488 _____ C:\WINDOWS\system32\FNTCACHE.DAT 2018-06-14 01:30 - 2018-04-12 02:19 - 000000000 ____D C:\WINDOWS\SysWOW64\zu-ZA 2018-06-14 01:30 - 2018-04-12 02:19 - 000000000 ____D C:\WINDOWS\SysWOW64\yo-NG 2018-06-14 01:30 - 2018-04-12 02:19 - 000000000 ____D C:\WINDOWS\SysWOW64\xh-ZA 2018-06-14 01:30 - 2018-04-12 02:19 - 000000000 ____D C:\WINDOWS\SysWOW64\wo-SN 2018-06-14 01:30 - 2018-04-12 02:19 - 000000000 ____D C:\WINDOWS\SysWOW64\uz-Latn-UZ 2018-06-14 01:30 - 2018-04-12 02:19 - 000000000 ____D C:\WINDOWS\SysWOW64\tn-ZA 2018-06-14 01:30 - 2018-04-12 02:19 - 000000000 ____D C:\WINDOWS\SysWOW64\ti-ET 2018-06-14 01:30 - 2018-04-12 02:19 - 000000000 ____D C:\WINDOWS\SysWOW64\tg-Cyrl-TJ 2018-06-14 01:30 - 2018-04-12 02:19 - 000000000 ____D C:\WINDOWS\SysWOW64\sr-Cyrl-RS 2018-06-14 01:30 - 2018-04-12 02:19 - 000000000 ____D C:\WINDOWS\SysWOW64\sr-Cyrl-BA 2018-06-14 01:30 - 2018-04-12 02:19 - 000000000 ____D C:\WINDOWS\SysWOW64\sd-Arab-PK 2018-06-14 01:30 - 2018-04-12 02:19 - 000000000 ____D C:\WINDOWS\SysWOW64\rw-RW 2018-06-14 01:30 - 2018-04-12 02:19 - 000000000 ____D C:\WINDOWS\SysWOW64\quc-Latn-GT 2018-06-14 01:30 - 2018-04-12 02:19 - 000000000 ____D C:\WINDOWS\SysWOW64\pa-Arab-PK 2018-06-14 01:30 - 2018-04-12 02:19 - 000000000 ____D C:\WINDOWS\SysWOW64\nso-ZA 2018-06-14 01:30 - 2018-04-12 02:19 - 000000000 ____D C:\WINDOWS\SysWOW64\ku-Arab-IQ 2018-06-14 01:30 - 2018-04-12 02:19 - 000000000 ____D C:\WINDOWS\SysWOW64\ig-NG 2018-06-14 01:30 - 2018-04-12 02:19 - 000000000 ____D C:\WINDOWS\SysWOW64\ha-Latn-NG 2018-06-14 01:30 - 2018-04-12 02:19 - 000000000 ____D C:\WINDOWS\SysWOW64\chr-CHER-US 2018-06-14 01:30 - 2018-04-12 02:19 - 000000000 ____D C:\WINDOWS\SysWOW64\ca-ES-valencia 2018-06-14 01:30 - 2018-04-12 02:19 - 000000000 ____D C:\WINDOWS\SysWOW64\bs-Latn-BA 2018-06-14 01:30 - 2018-04-12 02:19 - 000000000 ____D C:\WINDOWS\SysWOW64\az-Latn-AZ 2018-06-14 01:30 - 2018-04-12 02:19 - 000000000 ____D C:\WINDOWS\system32\zu-ZA 2018-06-14 01:30 - 2018-04-12 02:19 - 000000000 ____D C:\WINDOWS\system32\yo-NG 2018-06-14 01:30 - 2018-04-12 02:19 - 000000000 ____D C:\WINDOWS\system32\xh-ZA 2018-06-14 01:30 - 2018-04-12 02:19 - 000000000 ____D C:\WINDOWS\system32\wo-SN 2018-06-14 01:30 - 2018-04-12 02:19 - 000000000 ____D C:\WINDOWS\system32\uz-Latn-UZ 2018-06-14 01:30 - 2018-04-12 02:19 - 000000000 ____D C:\WINDOWS\system32\tn-ZA 2018-06-14 01:30 - 2018-04-12 02:19 - 000000000 ____D C:\WINDOWS\system32\ti-ET 2018-06-14 01:30 - 2018-04-12 02:19 - 000000000 ____D C:\WINDOWS\system32\tg-Cyrl-TJ 2018-06-14 01:30 - 2018-04-12 02:19 - 000000000 ____D C:\WINDOWS\system32\sr-Cyrl-RS 2018-06-14 01:30 - 2018-04-12 02:19 - 000000000 ____D C:\WINDOWS\system32\sr-Cyrl-BA 2018-06-14 01:30 - 2018-04-12 02:19 - 000000000 ____D C:\WINDOWS\system32\sd-Arab-PK 2018-06-14 01:30 - 2018-04-12 02:19 - 000000000 ____D C:\WINDOWS\system32\rw-RW 2018-06-14 01:30 - 2018-04-12 02:19 - 000000000 ____D C:\WINDOWS\system32\quc-Latn-GT 2018-06-14 01:30 - 2018-04-12 02:19 - 000000000 ____D C:\WINDOWS\system32\pa-Arab-PK 2018-06-14 01:30 - 2018-04-12 02:19 - 000000000 ____D C:\WINDOWS\system32\nso-ZA 2018-06-14 01:30 - 2018-04-12 02:19 - 000000000 ____D C:\WINDOWS\system32\ku-Arab-IQ 2018-06-14 01:30 - 2018-04-12 02:19 - 000000000 ____D C:\WINDOWS\system32\ig-NG 2018-06-14 01:30 - 2018-04-12 02:19 - 000000000 ____D C:\WINDOWS\system32\ha-Latn-NG 2018-06-14 01:30 - 2018-04-12 02:19 - 000000000 ____D C:\WINDOWS\system32\chr-CHER-US 2018-06-14 01:30 - 2018-04-12 02:19 - 000000000 ____D C:\WINDOWS\system32\ca-ES-valencia 2018-06-14 01:30 - 2018-04-12 02:19 - 000000000 ____D C:\WINDOWS\system32\bs-Latn-BA 2018-06-14 01:30 - 2018-04-12 02:19 - 000000000 ____D C:\WINDOWS\system32\az-Latn-AZ 2018-06-14 01:30 - 2018-04-11 16:38 - 000000000 ____D C:\WINDOWS\TextInput 2018-06-14 01:30 - 2018-04-11 16:38 - 000000000 ____D C:\WINDOWS\SysWOW64\setup 2018-06-14 01:30 - 2018-04-11 16:38 - 000000000 ____D C:\WINDOWS\SysWOW64\oobe 2018-06-14 01:30 - 2018-04-11 16:38 - 000000000 ____D C:\WINDOWS\SysWOW64\Dism 2018-06-14 01:30 - 2018-04-11 16:38 - 000000000 ____D C:\WINDOWS\system32\WinBioPlugIns 2018-06-14 01:30 - 2018-04-11 16:38 - 000000000 ____D C:\WINDOWS\system32\SystemResetPlatform 2018-06-14 01:30 - 2018-04-11 16:38 - 000000000 ____D C:\WINDOWS\system32\setup 2018-06-14 01:30 - 2018-04-11 16:38 - 000000000 ____D C:\WINDOWS\system32\oobe 2018-06-14 01:30 - 2018-04-11 16:38 - 000000000 ____D C:\WINDOWS\system32\appraiser 2018-06-14 01:30 - 2018-04-11 14:04 - 000000000 ____D C:\WINDOWS\system32\Dism 2018-06-14 01:29 - 2018-04-11 16:38 - 000000000 ___RD C:\WINDOWS\ImmersiveControlPanel 2018-06-14 01:29 - 2018-04-11 16:38 - 000000000 ____D C:\WINDOWS\ShellExperiences 2018-06-14 01:29 - 2018-04-11 16:38 - 000000000 ____D C:\WINDOWS\bcastdvr 2018-06-14 01:29 - 2018-04-11 16:38 - 000000000 ____D C:\Program Files\Windows Photo Viewer 2018-06-14 01:29 - 2018-04-11 16:38 - 000000000 ____D C:\Program Files (x86)\Windows Photo Viewer 2018-06-13 11:17 - 2016-11-23 21:38 - 000000000 ____D C:\WINDOWS\system32\MRT 2018-06-13 10:39 - 2018-04-11 16:30 - 000000000 ____D C:\WINDOWS\CbsTemp 2018-06-13 10:39 - 2017-10-13 14:12 - 133315992 ____C (Microsoft Corporation) C:\WINDOWS\system32\MRT-KB890830.exe 2018-06-13 10:39 - 2016-11-23 21:38 - 133315992 ____C (Microsoft Corporation) C:\WINDOWS\system32\MRT.exe 2018-06-12 09:19 - 2018-05-25 17:05 - 000000293 _____ C:\Users\Mike\Desktop\think small rather than think big 1 thru 12 grade.txt 2018-06-11 18:21 - 2018-06-05 06:23 - 000001721 _____ C:\Users\Mike\Desktop\blessedup.txt 2018-06-11 09:23 - 2018-05-24 17:45 - 000003446 _____ C:\WINDOWS\System32\Tasks\McAfee Remediation (Prepare) 2018-06-10 10:54 - 2018-05-31 06:42 - 000000763 _____ C:\Users\Mike\Desktop\Aspire look up to want to be like.txt 2018-06-08 02:40 - 2018-05-24 17:45 - 000004598 _____ C:\WINDOWS\System32\Tasks\Adobe Flash Player PPAPI Notifier 2018-06-08 02:40 - 2018-05-24 17:45 - 000004422 _____ C:\WINDOWS\System32\Tasks\Adobe Flash Player Updater 2018-06-08 02:40 - 2018-04-11 16:38 - 000000000 ____D C:\WINDOWS\SysWOW64\Macromed 2018-06-08 02:40 - 2018-04-11 16:38 - 000000000 ____D C:\WINDOWS\system32\Macromed ==================== Bamital & volsnap ====================== (There is no automatic fix for files that do not pass verification.) C:\WINDOWS\system32\winlogon.exe => File is digitally signed C:\WINDOWS\system32\wininit.exe => File is digitally signed C:\WINDOWS\explorer.exe => File is digitally signed C:\WINDOWS\SysWOW64\explorer.exe => File is digitally signed C:\WINDOWS\system32\svchost.exe => File is digitally signed C:\WINDOWS\SysWOW64\svchost.exe => File is digitally signed C:\WINDOWS\system32\services.exe => File is digitally signed C:\WINDOWS\system32\User32.dll => File is digitally signed C:\WINDOWS\SysWOW64\User32.dll => File is digitally signed C:\WINDOWS\system32\userinit.exe => File is digitally signed C:\WINDOWS\SysWOW64\userinit.exe => File is digitally signed C:\WINDOWS\system32\rpcss.dll => File is digitally signed C:\WINDOWS\system32\dnsapi.dll => File is digitally signed C:\WINDOWS\SysWOW64\dnsapi.dll => File is digitally signed C:\WINDOWS\system32\Drivers\volsnap.sys => File is digitally signed LastRegBack: 2018-05-24 17:16 ==================== End of FRST.txt ============================ Link to post Share on other sites More sharing options...
twinpeaks Posted July 8, 2018 Author ID:1255517 Share Posted July 8, 2018 Here's my Addition.txt Additional scan result of Farbar Recovery Scan Tool (x64) Version: 20.06.2018 Ran by Mike (08-07-2018 16:35:52) Running from C:\Users\Mike\Downloads Windows 10 Home Version 1803 17134.112 (X64) (2018-05-25 00:46:16) Boot Mode: Normal ========================================================== ==================== Accounts: ============================= Administrator (S-1-5-21-3765602466-2649139181-4260510445-500 - Administrator - Disabled) DefaultAccount (S-1-5-21-3765602466-2649139181-4260510445-503 - Limited - Disabled) Guest (S-1-5-21-3765602466-2649139181-4260510445-501 - Limited - Disabled) Mike (S-1-5-21-3765602466-2649139181-4260510445-1001 - Administrator - Enabled) => C:\Users\Mike WDAGUtilityAccount (S-1-5-21-3765602466-2649139181-4260510445-504 - Limited - Disabled) ==================== Security Center ======================== (If an entry is included in the fixlist, it will be removed.) AV: Avast Antivirus (Enabled - Up to date) {8EA8924E-BC81-DC44-8BB0-8BAE75D86EBF} AV: Windows Defender (Disabled - Up to date) {D68DDC3A-831F-4fae-9E44-DA132C1ACF46} AV: McAfee Anti-Virus and Anti-Spyware (Disabled - Up to date) {8BCDACFA-D264-3528-5EF8-E94FD0BC1FBC} AS: Windows Defender (Disabled - Up to date) {D68DDC3A-831F-4fae-9E44-DA132C1ACF46} AS: McAfee Anti-Virus and Anti-Spyware (Disabled - Up to date) {30AC4D1E-F45E-3AA6-6448-D23DAB3B5501} AS: Avast Antivirus (Enabled - Up to date) {35C973AA-9ABB-D3CA-B100-B0DC0E5F2402} FW: McAfee Firewall (Disabled) {B3F62DDF-980B-3470-75A7-407A2E6F58C7} FW: Avast Antivirus (Enabled) {B693136B-F6EE-DD1C-A0EF-229B8B0B29C4} ==================== Installed Programs ====================== (Only the adware programs with "Hidden" flag could be added to the fixlist to unhide them. The adware programs should be uninstalled manually.) 12 Labours of Hercules III: Girl Power (HKLM-x32\...\WTA-1ee7217b-75a8-4758-a7ad-db8bb20f1f52) (Version: 3.0.2.118 - WildTangent) Hidden Adobe Acrobat Reader DC (HKLM-x32\...\{AC76BA86-7AD7-1033-7B44-AC0F074E4100}) (Version: 18.011.20040 - Adobe Systems Incorporated) Adobe Flash Player 30 PPAPI (HKLM-x32\...\Adobe Flash Player PPAPI) (Version: 30.0.0.113 - Adobe Systems Incorporated) Adobe Shockwave Player 12.2 (HKLM-x32\...\Adobe Shockwave Player) (Version: 12.2.9.199 - Adobe Systems, Inc.) Apple Application Support (32-bit) (HKLM-x32\...\{D4C80B0C-CF67-43A7-90C3-466853543B54}) (Version: 6.3 - Apple Inc.) Apple Application Support (64-bit) (HKLM\...\{B2A2E8AF-BC48-4191-B2C4-3846A19835CA}) (Version: 6.3 - Apple Inc.) Apple Mobile Device Support (HKLM\...\{AA7D90D2-2387-4FA5-A3AF-96811BE49BFD}) (Version: 11.0.5.14 - Apple Inc.) Apple Software Update (HKLM-x32\...\{19589375-5C58-4AFA-842F-8B34744CCEAD}) (Version: 2.5.0.1 - Apple Inc.) Avast Internet Security (HKLM-x32\...\Avast Antivirus) (Version: 18.5.2342 - AVAST Software) Avast Secure Browser (HKLM-x32\...\Avast Secure Browser) (Version: 66.2.567.182 - AVAST Software) Avast SecureLine (HKLM\...\{2CD3C92F-EDC5-4B02-9B0A-9C1D37C58EF5}_is1) (Version: 1.0.275.2 - AVAST Software) Awakening: The Dreamless Castle (HKLM-x32\...\WTA-a6e13853-fdcb-4558-867d-b90ae4318fdd) (Version: 3.0.2.51 - WildTangent) Hidden Azkend 2: The World Beneath (HKLM-x32\...\WTA-2aae37fb-e597-4983-808a-70bbbf0998ed) (Version: 2.2.0.98 - WildTangent) Hidden Barn Yarn Collector's Edition (HKLM-x32\...\WTA-cc66808a-21d2-4e5d-88e6-e1eb6996b24d) (Version: 3.0.2.48 - WildTangent) Hidden Bonjour (HKLM\...\{56DDDFB8-7F79-4480-89D5-25E1F52AB28F}) (Version: 3.1.0.1 - Apple Inc.) Canon Easy-WebPrint EX (HKLM-x32\...\Easy-WebPrint EX) (Version: 1.7.0.0 - Canon Inc.) Canon IJ Network Scanner Selector EX (HKLM-x32\...\Canon_IJ_Network_Scanner_Selector_EX) (Version: - Canon Inc.) Canon IJ Network Tool (HKLM-x32\...\Canon_IJ_Network_UTILITY) (Version: 3.1.1 - Canon Inc.) Canon IJ Scan Utility (HKLM-x32\...\Canon_IJ_Scan_Utility) (Version: 1.1.15.23 - Canon Inc.) Canon Inkjet Printer/Scanner/Fax Extended Survey Program (HKLM-x32\...\CANONIJPLM100) (Version: 4.3.0 - Canon Inc.) Canon MG5400 series MP Drivers (HKLM\...\{1199FAD5-9546-44f3-81CF-FFDB8040B7BF}_Canon_MG5400_series) (Version: 1.01 - Canon Inc.) Canon MX490 series MP Drivers (HKLM\...\{1199FAD5-9546-44f3-81CF-FFDB8040B7BF}_Canon_MX490_series) (Version: 1.02 - Canon Inc.) Canon MX490 series On-screen Manual (HKLM-x32\...\Canon MX490 series On-screen Manual) (Version: 7.7.1 - Canon Inc.) Canon MX490 series User Registration (HKLM-x32\...\Canon MX490 series User Registration) (Version: - Canon Inc.) Canon My Image Garden (HKLM-x32\...\Canon My Image Garden) (Version: 3.5.2 - Canon Inc.) Canon My Image Garden Design Files (HKLM-x32\...\Canon My Image Garden Design Files) (Version: 3.5.2 - Canon Inc.) Canon My Printer (HKLM-x32\...\CanonMyPrinter) (Version: 3.3.0 - Canon Inc.) Canon Quick Menu (HKLM-x32\...\CanonQuickMenu) (Version: 2.7.1 - Canon Inc.) Canon Speed Dial Utility (HKLM-x32\...\Speed Dial Utility) (Version: 1.6.0 - Canon Inc.) CyberLink Power Media Player 14 (HKLM-x32\...\{32C8E300-BDB4-4398-92C2-E9B7D8A233DB}) (Version: 14.0.3.6129 - CyberLink Corp.) CyberLink PowerDirector 12 (HKLM\...\{E1646825-D391-42A0-93AA-27FA810DA093}) (Version: 12.0.6.4925 - CyberLink Corp.) Hidden CyberLink PowerDirector 12 (HKLM-x32\...\InstallShield_{E1646825-D391-42A0-93AA-27FA810DA093}) (Version: 12.0.6.4925 - CyberLink Corp.) Delicious: Emily's Wonder Wedding Premium Edition (HKLM-x32\...\WTA-ae2974f9-488b-4862-ad1b-16d69cc1a9c9) (Version: 3.0.2.59 - WildTangent) Hidden DisableMSDefender (HKLM\...\{74FE39A0-FB76-47CD-84BA-91E2BBB17EF2}) (Version: 1.0.0 - Hewlett-Packard Company) Hidden Driver Easy 5.5.2 (HKLM\...\DriverEasy_is1) (Version: 5.5.2 - Easeware) Dropbox 25 GB (HKLM-x32\...\{0867A88D-764F-366E-9E21-130DA8B472C3}) (Version: 3.1.18.0 - Dropbox, Inc.) Dropbox Update Helper (HKLM-x32\...\{099218A5-A723-43DC-8DB5-6173656A1E94}) (Version: 1.3.75.1 - Dropbox, Inc.) Hidden Energy Star (HKLM\...\{5CB22648-35F8-41BC-9C35-1E41FE6E12A5}) (Version: 1.1.1 - HP Inc.) Entwined: The Perfect Murder (HKLM-x32\...\WTA-ee97336d-50cb-43d9-9dd9-7394b42be8b9) (Version: 3.0.2.59 - WildTangent) Hidden Google Chrome (HKLM-x32\...\Google Chrome) (Version: 67.0.3396.99 - Google Inc.) Google Update Helper (HKLM-x32\...\{60EC980A-BDA2-4CB6-A427-B07A5498B4CA}) (Version: 1.3.33.17 - Google Inc.) Hidden Google Update Helper (HKLM-x32\...\{A92DAB39-4E2C-4304-9AB6-BC44E68B55E2}) (Version: 1.3.21.169 - Google Inc.) Hidden Green City: Go South (HKLM-x32\...\WTA-a5ee0083-df94-44bd-b398-feb151d397cc) (Version: 3.0.2.59 - WildTangent) Hidden HandBrake 1.0.7 (HKLM-x32\...\HandBrake) (Version: 1.0.7 - ) Home Makeover (HKLM-x32\...\WTA-3c439f09-85c2-4f85-a39b-4c2c2a8452a0) (Version: 3.0.2.59 - WildTangent) Hidden Hoyle Illusions Mahjongg (HKLM-x32\...\WTA-c8ed3f1b-8183-4235-bdb7-7b9c25c73cd8) (Version: 3.0.2.59 - WildTangent) Hidden HP 3D DriveGuard (HKLM-x32\...\{8F183B2E-D21D-4070-8132-DD39C3CBFA5C}) (Version: 6.0.41.1 - HP) HP CoolSense (HKLM-x32\...\{6A96E483-C0BD-456F-885B-7A0BAC7430AD}) (Version: 2.21.1 - HP Inc.) HP Documentation (HKLM\...\HP_Documentation) (Version: 1.0.0.1 - HP Inc.) HP ePrint SW (HKLM-x32\...\{88970959-baf7-4864-a39a-69a58e8ae5cf}) (Version: 5.0.18701 - HP) HP Registration Service (HKLM\...\{D1E8F2D7-7794-4245-B286-87ED86C1893C}) (Version: 1.2.8318.5320 - Hewlett-Packard) HP Support Assistant (HKLM-x32\...\{E959FD01-BD01-4CC4-9BB8-4EBE8309BF37}) (Version: 8.6.18.11 - HP) HP Support Solutions Framework (HKLM-x32\...\{E2CB09C1-3C76-4395-BB47-50C066535CF8}) (Version: 12.9.18.3 - HP) HP System Event Utility (HKLM-x32\...\{09D0DB68-90EA-4015-983E-A0BD777D5A02}) (Version: 1.4.9 - HP Inc.) HP Touchpoint Analytics Client (HKLM\...\{E5FB98E0-0784-44F0-8CEC-95CD4690C43F}) (Version: 4.0.2.1439 - HP Inc.) HP Welcome (HKLM\...\HPWelcome) (Version: 1.0 - HP Inc.) IGT Slots Fire Rubies (HKLM-x32\...\WTA-09fab75d-8054-4035-a399-3bb55f605ce3) (Version: 3.0.2.59 - WildTangent) Hidden Imperial Island: Birth of an Empire (HKLM-x32\...\WTA-a8888f90-8105-4064-8d05-6dc2f3894097) (Version: 3.0.2.59 - WildTangent) Hidden Intel(R) Chipset Device Software (HKLM-x32\...\{fb610cea-ba50-4d4b-a717-cf025419035c}) (Version: 10.1.1.13 - Intel(R) Corporation) Hidden Intel(R) Dynamic Platform and Thermal Framework (HKLM-x32\...\{654EE65D-FAA4-4EA6-8C07-DC94E6A304D4}) (Version: 8.1.10605.221 - Intel Corporation) Intel(R) Management Engine Components (HKLM\...\{1CEAC85D-2590-4760-800F-8DE5E91F3700}) (Version: 11.7.0.1054 - Intel Corporation) Intel(R) Processor Graphics (HKLM-x32\...\{F0E3AD40-2BBD-4360-9C76-B9AC9A5886EA}) (Version: 22.20.16.4749 - Intel Corporation) Intel(R) Rapid Storage Technology (HKLM\...\{409CB30E-E457-4008-9B1A-ED1B9EA21140}) (Version: 14.8.0.1042 - Intel Corporation) Intel(R) Serial IO (HKLM\...\{9FD91C5C-44AE-4D9D-85BE-AE52816B0294}) (Version: 30.63.1519.7 - Intel Corporation) Intel(R) Trusted Connect Service Client x86 (HKLM-x32\...\{C9552825-7BF2-4344-BA91-D3CD46F4C441}) (Version: 1.47.866.0 - Intel Corporation) Hidden Intel(R) Trusted Connect Services Client (HKLM-x32\...\{246c6cc0-9810-4728-9a29-28474de2eec5}) (Version: 1.47.866.0 - Intel Corporation) Hidden Intel(R) Virtual Buttons (HKLM-x32\...\1992736F-C90A-481C-B21B-EE34CAD07387) (Version: 1.1.0.21 - Intel Corporation) Intel(R) WiDi (HKLM\...\{6B15F1EF-F3A8-4C29-BF9E-18EB3683A83D}) (Version: 6.0.60.0 - Intel Corporation) Intel(R) WiDi Software Asset Manager (HKLM-x32\...\{AC8973AF-7F4C-40F4-BFE1-C02FE95ED2C2}) (Version: 3.2.1184 - Intel Corporation) Hidden Intel(R) Wireless Bluetooth(R) (HKLM-x32\...\{4DA9DC19-4E1D-4B10-A726-A5F2A1BC7265}) (Version: 18.1.1546.2762 - Intel Corporation) Intel® Integrated Sensor Solution (HKLM-x32\...\{dab50e7a-3a51-4ce0-9644-131748487cfe}) (Version: 3.0.4.1012 - Intel Corporation) Intel® PROSet/Wireless Software (HKLM-x32\...\{ed5cef80-a339-45bd-8c06-514eaf785ca8}) (Version: 19.71.0 - Intel Corporation) ISS_Drivers_x64 (HKLM\...\{6725DB57-487E-42F9-B986-A3113872FE47}) (Version: 3.0.4.1012 - Intel Corporation) Hidden iTunes (HKLM\...\{1D7D1271-5258-4F5A-B8C1-7176BF398782}) (Version: 12.7.3.46 - Apple Inc.) Jewel Match Snowscapes (HKLM-x32\...\WTA-2c7b47dd-bad0-436d-a3cb-a4ca2273688c) (Version: 3.0.2.118 - WildTangent) Hidden Lightworks (HKLM-x32\...\{E94DD4E4-7746-472c-AA7B-1242FED0CFC8}) (Version: 14.0.0.0 - EditShare) Little Boy: Walter's Scooter (HKLM-x32\...\WTA-03792e3f-3c53-4a54-9dad-3c9efb0f0d98) (Version: 3.0.2.59 - WildTangent) Hidden Lost Souls: Timeless Fables Collector's Edition (HKLM-x32\...\WTA-1567cb46-f762-4a8e-bf32-7cd2ce373a12) (Version: 3.0.2.59 - WildTangent) Hidden Magic Heroes: Save Our Park (HKLM-x32\...\WTA-6da1b5d3-358b-45c3-b177-5035da0b0203) (Version: 3.0.2.59 - WildTangent) Hidden Malwarebytes version 3.5.1.2522 (HKLM\...\{35065F43-4BB2-439A-BFF7-0F1014F2E0CD}_is1) (Version: 3.5.1.2522 - Malwarebytes) Manor Memoirs Collector's Edition (HKLM-x32\...\WTA-db21eabc-455b-4ed3-9546-87c0408b0e74) (Version: 3.0.2.59 - WildTangent) Hidden McAfee LiveSafe (HKLM-x32\...\MSC) (Version: 14.0.12000 - McAfee, Inc.) McAfee Security Scan Plus (HKLM\...\McAfee Security Scan) (Version: 3.11.747.1 - McAfee, Inc.) Microsoft Office 365 - en-us (HKLM\...\O365HomePremRetail - en-us) (Version: 16.0.10228.20080 - Microsoft Corporation) Microsoft OneDrive (HKU\S-1-5-21-3765602466-2649139181-4260510445-1001\...\OneDriveSetup.exe) (Version: 18.091.0506.0007 - Microsoft Corporation) Microsoft Visual C++ 2005 Redistributable (HKLM-x32\...\{710f4c1c-cc18-4c49-8cbf-51240c89a1a2}) (Version: 8.0.61001 - Microsoft Corporation) Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.17 (HKLM\...\{8220EEFE-38CD-377E-8595-13398D740ACE}) (Version: 9.0.30729 - Microsoft Corporation) Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.4148 (HKLM-x32\...\{1F1C2DFC-2D24-3E06-BCB8-725134ADF989}) (Version: 9.0.30729.4148 - Microsoft Corporation) Microsoft Visual C++ 2010 x64 Redistributable - 10.0.40219 (HKLM\...\{1D8E6291-B0D5-35EC-8441-6616F567A0F7}) (Version: 10.0.40219 - Microsoft Corporation) Microsoft Visual C++ 2012 Redistributable (x64) - 11.0.51106 (HKLM-x32\...\{6e8f74e0-43bd-4dce-8477-6ff6828acc07}) (Version: 11.0.51106.1 - Microsoft Corporation) Microsoft Visual C++ 2012 Redistributable (x64) - 11.0.61030 (HKLM-x32\...\{ca67548a-5ebe-413a-b50c-4b9ceb6d66c6}) (Version: 11.0.61030.0 - Microsoft Corporation) Microsoft Visual C++ 2012 Redistributable (x86) - 11.0.51106 (HKLM-x32\...\{8e70e4e1-06d7-470b-9f74-a51bef21088e}) (Version: 11.0.51106.1 - Microsoft Corporation) Microsoft Visual C++ 2012 Redistributable (x86) - 11.0.61030 (HKLM-x32\...\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}) (Version: 11.0.61030.0 - Microsoft Corporation) Microsoft Visual C++ 2013 Redistributable (x64) - 12.0.30501 (HKLM-x32\...\{050d4fc8-5d48-4b8f-8972-47c82c46020f}) (Version: 12.0.30501.0 - Microsoft Corporation) Microsoft Visual C++ 2015 Redistributable (x64) - 14.0.23026 (HKLM-x32\...\{e46eca4f-393b-40df-9f49-076faf788d83}) (Version: 14.0.23026.0 - Microsoft Corporation) mIRC (HKLM-x32\...\mIRC) (Version: 7.52 - mIRC Co. Ltd.) Mozilla Firefox 61.0.1 (x64 en-US) (HKLM\...\Mozilla Firefox 61.0.1 (x64 en-US)) (Version: 61.0.1 - Mozilla) Mozilla Maintenance Service (HKLM-x32\...\MozillaMaintenanceService) (Version: 61.0.1.6759 - Mozilla) NETWatch (HKLM-x32\...\{7415AD3D-BDF6-4CD5-87AE-7237FAAACECF}) (Version: 3.1.13.0 - Sharpeware Ltd) netwatch 0.1 (HKLM-x32\...\netwatch_0) (Version: 0.1 - [taesiri]) Office 16 Click-to-Run Extensibility Component (HKLM-x32\...\{90160000-008C-0000-0000-0000000FF1CE}) (Version: 16.0.10228.20080 - Microsoft Corporation) Hidden Office 16 Click-to-Run Extensibility Component 64-bit Registration (HKLM\...\{90160000-00DD-0000-1000-0000000FF1CE}) (Version: 16.0.10228.20080 - Microsoft Corporation) Hidden Office 16 Click-to-Run Licensing Component (HKLM\...\{90160000-008F-0000-1000-0000000FF1CE}) (Version: 16.0.10228.20080 - Microsoft Corporation) Hidden Office 16 Click-to-Run Localization Component (HKLM-x32\...\{90160000-008C-0409-0000-0000000FF1CE}) (Version: 16.0.10228.20080 - Microsoft Corporation) Hidden Opera Stable 53.0.2907.99 (HKU\S-1-5-21-3765602466-2649139181-4260510445-1001\...\Opera 53.0.2907.99) (Version: 53.0.2907.99 - Opera Software) Plagiarii (HKLM-x32\...\WTA-0efdd58a-17e7-42dd-85f1-51f6d8af16ef) (Version: 3.0.2.59 - WildTangent) Hidden Polar Bowler 1st Frame (HKLM-x32\...\WTA-e8e4950d-2d4a-407f-923d-8afab28879d8) (Version: 3.0.2.59 - WildTangent) Hidden PuppetShow: Return to Joyville (HKLM-x32\...\WTA-525d3f55-3508-476b-905b-1b96f4b6f312) (Version: 3.0.2.126 - WildTangent) Hidden Pyro Jump (HKLM-x32\...\WTA-b6795c86-e2a7-47e8-a406-4a8a07883660) (Version: 3.0.2.59 - WildTangent) Hidden Realtek Ethernet Controller Driver (HKLM-x32\...\{8833FFB6-5B0C-4764-81AA-06DFEED9A476}) (Version: 10.6.1001.2015 - Realtek) Realtek High Definition Audio Driver (HKLM-x32\...\{F132AF7F-7BCA-4EDE-8A7C-958108FE7DBC}) (Version: 6.0.1.7779 - Realtek Semiconductor Corp.) Regency Solitaire (HKLM-x32\...\WTA-f8a4a04d-df26-45c8-b01b-107df69806ac) (Version: 3.0.2.126 - WildTangent) Hidden Runefall (HKLM-x32\...\WTA-581f06df-e594-42c4-8846-ab7c8f25abdd) (Version: 3.0.2.126 - WildTangent) Hidden Rush Hour! Gas Station (HKLM-x32\...\WTA-94d5f7ab-44a9-4ee1-8012-06482570de03) (Version: 3.0.2.59 - WildTangent) Hidden Sky High Farm (HKLM-x32\...\WTA-235459cb-a30e-4108-a0f2-df58288548b3) (Version: 3.0.2.59 - WildTangent) Hidden SUPERAntiSpyware (HKLM\...\{CDDCBBF1-2703-46BC-938B-BCC81A1EEAAA}) (Version: 6.0.1228 - SUPERAntiSpyware.com) swMSM (HKLM-x32\...\{612C34C7-5E90-47D8-9B5C-0F717DD82726}) (Version: 12.0.0.1 - Adobe Systems, Inc) Hidden Synaptics ClickPad Driver (HKLM\...\SynTPDeinstKey) (Version: 19.3.31.31 - Synaptics Incorporated) Tasty Blue (HKLM-x32\...\WTA-88e9b7af-ae98-42cc-9b32-8ce5e9fbe37a) (Version: 3.0.2.59 - WildTangent) Hidden The Far Kingdoms (HKLM-x32\...\WTA-54d43377-25a2-47eb-9831-e4df4c02cfd1) (Version: 1.1.2.4 - WildTangent) Hidden Update Installer for WildTangent Games App (HKLM-x32\...\{2FA94A64-C84E-49d1-97DD-7BF06C7BBFB2}.WildTangent Games App) (Version: - WildTangent) Hidden Vivaldi (HKU\S-1-5-21-3765602466-2649139181-4260510445-1001\...\Vivaldi) (Version: 1.10.867.42 - Vivaldi) Vulkan Run Time Libraries 1.0.33.0 (HKLM\...\VulkanRT1.0.33.0) (Version: 1.0.33.0 - LunarG, Inc.) Hidden Vulkan Run Time Libraries 1.0.33.0 (HKLM\...\VulkanRT1.0.33.0-2) (Version: 1.0.33.0 - LunarG, Inc.) Hidden Vulkan Run Time Libraries 1.0.33.0 (HKLM\...\VulkanRT1.0.33.0-3) (Version: 1.0.33.0 - LunarG, Inc.) Hidden Vulkan Run Time Libraries 1.0.33.0 (HKLM\...\VulkanRT1.0.33.0-4) (Version: 1.0.33.0 - LunarG, Inc.) Vulkan Run Time Libraries 1.0.42.0 (HKLM\...\VulkanRT1.0.42.0) (Version: 1.0.42.0 - LunarG, Inc.) WildTangent Games (HKLM-x32\...\WildTangent wildgames Master Uninstall) (Version: 1.1.0.28 - WildTangent) WildTangent Games App for HP (HKLM-x32\...\{70B446D1-E03B-4ab0-9B3C-0832142C9AA8}.WildTangent Games App-hp) (Version: 4.1.1.2 - WildTangent) Hidden ==================== Custom CLSID (Whitelisted): ========================== (If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.) ShellIconOverlayIdentifiers: [00asw] -> {472083B0-C522-11CF-8763-00608CC02F24} => C:\Program Files\AVAST Software\Avast\ashShA64.dll [2018-07-05] (AVAST Software) ContextMenuHandlers1: [avast] -> {472083B0-C522-11CF-8763-00608CC02F24} => C:\Program Files\AVAST Software\Avast\ashShA64.dll [2018-07-05] (AVAST Software) ContextMenuHandlers1: [McCtxMenuFrmWrk] -> {CCA9EFD3-29ED-430A-BA6D-E6BBFF0A60C2} => C:\Program Files\mcafee\msc\McCtxMenuFrmWrk.dll [2017-03-03] (McAfee, Inc.) ContextMenuHandlers3: [00asw] -> {472083B0-C522-11CF-8763-00608CC02F24} => C:\Program Files\AVAST Software\Avast\ashShA64.dll [2018-07-05] (AVAST Software) ContextMenuHandlers3: [MBAMShlExt] -> {57CE581A-0CB6-4266-9CA0-19364C90A0B3} => C:\Program Files\Malwarebytes\Anti-Malware\mbshlext.dll [2018-05-09] (Malwarebytes) ContextMenuHandlers5: [igfxcui] -> {3AB1675A-CCFF-11D2-8B20-00A0C93CB1F4} => -> No File ContextMenuHandlers5: [igfxDTCM] -> {9B5F5829-A529-4B12-814A-E81BCB8D93FC} => C:\WINDOWS\System32\DriverStore\FileRepository\ki126577.inf_amd64_ae71f87c8938d56a\igfxDTCM.dll [2018-02-09] (Intel Corporation) ContextMenuHandlers6: [avast] -> {472083B0-C522-11CF-8763-00608CC02F24} => C:\Program Files\AVAST Software\Avast\ashShA64.dll [2018-07-05] (AVAST Software) ContextMenuHandlers6: [MBAMShlExt] -> {57CE581A-0CB6-4266-9CA0-19364C90A0B3} => C:\Program Files\Malwarebytes\Anti-Malware\mbshlext.dll [2018-05-09] (Malwarebytes) ContextMenuHandlers6: [McCtxMenuFrmWrk] -> {CCA9EFD3-29ED-430A-BA6D-E6BBFF0A60C2} => C:\Program Files\mcafee\msc\McCtxMenuFrmWrk.dll [2017-03-03] (McAfee, Inc.) ==================== Scheduled Tasks (Whitelisted) ============= (If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.) Task: {08FD1420-6D7B-4192-8C31-2AB9C13F9F68} - System32\Tasks\McAfeeLogon => C:\Program Files\Common Files\McAfee\platform\McUICnt.exe [2016-12-09] (McAfee, Inc.) Task: {119C49CC-54D4-4A74-A84F-A380FB8F5C68} - System32\Tasks\Microsoft\Office\Office ClickToRun Service Monitor => C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeC2RClient.exe [2018-06-20] (Microsoft Corporation) Task: {1261BA56-5C8F-4C12-AAE9-652B2C1AAB31} - System32\Tasks\IntelWiDi-Upgrade-91ba0caa-28a7-4f47-8d08-f71b4b10fbec-Logon => C:\Program Files (x86)\Intel Corporation\Intel WiDi\Intel(R) Software Asset Manager\bin\IntelSoftwareAssetManagerService.exe [2015-09-17] (Intel Corporation) Task: {1EFBB220-4040-4BC7-95EC-6F8C8D4D57E6} - System32\Tasks\Hewlett-Packard\HP Support Assistant\WarrantyChecker_DeviceScan => C:\Program Files (x86)\Hewlett-Packard\HP Support Framework\Resources\HPWarrantyCheck\HPWarrantyChecker.exe [2018-06-28] (HP Inc.) Task: {255406EF-0635-4858-870F-B33771C57A8E} - System32\Tasks\Intel\Intel Telemetry 2 => C:\Program Files\Intel\Telemetry 2.0\lrio.exe [2015-06-05] (Intel Corporation) Task: {277C6D2E-9250-4592-820F-3D94F2417C05} - System32\Tasks\Hewlett-Packard\HP Support Assistant\HP Support Assistant Quick Start => C:\Program Files (x86)\Hewlett-Packard\HP Support Framework\HPSF.exe [2018-05-04] (HP Inc.) Task: {2B824F2E-729C-4237-ADFB-818CFEC783CD} - System32\Tasks\Opera scheduled Autoupdate 1484841711 => C:\Users\Mike\AppData\Local\Programs\Opera\launcher.exe [2018-06-11] (Opera Software) Task: {2CCC782C-73EA-41F2-9191-43682E6EE746} - System32\Tasks\IUM-F1E24CA0-B63E-4F13-A9E3-4ADE3BFF3473 => C:\Program Files (x86)\Intel\Intel(R) Update Manager\bin\iumsvc.exe Task: {2EBE36CE-153A-4CDD-AA71-D9D802097A29} - System32\Tasks\DropboxOEM => C:\Program Files (x86)\Dropbox\DropboxOEM\DropboxOEM.exe [2016-09-21] () Task: {4D6ACF06-02F1-4C02-8930-4EA642B88B1E} - System32\Tasks\Hewlett-Packard\HP Support Assistant\HP Support Solutions Framework Report => C:\Program Files (x86)\Hewlett-Packard\HP Support Solutions\Modules\HPSFReport.exe [2017-06-22] (HP Inc.) Task: {5B01497D-4F8B-4920-B9FE-95C2F37380A9} - System32\Tasks\Driver Easy Scheduled Scan => C:\Program Files\Easeware\DriverEasy\DriverEasy.exe [2017-06-30] (Easeware) Task: {5B3654C2-77B9-4804-AD33-B1710A3BEF7F} - System32\Tasks\McAfee\McAfee Auto Maintenance Task Agent Task: {601C9620-2530-4E89-AB4F-33FFFD10E459} - System32\Tasks\HPCeeScheduleForMike => C:\Program Files (x86)\Hewlett-Packard\HP Ceement\HPCEE.exe [2015-06-16] (Hewlett-Packard) Task: {6066D696-1B47-46FD-8A90-81E48D9B0855} - System32\Tasks\Microsoft\Office\Office Automatic Updates 2.0 => C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeC2RClient.exe [2018-06-20] (Microsoft Corporation) Task: {60D0D77C-C70F-49ED-BFC1-E6978A4FB685} - System32\Tasks\Hewlett-Packard\HP Support Assistant\Product Configurator => C:\Program Files (x86)\Hewlett-Packard\HP Support Framework\Resources\ProductConfig.exe [2018-05-11] (HP Inc.) Task: {62248009-7B01-45CD-922E-93F94E4B4ABA} - System32\Tasks\avast! SL Update => C:\Program Files\AVAST Software\SecureLine\SLUpdate.exe [2015-12-08] (AVAST Software) Task: {65B85F6F-35B3-4459-A179-28255D5B7B25} - System32\Tasks\Microsoft\Windows\HelloFace\FODCleanupTask => C:\WINDOWS\System32\WinBioPlugIns\FaceFodUninstaller.exe [2018-04-11] () Task: {6E82839B-883F-47BF-8788-52102DBB47CC} - System32\Tasks\GoogleUpdateTaskMachineUA => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe [2017-07-28] (Google Inc.) Task: {71FE717E-2EB4-41CD-BE26-03C2581CAC21} - System32\Tasks\DropboxUpdateTaskMachineUA => C:\Program Files (x86)\Dropbox\Update\DropboxUpdate.exe [2016-11-23] (Dropbox, Inc.) Task: {77237DA7-A66D-475C-BA97-C4E1702709A0} - System32\Tasks\AVAST Software\Gaming mode Task Scheduler recovery => Command(1): schtasks.exe -> /Change /TN "\Adobe Acrobat Update Task" /ENABLE Task: {77237DA7-A66D-475C-BA97-C4E1702709A0} - System32\Tasks\AVAST Software\Gaming mode Task Scheduler recovery => Command(2): schtasks.exe -> /Change /TN "\Adobe Flash Player PPAPI Notifier" /ENABLE Task: {77237DA7-A66D-475C-BA97-C4E1702709A0} - System32\Tasks\AVAST Software\Gaming mode Task Scheduler recovery => Command(3): schtasks.exe -> /Change /TN "\Adobe Flash Player Updater" /ENABLE Task: {77237DA7-A66D-475C-BA97-C4E1702709A0} - System32\Tasks\AVAST Software\Gaming mode Task Scheduler recovery => Command(4): schtasks.exe -> /Change /TN "\Driver Easy Scheduled Scan" /ENABLE Task: {77237DA7-A66D-475C-BA97-C4E1702709A0} - System32\Tasks\AVAST Software\Gaming mode Task Scheduler recovery => Command(5): schtasks.exe -> /Change /TN "\DropboxOEM" /ENABLE Task: {77237DA7-A66D-475C-BA97-C4E1702709A0} - System32\Tasks\AVAST Software\Gaming mode Task Scheduler recovery => Command(6): schtasks.exe -> /Change /TN "\DropboxUpdateTaskMachineCore" /ENABLE Task: {77237DA7-A66D-475C-BA97-C4E1702709A0} - System32\Tasks\AVAST Software\Gaming mode Task Scheduler recovery => Command(7): schtasks.exe -> /Change /TN "\DropboxUpdateTaskMachineUA" /ENABLE Task: {77237DA7-A66D-475C-BA97-C4E1702709A0} - System32\Tasks\AVAST Software\Gaming mode Task Scheduler recovery => Command(8): schtasks.exe -> /Change /TN "\GoogleUpdateTaskMachineCore" /ENABLE Task: {77237DA7-A66D-475C-BA97-C4E1702709A0} - System32\Tasks\AVAST Software\Gaming mode Task Scheduler recovery => Command(9): schtasks.exe -> /Change /TN "\GoogleUpdateTaskMachineUA" /ENABLE Task: {77237DA7-A66D-475C-BA97-C4E1702709A0} - System32\Tasks\AVAST Software\Gaming mode Task Scheduler recovery => Command(10): schtasks.exe -> /Change /TN "\HPCeeScheduleForMike" /ENABLE Task: {77237DA7-A66D-475C-BA97-C4E1702709A0} - System32\Tasks\AVAST Software\Gaming mode Task Scheduler recovery => Command(11): schtasks.exe -> /Change /TN "\HPDAS" /ENABLE Task: {77237DA7-A66D-475C-BA97-C4E1702709A0} - System32\Tasks\AVAST Software\Gaming mode Task Scheduler recovery => Command(12): schtasks.exe -> /Change /TN "\IntelWiDi-Upgrade-91ba0caa-28a7-4f47-8d08-f71b4b10fbec" /ENABLE Task: {77237DA7-A66D-475C-BA97-C4E1702709A0} - System32\Tasks\AVAST Software\Gaming mode Task Scheduler recovery => Command(13): schtasks.exe -> /Change /TN "\IntelWiDi-Upgrade-91ba0caa-28a7-4f47-8d08-f71b4b10fbec-Logon" /ENABLE Task: {77237DA7-A66D-475C-BA97-C4E1702709A0} - System32\Tasks\AVAST Software\Gaming mode Task Scheduler recovery => Command(14): schtasks.exe -> /Change /TN "\IUM-F1E24CA0-B63E-4F13-A9E3-4ADE3BFF3473" /ENABLE Task: {77237DA7-A66D-475C-BA97-C4E1702709A0} - System32\Tasks\AVAST Software\Gaming mode Task Scheduler recovery => Command(15): schtasks.exe -> /Change /TN "\McAfee Remediation (Prepare)" /ENABLE Task: {77237DA7-A66D-475C-BA97-C4E1702709A0} - System32\Tasks\AVAST Software\Gaming mode Task Scheduler recovery => Command(16): schtasks.exe -> /Change /TN "\McAfeeLogon" /ENABLE Task: {77237DA7-A66D-475C-BA97-C4E1702709A0} - System32\Tasks\AVAST Software\Gaming mode Task Scheduler recovery => Command(17): schtasks.exe -> /Change /TN "\OneDrive Standalone Update Task-S-1-5-21-3765602466-2649139181-4260510445-1001" /ENABLE Task: {77237DA7-A66D-475C-BA97-C4E1702709A0} - System32\Tasks\AVAST Software\Gaming mode Task Scheduler recovery => Command(18): schtasks.exe -> /Change /TN "\Opera scheduled Autoupdate 1484841711" /ENABLE Task: {77237DA7-A66D-475C-BA97-C4E1702709A0} - System32\Tasks\AVAST Software\Gaming mode Task Scheduler recovery => Command(19): schtasks.exe -> /Change /TN "\SafeZone scheduled Autoupdate 1502336774" /ENABLE Task: {77237DA7-A66D-475C-BA97-C4E1702709A0} - System32\Tasks\AVAST Software\Gaming mode Task Scheduler recovery => Command(20): schtasks.exe -> /Change /TN "\AVAST Software\Gaming mode Task Scheduler recovery" /DISABLE Task: {778203DA-B7C5-4FD1-9181-A161F419CB1D} - System32\Tasks\Hewlett-Packard\HP Active Health\HP Active Health Scan (HPSA) => C:\Program Files (x86)\Hewlett-Packard\HP Support Framework\Resources\HPActiveHealth\ActiveHealth.exe [2017-11-23] () Task: {78D21640-6F86-404D-9F94-C8A99BA4FE95} - System32\Tasks\Microsoft\Office\OfficeBackgroundTaskHandlerLogon => C:\Program Files (x86)\Microsoft Office\root\Office16\officebackgroundtaskhandler.exe [2018-07-02] (Microsoft Corporation) Task: {862DB034-AEF0-476D-B81D-F0DAD95FBA9A} - System32\Tasks\HPDAS => C:\Program [Argument = Files\HP\HP ePrint\HP.DeliveryAndStatus.Desktop.App.exe /CheckJobs] Task: {8BC63739-417C-4055-8E35-B4699B052B93} - System32\Tasks\Adobe Flash Player PPAPI Notifier => C:\WINDOWS\SysWOW64\Macromed\Flash\FlashUtil32_30_0_0_113_pepper.exe [2018-06-08] (Adobe Systems Incorporated) Task: {8E687EB1-CD96-4D43-A83A-F5079AD036AA} - System32\Tasks\Intel PTT EK Recertification => C:\Program Files\Intel\iCLS Client\IntelPTTEKRecertification.exe [2017-10-11] (Intel(R) Corporation) Task: {8ED8D024-0C9C-4238-AADC-2858CC062252} - System32\Tasks\Hewlett-Packard\HP Support Assistant\WarrantyChecker => C:\Program Files (x86)\Hewlett-Packard\HP Support Framework\Resources\HPWarrantyCheck\HPWarrantyChecker.exe [2018-06-28] (HP Inc.) Task: {924F8EDE-10A3-4CCF-A5A2-F297571F57A3} - System32\Tasks\DropboxUpdateTaskMachineCore => C:\Program Files (x86)\Dropbox\Update\DropboxUpdate.exe [2016-11-23] (Dropbox, Inc.) Task: {93559F8F-E68C-4698-86EB-1CDCC5341D9E} - \Microsoft\Windows\UNP\RunCampaignManager -> No File <==== ATTENTION Task: {958847AA-0E89-483B-929E-456B2EEFCB57} - System32\Tasks\Microsoft\Windows\Setup\Notifier => C:\WINDOWS\system32\Notifier.exe Task: {9E14ADD1-D5A6-4381-A6E0-7B5888A46C18} - System32\Tasks\AvastUpdateTaskMachineCore => C:\Program Files (x86)\AVAST Software\Browser\Update\AvastBrowserUpdate.exe [2018-07-03] (AVAST Software) Task: {A0A825AF-5D0C-410F-83C6-D5C620CA7FDE} - System32\Tasks\Avast Software\Overseer => C:\Program Files\Common Files\Avast Software\Overseer\overseer.exe [2018-06-12] (AVAST Software) Task: {A8B8E196-5469-4F34-B451-030D8397E5B2} - System32\Tasks\GoogleUpdateTaskMachineCore => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe [2017-07-28] (Google Inc.) Task: {A9270006-A281-4AE5-AF28-26FC67E9E04E} - System32\Tasks\Microsoft\Office\OfficeOsfInstaller => C:\Program Files (x86)\Microsoft Office\root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\osfinstaller.exe [2018-07-02] (Microsoft Corporation) Task: {B72B52E2-1F25-4207-9CD2-DAAC5F916644} - System32\Tasks\HP\HP CoolSense\HP CoolSense Start at Logon => C:\Program Files (x86)\HP\HP CoolSense\CoolSense.exe [2015-10-23] (HP Development Company, L.P.) Task: {B848F0BE-6E98-477D-95FF-C5B21E2263CD} - System32\Tasks\IntelWiDi-Upgrade-91ba0caa-28a7-4f47-8d08-f71b4b10fbec => C:\Program Files (x86)\Intel Corporation\Intel WiDi\Intel(R) Software Asset Manager\bin\IntelSoftwareAssetManagerService.exe [2015-09-17] (Intel Corporation) Task: {B9E1DFF3-008C-49FE-ACD6-45FB491A1F0C} - System32\Tasks\Hewlett-Packard\HP Support Assistant\PC Health Analysis => C:\Program Files (x86)\Hewlett-Packard\HP Support Framework\HPSF.exe [2018-05-04] (HP Inc.) Task: {C47425A8-87AE-4F7F-ACDD-2CB9DED1C006} - System32\Tasks\Microsoft\Office\OfficeBackgroundTaskHandlerRegistration => C:\Program Files (x86)\Microsoft Office\root\Office16\officebackgroundtaskhandler.exe [2018-07-02] (Microsoft Corporation) Task: {CD1A37F0-7430-429F-86E5-AABF25FA153C} - System32\Tasks\Hewlett-Packard\HP Support Assistant\HP Support Solutions Framework Updater => C:\Program Files (x86)\Hewlett-Packard\HP Support Solutions\Modules\HPSSFUpdater.exe [2017-09-20] (HP Inc.) Task: {D536ED3B-07E4-4F9C-B24E-C4AC219EC0DC} - System32\Tasks\Avast SecureLine => C:\Program Files\AVAST Software\SecureLine\SecureLine.exe [2015-12-08] (AVAST Software) Task: {D65A59F7-E8ED-4AD1-9BEC-B6A506A6BE95} - System32\Tasks\Avast Emergency Update => C:\Program Files\AVAST Software\Avast\AvEmUpdate.exe [2018-07-05] (AVAST Software) Task: {D9FD3CFE-F909-4DD1-9945-6D33F9C90883} - System32\Tasks\McAfee Remediation (Prepare) => C:\Program Files\Common Files\AV\McAfee VirusScan\upgrade.exe [2018-05-04] (McAfee, Inc.) Task: {E0EE9A6C-E48C-4574-90E5-F03C61D1D190} - System32\Tasks\McAfee\McAfee Idle Detection Task Task: {EA03F496-DD37-445B-9BE4-24ACAFCD49D2} - System32\Tasks\Adobe Acrobat Update Task => C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe [2018-02-09] (Adobe Systems Incorporated) Task: {F86E6AAD-E32B-4C90-9F1A-1C8AD593F81C} - System32\Tasks\AvastUpdateTaskMachineUA => C:\Program Files (x86)\AVAST Software\Browser\Update\AvastBrowserUpdate.exe [2018-07-03] (AVAST Software) Task: {FE1D9C41-B435-447B-839A-D965CAC07B82} - System32\Tasks\Adobe Flash Player Updater => C:\WINDOWS\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe [2018-06-08] (Adobe Systems Incorporated) (If an entry is included in the fixlist, the task (.job) file will be moved. The file which is running by the task will not be moved.) Task: C:\WINDOWS\Tasks\Driver Easy Scheduled Scan.job => C:\Program Files\Easeware\DriverEasy\DriverEasy.exe Task: C:\WINDOWS\Tasks\DropboxUpdateTaskMachineCore.job => C:\Program Files (x86)\Dropbox\Update\DropboxUpdate.exe Task: C:\WINDOWS\Tasks\DropboxUpdateTaskMachineUA.job => C:\Program Files (x86)\Dropbox\Update\DropboxUpdate.exe Task: C:\WINDOWS\Tasks\HPCeeScheduleForMike.job => C:\Program Files (x86)\Hewlett-Packard\HP Ceement\HPCEE.exe ==================== Shortcuts & WMI ======================== (The entries could be listed to be restored or removed.) ShortcutWithArgument: C:\Users\Mike\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Ledger Manager.lnk -> C:\Program Files (x86)\Google\Chrome\Application\chrome.exe (Google Inc.) -> --profile-directory=Default --app-id=beimhnaefocolcplfimocfiaiefpkgbf ShortcutWithArgument: C:\Users\Mike\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Ledger Wallet Bitcoin.lnk -> C:\Program Files (x86)\Google\Chrome\Application\chrome.exe (Google Inc.) -> --profile-directory=Default --app-id=kkdpmhnladdopljabkgpacgpliggeeaf ShortcutWithArgument: C:\Users\Mike\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Ledger Wallet Ethereum.lnk -> C:\Program Files (x86)\Google\Chrome\Application\chrome.exe (Google Inc.) -> --profile-directory=Default --app-id=hmlhkialjkaldndjnlcdfdphcgeadkkm ShortcutWithArgument: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Priceline.com.lnk -> C:\Program Files (x86)\HP\Shared\WizLink.exe () -> hxxp://www.priceline.com/?refid=PLHBC6240OPQ&refclickid=square ShortcutWithArgument: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\VUDU - Streaming Movies.lnk -> C:\Program Files (x86)\HP\Shared\WizLink.exe () -> hxxp://www.vudu.com/ ==================== Loaded Modules (Whitelisted) ============== 2017-10-23 09:34 - 2014-05-15 19:25 - 000084616 _____ () C:\Program Files (x86)\Canon\IJPLM\IJPLMSVC.EXE 2018-01-05 01:14 - 2018-01-05 01:14 - 000088888 _____ () C:\Program Files\Common Files\Apple\Apple Application Support\zlib1.dll 2018-01-05 01:13 - 2018-01-05 01:13 - 001356088 _____ () C:\Program Files\Common Files\Apple\Apple Application Support\libxml2.dll 2016-07-30 12:21 - 2014-04-14 18:59 - 000389896 _____ () C:\Program Files\CyberLink\Shared files\RichVideo64.exe 2016-07-30 12:15 - 2015-12-08 16:58 - 000452456 _____ () C:\Program Files\AVAST Software\SecureLine\VpnSvc.exe 2018-06-12 09:37 - 2018-07-05 15:42 - 002297040 _____ () C:\PROGRAM FILES\MALWAREBYTES\ANTI-MALWARE\SelfProtectionSdk.dll 2018-04-11 16:34 - 2018-04-11 16:34 - 000491744 _____ () C:\Windows\System32\InputHost.dll 2018-04-11 16:34 - 2018-04-11 16:34 - 000472064 _____ () C:\Windows\ShellExperiences\TileControl.dll 2018-04-11 16:34 - 2018-04-11 16:34 - 002759168 _____ () C:\Windows\ShellComponents\TaskFlowUI.dll 2018-06-13 10:30 - 2018-06-08 01:56 - 002185216 _____ () C:\Windows\SystemApps\Microsoft.Windows.Cortana_cw5n1h2txyewy\Cortana.Core.dll 2018-01-22 04:15 - 2018-01-22 04:15 - 000088888 _____ () C:\Program Files\iTunes\zlib1.dll 2018-01-22 04:15 - 2018-01-22 04:15 - 001356088 _____ () C:\Program Files\iTunes\libxml2.dll 2018-06-25 20:13 - 2018-06-22 12:15 - 004608856 _____ () C:\Program Files (x86)\Google\Chrome\Application\67.0.3396.99\libglesv2.dll 2018-06-25 20:13 - 2018-06-22 12:15 - 000099672 _____ () C:\Program Files (x86)\Google\Chrome\Application\67.0.3396.99\libegl.dll 2018-07-05 14:43 - 2018-07-05 14:43 - 000483544 _____ () c:\program files\avast software\avast\streamback.dll 2018-03-16 23:45 - 2018-03-16 23:45 - 067126928 _____ () C:\Program Files\AVAST Software\Avast\libcef.dll 2018-07-05 14:42 - 2018-07-05 14:42 - 000282840 _____ () C:\Program Files\AVAST Software\Avast\gaming_mode_ui.dll 2018-06-14 01:44 - 2018-06-14 01:44 - 086163544 _____ () C:\Users\Mike\AppData\Local\Programs\Opera\53.0.2907.99\opera_browser.dll 2018-06-14 01:44 - 2018-06-14 01:43 - 003742296 _____ () C:\Users\Mike\AppData\Local\Programs\Opera\53.0.2907.99\libglesv2.dll 2018-06-14 01:44 - 2018-06-14 01:43 - 000086616 _____ () C:\Users\Mike\AppData\Local\Programs\Opera\53.0.2907.99\libegl.dll 2016-07-30 12:15 - 2015-12-08 16:58 - 038561984 _____ () C:\Program Files\AVAST Software\SecureLine\libcef.dll 2017-11-09 01:44 - 2017-11-09 01:44 - 001244304 _____ () C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\LMS\ACE.dll ==================== Alternate Data Streams (Whitelisted) ========= (If an entry is included in the fixlist, only the ADS will be removed.) ==================== Safe Mode (Whitelisted) =================== (If an entry is included in the fixlist, it will be removed from the registry. The "AlternateShell" will be restored.) HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\MBAMService => ""="Service" HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\MCODS => ""="Service" HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\mcpltsvc => ""="Service" HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\MBAMService => ""="Service" HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\McMPFSvc => ""="Service" HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\MCODS => ""="Service" HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\mcpltsvc => ""="Service" ==================== Association (Whitelisted) =============== (If an entry is included in the fixlist, the registry item will be restored to default or removed.) ==================== Internet Explorer trusted/restricted =============== (If an entry is included in the fixlist, it will be removed from the registry.) ==================== Hosts content: =============================== (If needed Hosts: directive could be included in the fixlist to reset Hosts.) 2015-10-30 00:24 - 2018-06-21 14:10 - 000000865 _____ C:\WINDOWS\system32\Drivers\etc\hosts 0.0.0.1 mssplus.mcafee.com ==================== Other Areas ============================ (Currently there is no automatic fix for this section.) HKU\S-1-5-21-3765602466-2649139181-4260510445-1001\Control Panel\Desktop\\Wallpaper -> DNS Servers: 209.18.47.62 - 209.18.47.61 HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System => (ConsentPromptBehaviorAdmin: 5) (ConsentPromptBehaviorUser: 3) (EnableLUA: 1) HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer => (SmartScreenEnabled: RequireAdmin) Windows Firewall is enabled. ==================== MSCONFIG/TASK MANAGER disabled items == ==================== FirewallRules (Whitelisted) =============== (If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.) FirewallRules: [{184610F0-044C-4920-98B6-9D9C9D63EFE9}] => (Allow) C:\Program Files\iTunes\iTunes.exe FirewallRules: [{03CAE7E6-20E6-4E96-9014-739DDE75E351}] => (Allow) C:\Program Files (x86)\Bonjour\mDNSResponder.exe FirewallRules: [{7CDFEF88-0BCA-40C6-BB5D-A0ECBFA99856}] => (Allow) C:\Program Files (x86)\Bonjour\mDNSResponder.exe FirewallRules: [{7B18D437-FF7B-44AF-8A21-33D6A29A5297}] => (Allow) C:\Program Files\Bonjour\mDNSResponder.exe FirewallRules: [{488F5B87-13B6-4D5C-9349-C3BBFFDEDCF0}] => (Allow) C:\Program Files\Bonjour\mDNSResponder.exe FirewallRules: [{F5B96822-E79B-494A-860F-CECC69AF9820}] => (Allow) C:\Program Files (x86)\Common Files\Apple\Apple Application Support\APSDaemon.exe FirewallRules: [{3420FFDA-4CA7-4B43-A668-D3C5624CCB67}] => (Allow) C:\Program Files (x86)\Microsoft Office\root\Office16\outlook.exe FirewallRules: [UDP Query User{55760E49-54CC-4D03-A2A3-C435F34DEA9B}C:\program files (x86)\netwatch\nwatch.exe] => (Block) C:\program files (x86)\netwatch\nwatch.exe FirewallRules: [TCP Query User{984B347B-D960-403F-A0C7-C41E49EE833C}C:\program files (x86)\netwatch\nwatch.exe] => (Block) C:\program files (x86)\netwatch\nwatch.exe FirewallRules: [{A2309BC4-4888-4083-B84E-EAD3285CD83B}] => (Allow) c:\Program Files\CyberLink\PowerDirector12\PDR10.EXE FirewallRules: [{BD20DD0F-86F1-474D-B096-2932C336FFDF}] => (Allow) C:\Program Files (x86)\CyberLink\PowerDVD14\PowerDVD.exe FirewallRules: [{0E6CDE38-D85A-4905-9A46-30BDF131BE63}] => (Allow) C:\Program Files (x86)\CyberLink\PowerDVD14\Kernel\DMS\CLMSServerPDVD14.exe FirewallRules: [{34348355-0176-4515-9ED0-04863A7730FA}] => (Allow) C:\Program Files (x86)\CyberLink\PowerDVD14\PowerDVD14Agent.exe FirewallRules: [{71BE5BBC-6402-4F69-9DA0-5A9C829FF20A}] => (Allow) C:\Program Files (x86)\CyberLink\PowerDVD14\Movie\PowerDVDMovie.exe FirewallRules: [{468FA527-F565-45E0-83F8-CCB59C5BFC97}] => (Allow) C:\Program Files (x86)\CyberLink\PowerDVD14\Movie\PowerDVD Cinema\PowerDVDCinema.exe FirewallRules: [{5042F74C-775E-4F1C-9AE3-0FD2AF8A666E}] => (Allow) C:\Program Files\Intel Corporation\Intel WiDi\WiDiApp.exe FirewallRules: [{91340DB4-F831-466A-9AF6-8E25C25DE1D6}] => (Allow) C:\Program Files\Intel Corporation\Intel WiDi\WiDiAppOld.exe FirewallRules: [{6FD9965D-9266-46BE-A594-7991A5E47C7C}] => (Allow) C:\Program Files\Intel Corporation\Intel WiDi\Next\WirelessDisplay.exe FirewallRules: [{6263A43D-A3D9-4936-87C7-5B6285128FF7}] => (Allow) C:\Program Files\Intel Corporation\Intel WiDi\SmartAgentTest.exe FirewallRules: [{3E35BF82-D543-4C84-BF82-2AEBCB264C4E}] => (Allow) C:\Program Files\Common Files\McAfee\Platform\McSvcHost\McSvHost.exe FirewallRules: [{82D0E4B2-D7D5-4139-A9B1-091CCE381619}] => (Allow) C:\Program Files (x86)\Mozilla Firefox\firefox.exe FirewallRules: [{704BF7E8-C223-4F22-8A83-0DFCC3B6F6EB}] => (Allow) C:\Program Files (x86)\Mozilla Firefox\firefox.exe FirewallRules: [TCP Query User{A70DA838-184D-4A14-9B79-8A8CB4ED4C70}C:\program files (x86)\mozilla firefox\firefox.exe] => (Block) C:\program files (x86)\mozilla firefox\firefox.exe FirewallRules: [UDP Query User{D77D3EAC-9717-4750-8C3A-37B81FFB7FE1}C:\program files (x86)\mozilla firefox\firefox.exe] => (Block) C:\program files (x86)\mozilla firefox\firefox.exe FirewallRules: [{7BAD5CFE-D39B-45A4-BE6F-B05D86407BEE}] => (Allow) C:\Program Files\Lightworks\lightworks.exe FirewallRules: [{14202580-7965-4A90-886E-2DECA241B345}] => (Allow) C:\Program Files\Lightworks\lightworks.exe FirewallRules: [{9595FE18-1DF9-4476-B680-71512D480541}] => (Allow) C:\Program Files\Lightworks\ntcardvt.exe FirewallRules: [{D49D4AAF-03C2-496B-BAAD-B3F8E8DF85EA}] => (Allow) C:\Program Files\Lightworks\ntcardvt.exe FirewallRules: [{FC4BB049-8EA3-4337-BE8F-851274472947}] => (Allow) C:\Program Files\Easeware\DriverEasy\DriverEasy.exe FirewallRules: [TCP Query User{4E6FC165-FE5B-40DF-9A6A-EA0E4E740E4F}C:\program files (x86)\mirc\mirc.exe] => (Allow) C:\program files (x86)\mirc\mirc.exe FirewallRules: [UDP Query User{9B4F8455-19F5-48D7-9163-E579089AF382}C:\program files (x86)\mirc\mirc.exe] => (Allow) C:\program files (x86)\mirc\mirc.exe FirewallRules: [{5633DE10-12D8-49E5-A2FE-9090C95E3FD0}] => (Allow) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe FirewallRules: [{6D9B4AD5-8B3F-4987-839E-2E06FD748835}] => (Allow) C:\Program Files (x86)\AVAST Software\Browser\Application\AvastBrowser.exe FirewallRules: [{6707CA6B-B3FA-4E56-91C9-AF54ED8D92BE}] => (Allow) C:\Program Files\AVAST Software\Avast\AvEmUpdate.exe FirewallRules: [{968FA830-55D8-436E-B848-82192533C942}] => (Allow) C:\Program Files\AVAST Software\Avast\AvEmUpdate.exe ==================== Restore Points ========================= 21-06-2018 11:50:05 Scheduled Checkpoint 03-07-2018 18:12:44 Scheduled Checkpoint ==================== Faulty Device Manager Devices ============= ==================== Event log errors: ========================= Application errors: ================== Error: (07/08/2018 04:22:11 PM) (Source: MsiInstaller) (EventID: 11316) (User: NT AUTHORITY) Description: Product: Avast Update Helper -- Error 1316. The specified account already exists. Error: (07/08/2018 04:17:41 PM) (Source: DPTF) (EventID: 256) (User: ) Description: Intel(R) Dynamic Platform and Thermal Framework : ESIF(8.1.10605.221) TYPE: ERROR DPTF Build Version: 8.1.10605.221 DPTF Build Date: Oct 23 2015 12:24:15 Source File: ..\..\..\Sources\Manager\WIDomainPowerControlCapabilityChanged.cpp @ line 63 Executing Function: WIDomainPowerControlCapabilityChanged::execute Message: Unhandled exception caught during execution of work item Framework Event: DomainPowerControlCapabilityChanged [19] Participant: TCPU [1] Policy: Passive Policy 2 [2] Exception Function: Policy::executeDomainPowerControlCapabilityChanged Exception Text: Could not find client in directory. Error: (07/08/2018 04:17:41 PM) (Source: DPTF) (EventID: 256) (User: ) Description: Intel(R) Dynamic Platform and Thermal Framework : ESIF(8.1.10605.221) TYPE: ERROR DPTF Build Version: 8.1.10605.221 DPTF Build Date: Oct 23 2015 12:24:15 Source File: ..\..\..\Sources\Manager\WIDomainPerformanceControlCapabilityChanged.cpp @ line 63 Executing Function: WIDomainPerformanceControlCapabilityChanged::execute Message: Unhandled exception caught during execution of work item Framework Event: DomainPerformanceControlCapabilityChanged [17] Participant: TCPU [1] Policy: Passive Policy 2 [2] Exception Function: Policy::executeDomainPerformanceControlCapabilityChanged Exception Text: Could not find client in directory. Error: (07/08/2018 04:17:41 PM) (Source: DPTF) (EventID: 256) (User: ) Description: Intel(R) Dynamic Platform and Thermal Framework : ESIF(8.1.10605.221) TYPE: ERROR DPTF Build Version: 8.1.10605.221 DPTF Build Date: Oct 23 2015 12:24:15 Source File: ..\..\..\Sources\Manager\WIDomainPerformanceControlCapabilityChanged.cpp @ line 63 Executing Function: WIDomainPerformanceControlCapabilityChanged::execute Message: Unhandled exception caught during execution of work item Framework Event: DomainPerformanceControlCapabilityChanged [17] Participant: TCPU [1] Policy: Passive Policy 2 [2] Exception Function: Policy::executeDomainPerformanceControlCapabilityChanged Exception Text: Could not find client in directory. Error: (07/08/2018 04:12:29 PM) (Source: MsiInstaller) (EventID: 11316) (User: NT AUTHORITY) Description: Product: Avast Update Helper -- Error 1316. The specified account already exists. Error: (07/08/2018 04:05:16 PM) (Source: MsiInstaller) (EventID: 11316) (User: NT AUTHORITY) Description: Product: Avast Update Helper -- Error 1316. The specified account already exists. Error: (07/08/2018 04:01:14 PM) (Source: DPTF) (EventID: 256) (User: ) Description: Intel(R) Dynamic Platform and Thermal Framework : ESIF(8.1.10605.221) TYPE: ERROR DPTF Build Version: 8.1.10605.221 DPTF Build Date: Oct 23 2015 12:24:15 Source File: ..\..\..\Sources\Manager\WIDomainPowerControlCapabilityChanged.cpp @ line 63 Executing Function: WIDomainPowerControlCapabilityChanged::execute Message: Unhandled exception caught during execution of work item Framework Event: DomainPowerControlCapabilityChanged [19] Participant: TCPU [1] Policy: Passive Policy 2 [2] Exception Function: Policy::executeDomainPowerControlCapabilityChanged Exception Text: Could not find client in directory. Error: (07/08/2018 03:22:02 PM) (Source: MsiInstaller) (EventID: 11316) (User: NT AUTHORITY) Description: Product: Avast Update Helper -- Error 1316. The specified account already exists. System errors: ============= Error: (07/08/2018 04:23:27 PM) (Source: BugCheck) (EventID: 1001) (User: ) Description: The computer has rebooted from a bugcheck. The bugcheck was: 0x00000001 (0x00007ff934fb9f94, 0x0000000000000000, 0x000000000000ffff, 0xfffff581a18dba80). A dump was saved in: C:\WINDOWS\MEMORY.DMP. Report Id: e9c685f1-191b-49bd-a181-6c6f8759cd5a. Error: (07/08/2018 04:20:18 PM) (Source: DCOM) (EventID: 10016) (User: DESKTOP-5QB6ES4) Description: The application-specific permission settings do not grant Local Activation permission for the COM Server application with CLSID {D63B10C5-BB46-4990-A94F-E40B9D520160} and APPID {9CA88EE3-ACB7-47C8-AFC4-AB702511C276} to the user DESKTOP-5QB6ES4\Mike SID (S-1-5-21-3765602466-2649139181-4260510445-1001) from address LocalHost (Using LRPC) running in the application container Unavailable SID (Unavailable). This security permission can be modified using the Component Services administrative tool. Error: (07/08/2018 04:19:47 PM) (Source: DCOM) (EventID: 10016) (User: DESKTOP-5QB6ES4) Description: The application-specific permission settings do not grant Local Activation permission for the COM Server application with CLSID {D63B10C5-BB46-4990-A94F-E40B9D520160} and APPID {9CA88EE3-ACB7-47C8-AFC4-AB702511C276} to the user DESKTOP-5QB6ES4\Mike SID (S-1-5-21-3765602466-2649139181-4260510445-1001) from address LocalHost (Using LRPC) running in the application container Unavailable SID (Unavailable). This security permission can be modified using the Component Services administrative tool. Error: (07/08/2018 04:18:10 PM) (Source: DCOM) (EventID: 10016) (User: NT AUTHORITY) Description: The application-specific permission settings do not grant Local Activation permission for the COM Server application with CLSID {6B3B8D23-FA8D-40B9-8DBD-B950333E2C52} and APPID {4839DDB7-58C2-48F5-8283-E1D1807D0D7D} to the user NT AUTHORITY\LOCAL SERVICE SID (S-1-5-19) from address LocalHost (Using LRPC) running in the application container Unavailable SID (Unavailable). This security permission can be modified using the Component Services administrative tool. Error: (07/08/2018 04:18:10 PM) (Source: DCOM) (EventID: 10016) (User: NT AUTHORITY) Description: The application-specific permission settings do not grant Local Activation permission for the COM Server application with CLSID {6B3B8D23-FA8D-40B9-8DBD-B950333E2C52} and APPID {4839DDB7-58C2-48F5-8283-E1D1807D0D7D} to the user NT AUTHORITY\LOCAL SERVICE SID (S-1-5-19) from address LocalHost (Using LRPC) running in the application container Unavailable SID (Unavailable). This security permission can be modified using the Component Services administrative tool. Error: (07/08/2018 04:17:41 PM) (Source: EventLog) (EventID: 6008) (User: ) Description: The previous system shutdown at 4:01:13 PM on 7/8/2018 was unexpected. Error: (07/08/2018 04:02:59 PM) (Source: DCOM) (EventID: 10016) (User: NT AUTHORITY) Description: The application-specific permission settings do not grant Local Activation permission for the COM Server application with CLSID {6B3B8D23-FA8D-40B9-8DBD-B950333E2C52} and APPID {4839DDB7-58C2-48F5-8283-E1D1807D0D7D} to the user NT AUTHORITY\LOCAL SERVICE SID (S-1-5-19) from address LocalHost (Using LRPC) running in the application container Unavailable SID (Unavailable). This security permission can be modified using the Component Services administrative tool. Error: (07/08/2018 04:02:59 PM) (Source: DCOM) (EventID: 10016) (User: NT AUTHORITY) Description: The application-specific permission settings do not grant Local Activation permission for the COM Server application with CLSID {6B3B8D23-FA8D-40B9-8DBD-B950333E2C52} and APPID {4839DDB7-58C2-48F5-8283-E1D1807D0D7D} to the user NT AUTHORITY\LOCAL SERVICE SID (S-1-5-19) from address LocalHost (Using LRPC) running in the application container Unavailable SID (Unavailable). This security permission can be modified using the Component Services administrative tool. ==================== Memory info =========================== Processor: Intel(R) Core(TM) i5-6200U CPU @ 2.30GHz Percentage of memory in use: 47% Total physical RAM: 8080.41 MB Available physical RAM: 4248.9 MB Total Virtual: 13456.41 MB Available Virtual: 8989.33 MB ==================== Drives ================================ Drive ? (Windows) (Fixed) (Total:914.6 GB) (Free:837.77 GB) NTFS Drive d: (RECOVERY) (Fixed) (Total:15.68 GB) (Free:1.63 GB) NTFS ==>[system with boot components (obtained from drive)] \\?\Volume{e4eeb714-1c90-46e8-9ae9-cc625138068e}\ (Windows RE tools) (Fixed) (Total:0.96 GB) (Free:0.4 GB) NTFS \\?\Volume{3b9bc79c-9aea-4e1a-963a-da26e9dc0e67}\ () (Fixed) (Total:0.25 GB) (Free:0.16 GB) FAT32 ==================== MBR & Partition Table ================== ======================================================== Disk: 0 (Size: 931.5 GB) (Disk ID: A50E1C7D) Partition: GPT. ==================== End of Addition.txt ============================ Link to post Share on other sites More sharing options...
nasdaq Posted July 9, 2018 ID:1255600 Share Posted July 9, 2018 Hi, The only suspicious items is this: (Sharpeware) C:\Program Files (x86)\NETWatch\NWATCH.EXE Did you install this program as I cannot find anything on Sharpeware Link to post Share on other sites More sharing options...
twinpeaks Posted July 10, 2018 Author ID:1255842 Share Posted July 10, 2018 Yes I did, any suggestions? Should I remove I do not use it The ADwCleaner scan detected (6 total) pup.optional.legacy virus which I read is a backdoor virus where the hacker is able to gain access to your computer entirely can you confirm? Link to post Share on other sites More sharing options...
nasdaq Posted July 11, 2018 ID:1256027 Share Posted July 11, 2018 Hello, Welcome to Malwarebytes. I'm nasdaq and will be helping you. If you can please print this topic it will make it easier for you to follow the instructions and complete all of the necessary steps in the order listed. === Remove these programs in bold via the Control Panel > Programs > Programs and Features.NETWatch (HKLM-x32\...\{7415AD3D-BDF6-4CD5-87AE-7237FAAACECF}) (Version: 3.1.13.0 - Sharpeware Ltd)netwatch 0.1 (HKLM-x32\...\netwatch_0) (Version: 0.1 - [taesiri]) Please download the attached Fixlist.txt file to the same folder where the Farbar tool is running from. The location is listed in the 3rd line of the FRST.txt log you have submitted. Run FRST and click Fix only once and wait. The tool will create a log (Fixlog.txt) please post it to your reply. === Please post also the AdwCleaner log with the items reported. fixlist.txt Link to post Share on other sites More sharing options...
Root Admin AdvancedSetup Posted July 21, 2018 Root Admin ID:1257884 Share Posted July 21, 2018 Due to the lack of feedback, this topic is closed to prevent others from posting here. If you need this topic reopened, please send a Private Message to any one of the moderating team members. Please include a link to this topic with your request. This applies only to the originator of this topic. Other members who need assistance please start your own topic in a new thread. Thanks Link to post Share on other sites More sharing options...
Recommended Posts