Page 1 of 2 12 LastLast
Results 1 to 10 of 19

Thread: Malware, logs are attached, this is HP Omen running Win 10

  1. #1
    Junior Member
    Join Date
    Jun 2017
    Posts
    15

    Question Malware, logs are attached, this is HP Omen running Win 10

    I was getting the BSOD several times a day. I ran Spybot S&D, AdwCleaner, Zemana, Malwarebytes, HitManPro.Alert, Avast Premiere. Spybot S&D, Malwarebytes, Hitman all found and removed a bunch of stuff. Others did not find anything, except AdwCleaner. It found and was unable to remove PUP.optional.advancedsystemcare, PUP.optional.legacy, and PUP.optional.productsetup.A. It said unknown handling error, terminating.

    I installed new copy of AdwCleaner, same problem:found them, can't remove them. On the last BSOD, which are still happening but less often, it said system service exception NETIO.sys. I thought there might be a problem with IOBit's Driver Booster so I uninstalled it (not necessarily because I thought it was related to NETIO.sys). I uninstalled a few other programs that I know are optional that I don't absolutely have to have such as Dropbox, etc as they are known for security holes. I ran CCleaner and it removed 65 GB of stuff no longer needed (this was after uninstalling those programs).

    I have included the required logs and Spybot's Rootkit scan logs as it found a bunch of stuff. I had to compress 3 of the .txt files.

    aswMBR.txtAddition.zipFRST.zipRootkits.180326-1617.zip

  2. #2
    Member of Team Spybot tashi's Avatar
    Join Date
    Oct 2005
    Location
    USA
    Posts
    30,475

    Default

    Hello geercom,

    In order for a volunteer analyst to respond please see the FAQ here.

    Copy and paste the Farbar Recovery Scan Tool and aswMBR logs into this topic as shown.

    The Addition.txt can be attached but not zipped.

    No need to post a log for the Root Analyzer:
    https://forums.spybot.info/showthrea...-Malware-Forum

    Best regards.
    Microsoft MVP Reconnect 2018-
    Windows Insider MVP 2016-2018
    Microsoft Consumer Security MVP 2006-2016

  3. #3
    Junior Member
    Join Date
    Jun 2017
    Posts
    15

    Default I will try to paste the logs again

    When I pasted the logs previously, I assumed they were too long because submitting the post timed out every time and went to a white error screen without posting the thread. When I tried to attach the files as they were, I got an error that they were too large.

    aswMBR version 1.0.1.2252 Copyright(c) 2014 AVAST Software
    Run date: 2018-03-26 14:55:33
    -----------------------------
    14:55:33.483 OS Version: Windows x64 6.2.9200
    14:55:33.483 Number of processors: 8 586 0x9E09
    14:55:33.483 ComputerName: DESKTOP-7F1R3BQ UserName: david
    14:55:34.389 Initialize success
    14:55:34.389 VM: initialized successfully
    14:55:34.389 VM: Intel CPU BiosDisabled
    14:55:42.487 AVAST engine defs: 18032600
    14:56:47.861 The log file has been saved successfully to "C:\Users\david\Desktop\aswMBR.txt"

    Scan result of Farbar Recovery Scan Tool (FRST) (x64) Version: 14.03.2018
    Ran by david (administrator) on DESKTOP-7F1R3BQ (26-03-2018 14:44:10)
    Running from C:\Users\david\Desktop
    Loaded Profiles: defaultuser0 & david & Administrator (Available Profiles: defaultuser0 & david & Administrator)
    Platform: Windows 10 Pro Version 1709 16299.309 (X64) Language: English (United States)
    Internet Explorer Version 11 (Default browser: Chrome)
    Boot Mode: Normal
    Tutorial for Farbar Recovery Scan Tool: http://www.geekstogo.com/forum/topic...ery-scan-tool/

    ==================== Processes (Whitelisted) =================

    (If an entry is included in the fixlist, the process will be closed. The file will not be moved.)

    (SurfRight B.V.) C:\Program Files (x86)\HitmanPro.Alert\hmpalert.exe
    (Realtek Semiconductor) C:\Program Files\Realtek\Audio\HDA\RtkAudioService64.exe
    (Realtek Semiconductor) C:\Program Files\Realtek\Audio\HDA\RAVBg64.exe
    (Realtek Semiconductor) C:\Program Files\Realtek\Audio\HDA\RAVBg64.exe
    (AVAST Software) C:\Program Files\AVAST Software\Avast\AvastSvc.exe
    (AVAST Software) C:\Program Files\AVAST Software\Avast\afwServ.exe
    (Safer-Networking Ltd.) C:\Program Files (x86)\Spybot - Search & Destroy 2\SDFSSvc.exe
    (Malwarebytes) C:\Program Files\Malwarebytes\Anti-Malware\MBAMService.exe
    (Copyright 2017.) C:\Program Files (x86)\Zemana AntiMalware\ZAM.exe
    (AVAST Software) C:\Program Files\AVAST Software\Avast\x64\aswidsagenta.exe
    (SurfRight B.V.) C:\Program Files (x86)\HitmanPro.Alert\hmpalert.exe
    (Malwarebytes) C:\Program Files\Malwarebytes\Anti-Malware\mbamtray.exe
    (IvoSoft) C:\Program Files\Classic Shell\ClassicStartMenu.exe
    () C:\Program Files\WindowsApps\Microsoft.SkypeApp_12.1811.248.0_x64__kzf8qxf38zg5c\SkypeHost.exe
    (Realtek Semiconductor) C:\Program Files\Realtek\Audio\HDA\RtkNGUI64.exe
    (AVAST Software) C:\Program Files\AVAST Software\Avast\AvastUI.exe
    (Copyright 2017.) C:\Program Files (x86)\Zemana AntiMalware\ZAM.exe
    (Piriform Ltd) C:\Program Files\CCleaner\CCleaner64.exe
    (Intel Corporation) C:\Program Files\Intel\Intel(R) Rapid Storage Technology\IAStorDataMgrSvc.exe
    (AVAST Software) C:\Program Files (x86)\AVAST Software\Avast Cleanup\TuneupSvc.exe
    (NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\Display.NvContainer\NVDisplay.Container.exe
    (NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\Display.NvContainer\NVDisplay.Container.exe
    (Safer-Networking Ltd.) C:\Program Files (x86)\Spybot - Search & Destroy 2\SDUpdSvc.exe
    (Microsoft Corporation) C:\Windows\System32\smartscreen.exe
    (Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
    (Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
    (Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
    (Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
    (Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
    (Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
    (Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
    (Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
    (Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
    (Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
    (Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
    (Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
    (Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
    (Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe

    ==================== Registry (Whitelisted) ===========================

    (If an entry is included in the fixlist, the registry item will be restored to default or removed. The file will not be moved.)

    HKLM\...\Run: [SecurityHealth] => C:\Program Files\Windows Defender\MSASCuiL.exe [630168 2017-09-29] (Microsoft Corporation)
    HKLM\...\Run: [RTHDVCPL] => C:\Program Files\Realtek\Audio\HDA\RtkNGUI64.exe [9235936 2018-03-22] (Realtek Semiconductor)
    HKLM\...\Run: [NvBackend] => C:\Program Files (x86)\NVIDIA Corporation\Update Core\NvBackend.exe [2397120 2016-06-15] (NVIDIA Corporation)
    HKLM\...\Run: [ShadowPlay] => "C:\windows\system32\rundll32.exe" C:\windows\system32\nvspcap64.dll,ShadowPlayOnSystemStart
    HKLM\...\Run: [AvastUI.exe] => C:\Program Files\AVAST Software\Avast\AvLaunch.exe [245608 2018-03-13] (AVAST Software)
    HKLM\...\Run: [Eraser] => C:\Program Files\Eraser\Eraser.exe [1074600 2016-08-28] (The Eraser Project)
    HKLM\...\Run: [Classic Start Menu] => C:\Program Files\Classic Shell\ClassicStartMenu.exe [163800 2016-07-30] (IvoSoft)
    HKLM\...\Run: [ZAM] => C:\Program Files (x86)\Zemana AntiMalware\ZAM.exe [15775888 2017-08-09] (Copyright 2017.)
    HKLM\...\Run: [iTunesHelper] => C:\Program Files\iTunes\iTunesHelper.exe [297272 2017-12-11] (Apple Inc.)
    HKLM\...\Run: [Logitech Download Assistant] => C:\Windows\system32\rundll32.exe C:\Windows\System32\LogiLDA.dll,LogiFetch
    HKLM-x32\...\Run: [HPMessageService] => C:\Program Files (x86)\HP\HP System Event\HPMSGSVC.exe [657424 2016-01-11] (HP Inc.)
    HKLM-x32\...\Run: [HPMSGSVC] => C:\Program Files (x86)\HP\HPPhoenixCtrl\HPMSGSVC.exe [502032 2016-06-16] (HP Development Company, L.P.)
    HKLM-x32\...\Run: [KeyScrambler] => C:\Program Files (x86)\KeyScrambler\keyscrambler.exe [515600 2017-04-22] (QFX Software Corporation)
    HKLM-x32\...\Run: [SDTray] => C:\Program Files (x86)\Spybot - Search & Destroy 2\SDTray.exe [4101576 2014-06-24] (Safer-Networking Ltd.)
    HKLM-x32\...\RunOnce: [SBrowserCheck] => C:\ProgramData\Avast Software\Avast\SecureBrowser\avast_browser_setup_checker.exe [2482128 2018-03-20] ()
    HKLM Group Policy restriction on software: %systemroot%\system32\mrt.exe <==== ATTENTION
    Winlogon\Notify\SDWinLogon-x32: SDWinLogon.dll [X]
    HKU\S-1-5-21-3840204244-4144708379-2675172571-1000\...\RunOnce: [WAB Migrate] => C:\Program Files\Windows Mail\wab.exe [519680 2017-09-29] (Microsoft Corporation)
    HKU\S-1-5-21-3840204244-4144708379-2675172571-1001\...\Run: [WinPatrol] => C:\Program Files (x86)\Ruiware\WinPatrol\winpatrol.exe [1223560 2017-05-07] (Ruiware)
    HKU\S-1-5-21-3840204244-4144708379-2675172571-1001\...\Run: [SpybotPostWindows10UpgradeReInstall] => C:\Program Files\Common Files\AV\Spybot - Search and Destroy\Test.exe [1011200 2015-07-28] (Safer-Networking Ltd.)
    HKU\S-1-5-21-3840204244-4144708379-2675172571-1001\...\Run: [f.lux] => C:\Users\david\AppData\Local\FluxSoftware\Flux\flux.exe [1678840 2017-10-10] (f.lux Software LLC)
    HKU\S-1-5-21-3840204244-4144708379-2675172571-1001\...\Run: [Amazon Drive] => C:\Users\david\AppData\Local\Amazon Drive\AmazonDrive.exe [6319280 2018-03-22] (Amazon.com Inc.)
    HKU\S-1-5-21-3840204244-4144708379-2675172571-1001\...\Run: [EPLTarget\P0000000000000000] => C:\WINDOWS\system32\spool\DRIVERS\x64\3\E_IATILBE.EXE [297024 2013-01-24] (SEIKO EPSON CORPORATION)
    HKU\S-1-5-21-3840204244-4144708379-2675172571-1001\...\Run: [CCleaner Monitoring] => C:\Program Files\CCleaner\CCleaner64.exe [17074688 2018-03-06] (Piriform Ltd)
    HKU\S-1-5-21-3840204244-4144708379-2675172571-1001\...\RunOnce: [Uninstall 18.025.0204.0009\amd64] => C:\WINDOWS\system32\cmd.exe /q /c rmdir /s /q "C:\Users\david\AppData\Local\Microsoft\OneDrive\18.025.0204.0009\amd64"
    HKU\S-1-5-21-3840204244-4144708379-2675172571-1001\...\RunOnce: [Uninstall 18.025.0204.0009] => C:\WINDOWS\system32\cmd.exe /q /c rmdir /s /q "C:\Users\david\AppData\Local\Microsoft\OneDrive\18.025.0204.0009"
    HKU\S-1-5-21-3840204244-4144708379-2675172571-500\...\RunOnce: [WAB Migrate] => C:\Program Files\Windows Mail\wab.exe [519680 2017-09-29] (Microsoft Corporation)
    IFEO\appvlp.exe: [Debugger] "C:\Program Files (x86)\AVAST Software\Avast Cleanup\autoreactivator.exe"
    IFEO\excel.exe: [Debugger] "C:\Program Files (x86)\AVAST Software\Avast Cleanup\autoreactivator.exe"
    IFEO\groove.exe: [Debugger] "C:\Program Files (x86)\AVAST Software\Avast Cleanup\autoreactivator.exe"
    IFEO\hporbit.exe: [Debugger] "C:\Program Files (x86)\AVAST Software\Avast Cleanup\autoreactivator.exe"
    IFEO\hpphoenixctrl.exe: [Debugger] "C:\Program Files (x86)\AVAST Software\Avast Cleanup\autoreactivator.exe"
    IFEO\hpsf.exe: [Debugger] "C:\Program Files (x86)\AVAST Software\Avast Cleanup\autoreactivator.exe"
    IFEO\irmtmodernui.exe: [Debugger] "C:\Program Files (x86)\AVAST Software\Avast Cleanup\autoreactivator.exe"
    IFEO\iwrap.exe: [Debugger] "C:\Program Files (x86)\AVAST Software\Avast Cleanup\autoreactivator.exe"
    IFEO\lync.exe: [Debugger] "C:\Program Files (x86)\AVAST Software\Avast Cleanup\autoreactivator.exe"
    IFEO\msaccess.exe: [Debugger] "C:\Program Files (x86)\AVAST Software\Avast Cleanup\autoreactivator.exe"
    IFEO\msoev.exe: [Debugger] "C:\Program Files (x86)\AVAST Software\Avast Cleanup\autoreactivator.exe"
    IFEO\msotd.exe: [Debugger] "C:\Program Files (x86)\AVAST Software\Avast Cleanup\autoreactivator.exe"
    IFEO\msoxmled.exe: [Debugger] "C:\Program Files (x86)\AVAST Software\Avast Cleanup\autoreactivator.exe"
    IFEO\mspub.exe: [Debugger] "C:\Program Files (x86)\AVAST Software\Avast Cleanup\autoreactivator.exe"
    IFEO\ocpubmgr.exe: [Debugger] "C:\Program Files (x86)\AVAST Software\Avast Cleanup\autoreactivator.exe"
    IFEO\onenote.exe: [Debugger] "C:\Program Files (x86)\AVAST Software\Avast Cleanup\autoreactivator.exe"
    IFEO\onenotem.exe: [Debugger] "C:\Program Files (x86)\AVAST Software\Avast Cleanup\autoreactivator.exe"
    IFEO\outlook.exe: [Debugger] "C:\Program Files (x86)\AVAST Software\Avast Cleanup\autoreactivator.exe"
    IFEO\powerpnt.exe: [Debugger] "C:\Program Files (x86)\AVAST Software\Avast Cleanup\autoreactivator.exe"
    IFEO\rebecca.exe: [Debugger] "C:\Program Files (x86)\AVAST Software\Avast Cleanup\autoreactivator.exe"
    IFEO\setlang.exe: [Debugger] "C:\Program Files (x86)\AVAST Software\Avast Cleanup\autoreactivator.exe"
    IFEO\softwareupdate.exe: [Debugger] "C:\Program Files (x86)\AVAST Software\Avast Cleanup\autoreactivator.exe"
    IFEO\winword.exe: [Debugger] "C:\Program Files (x86)\AVAST Software\Avast Cleanup\autoreactivator.exe"
    Startup: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\Avast Cleanup Premium.lnk [2017-10-05]
    ShortcutTarget: Avast Cleanup Premium.lnk -> C:\Program Files (x86)\AVAST Software\Avast Cleanup\TuneupUI.exe (AVAST Software)
    Startup: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\SteelSeries Engine 3.lnk [2017-02-08]
    ShortcutTarget: SteelSeries Engine 3.lnk -> C:\Program Files\SteelSeries\SteelSeries Engine 3\SteelSeriesEngine3.exe (SteelSeries ApS)
    Startup: C:\Users\david\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Send to OneNote.lnk [2017-12-22]
    ShortcutTarget: Send to OneNote.lnk -> C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTEM.EXE (Microsoft Corporation)

    ==================== Internet (Whitelisted) ====================

    (If an item is included in the fixlist, if it is a registry item it will be removed or restored to default.)

    Hosts: There are more than one entry in Hosts. See Hosts section of Addition.txt
    Tcpip\Parameters: [DhcpNameServer] 209.18.47.62 209.18.47.61
    Tcpip\..\Interfaces\{0f97bf0f-54bf-44f8-a554-0401debf0323}: [NameServer] 77.234.40.79
    Tcpip\..\Interfaces\{a1ab7776-22f9-428e-a8fd-c83a210a0aa1}: [DhcpNameServer] 209.18.47.62 209.18.47.61

    Internet Explorer:
    ==================
    HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://hp17win10.msn.com/?pc=HCTE
    HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = hxxp://hp17win10.msn.com/?pc=HCTE
    HKU\.DEFAULT\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://hp17win10.msn.com/?pc=HCTE
    HKU\.DEFAULT\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = hxxp://hp17win10.msn.com/?pc=HCTE
    HKU\S-1-5-21-3840204244-4144708379-2675172571-1001\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://hp17win10.msn.com/?pc=HCTE
    HKU\S-1-5-21-3840204244-4144708379-2675172571-1001\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = hxxp://hp17win10.msn.com/?pc=HCTE
    SearchScopes: HKLM -> DefaultScope value is missing
    SearchScopes: HKU\S-1-5-21-3840204244-4144708379-2675172571-1001 -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = hxxps://www.bing.com/search?q={searchTerms}&src=IE-SearchBox&FORM=IESR02&pc=UE04
    SearchScopes: HKU\S-1-5-21-3840204244-4144708379-2675172571-1001 -> {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = hxxps://www.bing.com/search?q={searchTerms}&src=IE-SearchBox&FORM=IESR02&pc=UE04
    SearchScopes: HKU\S-1-5-21-3840204244-4144708379-2675172571-1001 -> {518b33ae-375d-712d-6742-d1fe0400268d} URL =
    BHO: Lync Browser Helper -> {31D09BA0-12F5-4CCE-BE8A-2923E76605DA} -> C:\Program Files (x86)\Microsoft Office\root\VFS\ProgramFilesX64\Microsoft Office\Office16\OCHelper.dll [2018-03-01] (Microsoft Corporation)
    BHO: Microsoft OneDrive for Business Browser Helper -> {D0498E0A-45B7-42AE-A9AA-ABA463DBD3BF} -> C:\Program Files (x86)\Microsoft Office\root\VFS\ProgramFilesX64\Microsoft Office\Office16\GROOVEEX.DLL [2018-03-18] (Microsoft Corporation)
    BHO: HP Network Check Helper -> {E76FD755-C1BA-4DCB-9F13-99BD91223ADE} -> C:\Program Files (x86)\Hewlett-Packard\HP Support Framework\Resources\HPNetworkCheck\HPNetworkCheckPluginx64.dll [2016-09-22] (HP Inc.)
    BHO-x32: Lync Browser Helper -> {31D09BA0-12F5-4CCE-BE8A-2923E76605DA} -> C:\Program Files (x86)\Microsoft Office\root\Office16\OCHelper.dll [2018-03-01] (Microsoft Corporation)
    BHO-x32: Microsoft OneDrive for Business Browser Helper -> {D0498E0A-45B7-42AE-A9AA-ABA463DBD3BF} -> C:\Program Files (x86)\Microsoft Office\root\Office16\GROOVEEX.DLL [2018-03-18] (Microsoft Corporation)
    BHO-x32: HP Network Check Helper -> {E76FD755-C1BA-4DCB-9F13-99BD91223ADE} -> C:\Program Files (x86)\Hewlett-Packard\HP Support Framework\Resources\HPNetworkCheck\HPNetworkCheckPlugin.dll [2016-09-22] (HP Inc.)
    Handler-x32: belarc - {6318E0AB-2E93-11D1-B8ED-00608CC9A71F} - C:\Program Files (x86)\Belarc\BelarcAdvisor\System\BAVoilaX.dll [2016-01-04] (Belarc, Inc.)
    Handler-x32: mso-minsb-roaming.16 - {83C25742-A9F7-49FB-9138-434302C88D07} - C:\Program Files (x86)\Microsoft Office\root\Office16\MSOSB.DLL [2018-03-01] (Microsoft Corporation)
    Handler-x32: mso-minsb.16 - {42089D2D-912D-4018-9087-2B87803E93FB} - C:\Program Files (x86)\Microsoft Office\root\Office16\MSOSB.DLL [2018-03-01] (Microsoft Corporation)
    Handler-x32: osf-roaming.16 - {42089D2D-912D-4018-9087-2B87803E93FB} - C:\Program Files (x86)\Microsoft Office\root\Office16\MSOSB.DLL [2018-03-01] (Microsoft Corporation)
    Handler-x32: osf.16 - {5504BE45-A83B-4808-900A-3A5C36E7F77A} - C:\Program Files (x86)\Microsoft Office\root\Office16\MSOSB.DLL [2018-03-01] (Microsoft Corporation)

    FireFox:
    ========
    FF DefaultProfile: m3cozkdk.default
    FF ProfilePath: C:\Users\david\AppData\Roaming\Mozilla\Firefox\Profiles\m3cozkdk.default [2018-03-26]
    FF Homepage: Mozilla\Firefox\Profiles\m3cozkdk.default -> about:home
    FF Extension: (Avast SafePrice) - C:\Users\david\AppData\Roaming\Mozilla\Firefox\Profiles\m3cozkdk.default\Extensions\sp@avast.com.xpi [2017-09-03]
    FF Plugin-x32: @microsoft.com/Lync,version=15.0 -> C:\Program Files (x86)\Microsoft Office\root\VFS\ProgramFilesX86\Mozilla Firefox\plugins\npmeetingjoinpluginoc.dll [2018-03-01] (Microsoft Corporation)
    FF Plugin-x32: @microsoft.com/SharePoint,version=14.0 -> C:\Program Files (x86)\Microsoft Office\root\Office16\NPSPWRAP.DLL [2018-03-01] (Microsoft Corporation)
    FF Plugin-x32: @tools.google.com/Google Update;version=3 -> C:\Program Files (x86)\Google\Update\1.3.33.7\npGoogleUpdate3.dll [2017-11-14] (Google Inc.)
    FF Plugin-x32: @tools.google.com/Google Update;version=9 -> C:\Program Files (x86)\Google\Update\1.3.33.7\npGoogleUpdate3.dll [2017-11-14] (Google Inc.)
    FF Plugin-x32: Adobe Reader -> C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AIR\nppdf32.dll [2018-02-11] (Adobe Systems Inc.)
    FF Plugin ProgramFiles/Appdata: C:\Users\david\AppData\Roaming\mozilla\plugins\npatgpc.dll [2017-09-20] (Cisco WebEx LLC)

    Chrome:
    =======
    CHR DefaultProfile: Default
    CHR HomePage: Default -> hxxps://www.google.com/search?q=+
    CHR Profile: C:\Users\david\AppData\Local\Google\Chrome\User Data\Default [2018-03-26]
    CHR Extension: (Slides) - C:\Users\david\AppData\Local\Google\Chrome\User Data\Default\Extensions\aapocclcgogkmnckokdopfmhonfmgoek [2017-10-18]
    CHR Extension: (Docs) - C:\Users\david\AppData\Local\Google\Chrome\User Data\Default\Extensions\aohghmighlieiainnegkcijnfilokake [2017-10-18]
    CHR Extension: (Google Drive) - C:\Users\david\AppData\Local\Google\Chrome\User Data\Default\Extensions\apdfllckaahabafndbhieahigkjlhalf [2017-05-18]
    CHR Extension: (YouTube) - C:\Users\david\AppData\Local\Google\Chrome\User Data\Default\Extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo [2017-05-18]
    CHR Extension: (Honey) - C:\Users\david\AppData\Local\Google\Chrome\User Data\Default\Extensions\bmnlcjabgnpnenekpadlanbbkooimhnj [2018-03-10]
    CHR Extension: (Rebrandly) - C:\Users\david\AppData\Local\Google\Chrome\User Data\Default\Extensions\eaidebojanpehpceonghnmgdofblnlae [2018-03-26]
    CHR Extension: (Chromebleed) - C:\Users\david\AppData\Local\Google\Chrome\User Data\Default\Extensions\eeoekjnjgppnaegdjbcafdggilajhpic [2017-05-18]
    CHR Extension: (Adobe Acrobat) - C:\Users\david\AppData\Local\Google\Chrome\User Data\Default\Extensions\efaidnbmnnnibpcajpcglclefindmkaj [2017-05-18]
    CHR Extension: (Open options.) - C:\Users\david\AppData\Local\Google\Chrome\User Data\Default\Extensions\eiadekoaikejlgdbkbdfeijglgfdalml [2017-12-08]
    CHR Extension: (Sheets) - C:\Users\david\AppData\Local\Google\Chrome\User Data\Default\Extensions\felcaaldnbdncclmgdcncolpebgiejap [2017-10-18]
    CHR Extension: (HTTPS Everywhere) - C:\Users\david\AppData\Local\Google\Chrome\User Data\Default\Extensions\gcbommkclmclpchllfjekcdonpmejbdp [2018-03-01]
    CHR Extension: (Google Docs Offline) - C:\Users\david\AppData\Local\Google\Chrome\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi [2017-05-18]
    CHR Extension: (Avast Online Security) - C:\Users\david\AppData\Local\Google\Chrome\User Data\Default\Extensions\gomekmidlodglbbmalcneegieacbdmki [2018-03-02]
    CHR Extension: (Hunter) - C:\Users\david\AppData\Local\Google\Chrome\User Data\Default\Extensions\hgmhmanijnjhaffoampdlllchpolkdnj [2018-03-21]
    CHR Extension: (SimilarWeb - Traffic Rank & Website Analysis) - C:\Users\david\AppData\Local\Google\Chrome\User Data\Default\Extensions\hoklmmgfnpapgjgcpechhaamimifchmp [2018-03-01]
    CHR Extension: (Cisco WebEx Extension) - C:\Users\david\AppData\Local\Google\Chrome\User Data\Default\Extensions\jlhmfgmfgeifomenelglieieghnjghma [2017-09-20]
    CHR Extension: (Grammarly for Chrome) - C:\Users\david\AppData\Local\Google\Chrome\User Data\Default\Extensions\kbfnbcaeplbcioakkpcpgfkobkghlhen [2018-03-21]
    CHR Extension: (The Great Suspender) - C:\Users\david\AppData\Local\Google\Chrome\User Data\Default\Extensions\klbibkeccnjlkjkiokjodocebajanakg [2017-06-19]
    CHR Extension: (Flashcontrol) - C:\Users\david\AppData\Local\Google\Chrome\User Data\Default\Extensions\mfidmkgnfgnkihnjeklbekckimkipmoe [2017-07-13]
    CHR Extension: (Crystal) - C:\Users\david\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmaonghoefpmlfgaknnboiekjhfpmajh [2018-03-21]
    CHR Extension: (Chrome Web Store Payments) - C:\Users\david\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda [2017-08-21]
    CHR Extension: (Gmail) - C:\Users\david\AppData\Local\Google\Chrome\User Data\Default\Extensions\pjkljhegncpnkpknbcohdijeoejaedia [2017-05-18]
    CHR Extension: (Chrome Media Router) - C:\Users\david\AppData\Local\Google\Chrome\User Data\Default\Extensions\pkedcjkdefgpdelpbcmbmeomcjbeemfm [2018-03-23]
    CHR Extension: (Dux-Soup for LinkedIn) - C:\Users\david\AppData\Local\Google\Chrome\User Data\Default\Extensions\ppdakpfeaodfophjplfdedpcodkdkbal [2018-03-26]
    CHR Profile: C:\Users\david\AppData\Local\Google\Chrome\User Data\System Profile [2018-03-26]
    CHR HKLM-x32\...\Chrome\Extension: [efaidnbmnnnibpcajpcglclefindmkaj] - hxxps://clients2.google.com/service/update2/crx
    CHR HKLM-x32\...\Chrome\Extension: [eofcbnmajmjmplflapaojjnihcjkigck] - hxxps://clients2.google.com/service/update2/crx
    CHR HKLM-x32\...\Chrome\Extension: [gomekmidlodglbbmalcneegieacbdmki] - hxxps://clients2.google.com/service/update2/crx

    ==================== Services (Whitelisted) ====================

    (If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)

    S4 Apple Mobile Device Service; C:\Program Files\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe [83768 2017-11-27] (Apple Inc.)
    R3 aswbIDSAgent; C:\Program Files\AVAST Software\Avast\x64\aswidsagenta.exe [7556704 2018-03-13] (AVAST Software)
    R2 avast! Antivirus; C:\Program Files\AVAST Software\Avast\AvastSvc.exe [303728 2018-03-13] (AVAST Software)
    R2 avast! Firewall; C:\Program Files\AVAST Software\Avast\afwServ.exe [357760 2018-03-13] (AVAST Software)
    R2 CleanupPSvc; C:\Program Files (x86)\AVAST Software\Avast Cleanup\TuneupSvc.exe [7649576 2018-03-09] (AVAST Software)
    S4 ClickToRunSvc; C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe [7962288 2018-03-12] (Microsoft Corporation)
    S4 EpsonCustomerResearchParticipation; C:\Program Files\EPSON\EpsonCustomerResearchParticipation\EPCP.exe [677880 2017-04-25] (SEIKO EPSON CORPORATION)
    S2 GfExperienceService; C:\Program Files\NVIDIA Corporation\GeForce Experience Service\GfExperienceService.exe [1163712 2016-06-15] (NVIDIA Corporation)
    R2 hmpalertsvc; C:\Program Files (x86)\HitmanPro.Alert\hmpalert.exe [4616328 2018-03-21] (SurfRight B.V.)
    S2 HP Comm Recover; C:\Program Files\HPCommRecovery\HPCommRecovery.exe [1309184 2016-10-07] (HP Inc.) [File not signed]
    S4 HP Orbit Service; C:\Program Files\HP\HP Orbit Service\HPOrbitService.exe [3421616 2017-06-20] (HP Inc.)
    S4 HPJumpStartBridge; C:\Program Files (x86)\HP\HP JumpStart Bridge\HPJumpStartBridge.exe [471040 2017-07-28] (HP Inc.)
    S4 hpqcaslwmiex; C:\Program Files (x86)\HP\Shared\hpqwmiex.exe [1031704 2016-06-04] (HP)
    S4 HPSupportSolutionsFrameworkService; C:\Program Files (x86)\Hewlett-Packard\HP Support Solutions\HPSupportSolutionsFrameworkService.exe [332144 2017-11-21] (HP Inc.)
    S4 HPTouchpointAnalyticsService; C:\Program Files\HP\HP Touchpoint Analytics Client\TouchpointAnalyticsClientService.exe [332216 2017-11-22] (HP Inc.)
    S4 HPWMISVC; c:\Program Files (x86)\HP\HPPhoenixCtrl\HPWMISVC.exe [554768 2016-06-16] (HP Development Company, L.P.)
    R2 IAStorDataMgrSvc; C:\Program Files\Intel\Intel(R) Rapid Storage Technology\IAStorDataMgrSvc.exe [17976 2016-09-20] (Intel Corporation)
    S2 ibtsiva; C:\WINDOWS\system32\ibtsiva.exe [542320 2017-12-06] (Intel Corporation)
    S2 IISExpressSVC; C:\Program Files (x86)\Lansweeper\IISExpress\IISexpressSVC.exe [131072 2017-06-23] (Hemoco bvba) [File not signed]
    S4 Intel(R) Capability Licensing Service TCP IP Interface; C:\Program Files\Intel\iCLS Client\SocketHeciServer.exe [742704 2017-10-11] (Intel(R) Corporation)
    S4 Intel(R) TPM Provisioning Service; C:\Program Files\Intel\iCLS Client\TPMProvisioningService.exe [668472 2017-10-11] (Intel(R) Corporation)
    S4 IRMTService; C:\Program Files\Intel\Intel(R) Ready Mode Technology\IRMTService.exe [182896 2016-10-13] (Intel Corporation)
    S4 jhi_service; C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\DAL\jhi_service.exe [213648 2017-11-09] (Intel Corporation)
    S2 lansweeperservice; C:\Program Files (x86)\Lansweeper\Service\Lansweeperservice.exe [17175552 2017-07-27] (Lansweeper) [File not signed]
    R2 MBAMService; C:\Program Files\Malwarebytes\Anti-Malware\mbamservice.exe [6440736 2018-03-03] (Malwarebytes)
    S4 MyWiFiDHCPDNS; C:\Program Files\Intel\WiFi\bin\PanDhcpDns.exe [268928 2017-12-20] ()
    S2 NvNetworkService; C:\Program Files (x86)\NVIDIA Corporation\NetService\NvNetworkService.exe [1879488 2016-06-15] (NVIDIA Corporation)
    S2 NvStreamSvc; C:\Program Files\NVIDIA Corporation\NvStreamSrv\NvStreamService.exe [2521024 2016-06-15] (NVIDIA Corporation)
    S3 QFXUpdateService; C:\Program Files (x86)\KeyScrambler\x64\QFXUpdateService.exe [86544 2017-04-22] ()
    R2 RtkAudioService; C:\Program Files\Realtek\Audio\HDA\RtkAudioService64.exe [324576 2018-03-22] (Realtek Semiconductor)
    R2 SDScannerService; C:\Program Files (x86)\Spybot - Search & Destroy 2\SDFSSvc.exe [1738168 2014-06-24] (Safer-Networking Ltd.)
    R2 SDUpdateService; C:\Program Files (x86)\Spybot - Search & Destroy 2\SDUpdSvc.exe [4088608 2016-09-21] (Safer-Networking Ltd.) [File not signed]
    S2 SDWSCService; C:\Program Files (x86)\Spybot - Search & Destroy 2\SDWSCSvc.exe [235984 2016-11-24] (Safer-Networking Ltd.) [File not signed]
    S3 Sense; C:\Program Files\Windows Defender Advanced Threat Protection\MsSense.exe [4329952 2018-01-24] (Microsoft Corporation)
    S2 ss_conn_service; C:\Program Files\Samsung\USB Drivers\27_ssconn\conn\ss_conn_service.exe [754784 2016-01-08] (DEVGURU Co., LTD.)
    S3 WdNisSvc; C:\Program Files\Windows Defender\NisSrv.exe [355304 2017-09-29] (Microsoft Corporation)
    S3 WinDefend; C:\Program Files\Windows Defender\MsMpEng.exe [105944 2017-09-29] (Microsoft Corporation)
    R2 ZAMSvc; C:\Program Files (x86)\Zemana AntiMalware\ZAM.exe [15775888 2017-08-09] (Copyright 2017.)
    S4 ZeroConfigService; C:\Program Files\Intel\WiFi\bin\ZeroConfigService.exe [3758720 2017-12-20] (Intel® Corporation)
    R2 NVDisplay.ContainerLocalSystem; "C:\Program Files\NVIDIA Corporation\Display.NvContainer\NVDisplay.Container.exe" -s NVDisplay.ContainerLocalSystem -f "C:\ProgramData\NVIDIA\NVDisplay.ContainerLocalSystem.log" -l 3 -d "C:\Program Files\NVIDIA Corporation\Display.NvContainer\plugins\LocalSystem" -r -p 30000

    ===================== Drivers (Whitelisted) ======================

    (If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)

    S3 AmUStor; C:\WINDOWS\system32\drivers\AmUStor.SYS [90560 2018-03-22] (Alcorlink Corp.)
    R1 aswArPot; C:\WINDOWS\System32\drivers\aswArPot.sys [196648 2018-03-13] (AVAST Software)
    R1 aswbidsdriver; C:\WINDOWS\System32\drivers\aswbidsdrivera.sys [227504 2018-03-13] (AVAST Software)
    R0 aswbidsh; C:\WINDOWS\System32\drivers\aswbidsha.sys [199440 2018-03-13] (AVAST Software)
    R0 aswblog; C:\WINDOWS\System32\drivers\aswbloga.sys [343752 2018-03-13] (AVAST Software)
    R0 aswbuniv; C:\WINDOWS\System32\drivers\aswbuniva.sys [57680 2018-03-13] (AVAST Software)
    S3 aswHwid; C:\WINDOWS\System32\drivers\aswHwid.sys [46968 2018-03-13] (AVAST Software)
    R1 aswKbd; C:\WINDOWS\system32\drivers\aswKbd.sys [41832 2017-09-03] (AVAST Software)
    R2 aswMonFlt; C:\WINDOWS\System32\drivers\aswMonFlt.sys [146656 2018-03-13] (AVAST Software)
    R1 aswNetSec; C:\WINDOWS\System32\drivers\aswNetSec.sys [619984 2018-03-13] (AVAST Software)
    R1 aswRdr; C:\WINDOWS\System32\drivers\aswRdr2.sys [110328 2018-03-13] (AVAST Software)
    R0 aswRvrt; C:\WINDOWS\System32\drivers\aswRvrt.sys [84368 2018-03-13] (AVAST Software)
    R1 aswSnx; C:\WINDOWS\System32\drivers\aswSnx.sys [1026696 2018-03-13] (AVAST Software)
    R1 aswSP; C:\WINDOWS\System32\drivers\aswSP.sys [460520 2018-03-13] (AVAST Software)
    R2 aswStm; C:\WINDOWS\System32\drivers\aswStm.sys [205976 2018-03-13] (AVAST Software)
    S3 aswTap; C:\WINDOWS\System32\drivers\aswTap.sys [53904 2017-05-18] (The OpenVPN Project)
    R0 aswVmm; C:\WINDOWS\System32\drivers\aswVmm.sys [380528 2018-03-13] (AVAST Software)
    S3 dg_ssudbus; C:\WINDOWS\system32\DRIVERS\ssudbus.sys [131984 2017-05-18] (Samsung Electronics Co., Ltd.)
    R1 ESProtectionDriver; C:\WINDOWS\system32\drivers\mbae64.sys [76200 2018-01-18] ()
    R3 ETDSMBus; C:\WINDOWS\System32\drivers\ETDSMBus.sys [32840 2017-07-01] (ELAN Microelectronic Corp.)
    R1 hmpalert; C:\windows\system32\drivers\hmpalert.sys [297712 2018-03-21] (SurfRight B.V.)
    R3 hmpnet; C:\windows\system32\drivers\hmpnet.sys [93800 2018-03-21] (SurfRight B.V.)
    R1 HWiNFO32; C:\windows\SysWOW64\drivers\HWiNFO64A.SYS [27552 2017-07-01] (REALiX(tm))
    R3 ibtusb; C:\WINDOWS\system32\DRIVERS\ibtusb.sys [198080 2018-03-22] (Intel Corporation)
    R3 IntelReadyModeDriver; C:\WINDOWS\System32\drivers\IntelReadyModeDriver.sys [34720 2016-10-13] (Intel Corporation)
    R3 KeyScrambler; C:\WINDOWS\System32\drivers\keyscrambler.sys [233248 2017-02-19] (QFX Software Corporation)
    R2 MBAMChameleon; C:\WINDOWS\System32\Drivers\MbamChameleon.sys [193248 2018-03-12] (Malwarebytes)
    R3 MBAMFarflt; C:\WINDOWS\System32\DRIVERS\farflt.sys [109800 2018-03-26] (Malwarebytes)
    R3 MBAMProtection; C:\WINDOWS\system32\DRIVERS\mbam.sys [45960 2018-03-26] (Malwarebytes)
    R0 MBAMSwissArmy; C:\WINDOWS\System32\Drivers\mbamswissarmy.sys [253664 2018-03-23] (Malwarebytes)
    R3 MBAMWebProtection; C:\WINDOWS\system32\DRIVERS\mwac.sys [101600 2018-03-26] (Malwarebytes)
    S3 NETwNb64; C:\WINDOWS\System32\drivers\Netwbw04.sys [3556072 2017-09-03] (Intel Corporation)
    S3 NETwNs64; C:\WINDOWS\System32\drivers\Netwsw04.sys [3471880 2017-11-16] (Intel Corporation)
    R3 Netwtw04; C:\WINDOWS\System32\drivers\Netwtw04.sys [8614888 2018-03-22] (Intel Corporation)
    R3 nvlddmkm; C:\WINDOWS\System32\DriverStore\FileRepository\nvhdci.inf_amd64_a33a405d786e1e76\nvlddmkm.sys [17493824 2018-03-22] (NVIDIA Corporation)
    S3 NvStreamKms; C:\Program Files\NVIDIA Corporation\NvStreamSrv\NvStreamKms.sys [26560 2016-06-15] (NVIDIA Corporation)
    R3 nvvad_WaveExtensible; C:\WINDOWS\system32\drivers\nvvad64v.sys [59240 2018-03-22] (NVIDIA Corporation)
    S3 pmxdrv; C:\WINDOWS\system32\drivers\pmxdrv.sys [31152 2018-02-02] ()
    R3 rt640x64; C:\WINDOWS\System32\drivers\rt640x64.sys [1026896 2018-03-22] (Realtek )
    S3 RTSUER; C:\WINDOWS\system32\Drivers\RtsUer.sys [420832 2017-09-03] (Realsil Semiconductor Corporation)
    R3 ssdevfactory; C:\WINDOWS\System32\drivers\ssdevfactory.sys [41104 2016-10-18] (SteelSeries ApS)
    S3 sshid; C:\WINDOWS\System32\drivers\sshid.sys [52960 2016-10-04] (SteelSeries ApS)
    S3 ssudmdm; C:\WINDOWS\system32\DRIVERS\ssudmdm.sys [166288 2017-05-18] (Samsung Electronics Co., Ltd.)
    R1 UimBus; C:\WINDOWS\System32\drivers\uimbus.sys [108856 2017-04-11] (Paragon Software GmbH)
    R1 Uim_DEVIM; C:\WINDOWS\System32\drivers\uimdevim.sys [44848 2017-04-11] (Paragon Software GmbH)
    S3 WdBoot; C:\WINDOWS\system32\drivers\WdBoot.sys [44608 2017-09-29] (Microsoft Corporation)
    S3 WdFilter; C:\WINDOWS\system32\drivers\WdFilter.sys [309144 2017-09-29] (Microsoft Corporation)
    S3 WdNisDrv; C:\WINDOWS\System32\Drivers\WdNisDrv.sys [119192 2017-09-29] (Microsoft Corporation)
    R1 ZAM; C:\windows\System32\drivers\zam64.sys [203680 2017-12-08] (Zemana Ltd.)
    R1 ZAM_Guard; C:\windows\System32\drivers\zamguard64.sys [203680 2017-06-17] (Zemana Ltd.)

    ==================== NetSvcs (Whitelisted) ===================

    (If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)


    ==================== One Month Created files and folders ========

    (If an entry is included in the fixlist, the file/folder will be moved.)

    2018-03-26 14:44 - 2018-03-26 14:44 - 000031095 _____ C:\Users\david\Desktop\FRST.txt
    2018-03-26 14:43 - 2018-03-26 14:44 - 000000000 ____D C:\FRST
    2018-03-26 14:42 - 2018-03-26 14:42 - 002403328 _____ (Farbar) C:\Users\david\Desktop\FRST64.exe
    2018-03-26 14:39 - 2018-03-26 14:39 - 000000207 _____ C:\WINDOWS\tweaking.com-regbackup-DESKTOP-7F1R3BQ-Windows-10-Pro-(64-bit).dat
    2018-03-26 14:39 - 2018-03-26 14:39 - 000000000 ____D C:\RegBackup
    2018-03-26 14:38 - 2018-03-26 14:38 - 000017985 _____ C:\WINDOWS\Tweaking.com - Registry Backup Setup Log.txt
    2018-03-26 14:38 - 2018-03-26 14:38 - 000002319 _____ C:\Users\Public\Desktop\Tweaking.com - Registry Backup.lnk
    2018-03-26 14:38 - 2018-03-26 14:38 - 000000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Tweaking.com
    2018-03-26 14:38 - 2018-03-26 14:38 - 000000000 ____D C:\Program Files (x86)\Tweaking.com
    2018-03-26 14:37 - 2018-03-26 14:37 - 005766144 _____ (Tweaking.com) C:\Users\david\Desktop\tweaking.com_registry_backup_setup.exe
    2018-03-26 14:31 - 2018-03-26 14:31 - 000000088 _____ C:\Users\david\Desktop\Malware Removal.url
    2018-03-26 13:37 - 2018-03-26 13:40 - 000082432 _____ C:\Users\david\Desktop\RE Very important fact check for Stan Sterna comment.msg
    2018-03-26 13:37 - 2018-03-26 13:37 - 000076800 _____ C:\Users\david\Desktop\RE Very important question about one of Shane Randolph's comments.msg
    2018-03-26 12:01 - 2018-03-26 12:01 - 000061440 _____ C:\Users\david\Desktop\ANSWER THESE AND RETURN TO STACY Few more questions for your Smart Contracts story.msg
    2018-03-26 10:17 - 2018-03-26 10:17 - 000000096 _____ C:\Users\david\Desktop\How to Find the Best Contact for Your LOI - Technology Content Marketing Writer - Jennifer Goforth Gregory - Raleigh Freelance Technology Writer.url
    2018-03-26 09:40 - 2018-03-26 09:40 - 000103936 _____ C:\Users\david\Desktop\Today's LinkedIn Pulse post.msg
    2018-03-25 12:45 - 2018-03-25 12:45 - 000064000 _____ C:\Users\david\Desktop\Your Amazon.com order of Epson 200XL High Yield... has shipped!.msg
    2018-03-24 19:21 - 2018-03-24 19:21 - 000000163 _____ C:\Users\david\Desktop\-BEFORE You POST-(Please read this Procedure Before Requesting Assistance)- Updated.url
    2018-03-24 17:28 - 2018-03-24 17:28 - 000052224 _____ C:\Users\david\Desktop\Your Amazon.com order of Epson 200XL High Yield... and 1 more item..msg
    2018-03-24 03:02 - 2018-03-26 13:30 - 000045960 _____ (Malwarebytes) C:\WINDOWS\system32\Drivers\mbam.sys
    2018-03-24 03:02 - 2018-03-24 03:02 - 000428744 _____ C:\WINDOWS\system32\FNTCACHE.DAT
    2018-03-24 02:55 - 2018-01-09 19:36 - 000453575 _____ C:\WINDOWS\system32\Drivers\etc\hosts.20180324-025507.backup
    2018-03-23 21:32 - 2018-03-23 21:32 - 000040448 _____ C:\Users\david\Desktop\CENTRIFY CALL IN DATA FOR WED 28TH 1P ET Discuss Next-Gen Access post.msg
    2018-03-23 21:31 - 2018-03-23 21:31 - 000117248 _____ C:\Users\david\Desktop\CALENDAR PREP FOR MEETING KAREN 1P ET WED 28TH.msg
    2018-03-23 19:02 - 2018-03-23 19:02 - 000076288 _____ C:\Users\david\Desktop\Story ideas for you Sarah.msg
    2018-03-23 18:43 - 2018-03-23 18:43 - 000110592 _____ C:\Users\david\Desktop\KAREN SAID THIS KIND OF TWEET FOR LI PULSE AMP LOOKS GREAT.msg
    2018-03-23 18:39 - 2018-03-23 18:39 - 000099840 _____ C:\Users\david\Desktop\SETTING CALL FOR THIS KAREN MON OR WED BETWE 10 AND 4 ET.msg
    2018-03-23 18:17 - 2018-03-23 18:17 - 000000000 ___HD C:\$SysReset
    2018-03-23 17:44 - 2018-03-23 17:44 - 000000000 ____D C:\Users\david\AppData\Local\Amazon Drive
    2018-03-23 16:04 - 2018-03-23 16:04 - 000069120 _____ C:\Users\david\Desktop\RE AICPA article we added more of your comments final approval.msg
    2018-03-23 15:30 - 2018-03-23 15:30 - 000092160 _____ C:\Users\david\Desktop\Today's tweet amplifying the blockchain identity post.msg
    2018-03-23 15:19 - 2018-03-23 15:19 - 000060416 _____ C:\Users\david\Desktop\Re EXTERNAL Quotes I'd like to use.msg
    2018-03-23 14:41 - 2018-03-23 14:41 - 000028672 _____ C:\Users\david\Desktop\EXPERT COMMENT DoJ Indictment of Iranian Hackers.msg
    2018-03-23 14:37 - 2018-03-23 14:37 - 000147456 _____ C:\Users\david\Desktop\Re Here is the blog post.msg
    2018-03-23 13:26 - 2018-03-23 13:26 - 000000192 _____ C:\Users\david\Desktop\your pc encountered a problem and needs to restart - Microsoft Community.url
    2018-03-23 13:26 - 2018-03-23 13:26 - 000000188 _____ C:\Users\david\Desktop\Windows 10 reboot loop with Your PC ran into a problem and needs to - Microsoft Community.url
    2018-03-23 13:26 - 2018-03-23 13:26 - 000000083 _____ C:\Users\david\Desktop\-Your PC ran into a problem and needs to restart- error [FIX].url
    2018-03-23 13:25 - 2018-03-23 13:25 - 000000266 _____ C:\Users\david\Desktop\Windows 10 your computer encountered a problem and must restart - Google Search.url
    2018-03-23 13:25 - 2018-03-23 13:25 - 000000184 _____ C:\Users\david\Desktop\Your PC ran into a problem and needs to restart. - Microsoft Community.url
    2018-03-23 13:25 - 2018-03-23 13:25 - 000000104 _____ C:\Users\david\Desktop\Your PC ran into a problem and needs to restart in Windows 10 [Fixed] - EaseUS.url
    2018-03-23 13:25 - 2018-03-23 13:25 - 000000103 _____ C:\Users\david\Desktop\Your PC ran into a problem and needs to restart.url
    2018-03-23 13:21 - 2018-03-23 13:21 - 000000000 ___HD C:\ProgramData\temp
    2018-03-23 11:42 - 2018-03-23 11:56 - 000024054 ____H C:\Users\david\Desktop\~WRL1113.tmp
    2018-03-23 11:40 - 2018-03-26 13:53 - 000000000 ____D C:\WINDOWS\Minidump
    2018-03-23 11:32 - 2018-03-23 11:32 - 000056320 _____ C:\Users\david\Desktop\WAIT TILL MAY TO PITCH OR PING CHRIS BAYSDEN AGAIN IF NO WORD FROM HIM BY THEN.msg
    2018-03-23 09:41 - 2018-03-23 09:41 - 000036864 _____ C:\Users\david\Desktop\Thank you for the work; pitches.msg
    2018-03-23 08:04 - 2018-03-23 08:04 - 000000067 _____ C:\Users\david\Desktop\Marketing & Sales Training, Courses, and Certifications - HubSpot Academy.url
    2018-03-23 07:44 - 2018-03-23 07:44 - 000000093 _____ C:\Users\david\Desktop\MARKETS TO CONSIDER AND HOW TO MARKET TOO.url
    2018-03-23 07:41 - 2018-03-23 07:41 - 000000093 _____ C:\Users\david\Desktop\USE FOR KEYWORDS AND SERVICES IN LI PROFILE SUMMARY.url
    2018-03-23 07:26 - 2018-03-23 07:26 - 000000068 _____ C:\Users\david\Desktop\I GET MOST LI VIEWS LAST 3RD OF MONTH.url
    2018-03-23 07:17 - 2018-03-23 07:17 - 006435449 _____ C:\Users\david\Desktop\workforce-of-future-appendix.pdf
    2018-03-23 06:56 - 2018-03-23 06:56 - 000000300 _____ C:\Users\david\Desktop\How are Windows shortcut files vulnerable to attacks-.url
    2018-03-22 15:08 - 2018-03-22 15:08 - 000045056 _____ C:\Users\david\Desktop\Mark McLaughlin (IBM) to speak with David Geer (Risk Management Magazine).msg
    2018-03-22 14:39 - 2018-03-22 14:39 - 000045056 _____ C:\Users\david\Desktop\ADD TO QS DOC MARK M AND CALENDAR BEFORE CALL FRI 30TH.msg
    2018-03-22 14:14 - 2018-03-22 19:35 - 000049664 _____ C:\Users\david\Desktop\CHRIS B AICPA SAYS SEND INVOICES HAVEN'T SENT FOR HIM PROB THE TWO AND LOOK UP HOW SENT AND WHERE.msg
    2018-03-22 14:09 - 2018-03-22 14:09 - 000087040 _____ C:\Users\david\Desktop\DO LI PULSE POST HACK ALIVE AFTER 8A MONDAY, 5 TWEETS ONCE KNOW WHAT POINT TO, SET CALL HAVE IDEAS STORIES READY ETC.msg
    2018-03-22 13:45 - 2018-03-22 13:45 - 000080896 _____ C:\Users\david\Desktop\TOLD KAREN CENTRIFY BE READY START UP AGAIN MONDAY.msg
    2018-03-22 11:05 - 2018-03-22 11:05 - 000000102 _____ C:\Users\david\Desktop\Customizing Your LOI for Multiple Niches - Technology Content Marketing Writer - Jennifer Goforth Gregory - Raleigh Freelance Technology Writer.url
    2018-03-22 09:45 - 2018-03-22 09:45 - 019796336 _____ (NVIDIA Corporation) C:\WINDOWS\system32\nvopencl.dll
    2018-03-22 09:45 - 2018-03-22 09:45 - 016449872 _____ (NVIDIA Corporation) C:\WINDOWS\SysWOW64\nvopencl.dll
    2018-03-22 09:45 - 2018-03-22 09:45 - 013444552 _____ (NVIDIA Corporation) C:\WINDOWS\system32\nvptxJitCompiler.dll
    2018-03-22 09:45 - 2018-03-22 09:45 - 011026080 _____ (NVIDIA Corporation) C:\WINDOWS\SysWOW64\nvptxJitCompiler.dll
    2018-03-22 09:45 - 2018-03-22 09:45 - 001976120 _____ (NVIDIA Corporation) C:\WINDOWS\system32\nvdispco6439077.dll
    2018-03-22 09:45 - 2018-03-22 09:45 - 001673616 _____ (NVIDIA Corporation) C:\WINDOWS\system32\nvdispgenco6439077.dll
    2018-03-22 09:45 - 2018-03-22 09:45 - 001334808 _____ (NVIDIA Corporation) C:\WINDOWS\system32\nvEncMFThevc.dll
    2018-03-22 09:45 - 2018-03-22 09:45 - 001325384 _____ (NVIDIA Corporation) C:\WINDOWS\system32\nvEncMFTH264.dll
    2018-03-22 09:45 - 2018-03-22 09:45 - 001134768 _____ (NVIDIA Corporation) C:\WINDOWS\system32\nvfatbinaryLoader.dll
    2018-03-22 09:45 - 2018-03-22 09:45 - 001126888 _____ (NVIDIA Corporation) C:\WINDOWS\system32\NvFBC64.dll
    2018-03-22 09:45 - 2018-03-22 09:45 - 001054704 _____ (NVIDIA Corporation) C:\WINDOWS\SysWOW64\NvFBC.dll
    2018-03-22 09:45 - 2018-03-22 09:45 - 001049480 _____ (NVIDIA Corporation) C:\WINDOWS\SysWOW64\nvEncMFThevc.dll
    2018-03-22 09:45 - 2018-03-22 09:45 - 001043128 _____ (NVIDIA Corporation) C:\WINDOWS\SysWOW64\nvEncMFTH264.dll
    2018-03-22 09:45 - 2018-03-22 09:45 - 000988464 _____ (NVIDIA Corporation) C:\WINDOWS\system32\NvIFR64.dll
    2018-03-22 09:45 - 2018-03-22 09:45 - 000939832 _____ (NVIDIA Corporation) C:\WINDOWS\SysWOW64\NvIFR.dll
    2018-03-22 09:45 - 2018-03-22 09:45 - 000885680 _____ (NVIDIA Corporation) C:\WINDOWS\SysWOW64\nvfatbinaryLoader.dll
    2018-03-22 09:45 - 2018-03-22 09:45 - 000795928 _____ (NVIDIA Corporation) C:\WINDOWS\system32\nvEncodeAPI64.dll
    2018-03-22 09:45 - 2018-03-22 09:45 - 000740336 _____ (NVIDIA Corporation) C:\WINDOWS\system32\nvDecMFTMjpeg.dll
    2018-03-22 09:45 - 2018-03-22 09:45 - 000635248 _____ (NVIDIA Corporation) C:\WINDOWS\SysWOW64\nvEncodeAPI.dll
    2018-03-22 09:45 - 2018-03-22 09:45 - 000618928 _____ (NVIDIA Corporation) C:\WINDOWS\system32\nvmcumd.dll
    2018-03-22 09:45 - 2018-03-22 09:45 - 000616240 _____ (NVIDIA Corporation) C:\WINDOWS\system32\NvIFROpenGL.dll
    2018-03-22 09:45 - 2018-03-22 09:45 - 000599352 _____ (NVIDIA Corporation) C:\WINDOWS\SysWOW64\nvDecMFTMjpeg.dll
    2018-03-22 09:45 - 2018-03-22 09:45 - 000506864 _____ (NVIDIA Corporation) C:\WINDOWS\SysWOW64\NvIFROpenGL.dll
    2018-03-22 09:45 - 2018-03-22 09:45 - 000000000 ____D C:\WINDOWS\system32\Drivers\NVIDIA Corporation
    2018-03-22 09:44 - 2018-03-22 09:44 - 040269808 _____ (NVIDIA Corporation) C:\WINDOWS\system32\nvcompiler.dll
    2018-03-22 09:44 - 2018-03-22 09:44 - 035180016 _____ (NVIDIA Corporation) C:\WINDOWS\SysWOW64\nvcompiler.dll
    2018-03-22 09:44 - 2018-03-22 09:44 - 013333668 _____ C:\WINDOWS\system32\Drivers\Netwfw04.dat
    2018-03-22 09:44 - 2018-03-22 09:44 - 012843496 _____ (NVIDIA Corporation) C:\WINDOWS\system32\nvcuda.dll
    2018-03-22 09:44 - 2018-03-22 09:44 - 010900248 _____ (NVIDIA Corporation) C:\WINDOWS\SysWOW64\nvcuda.dll
    2018-03-22 09:44 - 2018-03-22 09:44 - 004308976 _____ (NVIDIA Corporation) C:\WINDOWS\system32\nvcuvid.dll
    2018-03-22 09:44 - 2018-03-22 09:44 - 003894304 _____ (NVIDIA Corporation) C:\WINDOWS\SysWOW64\nvapi.dll
    2018-03-22 09:44 - 2018-03-22 09:44 - 003709424 _____ (NVIDIA Corporation) C:\WINDOWS\SysWOW64\nvcuvid.dll
    2018-03-22 09:44 - 2018-03-22 09:44 - 000117392 _____ C:\WINDOWS\system32\Drivers\ibtfw.dat
    2018-03-22 09:43 - 2018-03-22 09:43 - 000045600 _____ (NVIDIA Corporation) C:\WINDOWS\system32\nvhdap64.dll
    2018-03-22 09:42 - 2018-03-22 09:42 - 072520704 _____ (Realtek Semiconductor Corp.) C:\WINDOWS\system32\RCoRes64.dat
    2018-03-22 09:42 - 2018-03-22 09:42 - 013831786 _____ C:\WINDOWS\system32\Drivers\RTAIODAT.DAT
    2018-03-22 09:42 - 2018-03-22 09:42 - 003677152 _____ (Realtek Semiconductor Corp.) C:\WINDOWS\system32\RTSnMg64.cpl
    2018-03-22 09:42 - 2018-03-22 09:42 - 003410832 _____ (DTS, Inc.) C:\WINDOWS\system32\slcnt64.dll
    2018-03-22 09:42 - 2018-03-22 09:42 - 003205120 _____ (Realtek Semiconductor Corp.) C:\WINDOWS\system32\RtPgEx64.dll
    2018-03-22 09:42 - 2018-03-22 09:42 - 003122648 _____ (DTS, Inc.) C:\WINDOWS\system32\sltech64.dll
    2018-03-22 09:42 - 2018-03-22 09:42 - 002922976 _____ (Realtek Semiconductor Corp.) C:\WINDOWS\system32\RCoInstII64.dll
    2018-03-22 09:42 - 2018-03-22 09:42 - 001435136 _____ (Synopsys, Inc.) C:\WINDOWS\system32\SRRPTR64.dll
    2018-03-22 09:42 - 2018-03-22 09:42 - 001348160 _____ (Realtek Semiconductor Corp.) C:\WINDOWS\system32\RTCOM64.dll
    2018-03-22 09:42 - 2018-03-22 09:42 - 001083424 _____ C:\WINDOWS\system32\AmRdrIco.icl
    2018-03-22 09:42 - 2018-03-22 09:42 - 001016920 _____ (Sound Research, Corp.) C:\WINDOWS\system32\SEHDHF64.dll
    2018-03-22 09:42 - 2018-03-22 09:42 - 000984904 _____ (DTS, Inc.) C:\WINDOWS\system32\sl3apo64.dll
    2018-03-22 09:42 - 2018-03-22 09:42 - 000877424 _____ (Sound Research, Corp.) C:\WINDOWS\SysWOW64\SEHDHF32.dll
    2018-03-22 09:42 - 2018-03-22 09:42 - 000868168 _____ (Sound Research, Corp.) C:\WINDOWS\system32\SECOMN64.dll
    2018-03-22 09:42 - 2018-03-22 09:42 - 000866632 _____ (Sound Research, Corp.) C:\WINDOWS\system32\SEHDRA64.dll
    2018-03-22 09:42 - 2018-03-22 09:42 - 000737960 _____ (Sound Research, Corp.) C:\WINDOWS\SysWOW64\SECOMN32.dll
    2018-03-22 09:42 - 2018-03-22 09:42 - 000691672 _____ (Realtek Semiconductor Corp.) C:\WINDOWS\system32\RtDataProc64.dll
    2018-03-22 09:42 - 2018-03-22 09:42 - 000532376 _____ (SRS Labs, Inc.) C:\WINDOWS\system32\SRSTSX64.dll
    2018-03-22 09:42 - 2018-03-22 09:42 - 000526272 _____ (Sound Research, Corp.) C:\WINDOWS\system32\SEAPO64.dll
    2018-03-22 09:42 - 2018-03-22 09:42 - 000467152 _____ (Synopsys, Inc.) C:\WINDOWS\system32\SRAPO64.dll
    2018-03-22 09:42 - 2018-03-22 09:42 - 000387304 _____ (Dolby Laboratories, Inc.) C:\WINDOWS\system32\RTEEP64A.dll
    2018-03-22 09:42 - 2018-03-22 09:42 - 000381400 _____ (Synopsys, Inc.) C:\WINDOWS\system32\SRCOM64.dll
    2018-03-22 09:42 - 2018-03-22 09:42 - 000343704 _____ (Realtek Semiconductor Corp.) C:\WINDOWS\system32\RtlCPAPI64.dll
    2018-03-22 09:42 - 2018-03-22 09:42 - 000341144 _____ (Synopsys, Inc.) C:\WINDOWS\SysWOW64\SRCOM.dll
    2018-03-22 09:42 - 2018-03-22 09:42 - 000341144 _____ (Synopsys, Inc.) C:\WINDOWS\system32\SRCOM.dll
    2018-03-22 09:42 - 2018-03-22 09:42 - 000321712 _____ (Dolby Laboratories, Inc.) C:\WINDOWS\system32\RP3DAA64.dll
    2018-03-22 09:42 - 2018-03-22 09:42 - 000321704 _____ (Dolby Laboratories, Inc.) C:\WINDOWS\system32\RP3DHT64.dll
    2018-03-22 09:42 - 2018-03-22 09:42 - 000258856 _____ (TODO: <Company name>) C:\WINDOWS\system32\slprp64.dll
    2018-03-22 09:42 - 2018-03-22 09:42 - 000221960 _____ (SRS Labs, Inc.) C:\WINDOWS\system32\SRSTSH64.dll
    2018-03-22 09:42 - 2018-03-22 09:42 - 000214824 _____ (Dolby Laboratories, Inc.) C:\WINDOWS\system32\RTEED64A.dll
    2018-03-22 09:42 - 2018-03-22 09:42 - 000209528 _____ (SRS Labs, Inc.) C:\WINDOWS\system32\SRSHP64.dll
    2018-03-22 09:42 - 2018-03-22 09:42 - 000166200 _____ (SRS Labs, Inc.) C:\WINDOWS\system32\SRSWOW64.dll
    2018-03-22 09:42 - 2018-03-22 09:42 - 000122312 _____ (Real Sound Lab SIA) C:\WINDOWS\system32\CONEQMSAPOGUILibrary.dll
    2018-03-22 09:42 - 2018-03-22 09:42 - 000110976 _____ (Dolby Laboratories, Inc.) C:\WINDOWS\system32\RTEEL64A.dll
    2018-03-22 09:42 - 2018-03-22 09:42 - 000090560 _____ (Alcorlink Corp.) C:\WINDOWS\system32\Drivers\AmUStor.sys
    2018-03-22 09:42 - 2018-03-22 09:42 - 000088336 _____ (Dolby Laboratories, Inc.) C:\WINDOWS\system32\RTEEG64A.dll
    2018-03-22 09:42 - 2018-03-22 09:42 - 000083616 _____ (Virage Logic Corporation / Sonic Focus) C:\WINDOWS\SysWOW64\SFCOM.dll
    2018-03-22 09:42 - 2018-03-22 09:42 - 000005115 _____ C:\WINDOWS\system32\AmUStor.ini
    2018-03-21 17:43 - 2018-03-21 17:43 - 001274504 _____ (SurfRight B.V.) C:\WINDOWS\system32\hmpalert.dll
    2018-03-21 17:43 - 2018-03-21 17:43 - 000866440 _____ (SurfRight B.V.) C:\WINDOWS\SysWOW64\hmpalert.dll
    2018-03-21 17:43 - 2018-03-21 17:43 - 000093800 _____ (SurfRight B.V.) C:\WINDOWS\system32\Drivers\hmpnet.sys
    2018-03-21 11:31 - 2018-03-21 11:31 - 000048640 _____ C:\Users\david\Desktop\Latest news from Naked Security (03212018).msg
    2018-03-21 10:24 - 2018-03-21 10:24 - 000030208 _____ C:\Users\david\Desktop\Centrify Corporation Payment Notification 0000031211.msg
    2018-03-21 03:14 - 2018-03-21 03:14 - 000044544 _____ C:\Users\david\Desktop\You're activated!.msg
    2018-03-20 18:10 - 2018-03-21 14:30 - 000056320 _____ C:\Users\david\Desktop\Re URGENT REMINDER Docker Payment Portal Registration required.msg
    2018-03-20 17:45 - 2018-03-20 17:45 - 000000066 _____ C:\Users\david\Desktop\ActualTech Media - About ActualTech Media.url
    2018-03-20 17:44 - 2018-03-20 17:44 - 000000078 _____ C:\Users\david\Desktop\Editorial Calendar.url
    2018-03-20 17:40 - 2018-03-20 17:40 - 000091648 _____ C:\Users\david\Desktop\WILL LET ME KNOW WHEN SHE WANTS TO GO LIVE WITH HACKING IND LI PULSE POST PERHAPS MONDAY.msg
    2018-03-20 17:39 - 2018-03-20 17:39 - 000102912 _____ C:\Users\david\Desktop\ALL GOOD W KAREN REYNOLDS LET HER KNOW WHEN BACK UP AND RUNNING.msg
    2018-03-20 17:16 - 2018-03-20 17:16 - 000049152 _____ C:\Users\david\Desktop\RE Did you get everything you needed with my first invoice.msg
    2018-03-20 17:15 - 2018-03-20 17:15 - 000039936 _____ C:\Users\david\Desktop\IBM's Watson Assistant is coming to IFTTT.msg
    2018-03-20 17:13 - 2018-03-20 17:13 - 000036352 _____ C:\Users\david\Desktop\Homeland Security Experts Build $50 million Blockchain.msg
    2018-03-20 15:27 - 2018-03-23 16:15 - 000045568 _____ C:\Users\david\Desktop\RE FM Fatal Flaw Review Request (rq5702-414).msg
    2018-03-20 15:07 - 2018-03-23 16:03 - 000089088 _____ C:\Users\david\Desktop\FM Fatal Flaw Review Request (rq5702-414).msg
    2018-03-20 14:57 - 2018-03-20 14:57 - 000040960 _____ C:\Users\david\Desktop\Re Anything in the pipeline.msg
    2018-03-20 13:54 - 2018-03-20 13:54 - 000022016 _____ C:\Users\david\Desktop\Orbitz Breach - need sources.msg
    2018-03-19 10:21 - 2018-03-19 10:21 - 000084480 _____ C:\Users\david\Desktop\Today's LI pulse post illness.msg
    2018-03-18 14:50 - 2018-03-18 14:50 - 000029696 _____ C:\Users\david\Desktop\Re Part of the tree came down front yard.msg
    2018-03-16 14:54 - 2018-03-16 14:54 - 000077312 _____ C:\Users\david\Desktop\Link to today's tweet.msg
    2018-03-16 14:34 - 2018-03-16 14:34 - 000100352 _____ C:\Users\david\Desktop\Here is the hacking industry alive and well post.msg
    2018-03-16 10:49 - 2018-03-16 10:49 - 001008980 _____ C:\Users\david\Desktop\security-advisor_security-outlook-2017_december.pdf
    2018-03-15 10:01 - 2018-03-15 10:01 - 000061952 _____ C:\Users\david\Desktop\RE 1099 Form.msg
    2018-03-13 20:02 - 2018-03-13 20:01 - 000380768 _____ (AVAST Software) C:\WINDOWS\system32\aswBoot.exe
    2018-03-13 15:36 - 2018-03-01 23:36 - 017085440 _____ (Microsoft Corporation) C:\WINDOWS\system32\HologramCompositor.dll
    2018-03-13 15:36 - 2018-03-01 22:59 - 000956416 _____ (Microsoft Corporation) C:\WINDOWS\system32\Spectrum.exe
    2018-03-13 15:36 - 2018-03-01 03:50 - 000270744 _____ (Microsoft Corporation) C:\WINDOWS\system32\acmigration.dll
    2018-03-13 15:36 - 2018-03-01 03:49 - 000389536 _____ (Microsoft Corporation) C:\WINDOWS\system32\invagent.dll
    2018-03-13 15:36 - 2018-03-01 03:48 - 000664472 _____ (Microsoft Corporation) C:\WINDOWS\system32\aeinv.dll
    2018-03-13 15:36 - 2018-03-01 03:47 - 000749464 _____ (Microsoft Corporation) C:\WINDOWS\system32\generaltel.dll
    2018-03-13 15:36 - 2018-03-01 03:47 - 000035224 _____ (Microsoft Corporation) C:\WINDOWS\system32\DeviceCensus.exe
    2018-03-13 15:36 - 2018-03-01 03:46 - 002003352 _____ (Microsoft Corporation) C:\WINDOWS\system32\aitstatic.exe
    2018-03-13 15:36 - 2018-03-01 03:46 - 001568664 _____ (Microsoft Corporation) C:\WINDOWS\system32\appraiser.dll
    2018-03-13 15:36 - 2018-03-01 03:46 - 000609176 _____ (Microsoft Corporation) C:\WINDOWS\system32\devinv.dll
    2018-03-13 15:36 - 2018-03-01 03:46 - 000138144 _____ (Microsoft Corporation) C:\WINDOWS\system32\CompatTelRunner.exe
    2018-03-13 15:36 - 2018-03-01 03:45 - 000070040 _____ (Microsoft Corporation) C:\WINDOWS\system32\win32appinventorycsp.dll
    2018-03-13 15:36 - 2018-03-01 03:40 - 002514936 _____ (Microsoft Corporation) C:\WINDOWS\system32\KernelBase.dll
    2018-03-13 15:36 - 2018-03-01 03:40 - 000461720 _____ (Microsoft Corporation) C:\WINDOWS\system32\dcntel.dll
    2018-03-13 15:36 - 2018-03-01 03:40 - 000273304 _____ (Microsoft Corporation) C:\WINDOWS\system32\aepic.dll
    2018-03-13 15:36 - 2018-03-01 03:37 - 007831760 _____ (Microsoft Corporation) C:\WINDOWS\system32\d3d10warp.dll
    2018-03-13 15:36 - 2018-03-01 03:31 - 008602520 _____ (Microsoft Corporation) C:\WINDOWS\system32\ntoskrnl.exe
    2018-03-13 15:36 - 2018-03-01 03:30 - 000540064 _____ (Microsoft Corporation) C:\WINDOWS\system32\pcasvc.dll
    2018-03-13 15:36 - 2018-03-01 03:30 - 000264040 _____ (Microsoft Corporation) C:\WINDOWS\system32\MusNotifyIcon.exe
    2018-03-13 15:36 - 2018-03-01 03:29 - 000733592 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\acpi.sys
    2018-03-13 15:36 - 2018-03-01 03:27 - 001173576 _____ (Microsoft Corporation) C:\WINDOWS\system32\rpcrt4.dll
    2018-03-13 15:36 - 2018-03-01 03:23 - 000749976 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\dxgmms2.sys
    2018-03-13 15:36 - 2018-03-01 03:17 - 002710736 _____ (Microsoft Corporation) C:\WINDOWS\system32\iertutil.dll
    2018-03-13 15:36 - 2018-03-01 03:17 - 000519152 _____ (Microsoft Corporation) C:\WINDOWS\system32\SecurityHealthService.exe
    2018-03-13 15:36 - 2018-03-01 03:17 - 000408984 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\dxgmms1.sys
    2018-03-13 15:36 - 2018-03-01 03:15 - 002574232 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\dxgkrnl.sys
    2018-03-13 15:36 - 2018-03-01 03:14 - 007675784 _____ (Microsoft Corporation) C:\WINDOWS\system32\windows.storage.dll
    2018-03-13 15:36 - 2018-03-01 03:14 - 007384576 _____ (Microsoft Corporation) C:\WINDOWS\system32\Windows.Media.Protection.PlayReady.dll
    2018-03-13 15:36 - 2018-03-01 03:14 - 001694224 _____ (Microsoft Corporation) C:\WINDOWS\system32\winmde.dll
    2018-03-13 15:36 - 2018-03-01 03:14 - 000356952 _____ (Microsoft Corporation) C:\WINDOWS\system32\wintrust.dll
    2018-03-13 15:36 - 2018-03-01 03:14 - 000147872 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\wcifs.sys
    2018-03-13 15:36 - 2018-03-01 03:12 - 000677272 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\cng.sys
    2018-03-13 15:36 - 2018-03-01 03:12 - 000189344 _____ (Microsoft Corporation) C:\WINDOWS\system32\SecurityHealthAgent.dll
    2018-03-13 15:36 - 2018-03-01 03:11 - 000093600 _____ (Microsoft Corporation) C:\WINDOWS\system32\rdpudd.dll
    2018-03-13 15:36 - 2018-03-01 03:10 - 001779936 _____ (Microsoft Corporation) C:\WINDOWS\system32\mfplat.dll
    2018-03-13 15:36 - 2018-03-01 03:10 - 000075168 _____ (Microsoft Corporation) C:\WINDOWS\system32\SecurityHealthProxyStub.dll
    2018-03-13 15:36 - 2018-03-01 03:09 - 001054272 _____ (Microsoft Corporation) C:\WINDOWS\system32\msvproc.dll
    2018-03-13 15:36 - 2018-03-01 02:51 - 000777904 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\rpcrt4.dll
    2018-03-13 15:36 - 2018-03-01 02:48 - 001930736 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\KernelBase.dll
    2018-03-13 15:36 - 2018-03-01 02:39 - 000213400 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\aepic.dll
    2018-03-13 15:36 - 2018-03-01 02:30 - 005615968 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\d3d10warp.dll
    2018-03-13 15:36 - 2018-03-01 02:29 - 006092152 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\windows.storage.dll
    2018-03-13 15:36 - 2018-03-01 02:28 - 006480616 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\Windows.Media.Protection.PlayReady.dll
    2018-03-13 15:36 - 2018-03-01 02:28 - 002193168 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\iertutil.dll
    2018-03-13 15:36 - 2018-03-01 02:27 - 000284112 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\wintrust.dll
    2018-03-13 15:36 - 2018-03-01 02:26 - 001524776 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\mfplat.dll
    2018-03-13 15:36 - 2018-03-01 02:26 - 001057816 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\msvproc.dll
    2018-03-13 15:36 - 2018-03-01 02:21 - 001558856 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\winmde.dll
    2018-03-13 15:36 - 2018-03-01 02:09 - 025251840 _____ (Microsoft Corporation) C:\WINDOWS\system32\edgehtml.dll
    2018-03-13 15:36 - 2018-03-01 02:03 - 002902528 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\win32kfull.sys
    2018-03-13 15:36 - 2018-03-01 02:03 - 000471552 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\AcSpecfc.dll
    2018-03-13 15:36 - 2018-03-01 02:03 - 000344576 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\edgeIso.dll
    2018-03-13 15:36 - 2018-03-01 02:03 - 000162304 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\IndexedDbLegacy.dll
    2018-03-13 15:36 - 2018-03-01 02:03 - 000065536 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\usoapi.dll
    2018-03-13 15:36 - 2018-03-01 02:01 - 019354624 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\mshtml.dll
    2018-03-13 15:36 - 2018-03-01 02:01 - 006575616 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\Windows.Data.Pdf.dll
    2018-03-13 15:36 - 2018-03-01 02:01 - 000155648 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\EdgeManager.dll
    2018-03-13 15:36 - 2018-03-01 01:58 - 004839424 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\dbgeng.dll
    2018-03-13 15:36 - 2018-03-01 01:58 - 000459776 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\webplatstorageserver.dll
    2018-03-13 15:36 - 2018-03-01 01:58 - 000405504 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\Windows.Payments.dll
    2018-03-13 15:36 - 2018-03-01 01:58 - 000368128 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\daxexec.dll
    2018-03-13 15:36 - 2018-03-01 01:57 - 000369152 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\msIso.dll
    2018-03-13 15:36 - 2018-03-01 01:56 - 018922496 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\edgehtml.dll
    2018-03-13 15:36 - 2018-03-01 01:56 - 000559104 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\jscript9diag.dll
    2018-03-13 15:36 - 2018-03-01 01:55 - 000346112 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\zipfldr.dll
    2018-03-13 15:36 - 2018-03-01 01:54 - 003664384 _____ (Microsoft Corporation) C:\WINDOWS\system32\win32kfull.sys
    2018-03-13 15:36 - 2018-03-01 01:54 - 003181568 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\cdp.dll
    2018-03-13 15:36 - 2018-03-01 01:54 - 001296896 _____ (Microsoft Corporation) C:\WINDOWS\system32\usocore.dll
    2018-03-13 15:36 - 2018-03-01 01:54 - 000665088 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\jscript.dll
    2018-03-13 15:36 - 2018-03-01 01:54 - 000496128 _____ (Microsoft Corporation) C:\WINDOWS\system32\updatehandlers.dll
    2018-03-13 15:36 - 2018-03-01 01:54 - 000463360 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\vbscript.dll
    2018-03-13 15:36 - 2018-03-01 01:53 - 000863232 _____ (Microsoft Corporation) C:\WINDOWS\system32\MusUpdateHandlers.dll
    2018-03-13 15:36 - 2018-03-01 01:53 - 000536576 _____ (Microsoft Corporation) C:\WINDOWS\system32\edgeIso.dll
    2018-03-13 15:36 - 2018-03-01 01:53 - 000399872 _____ (Microsoft Corporation) C:\WINDOWS\system32\MusNotification.exe
    2018-03-13 15:36 - 2018-03-01 01:53 - 000246272 _____ (Microsoft Corporation) C:\WINDOWS\system32\MusNotificationUx.exe
    2018-03-13 15:36 - 2018-03-01 01:53 - 000107520 _____ (Microsoft Corporation) C:\WINDOWS\system32\musdialoghandlers.dll
    2018-03-13 15:36 - 2018-03-01 01:53 - 000092160 _____ (Microsoft Corporation) C:\WINDOWS\system32\usoapi.dll
    2018-03-13 15:36 - 2018-03-01 01:53 - 000056320 _____ (Microsoft Corporation) C:\WINDOWS\system32\AcSpecfc.dll
    2018-03-13 15:36 - 2018-03-01 01:52 - 011923968 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\ieframe.dll
    2018-03-13 15:36 - 2018-03-01 01:52 - 006030336 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\Chakra.dll
    2018-03-13 15:36 - 2018-03-01 01:51 - 000201728 _____ (Microsoft Corporation) C:\WINDOWS\system32\EdgeManager.dll
    2018-03-13 15:36 - 2018-03-01 01:51 - 000034816 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\BasicRender.sys
    2018-03-13 15:36 - 2018-03-01 01:50 - 003677184 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\jscript9.dll
    2018-03-13 15:36 - 2018-03-01 01:50 - 002869760 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\wininet.dll
    2018-03-13 15:36 - 2018-03-01 01:50 - 000526336 _____ (Microsoft Corporation) C:\WINDOWS\system32\daxexec.dll
    2018-03-13 15:36 - 2018-03-01 01:49 - 000675328 _____ (Microsoft Corporation) C:\WINDOWS\system32\webplatstorageserver.dll
    2018-03-13 15:36 - 2018-03-01 01:49 - 000529408 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\nwifi.sys
    2018-03-13 15:36 - 2018-03-01 01:49 - 000066048 _____ (Microsoft Corporation) C:\WINDOWS\system32\winsrv.dll
    2018-03-13 15:36 - 2018-03-01 01:48 - 000543232 _____ (Microsoft Corporation) C:\WINDOWS\system32\HolographicExtensions.dll
    2018-03-13 15:36 - 2018-03-01 01:48 - 000431616 _____ (Microsoft Corporation) C:\WINDOWS\system32\msIso.dll
    2018-03-13 15:36 - 2018-03-01 01:47 - 023674368 _____ (Microsoft Corporation) C:\WINDOWS\system32\mshtml.dll
    2018-03-13 15:36 - 2018-03-01 01:47 - 000579584 _____ (Microsoft Corporation) C:\WINDOWS\system32\Windows.Payments.dll
    2018-03-13 15:36 - 2018-03-01 01:46 - 004051968 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\msi.dll
    2018-03-13 15:36 - 2018-03-01 01:46 - 000770048 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\WdiWiFi.sys
    2018-03-13 15:36 - 2018-03-01 01:45 - 000708096 _____ (Microsoft Corporation) C:\WINDOWS\system32\jscript9diag.dll
    2018-03-13 15:36 - 2018-03-01 01:45 - 000594944 _____ (Microsoft Corporation) C:\WINDOWS\system32\vbscript.dll
    2018-03-13 15:36 - 2018-03-01 01:45 - 000386560 _____ (Microsoft Corporation) C:\WINDOWS\system32\zipfldr.dll
    2018-03-13 15:36 - 2018-03-01 01:44 - 008030720 _____ (Microsoft Corporation) C:\WINDOWS\system32\Windows.Data.Pdf.dll
    2018-03-13 15:36 - 2018-03-01 01:44 - 005195776 _____ (Microsoft Corporation) C:\WINDOWS\system32\cdp.dll
    2018-03-13 15:36 - 2018-03-01 01:43 - 012830208 _____ (Microsoft Corporation) C:\WINDOWS\system32\ieframe.dll
    2018-03-13 15:36 - 2018-03-01 01:42 - 003505664 _____ (Microsoft Corporation) C:\WINDOWS\system32\MSVidCtl.dll
    2018-03-13 15:36 - 2018-03-01 01:42 - 002084352 _____ (Microsoft Corporation) C:\WINDOWS\system32\win32kbase.sys
    2018-03-13 15:36 - 2018-03-01 01:41 - 008103936 _____ (Microsoft Corporation) C:\WINDOWS\system32\Chakra.dll
    2018-03-13 15:36 - 2018-03-01 01:41 - 004745728 _____ (Microsoft Corporation) C:\WINDOWS\system32\jscript9.dll
    2018-03-13 15:36 - 2018-03-01 01:41 - 003334144 _____ (Microsoft Corporation) C:\WINDOWS\system32\wininet.dll
    2018-03-13 15:36 - 2018-03-01 01:41 - 001548288 _____ (Microsoft Corporation) C:\WINDOWS\system32\lsasrv.dll
    2018-03-13 15:36 - 2018-03-01 01:41 - 000812032 _____ (Microsoft Corporation) C:\WINDOWS\system32\jscript.dll
    2018-03-13 15:36 - 2018-03-01 01:40 - 005833216 _____ (Microsoft Corporation) C:\WINDOWS\system32\dbgeng.dll
    2018-03-13 15:36 - 2018-03-01 01:39 - 002222592 _____ (Microsoft Corporation) C:\WINDOWS\system32\wlidsvc.dll
    2018-03-13 15:36 - 2018-03-01 01:39 - 002035712 _____ (Microsoft Corporation) C:\WINDOWS\system32\rdpcorets.dll
    2018-03-13 15:36 - 2018-03-01 01:39 - 000899584 _____ (Microsoft Corporation) C:\WINDOWS\system32\samsrv.dll
    2018-03-13 15:36 - 2018-03-01 01:39 - 000666624 _____ (Microsoft Corporation) C:\WINDOWS\system32\DbgModel.dll
    2018-03-13 15:36 - 2018-03-01 01:38 - 000963072 _____ (Microsoft Corporation) C:\WINDOWS\system32\StorSvc.dll
    2018-03-13 15:36 - 2018-03-01 01:38 - 000726016 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\srv2.sys
    2018-03-13 15:36 - 2018-03-01 01:35 - 000050176 _____ (Microsoft Corporation) C:\WINDOWS\system32\pcalua.exe
    2018-03-13 15:36 - 2018-02-21 22:23 - 001092016 _____ (Microsoft Corporation) C:\WINDOWS\system32\winresume.efi
    2018-03-13 15:36 - 2018-02-21 22:23 - 000924648 _____ (Microsoft Corporation) C:\WINDOWS\system32\winresume.exe
    2018-03-13 15:36 - 2018-02-21 22:13 - 000279456 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\msiscsi.sys
    2018-03-13 15:36 - 2018-02-21 22:13 - 000077216 _____ (Microsoft Corporation) C:\WINDOWS\system32\hvloader.dll
    2018-03-13 15:36 - 2018-02-21 22:11 - 000109984 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\vmbus.sys
    2018-03-13 15:36 - 2018-02-21 22:10 - 000285080 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\sdbus.sys
    2018-03-13 15:36 - 2018-02-21 22:08 - 001206688 _____ (Microsoft Corporation) C:\WINDOWS\system32\hvix64.exe
    2018-03-13 15:36 - 2018-02-21 22:08 - 001055648 _____ (Microsoft Corporation) C:\WINDOWS\system32\hvax64.exe
    2018-03-13 15:36 - 2018-02-21 22:08 - 000571288 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\spaceport.sys
    2018-03-13 15:36 - 2018-02-21 22:07 - 001415296 _____ (Microsoft Corporation) C:\WINDOWS\system32\winload.efi
    2018-03-13 15:36 - 2018-02-21 22:07 - 001209248 _____ (Microsoft Corporation) C:\WINDOWS\system32\winload.exe
    2018-03-13 15:36 - 2018-02-21 22:03 - 000712600 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\vhdmp.sys
    2018-03-13 15:36 - 2018-02-21 22:03 - 000082848 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\volmgr.sys
    2018-03-13 15:36 - 2018-02-21 22:02 - 000149400 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\storahci.sys
    2018-03-13 15:36 - 2018-02-21 22:00 - 000187296 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\dumpsd.sys
    2018-03-13 15:36 - 2018-02-21 21:59 - 021351624 _____ (Microsoft Corporation) C:\WINDOWS\system32\shell32.dll
    2018-03-13 15:36 - 2018-02-21 21:54 - 000437144 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\USBXHCI.SYS
    2018-03-13 15:36 - 2018-02-21 21:52 - 000103328 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\stornvme.sys
    2018-03-13 15:36 - 2018-02-21 21:51 - 000555424 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\USBHUB3.SYS
    2018-03-13 15:36 - 2018-02-21 21:51 - 000097176 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\sdstor.sys
    2018-03-13 15:36 - 2018-02-21 21:51 - 000045472 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\storufs.sys
    2018-03-13 15:36 - 2018-02-21 21:50 - 000362904 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\pci.sys
    2018-03-13 15:36 - 2018-02-21 20:41 - 020286120 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\shell32.dll
    2018-03-13 15:36 - 2018-02-21 20:31 - 000057344 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\UcmUcsi.sys
    2018-03-13 15:36 - 2018-02-21 20:30 - 000192512 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\netvsc.sys
    2018-03-13 15:36 - 2018-02-21 20:30 - 000046080 _____ (Microsoft Corporation) C:\WINDOWS\system32\hidparse.sys
    2018-03-13 15:36 - 2018-02-21 20:30 - 000046080 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\hidparse.sys
    2018-03-13 15:36 - 2018-02-21 20:26 - 001015296 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\bthport.sys
    2018-03-13 15:36 - 2018-02-21 20:25 - 000086528 _____ (Microsoft Corporation) C:\WINDOWS\system32\cldapi.dll
    2018-03-13 15:36 - 2018-02-21 20:12 - 000076288 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\cldapi.dll
    2018-03-13 15:35 - 2018-03-01 23:02 - 000037888 _____ C:\WINDOWS\system32\SpectrumSyncClient.dll
    2018-03-13 15:35 - 2018-03-01 23:01 - 000640000 _____ (Microsoft Corporation) C:\WINDOWS\system32\HeadTrackerStorage.dll
    2018-03-13 15:35 - 2018-03-01 23:00 - 000329728 _____ (Microsoft Corporation) C:\WINDOWS\system32\Windows.Internal.Feedback.Analog.dll
    2018-03-13 15:35 - 2018-03-01 23:00 - 000248320 _____ (Microsoft Corporation) C:\WINDOWS\system32\svf.dll
    2018-03-13 15:35 - 2018-03-01 23:00 - 000230912 _____ (Microsoft Corporation) C:\WINDOWS\system32\HoloShellRuntime.dll
    2018-03-13 15:35 - 2018-03-01 16:28 - 000181760 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\HoloShellRuntime.dll
    2018-03-13 15:35 - 2018-03-01 03:26 - 000170912 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\ksecpkg.sys
    2018-03-13 15:35 - 2018-03-01 03:25 - 000377752 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\msrpc.sys
    2018-03-13 15:35 - 2018-03-01 03:19 - 000710768 _____ (Microsoft Corporation) C:\WINDOWS\system32\MSVideoDSP.dll
    2018-03-13 15:35 - 2018-03-01 03:14 - 005105664 _____ (Microsoft Corporation) C:\WINDOWS\system32\AuthFWSnapin.dll
    2018-03-13 15:35 - 2018-03-01 03:14 - 000128928 _____ (Microsoft Corporation) C:\WINDOWS\system32\offlinelsa.dll
    2018-03-13 15:35 - 2018-03-01 03:12 - 000250264 _____ (Microsoft Corporation) C:\WINDOWS\system32\offlinesam.dll
    2018-03-13 15:35 - 2018-03-01 03:10 - 000022936 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\isapnp.sys
    2018-03-13 15:35 - 2018-03-01 02:29 - 000574960 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\MSVideoDSP.dll
    2018-03-13 15:35 - 2018-03-01 02:28 - 000115096 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\offlinelsa.dll
    2018-03-13 15:35 - 2018-03-01 02:27 - 000221592 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\offlinesam.dll
    2018-03-13 15:35 - 2018-03-01 02:23 - 005105664 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\AuthFWSnapin.dll
    2018-03-13 15:35 - 2018-03-01 02:01 - 000019456 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\credssp.dll
    2018-03-13 15:35 - 2018-03-01 02:00 - 000098304 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\TSpkg.dll
    2018-03-13 15:35 - 2018-03-01 01:59 - 000220672 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\MicrosoftAccountWAMExtension.dll
    2018-03-13 15:35 - 2018-03-01 01:53 - 000206848 _____ (Microsoft Corporation) C:\WINDOWS\system32\IndexedDbLegacy.dll
    2018-03-13 15:35 - 2018-03-01 01:53 - 000097792 _____ (Microsoft Corporation) C:\WINDOWS\system32\updatecsp.dll
    2018-03-13 15:35 - 2018-03-01 01:53 - 000039424 _____ (Microsoft Corporation) C:\WINDOWS\system32\UsoClient.exe
    2018-03-13 15:35 - 2018-03-01 01:51 - 002329088 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\MSVidCtl.dll
    2018-03-13 15:35 - 2018-03-01 01:51 - 000023552 _____ (Microsoft Corporation) C:\WINDOWS\system32\credssp.dll
    2018-03-13 15:35 - 2018-03-01 01:50 - 000118272 _____ (Microsoft Corporation) C:\WINDOWS\system32\TSpkg.dll
    2018-03-13 15:35 - 2018-03-01 01:50 - 000075264 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\wcnfs.sys
    2018-03-13 15:35 - 2018-03-01 01:49 - 000301056 _____ (Microsoft Corporation) C:\WINDOWS\system32\MicrosoftAccountWAMExtension.dll
    2018-03-13 15:35 - 2018-03-01 01:47 - 000484352 _____ (Microsoft Corporation) C:\WINDOWS\system32\cdpusersvc.dll
    2018-03-13 15:35 - 2018-03-01 01:46 - 000026624 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\msisip.dll
    2018-03-13 15:35 - 2018-03-01 01:36 - 004050432 _____ (Microsoft Corporation) C:\WINDOWS\system32\msi.dll
    2018-03-13 15:35 - 2018-03-01 01:36 - 000030208 _____ (Microsoft Corporation) C:\WINDOWS\system32\msisip.dll
    2018-03-13 15:35 - 2018-03-01 01:35 - 000568320 _____ (Microsoft Corporation) C:\WINDOWS\system32\msra.exe
    2018-03-13 15:35 - 2018-03-01 01:35 - 000128000 _____ (Microsoft Corporation) C:\WINDOWS\system32\racpldlg.dll
    2018-03-13 15:35 - 2018-02-21 22:07 - 000194456 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\ataport.sys
    2018-03-13 15:35 - 2018-02-21 21:50 - 000229272 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\tpm.sys
    2018-03-13 15:35 - 2018-02-21 20:30 - 000043008 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\RfxVmt.sys
    2018-03-13 15:35 - 2018-02-21 20:27 - 001282048 _____ (Microsoft Corporation) C:\WINDOWS\system32\MSVPXENC.dll
    2018-03-13 15:35 - 2018-02-21 20:16 - 001286144 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\MSVPXENC.dll
    2018-03-13 09:18 - 2018-03-13 09:18 - 000043520 _____ C:\Users\david\Desktop\Pavan Udayagiri sent you a new message.msg
    2018-03-12 18:19 - 2018-03-26 13:30 - 000109800 _____ (Malwarebytes) C:\WINDOWS\system32\Drivers\farflt.sys
    2018-03-12 18:19 - 2018-03-26 13:30 - 000101600 _____ (Malwarebytes) C:\WINDOWS\system32\Drivers\mwac.sys
    2018-03-12 18:19 - 2018-03-23 18:11 - 000253664 _____ (Malwarebytes) C:\WINDOWS\system32\Drivers\mbamswissarmy.sys
    2018-03-12 18:19 - 2018-03-12 18:19 - 000193248 _____ (Malwarebytes) C:\WINDOWS\system32\Drivers\MbamChameleon.sys
    2018-03-12 18:19 - 2018-03-12 18:19 - 000000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Malwarebytes
    2018-03-12 15:19 - 2018-03-12 15:19 - 000036864 _____ C:\Users\david\Desktop\New tweet links.msg
    2018-03-12 15:00 - 2018-03-12 15:15 - 000047616 _____ C:\Users\david\Desktop\RE Today's tweet.msg
    2018-03-12 09:20 - 2018-03-12 09:20 - 000093696 _____ C:\Users\david\Desktop\RE No word yet; is it time to invoice you.msg
    2018-03-10 17:40 - 2018-03-10 17:40 - 000000053 _____ C:\Users\david\Desktop\Billions - Official Series Site - SHOWTIME.url
    2018-03-09 20:06 - 2018-03-09 20:06 - 000106496 _____ C:\Users\david\Desktop\How long do they take to pay.msg
    2018-03-09 13:27 - 2018-03-09 13:27 - 000036864 _____ C:\Users\david\Desktop\SEND DeOS TECH TIP AND INVOICE TO ROB WRIGHT NOT BRENDA BUT COPY HER.msg
    2018-03-08 22:33 - 2018-03-10 20:27 - 000000100 _____ C:\Users\david\Desktop\Today's notice and being paid to share or endorse a product or service - LinkedIn Help Forum.url
    2018-03-08 22:24 - 2018-03-08 22:24 - 000059904 _____ C:\Users\david\Desktop\Updates to our Terms of Service.msg
    2018-03-08 19:20 - 2018-03-08 19:20 - 000001638 _____ C:\Users\david\Desktop\TechTarget--DeOS {SEND ART & INVOICE TO ROB, COPY BRENDA} Attacks Tech Tip - Shortcut.lnk
    2018-03-08 15:39 - 2018-03-08 15:39 - 000224256 _____ C:\Users\david\Desktop\Analytics from all tweets.msg
    2018-03-08 11:51 - 2018-03-20 13:29 - 000048128 _____ C:\Users\david\Desktop\Re Apple project.msg
    2018-03-07 17:53 - 2018-03-08 15:38 - 000068096 _____ C:\Users\david\Desktop\BY FRI MORN 9TH PUT ANALYTICS FROM ALL 5 CENTRIFY TWEETS TOGETHER IN DOC AND SEND TO KAREN.msg
    2018-03-07 12:01 - 2018-03-07 12:01 - 000001765 _____ C:\Users\david\Desktop\Centrify--LIPulse, Blockchain+ID How Secure, + 5-7Tweets - Shortcut.lnk
    2018-03-07 12:01 - 2018-03-07 12:01 - 000001711 _____ C:\Users\david\Desktop\Centrify--LI Pulse, Hacking Industry, + 5-7 Tweets - Shortcut.lnk
    2018-03-07 11:16 - 2018-03-07 11:16 - 000061952 _____ C:\Users\david\Desktop\CodeCanyon Update available for 'WPBakery Page Builder for WordPress (formerly Visual Composer)'.msg
    2018-03-06 20:07 - 2018-03-06 20:07 - 000045056 _____ C:\Users\david\Desktop\Re David Geer SoW - for next 3 Pulse Posts.msg
    2018-03-06 12:21 - 2018-03-06 12:21 - 000024064 _____ C:\Users\david\Desktop\Reply to thread 'parts that keep cupboard doors and closet doors closed'.msg
    2018-03-05 18:17 - 2018-03-05 18:17 - 000000212 _____ C:\Users\david\Desktop\5% CASH BACK GROCERIES APRIL THRU JUNE DISCOVER CARD.url
    2018-03-05 17:35 - 2018-03-05 17:35 - 000001850 _____ C:\Users\david\Desktop\AICPA, for Sabine V--8 insights boards know AI - Shortcut.lnk
    2018-03-02 19:28 - 2018-03-02 19:28 - 000001626 _____ C:\Users\david\Desktop\Centrify--1 LinkedIn Pulse post Equifax, 5 Tweets - Shortcut.lnk
    2018-03-01 22:01 - 2018-03-01 22:01 - 000000000 ____D C:\Users\david\AppData\Local\{1442221E-30EA-4EA6-5D72-6B4E791A97D6}
    2018-02-28 20:48 - 2018-02-28 20:48 - 000001707 _____ C:\Users\david\Desktop\QASymphony--Barriers to Adopting Test Automation - Shortcut.lnk
    2018-02-28 19:35 - 2018-02-28 19:35 - 000001715 _____ C:\Users\david\Desktop\RMM--Smart contracts & risk management - Shortcut.lnk
    2018-02-28 17:17 - 2018-02-28 17:27 - 000060416 _____ C:\Users\david\Desktop\Re Pitch--slideshow seven hard truths about blockchain security.msg
    2018-02-28 16:20 - 2018-02-28 16:20 - 000059904 _____ C:\Users\david\Desktop\FW Heard a rumor you were back doing some work at IDG.msg
    2018-02-28 12:59 - 2018-03-20 13:40 - 000055808 _____ C:\Users\david\Desktop\Re Support on content creation.msg
    2018-02-28 11:46 - 2018-02-28 11:46 - 000097792 _____ C:\Users\david\Desktop\Analytics for 2nd and 3rd tweet.msg
    2018-02-27 17:26 - 2018-02-27 17:26 - 000116736 _____ C:\Users\david\Desktop\CONTACT WPP AGENCIES THIS WAY.msg
    2018-02-27 16:59 - 2018-02-27 16:59 - 000103936 _____ C:\Users\david\Desktop\RE Thank you for connecting on LinkedIn.msg
    2018-02-27 15:09 - 2018-02-27 15:09 - 000001647 _____ C:\Users\david\Desktop\iboss-Hackers target cybersec sw - Shortcut.lnk
    2018-02-27 15:09 - 2018-02-27 15:09 - 000001521 _____ C:\Users\david\Desktop\iboss-DeOS attacks - Shortcut.lnk
    2018-02-27 12:19 - 2018-02-27 12:19 - 000084992 _____ C:\Users\david\Desktop\CONTACT THIS EDITOR ABOUT WRITING FOR THE FOUNDRY AGAIN.msg
    2018-02-27 05:01 - 2018-02-27 14:53 - 000046592 _____ C:\Users\david\Desktop\SEND REQUESTED SAMPLES.msg
    2018-02-26 19:27 - 2018-02-26 19:27 - 000049152 _____ C:\Users\david\Desktop\Re Risk cybersecurity technical topics.msg
    2018-02-26 17:41 - 2018-02-26 17:41 - 000032256 _____ C:\Users\david\Desktop\ASKED JOAN ABOUT HER LONG FORM CONTENT NEEDS AT IDG NOW SHE BACK WITH IDG SMS.msg
    2018-02-26 15:59 - 2018-02-26 15:59 - 000030720 _____ C:\Users\david\Desktop\3rd tweet link.msg
    2018-02-26 14:47 - 2018-02-26 14:47 - 000935936 _____ C:\Users\david\Desktop\TECH AND OTHER EDITOR EMAILS.msg

    ==================== One Month Modified files and folders ========

    (If an entry is included in the fixlist, the file/folder will be moved.)

    2018-03-26 14:44 - 2017-06-17 18:42 - 000699676 _____ C:\WINDOWS\ZAM.krnl.trace
    2018-03-26 14:43 - 2017-06-17 18:42 - 000120544 _____ C:\WINDOWS\ZAM_Guard.krnl.trace
    2018-03-26 14:43 - 2017-05-18 14:21 - 000000000 ____D C:\WINDOWS\CryptoGuard
    2018-03-26 14:36 - 2017-06-24 09:43 - 000000000 ___RD C:\Users\david\Documents\Home, office tech, other
    2018-03-26 14:34 - 2017-07-01 15:47 - 000000000 ____D C:\Users\david\AppData\Local\ClassicShell
    2018-03-26 14:30 - 2017-06-18 13:18 - 000000000 ____D C:\Users\david\Documents\Outlook Files
    2018-03-26 14:26 - 2017-08-07 12:37 - 000000000 ____D C:\Users\david\AppData\Roaming\StyleGuard
    2018-03-26 14:18 - 2017-09-30 07:16 - 000000000 ____D C:\ProgramData\NVIDIA
    2018-03-26 14:18 - 2017-06-29 05:33 - 000000000 ____D C:\AdwCleaner
    2018-03-26 14:10 - 2017-09-29 09:46 - 000000000 ____D C:\WINDOWS\system32\FxsTmp
    2018-03-26 13:45 - 2017-09-03 09:06 - 000000000 ____D C:\Users\david\AppData\Roaming\Opera Software
    2018-03-26 13:45 - 2017-09-03 09:06 - 000000000 ____D C:\Users\david\AppData\Local\Opera Software
    2018-03-26 13:45 - 2017-09-03 09:06 - 000000000 ____D C:\Program Files (x86)\Opera
    2018-03-26 13:44 - 2017-05-18 14:54 - 000000000 ____D C:\Program Files\Sandboxie
    2018-03-26 13:44 - 2017-05-18 11:10 - 000000000 ___RD C:\Users\david\OneDrive
    2018-03-26 13:38 - 2018-01-24 09:38 - 001335196 _____ C:\WINDOWS\system32\PerfStringBackup.INI
    2018-03-26 13:35 - 2017-05-18 14:23 - 000000000 ____D C:\Program Files\SUPERAntiSpyware
    2018-03-26 13:32 - 2017-07-02 08:53 - 000000000 ____D C:\Users\david\AppData\Roaming\IObit
    2018-03-26 13:32 - 2017-07-01 17:43 - 000000000 ____D C:\ProgramData\ProductData
    2018-03-26 13:30 - 2018-01-24 09:45 - 000000006 ____H C:\WINDOWS\Tasks\SA.DAT
    2018-03-26 13:30 - 2018-01-24 09:38 - 000000000 ____D C:\Users\david
    2018-03-26 13:30 - 2018-01-24 09:37 - 000000000 ____D C:\WINDOWS\system32\SleepStudy
    2018-03-26 13:30 - 2017-06-23 21:56 - 000000364 _____ C:\WINDOWS\Tasks\HPCeeScheduleFordavid.job
    2018-03-26 12:01 - 2018-01-24 09:38 - 000000000 ____D C:\Users\david\AppData\Local\Packages
    2018-03-26 11:25 - 2017-06-24 10:58 - 000000000 ___RD C:\Users\david\Documents\Taxes
    2018-03-24 21:36 - 2018-01-24 09:45 - 000003256 _____ C:\WINDOWS\System32\Tasks\HPCeeScheduleFordavid
    2018-03-24 03:02 - 2017-05-18 14:21 - 000000000 ____D C:\ProgramData\HitmanPro.Alert
    2018-03-24 03:01 - 2017-09-29 04:45 - 000524288 _____ C:\WINDOWS\system32\config\BBI
    2018-03-24 03:01 - 2017-05-18 14:21 - 000000000 ____D C:\ProgramData\HitmanPro
    2018-03-24 02:56 - 2017-09-29 09:44 - 000000000 ____D C:\WINDOWS\INF
    2018-03-24 02:56 - 2017-05-18 14:19 - 000000000 ____D C:\Users\david\AppData\Roaming\hpqLog
    2018-03-24 02:51 - 2017-09-16 08:27 - 000055232 _____ C:\WINDOWS\system32\Drivers\hitmanpro37.sys
    2018-03-24 02:14 - 2017-09-29 09:46 - 000000000 ____D C:\WINDOWS\rescache
    2018-03-23 18:22 - 2017-09-29 09:46 - 000000000 ____D C:\WINDOWS\DeliveryOptimization
    2018-03-23 18:15 - 2017-07-06 10:10 - 000000000 ____D C:\Users\david\AppData\Local\ElevatedDiagnostics
    2018-03-23 18:11 - 2018-01-24 09:45 - 000002916 _____ C:\WINDOWS\System32\Tasks\HPJumpStartLaunch
    2018-03-23 17:44 - 2017-12-12 07:27 - 000001225 _____ C:\Users\david\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Amazon Drive.lnk
    2018-03-23 17:44 - 2017-07-03 18:55 - 000000000 ____D C:\Users\david\AppData\Roaming\Amazon Cloud Drive
    2018-03-23 16:33 - 2018-01-23 06:14 - 000000000 ___DC C:\WINDOWS\Panther
    2018-03-23 13:24 - 2017-09-29 09:46 - 000000000 ___HD C:\Program Files\WindowsApps
    2018-03-23 13:24 - 2017-09-29 09:46 - 000000000 ____D C:\WINDOWS\AppReadiness
    2018-03-23 13:22 - 2017-05-18 16:11 - 000000000 ____D C:\Program Files (x86)\Rainlendar2
    2018-03-23 11:40 - 2018-01-24 09:38 - 000000000 ____D C:\Users\defaultuser0
    2018-03-23 11:40 - 2018-01-24 09:38 - 000000000 ____D C:\Users\Administrator
    2018-03-22 19:26 - 2017-05-18 11:15 - 000002308 _____ C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Google Chrome.lnk
    2018-03-22 10:25 - 2017-05-18 11:14 - 000000000 ____D C:\Users\david\AppData\Local\CrashDumps
    2018-03-22 10:24 - 2018-01-24 09:45 - 000003936 _____ C:\WINDOWS\System32\Tasks\CCleaner Update
    2018-03-22 09:45 - 2017-11-16 09:15 - 017493824 _____ (NVIDIA Corporation) C:\WINDOWS\system32\Drivers\nvlddmkm.sys
    2018-03-22 09:45 - 2017-11-16 09:15 - 000048407 _____ C:\WINDOWS\system32\nvinfo.pb
    2018-03-22 09:44 - 2017-11-16 09:15 - 004580832 _____ (NVIDIA Corporation) C:\WINDOWS\system32\nvapi64.dll
    2018-03-22 09:44 - 2017-11-16 09:14 - 000198080 _____ (Intel Corporation) C:\WINDOWS\system32\Drivers\ibtusb.sys
    2018-03-22 09:44 - 2017-10-05 23:38 - 008614888 _____ (Intel Corporation) C:\WINDOWS\system32\Drivers\Netwtw04.sys
    2018-03-22 09:44 - 2017-10-01 12:55 - 001026896 _____ (Realtek ) C:\WINDOWS\system32\Drivers\rt640x64.sys
    2018-03-22 09:43 - 2018-01-24 09:37 - 000002065 _____ C:\ProgramData\Microsoft\Windows\Start Menu\Programs\DTS Audio Control.lnk
    2018-03-22 09:43 - 2017-11-16 11:06 - 001682288 _____ (NVIDIA Corporation) C:\WINDOWS\system32\nvhdagenco6420103.dll
    2018-03-22 09:43 - 2017-11-16 11:06 - 000226760 _____ (NVIDIA Corporation) C:\WINDOWS\system32\Drivers\nvhda64v.sys
    2018-03-22 09:43 - 2017-10-01 12:55 - 000059240 _____ (NVIDIA Corporation) C:\WINDOWS\system32\Drivers\nvvad64v.sys
    2018-03-22 09:42 - 2018-01-24 09:45 - 000003194 _____ C:\WINDOWS\System32\Tasks\RTKCPL
    2018-03-22 09:42 - 2017-11-16 09:14 - 005995944 _____ (Realtek Semiconductor Corp.) C:\WINDOWS\system32\Drivers\RTKVHD64.sys
    2018-03-22 09:42 - 2017-11-16 09:14 - 003561920 _____ (Realtek Semiconductor Corp.) C:\WINDOWS\system32\RltkAPO64.dll
    2018-03-22 09:42 - 2017-11-16 09:14 - 003509192 _____ (Realtek Semiconductor Corp.) C:\WINDOWS\system32\RtkApi64.dll
    2018-03-22 09:42 - 2017-11-16 09:14 - 000192976 _____ (Realtek Semiconductor Corp.) C:\WINDOWS\system32\RtkCfg64.dll
    2018-03-22 09:42 - 2017-11-16 09:14 - 000023688 _____ (Realtek Semiconductor Corp.) C:\WINDOWS\system32\RtkCoLDR64.dll
    2018-03-22 09:42 - 2017-09-30 07:16 - 000000000 ____D C:\WINDOWS\SysWOW64\RTCOM
    2018-03-22 09:42 - 2017-07-01 18:17 - 000018464 _____ (Alcorlink Corp.) C:\WINDOWS\system32\AmUStor2.dll
    2018-03-21 20:30 - 2018-01-24 09:51 - 000000000 ___RD C:\Users\david\3D Objects
    2018-03-21 20:30 - 2016-07-29 08:33 - 000000000 __RHD C:\Users\Public\AccountPictures
    2018-03-21 20:29 - 2017-05-18 14:21 - 000000000 ____D C:\Program Files (x86)\HitmanPro.Alert
    2018-03-21 20:28 - 2017-09-29 09:46 - 000000000 ____D C:\WINDOWS\TextInput
    2018-03-21 20:28 - 2017-09-29 09:46 - 000000000 ____D C:\WINDOWS\system32\appraiser
    2018-03-21 20:28 - 2017-09-29 09:46 - 000000000 ____D C:\WINDOWS\ShellExperiences
    2018-03-21 20:28 - 2017-09-29 09:46 - 000000000 ____D C:\WINDOWS\PolicyDefinitions
    2018-03-21 19:11 - 2017-09-29 09:37 - 000000000 ____D C:\WINDOWS\CbsTemp
    2018-03-21 17:43 - 2017-05-18 14:21 - 000297712 _____ (SurfRight B.V.) C:\WINDOWS\system32\Drivers\hmpalert.sys
    2018-03-20 14:01 - 2018-02-04 19:07 - 000655360 _____ C:\Users\david\Desktop\MUST INVOICE CENTRIFY THSI WAY WITH PO FROM THEM AND COPYING AP AND MY CONTACT.msg
    2018-03-20 13:53 - 2017-10-26 10:01 - 000055808 _____ C:\Users\david\Desktop\SHES FROM SHAKER HEIGHTS GRAD BEACHWOOD HS s.msg
    2018-03-20 13:50 - 2017-09-17 15:05 - 000042496 _____ C:\Users\david\Desktop\New blog post ideas.msg
    2018-03-20 13:14 - 2017-06-24 10:51 - 000000000 ___RD C:\Users\david\Documents\Markets, Queries
    2018-03-20 12:57 - 2017-06-24 10:56 - 000000000 ___RD C:\Users\david\Documents\Personal
    2018-03-20 11:15 - 2017-06-24 10:51 - 000000000 ___RD C:\Users\david\Documents\Marketing, Social Networking, Etc
    2018-03-20 07:27 - 2017-05-18 14:54 - 000001864 _____ C:\WINDOWS\Sandboxie.ini
    2018-03-18 04:28 - 2017-09-29 09:46 - 000000000 ____D C:\ProgramData\regid.1991-06.com.microsoft
    2018-03-18 04:26 - 2017-02-08 11:28 - 000000000 ____D C:\Program Files (x86)\Microsoft Office
    2018-03-13 20:05 - 2018-01-05 05:03 - 000061304 _____ () C:\WINDOWS\system32\Drivers\lpsport.sys
    2018-03-13 20:04 - 2018-01-24 09:45 - 000003990 _____ C:\WINDOWS\System32\Tasks\Avast Emergency Update
    2018-03-13 20:01 - 2017-11-16 06:43 - 000196648 _____ (AVAST Software) C:\WINDOWS\system32\Drivers\aswArPot.sys
    2018-03-13 20:01 - 2017-06-18 15:26 - 000619984 _____ (AVAST Software) C:\WINDOWS\system32\Drivers\aswNetSec.sys
    2018-03-13 20:01 - 2017-05-18 11:48 - 001026696 _____ (AVAST Software) C:\WINDOWS\system32\Drivers\aswSnx.sys
    2018-03-13 20:01 - 2017-05-18 11:48 - 000460520 _____ (AVAST Software) C:\WINDOWS\system32\Drivers\aswSP.sys
    2018-03-13 20:01 - 2017-05-18 11:48 - 000380528 _____ (AVAST Software) C:\WINDOWS\system32\Drivers\aswVmm.sys
    2018-03-13 20:01 - 2017-05-18 11:48 - 000343752 _____ (AVAST Software) C:\WINDOWS\system32\Drivers\aswbloga.sys
    2018-03-13 20:01 - 2017-05-18 11:48 - 000227504 _____ (AVAST Software) C:\WINDOWS\system32\Drivers\aswbidsdrivera.sys
    2018-03-13 20:01 - 2017-05-18 11:48 - 000205976 _____ (AVAST Software) C:\WINDOWS\system32\Drivers\aswStm.sys
    2018-03-13 20:01 - 2017-05-18 11:48 - 000199440 _____ (AVAST Software) C:\WINDOWS\system32\Drivers\aswbidsha.sys
    2018-03-13 20:01 - 2017-05-18 11:48 - 000146656 _____ (AVAST Software) C:\WINDOWS\system32\Drivers\aswMonFlt.sys
    2018-03-13 20:01 - 2017-05-18 11:48 - 000110328 _____ (AVAST Software) C:\WINDOWS\system32\Drivers\aswRdr2.sys
    2018-03-13 20:01 - 2017-05-18 11:48 - 000084368 _____ (AVAST Software) C:\WINDOWS\system32\Drivers\aswRvrt.sys
    2018-03-13 20:01 - 2017-05-18 11:48 - 000057680 _____ (AVAST Software) C:\WINDOWS\system32\Drivers\aswbuniva.sys
    2018-03-13 20:01 - 2017-05-18 11:48 - 000046968 _____ (AVAST Software) C:\WINDOWS\system32\Drivers\aswHwid.sys
    2018-03-13 15:41 - 2017-05-18 12:44 - 000000000 ____D C:\WINDOWS\system32\MRT
    2018-03-13 15:39 - 2017-10-10 23:37 - 130364688 ____C (Microsoft Corporation) C:\WINDOWS\system32\MRT-KB890830.exe
    2018-03-13 15:38 - 2017-05-18 12:44 - 130364688 ____C (Microsoft Corporation) C:\WINDOWS\system32\MRT.exe
    2018-03-13 15:37 - 2017-09-29 09:41 - 000140800 _____ (Microsoft Corporation) C:\WINDOWS\system32\Chakradiag.dll
    2018-03-13 15:37 - 2017-09-29 09:41 - 000106496 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\Chakradiag.dll
    2018-03-12 15:37 - 2017-08-02 14:41 - 000000000 ____D C:\Users\david\AppData\Roaming\audacity
    2018-03-09 14:34 - 2017-07-01 17:50 - 000000600 _____ C:\Users\david\AppData\Roaming\winscp.rnd
    2018-03-03 11:22 - 2018-01-24 09:45 - 000004284 _____ C:\WINDOWS\System32\Tasks\Avast TUNEUP Update
    2018-03-02 17:09 - 2018-02-16 23:24 - 000834552 _____ (Adobe Systems Incorporated) C:\WINDOWS\SysWOW64\FlashPlayerApp.exe
    2018-03-02 17:09 - 2018-02-16 23:24 - 000179704 _____ (Adobe Systems Incorporated) C:\WINDOWS\SysWOW64\FlashPlayerCPLApp.cpl
    2018-03-02 13:57 - 2017-06-24 10:57 - 000000000 ___RD C:\Users\david\Documents\Songs
    2018-03-01 22:00 - 2017-07-01 17:42 - 000000000 ____D C:\ProgramData\IObit
    2018-03-01 21:33 - 2017-09-29 09:46 - 000000000 ____D C:\WINDOWS\system32\oobe
    2018-03-01 21:33 - 2017-09-29 09:46 - 000000000 ____D C:\WINDOWS\bcastdvr
    2018-03-01 15:21 - 2018-02-15 19:18 - 000049152 _____ C:\Users\david\Desktop\PITCHED TO RMM, ALSO PITCH THIS AND OTHER VER ELSEWHERE.msg
    2018-02-26 21:02 - 2018-01-24 09:45 - 000004562 _____ C:\WINDOWS\System32\Tasks\Adobe Acrobat Update Task
    2018-02-24 03:16 - 2017-05-18 16:12 - 000002457 _____ C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Acrobat Reader DC.lnk

    ==================== Files in the root of some directories =======

    2017-06-18 13:27 - 2017-06-18 13:27 - 000022913 _____ () C:\Users\david\AppData\Roaming\Comma Separated Values (Windows).ADR
    2017-06-22 17:55 - 2017-10-12 10:43 - 000037833 _____ () C:\Users\david\AppData\Roaming\Comma Separated Values.ADR
    2017-07-01 17:50 - 2018-03-09 14:34 - 000000600 _____ () C:\Users\david\AppData\Roaming\winscp.rnd
    2017-07-01 16:56 - 2017-07-01 16:56 - 000000017 _____ () C:\Users\david\AppData\Local\resmon.resmoncfg

    Some files in TEMP:
    ====================
    2018-03-26 13:45 - 2018-03-26 13:45 - 002183680 _____ (Opera Software) C:\Users\david\AppData\Local\Temp\Opera_installer_180326174532829.dll
    2018-03-26 13:45 - 2018-03-26 13:45 - 002183680 _____ (Opera Software) C:\Users\david\AppData\Local\Temp\Opera_installer_180326174532985.dll
    2018-03-26 13:45 - 2018-03-26 13:45 - 002183680 _____ (Opera Software) C:\Users\david\AppData\Local\Temp\Opera_installer_180326174533423.dll
    2018-03-26 13:45 - 2018-03-26 13:45 - 002183680 _____ (Opera Software) C:\Users\david\AppData\Local\Temp\Opera_installer_180326174538083.dll

    ==================== Bamital & volsnap ======================

    (There is no automatic fix for files that do not pass verification.)

    C:\WINDOWS\system32\winlogon.exe => File is digitally signed
    C:\WINDOWS\system32\wininit.exe => File is digitally signed
    C:\WINDOWS\explorer.exe => File is digitally signed
    C:\WINDOWS\SysWOW64\explorer.exe => File is digitally signed
    C:\WINDOWS\system32\svchost.exe => File is digitally signed
    C:\WINDOWS\SysWOW64\svchost.exe => File is digitally signed
    C:\WINDOWS\system32\services.exe => File is digitally signed
    C:\WINDOWS\system32\User32.dll => File is digitally signed
    C:\WINDOWS\SysWOW64\User32.dll => File is digitally signed
    C:\WINDOWS\system32\userinit.exe => File is digitally signed
    C:\WINDOWS\SysWOW64\userinit.exe => File is digitally signed
    C:\WINDOWS\system32\rpcss.dll => File is digitally signed
    C:\WINDOWS\system32\dnsapi.dll => File is digitally signed
    C:\WINDOWS\SysWOW64\dnsapi.dll => File is digitally signed
    C:\WINDOWS\system32\Drivers\volsnap.sys => File is digitally signed

    LastRegBack: 2018-03-25 19:02

    ==================== End of FRST.txt ============================

    Additional scan result of Farbar Recovery Scan Tool (x64) Version: 14.03.2018
    Ran by david (26-03-2018 14:44:34)
    Running from C:\Users\david\Desktop
    Windows 10 Pro Version 1709 16299.309 (X64) (2018-01-24 13:47:09)
    Boot Mode: Normal
    ==========================================================


    ==================== Accounts: =============================

    Administrator (S-1-5-21-3840204244-4144708379-2675172571-500 - Administrator - Enabled) => C:\Users\Administrator
    david (S-1-5-21-3840204244-4144708379-2675172571-1001 - Administrator - Enabled) => C:\Users\david
    david_ufnzexa (S-1-5-21-3840204244-4144708379-2675172571-1003 - Limited - Disabled)
    DefaultAccount (S-1-5-21-3840204244-4144708379-2675172571-503 - Limited - Disabled)
    defaultuser0 (S-1-5-21-3840204244-4144708379-2675172571-1000 - Limited - Disabled) => C:\Users\defaultuser0
    Guest (S-1-5-21-3840204244-4144708379-2675172571-501 - Limited - Disabled)
    WDAGUtilityAccount (S-1-5-21-3840204244-4144708379-2675172571-504 - Limited - Disabled)

    ==================== Security Center ========================

    (If an entry is included in the fixlist, it will be removed.)

    AV: Avast Antivirus (Enabled - Up to date) {8EA8924E-BC81-DC44-8BB0-8BAE75D86EBF}
    AV: Windows Defender (Disabled - Up to date) {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
    AV: Malwarebytes (Enabled - Up to date) {23007AD3-69FE-687C-2629-D584AFFAF72B}
    AS: Malwarebytes (Enabled - Up to date) {98619B37-4FC4-67F2-1C99-EEF6D47DBD96}
    AS: Windows Defender (Disabled - Up to date) {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
    AS: Avast Antivirus (Enabled - Up to date) {35C973AA-9ABB-D3CA-B100-B0DC0E5F2402}
    FW: Avast Antivirus (Enabled) {B693136B-F6EE-DD1C-A0EF-229B8B0B29C4}

    ==================== Installed Programs ======================

    (Only the adware programs with "Hidden" flag could be added to the fixlist to unhide them. The adware programs should be uninstalled manually.)

    Adobe Acrobat Reader DC (HKLM-x32\...\{AC76BA86-7AD7-1033-7B44-AC0F074E4100}) (Version: 18.011.20038 - Adobe Systems Incorporated)
    Amazon Drive (HKU\S-1-5-21-3840204244-4144708379-2675172571-1001\...\Amazon Drive) (Version: 5.2.3 - Amazon.com, Inc.)
    Amazon Kindle (HKU\S-1-5-21-3840204244-4144708379-2675172571-1001\...\Amazon Kindle) (Version: 1.21.0.48017 - Amazon)
    Ansel (HKLM\...\{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_Ansel) (Version: 385.46 - NVIDIA Corporation) Hidden
    Apple Application Support (32-bit) (HKLM-x32\...\{BC7C46A4-D7A7-48EC-A98C-32A7762B5EFA}) (Version: 6.2.1 - Apple Inc.)
    Apple Application Support (64-bit) (HKLM\...\{F0C4B709-8BF4-4A72-B527-12E7BF5482F8}) (Version: 6.2.1 - Apple Inc.)
    Apple Mobile Device Support (HKLM\...\{BD6778C5-6FA5-492A-ADD6-E706339C2A7B}) (Version: 11.0.2.4 - Apple Inc.)
    Apple Software Update (HKLM-x32\...\{19589375-5C58-4AFA-842F-8B34744CCEAD}) (Version: 2.5.0.1 - Apple Inc.)
    Audacity 2.1.3 (HKLM-x32\...\Audacity®_is1) (Version: 2.1.3 - Audacity Team)
    Avast Cleanup Premium (HKLM-x32\...\{075CC190-59EE-499F-828B-0B5C098C8C15}_is1) (Version: 17.3.4228 - AVAST Software)
    Avast Premier (HKLM-x32\...\Avast Antivirus) (Version: 18.2.2328 - AVAST Software)
    AxCrypt 2.1.1494.0 (HKLM\...\{876F52CC-40A6-C31F-B14E-9E47509F6BAD}) (Version: 2.1.1494.0 - AxCrypt AB) Hidden
    AxCrypt 2.1.1494.0 (HKLM-x32\...\{699479f3-15fe-49aa-88cf-d76d0bbe1f71}) (Version: 2.1.1494.0 - AxCrypt AB)
    Belarc Advisor 8.5c (HKLM-x32\...\Belarc Advisor) (Version: 8.5.3.0 - Belarc Inc.)
    Bulk Rename Utility 3.0.0.1 (64-bit) (HKLM\...\Bulk Rename Utility Installation_is1) (Version: - TGRMN Software)
    CCleaner (HKLM\...\CCleaner) (Version: 5.41 - Piriform)
    Classic Shell (HKLM\...\{383BB30A-B4A7-4666-9A83-22CFA8640097}) (Version: 4.3.0 - IvoSoft)
    CyberLink Power Media Player 14 (HKLM-x32\...\{32C8E300-BDB4-4398-92C2-E9B7D8A233DB}) (Version: 14.0.5.7103 - CyberLink Corp.)
    Energy Star (HKLM\...\{5CB22648-35F8-41BC-9C35-1E41FE6E12A5}) (Version: 1.1.1 - HP Inc.)
    EPSON Connect version 1.0 (HKLM-x32\...\EPSON Connect_is1) (Version: 1.0 - Epson America Inc.)
    Epson Customer Research Participation (HKLM\...\{B26449A6-6007-4460-B4FE-C4776115BCEA}) (Version: 1.82.0000 - Seiko Epson Corporation)
    EPSON Scan (HKLM-x32\...\EPSON Scanner) (Version: - Seiko Epson Corporation)
    Epson Software Updater (HKLM-x32\...\{7BAC3F7A-B963-468E-982E-B5608A87408D}) (Version: 4.4.4 - SEIKO EPSON CORPORATION)
    EPSON XP-310 Series Printer Uninstall (HKLM\...\EPSON XP-310 Series) (Version: - SEIKO EPSON Corporation)
    EpsonNet Print (HKLM\...\{96ED1D58-440C-4345-8FEE-C4781366C67F}) (Version: 3.1.4.0 - SEIKO EPSON Corporation)
    Eraser 6.2.0.2979 (HKLM\...\{C5900DE9-D199-4C27-B692-354C9A6A6C8B}) (Version: 6.2.2979 - The Eraser Project)
    f.lux (HKU\S-1-5-21-3840204244-4144708379-2675172571-1001\...\Flux) (Version: - f.lux Software LLC)
    Google Chrome (HKLM-x32\...\Google Chrome) (Version: 65.0.3325.181 - Google Inc.)
    Google Update Helper (HKLM-x32\...\{60EC980A-BDA2-4CB6-A427-B07A5498B4CA}) (Version: 1.3.33.7 - Google Inc.) Hidden
    Grammarly (HKU\S-1-5-21-3840204244-4144708379-2675172571-1001\...\GrammarlyForWindows) (Version: 1.5.29 - Grammarly)
    Grammarly for Microsoft® Office Suite (HKLM\...\{B443A4BE-E688-43BD-B152-6724A38437B1}) (Version: 6.6.129 - Grammarly) Hidden
    Grammarly for Microsoft® Office Suite (HKU\S-1-5-21-3840204244-4144708379-2675172571-1001\...\{da7635e6-2ab8-496a-b5b5-8f82fb640c16}) (Version: 6.6.129 - Grammarly)
    HitmanPro.Alert 3 (HKLM\...\HitmanPro.Alert) (Version: 3.7.6.738 - SurfRight B.V.)
    HP Audio Switch (HKLM-x32\...\{0C5D69BD-B518-46DB-8471-506CD27F9478}) (Version: 1.0.138.0 - HP Inc.)
    HP Documentation (HKLM\...\HP_Documentation) (Version: 1.0.0.2 - HP Inc.)
    HP ePrint SW (HKLM-x32\...\{5b1a1d22-bd59-44e0-a954-e2f18ec43a23}) (Version: 5.2.20454 - HP Inc.)
    HP JumpStart Bridge (HKLM-x32\...\{1E7D6A6F-E28B-4057-BD4F-9989C1F5353D}) (Version: 1.3.0.423 - HP Inc.)
    HP JumpStart Launch (HKLM-x32\...\{4380D813-39E5-46FD-AC23-FC9A1A8B98AA}) (Version: 1.3.423.0 - HP Inc.)
    HP Orbit (HKLM-x32\...\{82b971c1-85fa-4c53-ada1-4ec6be0c0c8a}) (Version: 3.5.171.271 - HP Inc.)
    HP Registration Service (HKLM\...\{D1E8F2D7-7794-4245-B286-87ED86C1893C}) (Version: 1.2.8361.5688 - HP Inc.)
    HP Support Assistant (HKLM-x32\...\{30514137-FB26-4E1A-A3B4-5B48680F3ECE}) (Version: 8.5.37.19 - HP Inc.)
    HP Support Solutions Framework (HKLM-x32\...\{D566DA31-9325-400E-B309-4BBA18B367E3}) (Version: 12.8.47.1 - HP Inc.)
    HP Sure Connect (HKLM-x32\...\{6468C4A5-E47E-405F-B675-A70A70983EA6}) (Version: 1.0.0.29 - HP Inc.)
    HP System Event Utility (HKLM-x32\...\{025C1573-2F1D-46AF-BAB8-594EBF56A889}) (Version: 1.4.11 - HP Inc.)
    HP Touchpoint Analytics Client (HKLM\...\{E5FB98E0-0784-44F0-8CEC-95CD4690C43F}) (Version: 4.0.2.1439 - HP Inc.)
    Intel(R) Chipset Device Software (HKLM-x32\...\{bb0592a7-5772-4736-9d55-2402740085db}) (Version: 10.1.1.38 - Intel(R) Corporation) Hidden
    Intel(R) Management Engine Components (HKLM\...\{1CEAC85D-2590-4760-800F-8DE5E91F3700}) (Version: 11.7.0.1054 - Intel Corporation)
    Intel(R) Rapid Storage Technology (HKLM\...\{409CB30E-E457-4008-9B1A-ED1B9EA21140}) (Version: 15.2.0.1020 - Intel Corporation)
    Intel(R) Ready Mode Technology (HKLM\...\{CC3C017C-876D-4A31-A128-593FF92A1FE7}) (Version: 1.1.70.528 - Intel Corporation)
    Intel(R) Trusted Connect Service Client x86 (HKLM-x32\...\{C9552825-7BF2-4344-BA91-D3CD46F4C441}) (Version: 1.47.866.0 - Intel Corporation) Hidden
    Intel(R) Trusted Connect Services Client (HKLM-x32\...\{246c6cc0-9810-4728-9a29-28474de2eec5}) (Version: 1.47.866.0 - Intel Corporation) Hidden
    Intel(R) Wireless Bluetooth(R) (HKLM-x32\...\{F50984E6-5E69-4A75-B1A5-7F5B4D964EB0}) (Version: 19.11.1641.0703 - Intel Corporation)
    Intel® PROSet/Wireless Software (HKLM-x32\...\{ed4a5da7-ac62-4aa5-9502-7b4de55e8cb5}) (Version: 20.20.2 - Intel Corporation)
    iTunes (HKLM\...\{D7D4465C-B3B6-4BC1-B336-2803FB57BFAF}) (Version: 12.7.2.60 - Apple Inc.)
    KeyScrambler (HKLM-x32\...\KeyScrambler) (Version: 3.11.0.3 - QFX Software Corporation)
    LAME v3.99.3 (for Windows) (HKLM-x32\...\LAME_is1) (Version: - )
    Malwarebytes version 3.4.4.2398 (HKLM\...\{35065F43-4BB2-439A-BFF7-0F1014F2E0CD}_is1) (Version: 3.4.4.2398 - Malwarebytes)
    Microsoft Office Professional Plus 2016 - en-us (HKLM\...\ProPlusRetail - en-us) (Version: 16.0.9029.2253 - Microsoft Corporation)
    Microsoft OneDrive (HKU\S-1-5-21-3840204244-4144708379-2675172571-500\...\OneDriveSetup.exe) (Version: 17.3.6917.0607 - Microsoft Corporation)
    Microsoft Visual C++ 2005 Redistributable (HKLM-x32\...\{710f4c1c-cc18-4c49-8cbf-51240c89a1a2}) (Version: 8.0.61001 - Microsoft Corporation)
    Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.4148 (HKLM-x32\...\{1F1C2DFC-2D24-3E06-BCB8-725134ADF989}) (Version: 9.0.30729.4148 - Microsoft Corporation)
    Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161 (HKLM-x32\...\{9BE518E6-ECC6-35A9-88E4-87755C07200F}) (Version: 9.0.30729.6161 - Microsoft Corporation)
    Microsoft Visual C++ 2010 x64 Redistributable - 10.0.40219 (HKLM\...\{1D8E6291-B0D5-35EC-8441-6616F567A0F7}) (Version: 10.0.40219 - Microsoft Corporation)
    Microsoft Visual C++ 2010 x86 Redistributable - 10.0.40219 (HKLM-x32\...\{F0C3E5D1-1ADE-321E-8167-68EF0DE699A5}) (Version: 10.0.40219 - Microsoft Corporation)
    Microsoft Visual C++ 2012 Redistributable (x86) - 11.0.61030 (HKLM-x32\...\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}) (Version: 11.0.61030.0 - Microsoft Corporation)
    Microsoft Visual C++ 2013 Redistributable (x64) - 12.0.30501 (HKLM-x32\...\{050d4fc8-5d48-4b8f-8972-47c82c46020f}) (Version: 12.0.30501.0 - Microsoft Corporation)
    Microsoft Visual C++ 2013 Redistributable (x86) - 12.0.30501 (HKLM-x32\...\{f65db027-aff3-4070-886a-0d87064aabb1}) (Version: 12.0.30501.0 - Microsoft Corporation)
    Microsoft Visual C++ 2015 Redistributable (x64) - 14.0.23918 (HKLM-x32\...\{dab68466-3a7d-41a8-a5cf-415e3ff8ef71}) (Version: 14.0.23918.0 - Microsoft Corporation)
    Microsoft Visual C++ 2015 Redistributable (x86) - 14.0.23918 (HKLM-x32\...\{2e085fd2-a3e4-4b39-8e10-6b8d35f55244}) (Version: 14.0.23918.0 - Microsoft Corporation)
    Microsoft Visual Studio 2010 Tools for Office Runtime (x64) (HKLM\...\Microsoft Visual Studio 2010 Tools for Office Runtime (x64)) (Version: 10.0.50903 - Microsoft Corporation)
    NVIDIA GeForce Experience 2.11.4.0 (HKLM\...\{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_Display.GFExperience) (Version: 2.11.4.0 - NVIDIA Corporation)
    NVIDIA HD Audio Driver 1.3.36.6 (HKLM\...\{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_HDAudio.Driver) (Version: 1.3.36.6 - NVIDIA Corporation)
    NVIDIA PhysX System Software 9.16.0318 (HKLM\...\{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_Display.PhysX) (Version: 9.16.0318 - NVIDIA Corporation)
    Office 16 Click-to-Run Extensibility Component (HKLM-x32\...\{90160000-008C-0000-0000-0000000FF1CE}) (Version: 16.0.9029.2253 - Microsoft Corporation) Hidden
    Office 16 Click-to-Run Extensibility Component 64-bit Registration (HKLM\...\{90160000-00DD-0000-1000-0000000FF1CE}) (Version: 16.0.9029.2253 - Microsoft Corporation) Hidden
    Office 16 Click-to-Run Licensing Component (HKLM\...\{90160000-008F-0000-1000-0000000FF1CE}) (Version: 16.0.9029.2253 - Microsoft Corporation) Hidden
    Office 16 Click-to-Run Localization Component (HKLM-x32\...\{90160000-008C-0409-0000-0000000FF1CE}) (Version: 16.0.9029.2253 - Microsoft Corporation) Hidden
    OMEN Control (HKLM-x32\...\{AFE5BCE5-46DD-4DFA-9DD9-00F42E15ABD9}) (Version: 1.1.1 - HP)
    Paragon Backup & Recovery™ 16 (HKLM\...\{FA02F344-8F3D-4EDC-97DA-A7B4469EC72E}) (Version: 10.2.0.1235 - Paragon Software) Hidden
    Paragon Backup & Recovery™ 16 (HKLM-x32\...\{e34dc417-19f0-4881-8438-130eeb95d85b}) (Version: 10.2.0.1235 - Paragon Software GmbH)
    Paragon UIM (HKLM\...\{56EECD69-F428-41C4-ADF6-6CDEE14DDF3F}) (Version: 20.0.0.4 - Paragon Software) Hidden
    PeaZip 6.4.1 (WIN64) (HKLM\...\{5A2BC38A-406C-4A5B-BF45-6991F9A05325}_is1) (Version: 6.4.1 - Giorgio Tani)
    Realtek Card Reader (HKLM-x32\...\{5BC2B5AB-80DE-4E83-B8CF-426902051D0A}) (Version: 10.0.14393.31233 - Realtek Semiconductor Corp.)
    Realtek Ethernet Controller Driver (HKLM-x32\...\{8833FFB6-5B0C-4764-81AA-06DFEED9A476}) (Version: 10.12.1007.2016 - Realtek)
    Realtek High Definition Audio Driver (HKLM-x32\...\{F132AF7F-7BCA-4EDE-8A7C-958108FE7DBC}) (Version: 6.0.1.8264 - Realtek Semiconductor Corp.)
    Revo Uninstaller 1.95 (HKLM-x32\...\Revo Uninstaller) (Version: 1.95 - VS Revo Group)
    Safari (HKLM-x32\...\{C779648B-410E-4BBA-B75B-5815BCEFE71D}) (Version: 5.34.57.2 - Apple Inc.)
    SafeZone Stable 4.58.2552.909 (HKLM-x32\...\SafeZone 4.58.2552.909) (Version: 4.58.2552.909 - Avast Software) Hidden
    Samsung USB Driver for Mobile Phones (HKLM\...\{D0795B21-0CDA-4a92-AB9E-6E92D8111E44}) (Version: 1.5.59.0 - Samsung Electronics Co., Ltd.)
    SHIELD Streaming (HKLM\...\{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_GFExperience.NvStreamSrv) (Version: 7.1.0280 - NVIDIA Corporation) Hidden
    SHIELD Wireless Controller Driver (HKLM\...\{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_ShieldWirelessController) (Version: 2.11.4.0 - NVIDIA Corporation) Hidden
    Spybot - Search & Destroy (HKLM-x32\...\{B4092C6D-E886-4CB2-BA68-FE5A99D31DE7}_is1) (Version: 2.4.40 - Safer-Networking Ltd.)
    SteelSeries Engine 3.9.1 (HKLM\...\SteelSeries Engine 3) (Version: 3.9.1 - SteelSeries ApS)
    StyleGuard for Word 2013 (HKLM-x32\...\{E772411C-8FA7-4B12-9BF4-2C1E67A86604}) (Version: 3.16.0601 - StyleGuard)
    TurboTax 2015 (HKLM-x32\...\TurboTax 2015) (Version: 2015.0 - Intuit, Inc)
    Tweaking.com - Registry Backup (HKLM-x32\...\Tweaking.com - Registry Backup) (Version: 3.5.3 - Tweaking.com)
    Update for Windows 10 for x64-based Systems (KB4023057) (HKLM\...\{EC5A6438-850E-4AD1-9169-DD071C8EFFEF}) (Version: 2.10.0.0 - Microsoft Corporation)
    Vulkan Run Time Libraries 1.0.51.0 (HKLM\...\VulkanRT1.0.51.0) (Version: 1.0.51.0 - LunarG, Inc.)
    WinPatrol (HKLM-x32\...\{6A206A04-6BC1-411B-AA04-4E52EDEEADF2}) (Version: 35.5.2017.8 - Ruiware)
    WinSCP 5.11.3 (HKLM-x32\...\winscp3_is1) (Version: 5.11.3 - Martin Prikryl)
    Zemana AntiMalware (HKLM-x32\...\{8F0CD7D1-42F3-4195-95CD-833578D45057}_is1) (Version: 2.74.0.150 - Zemana Ltd.)

    ==================== Custom CLSID (Whitelisted): ==========================

    (If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)

    CustomCLSID: HKU\S-1-5-21-3840204244-4144708379-2675172571-1001_Classes\CLSID\{2AD206F1-152C-4F9D-A24E-6F93FE7A4AFC}\InprocServer32 -> C:\Users\david\AppData\Local\Grammarly\Grammarly for Microsoft Office Suite\6.6.129\8E542C5E5C\GrammarlyShim64.dll (CompanyName)
    CustomCLSID: HKU\S-1-5-21-3840204244-4144708379-2675172571-1001_Classes\CLSID\{4BE56754-B616-4998-B825-D16983AEE1B2}\InprocServer32 -> C:\windows\system32\mscoree.dll (Microsoft Corporation)
    ShellIconOverlayIdentifiers: [00asw] -> {472083B0-C522-11CF-8763-00608CC02F24} => C:\Program Files\AVAST Software\Avast\ashShA64.dll [2018-03-13] (AVAST Software)
    ContextMenuHandlers1: [2.0 Zemana AntiMalware] -> {6ABB1C11-E261-4CEA-BBB5-3836225689DD} => C:\Program Files (x86)\Zemana AntiMalware\ZAMShellExt64.dll [2017-12-08] ()
    ContextMenuHandlers1: [avast] -> {472083B0-C522-11CF-8763-00608CC02F24} => C:\Program Files\AVAST Software\Avast\ashShA64.dll [2018-03-13] (AVAST Software)
    ContextMenuHandlers1: [axcrypt.File] -> {C3DFC144-30F8-4138-81F9-578DBEB9324A} => C:\Program Files\AxCrypt\AxCrypt\ShellExt.dll [2017-04-20] (AxCrypt AB)
    ContextMenuHandlers1: [BRUMenuHandler] -> {5D924130-4CB1-11DB-B0DE-0800200C9A66} => C:\Program Files\Bulk Rename Utility\BRUhere64.dll [2016-02-04] (Bulk Rename Utility)
    ContextMenuHandlers1: [Eraser] -> {BC9B776A-90D7-4476-A791-79D835F30650} => C:\Program Files\Eraser\Eraser.Shell.dll [2016-08-28] (The Eraser Project)
    ContextMenuHandlers1: [SDECon32] -> {44176360-2BBF-4EC1-93CE-384B8681A0BC} => C:\Program Files (x86)\Spybot - Search & Destroy 2\SDECon64.dll [2014-06-24] (Safer-Networking Ltd.)
    ContextMenuHandlers1: [SDECon64] -> {44176360-2BBF-4EC1-93CE-384B8681A0BC} => C:\Program Files (x86)\Spybot - Search & Destroy 2\SDECon64.dll [2014-06-24] (Safer-Networking Ltd.)
    ContextMenuHandlers2: [BRUMenuHandler] -> {5D924130-4CB1-11DB-B0DE-0800200C9A66} => C:\Program Files\Bulk Rename Utility\BRUhere64.dll [2016-02-04] (Bulk Rename Utility)
    ContextMenuHandlers2: [Eraser] -> {BC9B776A-90D7-4476-A791-79D835F30650} => C:\Program Files\Eraser\Eraser.Shell.dll [2016-08-28] (The Eraser Project)
    ContextMenuHandlers3: [00asw] -> {472083B0-C522-11CF-8763-00608CC02F24} => C:\Program Files\AVAST Software\Avast\ashShA64.dll [2018-03-13] (AVAST Software)
    ContextMenuHandlers3: [MBAMShlExt] -> {57CE581A-0CB6-4266-9CA0-19364C90A0B3} => C:\Program Files\Malwarebytes\Anti-Malware\mbshlext.dll [2018-03-03] (Malwarebytes)
    ContextMenuHandlers4: [BRUMenuHandler] -> {5D924130-4CB1-11DB-B0DE-0800200C9A66} => C:\Program Files\Bulk Rename Utility\BRUhere64.dll [2016-02-04] (Bulk Rename Utility)
    ContextMenuHandlers4: [Eraser] -> {BC9B776A-90D7-4476-A791-79D835F30650} => C:\Program Files\Eraser\Eraser.Shell.dll [2016-08-28] (The Eraser Project)
    ContextMenuHandlers5: [Eraser] -> {BC9B776A-90D7-4476-A791-79D835F30650} => C:\Program Files\Eraser\Eraser.Shell.dll [2016-08-28] (The Eraser Project)
    ContextMenuHandlers5: [NvCplDesktopContext] -> {3D1975AF-48C6-4f8e-A182-BE0E08FA86A9} => C:\WINDOWS\system32\nvshext.dll [2017-10-06] (NVIDIA Corporation)
    ContextMenuHandlers6: [2.0 Zemana AntiMalware] -> {6ABB1C11-E261-4CEA-BBB5-3836225689DD} => C:\Program Files (x86)\Zemana AntiMalware\ZAMShellExt64.dll [2017-12-08] ()
    ContextMenuHandlers6: [avast] -> {472083B0-C522-11CF-8763-00608CC02F24} => C:\Program Files\AVAST Software\Avast\ashShA64.dll [2018-03-13] (AVAST Software)
    ContextMenuHandlers6: [axcrypt.File] -> {C3DFC144-30F8-4138-81F9-578DBEB9324A} => C:\Program Files\AxCrypt\AxCrypt\ShellExt.dll [2017-04-20] (AxCrypt AB)
    ContextMenuHandlers6: [Eraser] -> {BC9B776A-90D7-4476-A791-79D835F30650} => C:\Program Files\Eraser\Eraser.Shell.dll [2016-08-28] (The Eraser Project)
    ContextMenuHandlers6: [MBAMShlExt] -> {57CE581A-0CB6-4266-9CA0-19364C90A0B3} => C:\Program Files\Malwarebytes\Anti-Malware\mbshlext.dll [2018-03-03] (Malwarebytes)
    ContextMenuHandlers6: [SDECon32] -> {44176360-2BBF-4EC1-93CE-384B8681A0BC} => C:\Program Files (x86)\Spybot - Search & Destroy 2\SDECon64.dll [2014-06-24] (Safer-Networking Ltd.)
    ContextMenuHandlers6: [SDECon64] -> {44176360-2BBF-4EC1-93CE-384B8681A0BC} => C:\Program Files (x86)\Spybot - Search & Destroy 2\SDECon64.dll [2014-06-24] (Safer-Networking Ltd.)
    ContextMenuHandlers6: [StartMenuExt] -> {E595F05F-903F-4318-8B0A-7F633B520D2B} => C:\WINDOWS\System32\StartMenuHelper64.dll [2016-07-30] (IvoSoft)

    ==================== Scheduled Tasks (Whitelisted) =============

    (If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)

    Task: {02763B06-4489-4B43-B370-B6CBA830C0E5} - System32\Tasks\HPEA3JOBS => C:\Program [Argument = Files\HP\HP ePrint\hpeprint.exe /CheckJobs]
    Task: {08C76EA7-E305-4E43-A385-B38BD425B52E} - System32\Tasks\Microsoft\Office\Office Automatic Updates => C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeC2RClient.exe [2018-03-12] (Microsoft Corporation)
    Task: {09FC7C8A-A433-4DE4-9DC1-F2772DBDA66D} - System32\Tasks\Hewlett-Packard\HP Active Health\HP Active Health Scan (HPSA) => C:\Program Files (x86)\Hewlett-Packard\HP Support Framework\Resources\HPActiveHealth\ActiveHealth.exe [2017-11-17] ()
    Task: {117E1754-61A8-4DA7-80D1-7BC3FA3A35B3} - System32\Tasks\HPAudioSwitch => C:\Program Files (x86)\HP\HPAudioSwitch\HPAudioSwitch.exe [2016-10-04] (HP Inc.)
    Task: {27287D1C-0136-4B0C-8E96-D27DC856E3C9} - System32\Tasks\Microsoft\Office\OfficeTelemetryAgentFallBack2016 => C:\Program Files (x86)\Microsoft Office\root\Office16\msoia.exe [2018-03-18] (Microsoft Corporation)
    Task: {2B4BFF20-5221-4BD7-BE04-F0F62967014F} - System32\Tasks\RTKCPL => C:\Program Files\Realtek\Audio\HDA\RtkNGUI64.exe [2018-03-22] (Realtek Semiconductor)
    Task: {2F72DB27-507E-4867-8D08-BB1EA3078EDE} - System32\Tasks\EPSON XP-310 Series Invitation {AD4B3D86-8A7B-44B2-B634-2FBACD597EA3} => C:\WINDOWS\system32\spool\DRIVERS\x64\3\E_ITSLBE.EXE [2013-02-28] (SEIKO EPSON CORPORATION)
    Task: {33899C33-8F67-4BBA-B563-BD59AF63E1CF} - System32\Tasks\EPSON XP-310 Series Update {B6F0F63F-1841-4E98-B1F8-736E49490B37} => C:\windows\system32\spool\DRIVERS\x64\3\E_ITSLBE.EXE [2013-02-28] (SEIKO EPSON CORPORATION)
    Task: {4FA45BB6-66AC-4E95-9669-B247E91A14F6} - System32\Tasks\Hewlett-Packard\HP Support Assistant\Product Configurator => C:\Program Files (x86)\Hewlett-Packard\HP Support Framework\Resources\ProductConfig.exe [2018-03-07] (HP Inc.)
    Task: {569EE456-83E5-4DC5-9C34-456CE2648240} - System32\Tasks\Hewlett-Packard\HP Support Assistant\HP Support Assistant Quick Start => C:\Program Files (x86)\Hewlett-Packard\HP Support Framework\HPSF.exe [2017-09-27] (HP Inc.)
    Task: {59F8152E-173C-44E9-8045-0156988876E4} - System32\Tasks\OneDrive Standalone Update Task v2 => C:\Users\david\AppData\Local\Microsoft\OneDrive\OneDriveStandaloneUpdater.exe
    Task: {632227D3-6364-4188-9D48-0E45846B8A41} - System32\Tasks\Hewlett-Packard\HP Support Assistant\HP Support Solutions Framework Updater => C:\Program Files (x86)\Hewlett-Packard\HP Support Solutions\Modules\HPSSFUpdater.exe [2017-09-20] (HP Inc.)
    Task: {65C74806-196E-48E9-A947-16571F89AA9F} - System32\Tasks\Microsoft\Office\Office ClickToRun Service Monitor => C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeC2RClient.exe [2018-03-12] (Microsoft Corporation)
    Task: {68DEE128-477D-4BB5-9E15-A44603430DEE} - System32\Tasks\Avast Software\Overseer => C:\Program Files\Common Files\Avast Software\Overseer\overseer.exe [2018-01-07] (AVAST Software)
    Task: {6AA71443-6D56-4CE5-8FAF-9442FAD19D1D} - System32\Tasks\SafeZone scheduled Autoupdate 1495122600 => C:\Program Files\AVAST Software\SZBrowser\launcher.exe [2017-08-04] (Avast Software)
    Task: {75B2A1BA-3541-4B8D-9162-1C4985AF9D6E} - System32\Tasks\Hewlett-Packard\HP Support Assistant\PC Health Analysis => C:\Program Files (x86)\Hewlett-Packard\HP Support Framework\HPSF.exe [2017-09-27] (HP Inc.)
    Task: {77C8EAE9-1A4F-4662-9504-5231A2E7F01D} - System32\Tasks\HPCeeScheduleFordavid => C:\Program Files (x86)\Hewlett-Packard\HP Ceement\HPCEE.exe [2016-05-12] (HP Development Company, L.P.)
    Task: {7808A0BF-E35E-42AA-822F-D331C9CD6799} - System32\Tasks\CCleanerSkipUAC => C:\Program Files\CCleaner\CCleaner.exe [2018-03-06] (Piriform Ltd)
    Task: {7AF678D5-7AAD-4E6B-92AD-56553559864E} - System32\Tasks\Safer-Networking\Spybot - Search and Destroy\Check for updates => C:\Program Files (x86)\Spybot - Search & Destroy 2\SDUpdate.exe [2014-06-27] (Safer-Networking Ltd.)
    Task: {7DCACBA5-CE33-4F91-8452-CA1DBED1B1B2} - System32\Tasks\Safer-Networking\Spybot - Search and Destroy\Refresh immunization => C:\Program Files (x86)\Spybot - Search & Destroy 2\SDImmunize.exe [2016-03-21] (Safer-Networking Ltd.)
    Task: {85A3292C-E5B2-4A3E-81E6-CEF89BDA8978} - System32\Tasks\EPSON XP-310 Series Update {AD4B3D86-8A7B-44B2-B634-2FBACD597EA3} => C:\WINDOWS\system32\spool\DRIVERS\x64\3\E_ITSLBE.EXE [2013-02-28] (SEIKO EPSON CORPORATION)
    Task: {8C4FD5F0-24A4-4538-A48D-5F6A8C9E5312} - System32\Tasks\Adobe Acrobat Update Task => C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe [2018-02-09] (Adobe Systems Incorporated)
    Task: {8C8ED49C-2C50-4A1A-84CD-300D7CBAF2DF} - System32\Tasks\GoogleUpdateTaskMachineUA => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe [2017-05-18] (Google Inc.)
    Task: {9CD2F90E-4CDA-4559-B7BD-012852E4F2C3} - System32\Tasks\EPSON XP-310 Series Invitation {B6F0F63F-1841-4E98-B1F8-736E49490B37} => C:\windows\system32\spool\DRIVERS\x64\3\E_ITSLBE.EXE [2013-02-28] (SEIKO EPSON CORPORATION)
    Task: {9FAB5892-4E86-47DB-9792-BC336485D151} - System32\Tasks\HPJumpStartLaunch => C:\Program Files (x86)\HP\HP JumpStart Launch\HPJumpStartLaunch.exe [2017-07-28] ()
    Task: {AFEBDAEC-4E73-476B-80CB-A380DAB94218} - System32\Tasks\Microsoft\Office\OfficeBackgroundTaskHandlerLogon => C:\Program Files (x86)\Microsoft Office\root\Office16\officebackgroundtaskhandler.exe [2018-03-18] (Microsoft Corporation)
    Task: {B3E8F6AE-2800-4431-8104-C57BE9C5A8AD} - System32\Tasks\AVAST Software\Avast settings backup => C:\Program Files\Common Files\AV\avast! Antivirus\backup.exe
    Task: {C3A06987-199D-4C1D-B377-E4FF3A937076} - System32\Tasks\Safer-Networking\Spybot - Search and Destroy\Scan the system => C:\Program Files (x86)\Spybot - Search & Destroy 2\SDScan.exe [2016-03-21] (Safer-Networking Ltd.)
    Task: {C6EE379F-F1CD-40B4-B947-F1F1799C49BD} - System32\Tasks\Apple\AppleSoftwareUpdate => C:\Program Files (x86)\Apple Software Update\SoftwareUpdate.exe [2017-10-12] (Apple Inc.)
    Task: {E8184F46-C460-4D4C-9C8A-C00F12961D8C} - System32\Tasks\Microsoft\Office\OfficeBackgroundTaskHandlerRegistration => C:\Program Files (x86)\Microsoft Office\root\Office16\officebackgroundtaskhandler.exe [2018-03-18] (Microsoft Corporation)
    Task: {E9C52515-B093-4542-8F66-B6C846A97802} - System32\Tasks\Microsoft\Office\OfficeTelemetryAgentLogOn2016 => C:\Program Files (x86)\Microsoft Office\root\Office16\msoia.exe [2018-03-18] (Microsoft Corporation)
    Task: {EAF409CC-6B7A-4288-8EA4-CC059B04BFCC} - System32\Tasks\CCleaner Update => C:\Program Files\CCleaner\CCUpdate.exe [2018-03-06] (Piriform Ltd)
    Task: {EEA6156F-5C91-42F7-8CE1-E0BC49C2ECA4} - System32\Tasks\Avast TUNEUP Update => C:\Program Files (x86)\AVAST Software\Avast Cleanup\TUNEUpdate.exe [2018-03-09] (AVAST Software)
    Task: {F18D3B78-ED7D-40E6-BEBD-21DF90FF8B3B} - System32\Tasks\Avast Emergency Update => C:\Program Files\AVAST Software\Avast\AvEmUpdate.exe [2018-03-13] (AVAST Software)
    Task: {F5C60019-8070-43D5-9A6A-A4FDA6C3485D} - System32\Tasks\GoogleUpdateTaskMachineCore => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe [2017-05-18] (Google Inc.)
    Task: {F63297C9-F46F-48D6-BDD1-154D85A410D6} - System32\Tasks\Intel PTT EK Recertification => C:\Program Files\Intel\iCLS Client\IntelPTTEKRecertification.exe [2017-10-11] (Intel(R) Corporation)
    Task: {FF82D779-C88D-4E52-A92A-A206B84FD034} - \Microsoft\Windows\UNP\RunCampaignManager -> No File <==== ATTENTION
    Task: {FF9E9C96-2E7E-472A-A153-9F576E77F7C5} - System32\Tasks\Hewlett-Packard\HP Support Assistant\HP Support Solutions Framework Report => C:\Program Files (x86)\Hewlett-Packard\HP Support Solutions\Modules\HPSFReport.exe [2017-06-22] (HP Inc.)

    (If an entry is included in the fixlist, the task (.job) file will be moved. The file which is running by the task will not be moved.)

    Task: C:\WINDOWS\Tasks\EPSON XP-310 Series Invitation {AD4B3D86-8A7B-44B2-B634-2FBACD597EA3}.job => C:\WINDOWS\system32\spool\DRIVERS\x64\3\E_ITSLBE.EXE
    Task: C:\WINDOWS\Tasks\EPSON XP-310 Series Invitation {B6F0F63F-1841-4E98-B1F8-736E49490B37}.job => C:\windows\system32\spool\DRIVERS\x64\3\E_ITSLBE.EXE
    Task: C:\WINDOWS\Tasks\EPSON XP-310 Series Update {AD4B3D86-8A7B-44B2-B634-2FBACD597EA3}.job => C:\WINDOWS\system32\spool\DRIVERS\x64\3\E_ITSLBE.EXE:/EXE:{AD4B3D86-8A7B-44B2-B634-2FBACD597EA3} /F:UpdateWORKGROUP\DESKTOP-7F1R3BQ$ĊSearches for EPSON software updates, and notifies you when updates are available.If this task is disabled or stopped, your EPSON software will not be automatically kept up to date.Thi
    Task: C:\WINDOWS\Tasks\EPSON XP-310 Series Update {B6F0F63F-1841-4E98-B1F8-736E49490B37}.job => C:\windows\system32\spool\DRIVERS\x64\3\E_ITSLBE.EXE:/EXE:{B6F0F63F-1841-4E98-B1F8-736E49490B37} /F:UpdateWORKGROUP\DESKTOP-7F1R3BQ$ĊSearches for EPSON software updates, and notifies you when updates are available.If this task is disabled or stopped, your EPSON software will not be automatically kept up to date.Thi
    Task: C:\WINDOWS\Tasks\HPCeeScheduleFordavid.job => C:\Program Files (x86)\Hewlett-Packard\HP Ceement\HPCEE.exe

    ==================== Shortcuts & WMI ========================

    (The entries could be listed to be restored or removed.)


    ==================== Loaded Modules (Whitelisted) ==============

    2017-04-25 14:22 - 2017-04-25 14:22 - 002250896 _____ () C:\Windows\System32\vimsdk.dll
    2017-04-25 14:22 - 2017-04-25 14:22 - 000143504 _____ () C:\Windows\System32\vimbase.dll
    2017-09-29 09:41 - 2017-09-29 09:41 - 000184432 _____ () C:\WINDOWS\SYSTEM32\inputhost.dll
    2017-12-12 07:28 - 2018-03-01 10:31 - 002488608 _____ () C:\PROGRAM FILES\MALWAREBYTES\ANTI-MALWARE\MwacLib.dll
    2017-12-12 07:28 - 2018-02-05 14:44 - 002299168 _____ () C:\PROGRAM FILES\MALWAREBYTES\ANTI-MALWARE\SelfProtectionSdk.dll
    2017-08-17 19:27 - 2018-03-01 22:11 - 008933552 _____ () C:\Program Files (x86)\Microsoft Office\root\VFS\ProgramFilesX64\Microsoft Office\Office16\1033\GrooveIntlResource.dll
    2017-12-08 13:43 - 2017-12-08 13:43 - 000155504 _____ () C:\Program Files (x86)\Zemana AntiMalware\ZAMShellExt64.dll
    2018-03-13 15:36 - 2018-02-21 20:26 - 011044864 _____ () C:\Windows\SystemApps\Microsoft.Windows.Cortana_cw5n1h2txyewy\CortanaApi.dll
    2018-03-13 15:36 - 2018-02-21 20:21 - 001804288 _____ () C:\Windows\SystemApps\Microsoft.Windows.Cortana_cw5n1h2txyewy\Cortana.Core.dll
    2018-03-23 13:24 - 2018-03-23 13:24 - 000086528 _____ () C:\Program Files\WindowsApps\Microsoft.SkypeApp_12.1811.248.0_x64__kzf8qxf38zg5c\SkypeHost.exe
    2018-03-23 13:24 - 2018-03-23 13:24 - 000195072 _____ () C:\Program Files\WindowsApps\Microsoft.SkypeApp_12.1811.248.0_x64__kzf8qxf38zg5c\SkypeBackgroundTasks.dll
    2018-03-23 13:24 - 2018-03-23 13:24 - 022050304 _____ () C:\Program Files\WindowsApps\Microsoft.SkypeApp_12.1811.248.0_x64__kzf8qxf38zg5c\SkyWrap.dll
    2018-03-23 13:24 - 2018-03-23 13:24 - 002584576 _____ () C:\Program Files\WindowsApps\Microsoft.SkypeApp_12.1811.248.0_x64__kzf8qxf38zg5c\skypert.dll
    2018-03-23 13:24 - 2018-03-23 13:24 - 000657408 _____ () C:\Program Files\WindowsApps\Microsoft.SkypeApp_12.1811.248.0_x64__kzf8qxf38zg5c\RtmMvrUap.dll
    2018-03-22 19:26 - 2018-03-20 02:00 - 004435288 _____ () C:\Program Files (x86)\Google\Chrome\Application\65.0.3325.181\libglesv2.dll
    2018-03-22 19:26 - 2018-03-20 02:00 - 000099672 _____ () C:\Program Files (x86)\Google\Chrome\Application\65.0.3325.181\libegl.dll
    2018-03-13 20:01 - 2018-03-13 20:01 - 000280280 _____ () C:\Program Files\AVAST Software\Avast\tasks_core.dll
    2017-05-18 14:55 - 2012-08-23 10:38 - 000574840 _____ () C:\Program Files (x86)\Spybot - Search & Destroy 2\sqlite3.dll
    2017-05-18 14:55 - 2014-05-13 12:04 - 000109400 _____ () C:\Program Files (x86)\Spybot - Search & Destroy 2\snlThirdParty150.bpl
    2017-05-18 14:55 - 2014-05-13 12:04 - 000167768 _____ () C:\Program Files (x86)\Spybot - Search & Destroy 2\snlFileFormats150.bpl
    2017-05-18 14:55 - 2014-05-13 12:04 - 000416600 _____ () C:\Program Files (x86)\Spybot - Search & Destroy 2\DEC150.bpl
    2017-05-18 14:55 - 2012-04-03 17:06 - 000565640 _____ () C:\Program Files (x86)\Spybot - Search & Destroy 2\av\BDSmartDB.dll
    2018-03-13 20:01 - 2018-03-13 20:01 - 067126928 _____ () C:\Program Files\AVAST Software\Avast\libcef.dll
    2018-03-13 20:01 - 2018-03-13 20:01 - 000287960 _____ () C:\Program Files\AVAST Software\Avast\streamback.dll
    2018-03-13 20:01 - 2018-03-13 20:01 - 000275160 _____ () C:\Program Files\AVAST Software\Avast\gaming_mode_ui.dll

    ==================== Alternate Data Streams (Whitelisted) =========

    (If an entry is included in the fixlist, only the ADS will be removed.)

    AlternateDataStreams: C:\Users\david\Documents\Amazon Drive:com.amazon.drive.sync [177]
    AlternateDataStreams: C:\Users\david\Documents\Amazon Drive:com.amazon.drive.sync.root [42]

    ==================== Safe Mode (Whitelisted) ===================

    (If an entry is included in the fixlist, it will be removed from the registry. The "AlternateShell" will be restored.)

    HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\MBAMService => ""="Service"
    HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\MBAMService => ""="Service"

    ==================== Association (Whitelisted) ===============

    (If an entry is included in the fixlist, the registry item will be restored to default or removed.)


    ==================== Internet Explorer trusted/restricted ===============

    (If an entry is included in the fixlist, it will be removed from the registry.)

    IE restricted site: HKU\.DEFAULT\...\007guard.com -> install.007guard.com
    IE restricted site: HKU\.DEFAULT\...\008i.com -> 008i.com
    IE restricted site: HKU\.DEFAULT\...\008k.com -> www.008k.com
    IE restricted site: HKU\.DEFAULT\...\00hq.com -> www.00hq.com
    IE restricted site: HKU\.DEFAULT\...\010402.com -> 010402.com
    IE restricted site: HKU\.DEFAULT\...\032439.com -> 80gw6ry3i3x3qbrkwhxhw.032439.com
    IE restricted site: HKU\.DEFAULT\...\0scan.com -> www.0scan.com
    IE restricted site: HKU\.DEFAULT\...\1-2005-search.com -> www.1-2005-search.com
    IE restricted site: HKU\.DEFAULT\...\1-domains-registrations.com -> www.1-domains-registrations.com
    IE restricted site: HKU\.DEFAULT\...\1000gratisproben.com -> www.1000gratisproben.com
    IE restricted site: HKU\.DEFAULT\...\1001namen.com -> www.1001namen.com
    IE restricted site: HKU\.DEFAULT\...\100888290cs.com -> mir.100888290cs.com
    IE restricted site: HKU\.DEFAULT\...\100sexlinks.com -> www.100sexlinks.com
    IE restricted site: HKU\.DEFAULT\...\10sek.com -> www.10sek.com
    IE restricted site: HKU\.DEFAULT\...\12-26.net -> user1.12-26.net
    IE restricted site: HKU\.DEFAULT\...\12-27.net -> user1.12-27.net
    IE restricted site: HKU\.DEFAULT\...\123fporn.info -> www.123fporn.info
    IE restricted site: HKU\.DEFAULT\...\123haustiereundmehr.com -> www.123haustiereundmehr.com
    IE restricted site: HKU\.DEFAULT\...\123moviedownload.com -> www.123moviedownload.com
    IE restricted site: HKU\.DEFAULT\...\123simsen.com -> www.123simsen.com

    There are 7936 more sites.

    IE restricted site: HKU\S-1-5-21-3840204244-4144708379-2675172571-1000\...\007guard.com -> install.007guard.com
    IE restricted site: HKU\S-1-5-21-3840204244-4144708379-2675172571-1000\...\008i.com -> 008i.com
    IE restricted site: HKU\S-1-5-21-3840204244-4144708379-2675172571-1000\...\008k.com -> www.008k.com
    IE restricted site: HKU\S-1-5-21-3840204244-4144708379-2675172571-1000\...\00hq.com -> www.00hq.com
    IE restricted site: HKU\S-1-5-21-3840204244-4144708379-2675172571-1000\...\010402.com -> 010402.com
    IE restricted site: HKU\S-1-5-21-3840204244-4144708379-2675172571-1000\...\032439.com -> 80gw6ry3i3x3qbrkwhxhw.032439.com
    IE restricted site: HKU\S-1-5-21-3840204244-4144708379-2675172571-1000\...\0scan.com -> www.0scan.com
    IE restricted site: HKU\S-1-5-21-3840204244-4144708379-2675172571-1000\...\1-2005-search.com -> www.1-2005-search.com
    IE restricted site: HKU\S-1-5-21-3840204244-4144708379-2675172571-1000\...\1-domains-registrations.com -> www.1-domains-registrations.com
    IE restricted site: HKU\S-1-5-21-3840204244-4144708379-2675172571-1000\...\1000gratisproben.com -> www.1000gratisproben.com
    IE restricted site: HKU\S-1-5-21-3840204244-4144708379-2675172571-1000\...\1001namen.com -> www.1001namen.com
    IE restricted site: HKU\S-1-5-21-3840204244-4144708379-2675172571-1000\...\100888290cs.com -> mir.100888290cs.com
    IE restricted site: HKU\S-1-5-21-3840204244-4144708379-2675172571-1000\...\100sexlinks.com -> www.100sexlinks.com
    IE restricted site: HKU\S-1-5-21-3840204244-4144708379-2675172571-1000\...\10sek.com -> www.10sek.com
    IE restricted site: HKU\S-1-5-21-3840204244-4144708379-2675172571-1000\...\12-26.net -> user1.12-26.net
    IE restricted site: HKU\S-1-5-21-3840204244-4144708379-2675172571-1000\...\12-27.net -> user1.12-27.net
    IE restricted site: HKU\S-1-5-21-3840204244-4144708379-2675172571-1000\...\123fporn.info -> www.123fporn.info
    IE restricted site: HKU\S-1-5-21-3840204244-4144708379-2675172571-1000\...\123haustiereundmehr.com -> www.123haustiereundmehr.com
    IE restricted site: HKU\S-1-5-21-3840204244-4144708379-2675172571-1000\...\123moviedownload.com -> www.123moviedownload.com
    IE restricted site: HKU\S-1-5-21-3840204244-4144708379-2675172571-1000\...\123simsen.com -> www.123simsen.com

    There are 7936 more sites.

    IE restricted site: HKU\S-1-5-21-3840204244-4144708379-2675172571-1001\...\007guard.com -> install.007guard.com
    IE restricted site: HKU\S-1-5-21-3840204244-4144708379-2675172571-1001\...\008i.com -> 008i.com
    IE restricted site: HKU\S-1-5-21-3840204244-4144708379-2675172571-1001\...\008k.com -> www.008k.com
    IE restricted site: HKU\S-1-5-21-3840204244-4144708379-2675172571-1001\...\00hq.com -> www.00hq.com
    IE restricted site: HKU\S-1-5-21-3840204244-4144708379-2675172571-1001\...\010402.com -> 010402.com
    IE restricted site: HKU\S-1-5-21-3840204244-4144708379-2675172571-1001\...\032439.com -> 80gw6ry3i3x3qbrkwhxhw.032439.com
    IE restricted site: HKU\S-1-5-21-3840204244-4144708379-2675172571-1001\...\0scan.com -> www.0scan.com
    IE restricted site: HKU\S-1-5-21-3840204244-4144708379-2675172571-1001\...\1-2005-search.com -> www.1-2005-search.com
    IE restricted site: HKU\S-1-5-21-3840204244-4144708379-2675172571-1001\...\1-domains-registrations.com -> www.1-domains-registrations.com
    IE restricted site: HKU\S-1-5-21-3840204244-4144708379-2675172571-1001\...\1000gratisproben.com -> www.1000gratisproben.com
    IE restricted site: HKU\S-1-5-21-3840204244-4144708379-2675172571-1001\...\1001namen.com -> www.1001namen.com
    IE restricted site: HKU\S-1-5-21-3840204244-4144708379-2675172571-1001\...\100888290cs.com -> mir.100888290cs.com
    IE restricted site: HKU\S-1-5-21-3840204244-4144708379-2675172571-1001\...\100sexlinks.com -> www.100sexlinks.com
    IE restricted site: HKU\S-1-5-21-3840204244-4144708379-2675172571-1001\...\10sek.com -> www.10sek.com
    IE restricted site: HKU\S-1-5-21-3840204244-4144708379-2675172571-1001\...\12-26.net -> user1.12-26.net
    IE restricted site: HKU\S-1-5-21-3840204244-4144708379-2675172571-1001\...\12-27.net -> user1.12-27.net
    IE restricted site: HKU\S-1-5-21-3840204244-4144708379-2675172571-1001\...\123fporn.info -> www.123fporn.info
    IE restricted site: HKU\S-1-5-21-3840204244-4144708379-2675172571-1001\...\123haustiereundmehr.com -> www.123haustiereundmehr.com
    IE restricted site: HKU\S-1-5-21-3840204244-4144708379-2675172571-1001\...\123moviedownload.com -> www.123moviedownload.com
    IE restricted site: HKU\S-1-5-21-3840204244-4144708379-2675172571-1001\...\123simsen.com -> www.123simsen.com

    There are 7936 more sites.

    IE restricted site: HKU\S-1-5-21-3840204244-4144708379-2675172571-500\...\007guard.com -> install.007guard.com
    IE restricted site: HKU\S-1-5-21-3840204244-4144708379-2675172571-500\...\008i.com -> 008i.com
    IE restricted site: HKU\S-1-5-21-3840204244-4144708379-2675172571-500\...\008k.com -> www.008k.com
    IE restricted site: HKU\S-1-5-21-3840204244-4144708379-2675172571-500\...\00hq.com -> www.00hq.com
    IE restricted site: HKU\S-1-5-21-3840204244-4144708379-2675172571-500\...\010402.com -> 010402.com
    IE restricted site: HKU\S-1-5-21-3840204244-4144708379-2675172571-500\...\032439.com -> 80gw6ry3i3x3qbrkwhxhw.032439.com
    IE restricted site: HKU\S-1-5-21-3840204244-4144708379-2675172571-500\...\0scan.com -> www.0scan.com
    IE restricted site: HKU\S-1-5-21-3840204244-4144708379-2675172571-500\...\1-2005-search.com -> www.1-2005-search.com
    IE restricted site: HKU\S-1-5-21-3840204244-4144708379-2675172571-500\...\1-domains-registrations.com -> www.1-domains-registrations.com
    IE restricted site: HKU\S-1-5-21-3840204244-4144708379-2675172571-500\...\1000gratisproben.com -> www.1000gratisproben.com
    IE restricted site: HKU\S-1-5-21-3840204244-4144708379-2675172571-500\...\1001namen.com -> www.1001namen.com
    IE restricted site: HKU\S-1-5-21-3840204244-4144708379-2675172571-500\...\100888290cs.com -> mir.100888290cs.com
    IE restricted site: HKU\S-1-5-21-3840204244-4144708379-2675172571-500\...\100sexlinks.com -> www.100sexlinks.com
    IE restricted site: HKU\S-1-5-21-3840204244-4144708379-2675172571-500\...\10sek.com -> www.10sek.com
    IE restricted site: HKU\S-1-5-21-3840204244-4144708379-2675172571-500\...\12-26.net -> user1.12-26.net
    IE restricted site: HKU\S-1-5-21-3840204244-4144708379-2675172571-500\...\12-27.net -> user1.12-27.net
    IE restricted site: HKU\S-1-5-21-3840204244-4144708379-2675172571-500\...\123fporn.info -> www.123fporn.info
    IE restricted site: HKU\S-1-5-21-3840204244-4144708379-2675172571-500\...\123haustiereundmehr.com -> www.123haustiereundmehr.com
    IE restricted site: HKU\S-1-5-21-3840204244-4144708379-2675172571-500\...\123moviedownload.com -> www.123moviedownload.com
    IE restricted site: HKU\S-1-5-21-3840204244-4144708379-2675172571-500\...\123simsen.com -> www.123simsen.com

    There are 7936 more sites.


    ==================== Hosts content: ==========================

    (If needed Hosts: directive could be included in the fixlist to reset Hosts.)

    2016-07-16 07:47 - 2018-03-24 02:55 - 000453575 ____R C:\WINDOWS\system32\Drivers\etc\hosts

    127.0.0.1 localhost
    127.0.0.1 www.007guard.com
    127.0.0.1 007guard.com
    127.0.0.1 008i.com
    127.0.0.1 www.008k.com
    127.0.0.1 008k.com
    127.0.0.1 www.00hq.com
    127.0.0.1 00hq.com
    127.0.0.1 010402.com
    127.0.0.1 www.032439.com
    127.0.0.1 032439.com
    127.0.0.1 www.0scan.com
    127.0.0.1 0scan.com
    127.0.0.1 1000gratisproben.com
    127.0.0.1 www.1000gratisproben.com
    127.0.0.1 1001namen.com
    127.0.0.1 www.1001namen.com
    127.0.0.1 100888290cs.com
    127.0.0.1 www.100888290cs.com
    127.0.0.1 www.100sexlinks.com
    127.0.0.1 100sexlinks.com
    127.0.0.1 10sek.com
    127.0.0.1 www.10sek.com
    127.0.0.1 www.1-2005-search.com
    127.0.0.1 1-2005-search.com
    127.0.0.1 123fporn.info
    127.0.0.1 www.123fporn.info
    127.0.0.1 www.123haustiereundmehr.com
    127.0.0.1 123haustiereundmehr.com
    127.0.0.1 123moviedownload.com

    There are 15597 more lines.


    ==================== Other Areas ============================

    (Currently there is no automatic fix for this section.)

    HKU\S-1-5-21-3840204244-4144708379-2675172571-1000\Control Panel\Desktop\\Wallpaper -> C:\Windows\Web\Wallpaper\Windows\img0.jpg
    HKU\S-1-5-21-3840204244-4144708379-2675172571-1001\Control Panel\Desktop\\Wallpaper -> C:\Users\david\AppData\Local\Packages\Microsoft.Windows.Photos_8wekyb3d8bbwe\LocalState\PhotosAppBackground\{67f2a7bc-59ba-43c5-95ae-e37a14016eb3}.jpg
    HKU\S-1-5-21-3840204244-4144708379-2675172571-500\Control Panel\Desktop\\Wallpaper -> C:\windows\web\wallpaper\HP Backgrounds\backgroundDefault.jpg
    DNS Servers: 209.18.47.62 - 209.18.47.61
    HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System => (ConsentPromptBehaviorAdmin: 5) (ConsentPromptBehaviorUser: 3) (EnableLUA: 1)
    HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer => (SmartScreenEnabled: Prompt)
    Windows Firewall is enabled.

    ==================== MSCONFIG/TASK MANAGER disabled items ==

    HKLM\...\StartupApproved\Run: => "Eraser"
    HKLM\...\StartupApproved\Run: => "iTunesHelper"
    HKLM\...\StartupApproved\Run32: => "HPMessageService"
    HKLM\...\StartupApproved\Run32: => "HPMSGSVC"
    HKU\S-1-5-21-3840204244-4144708379-2675172571-1000\...\StartupApproved\Run: => "OneDriveSetup"
    HKU\S-1-5-21-3840204244-4144708379-2675172571-1001\...\StartupApproved\StartupFolder: => "Send to OneNote.lnk"
    HKU\S-1-5-21-3840204244-4144708379-2675172571-1001\...\StartupApproved\Run: => "SandboxieControl"
    HKU\S-1-5-21-3840204244-4144708379-2675172571-1001\...\StartupApproved\Run: => "Amazon Drive"
    HKU\S-1-5-21-3840204244-4144708379-2675172571-1001\...\StartupApproved\Run: => "OneDrive"
    HKU\S-1-5-21-3840204244-4144708379-2675172571-1001\...\StartupApproved\Run: => "SUPERAntiSpyware"
    HKU\S-1-5-21-3840204244-4144708379-2675172571-500\...\StartupApproved\Run: => "OneDriveSetup"
    HKU\S-1-5-21-3840204244-4144708379-2675172571-500\...\StartupApproved\Run: => "OneDrive"

    ==================== FirewallRules (Whitelisted) ===============

    (If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)

    FirewallRules: [{616AAE34-66E6-4D3F-9671-E6BBBC901AA7}] => (Allow) C:\Program Files\iTunes\iTunes.exe
    FirewallRules: [{6163E124-9704-4345-8E66-B486DC6BADC9}] => (Allow) C:\Program Files (x86)\Common Files\Apple\Apple Application Support\APSDaemon.exe
    FirewallRules: [{BC577CB6-D79E-479C-9429-7AFF2F9D9D8A}] => (Allow) C:\Program Files (x86)\NVIDIA Corporation\NetService\NvNetworkService.exe
    FirewallRules: [{1C59079D-90CA-4A83-BF36-209D5A26F687}] => (Allow) C:\Program Files (x86)\NVIDIA Corporation\NetService\NvNetworkService.exe
    FirewallRules: [{7DDBF716-B86E-4569-924A-40CEB67B298D}] => (Allow) C:\Program Files\NVIDIA Corporation\NvStreamSrv\NvStreamNetworkService.exe
    FirewallRules: [{23C37057-22E9-42BA-9AE1-2A43143A9244}] => (Allow) C:\Program Files\NVIDIA Corporation\NvStreamSrv\NvStreamNetworkService.exe
    FirewallRules: [{059B33D9-2345-4255-B60E-03648122A18F}] => (Allow) C:\Program Files\NVIDIA Corporation\NvStreamSrv\NvStreamUserAgent.exe
    FirewallRules: [{8A41E128-5ABD-4BFB-9BB5-6A7012C2AA0C}] => (Allow) C:\Program Files\NVIDIA Corporation\NvStreamSrv\nvstreamer.exe
    FirewallRules: [{0BD43C16-008A-4BAE-AC23-B77191F113AA}] => (Allow) C:\Program Files\NVIDIA Corporation\NvStreamSrv\nvstreamer.exe
    FirewallRules: [{D30D3921-F93E-4786-8E4C-86584FB31C0E}] => (Allow) C:\Program Files (x86)\CyberLink\PowerDVD14\PowerDVD.exe
    FirewallRules: [{F74EE6F2-AF91-43FC-B43A-5E21EDD75349}] => (Allow) C:\Program Files (x86)\CyberLink\PowerDVD14\Kernel\DMS\CLMSServerPDVD14.exe
    FirewallRules: [{7F1F6D0D-CE29-4783-93B9-E0CEFD3F67DA}] => (Allow) C:\Program Files (x86)\CyberLink\PowerDVD14\PowerDVD14Agent.exe
    FirewallRules: [{4590D767-3B45-4EE0-B933-7A7BF5A196DE}] => (Allow) C:\Program Files (x86)\CyberLink\PowerDVD14\Movie\PowerDVDMovie.exe
    FirewallRules: [{8C91E137-BDB9-4EE4-8EF8-0DA9BE0250D0}] => (Allow) C:\Program Files (x86)\CyberLink\PowerDVD14\Movie\PowerDVD Cinema\PowerDVDCinema.exe
    FirewallRules: [{4EB4978A-6186-42F1-A738-D36A5857040B}] => (Allow) C:\Program Files (x86)\Common Files\Intuit\Update Service v4\IntuitUpdater.exe
    FirewallRules: [{D40E4E5A-7AAC-43FB-8ED8-77F955A4571B}] => (Allow) C:\Program Files (x86)\Common Files\Intuit\Update Service v4\IntuitUpdateService.exe
    FirewallRules: [{FF0B1C64-6A6C-45F6-A86A-B64B88CFA872}] => (Allow) C:\Program Files (x86)\Common Files\Intuit\Update Service v4\IntuitUpdateService.exe
    FirewallRules: [{99F1C6F5-BE9F-472D-BA46-D45B579851B2}] => (Allow) C:\Program Files (x86)\Common Files\Intuit\Update Service v4\IntuitUpdateService.exe
    FirewallRules: [{461402B0-779E-454B-B702-3C075BC449C2}] => (Allow) C:\Program Files (x86)\Common Files\Intuit\Update Service v4\IntuitUpdateService.exe
    FirewallRules: [{C396FB9C-B792-4F3F-AF6C-9526D4BF5F04}] => (Allow) C:\Program Files (x86)\Common Files\Intuit\Update Service v4\IntuitUpdateService.exe
    FirewallRules: [{30170DAF-20E6-4162-B4A4-F4A6969CDEC2}] => (Allow) C:\Program Files (x86)\Microsoft Office\root\Office16\Lync.exe
    FirewallRules: [{373D32D1-656A-4AFA-ADEA-0678E7CCE71C}] => (Allow) C:\Program Files (x86)\Microsoft Office\root\Office16\Lync.exe
    FirewallRules: [{AD58AAAE-E1E5-4E19-AFB9-4A52040E4CBD}] => (Allow) C:\Program Files (x86)\Microsoft Office\root\Office16\UcMapi.exe
    FirewallRules: [{F437CFE9-49D0-4965-9343-F8D170E1406F}] => (Allow) C:\Program Files (x86)\Microsoft Office\root\Office16\UcMapi.exe
    FirewallRules: [{DD2F27A1-16BA-4030-9352-96CB1263990A}] => (Allow) C:\Program Files (x86)\EPSON Software\Event Manager\EEventManager.exe
    FirewallRules: [{DA33494D-575C-4D8A-AF3D-F8206169DD39}] => (Allow) C:\Program Files (x86)\EPSON Software\Event Manager\EEventManager.exe
    FirewallRules: [{24D6F391-35CE-4115-BBE7-32B2B3ED7D95}] => (Allow) C:\Program Files\Bonjour\mDNSResponder.exe
    FirewallRules: [{93EC22F0-452E-41A5-8F9E-CCC1C18C94DF}] => (Allow) C:\Program Files\Bonjour\mDNSResponder.exe
    FirewallRules: [{EE6EE4D7-8DAF-40D4-A595-364F61E183BC}] => (Allow) C:\Program Files (x86)\Bonjour\mDNSResponder.exe
    FirewallRules: [{A8298A6E-5CAA-4239-930D-095DE75D32A6}] => (Allow) C:\Program Files (x86)\Bonjour\mDNSResponder.exe
    FirewallRules: [{2D89F9EC-BAC6-4C1C-A780-AC0F06474150}] => (Block) LPort=445
    FirewallRules: [{685DA9E5-CDA8-4D6B-B7C0-6E8AF36F93DC}] => (Block) LPort=445
    FirewallRules: [{4F1BE023-43BF-4FAE-886A-30C5BC6BA4CA}] => (Allow) C:\Program Files\HP\HP Orbit Service\HPOrbitService.exe
    FirewallRules: [{79E551F1-0ACE-4683-975D-804191D7DCBB}] => (Allow) LPort=13148
    FirewallRules: [{E61E6FD2-B88B-4ADA-A638-E7942902985C}] => (Allow) LPort=81
    FirewallRules: [{7084ECB8-6F0F-4EC3-B976-2F7312E35EEE}] => (Allow) LPort=81
    FirewallRules: [{4142A306-789E-4A9E-A329-FC9F5FB6A954}] => (Allow) LPort=82
    FirewallRules: [{9B96C534-5E8E-4E3F-8434-8D893B6AB7DC}] => (Allow) LPort=82
    FirewallRules: [{22C64A09-9EB0-42BC-BBDA-807683E70B59}] => (Allow) LPort=9524
    FirewallRules: [{41F66F48-1A78-4DF4-96E7-18C977766271}] => (Allow) LPort=9524
    FirewallRules: [{BC712F90-4919-4B88-9D7D-5C93DA72EDC4}] => (Allow) C:\Program Files\AVAST Software\SZBrowser\4.58.2552.909\SZBrowser.exe
    FirewallRules: [{3FB8784B-A635-4741-92F5-16CEF17BB0C1}] => (Allow) C:\Program Files\AVAST Software\SZBrowser\4.58.2552.909_0\SZBrowser.exe
    FirewallRules: [{640730CB-4560-421C-A661-379016C8A9A2}] => (Allow) C:\Program Files\Intel\WiFi\bin\PanDhcpDns.exe
    FirewallRules: [{23229D88-D72F-4A51-8645-386168A7DB2A}] => (Allow) C:\Program Files (x86)\Microsoft Office\root\Office16\outlook.exe
    FirewallRules: [{A15A5DEA-D422-46D6-97DD-86D08937731F}] => (Allow) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
    StandardProfile\AuthorizedApplications: [C:\Program Files (x86)\Spybot - Search & Destroy 2\SDTray.exe] => Enabled:Spybot - Search & Destroy tray access
    StandardProfile\AuthorizedApplications: [C:\Program Files (x86)\Spybot - Search & Destroy 2\SDFSSvc.exe] => Enabled:Spybot-S&D 2 Scanner Service
    StandardProfile\AuthorizedApplications: [C:\Program Files (x86)\Spybot - Search & Destroy 2\SDUpdate.exe] => Enabled:Spybot-S&D 2 Updater
    StandardProfile\AuthorizedApplications: [C:\Program Files (x86)\Spybot - Search & Destroy 2\SDUpdSvc.exe] => Enabled:Spybot-S&D 2 Background update service

    ==================== Restore Points =========================

    26-03-2018 13:33:27 Removed Dropbox 25 GB

    ==================== Faulty Device Manager Devices =============

    Name: avast! SecureLine TAP Adapter v3
    Description: avast! SecureLine TAP Adapter v3
    Class Guid: {4d36e972-e325-11ce-bfc1-08002be10318}
    Manufacturer: TAP-Windows Provider V9
    Service: aswTap
    Problem: : This device is disabled. (Code 22)
    Resolution: In Device Manager, click "Action", and then click "Enable Device". This starts the Enable Device wizard. Follow the instructions.


    ==================== Event log errors: =========================

    Application errors:
    ==================
    Error: (03/26/2018 01:30:54 PM) (Source: Perflib) (EventID: 1008) (User: )
    Description: The Open Procedure for service "BITS" in DLL "C:\Windows\System32\bitsperf.dll" failed. Performance data for this service will not be available. The first four bytes (DWORD) of the Data section contains the error code.

    Error: (03/24/2018 03:02:25 AM) (Source: SideBySide) (EventID: 78) (User: )
    Description: Activation context generation failed for "C:\Program Files (x86)\Audacity\audacity.exe".Error in manifest or policy file "" on line .
    A component version required by the application conflicts with another component version already active.
    Conflicting components are:.
    Component 1: C:\WINDOWS\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.16299.309_none_15cfd4c4935e6b11.manifest.
    Component 2: C:\WINDOWS\WinSxS\manifests\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.16299.309_none_5d7d0b9ba7da9417.manifest.

    Error: (03/24/2018 03:02:22 AM) (Source: ESENT) (EventID: 455) (User: )
    Description: taskhostw (6568,R,0) WebCacheLocal: Error -1811 (0xfffff8ed) occurred while opening logfile C:\Users\david\AppData\Local\Microsoft\Windows\WebCache\V0100667.log.

    Error: (03/24/2018 02:59:59 AM) (Source: Application Error) (EventID: 1000) (User: )
    Description: Faulting application name: SDScan.exe, version: 2.6.44.181, time stamp: 0x56efed8f
    Faulting module name: KERNELBASE.dll, version: 10.0.16299.309, time stamp: 0xd3aa915c
    Exception code: 0x0eedfade
    Fault offset: 0x001008f2
    Faulting process id: 0x2624
    Faulting application start time: 0x01d3c33db776ba9e
    Faulting application path: C:\Program Files (x86)\Spybot - Search & Destroy 2\SDScan.exe
    Faulting module path: C:\WINDOWS\System32\KERNELBASE.dll
    Report Id: 728baf28-a5e6-4575-99a9-c5c569eb685d
    Faulting package full name:
    Faulting package-relative application ID:

    Error: (03/24/2018 02:59:59 AM) (Source: Application Error) (EventID: 1000) (User: )
    Description: Faulting application name: SDScan.exe, version: 2.6.44.181, time stamp: 0x56efed8f
    Faulting module name: KERNELBASE.dll, version: 10.0.16299.309, time stamp: 0xd3aa915c
    Exception code: 0x0eedfade
    Fault offset: 0x001008f2
    Faulting process id: 0xb74
    Faulting application start time: 0x01d3c33db829c7e2
    Faulting application path: C:\Program Files (x86)\Spybot - Search & Destroy 2\SDScan.exe
    Faulting module path: C:\WINDOWS\System32\KERNELBASE.dll
    Report Id: 2b92bfa7-8624-4e17-95c2-cba1dd718c2f
    Faulting package full name:
    Faulting package-relative application ID:

    Error: (03/24/2018 02:59:59 AM) (Source: Application Error) (EventID: 1000) (User: )
    Description: Faulting application name: SDScan.exe, version: 2.6.44.181, time stamp: 0x56efed8f
    Faulting module name: KERNELBASE.dll, version: 10.0.16299.309, time stamp: 0xd3aa915c
    Exception code: 0x0eedfade
    Fault offset: 0x001008f2
    Faulting process id: 0xb8
    Faulting application start time: 0x01d3c33db8d18b07
    Faulting application path: C:\Program Files (x86)\Spybot - Search & Destroy 2\SDScan.exe
    Faulting module path: C:\WINDOWS\System32\KERNELBASE.dll
    Report Id: 831df313-7732-4048-9952-899f44212c81
    Faulting package full name:
    Faulting package-relative application ID:

    Error: (03/24/2018 02:55:24 AM) (Source: Application Error) (EventID: 1000) (User: )
    Description: Faulting application name: SDScan.exe, version: 2.6.44.181, time stamp: 0x56efed8f
    Faulting module name: KERNELBASE.dll, version: 10.0.16299.309, time stamp: 0xd3aa915c
    Exception code: 0x0eedfade
    Fault offset: 0x001008f2
    Faulting process id: 0x2458
    Faulting application start time: 0x01d3c33d14f3b4c6
    Faulting application path: C:\Program Files (x86)\Spybot - Search & Destroy 2\SDScan.exe
    Faulting module path: C:\WINDOWS\System32\KERNELBASE.dll
    Report Id: 6dab7d62-5d75-4dfa-8bcf-f90253859e07
    Faulting package full name:
    Faulting package-relative application ID:

    Error: (03/24/2018 02:55:24 AM) (Source: Application Error) (EventID: 1000) (User: )
    Description: Faulting application name: SDScan.exe, version: 2.6.44.181, time stamp: 0x56efed8f
    Faulting module name: KERNELBASE.dll, version: 10.0.16299.309, time stamp: 0xd3aa915c
    Exception code: 0x0eedfade
    Fault offset: 0x001008f2
    Faulting process id: 0x3150
    Faulting application start time: 0x01d3c33d139aa0aa
    Faulting application path: C:\Program Files (x86)\Spybot - Search & Destroy 2\SDScan.exe
    Faulting module path: C:\WINDOWS\System32\KERNELBASE.dll
    Report Id: bb23eb75-0ed1-4470-8f3c-117842d633be
    Faulting package full name:
    Faulting package-relative application ID:


    System errors:
    =============
    Error: (03/26/2018 02:37:13 PM) (Source: DCOM) (EventID: 10016) (User: DESKTOP-7F1R3BQ)
    Description: The application-specific permission settings do not grant Local Activation permission for the COM Server application with CLSID
    {D63B10C5-BB46-4990-A94F-E40B9D520160}
    and APPID
    {9CA88EE3-ACB7-47C8-AFC4-AB702511C276}
    to the user DESKTOP-7F1R3BQ\david SID (S-1-5-21-3840204244-4144708379-2675172571-1001) from address LocalHost (Using LRPC) running in the application container Unavailable SID (Unavailable). This security permission can be modified using the Component Services administrative tool.

    Error: (03/26/2018 02:37:03 PM) (Source: DCOM) (EventID: 10016) (User: DESKTOP-7F1R3BQ)
    Description: The application-specific permission settings do not grant Local Activation permission for the COM Server application with CLSID
    {D63B10C5-BB46-4990-A94F-E40B9D520160}
    and APPID
    {9CA88EE3-ACB7-47C8-AFC4-AB702511C276}
    to the user DESKTOP-7F1R3BQ\david SID (S-1-5-21-3840204244-4144708379-2675172571-1001) from address LocalHost (Using LRPC) running in the application container Unavailable SID (Unavailable). This security permission can be modified using the Component Services administrative tool.

    Error: (03/26/2018 02:34:52 PM) (Source: DCOM) (EventID: 10016) (User: DESKTOP-7F1R3BQ)
    Description: The application-specific permission settings do not grant Local Activation permission for the COM Server application with CLSID
    {D63B10C5-BB46-4990-A94F-E40B9D520160}
    and APPID
    {9CA88EE3-ACB7-47C8-AFC4-AB702511C276}
    to the user DESKTOP-7F1R3BQ\david SID (S-1-5-21-3840204244-4144708379-2675172571-1001) from address LocalHost (Using LRPC) running in the application container Unavailable SID (Unavailable). This security permission can be modified using the Component Services administrative tool.

    Error: (03/26/2018 02:19:24 PM) (Source: DCOM) (EventID: 10016) (User: DESKTOP-7F1R3BQ)
    Description: The application-specific permission settings do not grant Local Activation permission for the COM Server application with CLSID
    {D63B10C5-BB46-4990-A94F-E40B9D520160}
    and APPID
    {9CA88EE3-ACB7-47C8-AFC4-AB702511C276}
    to the user DESKTOP-7F1R3BQ\david SID (S-1-5-21-3840204244-4144708379-2675172571-1001) from address LocalHost (Using LRPC) running in the application container Unavailable SID (Unavailable). This security permission can be modified using the Component Services administrative tool.

    Error: (03/26/2018 02:18:18 PM) (Source: Service Control Manager) (EventID: 7031) (User: )
    Description: The NVIDIA Display Container LS service terminated unexpectedly. It has done this 1 time(s). The following corrective action will be taken in 5000 milliseconds: Restart the service.

    Error: (03/26/2018 02:18:18 PM) (Source: Service Control Manager) (EventID: 7031) (User: )
    Description: The Avast Cleanup Premium service terminated unexpectedly. It has done this 2 time(s). The following corrective action will be taken in 5000 milliseconds: Restart the service.

    Error: (03/26/2018 02:18:18 PM) (Source: Service Control Manager) (EventID: 7031) (User: )
    Description: The Spybot-S&D 2 Updating Service service terminated unexpectedly. It has done this 2 time(s). The following corrective action will be taken in 60000 milliseconds: Restart the service.

    Error: (03/26/2018 02:16:14 PM) (Source: DCOM) (EventID: 10016) (User: DESKTOP-7F1R3BQ)
    Description: The application-specific permission settings do not grant Local Activation permission for the COM Server application with CLSID
    {D63B10C5-BB46-4990-A94F-E40B9D520160}
    and APPID
    {9CA88EE3-ACB7-47C8-AFC4-AB702511C276}
    to the user DESKTOP-7F1R3BQ\david SID (S-1-5-21-3840204244-4144708379-2675172571-1001) from address LocalHost (Using LRPC) running in the application container Unavailable SID (Unavailable). This security permission can be modified using the Component Services administrative tool.


    CodeIntegrity:
    ===================================

    Date: 2018-03-26 14:44:18.320
    Description:
    Windows is unable to verify the image integrity of the file \Device\HarddiskVolume3\Program Files (x86)\Spybot - Search & Destroy 2\SDWSCSvc.exe because file hash could not be found on the system. A recent hardware or software change might have installed a file that is signed incorrectly or damaged, or that might be malicious software from an unknown source.

    Date: 2018-03-26 14:44:18.318
    Description:
    Windows is unable to verify the image integrity of the file \Device\HarddiskVolume3\Program Files (x86)\Spybot - Search & Destroy 2\SDWSCSvc.exe because file hash could not be found on the system. A recent hardware or software change might have installed a file that is signed incorrectly or damaged, or that might be malicious software from an unknown source.

    Date: 2018-03-26 14:44:18.306
    Description:
    Windows is unable to verify the image integrity of the file \Device\HarddiskVolume3\Program Files (x86)\Spybot - Search & Destroy 2\SDWSCSvc.exe because file hash could not be found on the system. A recent hardware or software change might have installed a file that is signed incorrectly or damaged, or that might be malicious software from an unknown source.

    Date: 2018-03-26 14:44:18.304
    Description:
    Windows is unable to verify the image integrity of the file \Device\HarddiskVolume3\Program Files (x86)\Spybot - Search & Destroy 2\SDWSCSvc.exe because file hash could not be found on the system. A recent hardware or software change might have installed a file that is signed incorrectly or damaged, or that might be malicious software from an unknown source.

    Date: 2018-03-26 14:14:18.539
    Description:
    Windows is unable to verify the image integrity of the file \Device\HarddiskVolume3\Program Files (x86)\Spybot - Search & Destroy 2\SDWSCSvc.exe because file hash could not be found on the system. A recent hardware or software change might have installed a file that is signed incorrectly or damaged, or that might be malicious software from an unknown source.

    Date: 2018-03-26 14:14:18.536
    Description:
    Windows is unable to verify the image integrity of the file \Device\HarddiskVolume3\Program Files (x86)\Spybot - Search & Destroy 2\SDWSCSvc.exe because file hash could not be found on the system. A recent hardware or software change might have installed a file that is signed incorrectly or damaged, or that might be malicious software from an unknown source.

    Date: 2018-03-26 14:13:45.799
    Description:
    Windows is unable to verify the image integrity of the file \Device\HarddiskVolume3\Program Files (x86)\Spybot - Search & Destroy 2\SDWSCSvc.exe because file hash could not be found on the system. A recent hardware or software change might have installed a file that is signed incorrectly or damaged, or that might be malicious software from an unknown source.

    Date: 2018-03-26 14:13:45.797
    Description:
    Windows is unable to verify the image integrity of the file \Device\HarddiskVolume3\Program Files (x86)\Spybot - Search & Destroy 2\SDWSCSvc.exe because file hash could not be found on the system. A recent hardware or software change might have installed a file that is signed incorrectly or damaged, or that might be malicious software from an unknown source.

    ==================== Memory info ===========================

    Processor: Intel(R) Core(TM) i7-7700K CPU @ 4.20GHz
    Percentage of memory in use: 8%
    Total physical RAM: 65471.72 MB
    Available physical RAM: 59774.3 MB
    Total Virtual: 135103.72 MB
    Available Virtual: 129214.74 MB

    ==================== Drives ================================

    Drive c: (Windows) (Fixed) (Total:475.71 GB) (Free:296.3 GB) NTFS
    Drive d: (DATA) (Fixed) (Total:2784.39 GB) (Free:2434.62 GB) NTFS
    Drive e: (RECOVERY) (Fixed) (Total:10.12 GB) (Free:1.03 GB) NTFS ==>[system with boot components (obtained from drive)]

    \\?\Volume{333cf284-ea3c-4ac8-ac3f-87319045c9aa}\ () (Fixed) (Total:0.25 GB) (Free:0.17 GB) FAT32
    \\?\Volume{6fcab8a2-07f2-4671-84ea-508f5c56ae80}\ () (Fixed) (Total:0 GB) (Free:0 GB)

    ==================== MBR & Partition Table ==================

    ========================================================
    Disk: 0 (Size: 476.9 GB) (Disk ID: 318C0D81)

    Partition: GPT.

    ========================================================
    Disk: 1 (Size: 2794.5 GB) (Disk ID: 99C170A3)

    Partition: GPT.

    ==================== End of Addition.txt ============================

  4. #4
    Security Expert Juliet's Avatar
    Join Date
    Feb 2007
    Location
    Deep South
    Posts
    3,810

    Default

    The above error message might have occurred due to user-mode graphic drivers
    when watching videos, it's just a thought


    You also have Avast Cleanup Premium installed. The use of such registry cleaners, tuneup utilities, and system optimizers is NOTt recommended. Please see this link and this link for more information.

    ~~~~~~~~~~~~~~~~~~~~~~`
    If you have problems using the below fix, please disable your antivirus temporarily.

    Start Farbar Recovery Scan Tool with Administrator privileges
    (Right click on the FRST icon and select Run as administrator)

    highlight on the text below and select Copy.
    beginning with Start:: and finishing with End::


    Start::
    CloseProcesses:
    CreateRestorePoint:
    HKLM Group Policy restriction on software: %systemroot%\system32\mrt.exe <==== ATTENTION
    SearchScopes: HKU\S-1-5-21-3840204244-4144708379-2675172571-1001 -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = hxxps://www.bing.com/search?q={searchTerms}&src=IE-SearchBox&FORM=IESR02&pc=UE04
    SearchScopes: HKU\S-1-5-21-3840204244-4144708379-2675172571-1001 -> {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = hxxps://www.bing.com/search?q={searchTerms}&src=IE-SearchBox&FORM=IESR02&pc=UE04
    SearchScopes: HKU\S-1-5-21-3840204244-4144708379-2675172571-1001 -> {518b33ae-375d-712d-6742-d1fe0400268d} URL =
    2018-03-26 13:45 - 2018-03-26 13:45 - 002183680 _____ (Opera Software) C:\Users\david\AppData\Local\Temp\Opera_installer_180326174532829.dll
    2018-03-26 13:45 - 2018-03-26 13:45 - 002183680 _____ (Opera Software) C:\Users\david\AppData\Local\Temp\Opera_installer_180326174532985.dll
    2018-03-26 13:45 - 2018-03-26 13:45 - 002183680 _____ (Opera Software) C:\Users\david\AppData\Local\Temp\Opera_installer_180326174533423.dll
    2018-03-26 13:45 - 2018-03-26 13:45 - 002183680 _____ (Opera Software) C:\Users\david\AppData\Local\Temp\Opera_installer_180326174538083.dll
    Task: {FF82D779-C88D-4E52-A92A-A206B84FD034} - \Microsoft\Windows\UNP\RunCampaignManager -> No File <==== ATTENTION
    AlternateDataStreams: C:\Users\david\Documents\Amazon Drive:com.amazon.drive.sync [177]
    AlternateDataStreams: C:\Users\david\Documents\Amazon Drive:com.amazon.drive.sync.root [42]
    Emptytemp:
    End::


    Press the Fix button.
    If for some reason the tool needs a restart, please make sure you let the system restart normally. After that let the tool complete its run.
    When finished FRST will generate a log on the Desktop (Fixlog.txt). Please post it to your reply.

    ******

    RogueKiller
    • Download the right version of RogueKiller for your Windows version (32 or 64-bit)
    • Once done, move the executable file to your Desktop, right-click on it and select Run as Administrator (for Windows Vista, 7, 8, 8.1 and 10 users)
    • Click on the Start Scan button in the right panel, which will bring you to another tab, and click on it again (this time it'll be in the bottom right corner)
    • Wait for the scan to complete
    • On completion, the results will be displayed
    • Check every single entry (threat found), and click on the Remove Selected button
    • On completion, the results will be displayed. Click on the Open Report button in the bottom left corner, followed by the Open TXT button (also in the bottom left corner)
    • This will open the report in Notepad. Copy/paste its content in your next reply


    AdwCleaner - Fix Mode
    • Download AdwCleaner and move it to your Desktop
    • Right-click on AdwCleaner.exe and select Run as Administrator (for Windows Vista, 7, 8, 8.1 and 10 users)
    • Accept the EULA (I accept), then click on Scan
    • Let the scan complete. Once it's done, make sure that every item listed in the different tabs is checked and click on the Clean button. This will kill all active processes
    • Once the cleaning process is complete, AdwCleaner will ask to restart your computer, do it
    • After the restart, a log will open when logging in. Please copy/paste the content of that log in your next reply


    created by Aura

    ~~~~~~~~~~~
    Your next reply(ies) should therefore contain:
    • Copy/pasted Fixlog.txt
    • Copy/pasted RogueKiller clean log
    • Copy/pasted AdwCleaner clean log
    Windows Insider MVP Consumer Security 2009 - 2017
    Please do not PM me for Malware help, we all benefit from posting on the open board.

  5. #5
    Junior Member
    Join Date
    Jun 2017
    Posts
    15

    Question Am I to paste the text you mention in FRST somewhere before I press the FIX button?

    Am I to paste the text you mention in FRST somewhere before I press the FIX button? Where?

    Quote Originally Posted by Juliet View Post
    The above error message might have occurred due to user-mode graphic drivers
    when watching videos, it's just a thought


    You also have Avast Cleanup Premium installed. The use of such registry cleaners, tuneup utilities, and system optimizers is NOTt recommended. Please see this link and this link for more information.

    ~~~~~~~~~~~~~~~~~~~~~~`
    If you have problems using the below fix, please disable your antivirus temporarily.

    Start Farbar Recovery Scan Tool with Administrator privileges
    (Right click on the FRST icon and select Run as administrator)

    highlight on the text below and select Copy.
    beginning with Start:: and finishing with End::


    Start::
    CloseProcesses:
    CreateRestorePoint:
    HKLM Group Policy restriction on software: %systemroot%\system32\mrt.exe <==== ATTENTION
    SearchScopes: HKU\S-1-5-21-3840204244-4144708379-2675172571-1001 -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = hxxps://www.bing.com/search?q={searchTerms}&src=IE-SearchBox&FORM=IESR02&pc=UE04
    SearchScopes: HKU\S-1-5-21-3840204244-4144708379-2675172571-1001 -> {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = hxxps://www.bing.com/search?q={searchTerms}&src=IE-SearchBox&FORM=IESR02&pc=UE04
    SearchScopes: HKU\S-1-5-21-3840204244-4144708379-2675172571-1001 -> {518b33ae-375d-712d-6742-d1fe0400268d} URL =
    2018-03-26 13:45 - 2018-03-26 13:45 - 002183680 _____ (Opera Software) C:\Users\david\AppData\Local\Temp\Opera_installer_180326174532829.dll
    2018-03-26 13:45 - 2018-03-26 13:45 - 002183680 _____ (Opera Software) C:\Users\david\AppData\Local\Temp\Opera_installer_180326174532985.dll
    2018-03-26 13:45 - 2018-03-26 13:45 - 002183680 _____ (Opera Software) C:\Users\david\AppData\Local\Temp\Opera_installer_180326174533423.dll
    2018-03-26 13:45 - 2018-03-26 13:45 - 002183680 _____ (Opera Software) C:\Users\david\AppData\Local\Temp\Opera_installer_180326174538083.dll
    Task: {FF82D779-C88D-4E52-A92A-A206B84FD034} - \Microsoft\Windows\UNP\RunCampaignManager -> No File <==== ATTENTION
    AlternateDataStreams: C:\Users\david\Documents\Amazon Drive:com.amazon.drive.sync [177]
    AlternateDataStreams: C:\Users\david\Documents\Amazon Drive:com.amazon.drive.sync.root [42]
    Emptytemp:
    End::


    Press the Fix button.
    If for some reason the tool needs a restart, please make sure you let the system restart normally. After that let the tool complete its run.
    When finished FRST will generate a log on the Desktop (Fixlog.txt). Please post it to your reply.

    ******

    RogueKiller
    • Download the right version of RogueKiller for your Windows version (32 or 64-bit)
    • Once done, move the executable file to your Desktop, right-click on it and select Run as Administrator (for Windows Vista, 7, 8, 8.1 and 10 users)
    • Click on the Start Scan button in the right panel, which will bring you to another tab, and click on it again (this time it'll be in the bottom right corner)
    • Wait for the scan to complete
    • On completion, the results will be displayed
    • Check every single entry (threat found), and click on the Remove Selected button
    • On completion, the results will be displayed. Click on the Open Report button in the bottom left corner, followed by the Open TXT button (also in the bottom left corner)
    • This will open the report in Notepad. Copy/paste its content in your next reply


    AdwCleaner - Fix Mode
    • Download AdwCleaner and move it to your Desktop
    • Right-click on AdwCleaner.exe and select Run as Administrator (for Windows Vista, 7, 8, 8.1 and 10 users)
    • Accept the EULA (I accept), then click on Scan
    • Let the scan complete. Once it's done, make sure that every item listed in the different tabs is checked and click on the Clean button. This will kill all active processes
    • Once the cleaning process is complete, AdwCleaner will ask to restart your computer, do it
    • After the restart, a log will open when logging in. Please copy/paste the content of that log in your next reply


    created by Aura

    ~~~~~~~~~~~
    Your next reply(ies) should therefore contain:
    • Copy/pasted Fixlog.txt
    • Copy/pasted RogueKiller clean log
    • Copy/pasted AdwCleaner clean log

  6. #6
    Security Expert Juliet's Avatar
    Join Date
    Feb 2007
    Location
    Deep South
    Posts
    3,810

    Default

    Open Farbar Recovery Scan Tool (don't do anything with it I just want the tool open and ready to use)
    below I have created a script, highlight and copy it from where it says Start::



    Start::
    CloseProcesses:
    CreateRestorePoint:
    HKLM Group Policy restriction on software: %systemroot%\system32\mrt.exe <==== ATTENTION
    SearchScopes: HKU\S-1-5-21-3840204244-4144708379-2675172571-1001 -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = hxxps://www.bing.com/search?q={searchTerms}&src=IE-SearchBox&FORM=IESR02&pc=UE04
    SearchScopes: HKU\S-1-5-21-3840204244-4144708379-2675172571-1001 -> {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = hxxps://www.bing.com/search?q={searchTerms}&src=IE-SearchBox&FORM=IESR02&pc=UE04
    SearchScopes: HKU\S-1-5-21-3840204244-4144708379-2675172571-1001 -> {518b33ae-375d-712d-6742-d1fe0400268d} URL =
    2018-03-26 13:45 - 2018-03-26 13:45 - 002183680 _____ (Opera Software) C:\Users\david\AppData\Local\Temp\Opera_installer_180326174532829.dll
    2018-03-26 13:45 - 2018-03-26 13:45 - 002183680 _____ (Opera Software) C:\Users\david\AppData\Local\Temp\Opera_installer_180326174532985.dll
    2018-03-26 13:45 - 2018-03-26 13:45 - 002183680 _____ (Opera Software) C:\Users\david\AppData\Local\Temp\Opera_installer_180326174533423.dll
    2018-03-26 13:45 - 2018-03-26 13:45 - 002183680 _____ (Opera Software) C:\Users\david\AppData\Local\Temp\Opera_installer_180326174538083.dll
    Task: {FF82D779-C88D-4E52-A92A-A206B84FD034} - \Microsoft\Windows\UNP\RunCampaignManager -> No File <==== ATTENTION
    AlternateDataStreams: C:\Users\david\Documents\Amazon Drive:com.amazon.drive.sync [177]
    AlternateDataStreams: C:\Users\david\Documents\Amazon Drive:com.amazon.drive.sync.root [42]
    Emptytemp:
    End::


    Now, Look at the open Farbar Recovery Scan Tool, I think it's located at the bottom of the tool
    Press the Fix button.
    Windows Insider MVP Consumer Security 2009 - 2017
    Please do not PM me for Malware help, we all benefit from posting on the open board.

  7. #7
    Junior Member
    Join Date
    Jun 2017
    Posts
    15

    Default AdwCleaner could not finish; I pasted the other two logs

    I have pasted two logs for the programs that were able to finish. AdwCleaner could not complete. It said *** Caught unhandled unknown exception; terminated
    and then it froze up. I restarted in hopes it would then produce a log, but it did not. The items it did not or could not clean include Pup.Optional.AdvancedSystemCare, which showed up twice in the AdwCleaner results in C:\Users\david\AppData\roaming\IObit\AdvancedSystemCleaner

    Fix result of Farbar Recovery Scan Tool (x64) Version: 14.03.2018
    Ran by david (27-03-2018 15:38:47) Run:1
    Running from C:\Users\david\Desktop
    Loaded Profiles: defaultuser0 & david & Administrator (Available Profiles: defaultuser0 & david & Administrator)
    Boot Mode: Normal
    ==============================================

    fixlist content:
    *****************
    CloseProcesses:
    CreateRestorePoint:
    HKLM Group Policy restriction on software: %systemroot%\system32\mrt.exe <==== ATTENTION
    SearchScopes: HKU\S-1-5-21-3840204244-4144708379-2675172571-1001 -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = hxxps://www.bing.com/search?q={searchTerms}&src=IE-SearchBox&FORM=IESR02&pc=UE04
    SearchScopes: HKU\S-1-5-21-3840204244-4144708379-2675172571-1001 -> {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = hxxps://www.bing.com/search?q={searchTerms}&src=IE-SearchBox&FORM=IESR02&pc=UE04
    SearchScopes: HKU\S-1-5-21-3840204244-4144708379-2675172571-1001 -> {518b33ae-375d-712d-6742-d1fe0400268d} URL =
    2018-03-26 13:45 - 2018-03-26 13:45 - 002183680 _____ (Opera Software) C:\Users\david\AppData\Local\Temp\Opera_installer_180326174532829.dll
    2018-03-26 13:45 - 2018-03-26 13:45 - 002183680 _____ (Opera Software) C:\Users\david\AppData\Local\Temp\Opera_installer_180326174532985.dll
    2018-03-26 13:45 - 2018-03-26 13:45 - 002183680 _____ (Opera Software) C:\Users\david\AppData\Local\Temp\Opera_installer_180326174533423.dll
    2018-03-26 13:45 - 2018-03-26 13:45 - 002183680 _____ (Opera Software) C:\Users\david\AppData\Local\Temp\Opera_installer_180326174538083.dll
    Task: {FF82D779-C88D-4E52-A92A-A206B84FD034} - \Microsoft\Windows\UNP\RunCampaignManager -> No File <==== ATTENTION
    AlternateDataStreams: C:\Users\david\Documents\Amazon Drive:com.amazon.drive.sync [177]
    AlternateDataStreams: C:\Users\david\Documents\Amazon Drive:com.amazon.drive.sync.root [42]
    Emptytemp:

    *****************

    Processes closed successfully.
    Restore point was successfully created.
    HKLM Group Policy restriction on software: %systemroot%\system32\mrt.exe <==== ATTENTION => restored successfully
    "HKU\S-1-5-21-3840204244-4144708379-2675172571-1001\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\\DefaultScope" => removed successfully
    "HKU\S-1-5-21-3840204244-4144708379-2675172571-1001\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}" => removed successfully
    HKLM\Software\Classes\CLSID\{0633EE93-D776-472f-A0FF-E1416B8B2E3A} => not found
    "HKU\S-1-5-21-3840204244-4144708379-2675172571-1001\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{518b33ae-375d-712d-6742-d1fe0400268d}" => removed successfully
    HKLM\Software\Classes\CLSID\{518b33ae-375d-712d-6742-d1fe0400268d} => not found
    C:\Users\david\AppData\Local\Temp\Opera_installer_180326174532829.dll => moved successfully
    C:\Users\david\AppData\Local\Temp\Opera_installer_180326174532985.dll => moved successfully
    C:\Users\david\AppData\Local\Temp\Opera_installer_180326174533423.dll => moved successfully
    C:\Users\david\AppData\Local\Temp\Opera_installer_180326174538083.dll => moved successfully
    "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Plain\{FF82D779-C88D-4E52-A92A-A206B84FD034}" => removed successfully
    "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\{FF82D779-C88D-4E52-A92A-A206B84FD034}" => removed successfully
    HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tree\Microsoft\Windows\UNP\RunCampaignManager => could not remove. Access Denied.
    C:\Users\david\Documents\Amazon Drive => ":com.amazon.drive.sync" ADS removed successfully
    C:\Users\david\Documents\Amazon Drive => ":com.amazon.drive.sync.root" ADS removed successfully

    =========== EmptyTemp: ==========

    BITS transfer queue => 10510336 B
    DOMStore, IE Recovery, AppCache, Feeds Cache, Thumbcache, IconCache => 11818447 B
    Java, Flash, Steam htmlcache => 506 B
    Windows/system/drivers => 14043788 B
    Edge => 13593 B
    Chrome => 590952315 B
    Firefox => 6592100 B
    Opera => 0 B

    Temp, IE cache, history, cookies, recent:
    Default => 6656 B
    Users => 0 B
    ProgramData => 0 B
    Public => 0 B
    systemprofile => 0 B
    systemprofile32 => 0 B
    LocalService => 0 B
    NetworkService => 0 B
    defaultuser0 => 0 B
    david => 121674660 B
    Administrator => 11560 B

    RecycleBin => 271051 B
    EmptyTemp: => 720.9 MB temporary data Removed.

    ================================

    Result of scheduled files to move (Boot Mode: Normal) (Date&Time: 27-03-2018 15:40:10)


    Result of scheduled keys to remove after reboot:

    HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tree\Microsoft\Windows\UNP\RunCampaignManager => could not remove. Access Denied.

    ==== End of Fixlog 15:40:10 ====

    RogueKiller V12.12.10.0 (x64) [Mar 26 2018] (Free) by Adlice Software
    mail : http://www.adlice.com/contact/
    Feedback : https://forum.adlice.com
    Website : http://www.adlice.com/download/roguekiller/
    Blog : http://www.adlice.com

    Operating System : Windows 10 (10.0.16299) 64 bits version
    Started in : Normal mode
    User : david [Administrator]
    Started from : C:\Program Files\RogueKiller\RogueKiller64.exe
    Mode : Delete -- Date : 03/27/2018 15:45:47 (Duration : 00:14:33)

    ¤¤¤ Processes : 0 ¤¤¤

    ¤¤¤ Registry : 16 ¤¤¤
    [PUP.Gen1] (X64) HKEY_USERS\S-1-5-21-3840204244-4144708379-2675172571-1001\Software\ProductSetup -> Deleted
    [PUP.Gen1] (X86) HKEY_USERS\S-1-5-21-3840204244-4144708379-2675172571-1001\Software\ProductSetup -> Deleted
    [PUM.HomePage] (X64) HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\Main | Start Page : http://hp17win10.msn.com/?pc=HCTE -> Replaced (http://go.microsoft.com/fwlink/p/?LinkId=255141)
    [PUM.HomePage] (X64) HKEY_USERS\.DEFAULT\Software\Microsoft\Internet Explorer\Main | Start Page : http://hp17win10.msn.com/?pc=HCTE -> Replaced (http://go.microsoft.com/fwlink/p/?LinkId=255141)
    [PUM.HomePage] (X86) HKEY_USERS\.DEFAULT\Software\Microsoft\Internet Explorer\Main | Start Page : http://hp17win10.msn.com/?pc=HCTE -> Replaced (http://go.microsoft.com/fwlink/p/?LinkId=255141)
    [PUM.HomePage] (X64) HKEY_USERS\S-1-5-21-3840204244-4144708379-2675172571-1001\Software\Microsoft\Internet Explorer\Main | Start Page : http://hp17win10.msn.com/?pc=HCTE -> Replaced (http://go.microsoft.com/fwlink/p/?LinkId=255141)
    [PUM.HomePage] (X86) HKEY_USERS\S-1-5-21-3840204244-4144708379-2675172571-1001\Software\Microsoft\Internet Explorer\Main | Start Page : http://hp17win10.msn.com/?pc=HCTE -> Replaced (http://go.microsoft.com/fwlink/p/?LinkId=255141)
    [PUM.HomePage] (X64) HKEY_USERS\S-1-5-18\Software\Microsoft\Internet Explorer\Main | Start Page : http://hp17win10.msn.com/?pc=HCTE -> Replaced (http://go.microsoft.com/fwlink/p/?LinkId=255141)
    [PUM.HomePage] (X86) HKEY_USERS\S-1-5-18\Software\Microsoft\Internet Explorer\Main | Start Page : http://hp17win10.msn.com/?pc=HCTE -> Replaced (http://go.microsoft.com/fwlink/p/?LinkId=255141)
    [PUM.HomePage] (X64) HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\Main | Default_Page_URL : http://hp17win10.msn.com/?pc=HCTE -> Replaced (http://www.microsoft.com/isapi/redir...r=6&ar=msnhome)
    [PUM.HomePage] (X64) HKEY_USERS\.DEFAULT\Software\Microsoft\Internet Explorer\Main | Default_Page_URL : http://hp17win10.msn.com/?pc=HCTE -> Replaced (http://www.microsoft.com/isapi/redir...r=6&ar=msnhome)
    [PUM.HomePage] (X86) HKEY_USERS\.DEFAULT\Software\Microsoft\Internet Explorer\Main | Default_Page_URL : http://hp17win10.msn.com/?pc=HCTE -> Replaced (http://www.microsoft.com/isapi/redir...r=6&ar=msnhome)
    [PUM.HomePage] (X64) HKEY_USERS\S-1-5-21-3840204244-4144708379-2675172571-1001\Software\Microsoft\Internet Explorer\Main | Default_Page_URL : http://hp17win10.msn.com/?pc=HCTE -> Replaced (http://www.microsoft.com/isapi/redir...r=6&ar=msnhome)
    [PUM.HomePage] (X86) HKEY_USERS\S-1-5-21-3840204244-4144708379-2675172571-1001\Software\Microsoft\Internet Explorer\Main | Default_Page_URL : http://hp17win10.msn.com/?pc=HCTE -> Replaced (http://www.microsoft.com/isapi/redir...r=6&ar=msnhome)
    [PUM.HomePage] (X64) HKEY_USERS\S-1-5-18\Software\Microsoft\Internet Explorer\Main | Default_Page_URL : http://hp17win10.msn.com/?pc=HCTE -> Replaced (http://www.microsoft.com/isapi/redir...r=6&ar=msnhome)
    [PUM.HomePage] (X86) HKEY_USERS\S-1-5-18\Software\Microsoft\Internet Explorer\Main | Default_Page_URL : http://hp17win10.msn.com/?pc=HCTE -> Replaced (http://www.microsoft.com/isapi/redir...r=6&ar=msnhome)

    ¤¤¤ Tasks : 0 ¤¤¤

    ¤¤¤ Files : 0 ¤¤¤

    ¤¤¤ WMI : 0 ¤¤¤

    ¤¤¤ Hosts File : 0 [Too big!] ¤¤¤

    ¤¤¤ Antirootkit : 0 (Driver: Loaded) ¤¤¤

    ¤¤¤ Web browsers : 3 ¤¤¤
    [PUP.Gen0][Chrome:Addon] Default : Honey [bmnlcjabgnpnenekpadlanbbkooimhnj] -> Deleted
    [PUM.SearchEngine][Firefox:Config] m3cozkdk.default : user_pref("browser.search.selectedEngine", "Yahoo! Powered Search"); -> Deleted
    [PUM.SearchEngine][Firefox:Config] m3cozkdk.default : user_pref("browser.search.defaultenginename", "Yahoo! Powered Search"); -> Deleted

    ¤¤¤ MBR Check : ¤¤¤
    +++++ PhysicalDrive0: SanDisk SD8SB8U-512G-1006 +++++
    --- User ---
    [MBR] a24c96a3ee524f545f08fd6986cb1f85
    [BSP] a586ddf38dd5fab9f6cb403731de4bd6 : Empty|VT.Unknown MBR Code
    Partition table:
    0 - [MAN-MOUNT] EFI system partition | Offset (sectors): 2048 | Size: 260 MB
    1 - [MAN-MOUNT] Microsoft reserved partition | Offset (sectors): 534528 | Size: 16 MB
    2 - Basic data partition | Offset (sectors): 567296 | Size: 487124 MB
    3 - [SYSTEM][MAN-MOUNT] Basic data partition | Offset (sectors): 998197248 | Size: 980 MB
    User = LL1 ... OK
    User = LL2 ... OK

    +++++ PhysicalDrive1: ST3000DM001-1ER166 +++++
    --- User ---
    [MBR] 2c42c07e10669fbd94e123a15557bd45
    [BSP] e35de41c8d7b3af26b0f1574e64e059b : Empty|VT.Unknown MBR Code
    Partition table:
    0 - Basic data partition | Offset (sectors): 2048 | Size: 2851220 MB
    1 - [SYSTEM] Basic data partition | Offset (sectors): 5839300608 | Size: 10367 MB
    User = LL1 ... OK
    User = LL2 ... OK

  8. #8
    Security Expert Juliet's Avatar
    Join Date
    Feb 2007
    Location
    Deep South
    Posts
    3,810

    Default

    If those items above are not found by the following scans, we can attempt to go after them manually.

    ~~~~~~~~~~~~~~~~
    Let's update and run a scan with Malwarebytes Anti-Malware

    Open Malwarebytes Anti-Malware, let it update (if it doesn't automatically let me know)

    • Under SETTINGS.....APPLICATIONS leave everything at default
    • Under SETTINGS.....PROTECTION make sure AUTOMATIC QUARANTINE is on.
    • Go to the Setting Tab
    • Under Setting go to Detection and Protection
    • Under PUP and PUM make sure both are set to show Treat Detections as Malware
    • Then on the Dashboard click on Scan
    • Make sure to select THREAT SCAN
    • Then click on Scan
    • Note: You may see the following message, "Could not load DDA driver". Click Yes, allow your PC to reboot and continue afterwards.
      If threats are detected, click the Apply Actions button.
      You will now be prompted to reboot. Click Yes.
      Upon completion of the scan (or after the reboot), click the Reports tab.
      Double-click the Scan Log.
      At the bottom click Export and choose Text file.

    Save the file to your desktop and include its content in your next reply.

    You can access the logs by going in the "Reports" tab, clicking on the latest "Scan" entry (the one with detection's), then clicking on the "Export" button in the bottom-left corner and select "Copy to clipboard". After that, all you have to do is paste it here

    ~~~~~~~~~~~~~~~~~

    Emsisoft Emergency Kit - Fix Mode
    Follow the instructions below to run a scan using the Emsisoft Emergency Kit.
    • Download the Emsisoft Emergency Kit and execute it. From there, click on the Install button to extract the program in the EEK folder;
    • Once the extraction is complete, the EEK folder will open. Right-click on start emergency kit scanner.exe and select Run as Administrator (for Windows Vista, 7, 8, 8.1 and 10 users);
    • EEK will suggest that you run an online update before using the program. Click on Yes to launch it.
    • After the update, click on Malware Scan under 2. Scan and accept to let EEK detect PUPs (click on Yes).
    • Once the scan is complete, make sure that every item in the list is checked, and click on the Quarantine selected button;
    • If it asks you for a reboot to delete some items, click on Ok to reboot automatically;
    • After the restart, open EEK again (in the C:\EEK folder);
    • This time, click on Logs;
    • From there, go under the Quarantine Log tab, and click on the Export button;
    • Save the log on your desktop, then open it, and copy/paste its content in your next reply;


    created by Aura
    Windows Insider MVP Consumer Security 2009 - 2017
    Please do not PM me for Malware help, we all benefit from posting on the open board.

  9. #9
    Junior Member
    Join Date
    Jun 2017
    Posts
    15

    Default Both logs pasted in

    Malwarebytes
    www.malwarebytes.com

    -Log Details-
    Scan Date: 3/27/18
    Scan Time: 6:34 PM
    Log File: f52bd386-320e-11e8-bf1c-dcfe07d6b952.json
    Administrator: Yes

    -Software Information-
    Version: 3.4.4.2398
    Components Version: 1.0.322
    Update Package Version: 1.0.4514
    License: Premium

    -System Information-
    OS: Windows 10 (Build 16299.309)
    CPU: x64
    File System: NTFS
    User: DESKTOP-7F1R3BQ\david

    -Scan Summary-
    Scan Type: Threat Scan
    Result: Completed
    Objects Scanned: 373914
    Threats Detected: 0
    (No malicious items detected)
    Threats Quarantined: 0
    (No malicious items detected)
    Time Elapsed: 1 min, 18 sec

    -Scan Options-
    Memory: Enabled
    Startup: Enabled
    Filesystem: Enabled
    Archives: Enabled
    Rootkits: Enabled
    Heuristics: Enabled
    PUP: Detect
    PUM: Detect

    -Scan Details-
    Process: 0
    (No malicious items detected)

    Module: 0
    (No malicious items detected)

    Registry Key: 0
    (No malicious items detected)

    Registry Value: 0
    (No malicious items detected)

    Registry Data: 0
    (No malicious items detected)

    Data Stream: 0
    (No malicious items detected)

    Folder: 0
    (No malicious items detected)

    File: 0
    (No malicious items detected)

    Physical Sector: 0
    (No malicious items detected)


    (end)

    Emsisoft Emergency Kit 2017.12.0.8334 stable [en-us]
    OS: Windows 10 (Version 10.0, Build 16299, 64-bit Edition)

    Forensics log

    Date Component Action Details
    3/27/2018 6:45:07 PM User DESKTOP-7F1R3BQ\DAVID Infection quarantined Malware "Application.AppInstall (A)" in "software informer".
    3/27/2018 6:44:45 PM Scanner Scan finished Found 1 object , user to decide on further actions.
    3/27/2018 6:44:25 PM Scanner Detection PUP "Application.AppInstall (A)" in "software informer"
    3/27/2018 6:44:18 PM User DESKTOP-7F1R3BQ\david Scan started Malware Scan
    3/27/2018 6:43:55 PM User DESKTOP-7F1R3BQ\david Setting modified "Detect PUPs" has been changed to "Enabled".
    3/27/2018 6:41:21 PM User Update Downloaded and installed 125 files (22241 kb) (14 sec.).
    3/27/2018 6:41:07 PM Core Notification "Recommended Reading:13 mistakes to avoid when choosing antivirus software in 2018".
    3/27/2018 6:41:03 PM User Update Failed with error "Server returned error" (0 sec.).

  10. #10
    Security Expert Juliet's Avatar
    Join Date
    Feb 2007
    Location
    Deep South
    Posts
    3,810

    Default

    IObit left some items on your computer we can remove.

    Start Farbar Recovery Scan Tool with Administrator privileges
    (Right click on the FRST icon and select Run as administrator)

    highlight on the text below and select Copy.
    beginning with Start:: and finishing with End::


    Start::
    CloseProcesses:
    CreateRestorePoint:
    C:\Users\david\AppData\roaming\IObit\AdvancedSystemCleaner
    C:\Users\david\AppData\Roaming\IObit
    C:\ProgramData\IObit
    Emptytemp:
    End::


    Press the Fix button.
    If for some reason the tool needs a restart, please make sure you let the system restart normally. After that let the tool complete its run.
    When finished FRST will generate a log on the Desktop (Fixlog.txt). Please post it to your reply.

    Post this log when finished,

    How is the computer now?
    Windows Insider MVP Consumer Security 2009 - 2017
    Please do not PM me for Malware help, we all benefit from posting on the open board.

Tags for this Thread

Posting Permissions

  • You may not post new threads
  • You may not post replies
  • You may not post attachments
  • You may not edit your posts
  •