Addy78 Posted March 31, 2019 ID:1306052 Share Posted March 31, 2019 Hi there, My mouse has been double clicking unnecessarily for ages now. i tried to live with it but its now become unbearable. I changed my mouse twice but to no avail. Please help me get rid of this problem. Regards Adeel P.S i was using this tool "FixMouseLMB" but its giving up I guess as well. Link to post Share on other sites More sharing options...
Root Admin AdvancedSetup Posted March 31, 2019 Root Admin ID:1306056 Share Posted March 31, 2019 Hello @Addy78 and It may just be a bad mouse and need replacement. We'll go ahead though and scan for any malware or other issues and let you know what we find. Please run the following steps and post back the logs as an attachment when ready.STEP 01 If you're already running Malwarebytes 3 then open Malwarebytes and check for updates. Then click on the Scan tab and select Threat Scan and click on Start Scan button. If you don't have Malwarebytes 3 installed yet please download it from here and install it. Once installed then open Malwarebytes and check for updates. Then click on the Scan tab and select Threat Scan and click on Start Scan button. Once the scan is completed click on the Export Summary button and save the file as a Text file to your desktop or other location you can find, and attach that log on your next reply. If Malwarebytes won't run then please skip to the next step and let me know on your next reply. STEP 02 Please download AdwCleaner by Malwarebytes and save the file to your Desktop. Right-click on the program and select Run as Administrator to start the tool. Accept the Terms of use. Wait until the database is updated. Click Scan Now. When finished, please click Clean & Repair. Your PC should reboot now if any items were found. After reboot, a log file will be opened. Copy its content into your next reply. RESTART THE COMPUTER Before running Step 3 STEP 03 Please download the Farbar Recovery Scan Tool and save it to your desktop.Note: You need to run the version compatible with your system. You can check here if you're not sure if your computer is 32-bit or 64-bit Double-click to run it. When the tool opens, click Yes to disclaimer. Press the Scan button. It will make a log (FRST.txt) in the same directory the tool is run. Please attach it to your reply. The first time the tool is run, it also makes another log (Addition.txt). If you've, run the tool before you need to place a check mark here. Please attach the Additions.txt log to your reply as well. Thanks Ron Link to post Share on other sites More sharing options...
Addy78 Posted March 31, 2019 Author ID:1306065 Share Posted March 31, 2019 Thanks Ron for your prompt reply. I am attaching the outputs of the required softwares for your review and advice. Malwarebytes www.malwarebytes.com -Log Details- Scan Date: 3/31/19 Scan Time: 12:03 PM Log File: c92d99fd-5393-11e9-bdb6-00ff06a65fd6.json -Software Information- Version: 3.7.1.2839 Components Version: 1.0.563 Update Package Version: 1.0.9934 License: Trial -System Information- OS: Windows 7 Service Pack 1 CPU: x64 File System: NTFS User: PPNNCC\adeel.qureshi -Scan Summary- Scan Type: Threat Scan Scan Initiated By: Manual Result: Completed Objects Scanned: 351850 Threats Detected: 18 Threats Quarantined: 0 Time Elapsed: 4 min, 48 sec -Scan Options- Memory: Enabled Startup: Enabled Filesystem: Enabled Archives: Enabled Rootkits: Disabled Heuristics: Enabled PUP: Detect PUM: Detect -Scan Details- Process: 0 (No malicious items detected) Module: 0 (No malicious items detected) Registry Key: 10 PUP.Optional.DataMngr.AppFlsh, HKU\S-1-5-21-3420606195-2604840975-2076412875-1345\SOFTWARE\DataMngr_Toolbar, No Action By User, [59], [253613],1.0.9934 PUP.Optional.DataMngr.AppFlsh, HKU\S-1-5-21-409201503-875657276-1192498473-500\SOFTWARE\DataMngr, No Action By User, [59], [253612],1.0.9934 PUP.Optional.DataMngr.AppFlsh, HKU\S-1-5-21-409201503-875657276-1192498473-500\SOFTWARE\DataMngr_Toolbar, No Action By User, [59], [253613],1.0.9934 PUP.Optional.SearchQu, HKU\S-1-5-21-3420606195-2604840975-2076412875-1345\SOFTWARE\MICROSOFT\INTERNET EXPLORER\SEARCHSCOPES\{9BB47C17-9C68-4BB3-B188-DD9AF0FD2406}, No Action By User, [1547], [242758],1.0.9934 PUP.Optional.SearchQu, HKLM\SOFTWARE\MICROSOFT\INTERNET EXPLORER\SEARCHSCOPES\{9BB47C17-9C68-4BB3-B188-DD9AF0FD2406}, No Action By User, [1547], [242758],1.0.9934 PUP.Optional.SearchQu, HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\INTERNET EXPLORER\SEARCHSCOPES\{9BB47C17-9C68-4BB3-B188-DD9AF0FD2406}, No Action By User, [1547], [242758],1.0.9934 PUP.Optional.Delta.ShrtCln, HKLM\SOFTWARE\WOW6432NODE\GOOGLE\CHROME\EXTENSIONS\kiplfnciaokpcennlkldkdaeaaomamof, No Action By User, [69], [187974],1.0.9934 PUP.Optional.Bandoo.AppFlsh, HKLM\SOFTWARE\WOW6432NODE\CLASSES\CLSID\{377E5D4D-77E5-476A-8716-7E70A9272DA0}, No Action By User, [3], [253595],1.0.9934 PUP.Optional.Bandoo.AppFlsh, HKLM\SOFTWARE\CLASSES\WOW6432NODE\CLSID\{377E5D4D-77E5-476A-8716-7E70A9272DA0}, No Action By User, [3], [253595],1.0.9934 PUP.Optional.Bandoo.AppFlsh, HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\INTERNET EXPLORER\LOW RIGHTS\ELEVATIONPOLICY\{377e5d4d-77e5-476a-8716-7e70a9272da0}, No Action By User, [3], [253595],1.0.9934 Registry Value: 3 PUP.Optional.SearchQu, HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\INTERNET EXPLORER\SEARCHSCOPES\{9BB47C17-9C68-4BB3-B188-DD9AF0FD2406}|SUGGESTIONSURL_JSON, No Action By User, [1547], [242758],1.0.9934 PUP.Optional.SearchQu, HKLM\SOFTWARE\MICROSOFT\INTERNET EXPLORER\SEARCHSCOPES\{9BB47C17-9C68-4BB3-B188-DD9AF0FD2406}|SUGGESTIONSURL_JSON, No Action By User, [1547], [242758],1.0.9934 PUP.Optional.Bandoo.AppFlsh, HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\INTERNET EXPLORER\LOW RIGHTS\ELEVATIONPOLICY\{377e5d4d-77e5-476a-8716-7e70a9272da0}|APPPATH, No Action By User, [3], [253595],1.0.9934 Registry Data: 0 (No malicious items detected) Data Stream: 0 (No malicious items detected) Folder: 3 PUP.Optional.OpenCandy, C:\Users\adeel.qureshi\AppData\Roaming\OpenCandy\FC199B5A67764F1A9F39A1DCEDB7BB16, No Action By User, [1129], [173202],1.0.9934 PUP.Optional.OpenCandy, C:\USERS\ADEEL.QURESHI\APPDATA\ROAMING\OPENCANDY, No Action By User, [1129], [173202],1.0.9934 PUP.Optional.DataMngr.AppFlsh, C:\USERS\ADEEL.QURESHI\APPDATA\LOCALLOW\DATAMNGR, No Action By User, [59], [181454],1.0.9934 File: 2 PUP.Optional.OpenCandy, C:\Users\adeel.qureshi\AppData\Roaming\OpenCandy\FC199B5A67764F1A9F39A1DCEDB7BB16\Opera_NI_stable.exe, No Action By User, [1129], [173202],1.0.9934 PUP.Optional.DataMngr.AppFlsh, C:\Users\adeel.qureshi\AppData\LocalLow\DataMngr\{7CA1F051-A4FB-4143-B263-02B41E571EED}, No Action By User, [59], [181454],1.0.9934 Physical Sector: 0 (No malicious items detected) WMI: 0 (No malicious items detected) (end) # ------------------------------- # Malwarebytes AdwCleaner 7.2.7.0 # ------------------------------- # Build: 01-30-2019 # Database: 2019-03-25.1 (Cloud) # Support: https://www.malwarebytes.com/support # # ------------------------------- # Mode: Clean # ------------------------------- # Start: 03-31-2019 # Duration: 00:00:04 # OS: Windows 7 Professional # Cleaned: 35 # Failed: 0 ***** [ Services ] ***** No malicious services cleaned. ***** [ Folders ] ***** Deleted C:\Users\adeel.qureshi\AppData\LocalLow\searchresultstb Deleted C:\ProgramData\Browser Manager Deleted C:\Users\adeel.qureshi\AppData\Local\torch Deleted C:\Users\adeel.qureshi\AppData\Roaming\OpenCandy ***** [ Files ] ***** No malicious files cleaned. ***** [ DLL ] ***** No malicious DLLs cleaned. ***** [ WMI ] ***** No malicious WMI cleaned. ***** [ Shortcuts ] ***** No malicious shortcuts cleaned. ***** [ Tasks ] ***** No malicious tasks cleaned. ***** [ Registry ] ***** Deleted HKCU\Software\DataMngr_Toolbar Deleted HKCU\Software\torch Deleted HKLM\Software\Wow6432Node\torch Deleted HKLM\Software\Wow6432Node\iLividSRTB Deleted HKLM\Software\Wow6432Node\Clients\StartMenuInternet\Torch Deleted HKLM\SOFTWARE\Clients\StartMenuInternet\Torch Deleted HKLM\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\App Paths\torch.exe Deleted HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\App Paths\torch.exe Deleted HKLM\SOFTWARE\Classes\Applications\Torch.exe Deleted HKLM\SOFTWARE\Classes\Applications\ilividsetup.exe Deleted HKCU\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage\st.chatango.com Deleted HKCU\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage\chatango.com Deleted HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\SearchScopes\{9BB47C17-9C68-4BB3-B188-DD9AF0FD2406} Deleted HKLM\Software\Microsoft\Internet Explorer\SearchScopes\{9BB47C17-9C68-4BB3-B188-DD9AF0FD2406} Deleted HKLM\SOFTWARE\Classes\.gif\OpenWithList\Torch.exe Deleted HKLM\SOFTWARE\Classes\.jpg\OpenWithList\Torch.exe Deleted HKLM\SOFTWARE\Classes\.bmp\OpenWithList\Torch.exe Deleted HKLM\SOFTWARE\Classes\.dib\OpenWithList\Torch.exe Deleted HKLM\SOFTWARE\Classes\.htm\OpenWithList\Torch.exe Deleted HKLM\SOFTWARE\Classes\.mfp\OpenWithList\Torch.exe Deleted HKLM\SOFTWARE\Classes\.ico\OpenWithList\Torch.exe Deleted HKLM\SOFTWARE\Classes\.html\OpenWithList\Torch.exe Deleted HKLM\SOFTWARE\Classes\.jpe\OpenWithList\Torch.exe Deleted HKLM\SOFTWARE\Classes\.jfif\OpenWithList\Torch.exe Deleted HKLM\SOFTWARE\Classes\.URL\OpenWithList\Torch.exe Deleted HKLM\SOFTWARE\Classes\.pdf\OpenWithList\Torch.exe Deleted HKLM\SOFTWARE\Classes\.shtml\OpenWithList\Torch.exe Deleted HKLM\SOFTWARE\Classes\.png\OpenWithList\Torch.exe Deleted HKLM\SOFTWARE\Classes\.webm\OpenWithList\Torch.exe Deleted HKLM\SOFTWARE\Classes\.xht\OpenWithList\Torch.exe Deleted HKLM\SOFTWARE\Classes\.xhtml\OpenWithList\Torch.exe ***** [ Chromium (and derivatives) ] ***** No malicious Chromium entries cleaned. ***** [ Chromium URLs ] ***** No malicious Chromium URLs cleaned. ***** [ Firefox (and derivatives) ] ***** No malicious Firefox entries cleaned. ***** [ Firefox URLs ] ***** No malicious Firefox URLs cleaned. ************************* [+] Delete Tracing Keys [+] Reset Winsock ************************* AdwCleaner[S00].txt - [4207 octets] - [31/03/2019 12:13:46] ########## EOF - C:\AdwCleaner\Logs\AdwCleaner[C00].txt ########## Scan result of Farbar Recovery Scan Tool (FRST) (x64) Version: 17.03.2019 Ran by adeel.qureshi (administrator) on KFMC-421-PC (31-03-2019 12:21:40) Running from C:\Users\adeel.qureshi\Desktop Loaded Profiles: adeel.qureshi (Available Profiles: adeel.qureshi & Administrator) Platform: Windows 7 Professional Service Pack 1 (X64) Language: English (United States) Internet Explorer Version 11 (Default browser: Chrome) Boot Mode: Normal Tutorial for Farbar Recovery Scan Tool: http://www.geekstogo.com/forum/topic/335081-frst-tutorial-how-to-use-farbar-recovery-scan-tool/ ==================== Processes (Whitelisted) ================= (If an entry is included in the fixlist, the process will be closed. The file will not be moved.) (Adobe Systems, Incorporated -> Adobe Systems Incorporated) C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe (Apple Inc. -> Apple Inc.) C:\Program Files\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe (Nalpeiron Ltd.) [File not signed] C:\Windows\SysWOW64\ASTSRV.EXE (Autodesk, Inc.) [File not signed] C:\Program Files (x86)\Autodesk\Content Service\Connect.Service.ContentService.exe (Apple Inc. -> Apple Inc.) C:\Program Files\Bonjour\mDNSResponder.exe (Hewlett-Packard Company) [File not signed] C:\Program Files (x86)\Common Files\LightScribe\LSSrvc.exe (Kaspersky Lab -> Kaspersky Lab ZAO) C:\Program Files (x86)\Kaspersky Lab\Kaspersky Endpoint Security 10 for Windows\avp.exe (Malwarebytes Corporation -> Malwarebytes) C:\Program Files\Malwarebytes\Anti-Malware\MBAMService.exe (Intel Corporation - pGFX -> Intel Corporation) C:\Windows\System32\hkcmd.exe (Intel Corporation - pGFX -> Intel Corporation) C:\Windows\System32\igfxpers.exe (Akamai Technologies, Inc. -> Akamai Technologies, Inc.) C:\Users\adeel.qureshi\AppData\Local\Akamai\netsession_win.exe (Akamai Technologies, Inc. -> Akamai Technologies, Inc.) C:\Users\adeel.qureshi\AppData\Local\Akamai\netsession_win.exe (Kaspersky Lab -> Kaspersky Lab ZAO) C:\Program Files (x86)\Kaspersky Lab\Kaspersky Endpoint Security 10 for Windows\avp.exe (Oracle America, Inc. -> Oracle Corporation) C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe (Malwarebytes Corporation -> Malwarebytes) C:\Program Files\Malwarebytes\Anti-Malware\mbamtray.exe (Google LLC -> Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe (Google LLC -> Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe (Google LLC -> Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe (Google LLC -> Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe (Google LLC -> Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe (Google LLC -> Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe (Google LLC -> Google) C:\Users\adeel.qureshi\AppData\Local\Google\Chrome\User Data\SwReporter\39.195.200.3\software_reporter_tool.exe (Google LLC -> Google) C:\Users\adeel.qureshi\AppData\Local\Google\Chrome\User Data\SwReporter\39.195.200.3\software_reporter_tool.exe (Google LLC -> Google) C:\Users\adeel.qureshi\AppData\Local\Google\Chrome\User Data\SwReporter\39.195.200.3\software_reporter_tool.exe (Google LLC -> Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe (Google LLC -> Google) C:\Users\adeel.qureshi\AppData\Local\Google\Chrome\User Data\SwReporter\39.195.200.3\software_reporter_tool.exe ==================== Registry (Whitelisted) =========================== (If an entry is included in the fixlist, the registry item will be restored to default or removed. The file will not be moved.) HKLM\...\Run: [Autodesk Sync] => [X] HKLM-x32\...\Run: [] => [X] HKLM-x32\...\Run: [AVP] => C:\Program Files (x86)\Kaspersky Lab\Kaspersky Endpoint Security 10 for Windows\avp.exe [741360 2013-11-27] (Kaspersky Lab -> Kaspersky Lab ZAO) HKLM-x32\...\Run: [SunJavaUpdateSched] => C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe [601424 2018-12-16] (Oracle America, Inc. -> Oracle Corporation) HKLM Group Policy restriction on software: %HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\SystemRoot% <==== ATTENTION HKLM Group Policy restriction on software: %HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ProgramFilesDir% <==== ATTENTION HKU\S-1-5-21-3420606195-2604840975-2076412875-1345 Group Policy restriction on software: %HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\SystemRoot% <==== ATTENTION HKU\S-1-5-21-3420606195-2604840975-2076412875-1345 Group Policy restriction on software: %HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ProgramFilesDir% <==== ATTENTION HKU\S-1-5-21-3420606195-2604840975-2076412875-1345\...\Run: [Akamai NetSession Interface] => C:\Users\adeel.qureshi\AppData\Local\Akamai\netsession_win.exe [4586456 2018-04-17] (Akamai Technologies, Inc. -> Akamai Technologies, Inc.) HKU\S-1-5-21-3420606195-2604840975-2076412875-1345\...\Policies\Explorer: [] HKU\S-1-5-21-3420606195-2604840975-2076412875-1345\Control Panel\Desktop\\SCRNSAVE.EXE -> C:\Windows\system32\scrnsave.scr [11264 2009-07-14] (Microsoft Windows -> Microsoft Corporation) HKU\S-1-5-18\...\Run: [Autodesk Sync] => C:\Program Files\Autodesk\Autodesk Sync\AdSync.exe [1081224 2013-02-05] (Autodesk, Inc -> Autodesk, Inc.) HKLM\Software\Microsoft\Active Setup\Installed Components: [{2D46B6DC-2207-486B-B523-A557E6D54B47}] -> C:\Windows\system32\cmd.exe /D /C start C:\Windows\system32\ie4uinit.exe -ClearIconCache HKLM\Software\Microsoft\Active Setup\Installed Components: [{8A69D345-D564-463c-AFF1-A69D9E530F96}] -> C:\Program Files (x86)\Google\Chrome\Application\73.0.3683.86\Installer\chrmstp.exe [2019-03-21] (Google LLC -> Google Inc.) HKLM\Software\Wow6432Node\Microsoft\Active Setup\Installed Components: [{A6EADE66-0000-0000-484E-7E8A45000000}] -> C:\Program Files (x86)\Adobe\Acrobat Reader DC\Esl\AiodLite.dll [2018-09-20] (Adobe Systems, Incorporated -> Adobe Systems, Inc.) Startup: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\AnyDesk.lnk [2017-05-09] ShortcutTarget: AnyDesk.lnk -> C:\Program Files (x86)\AnyDesk\AnyDesk.exe (philandro Software GmbH -> ) GroupPolicyScripts: Restriction <==== ATTENTION ==================== Internet (Whitelisted) ==================== (If an item is included in the fixlist, if it is a registry item it will be removed or restored to default.) Tcpip\..\Interfaces\{FB2AF7C6-BC18-498C-93E0-4A7FA846FA77}: [NameServer] 192.168.1.33,94.77.215.126 HKLM\System\...\Parameters\PersistentRoutes: [0.0.0.0,0.0.0.0,192.168.1.1,-1] Internet Explorer: ================== HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Search Page = hxxp://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch HKU\.DEFAULT\Software\Microsoft\Internet Explorer\Main,Search Page = hxxp://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch HKU\.DEFAULT\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://www.microsoft.com/isapi/redir.dll?prd=ie&ar=msnhome HKU\S-1-5-19\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://www.symantec.com/enterprise/security_response/index.jsp?inid=biz_SR_sep_V12_1_MR_1 HKU\S-1-5-19\Software\Microsoft\Internet Explorer\Main,Search Page = hxxp://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch HKU\S-1-5-20\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://www.symantec.com/enterprise/security_response/index.jsp?inid=biz_SR_sep_V12_1_MR_1 HKU\S-1-5-20\Software\Microsoft\Internet Explorer\Main,Search Page = hxxp://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch HKU\S-1-5-21-3420606195-2604840975-2076412875-1345\Software\Microsoft\Internet Explorer\Main,Search Page = hxxp://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch SearchScopes: HKLM -> DefaultScope {9BB47C17-9C68-4BB3-B188-DD9AF0FD2406} URL = SearchScopes: HKLM-x32 -> DefaultScope {9BB47C17-9C68-4BB3-B188-DD9AF0FD2406} URL = SearchScopes: HKU\S-1-5-21-3420606195-2604840975-2076412875-1345 -> {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = SearchScopes: HKU\S-1-5-21-3420606195-2604840975-2076412875-1345 -> {9BB47C17-9C68-4BB3-B188-DD9AF0FD2406} URL = BHO: Office Document Cache Handler -> {B4F3A835-0E21-4959-BA22-42B3008E02FF} -> C:\Program Files\Microsoft Office\Office14\URLREDIR.DLL [2013-03-06] (Microsoft Corporation -> Microsoft Corporation) BHO-x32: Adobe PDF Reader Link Helper -> {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} -> C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll => No File BHO-x32: Java(tm) Plug-In SSV Helper -> {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} -> C:\Program Files (x86)\Java\jre1.8.0_201\bin\ssv.dll [2019-01-20] (Oracle America, Inc. -> Oracle Corporation) BHO-x32: Adobe PDF Conversion Toolbar Helper -> {AE7CD045-E861-484f-8273-0445EE161910} -> C:\Program Files (x86)\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll [2005-09-23] (Adobe Systems, Incorporated -> Adobe Systems Incorporated) BHO-x32: Office Document Cache Handler -> {B4F3A835-0E21-4959-BA22-42B3008E02FF} -> C:\Program Files (x86)\Microsoft Office\Office14\URLREDIR.DLL [2013-03-06] (Microsoft Corporation -> Microsoft Corporation) BHO-x32: Java(tm) Plug-In 2 SSV Helper -> {DBC80044-A445-435b-BC74-9C25C1C588A9} -> C:\Program Files (x86)\Java\jre1.8.0_201\bin\jp2ssv.dll [2019-01-20] (Oracle America, Inc. -> Oracle Corporation) Toolbar: HKLM-x32 - Adobe PDF - {47833539-D0C5-4125-9FA8-0819E2EAAC93} - C:\Program Files (x86)\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll [2005-09-23] (Adobe Systems, Incorporated -> Adobe Systems Incorporated) Toolbar: HKU\S-1-5-21-3420606195-2604840975-2076412875-1345 -> No Name - {2318C2B1-4965-11D4-9B18-009027A5CD4F} - No File Toolbar: HKU\S-1-5-21-3420606195-2604840975-2076412875-1345 -> No Name - {47833539-D0C5-4125-9FA8-0819E2EAAC93} - No File DPF: HKLM-x32 {D27CDB6E-AE6D-11CF-96B8-444553540000} hxxp://fpdownload2.macromedia.com/get/shockwave/cabs/flash/swflash.cab FireFox: ======== FF Plugin: @adobe.com/FlashPlayer -> C:\Windows\system32\Macromed\Flash\NPSWF64_16_0_0_257.dll [2015-01-14] (Adobe Systems Incorporated -> ) FF Plugin: @microsoft.com/GENUINE -> disabled [No File] FF Plugin: @Microsoft.com/NpCtrl,version=1.0 -> C:\Program Files\Microsoft Silverlight\5.1.50918.0\npctrl.dll [2018-10-23] (Microsoft Corporation -> Microsoft Corporation) FF Plugin: @microsoft.com/OfficeAuthz,version=14.0 -> C:\PROGRA~1\MICROS~1\Office14\NPAUTHZ.DLL [2010-01-09] (Microsoft Corporation -> Microsoft Corporation) FF Plugin-x32: @adobe.com/FlashPlayer -> C:\Windows\SysWOW64\Macromed\Flash\NPSWF32_16_0_0_257.dll [2015-01-14] (Adobe Systems Incorporated -> ) FF Plugin-x32: @java.com/DTPlugin,version=11.201.2 -> C:\Program Files (x86)\Java\jre1.8.0_201\bin\dtplugin\npDeployJava1.dll [2019-01-20] (Oracle America, Inc. -> Oracle Corporation) FF Plugin-x32: @java.com/JavaPlugin,version=11.201.2 -> C:\Program Files (x86)\Java\jre1.8.0_201\bin\plugin2\npjp2.dll [2019-01-20] (Oracle America, Inc. -> Oracle Corporation) FF Plugin-x32: @microsoft.com/GENUINE -> disabled [No File] FF Plugin-x32: @Microsoft.com/NpCtrl,version=1.0 -> C:\Program Files (x86)\Microsoft Silverlight\5.1.50918.0\npctrl.dll [2018-10-23] (Microsoft Corporation -> Microsoft Corporation) FF Plugin-x32: @microsoft.com/OfficeAuthz,version=14.0 -> C:\PROGRA~2\MICROS~1\Office14\NPAUTHZ.DLL [2010-01-09] (Microsoft Corporation -> Microsoft Corporation) FF Plugin-x32: @microsoft.com/SharePoint,version=14.0 -> C:\PROGRA~2\MICROS~1\Office14\NPSPWRAP.DLL [2010-03-24] (Microsoft Corporation -> Microsoft Corporation) FF Plugin-x32: @tools.google.com/Google Update;version=3 -> C:\Program Files (x86)\Google\Update\1.3.34.7\npGoogleUpdate3.dll [2019-03-28] (Google Inc -> Google LLC) FF Plugin-x32: @tools.google.com/Google Update;version=9 -> C:\Program Files (x86)\Google\Update\1.3.34.7\npGoogleUpdate3.dll [2019-03-28] (Google Inc -> Google LLC) FF Plugin-x32: Adobe Reader -> C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AIR\nppdf32.dll [2019-02-01] (Adobe Systems, Incorporated -> Adobe Systems Inc.) Chrome: ======= CHR DefaultProfile: Default CHR NewTab: Default -> Not-active:"chrome-extension://icpgjfneehieebagbmdbhnlpiopdcmna/main.html" CHR Profile: C:\Users\adeel.qureshi\AppData\Local\Google\Chrome\User Data\Default [2019-03-31] CHR Extension: (Google Search) - C:\Users\adeel.qureshi\AppData\Local\Google\Chrome\User Data\Default\Extensions\coobgpohoikkiipiblmjeljniedjpjpf [2015-10-27] CHR Extension: (Adobe Acrobat) - C:\Users\adeel.qureshi\AppData\Local\Google\Chrome\User Data\Default\Extensions\efaidnbmnnnibpcajpcglclefindmkaj [2017-03-06] CHR Extension: (Google Docs Offline) - C:\Users\adeel.qureshi\AppData\Local\Google\Chrome\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi [2018-08-27] CHR Extension: (New Tab Redirect) - C:\Users\adeel.qureshi\AppData\Local\Google\Chrome\User Data\Default\Extensions\icpgjfneehieebagbmdbhnlpiopdcmna [2016-11-07] CHR Extension: (Window Close Protector) - C:\Users\adeel.qureshi\AppData\Local\Google\Chrome\User Data\Default\Extensions\lnpifgapnmpninomacbhdlconlpikdai [2015-09-13] CHR Extension: (Chrome Web Store Payments) - C:\Users\adeel.qureshi\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda [2018-04-03] CHR Extension: (Chrome Media Router) - C:\Users\adeel.qureshi\AppData\Local\Google\Chrome\User Data\Default\Extensions\pkedcjkdefgpdelpbcmbmeomcjbeemfm [2019-03-14] CHR Profile: C:\Users\adeel.qureshi\AppData\Local\Google\Chrome\User Data\Guest Profile [2015-01-13] CHR HKU\S-1-5-21-3420606195-2604840975-2076412875-1345\SOFTWARE\Google\Chrome\Extensions\...\Chrome\Extension: [dhdgffkkebhmkfjojejmpbldmpobfkfo] - hxxp://clients2.google.com/service/update2/crx CHR HKLM-x32\...\Chrome\Extension: [efaidnbmnnnibpcajpcglclefindmkaj] - hxxps://clients2.google.com/service/update2/crx CHR HKLM-x32\...\Chrome\Extension: [kiplfnciaokpcennlkldkdaeaaomamof] - C:\Users\imran.yameen\AppData\Local\Torch\Plugins\TorchPlugin.crx <not found> ==================== Services (Whitelisted) ==================== (If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.) S2 AnyDesk; C:\Program Files (x86)\AnyDesk\AnyDesk.exe [1738952 2017-04-27] (philandro Software GmbH -> ) R2 Apple Mobile Device Service; C:\Program Files\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe [85304 2018-10-16] (Apple Inc. -> Apple Inc.) R2 astcc; C:\Windows\SysWOW64\astsrv.exe [57344 2007-02-16] (Nalpeiron Ltd.) [File not signed] R2 Autodesk Content Service; C:\Program Files (x86)\Autodesk\Content Service\Connect.Service.ContentService.exe [12288 2012-12-13] (Autodesk, Inc.) [File not signed] R2 AVP; C:\Program Files (x86)\Kaspersky Lab\Kaspersky Endpoint Security 10 for Windows\avp.exe [741360 2013-11-27] (Kaspersky Lab -> Kaspersky Lab ZAO) R2 LightScribeService; C:\Program Files (x86)\Common Files\LightScribe\LSSrvc.exe [61440 2006-12-14] (Hewlett-Packard Company) [File not signed] R2 MBAMService; C:\Program Files\Malwarebytes\Anti-Malware\mbamservice.exe [6562472 2019-02-01] (Malwarebytes Corporation -> Malwarebytes) R2 Net Driver HPZ12; C:\Windows\system32\HPZinw12.dll [50688 2012-07-31] (Hewlett-Packard) [File not signed] S3 NMIndexingService; C:\Program Files (x86)\Common Files\Ahead\Lib\NMIndexingService.exe [262144 2006-12-23] (Nero AG) [File not signed] R2 Pml Driver HPZ12; C:\Windows\system32\HPZipm12.dll [66048 2012-07-31] (Hewlett-Packard) [File not signed] R2 WinDefend; C:\Program Files\Windows Defender\mpsvc.dll [1011712 2013-05-27] (Microsoft Windows -> Microsoft Corporation) S3 Autodesk Licensing Service; "C:\Program Files (x86)\Common Files\Autodesk Shared\Service\AdskScSrv.exe" [X] ===================== Drivers (Whitelisted) ====================== (If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.) R1 ESProtectionDriver; C:\Windows\system32\drivers\mbae64.sys [153328 2019-01-08] (Malwarebytes Corporation -> Malwarebytes) R0 KL1; C:\Windows\System32\DRIVERS\kl1.sys [7717984 2013-09-05] (Kaspersky Lab -> Kaspersky Lab ZAO) U5 klflt; C:\Windows\System32\Drivers\klflt.sys [98400 2015-03-31] (Kaspersky Lab -> Kaspersky Lab ZAO) R1 KLFLTDEV; C:\Windows\System32\DRIVERS\klfltdev.sys [30816 2013-07-08] (Kaspersky Lab -> Kaspersky Lab ZAO) R1 KLIF; C:\Windows\System32\DRIVERS\klif.sys [661600 2015-03-31] (Kaspersky Lab -> Kaspersky Lab ZAO) R1 KLIM6; C:\Windows\System32\DRIVERS\klim6.sys [29792 2013-07-11] (Kaspersky Lab -> Kaspersky Lab ZAO) R1 kltdi; C:\Windows\System32\DRIVERS\kltdi.sys [54104 2012-11-22] (Kaspersky Lab -> Kaspersky Lab ZAO) R1 kneps; C:\Windows\System32\DRIVERS\kneps.sys [177760 2013-07-01] (Kaspersky Lab -> Kaspersky Lab ZAO) R2 MBAMChameleon; C:\Windows\System32\Drivers\MbamChameleon.sys [198512 2019-03-31] (Malwarebytes Corporation -> Malwarebytes) R3 MBAMFarflt; C:\Windows\System32\DRIVERS\farflt.sys [127136 2019-03-31] (Malwarebytes Corporation -> Malwarebytes) R3 MBAMProtection; C:\Windows\system32\DRIVERS\mbam.sys [73912 2019-03-31] (Malwarebytes Corporation -> Malwarebytes) R3 MBAMSwissArmy; C:\Windows\System32\Drivers\mbamswissarmy.sys [274416 2019-03-31] (Malwarebytes Corporation -> Malwarebytes) R3 MBAMWebProtection; C:\Windows\System32\DRIVERS\mwac.sys [104784 2019-03-31] (Malwarebytes Corporation -> Malwarebytes) S3 Netaapl; C:\Windows\System32\DRIVERS\netaapl64.sys [23040 2018-08-16] (Microsoft Windows Hardware Compatibility Publisher -> Apple Inc.) R3 taphss6; C:\Windows\System32\DRIVERS\taphss6.sys [42184 2013-10-15] (AnchorFree Inc -> Anchorfree Inc.) S3 USBAAPL64; C:\Windows\System32\Drivers\usbaapl64.sys [54784 2018-08-22] (Microsoft Windows Hardware Compatibility Publisher -> Apple, Inc.) S3 catchme; \??\C:\ComboFix\catchme.sys [X] S2 Haspnt; \??\C:\Program Files\InPage24\Haspnt.sys [X] ==================== NetSvcs (Whitelisted) =================== (If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.) ==================== One month (created) ======== (If an entry is included in the fixlist, the file/folder will be moved.) 2019-03-31 12:21 - 2019-03-31 12:22 - 000018322 _____ C:\Users\adeel.qureshi\Desktop\FRST.txt 2019-03-31 12:20 - 2019-03-31 12:20 - 000003759 _____ C:\Users\adeel.qureshi\Desktop\AdwCleaner[C00].txt 2019-03-31 12:18 - 2019-03-31 12:18 - 000127136 _____ (Malwarebytes) C:\Windows\system32\Drivers\farflt.sys 2019-03-31 12:18 - 2019-03-31 12:18 - 000104784 _____ (Malwarebytes) C:\Windows\system32\Drivers\mwac.sys 2019-03-31 12:18 - 2019-03-31 12:18 - 000073912 _____ (Malwarebytes) C:\Windows\system32\Drivers\mbam.sys 2019-03-31 12:17 - 2019-03-31 12:17 - 000274416 _____ (Malwarebytes) C:\Windows\system32\Drivers\mbamswissarmy.sys 2019-03-31 12:12 - 2019-03-31 12:15 - 000000000 ____D C:\AdwCleaner 2019-03-31 12:09 - 2019-03-31 12:12 - 000004070 _____ C:\Users\adeel.qureshi\Desktop\malware.txt 2019-03-31 11:46 - 2019-03-31 11:46 - 000973856 _____ C:\Windows\Minidump\033119-163317-01.dmp 2019-03-31 10:26 - 2019-03-31 10:26 - 002434048 _____ (Farbar) C:\Users\adeel.qureshi\Desktop\FRST64.exe 2019-03-31 10:26 - 2019-03-31 10:26 - 000000000 ____D C:\Users\adeel.qureshi\AppData\Local\mbam 2019-03-31 10:25 - 2019-03-31 10:26 - 007316688 _____ (Malwarebytes) C:\Users\adeel.qureshi\Desktop\adwcleaner_7.2.7.0.exe 2019-03-31 10:25 - 2019-03-31 10:25 - 000198512 _____ (Malwarebytes) C:\Windows\system32\Drivers\MbamChameleon.sys 2019-03-31 10:25 - 2019-03-31 10:25 - 000001867 _____ C:\Users\Public\Desktop\Malwarebytes.lnk 2019-03-31 10:25 - 2019-03-31 10:25 - 000000000 ____D C:\Users\adeel.qureshi\AppData\Local\mbamtray 2019-03-31 10:25 - 2019-03-31 10:25 - 000000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Malwarebytes 2019-03-31 10:25 - 2019-03-31 10:25 - 000000000 ____D C:\ProgramData\Malwarebytes 2019-03-31 10:25 - 2019-03-31 10:25 - 000000000 ____D C:\Program Files\Malwarebytes 2019-03-31 10:25 - 2019-01-08 16:32 - 000153328 _____ (Malwarebytes) C:\Windows\system32\Drivers\mbae64.sys 2019-03-31 10:24 - 2019-03-31 10:24 - 000000000 ____D C:\Users\adeel.qureshi\Desktop\New folder (4) 2019-03-31 08:53 - 2019-03-31 12:21 - 000000000 ____D C:\FRST 2019-03-28 14:58 - 2019-03-28 14:58 - 000002045 _____ C:\Users\Public\Desktop\SAP2000 20.lnk 2019-03-28 14:58 - 2019-03-28 14:58 - 000000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\SAP2000 20 2019-03-28 14:22 - 2019-03-28 14:22 - 000000000 ____D C:\Users\adeel.qureshi\AppData\Local\{4B294C2B-7177-4149-A3A6-48B530CE435E} 2019-03-20 16:44 - 2019-03-20 16:47 - 000000000 ____D C:\Users\adeel.qureshi\Documents\My Email Attachments 2019-03-20 16:42 - 2019-03-20 16:42 - 000000000 ____D C:\Users\adeel.qureshi\AppData\Roaming\MAPILab Ltd 2019-03-20 16:41 - 2019-03-20 16:41 - 000000000 ____D C:\Users\adeel.qureshi\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\MAPILab 2019-03-20 16:41 - 2019-03-20 16:41 - 000000000 ____D C:\Program Files (x86)\MAPILab Ltd 2019-03-19 08:52 - 2019-03-19 08:52 - 000002218 _____ C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Google Earth Pro.lnk 2019-03-13 12:12 - 2018-03-19 09:19 - 000000000 ____D C:\Users\adeel.qureshi\Desktop\GALCO SAP Models 2019-03-13 10:52 - 2019-03-13 10:53 - 000000000 ____D C:\Windows\rescache 2019-03-13 09:09 - 2019-02-16 08:32 - 000142336 _____ (Microsoft Corporation) C:\Windows\system32\poqexec.exe 2019-03-13 09:09 - 2019-02-16 08:30 - 000123904 _____ (Microsoft Corporation) C:\Windows\SysWOW64\poqexec.exe 2019-03-13 09:09 - 2019-02-10 19:41 - 012574208 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wmploc.DLL 2019-03-13 09:09 - 2019-02-10 19:41 - 011411968 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wmp.dll 2019-03-13 09:09 - 2019-02-10 19:41 - 003207168 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mf.dll 2019-03-13 09:09 - 2019-02-10 19:41 - 001329664 _____ (Microsoft Corporation) C:\Windows\SysWOW64\quartz.dll 2019-03-13 09:09 - 2019-02-10 19:41 - 001177088 _____ (Microsoft Corporation) C:\Windows\SysWOW64\crypt32.dll 2019-03-13 09:09 - 2019-02-10 19:41 - 001005056 _____ (Microsoft Corporation) C:\Windows\SysWOW64\cryptui.dll 2019-03-13 09:09 - 2019-02-10 19:41 - 000988160 _____ (Microsoft Corporation) C:\Windows\SysWOW64\drmv2clt.dll 2019-03-13 09:09 - 2019-02-10 19:41 - 000744960 _____ (Microsoft Corporation) C:\Windows\SysWOW64\blackbox.dll 2019-03-13 09:09 - 2019-02-10 19:41 - 000617984 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wmdrmsdk.dll 2019-03-13 09:09 - 2019-02-10 19:41 - 000519680 _____ (Microsoft Corporation) C:\Windows\SysWOW64\qdvd.dll 2019-03-13 09:09 - 2019-02-10 19:41 - 000504320 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msscp.dll 2019-03-13 09:09 - 2019-02-10 19:41 - 000489984 _____ (Microsoft Corporation) C:\Windows\SysWOW64\evr.dll 2019-03-13 09:09 - 2019-02-10 19:41 - 000442368 _____ (Microsoft Corporation) C:\Windows\SysWOW64\AUDIOKSE.dll 2019-03-13 09:09 - 2019-02-10 19:41 - 000406016 _____ (Microsoft Corporation) C:\Windows\SysWOW64\drmmgrtn.dll 2019-03-13 09:09 - 2019-02-10 19:41 - 000373248 _____ (Microsoft Corporation) C:\Windows\SysWOW64\AudioEng.dll 2019-03-13 09:09 - 2019-02-10 19:41 - 000354816 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mfplat.dll 2019-03-13 09:09 - 2019-02-10 19:41 - 000265216 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msnetobj.dll 2019-03-13 09:09 - 2019-02-10 19:41 - 000195072 _____ (Microsoft Corporation) C:\Windows\SysWOW64\AudioSes.dll 2019-03-13 09:09 - 2019-02-10 19:41 - 000179712 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wintrust.dll 2019-03-13 09:09 - 2019-02-10 19:41 - 000146432 _____ (Microsoft Corporation) C:\Windows\SysWOW64\cryptsvc.dll 2019-03-13 09:09 - 2019-02-10 19:41 - 000106496 _____ (Microsoft Corporation) C:\Windows\SysWOW64\cryptnet.dll 2019-03-13 09:09 - 2019-02-10 19:41 - 000103424 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mfps.dll 2019-03-13 09:09 - 2019-02-10 19:41 - 000080896 _____ (Microsoft Corporation) C:\Windows\SysWOW64\cryptsp.dll 2019-03-13 09:09 - 2019-02-10 19:41 - 000046592 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mssign32.dll 2019-03-13 09:09 - 2019-02-10 19:41 - 000002048 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mferror.dll 2019-03-13 09:09 - 2019-02-10 19:29 - 000008192 _____ (Microsoft Corporation) C:\Windows\SysWOW64\spwmp.dll 2019-03-13 09:09 - 2019-02-10 19:29 - 000004096 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msdxm.ocx 2019-03-13 09:09 - 2019-02-10 19:29 - 000004096 _____ (Microsoft Corporation) C:\Windows\SysWOW64\dxmasf.dll 2019-03-13 09:09 - 2019-02-10 19:28 - 000050176 _____ (Microsoft Corporation) C:\Windows\SysWOW64\rrinstaller.exe 2019-03-13 09:09 - 2019-02-10 19:28 - 000023040 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mfpmp.exe 2019-03-13 09:09 - 2019-02-10 19:10 - 000094440 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\mountmgr.sys 2019-03-13 09:09 - 2019-02-10 19:09 - 014635520 _____ (Microsoft Corporation) C:\Windows\system32\wmp.dll 2019-03-13 09:09 - 2019-02-10 19:09 - 012574720 _____ (Microsoft Corporation) C:\Windows\system32\wmploc.DLL 2019-03-13 09:09 - 2019-02-10 19:09 - 001574400 _____ (Microsoft Corporation) C:\Windows\system32\quartz.dll 2019-03-13 09:09 - 2019-02-10 19:09 - 000782848 _____ (Microsoft Corporation) C:\Windows\system32\wmdrmsdk.dll 2019-03-13 09:09 - 2019-02-10 19:09 - 000499712 _____ (Microsoft Corporation) C:\Windows\system32\AUDIOKSE.dll 2019-03-13 09:09 - 2019-02-10 19:09 - 000371712 _____ (Microsoft Corporation) C:\Windows\system32\qdvd.dll 2019-03-13 09:09 - 2019-02-10 19:09 - 000229376 _____ (Microsoft Corporation) C:\Windows\system32\wintrust.dll 2019-03-13 09:09 - 2019-02-10 19:09 - 000187904 _____ (Microsoft Corporation) C:\Windows\system32\pcasvc.dll 2019-03-13 09:09 - 2019-02-10 19:09 - 000037376 _____ (Microsoft Corporation) C:\Windows\system32\pcadm.dll 2019-03-13 09:09 - 2019-02-10 19:09 - 000009728 _____ (Microsoft Corporation) C:\Windows\system32\spwmp.dll 2019-03-13 09:09 - 2019-02-10 19:09 - 000008704 _____ (Microsoft Corporation) C:\Windows\system32\pcaevts.dll 2019-03-13 09:09 - 2019-02-10 19:09 - 000005120 _____ (Microsoft Corporation) C:\Windows\system32\msdxm.ocx 2019-03-13 09:09 - 2019-02-10 19:09 - 000005120 _____ (Microsoft Corporation) C:\Windows\system32\dxmasf.dll 2019-03-13 09:09 - 2019-02-10 19:08 - 004120576 _____ (Microsoft Corporation) C:\Windows\system32\mf.dll 2019-03-13 09:09 - 2019-02-10 19:08 - 001484800 _____ (Microsoft Corporation) C:\Windows\system32\crypt32.dll 2019-03-13 09:09 - 2019-02-10 19:08 - 001202176 _____ (Microsoft Corporation) C:\Windows\system32\drmv2clt.dll 2019-03-13 09:09 - 2019-02-10 19:08 - 001068544 _____ (Microsoft Corporation) C:\Windows\system32\cryptui.dll 2019-03-13 09:09 - 2019-02-10 19:08 - 000641024 _____ (Microsoft Corporation) C:\Windows\system32\msscp.dll 2019-03-13 09:09 - 2019-02-10 19:08 - 000632320 _____ (Microsoft Corporation) C:\Windows\system32\evr.dll 2019-03-13 09:09 - 2019-02-10 19:08 - 000497664 _____ (Microsoft Corporation) C:\Windows\system32\drmmgrtn.dll 2019-03-13 09:09 - 2019-02-10 19:08 - 000433152 _____ (Microsoft Corporation) C:\Windows\system32\mfplat.dll 2019-03-13 09:09 - 2019-02-10 19:08 - 000325632 _____ (Microsoft Corporation) C:\Windows\system32\msnetobj.dll 2019-03-13 09:09 - 2019-02-10 19:08 - 000284672 _____ (Microsoft Corporation) C:\Windows\system32\EncDump.dll 2019-03-13 09:09 - 2019-02-10 19:08 - 000206848 _____ (Microsoft Corporation) C:\Windows\system32\mfps.dll 2019-03-13 09:09 - 2019-02-10 19:08 - 000190976 _____ (Microsoft Corporation) C:\Windows\system32\cryptsvc.dll 2019-03-13 09:09 - 2019-02-10 19:08 - 000141824 _____ (Microsoft Corporation) C:\Windows\system32\cryptnet.dll 2019-03-13 09:09 - 2019-02-10 19:08 - 000081920 _____ (Microsoft Corporation) C:\Windows\system32\cryptsp.dll 2019-03-13 09:09 - 2019-02-10 19:08 - 000060416 _____ (Microsoft Corporation) C:\Windows\system32\mssign32.dll 2019-03-13 09:09 - 2019-02-10 19:08 - 000011264 _____ (Microsoft Corporation) C:\Windows\system32\msmmsp.dll 2019-03-13 09:09 - 2019-02-10 19:08 - 000002048 _____ (Microsoft Corporation) C:\Windows\system32\mferror.dll 2019-03-13 09:09 - 2019-02-10 19:07 - 000842240 _____ (Microsoft Corporation) C:\Windows\system32\blackbox.dll 2019-03-13 09:09 - 2019-02-10 19:07 - 000680448 _____ (Microsoft Corporation) C:\Windows\system32\audiosrv.dll 2019-03-13 09:09 - 2019-02-10 19:07 - 000438784 _____ (Microsoft Corporation) C:\Windows\system32\AudioEng.dll 2019-03-13 09:09 - 2019-02-10 19:07 - 000295936 _____ (Microsoft Corporation) C:\Windows\system32\AudioSes.dll 2019-03-13 09:09 - 2019-02-10 19:02 - 000663552 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\PEAuth.sys 2019-03-13 09:09 - 2019-02-10 18:50 - 000055808 _____ (Microsoft Corporation) C:\Windows\system32\rrinstaller.exe 2019-03-13 09:09 - 2019-02-10 18:49 - 000125952 _____ (Microsoft Corporation) C:\Windows\system32\audiodg.exe 2019-03-13 09:09 - 2019-02-10 18:49 - 000024576 _____ (Microsoft Corporation) C:\Windows\system32\mfpmp.exe 2019-03-13 09:09 - 2019-02-10 18:38 - 000011264 _____ (Microsoft Corporation) C:\Windows\system32\pcawrk.exe 2019-03-13 09:09 - 2019-02-10 18:38 - 000009728 _____ (Microsoft Corporation) C:\Windows\system32\pcalua.exe 2019-03-13 09:08 - 2019-03-06 06:18 - 000154856 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\ksecpkg.sys 2019-03-13 09:08 - 2019-03-06 06:18 - 000095464 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\ksecdd.sys 2019-03-13 09:08 - 2019-03-06 06:14 - 000708328 _____ (Microsoft Corporation) C:\Windows\system32\winload.efi 2019-03-13 09:08 - 2019-03-06 06:14 - 000631680 _____ (Microsoft Corporation) C:\Windows\system32\winresume.efi 2019-03-13 09:08 - 2019-03-06 06:13 - 005552872 _____ (Microsoft Corporation) C:\Windows\system32\ntoskrnl.exe 2019-03-13 09:08 - 2019-03-06 06:13 - 000262376 _____ (Microsoft Corporation) C:\Windows\system32\hal.dll 2019-03-13 09:08 - 2019-03-06 06:12 - 001664360 _____ (Microsoft Corporation) C:\Windows\system32\ntdll.dll 2019-03-13 09:08 - 2019-03-06 06:10 - 001472512 _____ (Microsoft Corporation) C:\Windows\system32\lsasrv.dll 2019-03-13 09:08 - 2019-03-06 06:10 - 001211392 _____ (Microsoft Corporation) C:\Windows\system32\rpcrt4.dll 2019-03-13 09:08 - 2019-03-06 06:10 - 001162752 _____ (Microsoft Corporation) C:\Windows\system32\kernel32.dll 2019-03-13 09:08 - 2019-03-06 06:10 - 000880640 _____ (Microsoft Corporation) C:\Windows\system32\advapi32.dll 2019-03-13 09:08 - 2019-03-06 06:10 - 000733184 _____ (Microsoft Corporation) C:\Windows\system32\kerberos.dll 2019-03-13 09:08 - 2019-03-06 06:10 - 000690688 _____ (Microsoft Corporation) C:\Windows\system32\adtschema.dll 2019-03-13 09:08 - 2019-03-06 06:10 - 000503808 _____ (Microsoft Corporation) C:\Windows\system32\srcore.dll 2019-03-13 09:08 - 2019-03-06 06:10 - 000463872 _____ (Microsoft Corporation) C:\Windows\system32\certcli.dll 2019-03-13 09:08 - 2019-03-06 06:10 - 000419840 _____ (Microsoft Corporation) C:\Windows\system32\KernelBase.dll 2019-03-13 09:08 - 2019-03-06 06:10 - 000361984 _____ (Microsoft Corporation) C:\Windows\system32\wow64win.dll 2019-03-13 09:08 - 2019-03-06 06:10 - 000345600 _____ (Microsoft Corporation) C:\Windows\system32\schannel.dll 2019-03-13 09:08 - 2019-03-06 06:10 - 000316928 _____ (Microsoft Corporation) C:\Windows\system32\msv1_0.dll 2019-03-13 09:08 - 2019-03-06 06:10 - 000312320 _____ (Microsoft Corporation) C:\Windows\system32\ncrypt.dll 2019-03-13 09:08 - 2019-03-06 06:10 - 000243712 _____ (Microsoft Corporation) C:\Windows\system32\wow64.dll 2019-03-13 09:08 - 2019-03-06 06:10 - 000236032 _____ (Microsoft Corporation) C:\Windows\system32\srvsvc.dll 2019-03-13 09:08 - 2019-03-06 06:10 - 000215552 _____ (Microsoft Corporation) C:\Windows\system32\winsrv.dll 2019-03-13 09:08 - 2019-03-06 06:10 - 000210432 _____ (Microsoft Corporation) C:\Windows\system32\wdigest.dll 2019-03-13 09:08 - 2019-03-06 06:10 - 000190464 _____ (Microsoft Corporation) C:\Windows\system32\rpchttp.dll 2019-03-13 09:08 - 2019-03-06 06:10 - 000146432 _____ (Microsoft Corporation) C:\Windows\system32\msaudite.dll 2019-03-13 09:08 - 2019-03-06 06:10 - 000135680 _____ (Microsoft Corporation) C:\Windows\system32\sspicli.dll 2019-03-13 09:08 - 2019-03-06 06:10 - 000123904 _____ (Microsoft Corporation) C:\Windows\system32\bcrypt.dll 2019-03-13 09:08 - 2019-03-06 06:10 - 000094208 _____ (Microsoft Corporation) C:\Windows\system32\TSpkg.dll 2019-03-13 09:08 - 2019-03-06 06:10 - 000063488 _____ (Microsoft Corporation) C:\Windows\system32\setbcdlocale.dll 2019-03-13 09:08 - 2019-03-06 06:10 - 000060416 _____ (Microsoft Corporation) C:\Windows\system32\msobjs.dll 2019-03-13 09:08 - 2019-03-06 06:10 - 000059904 _____ (Microsoft Corporation) C:\Windows\system32\appidapi.dll 2019-03-13 09:08 - 2019-03-06 06:10 - 000050176 _____ (Microsoft Corporation) C:\Windows\system32\srclient.dll 2019-03-13 09:08 - 2019-03-06 06:10 - 000044032 _____ (Microsoft Corporation) C:\Windows\system32\csrsrv.dll 2019-03-13 09:08 - 2019-03-06 06:10 - 000043520 _____ (Microsoft Corporation) C:\Windows\system32\cryptbase.dll 2019-03-13 09:08 - 2019-03-06 06:10 - 000034816 _____ (Microsoft Corporation) C:\Windows\system32\appidsvc.dll 2019-03-13 09:08 - 2019-03-06 06:10 - 000028672 _____ (Microsoft Corporation) C:\Windows\system32\sspisrv.dll 2019-03-13 09:08 - 2019-03-06 06:10 - 000028160 _____ (Microsoft Corporation) C:\Windows\system32\secur32.dll 2019-03-13 09:08 - 2019-03-06 06:10 - 000022016 _____ (Microsoft Corporation) C:\Windows\system32\credssp.dll 2019-03-13 09:08 - 2019-03-06 06:10 - 000016384 _____ (Microsoft Corporation) C:\Windows\system32\ntvdm64.dll 2019-03-13 09:08 - 2019-03-06 06:10 - 000013312 _____ (Microsoft Corporation) C:\Windows\system32\wow64cpu.dll 2019-03-13 09:08 - 2019-03-06 06:10 - 000013312 _____ (Microsoft Corporation) C:\Windows\system32\sscore.dll 2019-03-13 09:08 - 2019-03-06 06:10 - 000007168 _____ (Microsoft Corporation) C:\Windows\system32\apisetschema.dll 2019-03-13 09:08 - 2019-03-06 06:10 - 000006144 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-security-base-l1-1-0.dll 2019-03-13 09:08 - 2019-03-06 06:10 - 000005120 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-file-l1-1-0.dll 2019-03-13 09:08 - 2019-03-06 06:10 - 000004608 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-threadpool-l1-1-0.dll 2019-03-13 09:08 - 2019-03-06 06:10 - 000004608 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-processthreads-l1-1-0.dll 2019-03-13 09:08 - 2019-03-06 06:10 - 000004096 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-sysinfo-l1-1-0.dll 2019-03-13 09:08 - 2019-03-06 06:10 - 000004096 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-synch-l1-1-0.dll 2019-03-13 09:08 - 2019-03-06 06:10 - 000004096 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-localregistry-l1-1-0.dll 2019-03-13 09:08 - 2019-03-06 06:10 - 000004096 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-localization-l1-1-0.dll 2019-03-13 09:08 - 2019-03-06 06:10 - 000003584 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-rtlsupport-l1-1-0.dll 2019-03-13 09:08 - 2019-03-06 06:10 - 000003584 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-processenvironment-l1-1-0.dll 2019-03-13 09:08 - 2019-03-06 06:10 - 000003584 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-namedpipe-l1-1-0.dll 2019-03-13 09:08 - 2019-03-06 06:10 - 000003584 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-misc-l1-1-0.dll 2019-03-13 09:08 - 2019-03-06 06:10 - 000003584 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-memory-l1-1-0.dll 2019-03-13 09:08 - 2019-03-06 06:10 - 000003584 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-libraryloader-l1-1-0.dll 2019-03-13 09:08 - 2019-03-06 06:10 - 000003584 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-heap-l1-1-0.dll 2019-03-13 09:08 - 2019-03-06 06:10 - 000003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-xstate-l1-1-0.dll 2019-03-13 09:08 - 2019-03-06 06:10 - 000003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-util-l1-1-0.dll 2019-03-13 09:08 - 2019-03-06 06:10 - 000003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-string-l1-1-0.dll 2019-03-13 09:08 - 2019-03-06 06:10 - 000003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-profile-l1-1-0.dll 2019-03-13 09:08 - 2019-03-06 06:10 - 000003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-io-l1-1-0.dll 2019-03-13 09:08 - 2019-03-06 06:10 - 000003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-interlocked-l1-1-0.dll 2019-03-13 09:08 - 2019-03-06 06:10 - 000003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-handle-l1-1-0.dll 2019-03-13 09:08 - 2019-03-06 06:10 - 000003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-fibers-l1-1-0.dll 2019-03-13 09:08 - 2019-03-06 06:10 - 000003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-errorhandling-l1-1-0.dll 2019-03-13 09:08 - 2019-03-06 06:10 - 000003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-delayload-l1-1-0.dll 2019-03-13 09:08 - 2019-03-06 06:10 - 000003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-debug-l1-1-0.dll 2019-03-13 09:08 - 2019-03-06 06:10 - 000003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-datetime-l1-1-0.dll 2019-03-13 09:08 - 2019-03-06 06:10 - 000003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-console-l1-1-0.dll 2019-03-13 09:08 - 2019-03-06 06:04 - 004055784 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ntkrnlpa.exe 2019-03-13 09:08 - 2019-03-06 06:04 - 003960552 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ntoskrnl.exe 2019-03-13 09:08 - 2019-03-06 06:02 - 001314104 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ntdll.dll 2019-03-13 09:08 - 2019-03-06 06:01 - 001114112 _____ (Microsoft Corporation) C:\Windows\SysWOW64\kernel32.dll 2019-03-13 09:08 - 2019-03-06 06:01 - 000666112 _____ (Microsoft Corporation) C:\Windows\SysWOW64\rpcrt4.dll 2019-03-13 09:08 - 2019-03-06 06:01 - 000556032 _____ (Microsoft Corporation) C:\Windows\SysWOW64\kerberos.dll 2019-03-13 09:08 - 2019-03-06 06:01 - 000275968 _____ (Microsoft Corporation) C:\Windows\SysWOW64\KernelBase.dll 2019-03-13 09:08 - 2019-03-06 06:01 - 000261120 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msv1_0.dll 2019-03-13 09:08 - 2019-03-06 06:01 - 000254464 _____ (Microsoft Corporation) C:\Windows\SysWOW64\schannel.dll 2019-03-13 09:08 - 2019-03-06 06:01 - 000223232 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ncrypt.dll 2019-03-13 09:08 - 2019-03-06 06:01 - 000172032 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wdigest.dll 2019-03-13 09:08 - 2019-03-06 06:01 - 000146432 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msaudite.dll 2019-03-13 09:08 - 2019-03-06 06:01 - 000141312 _____ (Microsoft Corporation) C:\Windows\SysWOW64\rpchttp.dll 2019-03-13 09:08 - 2019-03-06 06:01 - 000096768 _____ (Microsoft Corporation) C:\Windows\SysWOW64\sspicli.dll 2019-03-13 09:08 - 2019-03-06 06:01 - 000082944 _____ (Microsoft Corporation) C:\Windows\SysWOW64\bcrypt.dll 2019-03-13 09:08 - 2019-03-06 06:01 - 000070144 _____ (Microsoft Corporation) C:\Windows\SysWOW64\TSpkg.dll 2019-03-13 09:08 - 2019-03-06 06:01 - 000060416 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msobjs.dll 2019-03-13 09:08 - 2019-03-06 06:01 - 000043008 _____ (Microsoft Corporation) C:\Windows\SysWOW64\srclient.dll 2019-03-13 09:08 - 2019-03-06 06:01 - 000022016 _____ (Microsoft Corporation) C:\Windows\SysWOW64\secur32.dll 2019-03-13 09:08 - 2019-03-06 06:01 - 000005120 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wow32.dll 2019-03-13 09:08 - 2019-03-06 06:00 - 000690688 _____ (Microsoft Corporation) C:\Windows\SysWOW64\adtschema.dll 2019-03-13 09:08 - 2019-03-06 06:00 - 000644096 _____ (Microsoft Corporation) C:\Windows\SysWOW64\advapi32.dll 2019-03-13 09:08 - 2019-03-06 06:00 - 000342528 _____ (Microsoft Corporation) C:\Windows\SysWOW64\certcli.dll 2019-03-13 09:08 - 2019-03-06 06:00 - 000050688 _____ (Microsoft Corporation) C:\Windows\SysWOW64\appidapi.dll 2019-03-13 09:08 - 2019-03-06 06:00 - 000017408 _____ (Microsoft Corporation) C:\Windows\SysWOW64\credssp.dll 2019-03-13 09:08 - 2019-03-06 06:00 - 000007168 _____ (Microsoft Corporation) C:\Windows\SysWOW64\apisetschema.dll 2019-03-13 09:08 - 2019-03-06 06:00 - 000005120 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-file-l1-1-0.dll 2019-03-13 09:08 - 2019-03-06 06:00 - 000004608 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-processthreads-l1-1-0.dll 2019-03-13 09:08 - 2019-03-06 06:00 - 000004096 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-sysinfo-l1-1-0.dll 2019-03-13 09:08 - 2019-03-06 06:00 - 000004096 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-synch-l1-1-0.dll 2019-03-13 09:08 - 2019-03-06 06:00 - 000004096 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-misc-l1-1-0.dll 2019-03-13 09:08 - 2019-03-06 06:00 - 000004096 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-localregistry-l1-1-0.dll 2019-03-13 09:08 - 2019-03-06 06:00 - 000004096 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-localization-l1-1-0.dll 2019-03-13 09:08 - 2019-03-06 06:00 - 000003584 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-processenvironment-l1-1-0.dll 2019-03-13 09:08 - 2019-03-06 06:00 - 000003584 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-namedpipe-l1-1-0.dll 2019-03-13 09:08 - 2019-03-06 06:00 - 000003584 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-memory-l1-1-0.dll 2019-03-13 09:08 - 2019-03-06 06:00 - 000003584 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-libraryloader-l1-1-0.dll 2019-03-13 09:08 - 2019-03-06 06:00 - 000003584 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-interlocked-l1-1-0.dll 2019-03-13 09:08 - 2019-03-06 06:00 - 000003584 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-heap-l1-1-0.dll 2019-03-13 09:08 - 2019-03-06 06:00 - 000003072 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-string-l1-1-0.dll 2019-03-13 09:08 - 2019-03-06 06:00 - 000003072 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-rtlsupport-l1-1-0.dll 2019-03-13 09:08 - 2019-03-06 06:00 - 000003072 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-profile-l1-1-0.dll 2019-03-13 09:08 - 2019-03-06 06:00 - 000003072 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-io-l1-1-0.dll 2019-03-13 09:08 - 2019-03-06 06:00 - 000003072 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-handle-l1-1-0.dll 2019-03-13 09:08 - 2019-03-06 06:00 - 000003072 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-fibers-l1-1-0.dll 2019-03-13 09:08 - 2019-03-06 06:00 - 000003072 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-errorhandling-l1-1-0.dll 2019-03-13 09:08 - 2019-03-06 06:00 - 000003072 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-delayload-l1-1-0.dll 2019-03-13 09:08 - 2019-03-06 06:00 - 000003072 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-debug-l1-1-0.dll 2019-03-13 09:08 - 2019-03-06 06:00 - 000003072 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-datetime-l1-1-0.dll 2019-03-13 09:08 - 2019-03-06 06:00 - 000003072 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-console-l1-1-0.dll 2019-03-13 09:08 - 2019-03-06 05:45 - 000148480 _____ (Microsoft Corporation) C:\Windows\system32\appidpolicyconverter.exe 2019-03-13 09:08 - 2019-03-06 05:45 - 000062464 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\appid.sys 2019-03-13 09:08 - 2019-03-06 05:45 - 000017920 _____ (Microsoft Corporation) C:\Windows\system32\appidcertstorecheck.exe 2019-03-13 09:08 - 2019-03-06 05:44 - 000064512 _____ (Microsoft Corporation) C:\Windows\system32\auditpol.exe 2019-03-13 09:08 - 2019-03-06 05:42 - 003228160 _____ (Microsoft Corporation) C:\Windows\system32\win32k.sys 2019-03-13 09:08 - 2019-03-06 05:42 - 000338432 _____ (Microsoft Corporation) C:\Windows\system32\conhost.exe 2019-03-13 09:08 - 2019-03-06 05:41 - 000296960 _____ (Microsoft Corporation) C:\Windows\system32\rstrui.exe 2019-03-13 09:08 - 2019-03-06 05:41 - 000129536 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\videoprt.sys 2019-03-13 09:08 - 2019-03-06 05:41 - 000009728 _____ (Microsoft Corporation) C:\Windows\SysWOW64\sscore.dll 2019-03-13 09:08 - 2019-03-06 05:40 - 000050688 _____ (Microsoft Corporation) C:\Windows\SysWOW64\auditpol.exe 2019-03-13 09:08 - 2019-03-06 05:38 - 000464384 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\srv.sys 2019-03-13 09:08 - 2019-03-06 05:38 - 000406016 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\srv2.sys 2019-03-13 09:08 - 2019-03-06 05:38 - 000291328 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\mrxsmb10.sys 2019-03-13 09:08 - 2019-03-06 05:38 - 000169984 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\srvnet.sys 2019-03-13 09:08 - 2019-03-06 05:38 - 000161280 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\mrxsmb.sys 2019-03-13 09:08 - 2019-03-06 05:38 - 000129536 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\mrxsmb20.sys 2019-03-13 09:08 - 2019-03-06 05:37 - 000112640 _____ (Microsoft Corporation) C:\Windows\system32\smss.exe 2019-03-13 09:08 - 2019-03-06 05:37 - 000064512 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\amdk8.sys 2019-03-13 09:08 - 2019-03-06 05:37 - 000062464 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\intelppm.sys 2019-03-13 09:08 - 2019-03-06 05:37 - 000060928 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\processr.sys 2019-03-13 09:08 - 2019-03-06 05:37 - 000060928 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\amdppm.sys 2019-03-13 09:08 - 2019-03-06 05:37 - 000044544 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\npfs.sys 2019-03-13 09:08 - 2019-03-06 05:37 - 000030720 _____ (Microsoft Corporation) C:\Windows\system32\lsass.exe 2019-03-13 09:08 - 2019-03-06 05:37 - 000025600 _____ (Microsoft Corporation) C:\Windows\SysWOW64\setup16.exe 2019-03-13 09:08 - 2019-03-06 05:37 - 000014336 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ntvdm64.dll 2019-03-13 09:08 - 2019-03-06 05:37 - 000007680 _____ (Microsoft Corporation) C:\Windows\SysWOW64\instnm.exe 2019-03-13 09:08 - 2019-03-06 05:37 - 000002048 _____ (Microsoft Corporation) C:\Windows\SysWOW64\user.exe 2019-03-13 09:08 - 2019-03-06 05:36 - 000036352 _____ (Microsoft Corporation) C:\Windows\SysWOW64\cryptbase.dll 2019-03-13 09:08 - 2019-03-06 05:36 - 000006144 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-security-base-l1-1-0.dll 2019-03-13 09:08 - 2019-03-06 05:36 - 000004608 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-threadpool-l1-1-0.dll 2019-03-13 09:08 - 2019-03-06 05:36 - 000003584 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-xstate-l1-1-0.dll 2019-03-13 09:08 - 2019-03-06 05:36 - 000003072 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-util-l1-1-0.dll 2019-03-13 09:08 - 2019-03-05 05:44 - 000076800 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\hidclass.sys 2019-03-13 09:08 - 2019-03-05 05:44 - 000033280 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\hidparse.sys 2019-03-13 09:08 - 2019-03-05 05:44 - 000030208 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\hidusb.sys 2019-03-13 09:08 - 2019-02-27 01:41 - 000397104 _____ (Microsoft Corporation) C:\Windows\system32\iedkcs32.dll 2019-03-13 09:08 - 2019-02-27 00:47 - 000348984 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iedkcs32.dll 2019-03-13 09:08 - 2019-02-26 10:57 - 025737216 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.dll 2019-03-13 09:08 - 2019-02-26 10:46 - 002724864 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.tlb 2019-03-13 09:08 - 2019-02-26 10:45 - 000004096 _____ (Microsoft Corporation) C:\Windows\system32\ieetwcollectorres.dll 2019-03-13 09:08 - 2019-02-26 10:33 - 002902528 _____ (Microsoft Corporation) C:\Windows\system32\iertutil.dll 2019-03-13 09:08 - 2019-02-26 10:32 - 000066560 _____ (Microsoft Corporation) C:\Windows\system32\iesetup.dll 2019-03-13 09:08 - 2019-02-26 10:31 - 000576512 _____ (Microsoft Corporation) C:\Windows\system32\vbscript.dll 2019-03-13 09:08 - 2019-02-26 10:31 - 000417280 _____ (Microsoft Corporation) C:\Windows\system32\html.iec 2019-03-13 09:08 - 2019-02-26 10:31 - 000088064 _____ (Microsoft Corporation) C:\Windows\system32\MshtmlDac.dll 2019-03-13 09:08 - 2019-02-26 10:31 - 000048640 _____ (Microsoft Corporation) C:\Windows\system32\ieetwproxystub.dll 2019-03-13 09:08 - 2019-02-26 10:25 - 020281856 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.dll 2019-03-13 09:08 - 2019-02-26 10:25 - 000054784 _____ (Microsoft Corporation) C:\Windows\system32\jsproxy.dll 2019-03-13 09:08 - 2019-02-26 10:24 - 000034304 _____ (Microsoft Corporation) C:\Windows\system32\iernonce.dll 2019-03-13 09:08 - 2019-02-26 10:22 - 005777920 _____ (Microsoft Corporation) C:\Windows\system32\jscript9.dll 2019-03-13 09:08 - 2019-02-26 10:21 - 000615936 _____ (Microsoft Corporation) C:\Windows\system32\ieui.dll 2019-03-13 09:08 - 2019-02-26 10:20 - 000814080 _____ (Microsoft Corporation) C:\Windows\system32\jscript9diag.dll 2019-03-13 09:08 - 2019-02-26 10:20 - 000790528 _____ (Microsoft Corporation) C:\Windows\system32\jscript.dll 2019-03-13 09:08 - 2019-02-26 10:20 - 000144384 _____ (Microsoft Corporation) C:\Windows\system32\ieUnatt.exe 2019-03-13 09:08 - 2019-02-26 10:20 - 000116224 _____ (Microsoft Corporation) C:\Windows\system32\ieetwcollector.exe 2019-03-13 09:08 - 2019-02-26 10:19 - 002724864 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.tlb 2019-03-13 09:08 - 2019-02-26 10:12 - 000969216 _____ (Microsoft Corporation) C:\Windows\system32\MsSpellCheckingFacility.exe 2019-03-13 09:08 - 2019-02-26 10:09 - 000489984 _____ (Microsoft Corporation) C:\Windows\system32\dxtmsft.dll 2019-03-13 09:08 - 2019-02-26 10:07 - 000498176 _____ (Microsoft Corporation) C:\Windows\SysWOW64\vbscript.dll 2019-03-13 09:08 - 2019-02-26 10:07 - 000062464 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iesetup.dll 2019-03-13 09:08 - 2019-02-26 10:06 - 000341504 _____ (Microsoft Corporation) C:\Windows\SysWOW64\html.iec 2019-03-13 09:08 - 2019-02-26 10:06 - 000047616 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieetwproxystub.dll 2019-03-13 09:08 - 2019-02-26 10:05 - 000064000 _____ (Microsoft Corporation) C:\Windows\SysWOW64\MshtmlDac.dll 2019-03-13 09:08 - 2019-02-26 10:04 - 002295808 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iertutil.dll 2019-03-13 09:08 - 2019-02-26 10:03 - 000077824 _____ (Microsoft Corporation) C:\Windows\system32\JavaScriptCollectionAgent.dll 2019-03-13 09:08 - 2019-02-26 10:02 - 000107520 _____ (Microsoft Corporation) C:\Windows\system32\inseng.dll 2019-03-13 09:08 - 2019-02-26 10:02 - 000087552 _____ (Microsoft Corporation) C:\Windows\system32\tdc.ocx 2019-03-13 09:08 - 2019-02-26 10:01 - 000047104 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jsproxy.dll 2019-03-13 09:08 - 2019-02-26 10:00 - 000030720 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iernonce.dll 2019-03-13 09:08 - 2019-02-26 09:59 - 000199680 _____ (Microsoft Corporation) C:\Windows\system32\msrating.dll 2019-03-13 09:08 - 2019-02-26 09:58 - 000476160 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieui.dll 2019-03-13 09:08 - 2019-02-26 09:58 - 000092160 _____ (Microsoft Corporation) C:\Windows\system32\mshtmled.dll 2019-03-13 09:08 - 2019-02-26 09:57 - 000663040 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript.dll 2019-03-13 09:08 - 2019-02-26 09:57 - 000620032 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript9diag.dll 2019-03-13 09:08 - 2019-02-26 09:57 - 000115712 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieUnatt.exe 2019-03-13 09:08 - 2019-02-26 09:56 - 000315392 _____ (Microsoft Corporation) C:\Windows\system32\dxtrans.dll 2019-03-13 09:08 - 2019-02-26 09:54 - 000152064 _____ (Microsoft Corporation) C:\Windows\system32\occache.dll 2019-03-13 09:08 - 2019-02-26 09:49 - 000416256 _____ (Microsoft Corporation) C:\Windows\SysWOW64\dxtmsft.dll 2019-03-13 09:08 - 2019-02-26 09:46 - 000262144 _____ (Microsoft Corporation) C:\Windows\system32\webcheck.dll 2019-03-13 09:08 - 2019-02-26 09:44 - 000073216 _____ (Microsoft Corporation) C:\Windows\SysWOW64\tdc.ocx 2019-03-13 09:08 - 2019-02-26 09:44 - 000060416 _____ (Microsoft Corporation) C:\Windows\SysWOW64\JavaScriptCollectionAgent.dll 2019-03-13 09:08 - 2019-02-26 09:43 - 015284224 _____ (Microsoft Corporation) C:\Windows\system32\ieframe.dll 2019-03-13 09:08 - 2019-02-26 09:43 - 000809472 _____ (Microsoft Corporation) C:\Windows\system32\msfeeds.dll 2019-03-13 09:08 - 2019-02-26 09:43 - 000728064 _____ (Microsoft Corporation) C:\Windows\system32\ie4uinit.exe 2019-03-13 09:08 - 2019-02-26 09:43 - 000091136 _____ (Microsoft Corporation) C:\Windows\SysWOW64\inseng.dll 2019-03-13 09:08 - 2019-02-26 09:41 - 002135552 _____ (Microsoft Corporation) C:\Windows\system32\inetcpl.cpl 2019-03-13 09:08 - 2019-02-26 09:41 - 001359360 _____ (Microsoft Corporation) C:\Windows\system32\mshtmlmedia.dll 2019-03-13 09:08 - 2019-02-26 09:41 - 000168960 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msrating.dll 2019-03-13 09:08 - 2019-02-26 09:41 - 000076288 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtmled.dll 2019-03-13 09:08 - 2019-02-26 09:39 - 000279040 _____ (Microsoft Corporation) C:\Windows\SysWOW64\dxtrans.dll 2019-03-13 09:08 - 2019-02-26 09:38 - 000130048 _____ (Microsoft Corporation) C:\Windows\SysWOW64\occache.dll 2019-03-13 09:08 - 2019-02-26 09:35 - 004494848 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript9.dll 2019-03-13 09:08 - 2019-02-26 09:33 - 000230400 _____ (Microsoft Corporation) C:\Windows\SysWOW64\webcheck.dll 2019-03-13 09:08 - 2019-02-26 09:31 - 002059776 _____ (Microsoft Corporation) C:\Windows\SysWOW64\inetcpl.cpl 2019-03-13 09:08 - 2019-02-26 09:31 - 000696320 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msfeeds.dll 2019-03-13 09:08 - 2019-02-26 09:30 - 001155072 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtmlmedia.dll 2019-03-13 09:08 - 2019-02-26 09:29 - 013681664 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieframe.dll 2019-03-13 09:08 - 2019-02-26 09:29 - 004858880 _____ (Microsoft Corporation) C:\Windows\system32\wininet.dll 2019-03-13 09:08 - 2019-02-26 09:18 - 001557504 _____ (Microsoft Corporation) C:\Windows\system32\urlmon.dll 2019-03-13 09:08 - 2019-02-26 09:12 - 004386304 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wininet.dll 2019-03-13 09:08 - 2019-02-26 09:09 - 001332224 _____ (Microsoft Corporation) C:\Windows\SysWOW64\urlmon.dll 2019-03-13 09:08 - 2019-02-26 09:07 - 000710144 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieapfltr.dll 2019-03-13 09:08 - 2019-02-26 09:06 - 000800768 _____ (Microsoft Corporation) C:\Windows\system32\ieapfltr.dll 2019-03-13 09:08 - 2019-02-22 06:07 - 000058880 _____ (Microsoft Corporation) C:\Windows\system32\mf3216.dll 2019-03-13 09:08 - 2019-02-22 06:07 - 000008192 _____ (Microsoft Corporation) C:\Windows\system32\msimg32.dll 2019-03-13 09:08 - 2019-02-22 05:56 - 000004608 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msimg32.dll 2019-03-13 09:08 - 2019-02-22 05:55 - 000044032 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mf3216.dll 2019-03-13 09:08 - 2019-02-22 05:35 - 000313344 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msrd2x40.dll 2019-03-13 09:08 - 2019-02-16 09:02 - 002072576 _____ (Microsoft Corporation) C:\Windows\system32\ole32.dll 2019-03-13 09:08 - 2019-02-16 09:02 - 000972288 _____ (Microsoft Corporation) C:\Windows\system32\localspl.dll 2019-03-13 09:08 - 2019-02-16 09:02 - 000878080 _____ (Microsoft Corporation) C:\Windows\system32\oleaut32.dll 2019-03-13 09:08 - 2019-02-16 09:02 - 000516608 _____ (Microsoft Corporation) C:\Windows\system32\rpcss.dll 2019-03-13 09:08 - 2019-02-16 09:02 - 000443904 _____ (Microsoft Corporation) C:\Windows\system32\winspool.drv 2019-03-13 09:08 - 2019-02-16 09:02 - 000026112 _____ (Microsoft Corporation) C:\Windows\system32\oleres.dll 2019-03-13 09:08 - 2019-02-16 09:01 - 000008704 _____ (Microsoft Corporation) C:\Windows\system32\comcat.dll 2019-03-13 09:08 - 2019-02-16 08:50 - 001425920 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ole32.dll 2019-03-13 09:08 - 2019-02-16 08:50 - 000583680 _____ (Microsoft Corporation) C:\Windows\SysWOW64\oleaut32.dll 2019-03-13 09:08 - 2019-02-16 08:50 - 000321536 _____ (Microsoft Corporation) C:\Windows\SysWOW64\winspool.drv 2019-03-13 09:08 - 2019-02-16 08:50 - 000026112 _____ (Microsoft Corporation) C:\Windows\SysWOW64\oleres.dll 2019-03-13 09:08 - 2019-02-16 08:33 - 000007168 _____ (Microsoft Corporation) C:\Windows\SysWOW64\comcat.dll 2019-03-13 09:08 - 2019-02-15 19:09 - 000485888 _____ (Microsoft Corporation) C:\Windows\system32\wer.dll 2019-03-13 09:08 - 2019-02-15 19:09 - 000355328 _____ (Microsoft Corporation) C:\Windows\system32\Faultrep.dll 2019-03-13 09:08 - 2019-02-15 19:09 - 000034304 _____ (Microsoft Corporation) C:\Windows\system32\werdiagcontroller.dll 2019-03-13 09:08 - 2019-02-15 18:58 - 000382976 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wer.dll 2019-03-13 09:08 - 2019-02-15 18:58 - 000320512 _____ (Microsoft Corporation) C:\Windows\SysWOW64\Faultrep.dll 2019-03-13 09:08 - 2019-02-15 18:40 - 000415744 _____ (Microsoft Corporation) C:\Windows\system32\WerFault.exe 2019-03-13 09:08 - 2019-02-15 18:40 - 000050688 _____ (Microsoft Corporation) C:\Windows\system32\wermgr.exe 2019-03-13 09:08 - 2019-02-15 18:40 - 000026112 _____ (Microsoft Corporation) C:\Windows\system32\WerFaultSecure.exe 2019-03-13 09:08 - 2019-02-15 18:38 - 000360960 _____ (Microsoft Corporation) C:\Windows\SysWOW64\WerFault.exe 2019-03-13 09:08 - 2019-02-15 18:38 - 000053760 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wermgr.exe 2019-03-13 09:08 - 2019-02-15 18:38 - 000028672 _____ (Microsoft Corporation) C:\Windows\SysWOW64\WerFaultSecure.exe 2019-03-13 09:08 - 2019-02-15 18:38 - 000028672 _____ (Microsoft Corporation) C:\Windows\SysWOW64\werdiagcontroller.dll 2019-03-13 09:08 - 2019-02-10 19:10 - 001680104 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\ntfs.sys 2019-03-13 09:08 - 2019-02-10 18:36 - 000328192 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\udfs.sys 2019-03-13 09:08 - 2019-02-10 18:36 - 000205312 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\fastfat.sys 2019-03-13 09:08 - 2019-02-10 18:36 - 000195584 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\exfat.sys 2019-03-13 09:08 - 2019-02-10 18:35 - 000092672 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\cdfs.sys 2019-03-13 09:08 - 2019-02-08 19:08 - 002009088 _____ (Microsoft Corporation) C:\Windows\system32\msxml6.dll 2019-03-13 09:08 - 2019-02-08 19:08 - 001889280 _____ (Microsoft Corporation) C:\Windows\system32\msxml3.dll 2019-03-13 09:08 - 2019-02-08 19:08 - 000002048 _____ (Microsoft Corporation) C:\Windows\system32\msxml6r.dll 2019-03-13 09:08 - 2019-02-08 19:08 - 000002048 _____ (Microsoft Corporation) C:\Windows\system32\msxml3r.dll 2019-03-13 09:08 - 2019-02-08 19:07 - 001133568 _____ (Microsoft Corporation) C:\Windows\system32\cdosys.dll 2019-03-13 09:08 - 2019-02-08 18:59 - 001391104 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msxml6.dll 2019-03-13 09:08 - 2019-02-08 18:59 - 001241088 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msxml3.dll 2019-03-13 09:08 - 2019-02-08 18:59 - 000805376 _____ (Microsoft Corporation) C:\Windows\SysWOW64\cdosys.dll 2019-03-13 09:08 - 2019-02-08 18:59 - 000002048 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msxml6r.dll 2019-03-13 09:08 - 2019-02-08 18:59 - 000002048 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msxml3r.dll 2019-03-13 09:08 - 2019-02-07 19:06 - 000027648 _____ (Microsoft Corporation) C:\Windows\system32\brdgcfg.dll 2019-03-13 09:08 - 2019-02-07 19:06 - 000002048 _____ (Microsoft Corporation) C:\Windows\system32\bridgeres.dll 2019-03-13 09:08 - 2019-02-07 19:01 - 000095232 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\bridge.sys 2019-03-13 09:08 - 2019-02-07 18:46 - 000020992 _____ (Microsoft Corporation) C:\Windows\system32\bridgeunattend.exe 2019-03-13 09:08 - 2019-02-03 18:36 - 000026112 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\msfs.sys 2019-03-13 09:08 - 2019-01-04 19:13 - 000143592 _____ (Microsoft Corporation) C:\Windows\system32\CompatTelRunner.exe 2019-03-13 09:08 - 2019-01-04 19:07 - 000727040 _____ (Microsoft Corporation) C:\Windows\system32\aeinv.dll 2019-03-13 09:08 - 2019-01-04 17:05 - 002862592 _____ (Microsoft Corporation) C:\Windows\system32\aitstatic.exe 2019-03-13 09:08 - 2019-01-04 17:05 - 001635328 _____ (Microsoft Corporation) C:\Windows\system32\appraiser.dll 2019-03-13 09:08 - 2019-01-04 17:05 - 000799744 _____ (Microsoft Corporation) C:\Windows\system32\generaltel.dll 2019-03-13 09:08 - 2019-01-04 17:05 - 000623104 _____ (Microsoft Corporation) C:\Windows\system32\devinv.dll 2019-03-13 09:08 - 2019-01-04 17:05 - 000495616 _____ (Microsoft Corporation) C:\Windows\system32\centel.dll 2019-03-13 09:08 - 2019-01-04 17:05 - 000451584 _____ (Microsoft Corporation) C:\Windows\system32\invagent.dll 2019-03-13 09:08 - 2019-01-04 17:05 - 000313856 _____ (Microsoft Corporation) C:\Windows\system32\acmigration.dll 2019-03-13 09:08 - 2019-01-04 17:05 - 000253952 _____ (Microsoft Corporation) C:\Windows\system32\aepic.dll 2019-03-13 09:08 - 2019-01-03 19:10 - 000002048 _____ (Microsoft Corporation) C:\Windows\system32\tzres.dll 2019-03-13 09:08 - 2019-01-03 18:55 - 000002048 _____ (Microsoft Corporation) C:\Windows\SysWOW64\tzres.dll ==================== One month (modified) ======== (If an entry is included in the fixlist, the file/folder will be moved.) 2019-03-31 12:17 - 2015-03-31 09:24 - 000000000 ____D C:\ProgramData\Kaspersky Lab 2019-03-31 12:17 - 2012-12-25 08:55 - 000000136 _____ C:\Windows\system32\config\netlogon.ftl 2019-03-31 12:16 - 2009-07-14 08:08 - 000000006 ____H C:\Windows\Tasks\SA.DAT 2019-03-31 11:54 - 2009-07-14 07:45 - 000022096 ____H C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0 2019-03-31 11:54 - 2009-07-14 07:45 - 000022096 ____H C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0 2019-03-31 11:46 - 2013-03-06 08:00 - 000000000 ____D C:\Windows\Minidump 2019-03-31 11:44 - 2019-01-03 08:33 - 728142624 ____N C:\Windows\MEMORY.DMP 2019-03-28 14:35 - 2013-09-04 16:36 - 000000000 ____D C:\Users\adeel.qureshi\AppData\Local\Computers and Structures 2019-03-28 14:28 - 2015-06-07 10:49 - 000000000 ____D C:\Program Files\Computers and Structures 2019-03-28 08:44 - 2016-09-19 09:38 - 000003330 _____ C:\Windows\System32\Tasks\GoogleUpdateTaskMachineUA 2019-03-28 08:44 - 2016-09-19 09:38 - 000003202 _____ C:\Windows\System32\Tasks\GoogleUpdateTaskMachineCore 2019-03-27 16:43 - 2009-07-14 08:13 - 000786662 _____ C:\Windows\system32\PerfStringBackup.INI 2019-03-27 16:43 - 2009-07-14 06:20 - 000000000 ____D C:\Windows\inf 2019-03-27 16:42 - 2013-12-25 10:51 - 000000000 ____D C:\Users\adeel.qureshi\Desktop\Letters 2019-03-21 08:52 - 2016-09-19 09:42 - 000002224 _____ C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Google Chrome.lnk 2019-03-19 08:52 - 2013-02-24 13:44 - 000000000 ____D C:\Program Files (x86)\Google 2019-03-13 09:31 - 2009-07-14 07:45 - 000487616 _____ C:\Windows\system32\FNTCACHE.DAT 2019-03-13 09:28 - 2015-05-04 08:12 - 000000000 ____D C:\Windows\system32\appraiser 2019-03-13 09:28 - 2014-05-07 09:08 - 000000000 ___SD C:\Windows\system32\CompatTel 2019-03-13 09:28 - 2009-07-14 06:20 - 000000000 ____D C:\Windows\SysWOW64\Dism 2019-03-13 09:28 - 2009-07-14 06:20 - 000000000 ____D C:\Windows\system32\Dism 2019-03-13 09:24 - 2013-08-16 03:01 - 000000000 ____D C:\Windows\system32\MRT 2019-03-13 09:19 - 2012-12-24 17:21 - 127411920 ____C (Microsoft Corporation) C:\Windows\system32\MRT.exe 2019-03-04 08:42 - 2013-04-16 08:51 - 000142144 _____ C:\Users\adeel.qureshi\AppData\Local\GDIPFONTCACHEV1.DAT ==================== Files in the root of some directories ======= 2015-11-16 16:53 - 2015-12-22 14:12 - 000000363 _____ () C:\Users\adeel.qureshi\AppData\Roaming\EC_StartupLog.INI 2018-02-15 17:22 - 2019-02-21 16:53 - 000001381 _____ () C:\Users\adeel.qureshi\AppData\Roaming\ETABS 2016.settings Some files in TEMP: ==================== 2018-08-18 16:45 - 2018-01-26 10:13 - 000240129 _____ () C:\Users\adeel.qureshi\AppData\Local\Temp\CSI.ETABS.AllInOneDllx64.dll ==================== Bamital & volsnap ====================== (There is no automatic fix for files that do not pass verification.) C:\Windows\system32\winlogon.exe => File is digitally signed C:\Windows\system32\wininit.exe => File is digitally signed C:\Windows\SysWOW64\wininit.exe => File is digitally signed C:\Windows\explorer.exe => File is digitally signed C:\Windows\SysWOW64\explorer.exe => File is digitally signed C:\Windows\system32\svchost.exe => File is digitally signed C:\Windows\SysWOW64\svchost.exe => File is digitally signed C:\Windows\system32\services.exe => File is digitally signed C:\Windows\system32\User32.dll => File is digitally signed C:\Windows\SysWOW64\User32.dll => File is digitally signed C:\Windows\system32\userinit.exe => File is digitally signed C:\Windows\SysWOW64\userinit.exe => File is digitally signed C:\Windows\system32\rpcss.dll => File is digitally signed C:\Windows\system32\dnsapi.dll => File is digitally signed C:\Windows\SysWOW64\dnsapi.dll => File is digitally signed C:\Windows\system32\dllhost.exe => File is digitally signed C:\Windows\SysWOW64\dllhost.exe => File is digitally signed C:\Windows\system32\Drivers\volsnap.sys => File is digitally signed LastRegBack: 2019-03-24 11:55 ==================== End of FRST.txt ============================ Additional scan result of Farbar Recovery Scan Tool (x64) Version: 17.03.2019 Ran by adeel.qureshi (31-03-2019 12:23:27) Running from C:\Users\adeel.qureshi\Desktop Windows 7 Professional Service Pack 1 (X64) (2012-12-24 13:17:13) Boot Mode: Normal ========================================================== ==================== Accounts: ============================= Administrator (S-1-5-21-409201503-875657276-1192498473-500 - Administrator - Enabled) => C:\Users\Administrator.KFMC-010-PC Guest (S-1-5-21-409201503-875657276-1192498473-501 - Limited - Disabled) ==================== Security Center ======================== (If an entry is included in the fixlist, it will be removed.) AV: Kaspersky Endpoint Security 10 for Windows (Enabled - Up to date) {179979E8-273D-D14E-0543-2861940E4886} AV: Malwarebytes (Enabled - Up to date) {23007AD3-69FE-687C-2629-D584AFFAF72B} AS: Kaspersky Endpoint Security 10 for Windows (Enabled - Up to date) {ACF8980C-0107-DEC0-3FF3-1313EF89023B} AS: Malwarebytes (Enabled - Up to date) {98619B37-4FC4-67F2-1C99-EEF6D47DBD96} AS: Windows Defender (Enabled - Up to date) {D68DDC3A-831F-4fae-9E44-DA132C1ACF46} FW: Kaspersky Endpoint Security 10 for Windows (Enabled) {2FA2F8CD-6D52-D016-2E1C-81546ADD0FFD} ==================== Installed Programs ====================== (Only the adware programs with "Hidden" flag could be added to the fixlist to unhide them. The adware programs should be uninstalled manually.) 64 Bit HP CIO Components Installer (HKLM\...\{3138F992-045B-4F55-825C-53B231E647CA}) (Version: 13.2.1 - Hewlett-Packard) Hidden Adobe Acrobat 7.0.8 Professional (HKLM-x32\...\Adobe Acrobat 7.0 Professional - V) (Version: 7.0.8 - Adobe Systems) Adobe Acrobat Reader DC (HKLM-x32\...\{AC76BA86-7AD7-1033-7B44-AC0F074E4100}) (Version: 19.010.20098 - Adobe Systems Incorporated) Adobe Flash Player 16 NPAPI (HKLM-x32\...\Adobe Flash Player NPAPI) (Version: 16.0.0.257 - Adobe Systems Incorporated) Adobe Flash Player 31 ActiveX (HKLM-x32\...\Adobe Flash Player ActiveX) (Version: 31.0.0.108 - Adobe Systems Incorporated) Akamai NetSession Interface (HKU\S-1-5-21-3420606195-2604840975-2076412875-1345\...\Akamai) (Version: - Akamai Technologies, Inc) AnyDesk (HKLM-x32\...\AnyDesk) (Version: ad 3.1.1 - philandro Software GmbH) Apple Application Support (32-bit) (HKLM-x32\...\{49F7DD82-FC83-48BF-86C6-CFE6E1E233E1}) (Version: 7.1 - Apple Inc.) Apple Application Support (64-bit) (HKLM\...\{1FA68E27-2951-42E8-9F57-1A7F6581B4FD}) (Version: 7.1 - Apple Inc.) Apple Mobile Device Support (HKLM\...\{5FA8C4BE-8C74-4B9C-9B49-EBF759230189}) (Version: 12.1.0.25 - Apple Inc.) Apple Software Update (HKLM-x32\...\{A30EA700-5515-48F0-88B0-9E99DC356B88}) (Version: 2.6.0.1 - Apple Inc.) Attachments Processor for Outlook (HKLM-x32\...\{2006DA28-2AC7-44C4-A04D-FE87DCB0AF66}) (Version: 4.7.0.4 - MAPILab Ltd.) AutoCAD 2014 - English (HKLM\...\{5783F2D7-D001-0000-0102-0060B0CE6BBA}) (Version: 19.1.18.0 - Autodesk) Hidden AutoCAD 2014 - English (HKLM\...\{5783F2D7-D001-0409-2102-0060B0CE6BBA}) (Version: 19.1.18.0 - Autodesk) Hidden AutoCAD 2014 Language Pack - English (HKLM\...\{5783F2D7-D001-0409-1102-0060B0CE6BBA}) (Version: 19.1.18.0 - Autodesk) Hidden Autodesk 360 (HKLM\...\{52B28CAD-F49D-47BA-9FFE-29C2E85F0D0B}) (Version: 4.0.27.1 - Autodesk) Autodesk App Manager (HKLM-x32\...\{C070121A-C8C5-4D52-9A7D-D240631BD433}) (Version: 1.1.0 - Autodesk) Autodesk AutoCAD 2014 - English (HKLM\...\AutoCAD 2014 - English) (Version: 19.1.18.0 - Autodesk) Autodesk Content Service (HKLM-x32\...\{62F029AB-85F2-0000-866A-9FC0DD99DDBC}) (Version: 3.1.3.0 - Autodesk) Hidden Autodesk Content Service (HKLM-x32\...\Autodesk Content Service) (Version: 3.1.3.0 - Autodesk) Autodesk Content Service Language Pack (HKLM-x32\...\{62F029AB-85F2-0001-866A-9FC0DD99DDBC}) (Version: 3.1.3.0 - Autodesk) Hidden Autodesk Featured Apps (HKLM-x32\...\{F732FEDA-7713-4428-934B-EF83B8DD65D0}) (Version: 1.1.0 - Autodesk) Autodesk Material Library 2014 (HKLM-x32\...\{644F9B19-A462-499C-BF4D-300ABC2A28B1}) (Version: 4.0.19.0 - Autodesk) Autodesk Material Library Base Resolution Image Library 2014 (HKLM-x32\...\{51BF3210-B825-4092-8E0D-66D689916E02}) (Version: 4.0.19.0 - Autodesk) Bentley OpenSTAADOEM (HKLM-x32\...\{9239C609-B616-4ABC-993F-6C5C314C7DCD}) (Version: 08.02.09.35 - Bentley Systems, Inc.) Bonjour (HKLM\...\{56DDDFB8-7F79-4480-89D5-25E1F52AB28F}) (Version: 3.1.0.1 - Apple Inc.) DWG TrueView 2013 (HKLM\...\{5783F2D7-B028-0409-0100-0060B0CE6BBA}) (Version: 19.0.55.0 - Autodesk) Hidden ETABS 2016 64-bit (HKLM\...\{DF526606-02C6-4A64-826A-00C7DC9F11E4}) (Version: 16.2.1 - Computers and Structures, Inc.) ETABS 9 (HKLM-x32\...\{32A105FD-AC27-4326-82DF-D60977FEBA20}) (Version: 9.7.4 - Computers and Structures) Extended Asian Language font pack for Adobe Acrobat Reader DC (HKLM-x32\...\{AC76BA86-7AD7-2530-0000-AC13084E6700}) (Version: 19.008.20071 - Adobe Systems Incorporated) FARO LS 1.1.406.58 (HKLM-x32\...\{951B0F30-9F1A-4BF6-B3DA-99EB0E917B1C}) (Version: 4.6.58.2 - FARO Scanner Production) FARO LS 1.1.501.0 (64bit) (HKLM-x32\...\{8A470330-70B2-49AD-86AF-79885EF9898A}) (Version: 5.1.0.30630 - FARO Scanner Production) Google Chrome (HKLM-x32\...\Google Chrome) (Version: 73.0.3683.86 - Google Inc.) Google Earth Pro (HKLM-x32\...\{9D524A1E-F2FC-444D-B12A-7592CEB56EB5}) (Version: 7.3.2.5776 - Google) Google Update Helper (HKLM-x32\...\{60EC980A-BDA2-4CB6-A427-B07A5498B4CA}) (Version: 1.3.34.7 - Google LLC) Hidden Google Update Helper (HKLM-x32\...\{A92DAB39-4E2C-4304-9AB6-BC44E68B55E2}) (Version: 1.3.25.11 - Google Inc.) Hidden InPage2014 Khattat Professionals 1.01 (HKLM-x32\...\InPage2014 Khattat Professionals 1.01) (Version: 1.01 - Nukta Soft) Intel(R) Network Connections Drivers (HKLM\...\PROSet) (Version: 15.4 - Intel) Intel(R) Processor Graphics (HKLM-x32\...\{F0E3AD40-2BBD-4360-9C76-B9AC9A5886EA}) (Version: 9.17.10.4229 - Intel Corporation) iTunes (HKLM\...\{90A70909-E9FE-4AB8-B33F-CAA6C70B4983}) (Version: 12.9.1.4 - Apple Inc.) Java 8 Update 201 (HKLM-x32\...\{26A24AE4-039D-4CA4-87B4-2F32180201F0}) (Version: 8.0.2010.9 - Oracle Corporation) Kaspersky Endpoint Security 10 for Windows (HKLM\...\{04CF7FBD-E56C-446D-8FC9-DD444BDBEE8E}) (Version: 10.2.1.23 - Kaspersky Lab) LightScribe 1.4.136.1 (HKLM-x32\...\{A87B11AC-4344-4E5D-8B12-8F471A87DAD9}) (Version: 1.4.136.1 - hxxp://www.lightscribe.com) Hidden LINE (HKU\S-1-5-21-3420606195-2604840975-2076412875-1345\...\LINE) (Version: 5.4.0.1554 - LINE Corporation) Malwarebytes version 3.7.1.2839 (HKLM\...\{35065F43-4BB2-439A-BFF7-0F1014F2E0CD}_is1) (Version: 3.7.1.2839 - Malwarebytes) Microsoft .NET Framework 4.7.2 (HKLM\...\{92FB6C44-E685-45AD-9B20-CADF4CABA132} - 1033) (Version: 4.7.03062 - Microsoft Corporation) Microsoft Office Standard 2010 (HKLM-x32\...\Office14.STANDARD) (Version: 14.0.7015.1000 - Microsoft Corporation) Microsoft Silverlight (HKLM\...\{89F4137D-6C26-4A84-BDB8-2E5A4BB71E00}) (Version: 5.1.50918.0 - Microsoft Corporation) Microsoft Visual C++ 2005 Redistributable (HKLM-x32\...\{710f4c1c-cc18-4c49-8cbf-51240c89a1a2}) (Version: 8.0.61001 - Microsoft Corporation) Microsoft Visual C++ 2005 Redistributable (x64) (HKLM\...\{6ce5bae9-d3ca-4b99-891a-1dc6c118a5fc}) (Version: 8.0.59192 - Microsoft Corporation) Microsoft Visual C++ 2005 Redistributable (x64) (HKLM\...\{ad8a2fa1-06e7-4b0d-927d-6e54b3d31028}) (Version: 8.0.61000 - Microsoft Corporation) Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.4148 (HKLM\...\{4B6C7001-C7D6-3710-913E-5BC23FCE91E6}) (Version: 9.0.30729.4148 - Microsoft Corporation) Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.6161 (HKLM\...\{5FCE6D76-F5DC-37AB-B2B8-22AB8CEDB1D4}) (Version: 9.0.30729.6161 - Microsoft Corporation) Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.4148 (HKLM-x32\...\{1F1C2DFC-2D24-3E06-BCB8-725134ADF989}) (Version: 9.0.30729.4148 - Microsoft Corporation) Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161 (HKLM-x32\...\{9BE518E6-ECC6-35A9-88E4-87755C07200F}) (Version: 9.0.30729.6161 - Microsoft Corporation) Microsoft Visual C++ 2010 x64 Redistributable - 10.0.40219 (HKLM\...\{1D8E6291-B0D5-35EC-8441-6616F567A0F7}) (Version: 10.0.40219 - Microsoft Corporation) Microsoft Visual C++ 2010 x86 Redistributable - 10.0.40219 (HKLM-x32\...\{F0C3E5D1-1ADE-321E-8167-68EF0DE699A5}) (Version: 10.0.40219 - Microsoft Corporation) Microsoft Visual C++ 2012 Redistributable (x86) - 11.0.51106 (HKLM-x32\...\{8e70e4e1-06d7-470b-9f74-a51bef21088e}) (Version: 11.0.51106.1 - Microsoft Corporation) Microsoft Visual C++ 2013 Redistributable (x64) - 12.0.30501 (HKLM-x32\...\{050d4fc8-5d48-4b8f-8972-47c82c46020f}) (Version: 12.0.30501.0 - Microsoft Corporation) Microsoft Visual C++ 2013 Redistributable (x86) - 12.0.30501 (HKLM-x32\...\{f65db027-aff3-4070-886a-0d87064aabb1}) (Version: 12.0.30501.0 - Microsoft Corporation) Microsoft Visual Studio 2010 Tools for Office Runtime (x64) (HKLM\...\Microsoft Visual Studio 2010 Tools for Office Runtime (x64)) (Version: 10.0.50903 - Microsoft Corporation) MSXML 4.0 SP2 (KB954430) (HKLM-x32\...\{86493ADD-824D-4B8E-BD72-8C5DCDC52A71}) (Version: 4.20.9870.0 - Microsoft Corporation) MSXML 4.0 SP2 (KB973688) (HKLM-x32\...\{F662A8E6-F4DC-41A2-901E-8C11F044BDEC}) (Version: 4.20.9876.0 - Microsoft Corporation) Nero 7 Essentials (HKLM-x32\...\{B28B351F-1232-46EA-85EF-B8EA91641033}) (Version: 7.02.5017 - Nero AG) SAFE 12 (HKLM-x32\...\{65BA1C24-A55A-416C-AC4B-7646595E58E6}) (Version: 12.3.2 - Computers and Structures) SAFE 2016 (HKLM-x32\...\{BA57957A-4884-4C19-A5CB-CBEB5F22AC76}) (Version: 16.0.1 - Computers and Structures, Inc.) SAP2000 20 64-bit (HKLM\...\{35AE6BBD-7FFB-42CA-B148-39E1B62063F9}) (Version: 20.0.0 - Computers and Structures, Inc.) Service Pack 2 for Microsoft Office 2010 (KB2687455) 32-Bit Edition (HKLM-x32\...\{90140000-0012-0000-0000-0000000FF1CE}_Office14.STANDARD_{DE28B448-32E8-4E8F-84F0-A52B21A49B5B}) (Version: - Microsoft) SketchUp Import for AutoCAD 2014 (HKLM-x32\...\{644E9589-F73A-49A4-AC61-A953B9DE5669}) (Version: 1.1.0 - Autodesk) STAAD.Pro V8i SELECTseries 5 (HKLM-x32\...\{71AD5473-2F1A-4378-B8F0-41B04D2DDD27}) (Version: 20.07.10.65 - Bentley Systems, Inc.) WinRAR archiver (HKLM-x32\...\WinRAR archiver) (Version: - ) ==================== Custom CLSID (Whitelisted): ========================== (If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.) CustomCLSID: HKU\S-1-5-21-3420606195-2604840975-2076412875-1345_Classes\CLSID\{3faa4380-a399-11cf-a466-00805fe418f6}\InprocServer32 -> C:\Program Files\Autodesk\DWG TrueView 2013\en-US\dwgviewrficn.dll => No File CustomCLSID: HKU\S-1-5-21-3420606195-2604840975-2076412875-1345_Classes\CLSID\{6A221957-2D85-42A7-8E19-BE33950D1DEB}\localserver32 -> C:\Program Files\Autodesk\AutoCAD 2014\acad.exe (Autodesk, Inc -> Autodesk, Inc.) CustomCLSID: HKU\S-1-5-21-3420606195-2604840975-2076412875-1345_Classes\CLSID\{7DE1BE5C-CEBA-4F1D-ACBC-9CE11EE9A2A1}\localserver32 -> C:\Program Files\Autodesk\AutoCAD 2014\acad.exe (Autodesk, Inc -> Autodesk, Inc.) CustomCLSID: HKU\S-1-5-21-3420606195-2604840975-2076412875-1345_Classes\CLSID\{BD0DEB94-63DB-4392-9420-6EEE05094B1F}\localserver32 -> C:\Program Files\Autodesk\AutoCAD 2014\acad.exe (Autodesk, Inc -> Autodesk, Inc.) CustomCLSID: HKU\S-1-5-21-3420606195-2604840975-2076412875-1345_Classes\CLSID\{E2C40589-DE61-11ce-BAE0-0020AF6D7005}\InprocServer32 -> C:\Program Files\Autodesk\AutoCAD 2014\en-US\acadficn.dll (Autodesk, Inc -> Autodesk, Inc.) ShellIconOverlayIdentifiers: [AutoCAD Digital Signatures Icon Overlay Handler] -> {36A21736-36C2-4C11-8ACB-D4136F2B57BD} => C:\Windows\system32\AcSignIcon.dll [2013-02-08] (Autodesk, Inc -> Autodesk, Inc.) ShellIconOverlayIdentifiers-x32: [AutoCAD Digital Signatures Icon Overlay Handler] -> {36A21736-36C2-4C11-8ACB-D4136F2B57BD} => C:\Windows\system32\AcSignIcon.dll [2013-02-08] (Autodesk, Inc -> Autodesk, Inc.) ContextMenuHandlers1: [AcShellExtension.AcContextMenuHandler] -> {2E7A2C6C-B938-40a4-BA1C-C7EC982DC202} => C:\Program Files\Common Files\Autodesk Shared\AcShellEx\AcShellExtension.dll [2013-02-08] (Autodesk, Inc -> Autodesk) ContextMenuHandlers1: [Kaspersky Anti-Virus] -> {dd230880-495a-11d1-b064-008048ec2fc5} => C:\Program Files (x86)\Kaspersky Lab\Kaspersky Endpoint Security 10 for Windows\x64\ShellEx.dll [2013-11-27] (Kaspersky Lab -> Kaspersky Lab ZAO) ContextMenuHandlers1: [WinRAR] -> {B41DB860-64E4-11D2-9906-E49FADC173CA} => C:\Program Files (x86)\WinRAR\rarext64.dll [2006-12-11] () [File not signed] ContextMenuHandlers1-x32: [WinRAR32] -> {B41DB860-8EE4-11D2-9906-E49FADC173CA} => C:\Program Files (x86)\WinRAR\rarext.dll [2007-09-20] () [File not signed] ContextMenuHandlers2: [Kaspersky Anti-Virus] -> {dd230880-495a-11d1-b064-008048ec2fc5} => C:\Program Files (x86)\Kaspersky Lab\Kaspersky Endpoint Security 10 for Windows\x64\ShellEx.dll [2013-11-27] (Kaspersky Lab -> Kaspersky Lab ZAO) ContextMenuHandlers3: [MBAMShlExt] -> {57CE581A-0CB6-4266-9CA0-19364C90A0B3} => C:\Program Files\Malwarebytes\Anti-Malware\mbshlext.dll [2019-02-01] (Malwarebytes Corporation -> Malwarebytes) ContextMenuHandlers4: [Kaspersky Anti-Virus] -> {dd230880-495a-11d1-b064-008048ec2fc5} => C:\Program Files (x86)\Kaspersky Lab\Kaspersky Endpoint Security 10 for Windows\x64\ShellEx.dll [2013-11-27] (Kaspersky Lab -> Kaspersky Lab ZAO) ContextMenuHandlers4: [WinRAR] -> {B41DB860-64E4-11D2-9906-E49FADC173CA} => C:\Program Files (x86)\WinRAR\rarext64.dll [2006-12-11] () [File not signed] ContextMenuHandlers4-x32: [WinRAR32] -> {B41DB860-8EE4-11D2-9906-E49FADC173CA} => C:\Program Files (x86)\WinRAR\rarext.dll [2007-09-20] () [File not signed] ContextMenuHandlers5: [igfxcui] -> {3AB1675A-CCFF-11D2-8B20-00A0C93CB1F4} => C:\Windows\system32\igfxpph.dll [2015-06-01] (Microsoft Windows Hardware Compatibility Publisher -> Intel Corporation) ContextMenuHandlers6: [Kaspersky Anti-Virus] -> {dd230880-495a-11d1-b064-008048ec2fc5} => C:\Program Files (x86)\Kaspersky Lab\Kaspersky Endpoint Security 10 for Windows\x64\ShellEx.dll [2013-11-27] (Kaspersky Lab -> Kaspersky Lab ZAO) ContextMenuHandlers6: [MBAMShlExt] -> {57CE581A-0CB6-4266-9CA0-19364C90A0B3} => C:\Program Files\Malwarebytes\Anti-Malware\mbshlext.dll [2019-02-01] (Malwarebytes Corporation -> Malwarebytes) ContextMenuHandlers6: [WinRAR] -> {B41DB860-64E4-11D2-9906-E49FADC173CA} => C:\Program Files (x86)\WinRAR\rarext64.dll [2006-12-11] () [File not signed] ContextMenuHandlers6-x32: [WinRAR32] -> {B41DB860-8EE4-11D2-9906-E49FADC173CA} => C:\Program Files (x86)\WinRAR\rarext.dll [2007-09-20] () [File not signed] ==================== Scheduled Tasks (Whitelisted) ============= (If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.) Task: {3B6D381E-D81E-4214-A5AE-85815F1EFC56} - System32\Tasks\{5C782072-B2EB-486E-AEF5-0164262EBF44} => C:\Windows\system32\pcalua.exe -a C:\Users\ADEEL~1.QUR\AppData\Local\Temp\jre-8u66-windows-au.exe -d C:\Windows\SysWOW64 -c /installmethod=jau FAMILYUPGRADE=1 <==== ATTENTION Task: {6F8F9F9D-BD64-4394-A6C0-12FBF4647DC5} - System32\Tasks\{D57978AD-2991-49E2-9841-78517B1B6328} => C:\Windows\system32\pcalua.exe -a C:\Users\ADEEL~1.QUR\AppData\Local\Temp\jre-8u65-windows-au.exe -d C:\Windows\SysWOW64 -c /installmethod=jau FAMILYUPGRADE=1 <==== ATTENTION Task: {CD66C1BE-69A3-4F7C-8620-7C042B882334} - System32\Tasks\GoogleUpdateTaskMachineCore => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe (Google Inc -> Google Inc.) Task: {DA98FD29-ECA1-4464-A58C-3915B3C8BF7B} - System32\Tasks\{0E7DAC3B-7E0C-4F7A-9762-A780BBD8795B} => C:\Windows\system32\pcalua.exe -a C:\Users\ADEEL~1.QUR\AppData\Local\Temp\jre-8u161-windows-au.exe -d C:\Windows\SysWOW64 -c /installmethod=jau FAMILYUPGRADE=1 <==== ATTENTION Task: {EEBB8F56-FC46-40C3-81D3-3BE73472DC69} - System32\Tasks\Adobe Acrobat Update Task => C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe (Adobe Systems, Incorporated -> Adobe Systems Incorporated) Task: {F8A1F1B8-1D86-4679-9731-251E8DFC5433} - System32\Tasks\GoogleUpdateTaskMachineUA => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe (Google Inc -> Google Inc.) (If an entry is included in the fixlist, the task (.job) file will be moved. The file which is running by the task will not be moved.) ==================== Shortcuts & WMI ======================== (The entries could be listed to be restored or removed.) WMI:subscription\__FilterToConsumerBinding->CommandLineEventConsumer.Name=\"BVTConsumer\"",Filter="__EventFilter.Name=\"BVTFilter\":: WMI:subscription\__EventFilter->BVTFilter::[Query => SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 99] WMI:subscription\CommandLineEventConsumer->BVTConsumer::[CommandLineTemplate => cscript KernCap.vbs][WorkingDirectory => C:\\tools\\kernrate] ==================== Loaded Modules (Whitelisted) ============== 2016-02-29 09:59 - 2013-04-22 21:27 - 000016896 _____ (KONICA MINOLTA, INC.) [File not signed] C:\Windows\System32\KOAYJJ_L.DLL 2013-04-23 00:27 - 2013-04-22 21:27 - 000016896 _____ (KONICA MINOLTA, INC.) [File not signed] C:\Windows\System32\KOAYKJ_L.DLL 2015-06-23 21:08 - 2015-06-23 18:08 - 000016896 _____ (KONICA MINOLTA, INC.) [File not signed] C:\Windows\System32\KOAYTJ_L.DLL 2013-07-11 14:29 - 2012-11-26 04:33 - 000067584 _____ (Hewlett-Packard) [File not signed] C:\Windows\System32\HPMPW081.DLL 2013-07-11 14:29 - 2012-11-26 04:33 - 000183296 _____ (Hewlett-Packard) [File not signed] C:\Windows\System32\HPMPM081.DLL 2013-07-11 14:29 - 2012-08-23 11:02 - 000230912 _____ (Hewlett-Packard Company) [File not signed] C:\Windows\System32\hpmlm135.dll 2013-07-11 14:29 - 2012-11-26 04:37 - 000570880 _____ (Hewlett-Packard Corporation) [File not signed] C:\Windows\system32\spool\PRTPROCS\x64\hpcpp140.dll 2016-02-29 13:13 - 2013-05-21 19:21 - 000083968 _____ (Monotype Imaging Inc.) [File not signed] C:\Windows\system32\spool\PRTPROCS\x64\KOAYJJ_P.dll 2016-03-09 11:09 - 2013-05-21 19:21 - 000083968 _____ (Monotype Imaging Inc.) [File not signed] C:\Windows\system32\spool\PRTPROCS\x64\KOAYKJ_P.DLL 2016-03-10 11:37 - 2015-06-23 18:08 - 000083968 _____ (Monotype Imaging Inc.) [File not signed] C:\Windows\system32\spool\PRTPROCS\x64\KOAYTJ_P.dll 2012-12-26 11:41 - 2011-07-18 13:51 - 000011264 _____ (Xerox Corporation) [File not signed] C:\Windows\system32\spool\PRTPROCS\x64\x5print.dll 2009-07-14 04:18 - 2011-11-03 04:43 - 000884224 _____ (Microsoft Corporation) [File not signed] C:\Windows\system32\spool\DRIVERS\x64\3\UNIDRVUI.DLL 2012-12-26 11:33 - 2011-07-18 13:58 - 001778688 _____ (Xerox Corporation) [File not signed] C:\Windows\system32\spool\DRIVERS\x64\3\x2upHL.dll 2012-12-26 11:33 - 2011-07-18 13:58 - 000523264 _____ (Xerox Corporation) [File not signed] C:\Windows\system32\spool\DRIVERS\x64\3\x2comsHL.dll 2012-12-26 11:33 - 2011-07-18 13:58 - 001777664 _____ (Xerox Corporation) [File not signed] C:\Windows\system32\spool\DRIVERS\x64\3\x2utilHL.dll 2007-02-16 20:08 - 2007-02-16 20:08 - 000057344 _____ (Nalpeiron Ltd.) [File not signed] C:\Windows\SysWOW64\astsrv.exe 2012-12-13 17:37 - 2012-12-13 17:37 - 000012288 _____ (Autodesk, Inc.) [File not signed] C:\Program Files (x86)\Autodesk\Content Service\Connect.Service.ContentService.exe 2006-12-14 17:49 - 2006-12-14 17:49 - 000061440 _____ (Hewlett-Packard Company) [File not signed] C:\Program Files (x86)\Common Files\LightScribe\LSSrvc.exe 2012-07-31 14:35 - 2012-07-31 14:35 - 000050688 _____ (Hewlett-Packard) [File not signed] c:\windows\system32\hpzinw12.dll 2012-07-31 14:35 - 2012-07-31 14:35 - 000066048 _____ (Hewlett-Packard) [File not signed] c:\windows\system32\hpzipm12.dll 2018-03-26 12:58 - 2018-03-26 12:58 - 000112128 _____ (Microsoft Corporation) [File not signed] C:\Windows\Microsoft.Net\assembly\GAC_32\System.EnterpriseServices\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.EnterpriseServices.Wrapper.dll 2006-12-14 17:49 - 2006-12-14 17:49 - 000081920 _____ (Hewlett-Packard Company) [File not signed] C:\Program Files (x86)\Common Files\LightScribe\LSSProxy.dll 2006-12-14 17:49 - 2006-12-14 17:49 - 000032768 _____ (Hewlett-Packard Company) [File not signed] C:\Program Files (x86)\Common Files\LightScribe\LSLog.dll 2013-11-27 21:21 - 2013-11-27 21:21 - 000165856 _____ (Kaspersky Lab -> Kaspersky Lab ZAO) [File not signed] C:\Program Files (x86)\Kaspersky Lab\Kaspersky Endpoint Security 10 for Windows\ichecker.dll 2019-03-31 10:25 - 2019-03-13 09:22 - 003084800 _____ (The Qt Company Ltd.) [File not signed] C:\Program Files\Malwarebytes\Anti-Malware\Qt5Quick.dll 2019-03-31 10:25 - 2019-03-13 09:22 - 005139968 _____ (The Qt Company Ltd.) [File not signed] C:\Program Files\Malwarebytes\Anti-Malware\Qt5Gui.dll 2019-03-31 10:25 - 2019-03-13 09:22 - 005010944 _____ (The Qt Company Ltd.) [File not signed] C:\Program Files\Malwarebytes\Anti-Malware\Qt5Core.dll 2019-03-31 10:25 - 2019-03-13 09:22 - 002950144 _____ (The Qt Company Ltd.) [File not signed] C:\Program Files\Malwarebytes\Anti-Malware\Qt5Qml.dll 2019-03-31 10:25 - 2019-03-13 09:22 - 002234880 _____ (The Qt Company Ltd.) [File not signed] C:\Program Files\Malwarebytes\Anti-Malware\Qt5Network.dll 2019-03-31 10:25 - 2019-03-13 09:22 - 004571648 _____ (The Qt Company Ltd.) [File not signed] C:\Program Files\Malwarebytes\Anti-Malware\Qt5Widgets.dll 2019-03-31 10:25 - 2019-03-13 09:22 - 000438272 _____ (The Qt Company Ltd.) [File not signed] C:\Program Files\Malwarebytes\Anti-Malware\Qt5WinExtras.dll 2019-03-31 10:25 - 2019-03-13 09:22 - 001181184 _____ (The Qt Company Ltd.) [File not signed] C:\Program Files\Malwarebytes\Anti-Malware\platforms\qwindows.dll 2019-03-31 10:25 - 2019-03-13 09:22 - 000124928 _____ (The Qt Company Ltd.) [File not signed] C:\Program Files\Malwarebytes\Anti-Malware\styles\qwindowsvistastyle.dll 2019-03-31 10:25 - 2019-03-13 09:22 - 000026112 _____ (The Qt Company Ltd.) [File not signed] C:\Program Files\Malwarebytes\Anti-Malware\imageformats\qico.dll 2019-03-31 10:25 - 2019-03-13 09:22 - 000020992 _____ (The Qt Company Ltd.) [File not signed] C:\Program Files\Malwarebytes\Anti-Malware\imageformats\qsvg.dll 2019-03-31 10:25 - 2019-03-13 09:22 - 000259584 _____ (The Qt Company Ltd.) [File not signed] C:\Program Files\Malwarebytes\Anti-Malware\Qt5Svg.dll 2019-03-31 10:25 - 2019-03-13 09:22 - 000014848 _____ (The Qt Company Ltd.) [File not signed] C:\Program Files\Malwarebytes\Anti-Malware\QtQuick.2\qtquick2plugin.dll 2019-03-31 10:25 - 2019-03-13 09:22 - 000729088 _____ (The Qt Company Ltd.) [File not signed] C:\Program Files\Malwarebytes\Anti-Malware\QtQuick\Controls\qtquickcontrolsplugin.dll 2019-03-31 10:25 - 2019-03-13 09:22 - 000073216 _____ (The Qt Company Ltd.) [File not signed] C:\Program Files\Malwarebytes\Anti-Malware\QtQuick\Layouts\qquicklayoutsplugin.dll 2019-03-31 10:25 - 2019-03-13 09:22 - 000179712 _____ (The Qt Company Ltd.) [File not signed] C:\Program Files\Malwarebytes\Anti-Malware\QtQuick\Dialogs\dialogplugin.dll 2019-03-31 10:25 - 2019-03-13 09:22 - 000014848 _____ (The Qt Company Ltd.) [File not signed] C:\Program Files\Malwarebytes\Anti-Malware\QtQuick\Window.2\windowplugin.dll 2019-03-31 10:25 - 2019-03-13 09:22 - 000014848 _____ (The Qt Company Ltd.) [File not signed] C:\Program Files\Malwarebytes\Anti-Malware\QtQml\Models.2\modelsplugin.dll 2019-03-31 10:25 - 2019-03-13 09:22 - 000101888 _____ (The Qt Company Ltd.) [File not signed] C:\Program Files\Malwarebytes\Anti-Malware\QtQuick\PrivateWidgets\widgetsplugin.dll ==================== Alternate Data Streams (Whitelisted) ========= (If an entry is included in the fixlist, only the ADS will be removed.) AlternateDataStreams: C:\Windows:AstInfo [0] AlternateDataStreams: C:\ProgramData\TEMP:A1EDB939 [132] ==================== Safe Mode (Whitelisted) =================== (If an entry is included in the fixlist, it will be removed from the registry. The "AlternateShell" will be restored.) HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\MBAMService => ""="Service" HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\MBAMService => ""="Service" ==================== Association (Whitelisted) =============== (If an entry is included in the fixlist, the registry item will be restored to default or removed.) HKU\S-1-5-21-3420606195-2604840975-2076412875-1345\Software\Classes\.scr: AutoCADScriptFile => C:\Windows\system32\notepad.exe "%1" ==================== Internet Explorer trusted/restricted =============== (If an entry is included in the fixlist, it will be removed from the registry.) ==================== Hosts content: =============================== (If needed Hosts: directive could be included in the fixlist to reset Hosts.) 2009-07-14 05:34 - 2019-02-14 10:45 - 000000027 _____ C:\Windows\system32\drivers\etc\hosts 127.0.0.1 localhost ==================== Other Areas ============================ (Currently there is no automatic fix for this section.) HKU\S-1-5-21-3420606195-2604840975-2076412875-1345\Control Panel\Desktop\\Wallpaper -> C:\Users\adeel.qureshi\AppData\Roaming\Microsoft\Windows\Themes\TranscodedWallpaper.jpg DNS Servers: 192.168.1.33 - 94.77.215.126 HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System => (ConsentPromptBehaviorAdmin: 5) (ConsentPromptBehaviorUser: 3) (EnableLUA: 1) Windows Firewall is disabled. ==================== MSCONFIG/TASK MANAGER disabled items == If an entry is included in the fixlist, it will be removed. MSCONFIG\startupfolder: C:^ProgramData^Microsoft^Windows^Start Menu^Programs^Startup^Adobe Acrobat Speed Launcher.lnk => C:\Windows\pss\Adobe Acrobat Speed Launcher.lnk.CommonStartup MSCONFIG\startupreg: Acrobat Assistant 7.0 => "C:\Program Files (x86)\Adobe\Acrobat 7.0\Distillr\Acrotray.exe" MSCONFIG\startupreg: Autodesk Sync => C:\Program Files\Autodesk\Autodesk Sync\AdSync.exe MSCONFIG\startupreg: BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA} => "C:\Program Files (x86)\Common Files\Ahead\Lib\NMBgMonitor.exe" MSCONFIG\startupreg: iTunesHelper => "C:\Program Files\iTunes\iTunesHelper.exe" ==================== FirewallRules (Whitelisted) =============== (If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.) FirewallRules: [SPPSVC-In-TCP] => (Allow) %SystemRoot%\system32\sppsvc.exe (Microsoft Windows -> Microsoft Corporation) FirewallRules: [SPPSVC-In-TCP-NoScope] => (Allow) %SystemRoot%\system32\sppsvc.exe (Microsoft Windows -> Microsoft Corporation) FirewallRules: [{D0885D8E-154B-4F5E-95A2-255BD8E779A4}] => (Allow) C:\Program Files (x86)\Symantec\Symantec Endpoint Protection\12.1.1000.157.105\Bin64\Smc.exe No File FirewallRules: [{3E6751BE-2FE0-41C5-8447-1D5C6EE92E5D}] => (Allow) C:\Program Files (x86)\Symantec\Symantec Endpoint Protection\12.1.1000.157.105\Bin64\Smc.exe No File FirewallRules: [{B47D4B0C-FADB-41BD-BB17-C02C9D13B015}] => (Allow) C:\Program Files (x86)\Symantec\Symantec Endpoint Protection\12.1.1000.157.105\Bin64\snac64.exe No File FirewallRules: [{A4C179C0-AAC3-422E-96BA-3C378A33B7BA}] => (Allow) C:\Program Files (x86)\Symantec\Symantec Endpoint Protection\12.1.1000.157.105\Bin64\snac64.exe No File FirewallRules: [{925829F1-550E-49C7-99EC-A082BB482887}] => (Allow) LPort=15000 FirewallRules: [{C676B8D8-E166-459B-BD9B-5DC12ACAB8DF}] => (Allow) C:\Users\imran.yameen\AppData\Local\Torch\Plugins\Torrent\TorchTorrent.exe No File FirewallRules: [{70CB6139-A83F-4B68-969E-E58D89290312}] => (Allow) LPort=15001 FirewallRules: [TCP Query User{1A607BC1-A551-4646-A566-DFBB4D503F80}C:\users\adeel.qureshi\appdata\local\akamai\netsession_win.exe] => (Allow) C:\users\adeel.qureshi\appdata\local\akamai\netsession_win.exe (Akamai Technologies, Inc. -> Akamai Technologies, Inc.) FirewallRules: [UDP Query User{5FDAE045-8DE6-457D-ACCC-9E148EBD5ABA}C:\users\adeel.qureshi\appdata\local\akamai\netsession_win.exe] => (Allow) C:\users\adeel.qureshi\appdata\local\akamai\netsession_win.exe (Akamai Technologies, Inc. -> Akamai Technologies, Inc.) FirewallRules: [{5A2E862B-B94D-4BCC-900F-37298000FFCF}] => (Allow) C:\Program Files (x86)\ENERCALC_6_DEMO\ec6.exe No File FirewallRules: [{66B058E9-2DC9-4CAA-802C-285F7394D5FA}] => (Allow) C:\Program Files (x86)\ENERCALC_6_DEMO\EC6DemoWebUpdateCheck.EXE No File FirewallRules: [{1FFDB3D0-4908-4177-AB2D-E70AE87D01E9}] => (Allow) C:\Program Files (x86)\ENERCALC_6_DEMO\EC6DemoWebUpdate.EXE No File FirewallRules: [{171F4EA7-FC17-443D-86BB-1D53EFD02744}] => (Allow) C:\Program Files (x86)\ENERCALC_6_DEMO\GetLatestRSSDate.exe No File FirewallRules: [{6326521E-CBD5-4A3D-9CCA-12A529BEF2BB}] => (Allow) C:\Program Files (x86)\ENERCALC_6_DEMO\NewMessageCheck.exe No File FirewallRules: [{042AC898-F1E7-4AA7-8F63-F1B18AD2E52F}] => (Allow) C:\Program Files (x86)\ENERCALC_6_DEMO\GetNewsAddr.exe No File FirewallRules: [{77AFF2E6-FB4E-4FAC-8ECC-86499491CC84}] => (Allow) C:\Users\adeel.qureshi\AppData\Local\LINE\bin\5.2.2.1459\LINE.exe No File FirewallRules: [{B7689C0D-1A60-444D-AED5-1126693197E1}] => (Allow) C:\Users\adeel.qureshi\AppData\Local\LINE\bin\5.2.2.1459\LINE.exe No File FirewallRules: [{07D75685-20CB-489E-8B18-31F64D79D44F}] => (Allow) C:\Users\adeel.qureshi\AppData\Local\LINE\bin\5.2.2.1459\LineUpdater.exe No File FirewallRules: [{65768A34-28CD-408E-9387-3D6E056097A7}] => (Allow) C:\Users\adeel.qureshi\AppData\Local\LINE\bin\5.2.2.1459\LineUpdater.exe No File FirewallRules: [{BBDB2D00-EEC1-4D66-AC6D-FF00DBF0F4F8}] => (Allow) LPort=50248 FirewallRules: [{B5D43DB8-DAD7-40CF-A810-3D3A57856002}] => (Allow) C:\Program Files (x86)\Common Files\Apple\Apple Application Support\APSDaemon.exe (Apple Inc. -> Apple Inc.) FirewallRules: [{92685346-E34E-497B-B73B-E1C5149568BB}] => (Allow) C:\Program Files\Bonjour\mDNSResponder.exe (Apple Inc. -> Apple Inc.) FirewallRules: [{3FFD4751-1628-4655-AC5C-2DE06A8B10D2}] => (Allow) C:\Program Files\Bonjour\mDNSResponder.exe (Apple Inc. -> Apple Inc.) FirewallRules: [{172ABDBD-A872-4F23-808E-90764902663D}] => (Allow) C:\Program Files (x86)\Bonjour\mDNSResponder.exe (Apple Inc. -> Apple Inc.) FirewallRules: [{3460C2E8-671C-424B-8E00-76079975D2AB}] => (Allow) C:\Program Files (x86)\Bonjour\mDNSResponder.exe (Apple Inc. -> Apple Inc.) FirewallRules: [{2252494B-E2EA-416A-B9CA-01A831F683A5}] => (Allow) C:\Program Files\iTunes\iTunes.exe (Apple Inc. -> Apple Inc.) FirewallRules: [{62F1724C-D690-496F-920A-ACCB89A66245}] => (Allow) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe (Google LLC -> Google Inc.) FirewallRules: [{F020ABAE-E412-473E-B6C7-52DD4D93964F}] => (Allow) C:\Program Files (x86)\AnyDesk\AnyDesk.exe (philandro Software GmbH -> ) FirewallRules: [{A3C21118-E298-470A-9FF7-CB4F753CFC71}] => (Allow) C:\Program Files (x86)\AnyDesk\AnyDesk.exe (philandro Software GmbH -> ) FirewallRules: [{3B98DB58-CFB8-4502-807E-4F539EE38C2F}] => (Allow) C:\Program Files (x86)\AnyDesk\AnyDesk.exe (philandro Software GmbH -> ) FirewallRules: [{7931E533-4DB3-43C7-8685-4DC8D72474FC}] => (Allow) C:\Program Files (x86)\AnyDesk\AnyDesk.exe (philandro Software GmbH -> ) FirewallRules: [{AAD4C19D-10A2-4979-8B12-EB58CD45FFE5}] => (Allow) C:\Program Files (x86)\AnyDesk\AnyDesk.exe (philandro Software GmbH -> ) FirewallRules: [{DA304742-9B3F-4587-B489-F442E8CC7AFE}] => (Allow) C:\Program Files (x86)\AnyDesk\AnyDesk.exe (philandro Software GmbH -> ) ==================== Restore Points ========================= 31-03-2019 11:07:54 Scheduled Checkpoint ==================== Faulty Device Manager Devices ============= Name: PS/2 Compatible Mouse Description: PS/2 Compatible Mouse Class Guid: {4d36e96f-e325-11ce-bfc1-08002be10318} Manufacturer: Microsoft Service: i8042prt Problem: : This device is not present, is not working properly, or does not have all its drivers installed. (Code 24) Resolution: The device is installed incorrectly. The problem could be a hardware failure, or a new driver might be needed. Devices stay in this state if they have been prepared for removal. After you remove the device, this error disappears.Remove the device, and this error should be resolved. ==================== Event log errors: ========================= Application errors: ================== Error: (03/31/2019 12:18:39 PM) (Source: WinMgmt) (EventID: 10) (User: ) Description: Event filter with query "SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 99" could not be reactivated in namespace "//./root/CIMV2" because of error 0x80041003. Events cannot be delivered through this filter until the problem is corrected. Error: (03/31/2019 11:45:59 AM) (Source: WinMgmt) (EventID: 10) (User: ) Description: Event filter with query "SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 99" could not be reactivated in namespace "//./root/CIMV2" because of error 0x80041003. Events cannot be delivered through this filter until the problem is corrected. Error: (03/31/2019 08:49:07 AM) (Source: WinMgmt) (EventID: 10) (User: ) Description: Event filter with query "SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 99" could not be reactivated in namespace "//./root/CIMV2" because of error 0x80041003. Events cannot be delivered through this filter until the problem is corrected. Error: (03/28/2019 02:56:47 PM) (Source: MsiInstaller) (EventID: 11722) (User: PPNNCC) Description: Product: SAP2000 20 64-bit -- Error 1722. There is a problem with this Windows Installer package. A program run as part of the setup did not finish as expected. Contact your support personnel or package vendor. Action InstallNGEN, location: C:\Program Files\Computers and Structures\SAP2000 20\, command: C:\Program Files\Computers and Structures\SAP2000 20\CSiNativeImageGen.exe 3 Error: (03/28/2019 02:33:36 PM) (Source: MsiInstaller) (EventID: 11722) (User: PPNNCC) Description: Product: SAP2000 20 64-bit -- Error 1722. There is a problem with this Windows Installer package. A program run as part of the setup did not finish as expected. Contact your support personnel or package vendor. Action InstallNGEN, location: C:\Program Files\Computers and Structures\SAP2000 20\, command: C:\Program Files\Computers and Structures\SAP2000 20\CSiNativeImageGen.exe 3 Error: (03/28/2019 02:25:54 PM) (Source: MsiInstaller) (EventID: 11601) (User: PPNNCC) Description: Product: SAP2000 20 64-bit -- Disk full: Out of disk space -- Volume: 'C:'; required space: 1,460,788 KB; available space: 1,308,172 KB. Free some disk space and retry. Error: (03/28/2019 08:34:53 AM) (Source: WinMgmt) (EventID: 10) (User: ) Description: Event filter with query "SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 99" could not be reactivated in namespace "//./root/CIMV2" because of error 0x80041003. Events cannot be delivered through this filter until the problem is corrected. Error: (03/27/2019 08:37:50 AM) (Source: WinMgmt) (EventID: 10) (User: ) Description: Event filter with query "SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 99" could not be reactivated in namespace "//./root/CIMV2" because of error 0x80041003. Events cannot be delivered through this filter until the problem is corrected. System errors: ============= Error: (03/31/2019 12:17:18 PM) (Source: Microsoft-Windows-GroupPolicy) (EventID: 1006) (User: PPNNCC) Description: The processing of Group Policy failed. Windows could not authenticate to the Active Directory service on a domain controller. (LDAP Bind function call failed). Look in the details tab for error code and description. Error: (03/31/2019 12:16:49 PM) (Source: NETLOGON) (EventID: 5719) (User: ) Description: This computer was not able to set up a secure session with a domain controller in domain PPNNCC due to the following: There are currently no logon servers available to service the logon request. This may lead to authentication problems. Make sure that this computer is connected to the network. If the problem persists, please contact your domain administrator. ADDITIONAL INFO If this computer is a domain controller for the specified domain, it sets up the secure session to the primary domain controller emulator in the specified domain. Otherwise, this computer sets up the secure session to any domain controller in the specified domain. Error: (03/31/2019 12:16:49 PM) (Source: Microsoft-Windows-GroupPolicy) (EventID: 1055) (User: NT AUTHORITY) Description: The processing of Group Policy failed. Windows could not resolve the computer name. This could be caused by one of more of the following: a) Name Resolution failure on the current domain controller. b) Active Directory Replication Latency (an account created on another domain controller has not replicated to the current domain controller). Error: (03/31/2019 12:16:49 PM) (Source: Service Control Manager) (EventID: 7000) (User: ) Description: The Haspnt service failed to start due to the following error: The system cannot find the path specified. Error: (03/31/2019 12:15:21 PM) (Source: Service Control Manager) (EventID: 7034) (User: ) Description: The Adobe Acrobat Update Service service terminated unexpectedly. It has done this 1 time(s). Error: (03/31/2019 12:15:21 PM) (Source: Service Control Manager) (EventID: 7034) (User: ) Description: The AST Service service terminated unexpectedly. It has done this 1 time(s). Error: (03/31/2019 12:15:21 PM) (Source: Service Control Manager) (EventID: 7031) (User: ) Description: The Autodesk Content Service service terminated unexpectedly. It has done this 1 time(s). The following corrective action will be taken in 10000 milliseconds: Restart the service. Error: (03/31/2019 12:15:21 PM) (Source: Service Control Manager) (EventID: 7034) (User: ) Description: The Office Software Protection Platform service terminated unexpectedly. It has done this 1 time(s). Windows Defender: =================================== Date: 2019-03-04 08:38:17.242 Description: Windows Defender scan has been stopped before completion. Scan ID:{DD81A852-3A5D-4C24-9812-9E5DFCD339F7} Scan Type:AntiSpyware Scan Parameters:Quick Scan Date: 2016-09-21 08:51:32.506 Description: Windows Defender scan has been stopped before completion. Scan ID:{D06D6030-FD5F-42C2-AF8C-9F83F0A7D5F4} Scan Type:AntiSpyware Scan Parameters:Full Scan Date: 2016-09-21 08:51:28.183 Description: Windows Defender scan has been stopped before completion. Scan ID:{75EB2319-87C7-43BB-8BEE-F4567F46A679} Scan Type:AntiSpyware Scan Parameters:Quick Scan Date: 2016-09-20 16:08:28.098 Description: Windows Defender scan has been stopped before completion. Scan ID:{A3FA9AFE-C758-4A3A-A8A0-063304C5A77B} Scan Type:AntiSpyware Scan Parameters:Full Scan Date: 2016-09-20 16:08:28.098 Description: Windows Defender has detected spyware or other potentially unwanted software. For more information please see the following:http://go.microsoft.com/fwlink/?linkid=37020&name=SoftwareBundler:Win32/GoFileExpress&threatid=206387 Name:SoftwareBundler:Win32/GoFileExpress ID:206387 Severity:High Category:Software Bundler Path Found:file:C:\$Recycle.Bin\S-1-5-21-3420606195-2604840975-2076412875-1215\$R7O5D9H.exe Detection Type:Concrete Detection Source:User Status:Unknown Process Name:C:\Program Files\Windows Defender\MSASCui.exe Date: 2018-07-04 08:40:47.626 Description: Windows Defender has encountered an error trying to update signatures. New Signature Version:1.271.442.0 Previous Signature Version:1.269.1075.0 Update Source:User Signature Type:AntiSpyware Update Type:Delta Current Engine Version:1.1.15000.2 Previous Engine Version:1.1.14901.4 Error code:0x80070666 Error description:Another version of this product is already installed. Installation of this version cannot continue. To configure or remove the existing version of this product, use Add/Remove Programs on the Control Panel. Date: 2018-07-04 08:40:47.626 Description: Windows Defender has encountered an error trying to update the engine. New Engine Version:1.1.15000.2 Previous Engine Version:1.1.14901.4 Update Source:User Error Code:0x80070666 Error description:Another version of this product is already installed. Installation of this version cannot continue. To configure or remove the existing version of this product, use Add/Remove Programs on the Control Panel. Date: 2013-09-04 08:31:05.029 Description: Windows Defender has encountered an error trying to load signatures and will attempt reverting back to a known-good set of signatures. Signatures Attempted:Current Error Code:0x80070002 Error description:The system cannot find the file specified. Signature version:0.0.0.0 Engine version:0.0.0.0 Date: 2013-09-04 08:31:04.264 Description: Windows Defender has encountered an error trying to update signatures. New Signature Version: Previous Signature Version: Update Source:Signature Update Folder Signature Type:AntiSpyware Update Type:Delta Current Engine Version: Previous Engine Version: Error code:0x80070002 Error description:The system cannot find the file specified. Date: 2013-09-01 08:25:57.137 Description: Windows Defender has encountered an error trying to load signatures and will attempt reverting back to a known-good set of signatures. Signatures Attempted:Current Error Code:0x80070002 Error description:The system cannot find the file specified. Signature version:0.0.0.0 Engine version:0.0.0.0 CodeIntegrity: =================================== Date: 2019-02-14 10:45:22.917 Description: Windows is unable to verify the image integrity of the file \Device\HarddiskVolume2\ComboFix\catchme.sys because file hash could not be found on the system. A recent hardware or software change might have installed a file that is signed incorrectly or damaged, or that might be malicious software from an unknown source. Date: 2019-02-14 10:45:22.886 Description: Windows is unable to verify the image integrity of the file \Device\HarddiskVolume2\ComboFix\catchme.sys because file hash could not be found on the system. A recent hardware or software change might have installed a file that is signed incorrectly or damaged, or that might be malicious software from an unknown source. Date: 2013-01-21 11:03:10.225 Description: Code Integrity is unable to verify the image integrity of the file \Device\HarddiskVolume2\Windows\System32\sysfer.dll because the set of per-page image hashes could not be found on the system. Date: 2013-01-21 10:57:31.900 Description: Code Integrity is unable to verify the image integrity of the file \Device\HarddiskVolume2\Windows\System32\sysfer.dll because the set of per-page image hashes could not be found on the system. Date: 2013-01-21 10:27:47.860 Description: Code Integrity is unable to verify the image integrity of the file \Device\HarddiskVolume2\Windows\System32\sysfer.dll because the set of per-page image hashes could not be found on the system. Date: 2013-01-21 09:56:28.039 Description: Code Integrity is unable to verify the image integrity of the file \Device\HarddiskVolume2\Windows\System32\sysfer.dll because the set of per-page image hashes could not be found on the system. Date: 2013-01-21 09:48:03.794 Description: Code Integrity is unable to verify the image integrity of the file \Device\HarddiskVolume2\Windows\System32\sysfer.dll because the set of per-page image hashes could not be found on the system. Date: 2013-01-21 09:00:06.347 Description: Code Integrity is unable to verify the image integrity of the file \Device\HarddiskVolume2\Windows\System32\sysfer.dll because the set of per-page image hashes could not be found on the system. ==================== Memory info =========================== Processor: Intel(R) Core(TM) i3-2120 CPU @ 3.30GHz Percentage of memory in use: 48% Total physical RAM: 8073.05 MB Available physical RAM: 4167.8 MB Total Virtual: 16144.25 MB Available Virtual: 12361.67 MB ==================== Drives ================================ Drive 😄 () (Fixed) (Total:97.56 GB) (Free:1.75 GB) NTFS Drive d: () (Fixed) (Total:368.1 GB) (Free:86.75 GB) NTFS Drive e: (Sep 16 2014) (CDROM) (Total:0.01 GB) (Free:0 GB) UDF \\?\Volume{95604244-4e50-11e2-ac49-806e6f6e6963}\ (System Reserved) (Fixed) (Total:0.1 GB) (Free:0.07 GB) NTFS ==================== MBR & Partition Table ================== ======================================================== Disk: 0 (MBR Code: Windows 7/8/10) (Size: 465.8 GB) (Disk ID: F5B43CD2) Partition 1: (Active) - (Size=100 MB) - (Type=07 NTFS) Partition 2: (Not Active) - (Size=97.6 GB) - (Type=07 NTFS) Partition 3: (Not Active) - (Size=368.1 GB) - (Type=07 NTFS) ==================== End of Addition.txt ============================ Link to post Share on other sites More sharing options...
Root Admin AdvancedSetup Posted April 2, 2019 Root Admin ID:1306268 Share Posted April 2, 2019 Please restart the computer. Then run the scans again. This time they should come back clean. Please ATTACH the logs on your next reply. When you copy/paste the forum software does not always render the values correctly Thanks Link to post Share on other sites More sharing options...
Addy78 Posted April 2, 2019 Author ID:1306288 Share Posted April 2, 2019 Thanks Advanced setup I am attaching my logs as requested for your prompt reply. malware.txt AdwCleaner[S01].txt FRST.txt Addition.txt Link to post Share on other sites More sharing options...
Root Admin AdvancedSetup Posted April 2, 2019 Root Admin ID:1306295 Share Posted April 2, 2019 Please temporarily disable your Kaspersky antivirus and run the following fix. Please download the attached fixlist.txt file and save it to the Desktop.NOTE. It's important that both files, FRST or FRST64 and fixlist.txt are in the same location or the fix will not work. NOTICE: This script was written specifically for this user, for use on this particular machine. Running this on another machine may cause damage to your operating system. Run FRST or FRST64 and press the Fix button just once and wait. If the tool needs a restart please make sure you let the system restart normally and let the tool complete its run after restart. The tool will make a log on the Desktop (Fixlog.txt). Please attach or post it to your next reply. Note: If the tool warned you about an outdated version please download and run the updated version. fixlist.txt Thanks Ron Link to post Share on other sites More sharing options...
Addy78 Posted April 2, 2019 Author ID:1306302 Share Posted April 2, 2019 Dear Ron, Find attached fixlog as requested, but I am afraid I am still having the problem of mouse double clicking. Fixlog.txt Link to post Share on other sites More sharing options...
Root Admin AdvancedSetup Posted April 3, 2019 Root Admin ID:1306394 Share Posted April 3, 2019 Yes, as I said, it may just be a bad or dirty mouse. We have been able to clean up a lot of items along the way that should not have been on the computer which is a good thing. For your mouse issue, do you have access to another mouse to plug in and try? Link to post Share on other sites More sharing options...
Addy78 Posted April 3, 2019 Author ID:1306427 Share Posted April 3, 2019 Thanks Ron I do had access to another mouse which by now is working fine. Hope it will remain the same and will not cause any other problem. Thanks once again for your help. Cheers Link to post Share on other sites More sharing options...
Root Admin AdvancedSetup Posted April 3, 2019 Root Admin ID:1306521 Share Posted April 3, 2019 You're quite welcome. Take care and stay safe out there. Help Secure your browsers Please install uBlock Origin for your browsers to better protect your system FireFox, Chrome, Opera , Safari, Microsoft EdgeAdBlock for Internet Explorer Follow-up Reading Everything you need to know about cybercrime 10 easy ways to prevent malware infection Keep your data backed up Thank you for choosing Malwarebytes Ron Link to post Share on other sites More sharing options...
Root Admin AdvancedSetup Posted April 3, 2019 Root Admin ID:1306522 Share Posted April 3, 2019 Glad we could help. If you need this topic reopened, please send a Private Message to any one of the moderating team members. Please include a link to this topic with your request. This applies only to the originator of this thread. Other members who need assistance please start your own topic in a new thread. Thanks Link to post Share on other sites More sharing options...
Recommended Posts