Activation issue on Windows 10 Home OEM + Windows Store suggestion

Status
Not open for further replies.
W

waterreedshimmer

New member
Hello,

It has been months, I have my over then 5years computer, activation issues on Windows 10 Home.
Yesterday was first time it asked me to buy a key on Windows Store, but at the same time it said it was because it had no connection to the Windows Servers, so it's contradictory information.
Today I could Activate my Windows 10 Home OEM that came with no DVD in my computer. It has been, maybe 50 times or more I do that. When it was Windows 8.1, before the upgrade, I did not have this error, I don't know if my sight is right, but I really did notice that issue as having started a few months ago, when I lost my data.
I couldn't download Farbar Recovery Scan Tool with Firefox, my usual browser, but I could download it with Microsoft Edge that I never use. I do not have " All users " box in FRST64.exe and I did run with without troubleshoot option, so no virtualisation from Windows 10 to Windows 8.
No idea if it is related, but we won't worry about that, with fake phone calls, today was: " - Goodbye ". Maybe it has nothing to do as the phone issues could be random.
This might ennoy you, but since my Windows had the Documents and Images folders deleted, I have the impression, that all my free and bought programs can no more create automatically folders and images, unless I put off both Windows defender and my dear Antivirus here. And they are often both down for a few minuts, but may be related to the fact that in Windows 10, we don't see at all when Windows is updated, we don't have the visual anymore, so maybe it is normal behaviour.
You don't need to worry if I loose Windows 10 Home, as I will have choice between going back to Windows XP Pro or going forward with Ubuntu Studio 18.10. But this will be decided in 14 days. Regedit was saved (exported) by inside and all is saved. Windows will wait a little, but one day, maybe next year, I intend to buy the Windows 10 Pro with PPF licence at Microsoft Website, not at Store as it is OEM like mine, but nowdays my money is for smaller things.
I also do suspect as past issue, not at all present issue, that virus can block OS creation on the DVD support, although this happend long ago, and I also suspect it had, long time ago, something to do with the fact that I couldn't re-do my double boot, and had wrx errors, so I had non installed Linux packages, and an issue report was sent somewhere to Ubuntu Linux. But I do not study informatics, so I can't tell things you people can understand.
I also suppose as it is a go and come back virus issue, that Windows 10 does interfere with issue. I think that is why it never did ask me before to buy the key while it couldn't connect to the servers to verify my key. And I suppose that the day I will buy one key, it will be kept in the Windows Server, and he will need to check it with Wifi. So I have no idea at all if Windows 10 needs Wifi to work or not ? But I get this activation issue, may I be in Wifi mode all day, or may I be offline during one day.
I don't know if the Store is a phishing or an illegal joke ?
I only did spoke about it on Facebook, in the Linux forum, but they won't interfere with nothing, as they are just for formatting my computer, usually, that's how they are =)
About Corel PaintShop Pro 2018 + gifts, I had bought it, I also had activation issue, but the issue is no more, it has self solved it, but I never tried the software, I had bought it in its official website. It also often put ads on my computer, but I don't think it to be related, and I don't think it to be phishing.
I will also do my best this time to avoid doing flood. As I know I write too much, and I will always wait for one reply and one question from you to write back, OK ? But it is mostly part of my personnality, not an intention to break the rules.
And thank you very much for your patience.

shoScan result of Farbar Recovery Scan Tool (FRST) (x64) Version: 15.11.2018
Ran by Françoise (administrator) on EARENDIL-LIGHT (16-11-2018 18:48:56)
Running from U:\Downloads
Loaded Profiles: Françoise (Available Profiles: Françoise)
Platform: Windows 8 Pro (X64) Language: English (United Kingdom)
Internet Explorer Version 11 (Default browser: Opera)
Boot Mode: Normal
Tutorial for Farbar Recovery Scan Tool: http://www.geekstogo.com/forum/topic/335081-frst-tutorial-how-to-use-farbar-recovery-scan-tool/

==================== Processes (Whitelisted) =================

(If an entry is included in the fixlist, the process will be closed. The file will not be moved.)

(NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\Display.NvContainer\NVDisplay.Container.exe
(NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\Display.NvContainer\NVDisplay.Container.exe
(Intel Corporation) C:\Windows\System32\igfxCUIService.exe
(Windows (R) Win 7 DDK provider) C:\Windows\System32\drivers\AdminService.exe
(Cybereason) C:\Program Files (x86)\Cybereason\RansomFree\CybereasonRansomFreeServiceHost.exe
(Microsoft Corporation) C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeClickToRun.exe
(Firebird Project) C:\Program Files\Instant-Gestion\Instant-Gestion-ME-Classic\firebird\bin\fbserver.exe
(ELAN Microelectronics Corp.) C:\Program Files\Elantech\ETDService.exe
(arvato digital services llc) C:\Program Files (x86)\Common Files\Protexis\License Service\PsiService_2.exe
(arvato digital services llc) C:\Program Files\Common Files\Protexis\License Service\PsiService_2.exe
(Safer-Networking Ltd.) C:\Program Files (x86)\Spybot - Search & Destroy 2\SDFSSvc.exe
(Safer-Networking Ltd.) C:\Program Files (x86)\Spybot - Search & Destroy 2\SDUpdSvc.exe
(Microsoft Corporation) C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.1810.5-0\MsMpEng.exe
(Safer-Networking Ltd.) C:\Program Files (x86)\Spybot - Search & Destroy 2\SDWSCSvc.exe
(ELAN Microelectronics Corp.) C:\Program Files\Elantech\ETDCtrl.exe
(Microsoft Corporation) C:\Windows\Microsoft.NET\Framework64\v3.0\WPF\PresentationFontCache.exe
(Cybereason) C:\Program Files (x86)\Cybereason\RansomFree\CybereasonRansomFree.exe
(Innovative Solutions) C:\Program Files (x86)\Innovative Solutions\DriverMax\innostp.exe
(Innovative Solutions) C:\Program Files (x86)\Innovative Solutions\DriverMax\drivermax.exe
(Innovative Solutions) C:\Program Files (x86)\Innovative Solutions\DriverMax\drivermax.exe
(ELAN Microelectronics Corp.) C:\Program Files\Elantech\ETDCtrlHelper.exe
(Intel Corporation) C:\Windows\System32\igfxEM.exe
(Intel Corporation) C:\Windows\System32\igfxHK.exe
(Intel Corporation) C:\Windows\System32\igfxTray.exe
(Microsoft Corporation) C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.1810.5-0\NisSrv.exe
(Oracle Corporation) C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe
(Microsoft Corporation) C:\Program Files\WindowsApps\Microsoft.MicrosoftOfficeHub_17.10314.31700.1000_x64__8wekyb3d8bbwe\Office16\OfficeHubTaskHost.exe
(Microsoft Corporation) C:\Windows\SystemApps\Microsoft.Windows.Cortana_cw5n1h2txyewy\RemindersServer.exe
(Microsoft Corporation) C:\Program Files\Windows Defender\MSASCuiL.exe
() C:\Program Files\WindowsApps\Microsoft.ZuneVideo_10.18082.13811.0_x64__8wekyb3d8bbwe\Video.UI.exe
(Realtek Semiconductor) C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe
(Safer-Networking Ltd.) C:\Program Files (x86)\Spybot - Search & Destroy 2\SDTray.exe
(SteelSeries ApS) C:\Program Files\SteelSeries\SteelSeries Engine 3\SteelSeriesEngine3.exe
(Microsoft Corporation) C:\Program Files\rempl\sedsvc.exe
(NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\Display\nvtray.exe
(Mozilla Corporation) C:\Program Files\Mozilla Firefox\firefox.exe
(Mozilla Corporation) C:\Program Files\Mozilla Firefox\firefox.exe
(Mozilla Corporation) C:\Program Files\Mozilla Firefox\firefox.exe
(Mozilla Corporation) C:\Program Files\Mozilla Firefox\firefox.exe
(Mozilla Corporation) C:\Program Files\Mozilla Firefox\firefox.exe
(Mozilla Corporation) C:\Program Files\Mozilla Firefox\firefox.exe
(Microsoft Corporation) C:\Windows\System32\dllhost.exe
(Microsoft Corporation) C:\Windows\System32\smartscreen.exe
(Vivaldi Technologies AS) C:\Users\franc\AppData\Local\Vivaldi\Application\update_notifier.exe

==================== Registry (Whitelisted) ===========================

(If an entry is included in the fixlist, the registry item will be restored to default or removed. The file will not be moved.)

HKLM\...\Run: [SecurityHealth] => C:\Program Files\Windows Defender\MSASCuiL.exe [638872 2018-04-12] (Microsoft Corporation)
HKLM\...\Run: [ETDCtrl] => C:\Program Files\Elantech\ETDCtrl.exe [3242696 2015-10-21] (ELAN Microelectronics Corp.)
HKLM\...\Run: [RTHDVCPL] => C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe [18390912 2018-10-31] (Realtek Semiconductor)
HKLM-x32\...\Run: [SunJavaUpdateSched] => C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe [653728 2018-03-07] (Oracle Corporation)
HKLM-x32\...\Run: [SDTray] => C:\Program Files (x86)\Spybot - Search & Destroy 2\SDTray.exe [6788032 2018-04-20] (Safer-Networking Ltd.)
HKLM-x32\...\Winlogon: [Userinit]
Winlogon\Notify\SDWinLogon-x32: SDWinLogon.dll [X]
HKLM\SOFTWARE\Policies\Microsoft\Windows Defender: Restriction <==== ATTENTION
HKU\S-1-5-19\...\RunOnce: [WAB Migrate] => C:\Program Files\Windows Mail\wab.exe [518144 2018-04-12] (Microsoft Corporation)
HKU\S-1-5-20\...\RunOnce: [WAB Migrate] => C:\Program Files\Windows Mail\wab.exe [518144 2018-04-12] (Microsoft Corporation)
HKU\S-1-5-21-3243081975-1801143758-1203345775-1001\...\Run: [Vivaldi Update Notifier] => C:\Users\franc\AppData\Local\Vivaldi\Application\update_notifier.exe [1488456 2018-03-21] (Vivaldi Technologies AS)
HKU\S-1-5-21-3243081975-1801143758-1203345775-1001\...\Run: [DriverMax_RESTART] => C:\Program Files (x86)\Innovative Solutions\DriverMax\drivermax.exe [7730776 2018-05-22] (Innovative Solutions)
Startup: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\SteelSeries Engine 3.lnk [2018-11-15]
ShortcutTarget: SteelSeries Engine 3.lnk -> C:\Program Files\SteelSeries\SteelSeries Engine 3\SteelSeriesEngine3.exe (SteelSeries ApS)

==================== Internet (Whitelisted) ====================

(If an item is included in the fixlist, if it is a registry item it will be removed or restored to default.)

Hosts: There are more than one entry in Hosts. See Hosts section of Addition.txt
Tcpip\Parameters: [DhcpNameServer] 192.168.0.254
Tcpip\..\Interfaces\{4a795f3e-9dd9-4f69-ba73-6383d7d52b39}: [DhcpNameServer] 192.168.0.254
Tcpip\..\Interfaces\{b66141e2-d2f2-43ae-97ca-26716373670e}: [DhcpNameServer] 212.27.40.241 212.27.40.240
Tcpip\..\Interfaces\{eb3db1f9-467c-47f0-9dc3-a1984f5de0e1}: [DhcpNameServer] 192.168.0.254
ManualProxies:

Internet Explorer:
==================
SearchScopes: HKU\S-1-5-21-3243081975-1801143758-1203345775-1001 -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = hxxps://www.bing.com/search?q={searchTerms}&src=IE-SearchBox&FORM=IESR02&pc=UE00
SearchScopes: HKU\S-1-5-21-3243081975-1801143758-1203345775-1001 -> {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = hxxps://www.bing.com/search?q={searchTerms}&src=IE-SearchBox&FORM=IESR02&pc=UE00
BHO: Skype for Business Browser Helper -> {31D09BA0-12F5-4CCE-BE8A-2923E76605DA} -> C:\Program Files (x86)\Microsoft Office\root\VFS\ProgramFilesX64\Microsoft Office\Office16\OCHelper.dll [2018-10-23] (Microsoft Corporation)
BHO: Java(tm) Plug-In SSV Helper -> {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} -> C:\Program Files\Java\jre1.8.0_181\bin\ssv.dll [2018-07-20] (Oracle Corporation)
BHO: Java(tm) Plug-In 2 SSV Helper -> {DBC80044-A445-435b-BC74-9C25C1C588A9} -> C:\Program Files\Java\jre1.8.0_181\bin\jp2ssv.dll [2018-07-20] (Oracle Corporation)
Handler-x32: mso-minsb-roaming.16 - {83C25742-A9F7-49FB-9138-434302C88D07} - C:\Program Files (x86)\Microsoft Office\root\Office16\MSOSB.DLL [2018-10-04] (Microsoft Corporation)
Handler-x32: mso-minsb.16 - {42089D2D-912D-4018-9087-2B87803E93FB} - C:\Program Files (x86)\Microsoft Office\root\Office16\MSOSB.DLL [2018-10-04] (Microsoft Corporation)
Handler-x32: osf-roaming.16 - {42089D2D-912D-4018-9087-2B87803E93FB} - C:\Program Files (x86)\Microsoft Office\root\Office16\MSOSB.DLL [2018-10-04] (Microsoft Corporation)
Handler-x32: osf.16 - {5504BE45-A83B-4808-900A-3A5C36E7F77A} - C:\Program Files (x86)\Microsoft Office\root\Office16\MSOSB.DLL [2018-10-04] (Microsoft Corporation)

Edge:
======
Edge Extension: (Adblock Plus) -> 10_EyeoGmbHAdblockPlus_d55gg7py3s0m0 => C:\Program Files\WindowsApps\EyeoGmbH.AdblockPlus_0.9.11.0_neutral__d55gg7py3s0m0 [2018-07-02]
Edge Extension: (Evernote Web Clipper) -> 9nblggh4x0qw_EvernoteEvernoteWebClipper_q4d96b2w5wcc2 => C:\Program Files\WindowsApps\Evernote.EvernoteWebClipper_6.13.2.0_neutral__q4d96b2w5wcc2 [2018-07-02]
Edge Extension: (Enhancer for YouTube™) -> EdgeExtension_48376MaximeRFEnhancerforYouTubeforMicrosoftEdge_f4efyycdr3qdm => C:\Program Files\WindowsApps\48376MaximeRF.EnhancerforYouTubeforMicrosoftEdge_2.0.77.0_neutral__f4efyycdr3qdm [2018-11-16]
Edge Extension: (Nom) -> EdgeExtension_8bitSolutionsLLCbitwardenFreePasswordManager_h4e712dmw3xyy => C:\Program Files\WindowsApps\8bitSolutionsLLC.bitwarden-FreePasswordManager_1.34.0.0_neutral__h4e712dmw3xyy [2018-11-10]
Edge Extension: (Pin It Button) -> EdgeExtension_PinterestPinItButton_xnkra2w3aecd0 => C:\Program Files\WindowsApps\Pinterest.PinItButton_1.39.5.0_neutral__xnkra2w3aecd0 [2018-07-02]
Edge Extension: (Translator pour Microsoft Edge) -> MicrosoftTranslate_MicrosoftTranslatorforMicrosoftEdge_8wekyb3d8bbwe => C:\Program Files\WindowsApps\Microsoft.TranslatorforMicrosoftEdge_0.91.48.0_neutral__8wekyb3d8bbwe [2018-07-21]

FireFox:
========
FF DefaultProfile: 4q9abl71.default
FF DefaultProfile: 1rca6x8y.default
FF ProfilePath: C:\Users\franc\AppData\Roaming\Mozilla\Firefox\Profiles\4q9abl71.default [2018-11-16]
FF Homepage: Mozilla\Firefox\Profiles\4q9abl71.default -> hxxps://start.me/p/ZmQG76/page-d-accueil-welcome-page-pagina-inicial
hxxps://atavi.com/start/
about:blank
FF NewTab: Mozilla\Firefox\Profiles\4q9abl71.default -> hxxp://www.bing.com/?pc=COSP&ptag=D070518-AD26CBEB7DD&form=CONMHP&conlogo=CT3335811
FF Session Restore: Mozilla\Firefox\Profiles\4q9abl71.default -> is enabled.
FF NewTabOverride: Mozilla\Firefox\Profiles\4q9abl71.default -> Disabled: extension@atavi.com
FF NewTabOverride: Mozilla\Firefox\Profiles\4q9abl71.default -> Enabled: {d04b0b40-3dab-4f0b-97a6-04ec3eddbfb0}
FF Extension: (Cookie AutoDelete) - C:\Users\franc\AppData\Roaming\Mozilla\Firefox\Profiles\4q9abl71.default\Extensions\CookieAutoDelete@kennydo.com.xpi [2018-07-02]
FF Extension: (Ghostery – Privacy Ad Blocker) - C:\Users\franc\AppData\Roaming\Mozilla\Firefox\Profiles\4q9abl71.default\Extensions\firefox@ghostery.com.xpi [2018-09-02]
FF Extension: (HTTPS Everywhere) - C:\Users\franc\AppData\Roaming\Mozilla\Firefox\Profiles\4q9abl71.default\Extensions\https-everywhere@eff.org.xpi [2018-11-01]
FF Extension: (To Google Translate) - C:\Users\franc\AppData\Roaming\Mozilla\Firefox\Profiles\4q9abl71.default\Extensions\jid1-93WyvpgvxzGATw@jetpack.xpi [2018-07-10]
FF Extension: (DuckDuckGo Privacy Essentials) - C:\Users\franc\AppData\Roaming\Mozilla\Firefox\Profiles\4q9abl71.default\Extensions\jid1-ZAdIEUB7XOzOJw@jetpack.xpi [2018-10-25]
FF Extension: (No Name) - C:\Users\franc\AppData\Roaming\Mozilla\Firefox\Profiles\4q9abl71.default\Extensions\openinbrowser@www.spasche.net.xpi [2018-10-07]
FF Extension: (Print Edit WE) - C:\Users\franc\AppData\Roaming\Mozilla\Firefox\Profiles\4q9abl71.default\Extensions\printedit-we@DW-dev.xpi [2018-11-08]
FF Extension: (Save Page WE) - C:\Users\franc\AppData\Roaming\Mozilla\Firefox\Profiles\4q9abl71.default\Extensions\savepage-we@DW-dev.xpi [2018-11-08]
FF Extension: (uBlock Origin) - C:\Users\franc\AppData\Roaming\Mozilla\Firefox\Profiles\4q9abl71.default\Extensions\uBlock0@raymondhill.net.xpi [2018-10-22]
FF Extension: (New tab page by start.me) - C:\Users\franc\AppData\Roaming\Mozilla\Firefox\Profiles\4q9abl71.default\Extensions\yourls@yourls.com.xpi [2018-11-12]
FF Extension: (Bitwarden - Free Password Manager) - C:\Users\franc\AppData\Roaming\Mozilla\Firefox\Profiles\4q9abl71.default\Extensions\{446900e4-71c2-419f-a6a7-df9c091e268b}.xpi [2018-11-08]
FF Extension: (Print to PDF) - C:\Users\franc\AppData\Roaming\Mozilla\Firefox\Profiles\4q9abl71.default\Extensions\{9ab38051-cd73-4e46-b7bd-dc147f6f6b29}.xpi [2018-07-02]
FF Extension: (Easy Youtube Video Downloader Express) - C:\Users\franc\AppData\Roaming\Mozilla\Firefox\Profiles\4q9abl71.default\Extensions\{b9acf540-acba-11e1-8ccb-001fd0e08bd4}.xpi [2018-11-12]
FF Extension: (Video DownloadHelper) - C:\Users\franc\AppData\Roaming\Mozilla\Firefox\Profiles\4q9abl71.default\Extensions\{b9db16a4-6edc-47ec-a1f4-b86292ed211d}.xpi [2018-09-02]
FF Extension: (Flash and Video Download) - C:\Users\franc\AppData\Roaming\Mozilla\Firefox\Profiles\4q9abl71.default\Extensions\{bee6eb20-01e0-ebd1-da83-080329fb9a3a}.xpi [2018-09-02]
FF Extension: (Ecosia - The search engine that plants trees) - C:\Users\franc\AppData\Roaming\Mozilla\Firefox\Profiles\4q9abl71.default\Extensions\{d04b0b40-3dab-4f0b-97a6-04ec3eddbfb0}.xpi [2018-07-02]
FF Extension: (Adblock Plus) - C:\Users\franc\AppData\Roaming\Mozilla\Firefox\Profiles\4q9abl71.default\Extensions\{d10d0bf8-f5b5-c8b4-a8b2-2b9879e08c5d}.xpi [2018-11-15]
FF Extension: (Diigo Web Collector - Capture and Annotate) - C:\Users\franc\AppData\Roaming\Mozilla\Firefox\Profiles\4q9abl71.default\Extensions\{fc2b8f80-d9a5-4f51-8076-7c7ce3c67ee3}.xpi [2018-07-02]
FF Extension: (Firefox Monitor) - C:\Users\franc\AppData\Roaming\Mozilla\Firefox\Profiles\4q9abl71.default\features\{2c09d05f-16f2-483d-bcfd-b6f561cff956}\fxmonitor@mozilla.org.xpi [2018-11-15]
FF SearchPlugin: C:\Users\franc\AppData\Roaming\Mozilla\Firefox\Profiles\4q9abl71.default\searchplugins\bing-lavasoft-ff59.xml [2018-07-05]
FF ProfilePath: C:\Users\franc\AppData\Roaming\Moonchild Productions\Pale Moon\Profiles\1rca6x8y.default [2018-11-16]
FF Plugin: @adobe.com/FlashPlayer -> C:\WINDOWS\system32\Macromed\Flash\NPSWF64_31_0_0_148.dll [2018-11-15] ()
FF Plugin: @java.com/DTPlugin,version=11.181.2 -> C:\Program Files\Java\jre1.8.0_181\bin\dtplugin\npDeployJava1.dll [2018-07-20] (Oracle Corporation)
FF Plugin: @java.com/JavaPlugin,version=11.181.2 -> C:\Program Files\Java\jre1.8.0_181\bin\plugin2\npjp2.dll [2018-07-20] (Oracle Corporation)
FF Plugin: @videolan.org/vlc,version=3.0.1 -> C:\Program Files\VideoLAN\VLC\npvlc.dll [2018-08-10] (VideoLAN)
FF Plugin: @videolan.org/vlc,version=3.0.3 -> C:\Program Files\VideoLAN\VLC\npvlc.dll [2018-08-10] (VideoLAN)
FF Plugin: @videolan.org/vlc,version=3.0.4 -> C:\Program Files\VideoLAN\VLC\npvlc.dll [2018-08-10] (VideoLAN)
FF Plugin-x32: @adobe.com/FlashPlayer -> C:\WINDOWS\SysWOW64\Macromed\Flash\NPSWF32_31_0_0_148.dll [2018-11-15] ()
FF Plugin-x32: @microsoft.com/SharePoint,version=14.0 -> C:\Program Files (x86)\Microsoft Office\root\Office16\NPSPWRAP.DLL [2018-09-22] (Microsoft Corporation)
FF Plugin-x32: Adobe Reader -> C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AIR\nppdf32.dll [2018-09-20] (Adobe Systems Inc.)

==================== Services (Whitelisted) ====================

(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)

R2 AtherosSvc; C:\WINDOWS\system32\DRIVERS\AdminService.exe [416072 2018-06-26] (Windows (R) Win 7 DDK provider)
R2 ClickToRunSvc; C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe [9667872 2018-10-24] (Microsoft Corporation)
R2 CybereasonRansomFree; C:\Program Files (x86)\Cybereason\RansomFree\CybereasonRansomFreeServiceHost.exe [13824 2017-11-20] (Cybereason) [File not signed]
R2 ETDService; C:\Program Files\Elantech\ETDService.exe [144072 2015-10-21] (ELAN Microelectronics Corp.)
R2 FirebirdServerDefaultInstance; c:\program files\Instant-Gestion\Instant-Gestion-ME-Classic\Firebird\bin\fbserver.exe [3735552 2010-09-17] (Firebird Project) [File not signed]
R2 igfxCUIService1.0.0.0; C:\WINDOWS\system32\igfxCUIService.exe [337888 2016-07-23] (Intel Corporation)
R2 PSI_SVC_2; c:\Program Files (x86)\Common Files\Protexis\License Service\PsiService_2.exe [277360 2014-04-30] (arvato digital services llc)
R2 PSI_SVC_2_x64; c:\Program Files\Common Files\Protexis\License Service\PsiService_2.exe [337776 2014-04-30] (arvato digital services llc)
R2 SDScannerService; C:\Program Files (x86)\Spybot - Search & Destroy 2\SDFSSvc.exe [3892256 2018-04-20] (Safer-Networking Ltd.)
R2 SDUpdateService; C:\Program Files (x86)\Spybot - Search & Destroy 2\SDUpdSvc.exe [3943664 2018-04-20] (Safer-Networking Ltd.)
R2 SDWSCService; C:\Program Files (x86)\Spybot - Search & Destroy 2\SDWSCSvc.exe [233712 2018-02-06] (Safer-Networking Ltd.)
S4 ssh-agent; C:\WINDOWS\System32\OpenSSH\ssh-agent.exe [495616 2018-03-10] ()
R3 WdNisSvc; C:\ProgramData\Microsoft\Windows Defender\platform\4.18.1810.5-0\NisSrv.exe [3917016 2018-10-23] (Microsoft Corporation)
R2 WinDefend; C:\ProgramData\Microsoft\Windows Defender\platform\4.18.1810.5-0\MsMpEng.exe [114208 2018-10-23] (Microsoft Corporation)
R2 NVDisplay.ContainerLocalSystem; "C:\Program Files\NVIDIA Corporation\Display.NvContainer\NVDisplay.Container.exe" -s NVDisplay.ContainerLocalSystem -f "C:\ProgramData\NVIDIA\NVDisplay.ContainerLocalSystem.log" -l 3 -d "C:\Program Files\NVIDIA Corporation\Display.NvContainer\plugins\LocalSystem" -r -p 30000

===================== Drivers (Whitelisted) ======================

(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)

S3 ampa; C:\WINDOWS\system32\ampa.sys [38320 2017-02-28] ()
S3 ampa; C:\WINDOWS\SysWOW64\ampa.sys [38320 2017-02-28] ()
R3 athr; C:\WINDOWS\System32\drivers\athw10x.sys [4322672 2018-03-20] (Qualcomm Atheros Communications, Inc.)
S3 Btcsrusb; C:\WINDOWS\System32\Drivers\btcusb.sys [53488 2017-12-22] (IVT Corporation.)
R3 BtFilter; C:\WINDOWS\system32\DRIVERS\btfilter.sys [69440 2018-06-26] (Qualcomm)
S3 dg_ssudbus; C:\WINDOWS\system32\DRIVERS\ssudbus.sys [131984 2017-05-18] (Samsung Electronics Co., Ltd.)
S3 FlashUSB; C:\WINDOWS\System32\drivers\FlashUSB.sys [19968 2014-12-03] (Intel Mobile Communications)
S3 LMDriver; C:\WINDOWS\System32\drivers\LMDriver.sys [21360 2013-07-17] (Acer Incorporated)
R3 nvlddmkm; C:\WINDOWS\System32\DriverStore\FileRepository\nvacwu.inf_amd64_9d2734742a07f3cf\nvlddmkm.sys [14456920 2017-05-18] (NVIDIA Corporation)
S3 pikbd; C:\WINDOWS\System32\drivers\pikbd.sys [41368 2016-11-17] ()
S3 RadioShim; C:\WINDOWS\System32\drivers\RadioShim.sys [14680 2013-07-17] (Acer Incorporated)
R1 SDHookDriver; C:\Program Files (x86)\Spybot - Search & Destroy 2\SDHookDrv64.sys [92032 2018-03-19] (Safer-Networking Ltd.)
S3 shspusb; C:\WINDOWS\System32\drivers\HSPUSB.sys [24064 2014-12-03] (MobileTop)
S3 SmbDrv; C:\WINDOWS\System32\drivers\Smb_driver_AMDASF.sys [41560 2018-01-09] (Synaptics Incorporated)
R3 SmbDrvI; C:\WINDOWS\System32\drivers\Smb_driver_Intel.sys [56936 2018-09-17] (Synaptics Incorporated)
S3 ssbthid; C:\WINDOWS\System32\drivers\ssbthid.sys [43824 2017-12-15] ()
S3 sscdserd; C:\WINDOWS\System32\drivers\sscdserd.sys [158024 2014-12-03] (MCCI Corporation)
S3 ssceserd; C:\WINDOWS\System32\drivers\ssceserd.sys [158024 2014-12-03] (MCCI Corporation)
R3 ssdevfactory; C:\WINDOWS\System32\drivers\ssdevfactory.sys [48320 2018-08-20] ()
S3 ssdudfu; C:\WINDOWS\System32\drivers\ssdudfu.sys [101960 2014-12-03] (MCCI)
S3 ssm_bus; C:\WINDOWS\System32\drivers\ssm_bus.sys [136192 2014-12-03] (MCCI Corporation)
S3 ssm_mdm; C:\WINDOWS\System32\drivers\ssm_mdm.sys [172032 2014-12-03] (MCCI Corporation)
S3 ssuddmgr; C:\WINDOWS\System32\drivers\ssuddmgr.sys [206104 2014-12-03] (DEVGURU Co., LTD.(www.devguru.co.kr))
S3 ssudmdm; C:\WINDOWS\system32\DRIVERS\ssudmdm.sys [166288 2017-05-18] (Samsung Electronics Co., Ltd.)
S3 ssudobex; C:\WINDOWS\System32\drivers\ssudobex.sys [206104 2014-12-03] (DEVGURU Co., LTD.(www.devguru.co.kr))
S3 ssudqcfilter; C:\WINDOWS\System32\drivers\ssudqcfilter.sys [48920 2014-12-03] (QUALCOMM Incorporated)
S3 ssudserd; C:\WINDOWS\System32\drivers\ssudserd.sys [206104 2014-12-03] (DEVGURU Co., LTD.(www.devguru.co.kr))
S3 ss_bserd; C:\WINDOWS\System32\drivers\ss_bserd.sys [128000 2014-12-03] (MCCI Corporation)
S3 ss_conn_usb_driver; C:\WINDOWS\System32\Drivers\ss_conn_usb_driver.sys [26392 2014-12-03] (DEVGURU Co., LTD.)
S3 STTub30; C:\WINDOWS\System32\Drivers\STTub30.sys [54104 2017-08-30] (STMicroelectronics)
S0 WdBoot; C:\WINDOWS\System32\drivers\wd\WdBoot.sys [46184 2018-10-23] (Microsoft Corporation)
R0 WdFilter; C:\WINDOWS\System32\drivers\wd\WdFilter.sys [328696 2018-10-23] (Microsoft Corporation)
R3 WdNisDrv; C:\WINDOWS\System32\drivers\wd\WdNisDrv.sys [60408 2018-10-23] (Microsoft Corporation)

==================== NetSvcs (Whitelisted) ===================

(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)


==================== One Month Created files and folders ========

(If an entry is included in the fixlist, the file/folder will be moved.)

2018-11-16 18:47 - 2018-11-16 18:48 - 000000000 ____D C:\FRST
2018-11-16 17:19 - 2018-11-16 17:19 - 000515880 ____N C:\Users\Akqhd\fade.studying.xlsx
2018-11-16 17:19 - 2018-11-16 17:19 - 000515355 ____N C:\Users\Qj4jpuc\guided-instruments.xlsx
2018-11-16 17:19 - 2018-11-16 17:19 - 000218490 ____N C:\Users\Qj4jpuc\identificationbetformation.mdb
2018-11-16 17:19 - 2018-11-16 17:19 - 000217576 ____N C:\Users\Akqhd\royalty_dimension_divide.mdb
2018-11-16 17:19 - 2018-11-16 17:19 - 000077030 ____N C:\Users\Qj4jpuc\cutpodgerchairsknock.xls
2018-11-16 17:19 - 2018-11-16 17:19 - 000064952 ____N C:\Users\Akqhd\nature_exercises_aspiration_wash.xls
2018-11-16 17:19 - 2018-11-16 17:19 - 000052681 ____N C:\Users\Akqhd\leather_personality.pem
2018-11-16 17:19 - 2018-11-16 17:19 - 000052059 ____N C:\Users\Qj4jpuc\meltingtensionswimdirt.pem
2018-11-16 17:19 - 2018-11-16 17:19 - 000021404 ____N C:\Users\Qj4jpuc\occasionallyordertoleratemusic.sql
2018-11-16 17:19 - 2018-11-16 17:19 - 000015116 ____N C:\Users\Qj4jpuc\textiletreat.txt
2018-11-16 17:19 - 2018-11-16 17:19 - 000011854 ____N C:\Users\Akqhd\bubble-supplied.txt
2018-11-16 17:19 - 2018-11-16 17:19 - 000011253 ____N C:\Users\Akqhd\introductionassembled.sql
2018-11-16 17:19 - 2018-11-16 17:19 - 000000000 __SHD C:\Users\franc\Desktop\0K, this directory is for Ransomware detection (just leave it here)
2018-11-16 17:19 - 2018-11-16 17:19 - 000000000 ___HD C:\Users\Qj4jpuc
2018-11-16 17:19 - 2018-11-16 17:19 - 000000000 ___HD C:\Users\franc\Documents\Tlog170
2018-11-16 17:19 - 2018-11-16 17:19 - 000000000 ___HD C:\Users\franc\Documents\Bconfiguration138
2018-11-16 17:19 - 2018-11-16 17:19 - 000000000 ___HD C:\Users\Akqhd
2018-11-16 17:19 - 2018-11-16 17:19 - 000000000 ____D C:\Ximages95
2018-11-16 17:19 - 2018-11-16 17:19 - 000000000 ____D C:\bmirror160
2018-11-16 15:08 - 2018-11-16 15:08 - 000002265 _____ C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Adobe Digital Editions 4.5.lnk
2018-11-16 15:08 - 2018-11-16 15:08 - 000000000 ____D C:\Users\franc\AppData\Local\Adobe_Systems_Incorporate
2018-11-16 15:08 - 2018-11-16 15:08 - 000000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Adobe
2018-11-16 15:08 - 2018-11-16 15:08 - 000000000 ____D C:\My Digital Editions
2018-11-15 16:49 - 2018-11-15 21:54 - 000000000 ____D C:\Users\franc\AppData\Roaming\vlc
2018-11-15 16:35 - 2018-11-15 16:35 - 000000000 ____D C:\Users\franc\AppData\Roaming\dvdcss
2018-11-15 12:31 - 2018-11-05 18:34 - 000835168 _____ (Adobe Systems Incorporated) C:\WINDOWS\SysWOW64\FlashPlayerApp.exe
2018-11-15 12:31 - 2018-11-05 18:34 - 000179808 _____ (Adobe Systems Incorporated) C:\WINDOWS\SysWOW64\FlashPlayerCPLApp.cpl
2018-11-15 09:54 - 2018-11-01 12:46 - 002394960 _____ (Microsoft Corporation) C:\WINDOWS\system32\WMVCORE.DLL
2018-11-15 09:54 - 2018-11-01 12:45 - 004527776 _____ (Microsoft Corporation) C:\WINDOWS\system32\sppsvc.exe
2018-11-15 09:54 - 2018-11-01 12:45 - 001617320 _____ (Microsoft Corporation) C:\WINDOWS\system32\sppobjs.dll
2018-11-15 09:54 - 2018-11-01 12:31 - 006602240 _____ (Microsoft Corporation) C:\WINDOWS\system32\twinui.dll
2018-11-15 09:54 - 2018-11-01 12:29 - 012710400 _____ (Microsoft Corporation) C:\WINDOWS\system32\ieframe.dll
2018-11-15 09:54 - 2018-11-01 12:28 - 004491264 _____ (Microsoft Corporation) C:\WINDOWS\system32\xpsrchvw.exe
2018-11-15 09:54 - 2018-11-01 12:28 - 003649024 _____ (Microsoft Corporation) C:\WINDOWS\system32\win32kfull.sys
2018-11-15 09:54 - 2018-11-01 10:59 - 005669888 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\twinui.dll
2018-11-15 09:54 - 2018-11-01 10:56 - 011902464 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\ieframe.dll
2018-11-15 09:54 - 2018-11-01 10:52 - 002892800 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\win32kfull.sys
2018-11-15 09:54 - 2018-11-01 10:15 - 023861760 _____ (Microsoft Corporation) C:\WINDOWS\system32\Hydrogen.dll
2018-11-15 09:54 - 2018-11-01 10:13 - 019525120 _____ (Microsoft Corporation) C:\WINDOWS\system32\HologramCompositor.dll
2018-11-15 09:54 - 2018-11-01 08:39 - 001035256 _____ (Microsoft Corporation) C:\WINDOWS\system32\ApplyTrustOffline.exe
2018-11-15 09:54 - 2018-11-01 08:28 - 001221432 _____ (Microsoft Corporation) C:\WINDOWS\system32\hvix64.exe
2018-11-15 09:54 - 2018-11-01 08:28 - 001029944 _____ (Microsoft Corporation) C:\WINDOWS\system32\hvax64.exe
2018-11-15 09:54 - 2018-11-01 08:27 - 001017152 _____ (Microsoft Corporation) C:\WINDOWS\system32\msmpeg2adec.dll
2018-11-15 09:54 - 2018-11-01 08:26 - 007432120 _____ (Microsoft Corporation) C:\WINDOWS\system32\windows.storage.dll
2018-11-15 09:54 - 2018-11-01 08:26 - 003291640 _____ (Microsoft Corporation) C:\WINDOWS\system32\combase.dll
2018-11-15 09:54 - 2018-11-01 08:26 - 003180080 _____ (Microsoft Corporation) C:\WINDOWS\system32\d3d11.dll
2018-11-15 09:54 - 2018-11-01 08:25 - 009089848 _____ (Microsoft Corporation) C:\WINDOWS\system32\ntoskrnl.exe
2018-11-15 09:54 - 2018-11-01 08:25 - 007520088 _____ (Microsoft Corporation) C:\WINDOWS\system32\Windows.Media.Protection.PlayReady.dll
2018-11-15 09:54 - 2018-11-01 08:25 - 004404912 _____ (Microsoft Corporation) C:\WINDOWS\system32\mfcore.dll
2018-11-15 09:54 - 2018-11-01 08:25 - 002822456 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\dxgkrnl.sys
2018-11-15 09:54 - 2018-11-01 08:25 - 002571320 _____ (Microsoft Corporation) C:\WINDOWS\system32\KernelBase.dll
2018-11-15 09:54 - 2018-11-01 08:25 - 002371296 _____ (Microsoft Corporation) C:\WINDOWS\system32\msmpeg2vdec.dll
2018-11-15 09:54 - 2018-11-01 08:25 - 001784680 _____ (Microsoft Corporation) C:\WINDOWS\system32\mfasfsrcsnk.dll
2018-11-15 09:54 - 2018-11-01 08:25 - 001288920 _____ (Microsoft Corporation) C:\WINDOWS\system32\mfmpeg2srcsnk.dll
2018-11-15 09:54 - 2018-11-01 08:09 - 025855488 _____ (Microsoft Corporation) C:\WINDOWS\system32\edgehtml.dll
2018-11-15 09:54 - 2018-11-01 08:03 - 003397120 _____ (Microsoft Corporation) C:\WINDOWS\system32\AppXDeploymentServer.dll
2018-11-15 09:54 - 2018-11-01 08:01 - 022716416 _____ (Microsoft Corporation) C:\WINDOWS\system32\mshtml.dll
2018-11-15 09:54 - 2018-11-01 08:01 - 009084928 _____ (Microsoft Corporation) C:\WINDOWS\system32\BingMaps.dll
2018-11-15 09:54 - 2018-11-01 08:01 - 007057408 _____ (Microsoft Corporation) C:\WINDOWS\system32\mos.dll
2018-11-15 09:54 - 2018-11-01 08:00 - 008189440 _____ (Microsoft Corporation) C:\WINDOWS\system32\Windows.Data.Pdf.dll
2018-11-15 09:54 - 2018-11-01 08:00 - 006031360 _____ (Microsoft Corporation) C:\WINDOWS\system32\d2d1.dll
2018-11-15 09:54 - 2018-11-01 08:00 - 003392000 _____ (Microsoft Corporation) C:\WINDOWS\system32\tquery.dll
2018-11-15 09:54 - 2018-11-01 07:58 - 007573504 _____ (Microsoft Corporation) C:\WINDOWS\system32\Chakra.dll
2018-11-15 09:54 - 2018-11-01 07:58 - 004867072 _____ (Microsoft Corporation) C:\WINDOWS\system32\jscript9.dll
2018-11-15 09:54 - 2018-11-01 07:58 - 004383744 _____ (Microsoft Corporation) C:\WINDOWS\system32\EdgeContent.dll
2018-11-15 09:54 - 2018-11-01 07:57 - 001804288 _____ (Microsoft Corporation) C:\WINDOWS\system32\urlmon.dll
2018-11-15 09:54 - 2018-11-01 07:56 - 001768448 _____ (Microsoft Corporation) C:\WINDOWS\system32\audiosrv.dll
2018-11-15 09:54 - 2018-11-01 07:56 - 001395200 _____ (Microsoft Corporation) C:\WINDOWS\system32\TokenBroker.dll
2018-11-15 09:54 - 2018-11-01 07:55 - 002738688 _____ (Microsoft Corporation) C:\WINDOWS\system32\mssrch.dll
2018-11-15 09:54 - 2018-11-01 07:53 - 002248192 _____ (Microsoft Corporation) C:\WINDOWS\system32\wlidsvc.dll
2018-11-15 09:54 - 2018-11-01 07:53 - 001159680 _____ (Microsoft Corporation) C:\WINDOWS\system32\rpcss.dll
2018-11-15 09:54 - 2018-11-01 05:50 - 000861712 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\msmpeg2adec.dll
2018-11-15 09:54 - 2018-11-01 05:48 - 006039064 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\windows.storage.dll
2018-11-15 09:54 - 2018-11-01 05:48 - 004790184 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\mfcore.dll
2018-11-15 09:54 - 2018-11-01 05:48 - 002478872 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\combase.dll
2018-11-15 09:54 - 2018-11-01 05:48 - 002331480 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\msmpeg2vdec.dll
2018-11-15 09:54 - 2018-11-01 05:47 - 006570368 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\Windows.Media.Protection.PlayReady.dll
2018-11-15 09:54 - 2018-11-01 05:47 - 001980776 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\KernelBase.dll
2018-11-15 09:54 - 2018-11-01 05:47 - 001379792 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\mfasfsrcsnk.dll
2018-11-15 09:54 - 2018-11-01 05:47 - 001020064 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\mfmpeg2srcsnk.dll
2018-11-15 09:54 - 2018-11-01 05:40 - 022015488 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\edgehtml.dll
2018-11-15 09:54 - 2018-11-01 05:35 - 019403776 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\mshtml.dll
2018-11-15 09:54 - 2018-11-01 05:34 - 002700288 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\tquery.dll
2018-11-15 09:54 - 2018-11-01 05:33 - 006661632 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\Windows.Data.Pdf.dll
2018-11-15 09:54 - 2018-11-01 05:33 - 003711488 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\jscript9.dll
2018-11-15 09:54 - 2018-11-01 05:30 - 005883904 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\mos.dll
2018-11-15 09:54 - 2018-11-01 05:30 - 005775872 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\Chakra.dll
2018-11-15 09:54 - 2018-10-21 14:00 - 021386368 _____ (Microsoft Corporation) C:\WINDOWS\system32\shell32.dll
2018-11-15 09:54 - 2018-10-21 14:00 - 001516120 _____ (Microsoft Corporation) C:\WINDOWS\system32\msctf.dll
2018-11-15 09:54 - 2018-10-21 13:46 - 013572096 _____ (Microsoft Corporation) C:\WINDOWS\system32\wmp.dll
2018-11-15 09:54 - 2018-10-21 13:46 - 004393472 _____ (Microsoft Corporation) C:\WINDOWS\system32\SettingsHandlers_nt.dll
2018-11-15 09:54 - 2018-10-21 12:38 - 001322376 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\msctf.dll
2018-11-15 09:54 - 2018-10-21 12:37 - 020381808 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\shell32.dll
2018-11-15 09:54 - 2018-10-21 12:28 - 012501504 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\wmp.dll
2018-11-15 09:54 - 2018-10-21 08:48 - 005602456 _____ (Microsoft Corporation) C:\WINDOWS\system32\StartTileData.dll
2018-11-15 09:54 - 2018-10-21 08:45 - 003283512 _____ (Microsoft Corporation) C:\WINDOWS\system32\CoreUIComponents.dll
2018-11-15 09:54 - 2018-10-21 08:28 - 016592384 _____ (Microsoft Corporation) C:\WINDOWS\system32\Windows.UI.Xaml.dll
2018-11-15 09:54 - 2018-10-21 08:22 - 004710912 _____ (Microsoft Corporation) C:\WINDOWS\system32\cdp.dll
2018-11-15 09:54 - 2018-10-21 08:17 - 001826816 _____ (Microsoft Corporation) C:\WINDOWS\system32\Windows.CloudStore.dll
2018-11-15 09:54 - 2018-10-21 08:17 - 001668096 _____ (Microsoft Corporation) C:\WINDOWS\system32\cdprt.dll
2018-11-15 09:54 - 2018-10-21 08:16 - 002368512 _____ (Microsoft Corporation) C:\WINDOWS\system32\WebRuntimeManager.dll
2018-11-15 09:54 - 2018-10-21 08:15 - 003212800 _____ (Microsoft Corporation) C:\WINDOWS\system32\DWrite.dll
2018-11-15 09:54 - 2018-10-21 08:15 - 002904064 _____ (Microsoft Corporation) C:\WINDOWS\system32\wuaueng.dll
2018-11-15 09:54 - 2018-10-21 08:14 - 001854976 _____ (Microsoft Corporation) C:\WINDOWS\system32\wevtsvc.dll
2018-11-15 09:54 - 2018-10-21 08:09 - 013873664 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\Windows.UI.Xaml.dll
2018-11-15 09:54 - 2018-10-21 08:02 - 002966528 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\cdp.dll
2018-11-15 09:53 - 2018-11-01 12:49 - 000348160 _____ (Microsoft Corporation) C:\WINDOWS\system32\MusNotifyIcon.exe
2018-11-15 09:53 - 2018-11-01 12:45 - 001376672 _____ (Microsoft Corporation) C:\WINDOWS\system32\ole32.dll
2018-11-15 09:53 - 2018-11-01 12:32 - 000064000 _____ (Microsoft Corporation) C:\WINDOWS\system32\iemigplugin.dll
2018-11-15 09:53 - 2018-11-01 12:30 - 000122368 _____ (Microsoft Corporation) C:\WINDOWS\system32\musdialoghandlers.dll
2018-11-15 09:53 - 2018-11-01 12:30 - 000029696 _____ (Microsoft Corporation) C:\WINDOWS\system32\msisip.dll
2018-11-15 09:53 - 2018-11-01 12:29 - 000073728 _____ (Microsoft Corporation) C:\WINDOWS\system32\SMSRouter.dll
2018-11-15 09:53 - 2018-11-01 12:28 - 000253952 _____ (Microsoft Corporation) C:\WINDOWS\system32\prnntfy.dll
2018-11-15 09:53 - 2018-11-01 12:27 - 001121792 _____ (Microsoft Corporation) C:\WINDOWS\system32\TSWorkspace.dll
2018-11-15 09:53 - 2018-11-01 12:27 - 000878592 _____ (Microsoft Corporation) C:\WINDOWS\system32\CPFilters.dll
2018-11-15 09:53 - 2018-11-01 12:26 - 001364992 _____ (Microsoft Corporation) C:\WINDOWS\system32\bcastdvruserservice.dll
2018-11-15 09:53 - 2018-11-01 12:26 - 000503296 _____ (Microsoft Corporation) C:\WINDOWS\system32\sppcext.dll
2018-11-15 09:53 - 2018-11-01 12:26 - 000392192 _____ (Microsoft Corporation) C:\WINDOWS\system32\iedkcs32.dll
2018-11-15 09:53 - 2018-11-01 12:25 - 000577024 _____ (Microsoft Corporation) C:\WINDOWS\system32\SppExtComObj.Exe
2018-11-15 09:53 - 2018-11-01 11:09 - 001027000 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\ole32.dll
2018-11-15 09:53 - 2018-11-01 10:56 - 000226304 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\prnntfy.dll
2018-11-15 09:53 - 2018-11-01 10:56 - 000024576 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\msisip.dll
2018-11-15 09:53 - 2018-11-01 10:54 - 003397632 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\xpsrchvw.exe
2018-11-15 09:53 - 2018-11-01 10:54 - 000344576 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\iedkcs32.dll
2018-11-15 09:53 - 2018-11-01 10:53 - 000908288 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\TSWorkspace.dll
2018-11-15 09:53 - 2018-11-01 08:38 - 000269336 _____ (Microsoft Corporation) C:\WINDOWS\system32\SgrmEnclave_secure.dll
2018-11-15 09:53 - 2018-11-01 08:37 - 000272408 _____ (Microsoft Corporation) C:\WINDOWS\system32\SgrmEnclave.dll
2018-11-15 09:53 - 2018-11-01 08:28 - 001062712 _____ (Microsoft Corporation) C:\WINDOWS\system32\SecConfig.efi
2018-11-15 09:53 - 2018-11-01 08:28 - 000566568 _____ (Microsoft Corporation) C:\WINDOWS\system32\tcblaunch.exe
2018-11-15 09:53 - 2018-11-01 08:28 - 000134968 _____ (Microsoft Corporation) C:\WINDOWS\system32\hvloader.dll
2018-11-15 09:53 - 2018-11-01 08:28 - 000076088 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\hvservice.sys
2018-11-15 09:53 - 2018-11-01 08:27 - 000491200 _____ (Microsoft Corporation) C:\WINDOWS\system32\mf.dll
2018-11-15 09:53 - 2018-11-01 08:26 - 001363536 _____ (Microsoft Corporation) C:\WINDOWS\system32\WinTypes.dll
2018-11-15 09:53 - 2018-11-01 08:25 - 001934808 _____ (Microsoft Corporation) C:\WINDOWS\system32\AudioEng.dll
2018-11-15 09:53 - 2018-11-01 08:25 - 001456728 _____ (Microsoft Corporation) C:\WINDOWS\system32\winload.efi
2018-11-15 09:53 - 2018-11-01 08:25 - 001257880 _____ (Microsoft Corporation) C:\WINDOWS\system32\winload.exe
2018-11-15 09:53 - 2018-11-01 08:25 - 001209888 _____ (Microsoft Corporation) C:\WINDOWS\system32\AudioSes.dll
2018-11-15 09:53 - 2018-11-01 08:25 - 001190248 _____ (Microsoft Corporation) C:\WINDOWS\system32\rpcrt4.dll
2018-11-15 09:53 - 2018-11-01 08:25 - 001140672 _____ (Microsoft Corporation) C:\WINDOWS\system32\winresume.efi
2018-11-15 09:53 - 2018-11-01 08:25 - 000982592 _____ (Microsoft Corporation) C:\WINDOWS\system32\winresume.exe
2018-11-15 09:53 - 2018-11-01 08:25 - 000885968 _____ (Microsoft Corporation) C:\WINDOWS\system32\CoreMessaging.dll
2018-11-15 09:53 - 2018-11-01 08:25 - 000793080 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\dxgmms2.sys
2018-11-15 09:53 - 2018-11-01 08:25 - 000713472 _____ (Microsoft Corporation) C:\WINDOWS\system32\MSVideoDSP.dll
2018-11-15 09:53 - 2018-11-01 08:25 - 000594224 _____ (Microsoft Corporation) C:\WINDOWS\system32\audiodg.exe
2018-11-15 09:53 - 2018-11-01 08:25 - 000463672 _____ (Microsoft Corporation) C:\WINDOWS\system32\coml2.dll
2018-11-15 09:53 - 2018-11-01 08:25 - 000413720 _____ (Microsoft Corporation) C:\WINDOWS\system32\AUDIOKSE.dll
2018-11-15 09:53 - 2018-11-01 08:25 - 000412984 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\dxgmms1.sys
2018-11-15 09:53 - 2018-11-01 08:25 - 000375824 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\msrpc.sys
2018-11-15 09:53 - 2018-11-01 08:25 - 000268088 _____ (Microsoft Corporation) C:\WINDOWS\system32\browserbroker.dll
2018-11-15 09:53 - 2018-11-01 08:25 - 000261000 _____ (Microsoft Corporation) C:\WINDOWS\system32\mfps.dll
2018-11-15 09:53 - 2018-11-01 08:03 - 000034816 _____ (Microsoft Corporation) C:\WINDOWS\system32\dusmtask.exe
2018-11-15 09:53 - 2018-11-01 08:02 - 000047104 _____ (Microsoft Corporation) C:\WINDOWS\system32\dusmapi.dll
2018-11-15 09:53 - 2018-11-01 08:02 - 000023552 _____ (Microsoft Corporation) C:\WINDOWS\system32\CSystemEventsBrokerClient.dll
2018-11-15 09:53 - 2018-11-01 08:00 - 000433664 _____ (Microsoft Corporation) C:\WINDOWS\system32\MusNotification.exe
2018-11-15 09:53 - 2018-11-01 08:00 - 000209408 _____ (Microsoft Corporation) C:\WINDOWS\system32\AppXApplicabilityBlob.dll
2018-11-15 09:53 - 2018-11-01 07:59 - 000322048 _____ (Microsoft Corporation) C:\WINDOWS\system32\MusNotificationUx.exe
2018-11-15 09:53 - 2018-11-01 07:59 - 000241152 _____ (Microsoft Corporation) C:\WINDOWS\system32\tetheringservice.dll
2018-11-15 09:53 - 2018-11-01 07:59 - 000192000 _____ (Microsoft Corporation) C:\WINDOWS\system32\scrrun.dll
2018-11-15 09:53 - 2018-11-01 07:59 - 000176128 _____ (Microsoft Corporation) C:\WINDOWS\system32\WPTaskScheduler.dll
2018-11-15 09:53 - 2018-11-01 07:59 - 000107520 _____ (Microsoft Corporation) C:\WINDOWS\system32\dab.dll
2018-11-15 09:53 - 2018-11-01 07:58 - 000530432 _____ (Microsoft Corporation) C:\WINDOWS\system32\MapConfiguration.dll
2018-11-15 09:53 - 2018-11-01 07:58 - 000273408 _____ (Microsoft Corporation) C:\WINDOWS\system32\ubpm.dll
2018-11-15 09:53 - 2018-11-01 07:58 - 000154112 _____ (Microsoft Corporation) C:\WINDOWS\system32\Chakradiag.dll
2018-11-15 09:53 - 2018-11-01 07:58 - 000149504 _____ (Microsoft Corporation) C:\WINDOWS\system32\dssvc.dll
2018-11-15 09:53 - 2018-11-01 07:57 - 003381248 _____ (Microsoft Corporation) C:\WINDOWS\system32\MapRouter.dll
2018-11-15 09:53 - 2018-11-01 07:57 - 002825728 _____ (Microsoft Corporation) C:\WINDOWS\system32\MapGeocoder.dll
2018-11-15 09:53 - 2018-11-01 07:57 - 002364928 _____ (Microsoft Corporation) C:\WINDOWS\system32\OpcServices.dll
2018-11-15 09:53 - 2018-11-01 07:57 - 001708544 _____ (Microsoft Corporation) C:\WINDOWS\system32\MSPhotography.dll
2018-11-15 09:53 - 2018-11-01 07:57 - 000898560 _____ (Microsoft Corporation) C:\WINDOWS\system32\MusUpdateHandlers.dll
2018-11-15 09:53 - 2018-11-01 07:57 - 000894464 _____ (Microsoft Corporation) C:\WINDOWS\system32\webplatstorageserver.dll
2018-11-15 09:53 - 2018-11-01 07:57 - 000835584 _____ (Microsoft Corporation) C:\WINDOWS\system32\PhoneService.dll
2018-11-15 09:53 - 2018-11-01 07:57 - 000808448 _____ (Microsoft Corporation) C:\WINDOWS\system32\EdgeManager.dll
2018-11-15 09:53 - 2018-11-01 07:57 - 000726528 _____ (Microsoft Corporation) C:\WINDOWS\system32\jscript9diag.dll
2018-11-15 09:53 - 2018-11-01 07:57 - 000356352 _____ (Microsoft Corporation) C:\WINDOWS\system32\dusmsvc.dll
2018-11-15 09:53 - 2018-11-01 07:57 - 000281600 _____ (Microsoft Corporation) C:\WINDOWS\system32\SystemEventsBrokerServer.dll
2018-11-15 09:53 - 2018-11-01 07:57 - 000265728 _____ (Microsoft Corporation) C:\WINDOWS\system32\psmsrv.dll
2018-11-15 09:53 - 2018-11-01 07:56 - 002929664 _____ (Microsoft Corporation) C:\WINDOWS\system32\xpsservices.dll
2018-11-15 09:53 - 2018-11-01 07:56 - 002172928 _____ (Microsoft Corporation) C:\WINDOWS\system32\AppXDeploymentExtensions.onecore.dll
2018-11-15 09:53 - 2018-11-01 07:56 - 000506880 _____ (Microsoft Corporation) C:\WINDOWS\system32\netprofmsvc.dll
2018-11-15 09:53 - 2018-11-01 07:55 - 001058304 _____ (Microsoft Corporation) C:\WINDOWS\system32\SearchIndexer.exe
2018-11-15 09:53 - 2018-11-01 07:55 - 000684544 _____ (Microsoft Corporation) C:\WINDOWS\system32\AudioEndpointBuilder.dll
2018-11-15 09:53 - 2018-11-01 07:54 - 001679360 _____ (Microsoft Corporation) C:\WINDOWS\system32\wwansvc.dll
2018-11-15 09:53 - 2018-11-01 07:54 - 001551360 _____ (Microsoft Corporation) C:\WINDOWS\system32\AppXDeploymentExtensions.desktop.dll
2018-11-15 09:53 - 2018-11-01 07:54 - 001264640 _____ (Microsoft Corporation) C:\WINDOWS\system32\JpMapControl.dll
2018-11-15 09:53 - 2018-11-01 07:54 - 001225216 _____ (Microsoft Corporation) C:\WINDOWS\system32\MapsStore.dll
2018-11-15 09:53 - 2018-11-01 07:54 - 001023488 _____ (Microsoft Corporation) C:\WINDOWS\system32\ShareHost.dll
2018-11-15 09:53 - 2018-11-01 07:54 - 000943616 _____ (Microsoft Corporation) C:\WINDOWS\system32\BingOnlineServices.dll
2018-11-15 09:53 - 2018-11-01 07:54 - 000916480 _____ (Microsoft Corporation) C:\WINDOWS\system32\Windows.Security.Authentication.Web.Core.dll
2018-11-15 09:53 - 2018-11-01 07:54 - 000895488 _____ (Microsoft Corporation) C:\WINDOWS\system32\Windows.Security.Authentication.OnlineId.dll
2018-11-15 09:53 - 2018-11-01 07:54 - 000884736 _____ (Microsoft Corporation) C:\WINDOWS\system32\MapControlCore.dll
2018-11-15 09:53 - 2018-11-01 07:54 - 000796672 _____ (Microsoft Corporation) C:\WINDOWS\system32\mssvp.dll
2018-11-15 09:53 - 2018-11-01 07:54 - 000606208 _____ (Microsoft Corporation) C:\WINDOWS\system32\updatehandlers.dll
2018-11-15 09:53 - 2018-11-01 07:53 - 001373696 _____ (Microsoft Corporation) C:\WINDOWS\system32\usocore.dll
2018-11-15 09:53 - 2018-11-01 07:53 - 000889344 _____ (Microsoft Corporation) C:\WINDOWS\system32\schedsvc.dll
2018-11-15 09:53 - 2018-11-01 07:53 - 000542208 _____ (Microsoft Corporation) C:\WINDOWS\system32\vbscript.dll
2018-11-15 09:53 - 2018-11-01 07:53 - 000406528 _____ (Microsoft Corporation) C:\WINDOWS\system32\SearchProtocolHost.exe
2018-11-15 09:53 - 2018-11-01 06:39 - 000001310 _____ C:\WINDOWS\system32\tcbres.wim
2018-11-15 09:53 - 2018-11-01 06:08 - 002417952 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\d3d11.dll
2018-11-15 09:53 - 2018-11-01 05:50 - 000786288 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\rpcrt4.dll
2018-11-15 09:53 - 2018-11-01 05:48 - 001805656 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\AudioEng.dll
2018-11-15 09:53 - 2018-11-01 05:48 - 001011872 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\AudioSes.dll
2018-11-15 09:53 - 2018-11-01 05:48 - 000880248 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\WinTypes.dll
2018-11-15 09:53 - 2018-11-01 05:48 - 000384520 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\coml2.dll
2018-11-15 09:53 - 2018-11-01 05:47 - 000581600 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\MSVideoDSP.dll
2018-11-15 09:53 - 2018-11-01 05:47 - 000567256 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\CoreMessaging.dll
2018-11-15 09:53 - 2018-11-01 05:47 - 000129304 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\mfps.dll
2018-11-15 09:53 - 2018-11-01 05:32 - 006647296 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\BingMaps.dll
2018-11-15 09:53 - 2018-11-01 05:31 - 005307904 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\d2d1.dll
2018-11-15 09:53 - 2018-11-01 05:31 - 000288768 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\Search.ProtocolHandler.MAPI2.dll
2018-11-15 09:53 - 2018-11-01 05:30 - 002449408 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\MapRouter.dll
2018-11-15 09:53 - 2018-11-01 05:30 - 001361408 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\MSPhotography.dll
2018-11-15 09:53 - 2018-11-01 05:30 - 000561152 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\jscript9diag.dll
2018-11-15 09:53 - 2018-11-01 05:30 - 000392704 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\MapConfiguration.dll
2018-11-15 09:53 - 2018-11-01 05:30 - 000310272 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\wincorlib.dll
2018-11-15 09:53 - 2018-11-01 05:29 - 002258944 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\mssrch.dll
2018-11-15 09:53 - 2018-11-01 05:29 - 001986560 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\MapGeocoder.dll
2018-11-15 09:53 - 2018-11-01 05:29 - 001862656 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\xpsservices.dll
2018-11-15 09:53 - 2018-11-01 05:29 - 000848384 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\ShareHost.dll
2018-11-15 09:53 - 2018-11-01 05:29 - 000608768 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\EdgeManager.dll
2018-11-15 09:53 - 2018-11-01 05:29 - 000578560 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\webplatstorageserver.dll
2018-11-15 09:53 - 2018-11-01 05:29 - 000165376 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\scrrun.dll
2018-11-15 09:53 - 2018-11-01 05:28 - 001348096 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\OpcServices.dll
2018-11-15 09:53 - 2018-11-01 05:28 - 001000448 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\TokenBroker.dll
2018-11-15 09:53 - 2018-11-01 05:28 - 000978944 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\JpMapControl.dll
2018-11-15 09:53 - 2018-11-01 05:27 - 001627648 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\urlmon.dll
2018-11-15 09:53 - 2018-11-01 05:27 - 000856576 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\SearchIndexer.exe
2018-11-15 09:53 - 2018-11-01 05:27 - 000713216 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\BingOnlineServices.dll
2018-11-15 09:53 - 2018-11-01 05:27 - 000678400 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\Windows.Security.Authentication.Web.Core.dll
2018-11-15 09:53 - 2018-11-01 05:27 - 000534016 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\vbscript.dll
2018-11-15 09:53 - 2018-11-01 05:26 - 000795648 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\Windows.Security.Authentication.OnlineId.dll
2018-11-15 09:53 - 2018-11-01 05:26 - 000735744 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\mssvp.dll
2018-11-15 09:53 - 2018-11-01 05:26 - 000345088 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\SearchProtocolHost.exe
2018-11-15 09:53 - 2018-10-21 14:00 - 001639560 _____ (Microsoft Corporation) C:\WINDOWS\system32\user32.dll
2018-11-15 09:53 - 2018-10-21 14:00 - 000790416 _____ (Microsoft Corporation) C:\WINDOWS\system32\fontdrvhost.exe
2018-11-15 09:53 - 2018-10-21 14:00 - 000396304 _____ (Adobe Systems Incorporated) C:\WINDOWS\system32\atmfd.dll
2018-11-15 09:53 - 2018-10-21 13:59 - 000766480 _____ (Microsoft Corporation) C:\WINDOWS\system32\LicensingWinRT.dll
2018-11-15 09:53 - 2018-10-21 13:59 - 000236728 _____ (Microsoft Corporation) C:\WINDOWS\system32\EditionUpgradeManagerObj.dll
2018-11-15 09:53 - 2018-10-21 13:45 - 000123392 _____ (Microsoft Corporation) C:\WINDOWS\system32\fontsub.dll
2018-11-15 09:53 - 2018-10-21 13:44 - 000623104 _____ (Microsoft Corporation) C:\WINDOWS\system32\osk.exe
2018-11-15 09:53 - 2018-10-21 13:44 - 000085504 _____ (Microsoft Corporation) C:\WINDOWS\system32\INETRES.dll
2018-11-15 09:53 - 2018-10-21 13:43 - 000345600 _____ (Microsoft Corporation) C:\WINDOWS\system32\AcGenral.dll
2018-11-15 09:53 - 2018-10-21 13:43 - 000276992 _____ (Microsoft Corporation) C:\WINDOWS\system32\wisp.dll
2018-11-15 09:53 - 2018-10-21 13:43 - 000182784 _____ (Microsoft Corporation) C:\WINDOWS\system32\LanguageComponentsInstaller.dll
2018-11-15 09:53 - 2018-10-21 13:42 - 001127936 _____ (Microsoft Corporation) C:\WINDOWS\system32\nettrace.dll
2018-11-15 09:53 - 2018-10-21 13:42 - 000765440 _____ (Microsoft Corporation) C:\WINDOWS\system32\tdh.dll
2018-11-15 09:53 - 2018-10-21 13:42 - 000592896 _____ (Microsoft Corporation) C:\WINDOWS\system32\UserLanguagesCpl.dll
2018-11-15 09:53 - 2018-10-21 13:42 - 000181248 _____ (Microsoft Corporation) C:\WINDOWS\system32\EditionUpgradeHelper.dll
2018-11-15 09:53 - 2018-10-21 13:41 - 001180672 _____ (Microsoft Corporation) C:\WINDOWS\system32\localspl.dll
2018-11-15 09:53 - 2018-10-21 12:38 - 000662312 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\fontdrvhost.exe
2018-11-15 09:53 - 2018-10-21 12:38 - 000660480 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\LicensingWinRT.dll
2018-11-15 09:53 - 2018-10-21 12:38 - 000221216 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\EditionUpgradeManagerObj.dll
2018-11-15 09:53 - 2018-10-21 12:37 - 001626656 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\user32.dll
2018-11-15 09:53 - 2018-10-21 12:28 - 000084992 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\INETRES.dll
2018-11-15 09:53 - 2018-10-21 12:23 - 000622080 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\tdh.dll
2018-11-15 09:53 - 2018-10-21 12:23 - 000523264 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\UserLanguagesCpl.dll
2018-11-15 09:53 - 2018-10-21 12:22 - 002405888 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\AcGenral.dll
2018-11-15 09:53 - 2018-10-21 12:22 - 000224256 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\wisp.dll
2018-11-15 09:53 - 2018-10-21 10:29 - 001008640 _____ (Microsoft Corporation) C:\WINDOWS\system32\Windows.Media.MixedRealityCapture.dll
2018-11-15 09:53 - 2018-10-21 09:44 - 000868864 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\Windows.Media.MixedRealityCapture.dll
2018-11-15 09:53 - 2018-10-21 08:47 - 000368440 _____ (Microsoft Corporation) C:\WINDOWS\system32\thumbcache.dll
2018-11-15 09:53 - 2018-10-21 08:46 - 000717112 _____ (Microsoft Corporation) C:\WINDOWS\system32\SettingsHandlers_StorageSense.dll
2018-11-15 09:53 - 2018-10-21 08:46 - 000709936 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\cng.sys
2018-11-15 09:53 - 2018-10-21 08:46 - 000611640 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\spaceport.sys
2018-11-15 09:53 - 2018-10-21 08:46 - 000560136 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\storport.sys
2018-11-15 09:53 - 2018-10-21 08:46 - 000497864 _____ (Microsoft Corporation) C:\WINDOWS\system32\Windows.Devices.Enumeration.dll
2018-11-15 09:53 - 2018-10-21 08:46 - 000171024 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\ksecpkg.sys
2018-11-15 09:53 - 2018-10-21 08:45 - 002719032 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\tcpip.sys
2018-11-15 09:53 - 2018-10-21 08:45 - 001946208 _____ (Microsoft Corporation) C:\WINDOWS\system32\ntdll.dll
2018-11-15 09:53 - 2018-10-21 08:45 - 001098064 _____ (Microsoft Corporation) C:\WINDOWS\system32\msvproc.dll
2018-11-15 09:53 - 2018-10-21 08:45 - 000607136 _____ (Microsoft Corporation) C:\WINDOWS\system32\TextInputFramework.dll
2018-11-15 09:53 - 2018-10-21 08:45 - 000185120 _____ (Microsoft Corporation) C:\WINDOWS\system32\sspicli.dll
2018-11-15 09:53 - 2018-10-21 08:45 - 000175624 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\spacedump.sys
2018-11-15 09:53 - 2018-10-21 08:45 - 000139792 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\ksecdd.sys
2018-11-15 09:53 - 2018-10-21 08:45 - 000058088 _____ (Microsoft Corporation) C:\WINDOWS\system32\lsass.exe
2018-11-15 09:53 - 2018-10-21 08:21 - 001589248 _____ (Microsoft Corporation) C:\WINDOWS\system32\Windows.Globalization.dll
2018-11-15 09:53 - 2018-10-21 08:21 - 000123424 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\sspicli.dll
2018-11-15 09:53 - 2018-10-21 08:20 - 000424000 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\Windows.Devices.Enumeration.dll
2018-11-15 09:53 - 2018-10-21 08:20 - 000295224 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\thumbcache.dll
2018-11-15 09:53 - 2018-10-21 08:20 - 000161792 _____ (Microsoft Corporation) C:\WINDOWS\system32\spacebridge.dll
2018-11-15 09:53 - 2018-10-21 08:20 - 000141312 _____ C:\WINDOWS\system32\DataStoreCacheDumpTool.exe
2018-11-15 09:53 - 2018-10-21 08:20 - 000050688 _____ (Microsoft Corporation) C:\WINDOWS\system32\wcimage.dll
2018-11-15 09:53 - 2018-10-21 08:19 - 002487088 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\CoreUIComponents.dll
2018-11-15 09:53 - 2018-10-21 08:19 - 001620776 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\ntdll.dll
2018-11-15 09:53 - 2018-10-21 08:19 - 001130768 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\msvproc.dll
2018-11-15 09:53 - 2018-10-21 08:19 - 000514560 _____ (Microsoft Corporation) C:\WINDOWS\system32\nltest.exe
2018-11-15 09:53 - 2018-10-21 08:19 - 000505616 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\TextInputFramework.dll
2018-11-15 09:53 - 2018-10-21 08:19 - 000463360 _____ (Microsoft Corporation) C:\WINDOWS\system32\wlansec.dll
2018-11-15 09:53 - 2018-10-21 08:19 - 000409088 _____ (Microsoft Corporation) C:\WINDOWS\system32\wlanmsm.dll
2018-11-15 09:53 - 2018-10-21 08:19 - 000228864 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\winnat.sys
2018-11-15 09:53 - 2018-10-21 08:19 - 000228352 _____ (Microsoft Corporation) C:\WINDOWS\system32\Windows.Web.Diagnostics.dll
2018-11-15 09:53 - 2018-10-21 08:19 - 000137728 _____ (Microsoft Corporation) C:\WINDOWS\system32\InputLocaleManager.dll
2018-11-15 09:53 - 2018-10-21 08:19 - 000112128 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\bthhfenum.sys
2018-11-15 09:53 - 2018-10-21 08:19 - 000086528 _____ (Microsoft Corporation) C:\WINDOWS\system32\ofdeploy.exe
2018-11-15 09:53 - 2018-10-21 08:19 - 000060928 _____ (Microsoft Corporation) C:\WINDOWS\system32\BthAvrcpAppSvc.dll
2018-11-15 09:53 - 2018-10-21 08:19 - 000036352 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\vhf.sys
2018-11-15 09:53 - 2018-10-21 08:19 - 000028672 _____ (Microsoft Corporation) C:\WINDOWS\system32\sspisrv.dll
2018-11-15 09:53 - 2018-10-21 08:18 - 000761344 _____ (Microsoft Corporation) C:\WINDOWS\system32\nshwfp.dll
2018-11-15 09:53 - 2018-10-21 08:18 - 000461824 _____ (Microsoft Corporation) C:\WINDOWS\system32\Windows.Data.Activities.dll
2018-11-15 09:53 - 2018-10-21 08:18 - 000395264 _____ (Microsoft Corporation) C:\WINDOWS\system32\BthAvctpSvc.dll
2018-11-15 09:53 - 2018-10-21 08:18 - 000275456 _____ (Microsoft Corporation) C:\WINDOWS\system32\scecli.dll
2018-11-15 09:53 - 2018-10-21 08:18 - 000274432 _____ (Microsoft Corporation) C:\WINDOWS\system32\DAFWSD.dll
2018-11-15 09:53 - 2018-10-21 08:18 - 000130048 _____ (Microsoft Corporation) C:\WINDOWS\system32\officecsp.dll
2018-11-15 09:53 - 2018-10-21 08:18 - 000030720 _____ (Microsoft Corporation) C:\WINDOWS\system32\seclogon.dll
2018-11-15 09:53 - 2018-10-21 08:17 - 000787456 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\WdiWiFi.sys
2018-11-15 09:53 - 2018-10-21 08:17 - 000625152 _____ (Microsoft Corporation) C:\WINDOWS\system32\PsmServiceExtHost.dll
2018-11-15 09:53 - 2018-10-21 08:17 - 000473600 _____ (Microsoft Corporation) C:\WINDOWS\system32\schannel.dll
2018-11-15 09:53 - 2018-10-21 08:17 - 000311296 _____ (Microsoft Corporation) C:\WINDOWS\system32\BthAvrcp.dll
2018-11-15 09:53 - 2018-10-21 08:17 - 000271872 _____ (Microsoft Corporation) C:\WINDOWS\system32\dafBth.dll
2018-11-15 09:53 - 2018-10-21 08:16 - 002584576 _____ (Microsoft Corporation) C:\WINDOWS\system32\wlansvc.dll
2018-11-15 09:53 - 2018-10-21 08:16 - 001535488 _____ (Microsoft Corporation) C:\WINDOWS\system32\lsasrv.dll
2018-11-15 09:53 - 2018-10-21 08:16 - 000847360 _____ (Microsoft Corporation) C:\WINDOWS\system32\bisrv.dll
2018-11-15 09:53 - 2018-10-21 08:16 - 000514048 _____ (Microsoft Corporation) C:\WINDOWS\system32\BTAGService.dll
2018-11-15 09:53 - 2018-10-21 08:16 - 000323584 _____ (Microsoft Corporation) C:\WINDOWS\system32\AppxAllUserStore.dll
2018-11-15 09:53 - 2018-10-21 08:15 - 000743936 _____ (Microsoft Corporation) C:\WINDOWS\system32\PrintRenderAPIHost.DLL
2018-11-15 09:53 - 2018-10-21 08:15 - 000401920 _____ (Microsoft Corporation) C:\WINDOWS\system32\rascustom.dll
2018-11-15 09:53 - 2018-10-21 08:14 - 002224640 _____ (Microsoft Corporation) C:\WINDOWS\system32\win32kbase.sys
2018-11-15 09:53 - 2018-10-21 08:14 - 001919488 _____ (Microsoft Corporation) C:\WINDOWS\system32\FntCache.dll
2018-11-15 09:53 - 2018-10-21 08:14 - 001097216 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\bthport.sys
2018-11-15 09:53 - 2018-10-21 08:14 - 001034752 _____ (Microsoft Corporation) C:\WINDOWS\system32\modernexecserver.dll
2018-11-15 09:53 - 2018-10-21 08:14 - 000932352 _____ (Microsoft Corporation) C:\WINDOWS\system32\rasmans.dll
2018-11-15 09:53 - 2018-10-21 08:14 - 000632320 _____ (Microsoft Corporation) C:\WINDOWS\system32\cdpsvc.dll
2018-11-15 09:53 - 2018-10-21 08:14 - 000453632 _____ (Microsoft Corporation) C:\WINDOWS\system32\cdpusersvc.dll
2018-11-15 09:53 - 2018-10-21 08:14 - 000311296 _____ (Microsoft Corporation) C:\WINDOWS\system32\EnterpriseAppMgmtSvc.dll
2018-11-15 09:53 - 2018-10-21 08:02 - 000157184 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\spacebridge.dll
2018-11-15 09:53 - 2018-10-21 08:01 - 001189376 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\Windows.Globalization.dll
2018-11-15 09:53 - 2018-10-21 08:01 - 000168448 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\Windows.Web.Diagnostics.dll
2018-11-15 09:53 - 2018-10-21 08:00 - 000214528 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\scecli.dll
2018-11-15 09:53 - 2018-10-21 07:59 - 000602112 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\nshwfp.dll
2018-11-15 09:53 - 2018-10-21 07:58 - 001124352 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\cdprt.dll
2018-11-15 09:53 - 2018-10-21 07:58 - 000415744 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\schannel.dll
2018-11-15 09:53 - 2018-10-21 07:58 - 000230912 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\AppxAllUserStore.dll
2018-11-15 09:53 - 2018-10-21 07:57 - 002611200 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\DWrite.dll
2018-11-15 09:53 - 2018-10-21 06:59 - 000806320 _____ C:\WINDOWS\SysWOW64\locale.nls
2018-11-15 09:53 - 2018-10-21 06:59 - 000806320 _____ C:\WINDOWS\system32\locale.nls
2018-11-15 09:53 - 2018-04-28 05:02 - 000144384 _____ (Microsoft Corporation) C:\WINDOWS\system32\mssprxy.dll
2018-11-10 14:01 - 2018-11-10 15:27 - 000001024 ____H C:\AMTAG.BIN
2018-11-10 14:01 - 2018-11-10 14:01 - 000000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\AOMEI Partition Assistant Standard Edition 7.5.1
2018-11-10 14:01 - 2018-11-10 14:01 - 000000000 ____D C:\ProgramData\AomeiBR
2018-11-10 14:00 - 2018-10-10 11:23 - 002164080 _____ C:\WINDOWS\ampa.exe
2018-11-10 14:00 - 2017-02-28 14:20 - 000038320 _____ C:\WINDOWS\SysWOW64\ampa.sys
2018-11-10 14:00 - 2017-02-28 14:20 - 000038320 _____ C:\WINDOWS\system32\ampa.sys
2018-11-10 13:59 - 2018-11-10 14:30 - 000000000 ____D C:\Program Files (x86)\AOMEI Partition Assistant Standard Edition 7.5.1
2018-11-06 11:58 - 2018-10-31 21:38 - 015218720 _____ (Yamaha Corporation) C:\WINDOWS\system32\YamahaAE3.dll
2018-11-06 11:58 - 2018-10-31 21:38 - 003306920 _____ (Yamaha Corporation) C:\WINDOWS\system32\YamahaAE2.dll
2018-11-06 11:58 - 2018-10-31 21:38 - 002198080 _____ (Yamaha Corporation) C:\WINDOWS\system32\YamahaAE.dll
2018-11-06 11:57 - 2018-10-31 21:38 - 005346888 _____ (Dolby Laboratories) C:\WINDOWS\system32\DolbyDAX2APOv211.dll
2018-11-06 11:57 - 2018-10-31 21:38 - 003762704 _____ (Realtek Semiconductor Corp.) C:\WINDOWS\system32\RltkAPO64.dll
2018-11-06 11:57 - 2018-10-31 21:38 - 003418120 _____ (DTS, Inc.) C:\WINDOWS\system32\slcnt64.dll
2018-11-06 11:57 - 2018-10-31 21:38 - 003319520 _____ (Realtek Semiconductor Corp.) C:\WINDOWS\system32\RtkApi64.dll
2018-11-06 11:57 - 2018-10-31 21:38 - 003282120 _____ (Realtek Semiconductor Corp.) C:\WINDOWS\SysWOW64\RltkAPO.dll
2018-11-06 11:57 - 2018-10-31 21:38 - 003128912 _____ (DTS, Inc.) C:\WINDOWS\system32\sltech64.dll
2018-11-06 11:57 - 2018-10-31 21:38 - 002444576 _____ (Dolby Laboratories) C:\WINDOWS\system32\DolbyDAX2APOv201.dll
2018-11-06 11:57 - 2018-10-31 21:38 - 001787848 _____ (DTS) C:\WINDOWS\system32\DTSS2SpeakerDLL64.dll
2018-11-06 11:57 - 2018-10-31 21:38 - 001598288 _____ (DTS) C:\WINDOWS\system32\DTSS2HeadphoneDLL64.dll
2018-11-06 11:57 - 2018-10-31 21:38 - 001516160 _____ (DTS) C:\WINDOWS\system32\DTSBoostDLL64.dll
2018-11-06 11:57 - 2018-10-31 21:38 - 001448864 _____ (Dolby Laboratories) C:\WINDOWS\system32\DolbyAPOv251gm.dll
2018-11-06 11:57 - 2018-10-31 21:38 - 001435248 _____ (Synopsys, Inc.) C:\WINDOWS\system32\SRRPTR64.dll
2018-11-06 11:57 - 2018-10-31 21:38 - 001396272 _____ (Sound Research, Corp.) C:\WINDOWS\system32\SECOMN64.dll
2018-11-06 11:57 - 2018-10-31 21:38 - 001382360 _____ (TOSHIBA Corporation) C:\WINDOWS\system32\tosade.dll
2018-11-06 11:57 - 2018-10-31 21:38 - 001353424 _____ (Realtek Semiconductor Corp.) C:\WINDOWS\system32\RTCOM64.dll
2018-11-06 11:57 - 2018-10-31 21:38 - 001337744 _____ (Toshiba Client Solutions Co., Ltd.) C:\WINDOWS\system32\tossaeapo64.dll
2018-11-06 11:57 - 2018-10-31 21:38 - 001318952 _____ (Sound Research, Corp.) C:\WINDOWS\system32\SEHDHF64.dll
2018-11-06 11:57 - 2018-10-31 21:38 - 001282656 _____ (Sound Research, Corp.) C:\WINDOWS\system32\SEAPO64.dll
2018-11-06 11:57 - 2018-10-31 21:38 - 001259624 _____ (Dolby Laboratories) C:\WINDOWS\system32\DolbyDAX2APOvlldp.dll
2018-11-06 11:57 - 2018-10-31 21:38 - 001180624 _____ (Sound Research, Corp.) C:\WINDOWS\system32\SEHDRA64.dll
2018-11-06 11:57 - 2018-10-31 21:38 - 001164512 _____ (Dolby Laboratories) C:\WINDOWS\system32\DolbyAPOvlldpgm.dll
2018-11-06 11:57 - 2018-10-31 21:38 - 001073800 _____ (Sound Research, Corp.) C:\WINDOWS\SysWOW64\SECOMN32.dll
2018-11-06 11:57 - 2018-10-31 21:38 - 001027928 _____ (Sound Research, Corp.) C:\WINDOWS\SysWOW64\SEHDHF32.dll
2018-11-06 11:57 - 2018-10-31 21:38 - 000994784 _____ (DTS, Inc.) C:\WINDOWS\system32\sl3apo64.dll
2018-11-06 11:57 - 2018-10-31 21:38 - 000965128 _____ (Sony Corporation) C:\WINDOWS\system32\SFSS_APO.dll
2018-11-06 11:57 - 2018-10-31 21:38 - 000884368 _____ (ICEpower a/s) C:\WINDOWS\system32\ICEsoundAPO64.dll
2018-11-06 11:57 - 2018-10-31 21:38 - 000873560 _____ (TOSHIBA Corporation) C:\WINDOWS\system32\tadefxapo264.dll
2018-11-06 11:57 - 2018-10-31 21:38 - 000852240 _____ (Toshiba Client Solutions Co., Ltd.) C:\WINDOWS\system32\tosasfapo64.dll
2018-11-06 11:57 - 2018-10-31 21:38 - 000751192 _____ (DTS) C:\WINDOWS\system32\DTSBassEnhancementDLL64.dll
2018-11-06 11:57 - 2018-10-31 21:38 - 000734664 _____ (DTS) C:\WINDOWS\system32\DTSSymmetryDLL64.dll
2018-11-06 11:57 - 2018-10-31 21:38 - 000715544 _____ (DTS) C:\WINDOWS\system32\DTSVoiceClarityDLL64.dll
2018-11-06 11:57 - 2018-10-31 21:38 - 000692264 _____ (Realtek Semiconductor Corp.) C:\WINDOWS\system32\RtDataProc64.dll
2018-11-06 11:57 - 2018-10-31 21:38 - 000604896 _____ (Toshiba Client Solutions Co., Ltd.) C:\WINDOWS\system32\tossaemaxapo64.dll
2018-11-06 11:57 - 2018-10-31 21:38 - 000541224 _____ (SRS Labs, Inc.) C:\WINDOWS\system32\SRSTSX64.dll
2018-11-06 11:57 - 2018-10-31 21:38 - 000511536 _____ (DTS) C:\WINDOWS\system32\DTSNeoPCDLL64.dll
2018-11-06 11:57 - 2018-10-31 21:38 - 000467264 _____ (Synopsys, Inc.) C:\WINDOWS\system32\SRAPO64.dll
2018-11-06 11:57 - 2018-10-31 21:38 - 000453168 _____ (Dolby Laboratories) C:\WINDOWS\system32\R4EED64A.dll
2018-11-06 11:57 - 2018-10-31 21:38 - 000452632 _____ (DTS) C:\WINDOWS\system32\DTSLimiterDLL64.dll
2018-11-06 11:57 - 2018-10-31 21:38 - 000448496 _____ (DTS) C:\WINDOWS\system32\DTSGainCompensatorDLL64.dll
2018-11-06 11:57 - 2018-10-31 21:38 - 000447304 _____ (Toshiba Client Solutions Co., Ltd.) C:\WINDOWS\system32\toseaeapo64.dll
2018-11-06 11:57 - 2018-10-31 21:38 - 000406344 _____ (Dolby Laboratories) C:\WINDOWS\system32\HiFiDAX2APIPCLL.dll
2018-11-06 11:57 - 2018-10-31 21:38 - 000392976 _____ (Dolby Laboratories, Inc.) C:\WINDOWS\system32\RTEEP64A.dll
2018-11-06 11:57 - 2018-10-31 21:38 - 000381512 _____ (Synopsys, Inc.) C:\WINDOWS\system32\SRCOM64.dll
2018-11-06 11:57 - 2018-10-31 21:38 - 000366016 _____ (Windows (R) Win 7 DDK provider) C:\WINDOWS\system32\HMAPO.dll
2018-11-06 11:57 - 2018-10-31 21:38 - 000360240 _____ (Harman) C:\WINDOWS\system32\HMClariFi.dll
2018-11-06 11:57 - 2018-10-31 21:38 - 000343808 _____ (Realtek Semiconductor Corp.) C:\WINDOWS\system32\RtlCPAPI64.dll
2018-11-06 11:57 - 2018-10-31 21:38 - 000341248 _____ (Synopsys, Inc.) C:\WINDOWS\SysWOW64\SRCOM.dll
2018-11-06 11:57 - 2018-10-31 21:38 - 000341248 _____ (Synopsys, Inc.) C:\WINDOWS\system32\SRCOM.dll
2018-11-06 11:57 - 2018-10-31 21:38 - 000327376 _____ (Dolby Laboratories, Inc.) C:\WINDOWS\system32\RP3DHT64.dll
2018-11-06 11:57 - 2018-10-31 21:38 - 000327376 _____ (Dolby Laboratories, Inc.) C:\WINDOWS\system32\RP3DAA64.dll
2018-11-06 11:57 - 2018-10-31 21:38 - 000261128 _____ (DTS) C:\WINDOWS\system32\DTSGFXAPO64.dll
2018-11-06 11:57 - 2018-10-31 21:38 - 000261096 _____ (DTS) C:\WINDOWS\system32\DTSLFXAPO64.dll
2018-11-06 11:57 - 2018-10-31 21:38 - 000260104 _____ (DTS) C:\WINDOWS\system32\DTSGFXAPONS64.dll
2018-11-06 11:57 - 2018-10-31 21:38 - 000232024 _____ (Synopsys, Inc.) C:\WINDOWS\system32\SFNHK64.dll
2018-11-06 11:57 - 2018-10-31 21:38 - 000230808 _____ (SRS Labs, Inc.) C:\WINDOWS\system32\SRSTSH64.dll
2018-11-06 11:57 - 2018-10-31 21:38 - 000220512 _____ (Dolby Laboratories, Inc.) C:\WINDOWS\system32\RTEED64A.dll
2018-11-06 11:57 - 2018-10-31 21:38 - 000218376 _____ (SRS Labs, Inc.) C:\WINDOWS\system32\SRSHP64.dll
2018-11-06 11:57 - 2018-10-31 21:38 - 000203736 _____ (Harman) C:\WINDOWS\system32\HMHVS.dll
2018-11-06 11:57 - 2018-10-31 21:38 - 000193088 _____ (Realtek Semiconductor Corp.) C:\WINDOWS\system32\RtkCfg64.dll
2018-11-06 11:57 - 2018-10-31 21:38 - 000190824 _____ (Harman) C:\WINDOWS\system32\HMEQ_Voice.dll
2018-11-06 11:57 - 2018-10-31 21:38 - 000190824 _____ (Harman) C:\WINDOWS\system32\HMEQ.dll
2018-11-06 11:57 - 2018-10-31 21:38 - 000179488 _____ (Harman) C:\WINDOWS\system32\HMLimiter.dll
2018-11-06 11:57 - 2018-10-31 21:38 - 000175040 _____ (SRS Labs, Inc.) C:\WINDOWS\system32\SRSWOW64.dll
2018-11-06 11:57 - 2018-10-31 21:38 - 000158800 _____ (TOSHIBA Corporation) C:\WINDOWS\system32\tadefxapo.dll
2018-11-06 11:57 - 2018-10-31 21:38 - 000157240 _____ (Dolby Laboratories) C:\WINDOWS\system32\R4EEL64A.dll
2018-11-06 11:57 - 2018-10-31 21:38 - 000139648 _____ (Dolby Laboratories) C:\WINDOWS\system32\R4EEA64A.dll
2018-11-06 11:57 - 2018-10-31 21:38 - 000116648 _____ (Dolby Laboratories, Inc.) C:\WINDOWS\system32\RTEEL64A.dll
2018-11-06 11:57 - 2018-10-31 21:38 - 000094008 _____ (Dolby Laboratories, Inc.) C:\WINDOWS\system32\RTEEG64A.dll
2018-11-06 11:57 - 2018-10-31 21:38 - 000091016 _____ (Synopsys, Inc.) C:\WINDOWS\system32\SFCOM64.dll
2018-11-06 11:57 - 2018-10-31 21:38 - 000090064 _____ (Dolby Laboratories) C:\WINDOWS\system32\R4EEG64A.dll
2018-11-06 11:57 - 2018-10-31 21:38 - 000088424 _____ (Synopsys, Inc.) C:\WINDOWS\system32\SFAPO64.dll
2018-11-06 11:57 - 2018-10-31 21:38 - 000083728 _____ (Virage Logic Corporation / Sonic Focus) C:\WINDOWS\SysWOW64\SFCOM.dll
2018-11-06 11:57 - 2018-10-31 21:38 - 000075640 _____ (TOSHIBA CORPORATION.) C:\WINDOWS\system32\tepeqapo64.dll
2018-11-06 11:57 - 2018-10-31 21:37 - 002992272 _____ (Audyssey Labs) C:\WINDOWS\system32\AudysseyEfx.dll
2018-11-06 11:57 - 2018-10-31 21:37 - 001971456 _____ (Dolby Laboratories) C:\WINDOWS\system32\DDPD64A.dll
2018-11-06 11:57 - 2018-10-31 21:37 - 001965248 _____ (Dolby Laboratories) C:\WINDOWS\system32\DDPD64AF3.dll
2018-11-06 11:57 - 2018-10-31 21:37 - 001544344 _____ (Dolby Laboratories) C:\WINDOWS\system32\DAX3APOProp.dll
2018-11-06 11:57 - 2018-10-31 21:37 - 001372480 _____ (Dolby Laboratories) C:\WINDOWS\system32\DAX3APOv251.dll
2018-11-06 11:57 - 2018-10-31 21:37 - 000367696 _____ (Dolby Laboratories) C:\WINDOWS\system32\DDPO64AF3.dll
2018-11-06 11:57 - 2018-10-31 21:37 - 000333104 _____ (Dolby Laboratories) C:\WINDOWS\system32\DDPO64A.dll
2018-11-06 11:57 - 2018-10-31 21:37 - 000316064 _____ (Dolby Laboratories) C:\WINDOWS\system32\DDPA64F3.dll
2018-11-06 11:57 - 2018-10-31 21:37 - 000278360 _____ (Dolby Laboratories) C:\WINDOWS\system32\DDPA64.dll
2018-11-06 11:57 - 2018-10-31 21:37 - 000175832 _____ (ASUSTeK COMPUTER INC.) C:\WINDOWS\system32\ATKWMI.dll
2018-11-06 11:57 - 2018-10-31 18:38 - 072520608 _____ (Realtek Semiconductor Corp.) C:\WINDOWS\system32\RCoRes64.dat
2018-11-06 11:57 - 2018-10-31 18:38 - 007178360 _____ (Dolby Laboratories) C:\WINDOWS\system32\R4EEP64A.dll
2018-11-06 11:57 - 2018-10-31 18:38 - 003677056 _____ (Realtek Semiconductor Corp.) C:\WINDOWS\system32\RTSnMg64.cpl
2018-11-06 11:57 - 2018-10-31 18:38 - 003159304 _____ (Realtek Semiconductor Corp.) C:\WINDOWS\system32\RtPgEx64.dll
2018-11-06 11:57 - 2018-10-31 18:38 - 002930048 _____ (Realtek Semiconductor Corp.) C:\WINDOWS\system32\RCoInstII64.dll
2018-11-06 11:57 - 2018-10-31 18:38 - 001159272 _____ (Dolby Laboratories) C:\WINDOWS\system32\DolbyDAX2APOProp.dll
2018-11-06 11:57 - 2018-10-31 18:38 - 000416400 _____ (Harman) C:\WINDOWS\system32\HMUI.dll
2018-11-06 11:57 - 2018-10-31 18:38 - 000378280 _____ (Dolby Laboratories) C:\WINDOWS\system32\HiFiDAX2API.dll
2018-11-06 11:57 - 2018-10-31 18:38 - 000266448 _____ (TODO: <Company name>) C:\WINDOWS\system32\slprp64.dll
2018-11-06 11:57 - 2018-10-31 18:38 - 000154256 _____ (Harman) C:\WINDOWS\system32\HarmanAudioInterface.dll
2018-11-06 11:57 - 2018-10-31 18:37 - 007101832 _____ (Dolby Laboratories) C:\WINDOWS\system32\DDPP64A.dll
2018-11-06 11:57 - 2018-10-31 18:37 - 006270280 _____ (Dolby Laboratories) C:\WINDOWS\system32\DDPP64AF3.dll
2018-11-06 11:57 - 2018-10-31 18:37 - 000122408 _____ (Real Sound Lab SIA) C:\WINDOWS\system32\CONEQMSAPOGUILibrary.dll
2018-11-06 11:57 - 2018-10-31 18:37 - 000118680 _____ C:\WINDOWS\system32\AcpiServiceVnA64.dll
2018-11-06 11:57 - 2018-10-31 18:37 - 000105400 _____ C:\WINDOWS\system32\audioLibVc.dll
2018-11-06 11:57 - 2018-10-31 18:09 - 023886413 _____ C:\WINDOWS\system32\Drivers\RTAIODAT.DAT
2018-11-05 22:28 - 2018-11-05 22:28 - 000013154 _____ C:\Users\franc\AppData\Local\recently-used.xbel
2018-11-04 10:50 - 2018-11-04 10:50 - 000080482 _____ C:\WINDOWS\dxdiag.txt
2018-11-03 12:28 - 2018-11-03 12:28 - 000002518 _____ C:\ProgramData\Microsoft\Windows\Start Menu\Programs\PowerPoint.lnk
2018-11-03 12:28 - 2018-11-03 12:28 - 000002518 _____ C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Access.lnk
2018-11-03 12:28 - 2018-11-03 12:28 - 000002501 _____ C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Word.lnk
2018-11-03 12:28 - 2018-11-03 12:28 - 000002491 _____ C:\ProgramData\Microsoft\Windows\Start Menu\Programs\OneNote 2016.lnk
2018-11-03 12:28 - 2018-11-03 12:28 - 000002491 _____ C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Excel.lnk
2018-11-03 12:28 - 2018-11-03 12:28 - 000002479 _____ C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Outlook.lnk
2018-11-03 12:28 - 2018-11-03 12:28 - 000002441 _____ C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Publisher.lnk
2018-11-03 12:28 - 2018-11-03 12:28 - 000000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Outils Microsoft Office
2018-11-02 15:54 - 2018-11-02 16:43 - 000000000 ____D C:\Users\franc\AppData\Local\calibre-cache
2018-11-02 15:52 - 2018-11-02 21:32 - 000000000 ____D C:\Users\franc\Bibliothèque calibre
2018-11-02 15:52 - 2018-11-02 16:43 - 000000000 ____D C:\Users\franc\AppData\Roaming\calibre
2018-11-02 15:52 - 2018-11-02 15:52 - 000000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\calibre - E-book Management
2018-11-02 15:52 - 2018-11-02 15:52 - 000000000 ____D C:\Program Files (x86)\Calibre2
2018-10-30 18:47 - 2018-10-30 18:47 - 000005893 _____ C:\Users\franc\Documents\queston sur les interactions sur internet 2018.txt
2018-10-27 15:06 - 2018-10-27 15:06 - 000000000 ____D C:\Users\franc\AppData\Local\D3DSCache

==================== One Month Modified files and folders ========

(If an entry is included in the fixlist, the file/folder will be moved.)

2018-11-16 18:48 - 2018-04-12 00:38 - 000000000 ____D C:\ProgramData\regid.1991-06.com.microsoft
2018-11-16 18:45 - 2018-09-27 14:29 - 000004176 _____ C:\WINDOWS\System32\Tasks\User_Feed_Synchronization-{5DABB7A3-3A6F-4283-9CAD-3695A54E8619}
2018-11-16 17:24 - 2018-09-27 14:29 - 000004078 _____ C:\WINDOWS\System32\Tasks\DriverMaxWelcome
2018-11-16 17:24 - 2018-04-30 08:43 - 000000000 ____D C:\Users\franc\AppData\LocalLow\Mozilla
2018-11-16 17:19 - 2018-07-02 08:50 - 000000000 ____D C:\Program Files (x86)\Spybot - Search & Destroy 2
2018-11-16 17:19 - 2018-04-12 00:38 - 000000000 ____D C:\WINDOWS\AppReadiness
2018-11-16 17:18 - 2018-09-27 14:29 - 000000006 ____H C:\WINDOWS\Tasks\SA.DAT
2018-11-16 17:18 - 2018-07-02 08:59 - 000000000 ____D C:\Program Files\Mozilla Firefox
2018-11-16 17:18 - 2018-07-02 08:59 - 000000000 ____D C:\Program Files (x86)\Mozilla Maintenance Service
2018-11-16 17:18 - 2018-07-01 22:36 - 000000000 ____D C:\ProgramData\NVIDIA
2018-11-16 17:17 - 2018-04-12 00:30 - 000000000 ____D C:\WINDOWS\CbsTemp
2018-11-16 17:17 - 2018-04-11 22:04 - 000786432 _____ C:\WINDOWS\system32\config\BBI
2018-11-16 17:14 - 2018-07-02 08:59 - 000001009 _____ C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Firefox.lnk
2018-11-16 15:08 - 2018-07-07 18:27 - 000000000 ____D C:\Program Files (x86)\Adobe
2018-11-16 13:46 - 2018-09-27 14:00 - 000000000 ____D C:\WINDOWS\system32\SleepStudy
2018-11-16 13:06 - 2018-09-27 14:29 - 000003384 _____ C:\WINDOWS\System32\Tasks\OneDrive Standalone Update Task-S-1-5-21-3243081975-1801143758-1203345775-1001
2018-11-16 13:06 - 2018-09-27 14:08 - 000002409 _____ C:\Users\franc\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\OneDrive.lnk
2018-11-16 13:06 - 2018-04-29 17:02 - 000000000 ___RD C:\Users\franc\OneDrive
2018-11-16 12:54 - 2018-04-12 00:38 - 000000000 ___HD C:\Program Files\WindowsApps
2018-11-16 12:27 - 2018-07-12 14:42 - 000000000 ____D C:\Program Files\rempl
2018-11-16 12:16 - 2018-07-07 12:15 - 000000000 ____D C:\Program Files\Pale Moon
2018-11-15 17:40 - 2018-05-19 20:26 - 000002457 _____ C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Acrobat Reader DC.lnk
2018-11-15 14:56 - 2018-07-17 20:37 - 000000000 ____D C:\Users\franc\AppData\Roaming\steelseries-engine-3-client
2018-11-15 14:33 - 2018-04-12 00:36 - 000000000 ____D C:\WINDOWS\INF
2018-11-15 13:10 - 2018-07-02 08:42 - 000000000 ____D C:\Users\franc\AppData\Local\Packages
2018-11-15 12:39 - 2018-09-27 15:25 - 000765382 _____ C:\WINDOWS\system32\prfh0416.dat
2018-11-15 12:39 - 2018-09-27 15:25 - 000152338 _____ C:\WINDOWS\system32\prfc0416.dat
2018-11-15 12:39 - 2018-09-27 15:16 - 000793528 _____ C:\WINDOWS\system32\perfh00C.dat
2018-11-15 12:39 - 2018-09-27 15:16 - 000153182 _____ C:\WINDOWS\system32\perfc00C.dat
2018-11-15 12:39 - 2018-09-27 14:20 - 002665632 _____ C:\WINDOWS\system32\PerfStringBackup.INI
2018-11-15 12:32 - 2018-04-29 16:58 - 000000000 __RHD C:\Users\Public\AccountPictures
2018-11-15 12:32 - 2018-04-29 16:58 - 000000000 ___RD C:\Users\franc\3D Objects
2018-11-15 12:31 - 2018-09-27 14:00 - 000512400 _____ C:\WINDOWS\system32\FNTCACHE.DAT
2018-11-15 12:24 - 2018-04-12 00:38 - 000000000 ___SD C:\WINDOWS\SysWOW64\F12
2018-11-15 12:24 - 2018-04-12 00:38 - 000000000 ___SD C:\WINDOWS\system32\F12
2018-11-15 12:24 - 2018-04-12 00:38 - 000000000 ___RD C:\WINDOWS\ImmersiveControlPanel
2018-11-15 12:24 - 2018-04-12 00:38 - 000000000 ____D C:\WINDOWS\TextInput
2018-11-15 12:24 - 2018-04-12 00:38 - 000000000 ____D C:\WINDOWS\system32\ShellExperiences
2018-11-15 12:24 - 2018-04-12 00:38 - 000000000 ____D C:\WINDOWS\ShellExperiences
2018-11-15 12:24 - 2018-04-12 00:38 - 000000000 ____D C:\WINDOWS\bcastdvr
2018-11-15 11:55 - 2018-07-02 09:03 - 000000000 ____D C:\Users\franc\AppData\Local\PlaceholderTileLogoFolder
2018-11-15 10:55 - 2018-09-27 14:29 - 000003342 _____ C:\WINDOWS\System32\Tasks\CorelUpdateHelperTask-5265A25A19640B8AF17F1AE484AB6A3D
2018-11-15 10:10 - 2018-07-02 08:51 - 000000000 ____D C:\WINDOWS\system32\MRT
2018-11-15 10:06 - 2018-07-02 08:50 - 137810048 ____C (Microsoft Corporation) C:\WINDOWS\system32\MRT.exe
2018-11-15 09:23 - 2018-09-27 14:29 - 000004766 _____ C:\WINDOWS\System32\Tasks\Adobe Flash Player NPAPI Notifier
2018-11-15 09:23 - 2018-09-27 14:29 - 000004594 _____ C:\WINDOWS\System32\Tasks\Adobe Flash Player Updater
2018-11-15 09:23 - 2018-04-12 00:38 - 000000000 ____D C:\WINDOWS\SysWOW64\Macromed
2018-11-15 09:23 - 2018-04-12 00:38 - 000000000 ____D C:\WINDOWS\system32\Macromed
2018-11-12 16:04 - 2018-04-11 22:04 - 000032768 _____ C:\WINDOWS\system32\config\ELAM
2018-11-10 14:25 - 2018-05-02 20:29 - 000000000 ____D C:\Users\franc\Desktop\Raccourcis
2018-11-10 13:20 - 2018-07-11 20:35 - 000001372 _____ C:\Users\franc\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Navigateur Opera.lnk
2018-11-10 13:17 - 2018-04-12 00:38 - 000000000 ____D C:\WINDOWS\system32\NDF
2018-11-09 19:39 - 2018-09-21 14:01 - 000048286 _____ C:\Users\franc\.sambox.cache
2018-11-06 11:59 - 2018-07-01 22:37 - 002033568 _____ C:\WINDOWS\system32\Drivers\rtkhdasetting.zip
2018-11-06 11:58 - 2018-07-01 22:36 - 000000000 ____D C:\WINDOWS\SysWOW64\RTCOM
2018-11-05 22:28 - 2018-09-25 17:13 - 000000000 ____D C:\Users\franc\AppData\Local\gtk-2.0
2018-11-05 22:28 - 2018-07-09 13:56 - 000000000 ____D C:\Users\franc\AppData\Local\babl-0.1
2018-11-03 12:27 - 2018-07-07 12:43 - 000000000 ____D C:\Program Files (x86)\Microsoft Office
2018-11-03 11:21 - 2018-04-12 00:38 - 000000000 ____D C:\WINDOWS\LiveKernelReports
2018-11-02 15:52 - 2018-09-27 14:08 - 000000000 ____D C:\Users\franc
2018-10-31 18:38 - 2018-09-24 11:00 - 006420864 _____ (Realtek Semiconductor Corp.) C:\WINDOWS\system32\Drivers\RTKVHD64.sys
2018-10-31 18:38 - 2018-09-24 10:59 - 000023584 _____ (Realtek Semiconductor Corp.) C:\WINDOWS\system32\RtkCoLDR64.dll
2018-10-23 09:53 - 2018-07-05 09:14 - 000000000 ____D C:\WINDOWS\system32\Drivers\wd
2018-10-17 10:29 - 2018-07-02 08:42 - 000000000 ____D C:\Users\franc\AppData\Local\ConnectedDevicesPlatform

==================== Files in the root of some directories =======

2018-07-22 18:42 - 2018-07-22 18:42 - 000000003 _____ () C:\Users\franc\AppData\Roaming\.ptbt0
2018-11-05 22:28 - 2018-11-05 22:28 - 000013154 _____ () C:\Users\franc\AppData\Local\recently-used.xbel
2018-07-22 18:59 - 2018-07-22 19:09 - 000007605 _____ () C:\Users\franc\AppData\Local\resmon.resmoncfg

Some files in TEMP:
====================
2018-11-15 16:38 - 2018-11-15 16:39 - 041486400 _____ () C:\Users\franc\AppData\Local\Temp\vlc-3.0.4-win64.exe

==================== Bamital & volsnap ======================

(There is no automatic fix for files that do not pass verification.)

C:\WINDOWS\system32\winlogon.exe => File is digitally signed
C:\WINDOWS\system32\wininit.exe => File is digitally signed
C:\WINDOWS\explorer.exe => File is digitally signed
C:\WINDOWS\SysWOW64\explorer.exe => File is digitally signed
C:\WINDOWS\system32\svchost.exe => File is digitally signed
C:\WINDOWS\SysWOW64\svchost.exe => File is digitally signed
C:\WINDOWS\system32\services.exe => File is digitally signed
C:\WINDOWS\system32\User32.dll => File is digitally signed
C:\WINDOWS\SysWOW64\User32.dll => File is digitally signed
C:\WINDOWS\system32\userinit.exe => File is digitally signed
C:\WINDOWS\SysWOW64\userinit.exe => File is digitally signed
C:\WINDOWS\system32\rpcss.dll => File is digitally signed
C:\WINDOWS\system32\dnsapi.dll => File is digitally signed
C:\WINDOWS\SysWOW64\dnsapi.dll => File is digitally signed
C:\WINDOWS\system32\Drivers\volsnap.sys => File is digitally signed

LastRegBack: 2018-09-27 14:00

==================== End of FRST.txt ============================
 

Attachments

aswMBR version 1.0.1.2252 Copyright(c) 2014 AVAST Software
Run date: 2018-11-16 20:03:15
-----------------------------
20:03:15.222 OS Version: Windows x64 6.2.9200
20:03:15.222 Number of processors: 2 586 0x3A09
20:03:15.222 ComputerName: EARENDIL-LIGHT UserName: Françoise
20:03:16.113 Initialze error C000010E - driver not loaded
20:05:54.416 Service scanning
20:06:24.472 Modules scanning
20:06:24.472 Disk 0 trace - called modules:
20:06:24.472
20:06:24.472 Scan finished successfully
20:06:52.148 The log file has been saved successfully to "U:\Outputs\right outputs\aswMBR.txt"
 
OK, so virus did 2 reactions:

1st. I forgot to do aswMBR update database of Avast. So I re-launched it and started the update. I went cooking and it did a weird Windows Update. I might have not seen it, but it got back to Welcome screen. Before it, the Activation virus had come back and after it, no more Activation virus. Screen was black with blue round about. So I couldn't click on Scan. No idea if to scan C:\ or the other option of Quick search, if I open it, Windows may reboot again.


2nd. Windows did the reboot since I had tried to open aswMBR a third time. Before there was a light skyblue screen with written on it:
Error message = " Your PC run into a problem and must restart it. " + the square that you can take a picture with a smartphone to access the error. But was too fast for my photo machine. Letters were in white I think.

So no idea if I can open aswMBR for the 4th time ?
 
I am not having now: Windows is not activated rectangle at bottom right. So that was it, the first update hidded the warning. But I checked on parameters, Windows is not activated again :/ but it is not telling me.
I am doing troubleshoot.
It takes very very long.
I think I can only re-activate Windows in the morning, during the night, either it bugs, either it is a virus:

Troubleshoot has completed
Something prevented us from communicating with our activation servers. Wait a few minuts and then try again. (0xc0020036)
We weren't able to activate Windows on this device.
Learn more about Windows Activation.
You can activate this device by going to the Store and purchasing a genuine copy of Windows.
Go to Store.

I did not try open aswMBR the 4th time yet.

Thank you and Good night =)
 
Many times when you receive alerts or notification pop ups, it can mean the server is busy and cannot be used at this time.
Some say wait a couple of days then try again.

I did see in the logs a couple of apps not working correctly.

C:\Program Files\Pale Moon\palemoon.exe has been blocked from modifying %userprofile%\Desktop by Controlled Folder Access.
Process Name: C:\Program Files\Pale Moon\palemoon.exe
I have no idea why or what is wrong with this program. Could it be your app CybereasonRansomFree denies this and the other apps access?

C:\Program Files\Corel\Corel AfterShot 3\build\AfterShot.exe has been blocked from modifying %userprofile%\Pictures\AfterShot Catalog 3\AfterShot Catalog 2018\ by Controlled Folder Access.

C:\Program Files\Corel\Corel PaintShop Pro 2018 (64-bit)\Corel PaintShop Pro.exe has been blocked from modifying %userprofile%\Documents\Corel PaintShop Pro\2018 by Controlled Folder Access.

~~
Let's check for malware.

Start Farbar Recovery Scan Tool with Administrator privileges
(Right click on the FRST icon and select Run as administrator)

highlight on the text below and select Copy.
beginning with Start:: and finishing with End::
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

Highlight the entire content of the quote box below and select Copy.


Start::
CloseProcesses:
CreateRestorePoint:
HKLM\SOFTWARE\Policies\Microsoft\Windows Defender: Restriction <==== ATTENTION
SearchScopes: HKU\S-1-5-21-3243081975-1801143758-1203345775-1001 -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = hxxps://www.bing.com/search?q={searchTerms}&src=IE-SearchBox&FORM=IESR02&pc=UE00
SearchScopes: HKU\S-1-5-21-3243081975-1801143758-1203345775-1001 -> {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = hxxps://www.bing.com/search?q={searchTerms}&src=IE-SearchBox&FORM=IESR02&pc=UE00
FF NewTab: Mozilla\Firefox\Profiles\4q9abl71.default -> hxxp://www.bing.com/?pc=COSP&ptag=D070518-AD26CBEB7DD&form=CONMHP&conlogo=CT3335811
2018-11-15 16:38 - 2018-11-15 16:39 - 041486400 _____ () C:\Users\franc\AppData\Local\Temp\vlc-3.0.4-win64.exe
C:\Windows\Temp\*.*
Emptytemp:
End::
Click to expand...


Start FRST (FRST64) with Administrator privileges
Press the Fix button. FRST will process the lines copied above from the clipboard.
When finished, a log file Fixlog.txt will pop up and saved in the same location the tool was ran from.

Please copy and paste its contents in your next reply.
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

zcMPezJ.png
AdwCleaner - Fix Mode
  • Download AdwCleaner and move it to your Desktop
  • Right-click on AdwCleaner.exe and select
    Spcusrh.png
    Run as Administrator (for Windows Vista, 7, 8, 8.1 and 10 users)
  • Accept the EULA (I accept), then click on Scan
  • Let the scan complete. Once it's done, make sure that every item listed in the different tabs is checked and click on the Clean & Repair button. This will kill all the active processes
  • Once the cleaning process is complete, AdwCleaner will ask to restart your computer, do it
  • After the restart, a log will open when logging in. Please copy/paste the content of that log in your next reply

RQKuhw1.png
RogueKiller
  • Download the right version of RogueKiller for your Windows version (32 or 64-bit)
  • Once done, move the executable file to your Desktop, right-click on it and select
    Spcusrh.png
    Run as Administrator (for Windows Vista, 7, 8, 8.1 and 10 users)
  • Click on the Start Scan button in the right panel, which will bring you to another tab, and click on it again (this time it'll be in the bottom right corner)
  • Wait for the scan to complete
  • On completion, the results will be displayed
  • Check every single entry (threat found), and click on the Remove Selected button
  • On completion, the results will be displayed. Click on the Open Report button in the bottom left corner, followed by the Open TXT button (also in the bottom left corner)
  • This will open the report in Notepad. Copy/paste its content in your next reply

created by Aura

Your next reply(ies) should therefore contain:
  • Copy/pasted Fixlog.txt
  • Copy/pasted AdwCleaner clean log
  • Copy/pasted RogueKiller clean log
 
Hello, I will post you the first log today, and the 2/3 and 3/3 logs on Tuesday 20th November 2018.
Windows had sent a fix to the Activation bug, so this issue was fixed by Windows, fix took 2 days to work. But as I intend either double boot, either go back to Ubuntu Linux, because of other old issues on my Windows Home, and mostly fear of starting any project and having all dissapear, I am interested in continuing with the virus search :alien:. Thank you very much for your pacience =)

Fix result of Farbar Recovery Scan Tool (x64) Version: 15.11.2018
Ran by Françoise (18-11-2018 22:08:35) Run:1
Running from U:\Antivirus
Loaded Profiles: Françoise (Available Profiles: Françoise)
Boot Mode: Normal
==============================================

fixlist content:
*****************
CloseProcesses:
CreateRestorePoint:
HKLM\SOFTWARE\Policies\Microsoft\Windows Defender: Restriction <==== ATTENTION
SearchScopes: HKU\S-1-5-21-3243081975-1801143758-1203345775-1001 -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = hxxps://www.bing.com/search?q={searchTerms}&src=IE-SearchBox&FORM=IESR02&pc=UE00
SearchScopes: HKU\S-1-5-21-3243081975-1801143758-1203345775-1001 -> {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = hxxps://www.bing.com/search?q={searchTerms}&src=IE-SearchBox&FORM=IESR02&pc=UE00
FF NewTab: Mozilla\Firefox\Profiles\4q9abl71.default -> hxxp://www.bing.com/?pc=COSP&ptag=D070518-AD26CBEB7DD&form=CONMHP&conlogo=CT3335811
2018-11-15 16:38 - 2018-11-15 16:39 - 041486400 _____ () C:\Users\franc\AppData\Local\Temp\vlc-3.0.4-win64.exe
C:\Windows\Temp\*.*
Emptytemp:

*****************

Processes closed successfully.
Restore point was successfully created.
HKLM\SOFTWARE\Policies\Microsoft\Windows Defender => removed successfully
"HKU\S-1-5-21-3243081975-1801143758-1203345775-1001\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\\DefaultScope" => removed successfully
HKU\S-1-5-21-3243081975-1801143758-1203345775-1001\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A} => removed successfully
HKLM\Software\Classes\CLSID\{0633EE93-D776-472f-A0FF-E1416B8B2E3A} => not found
"Firefox newtab" => removed successfully
C:\Users\franc\AppData\Local\Temp\vlc-3.0.4-win64.exe => moved successfully

=========== "C:\Windows\Temp\*.*" ==========

C:\Windows\Temp\AdobeARM.log => moved successfully
C:\Windows\Temp\AdobeARM_NotLocked.log => moved successfully
C:\Windows\Temp\ArmUI.ini => moved successfully
C:\Windows\Temp\EARENDIL-LIGHT-20181110-1728.log => moved successfully
C:\Windows\Temp\EARENDIL-LIGHT-20181110-1823.log => moved successfully
C:\Windows\Temp\EARENDIL-LIGHT-20181111-1030.log => moved successfully
C:\Windows\Temp\EARENDIL-LIGHT-20181111-1038.log => moved successfully
C:\Windows\Temp\EARENDIL-LIGHT-20181111-1038a.log => moved successfully
C:\Windows\Temp\EARENDIL-LIGHT-20181111-1056.log => moved successfully
C:\Windows\Temp\EARENDIL-LIGHT-20181111-1412.log => moved successfully
C:\Windows\Temp\EARENDIL-LIGHT-20181112-1543.log => moved successfully
C:\Windows\Temp\EARENDIL-LIGHT-20181112-1550.log => moved successfully
C:\Windows\Temp\EARENDIL-LIGHT-20181112-1550a.log => moved successfully
C:\Windows\Temp\EARENDIL-LIGHT-20181112-1651.log => moved successfully
C:\Windows\Temp\EARENDIL-LIGHT-20181115-0917.log => moved successfully
C:\Windows\Temp\EARENDIL-LIGHT-20181115-0921.log => moved successfully
C:\Windows\Temp\EARENDIL-LIGHT-20181115-0921a.log => moved successfully
C:\Windows\Temp\EARENDIL-LIGHT-20181115-1230.log => moved successfully
C:\Windows\Temp\EARENDIL-LIGHT-20181115-1238.log => moved successfully
C:\Windows\Temp\EARENDIL-LIGHT-20181115-1352.log => moved successfully
C:\Windows\Temp\EARENDIL-LIGHT-20181115-1359.log => moved successfully
C:\Windows\Temp\EARENDIL-LIGHT-20181115-1433.log => moved successfully
C:\Windows\Temp\EARENDIL-LIGHT-20181115-1632.log => moved successfully
C:\Windows\Temp\EARENDIL-LIGHT-20181115-1646.log => moved successfully
C:\Windows\Temp\EARENDIL-LIGHT-20181115-2245.log => moved successfully
C:\Windows\Temp\EARENDIL-LIGHT-20181116-1216.log => moved successfully
C:\Windows\Temp\EARENDIL-LIGHT-20181116-1222.log => moved successfully
C:\Windows\Temp\EARENDIL-LIGHT-20181116-1222a.log => moved successfully
C:\Windows\Temp\EARENDIL-LIGHT-20181116-1238.log => moved successfully
C:\Windows\Temp\EARENDIL-LIGHT-20181116-1336.log => moved successfully
C:\Windows\Temp\EARENDIL-LIGHT-20181116-1718.log => moved successfully
C:\Windows\Temp\EARENDIL-LIGHT-20181116-1725.log => moved successfully
C:\Windows\Temp\EARENDIL-LIGHT-20181116-1743.log => moved successfully
C:\Windows\Temp\EARENDIL-LIGHT-20181116-2024.log => moved successfully
C:\Windows\Temp\EARENDIL-LIGHT-20181116-2043.log => moved successfully
C:\Windows\Temp\EARENDIL-LIGHT-20181116-2052.log => moved successfully
C:\Windows\Temp\EARENDIL-LIGHT-20181116-2059.log => moved successfully
C:\Windows\Temp\EARENDIL-LIGHT-20181116-2108.log => moved successfully
C:\Windows\Temp\EARENDIL-LIGHT-20181116-2126.log => moved successfully
C:\Windows\Temp\EARENDIL-LIGHT-20181117-0941.log => moved successfully
C:\Windows\Temp\EARENDIL-LIGHT-20181117-0946.log => moved successfully
C:\Windows\Temp\EARENDIL-LIGHT-20181117-0946a.log => moved successfully
C:\Windows\Temp\EARENDIL-LIGHT-20181118-1950.log => moved successfully
C:\Windows\Temp\EARENDIL-LIGHT-20181118-1955.log => moved successfully
C:\Windows\Temp\EARENDIL-LIGHT-20181118-1955a.log => moved successfully
C:\Windows\Temp\EARENDIL-LIGHT-20181118-1956.log => moved successfully
C:\Windows\Temp\EARENDIL-LIGHT-20181118-2201.log => moved successfully
C:\Windows\Temp\EARENDIL-LIGHT-20181118-2201a.log => moved successfully
C:\Windows\Temp\EARENDIL-LIGHT-20181118-2202.log => moved successfully
C:\Windows\Temp\EARENDIL-LIGHT-20181118-2203.log => moved successfully
Could not move "C:\Windows\Temp\EARENDIL-LIGHT-20181118-2208.log" => Scheduled to move on reboot.
Could not move "C:\Windows\Temp\EARENDIL-LIGHT-20181118-2209.log" => Scheduled to move on reboot.
C:\Windows\Temp\MpCmdRun.log => moved successfully
C:\Windows\Temp\MpSigStub.log => moved successfully
C:\Windows\Temp\officeclicktorun.exe_streamserver(20181116171849D04).log => moved successfully
C:\Windows\Temp\officeclicktorun.exe_streamserver(20181116204319D44).log => moved successfully
C:\Windows\Temp\officeclicktorun.exe_streamserver(2018111822015138D8).log => moved successfully
C:\Windows\Temp\officeclicktorun.exe_streamserver(201811182202493BB0).log => moved successfully
Could not move "C:\Windows\Temp\officeclicktorun.exe_streamserver(2018111822083829A8).log" => Scheduled to move on reboot.
C:\Windows\Temp\sa.9WZDNCRFJ4Q1_0__.Public.InstallAgent.dat => moved successfully
C:\Windows\Temp\TBitDefenderUpdaterThread.log => moved successfully
C:\Windows\Temp\tem1B.tmp => moved successfully
C:\Windows\Temp\tem60D3.tmp => moved successfully
C:\Windows\Temp\tem6A04.tmp => moved successfully
C:\Windows\Temp\TSpybotUpdaterThread.log => moved successfully
C:\Windows\Temp\TS_489F.tmp => moved successfully
C:\Windows\Temp\TS_CADF.tmp => moved successfully
C:\Windows\Temp\WER1D1F.tmp.WERDataCollectionStatus.txt => moved successfully
C:\Windows\Temp\WER29A2.tmp.WERDataCollectionStatus.txt => moved successfully
C:\Windows\Temp\WER7AA1.tmp.WERDataCollectionStatus.txt => moved successfully
C:\Windows\Temp\WER7E37.tmp.WERDataCollectionStatus.txt => moved successfully
C:\Windows\Temp\WERABDC.tmp.WERDataCollectionStatus.txt => moved successfully
C:\Windows\Temp\WERABED.tmpsec.zip => moved successfully

========= End -> "C:\Windows\Temp\*.*" ========


=========== EmptyTemp: ==========

BITS transfer queue => 7888896 B
DOMStore, IE Recovery, AppCache, Feeds Cache, Thumbcache, IconCache => 262162929 B
Java, Flash, Steam htmlcache => 1154 B
Windows/system/drivers => 8354 B
Edge => 188580953 B
Chrome => 0 B
Firefox => 1089572842 B
Opera => 115290821 B

Temp, IE cache, history, cookies, recent:
Default => 0 B
Users => 0 B
ProgramData => 0 B
Public => 0 B
systemprofile => 0 B
systemprofile32 => 0 B
LocalService => 585988 B
LocalService => 0 B
NetworkService => 89796 B
NetworkService => 0 B
franc => 510560173 B

RecycleBin => 0 B
EmptyTemp: => 2 GB temporary data Removed.

================================

Result of scheduled files to move (Boot Mode: Normal) (Date&Time: 18-11-2018 22:18:48)

C:\Windows\Temp\EARENDIL-LIGHT-20181118-2208.log => Is moved successfully
C:\Windows\Temp\EARENDIL-LIGHT-20181118-2209.log => Is moved successfully
C:\Windows\Temp\officeclicktorun.exe_streamserver(2018111822083829A8).log => Is moved successfully

==== End of Fixlog 22:18:49 ====
 
Ok, post the other logs when you can.

Had a feeling this was related to a over busy server.
 
There is another problem I should speak of, many months ago, after my files did dissapear, after I did reset Windows 10 Home from inside, my admin short name had changed or was misspelled. I thought was Windows who did that, as sometimes they change the number of characters requested for the username, and as it was after a reset, and also as I don't know how to change it at all. Since then, I might had done many resets from inside, be keeping all or erasing all softwares and files. So after all is over, I do intend as soon as I can to do a 100% format. Some people said I don't need buying for same device a new Windows 10 Home, I'll check that, not your problem, but I doubt most on the fact that my computer will let me burn an OS ISO of any kind without errors. Maybe I am wrong, maybe it works back well. Anyway I could also buy it, but first I will check if that is true or not ? It's not your problem this format thing. I already ordered, in USA, an Ubuntu DVD + key, so anyway, I will find a way to get anything on this computer by beginning of December. If I was intending to do even a simple Linux boot, many months ago, I don't believe it would have worked. Because for the double boot I had rwx errors on live install. But now The DVD writer seems to work well, so I don't believe, and hope not to get an issue. But this is not your problem.

Anyway the only thing, if there is a way to check you can check, is why my username went a few months ago from fran to franc as Windows 10 Home Admin ?


Ok, here is 2/3 - Adwcleaner,

# -------------------------------
# Malwarebytes AdwCleaner 7.2.4.0
# -------------------------------
# Build: 09-25-2018
# Database: 2018-11-19.1 (Cloud)
# Support: https://www.malwarebytes.com/support
#
# -------------------------------
# Mode: Clean
# -------------------------------
# Start: 11-20-2018
# Duration: 00:00:05
# OS: Windows 10 Home
# Cleaned: 5
# Failed: 0


***** [ Services ] *****

No malicious services cleaned.

***** [ Folders ] *****

No malicious folders cleaned.

***** [ Files ] *****

No malicious files cleaned.

***** [ DLL ] *****

No malicious DLLs cleaned.

***** [ WMI ] *****

No malicious WMI cleaned.

***** [ Shortcuts ] *****

No malicious shortcuts cleaned.

***** [ Tasks ] *****

No malicious tasks cleaned.

***** [ Registry ] *****

Deleted HKCU\Software\csastats
Deleted HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\StartupApproved\Run|Web Companion
Deleted HKCU\Software\Lavasoft\Web Companion
Deleted HKLM\Software\Wow6432Node\Lavasoft\Web Companion
Deleted HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\Domains\webcompanion.com

***** [ Chromium (and derivatives) ] *****

No malicious Chromium entries cleaned.

***** [ Chromium URLs ] *****

No malicious Chromium URLs cleaned.

***** [ Firefox (and derivatives) ] *****

No malicious Firefox entries cleaned.

***** [ Firefox URLs ] *****

No malicious Firefox URLs cleaned.


*************************

[+] Delete Tracing Keys
[+] Reset Winsock

*************************

AdwCleaner[S00].txt - [1674 octets] - [20/11/2018 10:58:43]

########## EOF - C:\AdwCleaner\Logs\AdwCleaner[C00].txt ##########
 
Hello, here is report #3/3, thanks =)

RogueKiller Anti-Malware V13.0.10.0 (x64) [Nov 14 2018] (Free) by Adlice Software
mail : https://adlice.com/contact/
Website : https://adlice.com/download/roguekiller/
Operating System : Windows 10 (10.0.17134) 64 bits
Started in : Normal mode
User : Françoise [Administrator]
Started from : C:\Program Files\RogueKiller\RogueKiller64.exe
Mode : Standard Scan, Delete -- Date : 2018/11/20 12:51:07 (Duration : 01:03:00)

¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤ Delete ¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤
[PUP.InnovativeSolutions (Potentially Malicious)] drivermax.exe [Innovative Solutions Grup SRL] -- %programfiles(x86)%\Innovative Solutions\DriverMax\drivermax.exe -> Killed [Tree]
[PUP.InnovativeSolutions (Potentially Malicious)] drivermax.exe [Innovative Solutions Grup SRL] -- %programfiles(x86)%\Innovative Solutions\DriverMax\drivermax.exe -> Killed [Tree]
[PUP.InnovativeSolutions (Potentially Malicious)] innostp.exe [Innovative Solutions Grup SRL] -- %programfiles(x86)%\Innovative Solutions\DriverMax\innostp.exe -> Killed [Tree]
[PUP.InnovativeSolutions (Potentially Malicious)] \Application Starter - f1375f225883e83d52e8db9690775c3c -- C:\Program Files (x86)\Innovative Solutions\DriverMax\innostp.exe (-install) -> Deleted
[PUP.InnovativeSolutions (Potentially Malicious)] \DriverMax Notification -- C:\Program Files (x86)\Innovative Solutions\DriverMax\drivermax.exe (-NOT) -> Deleted
[PUP.InnovativeSolutions (Potentially Malicious)] \DriverMaxAgent -- C:\Program Files (x86)\Innovative Solutions\DriverMax\drivermax.exe (-AGENT) -> Deleted
[PUP.InnovativeSolutions (Potentially Malicious)] \DriverMaxWelcome -- C:\Program Files (x86)\Innovative Solutions\DriverMax\drivermax.exe (-BKSCAN) -> Deleted
[PUP.InnovativeSolutions (Potentially Malicious)] HKEY_LOCAL_MACHINE\Software\Innovative Solutions -- -> Deleted
[PUP.InnovativeSolutions (Potentially Malicious)] HKEY_USERS\S-1-5-21-3243081975-1801143758-1203345775-1001\Software\Innovative Solutions -- -> Deleted
[PUP.InnovativeSolutions (Potentially Malicious)] HKEY_USERS\S-1-5-21-3243081975-1801143758-1203345775-1001\Software\Innovative Solutions -- -> Deleted
[PUP.InnovativeSolutions (Potentially Malicious)] HKEY_USERS\S-1-5-21-3243081975-1801143758-1203345775-1001\Software\Microsoft\Windows\CurrentVersion\Run|DriverMax_RESTART -- [%programfiles(x86)%\Innovative Solutions\DriverMax\drivermax.exe] -> Deleted
[PUP.InnovativeSolutions (Potentially Malicious)] HKEY_USERS\S-1-5-21-3243081975-1801143758-1203345775-1001\Software\Microsoft\Windows\CurrentVersion\Run|DriverMax_RESTART -- [%programfiles(x86)%\Innovative Solutions\DriverMax\drivermax.exe] -> Deleted
[PUP.InnovativeSolutions (Potentially Malicious)] Innovative Solutions -- %localappdata%\Innovative Solutions -> Deleted
[PUP.InnovativeSolutions (Potentially Malicious)] DriverMax.lnk -- %programdata%\Microsoft\Windows\Start Menu\Programs\DriverMax\DriverMax.lnk (lnk => C:\PROGRA~2\INNOVA~1\DRIVER~1\DRIVER~1.EXE []) -> Deleted
[PUP.InnovativeSolutions (Potentially Malicious)] Uninstall DriverMax.lnk -- %programdata%\Microsoft\Windows\Start Menu\Programs\DriverMax\Uninstall DriverMax.lnk (lnk => C:\PROGRA~2\INNOVA~1\DRIVER~1\unins000.exe []) -> Deleted
[PUP.InnovativeSolutions (Potentially Malicious)] Innovative Solutions -- %programfiles(x86)%\Innovative Solutions -> Deleted
[PUP.InnovativeSolutions (Potentially Malicious)] Innovative Solutions -- %programfiles(x86)%\Innovative Solutions -> Removed at reboot [2]
[PUP.InnovativeSolutions (Potentially Malicious)] Innovative Solutions -- %localappdata%\Innovative Solutions -> Removed at reboot [2]
 
Out of topic:

NB: I own DriverMax Lifetime Licence, 1 user any device =), they still have the discount =) So I don't think they are dangerous. Unless their official and non official up to date drivers aren't malware-free. But it is normal that DriverMax has max rights as it is drivers it fetches. OK they are one of the less expensive, so not that much known in Google search results, so maybe fake positives.

I am happy that Windows did fix the activation bug, my Windows 10 Home was re-activated by Windows, not by me, took 2 days, so normal it is not our problem, but when we look at the issue, we can see that else they change authentication method due to bug, else they had to change it due to virus, and that indeed it did concerns millions of Windows, so it's not our problem, so part of your thought was right, Windows servers went saturate with people re-asking authentication, but anyway Windows knows who uses him, so no problem:
Asking my authentication in-built OEM key to Windows :
Node - EARENDIL-LIGHT
Error:
Description =


EARENDIL-LIGHT is the name of my computer.

But indeed our problem is not this one, and many problems did put me confusion. In Ubuntu the communication with any worldwide country Ubuntu server default repositories issue I also had in longtime past, could had been linked to authentication, also although it is GPG keys, but that was not my level, I am not in informatics, just common user, so when something don't answer, and when I can't find what to ask, no idea what should have been my question in Ubuntu, normal I did delete it. But not impossible it was also due to my computer not communicating with the servers due to some saturation of computers not being recognised because it did lost something. So maybe you are not wrong.

But we can't check on the Windows in-built issues, and for Ubuntu the in-built issues that can't become questions, become format it.

So we will stay in the virus issues. I won't format my personal files and folders as they are important to me in my external disk. I just hope to double boot, then I will only use Linux to access them, so it will be safer, as all this could come back from any file I may have in storage, if it is a virus and not a hack, and if it is still there. Maybe with some luck this is gone for good. But my personal files stay with me, not your concern neither. Working on my computer is already lots of job. So we shall stay with my computer =)
 
More talkings:

For what concern the Windows update fix, Activation bug did come back with Warning, I will have to do the October Update for maybe it to become reliable. But that will be done later. I won't touch the Warning, neither will bring problems of too many calls for solving a bug that Windows did solve himself before yesterday. Unless maybe my Windows don't need me to play the not authentified Activate Windows - Windows is Activated game ? Maybe it does search activation on its own, and it don't need me to push any troubleshoot button. So I don't know what is this activation fix sent to everyone about, why it did stop working today at 14:39 20/11/2018 while before yesterday I got the Windows is Activated till now ? Nothing is clear except: don't touch nothing ! Windows must be taking care of it, so I better not touch it.

Lucky, after 2 time no work, Windows has in his website MediaCreationTool that allows you re-install Windows with no ISO file, and so burn the DVD =) I have got no idea if it is compatible with a built-in OEM that has more over Activation bug, but as Windows will be able to Authenticate me in any mornings, from other parameters, mostly if I have the October Update, hope them to be in the ISO, after your virus search, I will be able to format it (no worries, I think no need to buy again the in-built OEM key, but if buying is needed, I can, but I prefer waiting for this bug to be fixed by Windows before I will do it because all computers come with in-built OEM Windows, so I can't know if it is just device related, I won't buy something expensive 3 times USA price if ther is no need to, and if I have the right of Activating it in same device if it is same Windows OS then the built-in, else they will need to release other better Windows in what concerns key security) =) Still some chance my computer will just crash, but let's just hope no xwr errors in the Windows ISO. I will re-try the double boot after we are finished, but normal, Windows will need to have his partition, but that's my problems =) PS: In the past I couldn't test MediaCreationTool in my computer as it was said as not been created for my OS version, mystery =)

So this going to stay a come and go bug times 1000 :spider:, till it is permanently fixed by Windows and we can't do a thing about it. Except lots later the format =) And I am not touching at all the Activation button when it is self-activating in the morning, not me. So I am no longer going to bring noise in this issue as the Windows servers must be saturated with that, mostly at night.

But we will stay in the virus issue, not in the Activation issue =)
 

Attachments

  • I did not reactivate it 18 11 2018.JPG
    I did not reactivate it 18 11 2018.JPG
    71.5 KB · Views: 1
  • Windows fix did not work weird 20 11 2018.JPG
    Windows fix did not work weird 20 11 2018.JPG
    16.5 KB · Views: 1
  • so it is win 8 dot 1 key that is missing - 18 11 2018.jpg
    so it is win 8 dot 1 key that is missing - 18 11 2018.jpg
    95 KB · Views: 1
  • franc was fran before first win reset after no files virus long ago.JPG
    franc was fran before first win reset after no files virus long ago.JPG
    21.6 KB · Views: 1
The status unavailable for Spybot anti-virus might also interest you, as it happens often :/ Also I must often put on again the periodic Windows Defender Scan :/. Same for Windows One Drive protection against Ransomware, it often goes back OFF :/

I often have them many times both not ON, but I don't think it's a bug, I think their status depends on the Windows Updates we can't see. As for Office: Word, etc., the manual updates needs both OFF. But I don't use much Office as it depends on Wifi ON and I won't always use Windows, and I won't always have a contract with them through family members, so I won't always be able to open files I create with them, they are just interesting for curriculum vitae. So that's not an issue.
 

Attachments

  • status unavailable 20 11 2018.JPG
    status unavailable 20 11 2018.JPG
    74.5 KB · Views: 3
  • everything including one drive anti ransomware often back off 20 11 2018.JPG
    everything including one drive anti ransomware often back off 20 11 2018.JPG
    39.4 KB · Views: 3
I think, windows updates is having issues keeping your machine up to date and all thats here one day and gone the next is unpredictable.
I have no idea why it would add a letter to your name, thats the first time I've ever heard or seen that.

I can give you a link to a tech help forum that can help with issues related to Ubuntu and other operating systems but, I'm no help with that.
It's possible they can help with the windows issues, I don't know. You'll need to join and create a user name, and you can add the link to this topic here if you like. I am also a member there and help in the malware removal forum.
https://forums.whatthetech.com/index.php?showforum=119

~~~~~~~~~~~~~~~~~~~~~~~~~

Online scan please


G0tu5D9.png
Emsisoft Emergency Kit - Fix Mode
Follow the instructions below to run a scan using the Emsisoft Emergency Kit.
  • Download the Emsisoft Emergency Kit and execute it. From there, click on the Install button to extract the program in the EEK folder;
  • Once the extraction is complete, the EEK folder will open. Right-click on
    G0tu5D9.png
    start emergency kit scanner.exe and select
    Spcusrh.png
    Run as Administrator (for Windows Vista, 7, 8, 8.1 and 10 users);
  • EEK will suggest that you run an online update before using the program. Click on Yes to launch it.
  • After the update, click on Malware Scan under 2. Scan and accept to let EEK detect PUPs (click on Yes).
  • Once the scan is complete, make sure that every item in the list is checked, and click on the Quarantine selected button;
  • If it asks you for a reboot to delete some items, click on Ok to reboot automatically;
  • After the restart, open EEK again (in the C:\EEK folder);
  • This time, click on Logs;
  • From there, go under the Quarantine Log tab, and click on the Export button;
  • Save the log on your desktop, then open it, and copy/paste its content in your next reply;
 
Hello, thank you for your reply =)
I will do the new scan, when Windows 10 OEM built-in becomes not activated again. So that the virus won't be hidding.

The Ubuntu issue was just because past bug/virus did not let me re-do double boot, but I think this bug/virus is gone =) .
I will do what you are asking =)

Today I discovered one thing, it wasn't Windows that did re-activate it, my opinion and feelings were wrong, no fix yet on my computer.

It is just aswMBR:
0- The bug or virus was here, Windows is not activated inside + the warning rectangle pop up.
1- I clicked on it once and then got the virtualization option and clicked yes, and Windows crashed.
2- Windows did restart with Windows is not activated inside, but no more pop up rectangle in the bottom right.
3- I added a Win8 compatibility layer to aswMBR, but I just opened it (after the opening test whom I don't know if it opened it or not) a second time (could be considered a third time since there was the test), and Windows crashed again with the blue background saying to check with a good smartphone the square at: http://www.windows.com/stopcode
4- Windows did restart with Windows is activated inside and no pop up rectangle.

So the bug is not there when it detects aswMBR being launched, but then it will surely come back at night. So this is the second time it happens to me when trying to open aswMBR. Not a proof, but possible.

So if it reacts to me trying to launch aswMBR, could be a Windows 10 virus, so each time the bug or virus will come back, I will click on aswMBR, then I will probably crash, then I will click again on aswMBR, and if I crash again and Windows gets re-activated without me having to spam Windows server, then we can be sure it to be a virus.

So I can't explain one of the times it did re-activate without me alone, but some chance it can be re-activated just by detecting the execution of aswMBR.

This said I'm not interested in informatics, just trying to help out =) :oreo:

Some times I can attach files, now for this message I can't, and there was one of the messages before where I couldn't upload pics, I did resize them to smaller, but it was not that. Seems like, if it is not you that decides when I can attach something, virus can also block computer communications :/ It's just the smartphone square, nothing important, I'll send it later. Those bugs can kill anyones life :/

Thank you very much, I might reply tomorrow or tonight, as I am waiting for Windows not to be activated again by himself =)
 
So if it reacts to me trying to launch aswMBR, could be a Windows 10 virus
Click to expand...
The problem here is that aswMBR ( it's not a virus) has not been updated to comply and be compatible with all versions of windows 10 and with all updates that have gone out since the tool was created,
When people tell me it crashed or crashes there computer I just tell them we will proceed without it.
For your machine, don't use it, if you see an icon or any files for it just go on and delete it.
 
Hello, Windows stayed Activated all day long. And there was this time a true Update from Windows. So I don't know if it fixed it. I will see after it all to defrag, shrink and maybe or maybe not buy a non digital licence of Windows 10, but not now. And also to check if anything wrong in hardware, as I read on Windows website, that Acer could have added some hardware changes before selling my computer, could be the Nvidia as it was a sell argument, and that could have caused the issue, or I think maybe as my computer is old, something I can't see, because I'm not in informatics, could be going wrong with my computer, but I had bought a big ventilator to put it on (outside, it's an object like a table or a mouse support), so I don't think, even if it was more then 5 years later, something will burn. I think in my last computer many things had burned, starting the screen, but I don't know how to check those. I might also have a small issue with the CMOS small battery as last year I had time issues on both Windows and Ubuntu, but I don't have the level to find it and to change it, if so, maybe one day I will ask one repair, but not this year, maybe in 2 years, as I consider it an expense that is not in first technological needs. But anyway, my problem, not yours at all =)

For rooting my phone, I didn't use this APK and none of the related files, and as I stopped playing my game, and got lucky that my SD card had an unknown incident after I said goodbye to all my game friends, and as I don't use it that much, I'm not using the root part anymore. But this antivirus didn't detect the .zip file that contains it, so there are 4 issues of the same. Not sure if I should delete it ? I did call Samsung before I had rooted it, they said only a problem if I sell rooting ways, not a problem if I root it for myself.

And I didn't try the GIMP plugins in Windows as most of them requires Linux.

Thanks a lot =)

*-*-*-*

Emsisoft Emergency Kit 2018.6.0.8742 stable [en-us]
OS: Windows 10 (Version 10.0, Build 17134, 64-bit Edition)

Forensics log

Date Component Action Details
22/11/2018 18:58:21 User EARENDIL-LIGHT\FRANçOISE Infection quarantined Malware "Application.DealAgent.TGX (B)" in "GIMP Instagram Effects_2707362728.exe".
22/11/2018 18:58:21 User EARENDIL-LIGHT\FRANçOISE Infection quarantined Malware "Android.Riskware.FakeApk.gUKNG (B)" in "Superuser.apk".
22/11/2018 18:58:21 User EARENDIL-LIGHT\FRANçOISE Infection quarantined Malware "Android.Riskware.FakeApk.gUKNG (B)" in "Superuser.apk".
22/11/2018 18:54:49 Scanner Scan finished Found 3 objects , user to decide on further actions.
22/11/2018 18:47:49 Scanner Detection PUP "Application.DealAgent.TGX (B)" in "GIMP Instagram Effects_2707362728.exe" (SHA1: 7b60972858a267aa87ee62f5e167ed797351d197) and 2 other objects
22/11/2018 18:44:00 User EARENDIL-LIGHT\Françoise Scan started Malware Scan
22/11/2018 18:43:59 User EARENDIL-LIGHT\Françoise Setting modified "Detect PUPs" has been changed to "Enabled".
22/11/2018 18:43:33 User Update Downloaded and installed 87 files (18538 kb) (52 sec.).
22/11/2018 15:17:45 User Update Downloaded and installed 77 files (17570 kb) (1 min. 9 sec.).
22/11/2018 15:16:37 Core Notification "Recommended Reading:Beware: New wave of malware spreads via ISO file email attachments".
22/11/2018 15:16:34 User Update Failed with error "Server returned error" (0 sec.).
 
Much information has come out lately of malware in androids, I wouldn't be so quick to download stuff.....
There are antivirus and malware scanners for android

https://www.malwarebytes.com/android/

It's easy to Google.

Now that windows is acting as it should the problem might have been related to issues with windows updates, might sound absurd but it happens alot.

Let's give it a day ot two and watch.
 
Oh, thank you =)
I have plenty to do with family hole day, I'll watch over it later. I will be less active next week as I will travel 2 days.
I'll also have to run all of your programs on the external disk for myself because of the files dissapearing long time past issue on C:\. But I hesitate going in a forum, as I am flood person and I was before on Linux where you solve all the bugs yourself or format it (but before flood was forbidden), and as also I don't speak like people who are in informatics. But nowdays the " format it " don't work as the USB and DVD-ROM have less good quality, and as many gets locked of from installing any OS, be Windows or Linux. Maybe also memory writting support is also nowdays less good quality even in what was in past computers good computers that could support being many times formatted or having many times same OS re-installed. I'm not alone in this formatting hesitation issue :snorkle:.
The one letter issue added to my Administrator username could be related or could not be related to me having a " ç ". I have changed it to " fran ", but if it is not during Windows installation (from inside), there is no change, " franc " is still there.
I had a thought about ReactOS, but seems like it's not enough maintained, needs more then 1000 persons on a OS, not 10, so no need to imagine myself installing Spybot on it, only if one day they emerge, but they might be better then Wine.
I could if I wanted buy Windows 10 Home PPF, but not a new computer. I prefer waiting the day I get a job, as I have my requirements that are high, so economy is better, if I can't reach what I want. =)
I don't have much time.
Thanks Spybot for all =)
 
Today I got twice Windows Defender Anti-Virus and Spybot are both turned off, second time was too fast, it doesn't stay in notification.

Even if it is a virus, it is also a permission issue, so you can't do nothing about it. In fact I did succeed in installing on Windows 10, HWiNFO (used by Nasa in their adds so shouldn't be deprecated... ^^), at first it worked, the it dissapeared, then I tried installing it with Windows XP, Windows 7, Windows 10 compatibility, and no compatibility did succeed in having permission to overwrite the program that was not launching (as administrator) anymore. So I couldn't memorize what was my Wifi pilot.

If it is virus, seems like it is interested in me not knowing my pilots, although, I must have tons of them saved, I just wanted to write down the name. The secure boot is said to be disabled in the HWiNFO I had no time to screenshot, but on the other ones it seems to be either a feature, either enabled, I don't know, and it had said UEFI enable in the same board I couldn't save image.

It's Windows that must improve security in permission issues. I think the delete all Images and Documents, maybe also Video and Music folder content back in past did screw that up long time ago, even in installing Windows 10 from inside. Download folder had no issue, as as weird as it is, there are 2 Download folders in my computer, maybe because language was fr, or because of whatever is roaming, so the one I was using had no virus issue.

I was "Françoise" as admin, "franc" by Windows or Virus since long ago, (maybe many) re-install from inside, and now I am "fran" as admin, but the "franc" stayed in the users folder.

I just add you the " log " of this installation issue, although, it is most Windows that it concerns, because I cannot know, because I don't have the level to know, if this could be related to a virus.

Activation virus not back yet, but the day begun well :/

This is funny I can attach screen capture of HWiNFO issue, but not past non important at all, screen capture of the 2 asWMBR issues in blue with the smartphone error code :/ ???


Thanks =)
 

Attachments

  • CHWiNFOAcerAspire-b-25-11-2018.jpg
    CHWiNFOAcerAspire-b-25-11-2018.jpg
    98.7 KB · Views: 1
  • Access is denied re-install HWiNFO64 that stopped working 25 11 2018.jpg
    Access is denied re-install HWiNFO64 that stopped working 25 11 2018.jpg
    89.9 KB · Views: 1
Status
Not open for further replies.
Back
Top