Activation issue on Windows 10 Home OEM + Windows Store suggestion

[waterreedshimmer]

Hello,

It has been months, I have my over then 5years computer, activation issues on Windows 10 Home.
Yesterday was first time it asked me to buy a key on Windows Store, but at the same time it said it was because it had no connection to the Windows Servers, so it's contradictory information.
Today I could Activate my Windows 10 Home OEM that came with no DVD in my computer. It has been, maybe 50 times or more I do that. When it was Windows 8.1, before the upgrade, I did not have this error, I don't know if my sight is right, but I really did notice that issue as having started a few months ago, when I lost my data.
I couldn't download Farbar Recovery Scan Tool with Firefox, my usual browser, but I could download it with Microsoft Edge that I never use. I do not have " All users " box in FRST64.exe and I did run with without troubleshoot option, so no virtualisation from Windows 10 to Windows 8.
No idea if it is related, but we won't worry about that, with fake phone calls, today was: " - Goodbye ". Maybe it has nothing to do as the phone issues could be random.
This might ennoy you, but since my Windows had the Documents and Images folders deleted, I have the impression, that all my free and bought programs can no more create automatically folders and images, unless I put off both Windows defender and my dear Antivirus here. And they are often both down for a few minuts, but may be related to the fact that in Windows 10, we don't see at all when Windows is updated, we don't have the visual anymore, so maybe it is normal behaviour.
You don't need to worry if I loose Windows 10 Home, as I will have choice between going back to Windows XP Pro or going forward with Ubuntu Studio 18.10. But this will be decided in 14 days. Regedit was saved (exported) by inside and all is saved. Windows will wait a little, but one day, maybe next year, I intend to buy the Windows 10 Pro with PPF licence at Microsoft Website, not at Store as it is OEM like mine, but nowdays my money is for smaller things.
I also do suspect as past issue, not at all present issue, that virus can block OS creation on the DVD support, although this happend long ago, and I also suspect it had, long time ago, something to do with the fact that I couldn't re-do my double boot, and had wrx errors, so I had non installed Linux packages, and an issue report was sent somewhere to Ubuntu Linux. But I do not study informatics, so I can't tell things you people can understand.
I also suppose as it is a go and come back virus issue, that Windows 10 does interfere with issue. I think that is why it never did ask me before to buy the key while it couldn't connect to the servers to verify my key. And I suppose that the day I will buy one key, it will be kept in the Windows Server, and he will need to check it with Wifi. So I have no idea at all if Windows 10 needs Wifi to work or not ? But I get this activation issue, may I be in Wifi mode all day, or may I be offline during one day.
I don't know if the Store is a phishing or an illegal joke ?
I only did spoke about it on Facebook, in the Linux forum, but they won't interfere with nothing, as they are just for formatting my computer, usually, that's how they are =)
About Corel PaintShop Pro 2018 + gifts, I had bought it, I also had activation issue, but the issue is no more, it has self solved it, but I never tried the software, I had bought it in its official website. It also often put ads on my computer, but I don't think it to be related, and I don't think it to be phishing.
I will also do my best this time to avoid doing flood. As I know I write too much, and I will always wait for one reply and one question from you to write back, OK ? But it is mostly part of my personnality, not an intention to break the rules.
And thank you very much for your patience.

shoScan result of Farbar Recovery Scan Tool (FRST) (x64) Version: 15.11.2018
Ran by Françoise (administrator) on EARENDIL-LIGHT (16-11-2018 18:48:56)
Running from U:\Downloads
Loaded Profiles: Françoise (Available Profiles: Françoise)
Platform: Windows 8 Pro (X64) Language: English (United Kingdom)
Internet Explorer Version 11 (Default browser: Opera)
Boot Mode: Normal
Tutorial for Farbar Recovery Scan Tool: http://www.geekstogo.com/forum/topic/335081-frst-tutorial-how-to-use-farbar-recovery-scan-tool/

==================== Processes (Whitelisted) =================

(If an entry is included in the fixlist, the process will be closed. The file will not be moved.)

(NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\Display.NvContainer\NVDisplay.Container.exe
(NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\Display.NvContainer\NVDisplay.Container.exe
(Intel Corporation) C:\Windows\System32\igfxCUIService.exe
(Windows (R) Win 7 DDK provider) C:\Windows\System32\drivers\AdminService.exe
(Cybereason) C:\Program Files (x86)\Cybereason\RansomFree\CybereasonRansomFreeServiceHost.exe
(Microsoft Corporation) C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeClickToRun.exe
(Firebird Project) C:\Program Files\Instant-Gestion\Instant-Gestion-ME-Classic\firebird\bin\fbserver.exe
(ELAN Microelectronics Corp.) C:\Program Files\Elantech\ETDService.exe
(arvato digital services llc) C:\Program Files (x86)\Common Files\Protexis\License Service\PsiService_2.exe
(arvato digital services llc) C:\Program Files\Common Files\Protexis\License Service\PsiService_2.exe
(Safer-Networking Ltd.) C:\Program Files (x86)\Spybot - Search & Destroy 2\SDFSSvc.exe
(Safer-Networking Ltd.) C:\Program Files (x86)\Spybot - Search & Destroy 2\SDUpdSvc.exe
(Microsoft Corporation) C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.1810.5-0\MsMpEng.exe
(Safer-Networking Ltd.) C:\Program Files (x86)\Spybot - Search & Destroy 2\SDWSCSvc.exe
(ELAN Microelectronics Corp.) C:\Program Files\Elantech\ETDCtrl.exe
(Microsoft Corporation) C:\Windows\Microsoft.NET\Framework64\v3.0\WPF\PresentationFontCache.exe
(Cybereason) C:\Program Files (x86)\Cybereason\RansomFree\CybereasonRansomFree.exe
(Innovative Solutions) C:\Program Files (x86)\Innovative Solutions\DriverMax\innostp.exe
(Innovative Solutions) C:\Program Files (x86)\Innovative Solutions\DriverMax\drivermax.exe
(Innovative Solutions) C:\Program Files (x86)\Innovative Solutions\DriverMax\drivermax.exe
(ELAN Microelectronics Corp.) C:\Program Files\Elantech\ETDCtrlHelper.exe
(Intel Corporation) C:\Windows\System32\igfxEM.exe
(Intel Corporation) C:\Windows\System32\igfxHK.exe
(Intel Corporation) C:\Windows\System32\igfxTray.exe
(Microsoft Corporation) C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.1810.5-0\NisSrv.exe
(Oracle Corporation) C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe
(Microsoft Corporation) C:\Program Files\WindowsApps\Microsoft.MicrosoftOfficeHub_17.10314.31700.1000_x64__8wekyb3d8bbwe\Office16\OfficeHubTaskHost.exe
(Microsoft Corporation) C:\Windows\SystemApps\Microsoft.Windows.Cortana_cw5n1h2txyewy\RemindersServer.exe
(Microsoft Corporation) C:\Program Files\Windows Defender\MSASCuiL.exe
() C:\Program Files\WindowsApps\Microsoft.ZuneVideo_10.18082.13811.0_x64__8wekyb3d8bbwe\Video.UI.exe
(Realtek Semiconductor) C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe
(Safer-Networking Ltd.) C:\Program Files (x86)\Spybot - Search & Destroy 2\SDTray.exe
(SteelSeries ApS) C:\Program Files\SteelSeries\SteelSeries Engine 3\SteelSeriesEngine3.exe
(Microsoft Corporation) C:\Program Files\rempl\sedsvc.exe
(NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\Display\nvtray.exe
(Mozilla Corporation) C:\Program Files\Mozilla Firefox\firefox.exe
(Mozilla Corporation) C:\Program Files\Mozilla Firefox\firefox.exe
(Mozilla Corporation) C:\Program Files\Mozilla Firefox\firefox.exe
(Mozilla Corporation) C:\Program Files\Mozilla Firefox\firefox.exe
(Mozilla Corporation) C:\Program Files\Mozilla Firefox\firefox.exe
(Mozilla Corporation) C:\Program Files\Mozilla Firefox\firefox.exe
(Microsoft Corporation) C:\Windows\System32\dllhost.exe
(Microsoft Corporation) C:\Windows\System32\smartscreen.exe
(Vivaldi Technologies AS) C:\Users\franc\AppData\Local\Vivaldi\Application\update_notifier.exe

==================== Registry (Whitelisted) ===========================

(If an entry is included in the fixlist, the registry item will be restored to default or removed. The file will not be moved.)

HKLM\...\Run: [SecurityHealth] => C:\Program Files\Windows Defender\MSASCuiL.exe [638872 2018-04-12] (Microsoft Corporation)
HKLM\...\Run: [ETDCtrl] => C:\Program Files\Elantech\ETDCtrl.exe [3242696 2015-10-21] (ELAN Microelectronics Corp.)
HKLM\...\Run: [RTHDVCPL] => C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe [18390912 2018-10-31] (Realtek Semiconductor)
HKLM-x32\...\Run: [SunJavaUpdateSched] => C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe [653728 2018-03-07] (Oracle Corporation)
HKLM-x32\...\Run: [SDTray] => C:\Program Files (x86)\Spybot - Search & Destroy 2\SDTray.exe [6788032 2018-04-20] (Safer-Networking Ltd.)
HKLM-x32\...\Winlogon: [Userinit]
Winlogon\Notify\SDWinLogon-x32: SDWinLogon.dll [X]
HKLM\SOFTWARE\Policies\Microsoft\Windows Defender: Restriction <==== ATTENTION
HKU\S-1-5-19\...\RunOnce: [WAB Migrate] => C:\Program Files\Windows Mail\wab.exe [518144 2018-04-12] (Microsoft Corporation)
HKU\S-1-5-20\...\RunOnce: [WAB Migrate] => C:\Program Files\Windows Mail\wab.exe [518144 2018-04-12] (Microsoft Corporation)
HKU\S-1-5-21-3243081975-1801143758-1203345775-1001\...\Run: [Vivaldi Update Notifier] => C:\Users\franc\AppData\Local\Vivaldi\Application\update_notifier.exe [1488456 2018-03-21] (Vivaldi Technologies AS)
HKU\S-1-5-21-3243081975-1801143758-1203345775-1001\...\Run: [DriverMax_RESTART] => C:\Program Files (x86)\Innovative Solutions\DriverMax\drivermax.exe [7730776 2018-05-22] (Innovative Solutions)
Startup: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\SteelSeries Engine 3.lnk [2018-11-15]
ShortcutTarget: SteelSeries Engine 3.lnk -> C:\Program Files\SteelSeries\SteelSeries Engine 3\SteelSeriesEngine3.exe (SteelSeries ApS)

==================== Internet (Whitelisted) ====================

(If an item is included in the fixlist, if it is a registry item it will be removed or restored to default.)

Hosts: There are more than one entry in Hosts. See Hosts section of Addition.txt
Tcpip\Parameters: [DhcpNameServer] 192.168.0.254
Tcpip\..\Interfaces\{4a795f3e-9dd9-4f69-ba73-6383d7d52b39}: [DhcpNameServer] 192.168.0.254
Tcpip\..\Interfaces\{b66141e2-d2f2-43ae-97ca-26716373670e}: [DhcpNameServer] 212.27.40.241 212.27.40.240
Tcpip\..\Interfaces\{eb3db1f9-467c-47f0-9dc3-a1984f5de0e1}: [DhcpNameServer] 192.168.0.254
ManualProxies:

Internet Explorer:
==================
SearchScopes: HKU\S-1-5-21-3243081975-1801143758-1203345775-1001 -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = hxxps://www.bing.com/search?q={searchTerms}&src=IE-SearchBox&FORM=IESR02&pc=UE00
SearchScopes: HKU\S-1-5-21-3243081975-1801143758-1203345775-1001 -> {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = hxxps://www.bing.com/search?q={searchTerms}&src=IE-SearchBox&FORM=IESR02&pc=UE00
BHO: Skype for Business Browser Helper -> {31D09BA0-12F5-4CCE-BE8A-2923E76605DA} -> C:\Program Files (x86)\Microsoft Office\root\VFS\ProgramFilesX64\Microsoft Office\Office16\OCHelper.dll [2018-10-23] (Microsoft Corporation)
BHO: Java(tm) Plug-In SSV Helper -> {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} -> C:\Program Files\Java\jre1.8.0_181\bin\ssv.dll [2018-07-20] (Oracle Corporation)
BHO: Java(tm) Plug-In 2 SSV Helper -> {DBC80044-A445-435b-BC74-9C25C1C588A9} -> C:\Program Files\Java\jre1.8.0_181\bin\jp2ssv.dll [2018-07-20] (Oracle Corporation)
Handler-x32: mso-minsb-roaming.16 - {83C25742-A9F7-49FB-9138-434302C88D07} - C:\Program Files (x86)\Microsoft Office\root\Office16\MSOSB.DLL [2018-10-04] (Microsoft Corporation)
Handler-x32: mso-minsb.16 - {42089D2D-912D-4018-9087-2B87803E93FB} - C:\Program Files (x86)\Microsoft Office\root\Office16\MSOSB.DLL [2018-10-04] (Microsoft Corporation)
Handler-x32: osf-roaming.16 - {42089D2D-912D-4018-9087-2B87803E93FB} - C:\Program Files (x86)\Microsoft Office\root\Office16\MSOSB.DLL [2018-10-04] (Microsoft Corporation)
Handler-x32: osf.16 - {5504BE45-A83B-4808-900A-3A5C36E7F77A} - C:\Program Files (x86)\Microsoft Office\root\Office16\MSOSB.DLL [2018-10-04] (Microsoft Corporation)

Edge:
======
Edge Extension: (Adblock Plus) -> 10_EyeoGmbHAdblockPlus_d55gg7py3s0m0 => C:\Program Files\WindowsApps\EyeoGmbH.AdblockPlus_0.9.11.0_neutral__d55gg7py3s0m0 [2018-07-02]
Edge Extension: (Evernote Web Clipper) -> 9nblggh4x0qw_EvernoteEvernoteWebClipper_q4d96b2w5wcc2 => C:\Program Files\WindowsApps\Evernote.EvernoteWebClipper_6.13.2.0_neutral__q4d96b2w5wcc2 [2018-07-02]
Edge Extension: (Enhancer for YouTube™) -> EdgeExtension_48376MaximeRFEnhancerforYouTubeforMicrosoftEdge_f4efyycdr3qdm => C:\Program Files\WindowsApps\48376MaximeRF.EnhancerforYouTubeforMicrosoftEdge_2.0.77.0_neutral__f4efyycdr3qdm [2018-11-16]
Edge Extension: (Nom) -> EdgeExtension_8bitSolutionsLLCbitwardenFreePasswordManager_h4e712dmw3xyy => C:\Program Files\WindowsApps\8bitSolutionsLLC.bitwarden-FreePasswordManager_1.34.0.0_neutral__h4e712dmw3xyy [2018-11-10]
Edge Extension: (Pin It Button) -> EdgeExtension_PinterestPinItButton_xnkra2w3aecd0 => C:\Program Files\WindowsApps\Pinterest.PinItButton_1.39.5.0_neutral__xnkra2w3aecd0 [2018-07-02]
Edge Extension: (Translator pour Microsoft Edge) -> MicrosoftTranslate_MicrosoftTranslatorforMicrosoftEdge_8wekyb3d8bbwe => C:\Program Files\WindowsApps\Microsoft.TranslatorforMicrosoftEdge_0.91.48.0_neutral__8wekyb3d8bbwe [2018-07-21]

FireFox:
========
FF DefaultProfile: 4q9abl71.default
FF DefaultProfile: 1rca6x8y.default
FF ProfilePath: C:\Users\franc\AppData\Roaming\Mozilla\Firefox\Profiles\4q9abl71.default [2018-11-16]
FF Homepage: Mozilla\Firefox\Profiles\4q9abl71.default -> hxxps://start.me/p/ZmQG76/page-d-accueil-welcome-page-pagina-inicial
hxxps://atavi.com/start/
about:blank
FF NewTab: Mozilla\Firefox\Profiles\4q9abl71.default -> hxxp://www.bing.com/?pc=COSP&ptag=D070518-AD26CBEB7DD&form=CONMHP&conlogo=CT3335811
FF Session Restore: Mozilla\Firefox\Profiles\4q9abl71.default -> is enabled.
FF NewTabOverride: Mozilla\Firefox\Profiles\4q9abl71.default -> Disabled: extension@atavi.com
FF NewTabOverride: Mozilla\Firefox\Profiles\4q9abl71.default -> Enabled: {d04b0b40-3dab-4f0b-97a6-04ec3eddbfb0}
FF Extension: (Cookie AutoDelete) - C:\Users\franc\AppData\Roaming\Mozilla\Firefox\Profiles\4q9abl71.default\Extensions\CookieAutoDelete@kennydo.com.xpi [2018-07-02]
FF Extension: (Ghostery – Privacy Ad Blocker) - C:\Users\franc\AppData\Roaming\Mozilla\Firefox\Profiles\4q9abl71.default\Extensions\firefox@ghostery.com.xpi [2018-09-02]
FF Extension: (HTTPS Everywhere) - C:\Users\franc\AppData\Roaming\Mozilla\Firefox\Profiles\4q9abl71.default\Extensions\https-everywhere@eff.org.xpi [2018-11-01]
FF Extension: (To Google Translate) - C:\Users\franc\AppData\Roaming\Mozilla\Firefox\Profiles\4q9abl71.default\Extensions\jid1-93WyvpgvxzGATw@jetpack.xpi [2018-07-10]
FF Extension: (DuckDuckGo Privacy Essentials) - C:\Users\franc\AppData\Roaming\Mozilla\Firefox\Profiles\4q9abl71.default\Extensions\jid1-ZAdIEUB7XOzOJw@jetpack.xpi [2018-10-25]
FF Extension: (No Name) - C:\Users\franc\AppData\Roaming\Mozilla\Firefox\Profiles\4q9abl71.default\Extensions\openinbrowser@www.spasche.net.xpi [2018-10-07]
FF Extension: (Print Edit WE) - C:\Users\franc\AppData\Roaming\Mozilla\Firefox\Profiles\4q9abl71.default\Extensions\printedit-we@DW-dev.xpi [2018-11-08]
FF Extension: (Save Page WE) - C:\Users\franc\AppData\Roaming\Mozilla\Firefox\Profiles\4q9abl71.default\Extensions\savepage-we@DW-dev.xpi [2018-11-08]
FF Extension: (uBlock Origin) - C:\Users\franc\AppData\Roaming\Mozilla\Firefox\Profiles\4q9abl71.default\Extensions\uBlock0@raymondhill.net.xpi [2018-10-22]
FF Extension: (New tab page by start.me) - C:\Users\franc\AppData\Roaming\Mozilla\Firefox\Profiles\4q9abl71.default\Extensions\yourls@yourls.com.xpi [2018-11-12]
FF Extension: (Bitwarden - Free Password Manager) - C:\Users\franc\AppData\Roaming\Mozilla\Firefox\Profiles\4q9abl71.default\Extensions\{446900e4-71c2-419f-a6a7-df9c091e268b}.xpi [2018-11-08]
FF Extension: (Print to PDF) - C:\Users\franc\AppData\Roaming\Mozilla\Firefox\Profiles\4q9abl71.default\Extensions\{9ab38051-cd73-4e46-b7bd-dc147f6f6b29}.xpi [2018-07-02]
FF Extension: (Easy Youtube Video Downloader Express) - C:\Users\franc\AppData\Roaming\Mozilla\Firefox\Profiles\4q9abl71.default\Extensions\{b9acf540-acba-11e1-8ccb-001fd0e08bd4}.xpi [2018-11-12]
FF Extension: (Video DownloadHelper) - C:\Users\franc\AppData\Roaming\Mozilla\Firefox\Profiles\4q9abl71.default\Extensions\{b9db16a4-6edc-47ec-a1f4-b86292ed211d}.xpi [2018-09-02]
FF Extension: (Flash and Video Download) - C:\Users\franc\AppData\Roaming\Mozilla\Firefox\Profiles\4q9abl71.default\Extensions\{bee6eb20-01e0-ebd1-da83-080329fb9a3a}.xpi [2018-09-02]
FF Extension: (Ecosia - The search engine that plants trees) - C:\Users\franc\AppData\Roaming\Mozilla\Firefox\Profiles\4q9abl71.default\Extensions\{d04b0b40-3dab-4f0b-97a6-04ec3eddbfb0}.xpi [2018-07-02]
FF Extension: (Adblock Plus) - C:\Users\franc\AppData\Roaming\Mozilla\Firefox\Profiles\4q9abl71.default\Extensions\{d10d0bf8-f5b5-c8b4-a8b2-2b9879e08c5d}.xpi [2018-11-15]
FF Extension: (Diigo Web Collector - Capture and Annotate) - C:\Users\franc\AppData\Roaming\Mozilla\Firefox\Profiles\4q9abl71.default\Extensions\{fc2b8f80-d9a5-4f51-8076-7c7ce3c67ee3}.xpi [2018-07-02]
FF Extension: (Firefox Monitor) - C:\Users\franc\AppData\Roaming\Mozilla\Firefox\Profiles\4q9abl71.default\features\{2c09d05f-16f2-483d-bcfd-b6f561cff956}\fxmonitor@mozilla.org.xpi [2018-11-15]
FF SearchPlugin: C:\Users\franc\AppData\Roaming\Mozilla\Firefox\Profiles\4q9abl71.default\searchplugins\bing-lavasoft-ff59.xml [2018-07-05]
FF ProfilePath: C:\Users\franc\AppData\Roaming\Moonchild Productions\Pale Moon\Profiles\1rca6x8y.default [2018-11-16]
FF Plugin: @adobe.com/FlashPlayer -> C:\WINDOWS\system32\Macromed\Flash\NPSWF64_31_0_0_148.dll [2018-11-15] ()
FF Plugin: @java.com/DTPlugin,version=11.181.2 -> C:\Program Files\Java\jre1.8.0_181\bin\dtplugin\npDeployJava1.dll [2018-07-20] (Oracle Corporation)
FF Plugin: @java.com/JavaPlugin,version=11.181.2 -> C:\Program Files\Java\jre1.8.0_181\bin\plugin2\npjp2.dll [2018-07-20] (Oracle Corporation)
FF Plugin: @videolan.org/vlc,version=3.0.1 -> C:\Program Files\VideoLAN\VLC\npvlc.dll [2018-08-10] (VideoLAN)
FF Plugin: @videolan.org/vlc,version=3.0.3 -> C:\Program Files\VideoLAN\VLC\npvlc.dll [2018-08-10] (VideoLAN)
FF Plugin: @videolan.org/vlc,version=3.0.4 -> C:\Program Files\VideoLAN\VLC\npvlc.dll [2018-08-10] (VideoLAN)
FF Plugin-x32: @adobe.com/FlashPlayer -> C:\WINDOWS\SysWOW64\Macromed\Flash\NPSWF32_31_0_0_148.dll [2018-11-15] ()
FF Plugin-x32: @microsoft.com/SharePoint,version=14.0 -> C:\Program Files (x86)\Microsoft Office\root\Office16\NPSPWRAP.DLL [2018-09-22] (Microsoft Corporation)
FF Plugin-x32: Adobe Reader -> C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AIR\nppdf32.dll [2018-09-20] (Adobe Systems Inc.)

==================== Services (Whitelisted) ====================

(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)

R2 AtherosSvc; C:\WINDOWS\system32\DRIVERS\AdminService.exe [416072 2018-06-26] (Windows (R) Win 7 DDK provider)
R2 ClickToRunSvc; C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe [9667872 2018-10-24] (Microsoft Corporation)
R2 CybereasonRansomFree; C:\Program Files (x86)\Cybereason\RansomFree\CybereasonRansomFreeServiceHost.exe [13824 2017-11-20] (Cybereason) [File not signed]
R2 ETDService; C:\Program Files\Elantech\ETDService.exe [144072 2015-10-21] (ELAN Microelectronics Corp.)
R2 FirebirdServerDefaultInstance; c:\program files\Instant-Gestion\Instant-Gestion-ME-Classic\Firebird\bin\fbserver.exe [3735552 2010-09-17] (Firebird Project) [File not signed]
R2 igfxCUIService1.0.0.0; C:\WINDOWS\system32\igfxCUIService.exe [337888 2016-07-23] (Intel Corporation)
R2 PSI_SVC_2; c:\Program Files (x86)\Common Files\Protexis\License Service\PsiService_2.exe [277360 2014-04-30] (arvato digital services llc)
R2 PSI_SVC_2_x64; c:\Program Files\Common Files\Protexis\License Service\PsiService_2.exe [337776 2014-04-30] (arvato digital services llc)
R2 SDScannerService; C:\Program Files (x86)\Spybot - Search & Destroy 2\SDFSSvc.exe [3892256 2018-04-20] (Safer-Networking Ltd.)
R2 SDUpdateService; C:\Program Files (x86)\Spybot - Search & Destroy 2\SDUpdSvc.exe [3943664 2018-04-20] (Safer-Networking Ltd.)
R2 SDWSCService; C:\Program Files (x86)\Spybot - Search & Destroy 2\SDWSCSvc.exe [233712 2018-02-06] (Safer-Networking Ltd.)
S4 ssh-agent; C:\WINDOWS\System32\OpenSSH\ssh-agent.exe [495616 2018-03-10] ()
R3 WdNisSvc; C:\ProgramData\Microsoft\Windows Defender\platform\4.18.1810.5-0\NisSrv.exe [3917016 2018-10-23] (Microsoft Corporation)
R2 WinDefend; C:\ProgramData\Microsoft\Windows Defender\platform\4.18.1810.5-0\MsMpEng.exe [114208 2018-10-23] (Microsoft Corporation)
R2 NVDisplay.ContainerLocalSystem; "C:\Program Files\NVIDIA Corporation\Display.NvContainer\NVDisplay.Container.exe" -s NVDisplay.ContainerLocalSystem -f "C:\ProgramData\NVIDIA\NVDisplay.ContainerLocalSystem.log" -l 3 -d "C:\Program Files\NVIDIA Corporation\Display.NvContainer\plugins\LocalSystem" -r -p 30000

===================== Drivers (Whitelisted) ======================

(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)

S3 ampa; C:\WINDOWS\system32\ampa.sys [38320 2017-02-28] ()
S3 ampa; C:\WINDOWS\SysWOW64\ampa.sys [38320 2017-02-28] ()
R3 athr; C:\WINDOWS\System32\drivers\athw10x.sys [4322672 2018-03-20] (Qualcomm Atheros Communications, Inc.)
S3 Btcsrusb; C:\WINDOWS\System32\Drivers\btcusb.sys [53488 2017-12-22] (IVT Corporation.)
R3 BtFilter; C:\WINDOWS\system32\DRIVERS\btfilter.sys [69440 2018-06-26] (Qualcomm)
S3 dg_ssudbus; C:\WINDOWS\system32\DRIVERS\ssudbus.sys [131984 2017-05-18] (Samsung Electronics Co., Ltd.)
S3 FlashUSB; C:\WINDOWS\System32\drivers\FlashUSB.sys [19968 2014-12-03] (Intel Mobile Communications)
S3 LMDriver; C:\WINDOWS\System32\drivers\LMDriver.sys [21360 2013-07-17] (Acer Incorporated)
R3 nvlddmkm; C:\WINDOWS\System32\DriverStore\FileRepository\nvacwu.inf_amd64_9d2734742a07f3cf\nvlddmkm.sys [14456920 2017-05-18] (NVIDIA Corporation)
S3 pikbd; C:\WINDOWS\System32\drivers\pikbd.sys [41368 2016-11-17] ()
S3 RadioShim; C:\WINDOWS\System32\drivers\RadioShim.sys [14680 2013-07-17] (Acer Incorporated)
R1 SDHookDriver; C:\Program Files (x86)\Spybot - Search & Destroy 2\SDHookDrv64.sys [92032 2018-03-19] (Safer-Networking Ltd.)
S3 shspusb; C:\WINDOWS\System32\drivers\HSPUSB.sys [24064 2014-12-03] (MobileTop)
S3 SmbDrv; C:\WINDOWS\System32\drivers\Smb_driver_AMDASF.sys [41560 2018-01-09] (Synaptics Incorporated)
R3 SmbDrvI; C:\WINDOWS\System32\drivers\Smb_driver_Intel.sys [56936 2018-09-17] (Synaptics Incorporated)
S3 ssbthid; C:\WINDOWS\System32\drivers\ssbthid.sys [43824 2017-12-15] ()
S3 sscdserd; C:\WINDOWS\System32\drivers\sscdserd.sys [158024 2014-12-03] (MCCI Corporation)
S3 ssceserd; C:\WINDOWS\System32\drivers\ssceserd.sys [158024 2014-12-03] (MCCI Corporation)
R3 ssdevfactory; C:\WINDOWS\System32\drivers\ssdevfactory.sys [48320 2018-08-20] ()
S3 ssdudfu; C:\WINDOWS\System32\drivers\ssdudfu.sys [101960 2014-12-03] (MCCI)
S3 ssm_bus; C:\WINDOWS\System32\drivers\ssm_bus.sys [136192 2014-12-03] (MCCI Corporation)
S3 ssm_mdm; C:\WINDOWS\System32\drivers\ssm_mdm.sys [172032 2014-12-03] (MCCI Corporation)
S3 ssuddmgr; C:\WINDOWS\System32\drivers\ssuddmgr.sys [206104 2014-12-03] (DEVGURU Co., LTD.(www.devguru.co.kr))
S3 ssudmdm; C:\WINDOWS\system32\DRIVERS\ssudmdm.sys [166288 2017-05-18] (Samsung Electronics Co., Ltd.)
S3 ssudobex; C:\WINDOWS\System32\drivers\ssudobex.sys [206104 2014-12-03] (DEVGURU Co., LTD.(www.devguru.co.kr))
S3 ssudqcfilter; C:\WINDOWS\System32\drivers\ssudqcfilter.sys [48920 2014-12-03] (QUALCOMM Incorporated)
S3 ssudserd; C:\WINDOWS\System32\drivers\ssudserd.sys [206104 2014-12-03] (DEVGURU Co., LTD.(www.devguru.co.kr))
S3 ss_bserd; C:\WINDOWS\System32\drivers\ss_bserd.sys [128000 2014-12-03] (MCCI Corporation)
S3 ss_conn_usb_driver; C:\WINDOWS\System32\Drivers\ss_conn_usb_driver.sys [26392 2014-12-03] (DEVGURU Co., LTD.)
S3 STTub30; C:\WINDOWS\System32\Drivers\STTub30.sys [54104 2017-08-30] (STMicroelectronics)
S0 WdBoot; C:\WINDOWS\System32\drivers\wd\WdBoot.sys [46184 2018-10-23] (Microsoft Corporation)
R0 WdFilter; C:\WINDOWS\System32\drivers\wd\WdFilter.sys [328696 2018-10-23] (Microsoft Corporation)
R3 WdNisDrv; C:\WINDOWS\System32\drivers\wd\WdNisDrv.sys [60408 2018-10-23] (Microsoft Corporation)

==================== NetSvcs (Whitelisted) ===================

(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)


==================== One Month Created files and folders ========

(If an entry is included in the fixlist, the file/folder will be moved.)

2018-11-16 18:47 - 2018-11-16 18:48 - 000000000 ____D C:\FRST
2018-11-16 17:19 - 2018-11-16 17:19 - 000515880 ____N C:\Users\Akqhd\fade.studying.xlsx
2018-11-16 17:19 - 2018-11-16 17:19 - 000515355 ____N C:\Users\Qj4jpuc\guided-instruments.xlsx
2018-11-16 17:19 - 2018-11-16 17:19 - 000218490 ____N C:\Users\Qj4jpuc\identificationbetformation.mdb
2018-11-16 17:19 - 2018-11-16 17:19 - 000217576 ____N C:\Users\Akqhd\royalty_dimension_divide.mdb
2018-11-16 17:19 - 2018-11-16 17:19 - 000077030 ____N C:\Users\Qj4jpuc\cutpodgerchairsknock.xls
2018-11-16 17:19 - 2018-11-16 17:19 - 000064952 ____N C:\Users\Akqhd\nature_exercises_aspiration_wash.xls
2018-11-16 17:19 - 2018-11-16 17:19 - 000052681 ____N C:\Users\Akqhd\leather_personality.pem
2018-11-16 17:19 - 2018-11-16 17:19 - 000052059 ____N C:\Users\Qj4jpuc\meltingtensionswimdirt.pem
2018-11-16 17:19 - 2018-11-16 17:19 - 000021404 ____N C:\Users\Qj4jpuc\occasionallyordertoleratemusic.sql
2018-11-16 17:19 - 2018-11-16 17:19 - 000015116 ____N C:\Users\Qj4jpuc\textiletreat.txt
2018-11-16 17:19 - 2018-11-16 17:19 - 000011854 ____N C:\Users\Akqhd\bubble-supplied.txt
2018-11-16 17:19 - 2018-11-16 17:19 - 000011253 ____N C:\Users\Akqhd\introductionassembled.sql
2018-11-16 17:19 - 2018-11-16 17:19 - 000000000 __SHD C:\Users\franc\Desktop\0K, this directory is for Ransomware detection (just leave it here)
2018-11-16 17:19 - 2018-11-16 17:19 - 000000000 ___HD C:\Users\Qj4jpuc
2018-11-16 17:19 - 2018-11-16 17:19 - 000000000 ___HD C:\Users\franc\Documents\Tlog170
2018-11-16 17:19 - 2018-11-16 17:19 - 000000000 ___HD C:\Users\franc\Documents\Bconfiguration138
2018-11-16 17:19 - 2018-11-16 17:19 - 000000000 ___HD C:\Users\Akqhd
2018-11-16 17:19 - 2018-11-16 17:19 - 000000000 ____D C:\Ximages95
2018-11-16 17:19 - 2018-11-16 17:19 - 000000000 ____D C:\bmirror160
2018-11-16 15:08 - 2018-11-16 15:08 - 000002265 _____ C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Adobe Digital Editions 4.5.lnk
2018-11-16 15:08 - 2018-11-16 15:08 - 000000000 ____D C:\Users\franc\AppData\Local\Adobe_Systems_Incorporate
2018-11-16 15:08 - 2018-11-16 15:08 - 000000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Adobe
2018-11-16 15:08 - 2018-11-16 15:08 - 000000000 ____D C:\My Digital Editions
2018-11-15 16:49 - 2018-11-15 21:54 - 000000000 ____D C:\Users\franc\AppData\Roaming\vlc
2018-11-15 16:35 - 2018-11-15 16:35 - 000000000 ____D C:\Users\franc\AppData\Roaming\dvdcss
2018-11-15 12:31 - 2018-11-05 18:34 - 000835168 _____ (Adobe Systems Incorporated) C:\WINDOWS\SysWOW64\FlashPlayerApp.exe
2018-11-15 12:31 - 2018-11-05 18:34 - 000179808 _____ (Adobe Systems Incorporated) C:\WINDOWS\SysWOW64\FlashPlayerCPLApp.cpl
2018-11-15 09:54 - 2018-11-01 12:46 - 002394960 _____ (Microsoft Corporation) C:\WINDOWS\system32\WMVCORE.DLL
2018-11-15 09:54 - 2018-11-01 12:45 - 004527776 _____ (Microsoft Corporation) C:\WINDOWS\system32\sppsvc.exe
2018-11-15 09:54 - 2018-11-01 12:45 - 001617320 _____ (Microsoft Corporation) C:\WINDOWS\system32\sppobjs.dll
2018-11-15 09:54 - 2018-11-01 12:31 - 006602240 _____ (Microsoft Corporation) C:\WINDOWS\system32\twinui.dll
2018-11-15 09:54 - 2018-11-01 12:29 - 012710400 _____ (Microsoft Corporation) C:\WINDOWS\system32\ieframe.dll
2018-11-15 09:54 - 2018-11-01 12:28 - 004491264 _____ (Microsoft Corporation) C:\WINDOWS\system32\xpsrchvw.exe
2018-11-15 09:54 - 2018-11-01 12:28 - 003649024 _____ (Microsoft Corporation) C:\WINDOWS\system32\win32kfull.sys
2018-11-15 09:54 - 2018-11-01 10:59 - 005669888 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\twinui.dll
2018-11-15 09:54 - 2018-11-01 10:56 - 011902464 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\ieframe.dll
2018-11-15 09:54 - 2018-11-01 10:52 - 002892800 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\win32kfull.sys
2018-11-15 09:54 - 2018-11-01 10:15 - 023861760 _____ (Microsoft Corporation) C:\WINDOWS\system32\Hydrogen.dll
2018-11-15 09:54 - 2018-11-01 10:13 - 019525120 _____ (Microsoft Corporation) C:\WINDOWS\system32\HologramCompositor.dll
2018-11-15 09:54 - 2018-11-01 08:39 - 001035256 _____ (Microsoft Corporation) C:\WINDOWS\system32\ApplyTrustOffline.exe
2018-11-15 09:54 - 2018-11-01 08:28 - 001221432 _____ (Microsoft Corporation) C:\WINDOWS\system32\hvix64.exe
2018-11-15 09:54 - 2018-11-01 08:28 - 001029944 _____ (Microsoft Corporation) C:\WINDOWS\system32\hvax64.exe
2018-11-15 09:54 - 2018-11-01 08:27 - 001017152 _____ (Microsoft Corporation) C:\WINDOWS\system32\msmpeg2adec.dll
2018-11-15 09:54 - 2018-11-01 08:26 - 007432120 _____ (Microsoft Corporation) C:\WINDOWS\system32\windows.storage.dll
2018-11-15 09:54 - 2018-11-01 08:26 - 003291640 _____ (Microsoft Corporation) C:\WINDOWS\system32\combase.dll
2018-11-15 09:54 - 2018-11-01 08:26 - 003180080 _____ (Microsoft Corporation) C:\WINDOWS\system32\d3d11.dll
2018-11-15 09:54 - 2018-11-01 08:25 - 009089848 _____ (Microsoft Corporation) C:\WINDOWS\system32\ntoskrnl.exe
2018-11-15 09:54 - 2018-11-01 08:25 - 007520088 _____ (Microsoft Corporation) C:\WINDOWS\system32\Windows.Media.Protection.PlayReady.dll
2018-11-15 09:54 - 2018-11-01 08:25 - 004404912 _____ (Microsoft Corporation) C:\WINDOWS\system32\mfcore.dll
2018-11-15 09:54 - 2018-11-01 08:25 - 002822456 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\dxgkrnl.sys
2018-11-15 09:54 - 2018-11-01 08:25 - 002571320 _____ (Microsoft Corporation) C:\WINDOWS\system32\KernelBase.dll
2018-11-15 09:54 - 2018-11-01 08:25 - 002371296 _____ (Microsoft Corporation) C:\WINDOWS\system32\msmpeg2vdec.dll
2018-11-15 09:54 - 2018-11-01 08:25 - 001784680 _____ (Microsoft Corporation) C:\WINDOWS\system32\mfasfsrcsnk.dll
2018-11-15 09:54 - 2018-11-01 08:25 - 001288920 _____ (Microsoft Corporation) C:\WINDOWS\system32\mfmpeg2srcsnk.dll
2018-11-15 09:54 - 2018-11-01 08:09 - 025855488 _____ (Microsoft Corporation) C:\WINDOWS\system32\edgehtml.dll
2018-11-15 09:54 - 2018-11-01 08:03 - 003397120 _____ (Microsoft Corporation) C:\WINDOWS\system32\AppXDeploymentServer.dll
2018-11-15 09:54 - 2018-11-01 08:01 - 022716416 _____ (Microsoft Corporation) C:\WINDOWS\system32\mshtml.dll
2018-11-15 09:54 - 2018-11-01 08:01 - 009084928 _____ (Microsoft Corporation) C:\WINDOWS\system32\BingMaps.dll
2018-11-15 09:54 - 2018-11-01 08:01 - 007057408 _____ (Microsoft Corporation) C:\WINDOWS\system32\mos.dll
2018-11-15 09:54 - 2018-11-01 08:00 - 008189440 _____ (Microsoft Corporation) C:\WINDOWS\system32\Windows.Data.Pdf.dll
2018-11-15 09:54 - 2018-11-01 08:00 - 006031360 _____ (Microsoft Corporation) C:\WINDOWS\system32\d2d1.dll
2018-11-15 09:54 - 2018-11-01 08:00 - 003392000 _____ (Microsoft Corporation) C:\WINDOWS\system32\tquery.dll
2018-11-15 09:54 - 2018-11-01 07:58 - 007573504 _____ (Microsoft Corporation) C:\WINDOWS\system32\Chakra.dll
2018-11-15 09:54 - 2018-11-01 07:58 - 004867072 _____ (Microsoft Corporation) C:\WINDOWS\system32\jscript9.dll
2018-11-15 09:54 - 2018-11-01 07:58 - 004383744 _____ (Microsoft Corporation) C:\WINDOWS\system32\EdgeContent.dll
2018-11-15 09:54 - 2018-11-01 07:57 - 001804288 _____ (Microsoft Corporation) C:\WINDOWS\system32\urlmon.dll
2018-11-15 09:54 - 2018-11-01 07:56 - 001768448 _____ (Microsoft Corporation) C:\WINDOWS\system32\audiosrv.dll
2018-11-15 09:54 - 2018-11-01 07:56 - 001395200 _____ (Microsoft Corporation) C:\WINDOWS\system32\TokenBroker.dll
2018-11-15 09:54 - 2018-11-01 07:55 - 002738688 _____ (Microsoft Corporation) C:\WINDOWS\system32\mssrch.dll
2018-11-15 09:54 - 2018-11-01 07:53 - 002248192 _____ (Microsoft Corporation) C:\WINDOWS\system32\wlidsvc.dll
2018-11-15 09:54 - 2018-11-01 07:53 - 001159680 _____ (Microsoft Corporation) C:\WINDOWS\system32\rpcss.dll
2018-11-15 09:54 - 2018-11-01 05:50 - 000861712 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\msmpeg2adec.dll
2018-11-15 09:54 - 2018-11-01 05:48 - 006039064 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\windows.storage.dll
2018-11-15 09:54 - 2018-11-01 05:48 - 004790184 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\mfcore.dll
2018-11-15 09:54 - 2018-11-01 05:48 - 002478872 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\combase.dll
2018-11-15 09:54 - 2018-11-01 05:48 - 002331480 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\msmpeg2vdec.dll
2018-11-15 09:54 - 2018-11-01 05:47 - 006570368 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\Windows.Media.Protection.PlayReady.dll
2018-11-15 09:54 - 2018-11-01 05:47 - 001980776 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\KernelBase.dll
2018-11-15 09:54 - 2018-11-01 05:47 - 001379792 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\mfasfsrcsnk.dll
2018-11-15 09:54 - 2018-11-01 05:47 - 001020064 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\mfmpeg2srcsnk.dll
2018-11-15 09:54 - 2018-11-01 05:40 - 022015488 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\edgehtml.dll
2018-11-15 09:54 - 2018-11-01 05:35 - 019403776 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\mshtml.dll
2018-11-15 09:54 - 2018-11-01 05:34 - 002700288 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\tquery.dll
2018-11-15 09:54 - 2018-11-01 05:33 - 006661632 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\Windows.Data.Pdf.dll
2018-11-15 09:54 - 2018-11-01 05:33 - 003711488 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\jscript9.dll
2018-11-15 09:54 - 2018-11-01 05:30 - 005883904 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\mos.dll
2018-11-15 09:54 - 2018-11-01 05:30 - 005775872 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\Chakra.dll
2018-11-15 09:54 - 2018-10-21 14:00 - 021386368 _____ (Microsoft Corporation) C:\WINDOWS\system32\shell32.dll
2018-11-15 09:54 - 2018-10-21 14:00 - 001516120 _____ (Microsoft Corporation) C:\WINDOWS\system32\msctf.dll
2018-11-15 09:54 - 2018-10-21 13:46 - 013572096 _____ (Microsoft Corporation) C:\WINDOWS\system32\wmp.dll
2018-11-15 09:54 - 2018-10-21 13:46 - 004393472 _____ (Microsoft Corporation) C:\WINDOWS\system32\SettingsHandlers_nt.dll
2018-11-15 09:54 - 2018-10-21 12:38 - 001322376 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\msctf.dll
2018-11-15 09:54 - 2018-10-21 12:37 - 020381808 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\shell32.dll
2018-11-15 09:54 - 2018-10-21 12:28 - 012501504 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\wmp.dll
2018-11-15 09:54 - 2018-10-21 08:48 - 005602456 _____ (Microsoft Corporation) C:\WINDOWS\system32\StartTileData.dll
2018-11-15 09:54 - 2018-10-21 08:45 - 003283512 _____ (Microsoft Corporation) C:\WINDOWS\system32\CoreUIComponents.dll
2018-11-15 09:54 - 2018-10-21 08:28 - 016592384 _____ (Microsoft Corporation) C:\WINDOWS\system32\Windows.UI.Xaml.dll
2018-11-15 09:54 - 2018-10-21 08:22 - 004710912 _____ (Microsoft Corporation) C:\WINDOWS\system32\cdp.dll
2018-11-15 09:54 - 2018-10-21 08:17 - 001826816 _____ (Microsoft Corporation) C:\WINDOWS\system32\Windows.CloudStore.dll
2018-11-15 09:54 - 2018-10-21 08:17 - 001668096 _____ (Microsoft Corporation) C:\WINDOWS\system32\cdprt.dll
2018-11-15 09:54 - 2018-10-21 08:16 - 002368512 _____ (Microsoft Corporation) C:\WINDOWS\system32\WebRuntimeManager.dll
2018-11-15 09:54 - 2018-10-21 08:15 - 003212800 _____ (Microsoft Corporation) C:\WINDOWS\system32\DWrite.dll
2018-11-15 09:54 - 2018-10-21 08:15 - 002904064 _____ (Microsoft Corporation) C:\WINDOWS\system32\wuaueng.dll
2018-11-15 09:54 - 2018-10-21 08:14 - 001854976 _____ (Microsoft Corporation) C:\WINDOWS\system32\wevtsvc.dll
2018-11-15 09:54 - 2018-10-21 08:09 - 013873664 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\Windows.UI.Xaml.dll
2018-11-15 09:54 - 2018-10-21 08:02 - 002966528 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\cdp.dll
2018-11-15 09:53 - 2018-11-01 12:49 - 000348160 _____ (Microsoft Corporation) C:\WINDOWS\system32\MusNotifyIcon.exe
2018-11-15 09:53 - 2018-11-01 12:45 - 001376672 _____ (Microsoft Corporation) C:\WINDOWS\system32\ole32.dll
2018-11-15 09:53 - 2018-11-01 12:32 - 000064000 _____ (Microsoft Corporation) C:\WINDOWS\system32\iemigplugin.dll
2018-11-15 09:53 - 2018-11-01 12:30 - 000122368 _____ (Microsoft Corporation) C:\WINDOWS\system32\musdialoghandlers.dll
2018-11-15 09:53 - 2018-11-01 12:30 - 000029696 _____ (Microsoft Corporation) C:\WINDOWS\system32\msisip.dll
2018-11-15 09:53 - 2018-11-01 12:29 - 000073728 _____ (Microsoft Corporation) C:\WINDOWS\system32\SMSRouter.dll
2018-11-15 09:53 - 2018-11-01 12:28 - 000253952 _____ (Microsoft Corporation) C:\WINDOWS\system32\prnntfy.dll
2018-11-15 09:53 - 2018-11-01 12:27 - 001121792 _____ (Microsoft Corporation) C:\WINDOWS\system32\TSWorkspace.dll
2018-11-15 09:53 - 2018-11-01 12:27 - 000878592 _____ (Microsoft Corporation) C:\WINDOWS\system32\CPFilters.dll
2018-11-15 09:53 - 2018-11-01 12:26 - 001364992 _____ (Microsoft Corporation) C:\WINDOWS\system32\bcastdvruserservice.dll
2018-11-15 09:53 - 2018-11-01 12:26 - 000503296 _____ (Microsoft Corporation) C:\WINDOWS\system32\sppcext.dll
2018-11-15 09:53 - 2018-11-01 12:26 - 000392192 _____ (Microsoft Corporation) C:\WINDOWS\system32\iedkcs32.dll
2018-11-15 09:53 - 2018-11-01 12:25 - 000577024 _____ (Microsoft Corporation) C:\WINDOWS\system32\SppExtComObj.Exe
2018-11-15 09:53 - 2018-11-01 11:09 - 001027000 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\ole32.dll
2018-11-15 09:53 - 2018-11-01 10:56 - 000226304 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\prnntfy.dll
2018-11-15 09:53 - 2018-11-01 10:56 - 000024576 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\msisip.dll
2018-11-15 09:53 - 2018-11-01 10:54 - 003397632 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\xpsrchvw.exe
2018-11-15 09:53 - 2018-11-01 10:54 - 000344576 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\iedkcs32.dll
2018-11-15 09:53 - 2018-11-01 10:53 - 000908288 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\TSWorkspace.dll
2018-11-15 09:53 - 2018-11-01 08:38 - 000269336 _____ (Microsoft Corporation) C:\WINDOWS\system32\SgrmEnclave_secure.dll
2018-11-15 09:53 - 2018-11-01 08:37 - 000272408 _____ (Microsoft Corporation) C:\WINDOWS\system32\SgrmEnclave.dll
2018-11-15 09:53 - 2018-11-01 08:28 - 001062712 _____ (Microsoft Corporation) C:\WINDOWS\system32\SecConfig.efi
2018-11-15 09:53 - 2018-11-01 08:28 - 000566568 _____ (Microsoft Corporation) C:\WINDOWS\system32\tcblaunch.exe
2018-11-15 09:53 - 2018-11-01 08:28 - 000134968 _____ (Microsoft Corporation) C:\WINDOWS\system32\hvloader.dll
2018-11-15 09:53 - 2018-11-01 08:28 - 000076088 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\hvservice.sys
2018-11-15 09:53 - 2018-11-01 08:27 - 000491200 _____ (Microsoft Corporation) C:\WINDOWS\system32\mf.dll
2018-11-15 09:53 - 2018-11-01 08:26 - 001363536 _____ (Microsoft Corporation) C:\WINDOWS\system32\WinTypes.dll
2018-11-15 09:53 - 2018-11-01 08:25 - 001934808 _____ (Microsoft Corporation) C:\WINDOWS\system32\AudioEng.dll
2018-11-15 09:53 - 2018-11-01 08:25 - 001456728 _____ (Microsoft Corporation) C:\WINDOWS\system32\winload.efi
2018-11-15 09:53 - 2018-11-01 08:25 - 001257880 _____ (Microsoft Corporation) C:\WINDOWS\system32\winload.exe
2018-11-15 09:53 - 2018-11-01 08:25 - 001209888 _____ (Microsoft Corporation) C:\WINDOWS\system32\AudioSes.dll
2018-11-15 09:53 - 2018-11-01 08:25 - 001190248 _____ (Microsoft Corporation) C:\WINDOWS\system32\rpcrt4.dll
2018-11-15 09:53 - 2018-11-01 08:25 - 001140672 _____ (Microsoft Corporation) C:\WINDOWS\system32\winresume.efi
2018-11-15 09:53 - 2018-11-01 08:25 - 000982592 _____ (Microsoft Corporation) C:\WINDOWS\system32\winresume.exe
2018-11-15 09:53 - 2018-11-01 08:25 - 000885968 _____ (Microsoft Corporation) C:\WINDOWS\system32\CoreMessaging.dll
2018-11-15 09:53 - 2018-11-01 08:25 - 000793080 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\dxgmms2.sys
2018-11-15 09:53 - 2018-11-01 08:25 - 000713472 _____ (Microsoft Corporation) C:\WINDOWS\system32\MSVideoDSP.dll
2018-11-15 09:53 - 2018-11-01 08:25 - 000594224 _____ (Microsoft Corporation) C:\WINDOWS\system32\audiodg.exe
2018-11-15 09:53 - 2018-11-01 08:25 - 000463672 _____ (Microsoft Corporation) C:\WINDOWS\system32\coml2.dll
2018-11-15 09:53 - 2018-11-01 08:25 - 000413720 _____ (Microsoft Corporation) C:\WINDOWS\system32\AUDIOKSE.dll
2018-11-15 09:53 - 2018-11-01 08:25 - 000412984 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\dxgmms1.sys
2018-11-15 09:53 - 2018-11-01 08:25 - 000375824 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\msrpc.sys
2018-11-15 09:53 - 2018-11-01 08:25 - 000268088 _____ (Microsoft Corporation) C:\WINDOWS\system32\browserbroker.dll
2018-11-15 09:53 - 2018-11-01 08:25 - 000261000 _____ (Microsoft Corporation) C:\WINDOWS\system32\mfps.dll
2018-11-15 09:53 - 2018-11-01 08:03 - 000034816 _____ (Microsoft Corporation) C:\WINDOWS\system32\dusmtask.exe
2018-11-15 09:53 - 2018-11-01 08:02 - 000047104 _____ (Microsoft Corporation) C:\WINDOWS\system32\dusmapi.dll
2018-11-15 09:53 - 2018-11-01 08:02 - 000023552 _____ (Microsoft Corporation) C:\WINDOWS\system32\CSystemEventsBrokerClient.dll
2018-11-15 09:53 - 2018-11-01 08:00 - 000433664 _____ (Microsoft Corporation) C:\WINDOWS\system32\MusNotification.exe
2018-11-15 09:53 - 2018-11-01 08:00 - 000209408 _____ (Microsoft Corporation) C:\WINDOWS\system32\AppXApplicabilityBlob.dll
2018-11-15 09:53 - 2018-11-01 07:59 - 000322048 _____ (Microsoft Corporation) C:\WINDOWS\system32\MusNotificationUx.exe
2018-11-15 09:53 - 2018-11-01 07:59 - 000241152 _____ (Microsoft Corporation) C:\WINDOWS\system32\tetheringservice.dll
2018-11-15 09:53 - 2018-11-01 07:59 - 000192000 _____ (Microsoft Corporation) C:\WINDOWS\system32\scrrun.dll
2018-11-15 09:53 - 2018-11-01 07:59 - 000176128 _____ (Microsoft Corporation) C:\WINDOWS\system32\WPTaskScheduler.dll
2018-11-15 09:53 - 2018-11-01 07:59 - 000107520 _____ (Microsoft Corporation) C:\WINDOWS\system32\dab.dll
2018-11-15 09:53 - 2018-11-01 07:58 - 000530432 _____ (Microsoft Corporation) C:\WINDOWS\system32\MapConfiguration.dll
2018-11-15 09:53 - 2018-11-01 07:58 - 000273408 _____ (Microsoft Corporation) C:\WINDOWS\system32\ubpm.dll
2018-11-15 09:53 - 2018-11-01 07:58 - 000154112 _____ (Microsoft Corporation) C:\WINDOWS\system32\Chakradiag.dll
2018-11-15 09:53 - 2018-11-01 07:58 - 000149504 _____ (Microsoft Corporation) C:\WINDOWS\system32\dssvc.dll
2018-11-15 09:53 - 2018-11-01 07:57 - 003381248 _____ (Microsoft Corporation) C:\WINDOWS\system32\MapRouter.dll
2018-11-15 09:53 - 2018-11-01 07:57 - 002825728 _____ (Microsoft Corporation) C:\WINDOWS\system32\MapGeocoder.dll
2018-11-15 09:53 - 2018-11-01 07:57 - 002364928 _____ (Microsoft Corporation) C:\WINDOWS\system32\OpcServices.dll
2018-11-15 09:53 - 2018-11-01 07:57 - 001708544 _____ (Microsoft Corporation) C:\WINDOWS\system32\MSPhotography.dll
2018-11-15 09:53 - 2018-11-01 07:57 - 000898560 _____ (Microsoft Corporation) C:\WINDOWS\system32\MusUpdateHandlers.dll
2018-11-15 09:53 - 2018-11-01 07:57 - 000894464 _____ (Microsoft Corporation) C:\WINDOWS\system32\webplatstorageserver.dll
2018-11-15 09:53 - 2018-11-01 07:57 - 000835584 _____ (Microsoft Corporation) C:\WINDOWS\system32\PhoneService.dll
2018-11-15 09:53 - 2018-11-01 07:57 - 000808448 _____ (Microsoft Corporation) C:\WINDOWS\system32\EdgeManager.dll
2018-11-15 09:53 - 2018-11-01 07:57 - 000726528 _____ (Microsoft Corporation) C:\WINDOWS\system32\jscript9diag.dll
2018-11-15 09:53 - 2018-11-01 07:57 - 000356352 _____ (Microsoft Corporation) C:\WINDOWS\system32\dusmsvc.dll
2018-11-15 09:53 - 2018-11-01 07:57 - 000281600 _____ (Microsoft Corporation) C:\WINDOWS\system32\SystemEventsBrokerServer.dll
2018-11-15 09:53 - 2018-11-01 07:57 - 000265728 _____ (Microsoft Corporation) C:\WINDOWS\system32\psmsrv.dll
2018-11-15 09:53 - 2018-11-01 07:56 - 002929664 _____ (Microsoft Corporation) C:\WINDOWS\system32\xpsservices.dll
2018-11-15 09:53 - 2018-11-01 07:56 - 002172928 _____ (Microsoft Corporation) C:\WINDOWS\system32\AppXDeploymentExtensions.onecore.dll
2018-11-15 09:53 - 2018-11-01 07:56 - 000506880 _____ (Microsoft Corporation) C:\WINDOWS\system32\netprofmsvc.dll
2018-11-15 09:53 - 2018-11-01 07:55 - 001058304 _____ (Microsoft Corporation) C:\WINDOWS\system32\SearchIndexer.exe
2018-11-15 09:53 - 2018-11-01 07:55 - 000684544 _____ (Microsoft Corporation) C:\WINDOWS\system32\AudioEndpointBuilder.dll
2018-11-15 09:53 - 2018-11-01 07:54 - 001679360 _____ (Microsoft Corporation) C:\WINDOWS\system32\wwansvc.dll
2018-11-15 09:53 - 2018-11-01 07:54 - 001551360 _____ (Microsoft Corporation) C:\WINDOWS\system32\AppXDeploymentExtensions.desktop.dll
2018-11-15 09:53 - 2018-11-01 07:54 - 001264640 _____ (Microsoft Corporation) C:\WINDOWS\system32\JpMapControl.dll
2018-11-15 09:53 - 2018-11-01 07:54 - 001225216 _____ (Microsoft Corporation) C:\WINDOWS\system32\MapsStore.dll
2018-11-15 09:53 - 2018-11-01 07:54 - 001023488 _____ (Microsoft Corporation) C:\WINDOWS\system32\ShareHost.dll
2018-11-15 09:53 - 2018-11-01 07:54 - 000943616 _____ (Microsoft Corporation) C:\WINDOWS\system32\BingOnlineServices.dll
2018-11-15 09:53 - 2018-11-01 07:54 - 000916480 _____ (Microsoft Corporation) C:\WINDOWS\system32\Windows.Security.Authentication.Web.Core.dll
2018-11-15 09:53 - 2018-11-01 07:54 - 000895488 _____ (Microsoft Corporation) C:\WINDOWS\system32\Windows.Security.Authentication.OnlineId.dll
2018-11-15 09:53 - 2018-11-01 07:54 - 000884736 _____ (Microsoft Corporation) C:\WINDOWS\system32\MapControlCore.dll
2018-11-15 09:53 - 2018-11-01 07:54 - 000796672 _____ (Microsoft Corporation) C:\WINDOWS\system32\mssvp.dll
2018-11-15 09:53 - 2018-11-01 07:54 - 000606208 _____ (Microsoft Corporation) C:\WINDOWS\system32\updatehandlers.dll
2018-11-15 09:53 - 2018-11-01 07:53 - 001373696 _____ (Microsoft Corporation) C:\WINDOWS\system32\usocore.dll
2018-11-15 09:53 - 2018-11-01 07:53 - 000889344 _____ (Microsoft Corporation) C:\WINDOWS\system32\schedsvc.dll
2018-11-15 09:53 - 2018-11-01 07:53 - 000542208 _____ (Microsoft Corporation) C:\WINDOWS\system32\vbscript.dll
2018-11-15 09:53 - 2018-11-01 07:53 - 000406528 _____ (Microsoft Corporation) C:\WINDOWS\system32\SearchProtocolHost.exe
2018-11-15 09:53 - 2018-11-01 06:39 - 000001310 _____ C:\WINDOWS\system32\tcbres.wim
2018-11-15 09:53 - 2018-11-01 06:08 - 002417952 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\d3d11.dll
2018-11-15 09:53 - 2018-11-01 05:50 - 000786288 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\rpcrt4.dll
2018-11-15 09:53 - 2018-11-01 05:48 - 001805656 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\AudioEng.dll
2018-11-15 09:53 - 2018-11-01 05:48 - 001011872 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\AudioSes.dll
2018-11-15 09:53 - 2018-11-01 05:48 - 000880248 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\WinTypes.dll
2018-11-15 09:53 - 2018-11-01 05:48 - 000384520 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\coml2.dll
2018-11-15 09:53 - 2018-11-01 05:47 - 000581600 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\MSVideoDSP.dll
2018-11-15 09:53 - 2018-11-01 05:47 - 000567256 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\CoreMessaging.dll
2018-11-15 09:53 - 2018-11-01 05:47 - 000129304 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\mfps.dll
2018-11-15 09:53 - 2018-11-01 05:32 - 006647296 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\BingMaps.dll
2018-11-15 09:53 - 2018-11-01 05:31 - 005307904 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\d2d1.dll
2018-11-15 09:53 - 2018-11-01 05:31 - 000288768 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\Search.ProtocolHandler.MAPI2.dll
2018-11-15 09:53 - 2018-11-01 05:30 - 002449408 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\MapRouter.dll
2018-11-15 09:53 - 2018-11-01 05:30 - 001361408 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\MSPhotography.dll
2018-11-15 09:53 - 2018-11-01 05:30 - 000561152 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\jscript9diag.dll
2018-11-15 09:53 - 2018-11-01 05:30 - 000392704 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\MapConfiguration.dll
2018-11-15 09:53 - 2018-11-01 05:30 - 000310272 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\wincorlib.dll
2018-11-15 09:53 - 2018-11-01 05:29 - 002258944 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\mssrch.dll
2018-11-15 09:53 - 2018-11-01 05:29 - 001986560 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\MapGeocoder.dll
2018-11-15 09:53 - 2018-11-01 05:29 - 001862656 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\xpsservices.dll
2018-11-15 09:53 - 2018-11-01 05:29 - 000848384 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\ShareHost.dll
2018-11-15 09:53 - 2018-11-01 05:29 - 000608768 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\EdgeManager.dll
2018-11-15 09:53 - 2018-11-01 05:29 - 000578560 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\webplatstorageserver.dll
2018-11-15 09:53 - 2018-11-01 05:29 - 000165376 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\scrrun.dll
2018-11-15 09:53 - 2018-11-01 05:28 - 001348096 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\OpcServices.dll
2018-11-15 09:53 - 2018-11-01 05:28 - 001000448 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\TokenBroker.dll
2018-11-15 09:53 - 2018-11-01 05:28 - 000978944 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\JpMapControl.dll
2018-11-15 09:53 - 2018-11-01 05:27 - 001627648 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\urlmon.dll
2018-11-15 09:53 - 2018-11-01 05:27 - 000856576 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\SearchIndexer.exe
2018-11-15 09:53 - 2018-11-01 05:27 - 000713216 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\BingOnlineServices.dll
2018-11-15 09:53 - 2018-11-01 05:27 - 000678400 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\Windows.Security.Authentication.Web.Core.dll
2018-11-15 09:53 - 2018-11-01 05:27 - 000534016 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\vbscript.dll
2018-11-15 09:53 - 2018-11-01 05:26 - 000795648 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\Windows.Security.Authentication.OnlineId.dll
2018-11-15 09:53 - 2018-11-01 05:26 - 000735744 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\mssvp.dll
2018-11-15 09:53 - 2018-11-01 05:26 - 000345088 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\SearchProtocolHost.exe
2018-11-15 09:53 - 2018-10-21 14:00 - 001639560 _____ (Microsoft Corporation) C:\WINDOWS\system32\user32.dll
2018-11-15 09:53 - 2018-10-21 14:00 - 000790416 _____ (Microsoft Corporation) C:\WINDOWS\system32\fontdrvhost.exe
2018-11-15 09:53 - 2018-10-21 14:00 - 000396304 _____ (Adobe Systems Incorporated) C:\WINDOWS\system32\atmfd.dll
2018-11-15 09:53 - 2018-10-21 13:59 - 000766480 _____ (Microsoft Corporation) C:\WINDOWS\system32\LicensingWinRT.dll
2018-11-15 09:53 - 2018-10-21 13:59 - 000236728 _____ (Microsoft Corporation) C:\WINDOWS\system32\EditionUpgradeManagerObj.dll
2018-11-15 09:53 - 2018-10-21 13:45 - 000123392 _____ (Microsoft Corporation) C:\WINDOWS\system32\fontsub.dll
2018-11-15 09:53 - 2018-10-21 13:44 - 000623104 _____ (Microsoft Corporation) C:\WINDOWS\system32\osk.exe
2018-11-15 09:53 - 2018-10-21 13:44 - 000085504 _____ (Microsoft Corporation) C:\WINDOWS\system32\INETRES.dll
2018-11-15 09:53 - 2018-10-21 13:43 - 000345600 _____ (Microsoft Corporation) C:\WINDOWS\system32\AcGenral.dll
2018-11-15 09:53 - 2018-10-21 13:43 - 000276992 _____ (Microsoft Corporation) C:\WINDOWS\system32\wisp.dll
2018-11-15 09:53 - 2018-10-21 13:43 - 000182784 _____ (Microsoft Corporation) C:\WINDOWS\system32\LanguageComponentsInstaller.dll
2018-11-15 09:53 - 2018-10-21 13:42 - 001127936 _____ (Microsoft Corporation) C:\WINDOWS\system32\nettrace.dll
2018-11-15 09:53 - 2018-10-21 13:42 - 000765440 _____ (Microsoft Corporation) C:\WINDOWS\system32\tdh.dll
2018-11-15 09:53 - 2018-10-21 13:42 - 000592896 _____ (Microsoft Corporation) C:\WINDOWS\system32\UserLanguagesCpl.dll
2018-11-15 09:53 - 2018-10-21 13:42 - 000181248 _____ (Microsoft Corporation) C:\WINDOWS\system32\EditionUpgradeHelper.dll
2018-11-15 09:53 - 2018-10-21 13:41 - 001180672 _____ (Microsoft Corporation) C:\WINDOWS\system32\localspl.dll
2018-11-15 09:53 - 2018-10-21 12:38 - 000662312 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\fontdrvhost.exe
2018-11-15 09:53 - 2018-10-21 12:38 - 000660480 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\LicensingWinRT.dll
2018-11-15 09:53 - 2018-10-21 12:38 - 000221216 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\EditionUpgradeManagerObj.dll
2018-11-15 09:53 - 2018-10-21 12:37 - 001626656 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\user32.dll
2018-11-15 09:53 - 2018-10-21 12:28 - 000084992 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\INETRES.dll
2018-11-15 09:53 - 2018-10-21 12:23 - 000622080 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\tdh.dll
2018-11-15 09:53 - 2018-10-21 12:23 - 000523264 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\UserLanguagesCpl.dll
2018-11-15 09:53 - 2018-10-21 12:22 - 002405888 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\AcGenral.dll
2018-11-15 09:53 - 2018-10-21 12:22 - 000224256 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\wisp.dll
2018-11-15 09:53 - 2018-10-21 10:29 - 001008640 _____ (Microsoft Corporation) C:\WINDOWS\system32\Windows.Media.MixedRealityCapture.dll
2018-11-15 09:53 - 2018-10-21 09:44 - 000868864 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\Windows.Media.MixedRealityCapture.dll
2018-11-15 09:53 - 2018-10-21 08:47 - 000368440 _____ (Microsoft Corporation) C:\WINDOWS\system32\thumbcache.dll
2018-11-15 09:53 - 2018-10-21 08:46 - 000717112 _____ (Microsoft Corporation) C:\WINDOWS\system32\SettingsHandlers_StorageSense.dll
2018-11-15 09:53 - 2018-10-21 08:46 - 000709936 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\cng.sys
2018-11-15 09:53 - 2018-10-21 08:46 - 000611640 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\spaceport.sys
2018-11-15 09:53 - 2018-10-21 08:46 - 000560136 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\storport.sys
2018-11-15 09:53 - 2018-10-21 08:46 - 000497864 _____ (Microsoft Corporation) C:\WINDOWS\system32\Windows.Devices.Enumeration.dll
2018-11-15 09:53 - 2018-10-21 08:46 - 000171024 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\ksecpkg.sys
2018-11-15 09:53 - 2018-10-21 08:45 - 002719032 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\tcpip.sys
2018-11-15 09:53 - 2018-10-21 08:45 - 001946208 _____ (Microsoft Corporation) C:\WINDOWS\system32\ntdll.dll
2018-11-15 09:53 - 2018-10-21 08:45 - 001098064 _____ (Microsoft Corporation) C:\WINDOWS\system32\msvproc.dll
2018-11-15 09:53 - 2018-10-21 08:45 - 000607136 _____ (Microsoft Corporation) C:\WINDOWS\system32\TextInputFramework.dll
2018-11-15 09:53 - 2018-10-21 08:45 - 000185120 _____ (Microsoft Corporation) C:\WINDOWS\system32\sspicli.dll
2018-11-15 09:53 - 2018-10-21 08:45 - 000175624 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\spacedump.sys
2018-11-15 09:53 - 2018-10-21 08:45 - 000139792 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\ksecdd.sys
2018-11-15 09:53 - 2018-10-21 08:45 - 000058088 _____ (Microsoft Corporation) C:\WINDOWS\system32\lsass.exe
2018-11-15 09:53 - 2018-10-21 08:21 - 001589248 _____ (Microsoft Corporation) C:\WINDOWS\system32\Windows.Globalization.dll
2018-11-15 09:53 - 2018-10-21 08:21 - 000123424 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\sspicli.dll
2018-11-15 09:53 - 2018-10-21 08:20 - 000424000 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\Windows.Devices.Enumeration.dll
2018-11-15 09:53 - 2018-10-21 08:20 - 000295224 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\thumbcache.dll
2018-11-15 09:53 - 2018-10-21 08:20 - 000161792 _____ (Microsoft Corporation) C:\WINDOWS\system32\spacebridge.dll
2018-11-15 09:53 - 2018-10-21 08:20 - 000141312 _____ C:\WINDOWS\system32\DataStoreCacheDumpTool.exe
2018-11-15 09:53 - 2018-10-21 08:20 - 000050688 _____ (Microsoft Corporation) C:\WINDOWS\system32\wcimage.dll
2018-11-15 09:53 - 2018-10-21 08:19 - 002487088 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\CoreUIComponents.dll
2018-11-15 09:53 - 2018-10-21 08:19 - 001620776 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\ntdll.dll
2018-11-15 09:53 - 2018-10-21 08:19 - 001130768 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\msvproc.dll
2018-11-15 09:53 - 2018-10-21 08:19 - 000514560 _____ (Microsoft Corporation) C:\WINDOWS\system32\nltest.exe
2018-11-15 09:53 - 2018-10-21 08:19 - 000505616 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\TextInputFramework.dll
2018-11-15 09:53 - 2018-10-21 08:19 - 000463360 _____ (Microsoft Corporation) C:\WINDOWS\system32\wlansec.dll
2018-11-15 09:53 - 2018-10-21 08:19 - 000409088 _____ (Microsoft Corporation) C:\WINDOWS\system32\wlanmsm.dll
2018-11-15 09:53 - 2018-10-21 08:19 - 000228864 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\winnat.sys
2018-11-15 09:53 - 2018-10-21 08:19 - 000228352 _____ (Microsoft Corporation) C:\WINDOWS\system32\Windows.Web.Diagnostics.dll
2018-11-15 09:53 - 2018-10-21 08:19 - 000137728 _____ (Microsoft Corporation) C:\WINDOWS\system32\InputLocaleManager.dll
2018-11-15 09:53 - 2018-10-21 08:19 - 000112128 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\bthhfenum.sys
2018-11-15 09:53 - 2018-10-21 08:19 - 000086528 _____ (Microsoft Corporation) C:\WINDOWS\system32\ofdeploy.exe
2018-11-15 09:53 - 2018-10-21 08:19 - 000060928 _____ (Microsoft Corporation) C:\WINDOWS\system32\BthAvrcpAppSvc.dll
2018-11-15 09:53 - 2018-10-21 08:19 - 000036352 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\vhf.sys
2018-11-15 09:53 - 2018-10-21 08:19 - 000028672 _____ (Microsoft Corporation) C:\WINDOWS\system32\sspisrv.dll
2018-11-15 09:53 - 2018-10-21 08:18 - 000761344 _____ (Microsoft Corporation) C:\WINDOWS\system32\nshwfp.dll
2018-11-15 09:53 - 2018-10-21 08:18 - 000461824 _____ (Microsoft Corporation) C:\WINDOWS\system32\Windows.Data.Activities.dll
2018-11-15 09:53 - 2018-10-21 08:18 - 000395264 _____ (Microsoft Corporation) C:\WINDOWS\system32\BthAvctpSvc.dll
2018-11-15 09:53 - 2018-10-21 08:18 - 000275456 _____ (Microsoft Corporation) C:\WINDOWS\system32\scecli.dll
2018-11-15 09:53 - 2018-10-21 08:18 - 000274432 _____ (Microsoft Corporation) C:\WINDOWS\system32\DAFWSD.dll
2018-11-15 09:53 - 2018-10-21 08:18 - 000130048 _____ (Microsoft Corporation) C:\WINDOWS\system32\officecsp.dll
2018-11-15 09:53 - 2018-10-21 08:18 - 000030720 _____ (Microsoft Corporation) C:\WINDOWS\system32\seclogon.dll
2018-11-15 09:53 - 2018-10-21 08:17 - 000787456 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\WdiWiFi.sys
2018-11-15 09:53 - 2018-10-21 08:17 - 000625152 _____ (Microsoft Corporation) C:\WINDOWS\system32\PsmServiceExtHost.dll
2018-11-15 09:53 - 2018-10-21 08:17 - 000473600 _____ (Microsoft Corporation) C:\WINDOWS\system32\schannel.dll
2018-11-15 09:53 - 2018-10-21 08:17 - 000311296 _____ (Microsoft Corporation) C:\WINDOWS\system32\BthAvrcp.dll
2018-11-15 09:53 - 2018-10-21 08:17 - 000271872 _____ (Microsoft Corporation) C:\WINDOWS\system32\dafBth.dll
2018-11-15 09:53 - 2018-10-21 08:16 - 002584576 _____ (Microsoft Corporation) C:\WINDOWS\system32\wlansvc.dll
2018-11-15 09:53 - 2018-10-21 08:16 - 001535488 _____ (Microsoft Corporation) C:\WINDOWS\system32\lsasrv.dll
2018-11-15 09:53 - 2018-10-21 08:16 - 000847360 _____ (Microsoft Corporation) C:\WINDOWS\system32\bisrv.dll
2018-11-15 09:53 - 2018-10-21 08:16 - 000514048 _____ (Microsoft Corporation) C:\WINDOWS\system32\BTAGService.dll
2018-11-15 09:53 - 2018-10-21 08:16 - 000323584 _____ (Microsoft Corporation) C:\WINDOWS\system32\AppxAllUserStore.dll
2018-11-15 09:53 - 2018-10-21 08:15 - 000743936 _____ (Microsoft Corporation) C:\WINDOWS\system32\PrintRenderAPIHost.DLL
2018-11-15 09:53 - 2018-10-21 08:15 - 000401920 _____ (Microsoft Corporation) C:\WINDOWS\system32\rascustom.dll
2018-11-15 09:53 - 2018-10-21 08:14 - 002224640 _____ (Microsoft Corporation) C:\WINDOWS\system32\win32kbase.sys
2018-11-15 09:53 - 2018-10-21 08:14 - 001919488 _____ (Microsoft Corporation) C:\WINDOWS\system32\FntCache.dll
2018-11-15 09:53 - 2018-10-21 08:14 - 001097216 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\bthport.sys
2018-11-15 09:53 - 2018-10-21 08:14 - 001034752 _____ (Microsoft Corporation) C:\WINDOWS\system32\modernexecserver.dll
2018-11-15 09:53 - 2018-10-21 08:14 - 000932352 _____ (Microsoft Corporation) C:\WINDOWS\system32\rasmans.dll
2018-11-15 09:53 - 2018-10-21 08:14 - 000632320 _____ (Microsoft Corporation) C:\WINDOWS\system32\cdpsvc.dll
2018-11-15 09:53 - 2018-10-21 08:14 - 000453632 _____ (Microsoft Corporation) C:\WINDOWS\system32\cdpusersvc.dll
2018-11-15 09:53 - 2018-10-21 08:14 - 000311296 _____ (Microsoft Corporation) C:\WINDOWS\system32\EnterpriseAppMgmtSvc.dll
2018-11-15 09:53 - 2018-10-21 08:02 - 000157184 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\spacebridge.dll
2018-11-15 09:53 - 2018-10-21 08:01 - 001189376 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\Windows.Globalization.dll
2018-11-15 09:53 - 2018-10-21 08:01 - 000168448 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\Windows.Web.Diagnostics.dll
2018-11-15 09:53 - 2018-10-21 08:00 - 000214528 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\scecli.dll
2018-11-15 09:53 - 2018-10-21 07:59 - 000602112 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\nshwfp.dll
2018-11-15 09:53 - 2018-10-21 07:58 - 001124352 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\cdprt.dll
2018-11-15 09:53 - 2018-10-21 07:58 - 000415744 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\schannel.dll
2018-11-15 09:53 - 2018-10-21 07:58 - 000230912 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\AppxAllUserStore.dll
2018-11-15 09:53 - 2018-10-21 07:57 - 002611200 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\DWrite.dll
2018-11-15 09:53 - 2018-10-21 06:59 - 000806320 _____ C:\WINDOWS\SysWOW64\locale.nls
2018-11-15 09:53 - 2018-10-21 06:59 - 000806320 _____ C:\WINDOWS\system32\locale.nls
2018-11-15 09:53 - 2018-04-28 05:02 - 000144384 _____ (Microsoft Corporation) C:\WINDOWS\system32\mssprxy.dll
2018-11-10 14:01 - 2018-11-10 15:27 - 000001024 ____H C:\AMTAG.BIN
2018-11-10 14:01 - 2018-11-10 14:01 - 000000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\AOMEI Partition Assistant Standard Edition 7.5.1
2018-11-10 14:01 - 2018-11-10 14:01 - 000000000 ____D C:\ProgramData\AomeiBR
2018-11-10 14:00 - 2018-10-10 11:23 - 002164080 _____ C:\WINDOWS\ampa.exe
2018-11-10 14:00 - 2017-02-28 14:20 - 000038320 _____ C:\WINDOWS\SysWOW64\ampa.sys
2018-11-10 14:00 - 2017-02-28 14:20 - 000038320 _____ C:\WINDOWS\system32\ampa.sys
2018-11-10 13:59 - 2018-11-10 14:30 - 000000000 ____D C:\Program Files (x86)\AOMEI Partition Assistant Standard Edition 7.5.1
2018-11-06 11:58 - 2018-10-31 21:38 - 015218720 _____ (Yamaha Corporation) C:\WINDOWS\system32\YamahaAE3.dll
2018-11-06 11:58 - 2018-10-31 21:38 - 003306920 _____ (Yamaha Corporation) C:\WINDOWS\system32\YamahaAE2.dll
2018-11-06 11:58 - 2018-10-31 21:38 - 002198080 _____ (Yamaha Corporation) C:\WINDOWS\system32\YamahaAE.dll
2018-11-06 11:57 - 2018-10-31 21:38 - 005346888 _____ (Dolby Laboratories) C:\WINDOWS\system32\DolbyDAX2APOv211.dll
2018-11-06 11:57 - 2018-10-31 21:38 - 003762704 _____ (Realtek Semiconductor Corp.) C:\WINDOWS\system32\RltkAPO64.dll
2018-11-06 11:57 - 2018-10-31 21:38 - 003418120 _____ (DTS, Inc.) C:\WINDOWS\system32\slcnt64.dll
2018-11-06 11:57 - 2018-10-31 21:38 - 003319520 _____ (Realtek Semiconductor Corp.) C:\WINDOWS\system32\RtkApi64.dll
2018-11-06 11:57 - 2018-10-31 21:38 - 003282120 _____ (Realtek Semiconductor Corp.) C:\WINDOWS\SysWOW64\RltkAPO.dll
2018-11-06 11:57 - 2018-10-31 21:38 - 003128912 _____ (DTS, Inc.) C:\WINDOWS\system32\sltech64.dll
2018-11-06 11:57 - 2018-10-31 21:38 - 002444576 _____ (Dolby Laboratories) C:\WINDOWS\system32\DolbyDAX2APOv201.dll
2018-11-06 11:57 - 2018-10-31 21:38 - 001787848 _____ (DTS) C:\WINDOWS\system32\DTSS2SpeakerDLL64.dll
2018-11-06 11:57 - 2018-10-31 21:38 - 001598288 _____ (DTS) C:\WINDOWS\system32\DTSS2HeadphoneDLL64.dll
2018-11-06 11:57 - 2018-10-31 21:38 - 001516160 _____ (DTS) C:\WINDOWS\system32\DTSBoostDLL64.dll
2018-11-06 11:57 - 2018-10-31 21:38 - 001448864 _____ (Dolby Laboratories) C:\WINDOWS\system32\DolbyAPOv251gm.dll
2018-11-06 11:57 - 2018-10-31 21:38 - 001435248 _____ (Synopsys, Inc.) C:\WINDOWS\system32\SRRPTR64.dll
2018-11-06 11:57 - 2018-10-31 21:38 - 001396272 _____ (Sound Research, Corp.) C:\WINDOWS\system32\SECOMN64.dll
2018-11-06 11:57 - 2018-10-31 21:38 - 001382360 _____ (TOSHIBA Corporation) C:\WINDOWS\system32\tosade.dll
2018-11-06 11:57 - 2018-10-31 21:38 - 001353424 _____ (Realtek Semiconductor Corp.) C:\WINDOWS\system32\RTCOM64.dll
2018-11-06 11:57 - 2018-10-31 21:38 - 001337744 _____ (Toshiba Client Solutions Co., Ltd.) C:\WINDOWS\system32\tossaeapo64.dll
2018-11-06 11:57 - 2018-10-31 21:38 - 001318952 _____ (Sound Research, Corp.) C:\WINDOWS\system32\SEHDHF64.dll
2018-11-06 11:57 - 2018-10-31 21:38 - 001282656 _____ (Sound Research, Corp.) C:\WINDOWS\system32\SEAPO64.dll
2018-11-06 11:57 - 2018-10-31 21:38 - 001259624 _____ (Dolby Laboratories) C:\WINDOWS\system32\DolbyDAX2APOvlldp.dll
2018-11-06 11:57 - 2018-10-31 21:38 - 001180624 _____ (Sound Research, Corp.) C:\WINDOWS\system32\SEHDRA64.dll
2018-11-06 11:57 - 2018-10-31 21:38 - 001164512 _____ (Dolby Laboratories) C:\WINDOWS\system32\DolbyAPOvlldpgm.dll
2018-11-06 11:57 - 2018-10-31 21:38 - 001073800 _____ (Sound Research, Corp.) C:\WINDOWS\SysWOW64\SECOMN32.dll
2018-11-06 11:57 - 2018-10-31 21:38 - 001027928 _____ (Sound Research, Corp.) C:\WINDOWS\SysWOW64\SEHDHF32.dll
2018-11-06 11:57 - 2018-10-31 21:38 - 000994784 _____ (DTS, Inc.) C:\WINDOWS\system32\sl3apo64.dll
2018-11-06 11:57 - 2018-10-31 21:38 - 000965128 _____ (Sony Corporation) C:\WINDOWS\system32\SFSS_APO.dll
2018-11-06 11:57 - 2018-10-31 21:38 - 000884368 _____ (ICEpower a/s) C:\WINDOWS\system32\ICEsoundAPO64.dll
2018-11-06 11:57 - 2018-10-31 21:38 - 000873560 _____ (TOSHIBA Corporation) C:\WINDOWS\system32\tadefxapo264.dll
2018-11-06 11:57 - 2018-10-31 21:38 - 000852240 _____ (Toshiba Client Solutions Co., Ltd.) C:\WINDOWS\system32\tosasfapo64.dll
2018-11-06 11:57 - 2018-10-31 21:38 - 000751192 _____ (DTS) C:\WINDOWS\system32\DTSBassEnhancementDLL64.dll
2018-11-06 11:57 - 2018-10-31 21:38 - 000734664 _____ (DTS) C:\WINDOWS\system32\DTSSymmetryDLL64.dll
2018-11-06 11:57 - 2018-10-31 21:38 - 000715544 _____ (DTS) C:\WINDOWS\system32\DTSVoiceClarityDLL64.dll
2018-11-06 11:57 - 2018-10-31 21:38 - 000692264 _____ (Realtek Semiconductor Corp.) C:\WINDOWS\system32\RtDataProc64.dll
2018-11-06 11:57 - 2018-10-31 21:38 - 000604896 _____ (Toshiba Client Solutions Co., Ltd.) C:\WINDOWS\system32\tossaemaxapo64.dll
2018-11-06 11:57 - 2018-10-31 21:38 - 000541224 _____ (SRS Labs, Inc.) C:\WINDOWS\system32\SRSTSX64.dll
2018-11-06 11:57 - 2018-10-31 21:38 - 000511536 _____ (DTS) C:\WINDOWS\system32\DTSNeoPCDLL64.dll
2018-11-06 11:57 - 2018-10-31 21:38 - 000467264 _____ (Synopsys, Inc.) C:\WINDOWS\system32\SRAPO64.dll
2018-11-06 11:57 - 2018-10-31 21:38 - 000453168 _____ (Dolby Laboratories) C:\WINDOWS\system32\R4EED64A.dll
2018-11-06 11:57 - 2018-10-31 21:38 - 000452632 _____ (DTS) C:\WINDOWS\system32\DTSLimiterDLL64.dll
2018-11-06 11:57 - 2018-10-31 21:38 - 000448496 _____ (DTS) C:\WINDOWS\system32\DTSGainCompensatorDLL64.dll
2018-11-06 11:57 - 2018-10-31 21:38 - 000447304 _____ (Toshiba Client Solutions Co., Ltd.) C:\WINDOWS\system32\toseaeapo64.dll
2018-11-06 11:57 - 2018-10-31 21:38 - 000406344 _____ (Dolby Laboratories) C:\WINDOWS\system32\HiFiDAX2APIPCLL.dll
2018-11-06 11:57 - 2018-10-31 21:38 - 000392976 _____ (Dolby Laboratories, Inc.) C:\WINDOWS\system32\RTEEP64A.dll
2018-11-06 11:57 - 2018-10-31 21:38 - 000381512 _____ (Synopsys, Inc.) C:\WINDOWS\system32\SRCOM64.dll
2018-11-06 11:57 - 2018-10-31 21:38 - 000366016 _____ (Windows (R) Win 7 DDK provider) C:\WINDOWS\system32\HMAPO.dll
2018-11-06 11:57 - 2018-10-31 21:38 - 000360240 _____ (Harman) C:\WINDOWS\system32\HMClariFi.dll
2018-11-06 11:57 - 2018-10-31 21:38 - 000343808 _____ (Realtek Semiconductor Corp.) C:\WINDOWS\system32\RtlCPAPI64.dll
2018-11-06 11:57 - 2018-10-31 21:38 - 000341248 _____ (Synopsys, Inc.) C:\WINDOWS\SysWOW64\SRCOM.dll
2018-11-06 11:57 - 2018-10-31 21:38 - 000341248 _____ (Synopsys, Inc.) C:\WINDOWS\system32\SRCOM.dll
2018-11-06 11:57 - 2018-10-31 21:38 - 000327376 _____ (Dolby Laboratories, Inc.) C:\WINDOWS\system32\RP3DHT64.dll
2018-11-06 11:57 - 2018-10-31 21:38 - 000327376 _____ (Dolby Laboratories, Inc.) C:\WINDOWS\system32\RP3DAA64.dll
2018-11-06 11:57 - 2018-10-31 21:38 - 000261128 _____ (DTS) C:\WINDOWS\system32\DTSGFXAPO64.dll
2018-11-06 11:57 - 2018-10-31 21:38 - 000261096 _____ (DTS) C:\WINDOWS\system32\DTSLFXAPO64.dll
2018-11-06 11:57 - 2018-10-31 21:38 - 000260104 _____ (DTS) C:\WINDOWS\system32\DTSGFXAPONS64.dll
2018-11-06 11:57 - 2018-10-31 21:38 - 000232024 _____ (Synopsys, Inc.) C:\WINDOWS\system32\SFNHK64.dll
2018-11-06 11:57 - 2018-10-31 21:38 - 000230808 _____ (SRS Labs, Inc.) C:\WINDOWS\system32\SRSTSH64.dll
2018-11-06 11:57 - 2018-10-31 21:38 - 000220512 _____ (Dolby Laboratories, Inc.) C:\WINDOWS\system32\RTEED64A.dll
2018-11-06 11:57 - 2018-10-31 21:38 - 000218376 _____ (SRS Labs, Inc.) C:\WINDOWS\system32\SRSHP64.dll
2018-11-06 11:57 - 2018-10-31 21:38 - 000203736 _____ (Harman) C:\WINDOWS\system32\HMHVS.dll
2018-11-06 11:57 - 2018-10-31 21:38 - 000193088 _____ (Realtek Semiconductor Corp.) C:\WINDOWS\system32\RtkCfg64.dll
2018-11-06 11:57 - 2018-10-31 21:38 - 000190824 _____ (Harman) C:\WINDOWS\system32\HMEQ_Voice.dll
2018-11-06 11:57 - 2018-10-31 21:38 - 000190824 _____ (Harman) C:\WINDOWS\system32\HMEQ.dll
2018-11-06 11:57 - 2018-10-31 21:38 - 000179488 _____ (Harman) C:\WINDOWS\system32\HMLimiter.dll
2018-11-06 11:57 - 2018-10-31 21:38 - 000175040 _____ (SRS Labs, Inc.) C:\WINDOWS\system32\SRSWOW64.dll
2018-11-06 11:57 - 2018-10-31 21:38 - 000158800 _____ (TOSHIBA Corporation) C:\WINDOWS\system32\tadefxapo.dll
2018-11-06 11:57 - 2018-10-31 21:38 - 000157240 _____ (Dolby Laboratories) C:\WINDOWS\system32\R4EEL64A.dll
2018-11-06 11:57 - 2018-10-31 21:38 - 000139648 _____ (Dolby Laboratories) C:\WINDOWS\system32\R4EEA64A.dll
2018-11-06 11:57 - 2018-10-31 21:38 - 000116648 _____ (Dolby Laboratories, Inc.) C:\WINDOWS\system32\RTEEL64A.dll
2018-11-06 11:57 - 2018-10-31 21:38 - 000094008 _____ (Dolby Laboratories, Inc.) C:\WINDOWS\system32\RTEEG64A.dll
2018-11-06 11:57 - 2018-10-31 21:38 - 000091016 _____ (Synopsys, Inc.) C:\WINDOWS\system32\SFCOM64.dll
2018-11-06 11:57 - 2018-10-31 21:38 - 000090064 _____ (Dolby Laboratories) C:\WINDOWS\system32\R4EEG64A.dll
2018-11-06 11:57 - 2018-10-31 21:38 - 000088424 _____ (Synopsys, Inc.) C:\WINDOWS\system32\SFAPO64.dll
2018-11-06 11:57 - 2018-10-31 21:38 - 000083728 _____ (Virage Logic Corporation / Sonic Focus) C:\WINDOWS\SysWOW64\SFCOM.dll
2018-11-06 11:57 - 2018-10-31 21:38 - 000075640 _____ (TOSHIBA CORPORATION.) C:\WINDOWS\system32\tepeqapo64.dll
2018-11-06 11:57 - 2018-10-31 21:37 - 002992272 _____ (Audyssey Labs) C:\WINDOWS\system32\AudysseyEfx.dll
2018-11-06 11:57 - 2018-10-31 21:37 - 001971456 _____ (Dolby Laboratories) C:\WINDOWS\system32\DDPD64A.dll
2018-11-06 11:57 - 2018-10-31 21:37 - 001965248 _____ (Dolby Laboratories) C:\WINDOWS\system32\DDPD64AF3.dll
2018-11-06 11:57 - 2018-10-31 21:37 - 001544344 _____ (Dolby Laboratories) C:\WINDOWS\system32\DAX3APOProp.dll
2018-11-06 11:57 - 2018-10-31 21:37 - 001372480 _____ (Dolby Laboratories) C:\WINDOWS\system32\DAX3APOv251.dll
2018-11-06 11:57 - 2018-10-31 21:37 - 000367696 _____ (Dolby Laboratories) C:\WINDOWS\system32\DDPO64AF3.dll
2018-11-06 11:57 - 2018-10-31 21:37 - 000333104 _____ (Dolby Laboratories) C:\WINDOWS\system32\DDPO64A.dll
2018-11-06 11:57 - 2018-10-31 21:37 - 000316064 _____ (Dolby Laboratories) C:\WINDOWS\system32\DDPA64F3.dll
2018-11-06 11:57 - 2018-10-31 21:37 - 000278360 _____ (Dolby Laboratories) C:\WINDOWS\system32\DDPA64.dll
2018-11-06 11:57 - 2018-10-31 21:37 - 000175832 _____ (ASUSTeK COMPUTER INC.) C:\WINDOWS\system32\ATKWMI.dll
2018-11-06 11:57 - 2018-10-31 18:38 - 072520608 _____ (Realtek Semiconductor Corp.) C:\WINDOWS\system32\RCoRes64.dat
2018-11-06 11:57 - 2018-10-31 18:38 - 007178360 _____ (Dolby Laboratories) C:\WINDOWS\system32\R4EEP64A.dll
2018-11-06 11:57 - 2018-10-31 18:38 - 003677056 _____ (Realtek Semiconductor Corp.) C:\WINDOWS\system32\RTSnMg64.cpl
2018-11-06 11:57 - 2018-10-31 18:38 - 003159304 _____ (Realtek Semiconductor Corp.) C:\WINDOWS\system32\RtPgEx64.dll
2018-11-06 11:57 - 2018-10-31 18:38 - 002930048 _____ (Realtek Semiconductor Corp.) C:\WINDOWS\system32\RCoInstII64.dll
2018-11-06 11:57 - 2018-10-31 18:38 - 001159272 _____ (Dolby Laboratories) C:\WINDOWS\system32\DolbyDAX2APOProp.dll
2018-11-06 11:57 - 2018-10-31 18:38 - 000416400 _____ (Harman) C:\WINDOWS\system32\HMUI.dll
2018-11-06 11:57 - 2018-10-31 18:38 - 000378280 _____ (Dolby Laboratories) C:\WINDOWS\system32\HiFiDAX2API.dll
2018-11-06 11:57 - 2018-10-31 18:38 - 000266448 _____ (TODO: <Company name>) C:\WINDOWS\system32\slprp64.dll
2018-11-06 11:57 - 2018-10-31 18:38 - 000154256 _____ (Harman) C:\WINDOWS\system32\HarmanAudioInterface.dll
2018-11-06 11:57 - 2018-10-31 18:37 - 007101832 _____ (Dolby Laboratories) C:\WINDOWS\system32\DDPP64A.dll
2018-11-06 11:57 - 2018-10-31 18:37 - 006270280 _____ (Dolby Laboratories) C:\WINDOWS\system32\DDPP64AF3.dll
2018-11-06 11:57 - 2018-10-31 18:37 - 000122408 _____ (Real Sound Lab SIA) C:\WINDOWS\system32\CONEQMSAPOGUILibrary.dll
2018-11-06 11:57 - 2018-10-31 18:37 - 000118680 _____ C:\WINDOWS\system32\AcpiServiceVnA64.dll
2018-11-06 11:57 - 2018-10-31 18:37 - 000105400 _____ C:\WINDOWS\system32\audioLibVc.dll
2018-11-06 11:57 - 2018-10-31 18:09 - 023886413 _____ C:\WINDOWS\system32\Drivers\RTAIODAT.DAT
2018-11-05 22:28 - 2018-11-05 22:28 - 000013154 _____ C:\Users\franc\AppData\Local\recently-used.xbel
2018-11-04 10:50 - 2018-11-04 10:50 - 000080482 _____ C:\WINDOWS\dxdiag.txt
2018-11-03 12:28 - 2018-11-03 12:28 - 000002518 _____ C:\ProgramData\Microsoft\Windows\Start Menu\Programs\PowerPoint.lnk
2018-11-03 12:28 - 2018-11-03 12:28 - 000002518 _____ C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Access.lnk
2018-11-03 12:28 - 2018-11-03 12:28 - 000002501 _____ C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Word.lnk
2018-11-03 12:28 - 2018-11-03 12:28 - 000002491 _____ C:\ProgramData\Microsoft\Windows\Start Menu\Programs\OneNote 2016.lnk
2018-11-03 12:28 - 2018-11-03 12:28 - 000002491 _____ C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Excel.lnk
2018-11-03 12:28 - 2018-11-03 12:28 - 000002479 _____ C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Outlook.lnk
2018-11-03 12:28 - 2018-11-03 12:28 - 000002441 _____ C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Publisher.lnk
2018-11-03 12:28 - 2018-11-03 12:28 - 000000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Outils Microsoft Office
2018-11-02 15:54 - 2018-11-02 16:43 - 000000000 ____D C:\Users\franc\AppData\Local\calibre-cache
2018-11-02 15:52 - 2018-11-02 21:32 - 000000000 ____D C:\Users\franc\Bibliothèque calibre
2018-11-02 15:52 - 2018-11-02 16:43 - 000000000 ____D C:\Users\franc\AppData\Roaming\calibre
2018-11-02 15:52 - 2018-11-02 15:52 - 000000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\calibre - E-book Management
2018-11-02 15:52 - 2018-11-02 15:52 - 000000000 ____D C:\Program Files (x86)\Calibre2
2018-10-30 18:47 - 2018-10-30 18:47 - 000005893 _____ C:\Users\franc\Documents\queston sur les interactions sur internet 2018.txt
2018-10-27 15:06 - 2018-10-27 15:06 - 000000000 ____D C:\Users\franc\AppData\Local\D3DSCache

==================== One Month Modified files and folders ========

(If an entry is included in the fixlist, the file/folder will be moved.)

2018-11-16 18:48 - 2018-04-12 00:38 - 000000000 ____D C:\ProgramData\regid.1991-06.com.microsoft
2018-11-16 18:45 - 2018-09-27 14:29 - 000004176 _____ C:\WINDOWS\System32\Tasks\User_Feed_Synchronization-{5DABB7A3-3A6F-4283-9CAD-3695A54E8619}
2018-11-16 17:24 - 2018-09-27 14:29 - 000004078 _____ C:\WINDOWS\System32\Tasks\DriverMaxWelcome
2018-11-16 17:24 - 2018-04-30 08:43 - 000000000 ____D C:\Users\franc\AppData\LocalLow\Mozilla
2018-11-16 17:19 - 2018-07-02 08:50 - 000000000 ____D C:\Program Files (x86)\Spybot - Search & Destroy 2
2018-11-16 17:19 - 2018-04-12 00:38 - 000000000 ____D C:\WINDOWS\AppReadiness
2018-11-16 17:18 - 2018-09-27 14:29 - 000000006 ____H C:\WINDOWS\Tasks\SA.DAT
2018-11-16 17:18 - 2018-07-02 08:59 - 000000000 ____D C:\Program Files\Mozilla Firefox
2018-11-16 17:18 - 2018-07-02 08:59 - 000000000 ____D C:\Program Files (x86)\Mozilla Maintenance Service
2018-11-16 17:18 - 2018-07-01 22:36 - 000000000 ____D C:\ProgramData\NVIDIA
2018-11-16 17:17 - 2018-04-12 00:30 - 000000000 ____D C:\WINDOWS\CbsTemp
2018-11-16 17:17 - 2018-04-11 22:04 - 000786432 _____ C:\WINDOWS\system32\config\BBI
2018-11-16 17:14 - 2018-07-02 08:59 - 000001009 _____ C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Firefox.lnk
2018-11-16 15:08 - 2018-07-07 18:27 - 000000000 ____D C:\Program Files (x86)\Adobe
2018-11-16 13:46 - 2018-09-27 14:00 - 000000000 ____D C:\WINDOWS\system32\SleepStudy
2018-11-16 13:06 - 2018-09-27 14:29 - 000003384 _____ C:\WINDOWS\System32\Tasks\OneDrive Standalone Update Task-S-1-5-21-3243081975-1801143758-1203345775-1001
2018-11-16 13:06 - 2018-09-27 14:08 - 000002409 _____ C:\Users\franc\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\OneDrive.lnk
2018-11-16 13:06 - 2018-04-29 17:02 - 000000000 ___RD C:\Users\franc\OneDrive
2018-11-16 12:54 - 2018-04-12 00:38 - 000000000 ___HD C:\Program Files\WindowsApps
2018-11-16 12:27 - 2018-07-12 14:42 - 000000000 ____D C:\Program Files\rempl
2018-11-16 12:16 - 2018-07-07 12:15 - 000000000 ____D C:\Program Files\Pale Moon
2018-11-15 17:40 - 2018-05-19 20:26 - 000002457 _____ C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Acrobat Reader DC.lnk
2018-11-15 14:56 - 2018-07-17 20:37 - 000000000 ____D C:\Users\franc\AppData\Roaming\steelseries-engine-3-client
2018-11-15 14:33 - 2018-04-12 00:36 - 000000000 ____D C:\WINDOWS\INF
2018-11-15 13:10 - 2018-07-02 08:42 - 000000000 ____D C:\Users\franc\AppData\Local\Packages
2018-11-15 12:39 - 2018-09-27 15:25 - 000765382 _____ C:\WINDOWS\system32\prfh0416.dat
2018-11-15 12:39 - 2018-09-27 15:25 - 000152338 _____ C:\WINDOWS\system32\prfc0416.dat
2018-11-15 12:39 - 2018-09-27 15:16 - 000793528 _____ C:\WINDOWS\system32\perfh00C.dat
2018-11-15 12:39 - 2018-09-27 15:16 - 000153182 _____ C:\WINDOWS\system32\perfc00C.dat
2018-11-15 12:39 - 2018-09-27 14:20 - 002665632 _____ C:\WINDOWS\system32\PerfStringBackup.INI
2018-11-15 12:32 - 2018-04-29 16:58 - 000000000 __RHD C:\Users\Public\AccountPictures
2018-11-15 12:32 - 2018-04-29 16:58 - 000000000 ___RD C:\Users\franc\3D Objects
2018-11-15 12:31 - 2018-09-27 14:00 - 000512400 _____ C:\WINDOWS\system32\FNTCACHE.DAT
2018-11-15 12:24 - 2018-04-12 00:38 - 000000000 ___SD C:\WINDOWS\SysWOW64\F12
2018-11-15 12:24 - 2018-04-12 00:38 - 000000000 ___SD C:\WINDOWS\system32\F12
2018-11-15 12:24 - 2018-04-12 00:38 - 000000000 ___RD C:\WINDOWS\ImmersiveControlPanel
2018-11-15 12:24 - 2018-04-12 00:38 - 000000000 ____D C:\WINDOWS\TextInput
2018-11-15 12:24 - 2018-04-12 00:38 - 000000000 ____D C:\WINDOWS\system32\ShellExperiences
2018-11-15 12:24 - 2018-04-12 00:38 - 000000000 ____D C:\WINDOWS\ShellExperiences
2018-11-15 12:24 - 2018-04-12 00:38 - 000000000 ____D C:\WINDOWS\bcastdvr
2018-11-15 11:55 - 2018-07-02 09:03 - 000000000 ____D C:\Users\franc\AppData\Local\PlaceholderTileLogoFolder
2018-11-15 10:55 - 2018-09-27 14:29 - 000003342 _____ C:\WINDOWS\System32\Tasks\CorelUpdateHelperTask-5265A25A19640B8AF17F1AE484AB6A3D
2018-11-15 10:10 - 2018-07-02 08:51 - 000000000 ____D C:\WINDOWS\system32\MRT
2018-11-15 10:06 - 2018-07-02 08:50 - 137810048 ____C (Microsoft Corporation) C:\WINDOWS\system32\MRT.exe
2018-11-15 09:23 - 2018-09-27 14:29 - 000004766 _____ C:\WINDOWS\System32\Tasks\Adobe Flash Player NPAPI Notifier
2018-11-15 09:23 - 2018-09-27 14:29 - 000004594 _____ C:\WINDOWS\System32\Tasks\Adobe Flash Player Updater
2018-11-15 09:23 - 2018-04-12 00:38 - 000000000 ____D C:\WINDOWS\SysWOW64\Macromed
2018-11-15 09:23 - 2018-04-12 00:38 - 000000000 ____D C:\WINDOWS\system32\Macromed
2018-11-12 16:04 - 2018-04-11 22:04 - 000032768 _____ C:\WINDOWS\system32\config\ELAM
2018-11-10 14:25 - 2018-05-02 20:29 - 000000000 ____D C:\Users\franc\Desktop\Raccourcis
2018-11-10 13:20 - 2018-07-11 20:35 - 000001372 _____ C:\Users\franc\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Navigateur Opera.lnk
2018-11-10 13:17 - 2018-04-12 00:38 - 000000000 ____D C:\WINDOWS\system32\NDF
2018-11-09 19:39 - 2018-09-21 14:01 - 000048286 _____ C:\Users\franc\.sambox.cache
2018-11-06 11:59 - 2018-07-01 22:37 - 002033568 _____ C:\WINDOWS\system32\Drivers\rtkhdasetting.zip
2018-11-06 11:58 - 2018-07-01 22:36 - 000000000 ____D C:\WINDOWS\SysWOW64\RTCOM
2018-11-05 22:28 - 2018-09-25 17:13 - 000000000 ____D C:\Users\franc\AppData\Local\gtk-2.0
2018-11-05 22:28 - 2018-07-09 13:56 - 000000000 ____D C:\Users\franc\AppData\Local\babl-0.1
2018-11-03 12:27 - 2018-07-07 12:43 - 000000000 ____D C:\Program Files (x86)\Microsoft Office
2018-11-03 11:21 - 2018-04-12 00:38 - 000000000 ____D C:\WINDOWS\LiveKernelReports
2018-11-02 15:52 - 2018-09-27 14:08 - 000000000 ____D C:\Users\franc
2018-10-31 18:38 - 2018-09-24 11:00 - 006420864 _____ (Realtek Semiconductor Corp.) C:\WINDOWS\system32\Drivers\RTKVHD64.sys
2018-10-31 18:38 - 2018-09-24 10:59 - 000023584 _____ (Realtek Semiconductor Corp.) C:\WINDOWS\system32\RtkCoLDR64.dll
2018-10-23 09:53 - 2018-07-05 09:14 - 000000000 ____D C:\WINDOWS\system32\Drivers\wd
2018-10-17 10:29 - 2018-07-02 08:42 - 000000000 ____D C:\Users\franc\AppData\Local\ConnectedDevicesPlatform

==================== Files in the root of some directories =======

2018-07-22 18:42 - 2018-07-22 18:42 - 000000003 _____ () C:\Users\franc\AppData\Roaming\.ptbt0
2018-11-05 22:28 - 2018-11-05 22:28 - 000013154 _____ () C:\Users\franc\AppData\Local\recently-used.xbel
2018-07-22 18:59 - 2018-07-22 19:09 - 000007605 _____ () C:\Users\franc\AppData\Local\resmon.resmoncfg

Some files in TEMP:
====================
2018-11-15 16:38 - 2018-11-15 16:39 - 041486400 _____ () C:\Users\franc\AppData\Local\Temp\vlc-3.0.4-win64.exe

==================== Bamital & volsnap ======================

(There is no automatic fix for files that do not pass verification.)

C:\WINDOWS\system32\winlogon.exe => File is digitally signed
C:\WINDOWS\system32\wininit.exe => File is digitally signed
C:\WINDOWS\explorer.exe => File is digitally signed
C:\WINDOWS\SysWOW64\explorer.exe => File is digitally signed
C:\WINDOWS\system32\svchost.exe => File is digitally signed
C:\WINDOWS\SysWOW64\svchost.exe => File is digitally signed
C:\WINDOWS\system32\services.exe => File is digitally signed
C:\WINDOWS\system32\User32.dll => File is digitally signed
C:\WINDOWS\SysWOW64\User32.dll => File is digitally signed
C:\WINDOWS\system32\userinit.exe => File is digitally signed
C:\WINDOWS\SysWOW64\userinit.exe => File is digitally signed
C:\WINDOWS\system32\rpcss.dll => File is digitally signed
C:\WINDOWS\system32\dnsapi.dll => File is digitally signed
C:\WINDOWS\SysWOW64\dnsapi.dll => File is digitally signed
C:\WINDOWS\system32\Drivers\volsnap.sys => File is digitally signed

LastRegBack: 2018-09-27 14:00

==================== End of FRST.txt ============================

[waterreedshimmer]

aswMBR version 1.0.1.2252 Copyright(c) 2014 AVAST Software
Run date: 2018-11-16 20:03:15
-----------------------------
20:03:15.222 OS Version: Windows x64 6.2.9200
20:03:15.222 Number of processors: 2 586 0x3A09
20:03:15.222 ComputerName: EARENDIL-LIGHT UserName: Françoise
20:03:16.113 Initialze error C000010E - driver not loaded
20:05:54.416 Service scanning
20:06:24.472 Modules scanning
20:06:24.472 Disk 0 trace - called modules:
20:06:24.472
20:06:24.472 Scan finished successfully
20:06:52.148 The log file has been saved successfully to "U:\Outputs\right outputs\aswMBR.txt"

[waterreedshimmer]

OK, so virus did 2 reactions:

1st. I forgot to do aswMBR update database of Avast. So I re-launched it and started the update. I went cooking and it did a weird Windows Update. I might have not seen it, but it got back to Welcome screen. Before it, the Activation virus had come back and after it, no more Activation virus. Screen was black with blue round about. So I couldn't click on Scan. No idea if to scan C:\ or the other option of Quick search, if I open it, Windows may reboot again.


2nd. Windows did the reboot since I had tried to open aswMBR a third time. Before there was a light skyblue screen with written on it:
Error message = " Your PC run into a problem and must restart it. " + the square that you can take a picture with a smartphone to access the error. But was too fast for my photo machine. Letters were in white I think.

So no idea if I can open aswMBR for the 4th time ?

[waterreedshimmer]

I am not having now: Windows is not activated rectangle at bottom right. So that was it, the first update hidded the warning. But I checked on parameters, Windows is not activated again :/ but it is not telling me.
I am doing troubleshoot.
It takes very very long.
I think I can only re-activate Windows in the morning, during the night, either it bugs, either it is a virus:

Troubleshoot has completed
Something prevented us from communicating with our activation servers. Wait a few minuts and then try again. (0xc0020036)
We weren't able to activate Windows on this device.
Learn more about Windows Activation.
You can activate this device by going to the Store and purchasing a genuine copy of Windows.
Go to Store.

I did not try open aswMBR the 4th time yet.

Thank you and Good night =)

[Juliet]

Many times when you receive alerts or notification pop ups, it can mean the server is busy and cannot be used at this time.
Some say wait a couple of days then try again.

I did see in the logs a couple of apps not working correctly.

C:\Program Files\Pale Moon\palemoon.exe has been blocked from modifying %userprofile%\Desktop by Controlled Folder Access.
Process Name: C:\Program Files\Pale Moon\palemoon.exe
I have no idea why or what is wrong with this program. Could it be your app CybereasonRansomFree denies this and the other apps access?

C:\Program Files\Corel\Corel AfterShot 3\build\AfterShot.exe has been blocked from modifying %userprofile%\Pictures\AfterShot Catalog 3\AfterShot Catalog 2018\ by Controlled Folder Access.

C:\Program Files\Corel\Corel PaintShop Pro 2018 (64-bit)\Corel PaintShop Pro.exe has been blocked from modifying %userprofile%\Documents\Corel PaintShop Pro\2018 by Controlled Folder Access.

~~
Let's check for malware.

Start Farbar Recovery Scan Tool with Administrator privileges
(Right click on the FRST icon and select Run as administrator)

highlight on the text below and select Copy.
beginning with Start:: and finishing with End::
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

Highlight the entire content of the quote box below and select Copy.




Start::
CloseProcesses:
CreateRestorePoint:
HKLM\SOFTWARE\Policies\Microsoft\Windows Defender: Restriction <==== ATTENTION
SearchScopes: HKU\S-1-5-21-3243081975-1801143758-1203345775-1001 -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = hxxps://www.bing.com/search?q={searchTerms}&src=IE-SearchBox&FORM=IESR02&pc=UE00
SearchScopes: HKU\S-1-5-21-3243081975-1801143758-1203345775-1001 -> {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = hxxps://www.bing.com/search?q={searchTerms}&src=IE-SearchBox&FORM=IESR02&pc=UE00
FF NewTab: Mozilla\Firefox\Profiles\4q9abl71.default -> hxxp://www.bing.com/?pc=COSP&ptag=D070518-AD26CBEB7DD&form=CONMHP&conlogo=CT3335811
2018-11-15 16:38 - 2018-11-15 16:39 - 041486400 _____ () C:\Users\franc\AppData\Local\Temp\vlc-3.0.4-win64.exe
C:\Windows\Temp\*.*
Emptytemp:
End::



Start FRST (FRST64) with Administrator privileges
Press the Fix button. FRST will process the lines copied above from the clipboard.
When finished, a log file Fixlog.txt will pop up and saved in the same location the tool was ran from.

Please copy and paste its contents in your next reply.
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

http://i.imgur.com/zcMPezJ.pngAdwCleaner - Fix Mode

Download AdwCleaner (http://www.bleepingcomputer.com/download/adwcleaner/dl/125/) and move it to your Desktop
Right-click on AdwCleaner.exe and select http://i.imgur.com/Spcusrh.pngRun as Administrator (for Windows Vista, 7, 8, 8.1 and 10 users)
Accept the EULA (I accept), then click on Scan
Let the scan complete. Once it's done, make sure that every item listed in the different tabs is checked and click on the Clean & Repair button. This will kill all the active processes
Once the cleaning process is complete, AdwCleaner will ask to restart your computer, do it
After the restart, a log will open when logging in. Please copy/paste the content of that log in your next reply


http://i.imgur.com/RQKuhw1.pngRogueKiller

Download the right version of RogueKiller (http://www.adlice.com/download/roguekiller/#download) for your Windows version (32 or 64-bit)
Once done, move the executable file to your Desktop, right-click on it and select http://i.imgur.com/Spcusrh.pngRun as Administrator (for Windows Vista, 7, 8, 8.1 and 10 users)
Click on the Start Scan button in the right panel, which will bring you to another tab, and click on it again (this time it'll be in the bottom right corner)
Wait for the scan to complete
On completion, the results will be displayed
Check every single entry (threat found), and click on the Remove Selected button
On completion, the results will be displayed. Click on the Open Report button in the bottom left corner, followed by the Open TXT button (also in the bottom left corner)
This will open the report in Notepad. Copy/paste its content in your next reply


created by Aura

Your next reply(ies) should therefore contain:

Copy/pasted Fixlog.txt
Copy/pasted AdwCleaner clean log
Copy/pasted RogueKiller clean log

[waterreedshimmer]

Hello, I will post you the first log today, and the 2/3 and 3/3 logs on Tuesday 20th November 2018.
Windows had sent a fix to the Activation bug, so this issue was fixed by Windows, fix took 2 days to work. But as I intend either double boot, either go back to Ubuntu Linux, because of other old issues on my Windows Home, and mostly fear of starting any project and having all dissapear, I am interested in continuing with the virus search :alien:. Thank you very much for your pacience =)

Fix result of Farbar Recovery Scan Tool (x64) Version: 15.11.2018
Ran by Françoise (18-11-2018 22:08:35) Run:1
Running from U:\Antivirus
Loaded Profiles: Françoise (Available Profiles: Françoise)
Boot Mode: Normal
==============================================

fixlist content:
*****************
CloseProcesses:
CreateRestorePoint:
HKLM\SOFTWARE\Policies\Microsoft\Windows Defender: Restriction <==== ATTENTION
SearchScopes: HKU\S-1-5-21-3243081975-1801143758-1203345775-1001 -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = hxxps://www.bing.com/search?q={searchTerms}&src=IE-SearchBox&FORM=IESR02&pc=UE00
SearchScopes: HKU\S-1-5-21-3243081975-1801143758-1203345775-1001 -> {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = hxxps://www.bing.com/search?q={searchTerms}&src=IE-SearchBox&FORM=IESR02&pc=UE00
FF NewTab: Mozilla\Firefox\Profiles\4q9abl71.default -> hxxp://www.bing.com/?pc=COSP&ptag=D070518-AD26CBEB7DD&form=CONMHP&conlogo=CT3335811
2018-11-15 16:38 - 2018-11-15 16:39 - 041486400 _____ () C:\Users\franc\AppData\Local\Temp\vlc-3.0.4-win64.exe
C:\Windows\Temp\*.*
Emptytemp:

*****************

Processes closed successfully.
Restore point was successfully created.
HKLM\SOFTWARE\Policies\Microsoft\Windows Defender => removed successfully
"HKU\S-1-5-21-3243081975-1801143758-1203345775-1001\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\\DefaultScope" => removed successfully
HKU\S-1-5-21-3243081975-1801143758-1203345775-1001\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A} => removed successfully
HKLM\Software\Classes\CLSID\{0633EE93-D776-472f-A0FF-E1416B8B2E3A} => not found
"Firefox newtab" => removed successfully
C:\Users\franc\AppData\Local\Temp\vlc-3.0.4-win64.exe => moved successfully

=========== "C:\Windows\Temp\*.*" ==========

C:\Windows\Temp\AdobeARM.log => moved successfully
C:\Windows\Temp\AdobeARM_NotLocked.log => moved successfully
C:\Windows\Temp\ArmUI.ini => moved successfully
C:\Windows\Temp\EARENDIL-LIGHT-20181110-1728.log => moved successfully
C:\Windows\Temp\EARENDIL-LIGHT-20181110-1823.log => moved successfully
C:\Windows\Temp\EARENDIL-LIGHT-20181111-1030.log => moved successfully
C:\Windows\Temp\EARENDIL-LIGHT-20181111-1038.log => moved successfully
C:\Windows\Temp\EARENDIL-LIGHT-20181111-1038a.log => moved successfully
C:\Windows\Temp\EARENDIL-LIGHT-20181111-1056.log => moved successfully
C:\Windows\Temp\EARENDIL-LIGHT-20181111-1412.log => moved successfully
C:\Windows\Temp\EARENDIL-LIGHT-20181112-1543.log => moved successfully
C:\Windows\Temp\EARENDIL-LIGHT-20181112-1550.log => moved successfully
C:\Windows\Temp\EARENDIL-LIGHT-20181112-1550a.log => moved successfully
C:\Windows\Temp\EARENDIL-LIGHT-20181112-1651.log => moved successfully
C:\Windows\Temp\EARENDIL-LIGHT-20181115-0917.log => moved successfully
C:\Windows\Temp\EARENDIL-LIGHT-20181115-0921.log => moved successfully
C:\Windows\Temp\EARENDIL-LIGHT-20181115-0921a.log => moved successfully
C:\Windows\Temp\EARENDIL-LIGHT-20181115-1230.log => moved successfully
C:\Windows\Temp\EARENDIL-LIGHT-20181115-1238.log => moved successfully
C:\Windows\Temp\EARENDIL-LIGHT-20181115-1352.log => moved successfully
C:\Windows\Temp\EARENDIL-LIGHT-20181115-1359.log => moved successfully
C:\Windows\Temp\EARENDIL-LIGHT-20181115-1433.log => moved successfully
C:\Windows\Temp\EARENDIL-LIGHT-20181115-1632.log => moved successfully
C:\Windows\Temp\EARENDIL-LIGHT-20181115-1646.log => moved successfully
C:\Windows\Temp\EARENDIL-LIGHT-20181115-2245.log => moved successfully
C:\Windows\Temp\EARENDIL-LIGHT-20181116-1216.log => moved successfully
C:\Windows\Temp\EARENDIL-LIGHT-20181116-1222.log => moved successfully
C:\Windows\Temp\EARENDIL-LIGHT-20181116-1222a.log => moved successfully
C:\Windows\Temp\EARENDIL-LIGHT-20181116-1238.log => moved successfully
C:\Windows\Temp\EARENDIL-LIGHT-20181116-1336.log => moved successfully
C:\Windows\Temp\EARENDIL-LIGHT-20181116-1718.log => moved successfully
C:\Windows\Temp\EARENDIL-LIGHT-20181116-1725.log => moved successfully
C:\Windows\Temp\EARENDIL-LIGHT-20181116-1743.log => moved successfully
C:\Windows\Temp\EARENDIL-LIGHT-20181116-2024.log => moved successfully
C:\Windows\Temp\EARENDIL-LIGHT-20181116-2043.log => moved successfully
C:\Windows\Temp\EARENDIL-LIGHT-20181116-2052.log => moved successfully
C:\Windows\Temp\EARENDIL-LIGHT-20181116-2059.log => moved successfully
C:\Windows\Temp\EARENDIL-LIGHT-20181116-2108.log => moved successfully
C:\Windows\Temp\EARENDIL-LIGHT-20181116-2126.log => moved successfully
C:\Windows\Temp\EARENDIL-LIGHT-20181117-0941.log => moved successfully
C:\Windows\Temp\EARENDIL-LIGHT-20181117-0946.log => moved successfully
C:\Windows\Temp\EARENDIL-LIGHT-20181117-0946a.log => moved successfully
C:\Windows\Temp\EARENDIL-LIGHT-20181118-1950.log => moved successfully
C:\Windows\Temp\EARENDIL-LIGHT-20181118-1955.log => moved successfully
C:\Windows\Temp\EARENDIL-LIGHT-20181118-1955a.log => moved successfully
C:\Windows\Temp\EARENDIL-LIGHT-20181118-1956.log => moved successfully
C:\Windows\Temp\EARENDIL-LIGHT-20181118-2201.log => moved successfully
C:\Windows\Temp\EARENDIL-LIGHT-20181118-2201a.log => moved successfully
C:\Windows\Temp\EARENDIL-LIGHT-20181118-2202.log => moved successfully
C:\Windows\Temp\EARENDIL-LIGHT-20181118-2203.log => moved successfully
Could not move "C:\Windows\Temp\EARENDIL-LIGHT-20181118-2208.log" => Scheduled to move on reboot.
Could not move "C:\Windows\Temp\EARENDIL-LIGHT-20181118-2209.log" => Scheduled to move on reboot.
C:\Windows\Temp\MpCmdRun.log => moved successfully
C:\Windows\Temp\MpSigStub.log => moved successfully
C:\Windows\Temp\officeclicktorun.exe_streamserver(20181116171849D04).log => moved successfully
C:\Windows\Temp\officeclicktorun.exe_streamserver(20181116204319D44).log => moved successfully
C:\Windows\Temp\officeclicktorun.exe_streamserver(2018111822015138D8).log => moved successfully
C:\Windows\Temp\officeclicktorun.exe_streamserver(201811182202493BB0).log => moved successfully
Could not move "C:\Windows\Temp\officeclicktorun.exe_streamserver(2018111822083829A8).log" => Scheduled to move on reboot.
C:\Windows\Temp\sa.9WZDNCRFJ4Q1_0__.Public.InstallAgent.dat => moved successfully
C:\Windows\Temp\TBitDefenderUpdaterThread.log => moved successfully
C:\Windows\Temp\tem1B.tmp => moved successfully
C:\Windows\Temp\tem60D3.tmp => moved successfully
C:\Windows\Temp\tem6A04.tmp => moved successfully
C:\Windows\Temp\TSpybotUpdaterThread.log => moved successfully
C:\Windows\Temp\TS_489F.tmp => moved successfully
C:\Windows\Temp\TS_CADF.tmp => moved successfully
C:\Windows\Temp\WER1D1F.tmp.WERDataCollectionStatus.txt => moved successfully
C:\Windows\Temp\WER29A2.tmp.WERDataCollectionStatus.txt => moved successfully
C:\Windows\Temp\WER7AA1.tmp.WERDataCollectionStatus.txt => moved successfully
C:\Windows\Temp\WER7E37.tmp.WERDataCollectionStatus.txt => moved successfully
C:\Windows\Temp\WERABDC.tmp.WERDataCollectionStatus.txt => moved successfully
C:\Windows\Temp\WERABED.tmpsec.zip => moved successfully

========= End -> "C:\Windows\Temp\*.*" ========


=========== EmptyTemp: ==========

BITS transfer queue => 7888896 B
DOMStore, IE Recovery, AppCache, Feeds Cache, Thumbcache, IconCache => 262162929 B
Java, Flash, Steam htmlcache => 1154 B
Windows/system/drivers => 8354 B
Edge => 188580953 B
Chrome => 0 B
Firefox => 1089572842 B
Opera => 115290821 B

Temp, IE cache, history, cookies, recent:
Default => 0 B
Users => 0 B
ProgramData => 0 B
Public => 0 B
systemprofile => 0 B
systemprofile32 => 0 B
LocalService => 585988 B
LocalService => 0 B
NetworkService => 89796 B
NetworkService => 0 B
franc => 510560173 B

RecycleBin => 0 B
EmptyTemp: => 2 GB temporary data Removed.

================================

Result of scheduled files to move (Boot Mode: Normal) (Date&Time: 18-11-2018 22:18:48)

C:\Windows\Temp\EARENDIL-LIGHT-20181118-2208.log => Is moved successfully
C:\Windows\Temp\EARENDIL-LIGHT-20181118-2209.log => Is moved successfully
C:\Windows\Temp\officeclicktorun.exe_streamserver(2018111822083829A8).log => Is moved successfully

==== End of Fixlog 22:18:49 ====

[Juliet]

Ok, post the other logs when you can.

Had a feeling this was related to a over busy server.

[waterreedshimmer]

There is another problem I should speak of, many months ago, after my files did dissapear, after I did reset Windows 10 Home from inside, my admin short name had changed or was misspelled. I thought was Windows who did that, as sometimes they change the number of characters requested for the username, and as it was after a reset, and also as I don't know how to change it at all. Since then, I might had done many resets from inside, be keeping all or erasing all softwares and files. So after all is over, I do intend as soon as I can to do a 100% format. Some people said I don't need buying for same device a new Windows 10 Home, I'll check that, not your problem, but I doubt most on the fact that my computer will let me burn an OS ISO of any kind without errors. Maybe I am wrong, maybe it works back well. Anyway I could also buy it, but first I will check if that is true or not ? It's not your problem this format thing. I already ordered, in USA, an Ubuntu DVD + key, so anyway, I will find a way to get anything on this computer by beginning of December. If I was intending to do even a simple Linux boot, many months ago, I don't believe it would have worked. Because for the double boot I had rwx errors on live install. But now The DVD writer seems to work well, so I don't believe, and hope not to get an issue. But this is not your problem.

Anyway the only thing, if there is a way to check you can check, is why my username went a few months ago from fran to franc as Windows 10 Home Admin ?


Ok, here is 2/3 - Adwcleaner,

# -------------------------------
# Malwarebytes AdwCleaner 7.2.4.0
# -------------------------------
# Build: 09-25-2018
# Database: 2018-11-19.1 (Cloud)
# Support: https://www.malwarebytes.com/support
#
# -------------------------------
# Mode: Clean
# -------------------------------
# Start: 11-20-2018
# Duration: 00:00:05
# OS: Windows 10 Home
# Cleaned: 5
# Failed: 0


***** [ Services ] *****

No malicious services cleaned.

***** [ Folders ] *****

No malicious folders cleaned.

***** [ Files ] *****

No malicious files cleaned.

***** [ DLL ] *****

No malicious DLLs cleaned.

***** [ WMI ] *****

No malicious WMI cleaned.

***** [ Shortcuts ] *****

No malicious shortcuts cleaned.

***** [ Tasks ] *****

No malicious tasks cleaned.

***** [ Registry ] *****

Deleted HKCU\Software\csastats
Deleted HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\StartupApproved\Run|Web Companion
Deleted HKCU\Software\Lavasoft\Web Companion
Deleted HKLM\Software\Wow6432Node\Lavasoft\Web Companion
Deleted HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\Domains\webcompanion.com

***** [ Chromium (and derivatives) ] *****

No malicious Chromium entries cleaned.

***** [ Chromium URLs ] *****

No malicious Chromium URLs cleaned.

***** [ Firefox (and derivatives) ] *****

No malicious Firefox entries cleaned.

***** [ Firefox URLs ] *****

No malicious Firefox URLs cleaned.


*************************

[+] Delete Tracing Keys
[+] Reset Winsock

*************************

AdwCleaner[S00].txt - [1674 octets] - [20/11/2018 10:58:43]

########## EOF - C:\AdwCleaner\Logs\AdwCleaner[C00].txt ##########

[waterreedshimmer]

Hello, here is report #3/3, thanks =)

RogueKiller Anti-Malware V13.0.10.0 (x64) [Nov 14 2018] (Free) by Adlice Software
mail : https://adlice.com/contact/
Website : https://adlice.com/download/roguekiller/
Operating System : Windows 10 (10.0.17134) 64 bits
Started in : Normal mode
User : Françoise [Administrator]
Started from : C:\Program Files\RogueKiller\RogueKiller64.exe
Mode : Standard Scan, Delete -- Date : 2018/11/20 12:51:07 (Duration : 01:03:00)

¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤ Delete ¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤
[PUP.InnovativeSolutions (Potentially Malicious)] drivermax.exe [Innovative Solutions Grup SRL] -- %programfiles(x86)%\Innovative Solutions\DriverMax\drivermax.exe -> Killed [Tree]
[PUP.InnovativeSolutions (Potentially Malicious)] drivermax.exe [Innovative Solutions Grup SRL] -- %programfiles(x86)%\Innovative Solutions\DriverMax\drivermax.exe -> Killed [Tree]
[PUP.InnovativeSolutions (Potentially Malicious)] innostp.exe [Innovative Solutions Grup SRL] -- %programfiles(x86)%\Innovative Solutions\DriverMax\innostp.exe -> Killed [Tree]
[PUP.InnovativeSolutions (Potentially Malicious)] \Application Starter - f1375f225883e83d52e8db9690775c3c -- C:\Program Files (x86)\Innovative Solutions\DriverMax\innostp.exe (-install) -> Deleted
[PUP.InnovativeSolutions (Potentially Malicious)] \DriverMax Notification -- C:\Program Files (x86)\Innovative Solutions\DriverMax\drivermax.exe (-NOT) -> Deleted
[PUP.InnovativeSolutions (Potentially Malicious)] \DriverMaxAgent -- C:\Program Files (x86)\Innovative Solutions\DriverMax\drivermax.exe (-AGENT) -> Deleted
[PUP.InnovativeSolutions (Potentially Malicious)] \DriverMaxWelcome -- C:\Program Files (x86)\Innovative Solutions\DriverMax\drivermax.exe (-BKSCAN) -> Deleted
[PUP.InnovativeSolutions (Potentially Malicious)] HKEY_LOCAL_MACHINE\Software\Innovative Solutions -- -> Deleted
[PUP.InnovativeSolutions (Potentially Malicious)] HKEY_USERS\S-1-5-21-3243081975-1801143758-1203345775-1001\Software\Innovative Solutions -- -> Deleted
[PUP.InnovativeSolutions (Potentially Malicious)] HKEY_USERS\S-1-5-21-3243081975-1801143758-1203345775-1001\Software\Innovative Solutions -- -> Deleted
[PUP.InnovativeSolutions (Potentially Malicious)] HKEY_USERS\S-1-5-21-3243081975-1801143758-1203345775-1001\Software\Microsoft\Windows\CurrentVersion\Run|DriverMax_RESTART -- [%programfiles(x86)%\Innovative Solutions\DriverMax\drivermax.exe] -> Deleted
[PUP.InnovativeSolutions (Potentially Malicious)] HKEY_USERS\S-1-5-21-3243081975-1801143758-1203345775-1001\Software\Microsoft\Windows\CurrentVersion\Run|DriverMax_RESTART -- [%programfiles(x86)%\Innovative Solutions\DriverMax\drivermax.exe] -> Deleted
[PUP.InnovativeSolutions (Potentially Malicious)] Innovative Solutions -- %localappdata%\Innovative Solutions -> Deleted
[PUP.InnovativeSolutions (Potentially Malicious)] DriverMax.lnk -- %programdata%\Microsoft\Windows\Start Menu\Programs\DriverMax\DriverMax.lnk (lnk => C:\PROGRA~2\INNOVA~1\DRIVER~1\DRIVER~1.EXE []) -> Deleted
[PUP.InnovativeSolutions (Potentially Malicious)] Uninstall DriverMax.lnk -- %programdata%\Microsoft\Windows\Start Menu\Programs\DriverMax\Uninstall DriverMax.lnk (lnk => C:\PROGRA~2\INNOVA~1\DRIVER~1\unins000.exe []) -> Deleted
[PUP.InnovativeSolutions (Potentially Malicious)] Innovative Solutions -- %programfiles(x86)%\Innovative Solutions -> Deleted
[PUP.InnovativeSolutions (Potentially Malicious)] Innovative Solutions -- %programfiles(x86)%\Innovative Solutions -> Removed at reboot [2]
[PUP.InnovativeSolutions (Potentially Malicious)] Innovative Solutions -- %localappdata%\Innovative Solutions -> Removed at reboot [2]

[waterreedshimmer]

Out of topic:

NB: I own DriverMax Lifetime Licence, 1 user any device =), they still have the discount =) So I don't think they are dangerous. Unless their official and non official up to date drivers aren't malware-free. But it is normal that DriverMax has max rights as it is drivers it fetches. OK they are one of the less expensive, so not that much known in Google search results, so maybe fake positives.

I am happy that Windows did fix the activation bug, my Windows 10 Home was re-activated by Windows, not by me, took 2 days, so normal it is not our problem, but when we look at the issue, we can see that else they change authentication method due to bug, else they had to change it due to virus, and that indeed it did concerns millions of Windows, so it's not our problem, so part of your thought was right, Windows servers went saturate with people re-asking authentication, but anyway Windows knows who uses him, so no problem:
Asking my authentication in-built OEM key to Windows :
Node - EARENDIL-LIGHT
Error:
Description =


EARENDIL-LIGHT is the name of my computer.

But indeed our problem is not this one, and many problems did put me confusion. In Ubuntu the communication with any worldwide country Ubuntu server default repositories issue I also had in longtime past, could had been linked to authentication, also although it is GPG keys, but that was not my level, I am not in informatics, just common user, so when something don't answer, and when I can't find what to ask, no idea what should have been my question in Ubuntu, normal I did delete it. But not impossible it was also due to my computer not communicating with the servers due to some saturation of computers not being recognised because it did lost something. So maybe you are not wrong.

But we can't check on the Windows in-built issues, and for Ubuntu the in-built issues that can't become questions, become format it.

So we will stay in the virus issues. I won't format my personal files and folders as they are important to me in my external disk. I just hope to double boot, then I will only use Linux to access them, so it will be safer, as all this could come back from any file I may have in storage, if it is a virus and not a hack, and if it is still there. Maybe with some luck this is gone for good. But my personal files stay with me, not your concern neither. Working on my computer is already lots of job. So we shall stay with my computer =)

[waterreedshimmer]

More talkings:

For what concern the Windows update fix, Activation bug did come back with Warning, I will have to do the October Update for maybe it to become reliable. But that will be done later. I won't touch the Warning, neither will bring problems of too many calls for solving a bug that Windows did solve himself before yesterday. Unless maybe my Windows don't need me to play the not authentified Activate Windows - Windows is Activated game ? Maybe it does search activation on its own, and it don't need me to push any troubleshoot button. So I don't know what is this activation fix sent to everyone about, why it did stop working today at 14:39 20/11/2018 while before yesterday I got the Windows is Activated till now ? Nothing is clear except: don't touch nothing ! Windows must be taking care of it, so I better not touch it.

Lucky, after 2 time no work, Windows has in his website MediaCreationTool that allows you re-install Windows with no ISO file, and so burn the DVD =) I have got no idea if it is compatible with a built-in OEM that has more over Activation bug, but as Windows will be able to Authenticate me in any mornings, from other parameters, mostly if I have the October Update, hope them to be in the ISO, after your virus search, I will be able to format it (no worries, I think no need to buy again the in-built OEM key, but if buying is needed, I can, but I prefer waiting for this bug to be fixed by Windows before I will do it because all computers come with in-built OEM Windows, so I can't know if it is just device related, I won't buy something expensive 3 times USA price if ther is no need to, and if I have the right of Activating it in same device if it is same Windows OS then the built-in, else they will need to release other better Windows in what concerns key security) =) Still some chance my computer will just crash, but let's just hope no xwr errors in the Windows ISO. I will re-try the double boot after we are finished, but normal, Windows will need to have his partition, but that's my problems =) PS: In the past I couldn't test MediaCreationTool in my computer as it was said as not been created for my OS version, mystery =)

So this going to stay a come and go bug times 1000 :spider:, till it is permanently fixed by Windows and we can't do a thing about it. Except lots later the format =) And I am not touching at all the Activation button when it is self-activating in the morning, not me. So I am no longer going to bring noise in this issue as the Windows servers must be saturated with that, mostly at night.

But we will stay in the virus issue, not in the Activation issue =)

[waterreedshimmer]

The status unavailable for Spybot anti-virus might also interest you, as it happens often :/ Also I must often put on again the periodic Windows Defender Scan :/. Same for Windows One Drive protection against Ransomware, it often goes back OFF :/

I often have them many times both not ON, but I don't think it's a bug, I think their status depends on the Windows Updates we can't see. As for Office: Word, etc., the manual updates needs both OFF. But I don't use much Office as it depends on Wifi ON and I won't always use Windows, and I won't always have a contract with them through family members, so I won't always be able to open files I create with them, they are just interesting for curriculum vitae. So that's not an issue.

[Juliet]

I think, windows updates is having issues keeping your machine up to date and all thats here one day and gone the next is unpredictable.
I have no idea why it would add a letter to your name, thats the first time I've ever heard or seen that.

I can give you a link to a tech help forum that can help with issues related to Ubuntu and other operating systems but, I'm no help with that.
It's possible they can help with the windows issues, I don't know. You'll need to join and create a user name, and you can add the link to this topic here if you like. I am also a member there and help in the malware removal forum.
https://forums.whatthetech.com/index.php?showforum=119

~~~~~~~~~~~~~~~~~~~~~~~~~

Online scan please


http://i.imgur.com/G0tu5D9.pngEmsisoft Emergency Kit - Fix Mode
Follow the instructions below to run a scan using the Emsisoft Emergency Kit.

Download the Emsisoft Emergency Kit (https://www.emsisoft.com/en/software/eek/download/) and execute it. From there, click on the Install button to extract the program in the EEK folder;
Once the extraction is complete, the EEK folder will open. Right-click on http://i.imgur.com/G0tu5D9.pngstart emergency kit scanner.exe and select http://i.imgur.com/Spcusrh.pngRun as Administrator (for Windows Vista, 7, 8, 8.1 and 10 users);
EEK will suggest that you run an online update before using the program. Click on Yes to launch it.
After the update, click on Malware Scan under 2. Scan and accept to let EEK detect PUPs (click on Yes).
Once the scan is complete, make sure that every item in the list is checked, and click on the Quarantine selected button;
If it asks you for a reboot to delete some items, click on Ok to reboot automatically;
After the restart, open EEK again (in the C:\EEK folder);
This time, click on Logs;
From there, go under the Quarantine Log tab, and click on the Export button;
Save the log on your desktop, then open it, and copy/paste its content in your next reply;

[waterreedshimmer]

Hello, thank you for your reply =)
I will do the new scan, when Windows 10 OEM built-in becomes not activated again. So that the virus won't be hidding.

The Ubuntu issue was just because past bug/virus did not let me re-do double boot, but I think this bug/virus is gone =) .
I will do what you are asking =)

Today I discovered one thing, it wasn't Windows that did re-activate it, my opinion and feelings were wrong, no fix yet on my computer.

It is just aswMBR:
0- The bug or virus was here, Windows is not activated inside + the warning rectangle pop up.
1- I clicked on it once and then got the virtualization option and clicked yes, and Windows crashed.
2- Windows did restart with Windows is not activated inside, but no more pop up rectangle in the bottom right.
3- I added a Win8 compatibility layer to aswMBR, but I just opened it (after the opening test whom I don't know if it opened it or not) a second time (could be considered a third time since there was the test), and Windows crashed again with the blue background saying to check with a good smartphone the square at: http://www.windows.com/stopcode
4- Windows did restart with Windows is activated inside and no pop up rectangle.

So the bug is not there when it detects aswMBR being launched, but then it will surely come back at night. So this is the second time it happens to me when trying to open aswMBR. Not a proof, but possible.

So if it reacts to me trying to launch aswMBR, could be a Windows 10 virus, so each time the bug or virus will come back, I will click on aswMBR, then I will probably crash, then I will click again on aswMBR, and if I crash again and Windows gets re-activated without me having to spam Windows server, then we can be sure it to be a virus.

So I can't explain one of the times it did re-activate without me alone, but some chance it can be re-activated just by detecting the execution of aswMBR.

This said I'm not interested in informatics, just trying to help out =) :oreo:

Some times I can attach files, now for this message I can't, and there was one of the messages before where I couldn't upload pics, I did resize them to smaller, but it was not that. Seems like, if it is not you that decides when I can attach something, virus can also block computer communications :/ It's just the smartphone square, nothing important, I'll send it later. Those bugs can kill anyones life :/

Thank you very much, I might reply tomorrow or tonight, as I am waiting for Windows not to be activated again by himself =)

[Juliet]

So if it reacts to me trying to launch aswMBR, could be a Windows 10 virus
The problem here is that aswMBR ( it's not a virus) has not been updated to comply and be compatible with all versions of windows 10 and with all updates that have gone out since the tool was created,
When people tell me it crashed or crashes there computer I just tell them we will proceed without it.
For your machine, don't use it, if you see an icon or any files for it just go on and delete it.

[waterreedshimmer]

Hello, Windows stayed Activated all day long. And there was this time a true Update from Windows. So I don't know if it fixed it. I will see after it all to defrag, shrink and maybe or maybe not buy a non digital licence of Windows 10, but not now. And also to check if anything wrong in hardware, as I read on Windows website, that Acer could have added some hardware changes before selling my computer, could be the Nvidia as it was a sell argument, and that could have caused the issue, or I think maybe as my computer is old, something I can't see, because I'm not in informatics, could be going wrong with my computer, but I had bought a big ventilator to put it on (outside, it's an object like a table or a mouse support), so I don't think, even if it was more then 5 years later, something will burn. I think in my last computer many things had burned, starting the screen, but I don't know how to check those. I might also have a small issue with the CMOS small battery as last year I had time issues on both Windows and Ubuntu, but I don't have the level to find it and to change it, if so, maybe one day I will ask one repair, but not this year, maybe in 2 years, as I consider it an expense that is not in first technological needs. But anyway, my problem, not yours at all =)

For rooting my phone, I didn't use this APK and none of the related files, and as I stopped playing my game, and got lucky that my SD card had an unknown incident after I said goodbye to all my game friends, and as I don't use it that much, I'm not using the root part anymore. But this antivirus didn't detect the .zip file that contains it, so there are 4 issues of the same. Not sure if I should delete it ? I did call Samsung before I had rooted it, they said only a problem if I sell rooting ways, not a problem if I root it for myself.

And I didn't try the GIMP plugins in Windows as most of them requires Linux.

Thanks a lot =)

*-*-*-*

Emsisoft Emergency Kit 2018.6.0.8742 stable [en-us]
OS: Windows 10 (Version 10.0, Build 17134, 64-bit Edition)

Forensics log

Date Component Action Details
22/11/2018 18:58:21 User EARENDIL-LIGHT\FRANçOISE Infection quarantined Malware "Application.DealAgent.TGX (B)" in "GIMP Instagram Effects_2707362728.exe".
22/11/2018 18:58:21 User EARENDIL-LIGHT\FRANçOISE Infection quarantined Malware "Android.Riskware.FakeApk.gUKNG (B)" in "Superuser.apk".
22/11/2018 18:58:21 User EARENDIL-LIGHT\FRANçOISE Infection quarantined Malware "Android.Riskware.FakeApk.gUKNG (B)" in "Superuser.apk".
22/11/2018 18:54:49 Scanner Scan finished Found 3 objects , user to decide on further actions.
22/11/2018 18:47:49 Scanner Detection PUP "Application.DealAgent.TGX (B)" in "GIMP Instagram Effects_2707362728.exe" (SHA1: 7b60972858a267aa87ee62f5e167ed797351d197) and 2 other objects
22/11/2018 18:44:00 User EARENDIL-LIGHT\Françoise Scan started Malware Scan
22/11/2018 18:43:59 User EARENDIL-LIGHT\Françoise Setting modified "Detect PUPs" has been changed to "Enabled".
22/11/2018 18:43:33 User Update Downloaded and installed 87 files (18538 kb) (52 sec.).
22/11/2018 15:17:45 User Update Downloaded and installed 77 files (17570 kb) (1 min. 9 sec.).
22/11/2018 15:16:37 Core Notification "Recommended Reading:Beware: New wave of malware spreads via ISO file email attachments".
22/11/2018 15:16:34 User Update Failed with error "Server returned error" (0 sec.).

[Juliet]

Much information has come out lately of malware in androids, I wouldn't be so quick to download stuff.....
There are antivirus and malware scanners for android

https://www.malwarebytes.com/android/

It's easy to Google.

Now that windows is acting as it should the problem might have been related to issues with windows updates, might sound absurd but it happens alot.

Let's give it a day ot two and watch.

[waterreedshimmer]

Oh, thank you =)
I have plenty to do with family hole day, I'll watch over it later. I will be less active next week as I will travel 2 days.
I'll also have to run all of your programs on the external disk for myself because of the files dissapearing long time past issue on C:\. But I hesitate going in a forum, as I am flood person and I was before on Linux where you solve all the bugs yourself or format it (but before flood was forbidden), and as also I don't speak like people who are in informatics. But nowdays the " format it " don't work as the USB and DVD-ROM have less good quality, and as many gets locked of from installing any OS, be Windows or Linux. Maybe also memory writting support is also nowdays less good quality even in what was in past computers good computers that could support being many times formatted or having many times same OS re-installed. I'm not alone in this formatting hesitation issue :snorkle:.
The one letter issue added to my Administrator username could be related or could not be related to me having a " ç ". I have changed it to " fran ", but if it is not during Windows installation (from inside), there is no change, " franc " is still there.
I had a thought about ReactOS, but seems like it's not enough maintained, needs more then 1000 persons on a OS, not 10, so no need to imagine myself installing Spybot on it, only if one day they emerge, but they might be better then Wine.
I could if I wanted buy Windows 10 Home PPF, but not a new computer. I prefer waiting the day I get a job, as I have my requirements that are high, so economy is better, if I can't reach what I want. =)
I don't have much time.
Thanks Spybot for all =)

[Juliet]

hope all remains well.

[waterreedshimmer]

Today I got twice Windows Defender Anti-Virus and Spybot are both turned off, second time was too fast, it doesn't stay in notification.

Even if it is a virus, it is also a permission issue, so you can't do nothing about it. In fact I did succeed in installing on Windows 10, HWiNFO (used by Nasa in their adds so shouldn't be deprecated... ^^), at first it worked, the it dissapeared, then I tried installing it with Windows XP, Windows 7, Windows 10 compatibility, and no compatibility did succeed in having permission to overwrite the program that was not launching (as administrator) anymore. So I couldn't memorize what was my Wifi pilot.

If it is virus, seems like it is interested in me not knowing my pilots, although, I must have tons of them saved, I just wanted to write down the name. The secure boot is said to be disabled in the HWiNFO I had no time to screenshot, but on the other ones it seems to be either a feature, either enabled, I don't know, and it had said UEFI enable in the same board I couldn't save image.

It's Windows that must improve security in permission issues. I think the delete all Images and Documents, maybe also Video and Music folder content back in past did screw that up long time ago, even in installing Windows 10 from inside. Download folder had no issue, as as weird as it is, there are 2 Download folders in my computer, maybe because language was fr, or because of whatever is roaming, so the one I was using had no virus issue.

I was "Françoise" as admin, "franc" by Windows or Virus since long ago, (maybe many) re-install from inside, and now I am "fran" as admin, but the "franc" stayed in the users folder.

I just add you the " log " of this installation issue, although, it is most Windows that it concerns, because I cannot know, because I don't have the level to know, if this could be related to a virus.

Activation virus not back yet, but the day begun well :/

This is funny I can attach screen capture of HWiNFO issue, but not past non important at all, screen capture of the 2 asWMBR issues in blue with the smartphone error code :/ ???


Thanks =)

[Juliet]

What might be going on is problems with your security programs.
Cybereason\RansomFree
Spybot anti-virus

Windows defender will be disabled with other antivirus features on a computer.

To rule out infection we can run a anti-rootkit scan.

Follow the instructions in the thread below to run a scan with MBAR. Don't forget to update the database before launching the scan, and once launched, leave MBAR running and do not touch your computer until it is done scanning.

https://forums.malwarebytes.com/topic/198907-requested-resource-is-in-use-error-unable-to-start-malwarebytes/

Once MBAR is done scanning, removing threats and rebooting your computer, go in its MBAR folder, and copy/paste the content of the mbar-log-TODAYS-DATE.txt log in your next reply.

[waterreedshimmer]

Hello, there is nothing showing up. I also had done chkdisk from cmd and nothing. I would also like to try run maybe in DVD, maybe in Plop + USB if it works, one of the antivirus that works before loging in the computer, YUMI (UEFI) does list them under Antivirus Tools, although just 3 appears easy in the internet. Should I do this with you ?

In December I will format all and this will fix everything =) I read from user that Windows will fix the permission issues.

But on my opinion (I did not study informatics) this is also related to upgrade from 8.1 to 10, as we see Windows 10 (and they say other OS too) did copy many Linux open source features and ideas, and as system grows more complex, it's like biology, a fresh install will always work better in any OS, else they will have to innovate and invent upgrades that keep a little of past features and add up on the new features that are compatible. But I don't think they will think about creating intermediary OS in informatics, so the upgrade bugs can't be solved nowhere. The upgrade idea is not a good one, it is always better fresh install or someone to create from past OS an intermediary OS, wich don't exist yet or will never exist. And what is bad is that computer creators are not creating them for users to do fresh installs, and they are wrong, some of the blockings I may encounter, may come from hidden features, I don't have the level to see, and that came with BIOS upgrades or whatever I have no idea what that changes the hardware and software possibilities. Informatics and technology speaks about evolution, but they got it all wrong, but I hope they won't do to genetics what they did to human science, changing the ideas for it to fit to them without telling or paying us, and making our thoughts dissapear from Earth. Technology could improve much more faster if they thought of how they are doing, and they don't need erasing other fields to do it better.

Something else, could seem fun, but Windows in the loading first screen did put a penguin on it to mean Windows or Virus knows I will do double boot with a Linux. It had put the same wallpaper at loading screen more then 5 years ago when I did my first double boot in here. Weird. I don't know what to think about this: I am watching you forever and wherever communication signs ? Anyway, it's not only on the computer that I can get those signs, although I don't pay anymore attention to it, but I find it stressing, same for ads that knows what you intend to buy.

I'll answer next time by Friday.

If you want to close issue, also tell me =)

Thanks a lot for all of your pacience and kindness =)

Malwarebytes Anti-Rootkit BETA 1.10.3.1001
www.malwarebytes.org

Database version:
main: v2018.11.26.03
rootkit: v2018.11.26.03

Windows 10 x64 NTFS
Internet Explorer 11.407.17134.0
Françoise :: EARENDIL-LIGHT [administrator]

26/11/2018 15:05:15
mbar-log-2018-11-26 (15-05-15).txt

Scan type: Quick scan
Scan options enabled: Anti-Rootkit | Drivers | MBR | Physical Sectors | Memory | Startup | Registry | File System | Heuristics/Extra | Heuristics/Shuriken
Scan options disabled:
Objects scanned: 221159
Time elapsed: 31 minute(s), 18 second(s)

Memory Processes Detected: 0
(No malicious items detected)

Memory Modules Detected: 0
(No malicious items detected)

Registry Keys Detected: 0
(No malicious items detected)

Registry Values Detected: 0
(No malicious items detected)

Registry Data Items Detected: 0
(No malicious items detected)

Folders Detected: 0
(No malicious items detected)

Files Detected: 0
(No malicious items detected)

Physical Sectors Detected: 0
(No malicious items detected)

(end)

[Juliet]

I would also like to try run maybe in DVD, maybe in Plop + USB if it works, one of the antivirus that works before loging in the computer, YUMI (UEFI) does list them under Antivirus Tools, although just 3 appears easy in the internet. Should I do this with you ?
I'm no help with this but I can direct you to a forum with tech people who might be able to give you tips with reformatting
https://forums.whatthetech.com/index.php?showforum=119

I think their are some who also run Linux as well.


In December I will format all and this will fix everything =) I read from user that Windows will fix the permission issues.

But on my opinion (I did not study informatics) this is also related to upgrade from 8.1 to 10,

Yes, it can be fixed if it's windows related, myself I have not had to do this.
Many machines have had problems with the up-grades, some of the updates that went out after the up-grades did damage but there are so many I cannot list it all.

Since there is no malware we should remove tools and quarantine folders,


Please download DelFix (https://www.bleepingcomputer.com/download/delfix/) or from Here (http://www.bleepingcomputer.com/download/delfix/) and save the file to your Desktop.
Double-click DelFix.exe to run the programme.
Place a checkmark next to the following items:
Activate UAC
Remove disinfection tools
Click the Run button.
-- This will remove the specialized tools we used to disinfect your system.
Any leftover logs, files, folders or tools remaining on your Desktop which were not removed can be deleted manually (right-click the file + delete).

*********

Keeping your programs up-to-date

Like keeping Windows updated, keeping your installed programs up-to-date is another important step in having a safe and secure system. Outdated programs can be exploited by hackers and malware to infect a system and take it over. This is especially true today with the rise of Exploit Kits (https://en.wikipedia.org/wiki/Exploit_kit) (and also 0-days (https://en.wikipedia.org/wiki/Zero-day_(computing))) which is one of the biggest attack vectors to distribute malware. Therefore, you should always keep vulnerable programs like Adobe Flash Player, Adobe Shockwave Player, Java, Silverlight, Google Chrome, Mozilla Firefox, VLC Media Player, etc. updated to their most recent version (even better, you don't have to install them if you don't use them). Programs like https://i.imgur.com/eF2jhaz.pngUCheck (https://www.adlice.com/download/ucheck/), ]SUMo (http://www.kcsoftwares.com/?sumo) and https://i.imgur.com/y5YE7At.pngHeimdal Free (http://www.bleepingcomputer.com/download/heimdal-free/) will scan your system for outdated programs, and help you identify them, as well as update them.


UCheck Documentation (https://www.adlice.com/documentation/ucheck/documentation/)


Anti-Virus, Anti-Malware, Firewall and Anti-Exploit/Ransomware

Having a decent security setup (which also includes an Anti-Virus) is the most crucial step to protect a system. These programs are a layer of defence that will prevent a system from being infected, or if it somehow ends up infected, help mitigate the infection and remediate it. Ideally, you should have on your system one Antivirus (never more than one installed at the time), one Antimalware (you can install multiple of these, assuming they do not conflict with each other and the other security programs installed), one Firewall and if you wish, one Anti-Exploit and/or Anti-Ransomware (since Ransomware are currently the most dangerous threat around and it can hit anywhere). Here are a few programs worth checking out if you don't have one yet.

Note: The programs listed below are all free to use or they have some sort of trial. Some of them have a paid version that provides more features, while a lot of other good programs only have a paid version but aren't listed there (such as Kaspersky and ESET Antivirus products).

Anti-Virus

https://i.imgur.com/sZQBUGE.pngSophos Home (https://home.sophos.com/reg)
https://i.imgur.com/GCZb0TR.pngBitdefender Free Antivirus (http://www.bitdefender.com/solutions/free.html)
https://i.imgur.com/1lXc99W.pngEmsisoft Anti-Malware (https://www.emsisoft.com/en/software/antimalware/) - Free 30 day trial. Once it expires, EAM enters into a freeware mode where it is still considered an Antivirus program, but without real-time protection
https://i.imgur.com/szLrBjg.pngAvira Free Antivirus (https://www.avira.com/en/avira-free-antivirus)
https://i.imgur.com/90ChiEw.pngavast! Free Antivirus (https://www.avast.com/index)


Anti-Malware

https://i.imgur.com/j1Bynr2.pngMalwarebytes (https://www.malwarebytes.org/) - Has both a free and paid version. The Premium version of Malwarebytes also offers Exploit and Ransomware protection, for a complete package of: Malware, Web, Exploit and Ransomware protection
https://i.imgur.com/S2NFpNw.pngHitmanPro 3 (http://www.surfright.nl/en/hitmanpro) - Free 30 day trial
https://i.imgur.com/ncqvIpu.pngZemana AntiMalware (https://www.zemana.com/AntiMalware) - Free 30 day trial


As for safe browsing habits, you can find tons of guides, tutorials, articles, etc. online that will highlight the basics you need to follow (only visit websites you trust, do not click on ads, do not download files from untrusted sources, use a password manager, always verify the URL of a website and make sure it's correctly typed, etc.), and even what you can do if you want to take it a step further (create a fake email address for spam emails, browse the web in a privacy mode, etc.). Here are a few:

The Ultimate Guide to Secure your Online Browsing: Chrome, Firefox and Internet Explorer (https://heimdalsecurity.com/blog/ultimate-guide-secure-online-browsing/) on Heimdal Security
Seven Useful Habits For A Safer Internet (https://blog.kaspersky.com/seven-useful-habits-for-a-safer-internet/3717/) on Kapsersky Blog
Tips for Secure Web Browsing: Cybersecurity 101 (https://www.veracode.com/blog/2013/01/tips-for-secure-web-browsing-cybersecurity-101) on VeraCode
Safe browsing habits (https://www.internetsafetyproject.org/wiki/safe-browsing-habits) on Internet Safety Project Wiki

As you can see, there are plenty of resources out there. Simply Googling "good browsing habits" or "safe browsing habits" should allow you to find a lot of them.


created by Aura

[waterreedshimmer]

Hello, thank you for all your advice.

I just came back (sick) from holidays.

I only did small antivirus check beginning of 13/21 external driver connections with, as I had said, DVD, since neither my USBs neither Plop DVD can't boot, wich is unusual for authentic Acer Aspire E1-530.

Only found 1 valuable virus for you, althoughI didn't check all, it is ReImageRepair.exe, I thought that was an official Microsoft program downloaded from its website, but I don't know :/. Anyway, the virus we won't find out, is something alike an OS or ReImageRepair, or something that comes from hardware, anyway that can block DVD-ROM pilots but also do Corel (fixed itself) and Windows authentication issues, in my opinion, not my level, not in informatics.

I did buy official Windows 10 Home, but I won't install it now, and I might keep my built-in OEM version, if I do a fresh re-install. I did that because I am having high tension, because all that did stress me. There is no reason for a true Acer to have lied to me, and the Authenticate virus has dissapear.

My Ethernet did work back, was D-Link that had a problem. But my Ethernet cable did took some minuts to react as if there was some data stock inside.

I know it's not your advice, but this paid antivirus has a free antivirus rescue, based on Linux Gentoo. Open RC 0.3.4.11 is starting up Gentoo Linux (x86_64), so it's not Qemu, they just used an open source OS, to propose a free rescue DVD or USB although deleted or quarantine files are lost forever. I don't think the free antivirus is open source, but its' free.

I also did receive my Ubuntu Studio DVD from USA =) Windows has some Linux bash inside, but I'm not interested, as I'm not in it for IA, but for being connected towards nice people.

Upload is blocked, can't add the picture. Corel is still doing normal, non virus, sales pop ups from inside.

Bye, time to sleep, you can close issue =)

Thank you very much, Juliet =) You can close subject =) :crowned:

[waterreedshimmer]

Good night and have a good week and year and life =) =) =)

Bye =)

[Juliet]

The photo is telling you that the machine finds ReImageRepair.exe as a virus, most malware techs will tell people, that it needs to be removed and you should to.

I thought ReImageRepair.exe that was an official Microsoft program downloaded from its website,
No
https://www.microsoft.com/en-us/windows/comprehensive-security
Windows Defender Antivirus
Microsoft has Windows Defender, a legitimate antivirus protection plan already built into Windows 10. However, not all antivirus software are the same. Windows 10 users should examine recent comparison studies that show where Defender lacks effectiveness before settling for Microsoft's default antivirus option.

*****

After you reformat your computer let me post helpful tips.

Anti-Virus, Anti-Malware, Firewall and Anti-Exploit/Ransomware

Having a decent security setup (which also includes an Anti-Virus) is the most crucial step to protect a system. These programs are a layer of defence that will prevent a system from being infected, or if it somehow ends up infected, help mitigate the infection and remediate it. Ideally, you should have on your system one Antivirus (never more than one installed at the time), one Antimalware (you can install multiple of these, assuming they do not conflict with each other and the other security programs installed), one Firewall and if you wish, one Anti-Exploit and/or Anti-Ransomware (since Ransomware are currently the most dangerous threat around and it can hit anywhere). Here are a few programs worth checking out if you don't have one yet.

Note: The programs listed below are all free to use or they have some sort of trial. Some of them have a paid version that provides more features, while a lot of other good programs only have a paid version but aren't listed there (such as Kaspersky and ESET Antivirus products).

Anti-Virus

https://i.imgur.com/sZQBUGE.pngSophos Home (https://home.sophos.com/reg)
https://i.imgur.com/GCZb0TR.pngBitdefender Free Antivirus (http://www.bitdefender.com/solutions/free.html)
https://i.imgur.com/1lXc99W.pngEmsisoft Anti-Malware (https://www.emsisoft.com/en/software/antimalware/) - Free 30 day trial. Once it expires, EAM enters into a freeware mode where it is still considered an Antivirus program, but without real-time protection
https://i.imgur.com/szLrBjg.pngAvira Free Antivirus (https://www.avira.com/en/avira-free-antivirus)
https://i.imgur.com/90ChiEw.pngavast! Free Antivirus (https://www.avast.com/index)





https://www.pcmag.com/article2/0,2817,2372364,00.asp
The Best Antivirus Protection of 2018

[waterreedshimmer]

Hello,

Ok, thank you, I think you will feel less worries if I use instead of mine, BitDefender Anti-ransomware tool free (on 30/11/2018) (https://www.bitdefender.com/solutions/anti-ransomware-tool.html) =) So that I will keep you as Antivirus, Windows also offers that feature, but according to websites, some say it is compatible with other anti-virus, other say it's not at all.

I checked on my bought at my Microsoft Account, no .iso (just appeared once the day I bought), so I suppose all is in the MediaCreationTool1809.exe and features depend on key tapped or recognized, I must have too the built-in key I can't see, but Microsoft can see it in Repair button after skipping key in installation, and I have my bought Windows 10 Home, if Repair fails (not to use if it does weird stuff like the one I had). I suppose language can be changed or installed later, as I put my Windows in English during installation or virus search. Else it goes French, or sometimes I put Brazilian to train my mother language. But I think my built-in key to be valid, and not to need to enter my bought key. So as I read the past COA Windows did came with one explicit DVD, I still have my Windows XP Pro key with DVD, never gave me problems, seems official, but no ISO, so this one is DVD dependent. But the present Windows Home is one DVD for all on the Microsoft website. And I also read the repair must be done from Microsoft's ISO file, so by inserting the install DVD (or USB). And I have issues with other Windows repair softwares. It's PC Repair that did change my Firefox profile, so I'll have to find a way to fix Firefox too as Firefox profiles must come from server (as much as my ReImageRepair that is still *safe* in OneDrive), and there is also some PC Hunter as well (can't find a picture about it :/ ?).

But still it is a security issue to give us the ISO, as in Ubuntu Unetbootin boots and burns OS ISOs from server (as option), so it's safer, and we don't need the ISO, unless we want to virtualize, but virtualisation also works from DVD install.

The only interest of ISOs is of keeping oldies that aren't anymore available on the internet.

Will take lots of time to perform full scan off all the things I have, so I can't do all before new install.

I will continue to upload images from this OS with picture within a picture, as I believe, some will be blocked, some not, no idea if the name is important.

I will have to provide myself more empty DVDs, as if I ever have ransomware, only DVDs can boot in my computer, the USBs have some weird issues, so it can't boot nothing. And Plop is either not for my hardware, either blocked. So this computer laptop is DVD only for OS installation.

I can't handle 2 OS, so probably if it works well, I'll be more on Linux, and maybe just for building my website, on Windows. But as human it is impossible, even when you have time like I do, I don't work, to use 2 OS. And I hope that my home studies will let me succeed in contest to become trainee in children professor job, wasn't my dream as people tell me things about it, but as it's reachable, it became a dream, so I didn't study it at university, but I need to reach it to have a job. And I have my self-business to succeed to, and if I have a job, sure I won't have time for it, but I will have the money to make the very small moves I want with it. And my stuff in my computer is important, as I have too much, tons of papers in my room, so numerisation for only personal kept of the past, and for doing space at home and in my room, makes what I have in my external disk valuable for memories, and I also like taking beautifull pictures, so all is valuable for me. And my self-business will also imply me to take pictures of what I create, although I am re-strating what I created before, but, anyway the how to and the final object to put online in an unique object way is also important to me. But in France laws tend to put and to list self-business that does nothing in the same listings then bigs commercial that earns millions, so hackers can't know.

They even have 2 entries with my name :/ the past one, and the actual one, but it's the same.
https://www.infogreffe.fr/entreprise-societe/753061712-del-socorro-francoise-920118A004250000.html?typeProduitOnglet=EXTRAIT&afficherretour=false

You see no hacker or thief cannot know if I am poor or rich, if I did start and did succeed in selling my stuff, or if I am a huge company * dreams *. But hackers and thief do have access to all data about me, including where I live, and my personal phone. So it's easy to find. So it's normal I receive too much spam and weird calls in my phone. But also true french people with only french origin, have same problem then me, but most don't react, as they only put the phone responder on, and only answer if you start leaving a message in it. But the problem is installing something to block unknown phone calls is not good for you as some can be important, like jobs or things you do in life where they don't give you their phones, so it's impossible to know. Only my mother is not afraid of answering to every phone call she receives, and thinks I am exagerating. And all that will get worse for virus protection whatever OS I may use.

Anyway I did wrote in the RCS all the things I dream of doing, and it's OK =) It's the hand craft Chambre des Métiers, that helped me fill it, no idea if it was paid or free, but as they are rich, I got my name in there for free =) but anyway now even self business must register in there. That is why even if I did got my mail in past - something that has to do with hacked - I must keep it and keep using it. And all my mails are important, as I don't buy same things with each. But one day, when I don't have time, I will have to find a way to receive all mails together, but not sure I want to do this now, I never did want to receive them in my computer.

I also in past did choose to put all information about me public linked to my cell phone, as the internet was starting to set phone numbers not mine with my name and also the opposite, and I wasn't going to pay for these errors, as it was already public as self-business. So there is no way to keep my identity private. Only a child can do it. Only very rich people that owns business can afford to keep identity private. I don't have money every year, neither every month to do this. And self-business stays in the name or true owner. So when people, mostly game players teenagers and adults, tell me only to use fake names on the internet, I must tell them it is impossible, and maybe not even legal for me.

And in the near future everything be law, websites, will be set to be the same for all, I still haven't subscribed it, because I'm not selling nothing, but we'll have the invoices online available for the government in the same website, and I don't know what else, but I'll have to look for information, as I'm not a look for information person, as I didn't include in my genes this feature of everything is in the internet neither the idea of internet as truth, and unfortunately also children professor courses and laws are there, so I'll have to become more connected although I am already too much, but connected to other then tidy up, mail, facebook, installation, updates, upgrades, so I am not at all aware of * important upgrades that gives no notification are on the internet as very long texts or as 1001 boards to click on * be in self-studies for children professor or in self-business. Big business wants whatever dreamer (I'm not even small seller yet) to be listed and to do exactly as them, so they are creating an in-between space in every field where both can evolve, so we'll have the same description sooner or later, everywhere.

I stopped game playing, because maybe it's linked, maybe not, but when you play whatever online game, weird, but virus and hackers do watch you more, and do show you weird things that games don't believe and that you can't report no where. Mostly to make you quit the game. It worked. But now I am considering my real life back. No games =) Was a 2.5 years player, maybe more, but now I am not playing nothing at all, and considering advancing in my life tasks. Tons of computer tasks I wouldn't have if I lived in 1960... But in 2018, I have computer tasks till dead, I do have lots to do for myself in my computer, and most things can't bring me no money, as it is just tidy up =). I'm not expecting to make money out of my self-business neither, just to find a way to exist and show that I have talents outside school. As being in the past, and without intelligence and strategy of life, one of the best students did bring me only being blocked in job search and in upgrading school levels. So I believe it's more what you can do that can bring you some self confidence.

So anyway it's more my private life I am protecting then any business that could eat another one. But that no one knows, and that will be less and less easy to see in future.

I hope I will succeed in becoming a children teacher professor (trainee first), even though no idea if that can bring me stability in future, as I will need to go back to university, to gain the chance of becoming an official teacher, else I'll be a trainee all my life. But no idea if that will be my path, if contest fails, I'll look for any true job that can help me out. Contest is very hard, lots to study. Apart from the contest, I will have my website, and my writings. So tons to make outside tidy up. So no time. And as I prefer to let my computer on dinning room, I can't always use it, and dinning room is also sleeping room, so I can't bother much with it on.

I don't know where PC Repair comes from ? Maybe from a Mozilla Firefox Add-On ?

# DelFix v1.010 - Logfile created 30/11/2018 at 15:21:38
# Updated 26/04/2015 by Xplode
# Username : Françoise - EARENDIL-LIGHT
# Operating System : Windows 10 Home (64 bits)

~ Activating UAC ... OK

~ Removing disinfection tools ...

Deleted : C:\FRST
Deleted : C:\AdwCleaner
Deleted : C:\Users\franc\Desktop\mbar
Deleted : C:\Users\franc\Desktop\RogueKiller_setup.exe
Deleted : C:\Users\Public\Desktop\RogueKiller.lnk

########## - EOF - ##########

I won't do all the checking all my devices now, too long, too big, too many.

I will only be able to afford a big anti-virus if in life I get a good job, for life, and a salary that can make me live well. Else all will be kept low. Because money comes and go, and sometimes I don't even have 10euros. And parent's won't always feed me their money, even thought I am 36yo. This year I used my mother's economy, but I hope to get all back one day with a future, and I only did invest in worthy things, and I include travelling in worthy things as I only pay the food and as I can't say no to travel with family, and as I need holidays too, so I prefer considering holidays as therapy for my stress. And all I did in gymnastics will also be worthy, not only for health and stress, but even if I'm null at it all, in children professor contest, they will question me about it, but in their way, that no one can imagine, and that has nothing to do with the way professionals of it thinks, so just having an idea of it, and then reading the papers that have to do with the contest, and that have nothing to do with the contents of the gymnastics, is what to do, I just went looking for the feelings, but if you are a better reader then me, and you read all their exercices and laws and question-answers, you don't need to show them nothing to succeed in it. So I'll have tons of printings to do. But no one is concerned with my level in it, just in me having read what they want. The level is for me and for my fun only =)

So I am at the very tiny bottom of a big to do and to read mountain. So I can't loose that much time with OS issues. I'm a small bacteria climbing the Everest on foot, and I must reach it before June, and include all possible time lost needed to be taken and to be lived else as good for the Ethics of helping or of getting better of illness or of being nice with friends and family or of living friends and family normal life, or good for my health and stress. In study life I did lots of sacrifice towards family and friends (just one friend now), but I can't afford no more to say no in giving them my time, as study won't give me ever no recognition back, and as they are the only ones that can love me back. So I must seek the positive things in every new door opened and in every thing that puts my time in something else then my aim, but I must keep my 3 aims of study for children professor contest so to have the right to do trainee first, tidy-up for space, self-business websites future creation. And OS taking care is a hidden aim. And professor contest + self-business needs me to put in my genes, read online with the computer, and that is difficult, as I don't understand the idea of reading whatever online, not my time, very difficult. So there goes 5 aims on this computer.

Tomorrow I shall do my double boot =)

Thank you very much, thank you a lot =) you can close subject =) :bigthumb: :thanks: :)

[waterreedshimmer]

Activate Windows virus is back, LOL =)

[waterreedshimmer]

Do you want me to launch any antivirus on it ? Before I format this computer ?

As it did hide and come back after DelFix =/ =)

[waterreedshimmer]

I did delete most of the Download folder, it's not there anymore, but there was a file called $mages a imprimer.docx that is no more there and that I had almost deleted, but did choose not as it said my system will work less well if I delete this file system. But I didn't kept the message. And there is no .docx there anymore. I had now put on hidden files. And will keep deleting till I get it as an advert again.

[waterreedshimmer]

ransomware activity detected !!!

[waterreedshimmer]

I won't do nothing about it it is in U:/ must find
a way to recharge picture

I can't send no more pics it is impossible, too risky and no battery

[waterreedshimmer]

don't close

[waterreedshimmer]

Cyberreason has detected ransomware, everywhere files are appearing, I can't send pictures :/

[waterreedshimmer]

I'm too stressed to find my battery, what shall I do, go to the police ?

[waterreedshimmer]

Cyberreason said that I eliminated ransomware, I will take pacience to look for my photo machine battery s I won't connect more devices to it. But I think it is still here.

Activate Windows is a ransomware !!!!!!!!!!!!!!!!!!!!!!!!!!



:fear:


What shall I do then ??????????????????????????????

[tashi]

New topic, now closed: https://forums.spybot.info/showthread.php?77093-Activate-Windows-is-a-ransomware-it-is-eating-my-computer-!!!&p=482476#post482476

[waterreedshimmer]

Do you need me for anything else ?

Is there anything I can do to secure my external drivers and phone and photo SDCards and USB keys ? So that my files won't dissapear and won't be crypted or whatsoever it does, I read it crypts files.

Shall I no more double boot and only install Linux, and will Linux be affected by the Ransomware if my personal files are, or is Linux safe, or are just some of the Linux safe and others are not ? (I know you don't know, but maybe you know)

I will contact Windows.

Is my hardware safe ?

[waterreedshimmer]

Ransomware did do noise to my conversation with Windows on phone so I can't talk to them about the problem. They can't hear what I say. They can't hear the word: Ransomware.

Noise is old issue, don't come from phone, very old weird issue related to unknown technology issue as I call them.

[waterreedshimmer]

Was my cell phone, not my line. But they know it.

[waterreedshimmer]

I did post here for not to say I did not warn Windows. Activate Windows hides a Ransomware !!!!!!!!!!!!!!! (https://answers.microsoft.com/en-us/windows/forum/windows_10-win_licensing/activate-windows-hides-a-ransomware/57bb12b6-1c06-43d2-8770-a004612d27a6?tm=1543605331451)

I did try to phone them once but somehow, cellphone not linked to the computer neither to the phone line in the computer had noise put by Ransomware in it so I couldn't tell Windows, but I did tell Windows users haha =)

OK, I explain, sadness and too much emotions like that make me smile, something is wrong with me, I think I can win it, but my smile hides lots lots of fright as before yesterday I did have too much high tension because of issue and I could not sleep, and maybe it was due to my throad pharynx, but was surely issue, I felt I was going to die, so I did sleep on my back, OK should be on my left, but was if there was something in my blood, maybe too much salt, or maybe I am getting in panic and was just a very bad reaction to humidity and to the fact I don't like travelling although I adore visiting new towns.

Anyway, I'm looking for help. And no idea if I will stop using Windows after that for not to loose nothing, and if Ubuntu Linux Studio is safe or should I go to an unknown OS and system that won't work at all and won't have GIMP and nothing usefull and that won't recognize none of my devices ?

[waterreedshimmer]

I'm in contact with WINDOWS =)

[waterreedshimmer]

I did told Windows. Couldn't put the stars on it :/ as I was doing pictures and it disconnected. Now either Windows Defender fixes it, else it lets it spread. Not my problem. I told them. Did my job. They do what they want with it.

Will ask money back and get only Linux on here =) but I have no idea at all if it is safe or not.

If Windows Defender gets the guilty, I as telepath, not really telepath, have something to solve with it, bad idea to eat Sauron.

Still no idea on what to do for my files. Lost in informatics.

Tomorrow Ubuntu Studio only, hope not too many bugs, but my problem.

I don't believe at all in Ubuntu Linux being safe against Ransomware. I need a forum to check for them without Windows ? Because it is amongst files left. It could reactivate.

I could also keep my Windows licence, but I won't use Windows. I'll have to see what Linux has to give me first for the next 5 years as this bug had hitted a little Ubuntu Linux in the past, as I had a pseudo activation issue on Ubuntu Linux. So not safe. I need to take it out of all of my files, anytime anywhere.

Yes it couldn't reach world wide servers in Linux, so maybe they are planning bad things on my Linux too ?:devil:

I willl ask Malwarebytes for it, even if I don't have at all Malwarebytes, or would need a better forum, where ?

If you have forum ideas, please tell me, you already told me plenty of FORUM ideas. I just need wiping on my personal files. Wiping the bad. I did flood today. I know it is wrong.

So sorry. Sorry Sorry.

Thank you very much for all this help and have a good night =)

[waterreedshimmer]

This issue started (well was already like that months ago, so infection started longtime ago, many many months, perhaps years ago. (https://forums.malwarebytes.com/topic/223809-hacker-deleted-pictures-and-documents-folder-content-in-windows-10/)

[Juliet]

Even if you actually had a ransomware infection, reformatting your computer would wipe it out.
The forum below can assist with this
https://forums.whatthetech.com/index.php?showforum=119

The photos you took said there was a threat. I do know that if you were hit with ransomware you would get a window telling you to pay money to get encrypted files back and you have never said this.
It would also tell you a web site to go to and how to go about contacting someone for a decryption key, and you would find all your photos and files with extensions and nothing would open on demand.

It might be possible, if you create a new user profile, go back and delete out all old ones?
I don't know.

Since we have done all we can do here, and you have run the tool to remove all quarantined, we can close this topic now.

[waterreedshimmer]

Hello, yes, you do have this picture.

I did format to Ubuntu =) So I'm free. Although I must solve: Firefox as it don't let me upload here, needs profile to be deleted as there was a suspect profile in outside scan, and cell phone, needs SD Card and Cell phone to be changed as they did noise to phone call.

CyberReason Ransom Free did delete the Ransomware virus on C:\ that is why it did not ask money.

But I was too much in panic and no battery although I could, but I didn't to take a picture of CyberReason Ransom Free list of files it did delete.

The trash recycle bin got stuck with the folders and files from the Ransomware.

None of those files are mine. In my opinion they were generated from millions of bits hidden in C:\ and in my opinion the Ransomware comes in small bits pieces too although there was this $mages a imprimer.docx that made it wake up when I did not delete it to check why it was saying to be a system file needed for the computer to work.

I didn't open the files, in my opinion, after the day, there must only be ugly awful things against law inside those files. And there was no way to delete them as recycle bin did stuck.

Maybe you don't know how CyberReason Ransom Free works, maybe it's illegal to talk to them, but they did things right in my opinion, and I don't think BitDefender would have been able to freeze the infection. In fact if I had no panic, I could wait for hours before clicking on :


Stop clean the threat?
No Let it run vs Yes Stop & clean the threat

As there was the link: view affected files on the Window called: Cyber(my picture from here is not neat -Reason) - Ransomware activity has been detected !

First line does say: c:\Windows\explorer.exe (started on Friday, Nov 30 at 2:27 PM) might be attempting to malicious encrypt files on your hard drive and has been suspended. Another process may be trying to conceal its activity by abusing c:\Windows\explorer.exe.

Cybereason strongly recommends that you click 'Yes' to stop the process to avoid possible encryption of valuable files (e.g. documents, photos, videos, etc.). If you are certain this instance of c:\Windows\explorer.exe is safe, click 'No'.

View affected files > (and that was my error not to take a picture / screenshot wasn't working on the View of it but did work without the View / of that sorry :( )

Stop clean the threat ?

No Yes
Let it run Stop & clean threat

Ransomware blog - contact us - Q&A


So I am very sorry that my information can't help Windows users :'(

But good luck to all =) And thank you very much.

If it's safe, I might use my new Windows Home in the Virtual Machine in Ubuntu so to have the programs that don't need drivers back =) I will also try Wine. But I feel better now. =)

Thank you very much and sorry for the trouble =)

I do hope Windows to catch this fake Activation virus that hides a Ransomware that for luck, I had computer almost empty, and for luck it was stopped before encryption started and before the whatever sign to appear on my desktop, and it only did create a few folders and files not mine, some of them were empty, those I sent you was not mine, it was a souvenir from the bad Ransomware that couldn't know he had not kill me yet =)

So thank you =)

I'm also very sorry for the flood, was panic :'(

You can close topic =)

[Juliet]

Trying to find answers as to why and what this tool is doing is hard since I don't use this but I did come across interesting comments.

It's possible these files are being created by the tool itself,
https://forums.malwarebytes.com/topic/203716-fp-for-cybereason-ransomfree/


https://www.bleepingcomputer.com/forums/t/672099/ransomware-stopped-but-files-still-on-computer/

name="quietman7" post="4454908" timestamp="1519934729"
Cybereason RansomFree (https://ransomfree.cybereason.com/) is a program which deliberately creates hidden dummy folders containing randomly named .bmp, .png, .gif, .jpg, .pem, .xls, .mdb, .txt, .sql, .docx, .doc, .xlsx, .xls, .rtf, and .txt files in various locations (and partitions) on your computer as part of its functionality. These are actually trap (bait) folders and "canary" files...patterns of files and hidden virtual files that ransomware is attracted to. They are monitored for any changes and meant to be targeted for encryption by ransomware before actual data files. When the anti-ransomware program detects any of these files has been modified it will display an alert that an attack is occurring and ask if you wish to terminate the process that is trying to access them. This feature is sometimes referred to as "Honeypot Detection" or "Entrapment Protection" but is commonly misidentified by users or incorrectly reported as being related to malware.

This is Nathan Scott's (https://twitter.com/decrypterfixer?lang=en) explanation of Entrapment Protection from his now closed EasySync web site in this topic (https://www.bleepingcomputer.com/forums/t/574358/cryptomonitor-question/?p=3690213).



Entrapment Protection
Entrapment Protection lays numerous different types of traps all around your system that a Ransomware Infection cannot resist to touch. These traps send encrypted pattern signals back and forth between CryptoMonitor and themselves constantly. When a Ransomware Infection falls into one of these traps, the pattern is broken and CryptoMonitor immediately takes action. Once this happens, the machine is locked down and you are alerted about the infection and prompted for your decision on what actions to take. During this time, no file modifications are allowed, so your files are safe while you think about your course of action. With this protection enabled you may notice a few hidden files, registry keys, folders, and services running, but don't worry, they are there to protect you!

Common dummy folder locations with random names typically include My Documents, Desktop and common folder variables (https://www.microsoft.com/security/portal/mmpc/shared/variables.aspx) such as %User Profile%, %AppData%, %LocalAppData%, %ProgramData%, %Temp%.


RansomFree also deploys a “Disconnected Network Drive (A) (https://groups.google.com/a/cybereason.com/forum/#!topic/ransomfree-support/zBRZUf9nfho)” which is related to additional protection and detection of ransomware. The developers do no recommend you tamper with the drive.

Bleeping Computer Review of Cybereason RansomFree (https://www.bleepingcomputer.com/news/security/ransomfree-is-the-latest-app-that-tries-to-stop-ransomware-infections-on-windows/)

If you attempt to remove these files and folders, RansomFree will re-create them. In fact, any attempt taken to delete (modify) the files or folders most likely will be interpreted as possible ransomware activity and trigger a warning alert or initiate some action by RansomFree.

The use of trap (bait, canary) files and folders is not a 100% solution...some data files probably will end up being encrypted by ransomware but whatever helps with prevention, I consider useful.


I think from this point on, you have questions, you should try to contact CyberReason Ransom Free forums

I will now close this topic.