saundm Posted March 26, 2019 ID:1305418 Share Posted March 26, 2019 The attached popup has appeared but I cannot find anything online to say it is safe or not. The process was listed as COM Surrogate (32bit) and the details said dllhost.exe I do not want to click on OK as I cannot verify the message (I have never seen a message like it before) Thanks Link to post Share on other sites More sharing options...
nasdaq Posted March 28, 2019 ID:1305752 Share Posted March 28, 2019 Hello, Welcome to Malwarebytes. I'm nasdaq and will be helping you. If you can please print this topic it will make it easier for you to follow the instructions and complete all of the necessary steps in the order listed. === If you still need help execute these instructions. Download the Farbar Recovery Scan Tool (FRST).Choose the 32 or 64 bit version for your system. and save it to a folder on your computer's Desktop. Double-click to run it. When the tool opens click Yes to disclaimer. Press Scan button. It will make a log (FRST.txt) in the same directory the tool is run. Please copy and paste it to your reply. The first time the tool is run, it makes also another log (Addition.txt). Please attach it to your reply. How to attach a file to your reply: In the Reply section in the bottom of the topic Click the "more reply Options" button. Attach the file. Select the "Choose a File" navigate to the location of the File.Click the file you wish to Attach.Click Attach this file.Click the Add reply button. === Please post the logs for my review. Wait for further instructions p.s. Let me know if your problem persists. Link to post Share on other sites More sharing options...
saundm Posted March 31, 2019 Author ID:1306123 Share Posted March 31, 2019 Hi Nasdaq and thank you in advance! Here is the content of FRST Scan result of Farbar Recovery Scan Tool (FRST) (x64) Version: 17.03.2019 Ran by matth (administrator) on MATTHEW-SURFACE (26-03-2019 20:10:39) Running from C:\Users\matth\Downloads Loaded Profiles: matth & (Available Profiles: matth & Linus & .NET v4.5 & DefaultAppPool & .NET v4.5 Classic) Platform: Windows 10 Pro Version 1803 17134.648 (X64) Language: English (United Kingdom) Default browser: IE Boot Mode: Normal Tutorial for Farbar Recovery Scan Tool: http://www.geekstogo.com/forum/topic/335081-frst-tutorial-how-to-use-farbar-recovery-scan-tool/ ==================== Processes (Whitelisted) ================= (If an entry is included in the fixlist, the process will be closed. The file will not be moved.) (NVIDIA Corporation -> NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\Display.NvContainer\NVDisplay.Container.exe (NVIDIA Corporation -> NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\Display.NvContainer\NVDisplay.Container.exe (Adobe Systems, Incorporated -> Adobe Systems Incorporated) C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe (Adobe Systems Incorporated -> Adobe Systems, Incorporated) C:\Program Files (x86)\Common Files\Adobe\AdobeGCClient\AGMService.exe (Adobe Systems Incorporated -> Adobe Systems, Incorporated) C:\Program Files (x86)\Common Files\Adobe\AdobeGCClient\AGSService.exe (Adobe Systems Incorporated -> Adobe Inc.) C:\Program Files (x86)\Common Files\Adobe\Adobe Desktop Common\ElevationManager\AdobeUpdateService.exe (Apple Inc. -> Apple Inc.) C:\Program Files\Bonjour\mDNSResponder.exe (Cisco WebEx LLC -> Cisco WebEx LLC) C:\Windows\SysWOW64\atashost.exe (Apple Inc. -> Apple Inc.) C:\Program Files\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe (Microsoft Corporation -> Microsoft Corporation) C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeClickToRun.exe (Dropbox, Inc -> Dropbox, Inc.) C:\Windows\System32\DbxSvc.exe (Intel(R) pGFX -> Intel Corporation) C:\Windows\System32\DriverStore\FileRepository\64gh6293.inf_amd64_22fd8f9659edd17f\IntelCpHDCPSvc.exe (devolo AG -> devolo AG) C:\Program Files (x86)\devolo\dlan\devolonetsvc.exe (McAfee, Inc. -> McAfee, Inc.) C:\Program Files\McAfee\WebAdvisor\servicehost.exe (McAfee, Inc. -> McAfee, LLC) C:\Program Files\Common Files\McAfee\SystemCore\mfemms.exe (McAfee, Inc. -> McAfee, Inc.) C:\Program Files\Common Files\McAfee\ModuleCore\ModuleCoreService.exe (Microsoft Windows -> Microsoft Corporation) C:\Windows\System32\mqsvc.exe () [File not signed] C:\Program Files\MySQL\MySQL Server 8.0\bin\mysqld.exe (Nitro Software, Inc. -> Nitro Software, Inc.) C:\Program Files\Nitro\Pro 10\NitroPDFDriverService10x64.exe (Microsoft Corporation -> Microsoft Corporation) C:\Windows\Microsoft.NET\Framework64\v4.0.30319\SMSvcHost.exe (Nitro Software, Inc. -> ) C:\Program Files\Nitro\Pro 10\Nitro_UpdateService.exe (Nitro Software, Inc. -> Nalpeiron Ltd.) C:\Windows\SysWOW64\NLSSRV32.EXE (NVIDIA Corporation -> NVIDIA Corporation) C:\Program Files (x86)\NVIDIA Corporation\NvTelemetry\NvTelemetryContainer.exe (McAfee, Inc. -> McAfee, Inc.) C:\Program Files\Common Files\McAfee\PEF\CORE\PEFService.exe (Sage (UK) Ltd.) [File not signed] C:\Program Files (x86)\Sage\AccountsServiceV24\sg50CtrlSvc_v24.exe (Sage (UK) Ltd.) [File not signed] C:\Program Files (x86)\Sage\AccountsServiceV24\sg50svc_v24.exe (Microsoft) [File not signed] C:\Program Files (x86)\Common Files\Sage\Central\AutoUpdateClient\Sage.Central.AutoUpdateManager.Service.exe (Sage UK Limited) [File not signed] C:\Program Files (x86)\Common Files\Sage\Shared\AutoUpdateManager\v2\Sage.Central.AutoUpdateManager.Service.exe (Sage (UK) Limited) [File not signed] C:\Program Files (x86)\Common Files\Sage SData\Sage.SData.Service.exe (Microsoft Corporation -> Microsoft Corporation) C:\Windows\System32\SurfaceDtxService.exe (Microsoft Corporation -> Microsoft Corporation) C:\Windows\System32\SurfaceUsbHubFwUpdateService.exe (TeamViewer GmbH -> TeamViewer GmbH) C:\Program Files (x86)\TeamViewer\TeamViewer_Service.exe (Malwarebytes Corporation -> Malwarebytes) C:\Program Files\Malwarebytes\Anti-Malware\MBAMService.exe (McAfee, Inc. -> McAfee, LLC) C:\Windows\System32\mfevtps.exe () [File not signed] C:\Program Files\MySQL\MySQL Server 8.0\bin\mysqld.exe (Intel(R) pGFX -> Intel Corporation) C:\Windows\System32\DriverStore\FileRepository\64gh6293.inf_amd64_22fd8f9659edd17f\IntelCpHeciSvc.exe (McAfee, Inc. -> McAfee, Inc.) C:\Program Files\Common Files\McAfee\MMSSHost\MMSSHOST.exe (McAfee, Inc. -> McAfee, LLC) C:\Windows\System32\mfevtps.exe (Microsoft Corporation -> Microsoft Corporation) C:\Windows\Microsoft.NET\Framework64\v4.0.30319\SMSvcHost.exe (McAfee, Inc. -> McAfee, Inc.) C:\Program Files\McAfee\MfeAV\MfeAVSvc.exe (McAfee, Inc. -> McAfee, Inc.) C:\Program Files\McAfee\WebAdvisor\uihost.exe (McAfee, Inc. -> McAfee, LLC) C:\Program Files\Common Files\McAfee\SystemCore\mfefire.exe (McAfee, Inc. -> McAfee, Inc.) C:\Program Files\Common Files\McAfee\VSCore_18_5\mcapexe.exe (McAfee, Inc. -> McAfee, Inc.) C:\Program Files\Common Files\McAfee\CSP\2.9.175.0\McCSPServiceHost.exe (Microsoft Windows -> Microsoft Corporation) C:\Windows\System32\dllhost.exe (McAfee, Inc. -> McAfee LLC.) C:\Program Files\Common Files\McAfee\AMCore\mcshield.exe (Microsoft Windows -> Microsoft Corporation) C:\Windows\System32\dllhost.exe () [File not signed] C:\Program Files\WindowsApps\Microsoft.SkypeApp_14.41.54.0_x64__kzf8qxf38zg5c\SkypeBackgroundHost.exe (Microsoft Windows -> Microsoft Corporation) C:\Windows\System32\Speech_OneCore\common\SpeechRuntime.exe (Microsoft Corporation) [File not signed] C:\Program Files\WindowsApps\Microsoft.SkypeApp_14.41.54.0_x64__kzf8qxf38zg5c\SkypeApp.exe (Microsoft Windows -> Microsoft Corporation) C:\Windows\SystemApps\Microsoft.Windows.Cortana_cw5n1h2txyewy\RemindersServer.exe (Microsoft Windows -> Microsoft Corporation) C:\Windows\System32\smartscreen.exe (Google Inc -> Google Inc.) C:\Program Files (x86)\Google\Update\1.3.33.23\GoogleCrashHandler.exe (Google Inc -> Google Inc.) C:\Program Files (x86)\Google\Update\1.3.33.23\GoogleCrashHandler64.exe (Malwarebytes Corporation -> Malwarebytes) C:\Program Files\Malwarebytes\Anti-Malware\mbamtray.exe (Microsoft Windows -> Microsoft Corporation) C:\Windows\SysWOW64\dllhost.exe (Microsoft Windows -> Microsoft Corporation) C:\Program Files\Windows Defender\MSASCuiL.exe (Microsoft Corporation -> ) C:\Windows\System32\SurfaceDTX.exe (Microsoft Corporation -> Microsoft Corporation) C:\Windows\WindowsMobile\wmdc.exe (Adobe Systems, Incorporated -> Adobe Systems Incorporated) C:\Program Files (x86)\Adobe\Acrobat DC\Acrobat\AdobeCollabSync.exe (Adobe Systems, Incorporated -> Adobe Systems Incorporated) C:\Program Files (x86)\Adobe\Acrobat DC\Acrobat\AdobeCollabSync.exe (Microsoft Corporation -> Microsoft Corporation) C:\Users\matth\AppData\Local\Microsoft\OneDrive\OneDrive.exe (TeamViewer GmbH -> TeamViewer GmbH) C:\Program Files (x86)\TeamViewer\TeamViewer.exe (McAfee, Inc. -> McAfee, Inc.) C:\Program Files\Common Files\McAfee\ModuleCore\ModuleCoreService.exe (Valve -> Valve Corporation) C:\Program Files (x86)\Steam\Steam.exe (Open-Xchange GmbH -> OX Software GmbH) C:\Users\matth\AppData\Local\Open-Xchange\OXUpdater\OXUpdater.exe (Siber Systems -> Siber Systems) C:\Program Files (x86)\Siber Systems\AI RoboForm\robotaskbaricon.exe (TeamViewer GmbH -> TeamViewer GmbH) C:\Program Files (x86)\TeamViewer\tv_w32.exe (TeamViewer GmbH -> TeamViewer GmbH) C:\Program Files (x86)\TeamViewer\tv_x64.exe (Spotify AB -> Spotify Ltd) C:\Program Files\WindowsApps\SpotifyAB.SpotifyMusic_1.101.348.0_x86__zpdnekdrzrea0\Spotify.exe (Valve -> Valve Corporation) C:\Program Files (x86)\Steam\bin\cef\cef.win7x64\steamwebhelper.exe (Valve -> Valve Corporation) C:\Program Files (x86)\Common Files\Steam\SteamService.exe (PFU Limited) [File not signed] C:\Program Files (x86)\PFU\ScanSnap\CardMinder\CardLauncher.exe (Adobe Systems Incorporated -> Adobe Inc.) C:\Program Files (x86)\Adobe\Adobe Creative Cloud\ACC\Creative Cloud.exe (Valve -> Valve Corporation) C:\Program Files (x86)\Steam\bin\cef\cef.win7x64\steamwebhelper.exe (Adobe Systems Incorporated -> Adobe Systems Incorporated) C:\Program Files (x86)\Common Files\Adobe\Adobe Desktop Common\IPCBox\AdobeIPCBroker.exe (Valve -> Valve Corporation) C:\Program Files (x86)\Steam\bin\cef\cef.win7x64\steamwebhelper.exe (PFU Limited) [File not signed] C:\Program Files (x86)\PFU\ScanSnap\Driver\PfuSsMon.exe (Spotify AB -> Spotify Ltd) C:\Program Files\WindowsApps\SpotifyAB.SpotifyMusic_1.101.348.0_x86__zpdnekdrzrea0\Spotify.exe (Adobe Systems, Incorporated -> Adobe Systems Inc.) C:\Program Files (x86)\Adobe\Acrobat DC\Acrobat\acrotray.exe (PFU LIMITED) [File not signed] C:\Program Files (x86)\PFU\ScanSnap\SSFolder\SSFolderTray.exe (Dropbox, Inc -> Dropbox, Inc.) C:\Program Files (x86)\Dropbox\Client\Dropbox.exe (Dropbox, Inc -> Dropbox, Inc.) C:\Program Files (x86)\Dropbox\Client\Dropbox.exe (Dropbox, Inc -> Dropbox, Inc.) C:\Program Files (x86)\Dropbox\Client\Dropbox.exe (Spotify AB -> Spotify Ltd) C:\Program Files\WindowsApps\SpotifyAB.SpotifyMusic_1.101.348.0_x86__zpdnekdrzrea0\Spotify.exe (Evernote Corporation -> Evernote Corp., 305 Walnut Street, Redwood City, CA 94063) C:\Program Files (x86)\Evernote\Evernote\EvernoteClipper.exe (Spotify AB -> Spotify Ltd) C:\Program Files\WindowsApps\SpotifyAB.SpotifyMusic_1.101.348.0_x86__zpdnekdrzrea0\Spotify.exe (Adobe Systems Incorporated -> Adobe Inc.) C:\Program Files (x86)\Common Files\Adobe\Adobe Desktop Common\ADS\Adobe Desktop Service.exe (Adobe Systems Incorporated -> Adobe Inc.) C:\Program Files (x86)\Common Files\Adobe\Adobe Desktop Common\HEX\Adobe CEF Helper.exe () [File not signed] C:\Users\matth\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Shortcuts.exe (PFU LIMITED) [File not signed] C:\Program Files (x86)\PFU\ScanSnap\Driver\SSDriver\fi5110\SsWiaChecker.exe (PFU Limited) [File not signed] C:\Program Files (x86)\PFU\ScanSnap\Update\SsUWatcher.exe (PFU) [File not signed] C:\Program Files (x86)\PFU\ScanSnapCloud\SSCloud\sCloudWatch.exe (Adobe Systems Incorporated -> ) C:\Program Files (x86)\Adobe\Adobe Sync\CoreSync\CoreSync.exe (Microsoft Corporation -> Microsoft Corp.) C:\Program Files (x86)\Microsoft\BingDesktop\BingDesktop.exe (Adobe Inc. -> Adobe Systems Incorporated) C:\Program Files (x86)\Adobe\Adobe Creative Cloud Experience\CCXProcess.exe (Node.js Foundation -> Node.js) C:\Program Files (x86)\Adobe\Adobe Creative Cloud Experience\libs\node.exe (Valve -> Valve Corporation) C:\Program Files (x86)\Steam\bin\cef\cef.win7x64\steamwebhelper.exe (Valve -> Valve Corporation) C:\Program Files (x86)\Steam\bin\cef\cef.win7x64\steamwebhelper.exe (Dropbox, Inc -> The Qt Company Ltd.) C:\Program Files (x86)\Dropbox\Client\QtWebEngineProcess.exe (Adobe Systems Incorporated -> Adobe Systems Incorporated) C:\Program Files (x86)\Common Files\Adobe\Creative Cloud Libraries\CCLibrary.exe (Node.js Foundation -> Node.js) C:\Program Files (x86)\Common Files\Adobe\Creative Cloud Libraries\libs\node.exe (Microsoft Corporation -> Microsoft Corporation) C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdge.exe (Microsoft Windows -> Microsoft Corporation) C:\Windows\System32\browser_broker.exe (Microsoft Windows -> Microsoft Corporation) C:\Windows\System32\dllhost.exe (Microsoft Corporation -> Microsoft Corporation) C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe (Microsoft Corporation -> Microsoft Corporation) C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe (Microsoft Corporation -> Microsoft Corporation) C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe (Dropbox, Inc -> The Qt Company Ltd.) C:\Program Files (x86)\Dropbox\Client\QtWebEngineProcess.exe (Microsoft Corporation -> Microsoft Corp.) C:\Program Files (x86)\Microsoft\BingDesktop\BDExtHost.exe () [File not signed] C:\Program Files\WindowsApps\SiberSystemsInc.RoboFormEdge_8.5.6.0_x86__7kk3kr9e0p1np\RoboFormCompanion.exe (Microsoft Corporation -> Microsoft Corp.) C:\Program Files (x86)\Microsoft\BingDesktop\BDAppHost.exe (Microsoft Corporation -> Microsoft Corporation) C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe (Microsoft Corporation -> Microsoft Corporation) C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe (McAfee, Inc. -> McAfee, Inc.) C:\Program Files\Common Files\McAfee\Platform\McUICnt.exe (Microsoft Corporation -> Microsoft Corp.) C:\Program Files (x86)\Microsoft\BingDesktop\BDRuntimeHost.exe (Siber Systems Inc.) [File not signed] C:\Program Files\WindowsApps\SiberSystemsInc.RoboFormEdge_8.5.6.0_x86__7kk3kr9e0p1np\DesktopBridge\rf-edge-nm-host.exe (Microsoft Corporation -> Microsoft Corporation) C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe (Microsoft Corporation -> Microsoft Corporation) C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe (Microsoft Corporation -> Microsoft Corporation) C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe (SAP SE -> SAP SE) C:\Program Files (x86)\SAP\SapSetup\setup\Updater\NwSapAutoWorkstationUpdateService.exe (Microsoft Windows -> Microsoft Corporation) C:\Program Files\rempl\sedsvc.exe (Microsoft Corporation -> Microsoft Corporation) C:\Windows\System32\SurfaceService.exe (Microsoft Corporation -> Microsoft Corporation) C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe (Microsoft Corporation -> Microsoft Corporation) C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe (Microsoft Corporation -> Microsoft Corporation) C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe ==================== Registry (Whitelisted) =========================== (If an entry is included in the fixlist, the registry item will be restored to default or removed. The file will not be moved.) HKLM\...\Run: [SecurityHealth] => C:\Program Files\Windows Defender\MSASCuiL.exe [638872 2018-04-11] (Microsoft Windows -> Microsoft Corporation) HKLM\...\Run: [SurfaceDTX.exe] => C:\WINDOWS\System32\SurfaceDTX.exe [804744 2017-11-01] (Microsoft Corporation -> ) HKLM\...\Run: [AdobeAAMUpdater-1.0] => C:\Program Files (x86)\Common Files\Adobe\OOBE\PDApp\UWA\UpdaterStartupUtility.exe [509936 2018-04-11] (Adobe Systems Incorporated -> Adobe Systems Incorporated) HKLM\...\Run: [AdobeGCInvoker-1.0] => C:\Program Files (x86)\Common Files\Adobe\AdobeGCClient\AGCInvokerUtility.exe [2675176 2018-12-13] (Adobe Systems Incorporated -> Adobe Systems, Incorporated) HKLM\...\Run: [iTunesHelper] => C:\Program Files\iTunes\iTunesHelper.exe [301880 2018-10-22] (Apple Inc. -> Apple Inc.) HKLM\...\Run: [Windows Mobile Device Center] => C:\WINDOWS\WindowsMobile\wmdc.exe [660360 2007-05-31] (Microsoft Corporation -> Microsoft Corporation) HKLM-x32\...\Run: [Adobe Creative Cloud] => C:\Program Files (x86)\Adobe\Adobe Creative Cloud\ACC\Creative Cloud.exe [2410960 2019-03-01] (Adobe Systems Incorporated -> Adobe Inc.) HKLM-x32\...\Run: [Acrobat Assistant 8.0] => C:\Program Files (x86)\Adobe\Acrobat DC\Acrobat\Acrotray.exe [4810224 2019-02-18] (Adobe Systems, Incorporated -> Adobe Systems Inc.) HKLM-x32\...\Run: [Dropbox] => C:\Program Files (x86)\Dropbox\Client\Dropbox.exe [4426560 2019-03-19] (Dropbox, Inc -> Dropbox, Inc.) HKLM-x32\...\Run: [ScanSnap WIA Service Checker] => C:\Program Files (x86)\PFU\ScanSnap\Driver\SSDriver\fi5110\SsWiaChecker.exe [86016 2016-02-18] (PFU LIMITED) [File not signed] HKLM-x32\...\Run: [ScanSnap OnlineUpdate Watcher] => C:\Program Files (x86)\PFU\ScanSnap\Update\SsUWatcher.exe [454144 2016-09-06] (PFU Limited) [File not signed] HKLM-x32\...\Run: [ScanSnap Cloud Watcher] => C:\Program Files (x86)\PFU\ScanSnapCloud\SSCloud\sCloudWatch.exe [114688 2017-04-26] (PFU) [File not signed] HKLM-x32\...\Run: [BingDesktop] => C:\Program Files (x86)\Microsoft\BingDesktop\BingDesktop.exe [2372800 2014-11-26] (Microsoft Corporation -> Microsoft Corp.) HKLM-x32\...\Run: [] => [X] HKU\S-1-5-19\...\RunOnce: [WAB Migrate] => C:\Program Files\Windows Mail\wab.exe [518144 2018-04-11] (Microsoft Windows -> Microsoft Corporation) HKU\S-1-5-19-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-03262019195843019\...\RunOnce: [WAB Migrate] => C:\Program Files\Windows Mail\wab.exe [518144 2018-04-11] (Microsoft Windows -> Microsoft Corporation) HKU\S-1-5-20\...\RunOnce: [WAB Migrate] => C:\Program Files\Windows Mail\wab.exe [518144 2018-04-11] (Microsoft Windows -> Microsoft Corporation) HKU\S-1-5-20-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-03262019195843048\...\RunOnce: [WAB Migrate] => C:\Program Files\Windows Mail\wab.exe [518144 2018-04-11] (Microsoft Windows -> Microsoft Corporation) HKU\S-1-5-21-306283558-555091848-1802614870-1001\...\Run: [Adobe Acrobat Synchronizer] => C:\Program Files (x86)\Adobe\Acrobat DC\Acrobat\AdobeCollabSync.exe [5933552 2019-02-18] (Adobe Systems, Incorporated -> Adobe Systems Incorporated) HKU\S-1-5-21-306283558-555091848-1802614870-1001\...\Run: [Lync] => "C:\Program Files (x86)\Microsoft Office\root\Office16\lync.exe" /fromrunkey HKU\S-1-5-21-306283558-555091848-1802614870-1001\...\Run: [Steam] => C:\Program Files (x86)\Steam\steam.exe [3146016 2019-03-05] (Valve -> Valve Corporation) HKU\S-1-5-21-306283558-555091848-1802614870-1001\...\Run: [OXUpdater] => C:\Users\matth\AppData\Local\Open-Xchange\OXUpdater\OXUpdater.exe [2477536 2016-05-09] (Open-Xchange GmbH -> OX Software GmbH) HKU\S-1-5-21-306283558-555091848-1802614870-1001\...\Run: [RoboForm] => C:\Program Files (x86)\Siber Systems\AI RoboForm\RoboTaskBarIcon.exe [145704 2019-03-22] (Siber Systems -> Siber Systems) HKU\S-1-5-21-306283558-555091848-1802614870-1001\Control Panel\Desktop\\SCRNSAVE.EXE -> C:\WINDOWS\system32\Ribbons.scr [148480 2018-04-11] (Microsoft Windows -> Microsoft Corporation) HKU\S-1-5-21-306283558-555091848-1802614870-1001-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-03262019195843088\...\Run: [Adobe Acrobat Synchronizer] => C:\Program Files (x86)\Adobe\Acrobat DC\Acrobat\AdobeCollabSync.exe [5933552 2019-02-18] (Adobe Systems, Incorporated -> Adobe Systems Incorporated) HKU\S-1-5-21-306283558-555091848-1802614870-1001-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-03262019195843088\...\Run: [Lync] => "C:\Program Files (x86)\Microsoft Office\root\Office16\lync.exe" /fromrunkey HKU\S-1-5-21-306283558-555091848-1802614870-1001-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-03262019195843088\...\Run: [Steam] => C:\Program Files (x86)\Steam\steam.exe [3146016 2019-03-05] (Valve -> Valve Corporation) HKU\S-1-5-21-306283558-555091848-1802614870-1001-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-03262019195843088\...\Run: [OXUpdater] => C:\Users\matth\AppData\Local\Open-Xchange\OXUpdater\OXUpdater.exe [2477536 2016-05-09] (Open-Xchange GmbH -> OX Software GmbH) HKU\S-1-5-21-306283558-555091848-1802614870-1001-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-03262019195843088\...\Run: [RoboForm] => C:\Program Files (x86)\Siber Systems\AI RoboForm\RoboTaskBarIcon.exe [145704 2019-03-22] (Siber Systems -> Siber Systems) HKU\S-1-5-21-306283558-555091848-1802614870-1001-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-03262019195843088\Control Panel\Desktop\\SCRNSAVE.EXE -> C:\WINDOWS\system32\Ribbons.scr [148480 2018-04-11] (Microsoft Windows -> Microsoft Corporation) HKU\S-1-5-82-271721585-897601226-2024613209-625570482-296978595-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-03262019195842809\...\RunOnce: [WAB Migrate] => C:\Program Files\Windows Mail\wab.exe [518144 2018-04-11] (Microsoft Windows -> Microsoft Corporation) HKU\S-1-5-82-271721585-897601226-2024613209-625570482-296978595-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-03262019195843795\...\RunOnce: [WAB Migrate] => C:\Program Files\Windows Mail\wab.exe [518144 2018-04-11] (Microsoft Windows -> Microsoft Corporation) HKU\S-1-5-82-3006700770-424185619-1745488364-794895919-4004696415-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-03262019195842853\...\RunOnce: [WAB Migrate] => C:\Program Files\Windows Mail\wab.exe [518144 2018-04-11] (Microsoft Windows -> Microsoft Corporation) HKU\S-1-5-82-3006700770-424185619-1745488364-794895919-4004696415-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-03262019195843828\...\RunOnce: [WAB Migrate] => C:\Program Files\Windows Mail\wab.exe [518144 2018-04-11] (Microsoft Windows -> Microsoft Corporation) HKU\S-1-5-82-3876422241-1344743610-1729199087-774402673-2621913236-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-03262019195842921\...\RunOnce: [WAB Migrate] => C:\Program Files\Windows Mail\wab.exe [518144 2018-04-11] (Microsoft Windows -> Microsoft Corporation) HKU\S-1-5-82-3876422241-1344743610-1729199087-774402673-2621913236-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-03262019195843860\...\RunOnce: [WAB Migrate] => C:\Program Files\Windows Mail\wab.exe [518144 2018-04-11] (Microsoft Windows -> Microsoft Corporation) HKLM\Software\Microsoft\Active Setup\Installed Components: [{8A69D345-D564-463c-AFF1-A69D9E530F96}] -> C:\Program Files (x86)\Google\Chrome\Application\73.0.3683.86\Installer\chrmstp.exe [2019-03-26] (Google LLC -> Google Inc.) Startup: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\CardMinder Viewer.lnk [2017-04-24] ShortcutTarget: CardMinder Viewer.lnk -> C:\Program Files (x86)\PFU\ScanSnap\CardMinder\CardLauncher.exe (PFU Limited) [File not signed] Startup: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\Conversion to PDF with ScanSnap Organizer.lnk [2017-04-24] ShortcutTarget: Conversion to PDF with ScanSnap Organizer.lnk -> C:\Program Files (x86)\PFU\ScanSnap\Organizer\PfuSsOrgOcrChk.exe (PFU LIMITED) [File not signed] Startup: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\ScanSnap Manager.lnk [2018-06-11] ShortcutTarget: ScanSnap Manager.lnk -> C:\Program Files (x86)\PFU\ScanSnap\Driver\PfuSsMon.exe (PFU Limited) [File not signed] Startup: C:\Users\matth\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\EvernoteClipper.lnk [2016-05-18] ShortcutTarget: EvernoteClipper.lnk -> C:\Program Files (x86)\Evernote\Evernote\EvernoteClipper.exe (Evernote Corporation -> Evernote Corp., 305 Walnut Street, Redwood City, CA 94063) Startup: C:\Users\matth\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\OneDrive for Business.lnk [2016-05-17] ShortcutTarget: OneDrive for Business.lnk -> C:\Program Files (x86)\Microsoft Office\root\Office16\GROOVE.EXE (No File) Startup: C:\Users\matth\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Send to OneNote.lnk [2018-09-25] ShortcutTarget: Send to OneNote.lnk -> C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTEM.EXE (No File) Startup: C:\Users\matth\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Shortcuts.exe [2017-10-21] () [File not signed] ==================== Internet (Whitelisted) ==================== (If an item is included in the fixlist, if it is a registry item it will be removed or restored to default.) Tcpip\Parameters: [DhcpNameServer] 192.168.0.1 Tcpip\..\Interfaces\{166640f9-e636-47b3-ae13-3f4becb235ec}: [DhcpNameServer] 192.168.0.1 Tcpip\..\Interfaces\{8d30f2dc-43ae-453d-be7d-063e7bfa3e45}: [DhcpNameServer] 192.168.16.2 Tcpip\..\Interfaces\{9c43cef1-7010-4b35-a6fc-5ade36c2b390}: [DhcpNameServer] 172.20.10.1 Internet Explorer: ================== BHO: Skype for Business Browser Helper -> {31D09BA0-12F5-4CCE-BE8A-2923E76605DA} -> C:\Program Files (x86)\Microsoft Office\root\VFS\ProgramFilesX64\Microsoft Office\Office16\OCHelper.dll [2019-03-19] (Microsoft Corporation -> Microsoft Corporation) BHO: RoboForm Toolbar Helper -> {724d43a9-0d85-11d4-9908-00400523e39a} -> C:\Program Files (x86)\Siber Systems\AI RoboForm\RoboForm-x64.dll [2019-03-22] (Siber Systems -> Siber Systems Inc.) BHO: Adobe Acrobat Create PDF Helper -> {AE7CD045-E861-484f-8273-0445EE161910} -> C:\Program Files (x86)\Common Files\Adobe\Acrobat\WCIEActiveX\DC\x64\AcroIEFavStub.dll [2016-05-03] (Adobe Systems, Incorporated -> Adobe Systems Incorporated) BHO: McAfee WebAdvisor -> {B164E929-A1B6-4A06-B104-2CD0E90A88FF} -> C:\Program Files\McAfee\WebAdvisor\x64\IEPlugin.dll [2019-02-21] (McAfee, Inc. -> McAfee, Inc.) BHO: No Name -> {D0498E0A-45B7-42AE-A9AA-ABA463DBD3BF} -> No File BHO: Adobe Acrobat Create PDF from Selection -> {F4971EE7-DAA0-4053-9964-665D8EE6A077} -> C:\Program Files (x86)\Common Files\Adobe\Acrobat\WCIEActiveX\DC\x64\AcroIEFavStub.dll [2016-05-03] (Adobe Systems, Incorporated -> Adobe Systems Incorporated) BHO-x32: No Name -> {31D09BA0-12F5-4CCE-BE8A-2923E76605DA} -> No File BHO-x32: RoboForm Toolbar Helper -> {724d43a9-0d85-11d4-9908-00400523e39a} -> C:\Program Files (x86)\Siber Systems\AI RoboForm\roboform.dll [2019-03-22] (Siber Systems -> Siber Systems Inc.) BHO-x32: Evernote extension -> {92EF2EAD-A7CE-4424-B0DB-499CF856608E} -> C:\Program Files (x86)\Evernote\Evernote\EvernoteIE.dll [2018-03-30] (Evernote Corporation -> Evernote Corp., 305 Walnut Street, Redwood City, CA 94063) BHO-x32: Adobe Acrobat Create PDF Helper -> {AE7CD045-E861-484f-8273-0445EE161910} -> C:\Program Files (x86)\Common Files\Adobe\Acrobat\WCIEActiveX\DC\AcroIEFavStub.dll [2016-05-03] (Adobe Systems, Incorporated -> Adobe Systems Incorporated) BHO-x32: McAfee WebAdvisor -> {B164E929-A1B6-4A06-B104-2CD0E90A88FF} -> C:\Program Files\McAfee\WebAdvisor\win32\IEPlugin.dll [2019-02-21] (McAfee, Inc. -> McAfee, Inc.) BHO-x32: Microsoft OneDrive for Business Browser Helper -> {D0498E0A-45B7-42AE-A9AA-ABA463DBD3BF} -> C:\Program Files (x86)\Microsoft Office\root\Office16\GROOVEEX.DLL => No File BHO-x32: Adobe Acrobat Create PDF from Selection -> {F4971EE7-DAA0-4053-9964-665D8EE6A077} -> C:\Program Files (x86)\Common Files\Adobe\Acrobat\WCIEActiveX\DC\AcroIEFavStub.dll [2016-05-03] (Adobe Systems, Incorporated -> Adobe Systems Incorporated) Toolbar: HKLM - &RoboForm Toolbar - {724d43a0-0d85-11d4-9908-00400523e39a} - C:\Program Files (x86)\Siber Systems\AI RoboForm\RoboForm-x64.dll [2019-03-22] (Siber Systems -> Siber Systems Inc.) Toolbar: HKLM - Adobe Acrobat Create PDF Toolbar - {47833539-D0C5-4125-9FA8-0819E2EAAC93} - C:\Program Files (x86)\Common Files\Adobe\Acrobat\WCIEActiveX\DC\x64\AcroIEFavStub.dll [2016-05-03] (Adobe Systems, Incorporated -> Adobe Systems Incorporated) Toolbar: HKLM-x32 - &RoboForm Toolbar - {724d43a0-0d85-11d4-9908-00400523e39a} - C:\Program Files (x86)\Siber Systems\AI RoboForm\roboform.dll [2019-03-22] (Siber Systems -> Siber Systems Inc.) Toolbar: HKLM-x32 - Adobe Acrobat Create PDF Toolbar - {47833539-D0C5-4125-9FA8-0819E2EAAC93} - C:\Program Files (x86)\Common Files\Adobe\Acrobat\WCIEActiveX\DC\AcroIEFavStub.dll [2016-05-03] (Adobe Systems, Incorporated -> Adobe Systems Incorporated) Toolbar: HKU\S-1-5-21-306283558-555091848-1802614870-1001 -> &RoboForm Toolbar - {724D43A0-0D85-11D4-9908-00400523E39A} - C:\Program Files (x86)\Siber Systems\AI RoboForm\RoboForm-x64.dll [2019-03-22] (Siber Systems -> Siber Systems Inc.) Toolbar: HKU\S-1-5-21-306283558-555091848-1802614870-1001 -> Adobe Acrobat Create PDF Toolbar - {47833539-D0C5-4125-9FA8-0819E2EAAC93} - C:\Program Files (x86)\Common Files\Adobe\Acrobat\WCIEActiveX\DC\x64\AcroIEFavStub.dll [2016-05-03] (Adobe Systems, Incorporated -> Adobe Systems Incorporated) Toolbar: HKU\S-1-5-21-306283558-555091848-1802614870-1001-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-03262019195843088 -> &RoboForm Toolbar - {724D43A0-0D85-11D4-9908-00400523E39A} - C:\Program Files (x86)\Siber Systems\AI RoboForm\RoboForm-x64.dll [2019-03-22] (Siber Systems -> Siber Systems Inc.) Toolbar: HKU\S-1-5-21-306283558-555091848-1802614870-1001-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-03262019195843088 -> Adobe Acrobat Create PDF Toolbar - {47833539-D0C5-4125-9FA8-0819E2EAAC93} - C:\Program Files (x86)\Common Files\Adobe\Acrobat\WCIEActiveX\DC\x64\AcroIEFavStub.dll [2016-05-03] (Adobe Systems, Incorporated -> Adobe Systems Incorporated) DPF: HKLM-x32 {E06E2E99-0AA1-11D4-ABA6-0060082AA75C} hxxps://cpgs.webex.com/client/WBXclient-T30L10NSP6-10050/webex/ieatgpc1.cab Handler-x32: mso-minsb-roaming.16 - {83C25742-A9F7-49FB-9138-434302C88D07} - C:\Program Files (x86)\Microsoft Office\root\Office16\MSOSB.DLL [2019-03-19] (Microsoft Corporation -> Microsoft Corporation) Handler-x32: mso-minsb.16 - {42089D2D-912D-4018-9087-2B87803E93FB} - C:\Program Files (x86)\Microsoft Office\root\Office16\MSOSB.DLL [2019-03-19] (Microsoft Corporation -> Microsoft Corporation) Handler-x32: osf-roaming.16 - {42089D2D-912D-4018-9087-2B87803E93FB} - C:\Program Files (x86)\Microsoft Office\root\Office16\MSOSB.DLL [2019-03-19] (Microsoft Corporation -> Microsoft Corporation) Handler-x32: osf.16 - {5504BE45-A83B-4808-900A-3A5C36E7F77A} - C:\Program Files (x86)\Microsoft Office\root\Office16\MSOSB.DLL [2019-03-19] (Microsoft Corporation -> Microsoft Corporation) Handler: sacore - {5513F07E-936B-4E52-9B00-067394E91CC5} - c:\PROGRA~2\mcafee\SITEAD~1\mcieplg.dll No File Handler-x32: saphtmlp - {D1F8BD1E-7967-11D2-B43A-006094B9EADB} - c:\program files (x86)\sap\frontend\sapgui\saphtmlp.dll [2015-12-28] (SAP SE -> SAP, Walldorf) Handler-x32: sapr3 - {D1F8BD1E-7967-11D2-B43A-006094B9EADB} - c:\program files (x86)\sap\frontend\sapgui\saphtmlp.dll [2015-12-28] (SAP SE -> SAP, Walldorf) Filter: application/x-mfe-ipt - {3EF5086B-5478-4598-A054-786C45D75692} - c:\Program Files\McAfee\MSC\McSnIePl64.dll [2018-06-15] (McAfee, Inc. -> McAfee, Inc.) Filter-x32: application/x-mfe-ipt - {3EF5086B-5478-4598-A054-786C45D75692} - c:\Program Files (x86)\McAfee\MSC\McSnIePl.dll [2018-06-15] (McAfee, Inc. -> McAfee, Inc.) Edge: ====== Edge Extension: (RoboForm) -> EdgeExtension_SiberSystemsIncRoboFormEdge_7kk3kr9e0p1np => C:\Program Files\WindowsApps\SiberSystemsInc.RoboFormEdge_8.5.6.0_x86__7kk3kr9e0p1np [2019-03-02] FireFox: ======== FF HKLM\...\Firefox\Extensions: [web2pdfextension.17@acrobat.adobe.com] - C:\Program Files (x86)\Adobe\Acrobat DC\Acrobat\Browser\WCFirefoxExtn\WebExtn\signed_extn\adobe_acrobat-1.0-windows.xpi FF Extension: (Adobe Acrobat) - C:\Program Files (x86)\Adobe\Acrobat DC\Acrobat\Browser\WCFirefoxExtn\WebExtn\signed_extn\adobe_acrobat-1.0-windows.xpi [2018-09-20] FF HKLM\...\Firefox\Extensions: [{4ED1F68A-5463-4931-9384-8FFF5ED91D92}] - C:\Program Files\McAfee\WebAdvisor\e10ssaffplg.xpi FF Extension: (McAfee® WebAdvisor) - C:\Program Files\McAfee\WebAdvisor\e10ssaffplg.xpi [2019-03-20] FF HKLM-x32\...\Firefox\Extensions: [web2pdfextension.17@acrobat.adobe.com] - C:\Program Files (x86)\Adobe\Acrobat DC\Acrobat\Browser\WCFirefoxExtn\WebExtn\signed_extn\adobe_acrobat-1.0-windows.xpi FF HKLM-x32\...\Firefox\Extensions: [{4ED1F68A-5463-4931-9384-8FFF5ED91D92}] - C:\Program Files\McAfee\WebAdvisor\e10ssaffplg.xpi FF HKLM-x32\...\Thunderbird\Extensions: [msktbird@mcafee.com] - C:\Program Files\McAfee\MSK FF Extension: (McAfee Anti-Spam Thunderbird Extension) - C:\Program Files\McAfee\MSK [2018-08-02] [Legacy] [not signed] FF Plugin: @mcafee.com/MSC,version=10 -> c:\PROGRA~1\mcafee\msc\NPMCSN~1.DLL [2018-06-15] (McAfee, Inc. -> ) FF Plugin: @Microsoft.com/NpCtrl,version=1.0 -> c:\Program Files\Microsoft Silverlight\5.1.50918.0\npctrl.dll [2018-10-23] (Microsoft Corporation -> Microsoft Corporation) FF Plugin: adobe.com/AdobeAAMDetect -> C:\Program Files (x86)\Adobe\Adobe Creative Cloud\Utils\npAdobeAAMDetect64.dll [2019-03-01] (Adobe Systems Incorporated -> Adobe Systems) FF Plugin-x32: @mcafee.com/MSC,version=10 -> c:\PROGRA~2\mcafee\msc\NPMCSN~1.DLL [2018-06-15] (McAfee, Inc. -> ) FF Plugin-x32: @Microsoft.com/NpCtrl,version=1.0 -> c:\Program Files (x86)\Microsoft Silverlight\5.1.50918.0\npctrl.dll [2018-10-23] (Microsoft Corporation -> Microsoft Corporation) FF Plugin-x32: @microsoft.com/SharePoint,version=14.0 -> C:\Program Files (x86)\Microsoft Office\root\Office16\NPSPWRAP.DLL [2019-03-19] (Microsoft Corporation -> Microsoft Corporation) FF Plugin-x32: @nitropdf.com/NitroPDF -> C:\Program Files (x86)\Nitro\Pro 10\npnitromozilla.dll [2016-07-22] (Nitro Software, Inc. -> Nitro PDF) FF Plugin-x32: @tools.google.com/Google Update;version=3 -> C:\Program Files (x86)\Google\Update\1.3.33.23\npGoogleUpdate3.dll [2019-01-23] (Google Inc -> Google Inc.) FF Plugin-x32: @tools.google.com/Google Update;version=9 -> C:\Program Files (x86)\Google\Update\1.3.33.23\npGoogleUpdate3.dll [2019-01-23] (Google Inc -> Google Inc.) FF Plugin-x32: Adobe Acrobat -> C:\Program Files (x86)\Adobe\Acrobat DC\Acrobat\Air\nppdf32.dll [2019-02-18] (Adobe Systems, Incorporated -> Adobe Systems Inc.) FF Plugin-x32: adobe.com/AdobeAAMDetect -> C:\Program Files (x86)\Adobe\Adobe Creative Cloud\Utils\npAdobeAAMDetect32.dll [2019-03-01] (Adobe Systems Incorporated -> Adobe Systems) FF Plugin HKU\S-1-5-21-306283558-555091848-1802614870-1001: @citrixonline.com/appdetectorplugin -> C:\Users\matth\AppData\Local\Citrix\Plugins\104\npappdetector.dll [2016-07-14] (Citrix Online -> Citrix Online) FF Plugin HKU\S-1-5-21-306283558-555091848-1802614870-1001-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-03262019195843088: @citrixonline.com/appdetectorplugin -> C:\Users\matth\AppData\Local\Citrix\Plugins\104\npappdetector.dll [2016-07-14] (Citrix Online -> Citrix Online) Chrome: ======= CHR Profile: C:\Users\matth\AppData\Local\Google\Chrome\User Data\Default [2018-09-25] CHR Extension: (Slides) - C:\Users\matth\AppData\Local\Google\Chrome\User Data\Default\Extensions\aapocclcgogkmnckokdopfmhonfmgoek [2018-02-15] CHR Extension: (Docs) - C:\Users\matth\AppData\Local\Google\Chrome\User Data\Default\Extensions\aohghmighlieiainnegkcijnfilokake [2018-02-15] CHR Extension: (Google Drive) - C:\Users\matth\AppData\Local\Google\Chrome\User Data\Default\Extensions\apdfllckaahabafndbhieahigkjlhalf [2018-02-15] CHR Extension: (YouTube) - C:\Users\matth\AppData\Local\Google\Chrome\User Data\Default\Extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo [2018-02-15] CHR Extension: (Adobe Acrobat) - C:\Users\matth\AppData\Local\Google\Chrome\User Data\Default\Extensions\efaidnbmnnnibpcajpcglclefindmkaj [2018-02-15] CHR Extension: (Sheets) - C:\Users\matth\AppData\Local\Google\Chrome\User Data\Default\Extensions\felcaaldnbdncclmgdcncolpebgiejap [2018-02-15] CHR Extension: (McAfee® WebAdvisor) - C:\Users\matth\AppData\Local\Google\Chrome\User Data\Default\Extensions\fheoggkfdfchfphceeifdbepaooicaho [2018-09-25] CHR Extension: (Google Docs Offline) - C:\Users\matth\AppData\Local\Google\Chrome\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi [2018-09-25] CHR Extension: (Skype) - C:\Users\matth\AppData\Local\Google\Chrome\User Data\Default\Extensions\lifbcibllhkdhoafpjfnlhfpfgnpldfl [2018-02-15] CHR Extension: (Chrome Web Store Payments) - C:\Users\matth\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda [2018-04-25] CHR Extension: (Gmail) - C:\Users\matth\AppData\Local\Google\Chrome\User Data\Default\Extensions\pjkljhegncpnkpknbcohdijeoejaedia [2018-02-15] CHR Extension: (Chrome Media Router) - C:\Users\matth\AppData\Local\Google\Chrome\User Data\Default\Extensions\pkedcjkdefgpdelpbcmbmeomcjbeemfm [2018-09-25] CHR Extension: (RoboForm Password Manager) - C:\Users\matth\AppData\Local\Google\Chrome\User Data\Default\Extensions\pnlccmojcmeohlpggmfnbbiapkmbliob [2018-09-25] CHR HKLM\...\Chrome\Extension: [fheoggkfdfchfphceeifdbepaooicaho] - hxxp://clients2.google.com/service/update2/crx CHR HKLM\...\Chrome\Extension: [pnlccmojcmeohlpggmfnbbiapkmbliob] - C:\Program Files (x86)\Siber Systems\AI RoboForm\Chrome\rf-chrome.crx [2016-05-17] CHR HKLM-x32\...\Chrome\Extension: [efaidnbmnnnibpcajpcglclefindmkaj] - hxxps://clients2.google.com/service/update2/crx CHR HKLM-x32\...\Chrome\Extension: [fheoggkfdfchfphceeifdbepaooicaho] - hxxp://clients2.google.com/service/update2/crx CHR HKLM-x32\...\Chrome\Extension: [lifbcibllhkdhoafpjfnlhfpfgnpldfl] - hxxps://clients2.google.com/service/update2/crx CHR HKLM-x32\...\Chrome\Extension: [pnlccmojcmeohlpggmfnbbiapkmbliob] - C:\Program Files (x86)\Siber Systems\AI RoboForm\Chrome\rf-chrome.crx [2016-05-17] ==================== Services (Whitelisted) ==================== (If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.) R2 AdobeUpdateService; C:\Program Files (x86)\Common Files\Adobe\Adobe Desktop Common\ElevationManager\AdobeUpdateService.exe [818128 2019-03-01] (Adobe Systems Incorporated -> Adobe Inc.) R2 AGMService; C:\Program Files (x86)\Common Files\Adobe\AdobeGCClient\AGMService.exe [2917864 2018-12-13] (Adobe Systems Incorporated -> Adobe Systems, Incorporated) R2 AGSService; C:\Program Files (x86)\Common Files\Adobe\AdobeGCClient\AGSService.exe [2709480 2018-12-13] (Adobe Systems Incorporated -> Adobe Systems, Incorporated) R2 Apple Mobile Device Service; C:\Program Files\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe [85304 2018-10-16] (Apple Inc. -> Apple Inc.) S2 BingDesktopUpdate; C:\Program Files (x86)\Microsoft\BingDesktop\BingDesktopUpdater.exe [173248 2014-11-26] (Microsoft Corporation -> Microsoft Corp.) R2 ClickToRunSvc; C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe [11129928 2019-03-06] (Microsoft Corporation -> Microsoft Corporation) S3 ClientAnalyticsService; C:\Program Files\Common Files\McAfee\ClientAnalytics\Legacy\McClientAnalytics.exe [1508656 2018-05-31] (McAfee, Inc. -> McAfee, Inc.) S2 dbupdate; C:\Program Files (x86)\Dropbox\Update\DropboxUpdate.exe [143144 2016-05-21] (Dropbox, Inc -> Dropbox, Inc.) S3 dbupdatem; C:\Program Files (x86)\Dropbox\Update\DropboxUpdate.exe [143144 2016-05-21] (Dropbox, Inc -> Dropbox, Inc.) R2 DbxSvc; C:\WINDOWS\system32\DbxSvc.exe [51024 2019-03-19] (Dropbox, Inc -> Dropbox, Inc.) R2 DevoloNetworkService; C:\Program Files (x86)\devolo\dlan\devolonetsvc.exe [3885592 2017-03-03] (devolo AG -> devolo AG) S3 Intel(R) Capability Licensing Service TCP IP Interface; C:\WINDOWS\System32\Intel\iCLS Client\lib\SocketHeciServer.exe [765112 2018-04-25] (Intel(R) Trust Services -> Intel(R) Corporation) S2 Intel(R) TPM Provisioning Service; C:\WINDOWS\System32\Intel\iCLS Client\lib\TPMProvisioningService.exe [731832 2018-04-25] (Intel(R) Trust Services -> Intel(R) Corporation) S2 IntelAudioService; C:\WINDOWS\system32\cAVS\Intel(R) Audio Service\IntelAudioService.exe [207416 2018-02-15] (Intel(R) Smart Sound Technology -> Intel) R2 MBAMService; C:\Program Files\Malwarebytes\Anti-Malware\mbamservice.exe [6562472 2019-02-01] (Malwarebytes Corporation -> Malwarebytes) R2 McAfee WebAdvisor; C:\Program Files\McAfee\WebAdvisor\ServiceHost.exe [899640 2019-02-21] (McAfee, Inc. -> McAfee, Inc.) R2 McAPExe; C:\Program Files\Common Files\McAfee\VSCore_18_5\McApExe.exe [728808 2018-06-12] (McAfee, Inc. -> McAfee, Inc.) R2 mccspsvc; C:\Program Files\Common Files\McAfee\CSP\2.9.175.0\\McCSPServiceHost.exe [2141912 2018-04-06] (McAfee, Inc. -> McAfee, Inc.) S3 mfefire; C:\Program Files\Common Files\McAfee\SystemCore\mfefire.exe [359888 2018-04-24] (McAfee, Inc. -> McAfee, LLC) R2 mfemms; C:\Program Files\Common Files\McAfee\SystemCore\mfemms.exe [519120 2018-04-24] (McAfee, Inc. -> McAfee, LLC) R2 mfevtp; C:\WINDOWS\system32\mfevtps.exe [473552 2018-04-24] (McAfee, Inc. -> McAfee, LLC) R2 ModuleCoreService; C:\Program Files\Common Files\McAfee\ModuleCore\ModuleCoreService.exe [1689952 2018-06-05] (McAfee, Inc. -> McAfee, Inc.) R2 MySQL80; C:\Program Files\MySQL\MySQL Server 8.0\bin\mysqld.exe [45210624 2018-06-28] () [File not signed] S3 MySQLRouter; C:\Program Files\MySQL\MySQL Router 8.0\bin\mysqlrouter.exe [538112 2018-06-27] () [File not signed] R2 NitroDriverReadSpool10; C:\Program Files\Nitro\Pro 10\NitroPDFDriverService10x64.exe [327320 2016-07-22] (Nitro Software, Inc. -> Nitro Software, Inc.) R2 NitroUpdateService; C:\Program Files\Nitro\Pro 10\Nitro_UpdateService.exe [417944 2016-07-22] (Nitro Software, Inc. -> ) R2 nlsX86cc; C:\WINDOWS\SysWOW64\NLSSRV32.EXE [71832 2016-07-22] (Nitro Software, Inc. -> Nalpeiron Ltd.) R2 NWSAPAutoWorkstationUpdateSvc; C:\Program Files (x86)\SAP\SAPsetup\Setup\Updater\NwSapAutoWorkstationUpdateService.exe [197840 2015-12-27] (SAP SE -> SAP SE) R2 PEFService; C:\Program Files\Common Files\McAfee\PEF\CORE\PEFService.exe [1047448 2018-05-30] (McAfee, Inc. -> McAfee, Inc.) R2 RapiMgr; C:\WINDOWS\WindowsMobile\rapimgr.dll [225672 2007-05-31] (Microsoft Corporation -> Microsoft Corporation) R2 Sage 50 Accounts Control v24; C:\Program Files (x86)\Sage\AccountsServiceV24\sg50CtrlSvc_v24.exe [2831872 2018-05-15] (Sage (UK) Ltd.) [File not signed] R2 Sage 50 Accounts Service v24; C:\Program Files (x86)\Sage\AccountsServiceV24\sg50svc_v24.exe [4794368 2018-05-15] (Sage (UK) Ltd.) [File not signed] R2 Sage AutoUpdate Manager Service; C:\Program Files (x86)\Common Files\Sage\Central\AutoUpdateClient\Sage.Central.AutoUpdateManager.Service.exe [8192 2013-06-04] (Microsoft) [File not signed] R2 Sage AutoUpdate Manager Service v2; C:\Program Files (x86)\Common Files\Sage\Shared\AutoUpdateManager\v2\Sage.Central.AutoUpdateManager.Service.exe [8192 2017-10-12] (Sage UK Limited) [File not signed] R2 Sage SData Service; C:\Program Files (x86)\Common Files\Sage SData\Sage.SData.Service.exe [43008 2017-06-30] (Sage (UK) Limited) [File not signed] S3 Sense; C:\Program Files\Windows Defender Advanced Threat Protection\MsSense.exe [4737560 2019-02-16] (Microsoft Windows Publisher -> Microsoft Corporation) R2 SurfaceDtxService; C:\WINDOWS\system32\SurfaceDtxService.exe [91016 2017-11-01] (Microsoft Corporation -> Microsoft Corporation) R2 SurfaceUsbHubFwUpdateService; C:\WINDOWS\System32\SurfaceUsbHubFwUpdateService.exe [951056 2017-02-09] (Microsoft Corporation -> Microsoft Corporation) R2 TeamViewer; C:\Program Files (x86)\TeamViewer\TeamViewer_Service.exe [11791704 2019-03-18] (TeamViewer GmbH -> TeamViewer GmbH) R2 WcesComm; C:\WINDOWS\WindowsMobile\wcescomm.dll [443784 2007-05-31] (Microsoft Corporation -> Microsoft Corporation) S3 WdNisSvc; C:\Program Files\Windows Defender\NisSrv.exe [4403496 2019-01-09] (Microsoft Corporation -> Microsoft Corporation) S3 WinDefend; C:\Program Files\Windows Defender\MsMpEng.exe [107160 2019-02-16] (Microsoft Corporation -> Microsoft Corporation) S2 0312231538387431mcinstcleanup; C:\WINDOWS\TEMP\031223~1.EXE -cleanup -nolog [X] R2 NVDisplay.ContainerLocalSystem; "C:\Program Files\NVIDIA Corporation\Display.NvContainer\NVDisplay.Container.exe" -s NVDisplay.ContainerLocalSystem -f "C:\ProgramData\NVIDIA\NVDisplay.ContainerLocalSystem.log" -l 3 -d "C:\Program Files\NVIDIA Corporation\Display.NvContainer\plugins\LocalSystem" -r -p 30000 R2 NvTelemetryContainer; "C:\Program Files (x86)\NVIDIA Corporation\NvTelemetry\NvTelemetryContainer.exe" -s NvTelemetryContainer -f "C:\ProgramData\NVIDIA\NvTelemetryContainer.log" -l 3 -d "C:\Program Files (x86)\NVIDIA Corporation\NvTelemetry\plugins" -r ===================== Drivers (Whitelisted) ====================== (If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.) R3 cfwids; C:\WINDOWS\System32\drivers\cfwids.sys [77216 2018-05-16] (McAfee, Inc. -> McAfee, LLC) R3 CSI2HostControllerDriver; C:\WINDOWS\System32\drivers\CSI2HostControllerDriver.sys [114096 2018-03-20] (Microsoft Corporation -> Intel(R) Corporation) R1 ESProtectionDriver; C:\WINDOWS\system32\drivers\mbae64.sys [153328 2019-03-24] (Malwarebytes Corporation -> Malwarebytes) S3 HipShieldK; C:\WINDOWS\System32\drivers\HipShieldK.sys [226984 2018-05-02] (McAfee, Inc. -> McAfee, Inc.) R3 iacamera64; C:\WINDOWS\system32\DRIVERS\iacamera64.sys [2405296 2018-03-20] (Microsoft Corporation -> Intel(R) Corporation) R3 iactrllogic; C:\WINDOWS\System32\drivers\iactrllogic64.sys [182184 2018-03-20] (Microsoft Corporation -> Intel(R) Corporation) S3 iaLPSS2_GPIO2; C:\WINDOWS\System32\drivers\iaLPSS2_GPIO2.sys [83768 2016-01-29] (Intel Corporation - Embedded Subsystems and IP Blocks Group -> Windows (R) Win 7 DDK provider) R2 MBAMChameleon; C:\WINDOWS\System32\Drivers\MbamChameleon.sys [198512 2019-03-24] (Malwarebytes Corporation -> Malwarebytes) S0 MbamElam; C:\WINDOWS\System32\DRIVERS\MbamElam.sys [20936 2019-02-01] (Microsoft Windows Early Launch Anti-malware Publisher -> Malwarebytes) R3 MBAMFarflt; C:\WINDOWS\System32\DRIVERS\farflt.sys [127136 2019-03-26] (Malwarebytes Corporation -> Malwarebytes) R3 MBAMProtection; C:\WINDOWS\system32\DRIVERS\mbam.sys [73912 2019-03-26] (Malwarebytes Corporation -> Malwarebytes) R3 MBAMSwissArmy; C:\WINDOWS\System32\Drivers\mbamswissarmy.sys [274416 2019-03-26] (Malwarebytes Corporation -> Malwarebytes) R3 MBAMWebProtection; C:\WINDOWS\system32\DRIVERS\mwac.sys [114040 2019-03-26] (Malwarebytes Corporation -> Malwarebytes) R3 mfeaack; C:\WINDOWS\System32\drivers\mfeaack.sys [497568 2018-05-16] (McAfee, Inc. -> McAfee, LLC) R3 mfeavfk; C:\WINDOWS\System32\drivers\mfeavfk.sys [361888 2018-05-16] (McAfee, Inc. -> McAfee, LLC) U3 mfeavfk01; no ImagePath S0 mfeelamk; C:\WINDOWS\System32\drivers\mfeelamk.sys [83952 2018-05-16] (Microsoft Windows Early Launch Anti-malware Publisher -> McAfee, LLC) R3 mfefirek; C:\WINDOWS\System32\drivers\mfefirek.sys [533408 2018-05-16] (McAfee, Inc. -> McAfee, LLC) R0 mfehidk; C:\WINDOWS\System32\drivers\mfehidk.sys [954784 2018-05-16] (McAfee, Inc. -> McAfee, LLC) R3 mfencbdc; C:\WINDOWS\System32\DRIVERS\mfencbdc.sys [550288 2018-05-03] (McAfee, Inc. -> McAfee LLC.) S3 mfencrk; C:\WINDOWS\System32\DRIVERS\mfencrk.sys [108944 2018-05-03] (McAfee, Inc. -> McAfee LLC.) R3 mfeplk; C:\WINDOWS\System32\drivers\mfeplk.sys [115616 2018-05-16] (McAfee, Inc. -> McAfee, LLC) R0 mfewfpk; C:\WINDOWS\System32\drivers\mfewfpk.sys [252832 2018-05-16] (McAfee, Inc. -> McAfee, LLC) S3 MOSUMAC; C:\WINDOWS\System32\drivers\MOSUMAC.sys [57208 2014-04-02] (WDKTestCert Alex,130389727012273971 -> ASIX Electronics Corp.) R3 mrvlpcie8897; C:\WINDOWS\System32\drivers\mrvlpcie8897.sys [1079784 2018-06-08] (Microsoft Windows Hardware Compatibility Publisher -> Marvell Semiconductors Inc.) S3 Netaapl; C:\WINDOWS\System32\drivers\netaapl64.sys [23040 2015-11-05] (Microsoft Windows Hardware Compatibility Publisher -> Apple Inc.) R2 NPF_devolo; C:\WINDOWS\sysWOW64\drivers\npf_devolo.sys [36496 2017-02-20] (devolo AG -> Riverbed Technology, Inc.) R3 nvlddmkm; C:\WINDOWS\System32\DriverStore\FileRepository\nvmso.inf_amd64_8461c3207f0421af\nvlddmkm.sys [17545472 2018-04-26] (NVIDIA Corporation -> NVIDIA Corporation) R3 ov5693; C:\WINDOWS\System32\drivers\ov5693.sys [165816 2018-03-20] (Microsoft Corporation -> Intel(R) Corporation) R3 ov7251; C:\WINDOWS\System32\drivers\ov7251.sys [166832 2018-03-20] (Microsoft Corporation -> Intel Corporation) R3 ov8865; C:\WINDOWS\System32\drivers\ov8865.sys [164272 2018-03-20] (Microsoft Corporation -> Intel Corporation) R3 PTPFilter; C:\WINDOWS\System32\drivers\PTPFilter.sys [51032 2016-08-29] (WDKTestCert tguni.kim,130826319441063508 -> Samsung) S3 Ser2pl; C:\WINDOWS\system32\DRIVERS\ser2pl64.sys [191504 2015-10-07] (Microsoft Windows Hardware Compatibility Publisher -> Prolific Technology Inc.) S1 subvgaproduct64; C:\WINDOWS\System32\drivers\subvga64.sys [5120 2009-12-29] (Microsoft Windows Hardware Compatibility Publisher -> Windows (R) Win 7 DDK provider) S1 subvgaproductmirr64; C:\WINDOWS\System32\drivers\subvgamirr64.sys [5120 2009-12-29] (Microsoft Windows Hardware Compatibility Publisher -> Windows (R) Win 7 DDK provider) R3 supportdriver; C:\WINDOWS\System32\drivers\iaisp64.sys [44968 2018-03-20] (Microsoft Corporation -> Intel(R) Corporation) R3 SurfaceBaseIntegration; C:\WINDOWS\System32\drivers\SurfaceBaseIntegration.sys [59448 2015-09-25] (Microsoft Corporation -> Microsoft Corporation) R0 SurfaceUsbHubFwUpdate; C:\WINDOWS\System32\drivers\SurfaceUsbHubFwUpdate.sys [80144 2017-02-09] (Microsoft Corporation -> Microsoft Corporation) S3 USBAAPL64; C:\WINDOWS\System32\Drivers\usbaapl64.sys [54784 2015-11-05] (Microsoft Windows Hardware Compatibility Publisher -> Apple, Inc.) S3 usbezdisplay64; C:\WINDOWS\system32\drivers\usbezdisplay64.sys [31336 2009-09-26] (Actions Microelectronics Co.,Ltd. -> Windows (R) Codename Longhorn DDK provider) R3 VBoxNetAdp; C:\WINDOWS\system32\DRIVERS\VBoxNetAdp6.sys [216080 2019-01-28] (Oracle Corporation -> Oracle Corporation) R1 VBoxNetLwf; C:\WINDOWS\system32\DRIVERS\VBoxNetLwf.sys [227008 2019-01-28] (Oracle Corporation -> Oracle Corporation) S3 WdBoot; C:\WINDOWS\system32\drivers\WdBoot.sys [44616 2018-04-11] (Microsoft Windows Early Launch Anti-malware Publisher -> Microsoft Corporation) S3 WdFilter; C:\WINDOWS\system32\drivers\WdFilter.sys [331680 2018-04-11] (Microsoft Windows -> Microsoft Corporation) S3 WdNisDrv; C:\WINDOWS\System32\Drivers\WdNisDrv.sys [44032 2018-04-11] (Microsoft Windows -> Microsoft Corporation) ==================== NetSvcs (Whitelisted) =================== (If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.) ==================== One month (created) ======== (If an entry is included in the fixlist, the file/folder will be moved.) 2019-03-26 20:10 - 2019-03-26 20:11 - 000049466 _____ C:\Users\matth\Downloads\FRST.txt 2019-03-26 20:10 - 2019-03-26 20:10 - 000000000 ____D C:\FRST 2019-03-26 20:09 - 2019-03-26 20:09 - 007316688 _____ (Malwarebytes) C:\Users\matth\Downloads\AdwCleaner.exe 2019-03-26 20:07 - 2019-03-26 20:07 - 002434048 _____ (Farbar) C:\Users\matth\Downloads\FRST64.exe 2019-03-26 20:00 - 2019-03-26 20:00 - 000073912 _____ (Malwarebytes) C:\WINDOWS\system32\Drivers\mbam.sys 2019-03-26 19:58 - 2019-03-26 19:58 - 000274416 _____ (Malwarebytes) C:\WINDOWS\system32\Drivers\mbamswissarmy.sys 2019-03-26 19:58 - 2019-03-26 19:58 - 000127136 _____ (Malwarebytes) C:\WINDOWS\system32\Drivers\farflt.sys 2019-03-26 19:58 - 2019-03-26 19:58 - 000114040 _____ (Malwarebytes) C:\WINDOWS\system32\Drivers\mwac.sys 2019-03-26 19:23 - 2019-03-26 19:57 - 000000000 ____D C:\AdwCleaner 2019-03-26 19:21 - 2019-03-26 19:22 - 007316688 _____ (Malwarebytes) C:\Users\matth\Downloads\adwcleaner_7.2.7.0.exe 2019-03-25 07:28 - 2019-03-25 07:29 - 002739340 _____ C:\WINDOWS\Minidump\032519-12328-01.dmp 2019-03-24 15:35 - 2019-03-25 07:28 - 2576596509 _____ C:\WINDOWS\MEMORY.DMP 2019-03-24 15:35 - 2019-03-24 15:35 - 002801708 _____ C:\WINDOWS\Minidump\032419-14500-01.dmp 2019-03-24 10:07 - 2019-03-24 10:07 - 000210622 _____ C:\Users\matth\OneDrive\Documents\Matthew Saunders CV 051018.pdf 2019-03-24 05:06 - 2019-03-24 05:06 - 000198512 _____ (Malwarebytes) C:\WINDOWS\system32\Drivers\MbamChameleon.sys 2019-03-20 19:40 - 2019-03-20 19:40 - 000000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Dropbox 2019-03-20 18:30 - 2019-03-20 18:30 - 000001156 _____ C:\Users\Public\Desktop\Oracle VM VirtualBox.lnk 2019-03-20 18:30 - 2019-03-20 18:30 - 000000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Oracle VM VirtualBox 2019-03-20 18:26 - 2019-03-20 18:26 - 114463232 _____ (Oracle Corporation) C:\Users\matth\Downloads\VirtualBox-5.2.26-128414-Win.exe 2019-03-19 19:48 - 2019-03-19 19:48 - 000051024 _____ (Dropbox, Inc.) C:\WINDOWS\system32\DbxSvc.exe 2019-03-19 19:48 - 2019-03-19 19:48 - 000047800 _____ (Dropbox, Inc.) C:\WINDOWS\system32\Drivers\dbx-stable.sys 2019-03-19 19:48 - 2019-03-19 19:48 - 000047600 _____ (Dropbox, Inc.) C:\WINDOWS\system32\Drivers\dbx-dev.sys 2019-03-19 19:48 - 2019-03-19 19:48 - 000047600 _____ (Dropbox, Inc.) C:\WINDOWS\system32\Drivers\dbx-canary.sys 2019-03-19 19:47 - 2019-03-06 09:03 - 007519896 _____ (Microsoft Corporation) C:\WINDOWS\system32\Windows.Media.Protection.PlayReady.dll 2019-03-19 19:47 - 2019-03-06 08:44 - 025856512 _____ (Microsoft Corporation) C:\WINDOWS\system32\edgehtml.dll 2019-03-19 19:47 - 2019-03-06 08:36 - 022716928 _____ (Microsoft Corporation) C:\WINDOWS\system32\mshtml.dll 2019-03-19 19:47 - 2019-03-06 08:28 - 004937728 _____ (Microsoft Corporation) C:\WINDOWS\system32\wininet.dll 2019-03-19 19:47 - 2019-03-06 06:14 - 006568528 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\Windows.Media.Protection.PlayReady.dll 2019-03-19 19:47 - 2019-03-06 06:05 - 022018048 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\edgehtml.dll 2019-03-19 19:47 - 2019-03-06 05:49 - 004516352 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\wininet.dll 2019-03-19 19:47 - 2019-02-16 10:24 - 023862272 _____ (Microsoft Corporation) C:\WINDOWS\system32\Hydrogen.dll 2019-03-19 19:47 - 2019-02-16 10:22 - 019525120 _____ (Microsoft Corporation) C:\WINDOWS\system32\HologramCompositor.dll 2019-03-19 19:46 - 2019-03-06 15:39 - 000720536 _____ (Microsoft Corporation) C:\WINDOWS\system32\kernel32.dll 2019-03-19 19:46 - 2019-03-06 15:37 - 001616608 _____ (Microsoft Corporation) C:\WINDOWS\system32\sppobjs.dll 2019-03-19 19:46 - 2019-03-06 15:36 - 001047352 _____ (Microsoft Corporation) C:\WINDOWS\system32\ReAgent.dll 2019-03-19 19:46 - 2019-03-06 15:20 - 000064000 _____ (Microsoft Corporation) C:\WINDOWS\system32\iemigplugin.dll 2019-03-19 19:46 - 2019-03-06 15:19 - 000058368 _____ (Microsoft Corporation) C:\WINDOWS\system32\mf3216.dll 2019-03-19 19:46 - 2019-03-06 15:17 - 012730368 _____ (Microsoft Corporation) C:\WINDOWS\system32\ieframe.dll 2019-03-19 19:46 - 2019-03-06 15:17 - 000810496 _____ C:\WINDOWS\system32\MBR2GPT.EXE 2019-03-19 19:46 - 2019-03-06 15:17 - 000116736 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\bridge.sys 2019-03-19 19:46 - 2019-03-06 15:14 - 001180672 _____ (Microsoft Corporation) C:\WINDOWS\system32\localspl.dll 2019-03-19 19:46 - 2019-03-06 15:14 - 000522240 _____ (Microsoft Corporation) C:\WINDOWS\system32\winspool.drv 2019-03-19 19:46 - 2019-03-06 15:14 - 000488448 _____ (Microsoft Corporation) C:\WINDOWS\system32\werui.dll 2019-03-19 19:46 - 2019-03-06 15:13 - 004053504 _____ (Microsoft Corporation) C:\WINDOWS\system32\msi.dll 2019-03-19 19:46 - 2019-03-06 15:13 - 001856512 _____ (Microsoft Corporation) C:\WINDOWS\system32\msxml3.dll 2019-03-19 19:46 - 2019-03-06 15:13 - 001662976 _____ (Microsoft Corporation) C:\WINDOWS\system32\GdiPlus.dll 2019-03-19 19:46 - 2019-03-06 15:13 - 001364992 _____ (Microsoft Corporation) C:\WINDOWS\system32\bcastdvruserservice.dll 2019-03-19 19:46 - 2019-03-06 15:12 - 001180672 _____ (Microsoft Corporation) C:\WINDOWS\system32\reseteng.dll 2019-03-19 19:46 - 2019-03-06 12:18 - 000918032 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\ReAgent.dll 2019-03-19 19:46 - 2019-03-06 12:18 - 000607744 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\kernel32.dll 2019-03-19 19:46 - 2019-03-06 12:10 - 000044544 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\mf3216.dll 2019-03-19 19:46 - 2019-03-06 12:09 - 011919360 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\ieframe.dll 2019-03-19 19:46 - 2019-03-06 12:06 - 000425472 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\werui.dll 2019-03-19 19:46 - 2019-03-06 12:05 - 004054016 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\msi.dll 2019-03-19 19:46 - 2019-03-06 12:05 - 001586176 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\msxml3.dll 2019-03-19 19:46 - 2019-03-06 12:04 - 001471488 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\GdiPlus.dll 2019-03-19 19:46 - 2019-03-06 12:04 - 000423936 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\winspool.drv 2019-03-19 19:46 - 2019-03-06 11:59 - 001008640 _____ (Microsoft Corporation) C:\WINDOWS\system32\Windows.Media.MixedRealityCapture.dll 2019-03-19 19:46 - 2019-03-06 09:29 - 001035040 _____ (Microsoft Corporation) C:\WINDOWS\system32\ApplyTrustOffline.exe 2019-03-19 19:46 - 2019-03-06 09:16 - 002822456 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\dxgkrnl.sys 2019-03-19 19:46 - 2019-03-06 09:16 - 001457032 _____ (Microsoft Corporation) C:\WINDOWS\system32\winload.efi 2019-03-19 19:46 - 2019-03-06 09:16 - 001188000 _____ (Microsoft Corporation) C:\WINDOWS\system32\rpcrt4.dll 2019-03-19 19:46 - 2019-03-06 09:16 - 000776792 _____ (Microsoft Corporation) C:\WINDOWS\system32\wer.dll 2019-03-19 19:46 - 2019-03-06 09:16 - 000722744 _____ (Microsoft Corporation) C:\WINDOWS\system32\wimgapi.dll 2019-03-19 19:46 - 2019-03-06 09:16 - 000566568 _____ (Microsoft Corporation) C:\WINDOWS\system32\tcblaunch.exe 2019-03-19 19:46 - 2019-03-06 09:16 - 000527160 _____ (Microsoft Corporation) C:\WINDOWS\system32\wimserv.exe 2019-03-19 19:46 - 2019-03-06 09:11 - 000493880 _____ (Microsoft Corporation) C:\WINDOWS\system32\WerFault.exe 2019-03-19 19:46 - 2019-03-06 09:10 - 000248880 _____ (Microsoft Corporation) C:\WINDOWS\system32\weretw.dll 2019-03-19 19:46 - 2019-03-06 09:07 - 001219896 _____ (Microsoft Corporation) C:\WINDOWS\system32\hvix64.exe 2019-03-19 19:46 - 2019-03-06 09:07 - 001023800 _____ (Microsoft Corporation) C:\WINDOWS\system32\hvax64.exe 2019-03-19 19:46 - 2019-03-06 09:07 - 000376120 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\fastfat.sys 2019-03-19 19:46 - 2019-03-06 09:06 - 009084216 _____ (Microsoft Corporation) C:\WINDOWS\system32\ntoskrnl.exe 2019-03-19 19:46 - 2019-03-06 09:06 - 000134968 _____ (Microsoft Corporation) C:\WINDOWS\system32\hvloader.dll 2019-03-19 19:46 - 2019-03-06 09:06 - 000076088 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\hvservice.sys 2019-03-19 19:46 - 2019-03-06 09:05 - 000439224 _____ (Microsoft Corporation) C:\WINDOWS\system32\Faultrep.dll 2019-03-19 19:46 - 2019-03-06 09:05 - 000436240 _____ (Microsoft Corporation) C:\WINDOWS\system32\msv1_0.dll 2019-03-19 19:46 - 2019-03-06 09:05 - 000159864 _____ (Microsoft Corporation) C:\WINDOWS\system32\WerFaultSecure.exe 2019-03-19 19:46 - 2019-03-06 09:04 - 002765856 _____ (Microsoft Corporation) C:\WINDOWS\system32\iertutil.dll 2019-03-19 19:46 - 2019-03-06 09:04 - 000945464 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\refsv1.sys 2019-03-19 19:46 - 2019-03-06 09:04 - 000628024 _____ (Microsoft Corporation) C:\WINDOWS\system32\dpx.dll 2019-03-19 19:46 - 2019-03-06 09:03 - 002719544 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\tcpip.sys 2019-03-19 19:46 - 2019-03-06 09:03 - 002465784 _____ (Microsoft Corporation) C:\WINDOWS\system32\msxml6.dll 2019-03-19 19:46 - 2019-03-06 09:03 - 001921848 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\refs.sys 2019-03-19 19:46 - 2019-03-06 09:03 - 000793400 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\dxgmms2.sys 2019-03-19 19:46 - 2019-03-06 09:03 - 000412984 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\dxgmms1.sys 2019-03-19 19:46 - 2019-03-06 09:03 - 000375608 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\msrpc.sys 2019-03-19 19:46 - 2019-03-06 09:02 - 002421048 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\ntfs.sys 2019-03-19 19:46 - 2019-03-06 09:02 - 001257672 _____ (Microsoft Corporation) C:\WINDOWS\system32\winload.exe 2019-03-19 19:46 - 2019-03-06 09:02 - 001140480 _____ (Microsoft Corporation) C:\WINDOWS\system32\winresume.efi 2019-03-19 19:46 - 2019-03-06 09:02 - 000982912 _____ (Microsoft Corporation) C:\WINDOWS\system32\winresume.exe 2019-03-19 19:46 - 2019-03-06 09:02 - 000626488 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\afd.sys 2019-03-19 19:46 - 2019-03-06 08:36 - 004383744 _____ (Microsoft Corporation) C:\WINDOWS\system32\EdgeContent.dll 2019-03-19 19:46 - 2019-03-06 08:34 - 004866048 _____ (Microsoft Corporation) C:\WINDOWS\system32\jscript9.dll 2019-03-19 19:46 - 2019-03-06 08:33 - 000046080 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\hidparse.sys 2019-03-19 19:46 - 2019-03-06 08:32 - 003399168 _____ (Microsoft Corporation) C:\WINDOWS\system32\AppXDeploymentServer.dll 2019-03-19 19:46 - 2019-03-06 08:32 - 000358912 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\exfat.sys 2019-03-19 19:46 - 2019-03-06 08:32 - 000209408 _____ (Microsoft Corporation) C:\WINDOWS\system32\AppXApplicabilityBlob.dll 2019-03-19 19:46 - 2019-03-06 08:31 - 007598592 _____ (Microsoft Corporation) C:\WINDOWS\system32\Chakra.dll 2019-03-19 19:46 - 2019-03-06 08:31 - 002368512 _____ (Microsoft Corporation) C:\WINDOWS\system32\WebRuntimeManager.dll 2019-03-19 19:46 - 2019-03-06 08:31 - 001826816 _____ (Microsoft Corporation) C:\WINDOWS\system32\Windows.CloudStore.dll 2019-03-19 19:46 - 2019-03-06 08:31 - 000894464 _____ (Microsoft Corporation) C:\WINDOWS\system32\webplatstorageserver.dll 2019-03-19 19:46 - 2019-03-06 08:31 - 000808448 _____ (Microsoft Corporation) C:\WINDOWS\system32\EdgeManager.dll 2019-03-19 19:46 - 2019-03-06 08:31 - 000726528 _____ (Microsoft Corporation) C:\WINDOWS\system32\jscript9diag.dll 2019-03-19 19:46 - 2019-03-06 08:31 - 000353792 _____ (Microsoft Corporation) C:\WINDOWS\system32\dhcpcore.dll 2019-03-19 19:46 - 2019-03-06 08:31 - 000324608 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\udfs.sys 2019-03-19 19:46 - 2019-03-06 08:31 - 000279552 _____ (Microsoft Corporation) C:\WINDOWS\system32\dhcpcore6.dll 2019-03-19 19:46 - 2019-03-06 08:31 - 000266752 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\srvnet.sys 2019-03-19 19:46 - 2019-03-06 08:31 - 000154112 _____ (Microsoft Corporation) C:\WINDOWS\system32\Chakradiag.dll 2019-03-19 19:46 - 2019-03-06 08:29 - 002364928 _____ (Microsoft Corporation) C:\WINDOWS\system32\OpcServices.dll 2019-03-19 19:46 - 2019-03-06 08:29 - 002174976 _____ (Microsoft Corporation) C:\WINDOWS\system32\AppXDeploymentExtensions.onecore.dll 2019-03-19 19:46 - 2019-03-06 08:29 - 001559552 _____ (Microsoft Corporation) C:\WINDOWS\system32\AppXDeploymentExtensions.desktop.dll 2019-03-19 19:46 - 2019-03-06 08:29 - 000736256 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\srv2.sys 2019-03-19 19:46 - 2019-03-06 08:28 - 001803776 _____ (Microsoft Corporation) C:\WINDOWS\system32\urlmon.dll 2019-03-19 19:46 - 2019-03-06 08:27 - 002224640 _____ (Microsoft Corporation) C:\WINDOWS\system32\win32kbase.sys 2019-03-19 19:46 - 2019-03-06 08:27 - 000776192 _____ (Microsoft Corporation) C:\WINDOWS\system32\jscript.dll 2019-03-19 19:46 - 2019-03-06 08:27 - 000542720 _____ (Microsoft Corporation) C:\WINDOWS\system32\vbscript.dll 2019-03-19 19:46 - 2019-03-06 08:27 - 000507392 _____ (Microsoft Corporation) C:\WINDOWS\system32\edgeIso.dll 2019-03-19 19:46 - 2019-03-06 08:26 - 000868864 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\Windows.Media.MixedRealityCapture.dll 2019-03-19 19:46 - 2019-03-06 08:26 - 000073216 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\npfs.sys 2019-03-19 19:46 - 2019-03-06 08:26 - 000031232 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\msfs.sys 2019-03-19 19:46 - 2019-03-06 08:25 - 000093696 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\cdfs.sys 2019-03-19 19:46 - 2019-03-06 07:08 - 000001310 _____ C:\WINDOWS\system32\tcbres.wim 2019-03-19 19:46 - 2019-03-06 06:17 - 001989040 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\msxml6.dll 2019-03-19 19:46 - 2019-03-06 06:17 - 000146712 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\WerFaultSecure.exe 2019-03-19 19:46 - 2019-03-06 06:15 - 002253488 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\iertutil.dll 2019-03-19 19:46 - 2019-03-06 06:15 - 000434488 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\WerFault.exe 2019-03-19 19:46 - 2019-03-06 06:14 - 000785568 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\rpcrt4.dll 2019-03-19 19:46 - 2019-03-06 06:14 - 000665224 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\wer.dll 2019-03-19 19:46 - 2019-03-06 06:14 - 000450872 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\dpx.dll 2019-03-19 19:46 - 2019-03-06 06:14 - 000380728 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\msv1_0.dll 2019-03-19 19:46 - 2019-03-06 06:13 - 000607248 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\wimgapi.dll 2019-03-19 19:46 - 2019-03-06 05:56 - 019404288 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\mshtml.dll 2019-03-19 19:46 - 2019-03-06 05:53 - 005307392 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\d2d1.dll 2019-03-19 19:46 - 2019-03-06 05:53 - 003711488 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\jscript9.dll 2019-03-19 19:46 - 2019-03-06 05:52 - 005790720 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\Chakra.dll 2019-03-19 19:46 - 2019-03-06 05:52 - 000608768 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\EdgeManager.dll 2019-03-19 19:46 - 2019-03-06 05:52 - 000261632 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\dhcpcore6.dll 2019-03-19 19:46 - 2019-03-06 05:51 - 000561152 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\jscript9diag.dll 2019-03-19 19:46 - 2019-03-06 05:51 - 000333824 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\edgeIso.dll 2019-03-19 19:46 - 2019-03-06 05:51 - 000032768 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\werdiagcontroller.dll 2019-03-19 19:46 - 2019-03-06 05:50 - 001628160 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\urlmon.dll 2019-03-19 19:46 - 2019-03-06 05:50 - 001347584 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\OpcServices.dll 2019-03-19 19:46 - 2019-03-06 05:50 - 000578560 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\webplatstorageserver.dll 2019-03-19 19:46 - 2019-03-06 05:49 - 000318464 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\dhcpcore.dll 2019-03-19 19:46 - 2019-03-06 05:49 - 000251904 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\msIso.dll 2019-03-19 19:46 - 2019-03-06 05:48 - 000669696 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\jscript.dll 2019-03-19 19:46 - 2019-03-06 05:48 - 000533504 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\vbscript.dll 2019-03-19 19:46 - 2019-02-21 03:26 - 000313344 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\msrd2x40.dll 2019-03-19 19:46 - 2019-02-16 13:02 - 002871304 _____ (Microsoft Corporation) C:\WINDOWS\system32\aitstatic.exe 2019-03-19 19:46 - 2019-02-16 13:02 - 001644040 _____ (Microsoft Corporation) C:\WINDOWS\system32\appraiser.dll 2019-03-19 19:46 - 2019-02-16 13:02 - 000808456 _____ (Microsoft Corporation) C:\WINDOWS\system32\generaltel.dll 2019-03-19 19:46 - 2019-02-16 13:02 - 000735752 _____ (Microsoft Corporation) C:\WINDOWS\system32\aeinv.dll 2019-03-19 19:46 - 2019-02-16 13:02 - 000620040 _____ (Microsoft Corporation) C:\WINDOWS\system32\devinv.dll 2019-03-19 19:46 - 2019-02-16 13:02 - 000460296 _____ (Microsoft Corporation) C:\WINDOWS\system32\invagent.dll 2019-03-19 19:46 - 2019-02-16 13:02 - 000322568 _____ (Microsoft Corporation) C:\WINDOWS\system32\acmigration.dll 2019-03-19 19:46 - 2019-02-16 13:02 - 000147464 _____ (Microsoft Corporation) C:\WINDOWS\system32\CompatTelRunner.exe 2019-03-19 19:46 - 2019-02-16 13:02 - 000071176 _____ (Microsoft Corporation) C:\WINDOWS\system32\win32appinventorycsp.dll 2019-03-19 19:46 - 2019-02-16 12:57 - 002266936 _____ (Microsoft Corporation) C:\WINDOWS\system32\AppVEntSubsystems64.dll 2019-03-19 19:46 - 2019-02-16 12:57 - 001786672 _____ (Microsoft Corporation) C:\WINDOWS\system32\AppVEntVirtualization.dll 2019-03-19 19:46 - 2019-02-16 12:57 - 001627448 _____ (Microsoft Corporation) C:\WINDOWS\system32\AppVIntegration.dll 2019-03-19 19:46 - 2019-02-16 12:57 - 001424696 _____ (Microsoft Corporation) C:\WINDOWS\system32\AppVEntSubsystemController.dll 2019-03-19 19:46 - 2019-02-16 12:57 - 001048472 _____ (Microsoft Corporation) C:\WINDOWS\system32\Windows.Internal.Shell.Broker.dll 2019-03-19 19:46 - 2019-02-16 12:57 - 001038136 _____ (Microsoft Corporation) C:\WINDOWS\system32\AppVPolicy.dll 2019-03-19 19:46 - 2019-02-16 12:57 - 000954168 _____ (Microsoft Corporation) C:\WINDOWS\system32\AppVManifest.dll 2019-03-19 19:46 - 2019-02-16 12:57 - 000830264 _____ (Microsoft Corporation) C:\WINDOWS\system32\AppVOrchestration.dll 2019-03-19 19:46 - 2019-02-16 12:57 - 000825144 _____ (Microsoft Corporation) C:\WINDOWS\system32\AppVEntStreamingManager.dll 2019-03-19 19:46 - 2019-02-16 12:57 - 000749880 _____ (Microsoft Corporation) C:\WINDOWS\system32\AppVReporting.dll 2019-03-19 19:46 - 2019-02-16 12:57 - 000670008 _____ (Microsoft Corporation) C:\WINDOWS\system32\AppVCatalog.dll 2019-03-19 19:46 - 2019-02-16 12:57 - 000652088 _____ (Microsoft Corporation) C:\WINDOWS\system32\AppVPublishing.dll 2019-03-19 19:46 - 2019-02-16 12:57 - 000506088 _____ (Microsoft Corporation) C:\WINDOWS\system32\systemreset.exe 2019-03-19 19:46 - 2019-02-16 12:57 - 000495416 _____ (Microsoft Corporation) C:\WINDOWS\system32\TransportDSA.dll 2019-03-19 19:46 - 2019-02-16 12:57 - 000399672 _____ (Microsoft Corporation) C:\WINDOWS\system32\AppVScripting.dll 2019-03-19 19:46 - 2019-02-16 12:57 - 000257848 _____ (Microsoft Corporation) C:\WINDOWS\system32\AppVFileSystemMetadata.dll 2019-03-19 19:46 - 2019-02-16 12:57 - 000231224 _____ (Microsoft Corporation) C:\WINDOWS\system32\AppVShNotify.exe 2019-03-19 19:46 - 2019-02-16 12:57 - 000228152 _____ (Microsoft Corporation) C:\WINDOWS\system32\AppVStreamMap.dll 2019-03-19 19:46 - 2019-02-16 12:57 - 000201528 _____ (Microsoft Corporation) C:\WINDOWS\system32\AppVStreamingUX.dll 2019-03-19 19:46 - 2019-02-16 12:57 - 000183608 _____ (Microsoft Corporation) C:\WINDOWS\system32\mavinject.exe 2019-03-19 19:46 - 2019-02-16 12:57 - 000180528 _____ (Microsoft Corporation) C:\WINDOWS\system32\AppVDllSurrogate.exe 2019-03-19 19:46 - 2019-02-16 12:57 - 000172856 _____ (Microsoft Corporation) C:\WINDOWS\system32\AppVNice.exe 2019-03-19 19:46 - 2019-02-16 12:57 - 000034104 _____ C:\WINDOWS\system32\SyncAppvPublishingServer.exe 2019-03-19 19:46 - 2019-02-16 12:56 - 000549520 _____ (Microsoft Corporation) C:\WINDOWS\system32\AppResolver.dll 2019-03-19 19:46 - 2019-02-16 12:56 - 000540984 _____ (Microsoft Corporation) C:\WINDOWS\system32\pcasvc.dll 2019-03-19 19:46 - 2019-02-16 12:53 - 001516416 _____ (Microsoft Corporation) C:\WINDOWS\system32\msctf.dll 2019-03-19 19:46 - 2019-02-16 12:36 - 000127488 _____ (Microsoft Corporation) C:\WINDOWS\system32\AppxSysprep.dll 2019-03-19 19:46 - 2019-02-16 12:34 - 004718080 _____ (Microsoft Corporation) C:\WINDOWS\system32\twinui.pcshell.dll 2019-03-19 19:46 - 2019-02-16 12:34 - 001725952 _____ (Microsoft Corporation) C:\WINDOWS\system32\Windows.UI.Immersive.dll 2019-03-19 19:46 - 2019-02-16 12:34 - 000302080 _____ (Microsoft Corporation) C:\WINDOWS\system32\AcLayers.dll 2019-03-19 19:46 - 2019-02-16 12:33 - 002194432 _____ (Microsoft Corporation) C:\WINDOWS\system32\Microsoft.Uev.ModernAppAgent.dll 2019-03-19 19:46 - 2019-02-16 12:33 - 001786880 _____ (Microsoft Corporation) C:\WINDOWS\system32\wsp_health.dll 2019-03-19 19:46 - 2019-02-16 12:32 - 003646976 _____ (Microsoft Corporation) C:\WINDOWS\system32\win32kfull.sys 2019-03-19 19:46 - 2019-02-16 12:32 - 002051072 _____ (Microsoft Corporation) C:\WINDOWS\system32\wsp_fs.dll 2019-03-19 19:46 - 2019-02-16 12:32 - 001127936 _____ (Microsoft Corporation) C:\WINDOWS\system32\ApplySettingsTemplateCatalog.exe 2019-03-19 19:46 - 2019-02-16 12:31 - 001271808 _____ (Microsoft Corporation) C:\WINDOWS\system32\gpsvc.dll 2019-03-19 19:46 - 2019-02-16 12:31 - 001186816 _____ (Microsoft Corporation) C:\WINDOWS\system32\Microsoft.Uev.CommonBridge.dll 2019-03-19 19:46 - 2019-02-16 12:31 - 001003520 _____ (Microsoft Corporation) C:\WINDOWS\system32\clusapi.dll 2019-03-19 19:46 - 2019-02-16 12:31 - 000861184 _____ (Microsoft Corporation) C:\WINDOWS\system32\mprddm.dll 2019-03-19 19:46 - 2019-02-16 12:31 - 000615424 _____ (Microsoft Corporation) C:\WINDOWS\system32\resutils.dll 2019-03-19 19:46 - 2019-02-16 12:30 - 002019840 _____ (Microsoft Corporation) C:\WINDOWS\system32\ResetEngine.dll 2019-03-19 19:46 - 2019-02-16 12:30 - 000877568 _____ (Microsoft Corporation) C:\WINDOWS\system32\RecoveryDrive.exe 2019-03-19 19:46 - 2019-02-16 12:29 - 000174080 _____ (Microsoft Corporation) C:\WINDOWS\system32\ResetEngOnline.dll 2019-03-19 19:46 - 2019-02-16 12:29 - 000091136 _____ (Microsoft Corporation) C:\WINDOWS\system32\mcbuilder.exe 2019-03-19 19:46 - 2019-02-16 12:25 - 001539896 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\AppVEntSubsystems32.dll 2019-03-19 19:46 - 2019-02-16 12:25 - 000148784 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\mavinject.exe 2019-03-19 19:46 - 2019-02-16 12:24 - 000444176 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\AppResolver.dll 2019-03-19 19:46 - 2019-02-16 12:22 - 001322176 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\msctf.dll 2019-03-19 19:46 - 2019-02-16 12:08 - 000373760 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\AcLayers.dll 2019-03-19 19:46 - 2019-02-16 12:07 - 001307648 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\wsp_health.dll 2019-03-19 19:46 - 2019-02-16 12:07 - 000484352 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\resutils.dll 2019-03-19 19:46 - 2019-02-16 12:06 - 002890752 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\win32kfull.sys 2019-03-19 19:46 - 2019-02-16 12:06 - 001530880 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\Windows.UI.Immersive.dll 2019-03-19 19:46 - 2019-02-16 12:06 - 001451520 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\wsp_fs.dll 2019-03-19 19:46 - 2019-02-16 12:06 - 000774656 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\clusapi.dll 2019-03-19 19:46 - 2019-02-16 12:06 - 000765952 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\mprddm.dll 2019-03-19 19:46 - 2019-02-16 12:04 - 000080384 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\mcbuilder.exe 2019-03-19 19:46 - 2019-02-16 12:02 - 000055808 _____ (Microsoft Corporation) C:\WINDOWS\system32\UevAppMonitor.exe 2019-03-19 19:46 - 2019-02-16 11:55 - 000070656 _____ (Microsoft Corporation) C:\WINDOWS\system32\Microsoft.Uev.Common.dll 2019-03-19 19:46 - 2019-02-16 08:16 - 000511800 _____ (Microsoft Corporation) C:\WINDOWS\system32\aepic.dll 2019-03-19 19:46 - 2019-02-16 08:15 - 000505656 _____ (Microsoft Corporation) C:\WINDOWS\system32\dcntel.dll 2019-03-19 19:46 - 2019-02-16 08:15 - 000035640 _____ (Microsoft Corporation) C:\WINDOWS\system32\DeviceCensus.exe 2019-03-19 19:46 - 2019-02-16 08:05 - 000087800 _____ (Microsoft Corporation) C:\WINDOWS\system32\taskhostw.exe 2019-03-19 19:46 - 2019-02-16 08:04 - 000193032 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\appid.sys 2019-03-19 19:46 - 2019-02-16 08:03 - 007901392 _____ (Microsoft Corporation) C:\WINDOWS\system32\d3d10warp.dll 2019-03-19 19:46 - 2019-02-16 08:03 - 005625360 _____ (Microsoft Corporation) C:\WINDOWS\system32\StartTileData.dll 2019-03-19 19:46 - 2019-02-16 08:03 - 000510288 _____ (Microsoft Corporation) C:\WINDOWS\system32\policymanager.dll 2019-03-19 19:46 - 2019-02-16 08:02 - 005821440 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\d3d10warp.dll 2019-03-19 19:46 - 2019-02-16 08:02 - 003291632 _____ (Microsoft Corporation) C:\WINDOWS\system32\combase.dll 2019-03-19 19:46 - 2019-02-16 08:02 - 001934800 _____ (Microsoft Corporation) C:\WINDOWS\system32\AudioEng.dll 2019-03-19 19:46 - 2019-02-16 08:02 - 001792712 _____ (Microsoft Corporation) C:\WINDOWS\system32\propsys.dll 2019-03-19 19:46 - 2019-02-16 08:02 - 000705848 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\vhdmp.sys 2019-03-19 19:46 - 2019-02-16 08:02 - 000432952 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\rdbss.sys 2019-03-19 19:46 - 2019-02-16 08:02 - 000413712 _____ (Microsoft Corporation) C:\WINDOWS\system32\AUDIOKSE.dll 2019-03-19 19:46 - 2019-02-16 08:01 - 001285424 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\ndis.sys 2019-03-19 19:46 - 2019-02-16 08:01 - 001209696 _____ (Microsoft Corporation) C:\WINDOWS\system32\AudioSes.dll 2019-03-19 19:46 - 2019-02-16 08:01 - 001098056 _____ (Microsoft Corporation) C:\WINDOWS\system32\msvproc.dll 2019-03-19 19:46 - 2019-02-16 08:01 - 001028920 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\http.sys 2019-03-19 19:46 - 2019-02-16 08:01 - 001014344 _____ (Microsoft Corporation) C:\WINDOWS\system32\ucrtbase.dll 2019-03-19 19:46 - 2019-02-16 08:01 - 000735464 _____ (Microsoft Corporation) C:\WINDOWS\system32\AppXDeploymentClient.dll 2019-03-19 19:46 - 2019-02-16 08:01 - 000641984 _____ (Microsoft Corporation) C:\WINDOWS\system32\msvcp_win.dll 2019-03-19 19:46 - 2019-02-16 08:01 - 000594024 _____ (Microsoft Corporation) C:\WINDOWS\system32\audiodg.exe 2019-03-19 19:46 - 2019-02-16 08:01 - 000527160 _____ (Microsoft Corporation) C:\WINDOWS\system32\hal.dll 2019-03-19 19:46 - 2019-02-16 08:01 - 000480840 _____ (Microsoft Corporation) C:\WINDOWS\system32\ucrtbase_enclave.dll 2019-03-19 19:46 - 2019-02-16 08:01 - 000335672 _____ (Microsoft Corporation) C:\WINDOWS\system32\moshostcore.dll 2019-03-19 19:46 - 2019-02-16 08:01 - 000161664 _____ (Microsoft Corporation) C:\WINDOWS\system32\RTWorkQ.dll 2019-03-19 19:46 - 2019-02-16 07:57 - 000383288 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\aepic.dll 2019-03-19 19:46 - 2019-02-16 07:53 - 000443632 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\policymanager.dll 2019-03-19 19:46 - 2019-02-16 07:51 - 002479168 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\combase.dll 2019-03-19 19:46 - 2019-02-16 07:51 - 001584536 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\propsys.dll 2019-03-19 19:46 - 2019-02-16 07:51 - 000170952 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\RTWorkQ.dll 2019-03-19 19:46 - 2019-02-16 07:50 - 001805648 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\AudioEng.dll 2019-03-19 19:46 - 2019-02-16 07:50 - 001171336 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\ucrtbase.dll 2019-03-19 19:46 - 2019-02-16 07:50 - 001130568 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\msvproc.dll 2019-03-19 19:46 - 2019-02-16 07:50 - 001011872 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\AudioSes.dll 2019-03-19 19:46 - 2019-02-16 07:50 - 000560384 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\AppXDeploymentClient.dll 2019-03-19 19:46 - 2019-02-16 07:50 - 000504072 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\msvcp_win.dll 2019-03-19 19:46 - 2019-02-16 07:37 - 009084928 _____ (Microsoft Corporation) C:\WINDOWS\system32\BingMaps.dll 2019-03-19 19:46 - 2019-02-16 07:36 - 007057408 _____ (Microsoft Corporation) C:\WINDOWS\system32\mos.dll 2019-03-19 19:46 - 2019-02-16 07:36 - 000144384 _____ (Microsoft Corporation) C:\WINDOWS\system32\fcon.dll 2019-03-19 19:46 - 2019-02-16 07:35 - 008188928 _____ (Microsoft Corporation) C:\WINDOWS\system32\Windows.Data.Pdf.dll 2019-03-19 19:46 - 2019-02-16 07:35 - 006661632 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\Windows.Data.Pdf.dll 2019-03-19 19:46 - 2019-02-16 07:34 - 005883904 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\mos.dll 2019-03-19 19:46 - 2019-02-16 07:34 - 000095232 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\UserDataTimeUtil.dll 2019-03-19 19:46 - 2019-02-16 07:34 - 000002560 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\tzres.dll 2019-03-19 19:46 - 2019-02-16 07:33 - 006646784 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\BingMaps.dll 2019-03-19 19:46 - 2019-02-16 07:33 - 004708864 _____ (Microsoft Corporation) C:\WINDOWS\system32\cdp.dll 2019-03-19 19:46 - 2019-02-16 07:33 - 000119808 _____ (Microsoft Corporation) C:\WINDOWS\system32\UserDataTimeUtil.dll 2019-03-19 19:46 - 2019-02-16 07:33 - 000054272 _____ (Microsoft Corporation) C:\WINDOWS\system32\CredentialMigrationHandler.dll 2019-03-19 19:46 - 2019-02-16 07:33 - 000043520 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\CredentialMigrationHandler.dll 2019-03-19 19:46 - 2019-02-16 07:33 - 000002560 _____ (Microsoft Corporation) C:\WINDOWS\system32\tzres.dll 2019-03-19 19:46 - 2019-02-16 07:32 - 002969088 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\cdp.dll 2019-03-19 19:46 - 2019-02-16 07:32 - 000173568 _____ (Microsoft Corporation) C:\WINDOWS\system32\EnterpriseModernAppMgmtCSP.dll 2019-03-19 19:46 - 2019-02-16 07:31 - 002825728 _____ (Microsoft Corporation) C:\WINDOWS\system32\MapGeocoder.dll 2019-03-19 19:46 - 2019-02-16 07:31 - 000392704 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\MapConfiguration.dll 2019-03-19 19:46 - 2019-02-16 07:31 - 000141312 _____ (Microsoft Corporation) C:\WINDOWS\system32\AppointmentActivation.dll 2019-03-19 19:46 - 2019-02-16 07:31 - 000126976 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\srpapi.dll 2019-03-19 19:46 - 2019-02-16 07:30 - 002449408 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\MapRouter.dll 2019-03-19 19:46 - 2019-02-16 07:30 - 001986560 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\MapGeocoder.dll 2019-03-19 19:46 - 2019-02-16 07:30 - 001124352 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\cdprt.dll 2019-03-19 19:46 - 2019-02-16 07:30 - 000530432 _____ (Microsoft Corporation) C:\WINDOWS\system32\MapConfiguration.dll 2019-03-19 19:46 - 2019-02-16 07:30 - 000357888 _____ (Microsoft Corporation) C:\WINDOWS\system32\AppLockerCSP.dll 2019-03-19 19:46 - 2019-02-16 07:30 - 000254464 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\AppLockerCSP.dll 2019-03-19 19:46 - 2019-02-16 07:30 - 000145920 _____ (Microsoft Corporation) C:\WINDOWS\system32\srpapi.dll 2019-03-19 19:46 - 2019-02-16 07:29 - 001768448 _____ (Microsoft Corporation) C:\WINDOWS\system32\audiosrv.dll 2019-03-19 19:46 - 2019-02-16 07:29 - 000304128 _____ (Microsoft Corporation) C:\WINDOWS\system32\domgmt.dll 2019-03-19 19:46 - 2019-02-16 07:28 - 003381248 _____ (Microsoft Corporation) C:\WINDOWS\system32\MapRouter.dll 2019-03-19 19:46 - 2019-02-16 07:28 - 002585600 _____ (Microsoft Corporation) C:\WINDOWS\system32\wlansvc.dll 2019-03-19 19:46 - 2019-02-16 07:28 - 001668096 _____ (Microsoft Corporation) C:\WINDOWS\system32\cdprt.dll 2019-03-19 19:46 - 2019-02-16 07:28 - 000713216 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\BingOnlineServices.dll 2019-03-19 19:46 - 2019-02-16 07:28 - 000705024 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\MapControlCore.dll 2019-03-19 19:46 - 2019-02-16 07:28 - 000528384 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\ActivationManager.dll 2019-03-19 19:46 - 2019-02-16 07:27 - 001364992 _____ (Microsoft Corporation) C:\WINDOWS\system32\lpasvc.dll 2019-03-19 19:46 - 2019-02-16 07:27 - 000729088 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\NMAA.dll 2019-03-19 19:46 - 2019-02-16 07:27 - 000686592 _____ (Microsoft Corporation) C:\WINDOWS\system32\AudioEndpointBuilder.dll 2019-03-19 19:46 - 2019-02-16 07:26 - 001459712 _____ (Microsoft Corporation) C:\WINDOWS\system32\dosvc.dll 2019-03-19 19:46 - 2019-02-16 07:26 - 001225216 _____ (Microsoft Corporation) C:\WINDOWS\system32\MapsStore.dll 2019-03-19 19:46 - 2019-02-16 07:26 - 000943616 _____ (Microsoft Corporation) C:\WINDOWS\system32\BingOnlineServices.dll 2019-03-19 19:46 - 2019-02-16 07:26 - 000935424 _____ (Microsoft Corporation) C:\WINDOWS\system32\rasmans.dll 2019-03-19 19:46 - 2019-02-16 07:26 - 000401920 _____ (Microsoft Corporation) C:\WINDOWS\system32\rascustom.dll 2019-03-19 19:46 - 2019-02-16 07:25 - 000884224 _____ (Microsoft Corporation) C:\WINDOWS\system32\NMAA.dll 2019-03-19 19:46 - 2019-02-16 07:25 - 000652800 _____ (Microsoft Corporation) C:\WINDOWS\system32\ActivationManager.dll 2019-03-19 19:29 - 2019-03-19 19:40 - 573980852 _____ C:\Users\matth\Downloads\linuxmint-19.1-cinnamon-64bit.iso 2019-03-19 19:25 - 2019-03-19 19:25 - 000002500 _____ C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Word.lnk 2019-03-19 19:25 - 2019-03-19 19:25 - 000002499 _____ C:\ProgramData\Microsoft\Windows\Start Menu\Programs\PowerPoint.lnk 2019-03-19 19:25 - 2019-03-19 19:25 - 000002463 _____ C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Access.lnk 2019-03-19 19:25 - 2019-03-19 19:25 - 000002462 _____ C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Excel.lnk 2019-03-19 19:25 - 2019-03-19 19:25 - 000002456 _____ C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Outlook.lnk 2019-03-19 19:25 - 2019-03-19 19:25 - 000002450 _____ C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Publisher.lnk 2019-03-19 19:25 - 2019-03-19 19:25 - 000000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Microsoft Office Tools 2019-03-19 19:06 - 2019-03-19 19:06 - 000001413 _____ C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Adobe Creative Cloud.lnk 2019-03-19 19:06 - 2019-03-19 19:06 - 000001401 _____ C:\Users\Public\Desktop\Adobe Creative Cloud.lnk 2019-03-02 16:45 - 2019-03-02 16:45 - 000002019 _____ C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Nitro Pro 10.lnk 2019-03-02 16:45 - 2019-03-02 16:45 - 000002007 _____ C:\Users\Public\Desktop\Nitro Pro 10.lnk 2019-03-02 16:45 - 2019-03-02 16:45 - 000000000 ____D C:\Program Files\Nitro 2019-03-02 16:45 - 2019-03-02 16:45 - 000000000 ____D C:\Program Files\Common Files\Nitro 2019-03-02 16:45 - 2019-03-02 16:45 - 000000000 ____D C:\Program Files (x86)\Nitro 2019-03-02 16:45 - 2016-07-22 17:26 - 000031896 _____ (Nitro Software, Inc.) C:\WINDOWS\system32\nitrolocalmon10.dll 2019-03-02 16:45 - 2016-07-22 17:26 - 000020120 _____ (Nitro Software, Inc.) C:\WINDOWS\system32\nitrolocalui10.dll 2019-03-02 16:43 - 2019-03-02 16:43 - 000000000 ____D C:\Users\matth\AppData\Roaming\Downloaded Installations 2019-03-02 15:33 - 2019-03-02 15:33 - 000000000 ____D C:\Users\matth\AppData\Roaming\Nitro 2019-03-02 15:33 - 2019-03-02 15:33 - 000000000 ____D C:\ProgramData\Nitro 2019-03-02 15:33 - 2018-01-06 01:50 - 000749664 _____ (Nitro Software, Inc.) C:\WINDOWS\system32\NxPrinterMonitor11.dll ==================== One month (modified) ======== (If an entry is included in the fixlist, the file/folder will be moved.) 2019-03-26 20:06 - 2018-05-21 09:12 - 000969288 _____ C:\WINDOWS\system32\PerfStringBackup.INI 2019-03-26 20:06 - 2018-04-11 23:36 - 000000000 ____D C:\WINDOWS\INF 2019-03-26 20:05 - 2018-04-11 23:38 - 000000000 ____D C:\WINDOWS\AppReadiness 2019-03-26 19:59 - 2019-02-09 15:57 - 000000000 ____D C:\Users\matth\AppData\Local\OXSTORE2 2019-03-26 19:59 - 2018-08-24 13:50 - 000000000 ____D C:\Program Files (x86)\Steam 2019-03-26 19:59 - 2016-05-21 06:31 - 000000000 ___RD C:\Users\matth\Dropbox 2019-03-26 19:59 - 2016-05-17 15:15 - 000000000 ___RD C:\Users\matth\Creative Cloud Files 2019-03-26 19:59 - 2016-05-17 14:42 - 000000000 ____D C:\Users\matth\AppData\Local\Adobe 2019-03-26 19:59 - 2016-05-17 11:29 - 000000000 ___RD C:\Users\matth\OneDrive 2019-03-26 19:58 - 2018-05-21 09:26 - 000000006 ____H C:\WINDOWS\Tasks\SA.DAT 2019-03-26 19:58 - 2018-04-11 23:38 - 000000000 ____D C:\WINDOWS\system32\WinBioDatabase 2019-03-26 19:58 - 2018-04-11 23:38 - 000000000 ____D C:\ProgramData\regid.1991-06.com.microsoft 2019-03-26 19:58 - 2018-04-11 21:04 - 001310720 _____ C:\WINDOWS\system32\config\BBI 2019-03-26 19:58 - 2018-04-11 21:04 - 000032768 _____ C:\WINDOWS\system32\config\ELAM 2019-03-26 19:58 - 2017-06-15 10:34 - 000041448 _____ C:\WINDOWS\system32\OV5693_FRONT.aiqd 2019-03-26 19:58 - 2017-05-17 17:14 - 000000000 ____D C:\ProgramData\NVIDIA 2019-03-26 19:58 - 2016-08-07 07:26 - 000041448 _____ C:\WINDOWS\system32\OV7251_FRONT.aiqd 2019-03-26 19:58 - 2016-05-18 08:47 - 000000000 ____D C:\Program Files (x86)\TeamViewer 2019-03-26 19:51 - 2018-05-21 09:10 - 000000000 ____D C:\WINDOWS\system32\SleepStudy 2019-03-26 18:18 - 2018-04-11 23:38 - 000000000 ___HD C:\Program Files\WindowsApps 2019-03-26 18:16 - 2018-02-15 10:41 - 000002308 _____ C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Google Chrome.lnk 2019-03-26 18:16 - 2018-02-15 10:41 - 000002267 _____ C:\Users\Public\Desktop\Google Chrome.lnk 2019-03-26 18:11 - 2018-05-21 09:17 - 000000000 ____D C:\Users\matth 2019-03-25 07:28 - 2018-06-01 15:21 - 000000000 ____D C:\WINDOWS\Minidump 2019-03-24 20:04 - 2018-08-17 08:42 - 000000000 ___HD C:\OneDriveTemp 2019-03-24 20:01 - 2017-05-17 17:13 - 000000000 ____D C:\WINDOWS\Firmware 2019-03-24 10:08 - 2016-05-17 11:27 - 000000000 ____D C:\Users\matth\AppData\Roaming\Adobe 2019-03-24 10:07 - 2016-05-18 09:32 - 000000000 ____D C:\Users\matth\AppData\LocalLow\Adobe 2019-03-24 10:07 - 2016-05-17 15:42 - 000000000 ____D C:\ProgramData\regid.1986-12.com.adobe 2019-03-24 05:06 - 2019-02-23 19:06 - 000153328 _____ (Malwarebytes) C:\WINDOWS\system32\Drivers\mbae64.sys 2019-03-23 11:37 - 2017-05-22 18:45 - 000000000 ____D C:\Users\matth\.VirtualBox 2019-03-22 17:42 - 2018-05-21 09:26 - 000004396 _____ C:\WINDOWS\System32\Tasks\Open URL by RoboForm 2019-03-22 17:42 - 2018-05-21 09:26 - 000003800 _____ C:\WINDOWS\System32\Tasks\Run RoboForm TaskBar Icon 2019-03-22 17:42 - 2016-05-17 14:18 - 000000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\RoboForm 2019-03-21 22:15 - 2018-04-11 23:38 - 000000000 ____D C:\WINDOWS\LiveKernelReports 2019-03-20 19:41 - 2018-01-13 04:56 - 000000000 ____D C:\Program Files\rempl 2019-03-20 19:40 - 2016-05-21 06:25 - 000000000 ____D C:\Program Files (x86)\Dropbox 2019-03-20 19:35 - 2018-08-24 19:54 - 000000000 ____D C:\Users\Linus 2019-03-20 19:35 - 2018-05-21 09:10 - 001701536 _____ C:\WINDOWS\system32\FNTCACHE.DAT 2019-03-20 19:34 - 2018-04-12 16:19 - 000000000 ____D C:\Program Files\Windows Defender Advanced Threat Protection 2019-03-20 19:34 - 2018-04-11 23:38 - 000000000 ___SD C:\WINDOWS\system32\UNP 2019-03-20 19:34 - 2018-04-11 23:38 - 000000000 ___RD C:\Program Files\Windows Defender 2019-03-20 19:34 - 2018-04-11 23:38 - 000000000 ____D C:\WINDOWS\TextInput 2019-03-20 19:34 - 2018-04-11 23:38 - 000000000 ____D C:\WINDOWS\system32\oobe 2019-03-20 19:34 - 2018-04-11 23:38 - 000000000 ____D C:\WINDOWS\system32\appraiser 2019-03-20 19:34 - 2018-04-11 23:38 - 000000000 ____D C:\WINDOWS\ShellExperiences 2019-03-20 19:34 - 2018-04-11 23:38 - 000000000 ____D C:\WINDOWS\bcastdvr 2019-03-20 19:34 - 2018-04-11 23:38 - 000000000 ____D C:\Program Files (x86)\Windows Defender 2019-03-20 19:32 - 2016-07-14 11:34 - 000000666 _____ C:\WINDOWS\Tasks\G2MUploadTask-S-1-5-21-306283558-555091848-1802614870-1001.job 2019-03-20 19:32 - 2016-07-14 11:34 - 000000570 _____ C:\WINDOWS\Tasks\G2MUpdateTask-S-1-5-21-306283558-555091848-1802614870-1001.job 2019-03-19 19:50 - 2018-04-11 23:30 - 000000000 ____D C:\WINDOWS\CbsTemp 2019-03-19 19:49 - 2017-05-22 19:20 - 000000000 ____D C:\Users\matth\VirtualBox VMs 2019-03-19 19:46 - 2016-05-18 10:45 - 000000000 ____D C:\WINDOWS\system32\MRT 2019-03-19 19:37 - 2019-02-05 18:58 - 000001047 _____ C:\ProgramData\Microsoft\Windows\Start Menu\Programs\TeamViewer 14.lnk 2019-03-19 19:37 - 2019-02-05 18:58 - 000001035 _____ C:\Users\Public\Desktop\TeamViewer 14.lnk 2019-03-19 19:37 - 2018-05-21 09:17 - 000000000 ____D C:\Users\DefaultAppPool 2019-03-19 19:37 - 2018-05-21 09:17 - 000000000 ____D C:\Users\.NET v4.5 Classic 2019-03-19 19:37 - 2018-05-21 09:17 - 000000000 ____D C:\Users\.NET v4.5 2019-03-19 19:30 - 2017-07-10 02:33 - 000000000 ____D C:\Users\matth\AppData\Local\GoToMeeting 2019-03-19 19:24 - 2016-05-17 11:57 - 000000000 ____D C:\Program Files (x86)\Microsoft Office 2019-03-19 19:21 - 2016-05-18 10:45 - 127411920 ____C (Microsoft Corporation) C:\WINDOWS\system32\MRT.exe 2019-03-19 19:19 - 2018-07-13 21:57 - 000003374 _____ C:\WINDOWS\System32\Tasks\OneDrive Standalone Update Task-S-1-5-21-306283558-555091848-1802614870-1001 2019-03-19 19:19 - 2018-07-13 21:55 - 000002370 _____ C:\Users\matth\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\OneDrive.lnk 2019-03-19 19:06 - 2016-05-17 15:01 - 000000000 ____D C:\Program Files (x86)\Adobe 2019-03-19 19:02 - 2018-05-21 09:26 - 000003832 _____ C:\WINDOWS\System32\Tasks\G2MUploadTask-S-1-5-21-306283558-555091848-1802614870-1001 2019-03-19 19:02 - 2018-05-21 09:26 - 000003736 _____ C:\WINDOWS\System32\Tasks\G2MUpdateTask-S-1-5-21-306283558-555091848-1802614870-1001 2019-03-03 16:54 - 2018-09-27 11:22 - 000835480 _____ (Adobe Systems Incorporated) C:\WINDOWS\SysWOW64\FlashPlayerApp.exe 2019-03-03 16:54 - 2018-09-27 11:22 - 000179608 _____ (Adobe Systems Incorporated) C:\WINDOWS\SysWOW64\FlashPlayerCPLApp.cpl 2019-03-02 16:43 - 2016-02-12 02:15 - 000000000 ____D C:\ProgramData\Package Cache 2019-03-02 15:33 - 2017-04-24 11:00 - 000000000 ____D C:\Users\matth\AppData\Local\Downloaded Installations ==================== Files in the root of some directories ======= 2018-10-08 10:35 - 2018-10-08 10:35 - 000000000 _____ () C:\Users\matth\AppData\Local\oobelibMkey.log 2018-03-14 19:20 - 2018-03-14 19:20 - 000007627 _____ () C:\Users\matth\AppData\Local\Resmon.ResmonCfg ==================== Bamital & volsnap ====================== (There is no automatic fix for files that do not pass verification.) C:\WINDOWS\system32\winlogon.exe => File is digitally signed C:\WINDOWS\system32\wininit.exe => File is digitally signed C:\WINDOWS\explorer.exe => File is digitally signed C:\WINDOWS\SysWOW64\explorer.exe => File is digitally signed C:\WINDOWS\system32\svchost.exe => File is digitally signed C:\WINDOWS\SysWOW64\svchost.exe => File is digitally signed C:\WINDOWS\system32\services.exe => File is digitally signed C:\WINDOWS\system32\User32.dll => File is digitally signed C:\WINDOWS\SysWOW64\User32.dll => File is digitally signed C:\WINDOWS\system32\userinit.exe => File is digitally signed C:\WINDOWS\SysWOW64\userinit.exe => File is digitally signed C:\WINDOWS\system32\rpcss.dll => File is digitally signed C:\WINDOWS\system32\dnsapi.dll => File is digitally signed C:\WINDOWS\SysWOW64\dnsapi.dll => File is digitally signed C:\WINDOWS\system32\dllhost.exe => File is digitally signed C:\WINDOWS\SysWOW64\dllhost.exe => File is digitally signed C:\WINDOWS\system32\Drivers\volsnap.sys => File is digitally signed LastRegBack: 2018-05-21 09:10 ==================== End of FRST.txt ============================ Addition.txt Link to post Share on other sites More sharing options...
nasdaq Posted April 1, 2019 ID:1306183 Share Posted April 1, 2019 (edited) Hi, No malware was found. This is just a clean up of empty items. Please download the attached Fixlist.txt file to the same folder where the Farbar tool is running from. The location is listed in the 3rd line of the FRST.txt log you have submitted. Run FRST and click Fix only once and wait. The tool will create a log (Fixlog.txt) please post it to your reply. === Please post the Fixlog.txt. Do you still get the error message? How is the computer running? fixlist.txt Edited April 1, 2019 by nasdaq Link to post Share on other sites More sharing options...
saundm Posted April 1, 2019 Author ID:1306227 Share Posted April 1, 2019 Hi Nasdaq Fix applied and file attached. On restart I have had the same popup. And this one too. If there is no problem with malware I will run the crosscheck - I presume that it is a genuine popup. Thanks for your help. Link to post Share on other sites More sharing options...
nasdaq Posted April 2, 2019 ID:1306322 Share Posted April 2, 2019 HI, This article refers to this error. Check it out. https://support.microsoft.com/en-ca/help/3181206/outlook-2016-error-the-time-limit-for-logging-on-was-reached-while-wai Link to post Share on other sites More sharing options...
nasdaq Posted April 7, 2019 ID:1307033 Share Posted April 7, 2019 Are you still with me? Link to post Share on other sites More sharing options...
saundm Posted April 7, 2019 Author ID:1307040 Share Posted April 7, 2019 Sorry Nasdaq, I thought we were done....? Link to post Share on other sites More sharing options...
nasdaq Posted April 7, 2019 ID:1307051 Share Posted April 7, 2019 Was your problem solved? Link to post Share on other sites More sharing options...
Root Admin AdvancedSetup Posted April 18, 2019 Root Admin ID:1308393 Share Posted April 18, 2019 Due to the lack of feedback, this topic is closed to prevent others from posting here. If you need this topic reopened, please send a Private Message to any one of the moderating team members. Please include a link to this topic with your request. This applies only to the originator of this topic. Other members who need assistance please start your own topic in a new thread. Thanks Link to post Share on other sites More sharing options...
Recommended Posts