everything is acting like infection...

[rcb56]

i had this ready to post then pc crashed with blue page. everything on here is acting crazy mouse, all of it help please...

Scan result of Farbar Recovery Scan Tool (FRST) (x64) Version: 15.11.2018
Ran by Dad (administrator) on BRIDGES1 (19-11-2018 10:52:37)
Running from C:\Users\Dad\Desktop
Loaded Profiles: Dad (Available Profiles: Dad)
Platform: Windows 10 Home Version 1803 17134.407 (X64) Language: English (United States)
Internet Explorer Version 11 (Default browser: "C:\Program Files (x86)\Maxthon5\Bin\Maxthon.exe" "%1")
Boot Mode: Normal
Tutorial for Farbar Recovery Scan Tool: http://www.geekstogo.com/forum/topic/335081-frst-tutorial-how-to-use-farbar-recovery-scan-tool/

==================== Processes (Whitelisted) =================

(If an entry is included in the fixlist, the process will be closed. The file will not be moved.)

(Apple Inc.) C:\Program Files\Bonjour\mDNSResponder.exe
(Apple Inc.) C:\Program Files\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe
(Microsoft Corporation) C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.1810.5-0\MsMpEng.exe
(DEVGURU Co., LTD.) C:\Program Files\Samsung\USB Drivers\27_ssconn\conn\ss_conn_service.exe
(Malwarebytes) C:\Program Files\Malwarebytes\Anti-Malware\MBAMService.exe
(Microsoft Corporation) C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.1810.5-0\NisSrv.exe
(Malwarebytes) C:\Program Files\Malwarebytes\Anti-Malware\mbamtray.exe
(Microsoft Corporation) C:\Program Files\WindowsApps\Microsoft.MicrosoftOfficeHub_17.10314.31700.1000_x64__8wekyb3d8bbwe\Office16\OfficeHubTaskHost.exe
(Microsoft Corporation) C:\Program Files\Windows Defender\MSASCuiL.exe
(Intel Corporation) C:\Windows\System32\hkcmd.exe
(Intel Corporation) C:\Windows\System32\igfxpers.exe
() C:\Program Files (x86)\Common Files\Freemake Shared\ProductUpdater\ProductUpdater.exe
(Oracle Corporation) C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe
(Google Inc.) C:\Program Files (x86)\Google\Update\1.3.33.17\GoogleCrashHandler.exe
(Google Inc.) C:\Program Files (x86)\Google\Update\1.3.33.17\GoogleCrashHandler64.exe
(Microsoft Corporation) C:\Program Files\rempl\sedsvc.exe
(Tweaking.com) C:\Program Files (x86)\Tweaking.com\Windows Repair (All in One)\WR_Tray_Icon.exe
(Microsoft Corporation) C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdge.exe
(Microsoft Corporation) C:\Windows\System32\browser_broker.exe
(Microsoft Corporation) C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
(Microsoft Corporation) C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
(Microsoft Corporation) C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
(Microsoft Corporation) C:\Windows\System32\dllhost.exe
(Microsoft Corporation) C:\Windows\System32\dllhost.exe
(TunnelBear) C:\Program Files (x86)\TunnelBear\TunnelBear.Maintenance.exe
() C:\Program Files\WindowsApps\Microsoft.Windows.Photos_2018.18091.17210.0_x64__8wekyb3d8bbwe\Microsoft.Photos.exe
(Maxthon International ltd.) C:\Program Files (x86)\Maxthon5\Bin\Maxthon.exe
(Maxthon International ltd.) C:\Program Files (x86)\Maxthon5\Bin\Maxthon.exe
(Maxthon International ltd.) C:\Program Files (x86)\Maxthon5\Bin\Maxthon.exe
(Maxthon International ltd.) C:\Program Files (x86)\Maxthon5\Bin\Maxthon.exe
(Maxthon International ltd.) C:\Program Files (x86)\Maxthon5\Bin\Maxthon.exe
(Maxthon International ltd.) C:\Program Files (x86)\Maxthon5\Bin\Maxthon.exe
(Maxthon International ltd.) C:\Program Files (x86)\Maxthon5\Bin\Maxthon.exe
(Maxthon International ltd.) C:\Program Files (x86)\Maxthon5\Bin\Maxthon.exe
(Maxthon International ltd.) C:\Program Files (x86)\Maxthon5\Bin\Maxthon.exe
(Microsoft Corporation) C:\Windows\System32\Taskmgr.exe
(Maxthon International ltd.) C:\Program Files (x86)\Maxthon5\Bin\Maxthon.exe
(Maxthon International ltd.) C:\Program Files (x86)\Maxthon5\Bin\Maxthon.exe

==================== Registry (Whitelisted) ===========================

(If an entry is included in the fixlist, the registry item will be restored to default or removed. The file will not be moved.)

HKLM\...\Run: [SecurityHealth] => C:\Program Files\Windows Defender\MSASCuiL.exe [638872 2018-04-11] (Microsoft Corporation)
HKLM\...\Run: [Wondershare Helper Compact.exe] => C:\Program Files\Common Files\Wondershare\Wondershare Helper Compact\WSHelper.exe
HKLM\...\Run: [iTunesHelper] => C:\Program Files\iTunes\iTunesHelper.exe [301880 2018-10-22] (Apple Inc.)
HKLM\...\Run: [RTHDVCPL] => C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe [18381792 2017-06-29] (Realtek Semiconductor)
HKLM-x32\...\Run: [LWS] => C:\Program Files (x86)\Logitech\LWS\Webcam Software\LWS.exe [204136 2012-09-12] (Logitech Inc.)
HKLM-x32\...\Run: [ProductUpdater] => C:\Program Files (x86)\Common Files\Freemake Shared\ProductUpdater\ProductUpdater.exe [203760 2018-07-24] ()
HKLM-x32\...\Run: [Wondershare Helper Compact.exe] => C:\Program Files (x86)\Common Files\Wondershare\Wondershare Helper Compact\WSHelper.exe
HKLM-x32\...\Run: [SunJavaUpdateSched] => C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe [601424 2018-10-06] (Oracle Corporation)
Winlogon\Notify\igfxcui: C:\WINDOWS\system32\igfxdev.dll (Intel Corporation)
HKU\S-1-5-21-2107755742-302254199-1763176924-1001\...\Run: [Skype] => C:\Program Files (x86)\Skype\Phone\Skype.exe [27832272 2017-08-25] (Skype Technologies S.A.)
HKU\S-1-5-21-2107755742-302254199-1763176924-1001\...\Run: [BingSvc] => C:\Users\Dad\AppData\Local\Microsoft\BingSvc\BingSvc.exe [144008 2015-11-05] (© 2015 Microsoft Corporation)
HKU\S-1-5-21-2107755742-302254199-1763176924-1001\...\Run: [CCleaner Monitoring] => C:\Program Files\CCleaner\CCleaner64.exe [19467544 2018-11-06] (Piriform Ltd)
HKU\S-1-5-21-2107755742-302254199-1763176924-1001\...\Run: [World of Tanks] => "C:\Games\World_of_Tanks\WargamingGameUpdater.exe"
HKU\S-1-5-21-2107755742-302254199-1763176924-1001\...\Run: [Paltalk] => C:\Program Files (x86)\Paltalk\Paltalk.exe [26452856 2018-08-01] (AVM Software)
Startup: C:\Users\Dad\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Logitech . Product Registration.lnk [2017-10-12]
ShortcutTarget: Logitech . Product Registration.lnk -> C:\Program Files (x86)\Logitech\Ereg\eReg.exe (Leader Technologies/Logitech)

==================== Internet (Whitelisted) ====================

(If an item is included in the fixlist, if it is a registry item it will be removed or restored to default.)

Tcpip\Parameters: [DhcpNameServer] 192.168.1.1
Tcpip\..\Interfaces\{08efd30a-3b89-4b5e-96c8-22d8179e32bc}: [DhcpNameServer] 192.168.1.1
Tcpip\..\Interfaces\{37b78ff1-e6e5-4cb6-8c58-901ed6ed9a29}: [DhcpNameServer] 172.18.10.1
Tcpip\..\Interfaces\{4b213914-881c-4cd2-b83b-88424c186eef}: [DhcpNameServer] 192.168.1.1
Tcpip\..\Interfaces\{840609af-911f-4c5e-a8eb-039c51d6f9ed}: [DhcpNameServer] 192.168.1.1
Tcpip\..\Interfaces\{c9709154-fd6d-4b76-82af-c2d64867b8a8}: [DhcpNameServer] 192.168.42.129
Tcpip\..\Interfaces\{df402617-2238-4387-82b5-8c59da1d4835}: [DhcpNameServer] 192.168.1.1

Internet Explorer:
==================
SearchScopes: HKU\S-1-5-21-2107755742-302254199-1763176924-1001 -> DefaultScope {DF3BC73C-F06A-49A0-A8BC-A0036FBF565F} URL =
BHO: Java(tm) Plug-In SSV Helper -> {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} -> C:\Program Files\Java\jre1.8.0_191\bin\ssv.dll [2018-10-31] (Oracle Corporation)
BHO: Java(tm) Plug-In 2 SSV Helper -> {DBC80044-A445-435b-BC74-9C25C1C588A9} -> C:\Program Files\Java\jre1.8.0_191\bin\jp2ssv.dll [2018-10-31] (Oracle Corporation)
BHO-x32: Java(tm) Plug-In SSV Helper -> {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} -> C:\Program Files (x86)\Java\jre1.8.0_191\bin\ssv.dll [2018-10-31] (Oracle Corporation)
BHO-x32: Java(tm) Plug-In 2 SSV Helper -> {DBC80044-A445-435b-BC74-9C25C1C588A9} -> C:\Program Files (x86)\Java\jre1.8.0_191\bin\jp2ssv.dll [2018-10-31] (Oracle Corporation)

Edge:
======
Edge Extension: (No Name) -> EdgeExtension_BetaFishAdBlock_c1wakc4j0nefm => C:\Program Files\WindowsApps\BetaFish.AdBlock_2.5.1.0_neutral__c1wakc4j0nefm [not found]

FireFox:
========
FF DefaultProfile: u1qtbtfx.default
FF DefaultProfile: nnzgkec8.default
FF ProfilePath: C:\Users\Dad\AppData\Roaming\Mozilla\SeaMonkey\Profiles\u1qtbtfx.default [2018-11-17]
FF ProfilePath: C:\Users\Dad\AppData\Roaming\Mozilla\Firefox\Profiles\nnzgkec8.default [2018-11-19]
FF Homepage: Mozilla\Firefox\Profiles\nnzgkec8.default -> www.yahoo.com
FF HomepageOverride: Mozilla\Firefox\Profiles\nnzgkec8.default -> Disabled: File_Converter_Tab_bHaEkegUAR@www.fileconvertertab.com
FF NewTabOverride: Mozilla\Firefox\Profiles\nnzgkec8.default -> Disabled: File_Converter_Tab_bHaEkegUAR@www.fileconvertertab.com
FF Extension: (AdBlocker Ultimate) - C:\Users\Dad\AppData\Roaming\Mozilla\Firefox\Profiles\nnzgkec8.default\Extensions\adblockultimate@adblockultimate.net.xpi [2018-11-02]
FF Extension: (Easy Screenshot) - C:\Users\Dad\AppData\Roaming\Mozilla\Firefox\Profiles\nnzgkec8.default\Extensions\easyscreenshot@mozillaonline.com.xpi [2018-09-15] [Legacy]
FF SearchPlugin: C:\Users\Dad\AppData\Roaming\Mozilla\Firefox\Profiles\nnzgkec8.default\searchplugins\search.xml [2018-08-08]
FF HKLM-x32\...\Firefox\Extensions: [{F003DA68-8256-4b37-A6C4-350FA04494DF}] - C:\Program Files\Logitech\SetPointP\LogiSmoothFirefoxExt => not found
FF Plugin: @adobe.com/FlashPlayer -> C:\WINDOWS\system32\Macromed\Flash\NPSWF64_31_0_0_148.dll [2018-11-14] ()
FF Plugin: @java.com/DTPlugin,version=11.191.2 -> C:\Program Files\Java\jre1.8.0_191\bin\dtplugin\npDeployJava1.dll [2018-10-31] (Oracle Corporation)
FF Plugin: @java.com/JavaPlugin,version=11.191.2 -> C:\Program Files\Java\jre1.8.0_191\bin\plugin2\npjp2.dll [2018-10-31] (Oracle Corporation)
FF Plugin-x32: @adobe.com/FlashPlayer -> C:\WINDOWS\SysWOW64\Macromed\Flash\NPSWF32_31_0_0_148.dll [2018-11-14] ()
FF Plugin-x32: @flyordie.com/GamesPlugin -> C:\Program Files (x86)\Flyordie Plugin\npfod.dll [2018-07-17] (Solware)
FF Plugin-x32: @java.com/DTPlugin,version=11.191.2 -> C:\Program Files (x86)\Java\jre1.8.0_191\bin\dtplugin\npDeployJava1.dll [2018-10-31] (Oracle Corporation)
FF Plugin-x32: @java.com/JavaPlugin,version=11.191.2 -> C:\Program Files (x86)\Java\jre1.8.0_191\bin\plugin2\npjp2.dll [2018-10-31] (Oracle Corporation)
FF Plugin-x32: @tools.google.com/Google Update;version=3 -> C:\Program Files (x86)\Google\Update\1.3.33.17\npGoogleUpdate3.dll [2018-05-17] (Google Inc.)
FF Plugin-x32: @tools.google.com/Google Update;version=9 -> C:\Program Files (x86)\Google\Update\1.3.33.17\npGoogleUpdate3.dll [2018-05-17] (Google Inc.)
FF ExtraCheck: C:\Program Files (x86)\mozilla firefox\defaults\pref\firefox-branding.js [2007-11-27]
FF ExtraCheck: C:\Program Files (x86)\mozilla firefox\defaults\pref\firefox-l10n.js [2007-11-27]
FF ExtraCheck: C:\Program Files (x86)\mozilla firefox\defaults\pref\firefox.js [2007-11-27]
FF ExtraCheck: C:\Program Files (x86)\mozilla firefox\defaults\pref\reporter.js [2007-11-27]

Chrome:
=======
CHR HomePage: Default -> msn.com
CHR DefaultSearchKeyword: Default -> google.com_
CHR Profile: C:\Users\Dad\AppData\Local\Google\Chrome\User Data\Default [2018-11-17]
CHR Extension: (Slides) - C:\Users\Dad\AppData\Local\Google\Chrome\User Data\Default\Extensions\aapocclcgogkmnckokdopfmhonfmgoek [2017-10-21]
CHR Extension: (Docs) - C:\Users\Dad\AppData\Local\Google\Chrome\User Data\Default\Extensions\aohghmighlieiainnegkcijnfilokake [2017-10-21]
CHR Extension: (Google Drive) - C:\Users\Dad\AppData\Local\Google\Chrome\User Data\Default\Extensions\apdfllckaahabafndbhieahigkjlhalf [2017-06-19]
CHR Extension: (YouTube) - C:\Users\Dad\AppData\Local\Google\Chrome\User Data\Default\Extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo [2017-06-19]
CHR Extension: (Myki Password Manager & Authenticator) - C:\Users\Dad\AppData\Local\Google\Chrome\User Data\Default\Extensions\bmikpgodpkclnkgmnpphehdgcimmided [2018-11-17]
CHR Extension: (Sheets) - C:\Users\Dad\AppData\Local\Google\Chrome\User Data\Default\Extensions\felcaaldnbdncclmgdcncolpebgiejap [2017-10-21]
CHR Extension: (Chrome Remote Desktop) - C:\Users\Dad\AppData\Local\Google\Chrome\User Data\Default\Extensions\gbchcmhmhahfdphkhkmpfmihenigjmpp [2018-11-16]
CHR Extension: (Google Docs Offline) - C:\Users\Dad\AppData\Local\Google\Chrome\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi [2018-08-14]
CHR Extension: (Glossy Blue) - C:\Users\Dad\AppData\Local\Google\Chrome\User Data\Default\Extensions\nheaocaplknjkpcnbadlgfpdfjaabiml [2017-11-17]
CHR Extension: (Chrome Web Store Payments) - C:\Users\Dad\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda [2018-05-22]
CHR Extension: (Gmail) - C:\Users\Dad\AppData\Local\Google\Chrome\User Data\Default\Extensions\pjkljhegncpnkpknbcohdijeoejaedia [2017-06-19]
CHR Extension: (Chrome Media Router) - C:\Users\Dad\AppData\Local\Google\Chrome\User Data\Default\Extensions\pkedcjkdefgpdelpbcmbmeomcjbeemfm [2018-11-16]
CHR Profile: C:\Users\Dad\AppData\Local\Google\Chrome\User Data\System Profile [2017-10-20]
CHR HKU\S-1-5-21-2107755742-302254199-1763176924-1001\SOFTWARE\Google\Chrome\Extensions\...\Chrome\Extension: [fkkcgfbgohboipdhliafmacjnhjbhmim] - hxxps://clients2.google.com/service/update2/crx

==================== Services (Whitelisted) ====================

(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)

R2 Apple Mobile Device Service; C:\Program Files\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe [85304 2018-10-16] (Apple Inc.)
S3 Freemake Improver; C:\ProgramData\Freemake\FreemakeUtilsService\FreemakeUtilsService.exe [73200 2018-07-24] (Freemake)
R2 MBAMService; C:\Program Files\Malwarebytes\Anti-Malware\mbamservice.exe [6347056 2018-09-19] (Malwarebytes)
S2 MxService; C:\Program Files (x86)\Maxthon5\Bin\MxService.exe [144152 2018-10-04] (Maxthon International ltd.)
S4 paltalk_update_service; C:\Program Files (x86)\Paltalk\update\pt_update_service.exe [1414176 2018-06-15] (AVM Software)
S4 ssh-agent; C:\WINDOWS\System32\OpenSSH\ssh-agent.exe [495616 2018-03-10] ()
R2 ss_conn_service; C:\Program Files\Samsung\USB Drivers\27_ssconn\conn\ss_conn_service.exe [752224 2017-05-22] (DEVGURU Co., LTD.)
R2 TunnelBearMaintenance; C:\Program Files (x86)\TunnelBear\TunnelBear.Maintenance.exe [138872 2018-10-29] (TunnelBear)
R3 WdNisSvc; C:\ProgramData\Microsoft\Windows Defender\platform\4.18.1810.5-0\NisSrv.exe [3917016 2018-10-22] (Microsoft Corporation)
R2 WinDefend; C:\ProgramData\Microsoft\Windows Defender\platform\4.18.1810.5-0\MsMpEng.exe [114208 2018-10-22] (Microsoft Corporation)
S2 WsAppService; C:\Program Files (x86)\Wondershare\WAF\2.4.3.237\WsAppService.exe [495720 2018-07-04] (Wondershare)
S2 WsDrvInst; C:\Program Files (x86)\Wondershare\drfone\Library\DriverInstaller\DriverInstall.exe [120016 2018-07-04] (Wondershare)

===================== Drivers (Whitelisted) ======================

(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)

S3 dg_ssudbus; C:\WINDOWS\system32\DRIVERS\ssudbus.sys [131984 2017-05-22] (Samsung Electronics Co., Ltd.)
R3 easytether; C:\WINDOWS\System32\drivers\easytthrx.sys [22728 2015-11-22] (Mobile Stream)
R3 MBAMSwissArmy; C:\WINDOWS\System32\Drivers\mbamswissarmy.sys [260480 2018-11-16] (Malwarebytes)
R3 netr28x; C:\WINDOWS\System32\drivers\netr28x.sys [2537984 2018-04-11] (MediaTek Inc.)
R3 rt640x64; C:\WINDOWS\System32\drivers\rt640x64.sys [604160 2018-04-11] (Realtek )
S3 ssudmdm; C:\WINDOWS\system32\DRIVERS\ssudmdm.sys [166288 2017-05-22] (Samsung Electronics Co., Ltd.)
R3 stdriver; C:\WINDOWS\system32\DRIVERS\stdriverx64.sys [54664 2018-11-01] ()
S2 sxuptp; C:\WINDOWS\System32\drivers\sxuptp.sys [291352 2009-06-22] (silex technology, Inc.)
R3 tap-tb-0901; C:\WINDOWS\System32\drivers\tap-tb-0901.sys [38656 2018-07-31] (The OpenVPN Project)
S3 tapexpressvpn; C:\WINDOWS\System32\drivers\tapexpressvpn.sys [45024 2018-11-06] (The OpenVPN Project)
R3 usbrndis6; C:\WINDOWS\System32\drivers\usb80236.sys [22016 2018-04-11] (Microsoft Corporation)
R3 voxaldriver; C:\WINDOWS\system32\DRIVERS\voxaldriverx64.sys [52976 2018-08-10] ()
S0 WdBoot; C:\WINDOWS\System32\drivers\wd\WdBoot.sys [46184 2018-10-22] (Microsoft Corporation)
R0 WdFilter; C:\WINDOWS\System32\drivers\wd\WdFilter.sys [328696 2018-10-22] (Microsoft Corporation)
R3 WdNisDrv; C:\WINDOWS\System32\drivers\wd\WdNisDrv.sys [60408 2018-10-22] (Microsoft Corporation)
R1 ZAM_Guard; C:\WINDOWS\System32\drivers\zamguard64.sys [203680 2017-09-27] (Zemana Ltd.)

==================== NetSvcs (Whitelisted) ===================

(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)


==================== One Month Created files and folders ========

(If an entry is included in the fixlist, the file/folder will be moved.)

2018-11-19 10:52 - 2018-11-19 10:53 - 000016924 _____ C:\Users\Dad\Desktop\FRST.txt
2018-11-19 10:52 - 2018-11-19 10:52 - 002416128 _____ (Farbar) C:\Users\Dad\Desktop\FRST64.exe
2018-11-19 10:50 - 2018-11-19 10:50 - 005766144 _____ (Tweaking.com) C:\Users\Dad\Desktop\tweaking.com_registry_backup_setup.exe
2018-11-18 01:08 - 2018-11-18 01:08 - 090262952 _____ (TunnelBear) C:\Users\Dad\Desktop\TunnelBear-Installer(1).exe
2018-11-18 01:02 - 2018-11-18 01:07 - 000000000 ____D C:\Program Files (x86)\TunnelBear
2018-11-18 01:02 - 2018-11-18 01:02 - 000000000 ____D C:\Users\Dad\AppData\Roaming\TunnelBear
2018-11-18 01:02 - 2018-11-18 01:02 - 000000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\TunnelBear
2018-11-16 21:12 - 2018-11-16 21:12 - 056134208 _____ (Oracle Corporation) C:\Users\Dad\Downloads\JavaSetup.exe
2018-11-16 21:11 - 2018-11-16 21:11 - 002492602 _____ ( ) C:\Users\Dad\Desktop\JavaSetup_3759098556.exe
2018-11-16 20:51 - 2018-11-16 20:51 - 000000000 ____D C:\Users\Dad\AppData\Local\IsolatedStorage
2018-11-16 20:49 - 2018-11-16 20:49 - 000260480 _____ (Malwarebytes) C:\WINDOWS\system32\Drivers\mbamswissarmy.sys
2018-11-16 20:45 - 2018-11-18 02:43 - 000000000 ____D C:\Users\Dad\AppData\Local\ExpressVPN
2018-11-14 11:04 - 2018-11-14 11:04 - 000000020 _____ C:\Users\Dad\Desktop\fraud.txt
2018-11-14 00:30 - 2018-11-05 11:34 - 000835168 _____ (Adobe Systems Incorporated) C:\WINDOWS\SysWOW64\FlashPlayerApp.exe
2018-11-14 00:30 - 2018-11-05 11:34 - 000179808 _____ (Adobe Systems Incorporated) C:\WINDOWS\SysWOW64\FlashPlayerCPLApp.cpl
2018-11-13 20:31 - 2018-11-01 05:46 - 002394960 _____ (Microsoft Corporation) C:\WINDOWS\system32\WMVCORE.DLL
2018-11-13 20:31 - 2018-11-01 05:45 - 004527776 _____ (Microsoft Corporation) C:\WINDOWS\system32\sppsvc.exe
2018-11-13 20:31 - 2018-11-01 05:45 - 001617320 _____ (Microsoft Corporation) C:\WINDOWS\system32\sppobjs.dll
2018-11-13 20:31 - 2018-11-01 05:45 - 001376672 _____ (Microsoft Corporation) C:\WINDOWS\system32\ole32.dll
2018-11-13 20:31 - 2018-11-01 05:31 - 006602240 _____ (Microsoft Corporation) C:\WINDOWS\system32\twinui.dll
2018-11-13 20:31 - 2018-11-01 05:29 - 012710400 _____ (Microsoft Corporation) C:\WINDOWS\system32\ieframe.dll
2018-11-13 20:31 - 2018-11-01 05:28 - 004491264 _____ (Microsoft Corporation) C:\WINDOWS\system32\xpsrchvw.exe
2018-11-13 20:31 - 2018-11-01 05:28 - 003649024 _____ (Microsoft Corporation) C:\WINDOWS\system32\win32kfull.sys
2018-11-13 20:31 - 2018-11-01 05:27 - 001121792 _____ (Microsoft Corporation) C:\WINDOWS\system32\TSWorkspace.dll
2018-11-13 20:31 - 2018-11-01 05:27 - 000878592 _____ (Microsoft Corporation) C:\WINDOWS\system32\CPFilters.dll
2018-11-13 20:31 - 2018-11-01 05:26 - 001364992 _____ (Microsoft Corporation) C:\WINDOWS\system32\bcastdvruserservice.dll
2018-11-13 20:31 - 2018-11-01 04:09 - 001027000 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\ole32.dll
2018-11-13 20:31 - 2018-11-01 03:59 - 005669888 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\twinui.dll
2018-11-13 20:31 - 2018-11-01 03:56 - 011902464 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\ieframe.dll
2018-11-13 20:31 - 2018-11-01 03:54 - 003397632 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\xpsrchvw.exe
2018-11-13 20:31 - 2018-11-01 03:52 - 002892800 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\win32kfull.sys
2018-11-13 20:31 - 2018-11-01 03:15 - 023861760 _____ (Microsoft Corporation) C:\WINDOWS\system32\Hydrogen.dll
2018-11-13 20:31 - 2018-11-01 03:13 - 019525120 _____ (Microsoft Corporation) C:\WINDOWS\system32\HologramCompositor.dll
2018-11-13 20:31 - 2018-11-01 01:39 - 001035256 _____ (Microsoft Corporation) C:\WINDOWS\system32\ApplyTrustOffline.exe
2018-11-13 20:31 - 2018-11-01 01:38 - 000269336 _____ (Microsoft Corporation) C:\WINDOWS\system32\SgrmEnclave_secure.dll
2018-11-13 20:31 - 2018-11-01 01:28 - 001221432 _____ (Microsoft Corporation) C:\WINDOWS\system32\hvix64.exe
2018-11-13 20:31 - 2018-11-01 01:28 - 001062712 _____ (Microsoft Corporation) C:\WINDOWS\system32\SecConfig.efi
2018-11-13 20:31 - 2018-11-01 01:28 - 001029944 _____ (Microsoft Corporation) C:\WINDOWS\system32\hvax64.exe
2018-11-13 20:31 - 2018-11-01 01:28 - 000566568 _____ (Microsoft Corporation) C:\WINDOWS\system32\tcblaunch.exe
2018-11-13 20:31 - 2018-11-01 01:27 - 001017152 _____ (Microsoft Corporation) C:\WINDOWS\system32\msmpeg2adec.dll
2018-11-13 20:31 - 2018-11-01 01:27 - 000491200 _____ (Microsoft Corporation) C:\WINDOWS\system32\mf.dll
2018-11-13 20:31 - 2018-11-01 01:26 - 007432120 _____ (Microsoft Corporation) C:\WINDOWS\system32\windows.storage.dll
2018-11-13 20:31 - 2018-11-01 01:26 - 003291640 _____ (Microsoft Corporation) C:\WINDOWS\system32\combase.dll
2018-11-13 20:31 - 2018-11-01 01:26 - 003180080 _____ (Microsoft Corporation) C:\WINDOWS\system32\d3d11.dll
2018-11-13 20:31 - 2018-11-01 01:26 - 001363536 _____ (Microsoft Corporation) C:\WINDOWS\system32\WinTypes.dll
2018-11-13 20:31 - 2018-11-01 01:25 - 009089848 _____ (Microsoft Corporation) C:\WINDOWS\system32\ntoskrnl.exe
2018-11-13 20:31 - 2018-11-01 01:25 - 007520088 _____ (Microsoft Corporation) C:\WINDOWS\system32\Windows.Media.Protection.PlayReady.dll
2018-11-13 20:31 - 2018-11-01 01:25 - 004404912 _____ (Microsoft Corporation) C:\WINDOWS\system32\mfcore.dll
2018-11-13 20:31 - 2018-11-01 01:25 - 002822456 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\dxgkrnl.sys
2018-11-13 20:31 - 2018-11-01 01:25 - 002571320 _____ (Microsoft Corporation) C:\WINDOWS\system32\KernelBase.dll
2018-11-13 20:31 - 2018-11-01 01:25 - 002371296 _____ (Microsoft Corporation) C:\WINDOWS\system32\msmpeg2vdec.dll
2018-11-13 20:31 - 2018-11-01 01:25 - 001934808 _____ (Microsoft Corporation) C:\WINDOWS\system32\AudioEng.dll
2018-11-13 20:31 - 2018-11-01 01:25 - 001784680 _____ (Microsoft Corporation) C:\WINDOWS\system32\mfasfsrcsnk.dll
2018-11-13 20:31 - 2018-11-01 01:25 - 001456728 _____ (Microsoft Corporation) C:\WINDOWS\system32\winload.efi
2018-11-13 20:31 - 2018-11-01 01:25 - 001288920 _____ (Microsoft Corporation) C:\WINDOWS\system32\mfmpeg2srcsnk.dll
2018-11-13 20:31 - 2018-11-01 01:25 - 001257880 _____ (Microsoft Corporation) C:\WINDOWS\system32\winload.exe
2018-11-13 20:31 - 2018-11-01 01:25 - 001209888 _____ (Microsoft Corporation) C:\WINDOWS\system32\AudioSes.dll
2018-11-13 20:31 - 2018-11-01 01:25 - 001190248 _____ (Microsoft Corporation) C:\WINDOWS\system32\rpcrt4.dll
2018-11-13 20:31 - 2018-11-01 01:25 - 001140672 _____ (Microsoft Corporation) C:\WINDOWS\system32\winresume.efi
2018-11-13 20:31 - 2018-11-01 01:25 - 000982592 _____ (Microsoft Corporation) C:\WINDOWS\system32\winresume.exe
2018-11-13 20:31 - 2018-11-01 01:25 - 000594224 _____ (Microsoft Corporation) C:\WINDOWS\system32\audiodg.exe
2018-11-13 20:31 - 2018-11-01 01:25 - 000463672 _____ (Microsoft Corporation) C:\WINDOWS\system32\coml2.dll
2018-11-13 20:31 - 2018-11-01 01:25 - 000268088 _____ (Microsoft Corporation) C:\WINDOWS\system32\browserbroker.dll
2018-11-13 20:31 - 2018-11-01 01:25 - 000261000 _____ (Microsoft Corporation) C:\WINDOWS\system32\mfps.dll
2018-11-13 20:31 - 2018-11-01 01:09 - 025855488 _____ (Microsoft Corporation) C:\WINDOWS\system32\edgehtml.dll
2018-11-13 20:31 - 2018-11-01 01:03 - 003397120 _____ (Microsoft Corporation) C:\WINDOWS\system32\AppXDeploymentServer.dll
2018-11-13 20:31 - 2018-11-01 01:01 - 022716416 _____ (Microsoft Corporation) C:\WINDOWS\system32\mshtml.dll
2018-11-13 20:31 - 2018-11-01 01:01 - 009084928 _____ (Microsoft Corporation) C:\WINDOWS\system32\BingMaps.dll
2018-11-13 20:31 - 2018-11-01 01:01 - 007057408 _____ (Microsoft Corporation) C:\WINDOWS\system32\mos.dll
2018-11-13 20:31 - 2018-11-01 01:00 - 008189440 _____ (Microsoft Corporation) C:\WINDOWS\system32\Windows.Data.Pdf.dll
2018-11-13 20:31 - 2018-11-01 01:00 - 006031360 _____ (Microsoft Corporation) C:\WINDOWS\system32\d2d1.dll
2018-11-13 20:31 - 2018-11-01 01:00 - 003392000 _____ (Microsoft Corporation) C:\WINDOWS\system32\tquery.dll
2018-11-13 20:31 - 2018-11-01 01:00 - 000433664 _____ (Microsoft Corporation) C:\WINDOWS\system32\MusNotification.exe
2018-11-13 20:31 - 2018-11-01 00:59 - 000322048 _____ (Microsoft Corporation) C:\WINDOWS\system32\MusNotificationUx.exe
2018-11-13 20:31 - 2018-11-01 00:58 - 007573504 _____ (Microsoft Corporation) C:\WINDOWS\system32\Chakra.dll
2018-11-13 20:31 - 2018-11-01 00:58 - 004867072 _____ (Microsoft Corporation) C:\WINDOWS\system32\jscript9.dll
2018-11-13 20:31 - 2018-11-01 00:58 - 004383744 _____ (Microsoft Corporation) C:\WINDOWS\system32\EdgeContent.dll
2018-11-13 20:31 - 2018-11-01 00:58 - 000530432 _____ (Microsoft Corporation) C:\WINDOWS\system32\MapConfiguration.dll
2018-11-13 20:31 - 2018-11-01 00:58 - 000273408 _____ (Microsoft Corporation) C:\WINDOWS\system32\ubpm.dll
2018-11-13 20:31 - 2018-11-01 00:57 - 003381248 _____ (Microsoft Corporation) C:\WINDOWS\system32\MapRouter.dll
2018-11-13 20:31 - 2018-11-01 00:57 - 002825728 _____ (Microsoft Corporation) C:\WINDOWS\system32\MapGeocoder.dll
2018-11-13 20:31 - 2018-11-01 00:57 - 001804288 _____ (Microsoft Corporation) C:\WINDOWS\system32\urlmon.dll
2018-11-13 20:31 - 2018-11-01 00:57 - 000898560 _____ (Microsoft Corporation) C:\WINDOWS\system32\MusUpdateHandlers.dll
2018-11-13 20:31 - 2018-11-01 00:57 - 000894464 _____ (Microsoft Corporation) C:\WINDOWS\system32\webplatstorageserver.dll
2018-11-13 20:31 - 2018-11-01 00:57 - 000808448 _____ (Microsoft Corporation) C:\WINDOWS\system32\EdgeManager.dll
2018-11-13 20:31 - 2018-11-01 00:56 - 002929664 _____ (Microsoft Corporation) C:\WINDOWS\system32\xpsservices.dll
2018-11-13 20:31 - 2018-11-01 00:56 - 002172928 _____ (Microsoft Corporation) C:\WINDOWS\system32\AppXDeploymentExtensions.onecore.dll
2018-11-13 20:31 - 2018-11-01 00:56 - 001768448 _____ (Microsoft Corporation) C:\WINDOWS\system32\audiosrv.dll
2018-11-13 20:31 - 2018-11-01 00:56 - 001395200 _____ (Microsoft Corporation) C:\WINDOWS\system32\TokenBroker.dll
2018-11-13 20:31 - 2018-11-01 00:56 - 000506880 _____ (Microsoft Corporation) C:\WINDOWS\system32\netprofmsvc.dll
2018-11-13 20:31 - 2018-11-01 00:55 - 002738688 _____ (Microsoft Corporation) C:\WINDOWS\system32\mssrch.dll
2018-11-13 20:31 - 2018-11-01 00:55 - 001058304 _____ (Microsoft Corporation) C:\WINDOWS\system32\SearchIndexer.exe
2018-11-13 20:31 - 2018-11-01 00:55 - 000684544 _____ (Microsoft Corporation) C:\WINDOWS\system32\AudioEndpointBuilder.dll
2018-11-13 20:31 - 2018-11-01 00:54 - 001551360 _____ (Microsoft Corporation) C:\WINDOWS\system32\AppXDeploymentExtensions.desktop.dll
2018-11-13 20:31 - 2018-11-01 00:54 - 001264640 _____ (Microsoft Corporation) C:\WINDOWS\system32\JpMapControl.dll
2018-11-13 20:31 - 2018-11-01 00:54 - 001225216 _____ (Microsoft Corporation) C:\WINDOWS\system32\MapsStore.dll
2018-11-13 20:31 - 2018-11-01 00:54 - 001023488 _____ (Microsoft Corporation) C:\WINDOWS\system32\ShareHost.dll
2018-11-13 20:31 - 2018-11-01 00:54 - 000943616 _____ (Microsoft Corporation) C:\WINDOWS\system32\BingOnlineServices.dll
2018-11-13 20:31 - 2018-11-01 00:54 - 000916480 _____ (Microsoft Corporation) C:\WINDOWS\system32\Windows.Security.Authentication.Web.Core.dll
2018-11-13 20:31 - 2018-11-01 00:54 - 000895488 _____ (Microsoft Corporation) C:\WINDOWS\system32\Windows.Security.Authentication.OnlineId.dll
2018-11-13 20:31 - 2018-11-01 00:54 - 000884736 _____ (Microsoft Corporation) C:\WINDOWS\system32\MapControlCore.dll
2018-11-13 20:31 - 2018-11-01 00:54 - 000606208 _____ (Microsoft Corporation) C:\WINDOWS\system32\updatehandlers.dll
2018-11-13 20:31 - 2018-11-01 00:53 - 002248192 _____ (Microsoft Corporation) C:\WINDOWS\system32\wlidsvc.dll
2018-11-13 20:31 - 2018-11-01 00:53 - 001373696 _____ (Microsoft Corporation) C:\WINDOWS\system32\usocore.dll
2018-11-13 20:31 - 2018-11-01 00:53 - 001159680 _____ (Microsoft Corporation) C:\WINDOWS\system32\rpcss.dll
2018-11-13 20:31 - 2018-11-01 00:53 - 000889344 _____ (Microsoft Corporation) C:\WINDOWS\system32\schedsvc.dll
2018-11-13 20:31 - 2018-11-01 00:53 - 000542208 _____ (Microsoft Corporation) C:\WINDOWS\system32\vbscript.dll
2018-11-13 20:31 - 2018-10-31 23:08 - 002417952 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\d3d11.dll
2018-11-13 20:31 - 2018-10-31 22:50 - 000861712 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\msmpeg2adec.dll
2018-11-13 20:31 - 2018-10-31 22:50 - 000786288 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\rpcrt4.dll
2018-11-13 20:31 - 2018-10-31 22:48 - 006039064 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\windows.storage.dll
2018-11-13 20:31 - 2018-10-31 22:48 - 004790184 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\mfcore.dll
2018-11-13 20:31 - 2018-10-31 22:48 - 002478872 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\combase.dll
2018-11-13 20:31 - 2018-10-31 22:48 - 002331480 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\msmpeg2vdec.dll
2018-11-13 20:31 - 2018-10-31 22:48 - 001805656 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\AudioEng.dll
2018-11-13 20:31 - 2018-10-31 22:48 - 001011872 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\AudioSes.dll
2018-11-13 20:31 - 2018-10-31 22:48 - 000880248 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\WinTypes.dll
2018-11-13 20:31 - 2018-10-31 22:48 - 000384520 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\coml2.dll
2018-11-13 20:31 - 2018-10-31 22:47 - 006570368 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\Windows.Media.Protection.PlayReady.dll
2018-11-13 20:31 - 2018-10-31 22:47 - 001980776 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\KernelBase.dll
2018-11-13 20:31 - 2018-10-31 22:47 - 001379792 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\mfasfsrcsnk.dll
2018-11-13 20:31 - 2018-10-31 22:47 - 001020064 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\mfmpeg2srcsnk.dll
2018-11-13 20:31 - 2018-10-31 22:40 - 022015488 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\edgehtml.dll
2018-11-13 20:31 - 2018-10-31 22:35 - 019403776 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\mshtml.dll
2018-11-13 20:31 - 2018-10-31 22:34 - 002700288 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\tquery.dll
2018-11-13 20:31 - 2018-10-31 22:33 - 006661632 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\Windows.Data.Pdf.dll
2018-11-13 20:31 - 2018-10-31 22:33 - 003711488 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\jscript9.dll
2018-11-13 20:31 - 2018-10-31 22:32 - 006647296 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\BingMaps.dll
2018-11-13 20:31 - 2018-10-31 22:31 - 005307904 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\d2d1.dll
2018-11-13 20:31 - 2018-10-31 22:30 - 005883904 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\mos.dll
2018-11-13 20:31 - 2018-10-31 22:30 - 005775872 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\Chakra.dll
2018-11-13 20:31 - 2018-10-31 22:30 - 000561152 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\jscript9diag.dll
2018-11-13 20:31 - 2018-10-31 22:29 - 002258944 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\mssrch.dll
2018-11-13 20:31 - 2018-10-31 22:29 - 001986560 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\MapGeocoder.dll
2018-11-13 20:31 - 2018-10-31 22:29 - 001862656 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\xpsservices.dll
2018-11-13 20:31 - 2018-10-31 22:29 - 000848384 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\ShareHost.dll
2018-11-13 20:31 - 2018-10-31 22:29 - 000608768 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\EdgeManager.dll
2018-11-13 20:31 - 2018-10-31 22:28 - 001000448 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\TokenBroker.dll
2018-11-13 20:31 - 2018-10-31 22:28 - 000978944 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\JpMapControl.dll
2018-11-13 20:31 - 2018-10-31 22:27 - 001627648 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\urlmon.dll
2018-11-13 20:31 - 2018-10-31 22:27 - 000713216 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\BingOnlineServices.dll
2018-11-13 20:31 - 2018-10-31 22:27 - 000678400 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\Windows.Security.Authentication.Web.Core.dll
2018-11-13 20:31 - 2018-10-31 22:27 - 000534016 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\vbscript.dll
2018-11-13 20:31 - 2018-10-31 22:26 - 000795648 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\Windows.Security.Authentication.OnlineId.dll
2018-11-13 20:31 - 2018-10-21 07:00 - 021386368 _____ (Microsoft Corporation) C:\WINDOWS\system32\shell32.dll
2018-11-13 20:31 - 2018-10-21 07:00 - 001639560 _____ (Microsoft Corporation) C:\WINDOWS\system32\user32.dll
2018-11-13 20:31 - 2018-10-21 07:00 - 001516120 _____ (Microsoft Corporation) C:\WINDOWS\system32\msctf.dll
2018-11-13 20:31 - 2018-10-21 07:00 - 000790416 _____ (Microsoft Corporation) C:\WINDOWS\system32\fontdrvhost.exe
2018-11-13 20:31 - 2018-10-21 06:59 - 000766480 _____ (Microsoft Corporation) C:\WINDOWS\system32\LicensingWinRT.dll
2018-11-13 20:31 - 2018-10-21 06:46 - 013572096 _____ (Microsoft Corporation) C:\WINDOWS\system32\wmp.dll
2018-11-13 20:31 - 2018-10-21 06:46 - 004393472 _____ (Microsoft Corporation) C:\WINDOWS\system32\SettingsHandlers_nt.dll
2018-11-13 20:31 - 2018-10-21 06:43 - 000345600 _____ (Microsoft Corporation) C:\WINDOWS\system32\AcGenral.dll
2018-11-13 20:31 - 2018-10-21 06:42 - 001127936 _____ (Microsoft Corporation) C:\WINDOWS\system32\nettrace.dll
2018-11-13 20:31 - 2018-10-21 06:42 - 000765440 _____ (Microsoft Corporation) C:\WINDOWS\system32\tdh.dll
2018-11-13 20:31 - 2018-10-21 06:41 - 001180672 _____ (Microsoft Corporation) C:\WINDOWS\system32\localspl.dll
2018-11-13 20:31 - 2018-10-21 05:38 - 001322376 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\msctf.dll
2018-11-13 20:31 - 2018-10-21 05:38 - 000662312 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\fontdrvhost.exe
2018-11-13 20:31 - 2018-10-21 05:38 - 000660480 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\LicensingWinRT.dll
2018-11-13 20:31 - 2018-10-21 05:37 - 020381808 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\shell32.dll
2018-11-13 20:31 - 2018-10-21 05:37 - 001626656 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\user32.dll
2018-11-13 20:31 - 2018-10-21 05:28 - 012501504 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\wmp.dll
2018-11-13 20:31 - 2018-10-21 05:23 - 000622080 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\tdh.dll
2018-11-13 20:31 - 2018-10-21 05:22 - 002405888 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\AcGenral.dll
2018-11-13 20:31 - 2018-10-21 01:48 - 005602456 _____ (Microsoft Corporation) C:\WINDOWS\system32\StartTileData.dll
2018-11-13 20:31 - 2018-10-21 01:46 - 000717112 _____ (Microsoft Corporation) C:\WINDOWS\system32\SettingsHandlers_StorageSense.dll
2018-11-13 20:31 - 2018-10-21 01:46 - 000611640 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\spaceport.sys
2018-11-13 20:31 - 2018-10-21 01:46 - 000560136 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\storport.sys
2018-11-13 20:31 - 2018-10-21 01:46 - 000497864 _____ (Microsoft Corporation) C:\WINDOWS\system32\Windows.Devices.Enumeration.dll
2018-11-13 20:31 - 2018-10-21 01:45 - 003283512 _____ (Microsoft Corporation) C:\WINDOWS\system32\CoreUIComponents.dll
2018-11-13 20:31 - 2018-10-21 01:45 - 002719032 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\tcpip.sys
2018-11-13 20:31 - 2018-10-21 01:45 - 001946208 _____ (Microsoft Corporation) C:\WINDOWS\system32\ntdll.dll
2018-11-13 20:31 - 2018-10-21 01:45 - 001098064 _____ (Microsoft Corporation) C:\WINDOWS\system32\msvproc.dll
2018-11-13 20:31 - 2018-10-21 01:45 - 000607136 _____ (Microsoft Corporation) C:\WINDOWS\system32\TextInputFramework.dll
2018-11-13 20:31 - 2018-10-21 01:45 - 000185120 _____ (Microsoft Corporation) C:\WINDOWS\system32\sspicli.dll
2018-11-13 20:31 - 2018-10-21 01:45 - 000139792 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\ksecdd.sys
2018-11-13 20:31 - 2018-10-21 01:28 - 016592384 _____ (Microsoft Corporation) C:\WINDOWS\system32\Windows.UI.Xaml.dll
2018-11-13 20:31 - 2018-10-21 01:22 - 004710912 _____ (Microsoft Corporation) C:\WINDOWS\system32\cdp.dll
2018-11-13 20:31 - 2018-10-21 01:21 - 001589248 _____ (Microsoft Corporation) C:\WINDOWS\system32\Windows.Globalization.dll
2018-11-13 20:31 - 2018-10-21 01:20 - 000424000 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\Windows.Devices.Enumeration.dll
2018-11-13 20:31 - 2018-10-21 01:19 - 002487088 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\CoreUIComponents.dll
2018-11-13 20:31 - 2018-10-21 01:19 - 001620776 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\ntdll.dll
2018-11-13 20:31 - 2018-10-21 01:19 - 001130768 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\msvproc.dll
2018-11-13 20:31 - 2018-10-21 01:19 - 000505616 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\TextInputFramework.dll
2018-11-13 20:31 - 2018-10-21 01:18 - 000461824 _____ (Microsoft Corporation) C:\WINDOWS\system32\Windows.Data.Activities.dll
2018-11-13 20:31 - 2018-10-21 01:18 - 000130048 _____ (Microsoft Corporation) C:\WINDOWS\system32\officecsp.dll
2018-11-13 20:31 - 2018-10-21 01:17 - 001826816 _____ (Microsoft Corporation) C:\WINDOWS\system32\Windows.CloudStore.dll
2018-11-13 20:31 - 2018-10-21 01:17 - 001668096 _____ (Microsoft Corporation) C:\WINDOWS\system32\cdprt.dll
2018-11-13 20:31 - 2018-10-21 01:17 - 000787456 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\WdiWiFi.sys
2018-11-13 20:31 - 2018-10-21 01:17 - 000625152 _____ (Microsoft Corporation) C:\WINDOWS\system32\PsmServiceExtHost.dll
2018-11-13 20:31 - 2018-10-21 01:17 - 000473600 _____ (Microsoft Corporation) C:\WINDOWS\system32\schannel.dll
2018-11-13 20:31 - 2018-10-21 01:17 - 000311296 _____ (Microsoft Corporation) C:\WINDOWS\system32\BthAvrcp.dll
2018-11-13 20:31 - 2018-10-21 01:17 - 000271872 _____ (Microsoft Corporation) C:\WINDOWS\system32\dafBth.dll
2018-11-13 20:31 - 2018-10-21 01:16 - 002584576 _____ (Microsoft Corporation) C:\WINDOWS\system32\wlansvc.dll
2018-11-13 20:31 - 2018-10-21 01:16 - 002368512 _____ (Microsoft Corporation) C:\WINDOWS\system32\WebRuntimeManager.dll
2018-11-13 20:31 - 2018-10-21 01:16 - 001535488 _____ (Microsoft Corporation) C:\WINDOWS\system32\lsasrv.dll
2018-11-13 20:31 - 2018-10-21 01:16 - 000847360 _____ (Microsoft Corporation) C:\WINDOWS\system32\bisrv.dll
2018-11-13 20:31 - 2018-10-21 01:16 - 000514048 _____ (Microsoft Corporation) C:\WINDOWS\system32\BTAGService.dll
2018-11-13 20:31 - 2018-10-21 01:15 - 003212800 _____ (Microsoft Corporation) C:\WINDOWS\system32\DWrite.dll
2018-11-13 20:31 - 2018-10-21 01:15 - 002904064 _____ (Microsoft Corporation) C:\WINDOWS\system32\wuaueng.dll
2018-11-13 20:31 - 2018-10-21 01:15 - 000743936 _____ (Microsoft Corporation) C:\WINDOWS\system32\PrintRenderAPIHost.DLL
2018-11-13 20:31 - 2018-10-21 01:14 - 002224640 _____ (Microsoft Corporation) C:\WINDOWS\system32\win32kbase.sys
2018-11-13 20:31 - 2018-10-21 01:14 - 001919488 _____ (Microsoft Corporation) C:\WINDOWS\system32\FntCache.dll
2018-11-13 20:31 - 2018-10-21 01:14 - 001854976 _____ (Microsoft Corporation) C:\WINDOWS\system32\wevtsvc.dll
2018-11-13 20:31 - 2018-10-21 01:14 - 001034752 _____ (Microsoft Corporation) C:\WINDOWS\system32\modernexecserver.dll
2018-11-13 20:31 - 2018-10-21 01:14 - 000453632 _____ (Microsoft Corporation) C:\WINDOWS\system32\cdpusersvc.dll
2018-11-13 20:31 - 2018-10-21 01:14 - 000311296 _____ (Microsoft Corporation) C:\WINDOWS\system32\EnterpriseAppMgmtSvc.dll
2018-11-13 20:31 - 2018-10-21 01:09 - 013873664 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\Windows.UI.Xaml.dll
2018-11-13 20:31 - 2018-10-21 01:02 - 002966528 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\cdp.dll
2018-11-13 20:31 - 2018-10-21 01:01 - 001189376 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\Windows.Globalization.dll
2018-11-13 20:31 - 2018-10-21 00:58 - 000415744 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\schannel.dll
2018-11-13 20:31 - 2018-10-21 00:57 - 002611200 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\DWrite.dll
2018-11-13 20:31 - 2018-10-20 23:59 - 000806320 _____ C:\WINDOWS\SysWOW64\locale.nls
2018-11-13 20:31 - 2018-10-20 23:59 - 000806320 _____ C:\WINDOWS\system32\locale.nls
2018-11-13 20:30 - 2018-11-01 05:49 - 000348160 _____ (Microsoft Corporation) C:\WINDOWS\system32\MusNotifyIcon.exe
2018-11-13 20:30 - 2018-11-01 05:32 - 000064000 _____ (Microsoft Corporation) C:\WINDOWS\system32\iemigplugin.dll
2018-11-13 20:30 - 2018-11-01 05:30 - 000122368 _____ (Microsoft Corporation) C:\WINDOWS\system32\musdialoghandlers.dll
2018-11-13 20:30 - 2018-11-01 05:30 - 000029696 _____ (Microsoft Corporation) C:\WINDOWS\system32\msisip.dll
2018-11-13 20:30 - 2018-11-01 05:29 - 000073728 _____ (Microsoft Corporation) C:\WINDOWS\system32\SMSRouter.dll
2018-11-13 20:30 - 2018-11-01 05:28 - 000253952 _____ (Microsoft Corporation) C:\WINDOWS\system32\prnntfy.dll
2018-11-13 20:30 - 2018-11-01 05:26 - 000503296 _____ (Microsoft Corporation) C:\WINDOWS\system32\sppcext.dll
2018-11-13 20:30 - 2018-11-01 05:26 - 000392192 _____ (Microsoft Corporation) C:\WINDOWS\system32\iedkcs32.dll
2018-11-13 20:30 - 2018-11-01 05:25 - 000577024 _____ (Microsoft Corporation) C:\WINDOWS\system32\SppExtComObj.Exe
2018-11-13 20:30 - 2018-11-01 03:56 - 000226304 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\prnntfy.dll
2018-11-13 20:30 - 2018-11-01 03:56 - 000024576 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\msisip.dll
2018-11-13 20:30 - 2018-11-01 03:54 - 000344576 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\iedkcs32.dll
2018-11-13 20:30 - 2018-11-01 03:53 - 000908288 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\TSWorkspace.dll
2018-11-13 20:30 - 2018-11-01 01:37 - 000272408 _____ (Microsoft Corporation) C:\WINDOWS\system32\SgrmEnclave.dll
2018-11-13 20:30 - 2018-11-01 01:28 - 000134968 _____ (Microsoft Corporation) C:\WINDOWS\system32\hvloader.dll
2018-11-13 20:30 - 2018-11-01 01:28 - 000076088 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\hvservice.sys
2018-11-13 20:30 - 2018-11-01 01:25 - 000885968 _____ (Microsoft Corporation) C:\WINDOWS\system32\CoreMessaging.dll
2018-11-13 20:30 - 2018-11-01 01:25 - 000793080 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\dxgmms2.sys
2018-11-13 20:30 - 2018-11-01 01:25 - 000713472 _____ (Microsoft Corporation) C:\WINDOWS\system32\MSVideoDSP.dll
2018-11-13 20:30 - 2018-11-01 01:25 - 000413720 _____ (Microsoft Corporation) C:\WINDOWS\system32\AUDIOKSE.dll
2018-11-13 20:30 - 2018-11-01 01:25 - 000412984 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\dxgmms1.sys
2018-11-13 20:30 - 2018-11-01 01:25 - 000375824 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\msrpc.sys
2018-11-13 20:30 - 2018-11-01 01:03 - 000034816 _____ (Microsoft Corporation) C:\WINDOWS\system32\dusmtask.exe
2018-11-13 20:30 - 2018-11-01 01:02 - 000047104 _____ (Microsoft Corporation) C:\WINDOWS\system32\dusmapi.dll
2018-11-13 20:30 - 2018-11-01 01:02 - 000023552 _____ (Microsoft Corporation) C:\WINDOWS\system32\CSystemEventsBrokerClient.dll
2018-11-13 20:30 - 2018-11-01 01:00 - 000209408 _____ (Microsoft Corporation) C:\WINDOWS\system32\AppXApplicabilityBlob.dll
2018-11-13 20:30 - 2018-11-01 00:59 - 000241152 _____ (Microsoft Corporation) C:\WINDOWS\system32\tetheringservice.dll
2018-11-13 20:30 - 2018-11-01 00:59 - 000192000 _____ (Microsoft Corporation) C:\WINDOWS\system32\scrrun.dll
2018-11-13 20:30 - 2018-11-01 00:59 - 000176128 _____ (Microsoft Corporation) C:\WINDOWS\system32\WPTaskScheduler.dll
2018-11-13 20:30 - 2018-11-01 00:59 - 000107520 _____ (Microsoft Corporation) C:\WINDOWS\system32\dab.dll
2018-11-13 20:30 - 2018-11-01 00:58 - 000154112 _____ (Microsoft Corporation) C:\WINDOWS\system32\Chakradiag.dll
2018-11-13 20:30 - 2018-11-01 00:58 - 000149504 _____ (Microsoft Corporation) C:\WINDOWS\system32\dssvc.dll
2018-11-13 20:30 - 2018-11-01 00:57 - 002364928 _____ (Microsoft Corporation) C:\WINDOWS\system32\OpcServices.dll
2018-11-13 20:30 - 2018-11-01 00:57 - 001708544 _____ (Microsoft Corporation) C:\WINDOWS\system32\MSPhotography.dll
2018-11-13 20:30 - 2018-11-01 00:57 - 000835584 _____ (Microsoft Corporation) C:\WINDOWS\system32\PhoneService.dll
2018-11-13 20:30 - 2018-11-01 00:57 - 000726528 _____ (Microsoft Corporation) C:\WINDOWS\system32\jscript9diag.dll
2018-11-13 20:30 - 2018-11-01 00:57 - 000356352 _____ (Microsoft Corporation) C:\WINDOWS\system32\dusmsvc.dll
2018-11-13 20:30 - 2018-11-01 00:57 - 000281600 _____ (Microsoft Corporation) C:\WINDOWS\system32\SystemEventsBrokerServer.dll
2018-11-13 20:30 - 2018-11-01 00:57 - 000265728 _____ (Microsoft Corporation) C:\WINDOWS\system32\psmsrv.dll
2018-11-13 20:30 - 2018-11-01 00:54 - 001679360 _____ (Microsoft Corporation) C:\WINDOWS\system32\wwansvc.dll
2018-11-13 20:30 - 2018-11-01 00:54 - 000796672 _____ (Microsoft Corporation) C:\WINDOWS\system32\mssvp.dll
2018-11-13 20:30 - 2018-11-01 00:53 - 000406528 _____ (Microsoft Corporation) C:\WINDOWS\system32\SearchProtocolHost.exe
2018-11-13 20:30 - 2018-10-31 23:39 - 000001310 _____ C:\WINDOWS\system32\tcbres.wim
2018-11-13 20:30 - 2018-10-31 22:47 - 000581600 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\MSVideoDSP.dll
2018-11-13 20:30 - 2018-10-31 22:47 - 000567256 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\CoreMessaging.dll
2018-11-13 20:30 - 2018-10-31 22:47 - 000129304 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\mfps.dll
2018-11-13 20:30 - 2018-10-31 22:31 - 000288768 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\Search.ProtocolHandler.MAPI2.dll
2018-11-13 20:30 - 2018-10-31 22:30 - 002449408 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\MapRouter.dll
2018-11-13 20:30 - 2018-10-31 22:30 - 001361408 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\MSPhotography.dll
2018-11-13 20:30 - 2018-10-31 22:30 - 000392704 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\MapConfiguration.dll
2018-11-13 20:30 - 2018-10-31 22:30 - 000310272 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\wincorlib.dll
2018-11-13 20:30 - 2018-10-31 22:29 - 000578560 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\webplatstorageserver.dll
2018-11-13 20:30 - 2018-10-31 22:29 - 000165376 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\scrrun.dll
2018-11-13 20:30 - 2018-10-31 22:28 - 001348096 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\OpcServices.dll
2018-11-13 20:30 - 2018-10-31 22:27 - 000856576 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\SearchIndexer.exe
2018-11-13 20:30 - 2018-10-31 22:26 - 000735744 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\mssvp.dll
2018-11-13 20:30 - 2018-10-31 22:26 - 000345088 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\SearchProtocolHost.exe
2018-11-13 20:30 - 2018-10-21 07:00 - 000396304 _____ (Adobe Systems Incorporated) C:\WINDOWS\system32\atmfd.dll
2018-11-13 20:30 - 2018-10-21 06:59 - 000236728 _____ (Microsoft Corporation) C:\WINDOWS\system32\EditionUpgradeManagerObj.dll
2018-11-13 20:30 - 2018-10-21 06:45 - 000123392 _____ (Microsoft Corporation) C:\WINDOWS\system32\fontsub.dll
2018-11-13 20:30 - 2018-10-21 06:44 - 000623104 _____ (Microsoft Corporation) C:\WINDOWS\system32\osk.exe
2018-11-13 20:30 - 2018-10-21 06:44 - 000085504 _____ (Microsoft Corporation) C:\WINDOWS\system32\INETRES.dll
2018-11-13 20:30 - 2018-10-21 06:43 - 000276992 _____ (Microsoft Corporation) C:\WINDOWS\system32\wisp.dll
2018-11-13 20:30 - 2018-10-21 06:43 - 000182784 _____ (Microsoft Corporation) C:\WINDOWS\system32\LanguageComponentsInstaller.dll
2018-11-13 20:30 - 2018-10-21 06:42 - 000592896 _____ (Microsoft Corporation) C:\WINDOWS\system32\UserLanguagesCpl.dll
2018-11-13 20:30 - 2018-10-21 06:42 - 000181248 _____ (Microsoft Corporation) C:\WINDOWS\system32\EditionUpgradeHelper.dll
2018-11-13 20:30 - 2018-10-21 05:38 - 000221216 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\EditionUpgradeManagerObj.dll
2018-11-13 20:30 - 2018-10-21 05:28 - 000084992 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\INETRES.dll
2018-11-13 20:30 - 2018-10-21 05:23 - 000523264 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\UserLanguagesCpl.dll
2018-11-13 20:30 - 2018-10-21 05:22 - 000224256 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\wisp.dll
2018-11-13 20:30 - 2018-10-21 03:29 - 001008640 _____ (Microsoft Corporation) C:\WINDOWS\system32\Windows.Media.MixedRealityCapture.dll
2018-11-13 20:30 - 2018-10-21 02:44 - 000868864 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\Windows.Media.MixedRealityCapture.dll
2018-11-13 20:30 - 2018-10-21 01:47 - 000368440 _____ (Microsoft Corporation) C:\WINDOWS\system32\thumbcache.dll
2018-11-13 20:30 - 2018-10-21 01:46 - 000709936 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\cng.sys
2018-11-13 20:30 - 2018-10-21 01:46 - 000171024 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\ksecpkg.sys
2018-11-13 20:30 - 2018-10-21 01:45 - 000175624 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\spacedump.sys
2018-11-13 20:30 - 2018-10-21 01:45 - 000058088 _____ (Microsoft Corporation) C:\WINDOWS\system32\lsass.exe
2018-11-13 20:30 - 2018-10-21 01:21 - 000123424 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\sspicli.dll
2018-11-13 20:30 - 2018-10-21 01:20 - 000295224 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\thumbcache.dll
2018-11-13 20:30 - 2018-10-21 01:20 - 000161792 _____ (Microsoft Corporation) C:\WINDOWS\system32\spacebridge.dll
2018-11-13 20:30 - 2018-10-21 01:20 - 000141312 _____ C:\WINDOWS\system32\DataStoreCacheDumpTool.exe
2018-11-13 20:30 - 2018-10-21 01:20 - 000050688 _____ (Microsoft Corporation) C:\WINDOWS\system32\wcimage.dll
2018-11-13 20:30 - 2018-10-21 01:19 - 000514560 _____ (Microsoft Corporation) C:\WINDOWS\system32\nltest.exe
2018-11-13 20:30 - 2018-10-21 01:19 - 000463360 _____ (Microsoft Corporation) C:\WINDOWS\system32\wlansec.dll
2018-11-13 20:30 - 2018-10-21 01:19 - 000409088 _____ (Microsoft Corporation) C:\WINDOWS\system32\wlanmsm.dll
2018-11-13 20:30 - 2018-10-21 01:19 - 000228864 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\winnat.sys
2018-11-13 20:30 - 2018-10-21 01:19 - 000228352 _____ (Microsoft Corporation) C:\WINDOWS\system32\Windows.Web.Diagnostics.dll
2018-11-13 20:30 - 2018-10-21 01:19 - 000137728 _____ (Microsoft Corporation) C:\WINDOWS\system32\InputLocaleManager.dll
2018-11-13 20:30 - 2018-10-21 01:19 - 000112128 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\bthhfenum.sys
2018-11-13 20:30 - 2018-10-21 01:19 - 000086528 _____ (Microsoft Corporation) C:\WINDOWS\system32\ofdeploy.exe
2018-11-13 20:30 - 2018-10-21 01:19 - 000060928 _____ (Microsoft Corporation) C:\WINDOWS\system32\BthAvrcpAppSvc.dll
2018-11-13 20:30 - 2018-10-21 01:19 - 000036352 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\vhf.sys
2018-11-13 20:30 - 2018-10-21 01:19 - 000028672 _____ (Microsoft Corporation) C:\WINDOWS\system32\sspisrv.dll
2018-11-13 20:30 - 2018-10-21 01:18 - 000761344 _____ (Microsoft Corporation) C:\WINDOWS\system32\nshwfp.dll
2018-11-13 20:30 - 2018-10-21 01:18 - 000395264 _____ (Microsoft Corporation) C:\WINDOWS\system32\BthAvctpSvc.dll
2018-11-13 20:30 - 2018-10-21 01:18 - 000275456 _____ (Microsoft Corporation) C:\WINDOWS\system32\scecli.dll
2018-11-13 20:30 - 2018-10-21 01:18 - 000274432 _____ (Microsoft Corporation) C:\WINDOWS\system32\DAFWSD.dll
2018-11-13 20:30 - 2018-10-21 01:18 - 000030720 _____ (Microsoft Corporation) C:\WINDOWS\system32\seclogon.dll
2018-11-13 20:30 - 2018-10-21 01:16 - 000323584 _____ (Microsoft Corporation) C:\WINDOWS\system32\AppxAllUserStore.dll
2018-11-13 20:30 - 2018-10-21 01:15 - 000401920 _____ (Microsoft Corporation) C:\WINDOWS\system32\rascustom.dll
2018-11-13 20:30 - 2018-10-21 01:14 - 000932352 _____ (Microsoft Corporation) C:\WINDOWS\system32\rasmans.dll
2018-11-13 20:30 - 2018-10-21 01:14 - 000632320 _____ (Microsoft Corporation) C:\WINDOWS\system32\cdpsvc.dll
2018-11-13 20:30 - 2018-10-21 01:02 - 000157184 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\spacebridge.dll
2018-11-13 20:30 - 2018-10-21 01:01 - 000168448 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\Windows.Web.Diagnostics.dll
2018-11-13 20:30 - 2018-10-21 01:00 - 000214528 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\scecli.dll
2018-11-13 20:30 - 2018-10-21 00:59 - 000602112 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\nshwfp.dll
2018-11-13 20:30 - 2018-10-21 00:58 - 001124352 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\cdprt.dll
2018-11-13 20:30 - 2018-10-21 00:58 - 000230912 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\AppxAllUserStore.dll
2018-11-13 20:30 - 2018-04-27 22:02 - 000144384 _____ (Microsoft Corporation) C:\WINDOWS\system32\mssprxy.dll
2018-11-12 20:26 - 2018-11-12 20:26 - 000003234 _____ C:\Users\Dad\Desktop\untitled.html
2018-11-12 16:49 - 2018-11-12 20:31 - 000000000 ____D C:\ProgramData\TSR7Settings
2018-11-10 21:40 - 2018-11-10 21:40 - 000000000 ___HD C:\$SysReset
2018-11-10 21:25 - 2018-11-10 21:25 - 000000000 ____D C:\Program Files\Realtek
2018-11-10 21:24 - 2017-06-29 18:55 - 013122576 _____ (Waves Audio Ltd.) C:\WINDOWS\system32\MaxxVoiceAPO3064.dll
2018-11-10 21:24 - 2017-06-29 18:55 - 012988336 _____ (Waves Audio Ltd.) C:\WINDOWS\system32\MaxxVoiceAPO4064.dll
2018-11-10 21:24 - 2017-06-29 18:55 - 006410088 _____ (Nahimic Inc) C:\WINDOWS\system32\NAHIMICV3apo.dll
2018-11-10 21:24 - 2017-06-29 18:55 - 005938904 _____ (Nahimic Inc) C:\WINDOWS\system32\NAHIMICV2apo.dll
2018-11-10 21:24 - 2017-06-29 18:55 - 005593608 _____ (Nahimic Inc) C:\WINDOWS\system32\NAHIMICAPOlfx.dll
2018-11-10 21:24 - 2017-06-29 18:55 - 003509256 _____ (Realtek Semiconductor Corp.) C:\WINDOWS\system32\RltkAPO64.dll
2018-11-10 21:24 - 2017-06-29 18:55 - 003507688 _____ (Realtek Semiconductor Corp.) C:\WINDOWS\system32\RtkApi64.dll
2018-11-10 21:24 - 2017-06-29 18:55 - 003410832 _____ (DTS, Inc.) C:\WINDOWS\system32\slcnt64.dll
2018-11-10 21:24 - 2017-06-29 18:55 - 003299816 _____ (Yamaha Corporation) C:\WINDOWS\system32\YamahaAE2.dll
2018-11-10 21:24 - 2017-06-29 18:55 - 003122656 _____ (DTS, Inc.) C:\WINDOWS\system32\sltech64.dll
2018-11-10 21:24 - 2017-06-29 18:55 - 003092336 _____ (Realtek Semiconductor Corp.) C:\WINDOWS\SysWOW64\RltkAPO.dll
2018-11-10 21:24 - 2017-06-29 18:55 - 002190976 _____ (Yamaha Corporation) C:\WINDOWS\system32\YamahaAE.dll
2018-11-10 21:24 - 2017-06-29 18:55 - 001435136 _____ (Synopsys, Inc.) C:\WINDOWS\system32\SRRPTR64.dll
2018-11-10 21:24 - 2017-06-29 18:55 - 001382232 _____ (TOSHIBA Corporation) C:\WINDOWS\system32\tosade.dll
2018-11-10 21:24 - 2017-06-29 18:55 - 001347136 _____ (Realtek Semiconductor Corp.) C:\WINDOWS\system32\RTCOM64.dll
2018-11-10 21:24 - 2017-06-29 18:55 - 001337640 _____ (Toshiba Client Solutions Co., Ltd.) C:\WINDOWS\system32\tossaeapo64.dll
2018-11-10 21:24 - 2017-06-29 18:55 - 001016928 _____ (Sound Research, Corp.) C:\WINDOWS\system32\SEHDHF64.dll
2018-11-10 21:24 - 2017-06-29 18:55 - 000984912 _____ (DTS, Inc.) C:\WINDOWS\system32\sl3apo64.dll
2018-11-10 21:24 - 2017-06-29 18:55 - 000965024 _____ (Sony Corporation) C:\WINDOWS\system32\SFSS_APO.dll
2018-11-10 21:24 - 2017-06-29 18:55 - 000923736 _____ (Sony Corporation) C:\WINDOWS\system32\MISS_APO.dll
2018-11-10 21:24 - 2017-06-29 18:55 - 000877424 _____ (Sound Research, Corp.) C:\WINDOWS\SysWOW64\SEHDHF32.dll
2018-11-10 21:24 - 2017-06-29 18:55 - 000873456 _____ (TOSHIBA Corporation) C:\WINDOWS\system32\tadefxapo264.dll
2018-11-10 21:24 - 2017-06-29 18:55 - 000868176 _____ (Sound Research, Corp.) C:\WINDOWS\system32\SECOMN64.dll
2018-11-10 21:24 - 2017-06-29 18:55 - 000866640 _____ (Sound Research, Corp.) C:\WINDOWS\system32\SEHDRA64.dll
2018-11-10 21:24 - 2017-06-29 18:55 - 000852128 _____ (Toshiba Client Solutions Co., Ltd.) C:\WINDOWS\system32\tosasfapo64.dll
2018-11-10 21:24 - 2017-06-29 18:55 - 000737960 _____ (Sound Research, Corp.) C:\WINDOWS\SysWOW64\SECOMN32.dll
2018-11-10 21:24 - 2017-06-29 18:55 - 000691680 _____ (Realtek Semiconductor Corp.) C:\WINDOWS\system32\RtDataProc64.dll
2018-11-10 21:24 - 2017-06-29 18:55 - 000677664 _____ (Waves Audio Ltd.) C:\WINDOWS\system32\MaxxVolumeSDAPO.dll
2018-11-10 21:24 - 2017-06-29 18:55 - 000604792 _____ (Toshiba Client Solutions Co., Ltd.) C:\WINDOWS\system32\tossaemaxapo64.dll
2018-11-10 21:24 - 2017-06-29 18:55 - 000532376 _____ (SRS Labs, Inc.) C:\WINDOWS\system32\SRSTSX64.dll
2018-11-10 21:24 - 2017-06-29 18:55 - 000525768 _____ (Sound Research, Corp.) C:\WINDOWS\system32\SEAPO64.dll
2018-11-10 21:24 - 2017-06-29 18:55 - 000467152 _____ (Synopsys, Inc.) C:\WINDOWS\system32\SRAPO64.dll
2018-11-10 21:24 - 2017-06-29 18:55 - 000447712 _____ (Dolby Laboratories) C:\WINDOWS\system32\R4EED64A.dll
2018-11-10 21:24 - 2017-06-29 18:55 - 000447176 _____ (Toshiba Client Solutions Co., Ltd.) C:\WINDOWS\system32\toseaeapo64.dll
2018-11-10 21:24 - 2017-06-29 18:55 - 000387312 _____ (Dolby Laboratories, Inc.) C:\WINDOWS\system32\RTEEP64A.dll
2018-11-10 21:24 - 2017-06-29 18:55 - 000381408 _____ (Synopsys, Inc.) C:\WINDOWS\system32\SRCOM64.dll
2018-11-10 21:24 - 2017-06-29 18:55 - 000343704 _____ (Realtek Semiconductor Corp.) C:\WINDOWS\system32\RtlCPAPI64.dll
2018-11-10 21:24 - 2017-06-29 18:55 - 000341144 _____ (Synopsys, Inc.) C:\WINDOWS\SysWOW64\SRCOM.dll
2018-11-10 21:24 - 2017-06-29 18:55 - 000341144 _____ (Synopsys, Inc.) C:\WINDOWS\system32\SRCOM.dll
2018-11-10 21:24 - 2017-06-29 18:55 - 000321712 _____ (Dolby Laboratories, Inc.) C:\WINDOWS\system32\RP3DHT64.dll
2018-11-10 21:24 - 2017-06-29 18:55 - 000321712 _____ (Dolby Laboratories, Inc.) C:\WINDOWS\system32\RP3DAA64.dll
2018-11-10 21:24 - 2017-06-29 18:55 - 000231912 _____ (Synopsys, Inc.) C:\WINDOWS\system32\SFNHK64.dll
2018-11-10 21:24 - 2017-06-29 18:55 - 000221960 _____ (SRS Labs, Inc.) C:\WINDOWS\system32\SRSTSH64.dll
2018-11-10 21:24 - 2017-06-29 18:55 - 000214832 _____ (Dolby Laboratories, Inc.) C:\WINDOWS\system32\RTEED64A.dll
2018-11-10 21:24 - 2017-06-29 18:55 - 000209528 _____ (SRS Labs, Inc.) C:\WINDOWS\system32\SRSHP64.dll
2018-11-10 21:24 - 2017-06-29 18:55 - 000192976 _____ (Realtek Semiconductor Corp.) C:\WINDOWS\system32\RtkCfg64.dll
2018-11-10 21:24 - 2017-06-29 18:55 - 000166200 _____ (SRS Labs, Inc.) C:\WINDOWS\system32\SRSWOW64.dll
2018-11-10 21:24 - 2017-06-29 18:55 - 000158696 _____ (TOSHIBA Corporation) C:\WINDOWS\system32\tadefxapo.dll
2018-11-10 21:24 - 2017-06-29 18:55 - 000151784 _____ (Dolby Laboratories) C:\WINDOWS\system32\R4EEL64A.dll
2018-11-10 21:24 - 2017-06-29 18:55 - 000134200 _____ (Dolby Laboratories) C:\WINDOWS\system32\R4EEA64A.dll
2018-11-10 21:24 - 2017-06-29 18:55 - 000110976 _____ (Dolby Laboratories, Inc.) C:\WINDOWS\system32\RTEEL64A.dll
2018-11-10 21:24 - 2017-06-29 18:55 - 000090912 _____ (Synopsys, Inc.) C:\WINDOWS\system32\SFCOM64.dll
2018-11-10 21:24 - 2017-06-29 18:55 - 000088344 _____ (Dolby Laboratories, Inc.) C:\WINDOWS\system32\RTEEG64A.dll
2018-11-10 21:24 - 2017-06-29 18:55 - 000088312 _____ (Synopsys, Inc.) C:\WINDOWS\system32\SFAPO64.dll
2018-11-10 21:24 - 2017-06-29 18:55 - 000084608 _____ (Dolby Laboratories) C:\WINDOWS\system32\R4EEG64A.dll
2018-11-10 21:24 - 2017-06-29 18:55 - 000083624 _____ (Virage Logic Corporation / Sonic Focus) C:\WINDOWS\SysWOW64\SFCOM.dll
2018-11-10 21:24 - 2017-06-29 18:55 - 000075536 _____ (TOSHIBA CORPORATION.) C:\WINDOWS\system32\tepeqapo64.dll
2018-11-10 21:24 - 2017-06-29 18:54 - 010536152 _____ (Intel Corporation) C:\WINDOWS\system32\IntelSSTAPO.dll
2018-11-10 21:24 - 2017-06-29 18:54 - 002291304 _____ (Waves Audio Ltd.) C:\WINDOWS\system32\MaxxAudioAPO7064.dll
2018-11-10 21:24 - 2017-06-29 18:54 - 001422920 _____ (Waves Audio Ltd.) C:\WINDOWS\system32\MaxxAudioAPO6064.dll
2018-11-10 21:24 - 2017-06-29 18:54 - 001334376 _____ (Waves Audio Ltd.) C:\WINDOWS\system32\MaxxSpeechAPO64.dll
2018-11-10 21:24 - 2017-06-29 18:54 - 001213656 _____ (Waves Audio Ltd.) C:\WINDOWS\system32\MaxxAudioAPO5064.dll
2018-11-10 21:24 - 2017-06-29 18:54 - 001166152 _____ (Waves Audio Ltd.) C:\WINDOWS\system32\MaxxAudioAPO4064.dll
2018-11-10 21:24 - 2017-06-29 18:54 - 000999848 _____ (Waves Audio Ltd.) C:\WINDOWS\system32\MaxxVoiceAPO2064.dll
2018-11-10 21:24 - 2017-06-29 18:54 - 000680544 _____ (ICEpower a/s) C:\WINDOWS\system32\ICEsoundAPO64.dll
2018-11-10 21:24 - 2017-06-29 18:54 - 000678176 _____ (Waves Audio Ltd.) C:\WINDOWS\system32\MaxxAudioAPO30.dll
2018-11-10 21:24 - 2017-06-29 18:54 - 000618184 _____ (Knowles Acoustics ) C:\WINDOWS\system32\KAAPORT64.dll
2018-11-10 21:24 - 2017-06-29 18:54 - 000406448 _____ (Dolby Laboratories) C:\WINDOWS\system32\HiFiDAX2APIPCLL.dll
2018-11-10 21:24 - 2017-06-29 18:54 - 000366120 _____ (Windows (R) Win 7 DDK provider) C:\WINDOWS\system32\HMAPO.dll
2018-11-10 21:24 - 2017-06-29 18:54 - 000360344 _____ (Harman) C:\WINDOWS\system32\HMClariFi.dll
2018-11-10 21:24 - 2017-06-29 18:54 - 000330552 _____ (Waves Audio Ltd.) C:\WINDOWS\system32\MaxxAudioAPO20.dll
2018-11-10 21:24 - 2017-06-29 18:54 - 000203840 _____ (Harman) C:\WINDOWS\system32\HMHVS.dll
2018-11-10 21:24 - 2017-06-29 18:54 - 000190928 _____ (Harman) C:\WINDOWS\system32\HMEQ_Voice.dll
2018-11-10 21:24 - 2017-06-29 18:54 - 000190928 _____ (Harman) C:\WINDOWS\system32\HMEQ.dll
2018-11-10 21:24 - 2017-06-29 18:54 - 000179592 _____ (Harman) C:\WINDOWS\system32\HMLimiter.dll
2018-11-10 21:24 - 2017-06-29 18:52 - 005826560 _____ (Realtek Semiconductor Corp.) C:\WINDOWS\system32\Drivers\RTKVHD64.sys
2018-11-10 21:24 - 2017-06-29 18:52 - 003677160 _____ (Realtek Semiconductor Corp.) C:\WINDOWS\system32\RTSnMg64.cpl
2018-11-10 21:24 - 2017-06-29 18:52 - 003205120 _____ (Realtek Semiconductor Corp.) C:\WINDOWS\system32\RtPgEx64.dll
2018-11-10 21:24 - 2017-06-29 18:52 - 002110592 _____ (Waves Audio Ltd.) C:\WINDOWS\system32\WavesGUILib64.dll
2018-11-10 21:24 - 2017-06-29 18:52 - 000258856 _____ (TODO: <Company name>) C:\WINDOWS\system32\slprp64.dll
2018-11-10 21:24 - 2017-06-29 18:51 - 072520712 _____ (Realtek Semiconductor Corp.) C:\WINDOWS\system32\RCoRes64.dat
2018-11-10 21:24 - 2017-06-29 18:51 - 014057248 _____ (Waves Audio Ltd.) C:\WINDOWS\system32\MaxxAudioRealtek64.dll
2018-11-10 21:24 - 2017-06-29 18:51 - 007172912 _____ (Dolby Laboratories) C:\WINDOWS\system32\R4EEP64A.dll
2018-11-10 21:24 - 2017-06-29 18:51 - 002210304 _____ (Realtek Semiconductor Corp.) C:\WINDOWS\system32\RCoInstII64.dll
2018-11-10 21:24 - 2017-06-29 18:51 - 002050176 _____ (Waves Audio Ltd.) C:\WINDOWS\system32\MaxxAudioEQ64.dll
2018-11-10 21:24 - 2017-06-29 18:51 - 001186832 _____ (Intel Corporation) C:\WINDOWS\system32\IntelSstCApoPropPage.dll
2018-11-10 21:24 - 2017-06-29 18:51 - 001003856 _____ (Nahimic Inc) C:\WINDOWS\system32\NahimicAPONSControl.dll
2018-11-10 21:24 - 2017-06-29 18:51 - 000931616 _____ (Waves Audio Ltd.) C:\WINDOWS\system32\MaxxAudioAPOShell64.dll
2018-11-10 21:24 - 2017-06-29 18:51 - 000416504 _____ (Harman) C:\WINDOWS\system32\HMUI.dll
2018-11-10 21:24 - 2017-06-29 18:51 - 000378384 _____ (Dolby Laboratories) C:\WINDOWS\system32\HiFiDAX2API.dll
2018-11-10 21:24 - 2017-06-29 18:51 - 000023688 _____ (Realtek Semiconductor Corp.) C:\WINDOWS\system32\RtkCoLDR64.dll
2018-11-10 21:24 - 2017-06-29 03:05 - 012334923 _____ C:\WINDOWS\system32\Drivers\RTAIODAT.DAT
2018-11-10 21:24 - 2017-06-29 03:05 - 005804772 _____ C:\WINDOWS\system32\Drivers\rtvienna.dat
2018-11-10 21:24 - 2017-06-29 03:05 - 001920870 _____ C:\WINDOWS\system32\Drivers\rtkSSTsetting.dat
2018-11-10 21:23 - 2017-06-29 18:54 - 004059960 _____ (Fortemedia Corporation) C:\WINDOWS\system32\FMAPO64.dll
2018-11-10 21:23 - 2017-06-29 18:54 - 001780616 _____ (DTS) C:\WINDOWS\system32\DTSS2SpeakerDLL64.dll
2018-11-10 21:23 - 2017-06-29 18:54 - 001591056 _____ (DTS) C:\WINDOWS\system32\DTSS2HeadphoneDLL64.dll
2018-11-10 21:23 - 2017-06-29 18:54 - 000727432 _____ (DTS) C:\WINDOWS\system32\DTSSymmetryDLL64.dll
2018-11-10 21:23 - 2017-06-29 18:54 - 000708312 _____ (DTS) C:\WINDOWS\system32\DTSVoiceClarityDLL64.dll
2018-11-10 21:23 - 2017-06-29 18:54 - 000514520 _____ (DTS) C:\WINDOWS\system32\DTSU2PLFX64.dll
2018-11-10 21:23 - 2017-06-29 18:54 - 000500552 _____ (DTS) C:\WINDOWS\system32\DTSU2PGFX64.dll
2018-11-10 21:23 - 2017-06-29 18:54 - 000428224 _____ (DTS) C:\WINDOWS\system32\DTSU2PREC64.dll
2018-11-10 21:23 - 2017-06-29 18:53 - 005346992 _____ (Dolby Laboratories) C:\WINDOWS\system32\DolbyDAX2APOv211.dll
2018-11-10 21:23 - 2017-06-29 18:53 - 002444680 _____ (Dolby Laboratories) C:\WINDOWS\system32\DolbyDAX2APOv201.dll
2018-11-10 21:23 - 2017-06-29 18:53 - 001965808 _____ (Dolby Laboratories) C:\WINDOWS\system32\DDPD64A.dll
2018-11-10 21:23 - 2017-06-29 18:53 - 001959600 _____ (Dolby Laboratories) C:\WINDOWS\system32\DDPD64AF3.dll
2018-11-10 21:23 - 2017-06-29 18:53 - 001616680 _____ (Conexant Systems Inc.) C:\WINDOWS\system32\CX64APO.dll
2018-11-10 21:23 - 2017-06-29 18:53 - 001554600 _____ (Dolby Laboratories) C:\WINDOWS\system32\DAX3APOProp.dll
2018-11-10 21:23 - 2017-06-29 18:53 - 001529136 _____ (Conexant Systems Inc.) C:\WINDOWS\system32\CX64Proxy.dll
2018-11-10 21:23 - 2017-06-29 18:53 - 001508928 _____ (DTS) C:\WINDOWS\system32\DTSBoostDLL64.dll
2018-11-10 21:23 - 2017-06-29 18:53 - 001326424 _____ (Dolby Laboratories) C:\WINDOWS\system32\DAX3APOv251.dll
2018-11-10 21:23 - 2017-06-29 18:53 - 001170872 _____ (Dolby Laboratories) C:\WINDOWS\system32\DolbyDAX2APOvlldp.dll
2018-11-10 21:23 - 2017-06-29 18:53 - 000743960 _____ (DTS) C:\WINDOWS\system32\DTSBassEnhancementDLL64.dll
2018-11-10 21:23 - 2017-06-29 18:53 - 000504304 _____ (DTS) C:\WINDOWS\system32\DTSNeoPCDLL64.dll
2018-11-10 21:23 - 2017-06-29 18:53 - 000445392 _____ (DTS) C:\WINDOWS\system32\DTSLimiterDLL64.dll
2018-11-10 21:23 - 2017-06-29 18:53 - 000441264 _____ (DTS) C:\WINDOWS\system32\DTSGainCompensatorDLL64.dll
2018-11-10 21:23 - 2017-06-29 18:53 - 000362048 _____ (Dolby Laboratories) C:\WINDOWS\system32\DDPO64AF3.dll
2018-11-10 21:23 - 2017-06-29 18:53 - 000327448 _____ (Dolby Laboratories) C:\WINDOWS\system32\DDPO64A.dll
2018-11-10 21:23 - 2017-06-29 18:53 - 000310416 _____ (Dolby Laboratories) C:\WINDOWS\system32\DDPA64F3.dll
2018-11-10 21:23 - 2017-06-29 18:53 - 000272712 _____ (Dolby Laboratories) C:\WINDOWS\system32\DDPA64.dll
2018-11-10 21:23 - 2017-06-29 18:53 - 000253896 _____ (DTS) C:\WINDOWS\system32\DTSGFXAPO64.dll
2018-11-10 21:23 - 2017-06-29 18:53 - 000253864 _____ (DTS) C:\WINDOWS\system32\DTSLFXAPO64.dll
2018-11-10 21:23 - 2017-06-29 18:53 - 000252872 _____ (DTS) C:\WINDOWS\system32\DTSGFXAPONS64.dll
2018-11-10 21:23 - 2017-06-29 18:52 - 000574752 _____ (Andrea Electronics Corporation) C:\WINDOWS\system32\AERTAC64.dll
2018-11-10 21:23 - 2017-06-29 18:52 - 000118592 _____ (Andrea Electronics Corporation) C:\WINDOWS\system32\AERTAR64.dll
2018-11-10 21:23 - 2017-06-29 18:51 - 007096184 _____ (Dolby Laboratories) C:\WINDOWS\system32\DDPP64A.dll
2018-11-10 21:23 - 2017-06-29 18:51 - 006264632 _____ (Dolby Laboratories) C:\WINDOWS\system32\DDPP64AF3.dll
2018-11-10 21:23 - 2017-06-29 18:51 - 001133064 _____ (Dolby Laboratories) C:\WINDOWS\system32\DolbyDAX2APOProp.dll
2018-11-10 21:23 - 2017-06-29 18:51 - 000154360 _____ (Harman) C:\WINDOWS\system32\HarmanAudioInterface.dll
2018-11-10 21:23 - 2017-06-29 18:50 - 000122320 _____ (Real Sound Lab SIA) C:\WINDOWS\system32\CONEQMSAPOGUILibrary.dll
2018-11-10 21:23 - 2017-06-29 18:50 - 000118584 _____ C:\WINDOWS\system32\AcpiServiceVnA64.dll
2018-11-10 21:23 - 2017-06-29 18:50 - 000105304 _____ C:\WINDOWS\system32\audioLibVc.dll
2018-11-10 21:22 - 2018-11-10 21:22 - 000000000 ___HD C:\Program Files (x86)\InstallShield Installation Information
2018-11-10 21:22 - 2016-09-22 14:55 - 002839520 _____ (Realtek Semiconductor Corp.) C:\WINDOWS\RtlExUpd.dll
2018-11-10 21:14 - 2018-11-10 21:15 - 264424269 _____ (Realtek Semiconductor Corp.) C:\Users\Dad\Desktop\0009-64bit_Win7_Win8_Win81_Win10_R282.exe
2018-11-08 19:31 - 2018-11-08 19:31 - 000001783 _____ C:\Users\Public\Desktop\iTunes.lnk
2018-11-08 19:31 - 2018-11-08 19:31 - 000000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\iTunes
2018-11-08 19:31 - 2018-11-08 19:31 - 000000000 ____D C:\Program Files\iPod
2018-11-08 19:30 - 2018-11-08 19:31 - 000000000 ____D C:\Program Files\iTunes
2018-11-06 11:06 - 2018-11-06 11:06 - 000045024 _____ (The OpenVPN Project) C:\WINDOWS\system32\Drivers\tapexpressvpn.sys
2018-11-01 15:06 - 2018-11-01 15:06 - 000001238 _____ C:\Users\Public\Desktop\SoundTap Streaming Audio Recorder.lnk
2018-10-31 20:35 - 2018-10-31 20:34 - 000110968 _____ (Oracle Corporation) C:\WINDOWS\SysWOW64\WindowsAccessBridge-64.dll
2018-10-30 16:59 - 2018-10-30 16:59 - 000000000 ____D C:\Users\Dad\AppData\Local\Logishrd
2018-10-30 16:58 - 2018-10-30 16:58 - 000000000 ____D C:\Users\Dad\AppData\Roaming\sp6_log
2018-10-26 13:25 - 2018-10-26 13:25 - 005127680 _____ C:\Users\Dad\Desktop\0409_E10694_X540S_X540L_B.pdf

==================== One Month Modified files and folders ========

(If an entry is included in the fixlist, the file/folder will be moved.)

2018-11-19 10:52 - 2018-07-12 17:02 - 000000000 ____D C:\FRST
2018-11-19 10:52 - 2017-12-07 20:35 - 000628263 _____ C:\WINDOWS\ZAM_Guard.krnl.trace
2018-11-19 10:50 - 2018-07-12 16:57 - 000032663 _____ C:\WINDOWS\Tweaking.com - Registry Backup Setup Log.txt
2018-11-19 10:50 - 2017-09-25 10:36 - 000002315 _____ C:\Users\Public\Desktop\Tweaking.com - Registry Backup.lnk
2018-11-19 10:47 - 2018-04-11 17:38 - 000000000 ____D C:\ProgramData\regid.1991-06.com.microsoft
2018-11-19 10:41 - 2016-11-26 04:03 - 000000000 ____D C:\Users\Dad\AppData\LocalLow\Mozilla
2018-11-19 10:22 - 2018-02-25 21:12 - 000000000 ____D C:\Users\Dad\AppData\Local\CrashDumps
2018-11-19 10:07 - 2018-08-24 07:20 - 000000000 ____D C:\WINDOWS\system32\SleepStudy
2018-11-19 08:09 - 2018-08-24 09:00 - 000838560 _____ C:\WINDOWS\system32\PerfStringBackup.INI
2018-11-19 08:09 - 2018-04-11 17:36 - 000000000 ____D C:\WINDOWS\INF
2018-11-19 01:19 - 2017-11-29 17:39 - 000000000 ____D C:\Users\Dad\Downloads\New folder 2017
2018-11-18 13:10 - 2018-08-14 15:03 - 000000000 ____D C:\Users\Dad\Desktop\New folder (2)
2018-11-18 13:08 - 2017-09-27 17:00 - 000000000 ____D C:\Users\Dad\Desktop\greeson17
2018-11-18 13:04 - 2017-10-25 17:28 - 000000000 ____D C:\Users\Dad\Desktop\Deer Cams
2018-11-18 13:00 - 2018-04-10 07:29 - 000131135 _____ C:\Users\Dad\Downloads\725ec3afe5dd44187a4cf7617fe12bf8.zip
2018-11-18 13:00 - 2016-01-05 01:03 - 000000000 ___RD C:\Users\Dad\Downloads\DeviceDoctor.WinOpener_mkdtfchztkfbm!App
2018-11-18 11:28 - 2018-08-24 09:08 - 000004148 _____ C:\WINDOWS\System32\Tasks\User_Feed_Synchronization-{7E7F596B-AAC6-435F-B4E6-35ACBDC689CA}
2018-11-18 10:49 - 2018-04-11 17:30 - 000000000 ____D C:\WINDOWS\CbsTemp
2018-11-18 07:27 - 2018-02-02 09:35 - 000000000 ___RD C:\Users\Dad\3D Objects
2018-11-18 02:43 - 2017-06-05 16:14 - 000000000 ____D C:\ProgramData\Package Cache
2018-11-18 01:09 - 2018-04-11 17:38 - 000000000 ____D C:\WINDOWS\LiveKernelReports
2018-11-17 18:21 - 2018-04-11 17:38 - 000000000 ___HD C:\Program Files\WindowsApps
2018-11-17 18:21 - 2018-04-11 17:38 - 000000000 ____D C:\WINDOWS\AppReadiness
2018-11-16 21:14 - 2017-06-10 23:52 - 000000000 ____D C:\ProgramData\Oracle
2018-11-16 21:13 - 2018-07-17 16:56 - 000000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Java
2018-11-16 21:13 - 2018-07-17 16:56 - 000000000 ____D C:\Program Files (x86)\Java
2018-11-16 20:48 - 2018-08-24 09:08 - 000000006 ____H C:\WINDOWS\Tasks\SA.DAT
2018-11-16 20:46 - 2018-08-24 07:26 - 000000000 ____D C:\Users\Dad
2018-11-16 20:17 - 2017-06-19 12:37 - 000002380 _____ C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Google Chrome.lnk
2018-11-16 14:59 - 2017-10-01 00:20 - 000000000 ____D C:\Program Files\rempl
2018-11-16 01:24 - 2018-02-02 09:56 - 000000000 ____D C:\Users\Dad\AppData\Local\PlaceholderTileLogoFolder
2018-11-16 00:54 - 2018-02-02 03:14 - 000000000 ____D C:\Users\Dad\AppData\Local\Packages
2018-11-15 13:15 - 2018-08-24 09:08 - 000002856 _____ C:\WINDOWS\System32\Tasks\OneDrive Standalone Update Task-S-1-5-21-2107755742-302254199-1763176924-1001
2018-11-15 13:15 - 2018-08-24 07:26 - 000002364 _____ C:\Users\Dad\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\OneDrive.lnk
2018-11-15 13:15 - 2015-12-31 11:53 - 000000000 ___RD C:\Users\Dad\OneDrive
2018-11-15 11:07 - 2017-08-18 03:20 - 000000000 ____D C:\Users\Dad\Desktop\NCH Recordings
2018-11-14 01:22 - 2018-08-24 09:08 - 000004570 _____ C:\WINDOWS\System32\Tasks\Adobe Flash Player NPAPI Notifier
2018-11-14 01:22 - 2018-08-24 09:08 - 000004422 _____ C:\WINDOWS\System32\Tasks\Adobe Flash Player Updater
2018-11-14 01:22 - 2018-04-11 17:38 - 000000000 ____D C:\WINDOWS\SysWOW64\Macromed
2018-11-14 00:31 - 2015-12-31 11:50 - 000000000 __RHD C:\Users\Public\AccountPictures
2018-11-14 00:30 - 2018-08-24 07:20 - 000243064 _____ C:\WINDOWS\system32\FNTCACHE.DAT
2018-11-14 00:11 - 2018-04-11 17:38 - 000000000 ___SD C:\WINDOWS\SysWOW64\F12
2018-11-14 00:11 - 2018-04-11 17:38 - 000000000 ___SD C:\WINDOWS\system32\F12
2018-11-14 00:11 - 2018-04-11 17:38 - 000000000 ___RD C:\WINDOWS\ImmersiveControlPanel
2018-11-14 00:11 - 2018-04-11 17:38 - 000000000 ____D C:\WINDOWS\TextInput
2018-11-14 00:11 - 2018-04-11 17:38 - 000000000 ____D C:\WINDOWS\system32\ShellExperiences
2018-11-14 00:11 - 2018-04-11 17:38 - 000000000 ____D C:\WINDOWS\ShellExperiences
2018-11-14 00:11 - 2018-04-11 17:38 - 000000000 ____D C:\WINDOWS\bcastdvr
2018-11-13 20:48 - 2017-06-06 00:21 - 000000000 ____D C:\WINDOWS\system32\MRT
2018-11-13 20:45 - 2017-06-06 00:21 - 137810048 ____C (Microsoft Corporation) C:\WINDOWS\system32\MRT.exe
2018-11-12 20:37 - 2017-06-05 23:45 - 000000000 ____D C:\Program Files (x86)\NCH Software
2018-11-12 20:35 - 2018-08-24 09:08 - 000000000 ____D C:\WINDOWS\System32\Tasks\NCH Software
2018-11-12 20:35 - 2017-06-05 23:45 - 000000000 ____D C:\Users\Dad\AppData\Roaming\NCH Software
2018-11-12 20:30 - 2018-10-18 16:24 - 000000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Wondershare
2018-11-12 20:30 - 2018-05-04 07:04 - 000000000 ____D C:\ProgramData\Wondershare
2018-11-10 21:26 - 2018-04-11 15:04 - 000524288 _____ C:\WINDOWS\system32\config\BBI
2018-11-10 21:26 - 2017-12-10 11:36 - 000000000 ___HD C:\Program Files (x86)\Temp
2018-11-10 21:25 - 2017-12-10 11:39 - 000000000 ____D C:\WINDOWS\system32\DAX3
2018-11-10 21:25 - 2017-12-10 11:39 - 000000000 ____D C:\WINDOWS\system32\DAX2
2018-11-10 21:25 - 2017-12-10 11:38 - 000000000 ____D C:\WINDOWS\SysWOW64\RTCOM
2018-11-10 21:17 - 2017-12-10 11:37 - 000000000 ____D C:\Program Files (x86)\Realtek
2018-11-09 21:21 - 2017-06-12 14:50 - 000000000 ____D C:\Users\Dad\AppData\Local\ElevatedDiagnostics
2018-11-09 17:03 - 2018-08-24 09:08 - 000004210 _____ C:\WINDOWS\System32\Tasks\CCleaner Update
2018-11-06 19:03 - 2017-10-08 08:27 - 000000000 ____D C:\Program Files\CCleaner
2018-11-03 19:48 - 2017-06-04 23:57 - 000000000 ____D C:\Program Files\Common Files\logishrd
2018-11-03 19:47 - 2017-10-09 02:20 - 000000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Logitech
2018-11-03 19:47 - 2017-06-05 15:39 - 000000000 ____D C:\ProgramData\LogiShrd
2018-11-01 15:06 - 2017-06-05 23:45 - 000054664 _____ C:\WINDOWS\system32\Drivers\stdriverx64.sys
2018-11-01 15:06 - 2017-06-05 23:45 - 000001366 _____ C:\Users\Public\Desktop\NCH Suite.lnk
2018-11-01 15:06 - 2017-06-05 23:45 - 000001250 _____ C:\ProgramData\Microsoft\Windows\Start Menu\Programs\SoundTap Streaming Audio Recorder.lnk
2018-10-31 20:35 - 2018-08-23 12:20 - 000000000 ____D C:\Program Files\Java
2018-10-31 20:34 - 2018-08-23 12:21 - 000110968 _____ (Oracle Corporation) C:\WINDOWS\system32\WindowsAccessBridge-64.dll
2018-10-31 20:33 - 2018-07-17 16:56 - 000098680 _____ (Oracle Corporation) C:\WINDOWS\SysWOW64\WindowsAccessBridge-32.dll
2018-10-29 00:41 - 2018-09-28 00:58 - 000152688 _____ (Malwarebytes) C:\WINDOWS\system32\Drivers\mbae64.sys
2018-10-27 11:47 - 2018-09-05 16:44 - 000000000 ____D C:\Users\Dad\AppData\Roaming\Maxthon5
2018-10-23 14:30 - 2018-02-07 09:36 - 000000000 ____D C:\Users\Dad\Desktop\screenshots
2018-10-22 16:50 - 2018-03-04 18:41 - 000000000 ____D C:\WINDOWS\system32\Drivers\wd
2018-10-21 23:59 - 2018-02-21 12:07 - 000028272 _____ C:\WINDOWS\system32\Drivers\TrueSight.sys

==================== Files in the root of some directories =======

2017-06-05 23:45 - 2018-05-22 07:40 - 000001167 _____ () C:\Users\Dad\AppData\Roaming\trace_FilterInstaller.1.txt
2017-06-05 23:45 - 2018-05-02 11:15 - 000001167 _____ () C:\Users\Dad\AppData\Roaming\trace_FilterInstaller.2.txt
2017-06-05 23:45 - 2017-06-05 23:56 - 000001167 _____ () C:\Users\Dad\AppData\Roaming\trace_FilterInstaller.3.txt
2017-06-05 23:45 - 2017-06-05 23:45 - 000001167 _____ () C:\Users\Dad\AppData\Roaming\trace_FilterInstaller.4.txt
2017-06-05 23:45 - 2018-08-10 22:07 - 000001167 _____ () C:\Users\Dad\AppData\Roaming\trace_FilterInstaller.txt
2017-06-05 23:45 - 2018-08-10 22:07 - 000000000 _____ () C:\Users\Dad\AppData\Roaming\trace_FilterInstaller.txt-CRT.txt
2018-04-10 00:22 - 2018-04-10 00:22 - 000000875 _____ () C:\Users\Dad\AppData\Local\recently-used.xbel
2018-09-10 20:37 - 2018-09-13 07:57 - 000003111 _____ () C:\Users\Dad\AppData\Local\Temptoast_image.png
2018-02-09 19:50 - 2018-02-09 19:50 - 000000003 _____ () C:\Users\Dad\AppData\Local\updater.log
2018-02-09 19:50 - 2018-02-12 04:33 - 000000059 _____ () C:\Users\Dad\AppData\Local\UserProducts.xml

Some files in TEMP:
====================
2018-11-16 20:16 - 2018-11-16 20:16 - 001130840 _____ (Google Inc.) C:\Users\Dad\AppData\Local\Temp\ChromeSetup.exe
2018-11-12 16:56 - 2018-11-12 16:56 - 000392704 _____ () C:\Users\Dad\AppData\Local\Temp\dfrF453.tmp.dll
2018-11-16 20:45 - 2018-11-18 02:43 - 000258048 _____ (ExpressVPN) C:\Users\Dad\AppData\Local\Temp\ExpressVpn.Client.Setup.Helper.exe

==================== Bamital & volsnap ======================

(There is no automatic fix for files that do not pass verification.)

C:\WINDOWS\system32\winlogon.exe => File is digitally signed
C:\WINDOWS\system32\wininit.exe => File is digitally signed
C:\WINDOWS\explorer.exe => File is digitally signed
C:\WINDOWS\SysWOW64\explorer.exe => File is digitally signed
C:\WINDOWS\system32\svchost.exe => File is digitally signed
C:\WINDOWS\SysWOW64\svchost.exe => File is digitally signed
C:\WINDOWS\system32\services.exe => File is digitally signed
C:\WINDOWS\system32\User32.dll => File is digitally signed
C:\WINDOWS\SysWOW64\User32.dll => File is digitally signed
C:\WINDOWS\system32\userinit.exe => File is digitally signed
C:\WINDOWS\SysWOW64\userinit.exe => File is digitally signed
C:\WINDOWS\system32\rpcss.dll => File is digitally signed
C:\WINDOWS\system32\dnsapi.dll => File is digitally signed
C:\WINDOWS\SysWOW64\dnsapi.dll => File is digitally signed
C:\WINDOWS\system32\Drivers\volsnap.sys => File is digitally signed

LastRegBack: 2018-08-24 07:20

==================== End of FRST.txt ============================

Additional scan result of Farbar Recovery Scan Tool (x64) Version: 15.11.2018
Ran by Dad (19-11-2018 10:54:32)
Running from C:\Users\Dad\Desktop
Windows 10 Home Version 1803 17134.407 (X64) (2018-08-24 15:10:22)
Boot Mode: Normal
==========================================================


==================== Accounts: =============================

Administrator (S-1-5-21-2107755742-302254199-1763176924-500 - Administrator - Disabled)
Dad (S-1-5-21-2107755742-302254199-1763176924-1001 - Administrator - Enabled) => C:\Users\Dad
DefaultAccount (S-1-5-21-2107755742-302254199-1763176924-503 - Limited - Disabled)
Guest (S-1-5-21-2107755742-302254199-1763176924-501 - Limited - Disabled)
HomeGroupUser$ (S-1-5-21-2107755742-302254199-1763176924-1005 - Limited - Enabled)
WDAGUtilityAccount (S-1-5-21-2107755742-302254199-1763176924-504 - Limited - Disabled)

==================== Security Center ========================

(If an entry is included in the fixlist, it will be removed.)

AV: Windows Defender (Enabled - Up to date) {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
AS: Windows Defender (Enabled - Up to date) {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}

==================== Installed Programs ======================

(Only the adware programs with "Hidden" flag could be added to the fixlist to unhide them. The adware programs should be uninstalled manually.)

Adobe Flash Player 31 NPAPI (HKLM-x32\...\Adobe Flash Player NPAPI) (Version: 31.0.0.148 - Adobe Systems Incorporated)
Apple Application Support (32-bit) (HKLM-x32\...\{49F7DD82-FC83-48BF-86C6-CFE6E1E233E1}) (Version: 7.1 - Apple Inc.)
Apple Application Support (64-bit) (HKLM\...\{1FA68E27-2951-42E8-9F57-1A7F6581B4FD}) (Version: 7.1 - Apple Inc.)
Apple Mobile Device Support (HKLM\...\{5FA8C4BE-8C74-4B9C-9B49-EBF759230189}) (Version: 12.1.0.25 - Apple Inc.)
Apple Software Update (HKLM-x32\...\{A30EA700-5515-48F0-88B0-9E99DC356B88}) (Version: 2.6.0.1 - Apple Inc.)
Bonjour (HKLM\...\{56DDDFB8-7F79-4480-89D5-25E1F52AB28F}) (Version: 3.1.0.1 - Apple Inc.)
CameraHelperMsi (HKLM-x32\...\{15634701-BACE-4449-8B25-1567DA8C9FD3}) (Version: 13.51.815.0 - Logitech) Hidden
CCleaner (HKLM\...\CCleaner) (Version: 5.43 - Piriform)
Dwyco CDC-X version 2.17 (HKU\S-1-5-21-2107755742-302254199-1763176924-1001\...\Dwyco CDC-X_is1) (Version: 2.17 - Dwyco, Inc.)
Easy Thumbnails (Remove only) (HKLM-x32\...\Easy Thumbnails_is1) (Version: 3.0 - Fookes Software)
erLT (HKLM-x32\...\{3EE9BCAE-E9A9-45E5-9B1C-83A4D357E05C}) (Version: 1.20.138.34 - Logitech, Inc.) Hidden
Freemake Video Converter version 4.1.10 (HKLM-x32\...\Freemake Video Converter_is1) (Version: 4.1.10 - Ellora Assets Corporation)
Google Chrome (HKLM-x32\...\Google Chrome) (Version: 70.0.3538.102 - Google Inc.)
Google Update Helper (HKLM-x32\...\{60EC980A-BDA2-4CB6-A427-B07A5498B4CA}) (Version: 1.3.33.17 - Google Inc.) Hidden
iTunes (HKLM\...\{3F702C1B-628F-46FB-A094-56D5404CEE63}) (Version: 12.9.1.4 - Apple Inc.)
Java 8 Update 111 (HKLM-x32\...\{26A24AE4-039D-4CA4-87B4-2F32180111F0}) (Version: 8.0.1110.14 - Oracle Corporation)
Java 8 Update 191 (64-bit) (HKLM\...\{26A24AE4-039D-4CA4-87B4-2F64180191F0}) (Version: 8.0.1910.12 - Oracle Corporation)
Java 8 Update 191 (HKLM-x32\...\{26A24AE4-039D-4CA4-87B4-2F32180191F0}) (Version: 8.0.1910.12 - Oracle Corporation)
KaraFun Player 2 (HKLM-x32\...\KaraFun Player 2_is1) (Version: 2.6.0.9 - Recisio)
Logitech Webcam Software (HKLM-x32\...\{D40EB009-0499-459c-A8AF-C9C110766215}) (Version: 2.80 - Logitech Inc.)
Malwarebytes version 3.6.1.2711 (HKLM\...\{35065F43-4BB2-439A-BFF7-0F1014F2E0CD}_is1) (Version: 3.6.1.2711 - Malwarebytes)
Microsoft OneDrive (HKU\S-1-5-21-2107755742-302254199-1763176924-1001\...\OneDriveSetup.exe) (Version: 18.192.0920.0015 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.17 (HKLM\...\{8220EEFE-38CD-377E-8595-13398D740ACE}) (Version: 9.0.30729 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.6161 (HKLM\...\{5FCE6D76-F5DC-37AB-B2B8-22AB8CEDB1D4}) (Version: 9.0.30729.6161 - Microsoft Corporation)
Microsoft Visual C++ 2010 x86 Redistributable - 10.0.40219 (HKLM-x32\...\{F0C3E5D1-1ADE-321E-8167-68EF0DE699A5}) (Version: 10.0.40219 - Microsoft Corporation)
Microsoft Visual C++ 2013 Redistributable (x64) - 12.0.30501 (HKLM-x32\...\{050d4fc8-5d48-4b8f-8972-47c82c46020f}) (Version: 12.0.30501.0 - Microsoft Corporation)
Microsoft Visual C++ 2013 Redistributable (x86) - 12.0.30501 (HKLM-x32\...\{f65db027-aff3-4070-886a-0d87064aabb1}) (Version: 12.0.30501.0 - Microsoft Corporation)
Microsoft Visual C++ 2015 Redistributable (x86) - 14.0.24215 (HKLM-x32\...\{e2803110-78b3-4664-a479-3611a381656a}) (Version: 14.0.24215.1 - Microsoft Corporation)
Mozilla Firefox 40.0 (x86 en-US) (HKLM-x32\...\Mozilla Firefox 40.0 (x86 en-US)) (Version: 40.0 - Mozilla)
Mozilla Firefox 52.9.0 ESR (x64 en-US) (HKLM\...\Mozilla Firefox 52.9.0 ESR (x64 en-US)) (Version: 52.9.0 - Mozilla)
Mozilla Maintenance Service (HKLM\...\MozillaMaintenanceService) (Version: 60.1.0 - Mozilla)
Mozilla Maintenance Service (HKLM-x32\...\MozillaMaintenanceService) (Version: 40.0 - Mozilla)
MX5 (HKLM-x32\...\Maxthon5) (Version: 5.2.4.3000 - Maxthon International Limited)
Paltalk (HKLM-x32\...\Paltalk) (Version: - )
QuickBooks Online Edition Utilities V11 (HKLM-x32\...\{06346CB3-EB19-4CD8-8DDC-3C46EA2785A0}) (Version: 1.0.0 - Intuit)
Realtek High Definition Audio Driver (HKLM-x32\...\{F132AF7F-7BCA-4EDE-8A7C-958108FE7DBC}) (Version: 6.0.1.8186 - Realtek Semiconductor Corp.)
Samsung USB Driver for Mobile Phones (HKLM\...\{D0795B21-0CDA-4a92-AB9E-6E92D8111E44}) (Version: 1.5.65.0 - Samsung Electronics Co., Ltd.)
SD Card Formatter (HKLM-x32\...\{10C16E01-F739-4093-89A7-E570589FA0F6}) (Version: 5.0.0 - SD Association)
SeaMonkey 2.49.4 (x86 en-US) (HKLM-x32\...\SeaMonkey 2.49.4 (x86 en-US)) (Version: 2.49.4 - Mozilla)
Skype™ 7.40 (HKLM-x32\...\{3B7E914A-93D5-4A29-92BB-AF8C3F66C431}) (Version: 7.40.103 - Skype Technologies S.A.)
SoundTap Streaming Audio Recorder (HKLM-x32\...\SoundTap) (Version: 5.06 - NCH Software)
TunnelBear (HKLM-x32\...\{58a01650-b45c-443b-a51e-90f586a63532}) (Version: 3.7.2.0 - TunnelBear)
TunnelBear (HKLM-x32\...\{C7E7F8CF-E23A-4FC1-8AAC-8710A70490E3}) (Version: 3.7.2.0 - TunnelBear) Hidden
Tweaking.com - Registry Backup (HKLM-x32\...\Tweaking.com - Registry Backup) (Version: 3.5.3 - Tweaking.com)
Tweaking.com - Windows Repair (HKLM-x32\...\Tweaking.com - Windows Repair) (Version: 4.0.19 - Tweaking.com)
Update for Windows 10 for x64-based Systems (KB4023057) (HKLM\...\{C5FDDED7-DEC7-48B4-AFD8-DFB8A0FD199A}) (Version: 2.51.0.0 - Microsoft Corporation)
UpdateAssistant (HKLM-x32\...\{7C070E60-8769-4763-BBD8-7537A28A60D4}) (Version: 1.10.0.0 - Microsoft Corporation) Hidden
vanBasco's Karaoke Player (HKLM-x32\...\VMidi) (Version: - )
VideoPad Video Editor (HKLM-x32\...\VideoPad) (Version: 6.10 - NCH Software)
Voxal Voice Changer (HKLM-x32\...\Voxal) (Version: 3.00 - NCH Software)
WavePad Sound Editor (HKLM-x32\...\WavePad) (Version: 8.13 - NCH Software)
Windows 10 Update Assistant (HKLM-x32\...\{D5C69738-B486-402E-85AC-2456D98A64E4}) (Version: 1.4.9200.22391 - Microsoft Corporation)

==================== Custom CLSID (Whitelisted): ==========================

(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)

ShellIconOverlayIdentifiers: [00asw] -> {472083B0-C522-11CF-8763-00608CC02F24} => -> No File
ContextMenuHandlers3: [MBAMShlExt] -> {57CE581A-0CB6-4266-9CA0-19364C90A0B3} => C:\Program Files\Malwarebytes\Anti-Malware\mbshlext.dll [2018-09-19] (Malwarebytes)
ContextMenuHandlers4: [Offline Files] -> {474C98EE-CF3D-41f5-80E3-4AAB0AB04301} => -> No File
ContextMenuHandlers5: [igfxcui] -> {3AB1675A-CCFF-11D2-8B20-00A0C93CB1F4} => C:\WINDOWS\system32\igfxpph.dll [2017-03-09] (Intel Corporation)
ContextMenuHandlers6: [BriefcaseMenu] -> {85BBD920-42A0-1069-A2E4-08002B30309D} => -> No File
ContextMenuHandlers6: [MBAMShlExt] -> {57CE581A-0CB6-4266-9CA0-19364C90A0B3} => C:\Program Files\Malwarebytes\Anti-Malware\mbshlext.dll [2018-09-19] (Malwarebytes)
ContextMenuHandlers6: [Offline Files] -> {474C98EE-CF3D-41f5-80E3-4AAB0AB04301} => -> No File

==================== Scheduled Tasks (Whitelisted) =============

(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)

Task: {13941925-1A2B-46B3-9347-752B9F51CA8E} - System32\Tasks\Maxthon5 Update => C:\Program Files (x86)\Maxthon5\Bin\Maxthon.exe [2018-10-04] (Maxthon International ltd.)
Task: {18E61CDA-83AA-49D1-943F-14A92ECCD261} - System32\Tasks\Adobe Flash Player Updater => C:\WINDOWS\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe [2018-11-14] (Adobe Systems Incorporated)
Task: {2346F721-A9D9-4A64-8DA2-AE86F27DE23A} - System32\Tasks\CreateExplorerShellUnelevatedTask => C:\WINDOWS\explorer.exe /NOUACCHECK
Task: {2430C92A-CB91-4DF8-AE98-2F6BD8F956DB} - System32\Tasks\Apple\AppleSoftwareUpdate => C:\Program Files (x86)\Apple Software Update\SoftwareUpdate.exe [2018-01-08] (Apple Inc.)
Task: {2D7A650A-EC04-407D-BC12-E8C4CB5C8C87} - System32\Tasks\NCH Software\VoxalDowngrade => C:\Program Files (x86)\NCH Software\Voxal\voxal.exe [2018-07-13] (NCH Software)
Task: {2F17D672-7379-4759-BCE5-2383DFD24B2B} - System32\Tasks\Microsoft\Windows\Windows Defender\Windows Defender Cleanup => C:\ProgramData\Microsoft\Windows Defender\platform\4.18.1810.5-0\MpCmdRun.exe [2018-10-22] (Microsoft Corporation)
Task: {37F4D2E2-0574-4037-BD0A-94B879EBF583} - System32\Tasks\GoogleUpdateTaskMachineUA => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe [2017-06-19] (Google Inc.)
Task: {491AB039-0341-4956-83F6-3106AC11F233} - System32\Tasks\update-sys => C:\Program Files (x86)\Skillbrains\Updater\Updater.exe [2017-04-12] (TODO: <Company name>)
Task: {49BDBEAD-9367-4FBA-9858-3F2B673002A5} - System32\Tasks\NCH Software\SoundTapSevenDays => C:\Program Files (x86)\NCH Software\SoundTap\SoundTap.exe [2018-11-01] (NCH Software)
Task: {65B85F6F-35B3-4459-A179-28255D5B7B25} - System32\Tasks\Microsoft\Windows\HelloFace\FODCleanupTask => C:\WINDOWS\System32\WinBioPlugIns\FaceFodUninstaller.exe [2018-04-11] ()
Task: {7C43A385-1BAC-464C-A893-7B78BBA60157} - System32\Tasks\Microsoft\Windows\Windows Defender\Windows Defender Cache Maintenance => C:\ProgramData\Microsoft\Windows Defender\platform\4.18.1810.5-0\MpCmdRun.exe [2018-10-22] (Microsoft Corporation)
Task: {7D738910-14A4-4408-9B42-521F259B2A0D} - System32\Tasks\CCleanerSkipUAC => C:\Program Files\CCleaner\CCleaner.exe [2018-11-06] (Piriform Ltd)
Task: {90410327-3FDA-489E-A835-D72B23D4D45D} - System32\Tasks\Adobe Flash Player NPAPI Notifier => C:\WINDOWS\SysWOW64\Macromed\Flash\FlashUtil32_31_0_0_148_Plugin.exe [2018-11-14] (Adobe Systems Incorporated)
Task: {B0503919-9EAF-478E-8474-B463F64F275A} - System32\Tasks\update-S-1-5-21-2107755742-302254199-1763176924-1001 => C:\Program Files (x86)\Skillbrains\Updater\Updater.exe [2017-04-12] (TODO: <Company name>)
Task: {B26E32BD-3AE4-40CE-A370-4B84BF6C5637} - System32\Tasks\NCH Software\WavePadDowngrade => C:\Program Files (x86)\NCH Software\WavePad\wavepad.exe [2018-06-21] (NCH Software)
Task: {B7FE982C-F16F-4351-9D5A-8997CAA17840} - System32\Tasks\Tweaking.com - Windows Repair Tray Icon => C:\Program Files (x86)\Tweaking.com\Windows Repair (All in One)\WR_Tray_Icon.exe [2017-05-02] (Tweaking.com)
Task: {C876E438-10C0-4240-B01C-36D655881E82} - System32\Tasks\CCleaner Update => C:\Program Files\CCleaner\CCUpdate.exe [2018-05-15] (Piriform Ltd)
Task: {CBD83BA1-9AB6-45F1-A81A-D0F2E3D5411A} - System32\Tasks\Microsoft\Windows\Windows Defender\Windows Defender Scheduled Scan => C:\ProgramData\Microsoft\Windows Defender\platform\4.18.1810.5-0\MpCmdRun.exe [2018-10-22] (Microsoft Corporation)
Task: {E749E9EF-2C90-421D-A2AA-D920463EEED4} - System32\Tasks\GoogleUpdateTaskMachineCore => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe [2017-06-19] (Google Inc.)
Task: {EAD676B9-FAC8-433E-A5C7-773A1A14CC22} - System32\Tasks\Microsoft\Windows\Windows Defender\Windows Defender Verification => C:\ProgramData\Microsoft\Windows Defender\platform\4.18.1810.5-0\MpCmdRun.exe [2018-10-22] (Microsoft Corporation)

(If an entry is included in the fixlist, the task (.job) file will be moved. The file which is running by the task will not be moved.)

Task: C:\WINDOWS\Tasks\CreateExplorerShellUnelevatedTask.job => C:\WINDOWS\explorer.exe
Task: C:\WINDOWS\Tasks\update-S-1-5-21-2107755742-302254199-1763176924-1001.job => C:\Program Files (x86)\Skillbrains\Updater\Updater.exe
Task: C:\WINDOWS\Tasks\update-sys.job => C:\Program Files (x86)\Skillbrains\Updater\Updater.exe

==================== Shortcuts & WMI ========================

(The entries could be listed to be restored or removed.)


Shortcut: C:\Users\Dad\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Paltalk\Remove settings.lnk -> C:\Program Files (x86)\Paltalk\ng_clean_settings.bat ()

ShortcutWithArgument: C:\Users\Dad\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Chrome Remote Desktop.lnk -> C:\Program Files (x86)\Google\Chrome\Application\chrome.exe (Google Inc.) -> --profile-directory=Default --app-id=gbchcmhmhahfdphkhkmpfmihenigjmpp

==================== Loaded Modules (Whitelisted) ==============

2017-11-30 18:54 - 2017-11-30 18:54 - 000088888 _____ () C:\Program Files\Common Files\Apple\Apple Application Support\zlib1.dll
2018-10-21 02:17 - 2018-10-21 02:17 - 001356088 _____ () C:\Program Files\Common Files\Apple\Apple Application Support\libxml2.dll
2018-09-28 00:58 - 2018-10-29 00:41 - 002695360 _____ () C:\PROGRAM FILES\MALWAREBYTES\ANTI-MALWARE\SelfProtectionSdk.dll
2018-04-11 17:34 - 2018-04-11 17:34 - 000491744 _____ () C:\WINDOWS\SYSTEM32\inputhost.dll
2018-04-11 17:34 - 2018-04-11 17:34 - 000472064 _____ () C:\Windows\ShellExperiences\TileControl.dll
2018-04-11 17:34 - 2018-04-11 17:34 - 002759168 _____ () C:\Windows\ShellComponents\TaskFlowUI.dll
2018-11-13 20:31 - 2018-11-01 00:55 - 002185216 _____ () C:\Windows\SystemApps\Microsoft.Windows.Cortana_cw5n1h2txyewy\Cortana.Core.dll
2018-06-21 20:14 - 2018-06-21 20:14 - 001922224 _____ () C:\Program Files\WindowsApps\Microsoft.MicrosoftOfficeHub_17.10314.31700.1000_x64__8wekyb3d8bbwe\Microsoft.Applications.Telemetry.Windows.dll
2017-03-09 00:16 - 2017-03-09 00:16 - 000112264 _____ () C:\Windows\System32\IccLibDll_x64.dll
2018-07-29 22:10 - 2018-07-24 14:03 - 000203760 _____ () C:\Program Files (x86)\Common Files\Freemake Shared\ProductUpdater\ProductUpdater.exe
2018-11-13 12:50 - 2018-11-13 12:50 - 000478720 _____ () C:\Program Files\WindowsApps\Microsoft.Windows.Photos_2018.18091.17210.0_x64__8wekyb3d8bbwe\Microsoft.Photos.exe
2018-11-13 12:50 - 2018-11-13 12:50 - 066031104 _____ () C:\Program Files\WindowsApps\Microsoft.Windows.Photos_2018.18091.17210.0_x64__8wekyb3d8bbwe\Microsoft.Photos.dll
2018-02-02 12:18 - 2018-02-02 12:19 - 002523136 _____ () C:\Program Files\WindowsApps\Microsoft.Windows.Photos_2018.18091.17210.0_x64__8wekyb3d8bbwe\UnityEngineDelegates.dll
2018-11-07 22:08 - 2018-11-07 22:08 - 000010752 _____ () C:\Program Files\WindowsApps\Microsoft.Windows.Photos_2018.18091.17210.0_x64__8wekyb3d8bbwe\RenderingPlugin.dll
2018-11-07 22:08 - 2018-11-07 22:08 - 003715072 _____ () C:\Program Files\WindowsApps\Microsoft.Windows.Photos_2018.18091.17210.0_x64__8wekyb3d8bbwe\MediaEngineCSWrapper.dll
2018-11-07 22:08 - 2018-11-07 22:08 - 000036352 _____ () C:\Program Files\WindowsApps\Microsoft.Windows.Photos_2018.18091.17210.0_x64__8wekyb3d8bbwe\WinMLWrapper.UWP.dll
2018-08-16 17:02 - 2018-08-16 17:03 - 002280960 _____ () C:\Program Files\WindowsApps\Microsoft.Windows.Photos_2018.18091.17210.0_x64__8wekyb3d8bbwe\opencv_core320.dll
2018-04-05 11:30 - 2018-04-05 11:30 - 002283008 _____ () C:\Program Files\WindowsApps\Microsoft.Windows.Photos_2018.18091.17210.0_x64__8wekyb3d8bbwe\TrackingDLLUWP.dll
2018-08-16 17:02 - 2018-08-16 17:03 - 002480640 _____ () C:\Program Files\WindowsApps\Microsoft.Windows.Photos_2018.18091.17210.0_x64__8wekyb3d8bbwe\opencv_imgproc320.dll
2018-11-13 12:50 - 2018-11-13 12:50 - 014097920 _____ () C:\Program Files\WindowsApps\Microsoft.Windows.Photos_2018.18091.17210.0_x64__8wekyb3d8bbwe\PhotosApp.Windows.dll
2018-11-07 22:08 - 2018-11-07 22:08 - 003569152 _____ () C:\Program Files\WindowsApps\Microsoft.Windows.Photos_2018.18091.17210.0_x64__8wekyb3d8bbwe\MediaEngine.dll
2018-11-13 12:50 - 2018-11-13 12:50 - 002863616 _____ () C:\Program Files\WindowsApps\Microsoft.Windows.Photos_2018.18091.17210.0_x64__8wekyb3d8bbwe\AppCore.Windows.dll
2018-08-28 17:41 - 2018-08-28 17:48 - 000973312 _____ () C:\Program Files\WindowsApps\Microsoft.Windows.Photos_2018.18091.17210.0_x64__8wekyb3d8bbwe\RuntimeConfiguration.dll
2018-07-26 23:53 - 2018-07-26 23:54 - 004584960 _____ () C:\Program Files\WindowsApps\Microsoft.Windows.Photos_2018.18091.17210.0_x64__8wekyb3d8bbwe\Microsoft.UI.Xaml.dll
2018-11-13 12:50 - 2018-11-13 12:50 - 000146432 _____ () C:\Program Files\WindowsApps\Microsoft.Windows.Photos_2018.18091.17210.0_x64__8wekyb3d8bbwe\SKU.dll
2018-10-29 17:09 - 2018-10-29 17:09 - 000030720 _____ () C:\Program Files (x86)\TunnelBear\TunnelBear.Maintenance.Wrapper.dll
2018-10-29 17:09 - 2018-10-29 17:09 - 000167424 _____ () C:\Program Files (x86)\TunnelBear\TunnelBear.VigilantBear.Wrapper.dll
2018-10-04 23:35 - 2018-10-04 23:35 - 003140896 _____ () C:\Program Files (x86)\Maxthon5\Core\libglesv2.dll
2018-10-04 23:35 - 2018-10-04 23:35 - 000092960 _____ () C:\Program Files (x86)\Maxthon5\Core\libegl.dll

==================== Alternate Data Streams (Whitelisted) =========

(If an entry is included in the fixlist, only the ADS will be removed.)


==================== Safe Mode (Whitelisted) ===================

(If an entry is included in the fixlist, it will be removed from the registry. The "AlternateShell" will be restored.)

HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\MBAMService => ""="Service"
HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\MBAMService => ""="Service"

==================== Association (Whitelisted) ===============

(If an entry is included in the fixlist, the registry item will be restored to default or removed.)


==================== Internet Explorer trusted/restricted ===============

(If an entry is included in the fixlist, it will be removed from the registry.)

IE trusted site: HKU\S-1-5-21-2107755742-302254199-1763176924-1001\...\localhost -> localhost
IE restricted site: HKU\S-1-5-21-2107755742-302254199-1763176924-1001\...\007guard.com -> install.007guard.com
IE restricted site: HKU\S-1-5-21-2107755742-302254199-1763176924-1001\...\008i.com -> 008i.com
IE restricted site: HKU\S-1-5-21-2107755742-302254199-1763176924-1001\...\008k.com -> www.008k.com
IE restricted site: HKU\S-1-5-21-2107755742-302254199-1763176924-1001\...\00hq.com -> www.00hq.com
IE restricted site: HKU\S-1-5-21-2107755742-302254199-1763176924-1001\...\010402.com -> 010402.com
IE restricted site: HKU\S-1-5-21-2107755742-302254199-1763176924-1001\...\032439.com -> 80gw6ry3i3x3qbrkwhxhw.032439.com
IE restricted site: HKU\S-1-5-21-2107755742-302254199-1763176924-1001\...\0scan.com -> www.0scan.com
IE restricted site: HKU\S-1-5-21-2107755742-302254199-1763176924-1001\...\1-2005-search.com -> www.1-2005-search.com
IE restricted site: HKU\S-1-5-21-2107755742-302254199-1763176924-1001\...\1-domains-registrations.com -> www.1-domains-registrations.com
IE restricted site: HKU\S-1-5-21-2107755742-302254199-1763176924-1001\...\1000gratisproben.com -> www.1000gratisproben.com
IE restricted site: HKU\S-1-5-21-2107755742-302254199-1763176924-1001\...\1001namen.com -> www.1001namen.com
IE restricted site: HKU\S-1-5-21-2107755742-302254199-1763176924-1001\...\100888290cs.com -> mir.100888290cs.com
IE restricted site: HKU\S-1-5-21-2107755742-302254199-1763176924-1001\...\100sexlinks.com -> www.100sexlinks.com
IE restricted site: HKU\S-1-5-21-2107755742-302254199-1763176924-1001\...\10sek.com -> www.10sek.com
IE restricted site: HKU\S-1-5-21-2107755742-302254199-1763176924-1001\...\12-26.net -> user1.12-26.net
IE restricted site: HKU\S-1-5-21-2107755742-302254199-1763176924-1001\...\12-27.net -> user1.12-27.net
IE restricted site: HKU\S-1-5-21-2107755742-302254199-1763176924-1001\...\123fporn.info -> www.123fporn.info
IE restricted site: HKU\S-1-5-21-2107755742-302254199-1763176924-1001\...\123haustiereundmehr.com -> www.123haustiereundmehr.com
IE restricted site: HKU\S-1-5-21-2107755742-302254199-1763176924-1001\...\123moviedownload.com -> www.123moviedownload.com
IE restricted site: HKU\S-1-5-21-2107755742-302254199-1763176924-1001\...\123simsen.com -> www.123simsen.com

There are 7936 more sites.


==================== Hosts content: ===============================

(If needed Hosts: directive could be included in the fixlist to reset Hosts.)

2017-06-05 01:11 - 2018-11-18 01:17 - 000000855 _____ C:\WINDOWS\system32\Drivers\etc\hosts

127.0.0.1 localhost

==================== Other Areas ============================

(Currently there is no automatic fix for this section.)

HKU\S-1-5-21-2107755742-302254199-1763176924-1001\Control Panel\Desktop\\Wallpaper -> C:\Users\Dad\AppData\Local\Packages\Microsoft.Windows.Photos_8wekyb3d8bbwe\LocalState\PhotosAppBackground\20180626_061637.jpg
DNS Servers: 192.168.1.1
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System => (ConsentPromptBehaviorAdmin: 5) (ConsentPromptBehaviorUser: 3) (EnableLUA: 1)
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer => (SmartScreenEnabled: RequireAdmin)
Windows Firewall is enabled.

==================== MSCONFIG/TASK MANAGER disabled items ==

If an entry is included in the fixlist, it will be removed.

MSCONFIG\Services: BDESVC => 3
MSCONFIG\Services: paltalk_update_service => 2
HKLM\...\StartupApproved\Run: => "iTunesHelper"
HKLM\...\StartupApproved\Run: => "ZAM"
HKLM\...\StartupApproved\Run32: => "VRS"
HKLM\...\StartupApproved\Run32: => "LWS"
HKLM\...\StartupApproved\Run32: => "SDTray"
HKU\S-1-5-21-2107755742-302254199-1763176924-1001\...\StartupApproved\StartupFolder: => "Logitech . Product Registration.lnk"
HKU\S-1-5-21-2107755742-302254199-1763176924-1001\...\StartupApproved\StartupFolder: => "PalTalk.lnk"
HKU\S-1-5-21-2107755742-302254199-1763176924-1001\...\StartupApproved\Run: => "OneDrive"
HKU\S-1-5-21-2107755742-302254199-1763176924-1001\...\StartupApproved\Run: => "CCleaner Monitoring"
HKU\S-1-5-21-2107755742-302254199-1763176924-1001\...\StartupApproved\Run: => "BingSvc"
HKU\S-1-5-21-2107755742-302254199-1763176924-1001\...\StartupApproved\Run: => "Skype"
HKU\S-1-5-21-2107755742-302254199-1763176924-1001\...\StartupApproved\Run: => "World of Tanks"
HKU\S-1-5-21-2107755742-302254199-1763176924-1001\...\StartupApproved\Run: => "Paltalk"

==================== FirewallRules (Whitelisted) ===============

(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)

FirewallRules: [{8FB6721E-87D7-4FB8-BD57-E48E82F5D835}] => (Allow) C:\Program Files (x86)\NCH Software\VRS\vrs.exe
FirewallRules: [{C27F3252-7C9F-4A22-9D34-EC82011B8D86}] => (Allow) C:\Program Files (x86)\NCH Software\VRS\vrs.exe
FirewallRules: [{67774D64-52CD-496E-A45A-1A7751FCBF8F}] => (Allow) C:\Program Files (x86)\NCH Software\VRS\vrs.exe
FirewallRules: [{855B13F3-8E97-4F25-9727-41868561BD40}] => (Allow) C:\Program Files (x86)\NCH Software\VRS\vrs.exe
FirewallRules: [{F485C3FF-4959-431F-B4C7-7B17BCD4F656}] => (Allow) C:\Program Files (x86)\NCH Software\VRS\vrs.exe
FirewallRules: [{0B5A8556-6228-478D-9CA1-C3B3BC7D1DB0}] => (Allow) C:\Program Files (x86)\NCH Software\VRS\vrs.exe
FirewallRules: [UDP Query User{962B321F-7152-4FBD-9B27-D42683404A59}C:\program files\mozilla firefox\firefox.exe] => (Allow) C:\program files\mozilla firefox\firefox.exe
FirewallRules: [TCP Query User{C43DEF9A-0D00-4861-9417-D955CE8D48A3}C:\program files\mozilla firefox\firefox.exe] => (Allow) C:\program files\mozilla firefox\firefox.exe
FirewallRules: [{1C69D635-125C-45A4-8052-574907AB5E4E}] => (Allow) C:\Program Files\Mozilla Firefox\firefox.exe
FirewallRules: [{EBDFAB83-DB28-46FF-ACAD-B9196138DC43}] => (Allow) C:\Program Files\Mozilla Firefox\firefox.exe
FirewallRules: [{48380C01-FCD2-4F6A-9B1C-67F99EA78734}] => (Allow) C:\Program Files (x86)\Mozilla Firefox\firefox.exe
FirewallRules: [{FE373094-A60A-41B7-AAB1-E8E73E51FDF5}] => (Allow) C:\Program Files (x86)\Mozilla Firefox\firefox.exe
FirewallRules: [{0B8C3854-02F3-4873-8137-AA07C6AACD70}] => (Allow) C:\Games\World_of_Tanks\worldoftanks.exe
FirewallRules: [{EE52C107-CFB0-4AB6-AB07-511083C515F1}] => (Allow) C:\Games\World_of_Tanks\worldoftanks.exe
FirewallRules: [{3B10229E-CDCB-4838-A588-A36298F46539}] => (Allow) C:\Games\World_of_Tanks\WoTLauncher.exe
FirewallRules: [{BEC79ECD-6681-4E93-B010-ADEB31358442}] => (Allow) C:\Games\World_of_Tanks\WoTLauncher.exe
FirewallRules: [{842718F1-D799-4129-B411-C6AA75BCCAF2}] => (Allow) C:\Program Files (x86)\Mozilla Firefox\firefox.exe
FirewallRules: [{3983567D-ABED-414F-8346-E716A1AC4AD6}] => (Allow) C:\Program Files (x86)\Mozilla Firefox\firefox.exe
FirewallRules: [TCP Query User{DDA1ECFF-9C07-456F-AED1-E7E4ACC6DC69}C:\program files (x86)\google\chrome\application\chrome.exe] => (Allow) C:\program files (x86)\google\chrome\application\chrome.exe
FirewallRules: [UDP Query User{D6644C78-5BEB-4F4F-ADF4-0DFCEECD800B}C:\program files (x86)\google\chrome\application\chrome.exe] => (Allow) C:\program files (x86)\google\chrome\application\chrome.exe
FirewallRules: [TCP Query User{3BB79B1F-5EAF-409D-9277-3D93CF6A5BBB}C:\program files (x86)\google\chrome\application\chrome.exe] => (Allow) C:\program files (x86)\google\chrome\application\chrome.exe
FirewallRules: [UDP Query User{CA8FC303-D0A8-43A6-84C6-54CAC9CA4FC0}C:\program files (x86)\google\chrome\application\chrome.exe] => (Allow) C:\program files (x86)\google\chrome\application\chrome.exe
FirewallRules: [TCP Query User{652BCC34-0101-42ED-8CFC-BDF4E367733E}C:\users\dad\documents\dwyco\cdc-x\cdcx.exe] => (Allow) C:\users\dad\documents\dwyco\cdc-x\cdcx.exe
FirewallRules: [UDP Query User{E97CF5CC-E875-4413-AF67-EA0BDE39744F}C:\users\dad\documents\dwyco\cdc-x\cdcx.exe] => (Allow) C:\users\dad\documents\dwyco\cdc-x\cdcx.exe
FirewallRules: [TCP Query User{003B7E6E-80BD-439B-8A70-857B9C41445E}C:\users\dad\documents\dwyco\cdc-x\cdcx.exe] => (Allow) C:\users\dad\documents\dwyco\cdc-x\cdcx.exe
FirewallRules: [UDP Query User{D040F650-7821-46C1-B3E2-FC21FE4540A8}C:\users\dad\documents\dwyco\cdc-x\cdcx.exe] => (Allow) C:\users\dad\documents\dwyco\cdc-x\cdcx.exe
FirewallRules: [{46B65E1E-BEDF-4DC5-9D92-8D74D4F9F47D}] => (Allow) C:\Program Files (x86)\Skype\Phone\Skype.exe
FirewallRules: [{F3B37680-C314-40B7-BC39-16EEDE3EF147}] => (Allow) C:\Program Files\Bonjour\mDNSResponder.exe
FirewallRules: [{E6212E99-160B-4688-8CBA-D7A12F5EC108}] => (Allow) C:\Program Files\Bonjour\mDNSResponder.exe
FirewallRules: [{AB709A6E-44BB-49AD-8FD6-4C5F1FC92929}] => (Allow) C:\Program Files (x86)\Bonjour\mDNSResponder.exe
FirewallRules: [{75A45EA3-8F6E-40A6-ABEA-BEE725167883}] => (Allow) C:\Program Files (x86)\Bonjour\mDNSResponder.exe
FirewallRules: [{8CCAC849-70E3-46E5-917C-BC8AF033E480}] => (Allow) C:\Program Files (x86)\Common Files\Apple\Apple Application Support\APSDaemon.exe
FirewallRules: [{E862C93A-2323-40FE-A5C7-BDA02CB753DD}] => (Allow) C:\Program Files\Blackmagic Design\DaVinci Resolve\Resolve.exe
FirewallRules: [{3151F97B-3979-4D77-9733-B205CC3F9091}] => (Allow) C:\Program Files\Blackmagic Design\DaVinci Resolve\bmdpaneld.exe
FirewallRules: [{8F16C789-AD05-4E02-9453-99D23E4B4956}] => (Allow) C:\Program Files\Blackmagic Design\DaVinci Resolve\DaVinciPanelDaemon.exe
FirewallRules: [{2D3BCC6F-57DF-4139-9D16-A4A69FF0F91C}] => (Allow) C:\Program Files\Blackmagic Design\DaVinci Resolve\JLCooperPanelDaemon.exe
FirewallRules: [{2D917239-EBB3-46C7-9442-6523607F22CD}] => (Allow) C:\Program Files\Blackmagic Design\DaVinci Resolve\EuphonixPanelDaemon.exe
FirewallRules: [{A205AFA8-D989-4F78-8FEA-D0A4C93C47E1}] => (Allow) C:\Program Files\Blackmagic Design\DaVinci Resolve\TangentPanelDaemon.exe
FirewallRules: [{84A1AEC1-1099-4164-951D-3730CCA61342}] => (Allow) C:\Program Files\Blackmagic Design\DaVinci Resolve\ElementsPanelDaemon.exe
FirewallRules: [{BA0A3799-3641-414D-B931-5E28A46973D4}] => (Allow) C:\Program Files\Blackmagic Design\DaVinci Resolve\OxygenPanelDaemon.exe
FirewallRules: [{0EAEA49B-C88E-4779-853E-75AE153E8F5C}] => (Allow) C:\Program Files\Blackmagic Design\DaVinci Resolve\DPDecoder.exe
FirewallRules: [{962498E8-78E5-4D70-A60A-4D52DCFD8595}] => (Allow) C:\ProgramData\Blackmagic Design\DaVinci Resolve\Support\QtDecoder\QTDecoder.exe
FirewallRules: [{952CC195-5D2F-46A5-9CAA-1E426406486D}] => (Allow) C:\Program Files (x86)\Maxthon5\Bin\Maxthon.exe
FirewallRules: [{6203029F-31F7-4D02-9E2F-4ADC7847B10B}] => (Allow) C:\Program Files (x86)\Maxthon5\Bin\Maxthon.exe
FirewallRules: [{B937569C-B14E-4816-B1D0-CD32F5209B2B}] => (Allow) C:\Program Files\iTunes\iTunes.exe
FirewallRules: [{BB1627AB-ABE6-4E5A-BA76-088336A58FEB}] => (Allow) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe

==================== Restore Points =========================

04-11-2018 11:00:53 Windows Modules Installer
05-11-2018 13:00:51 Windows Modules Installer
06-11-2018 13:03:14 Windows Modules Installer
07-11-2018 15:03:43 Windows Modules Installer
08-11-2018 17:01:10 Windows Modules Installer
09-11-2018 17:50:35 Windows Modules Installer
09-11-2018 18:52:03 Windows Modules Installer
10-11-2018 19:09:22 Windows Modules Installer
10-11-2018 21:44:14 Restore Operation
11-11-2018 23:49:11 Windows Modules Installer
12-11-2018 09:13:22 Restore Operation
13-11-2018 00:11:40 Windows Modules Installer
14-11-2018 00:40:11 Windows Modules Installer
15-11-2018 02:43:50 Windows Modules Installer
16-11-2018 03:52:41 Windows Modules Installer
17-11-2018 08:51:13 Windows Modules Installer
18-11-2018 02:44:07 Removed Chrome Remote Desktop Host
18-11-2018 10:49:12 Windows Modules Installer

==================== Faulty Device Manager Devices =============


==================== Event log errors: =========================

Application errors:
==================
Error: (11/19/2018 10:41:59 AM) (Source: Application Hang) (EventID: 1002) (User: )
Description: The program firefox.exe version 52.9.0.6746 stopped interacting with Windows and was closed. To see if more information about the problem is available, check the problem history in the Security and Maintenance control panel.

Process ID: 461c

Start Time: 01d48026a89215b5

Termination Time: 4294967295

Application Path: C:\Program Files\Mozilla Firefox\firefox.exe

Report Id: 1afaf119-0603-4f5c-beff-0a45d85d5844

Faulting package full name:

Faulting package-relative application ID:

Error: (11/19/2018 10:41:46 AM) (Source: Application Hang) (EventID: 1002) (User: )
Description: The program firefox.exe version 52.9.0.6746 stopped interacting with Windows and was closed. To see if more information about the problem is available, check the problem history in the Security and Maintenance control panel.

Process ID: 658

Start Time: 01d48023f65d9826

Termination Time: 4294967295

Application Path: C:\Program Files\Mozilla Firefox\firefox.exe

Report Id: d3cfde63-e295-4070-8aaf-3ee3c87132cd

Faulting package full name:

Faulting package-relative application ID:

Error: (11/19/2018 10:22:05 AM) (Source: Application Error) (EventID: 1000) (User: )
Description: Faulting application name: SystemSettings.exe, version: 10.0.17134.112, time stamp: 0x2a3c4e62
Faulting module name: msxml6.dll, version: 6.30.17134.345, time stamp: 0xd3dc41a8
Exception code: 0xc0000005
Fault offset: 0x0000000000080b97
Faulting process id: 0x1dd8
Faulting application start time: 0x01d47ec7351edcbe
Faulting application path: C:\Windows\ImmersiveControlPanel\SystemSettings.exe
Faulting module path: C:\Windows\System32\msxml6.dll
Report Id: 9ea89273-d529-44cb-b2db-9965ee8402ad
Faulting package full name: windows.immersivecontrolpanel_10.0.2.1000_neutral_neutral_cw5n1h2txyewy
Faulting package-relative application ID: microsoft.windows.immersivecontrolpanel

Error: (11/18/2018 06:43:11 PM) (Source: COM) (EventID: 10031) (User: )
Description: An unmarshaling policy check was performed when unmarshaling a custom marshaled object and the class {41FD88F7-F295-4D39-91AC-A85F3149A05B} was rejected

Error: (11/18/2018 06:43:11 PM) (Source: COM) (EventID: 10031) (User: )
Description: An unmarshaling policy check was performed when unmarshaling a custom marshaled object and the class {41FD88F7-F295-4D39-91AC-A85F3149A05B} was rejected

Error: (11/18/2018 03:59:08 AM) (Source: COM) (EventID: 10031) (User: )
Description: An unmarshaling policy check was performed when unmarshaling a custom marshaled object and the class {41FD88F7-F295-4D39-91AC-A85F3149A05B} was rejected

Error: (11/18/2018 03:59:08 AM) (Source: COM) (EventID: 10031) (User: )
Description: An unmarshaling policy check was performed when unmarshaling a custom marshaled object and the class {41FD88F7-F295-4D39-91AC-A85F3149A05B} was rejected

Error: (11/17/2018 03:44:08 PM) (Source: COM) (EventID: 10031) (User: )
Description: An unmarshaling policy check was performed when unmarshaling a custom marshaled object and the class {41FD88F7-F295-4D39-91AC-A85F3149A05B} was rejected


System errors:
=============
Error: (11/19/2018 10:24:16 AM) (Source: DCOM) (EventID: 10016) (User: BRIDGES1)
Description: The application-specific permission settings do not grant Local Activation permission for the COM Server application with CLSID
{9E175B6D-F52A-11D8-B9A5-505054503030}
and APPID
{9E175B9C-F52A-11D8-B9A5-505054503030}
to the user Bridges1\Dad SID (S-1-5-21-2107755742-302254199-1763176924-1001) from address LocalHost (Using LRPC) running in the application container Unavailable SID (Unavailable). This security permission can be modified using the Component Services administrative tool.

Error: (11/18/2018 01:06:08 AM) (Source: Microsoft-Windows-NDIS) (EventID: 10317) (User: NT AUTHORITY)
Description: Miniport TunnelBear Adapter V9, {A05C3DAF-9B86-4E90-8503-1C2F493263F6}, had event 76

Error: (11/17/2018 06:39:14 PM) (Source: DCOM) (EventID: 10016) (User: BRIDGES1)
Description: The application-specific permission settings do not grant Local Activation permission for the COM Server application with CLSID
{8BC3F05E-D86B-11D0-A075-00C04FB68820}
and APPID
{8BC3F05E-D86B-11D0-A075-00C04FB68820}
to the user Bridges1\Dad SID (S-1-5-21-2107755742-302254199-1763176924-1001) from address LocalHost (Using LRPC) running in the application container Microsoft.Windows.ContentDeliveryManager_10.0.17134.1_neutral_neutral_cw5n1h2txyewy SID (S-1-15-2-350187224-1905355452-1037786396-3028148496-2624191407-3283318427-1255436723). This security permission can be modified using the Component Services administrative tool.

Error: (11/17/2018 12:22:02 AM) (Source: DCOM) (EventID: 10016) (User: NT AUTHORITY)
Description: The application-specific permission settings do not grant Local Activation permission for the COM Server application with CLSID
{D63B10C5-BB46-4990-A94F-E40B9D520160}
and APPID
{9CA88EE3-ACB7-47C8-AFC4-AB702511C276}
to the user NT AUTHORITY\LOCAL SERVICE SID (S-1-5-19) from address LocalHost (Using LRPC) running in the application container Unavailable SID (Unavailable). This security permission can be modified using the Component Services administrative tool.

Error: (11/17/2018 12:21:10 AM) (Source: DCOM) (EventID: 10016) (User: BRIDGES1)
Description: The application-specific permission settings do not grant Local Activation permission for the COM Server application with CLSID
{D63B10C5-BB46-4990-A94F-E40B9D520160}
and APPID
{9CA88EE3-ACB7-47C8-AFC4-AB702511C276}
to the user Bridges1\Dad SID (S-1-5-21-2107755742-302254199-1763176924-1001) from address LocalHost (Using LRPC) running in the application container Unavailable SID (Unavailable). This security permission can be modified using the Component Services administrative tool.

Error: (11/16/2018 08:51:35 PM) (Source: DCOM) (EventID: 10016) (User: NT AUTHORITY)
Description: The application-specific permission settings do not grant Local Launch permission for the COM Server application with CLSID
Windows.SecurityCenter.WscDataProtection
and APPID
Unavailable
to the user NT AUTHORITY\SYSTEM SID (S-1-5-18) from address LocalHost (Using LRPC) running in the application container Unavailable SID (Unavailable). This security permission can be modified using the Component Services administrative tool.

Error: (11/16/2018 08:51:35 PM) (Source: DCOM) (EventID: 10016) (User: NT AUTHORITY)
Description: The application-specific permission settings do not grant Local Launch permission for the COM Server application with CLSID
Windows.SecurityCenter.WscBrokerManager
and APPID
Unavailable
to the user NT AUTHORITY\SYSTEM SID (S-1-5-18) from address LocalHost (Using LRPC) running in the application container Unavailable SID (Unavailable). This security permission can be modified using the Component Services administrative tool.

Error: (11/16/2018 08:49:28 PM) (Source: DCOM) (EventID: 10016) (User: NT AUTHORITY)
Description: The application-specific permission settings do not grant Local Activation permission for the COM Server application with CLSID
{D63B10C5-BB46-4990-A94F-E40B9D520160}
and APPID
{9CA88EE3-ACB7-47C8-AFC4-AB702511C276}
to the user NT AUTHORITY\LOCAL SERVICE SID (S-1-5-19) from address LocalHost (Using LRPC) running in the application container Unavailable SID (Unavailable). This security permission can be modified using the Component Services administrative tool.


Windows Defender:
===================================
Date: 2018-11-09 02:23:56.357
Description:
Windows Defender Antivirus scan has been stopped before completion.
Scan ID: {797D14D7-5BA9-4FAF-A904-BACEBCD38F5E}
Scan Type: Antimalware
Scan Parameters: Quick Scan

Date: 2018-10-31 05:25:39.315
Description:
Windows Defender Antivirus scan has been stopped before completion.
Scan ID: {1E20FEB0-369F-4E32-B4EE-8BFB071C17BB}
Scan Type: Antimalware
Scan Parameters: Quick Scan

Date: 2018-10-31 05:19:32.182
Description:
Windows Defender Antivirus scan has been stopped before completion.
Scan ID: {9DCB3DF2-F5EB-4DC3-BD73-2FBBFEEA3870}
Scan Type: Antimalware
Scan Parameters: Quick Scan

Date: 2018-10-22 00:26:10.942
Description:
Windows Defender Antivirus has detected a suspicious behavior.
Name: Informational:Behavior/ModifiedKernel
ID: 654215520
Severity: Low
Category: Suspicious Behavior
Path Found: process:_0
Detection Origin: Unknown
Detection Type: Suspicious
Detection Source: Real-Time Protection
Status: Executing
Process Name: Unknown
Signature ID: 717259538435
Signature Version: AV: 1.279.247.0, AS: 1.279.247.0
Engine Version: 1.1.15400.4
Fidelity Label: Medium
Target File Name: c:\windows\\system32\drivers\easytthrx.sys

==================== Memory info ===========================

Processor: Intel(R) Core(TM) i3-2120 CPU @ 3.30GHz
Percentage of memory in use: 44%
Total physical RAM: 6048.27 MB
Available physical RAM: 3327.67 MB
Total Virtual: 7091.62 MB
Available Virtual: 3665.3 MB

==================== Drives ================================

Drive c: (Gateway) (Fixed) (Total:918.41 GB) (Free:723.22 GB) NTFS
Drive d: (Recovery1) (CDROM) (Total:3.9 GB) (Free:0 GB) UDF

\\?\Volume{1f74b045-50b1-11e1-94c3-806e6f6e6963}\ (SYSTEM RESERVED) (Fixed) (Total:0.1 GB) (Free:0.06 GB) NTFS
\\?\Volume{1f74b044-50b1-11e1-94c3-806e6f6e6963}\ (PQSERVICE) (Fixed) (Total:13 GB) (Free:2.93 GB) NTFS

==================== MBR & Partition Table ==================

========================================================
Disk: 0 (MBR Code: Windows 7/8/10) (Size: 931.5 GB) (Disk ID: 5D81C09C)
Partition 1: (Not Active) - (Size=13 GB) - (Type=27)
Partition 2: (Active) - (Size=100 MB) - (Type=07 NTFS)
Partition 3: (Not Active) - (Size=918.4 GB) - (Type=07 NTFS)

==================== End of Addition.txt ============================

aswMBR version 1.0.1.2252 Copyright(c) 2014 AVAST Software
Run date: 2018-11-19 10:57:51
-----------------------------
10:57:51.800 OS Version: Windows x64 6.2.9200
10:57:51.800 Number of processors: 4 586 0x2A07
10:57:51.802 ComputerName: BRIDGES1 UserName: Dad
10:57:53.733 Initialze error C000010E - driver not loaded
10:58:59.460 The log file has been saved successfully to "C:\Users\Dad\Desktop\aswMBR.txt"

[rcb56]

i forgot to add after the crash that a week ago i clicked on a facebook ad and immediately my pc was taken over by a page claiming to be microsoft. it gave an 800 number and warned me not to turn off the pc. i'd seen this before and knew it was a scam. they wanted ne to let them in my pc to correct it all for a fee of about $375 plus they have full access to all my financial info. so no deal.

[Juliet]

Uninstall/delete the below version of outdated Java
Java 8 Update 111 (HKLM-x32\...\{26A24AE4-039D-4CA4-87B4-2F32180111F0}) (Version: 8.0.1110.14 - Oracle Corporation)


~~~~~~~~~~~

Start Farbar Recovery Scan Tool with Administrator privileges
(Right click on the FRST icon and select Run as administrator)

highlight on the text below and select Copy.
beginning with Start:: and finishing with End::


Start::
CloseProcesses:
CreateRestorePoint:
SearchScopes: HKU\S-1-5-21-2107755742-302254199-1763176924-1001 -> DefaultScope {DF3BC73C-F06A-49A0-A8BC-A0036FBF565F} URL =
FF HKLM-x32\...\Firefox\Extensions: [{F003DA68-8256-4b37-A6C4-350FA04494DF}] - C:\Program Files\Logitech\SetPointP\LogiSmoothFirefoxExt => not found
2018-11-16 20:16 - 2018-11-16 20:16 - 001130840 _____ (Google Inc.) C:\Users\Dad\AppData\Local\Temp\ChromeSetup.exe
2018-11-12 16:56 - 2018-11-12 16:56 - 000392704 _____ () C:\Users\Dad\AppData\Local\Temp\dfrF453.tmp.dll
2018-11-16 20:45 - 2018-11-18 02:43 - 000258048 _____ (ExpressVPN) C:\Users\Dad\AppData\Local\Temp\ExpressVpn.Client.Setup.Helper.exe
ShellIconOverlayIdentifiers: [00asw] -> {472083B0-C522-11CF-8763-00608CC02F24} => -> No File
ContextMenuHandlers4: [Offline Files] -> {474C98EE-CF3D-41f5-80E3-4AAB0AB04301} => -> No File
ContextMenuHandlers6: -> {85BBD920-42A0-1069-A2E4-08002B30309D} => -> No File
ContextMenuHandlers6: [Offline Files] -> {474C98EE-CF3D-41f5-80E3-4AAB0AB04301} => -> No File
ShortcutWithArgument: C:\Users\Dad\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Chrome Remote Desktop.lnk -> C:\Program Files (x86)\Google\Chrome\Application\chrome.exe (Google Inc.) -> --profile-directory=Default --app-id=gbchcmhmhahfdphkhkmpfmihenigjmpp
C:\Windows\Temp\*.*
Emptytemp:
End::



Start FRST (FRST64) with Administrator privileges
Press the Fix button. FRST will process the lines copied above from the clipboard.
When finished, a log file Fixlog.txt will pop up and saved in the same location the tool was ran from.

Please copy and paste its contents in your next reply.
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

http://i.imgur.com/zcMPezJ.pngAdwCleaner - Fix Mode

Download [b]AdwCleaner (http://www.bleepingcomputer.com/download/adwcleaner/dl/125/) and move it to your Desktop
Right-click on AdwCleaner.exe and select http://i.imgur.com/Spcusrh.pngRun as Administrator (for Windows Vista, 7, 8, 8.1 and 10 users)
Accept the EULA (I accept), then click on Scan
Let the scan complete. Once it's done, make sure that every item listed in the different tabs is checked and click on the Clean & Repair button. This will kill all the active processes
Once the cleaning process is complete, AdwCleaner will ask to restart your computer, do it
After the restart, a log will open when logging in. Please copy/paste the content of that log in your next reply


~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
http://i.imgur.com/RQKuhw1.pngRogueKiller

Download the right version of RogueKiller (http://www.adlice.com/download/roguekiller/#download) for your Windows version (32 or 64-bit)
Once done, move the executable file to your Desktop, right-click on it and select http://i.imgur.com/Spcusrh.pngRun as Administrator (for Windows Vista, 7, 8, 8.1 and 10 users)
Click on the Start Scan button in the right panel, which will bring you to another tab, and click on it again (this time it'll be in the bottom right corner)
Wait for the scan to complete
On completion, the results will be displayed
Check every single entry (threat found), and click on the Remove Selected button
On completion, the results will be displayed. Click on the Open Report button in the bottom left corner, followed by the Open TXT button (also in the bottom left corner)
This will open the report in Notepad. Copy/paste its content in your next reply


Your next reply(ies) should therefore contain:

Copy/pasted Fixlog.txt
Copy/pasted AdwCleaner clean log
Copy/pasted RogueKiller clean log

[rcb56]

thanks juliet...hello!

Fix result of Farbar Recovery Scan Tool (x64) Version: 15.11.2018
Ran by Dad (19-11-2018 18:15:18) Run:1
Running from C:\Users\Dad\Desktop
Loaded Profiles: Dad (Available Profiles: Dad)
Boot Mode: Normal
==============================================

fixlist content:
*****************
CloseProcesses:
CreateRestorePoint:
SearchScopes: HKU\S-1-5-21-2107755742-302254199-1763176924-1001 -> DefaultScope {DF3BC73C-F06A-49A0-A8BC-A0036FBF565F} URL =
FF HKLM-x32\...\Firefox\Extensions: [{F003DA68-8256-4b37-A6C4-350FA04494DF}] - C:\Program Files\Logitech\SetPointP\LogiSmoothFirefoxExt => not found
2018-11-16 20:16 - 2018-11-16 20:16 - 001130840 _____ (Google Inc.) C:\Users\Dad\AppData\Local\Temp\ChromeSetup.exe
2018-11-12 16:56 - 2018-11-12 16:56 - 000392704 _____ () C:\Users\Dad\AppData\Local\Temp\dfrF453.tmp.dll
2018-11-16 20:45 - 2018-11-18 02:43 - 000258048 _____ (ExpressVPN) C:\Users\Dad\AppData\Local\Temp\ExpressVpn.Client.Setup.Helper.exe
ShellIconOverlayIdentifiers: [00asw] -> {472083B0-C522-11CF-8763-00608CC02F24} => -> No File
ContextMenuHandlers4: [Offline Files] -> {474C98EE-CF3D-41f5-80E3-4AAB0AB04301} => -> No File
ContextMenuHandlers6: [BriefcaseMenu] -> {85BBD920-42A0-1069-A2E4-08002B30309D} => -> No File
ContextMenuHandlers6: [Offline Files] -> {474C98EE-CF3D-41f5-80E3-4AAB0AB04301} => -> No File
ShortcutWithArgument: C:\Users\Dad\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Chrome Remote Desktop.lnk -> C:\Program Files (x86)\Google\Chrome\Application\chrome.exe (Google Inc.) -> --profile-directory=Default --app-id=gbchcmhmhahfdphkhkmpfmihenigjmpp
C:\Windows\Temp\*.*
Emptytemp:

*****************

Processes closed successfully.
Restore point was successfully created.
"HKU\S-1-5-21-2107755742-302254199-1763176924-1001\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\\DefaultScope" => removed successfully
"HKLM\Software\Wow6432Node\Mozilla\Firefox\Extensions\\{F003DA68-8256-4b37-A6C4-350FA04494DF}" => removed successfully
C:\Users\Dad\AppData\Local\Temp\ChromeSetup.exe => moved successfully
C:\Users\Dad\AppData\Local\Temp\dfrF453.tmp.dll => moved successfully
C:\Users\Dad\AppData\Local\Temp\ExpressVpn.Client.Setup.Helper.exe => moved successfully
HKLM\Software\Microsoft\Windows\CurrentVersion\Explorer\ShellIconOverlayIdentifiers\00asw => removed successfully
HKLM\Software\Classes\CLSID\{472083B0-C522-11CF-8763-00608CC02F24} => not found
HKLM\Software\Classes\Directory\ShellEx\ContextMenuHandlers\Offline Files => removed successfully
HKLM\Software\Classes\CLSID\{474C98EE-CF3D-41f5-80E3-4AAB0AB04301} => not found
HKLM\Software\Classes\Folder\ShellEx\ContextMenuHandlers\BriefcaseMenu => removed successfully
"HKLM\Software\Classes\CLSID\{85BBD920-42A0-1069-A2E4-08002B30309D}" => removed successfully
HKLM\Software\Classes\Folder\ShellEx\ContextMenuHandlers\Offline Files => removed successfully
HKLM\Software\Classes\CLSID\{474C98EE-CF3D-41f5-80E3-4AAB0AB04301} => not found
C:\Users\Dad\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Chrome Remote Desktop.lnk => Shortcut argument removed successfully

=========== "C:\Windows\Temp\*.*" ==========

C:\Windows\Temp\FXSAPIDebugLogFile.txt => moved successfully
C:\Windows\Temp\FXSTIFFDebugLogFile.txt => moved successfully
C:\Windows\Temp\HighPerformancePlan.log => moved successfully
C:\Windows\Temp\MpCmdRun.log => moved successfully
C:\Windows\Temp\MpSigStub.log => moved successfully
C:\Windows\Temp\PowerPlan.log => moved successfully
C:\Windows\Temp\sa.9PGGJ4LF6SPV_0__.Public.InstallAgent.dat => moved successfully
C:\Windows\Temp\TS_216A.tmp => moved successfully
C:\Windows\Temp\TS_B716.tmp => moved successfully

========= End -> "C:\Windows\Temp\*.*" ========


=========== EmptyTemp: ==========

BITS transfer queue => 8151040 B
DOMStore, IE Recovery, AppCache, Feeds Cache, Thumbcache, IconCache => 121381895 B
Java, Flash, Steam htmlcache => 189631 B
Windows/system/drivers => 40 B
Edge => 900809 B
Chrome => 239792223 B
Firefox => 34097440 B
Opera => 177310 B

Temp, IE cache, history, cookies, recent:
Default => 0 B
Users => 0 B
ProgramData => 0 B
Public => 0 B
systemprofile => 0 B
systemprofile32 => 14341284 B
LocalService => 10178 B
LocalService => 0 B
NetworkService => 246088 B
NetworkService => 0 B
Dad => 524345261 B

RecycleBin => 219614685 B
EmptyTemp: => 1.1 GB temporary data Removed.

================================


The system needed a reboot.

==== End of Fixlog 18:17:30 ====

[Juliet]

AdwCleaner log
RogueKiller log

Have you run these?

I might not be back tonight, also tell me how the computer is now.

[rcb56]

is this all of them?

RogueKiller Anti-Malware V13.0.11.0 (x64) [Nov 19 2018] (Free) by Adlice Software
mail : https://adlice.com/contact/
Website : https://adlice.com/download/roguekiller/
Operating System : Windows 10 (10.0.17134) 64 bits
Started in : Normal mode
User : Dad [Administrator]
Started from : C:\Program Files\RogueKiller\RogueKiller64.exe
Mode : Standard Scan, Scan -- Date : 2018/11/19 18:53:21 (Duration : 00:41:59)

¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤ Processes ¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤

¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤ Process Modules ¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤

¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤ Services ¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤

¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤ Tasks ¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤

¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤ Registry ¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤
>>>>>> XX - Software
[PUP.Conduit|PUP.Gen1 (Potentially Malicious)] (X86) HKEY_LOCAL_MACHINE\Software\Conduit -- N/A -> Found

¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤ WMI ¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤

¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤ Hosts File ¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤

¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤ Files ¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤

¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤ Web browsers ¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤
>>>>>> Chrome Config
[PUM.SearchEngine (Potentially Malicious)] default_search_provider_data.template_url_data.keyword (C:\Users\Dad\AppData\Local\Google\Chrome\User Data\Default\Secure Preferences) -- google.com_ -> Found

aswMBR version 1.0.1.2252 Copyright(c) 2014 AVAST Software
Run date: 2018-11-19 10:57:51
-----------------------------
10:57:51.800 OS Version: Windows x64 6.2.9200
10:57:51.800 Number of processors: 4 586 0x2A07
10:57:51.802 ComputerName: BRIDGES1 UserName: Dad
10:57:53.733 Initialze error C000010E - driver not loaded
10:58:59.460 The log file has been saved successfully to "C:\Users\Dad\Desktop\aswMBR.txt"

[Juliet]

I would like to see the log from the below tool.

http://i.imgur.com/zcMPezJ.pngAdwCleaner - Fix Mode

Download AdwCleaner (http://www.bleepingcomputer.com/download/adwcleaner/dl/125/) and move it to your Desktop
Right-click on AdwCleaner.exe and select http://i.imgur.com/Spcusrh.pngRun as Administrator (for Windows Vista, 7, 8, 8.1 and 10 users)
Accept the EULA (I accept), then click on Scan
Let the scan complete. Once it's done, make sure that every item listed in the different tabs is checked and click on the Clean & Repair button. This will kill all the active processes
Once the cleaning process is complete, AdwCleaner will ask to restart your computer, do it
After the restart, a log will open when logging in. Please copy/paste the content of that log in your next reply


~~~~~
By chance, can you run RogueKiller again and let it delete what it finds, or did you post the log before it was finished?
The log says found not deleted or quarantined.

Click on the Start Scan button in the right panel, which will bring you to another tab, and click on it again (this time it'll be in the bottom right corner)
Wait for the scan to complete
On completion, the results will be displayed
Check every single entry (threat found), and click on the Remove Selected button
On completion, the results will be displayed. Click on the Open Report button in the bottom left corner, followed by the Open TXT button (also in the bottom left corner)
This will open the report in Notepad. Copy/paste its content in your next reply

[rcb56]

i assume i just did it wrong. it showed what it found but for some reason i didn't select to delete and restart, sorry. running the rogue now
# -------------------------------
# Malwarebytes AdwCleaner 7.2.4.0
# -------------------------------
# Build: 09-25-2018
# Database: 2018-11-19.1 (Cloud)
# Support: https://www.malwarebytes.com/support
#
# -------------------------------
# Mode: Clean
# -------------------------------
# Start: 11-20-2018
# Duration: 00:00:07
# OS: Windows 10 Home
# Cleaned: 5
# Failed: 0


***** [ Services ] *****

No malicious services cleaned.

***** [ Folders ] *****

No malicious folders cleaned.

***** [ Files ] *****

No malicious files cleaned.

***** [ DLL ] *****

No malicious DLLs cleaned.

***** [ WMI ] *****

No malicious WMI cleaned.

***** [ Shortcuts ] *****

No malicious shortcuts cleaned.

***** [ Tasks ] *****

No malicious tasks cleaned.

***** [ Registry ] *****

Deleted HKLM\Software\Wow6432Node\Conduit
Deleted HKLM\Software\Microsoft\Windows\CurrentVersion\Explorer\StartupApproved\Run32|ProductUpdater
Deleted HKLM\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\Run|ProductUpdater
Deleted HKLM\Software\Wow6432Node\Classes\AppID\{A245B088-41FA-478E-8DEA-86177F1394BB}
Deleted HKLM\Software\Classes\AppID\{A245B088-41FA-478E-8DEA-86177F1394BB}

***** [ Chromium (and derivatives) ] *****

No malicious Chromium entries cleaned.

***** [ Chromium URLs ] *****

No malicious Chromium URLs cleaned.

***** [ Firefox (and derivatives) ] *****

No malicious Firefox entries cleaned.

***** [ Firefox URLs ] *****

No malicious Firefox URLs cleaned.


*************************

[+] Delete Tracing Keys
[+] Reset Winsock

*************************

AdwCleaner[S00].txt - [1624 octets] - [12/07/2018 21:34:49]
AdwCleaner[C00].txt - [1678 octets] - [12/07/2018 21:35:46]
AdwCleaner[S01].txt - [2874 octets] - [19/11/2018 18:29:27]
AdwCleaner[C01].txt - [2784 octets] - [19/11/2018 18:30:48]
AdwCleaner[S02].txt - [1972 octets] - [20/11/2018 13:18:08]

########## EOF - C:\AdwCleaner\Logs\AdwCleaner[C02].txt ##########

[rcb56]

ok juliet i hope i got them all done right...

RogueKiller Anti-Malware V13.0.11.0 (x64) [Nov 19 2018] (Free) by Adlice Software
mail : https://adlice.com/contact/
Website : https://adlice.com/download/roguekiller/
Operating System : Windows 10 (10.0.17134) 64 bits
Started in : Normal mode
User : Dad [Administrator]
Started from : C:\Program Files\RogueKiller\RogueKiller64.exe
Mode : Standard Scan, Delete -- Date : 2018/11/20 14:17:18 (Duration : 00:41:17)

¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤ Delete ¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤
[PUM.SearchEngine (Potentially Malicious)] default_search_provider_data.template_url_data.keyword -- google.com_ -> Deleted

[Juliet]

OK looks good

http://i.imgur.com/G0tu5D9.pngEmsisoft Emergency Kit - Fix Mode
Follow the instructions below to run a scan using the Emsisoft Emergency Kit.

Download the Emsisoft Emergency Kit (https://www.emsisoft.com/en/software/eek/download/) and execute it. From there, click on the Install button to extract the program in the EEK folder;
Once the extraction is complete, the EEK folder will open. Right-click on http://i.imgur.com/G0tu5D9.pngstart emergency kit scanner.exe and select http://i.imgur.com/Spcusrh.pngRun as Administrator (for Windows Vista, 7, 8, 8.1 and 10 users);
EEK will suggest that you run an online update before using the program. Click on Yes to launch it.
After the update, click on Malware Scan under 2. Scan and accept to let EEK detect PUPs (click on Yes).
Once the scan is complete, make sure that every item in the list is checked, and click on the Quarantine selected button;
If it asks you for a reboot to delete some items, click on Ok to reboot automatically;
After the restart, open EEK again (in the C:\EEK folder);
This time, click on Logs;
From there, go under the Quarantine Log tab, and click on the Export button;
Save the log on your desktop, then open it, and copy/paste its content in your next reply;


Tell me what the computer is doing now.

[rcb56]

well it has stopped all the crazy stuff like when i opened a browser before it might open 40 or so windows, my mouse scrolling appeared to be stone cold drunk, all in all i's say it's doing great...again! this was a long scan!

Emsisoft Emergency Kit 2018.6.0.8742 stable [en-us]
OS: Windows 10 (Version 10.0, Build 17134, 64-bit Edition)

Forensics log

Date Component Action Details
11/20/2018 10:21:26 PM User BRIDGES1\DAD Infection quarantined Malware "Gen:Variant.Application.MAC.OSX.InstallMiez.1 (B)" in "Flash Player.dmg".
11/20/2018 10:21:26 PM User BRIDGES1\DAD Infection quarantined Malware "Application.DealAgent.AVYP (B)" in "JavaSetup_3759098556.exe".
11/20/2018 10:20:15 PM Scanner Scan finished Found 3 objects , user to decide on further actions.
11/20/2018 9:15:06 PM Scanner Detection PUP "Gen:Variant.Application.MAC.OSX.InstallMiez.1 (B)" in "Flash Player.dmg -> (Disk Image) -> (disk image) -> /Installer/Installer.app/Contents/MacOS/premutative" and PUP "Gen:Variant.Application.MAC.OSX.InstallMiez.1 (B)" in "Flash Player.dmg -> (Disk Image) -> (disk image) -> /Installer/Installer.app/Contents/Resources/InstallerHelper"
11/20/2018 9:07:34 PM Scanner Detection PUP "Application.DealAgent.AVYP (B)" in "JavaSetup_3759098556.exe" (SHA1: ee69a6691533ee17d78bde1c85a8e835287f6a2f)
11/20/2018 8:18:29 PM User BRIDGES1\Dad Scan started Custom Scan
11/20/2018 8:16:35 PM User Update Downloaded and installed 13 files (846 kb) (34 sec.).
11/20/2018 8:16:02 PM Core Notification "Recommended Reading:Beware: New wave of malware spreads via ISO file email attachments".
7/13/2018 10:58:19 PM Scanner Scan finished Scanned 20517 objects and found nothing.
7/13/2018 10:45:49 PM User BRIDGES1\Dad Scan started Malware Scan
7/13/2018 10:44:25 PM User Update Downloaded and installed 32 files (2616 kb) (50 sec.).
7/13/2018 10:43:35 PM Core Notification "Recommended Reading:How to perform manual removal of unwanted programs (PUPs)".
5/24/2018 10:18:32 PM Scanner Scan finished Scanned 202580 objects and found nothing.
5/24/2018 10:04:20 PM User BRIDGES1\Dad Scan started Malware Scan
5/24/2018 10:04:17 PM User Update Canceled by user (52 sec.).
5/24/2018 10:03:25 PM Core Notification "Recommended Reading:The Basics of Manual Malware Identification and Removal".
2/22/2018 7:02:38 AM Scanner Scan finished Scanned 202123 objects and found nothing.
2/22/2018 6:52:35 AM User BRIDGES1\Dad Scan started Malware Scan

[Juliet]

What I see here is the Forensics log, it shows time stamps and what was found but doesn't show me if anything was quarantined or deleted?


well it has stopped all the crazy stuff like when i opened a browser before it might open 40 or so windows, my mouse scrolling appeared to be stone cold drunk, all in all i's say it's doing great...again!
Yeah!!

ready to remove tools and quarantine folders?

[rcb56]

yes i suppose so! once again i thank you and safernetworking for saving my old strong pc from myself and the internet! thanks so much! have a happy thanksgiving!

[Juliet]

You and your family have a safe and Happy Thanks giving too!

DelFix


Please download DelFix (https://www.bleepingcomputer.com/download/delfix/) or from Here (http://www.bleepingcomputer.com/download/delfix/) and save the file to your Desktop.
Double-click DelFix.exe to run the programme.
Place a checkmark next to the following items:
Activate UAC
Remove disinfection tools
Click the Run button.
-- This will remove the specialized tools we used to disinfect your system.
Any leftover logs, files, folders or tools remaining on your Desktop which were not removed can be deleted manually (right-click the file + delete).

************************************

[rcb56]

done! thanks again so much!

[Juliet]

Your welcome

Glad we could help. http://i.imgur.com/SakDYGv.gif
Since this issue appears resolved ... this Topic is closed.