Javascript Disabled Detected

You currently have javascript disabled. Several functions may not work. Please re-enable javascript to access full functionality.

General Cleanup Needed

Started by DC0001 , Feb 03 2018 12:09 AM

Pop-ups Chromium

This topic is locked

17 replies to this topic

#1 DC0001

Member

Full Member
35 posts

Posted 03 February 2018 - 12:09 AM

Hi, I've got general pop-ups and infested browsers, but nothing too serious, hopefully. Got a BS "Chromium" browser on the toolbar. I'd just like some help cleaning it all up.

This is an HP dv6 Notebook PC laptop running Windows 7 Professional. Service Pack 1.

8.0 GB RAM

64-bit OS

Hard drive has about 12 out of 127 GB free.

Ran Malwarebytes:

Instructions don't seem to match current version. History and scan log export options aren't available.

Ran Farbar Recovery Scan Tool: log "frst.txt" and "addition" under SWI Logs under Documents:

Scan result of Farbar Recovery Scan Tool (FRST) (x64) Version: 27.01.2018

Ran by David (administrator) on DAVID-LAPTOP (01-02-2018 20:24:29)

Running from C:\Users\David\Desktop

Loaded Profiles: David (Available Profiles: UpdatusUser & David)

Platform: Windows 7 Professional Service Pack 1 (X64) Language: English (United States)

Internet Explorer Version 11 (Default browser: Chrome)

Boot Mode: Normal

Tutorial for Farbar Recovery Scan Tool: http://www.geekstogo...very-scan-tool/

==================== Processes (Whitelisted) =================

(If an entry is included in the fixlist, the process will be closed. The file will not be moved.)

(HP) C:\Program Files (x86)\HP SimplePass\TrueSuiteService.exe

(NVIDIA Corporation) C:\Windows\System32\nvvsvc.exe

(IDT, Inc.) C:\Program Files\IDT\WDM\stacsv64.exe

(Hewlett-Packard Company) C:\Windows\System32\hpservice.exe

(NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\Display\nvxdsync.exe

(NVIDIA Corporation) C:\Windows\System32\nvvsvc.exe

(DisplayLink Corp.) C:\Program Files\DisplayLink Core Software\8.2.1956.0\DisplayLinkManager.exe

(DisplayLink Corp.) C:\Program Files\DisplayLink Core Software\8.2.1956.0\DisplayLinkUserAgent.exe

(AVAST Software) C:\Program Files\AVAST Software\Avast\AvastSvc.exe

(Adobe Systems Incorporated) C:\Program Files (x86)\Adobe\Elements Organizer 8.0\PhotoshopElementsFileAgent.exe

(Adobe Systems Incorporated) C:\Program Files (x86)\Adobe\Elements 9 Organizer\PhotoshopElementsFileAgent.exe

(Apple Inc.) C:\Program Files\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe

(Apple Inc.) C:\Program Files\Bonjour\mDNSResponder.exe

(Microsoft Corporation) C:\Program Files\Microsoft Office 15\ClientX64\officeclicktorun.exe

(VMware, Inc.) C:\Program Files (x86)\VMware\VMware Horizon View Client\ClientService\horizon_client_service.exe

(Portrait Disbbut nplays, Inc.) C:\Program Files (x86)\Common Files\Portrait Displays\Shared\DTSRVC.exe

() C:\Program Files\Common Files\VMware\DeviceRedirectionCommon\ftnlsv.exe

(Hewlett-Packard Company) C:\Program Files\Hewlett-Packard\HP Client Services\HPClientServices.exe

(Hewlett-Packard Development Company, L.P.) C:\Program Files (x86)\Hewlett-Packard\HP Quick Launch\HPWMISVC.exe

(Intel® Corporation) C:\Program Files\Intel\iCLS Client\HeciServer.exe

(Portrait Displays, Inc.) C:\Program Files (x86)\Common Files\Portrait Displays\Drivers\pdisrvc.exe

() C:\Program Files (x86)\Photodex\ProShowGold\scsiaccess.exe

(AVG Secure Search) C:\Program Files (x86)\Common Files\AVG Secure Search\vToolbarUpdater\15.5.0\ToolbarUpdater.exe

() C:\Program Files (x86)\Lavasoft\Web Companion\Application\Lavasoft.WCAssistant.WinService.exe

(Microsoft Corp.) C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE

(Yahoo! Inc.) C:\Program Files (x86)\Yahoo!\SoftwareUpdate\YahooAUService.exe

(Malwarebytes) C:\Program Files\Malwarebytes\Anti-Malware\MBAMService.exe

(Microsoft Corp.) C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVCM.EXE

(VMware, Inc.) C:\Program Files (x86)\VMware\VMware Horizon View Client\vmware-view-usbd.exe

(AVAST Software) C:\Program Files\AVAST Software\Avast\x64\aswidsagenta.exe

(AuthenTec Inc.) C:\Program Files (x86)\HP SimplePass\TouchControl.exe

(DisplayLink Corp.) C:\Program Files\DisplayLink Core Software\8.2.1956.0\DisplayLinkUI.exe

(Microsoft Corporation) C:\Windows\System32\rundll32.exe

(Synaptics Incorporated) C:\Program Files\Synaptics\SynTP\SynTPEnh.exe

(IDT, Inc.) C:\Program Files\IDT\WDM\sttray64.exe

(Apple Inc.) C:\Program Files\iTunes\iTunesHelper.exe

(AVAST Software) C:\Program Files\AVAST Software\Avast\AvastUI.exe

(Lavasoft) C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exe

(Apple Inc.) C:\Program Files (x86)\Common Files\Apple\Internet Services\iCloudServices.exe

() C:\Program Files (x86)\Itibiti Soft Phone\Phone\Itibiti.exe

(NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\Display\nvtray.exe

(Intel Corporation) C:\Program Files (x86)\Intel\Intel® USB 3.0 eXtensible Host Controller Driver\Application\iusb3mon.exe

(Hewlett-Packard Development Company, L.P.) C:\Program Files (x86)\Hewlett-Packard\HP On Screen Display\HPOSD.exe

(Hewlett-Packard Development Company, L.P.) C:\Program Files (x86)\Hewlett-Packard\HP CoolSense\CoolSense.exe

(Apple Inc.) C:\Program Files\iPod\bin\iPodService.exe

() C:\Program Files (x86)\HP SimplePass\IEWebSiteLogon.exe

() C:\Program Files (x86)\Portrait Displays\Pivot Software\wpCtrl.exe

(Hewlett-Packard Company) C:\Program Files (x86)\Hewlett-Packard\Shared\hpqwmiex.exe

(Synaptics Incorporated) C:\Program Files\Synaptics\SynTP\SynTPHelper.exe

() C:\Program Files (x86)\Portrait Displays\Pivot Software\Floater.exe

(Hewlett-Packard Development Company, L.P.) C:\Program Files (x86)\Hewlett-Packard\HP Quick Launch\HPMSGSVC.exe

(CyberLink Corp.) C:\Program Files (x86)\CyberLink\PowerDVD10\PDVD10Serv.exe

(Portrait Displays, Inc) C:\Program Files (x86)\Hewlett-Packard\HP My Display\dthtml.exe

(cyberlink) C:\Program Files (x86)\CyberLink\Shared files\brs.exe

(CANON INC.) C:\Program Files (x86)\Canon\IJ Network Scanner Selector EX\CNMNSST.exe

(Apple Inc.) C:\Program Files (x86)\Common Files\Apple\Apple Application Support\APSDaemon.exe

(Microsoft Corporation) C:\Windows\Microsoft.NET\Framework64\v3.0\WPF\PresentationFontCache.exe

(CyberLink) C:\Program Files (x86)\CyberLink\YouCam\YCMMirage.exe

(Microsoft Corporation) C:\Windows\System32\dllhost.exe

() C:\Program Files (x86)\VMware\ScannerRedirection\ftscanmgrhv.exe

(HP Inc.) C:\Program Files (x86)\Hewlett-Packard\HP Support Solutions\HPSupportSolutionsFrameworkService.exe

(HP Inc.) C:\Program Files\HP\HP Touchpoint Analytics Client\TouchpointAnalyticsClientService.exe

(Intuit Inc.) C:\Program Files (x86)\Common Files\Intuit\Update Service v4\IntuitUpdateService.exe

(VMware) C:\Program Files (x86)\Common Files\VMware\SerialPortRedirection\Client\vmwsprrdpwks.exe

(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe

(Microsoft Corporation.) C:\Program Files (x86)\Microsoft\BingBar\7.3.132.0\SeaPort.EXE

(Malwarebytes) C:\Program Files\Malwarebytes\Anti-Malware\mbamtray.exe

(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe

==================== Registry (Whitelisted) ===========================

(If an entry is included in the fixlist, the registry item will be restored to default or removed. The file will not be moved.)

HKLM\...\Run: [SynTPEnh] => C:\Program Files\Synaptics\SynTP\SynTPEnh.exe [2837288 2011-10-13] (Synaptics Incorporated)

HKLM\...\Run: [SysTrayApp] => C:\Program Files\IDT\WDM\sttray64.exe [1425408 2013-05-24] (IDT, Inc.)

HKLM\...\Run: [VMware Netlink 3 HV Install Utility] => C:\Program Files\Common Files\VMware\DeviceRedirectionCommon\ftnliu.exe [78752 2016-10-03] ()

HKLM\...\Run: [AvastUI.exe] => C:\Program Files\AVAST Software\Avast\AvLaunch.exe [246120 2018-01-07] (AVAST Software)

HKLM\...\Run: [iTunesHelper] => C:\Program Files\iTunes\iTunesHelper.exe [303928 2017-07-14] (Apple Inc.)

HKLM-x32\...\Run: [USB3MON] => C:\Program Files (x86)\Intel\Intel® USB 3.0 eXtensible Host Controller Driver\Application\iusb3mon.exe [291096 2011-12-05] (Intel Corporation)

HKLM-x32\...\Run: [HPOSD] => C:\Program Files (x86)\Hewlett-Packard\HP On Screen Display\HPOSD.exe [379960 2011-08-19] (Hewlett-Packard Development Company, L.P.)

HKLM-x32\...\Run: [HP CoolSense] => C:\Program Files (x86)\Hewlett-Packard\HP CoolSense\CoolSense.exe [1343904 2012-11-05] (Hewlett-Packard Development Company, L.P.)

HKLM-x32\...\Run: [PivotSoftware] => C:\Program Files (x86)\Portrait Displays\Pivot Software\wpctrl.exe [694824 2009-03-03] ()

HKLM-x32\...\Run: [DT HPC] => C:\Program Files (x86)\Common Files\Portrait Displays\Shared\DT_startup.exe [120400 2012-08-17] (Portrait Displays, Inc.)

HKLM-x32\...\Run: [HP Quick Launch] => C:\Program Files (x86)\Hewlett-Packard\HP Quick Launch\HPMSGSVC.exe [578944 2012-03-05] (Hewlett-Packard Development Company, L.P.)

HKLM-x32\...\Run: [RemoteControl10] => C:\Program Files (x86)\CyberLink\PowerDVD10\PDVD10Serv.exe [93296 2012-07-13] (CyberLink Corp.)

HKLM-x32\...\Run: [BDRegion] => C:\Program Files (x86)\Cyberlink\Shared files\brs.exe [78352 2012-09-03] (cyberlink)

HKLM-x32\...\Run: [] => [X]

HKLM-x32\...\Run: [IAStorIcon] => C:\Program Files (x86)\Intel\Intel® Rapid Storage Technology\IAStorIcon.exe

HKLM-x32\...\Run: [IJNetworkScannerSelectorEX] => C:\Program Files (x86)\Canon\IJ Network Scanner Selector EX\CNMNSST.exe [454248 2013-08-02] (CANON INC.)

HKLM-x32\...\Run: [SilentCleanService] => C:\Program Files (x86)\iMobie\AnyTrans\${CHECK_RUNSERVICE_NAME}

Winlogon\Notify\igfxcui: C:\Windows\system32\igfxdev.dll (Intel Corporation)

HKLM\SOFTWARE\Policies\Microsoft\Windows Defender: Restriction <==== ATTENTION

HKU\S-1-5-21-2096361384-901469764-2865818563-1002\...\Run: [ApplePhotoStreams] => C:\Program Files (x86)\Common Files\Apple\Internet Services\ApplePhotoStreams.exe [67896 2017-07-14] (Apple Inc.)

HKU\S-1-5-21-2096361384-901469764-2865818563-1002\...\Run: [Web Companion] => C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exe [7704168 2017-12-20] (Lavasoft)

HKU\S-1-5-21-2096361384-901469764-2865818563-1002\...\Run: [Itibiti.exe] => C:\Program Files (x86)\Itibiti Soft Phone\ItibitiLauncher.exe [2638848 2017-09-11] () <==== ATTENTION

HKU\S-1-5-21-2096361384-901469764-2865818563-1002\...\Run: [CAHeadless] => C:\Program Files (x86)\Adobe\Elements Organizer 8.0\CAHeadless\ElementsAutoAnalyzer.exe [615808 2009-10-09] (Adobe Systems Incorporated)

HKU\S-1-5-21-2096361384-901469764-2865818563-1002\...\Run: [iCloudServices] => C:\Program Files (x86)\Common Files\Apple\Internet Services\iCloudServices.exe [67384 2017-07-14] (Apple Inc.)

AppInit_DLLs: C:\Windows\system32\nvinitx.dll => C:\Windows\system32\nvinitx.dll [245872 2013-02-27] (NVIDIA Corporation)

AppInit_DLLs-x32: C:\Windows\SysWOW64\nvinit.dll => C:\Windows\SysWOW64\nvinit.dll [201576 2013-02-27] (NVIDIA Corporation)

GroupPolicy\User: Restriction <==== ATTENTION

CHR HKU\S-1-5-21-2096361384-901469764-2865818563-1002\SOFTWARE\Policies\Google: Restriction <==== ATTENTION

==================== Internet (Whitelisted) ====================

(If an item is included in the fixlist, if it is a registry item it will be removed or restored to default.)

Tcpip\Parameters: [DhcpNameServer] 192.168.1.1

Tcpip\..\Interfaces\{214ED3E9-4B87-41E5-A2A3-623DBFF8C4F6}: [DhcpNameServer] 192.168.1.1

Tcpip\..\Interfaces\{8D9F6BE3-6D4D-4F1A-B43C-1A2D2EEC075E}: [DhcpNameServer] 172.168.0.2

Internet Explorer:

==================

HKLM\SOFTWARE\Policies\Microsoft\Internet Explorer: Restriction <==== ATTENTION

HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = www.google.com

HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Start Page = www.google.com

HKU\S-1-5-21-2096361384-901469764-2865818563-1002\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = hxxp://g.msn.com/HPNOT/1

URLSearchHook: HKU\S-1-5-21-2096361384-901469764-2865818563-1002 - YTNavAssistPlugin Class - {81017EA9-9AA8-4A6A-9734-7AF40E7D593F} - C:\Program Files (x86)\Yahoo!\Companion\Installs\cpn2\yt.dll No File

SearchScopes: HKLM -> DefaultScope value is missing

SearchScopes: HKLM -> {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = hxxp://www.bing.com/search?q={searchTerms}&form=HPNTDF&pc=HPNTDF&src=IE-SearchBox

SearchScopes: HKLM -> {A181A777-A6DF-4D92-B1C6-88C0DE651139} URL = hxxp://www.amazon.com/s/ref=azs_osd_iea?ie=UTF-8&tag=hp-us2-vsb-20&link%5Fcode=qs&index=aps&field-keywords={searchTerms}

SearchScopes: HKLM -> {D944BB61-2E34-4DBF-A683-47E505C587DC} URL = hxxp://rover.ebay.com/rover/1/711-30572-11896-2/4?mpre=hxxp://www.ebay.com/sch/i.html?_nkw={searchTerms}

SearchScopes: HKLM-x32 -> DefaultScope value is missing

SearchScopes: HKLM-x32 -> {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = hxxp://www.bing.com/search?q={searchTerms}&form=HPNTDF&pc=HPNTDF&src=IE-SearchBox

SearchScopes: HKLM-x32 -> {D944BB61-2E34-4DBF-A683-47E505C587DC} URL = hxxp://rover.ebay.com/rover/1/711-30572-11896-2/4?mpre=hxxp://www.ebay.com/sch/i.html?_nkw={searchTerms}

SearchScopes: HKU\S-1-5-21-2096361384-901469764-2865818563-1002 -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = hxxp://www.bing.com/search?q={searchTerms}&form=HPNTDF&pc=HPNTDF&src=IE-SearchBox

SearchScopes: HKU\S-1-5-21-2096361384-901469764-2865818563-1002 -> {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = hxxp://www.bing.com/search?q={searchTerms}&form=HPNTDF&pc=HPNTDF&src=IE-SearchBox

SearchScopes: HKU\S-1-5-21-2096361384-901469764-2865818563-1002 -> {91607fa7-3c2f-4f90-93e3-d5337a6b0ac2} URL = Playbryte-serp-adk/search/redirect/?type=default&user_id=b53bab51-6b3e-4736-b02f-6129ed97f99e&query={searchTerms}

SearchScopes: HKU\S-1-5-21-2096361384-901469764-2865818563-1002 -> {D944BB61-2E34-4DBF-A683-47E505C587DC} URL = hxxp://rover.ebay.com/rover/1/711-30572-11896-2/4?mpre=hxxp://www.ebay.com/sch/i.html?_nkw={searchTerms}

BHO: Bing Bar Helper -> {1dad3af3-ef2f-4f64-ac4b-11789189fcb6} -> C:\Program Files (x86)\Microsoft\BingBar\7.3.132.0\amd64\BingExt.dll [2014-03-11] (Microsoft Corporation.)

BHO: Skype for Business Browser Helper -> {31D09BA0-12F5-4CCE-BE8A-2923E76605DA} -> C:\Program Files\Microsoft Office 15\root\VFS\ProgramFilesX64\Microsoft Office\Office15\OCHelper.dll [2017-12-12] (Microsoft Corporation)

BHO: Canon Easy-WebPrint EX BHO -> {3785D0AD-BFFF-47F6-BF5B-A587C162FED9} -> C:\Program Files (x86)\Canon\Easy-WebPrint EX\addon64\ewpexbho.dll [2014-01-24] (CANON INC.)

BHO: avast! Online Security -> {8E5E2654-AD2D-48bf-AC2D-D17F00898D06} -> C:\Program Files\AVAST Software\Avast\aswWebRepIE64.dll [2017-11-17] (AVAST Software)

BHO: Windows Live ID Sign-in Helper -> {9030D464-4C02-4ABF-8ECC-5164760863C6} -> C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll [2011-03-28] (Microsoft Corp.)

BHO: Office Document Cache Handler -> {B4F3A835-0E21-4959-BA22-42B3008E02FF} -> C:\Program Files\Microsoft Office 15\root\VFS\ProgramFilesX64\Microsoft Office\Office15\URLREDIR.DLL [2017-12-12] (Microsoft Corporation)

BHO: Microsoft SkyDrive Pro Browser Helper -> {D0498E0A-45B7-42AE-A9AA-ABA463DBD3BF} -> C:\Program Files\Microsoft Office 15\root\VFS\ProgramFilesX64\Microsoft Office\Office15\GROOVEEX.DLL [2017-12-12] (Microsoft Corporation)

BHO: HP Network Check Helper -> {E76FD755-C1BA-4DCB-9F13-99BD91223ADE} -> C:\Program Files (x86)\Hewlett-Packard\HP Support Framework\Resources\HPNetworkCheck\HPNetworkCheckPluginx64.dll [2016-07-21] (HP Inc.)

BHO-x32: &Yahoo! Toolbar Helper -> {02478D38-C3F9-4efb-9B51-7695ECA05670} -> C:\Program Files (x86)\Yahoo!\Companion\Installs\cpn2\yt.dll => No File

BHO-x32: Bing Bar Helper -> {1dad3af3-ef2f-4f64-ac4b-11789189fcb6} -> C:\Program Files (x86)\Microsoft\BingBar\7.3.132.0\BingExt.dll => No File

BHO-x32: Skype for Business Browser Helper -> {31D09BA0-12F5-4CCE-BE8A-2923E76605DA} -> C:\Program Files\Microsoft Office 15\root\Office15\OCHelper.dll [2017-08-15] (Microsoft Corporation)

BHO-x32: Canon Easy-WebPrint EX BHO -> {3785D0AD-BFFF-47F6-BF5B-A587C162FED9} -> C:\Program Files (x86)\Canon\Easy-WebPrint EX\ewpexbho.dll [2014-01-24] (CANON INC.)

BHO-x32: avast! Online Security -> {8E5E2654-AD2D-48bf-AC2D-D17F00898D06} -> C:\Program Files\AVAST Software\Avast\aswWebRepIE.dll [2017-11-17] (AVAST Software)

BHO-x32: Windows Live ID Sign-in Helper -> {9030D464-4C02-4ABF-8ECC-5164760863C6} -> C:\Program Files (x86)\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll => No File

BHO-x32: Office Document Cache Handler -> {B4F3A835-0E21-4959-BA22-42B3008E02FF} -> C:\Program Files\Microsoft Office 15\root\Office15\URLREDIR.DLL [2017-12-12] (Microsoft Corporation)

BHO-x32: Microsoft SkyDrive Pro Browser Helper -> {D0498E0A-45B7-42AE-A9AA-ABA463DBD3BF} -> C:\Program Files\Microsoft Office 15\root\Office15\GROOVEEX.DLL [2017-12-12] (Microsoft Corporation)

BHO-x32: HP Network Check Helper -> {E76FD755-C1BA-4DCB-9F13-99BD91223ADE} -> C:\Program Files (x86)\Hewlett-Packard\HP Support Framework\Resources\HPNetworkCheck\HPNetworkCheckPlugin.dll [2016-07-21] (HP Inc.)

Toolbar: HKLM - avast! Online Security - {318A227B-5E9F-45bd-8999-7F8F10CA4CF5} - No File

Toolbar: HKLM - No Name - {CC1A175A-E45B-41ED-A30C-C9B1D7A0C02F} - No File

Toolbar: HKLM - Bing Bar - {eec0f710-38b5-4aba-99bf-ec87564a4e13} - C:\Program Files (x86)\Microsoft\BingBar\7.3.132.0\amd64\BingExt.dll [2014-03-11] (Microsoft Corporation.)

Toolbar: HKLM - Canon Easy-WebPrint EX - {759D9886-0C6F-4498-BAB6-4A5F47C6C72F} - C:\Program Files (x86)\Canon\Easy-WebPrint EX\addon64\ewpexhlp.dll [2014-01-24] (CANON INC.)

Toolbar: HKLM-x32 - Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files (x86)\Yahoo!\Companion\Installs\cpn2\yt.dll No File

Toolbar: HKLM-x32 - Bing Bar - {eec0f710-38b5-4aba-99bf-ec87564a4e13} - C:\Program Files (x86)\Microsoft\BingBar\7.3.132.0\BingExt.dll No File

Toolbar: HKLM-x32 - Canon Easy-WebPrint EX - {759D9886-0C6F-4498-BAB6-4A5F47C6C72F} - C:\Program Files (x86)\Canon\Easy-WebPrint EX\ewpexhlp.dll No File

Toolbar: HKU\S-1-5-21-2096361384-901469764-2865818563-1002 -> No Name - {7FEBEFE3-6B19-4349-98D2-FFB09D4B49CA} - No File

Handler-x32: osf - {D924BDC6-C83A-4BD5-90D0-095128A113D1} - C:\Program Files\Microsoft Office 15\root\Office15\MSOSB.DLL [2017-07-18] (Microsoft Corporation)

FireFox:

========

FF Plugin: @adobe.com/FlashPlayer -> C:\Windows\system32\Macromed\Flash\NPSWF64_28_0_0_137.dll [2018-01-09] ()

FF Plugin: @microsoft.com/GENUINE -> disabled [No File]

FF Plugin: @Microsoft.com/NpCtrl,version=1.0 -> c:\Program Files\Microsoft Silverlight\5.1.50907.0\npctrl.dll [2017-05-03] ( Microsoft Corporation)

FF Plugin-x32: @adobe.com/FlashPlayer -> C:\Windows\SysWOW64\Macromed\Flash\NPSWF32_28_0_0_137.dll [2018-01-09] ()

FF Plugin-x32: @adobe.com/ShockwavePlayer -> C:\Windows\SysWOW64\Adobe\Director\np32dsw.dll [2011-11-07] (Adobe Systems, Inc.)

FF Plugin-x32: @authentec.com/ffwloplugin -> C:\Program Files (x86)\HP SimplePass\npffwloplugin.dll [2013-06-07] ( HP)

FF Plugin-x32: @canon.com/EPPEX -> C:\Program Files (x86)\Canon\My Image Garden\AddOn\CIG\npmigfpi.dll [2011-11-30] (CANON INC.)

FF Plugin-x32: @microsoft.com/GENUINE -> disabled [No File]

FF Plugin-x32: @microsoft.com/Lync,version=15.0 -> C:\Program Files\Microsoft Office 15\root\VFS\ProgramFilesX86\Mozilla Firefox\plugins\npmeetingjoinpluginoc.dll [2016-07-12] (Microsoft Corporation)

FF Plugin-x32: @Microsoft.com/NpCtrl,version=1.0 -> c:\Program Files (x86)\Microsoft Silverlight\5.1.50907.0\npctrl.dll [2017-05-03] ( Microsoft Corporation)

FF Plugin-x32: @microsoft.com/SharePoint,version=14.0 -> C:\Program Files\Microsoft Office 15\root\Office15\NPSPWRAP.DLL [2013-07-13] (Microsoft Corporation)

FF Plugin-x32: @microsoft.com/WLPG,version=15.4.3502.0922 -> C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll [2011-05-13] (Microsoft Corporation)

FF Plugin-x32: @microsoft.com/WLPG,version=15.4.3538.0513 -> C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll [2011-05-13] (Microsoft Corporation)

FF Plugin-x32: @photodex.com/PhotodexPresenter -> C:\Program Files (x86)\Photodex Presenter\npPxPlay.dll [2013-06-19] ( )

FF Plugin-x32: @tools.google.com/Google Update;version=3 -> C:\Program Files (x86)\Google\Update\1.3.33.7\npGoogleUpdate3.dll [2017-11-17] (Google Inc.)

FF Plugin-x32: @tools.google.com/Google Update;version=9 -> C:\Program Files (x86)\Google\Update\1.3.33.7\npGoogleUpdate3.dll [2017-11-17] (Google Inc.)

FF Plugin-x32: @WildTangent.com/GamesAppPresenceDetector,Version=1.0 -> C:\Program Files (x86)\WildTangent Games\App\BrowserIntegration\Registered\0\NP_wtapp.dll [2012-10-12] ()

FF Plugin-x32: Adobe Reader -> C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AIR\nppdf32.dll [2017-11-27] (Adobe Systems Inc.)

FF Plugin HKU\S-1-5-21-2096361384-901469764-2865818563-1002: @zoom.us/ZoomVideoPlugin -> C:\Users\David\AppData\Roaming\Zoom\bin\npzoomplugin.dll [2015-04-13] (Zoom Video Communications, Inc.)

FF Plugin HKU\S-1-5-21-2096361384-901469764-2865818563-1002: tdameritrade.com/tossc -> C:\Program Files (x86)\thinkTDA\tossc32.dll [2013-06-02] (TD Ameritrade)

Chrome:

=======

CHR DefaultProfile: Default

CHR Profile: C:\Users\David\AppData\Local\Google\Chrome\User Data\Default [2018-02-01]

CHR Extension: (HP Product Detection Plugin) - C:\Users\David\AppData\Local\Google\Chrome\User Data\Default\Extensions\aelbknmfcacjffmgnoaaonhgoghlmlkp [2013-12-05]

CHR Extension: (Docs) - C:\Users\David\AppData\Local\Google\Chrome\User Data\Default\Extensions\aohghmighlieiainnegkcijnfilokake [2018-02-01]

CHR Extension: (Google Drive) - C:\Users\David\AppData\Local\Google\Chrome\User Data\Default\Extensions\apdfllckaahabafndbhieahigkjlhalf [2015-12-31]

CHR Extension: (YouTube) - C:\Users\David\AppData\Local\Google\Chrome\User Data\Default\Extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo [2015-12-31]

CHR Extension: (Google Search) - C:\Users\David\AppData\Local\Google\Chrome\User Data\Default\Extensions\coobgpohoikkiipiblmjeljniedjpjpf [2015-12-31]

CHR Extension: (Avast SafePrice) - C:\Users\David\AppData\Local\Google\Chrome\User Data\Default\Extensions\eofcbnmajmjmplflapaojjnihcjkigck [2018-02-01]

CHR Extension: (Google Docs Offline) - C:\Users\David\AppData\Local\Google\Chrome\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi [2016-05-09]

CHR Extension: (Chrome Web Store Payments) - C:\Users\David\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda [2018-02-01]

CHR Extension: (Gmail) - C:\Users\David\AppData\Local\Google\Chrome\User Data\Default\Extensions\pjkljhegncpnkpknbcohdijeoejaedia [2015-05-03]

CHR Extension: (Chrome Media Router) - C:\Users\David\AppData\Local\Google\Chrome\User Data\Default\Extensions\pkedcjkdefgpdelpbcmbmeomcjbeemfm [2018-02-01]

CHR HKLM-x32\...\Chrome\Extension: [eofcbnmajmjmplflapaojjnihcjkigck] - hxxps://clients2.google.com/service/update2/crx

CHR HKLM-x32\...\Chrome\Extension: [gomekmidlodglbbmalcneegieacbdmki] - C:\Program Files\AVAST Software\Avast\WebRep\Chrome\aswWebRepChrome.crx <not found>

==================== Services (Whitelisted) ====================

(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)

R2 Apple Mobile Device Service; C:\Program Files\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe [83768 2017-04-03] (Apple Inc.)

R3 aswbIDSAgent; C:\Program Files\AVAST Software\Avast\x64\aswidsagenta.exe [7538536 2018-01-07] (AVAST Software)

R2 avast! Antivirus; C:\Program Files\AVAST Software\Avast\AvastSvc.exe [301168 2018-01-07] (AVAST Software)

R2 ClickToRunSvc; C:\Program Files\Microsoft Office 15\ClientX64\OfficeClickToRun.exe [3058392 2017-12-12] (Microsoft Corporation)

R2 client_service; C:\Program Files (x86)\VMware\VMware Horizon View Client\ClientService\horizon_client_service.exe [531432 2016-11-27] (VMware, Inc.)

S2 CLKMSVC10_38F51D56; C:\Program Files (x86)\CyberLink\PowerDVD10\NavFilter\kmsvc.exe [245264 2012-09-03] (CyberLink)

R2 DisplayLinkService; C:\Program Files\DisplayLink Core Software\8.2.1956.0\DisplayLinkManager.exe [12100264 2017-05-22] (DisplayLink Corp.)

R2 DTSRVC; C:\Program Files (x86)\Common Files\Portrait Displays\Shared\dtsrvc.exe [136784 2012-08-17] (Portrait Displays, Inc.)

R2 FPLService; C:\Program Files (x86)\HP SimplePass\TrueSuiteService.exe [1641768 2013-06-07] (HP)

R2 ftnlsv3hv; C:\Program Files\Common Files\VMware\DeviceRedirectionCommon\ftnlsv.exe [234400 2016-10-03] ()

R2 ftscanmgrhv; C:\Program Files (x86)\VMware\ScannerRedirection\ftscanmgrhv.exe [6331296 2016-10-18] ()

R2 HPSupportSolutionsFrameworkService; C:\Program Files (x86)\Hewlett-Packard\HP Support Solutions\HPSupportSolutionsFrameworkService.exe [332144 2017-11-21] (HP Inc.)

R2 HPTouchpointAnalyticsService; C:\Program Files\HP\HP Touchpoint Analytics Client\TouchpointAnalyticsClientService.exe [332216 2017-11-22] (HP Inc.)

R2 MBAMService; C:\Program Files\Malwarebytes\Anti-Malware\mbamservice.exe [6234056 2017-11-01] (Malwarebytes)

R2 ScsiAccess; C:\Program Files (x86)\Photodex\ProShowGold\ScsiAccess.exe [186760 2013-06-19] ()

S3 TrueService; C:\Program Files\Common Files\AuthenTec\TrueService.exe [401856 2013-01-07] (AuthenTec, Inc.)

R2 vmware-view-usbd; C:\Program Files (x86)\VMware\VMware Horizon View Client\vmware-view-usbd.exe [1169896 2016-11-24] (VMware, Inc.)

R2 vmwsprrdpwks; C:\Program Files (x86)\Common Files\VMware\SerialPortRedirection\Client\vmwsprrdpwks.exe [275872 2016-10-18] (VMware)

R2 vToolbarUpdater15.5.0; C:\Program Files (x86)\Common Files\AVG Secure Search\vToolbarUpdater\15.5.0\ToolbarUpdater.exe [1643184 2013-08-17] (AVG Secure Search)

R2 WCAssistantService; C:\Program Files (x86)\Lavasoft\Web Companion\Application\Lavasoft.WCAssistant.WinService.exe [25704 2017-12-20] ()

S3 WinDefend; C:\Program Files\Windows Defender\mpsvc.dll [1011712 2013-05-26] (Microsoft Corporation)

===================== Drivers (Whitelisted) ======================

(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)

R1 aswArPot; C:\Windows\System32\drivers\aswArPot.sys [185096 2018-01-07] (AVAST Software)

R1 aswbidsdriver; C:\Windows\System32\drivers\aswbidsdrivera.sys [321512 2018-01-07] (AVAST Software)

R0 aswbidsh; C:\Windows\System32\drivers\aswbidsha.sys [199448 2018-01-07] (AVAST Software)

R0 aswblog; C:\Windows\System32\drivers\aswbloga.sys [343768 2018-01-07] (AVAST Software)

R0 aswbuniv; C:\Windows\System32\drivers\aswbuniva.sys [57696 2018-01-07] (AVAST Software)

R1 aswHdsKe; C:\Windows\System32\drivers\aswHdsKe.sys [149344 2018-01-07] (AVAST Software)

S3 aswHwid; C:\Windows\System32\drivers\aswHwid.sys [46976 2018-01-07] (AVAST Software)

R1 aswKbd; C:\Windows\system32\drivers\aswKbd.sys [41832 2017-09-07] (AVAST Software)

R2 aswMonFlt; C:\Windows\System32\drivers\aswMonFlt.sys [146648 2018-01-12] (AVAST Software)

R1 aswRdr; C:\Windows\System32\drivers\aswRdr2.sys [110336 2018-01-07] (AVAST Software)

R0 aswRvrt; C:\Windows\System32\drivers\aswRvrt.sys [84384 2018-01-07] (AVAST Software)

R1 aswSnx; C:\Windows\System32\drivers\aswSnx.sys [1025176 2018-01-07] (AVAST Software)

R1 aswSP; C:\Windows\System32\drivers\aswSP.sys [457896 2018-01-12] (AVAST Software)

R2 aswStm; C:\Windows\System32\drivers\aswStm.sys [204456 2018-01-07] (AVAST Software)

R0 aswVmm; C:\Windows\System32\drivers\aswVmm.sys [358672 2018-01-07] (AVAST Software)

R1 avgtp; C:\Windows\system32\drivers\avgtpx64.sys [45856 2013-08-17] (AVG Technologies)

S3 DisplayLinkUsbIo_x64; C:\Windows\System32\DRIVERS\DisplayLinkUsbIo_x64_8.2.1956.0.sys [67296 2017-07-25] ()

S3 DisplayLinkUsbPort; C:\Windows\System32\DRIVERS\DisplayLinkUsbPort_6.3.38103.0.sys [17408 2013-05-04] (hxxp://libusb-win32.sourceforge.net)

S3 dlcdcecm; C:\Windows\System32\DRIVERS\dlcdcecm.sys [38400 2012-05-15] (DisplayLink Corp.)

S3 dlusbaudio; C:\Windows\System32\DRIVERS\dlusbaudio_x64.sys [192120 2012-05-15] (DisplayLink Corp.)

R1 ESProtectionDriver; C:\Windows\system32\drivers\mbae64.sys [77432 2017-11-29] ()

S3 IntcDAud; C:\Windows\System32\DRIVERS\IntcDAud.sys [331264 2011-12-06] (Intel® Corporation) [File not signed]

R2 MBAMChameleon; C:\Windows\System32\Drivers\MbamChameleon.sys [193968 2018-02-01] (Malwarebytes)

R3 MBAMFarflt; C:\Windows\System32\DRIVERS\farflt.sys [110016 2018-02-01] (Malwarebytes)

R3 MBAMProtection; C:\Windows\System32\DRIVERS\mbam.sys [46008 2018-02-01] (Malwarebytes)

R0 MBAMSwissArmy; C:\Windows\System32\Drivers\mbamswissarmy.sys [253880 2018-02-01] (Malwarebytes)

R3 MBAMWebProtection; C:\Windows\System32\DRIVERS\mwac.sys [84256 2018-02-01] (Malwarebytes)

S3 RSP2STOR; C:\Windows\System32\DRIVERS\RtsP2Stor.sys [259688 2011-10-27] (Realtek Semiconductor Corp.)

R3 SmbDrv; C:\Windows\system32\drivers\Smb_driver.sys [20016 2011-10-13] (Synaptics Incorporated)

S3 Afc; system32\drivers\Afc.sys [X]

S3 SWDUMon; system32\DRIVERS\SWDUMon.sys [X]

S3 vmwvusb; System32\Drivers\vmwvusb.sys [X]

==================== NetSvcs (Whitelisted) ===================

(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)

==================== One Month Created files and folders ========

(If an entry is included in the fixlist, the file/folder will be moved.)

2018-02-01 20:24 - 2018-02-01 20:24 - 000028911 _____ C:\Users\David\Desktop\FRST.txt

2018-02-01 20:22 - 2018-02-01 20:24 - 000000000 ____D C:\FRST

2018-02-01 20:15 - 2018-02-01 20:15 - 002393088 _____ (Farbar) C:\Users\David\Desktop\FRST64.exe

2018-02-01 20:06 - 2018-02-01 20:06 - 000000120 _____ C:\Users\David\Desktop\SWI Notes.txt

2018-02-01 19:47 - 2018-02-01 19:47 - 000000000 ____D C:\ProgramData\SWCUTemp

2018-02-01 19:00 - 2018-02-01 19:00 - 000193968 _____ (Malwarebytes) C:\Windows\system32\Drivers\MbamChameleon.sys

2018-02-01 18:59 - 2018-02-01 20:14 - 000001992 _____ C:\Users\Public\Desktop\Malwarebytes.lnk

2018-02-01 18:59 - 2018-02-01 20:14 - 000001992 _____ C:\ProgramData\Desktop\Malwarebytes.lnk

2018-02-01 18:59 - 2018-02-01 19:47 - 000110016 _____ (Malwarebytes) C:\Windows\system32\Drivers\farflt.sys

2018-02-01 18:59 - 2018-02-01 19:47 - 000084256 _____ (Malwarebytes) C:\Windows\system32\Drivers\mwac.sys

2018-02-01 18:59 - 2018-02-01 19:47 - 000046008 _____ (Malwarebytes) C:\Windows\system32\Drivers\mbam.sys

2018-02-01 18:59 - 2018-02-01 18:59 - 000253880 _____ (Malwarebytes) C:\Windows\system32\Drivers\mbamswissarmy.sys

2018-02-01 18:59 - 2018-02-01 18:59 - 000000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Malwarebytes

2018-02-01 18:59 - 2018-02-01 18:59 - 000000000 ____D C:\ProgramData\Malwarebytes

2018-02-01 18:59 - 2018-02-01 18:59 - 000000000 ____D C:\Program Files\Malwarebytes

2018-02-01 18:59 - 2017-11-29 09:11 - 000077432 _____ C:\Windows\system32\Drivers\mbae64.sys

2018-02-01 18:23 - 2018-02-01 18:24 - 082132184 _____ (Malwarebytes ) C:\Users\David\Downloads\mb3-setup-consumer-3.3.1.2183-1.0.262-1.0.3839.exe

2018-02-01 17:02 - 2018-02-01 17:02 - 000032832 _____ C:\Windows\SysWOW64\rnd_chunk.bin

2018-02-01 17:00 - 2018-02-01 17:56 - 000000000 ____D C:\ProgramData\UAB

2018-02-01 17:00 - 2018-02-01 17:00 - 000000000 ____D C:\ProgramData\Driver Support

2018-02-01 16:59 - 2018-02-01 16:59 - 000674496 _____ (PC Drivers HeadQuarters LP) C:\Users\David\Downloads\DriverSupport.exe

2018-01-08 17:04 - 2017-12-31 18:21 - 005581544 _____ (Microsoft Corporation) C:\Windows\system32\ntoskrnl.exe

2018-01-08 17:04 - 2017-12-31 18:21 - 001680616 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\ntfs.sys

2018-01-08 17:04 - 2017-12-31 18:21 - 000948968 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\ndis.sys

2018-01-08 17:04 - 2017-12-31 18:21 - 000708328 _____ (Microsoft Corporation) C:\Windows\system32\winload.efi

2018-01-08 17:04 - 2017-12-31 18:21 - 000288488 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\fltMgr.sys

2018-01-08 17:04 - 2017-12-31 18:21 - 000262376 _____ (Microsoft Corporation) C:\Windows\system32\hal.dll

2018-01-08 17:04 - 2017-12-31 18:21 - 000213736 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\rdyboost.sys

2018-01-08 17:04 - 2017-12-31 18:21 - 000154856 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\ksecpkg.sys

2018-01-08 17:04 - 2017-12-31 18:21 - 000114408 _____ (Microsoft Corporation) C:\Windows\system32\consent.exe

2018-01-08 17:04 - 2017-12-31 18:21 - 000095464 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\ksecdd.sys

2018-01-08 17:04 - 2017-12-31 18:19 - 001665384 _____ (Microsoft Corporation) C:\Windows\system32\ntdll.dll

2018-01-08 17:04 - 2017-12-31 18:18 - 014183936 _____ (Microsoft Corporation) C:\Windows\system32\shell32.dll

2018-01-08 17:04 - 2017-12-31 18:18 - 002066432 _____ (Microsoft Corporation) C:\Windows\system32\ole32.dll

2018-01-08 17:04 - 2017-12-31 18:18 - 002004480 _____ (Microsoft Corporation) C:\Windows\system32\msxml6.dll

2018-01-08 17:04 - 2017-12-31 18:18 - 001942016 _____ (Microsoft Corporation) C:\Windows\system32\authui.dll

2018-01-08 17:04 - 2017-12-31 18:18 - 001867776 _____ (Microsoft Corporation) C:\Windows\system32\ExplorerFrame.dll

2018-01-08 17:04 - 2017-12-31 18:18 - 001741312 _____ (Microsoft Corporation) C:\Windows\system32\sysmain.dll

2018-01-08 17:04 - 2017-12-31 18:18 - 001460736 _____ (Microsoft Corporation) C:\Windows\system32\lsasrv.dll

2018-01-08 17:04 - 2017-12-31 18:18 - 001361408 _____ (Microsoft Corporation) C:\Windows\system32\PeerDistSvc.dll

2018-01-08 17:04 - 2017-12-31 18:18 - 001212928 _____ (Microsoft Corporation) C:\Windows\system32\rpcrt4.dll

2018-01-08 17:04 - 2017-12-31 18:18 - 001163264 _____ (Microsoft Corporation) C:\Windows\system32\kernel32.dll

2018-01-08 17:04 - 2017-12-31 18:18 - 001110528 _____ (Microsoft Corporation) C:\Windows\system32\schedsvc.dll

2018-01-08 17:04 - 2017-12-31 18:18 - 000977408 _____ (Microsoft Corporation) C:\Windows\system32\inetcomm.dll

2018-01-08 17:04 - 2017-12-31 18:18 - 000961024 _____ (Microsoft Corporation) C:\Windows\system32\actxprxy.dll

2018-01-08 17:04 - 2017-12-31 18:18 - 000880640 _____ (Microsoft Corporation) C:\Windows\system32\advapi32.dll

2018-01-08 17:04 - 2017-12-31 18:18 - 000863232 _____ (Microsoft Corporation) C:\Windows\system32\IKEEXT.DLL

2018-01-08 17:04 - 2017-12-31 18:18 - 000842752 _____ (Microsoft Corporation) C:\Windows\system32\nshwfp.dll

2018-01-08 17:04 - 2017-12-31 18:18 - 000828928 _____ (Microsoft Corporation) C:\Windows\system32\MPSSVC.dll

2018-01-08 17:04 - 2017-12-31 18:18 - 000749568 _____ (Microsoft Corporation) C:\Windows\system32\FirewallAPI.dll

2018-01-08 17:04 - 2017-12-31 18:18 - 000731648 _____ (Microsoft Corporation) C:\Windows\system32\kerberos.dll

2018-01-08 17:04 - 2017-12-31 18:18 - 000705024 _____ (Microsoft Corporation) C:\Windows\system32\BFE.DLL

2018-01-08 17:04 - 2017-12-31 18:18 - 000690688 _____ (Microsoft Corporation) C:\Windows\system32\adtschema.dll

2018-01-08 17:04 - 2017-12-31 18:18 - 000512000 _____ (Microsoft Corporation) C:\Windows\system32\rpcss.dll

2018-01-08 17:04 - 2017-12-31 18:18 - 000503808 _____ (Microsoft Corporation) C:\Windows\system32\srcore.dll

2018-01-08 17:04 - 2017-12-31 18:18 - 000473600 _____ (Microsoft Corporation) C:\Windows\system32\taskcomp.dll

2018-01-08 17:04 - 2017-12-31 18:18 - 000463872 _____ (Microsoft Corporation) C:\Windows\system32\certcli.dll

2018-01-08 17:04 - 2017-12-31 18:18 - 000444928 _____ (Microsoft Corporation) C:\Windows\system32\winhttp.dll

2018-01-08 17:04 - 2017-12-31 18:18 - 000439296 _____ (Microsoft Corporation) C:\Windows\system32\p2psvc.dll

2018-01-08 17:04 - 2017-12-31 18:18 - 000419840 _____ (Microsoft Corporation) C:\Windows\system32\KernelBase.dll

2018-01-08 17:04 - 2017-12-31 18:18 - 000366592 _____ (Microsoft Corporation) C:\Windows\system32\wcncsvc.dll

2018-01-08 17:04 - 2017-12-31 18:18 - 000361984 _____ (Microsoft Corporation) C:\Windows\system32\wow64win.dll

2018-01-08 17:04 - 2017-12-31 18:18 - 000345600 _____ (Microsoft Corporation) C:\Windows\system32\schannel.dll

2018-01-08 17:04 - 2017-12-31 18:18 - 000327168 _____ (Microsoft Corporation) C:\Windows\system32\pnrpsvc.dll

2018-01-08 17:04 - 2017-12-31 18:18 - 000324096 _____ (Microsoft Corporation) C:\Windows\system32\FWPUCLNT.DLL

2018-01-08 17:04 - 2017-12-31 18:18 - 000316928 _____ (Microsoft Corporation) C:\Windows\system32\msv1_0.dll

2018-01-08 17:04 - 2017-12-31 18:18 - 000312320 _____ (Microsoft Corporation) C:\Windows\system32\ncrypt.dll

2018-01-08 17:04 - 2017-12-31 18:18 - 000303104 _____ (Microsoft Corporation) C:\Windows\system32\nlasvc.dll

2018-01-08 17:04 - 2017-12-31 18:18 - 000264704 _____ (Microsoft Corporation) C:\Windows\system32\P2P.dll

2018-01-08 17:04 - 2017-12-31 18:18 - 000243712 _____ (Microsoft Corporation) C:\Windows\system32\wow64.dll

2018-01-08 17:04 - 2017-12-31 18:18 - 000223232 _____ (Microsoft Corporation) C:\Windows\system32\ncsi.dll

2018-01-08 17:04 - 2017-12-31 18:18 - 000215552 _____ (Microsoft Corporation) C:\Windows\system32\winsrv.dll

2018-01-08 17:04 - 2017-12-31 18:18 - 000210432 _____ (Microsoft Corporation) C:\Windows\system32\wdigest.dll

2018-01-08 17:04 - 2017-12-31 18:18 - 000190464 _____ (Microsoft Corporation) C:\Windows\system32\rpchttp.dll

2018-01-08 17:04 - 2017-12-31 18:18 - 000181760 _____ (Microsoft Corporation) C:\Windows\system32\PeerDist.dll

2018-01-08 17:04 - 2017-12-31 18:18 - 000146432 _____ (Microsoft Corporation) C:\Windows\system32\msaudite.dll

2018-01-08 17:04 - 2017-12-31 18:18 - 000135680 _____ (Microsoft Corporation) C:\Windows\system32\sspicli.dll

2018-01-08 17:04 - 2017-12-31 18:18 - 000131584 _____ (Microsoft Corporation) C:\Windows\system32\PeerDistWSDDiscoProv.dll

2018-01-08 17:04 - 2017-12-31 18:18 - 000123904 _____ (Microsoft Corporation) C:\Windows\system32\bcrypt.dll

2018-01-08 17:04 - 2017-12-31 18:18 - 000120320 _____ (Microsoft Corporation) C:\Windows\system32\WcnApi.dll

2018-01-08 17:04 - 2017-12-31 18:18 - 000108544 _____ (Microsoft Corporation) C:\Windows\system32\icfupgd.dll

2018-01-08 17:04 - 2017-12-31 18:18 - 000101376 _____ (Microsoft Corporation) C:\Windows\system32\fdWCN.dll

2018-01-08 17:04 - 2017-12-31 18:18 - 000095744 _____ (Microsoft Corporation) C:\Windows\system32\rascfg.dll

2018-01-08 17:04 - 2017-12-31 18:18 - 000086528 _____ (Microsoft Corporation) C:\Windows\system32\TSpkg.dll

2018-01-08 17:04 - 2017-12-31 18:18 - 000084480 _____ (Microsoft Corporation) C:\Windows\system32\INETRES.dll

2018-01-08 17:04 - 2017-12-31 18:18 - 000076288 _____ (Microsoft Corporation) C:\Windows\system32\rasdiag.dll

2018-01-08 17:04 - 2017-12-31 18:18 - 000070656 _____ (Microsoft Corporation) C:\Windows\system32\nlaapi.dll

2018-01-08 17:04 - 2017-12-31 18:18 - 000070144 _____ (Microsoft Corporation) C:\Windows\system32\appinfo.dll

2018-01-08 17:04 - 2017-12-31 18:18 - 000063488 _____ (Microsoft Corporation) C:\Windows\system32\setbcdlocale.dll

2018-01-08 17:04 - 2017-12-31 18:18 - 000060928 _____ (Microsoft Corporation) C:\Windows\system32\ndptsp.tsp

2018-01-08 17:04 - 2017-12-31 18:18 - 000060416 _____ (Microsoft Corporation) C:\Windows\system32\msobjs.dll

2018-01-08 17:04 - 2017-12-31 18:18 - 000059904 _____ (Microsoft Corporation) C:\Windows\system32\appidapi.dll

2018-01-08 17:04 - 2017-12-31 18:18 - 000053760 _____ (Microsoft Corporation) C:\Windows\system32\vmicres.dll

2018-01-08 17:04 - 2017-12-31 18:18 - 000051200 _____ (Microsoft Corporation) C:\Windows\system32\PeerDistHttpTrans.dll

2018-01-08 17:04 - 2017-12-31 18:18 - 000050176 _____ (Microsoft Corporation) C:\Windows\system32\srclient.dll

2018-01-08 17:04 - 2017-12-31 18:18 - 000047104 _____ (Microsoft Corporation) C:\Windows\system32\kmddsp.tsp

2018-01-08 17:04 - 2017-12-31 18:18 - 000044032 _____ (Microsoft Corporation) C:\Windows\system32\csrsrv.dll

2018-01-08 17:04 - 2017-12-31 18:18 - 000043520 _____ (Microsoft Corporation) C:\Windows\system32\cryptbase.dll

2018-01-08 17:04 - 2017-12-31 18:18 - 000041472 _____ (Microsoft Corporation) C:\Windows\system32\rasmxs.dll

2018-01-08 17:04 - 2017-12-31 18:18 - 000039424 _____ (Microsoft Corporation) C:\Windows\system32\traffic.dll

2018-01-08 17:04 - 2017-12-31 18:18 - 000034816 _____ (Microsoft Corporation) C:\Windows\system32\appidsvc.dll

2018-01-08 17:04 - 2017-12-31 18:18 - 000029696 _____ (Microsoft Corporation) C:\Windows\system32\rasser.dll

2018-01-08 17:04 - 2017-12-31 18:18 - 000028672 _____ (Microsoft Corporation) C:\Windows\system32\sspisrv.dll

2018-01-08 17:04 - 2017-12-31 18:18 - 000028160 _____ (Microsoft Corporation) C:\Windows\system32\secur32.dll

2018-01-08 17:04 - 2017-12-31 18:18 - 000026112 _____ (Microsoft Corporation) C:\Windows\system32\oleres.dll

2018-01-08 17:04 - 2017-12-31 18:18 - 000024576 _____ (Microsoft Corporation) C:\Windows\system32\WcnEapPeerProxy.dll

2018-01-08 17:04 - 2017-12-31 18:18 - 000024064 _____ (Microsoft Corporation) C:\Windows\system32\WcnEapAuthProxy.dll

2018-01-08 17:04 - 2017-12-31 18:18 - 000022528 _____ (Microsoft Corporation) C:\Windows\system32\wfapigp.dll

2018-01-08 17:04 - 2017-12-31 18:18 - 000022016 _____ (Microsoft Corporation) C:\Windows\system32\credssp.dll

2018-01-08 17:04 - 2017-12-31 18:18 - 000016896 _____ (Microsoft Corporation) C:\Windows\system32\wshqos.dll

2018-01-08 17:04 - 2017-12-31 18:18 - 000016384 _____ (Microsoft Corporation) C:\Windows\system32\ntvdm64.dll

2018-01-08 17:04 - 2017-12-31 18:18 - 000013312 _____ (Microsoft Corporation) C:\Windows\system32\wshnetbs.dll

2018-01-08 17:04 - 2017-12-31 18:18 - 000013312 _____ (Microsoft Corporation) C:\Windows\system32\wow64cpu.dll

2018-01-08 17:04 - 2017-12-31 18:18 - 000008704 _____ (Microsoft Corporation) C:\Windows\system32\comcat.dll

2018-01-08 17:04 - 2017-12-31 18:18 - 000006656 _____ (Microsoft Corporation) C:\Windows\system32\apisetschema.dll

2018-01-08 17:04 - 2017-12-31 18:18 - 000006144 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-security-base-l1-1-0.dll

2018-01-08 17:04 - 2017-12-31 18:18 - 000005120 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-file-l1-1-0.dll

2018-01-08 17:04 - 2017-12-31 18:18 - 000004608 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-threadpool-l1-1-0.dll

2018-01-08 17:04 - 2017-12-31 18:18 - 000004608 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-processthreads-l1-1-0.dll

2018-01-08 17:04 - 2017-12-31 18:18 - 000004096 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-sysinfo-l1-1-0.dll

2018-01-08 17:04 - 2017-12-31 18:18 - 000004096 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-synch-l1-1-0.dll

2018-01-08 17:04 - 2017-12-31 18:18 - 000004096 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-localregistry-l1-1-0.dll

2018-01-08 17:04 - 2017-12-31 18:18 - 000004096 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-localization-l1-1-0.dll

2018-01-08 17:04 - 2017-12-31 18:18 - 000003584 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-rtlsupport-l1-1-0.dll

2018-01-08 17:04 - 2017-12-31 18:18 - 000003584 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-processenvironment-l1-1-0.dll

2018-01-08 17:04 - 2017-12-31 18:18 - 000003584 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-namedpipe-l1-1-0.dll

2018-01-08 17:04 - 2017-12-31 18:18 - 000003584 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-misc-l1-1-0.dll

2018-01-08 17:04 - 2017-12-31 18:18 - 000003584 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-memory-l1-1-0.dll

2018-01-08 17:04 - 2017-12-31 18:18 - 000003584 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-libraryloader-l1-1-0.dll

2018-01-08 17:04 - 2017-12-31 18:18 - 000003584 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-heap-l1-1-0.dll

2018-01-08 17:04 - 2017-12-31 18:18 - 000003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-xstate-l1-1-0.dll

2018-01-08 17:04 - 2017-12-31 18:18 - 000003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-util-l1-1-0.dll

2018-01-08 17:04 - 2017-12-31 18:18 - 000003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-string-l1-1-0.dll

2018-01-08 17:04 - 2017-12-31 18:18 - 000003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-profile-l1-1-0.dll

2018-01-08 17:04 - 2017-12-31 18:18 - 000003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-io-l1-1-0.dll

2018-01-08 17:04 - 2017-12-31 18:18 - 000003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-interlocked-l1-1-0.dll

2018-01-08 17:04 - 2017-12-31 18:18 - 000003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-handle-l1-1-0.dll

2018-01-08 17:04 - 2017-12-31 18:18 - 000003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-fibers-l1-1-0.dll

2018-01-08 17:04 - 2017-12-31 18:18 - 000003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-errorhandling-l1-1-0.dll

2018-01-08 17:04 - 2017-12-31 18:18 - 000003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-delayload-l1-1-0.dll

2018-01-08 17:04 - 2017-12-31 18:18 - 000003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-debug-l1-1-0.dll

2018-01-08 17:04 - 2017-12-31 18:18 - 000003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-datetime-l1-1-0.dll

2018-01-08 17:04 - 2017-12-31 18:18 - 000003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-console-l1-1-0.dll

2018-01-08 17:04 - 2017-12-31 18:18 - 000002048 _____ (Microsoft Corporation) C:\Windows\system32\msxml6r.dll

2018-01-08 17:04 - 2017-12-31 18:13 - 000631680 _____ (Microsoft Corporation) C:\Windows\system32\winresume.efi

2018-01-08 17:04 - 2017-12-31 18:04 - 000559616 _____ (Microsoft Corporation) C:\Windows\system32\spoolsv.exe

2018-01-08 17:04 - 2017-12-31 18:02 - 001314112 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ntdll.dll

2018-01-08 17:04 - 2017-12-31 18:00 - 012880384 _____ (Microsoft Corporation) C:\Windows\SysWOW64\shell32.dll

2018-01-08 17:04 - 2017-12-31 18:00 - 001499648 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ExplorerFrame.dll

2018-01-08 17:04 - 2017-12-31 18:00 - 001417728 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ole32.dll

2018-01-08 17:04 - 2017-12-31 18:00 - 001390080 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msxml6.dll

2018-01-08 17:04 - 2017-12-31 18:00 - 001114112 _____ (Microsoft Corporation) C:\Windows\SysWOW64\kernel32.dll

2018-01-08 17:04 - 2017-12-31 18:00 - 000741888 _____ (Microsoft Corporation) C:\Windows\SysWOW64\inetcomm.dll

2018-01-08 17:04 - 2017-12-31 18:00 - 000666624 _____ (Microsoft Corporation) C:\Windows\SysWOW64\nshwfp.dll

2018-01-08 17:04 - 2017-12-31 18:00 - 000666112 _____ (Microsoft Corporation) C:\Windows\SysWOW64\rpcrt4.dll

2018-01-08 17:04 - 2017-12-31 18:00 - 000554496 _____ (Microsoft Corporation) C:\Windows\SysWOW64\kerberos.dll

2018-01-08 17:04 - 2017-12-31 18:00 - 000463360 _____ (Microsoft Corporation) C:\Windows\SysWOW64\FirewallAPI.dll

2018-01-08 17:04 - 2017-12-31 18:00 - 000351744 _____ (Microsoft Corporation) C:\Windows\SysWOW64\winhttp.dll

2018-01-08 17:04 - 2017-12-31 18:00 - 000304640 _____ (Microsoft Corporation) C:\Windows\SysWOW64\taskcomp.dll

2018-01-08 17:04 - 2017-12-31 18:00 - 000276992 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wcncsvc.dll

2018-01-08 17:04 - 2017-12-31 18:00 - 000275456 _____ (Microsoft Corporation) C:\Windows\SysWOW64\KernelBase.dll

2018-01-08 17:04 - 2017-12-31 18:00 - 000261120 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msv1_0.dll

2018-01-08 17:04 - 2017-12-31 18:00 - 000254464 _____ (Microsoft Corporation) C:\Windows\SysWOW64\schannel.dll

2018-01-08 17:04 - 2017-12-31 18:00 - 000223232 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ncrypt.dll

2018-01-08 17:04 - 2017-12-31 18:00 - 000217600 _____ (Microsoft Corporation) C:\Windows\SysWOW64\P2P.dll

2018-01-08 17:04 - 2017-12-31 18:00 - 000216576 _____ (Microsoft Corporation) C:\Windows\SysWOW64\FWPUCLNT.DLL

2018-01-08 17:04 - 2017-12-31 18:00 - 000172032 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wdigest.dll

2018-01-08 17:04 - 2017-12-31 18:00 - 000162304 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ncsi.dll

2018-01-08 17:04 - 2017-12-31 18:00 - 000146432 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msaudite.dll

2018-01-08 17:04 - 2017-12-31 18:00 - 000141312 _____ (Microsoft Corporation) C:\Windows\SysWOW64\rpchttp.dll

2018-01-08 17:04 - 2017-12-31 18:00 - 000139776 _____ (Microsoft Corporation) C:\Windows\SysWOW64\PeerDist.dll

2018-01-08 17:04 - 2017-12-31 18:00 - 000096768 _____ (Microsoft Corporation) C:\Windows\SysWOW64\sspicli.dll

2018-01-08 17:04 - 2017-12-31 18:00 - 000084480 _____ (Microsoft Corporation) C:\Windows\SysWOW64\INETRES.dll

2018-01-08 17:04 - 2017-12-31 18:00 - 000082944 _____ (Microsoft Corporation) C:\Windows\SysWOW64\bcrypt.dll

2018-01-08 17:04 - 2017-12-31 18:00 - 000081920 _____ (Microsoft Corporation) C:\Windows\SysWOW64\fdWCN.dll

2018-01-08 17:04 - 2017-12-31 18:00 - 000081408 _____ (Microsoft Corporation) C:\Windows\SysWOW64\rascfg.dll

2018-01-08 17:04 - 2017-12-31 18:00 - 000065536 _____ (Microsoft Corporation) C:\Windows\SysWOW64\TSpkg.dll

2018-01-08 17:04 - 2017-12-31 18:00 - 000061952 _____ (Microsoft Corporation) C:\Windows\SysWOW64\rasdiag.dll

2018-01-08 17:04 - 2017-12-31 18:00 - 000060416 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msobjs.dll

2018-01-08 17:04 - 2017-12-31 18:00 - 000052224 _____ (Microsoft Corporation) C:\Windows\SysWOW64\nlaapi.dll

2018-01-08 17:04 - 2017-12-31 18:00 - 000050688 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ndptsp.tsp

2018-01-08 17:04 - 2017-12-31 18:00 - 000043008 _____ (Microsoft Corporation) C:\Windows\SysWOW64\srclient.dll

2018-01-08 17:04 - 2017-12-31 18:00 - 000033280 _____ (Microsoft Corporation) C:\Windows\SysWOW64\traffic.dll

2018-01-08 17:04 - 2017-12-31 18:00 - 000026112 _____ (Microsoft Corporation) C:\Windows\SysWOW64\oleres.dll

2018-01-08 17:04 - 2017-12-31 18:00 - 000022016 _____ (Microsoft Corporation) C:\Windows\SysWOW64\secur32.dll

2018-01-08 17:04 - 2017-12-31 18:00 - 000017408 _____ (Microsoft Corporation) C:\Windows\SysWOW64\credssp.dll

2018-01-08 17:04 - 2017-12-31 18:00 - 000005120 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wow32.dll

2018-01-08 17:04 - 2017-12-31 18:00 - 000002048 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msxml6r.dll

2018-01-08 17:04 - 2017-12-31 17:59 - 001806848 _____ (Microsoft Corporation) C:\Windows\SysWOW64\authui.dll

2018-01-08 17:04 - 2017-12-31 17:59 - 000690688 _____ (Microsoft Corporation) C:\Windows\SysWOW64\adtschema.dll

2018-01-08 17:04 - 2017-12-31 17:59 - 000644096 _____ (Microsoft Corporation) C:\Windows\SysWOW64\advapi32.dll

2018-01-08 17:04 - 2017-12-31 17:59 - 000342528 _____ (Microsoft Corporation) C:\Windows\SysWOW64\certcli.dll

2018-01-08 17:04 - 2017-12-31 17:59 - 000309760 _____ (Microsoft Corporation) C:\Windows\SysWOW64\actxprxy.dll

2018-01-08 17:04 - 2017-12-31 17:59 - 000050688 _____ (Microsoft Corporation) C:\Windows\SysWOW64\appidapi.dll

2018-01-08 17:04 - 2017-12-31 17:59 - 000006656 _____ (Microsoft Corporation) C:\Windows\SysWOW64\apisetschema.dll

2018-01-08 17:04 - 2017-12-31 17:59 - 000005120 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-file-l1-1-0.dll

2018-01-08 17:04 - 2017-12-31 17:59 - 000004608 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-processthreads-l1-1-0.dll

2018-01-08 17:04 - 2017-12-31 17:59 - 000004096 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-sysinfo-l1-1-0.dll

2018-01-08 17:04 - 2017-12-31 17:59 - 000004096 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-synch-l1-1-0.dll

2018-01-08 17:04 - 2017-12-31 17:59 - 000004096 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-misc-l1-1-0.dll

2018-01-08 17:04 - 2017-12-31 17:59 - 000004096 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-localregistry-l1-1-0.dll

2018-01-08 17:04 - 2017-12-31 17:59 - 000004096 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-localization-l1-1-0.dll

2018-01-08 17:04 - 2017-12-31 17:59 - 000003584 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-processenvironment-l1-1-0.dll

2018-01-08 17:04 - 2017-12-31 17:59 - 000003584 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-namedpipe-l1-1-0.dll

2018-01-08 17:04 - 2017-12-31 17:59 - 000003584 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-memory-l1-1-0.dll

2018-01-08 17:04 - 2017-12-31 17:59 - 000003584 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-libraryloader-l1-1-0.dll

2018-01-08 17:04 - 2017-12-31 17:59 - 000003584 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-interlocked-l1-1-0.dll

2018-01-08 17:04 - 2017-12-31 17:59 - 000003584 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-heap-l1-1-0.dll

2018-01-08 17:04 - 2017-12-31 17:59 - 000003072 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-string-l1-1-0.dll

2018-01-08 17:04 - 2017-12-31 17:59 - 000003072 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-rtlsupport-l1-1-0.dll

2018-01-08 17:04 - 2017-12-31 17:59 - 000003072 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-profile-l1-1-0.dll

2018-01-08 17:04 - 2017-12-31 17:59 - 000003072 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-io-l1-1-0.dll

2018-01-08 17:04 - 2017-12-31 17:59 - 000003072 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-handle-l1-1-0.dll

2018-01-08 17:04 - 2017-12-31 17:59 - 000003072 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-fibers-l1-1-0.dll

2018-01-08 17:04 - 2017-12-31 17:59 - 000003072 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-errorhandling-l1-1-0.dll

2018-01-08 17:04 - 2017-12-31 17:59 - 000003072 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-delayload-l1-1-0.dll

2018-01-08 17:04 - 2017-12-31 17:59 - 000003072 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-debug-l1-1-0.dll

2018-01-08 17:04 - 2017-12-31 17:59 - 000003072 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-datetime-l1-1-0.dll

2018-01-08 17:04 - 2017-12-31 17:59 - 000003072 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-console-l1-1-0.dll

2018-01-08 17:04 - 2017-12-31 17:55 - 000131584 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\pacer.sys

2018-01-08 17:04 - 2017-12-31 17:55 - 000088576 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\wanarp.sys

2018-01-08 17:04 - 2017-12-31 17:55 - 000058368 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\ndproxy.sys

2018-01-08 17:04 - 2017-12-31 17:55 - 000045056 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\netbios.sys

2018-01-08 17:04 - 2017-12-31 17:55 - 000024064 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\ndistapi.sys

2018-01-08 17:04 - 2017-12-31 17:54 - 004013800 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ntkrnlpa.exe

2018-01-08 17:04 - 2017-12-31 17:54 - 003959016 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ntoskrnl.exe

2018-01-08 17:04 - 2017-12-31 17:54 - 000077312 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\mpsdrv.sys

2018-01-08 17:04 - 2017-12-31 17:50 - 000455680 _____ (Microsoft Corporation) C:\Windows\system32\winlogon.exe

2018-01-08 17:04 - 2017-12-31 17:49 - 000148480 _____ (Microsoft Corporation) C:\Windows\system32\appidpolicyconverter.exe

2018-01-08 17:04 - 2017-12-31 17:49 - 000064000 _____ (Microsoft Corporation) C:\Windows\system32\auditpol.exe

2018-01-08 17:04 - 2017-12-31 17:49 - 000062464 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\appid.sys

2018-01-08 17:04 - 2017-12-31 17:49 - 000017920 _____ (Microsoft Corporation) C:\Windows\system32\appidcertstorecheck.exe

2018-01-08 17:04 - 2017-12-31 17:47 - 000244224 _____ (Microsoft Corporation) C:\Windows\system32\vmicsvc.exe

2018-01-08 17:04 - 2017-12-31 17:46 - 000338432 _____ (Microsoft Corporation) C:\Windows\system32\conhost.exe

2018-01-08 17:04 - 2017-12-31 17:46 - 000128512 _____ (Microsoft Corporation) C:\Windows\system32\IcCoinstall.dll

2018-01-08 17:04 - 2017-12-31 17:46 - 000051712 _____ (Microsoft Corporation) C:\Windows\system32\vmictimeprovider.dll

2018-01-08 17:04 - 2017-12-31 17:45 - 000296960 _____ (Microsoft Corporation) C:\Windows\system32\rstrui.exe

2018-01-08 17:04 - 2017-12-31 17:43 - 000086528 _____ (Microsoft Corporation) C:\Windows\SysWOW64\WcnApi.dll

2018-01-08 17:04 - 2017-12-31 17:43 - 000038912 _____ (Microsoft Corporation) C:\Windows\SysWOW64\kmddsp.tsp

2018-01-08 17:04 - 2017-12-31 17:43 - 000033280 _____ (Microsoft Corporation) C:\Windows\SysWOW64\rasmxs.dll

2018-01-08 17:04 - 2017-12-31 17:43 - 000022528 _____ (Microsoft Corporation) C:\Windows\SysWOW64\rasser.dll

2018-01-08 17:04 - 2017-12-31 17:43 - 000020480 _____ (Microsoft Corporation) C:\Windows\SysWOW64\WcnEapPeerProxy.dll

2018-01-08 17:04 - 2017-12-31 17:43 - 000019968 _____ (Microsoft Corporation) C:\Windows\SysWOW64\WcnEapAuthProxy.dll

2018-01-08 17:04 - 2017-12-31 17:43 - 000018944 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wfapigp.dll

2018-01-08 17:04 - 2017-12-31 17:43 - 000013824 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wshqos.dll

2018-01-08 17:04 - 2017-12-31 17:42 - 000460288 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\srv.sys

2018-01-08 17:04 - 2017-12-31 17:42 - 000406016 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\srv2.sys

2018-01-08 17:04 - 2017-12-31 17:42 - 000168448 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\srvnet.sys

2018-01-08 17:04 - 2017-12-31 17:42 - 000159744 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\mrxsmb.sys

2018-01-08 17:04 - 2017-12-31 17:41 - 000754176 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\http.sys

2018-01-08 17:04 - 2017-12-31 17:41 - 000291328 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\mrxsmb10.sys

2018-01-08 17:04 - 2017-12-31 17:41 - 000129536 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\mrxsmb20.sys

2018-01-08 17:04 - 2017-12-31 17:41 - 000112640 _____ (Microsoft Corporation) C:\Windows\system32\smss.exe

2018-01-08 17:04 - 2017-12-31 17:41 - 000106496 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\dfsc.sys

2018-01-08 17:04 - 2017-12-31 17:41 - 000030720 _____ (Microsoft Corporation) C:\Windows\system32\lsass.exe

2018-01-08 17:04 - 2017-12-31 17:41 - 000007168 _____ (Microsoft Corp

Back to top

#2 nasdaq

Forum Deity

Global Moderator
49,288 posts

Posted 03 February 2018 - 07:28 AM

Hello, Welcome to SpywareInfoForumr.
I'm nasdaq and will be helping you.

If you can please print this topic it will make it easier for you to follow the instructions and complete all of the necessary steps in the order listed.
===

Remove these programs in bold via the Control Panel > Programs > Programs and Features.
DriverUpdate (HKLM-x32\...\{E6617834-9398-4F95-9C05-2D87B192E1DF}) (Version: 2.4.3 - SlimWare Utilities, Inc.)
Iminent (HKLM-x32\...\{5CDCDBCD-119A-4AE1-9C55-B816DBBE4245}) (Version: 6.27.21.0 - Iminent) Hidden <==== ATTENTION
KNCTR (HKLM-x32\...\Itibiti_is1) (Version: - Itibiti Systems Inc.) <==== ATTENTION
LessTabs (HKLM-x32\...\LessTabs) (Version: 1.7.2.0 - LessTabs)
===

Press the Windows key + r on your keyboard at the same time. This will open the RUN BOX.
Type Notepad and and click the OK key.
Please copy the entire contents of the code box below to the a new file.

start

CreateRestorePoint:
EmptyTemp:
CloseProcesses:

(AVG Secure Search) C:\Program Files (x86)\Common Files\AVG Secure Search\vToolbarUpdater\15.5.0\ToolbarUpdater.exe
() C:\Program Files (x86)\Itibiti Soft Phone\Phone\Itibiti.exe
HKLM-x32\...\Run: [] => [X]
HKU\S-1-5-21-2096361384-901469764-2865818563-1002\...\Run: [Itibiti.exe] => C:\Program Files (x86)\Itibiti Soft Phone\ItibitiLauncher.exe [2638848 2017-09-11] () <==== ATTENTION
GroupPolicy\User: Restriction <==== ATTENTION
CHR HKU\S-1-5-21-2096361384-901469764-2865818563-1002\SOFTWARE\Policies\Google: Restriction <==== ATTENTION
HKLM\SOFTWARE\Policies\Microsoft\Internet Explorer: Restriction <==== ATTENTION
URLSearchHook: HKU\S-1-5-21-2096361384-901469764-2865818563-1002 - YTNavAssistPlugin Class - {81017EA9-9AA8-4A6A-9734-7AF40E7D593F} - C:\Program Files (x86)\Yahoo!\Companion\Installs\cpn2\yt.dll No File
SearchScopes: HKLM -> DefaultScope value is missing
SearchScopes: HKLM-x32 -> DefaultScope value is missing
SearchScopes: HKU\S-1-5-21-2096361384-901469764-2865818563-1002 -> {91607fa7-3c2f-4f90-93e3-d5337a6b0ac2} URL = Playbryte-serp-adk/search/redirect/?type=default&user_id=b53bab51-6b3e-4736-b02f-6129ed97f99e&query={searchTerms}
BHO-x32: &Yahoo! Toolbar Helper -> {02478D38-C3F9-4efb-9B51-7695ECA05670} -> C:\Program Files (x86)\Yahoo!\Companion\Installs\cpn2\yt.dll => No File
BHO-x32: Bing Bar Helper -> {1dad3af3-ef2f-4f64-ac4b-11789189fcb6} -> C:\Program Files (x86)\Microsoft\BingBar\7.3.132.0\BingExt.dll => No File
BHO-x32: Windows Live ID Sign-in Helper -> {9030D464-4C02-4ABF-8ECC-5164760863C6} -> C:\Program Files (x86)\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll => No File
Toolbar: HKLM - avast! Online Security - {318A227B-5E9F-45bd-8999-7F8F10CA4CF5} -  No File
Toolbar: HKLM - No Name - {CC1A175A-E45B-41ED-A30C-C9B1D7A0C02F} -  No File
Toolbar: HKLM-x32 - Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files (x86)\Yahoo!\Companion\Installs\cpn2\yt.dll No File
Toolbar: HKLM-x32 - Bing Bar - {eec0f710-38b5-4aba-99bf-ec87564a4e13} - C:\Program Files (x86)\Microsoft\BingBar\7.3.132.0\BingExt.dll No File
Toolbar: HKLM-x32 - Canon Easy-WebPrint EX - {759D9886-0C6F-4498-BAB6-4A5F47C6C72F} - C:\Program Files (x86)\Canon\Easy-WebPrint EX\ewpexhlp.dll No File
Toolbar: HKU\S-1-5-21-2096361384-901469764-2865818563-1002 -> No Name - {7FEBEFE3-6B19-4349-98D2-FFB09D4B49CA} -  No File
FF Plugin: @microsoft.com/GENUINE -> disabled [No File]
FF Plugin-x32: @microsoft.com/GENUINE -> disabled [No File]
CHR Extension: (Avast SafePrice) - C:\Users\David\AppData\Local\Google\Chrome\User Data\Default\Extensions\eofcbnmajmjmplflapaojjnihcjkigck [2018-02-01]
CHR HKLM-x32\...\Chrome\Extension: [eofcbnmajmjmplflapaojjnihcjkigck] - hxxps://clients2.google.com/service/update2/crx
CHR HKLM-x32\...\Chrome\Extension: [gomekmidlodglbbmalcneegieacbdmki] - C:\Program Files\AVAST Software\Avast\WebRep\Chrome\aswWebRepChrome.crx <not found>
R2 vToolbarUpdater15.5.0; C:\Program Files (x86)\Common Files\AVG Secure Search\vToolbarUpdater\15.5.0\ToolbarUpdater.exe [1643184 2013-08-17] (AVG Secure Search)
S3 Afc; system32\drivers\Afc.sys [X]
S3 SWDUMon; system32\DRIVERS\SWDUMon.sys [X]
S3 vmwvusb; System32\Drivers\vmwvusb.sys [X]

FirewallRules: [TCP Query User{31A77BAF-ABC6-4BF4-982E-0D79E2E22F10}C:\program files (x86)\itibiti soft phone\itibiti.exe] => (Block) C:\program files (x86)\itibiti soft phone\itibiti.exe
FirewallRules: [UDP Query User{02A8936C-33EE-499F-8AC6-B8E6925A365A}C:\program files (x86)\itibiti soft phone\itibiti.exe] => (Block) C:\program files (x86)\itibiti soft phone\itibiti.exe
FirewallRules: [{2A81D7D2-18ED-4132-8639-0F7C83B532CF}] => (Allow) C:\Program Files (x86)\Itibiti Soft Phone\Phone\Itibiti.exe
FirewallRules: [{2B7F12EB-8D59-419F-85CC-FC3278EE20F1}] => (Allow) C:\Program Files (x86)\Itibiti Soft Phone\Phone\Itibiti.exe
FirewallRules: [{B3FF49FF-75A7-4174-9CFB-6EF330508DD7}] => (Allow) C:\Program Files (x86)\Itibiti Soft Phone\NoPhone\Itibiti.exe
FirewallRules: [{B9CEC663-6076-4B04-AB13-3277F7053FD2}] => (Allow) C:\Program Files (x86)\Itibiti Soft Phone\NoPhone\Itibiti.exe
FirewallRules: [TCP Query User{779DE6B3-4C5C-4F9F-BB9B-2C7C527538C4}C:\program files (x86)\itibiti soft phone\phone\itibiti.exe] => (Block) C:\program files (x86)\itibiti soft phone\phone\itibiti.exe
FirewallRules: [UDP Query User{D4AD4DA0-B855-47E8-BADE-2D376D7667B5}C:\program files (x86)\itibiti soft phone\phone\itibiti.exe] => (Block) C:\program files (x86)\itibiti soft phone\phone\itibiti.exe

2018-02-01 16:59 - 2018-02-01 16:59 - 000674496 _____ (PC Drivers HeadQuarters LP) C:\Users\David\Downloads\DriverSupport.exe
2013-06-22 21:01 - 2013-06-23 15:12 - 000099384 _____ () C:\Users\David\AppData\Roaming\inst.exe
C:\Program Files (x86)\Itibiti Soft Phone
2012-06-30 10:34 - 2012-06-30 10:34 - 144895440 _____ (Hewlett-Packard                                             ) C:\Users\David\AppData\Local\Temp\SP56904.exe
2013-05-09 05:50 - 2013-05-09 05:50 - 004022944 _____ (Hewlett-Packard Company                                     ) C:\Users\David\AppData\Local\Temp\SP56929.exe
2013-05-23 15:59 - 2013-05-23 15:59 - 023478616 _____ (Hewlett-Packard Company                                     ) C:\Users\David\AppData\Local\Temp\SP57538.exe
2013-05-22 17:08 - 2013-05-22 17:08 - 006594568 _____ (Hewlett Packard Inc                                         ) C:\Users\David\AppData\Local\Temp\SP57698.exe
2013-05-09 05:48 - 2013-05-09 05:48 - 045042944 _____ (Hewlett-Packard                                             ) C:\Users\David\AppData\Local\Temp\SP57966.exe
2013-06-02 11:32 - 2013-06-02 11:33 - 041580520 _____ (Hewlett-Packard                                             ) C:\Users\David\AppData\Local\Temp\sp58915.exe
2013-02-01 16:19 - 2013-02-01 16:19 - 306173352 _____ (Hewlett-Packard                                             ) C:\Users\David\AppData\Local\Temp\SP59787.exe
2013-05-23 16:13 - 2013-05-23 16:13 - 006709496 _____ (Hewlett-Packard Company                                     ) C:\Users\David\AppData\Local\Temp\SP60051.exe
2013-05-20 06:50 - 2013-05-20 06:50 - 009982176 _____ (Hewlett-Packard                                             ) C:\Users\David\AppData\Local\Temp\SP61037.exe
2013-05-23 16:14 - 2013-05-23 16:14 - 069668656 _____ (Hewlett-Packard                                             ) C:\Users\David\AppData\Local\Temp\SP61399.exe
2013-07-02 20:16 - 2013-07-02 20:16 - 035990952 _____ (Hewlett-Packard Company                                     ) C:\Users\David\AppData\Local\Temp\SP61776.exe
2013-08-29 01:38 - 2013-08-29 01:38 - 006844168 _____ (Hewlett-Packard Company                                     ) C:\Users\David\AppData\Local\Temp\SP62991.exe
2013-10-25 08:13 - 2013-10-25 08:13 - 069669936 _____ (Hewlett-Packard                                             ) C:\Users\David\AppData\Local\Temp\SP63224.exe
2013-10-25 07:58 - 2013-10-25 07:58 - 006879392 _____ (Hewlett-Packard Company                                     ) C:\Users\David\AppData\Local\Temp\SP63801.exe
2013-11-28 03:56 - 2013-11-28 03:56 - 029030920 _____ (Hewlett-Packard Company                                     ) C:\Users\David\AppData\Local\Temp\SP64082.exe
2014-02-06 12:18 - 2014-02-06 12:18 - 044799704 _____ (Hewlett-Packard                                             ) C:\Users\David\AppData\Local\Temp\sp64126.exe
2013-09-07 13:51 - 2012-01-05 11:43 - 000121856 _____ (Microsoft Corporation) C:\Users\David\AppData\Local\Temp\xmllite.dll


End

Save the file as fixlist.txt in the same folder where the Farbar tool is running from.
The location is listed in the 3rd line of the Farbar log you have submitted.

Run FRST and click Fix only once and wait.

The tool will create a log (Fixlog.txt) please post it to your reply.
===

Please download AdwCleaner by Xplode onto your Desktop.

Close all open programs and internet browsers.
Double click on AdwCleaner.exe to run the tool.
Click the Scan button and wait for the process to complete.
Click the LogFile button and the report will open in Notepad.

IMPORTANT

If you click the Clean button all items listed in the report will be removed.

If you find some false positive items or programs that you wish to keep, Close the AdwCleaner windows.

Close all open programs and internet browsers.
Double click on AdwCleaner.exe to run the tool.
Click the Scan button and wait for the process to complete.
Check off the element(s) you wish to keep.
Click on the Clean button follow the prompts.
A log file will automatically open after the scan has finished.
Please post the content of that log file with your next answer.
You can find the log file at C:\AdwCleanerCx.txt (x is a number).

===

Please post the logs and let me know what problem persists.

nasdaq

Favorite tools: [ SpywareBlaster ] [ Spybot ] [ AdAware ] [ HijackThis ]
[ Housecall online virus scan ] [ Bitdefender online virus scan ]
[ AVG antivirus ] [ Sunbelt Personal Firewall ] [ ZoneAlarm firewall ]

My help is free, but if we have helped you in anyway,please considerDonating ,
see this topic for details.We need members like you.

========
Shouldn't water be worth more than diamonds?
Adam Smith Glasgow, 1760

Back to top

#3 DC0001

Member

Full Member
35 posts

Posted 03 February 2018 - 09:07 PM

DriverUpdate uninstalled.

I don't see Iminent under the Program Manager.

"Uninstall has detected that KNCTR is currently running. Please close all instances of it now..." but I can't find it in the Task Manager under Applications, Processes or Services.

Less Tabs uninstalled.

Fixlist saved and FRST ran:

Fix result of Farbar Recovery Scan Tool (x64) Version: 27.01.2018

Ran by David (03-02-2018 17:50:27) Run:1

Running from C:\Users\David\Desktop

Loaded Profiles: David (Available Profiles: UpdatusUser & David)

Boot Mode: Normal

==============================================

fixlist content:

*****************

start

CreateRestorePoint:

EmptyTemp:

CloseProcesses: