Javascript Disabled Detected

You currently have javascript disabled. Several functions may not work. Please re-enable javascript to access full functionality.

A "ghost" turns my PC off!

Started by floridalou , Feb 14 2018 06:05 PM

rebooting slow turns off

Please log in to reply

14 replies to this topic

#1 floridalou

Member

Full Member
40 posts

Posted 14 February 2018 - 06:05 PM

Hello gentle people,

Recently my computer (PC Windows 10) has been shutting itself off and rebooting.

It can happen when I am on the Internet or when the computer is sitting idle and I am not on the Internet.

As of today, the computer had trouble rebooting.

I have Norton's security and it does a scan every day but nothing has been detected.

Moreover, when I need to put the PIN in to open my desktop, I need to put in the PIN twice, it does not take the first time.

Please advise and thank you all my best

Florida Lou

Scan result of Farbar Recovery Scan Tool (FRST) (x64) Version: 12.02.2018

Ran by mill1 (administrator) on DESKTOP-2K81PH6 (14-02-2018 18:43:03)

Running from C:\Users\mill1\Desktop

Loaded Profiles: mill1 (Available Profiles: defaultuser0 & mill1)

Platform: Windows 10 Home Version 1709 16299.248 (X64) Language: English (United States)

Internet Explorer Version 11 (Default browser: Chrome)

Boot Mode: Normal

Tutorial for Farbar Recovery Scan Tool: http://www.geekstogo...very-scan-tool/

==================== Processes (Whitelisted) =================

(If an entry is included in the fixlist, the process will be closed. The file will not be moved.)

(AMD) C:\Windows\System32\atiesrxx.exe

(AMD) C:\Windows\System32\atieclxx.exe

(Realtek Semiconductor) C:\Program Files\Realtek\Audio\HDA\RtkAudioService64.exe

(Microsoft Corporation) C:\Windows\System32\wlanext.exe

(Apple Inc.) C:\Program Files\Bonjour\mDNSResponder.exe

(Microsoft Corporation) C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeClickToRun.exe

(Nuance Communications, Inc.) C:\Program Files (x86)\Common Files\Nuance\dgnsvc.exe

(Intel® Corporation) C:\Program Files\Intel\WiFi\bin\EvtEng.exe

(HP Inc.) C:\Program Files (x86)\HP\HP System Event\HPWMISVC.exe

(Intel® Corporation) C:\Program Files\Common Files\Intel\WirelessCommon\RegSrvc.exe

(Intel Corporation) C:\Windows\System32\ibtsiva.exe

(Intel® Corporation) C:\Program Files\Intel\WiFi\bin\ZeroConfigService.exe

(Symantec Corporation) C:\Program Files (x86)\Norton Security Suite\Engine\22.12.0.104\nortonsecurity.exe

(Nuance Communications, Inc.) C:\Program Files (x86)\Common Files\Nuance\loggerservice.exe

(HP Inc.) C:\Program Files\HP\HP Orbit Service\HPOrbitService.exe

(Symantec Corporation) C:\Program Files (x86)\Norton Security Suite\Engine\22.12.0.104\nortonsecurity.exe

() C:\Program Files (x86)\HP\HP JumpStart Launch\HPJumpStartLaunch.exe

(Dropbox, Inc.) C:\Program Files (x86)\Dropbox\Update\DropboxUpdate.exe

(Advanced Micro Devices, Inc.) C:\Program Files\AMD\CNext\CNext\RadeonSettings.exe

(HP Inc.) C:\Program Files (x86)\HP\HPAudioSwitch\HPAudioSwitch.exe

(Microsoft Corporation) C:\Program Files\Windows Defender\MSASCuiL.exe

(Realtek Semiconductor) C:\Program Files\Realtek\Audio\HDA\RtkNGUI64.exe

(Microsoft Corporation) C:\Program Files (x86)\Greetings Workshop\GWREMIND.EXE

(Flexera Software LLC.) C:\ProgramData\FLEXnet\Connect\11\ISUSPM.exe

(Flexera Software LLC.) C:\ProgramData\FLEXnet\Connect\11\agent.exe

(HP Inc.) C:\Program Files (x86)\HP\HP System Event\HPMSGSVC.exe

(Microsoft Corporation) C:\Windows\SystemApps\Microsoft.Windows.Cortana_cw5n1h2txyewy\RemindersServer.exe

(Hewlett-Packard) C:\Program Files (x86)\HP\HP Software Update\hpwuschd2.exe

() C:\Program Files\WindowsApps\Microsoft.SkypeApp_12.1803.279.0_x64__kzf8qxf38zg5c\SkypeHost.exe

(HP Inc.) C:\Program Files\HPCommRecovery\HPCommRecovery.exe

(HP Inc.) C:\Program Files (x86)\HP\HP JumpStart Bridge\HPJumpStartBridge.exe

(HP Inc.) C:\Program Files (x86)\Hewlett-Packard\HP Support Solutions\HPSupportSolutionsFrameworkService.exe

(HP Inc.) C:\Program Files\HP\HP Touchpoint Analytics Client\TouchpointAnalyticsClientService.exe

(CyberLink) C:\Program Files\CyberLink\Shared files\RichVideo64.exe

(Malwarebytes) C:\Program Files\Malwarebytes\Anti-Malware\MBAMService.exe

(Malwarebytes) C:\Program Files\Malwarebytes\Anti-Malware\mbamtray.exe

(Zhuhai Kingsoft Office Software Co.,Ltd) C:\Users\mill1\AppData\Local\Kingsoft\WPS Office\10.2.0.5996\office6\wpscloudsvr.exe

(Zhuhai Kingsoft Office Software Co.,Ltd) C:\Users\mill1\AppData\Local\Kingsoft\WPS Office\10.2.0.5996\office6\wpscenter.exe

(Microsoft Corporation) C:\Windows\System32\smartscreen.exe

(Flexera Software LLC.) C:\ProgramData\FLEXnet\Connect\11\ISUSPM.exe

(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe

(Microsoft Corporation) C:\Windows\System32\cmd.exe

(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe

(Symantec Corporation) C:\Program Files (x86)\Norton Security Suite\Engine\22.12.0.104\conathst.exe

(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe

(Microsoft Corporation) C:\Windows\System32\cmd.exe

(Nuance Communications, Inc.) C:\Program Files (x86)\Nuance\NaturallySpeaking13\Program\dgnria_nmhost.exe

==================== Registry (Whitelisted) ===========================

(If an entry is included in the fixlist, the registry item will be restored to default or removed. The file will not be moved.)

HKLM\...\Run: [SecurityHealth] => C:\Program Files\Windows Defender\MSASCuiL.exe [630168 2017-09-29] (Microsoft Corporation)

HKLM\...\Run: [RTHDVCPL] => C:\Program Files\Realtek\Audio\HDA\RtkNGUI64.exe [8843784 2016-08-15] (Realtek Semiconductor)

HKLM-x32\...\Run: [HPMessageService] => C:\Program Files (x86)\HP\HP System Event\HPMSGSVC.exe [705784 2016-06-20] (HP Inc.)

HKLM-x32\...\Run: [HP Software Update] => C:\Program Files (x86)\Hp\HP Software Update\HPWuSchd2.exe [96056 2013-05-30] (Hewlett-Packard)

HKLM-x32\...\Run: [ISUSPM] => C:\ProgramData\FLEXnet\Connect\11\\isuspm.exe [2075480 2013-06-24] (Flexera Software LLC.)

HKLM-x32\...\Run: [DNS7reminder] => "C:\Program Files (x86)\Nuance\NaturallySpeaking13\Ereg\Ereg.exe" -r "C:\ProgramData\Nuance\NaturallySpeaking13\Ereg.ini"

HKLM-x32\...\Run: [Nikon Message Center 2] => C:\Program Files (x86)\Nikon\Nikon Message Center 2\NkMC2.exe [571392 2011-10-30] (Nikon Corporation)

HKU\S-1-5-21-2306285249-3646823635-4279856882-1001\...\Run: [ISUSPM] => C:\ProgramData\FLEXnet\Connect\11\ISUSPM.exe [2075480 2013-06-24] (Flexera Software LLC.)

Startup: C:\Users\mill1\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Greetings Workshop Reminders.lnk [2017-09-03]

ShortcutTarget: Greetings Workshop Reminders.lnk -> C:\Program Files (x86)\Greetings Workshop\GWREMIND.EXE (Microsoft Corporation)

Startup: C:\Users\mill1\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Monitor Ink Alerts - HP Officejet Pro 8610.lnk [2018-02-04]

==================== Internet (Whitelisted) ====================

(If an item is included in the fixlist, if it is a registry item it will be removed or restored to default.)

Tcpip\Parameters: [DhcpNameServer] 75.75.75.75 75.75.76.76

Tcpip\..\Interfaces\{6e61c5b6-7407-4810-945d-5c9a203c0ac4}: [DhcpNameServer] 75.75.75.75 75.75.76.76

Internet Explorer:

==================

HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://hp17win10.msn.com/?pc=HCTE

HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = hxxp://hp17win10.msn.com/?pc=HCTE

HKU\.DEFAULT\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://hp17win10.msn.com/?pc=HCTE

HKU\.DEFAULT\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = hxxp://hp17win10.msn.com/?pc=HCTE

HKU\S-1-5-21-2306285249-3646823635-4279856882-1001\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://hp17win10.msn.com/?pc=HCTE

HKU\S-1-5-21-2306285249-3646823635-4279856882-1001\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = hxxp://hp17win10.msn.com/?pc=HCTE

SearchScopes: HKLM -> {7B90C24F-0A32-46A2-8FC2-439F20B3F585} URL = hxxp://www.amazon.com/s/ref=azs_osd_iea?ie=UTF-8&tag=hp-us1-vsb-20&link%5Fcode=qs&index=aps&field-keywords={searchTerms}

SearchScopes: HKLM-x32 -> {7B90C24F-0A32-46A2-8FC2-439F20B3F585} URL = hxxp://www.amazon.com/s/ref=azs_osd_iea?ie=UTF-8&tag=hp-us1-vsb-20&link%5Fcode=qs&index=aps&field-keywords={searchTerms}

SearchScopes: HKU\S-1-5-21-2306285249-3646823635-4279856882-1001 -> {7B90C24F-0A32-46A2-8FC2-439F20B3F585} URL = hxxp://www.amazon.com/s/ref=azs_osd_iea?ie=UTF-8&tag=hp-us1-vsb-20&link%5Fcode=qs&index=aps&field-keywords={searchTerms}

BHO: Lync Browser Helper -> {31D09BA0-12F5-4CCE-BE8A-2923E76605DA} -> C:\Program Files (x86)\Microsoft Office\root\VFS\ProgramFilesX64\Microsoft Office\Office16\OCHelper.dll [2018-02-06] (Microsoft Corporation)

BHO: Norton Identity Safety -> {602ADB0E-4AFF-4217-8AA1-95DAC4DFA408} -> C:\Program Files (x86)\Norton Security Suite\Engine\22.12.0.104\coIEPlg.dll [2018-01-25] (Symantec Corporation)

BHO: Dragon Web Extension For Internet Explorer -> {609C0837-8DD3-4F9B-AAC5-446F36BC0353} -> C:\Program Files (x86)\Nuance\NaturallySpeaking13\Program\x64\dgnriaie_x64.dll [2015-01-23] (Nuance Communications, Inc.)

BHO: HP Network Check Helper -> {E76FD755-C1BA-4DCB-9F13-99BD91223ADE} -> C:\Program Files (x86)\Hewlett-Packard\HP Support Framework\Resources\HPNetworkCheck\HPNetworkCheckPluginx64.dll [2016-08-05] (HP Inc.)

BHO-x32: Norton Identity Safety -> {602ADB0E-4AFF-4217-8AA1-95DAC4DFA408} -> C:\Program Files (x86)\Norton Security Suite\Engine32\22.12.0.104\coIEPlg.dll [2018-01-25] (Symantec Corporation)

BHO-x32: Dragon Web Extension For Internet Explorer -> {609C0837-8DD3-4F9B-AAC5-446F36BC0353} -> C:\Program Files (x86)\Nuance\NaturallySpeaking13\Program\dgnriaie.dll [2015-01-23] (Nuance Communications, Inc.)

BHO-x32: HP Network Check Helper -> {E76FD755-C1BA-4DCB-9F13-99BD91223ADE} -> C:\Program Files (x86)\Hewlett-Packard\HP Support Framework\Resources\HPNetworkCheck\HPNetworkCheckPlugin.dll [2016-08-05] (HP Inc.)

Toolbar: HKLM - Norton Toolbar - {7FEBEFE3-6B19-4349-98D2-FFB09D4B49CA} - C:\Program Files (x86)\Norton Security Suite\Engine\22.12.0.104\coIEPlg.dll [2018-01-25] (Symantec Corporation)

Toolbar: HKLM-x32 - Norton Toolbar - {7FEBEFE3-6B19-4349-98D2-FFB09D4B49CA} - C:\Program Files (x86)\Norton Security Suite\Engine32\22.12.0.104\coIEPlg.dll [2018-01-25] (Symantec Corporation)

Handler-x32: mso-minsb-roaming.16 - {83C25742-A9F7-49FB-9138-434302C88D07} - C:\Program Files (x86)\Microsoft Office\root\Office16\MSOSB.DLL [2018-02-06] (Microsoft Corporation)

Handler-x32: mso-minsb.16 - {42089D2D-912D-4018-9087-2B87803E93FB} - C:\Program Files (x86)\Microsoft Office\root\Office16\MSOSB.DLL [2018-02-06] (Microsoft Corporation)

Handler-x32: osf-roaming.16 - {42089D2D-912D-4018-9087-2B87803E93FB} - C:\Program Files (x86)\Microsoft Office\root\Office16\MSOSB.DLL [2018-02-06] (Microsoft Corporation)

Handler-x32: osf.16 - {5504BE45-A83B-4808-900A-3A5C36E7F77A} - C:\Program Files (x86)\Microsoft Office\root\Office16\MSOSB.DLL [2018-02-06] (Microsoft Corporation)

FireFox:

========

FF DefaultProfile: be1ip8lh.default

FF ProfilePath: C:\Users\mill1\AppData\Roaming\Mozilla\Firefox\Profiles\be1ip8lh.default [2018-02-04]

FF Plugin: @Microsoft.com/NpCtrl,version=1.0 -> c:\Program Files\Microsoft Silverlight\5.1.50907.0\npctrl.dll [2017-05-03] ( Microsoft Corporation)

FF Plugin: nuance.com/DgnRia2_x86_64 -> C:\Program Files (x86)\Nuance\NaturallySpeaking13\Program\x64\npDgnRia2_x64.dll [2015-01-23] (Nuance Communications, Inc.)

FF Plugin-x32: @Microsoft.com/NpCtrl,version=1.0 -> c:\Program Files (x86)\Microsoft Silverlight\5.1.50907.0\npctrl.dll [2017-05-03] ( Microsoft Corporation)

FF Plugin-x32: @microsoft.com/SharePoint,version=14.0 -> C:\Program Files (x86)\Microsoft Office\root\Office16\NPSPWRAP.DLL [2018-01-22] (Microsoft Corporation)

FF Plugin-x32: @tools.google.com/Google Update;version=3 -> C:\Program Files (x86)\Google\Update\1.3.33.7\npGoogleUpdate3.dll [2017-11-14] (Google Inc.)

FF Plugin-x32: @tools.google.com/Google Update;version=9 -> C:\Program Files (x86)\Google\Update\1.3.33.7\npGoogleUpdate3.dll [2017-11-14] (Google Inc.)

FF Plugin-x32: @WildTangent.com/GamesAppPresenceDetector,Version=1.0 -> C:\Program Files (x86)\WildTangent Games\App\BrowserIntegration\Registered\0\NP_wtapp.dll [2016-05-23] ()

FF Plugin-x32: Adobe Reader -> C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AIR\nppdf32.dll [2017-11-04] (Adobe Systems Inc.)

FF Plugin-x32: nuance.com/DgnRia2 -> C:\Program Files (x86)\Nuance\NaturallySpeaking13\Program\npDgnRia2.dll [2015-01-23] (Nuance Communications, Inc.)

Chrome:

=======

CHR StartupUrls: Default -> "hxxp://www.google.com/","hxxp://start.mysearchdial.com/?f=1&a=dsites&cd=2XzuyEtN2Y1L1QzutDtDtD0A0C0DtBtAtCtD0Dzy0D0FtC0EtN0D0Tzu0SyBzyyDtN1L2XzutBtFtCzztFtAtFtDtN1L1CzutDtBtCtC1V1TtN1L1G1B1V1N2Y1L1Qzu2SyByD0AyE0AyB0AyEtGtAyB0AzytG0D0BtB0BtGzz0F0BzytGyCtA0CyByC0FyD0AtA0EyDzz2QtN1M1F1B2Z1V1N2Y1L1Qzu2StBtD0F0D0E0D0FtBtGtB0EyByDtGtAzyyDyDtGzy0Bzz0BtGyBtBtByB0AtCyDyB0FtCyByC2Q&cr=2020156714&ir=","hxxp://mysearch.avg.com?cid={617406C1-4D8F-4C16-9091-CB574836D902}&mid=7d54722d2fda40568816ef443f380bb6-bccb702c01ccb952beac1a9d11e2bc1154d6f83c&lang=en&ds=hk018&coid=avgtbdishk&cmpid=&pr=sa&d=2014-03-19 00:28:27&v=18.0.0.248&pid=safeguard&sg=&sap=hp","hxxp://start.mysearchdial.com/?f=1&a=ir_14_12_ch&cd=2XzuyEtN2Y1L1QzutDtDtD0A0C0DtBtAtCtD0Dzy0D0FtC0EtN0D0Tzu0SzztDzztN1L2XzutBtFtCzztFtBtFtDtN1L1CzutCyEtDtAtDyD1V1TtN1L1G1B1V1N2Y1L1Qzu2StAtCyB0ByCtCyDyDtG0AtDzytCtGyB0EyCyBtGtCtAzy0EtGtCyEzytB0A0FyEtAyEyC0Bzz2QtN1M1F1B2Z1V1N2Y1L1Qzu2StBtD0F0D0E0D0FtBtGtB0EyByDtGtAzyyDyDtGzy0Bzz0BtGyBtBtByB0AtCyDyB0FtCyByC2Q&cr=1922534280&ir=","hxxp://start.mysearchdial.com/?f=1&a=ir_14_12_ch&cd=2XzuyEtN2Y1L1QzutDtDtD0A0C0DtBtAtCtD0Dzy0D0FtC0EtN0D0Tzu0SzztDzztN1L2XzutBtFtCzztFtBtFtDtN1L1CzutCyEtDtAtDyD1V1QtN1L1G1B1V1N2Y1L1Qzu2SyDyD0E0EtCtByD0FtGtD0CyEzztGzz0AyC0AtGtCtCzz0BtGtB0EyByB0FtC0EyCtDzzzz0D2QtN1M1F1B2Z1V1N2Y1L1Qzu2StBtD0F0D0E0D0FtBtGtB0EyByDtGtAzyyDyDtGzy0Bzz0BtGyBtBtByB0AtCyDyB0FtCyByC2Q&cr=1822646732&ir=","hxxps://www.google.com/"

CHR Profile: C:\Users\mill1\AppData\Local\Google\Chrome\User Data\Default [2018-02-14]

CHR Extension: (Slides) - C:\Users\mill1\AppData\Local\Google\Chrome\User Data\Default\Extensions\aapocclcgogkmnckokdopfmhonfmgoek [2017-10-12]

CHR Extension: (Flash Video Downloader) - C:\Users\mill1\AppData\Local\Google\Chrome\User Data\Default\Extensions\aiimdkdngfcipjohbjenkahhlhccpdbc [2017-11-09]

CHR Extension: (Docs) - C:\Users\mill1\AppData\Local\Google\Chrome\User Data\Default\Extensions\aohghmighlieiainnegkcijnfilokake [2017-10-12]

CHR Extension: (Google Drive) - C:\Users\mill1\AppData\Local\Google\Chrome\User Data\Default\Extensions\apdfllckaahabafndbhieahigkjlhalf [2017-05-11]

CHR Extension: (Pop up blocker for Chrome™ - Poper Blocker) - C:\Users\mill1\AppData\Local\Google\Chrome\User Data\Default\Extensions\bkkbcggnhapdmkeljlodobbkopceiche [2017-12-20]

CHR Extension: (YouTube) - C:\Users\mill1\AppData\Local\Google\Chrome\User Data\Default\Extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo [2017-05-11]

CHR Extension: (Honey) - C:\Users\mill1\AppData\Local\Google\Chrome\User Data\Default\Extensions\bmnlcjabgnpnenekpadlanbbkooimhnj [2018-02-03]

CHR Extension: (Norton Security Toolbar) - C:\Users\mill1\AppData\Local\Google\Chrome\User Data\Default\Extensions\cjabmdjcfcfdmffimndhafhblfmpjdpe [2017-10-04]

CHR Extension: (Screen capture, screenshot share/save) - C:\Users\mill1\AppData\Local\Google\Chrome\User Data\Default\Extensions\cjbjepchlgclmpinlbbeinajphohgfod [2017-05-11]

CHR Extension: (uBlock Origin) - C:\Users\mill1\AppData\Local\Google\Chrome\User Data\Default\Extensions\cjpalhdlnbpafiamejdnhcphjbkeiagm [2018-02-04]

CHR Extension: (Dragon Web Extension) - C:\Users\mill1\AppData\Local\Google\Chrome\User Data\Default\Extensions\ddaloccgjfibfpkalenodgehlhkgoahe [2018-02-02]

CHR Extension: (Adobe Acrobat) - C:\Users\mill1\AppData\Local\Google\Chrome\User Data\Default\Extensions\efaidnbmnnnibpcajpcglclefindmkaj [2017-05-19]

CHR Extension: (Sheets) - C:\Users\mill1\AppData\Local\Google\Chrome\User Data\Default\Extensions\felcaaldnbdncclmgdcncolpebgiejap [2017-10-12]

CHR Extension: (Google Docs Offline) - C:\Users\mill1\AppData\Local\Google\Chrome\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi [2017-05-11]

CHR Extension: (AdBlock) - C:\Users\mill1\AppData\Local\Google\Chrome\User Data\Default\Extensions\gighmmpiobklfepjocnamgkkbiglidom [2018-02-01]

CHR Extension: (Unlimited Free VPN - Hola) - C:\Users\mill1\AppData\Local\Google\Chrome\User Data\Default\Extensions\gkojfkhlekighikafcpjkiklfbnlmeio [2018-02-11]

CHR Extension: (Kindle Cloud Reader) - C:\Users\mill1\AppData\Local\Google\Chrome\User Data\Default\Extensions\icdipabjmbhpdkjaihfjoikhjjeneebd [2017-08-30]

CHR Extension: (Norton Identity Safe) - C:\Users\mill1\AppData\Local\Google\Chrome\User Data\Default\Extensions\iikflkcanblccfahdhdonehdalibjnif [2017-05-12]

CHR Extension: (Clipular! Research, save & share screenshot) - C:\Users\mill1\AppData\Local\Google\Chrome\User Data\Default\Extensions\jmjbgcjbgmcfgbgikmbdioggjlhjegpp [2017-05-11]

CHR Extension: (Chrome Web Store Payments) - C:\Users\mill1\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda [2017-08-21]

CHR Extension: (Gmail) - C:\Users\mill1\AppData\Local\Google\Chrome\User Data\Default\Extensions\pjkljhegncpnkpknbcohdijeoejaedia [2017-05-11]

CHR Extension: (Chrome Media Router) - C:\Users\mill1\AppData\Local\Google\Chrome\User Data\Default\Extensions\pkedcjkdefgpdelpbcmbmeomcjbeemfm [2017-12-14]

CHR HKLM\...\Chrome\Extension: [cjabmdjcfcfdmffimndhafhblfmpjdpe] - C:\Program Files (x86)\Norton Security Suite\Engine\22.12.0.104\Exts\Chrome.crx <not found>

CHR HKLM\...\Chrome\Extension: [iikflkcanblccfahdhdonehdalibjnif] - hxxps://clients2.google.com/service/update2/crx

CHR HKLM-x32\...\Chrome\Extension: [cjabmdjcfcfdmffimndhafhblfmpjdpe] - C:\Program Files (x86)\Norton Security Suite\Engine\22.12.0.104\Exts\Chrome.crx <not found>

CHR HKLM-x32\...\Chrome\Extension: [efaidnbmnnnibpcajpcglclefindmkaj] - hxxps://clients2.google.com/service/update2/crx

CHR HKLM-x32\...\Chrome\Extension: [iikflkcanblccfahdhdonehdalibjnif] - hxxps://clients2.google.com/service/update2/crx

==================== Services (Whitelisted) ====================

(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)

R2 ClickToRunSvc; C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe [7968432 2018-01-30] (Microsoft Corporation)

S2 dbupdate; C:\Program Files (x86)\Dropbox\Update\DropboxUpdate.exe [143144 2017-05-11] (Dropbox, Inc.)

S3 dbupdatem; C:\Program Files (x86)\Dropbox\Update\DropboxUpdate.exe [143144 2017-05-11] (Dropbox, Inc.)

R2 DragonLoggerService; C:\Program Files (x86)\Common Files\Nuance\loggerservice.exe [151616 2015-01-23] (Nuance Communications, Inc.)

S2 GamesAppIntegrationService; C:\Program Files (x86)\WildTangent Games\App\GamesAppIntegrationService.exe [350064 2016-05-23] (WildTangent)

R2 HP Comm Recover; C:\Program Files\HPCommRecovery\HPCommRecovery.exe [894976 2016-08-04] (HP Inc.) [File not signed]

R2 HP Orbit Service; C:\Program Files\HP\HP Orbit Service\HPOrbitService.exe [3421616 2017-06-20] (HP Inc.)

R2 HPJumpStartBridge; C:\Program Files (x86)\HP\HP JumpStart Bridge\HPJumpStartBridge.exe [471040 2017-07-28] (HP Inc.)

S3 hpqcaslwmiex; C:\Program Files (x86)\HP\Shared\hpqwmiex.exe [1031704 2016-06-04] (HP)

R2 HPSupportSolutionsFrameworkService; C:\Program Files (x86)\Hewlett-Packard\HP Support Solutions\HPSupportSolutionsFrameworkService.exe [332144 2017-11-21] (HP Inc.)

R2 HPTouchpointAnalyticsService; C:\Program Files\HP\HP Touchpoint Analytics Client\TouchpointAnalyticsClientService.exe [332216 2017-11-22] (HP Inc.)

R2 HPWMISVC; c:\Program Files (x86)\HP\HP System Event\HPWMISVC.exe [631800 2016-06-20] (HP Inc.)

R2 ibtsiva; C:\WINDOWS\system32\ibtsiva.exe [542320 2017-12-06] (Intel Corporation)

R2 MBAMService; C:\Program Files\Malwarebytes\Anti-Malware\mbamservice.exe [6234056 2017-11-01] (Malwarebytes)

S3 MyWiFiDHCPDNS; C:\Program Files\Intel\WiFi\bin\PanDhcpDns.exe [268928 2017-12-20] ()

R2 NortonSecurity; C:\Program Files (x86)\Norton Security Suite\Engine\22.12.0.104\NortonSecurity.exe [328712 2018-01-26] (Symantec Corporation)

R2 RichVideo64; C:\Program Files\CyberLink\Shared files\RichVideo64.exe [614664 2016-03-23] (CyberLink)

R2 RtkAudioService; C:\Program Files\Realtek\Audio\HDA\RtkAudioService64.exe [314624 2016-08-15] (Realtek Semiconductor)

S3 WdNisSvc; C:\Program Files\Windows Defender\NisSrv.exe [355304 2017-09-29] (Microsoft Corporation)

S3 WinDefend; C:\Program Files\Windows Defender\MsMpEng.exe [105944 2017-09-29] (Microsoft Corporation)

R2 ZeroConfigService; C:\Program Files\Intel\WiFi\bin\ZeroConfigService.exe [3758720 2017-12-20] (Intel® Corporation)

===================== Drivers (Whitelisted) ======================

(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)

R3 AmdGpio2; C:\WINDOWS\System32\drivers\AmdGpio2.sys [34032 2016-07-29] (Advanced Micro Devices, INC.)

S3 amdkmcsp; C:\WINDOWS\system32\DRIVERS\amdkmcsp.sys [95080 2017-06-12] (Advanced Micro Devices, Inc. )

R3 amdkmdag; C:\WINDOWS\System32\DriverStore\FileRepository\c0315087.inf_amd64_a27f9e273e87a888\atikmdag.sys [32702840 2017-06-19] (Advanced Micro Devices, Inc.)

R3 amdkmdap; C:\WINDOWS\System32\DriverStore\FileRepository\c0315087.inf_amd64_a27f9e273e87a888\atikmpag.sys [525184 2017-06-19] (Advanced Micro Devices, Inc.)

R1 amdpsp; C:\WINDOWS\system32\DRIVERS\amdpsp.sys [239976 2017-06-12] (Advanced Micro Devices, Inc. )

R3 AtiHDAudioService; C:\WINDOWS\system32\drivers\AtihdWT6.sys [110096 2016-07-29] (Advanced Micro Devices)

R1 BHDrvx64; C:\Program Files (x86)\Norton Security Suite\NortonData\22.7.0.76\Definitions\BASHDefs\20180210.001\BHDrvx64.sys [1879632 2018-02-09] (Symantec Corporation)

R1 ccSet_NGC; C:\WINDOWS\system32\drivers\NGCx64\160C000.068\ccSetx64.sys [187544 2018-01-25] (Symantec Corporation)

R1 ESProtectionDriver; C:\WINDOWS\system32\drivers\mbae64.sys [77432 2017-11-29] ()

R3 ibtusb; C:\WINDOWS\system32\DRIVERS\ibtusb.sys [136128 2017-12-06] (Intel Corporation)

R1 IDSVia64; C:\Program Files (x86)\Norton Security Suite\NortonData\22.7.0.76\Definitions\IPSDefs\20180213.001\IDSvia64.sys [1056920 2017-10-14] (Symantec Corporation)

R2 MBAMChameleon; C:\WINDOWS\System32\Drivers\MbamChameleon.sys [193968 2018-02-14] (Malwarebytes)

R3 MBAMFarflt; C:\WINDOWS\system32\DRIVERS\farflt.sys [110016 2018-02-14] (Malwarebytes)

R3 MBAMProtection; C:\WINDOWS\system32\DRIVERS\mbam.sys [46008 2018-02-14] (Malwarebytes)

R3 MBAMSwissArmy; C:\WINDOWS\System32\Drivers\mbamswissarmy.sys [253880 2018-02-14] (Malwarebytes)

R3 MBAMWebProtection; C:\WINDOWS\system32\DRIVERS\mwac.sys [94144 2018-02-14] (Malwarebytes)

R3 Netwtw04; C:\WINDOWS\system32\DRIVERS\Netwtw04.sys [8614376 2017-12-01] (Intel Corporation)

R3 RSP2STOR; C:\WINDOWS\system32\DRIVERS\RtsP2Stor.sys [328920 2016-06-16] (Realtek Semiconductor Corp.)

R3 rt640x64; C:\WINDOWS\System32\drivers\rt640x64.sys [943112 2016-07-19] (Realtek )

R3 SRTSP; C:\WINDOWS\System32\Drivers\NGCx64\160C000.068\SRTSP64.SYS [817816 2018-01-25] (Symantec Corporation)

R1 SRTSPX; C:\WINDOWS\system32\drivers\NGCx64\160C000.068\SRTSPX64.SYS [49304 2018-01-25] (Symantec Corporation)

R0 SymEFASI; C:\WINDOWS\System32\drivers\NGCx64\160C000.068\SYMEFASI64.SYS [1942168 2018-01-25] (Symantec Corporation)

S0 SymELAM; C:\WINDOWS\System32\drivers\NGCx64\160C000.068\SymELAM.sys [24608 2018-01-25] (Symantec Corporation)

R3 SymEvent; C:\windows\system32\Drivers\SYMEVENT64x86.SYS [102552 2018-02-14] (Symantec Corporation)

R1 SymIRON; C:\WINDOWS\system32\drivers\NGCx64\160C000.068\Ironx64.SYS [307864 2018-01-25] (Symantec Corporation)

R1 SymNetS; C:\WINDOWS\System32\Drivers\NGCx64\160C000.068\SYMNETS.SYS [566936 2018-01-25] (Symantec Corporation)

S3 WdBoot; C:\WINDOWS\system32\drivers\WdBoot.sys [44608 2017-09-29] (Microsoft Corporation)

S3 WdFilter; C:\WINDOWS\system32\drivers\WdFilter.sys [309144 2017-09-29] (Microsoft Corporation)

S3 WdNisDrv; C:\WINDOWS\System32\Drivers\WdNisDrv.sys [119192 2017-09-29] (Microsoft Corporation)

==================== NetSvcs (Whitelisted) ===================

(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)

==================== One Month Created files and folders ========

(If an entry is included in the fixlist, the file/folder will be moved.)

2018-02-14 18:43 - 2018-02-14 18:43 - 000024931 _____ C:\Users\mill1\Desktop\FRST.txt

2018-02-14 18:42 - 2018-02-14 18:43 - 000000000 ____D C:\FRST

2018-02-14 18:40 - 2018-02-14 18:40 - 002405376 _____ (Farbar) C:\Users\mill1\Desktop\FRST64.exe

2018-02-14 18:32 - 2018-02-14 18:34 - 000094144 _____ (Malwarebytes) C:\WINDOWS\system32\Drivers\mwac.sys

2018-02-14 18:32 - 2018-02-14 18:32 - 000253880 _____ (Malwarebytes) C:\WINDOWS\system32\Drivers\mbamswissarmy.sys

2018-02-14 18:32 - 2018-02-14 18:32 - 000193968 _____ (Malwarebytes) C:\WINDOWS\system32\Drivers\MbamChameleon.sys

2018-02-14 18:32 - 2018-02-14 18:32 - 000110016 _____ (Malwarebytes) C:\WINDOWS\system32\Drivers\farflt.sys

2018-02-14 18:32 - 2018-02-14 18:32 - 000046008 _____ (Malwarebytes) C:\WINDOWS\system32\Drivers\mbam.sys

2018-02-14 18:32 - 2018-02-14 18:32 - 000001919 _____ C:\Users\Public\Desktop\Malwarebytes.lnk

2018-02-14 18:32 - 2018-02-14 18:32 - 000000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Malwarebytes

2018-02-14 18:32 - 2018-02-14 18:32 - 000000000 ____D C:\ProgramData\Malwarebytes

2018-02-14 18:32 - 2018-02-14 18:32 - 000000000 ____D C:\Program Files\Malwarebytes

2018-02-14 18:32 - 2017-11-29 09:11 - 000077432 _____ C:\WINDOWS\system32\Drivers\mbae64.sys

2018-02-14 18:30 - 2018-02-14 18:30 - 067292528 _____ (Malwarebytes ) C:\Users\mill1\Desktop\mb3-setup-consumer-3.3.1.2183-1.0.262-1.0.3932.exe

2018-02-14 18:30 - 2018-02-14 18:30 - 000000000 ____D C:\WINDOWS\System32\Tasks\Norton 360

2018-02-14 18:25 - 2018-02-14 18:25 - 000000000 ___HD C:\OneDriveTemp

2018-02-14 18:23 - 2018-02-14 18:23 - 000000000 ___HD C:\ProgramData\temp

2018-02-14 18:16 - 2018-02-14 18:16 - 000003402 _____ C:\WINDOWS\System32\Tasks\Norton WSC Integration

2018-02-14 18:16 - 2018-02-14 18:16 - 000002450 _____ C:\Users\Public\Desktop\Norton Security.lnk

2018-02-14 18:16 - 2018-02-14 18:16 - 000000000 ___RD C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Norton Security Suite

2018-02-14 11:50 - 2018-02-10 01:24 - 000270744 _____ (Microsoft Corporation) C:\WINDOWS\system32\acmigration.dll

2018-02-14 11:50 - 2018-02-10 01:23 - 001577880 _____ (Microsoft Corporation) C:\WINDOWS\system32\appraiser.dll

2018-02-14 11:50 - 2018-02-10 01:23 - 000613272 _____ (Microsoft Corporation) C:\WINDOWS\system32\devinv.dll

2018-02-14 11:50 - 2018-02-10 01:23 - 000138136 _____ (Microsoft Corporation) C:\WINDOWS\system32\CompatTelRunner.exe

2018-02-14 11:50 - 2018-02-10 01:21 - 001092016 _____ (Microsoft Corporation) C:\WINDOWS\system32\winresume.efi

2018-02-14 11:50 - 2018-02-10 01:21 - 000479912 _____ (Microsoft Corporation) C:\WINDOWS\system32\ucrtbase_enclave.dll

2018-02-14 11:50 - 2018-02-10 01:20 - 001206680 _____ (Microsoft Corporation) C:\WINDOWS\system32\hvix64.exe

2018-02-14 11:50 - 2018-02-10 01:20 - 001055640 _____ (Microsoft Corporation) C:\WINDOWS\system32\hvax64.exe

2018-02-14 11:50 - 2018-02-10 01:20 - 000924648 _____ (Microsoft Corporation) C:\WINDOWS\system32\winresume.exe

2018-02-14 11:50 - 2018-02-10 01:20 - 000599448 _____ (Microsoft Corporation) C:\WINDOWS\system32\securekernel.exe

2018-02-14 11:50 - 2018-02-10 01:20 - 000077208 _____ (Microsoft Corporation) C:\WINDOWS\system32\hvloader.dll

2018-02-14 11:50 - 2018-02-10 01:18 - 000319864 _____ (Microsoft Corporation) C:\WINDOWS\system32\wow64.dll

2018-02-14 11:50 - 2018-02-10 01:17 - 001209240 _____ (Microsoft Corporation) C:\WINDOWS\system32\winload.exe

2018-02-14 11:50 - 2018-02-10 01:16 - 008603032 _____ (Microsoft Corporation) C:\WINDOWS\system32\ntoskrnl.exe

2018-02-14 11:50 - 2018-02-10 01:16 - 000739696 _____ (Microsoft Corporation) C:\WINDOWS\system32\dnsapi.dll

2018-02-14 11:50 - 2018-02-10 01:15 - 001954048 _____ (Microsoft Corporation) C:\WINDOWS\system32\ntdll.dll

2018-02-14 11:50 - 2018-02-10 01:15 - 001415296 _____ (Microsoft Corporation) C:\WINDOWS\system32\winload.efi

2018-02-14 11:50 - 2018-02-10 01:15 - 000471968 _____ (Microsoft Corporation) C:\WINDOWS\system32\hal.dll

2018-02-14 11:50 - 2018-02-10 01:14 - 004504464 _____ (Microsoft Corporation) C:\WINDOWS\system32\sppsvc.exe

2018-02-14 11:50 - 2018-02-10 01:14 - 002395032 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\ntfs.sys

2018-02-14 11:50 - 2018-02-10 01:14 - 001002592 _____ (Microsoft Corporation) C:\WINDOWS\system32\ucrtbase.dll

2018-02-14 11:50 - 2018-02-10 01:13 - 000373656 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\clfs.sys

2018-02-14 11:50 - 2018-02-10 01:12 - 001277848 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\ndis.sys

2018-02-14 11:50 - 2018-02-10 01:12 - 000712600 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\vhdmp.sys

2018-02-14 11:50 - 2018-02-10 01:11 - 000711432 _____ (Microsoft Corporation) C:\WINDOWS\system32\ci.dll

2018-02-14 11:50 - 2018-02-10 01:11 - 000677784 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\cng.sys

2018-02-14 11:50 - 2018-02-10 01:10 - 002447768 _____ (Microsoft Corporation) C:\WINDOWS\system32\UpdateAgent.dll

2018-02-14 11:50 - 2018-02-10 01:09 - 003904296 _____ (Microsoft Corporation) C:\WINDOWS\explorer.exe

2018-02-14 11:50 - 2018-02-10 01:09 - 000755712 _____ (Microsoft Corporation) C:\WINDOWS\system32\evr.dll

2018-02-14 11:50 - 2018-02-10 01:08 - 021351624 _____ (Microsoft Corporation) C:\WINDOWS\system32\shell32.dll

2018-02-14 11:50 - 2018-02-10 01:08 - 007675784 _____ (Microsoft Corporation) C:\WINDOWS\system32\windows.storage.dll

2018-02-14 11:50 - 2018-02-10 01:08 - 003010248 _____ (Microsoft Corporation) C:\WINDOWS\system32\d3d11.dll

2018-02-14 11:50 - 2018-02-10 01:08 - 002574232 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\dxgkrnl.sys

2018-02-14 11:50 - 2018-02-10 01:08 - 000048112 _____ (Microsoft Corporation) C:\WINDOWS\system32\wuauclt.exe

2018-02-14 11:50 - 2018-02-10 01:07 - 004506576 _____ (Microsoft Corporation) C:\WINDOWS\system32\mfcore.dll

2018-02-14 11:50 - 2018-02-10 01:07 - 002710728 _____ (Microsoft Corporation) C:\WINDOWS\system32\iertutil.dll

2018-02-14 11:50 - 2018-02-10 01:06 - 000727448 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\fvevol.sys

2018-02-14 11:50 - 2018-02-10 01:06 - 000494488 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\mrxsmb.sys

2018-02-14 11:50 - 2018-02-10 01:06 - 000362904 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\pci.sys

2018-02-14 11:50 - 2018-02-10 01:06 - 000087384 _____ (Microsoft Corporation) C:\WINDOWS\system32\remoteaudioendpoint.dll

2018-02-14 11:50 - 2018-02-10 01:04 - 007384576 _____ (Microsoft Corporation) C:\WINDOWS\system32\Windows.Media.Protection.PlayReady.dll

2018-02-14 11:50 - 2018-02-10 01:04 - 006791984 _____ (Microsoft Corporation) C:\WINDOWS\system32\Windows.Media.dll

2018-02-14 11:50 - 2018-02-10 01:04 - 001426672 _____ (Microsoft Corporation) C:\WINDOWS\system32\AudioEng.dll

2018-02-14 11:50 - 2018-02-10 01:04 - 001254144 _____ (Microsoft Corporation) C:\WINDOWS\system32\mfsvr.dll

2018-02-14 11:50 - 2018-02-10 01:04 - 001170008 _____ (Microsoft Corporation) C:\WINDOWS\system32\AudioSes.dll

2018-02-14 11:50 - 2018-02-10 01:04 - 000614296 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\afd.sys

2018-02-14 11:50 - 2018-02-10 01:04 - 000603920 _____ (Microsoft Corporation) C:\WINDOWS\system32\audiodg.exe

2018-02-14 11:50 - 2018-02-10 01:04 - 000374032 _____ (Microsoft Corporation) C:\WINDOWS\system32\vac.exe

2018-02-14 11:50 - 2018-02-10 01:04 - 000260896 _____ (Microsoft Corporation) C:\WINDOWS\system32\mfps.dll

2018-02-14 11:50 - 2018-02-10 01:03 - 000404888 _____ (Microsoft Corporation) C:\WINDOWS\system32\CloudExperienceHost.dll

2018-02-14 11:50 - 2018-02-10 01:02 - 002773400 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\tcpip.sys

2018-02-14 11:50 - 2018-02-10 01:02 - 001103768 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\http.sys

2018-02-14 11:50 - 2018-02-10 01:02 - 000617304 _____ (Microsoft Corporation) C:\WINDOWS\system32\TextInputFramework.dll

2018-02-14 11:50 - 2018-02-10 00:21 - 001615712 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\ntdll.dll

2018-02-14 11:50 - 2018-02-10 00:17 - 000597160 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\dnsapi.dll

2018-02-14 11:50 - 2018-02-10 00:15 - 001145624 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\ucrtbase.dll

2018-02-14 11:50 - 2018-02-10 00:09 - 006092152 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\windows.storage.dll

2018-02-14 11:50 - 2018-02-10 00:09 - 003485392 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\explorer.exe

2018-02-14 11:50 - 2018-02-10 00:09 - 002338776 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\d3d11.dll

2018-02-14 11:50 - 2018-02-10 00:08 - 002193168 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\iertutil.dll

2018-02-14 11:50 - 2018-02-10 00:07 - 025253376 _____ (Microsoft Corporation) C:\WINDOWS\system32\edgehtml.dll

2018-02-14 11:50 - 2018-02-10 00:07 - 020286120 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\shell32.dll

2018-02-14 11:50 - 2018-02-10 00:06 - 006481640 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\Windows.Media.Protection.PlayReady.dll

2018-02-14 11:50 - 2018-02-10 00:06 - 006014688 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\Windows.Media.dll

2018-02-14 11:50 - 2018-02-10 00:06 - 004670728 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\mfcore.dll

2018-02-14 11:50 - 2018-02-10 00:06 - 000982528 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\AudioSes.dll

2018-02-14 11:50 - 2018-02-10 00:05 - 001246432 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\AudioEng.dll

2018-02-14 11:50 - 2018-02-10 00:05 - 001149272 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\mfsvr.dll

2018-02-14 11:50 - 2018-02-10 00:05 - 000662208 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\evr.dll

2018-02-14 11:50 - 2018-02-10 00:05 - 000129184 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\mfps.dll

2018-02-14 11:50 - 2018-02-10 00:05 - 000074992 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\remoteaudioendpoint.dll

2018-02-14 11:50 - 2018-02-09 23:50 - 003665408 _____ (Microsoft Corporation) C:\WINDOWS\system32\win32kfull.sys

2018-02-14 11:50 - 2018-02-09 23:50 - 001294848 _____ (Microsoft Corporation) C:\WINDOWS\system32\usocore.dll

2018-02-14 11:50 - 2018-02-09 23:49 - 000536576 _____ (Microsoft Corporation) C:\WINDOWS\system32\edgeIso.dll

2018-02-14 11:50 - 2018-02-09 23:49 - 000385536 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\cldflt.sys

2018-02-14 11:50 - 2018-02-09 23:49 - 000329728 _____ (Microsoft Corporation) C:\WINDOWS\system32\AcGenral.dll

2018-02-14 11:50 - 2018-02-09 23:49 - 000326656 _____ (Microsoft Corporation) C:\WINDOWS\system32\MusNotification.exe

2018-02-14 11:50 - 2018-02-09 23:49 - 000232960 _____ (Microsoft Corporation) C:\WINDOWS\system32\convertvhd.exe

2018-02-14 11:50 - 2018-02-09 23:47 - 017160704 _____ (Microsoft Corporation) C:\WINDOWS\system32\Windows.UI.Xaml.dll

2018-02-14 11:50 - 2018-02-09 23:47 - 013704192 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\Windows.UI.Xaml.dll

2018-02-14 11:50 - 2018-02-09 23:46 - 002902528 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\win32kfull.sys

2018-02-14 11:50 - 2018-02-09 23:46 - 002393600 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\AcGenral.dll

2018-02-14 11:50 - 2018-02-09 23:46 - 000344576 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\edgeIso.dll

2018-02-14 11:50 - 2018-02-09 23:46 - 000225792 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\winnat.sys

2018-02-14 11:50 - 2018-02-09 23:46 - 000169472 _____ (Microsoft Corporation) C:\WINDOWS\system32\wuuhosdeployment.dll

2018-02-14 11:50 - 2018-02-09 23:45 - 007545344 _____ (Microsoft Corporation) C:\WINDOWS\system32\twinui.dll

2018-02-14 11:50 - 2018-02-09 23:45 - 000675328 _____ (Microsoft Corporation) C:\WINDOWS\system32\webplatstorageserver.dll

2018-02-14 11:50 - 2018-02-09 23:45 - 000115200 _____ (Microsoft Corporation) C:\WINDOWS\system32\updatepolicy.dll

2018-02-14 11:50 - 2018-02-09 23:45 - 000093696 _____ (Microsoft Corporation) C:\WINDOWS\system32\mshtmled.dll

2018-02-14 11:50 - 2018-02-09 23:45 - 000079872 _____ (Microsoft Corporation) C:\WINDOWS\system32\nlaapi.dll

2018-02-14 11:50 - 2018-02-09 23:45 - 000043008 _____ (Microsoft Corporation) C:\WINDOWS\system32\nshhttp.dll

2018-02-14 11:50 - 2018-02-09 23:44 - 001498112 _____ (Microsoft Corporation) C:\WINDOWS\system32\WebRuntimeManager.dll

2018-02-14 11:50 - 2018-02-09 23:44 - 000539136 _____ (Microsoft Corporation) C:\WINDOWS\system32\HolographicExtensions.dll

2018-02-14 11:50 - 2018-02-09 23:44 - 000431616 _____ (Microsoft Corporation) C:\WINDOWS\system32\msIso.dll

2018-02-14 11:50 - 2018-02-09 23:44 - 000336896 _____ (Microsoft Corporation) C:\WINDOWS\system32\AppLockerCSP.dll

2018-02-14 11:50 - 2018-02-09 23:44 - 000276480 _____ (Microsoft Corporation) C:\WINDOWS\system32\dxtrans.dll

2018-02-14 11:50 - 2018-02-09 23:43 - 018923008 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\edgehtml.dll

2018-02-14 11:50 - 2018-02-09 23:43 - 008020480 _____ (Microsoft Corporation) C:\WINDOWS\system32\Windows.Data.Pdf.dll

2018-02-14 11:50 - 2018-02-09 23:43 - 006466560 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\twinui.dll

2018-02-14 11:50 - 2018-02-09 23:43 - 000570368 _____ (Microsoft Corporation) C:\WINDOWS\system32\TileDataRepository.dll

2018-02-14 11:50 - 2018-02-09 23:43 - 000456704 _____ (Microsoft Corporation) C:\WINDOWS\system32\dxtmsft.dll

2018-02-14 11:50 - 2018-02-09 23:43 - 000394752 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\ks.sys

2018-02-14 11:50 - 2018-02-09 23:43 - 000391168 _____ (Microsoft Corporation) C:\WINDOWS\system32\iedkcs32.dll

2018-02-14 11:50 - 2018-02-09 23:43 - 000268288 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\dxtrans.dll

2018-02-14 11:50 - 2018-02-09 23:43 - 000086528 _____ (Microsoft Corporation) C:\WINDOWS\system32\cldapi.dll

2018-02-14 11:50 - 2018-02-09 23:42 - 023671808 _____ (Microsoft Corporation) C:\WINDOWS\system32\mshtml.dll

2018-02-14 11:50 - 2018-02-09 23:42 - 001425408 _____ (Microsoft Corporation) C:\WINDOWS\system32\SystemSettings.Handlers.dll

2018-02-14 11:50 - 2018-02-09 23:42 - 001015296 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\bthport.sys

2018-02-14 11:50 - 2018-02-09 23:42 - 000813568 _____ (Microsoft Corporation) C:\WINDOWS\system32\bisrv.dll

2018-02-14 11:50 - 2018-02-09 23:42 - 000708096 _____ (Microsoft Corporation) C:\WINDOWS\system32\jscript9diag.dll

2018-02-14 11:50 - 2018-02-09 23:42 - 000397824 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\dxtmsft.dll

2018-02-14 11:50 - 2018-02-09 23:42 - 000236032 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\FSClient.dll

2018-02-14 11:50 - 2018-02-09 23:42 - 000233984 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\AppLockerCSP.dll

2018-02-14 11:50 - 2018-02-09 23:42 - 000228352 _____ (Microsoft Corporation) C:\WINDOWS\system32\ie4uinit.exe

2018-02-14 11:50 - 2018-02-09 23:41 - 019352576 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\mshtml.dll

2018-02-14 11:50 - 2018-02-09 23:41 - 001495552 _____ (Microsoft Corporation) C:\WINDOWS\system32\AppXDeploymentExtensions.desktop.dll

2018-02-14 11:50 - 2018-02-09 23:41 - 000815616 _____ (Microsoft Corporation) C:\WINDOWS\system32\ieproxy.dll

2018-02-14 11:50 - 2018-02-09 23:41 - 000721408 _____ (Microsoft Corporation) C:\WINDOWS\system32\LogonController.dll

2018-02-14 11:50 - 2018-02-09 23:41 - 000401408 _____ (Microsoft Corporation) C:\WINDOWS\system32\ncsi.dll

2018-02-14 11:50 - 2018-02-09 23:41 - 000369152 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\msIso.dll

2018-02-14 11:50 - 2018-02-09 23:41 - 000365568 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\ieproxy.dll

2018-02-14 11:50 - 2018-02-09 23:41 - 000063488 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\nlaapi.dll

2018-02-14 11:50 - 2018-02-09 23:40 - 012831744 _____ (Microsoft Corporation) C:\WINDOWS\system32\ieframe.dll

2018-02-14 11:50 - 2018-02-09 23:40 - 008110080 _____ (Microsoft Corporation) C:\WINDOWS\system32\Chakra.dll

2018-02-14 11:50 - 2018-02-09 23:40 - 001002496 _____ (Microsoft Corporation) C:\WINDOWS\system32\modernexecserver.dll

2018-02-14 11:50 - 2018-02-09 23:40 - 000756736 _____ (Microsoft Corporation) C:\WINDOWS\system32\msfeeds.dll

2018-02-14 11:50 - 2018-02-09 23:40 - 000559104 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\jscript9diag.dll

2018-02-14 11:50 - 2018-02-09 23:40 - 000366080 _____ (Microsoft Corporation) C:\WINDOWS\system32\nlasvc.dll

2018-02-14 11:50 - 2018-02-09 23:40 - 000343040 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\iedkcs32.dll

2018-02-14 11:50 - 2018-02-09 23:39 - 011925504 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\ieframe.dll

2018-02-14 11:50 - 2018-02-09 23:39 - 004748288 _____ (Microsoft Corporation) C:\WINDOWS\system32\jscript9.dll

2018-02-14 11:50 - 2018-02-09 23:39 - 004592640 _____ (Microsoft Corporation) C:\WINDOWS\system32\SystemSettingsThresholdAdminFlowUI.dll

2018-02-14 11:50 - 2018-02-09 23:39 - 002976256 _____ (Microsoft Corporation) C:\WINDOWS\system32\twinui.pcshell.dll

2018-02-14 11:50 - 2018-02-09 23:39 - 002209280 _____ (Microsoft Corporation) C:\WINDOWS\system32\AppXDeploymentExtensions.onecore.dll

2018-02-14 11:50 - 2018-02-09 23:38 - 006567936 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\Windows.Data.Pdf.dll

2018-02-14 11:50 - 2018-02-09 23:38 - 005833216 _____ (Microsoft Corporation) C:\WINDOWS\system32\dbgeng.dll

2018-02-14 11:50 - 2018-02-09 23:38 - 004815360 _____ (Microsoft Corporation) C:\WINDOWS\system32\MFMediaEngine.dll

2018-02-14 11:50 - 2018-02-09 23:38 - 003334144 _____ (Microsoft Corporation) C:\WINDOWS\system32\wininet.dll

2018-02-14 11:50 - 2018-02-09 23:38 - 003169280 _____ (Microsoft Corporation) C:\WINDOWS\system32\AppXDeploymentServer.dll

2018-02-14 11:50 - 2018-02-09 23:38 - 003125760 _____ (Microsoft Corporation) C:\WINDOWS\system32\InputService.dll

2018-02-14 11:50 - 2018-02-09 23:38 - 002857984 _____ (Microsoft Corporation) C:\WINDOWS\system32\dwmcore.dll

2018-02-14 11:50 - 2018-02-09 23:38 - 002086400 _____ (Microsoft Corporation) C:\WINDOWS\system32\win32kbase.sys

2018-02-14 11:50 - 2018-02-09 23:38 - 002082304 _____ (Microsoft Corporation) C:\WINDOWS\system32\inetcpl.cpl

2018-02-14 11:50 - 2018-02-09 23:38 - 001597952 _____ (Microsoft Corporation) C:\WINDOWS\system32\ieapfltr.dll

2018-02-14 11:50 - 2018-02-09 23:38 - 001547776 _____ (Microsoft Corporation) C:\WINDOWS\system32\lsasrv.dll

2018-02-14 11:50 - 2018-02-09 23:38 - 001228800 _____ (Microsoft Corporation) C:\WINDOWS\system32\TokenBroker.dll

2018-02-14 11:50 - 2018-02-09 23:38 - 001167360 _____ (Microsoft Corporation) C:\WINDOWS\system32\ISM.dll

2018-02-14 11:50 - 2018-02-09 23:38 - 001057792 _____ (Microsoft Corporation) C:\WINDOWS\system32\comdlg32.dll

2018-02-14 11:50 - 2018-02-09 23:38 - 000668160 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\msfeeds.dll

2018-02-14 11:50 - 2018-02-09 23:38 - 000556544 _____ (Microsoft Corporation) C:\WINDOWS\system32\LockAppBroker.dll

2018-02-14 11:50 - 2018-02-09 23:38 - 000462336 _____ (Microsoft Corporation) C:\WINDOWS\system32\wuuhext.dll

2018-02-14 11:50 - 2018-02-09 23:37 - 004839424 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\dbgeng.dll

2018-02-14 11:50 - 2018-02-09 23:37 - 004772352 _____ (Microsoft Corporation) C:\WINDOWS\system32\ExplorerFrame.dll

2018-02-14 11:50 - 2018-02-09 23:37 - 003678720 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\jscript9.dll

2018-02-14 11:50 - 2018-02-09 23:37 - 003578368 _____ (Microsoft Corporation) C:\WINDOWS\system32\SRH.dll

2018-02-14 11:50 - 2018-02-09 23:37 - 002784256 _____ (Microsoft Corporation) C:\WINDOWS\system32\wuaueng.dll

2018-02-14 11:50 - 2018-02-09 23:37 - 001822208 _____ (Microsoft Corporation) C:\WINDOWS\system32\urlmon.dll

2018-02-14 11:50 - 2018-02-09 23:37 - 001488384 _____ (Microsoft Corporation) C:\WINDOWS\system32\audiosrv.dll

2018-02-14 11:50 - 2018-02-09 23:37 - 000456704 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\LockAppBroker.dll

2018-02-14 11:50 - 2018-02-09 23:36 - 006031360 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\Chakra.dll

2018-02-14 11:50 - 2018-02-09 23:36 - 002869760 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\wininet.dll

2018-02-14 11:50 - 2018-02-09 23:36 - 002859520 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\SRH.dll

2018-02-14 11:50 - 2018-02-09 23:36 - 002464768 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\dwmcore.dll

2018-02-14 11:50 - 2018-02-09 23:36 - 001739264 _____ (Microsoft Corporation) C:\WINDOWS\system32\Windows.UI.Immersive.dll

2018-02-14 11:50 - 2018-02-09 23:36 - 001559552 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\urlmon.dll

2018-02-14 11:50 - 2018-02-09 23:36 - 000685056 _____ (Microsoft Corporation) C:\WINDOWS\system32\AudioEndpointBuilder.dll

2018-02-14 11:50 - 2018-02-09 23:36 - 000666624 _____ (Microsoft Corporation) C:\WINDOWS\system32\DbgModel.dll

2018-02-14 11:50 - 2018-02-09 23:36 - 000599552 _____ (Microsoft Corporation) C:\WINDOWS\system32\Windows.UI.Core.TextInput.dll

2018-02-14 11:50 - 2018-02-09 23:35 - 004384768 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\ExplorerFrame.dll

2018-02-14 11:50 - 2018-02-09 23:35 - 002349568 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\InputService.dll

2018-02-14 11:50 - 2018-02-09 23:35 - 002013184 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\inetcpl.cpl

2018-02-14 11:50 - 2018-02-09 23:35 - 001474560 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\ieapfltr.dll

2018-02-14 11:50 - 2018-02-09 23:35 - 000963584 _____ (Microsoft Corporation) C:\WINDOWS\system32\StorSvc.dll

2018-02-14 11:50 - 2018-02-09 23:35 - 000842240 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\comdlg32.dll

2018-02-14 11:50 - 2018-02-09 23:34 - 004249600 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\MFMediaEngine.dll

2018-02-14 11:50 - 2018-02-09 23:33 - 001570816 _____ (Microsoft Corporation) C:\WINDOWS\system32\RecoveryDrive.exe

2018-02-14 11:50 - 2018-02-09 23:33 - 001509888 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\Windows.UI.Immersive.dll

2018-02-14 11:49 - 2018-02-10 01:23 - 000758168 _____ (Microsoft Corporation) C:\WINDOWS\system32\generaltel.dll

2018-02-14 11:49 - 2018-02-10 01:22 - 002003352 _____ (Microsoft Corporation) C:\WINDOWS\system32\aitstatic.exe

2018-02-14 11:49 - 2018-02-10 01:22 - 000662936 _____ (Microsoft Corporation) C:\WINDOWS\system32\aeinv.dll

2018-02-14 11:49 - 2018-02-10 01:22 - 000460696 _____ (Microsoft Corporation) C:\WINDOWS\system32\dcntel.dll

2018-02-14 11:49 - 2018-02-10 01:22 - 000387480 _____ (Microsoft Corporation) C:\WINDOWS\system32\invagent.dll

2018-02-14 11:49 - 2018-02-10 01:22 - 000272800 _____ (Microsoft Corporation) C:\WINDOWS\system32\aepic.dll

2018-02-14 11:49 - 2018-02-10 01:22 - 000070040 _____ (Microsoft Corporation) C:\WINDOWS\system32\win32appinventorycsp.dll

2018-02-14 11:49 - 2018-02-10 01:22 - 000035224 _____ (Microsoft Corporation) C:\WINDOWS\system32\DeviceCensus.exe

2018-02-14 11:49 - 2018-02-10 01:21 - 000279456 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\msiscsi.sys

2018-02-14 11:49 - 2018-02-10 01:19 - 001133888 _____ (Microsoft Corporation) C:\WINDOWS\system32\MSVP9DEC.dll

2018-02-14 11:49 - 2018-02-10 01:18 - 001193192 _____ (Microsoft Corporation) C:\WINDOWS\system32\Windows.StateRepositoryPS.dll

2018-02-14 11:49 - 2018-02-10 01:18 - 000098272 _____ (Microsoft Corporation) C:\WINDOWS\system32\FsIso.exe

2018-02-14 11:49 - 2018-02-10 01:18 - 000022400 _____ (Microsoft Corporation) C:\WINDOWS\system32\wow64cpu.dll

2018-02-14 11:49 - 2018-02-10 01:16 - 002406456 _____ (Microsoft Corporation) C:\WINDOWS\system32\msmpeg2vdec.dll

2018-02-14 11:49 - 2018-02-10 01:15 - 002514944 _____ (Microsoft Corporation) C:\WINDOWS\system32\KernelBase.dll

2018-02-14 11:49 - 2018-02-10 01:13 - 001416392 _____ (Microsoft Corporation) C:\WINDOWS\system32\D3D12.dll

2018-02-14 11:49 - 2018-02-10 01:13 - 000535960 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\netio.sys

2018-02-14 11:49 - 2018-02-10 01:13 - 000408984 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\dxgmms1.sys

2018-02-14 11:49 - 2018-02-10 01:12 - 004537040 _____ (Microsoft Corporation) C:\WINDOWS\system32\setupapi.dll

2018-02-14 11:49 - 2018-02-10 01:12 - 001313016 _____ (Microsoft Corporation) C:\WINDOWS\system32\Taskmgr.exe

2018-02-14 11:49 - 2018-02-10 01:11 - 001029528 _____ (Microsoft Corporation) C:\WINDOWS\system32\efscore.dll

2018-02-14 11:49 - 2018-02-10 01:11 - 000494496 _____ (Microsoft Corporation) C:\WINDOWS\system32\pcasvc.dll

2018-02-14 11:49 - 2018-02-10 01:10 - 000749976 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\dxgmms2.sys

2018-02-14 11:49 - 2018-02-10 01:10 - 000614160 _____ (Microsoft Corporation) C:\WINDOWS\system32\StateRepository.Core.dll

2018-02-14 11:49 - 2018-02-10 01:10 - 000246168 _____ (Microsoft Corporation) C:\WINDOWS\system32\browserbroker.dll

2018-02-14 11:49 - 2018-02-10 01:10 - 000154520 _____ (Microsoft Corporation) C:\WINDOWS\system32\Windows.StateRepositoryClient.dll

2018-02-14 11:49 - 2018-02-10 01:09 - 000525208 _____ (Microsoft Corporation) C:\WINDOWS\system32\wimserv.exe

2018-02-14 11:49 - 2018-02-10 01:09 - 000491264 _____ (Microsoft Corporation) C:\WINDOWS\system32\policymanager.dll

2018-02-14 11:49 - 2018-02-10 01:09 - 000075160 _____ (Microsoft Corporation) C:\WINDOWS\system32\SecurityHealthProxyStub.dll

2018-02-14 11:49 - 2018-02-10 01:08 - 000687552 _____ (Microsoft Corporation) C:\WINDOWS\system32\StructuredQuery.dll

2018-02-14 11:49 - 2018-02-10 01:08 - 000398824 _____ (Microsoft Corporation) C:\WINDOWS\system32\SystemSettingsAdminFlows.exe

2018-02-14 11:49 - 2018-02-10 01:08 - 000096200 _____ (Microsoft Corporation) C:\WINDOWS\system32\winbrand.dll

2018-02-14 11:49 - 2018-02-10 01:07 - 000705944 _____ (Microsoft Corporation) C:\WINDOWS\system32\wimgapi.dll

2018-02-14 11:49 - 2018-02-10 01:07 - 000436632 _____ (Microsoft Corporation) C:\WINDOWS\system32\CloudExperienceHostCommon.dll

2018-02-14 11:49 - 2018-02-10 01:06 - 004486904 _____ (Microsoft Corporation) C:\WINDOWS\system32\Windows.StateRepository.dll

2018-02-14 11:49 - 2018-02-10 01:06 - 000824896 _____ (Microsoft Corporation) C:\WINDOWS\system32\ClipSVC.dll

2018-02-14 11:49 - 2018-02-10 01:06 - 000594048 _____ (Microsoft Corporation) C:\WINDOWS\system32\mf.dll

2018-02-14 11:49 - 2018-02-10 01:06 - 000519144 _____ (Microsoft Corporation) C:\WINDOWS\system32\SecurityHealthService.exe

2018-02-14 11:49 - 2018-02-10 01:06 - 000356952 _____ (Microsoft Corporation) C:\WINDOWS\system32\wintrust.dll

2018-02-14 11:49 - 2018-02-10 01:06 - 000189336 _____ (Microsoft Corporation) C:\WINDOWS\system32\SecurityHealthAgent.dll

2018-02-14 11:49 - 2018-02-10 01:06 - 000100248 _____ (Microsoft Corporation) C:\WINDOWS\system32\Windows.StateRepositoryBroker.dll

2018-02-14 11:49 - 2018-02-10 01:05 - 000688064 _____ (Microsoft Corporation) C:\WINDOWS\system32\AppXDeploymentClient.dll

2018-02-14 11:49 - 2018-02-10 01:05 - 000413888 _____ (Microsoft Corporation) C:\WINDOWS\system32\AUDIOKSE.dll

2018-02-14 11:49 - 2018-02-10 01:05 - 000097176 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\sdstor.sys

2018-02-14 11:49 - 2018-02-10 01:05 - 000070856 _____ (Microsoft Corporation) C:\WINDOWS\system32\wldp.dll

2018-02-14 11:49 - 2018-02-10 01:04 - 001430760 _____ (Microsoft Corporation) C:\WINDOWS\system32\WpcMon.exe

2018-02-14 11:49 - 2018-02-10 01:04 - 000339872 _____ (Microsoft Corporation) C:\WINDOWS\system32\NetworkBindingEngineMigPlugin.dll

2018-02-14 11:49 - 2018-02-10 01:04 - 000212880 _____ (Microsoft Corporation) C:\WINDOWS\system32\mfsensorgroup.dll

2018-02-14 11:49 - 2018-02-10 01:04 - 000093592 _____ (Microsoft Corporation) C:\WINDOWS\system32\rdpudd.dll

2018-02-14 11:49 - 2018-02-10 01:03 - 001619808 _____ (Microsoft Corporation) C:\WINDOWS\system32\sppobjs.dll

2018-02-14 11:49 - 2018-02-10 01:03 - 000849304 _____ (Microsoft Corporation) C:\WINDOWS\system32\LicensingWinRT.dll

2018-02-14 11:49 - 2018-02-10 01:03 - 000722616 _____ (Microsoft Corporation) C:\WINDOWS\system32\sppwinob.dll

2018-02-14 11:49 - 2018-02-10 01:03 - 000706600 _____ (Microsoft Corporation) C:\WINDOWS\system32\EditionUpgradeManagerObj.dll

2018-02-14 11:49 - 2018-02-10 01:03 - 000098712 _____ (Microsoft Corporation) C:\WINDOWS\system32\DeviceReactivation.dll

2018-02-14 11:49 - 2018-02-10 01:02 - 000628632 _____ (Microsoft Corporation) C:\WINDOWS\system32\msvcp_win.dll

2018-02-14 11:49 - 2018-02-10 00:22 - 001930224 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\KernelBase.dll

2018-02-14 11:49 - 2018-02-10 00:18 - 001384288 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\MSVP9DEC.dll

2018-02-14 11:49 - 2018-02-10 00:17 - 002255112 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\msmpeg2vdec.dll

2018-02-14 11:49 - 2018-02-10 00:17 - 000542856 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\Windows.StateRepositoryPS.dll

2018-02-14 11:49 - 2018-02-10 00:17 - 000211864 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\aepic.dll

2018-02-14 11:49 - 2018-02-10 00:12 - 004382032 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\setupapi.dll

2018-02-14 11:49 - 2018-02-10 00:11 - 001250528 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\Taskmgr.exe

2018-02-14 11:49 - 2018-02-10 00:10 - 000422592 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\policymanager.dll

2018-02-14 11:49 - 2018-02-10 00:09 - 001123456 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\D3D12.dll

2018-02-14 11:49 - 2018-02-10 00:09 - 000559976 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\StructuredQuery.dll

2018-02-14 11:49 - 2018-02-10 00:09 - 000354200 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\CloudExperienceHostCommon.dll

2018-02-14 11:49 - 2018-02-10 00:08 - 003980720 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\Windows.StateRepository.dll

2018-02-14 11:49 - 2018-02-10 00:08 - 000592792 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\wimgapi.dll

2018-02-14 11:49 - 2018-02-10 00:07 - 000543920 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\AppXDeploymentClient.dll

2018-02-14 11:49 - 2018-02-10 00:07 - 000527864 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\StateRepository.Core.dll

2018-02-14 11:49 - 2018-02-10 00:07 - 000284112 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\wintrust.dll

2018-02-14 11:49 - 2018-02-10 00:07 - 000123808 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\Windows.StateRepositoryClient.dll

2018-02-14 11:49 - 2018-02-10 00:07 - 000089504 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\Windows.StateRepositoryBroker.dll

2018-02-14 11:49 - 2018-02-10 00:07 - 000083216 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\winbrand.dll

2018-02-14 11:49 - 2018-02-10 00:07 - 000061024 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\wldp.dll

2018-02-14 11:49 - 2018-02-10 00:05 - 000718232 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\LicensingWinRT.dll

2018-02-14 11:49 - 2018-02-10 00:05 - 000654456 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\EditionUpgradeManagerObj.dll

2018-02-14 11:49 - 2018-02-10 00:05 - 000551672 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\mf.dll

2018-02-14 11:49 - 2018-02-10 00:05 - 000386424 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\AUDIOKSE.dll

2018-02-14 11:49 - 2018-02-10 00:05 - 000193248 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\mfsensorgroup.dll

2018-02-14 11:49 - 2018-02-10 00:05 - 000079256 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\DeviceReactivation.dll

2018-02-14 11:49 - 2018-02-10 00:05 - 000077552 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\CloudNotifications.exe

2018-02-14 11:49 - 2018-02-10 00:03 - 000505160 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\msvcp_win.dll

2018-02-14 11:49 - 2018-02-09 23:50 - 001313792 _____ (Microsoft Corporation) C:\WINDOWS\system32\InstallService.dll

2018-02-14 11:49 - 2018-02-09 23:50 - 000849920 _____ (Microsoft Corporation) C:\WINDOWS\system32\uDWM.dll

2018-02-14 11:49 - 2018-02-09 23:50 - 000496128 _____ (Microsoft Corporation) C:\WINDOWS\system32\updatehandlers.dll

2018-02-14 11:49 - 2018-02-09 23:49 - 001664512 _____ (Microsoft Corporation) C:\WINDOWS\system32\GdiPlus.dll

2018-02-14 11:49 - 2018-02-09 23:49 - 000848896 _____ (Microsoft Corporation) C:\WINDOWS\system32\MusUpdateHandlers.dll

2018-02-14 11:49 - 2018-02-09 23:49 - 000211456 _____ (Microsoft Corporation) C:\WINDOWS\system32\MusNotificationUx.exe

2018-02-14 11:49 - 2018-02-09 23:49 - 000107520 _____ (Microsoft Corporation) C:\WINDOWS\system32\musdialoghandlers.dll

2018-02-14 11:49 - 2018-02-09 23:48 - 002890240 _____ (Microsoft Corporation) C:\WINDOWS\system32\Windows.UI.Xaml.Resources.dll

2018-02-14 11:49 - 2018-02-09 23:48 - 000033280 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\mskssrv.sys

2018-02-14 11:49 - 2018-02-09 23:48 - 000025088 _____ (Microsoft Corporation) C:\WINDOWS\system32\EnterpriseAppMgmtClient.dll

2018-02-14 11:49 - 2018-02-09 23:47 - 000331264 _____ (Microsoft Corporation) C:\WINDOWS\system32\browserexport.exe

2018-02-14 11:49 - 2018-02-09 23:47 - 000201728 _____ (Microsoft Corporation) C:\WINDOWS\system32\EdgeManager.dll

2018-02-14 11:49 - 2018-02-09 23:47 - 000201216 _____ (Microsoft Corporation) C:\WINDOWS\system32\SharedPCCSP.dll

2018-02-14 11:49 - 2018-02-09 23:47 - 000143872 _____ (Microsoft Corporation) C:\WINDOWS\system32\mssprxy.dll

2018-02-14 11:49 - 2018-02-09 23:47 - 000140800 _____ (Microsoft Corporation) C:\WINDOWS\system32\Chakradiag.dll

2018-02-14 11:49 - 2018-02-09 23:47 - 000055808 _____ (Microsoft Corporation) C:\WINDOWS\system32\virtdisk.dll

2018-02-14 11:49 - 2018-02-09 23:47 - 000046080 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\hidparse.sys

2018-02-14 11:49 - 2018

#2 Android 8888

SWI Malware Tracker

Trusted Advisor*
1,100 posts

Posted 15 February 2018 - 12:38 PM

Hello floridalou and welcome to SpywareInfo Forum.
I'm Android 8888 and I'll be helping you with your computer issues.

Please wait until I examine your logs and then I will get back to you as soon as possible.

Thank you.

Android 8888

Android 8888

Website: http://android8888.comlu.com

Tavira - Here's where I live!

Please read the Instructions for posting requested logs and the article "So how did I get infected in the first place?"

Our help is free, but if you wish to help keep these forums running please consider a donation; Please see This Topic for details.

#3 Android 8888

SWI Malware Tracker

Trusted Advisor*
1,100 posts

Posted 15 February 2018 - 03:30 PM

Hello.

I suggest printing out each set of instructions or copy them to a Notepad file and reading the entire post before proceeding. It will make following them easier.

Type chrome://extensions in the address bar and press Enter.
Click the trash can icon by the extension Flash Video Downloader.
A confirmation dialog appears, click Remove.

Next,

NOTICE: The following script was written specifically for this user, for use on this particular machine. Running this on another machine may cause damage to your operating system.

Press the Windows key + R on your keyboard at the same time. This will open the RUN BOX.
Type Notepad and click the OK button.
Please copy the entire contents of the code box below. To do this highlight the contents of the box and right click on it and select Copy.
Paste this into the open Notepad.

Start::
CreateRestorePoint:
CloseProcesses:
SearchScopes: HKLM -> {7B90C24F-0A32-46A2-8FC2-439F20B3F585} URL = hxxp://www.amazon.com/s/ref=azs_osd_iea?ie=UTF-8&tag=hp-us1-vsb-20&link%5Fcode=qs&index=aps&field-keywords={searchTerms}
SearchScopes: HKLM-x32 -> {7B90C24F-0A32-46A2-8FC2-439F20B3F585} URL = hxxp://www.amazon.com/s/ref=azs_osd_iea?ie=UTF-8&tag=hp-us1-vsb-20&link%5Fcode=qs&index=aps&field-keywords={searchTerms}
SearchScopes: HKU\S-1-5-21-2306285249-3646823635-4279856882-1001 -> {7B90C24F-0A32-46A2-8FC2-439F20B3F585} URL = hxxp://www.amazon.com/s/ref=azs_osd_iea?ie=UTF-8&tag=hp-us1-vsb-20&link%5Fcode=qs&index=aps&field-keywords={searchTerms}
CHR StartupUrls: Default -> "hxxp://www.google.com/","hxxp://start.mysearchdial.com/?f=1&a=dsites&cd=2XzuyEtN2Y1L1QzutDtDtD0A0C0DtBtAtCtD0Dzy0D0FtC0EtN0D0Tzu0SyBzyyDtN1L2XzutBtFtCzztFtAtFtDtN1L1CzutDtBtCtC1V1TtN1L1G1B1V1N2Y1L1Qzu2SyByD0AyE0AyB0AyEtGtAyB0AzytG0D0BtB0BtGzz0F0BzytGyCtA0CyByC0FyD0AtA0EyDzz2QtN1M1F1B2Z1V1N2Y1L1Qzu2StBtD0F0D0E0D0FtBtGtB0EyByDtGtAzyyDyDtGzy0Bzz0BtGyBtBtByB0AtCyDyB0FtCyByC2Q&cr=2020156714&ir=","hxxp://mysearch.avg.com?cid={617406C1-4D8F-4C16-9091-CB5... (long line)
CHR HKLM\...\Chrome\Extension: [cjabmdjcfcfdmffimndhafhblfmpjdpe] - C:\Program Files (x86)\Norton Security Suite\Engine\22.12.0.104\Exts\Chrome.crx <not found>
CHR HKLM-x32\...\Chrome\Extension: [cjabmdjcfcfdmffimndhafhblfmpjdpe] - C:\Program Files (x86)\Norton Security Suite\Engine\22.12.0.104\Exts\Chrome.crx <not found>
Task: {115AC980-255F-4854-84D9-A0B5032198E4} - \Microsoft\Windows\UNP\RunCampaignManager -> No File <==== ATTENTION
Folder: C:\inetpub
Folder: C:\WINDOWS\system32\ÿÿÿÿÿÿÿÿ8
Folder: C:\WINDOWS\system32\6f01f6654283d891ba8957..bin
Folder: C:\WINDOWS\system32\m32
CMD: ipconfig /flushDNS
EmptyTemp:
End::

Save the file as fixlist.txt in to the same folder as FRST.
Right-click the FRST icon and select Run as administrator to run the tool.
Click the Fix button only once and wait.
When finished FRST will generate a log (Fixlog.txt) on the same folder where FRST is located. Please post its content to your next reply.

NOTE. It's important that both files, FRST and fixlist.txt are in the same location or the fix will not work.

If for some reason the tool needs a restart, please make sure you let the system restart normally. After that let the tool complete its run.

Next,

Open Malwarebytes;
On the left pane select Settings;
Select the Protection tab;
Scroll down to Scan Options and ensure Scan for Rootkits and Scan within Archives are both on and leave all other settings to default.
Go back to DashBoard and select the blue Scan Now tab; Note: The scan may take some time to finish, so please be patient.
When the scan completes if potential threats are detected, ensure to checkmark all the listed items, and click the Quarantine Selectedbutton.
While still on the Scan tab, click the View Report button, and in the window that opens click the Export button, select Text file (*.txt), give it a name and save it to your Desktop.
The log can also be viewed by clicking the log to select it, then clicking the View Report button.
Please copy/paste the content of the log in your next reply.

Next,

Download AdwCleaner and move it to your Desktop.
Right-click on AdwCleaner.exe and select Run as Administrator.
Accept the EULA (I accept), then click on Scan.
Let the scan complete. Once it's done, make sure that every item listed in the different tabs is checked and click on the Clean button.
Once the cleaning process is complete, AdwCleaner will ask to restart your computer, do it.
After the restart, a log will open when logging in. Please copy/paste the content of that log in your next reply.

To summarize, please post:
Fixlog.txt
Malwarebytes log.
AdwCleaner clean log.

Ho is the computer running at this point? Does it still restarting suddenly?

Thank you.

Android 8888

#4 floridalou

Member

Full Member
40 posts

Posted 16 February 2018 - 09:57 AM

Hello,

I hope all is well in your life.

I did what you suggested and my PC is no longer sluggish, I only have to log in once and the "ghost"

seems to have moved on (it no longer restarts randomly).

Thanks again and here are the logs.

FloridaLou

Fix result of Farbar Recovery Scan Tool (x64) Version: 12.02.2018

Ran by mill1 (15-02-2018 17:09:08) Run:1

Running from C:\Users\mill1\Desktop

Loaded Profiles: mill1 (Available Profiles: defaultuser0 & mill1)

Boot Mode: Normal

==============================================

fixlist content:

*****************

CreateRestorePoint:

CloseProcesses:

SearchScopes: HKLM -> {7B90C24F-0A32-46A2-8FC2-439F20B3F585} URL = hxxp://www.amazon.com/s/ref=azs_osd_iea?ie=UTF-8&tag=hp-us1-vsb-20&link%5Fcode=qs&index=aps&field-keywords={searchTerms}

SearchScopes: HKLM-x32 -> {7B90C24F-0A32-46A2-8FC2-439F20B3F585} URL = hxxp://www.amazon.com/s/ref=azs_osd_iea?ie=UTF-8&tag=hp-us1-vsb-20&link%5Fcode=qs&index=aps&field-keywords={searchTerms}

CHR HKLM\...\Chrome\Extension: [cjabmdjcfcfdmffimndhafhblfmpjdpe] - C:\Program Files (x86)\Norton Security Suite\Engine\22.12.0.104\Exts\Chrome.crx <not found>

CHR HKLM-x32\...\Chrome\Extension: [cjabmdjcfcfdmffimndhafhblfmpjdpe] - C:\Program Files (x86)\Norton Security Suite\Engine\22.12.0.104\Exts\Chrome.crx <not found>

Task: {115AC980-255F-4854-84D9-A0B5032198E4} - \Microsoft\Windows\UNP\RunCampaignManager -> No File <==== ATTENTION

Folder: C:\inetpub

Folder: C:\WINDOWS\system32\��8

Folder: C:\WINDOWS\system32\6f01f6654283d891ba8957..bin

Folder: C:\WINDOWS\system32\m32

CMD: ipconfig /flushDNS

EmptyTemp:

*****************

Restore point was successfully created.

Processes closed successfully.

"HKLM\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{7B90C24F-0A32-46A2-8FC2-439F20B3F585}" => removed successfully

HKLM\Software\Classes\CLSID\{7B90C24F-0A32-46A2-8FC2-439F20B3F585} => key not found

"HKLM\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\SearchScopes\{7B90C24F-0A32-46A2-8FC2-439F20B3F585}" => removed successfully

HKLM\Software\Wow6432Node\Classes\CLSID\{7B90C24F-0A32-46A2-8FC2-439F20B3F585} => key not found

"HKU\S-1-5-21-2306285249-3646823635-4279856882-1001\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{7B90C24F-0A32-46A2-8FC2-439F20B3F585}" => removed successfully

HKLM\Software\Classes\CLSID\{7B90C24F-0A32-46A2-8FC2-439F20B3F585} => key not found

"Chrome StartupUrls" => removed successfully

"HKLM\SOFTWARE\Google\Chrome\Extensions\cjabmdjcfcfdmffimndhafhblfmpjdpe" => removed successfully

"HKLM\SOFTWARE\Wow6432Node\Google\Chrome\Extensions\cjabmdjcfcfdmffimndhafhblfmpjdpe" => removed successfully

HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Plain\{115AC980-255F-4854-84D9-A0B5032198E4} => could not remove key. ErrorCode1: 0x00000002

HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\{115AC980-255F-4854-84D9-A0B5032198E4} => could not remove key. ErrorCode1: 0x00000002

HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tree\Microsoft\Windows\UNP\RunCampaignManager => could not remove key. ErrorCode1: 0x00000001

========================= Folder: C:\inetpub ========================

2018-01-23 20:47 - 2018-01-24 11:00 - 000000000 ____D [D41D8CD98F00B204E9800998ECF8427E] () C:\inetpub\history

2017-09-23 04:25 - 2017-09-23 04:25 - 000000000 ____D [D41D8CD98F00B204E9800998ECF8427E] () C:\inetpub\history\CFGHISTORY_0000000001

2017-09-23 04:25 - 2017-09-23 08:03 - 000018765 ____A [2A0C77B6013FFA3F6A8468A022CD6E8A] () C:\inetpub\history\CFGHISTORY_0000000001\administration.config

2017-09-23 04:25 - 2017-09-23 08:03 - 000010066 ____A [DFE400147422A814E3375C61C50AA60D] () C:\inetpub\history\CFGHISTORY_0000000001\applicationHost.config

2017-09-23 04:29 - 2017-09-23 04:29 - 000000000 ____D [D41D8CD98F00B204E9800998ECF8427E] () C:\inetpub\history\CFGHISTORY_0000000002

2017-09-23 04:29 - 2017-09-23 08:03 - 000018765 ____A [2A0C77B6013FFA3F6A8468A022CD6E8A] () C:\inetpub\history\CFGHISTORY_0000000002\administration.config

2017-09-23 04:29 - 2017-09-23 04:28 - 000012578 ____A [559EA0E642359DA4543FBB9E75B34027] () C:\inetpub\history\CFGHISTORY_0000000002\applicationHost.config

2017-09-23 04:33 - 2017-09-23 04:33 - 000000000 ____D [D41D8CD98F00B204E9800998ECF8427E] () C:\inetpub\history\CFGHISTORY_0000000003

2017-09-23 04:33 - 2017-09-23 08:03 - 000018765 ____A [2A0C77B6013FFA3F6A8468A022CD6E8A] () C:\inetpub\history\CFGHISTORY_0000000003\administration.config

2017-09-23 04:33 - 2017-09-23 04:31 - 000012636 ____A [4EF158325B6915AF99BBF19D5C09B3B3] () C:\inetpub\history\CFGHISTORY_0000000003\applicationHost.config

2018-01-24 10:56 - 2018-01-24 10:56 - 000000000 ____D [D41D8CD98F00B204E9800998ECF8427E] () C:\inetpub\history\CFGHISTORY_0000000004

2018-01-24 10:56 - 2018-01-23 20:47 - 000018765 ____A [2A0C77B6013FFA3F6A8468A022CD6E8A] () C:\inetpub\history\CFGHISTORY_0000000004\administration.config

2018-01-24 10:56 - 2018-01-24 10:55 - 000012578 ____A [87DD43EE02E4DB868879B70436DC442A] () C:\inetpub\history\CFGHISTORY_0000000004\applicationHost.config

2018-01-24 11:00 - 2018-01-24 11:00 - 000000000 ____D [D41D8CD98F00B204E9800998ECF8427E] () C:\inetpub\history\CFGHISTORY_0000000005

2018-01-24 11:00 - 2018-01-23 20:47 - 000018765 ____A [2A0C77B6013FFA3F6A8468A022CD6E8A] () C:\inetpub\history\CFGHISTORY_0000000005\administration.config

2018-01-24 11:00 - 2018-01-24 10:59 - 000012636 ____A [4EF158325B6915AF99BBF19D5C09B3B3] () C:\inetpub\history\CFGHISTORY_0000000005\applicationHost.config

2018-01-23 20:47 - 2018-01-23 20:47 - 000000000 ____D [D41D8CD98F00B204E9800998ECF8427E] () C:\inetpub\temp

2018-01-23 20:47 - 2018-01-23 20:47 - 000000000 ____D [D41D8CD98F00B204E9800998ECF8427E] () C:\inetpub\temp\appPools

====== End of Folder: ======

========================= Folder: C:\WINDOWS\system32\��8 ========================

not found.

====== End of Folder: ======

========================= Folder: C:\WINDOWS\system32\6f01f6654283d891ba8957..bin ========================

2017-05-14 19:04 - 2017-05-14 19:04 - 000000000 ____D [D41D8CD98F00B204E9800998ECF8427E] () C:\WINDOWS\system32\6f01f6654283d891ba8957..bin\AMD

2017-05-14 19:04 - 2017-05-14 19:04 - 000000000 ____D [D41D8CD98F00B204E9800998ECF8427E] () C:\WINDOWS\system32\6f01f6654283d891ba8957..bin\AMD\DxCache

====== End of Folder: ======

========================= Folder: C:\WINDOWS\system32\m32 ========================

2017-05-11 22:32 - 2017-05-11 22:32 - 000000000 ____D [D41D8CD98F00B204E9800998ECF8427E] () C:\WINDOWS\system32\m32\DriverStore

====== End of Folder: ======

========= ipconfig /flushDNS =========

Windows IP Configuration

Successfully flushed the DNS Resolver Cache.

========= End of CMD: =========

=========== EmptyTemp: ==========

BITS transfer queue => 7888896 B

DOMStore, IE Recovery, AppCache, Feeds Cache, Thumbcache, IconCache => 28710594 B

Java, Flash, Steam htmlcache => 610 B

Windows/system/drivers => 3568835 B

Edge => 1060190 B

Chrome => 671039757 B

Firefox => 55759697 B

Opera => 0 B

Temp, IE cache, history, cookies, recent:

Default => 6656 B

Users => 0 B

ProgramData => 0 B

Public => 0 B

systemprofile => 0 B

systemprofile32 => 0 B

LocalService => 13122 B

NetworkService => 0 B

defaultuser0 => 7168 B

mill1 => 26505278 B

RecycleBin => 4461588215 B

EmptyTemp: => 4.9 GB temporary data Removed.

================================

Result of scheduled files to move (Boot Mode: Normal) (Date&Time: 15-02-2018 17:15:00)

Result of scheduled keys to remove after reboot:

"HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Plain\{115AC980-255F-4854-84D9-A0B5032198E4}" => removed successfully

"HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\{115AC980-255F-4854-84D9-A0B5032198E4}" => removed successfully

HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tree\Microsoft\Windows\UNP\RunCampaignManager => key removed successfully

==== End of Fixlog 17:15:06 ====

Malwarebytes

www.malwarebytes.com

-Log Details-

Scan Date: 2/15/18

Scan Time: 5:19 PM

Log File: 459b6362-129e-11e8-9e92-3c528231493d.json

Administrator: Yes

-Software Information-

Version: 3.3.1.2183

Components Version: 1.0.262

Update Package Version: 1.0.3963

License: Trial

-System Information-

OS: Windows 10 (Build 16299.248)

CPU: x64

File System: NTFS

User: DESKTOP-2K81PH6\mill1

-Scan Summary-

Scan Type: Threat Scan

Result: Completed

Objects Scanned: 316324

Threats Detected: 0

(No malicious items detected)

Threats Quarantined: 0

(No malicious items detected)

Time Elapsed: 15 min, 9 sec

-Scan Options-

Memory: Enabled

Startup: Enabled

Filesystem: Enabled

Archives: Enabled

Rootkits: Enabled

Heuristics: Enabled

PUP: Detect

PUM: Detect

-Scan Details-

Process: 0

(No malicious items detected)

Module: 0

(No malicious items detected)

Registry Key: 0

(No malicious items detected)

Registry Value: 0

(No malicious items detected)

Registry Data: 0

(No malicious items detected)

Data Stream: 0

(No malicious items detected)

Folder: 0

(No malicious items detected)

File: 0

(No malicious items detected)

Physical Sector: 0

(No malicious items detected)

(end)

# AdwCleaner 7.0.8.0 - Logfile created on Thu Feb 15 22:42:24 2018

# Updated on 2018/08/02 by Malwarebytes

# Database: 02-15-2018.2

# Running on Windows 10 Home (X64)

# Mode: scan

# Support: https://www.malwarebytes.com/support

***** [ Services ] *****

No malicious services found.

***** [ Folders ] *****

No malicious folders found.

***** [ Files ] *****

No malicious files found.

***** [ DLL ] *****

No malicious DLLs found.

***** [ WMI ] *****

No malicious WMI found.

***** [ Shortcuts ] *****

No malicious shortcuts found.

***** [ Tasks ] *****

No malicious tasks found.

***** [ Registry ] *****

No malicious registry entries found.

***** [ Firefox (and derivatives) ] *****

No malicious Firefox entries.

***** [ Chromium (and derivatives) ] *****

No malicious Chromium entries.

*************************

########## EOF - C:\AdwCleaner\AdwCleaner[S0].txt ##########

#5 Android 8888

SWI Malware Tracker

Trusted Advisor*
1,100 posts

Posted 16 February 2018 - 01:29 PM

Hello floridalou.

I hope all is well in your life.

Yes I'm fine, thank you. I wish you the same.

I'm glad your issue is solved. The logs are clean. Excellent! :thumbup:

Now I suggest you run one last scan to search for leftovers in your system. This is a very thorough scan but it's worth it.

Please scan your computer with ESET Online Scanner.

Click on this link to open ESET Online Scanner in a new window.
- Click on the Scan Now button to download the esetonlinescanner_enu.exe file and save it to your computer Desktop.
- Close all your programs and browsers and disconnect any USB flash drives from the computer.
- Please disable your antivirus program to avoid potential conflicts, improve the performance and speed up the scan.
- Right-click on esetonlinescanner_enu.exe and select Run as administrator.
- Click Yes to accept the User Account Control security warning that may appear. It will open a window with the Terms of Use.

Click the Accept button.
Under Computer scan settings, check mark Enable detection of potentially unwanted applications.
Then click Advanced settings and check mark the following options:
- Enable detection of potentially unsafe applications
- Clean threats automatically
Click the Scan button.
ESET will then download updates for itself, install itself, and begin scanning your computer. Please be patient as this can take some time.
When the scan completes, click List Threats.
Click Export, and save the file to your Desktop using a unique name, such as ESETScan. Include the contents of this report in your next reply.
Click the Back button.
Click the Finish button.

Note: If nothing is found, it will not produce a log.

Please re-enable your antivirus program.

Please post the content of the ESET log (if it produced one).

Android 8888

Edited by Android 8888, 16 February 2018 - 01:33 PM.

#6 floridalou

Member

Full Member
40 posts

Posted 17 February 2018 - 01:13 AM

I ran the online scan program here is the report.

There were two infected items.

Thanks again.

Florida Lou

C:\Users\mill1\AppData\Local\Kingsoft\WPS Office\10.2.0.5978\wtoolex\wpsupdate.exe a variant of Win32/KingSoft.D potentially unwanted application cleaned by deleting

C:\Users\mill1\AppData\Local\Kingsoft\WPS Office\10.2.0.5996\wtoolex\wpsupdate.exe a variant of Win32/KingSoft.D potentially unwanted application cleaned by deleting

#7 Android 8888

SWI Malware Tracker

Trusted Advisor*
1,100 posts

Posted 17 February 2018 - 03:55 AM

Hello.

Good news! Your computer appears to be clean and malware free.

Now it's time to check for updates. Outdated programs contains security vulnerabilities that are exploited by malware in order to infect the computer without the user's knowledge. Usually this is one of the ways that more contributes to the infection of your computer.

Your Google Chrome is outdated. See here on how to update it:
https://support.goog...esktop&hl=en-GB

Please update also Mozilla Firefox:
https://support.mozi...-latest-version

You can run a program like Personal Software Inspector (PSI) or FileHippo Update Checker or UCheck to see what programs still need to be updated. Use the one you better adapt.

If all updates went well you can now remove the tools we used in the malware removal by running DelFix. After running DelFix will be removed by itself.

Follow the instructions below to download and execute DelFix.

Download DelFix and move the executable to your Desktop;
Right-click on DelFix.exe and select Run as Administrator;
Check the following options :
- Remove disinfection tools (this option will remove the tools used in the cleaning process).
- Create registry backup (this option will create a backup from the Windows Registry).
- Purge system restore (this option will remove all previous and possibly infected restore points, and will create a new and clean restore point of your system).
- Reset system settings (this option will reset any system settings back to default that were changed either by us during cleansing or by malware infection).
Once the options mentioned above are checked, click on Run;
After DelFix is done running, a log will open. I don't need to see the log file, just close it and delete it. The log can be found in C:\DelFix.txt

Are there any issues you may want to address about the computer or that is all?

Edited by Android 8888, 17 February 2018 - 03:56 AM.

#8 floridalou

Member

Full Member
40 posts

Posted 18 February 2018 - 01:35 AM

Hello,

I did as you suggested and my computer works great!

How do I make a donation to this forum?

Thanks again

Florida Lou

#9 Android 8888

SWI Malware Tracker

Trusted Advisor*
1,100 posts

Posted 18 February 2018 - 06:41 AM

Hello floridalou,

You're welcome.

I did as you suggested and my computer works great!

Excellent! I'm glad to hear that. :good:

How do I make a donation to this forum?

If you wish to do so you can make it by clicking the yellow "Donate" button at the bottom of this page.

To help keep malware off your system below I have included a number of recommendations for how to protect your computer in order to prevent future malware infections. Please consider using these ideas to help secure your computer.

Keep your Windows Operating System up-to-date.

Keep your Antivirus program up-to-date.

Please note: Many installer offer third-party downloads that are installed automatically when you do not uncheck certain checkboxes. While most of the time not being malicious you usually do not want these on your computer. Be careful during the installation process and you will avoid seeing tons of new unwanted toolbars in your favorite web browser.

Please consider installing and running some of the following programs; they are either free or have free versions of commercial programs:
Keep Malwarebytes Anti-Malware (MBAM) update and perform a regular scan to your system as it will make it harder for malware to reside on your computer.
A tutorial on using MBAM can be found here and a complete guide here

Please Note: Only the paid for version has real time capabilities. Please go here and scroll down to find a comparison list of the two versions.

A free non-resident utility to prevent the installation of ActiveX-based malware is JavaCool's SpywareBlaster, available here

Please keep these programs up-to-date and run them whenever you suspect a problem to prevent malware problems. A number of programs have resident protection and it is a good idea to run the resident protection of one of each type of program to maintain protection. However, it is important to run only one resident program of each type since they can conflict and become less effective. That means only one antivirus, firewall and scanning anti-spyware program at a time. Passive protectors, like SpywareBlaster can be run with any of them.

Note that there are a lot of rogue programs out there that want to scare you into giving them your money and some malware actually claims to be security programs. If you get a popup for a security program that you did not install yourself, do NOT click on it and ask for help immediately. It is very important to run an antivirus and firewall, but you can't always rely on reviews and ads for information. Ask in a security forum that you trust if you are not sure.

A similar category of programs is now called "scareware." Scareware programs are active infections that will pop-up on your computer and tell you that you are infected. If you look closely, it will usually have a name that looks like it might be legitimate, but it is NOT one of the programs you installed. It tells you to click and install it right away. If you click on any part of it, including the 'X' to close it, you may actually help it infect your computer further. Keeping protection updated and running resident protection can help prevent these infections. If it happens anyway, get offline as quickly as you can. Pull the internet connection cable or shut down the computer if you have to. Contact someone to help by using another computer if possible. These programs are also sometimes called 'rogues', but they are different than the older version of rogues mentioned above.

Another most feared threat at the moment is an infection by a Ransomware. A Ransomware infection is a program that ransoms the data or functionality of your computer until you perform an action. This action is typically to pay a ransom in the form of Bitcoins or another payment method. I advise you to read more info on this terrible threat here and here.

Please keep your programs up to date. This applies to your programs and all your Internet Browsers in particular. Vulnerabilities in these programs are often exploited in order to install malware on your PC.

Be careful with flash drives, as they can spread infections. See this post on USB/flash drive safety.

Stay away from P2P software; even with a clean P2P program, their networks are often riddled with malware.

Don't click on attachments or links in e-mail, and read your e-mail in text-only mode for the highest safety.

Don't click on links received in instant message programs.

A HOSTS file will prevent Internet Explorer from communicating with sites known to be associated with adware or spyware. A good regularly updated HOST file is MVPS HOSTS File, available here

For much more useful and complete information, please read the following links to fully understand PC Security and Best Practices:
How did I get infected in the first place
Answers to common security questions - Best Practices

Hopefully these steps will help to keep you error and malware free. If you run into more difficulty, we will certainly do what we can to help.

Happy surfing and stay safe. :thumbup:

Android 8888

#10 floridalou

Member

Full Member
40 posts

Posted 19 February 2018 - 10:15 AM

Help!!!

It did it again, the "ghost" turned off the computer and it rebooted (very slowly).

Please advise

Florida Lou

#11 Android 8888

SWI Malware Tracker

Trusted Advisor*
1,100 posts

Posted 19 February 2018 - 12:48 PM

Hello floridalou.

Please do the following:

Download RogueKiller_portable64.exe by Tigzy and save it to your computer Desktop.

Now close all programs and Internet browsers and disconnect any USB or external drives from the computer before you run this scan!
Right-click on the file RogueKiller_portable64.exeand select Run as administrator to start the tool.
Click Yes to accept the User Account Control security warning that may appear.
Once the tool is open, click the 'Scan' tab menu and the click the Start Scan button.
Wait until the scan has finished. Note: This scan may take some time to complete;
Warning: Do NOT remove any entry it found. They are not all bad and need to be carefully analyzed.
Once finished the results will be displayed. Click on the Open Report button. It will open a new window.
Click Export TXT to export the report as a text file, give a name to the file such as RKlog.txt and save it to your computer Desktop.
Close RogueKiller.

Please copy and paste the contents of RKlog.txt to your next reply for my review.

Android 8888

#12 floridalou

Member

Full Member
40 posts

Posted 19 February 2018 - 04:30 PM

Hello,

Thank you again for your help.

Here is the log, I have deleted NONE of these files.

Florida Lou

RogueKiller V12.12.5.0 (x64) [Feb 19 2018] (Free) by Adlice Software

mail : http://www.adlice.com/contact/

Feedback : https://forum.adlice.com

Website : http://www.adlice.co...ad/roguekiller/

Blog : http://www.adlice.com

Operating System : Windows 10 (10.0.16299) 64 bits version

Started in : Normal mode

User : mill1 [Administrator]

Started from : C:\Users\mill1\Desktop\RogueKiller_portable64.exe

Mode : Scan -- Date : 02/19/2018 16:14:34 (Duration : 01:11:17)

¤¤¤ Processes : 1 ¤¤¤

[VT.Unknown] GWREMIND.EXE(9280) -- C:\Program Files (x86)\Greetings Workshop\GWREMIND.EXE[-] -> Found

¤¤¤ Registry : 16 ¤¤¤

[PUM.HomePage] (X64) HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\Main | Start Page : http://hp17win10.msn.com/?pc=HCTE -> Found

[PUM.HomePage] (X64) HKEY_USERS\.DEFAULT\Software\Microsoft\Internet Explorer\Main | Start Page : http://hp17win10.msn.com/?pc=HCTE -> Found

[PUM.HomePage] (X86) HKEY_USERS\.DEFAULT\Software\Microsoft\Internet Explorer\Main | Start Page : http://hp17win10.msn.com/?pc=HCTE -> Found

[PUM.HomePage] (X64) HKEY_USERS\S-1-5-21-2306285249-3646823635-4279856882-1001\Software\Microsoft\Internet Explorer\Main | Start Page : http://hp17win10.msn.com/?pc=HCTE -> Found

[PUM.HomePage] (X86) HKEY_USERS\S-1-5-21-2306285249-3646823635-4279856882-1001\Software\Microsoft\Internet Explorer\Main | Start Page : http://hp17win10.msn.com/?pc=HCTE -> Found

[PUM.HomePage] (X64) HKEY_USERS\S-1-5-18\Software\Microsoft\Internet Explorer\Main | Start Page : http://hp17win10.msn.com/?pc=HCTE -> Found

[PUM.HomePage] (X86) HKEY_USERS\S-1-5-18\Software\Microsoft\Internet Explorer\Main | Start Page : http://hp17win10.msn.com/?pc=HCTE -> Found

[PUM.HomePage] (X64) HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\Main | Default_Page_URL : http://hp17win10.msn.com/?pc=HCTE -> Found

[PUM.HomePage] (X64) HKEY_USERS\.DEFAULT\Software\Microsoft\Internet Explorer\Main | Default_Page_URL : http://hp17win10.msn.com/?pc=HCTE -> Found

[PUM.HomePage] (X86) HKEY_USERS\.DEFAULT\Software\Microsoft\Internet Explorer\Main | Default_Page_URL : http://hp17win10.msn.com/?pc=HCTE -> Found

[PUM.HomePage] (X64) HKEY_USERS\S-1-5-21-2306285249-3646823635-4279856882-1001\Software\Microsoft\Internet Explorer\Main | Default_Page_URL : http://hp17win10.msn.com/?pc=HCTE -> Found

[PUM.HomePage] (X86) HKEY_USERS\S-1-5-21-2306285249-3646823635-4279856882-1001\Software\Microsoft\Internet Explorer\Main | Default_Page_URL : http://hp17win10.msn.com/?pc=HCTE -> Found

[PUM.HomePage] (X64) HKEY_USERS\S-1-5-18\Software\Microsoft\Internet Explorer\Main | Default_Page_URL : http://hp17win10.msn.com/?pc=HCTE -> Found

[PUM.HomePage] (X86) HKEY_USERS\S-1-5-18\Software\Microsoft\Internet Explorer\Main | Default_Page_URL : http://hp17win10.msn.com/?pc=HCTE -> Found

[Suspicious.Path] (X64) HKEY_LOCAL_MACHINE\System\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\FirewallRules | {3608F51C-9A26-439C-A0C6-36BFCC86C0BA} : v2.26|Action=Allow|Active=TRUE|Dir=In|Protocol=6|Profile=Public|App=C:\Users\mill1\AppData\Local\Temp\7zS6F9A\HPDiagnosticCoreUI.exe|Name=HPSAPS| [x] -> Found

[Suspicious.Path] (X64) HKEY_LOCAL_MACHINE\System\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\FirewallRules | {F97A73CA-21DB-4335-B028-A9149A2D8EC8} : v2.26|Action=Allow|Active=TRUE|Dir=In|Protocol=17|Profile=Public|App=C:\Users\mill1\AppData\Local\Temp\7zS6F9A\HPDiagnosticCoreUI.exe|Name=HPSAPS| [x] -> Found

¤¤¤ Tasks : 0 ¤¤¤

¤¤¤ Files : 0 ¤¤¤

¤¤¤ WMI : 0 ¤¤¤

¤¤¤ Hosts File : 0 ¤¤¤

¤¤¤ Antirootkit : 0 (Driver: Loaded) ¤¤¤

¤¤¤ Web browsers : 1 ¤¤¤

[PUP.Gen0][Chrome:Addon] Default : Honey [bmnlcjabgnpnenekpadlanbbkooimhnj] -> Found

¤¤¤ MBR Check : ¤¤¤

+++++ PhysicalDrive0: TOSHIBA DT01ACA100 +++++

--- User ---

[MBR] 3a8e0307f5c0dd464423c588f45c4356

[BSP] 8aa1f5ee7691463520b387b031a066b7 : Empty MBR Code

Partition table:

0 - [MAN-MOUNT] EFI system partition | Offset (sectors): 2048 | Size: 260 MB

1 - [MAN-MOUNT] Microsoft reserved partition | Offset (sectors): 534528 | Size: 16 MB

2 - Basic data partition | Offset (sectors): 567296 | Size: 941703 MB

3 - [SYSTEM][MAN-MOUNT] Basic data partition | Offset (sectors): 1929175040 | Size: 980 MB

4 - [SYSTEM] Basic data partition | Offset (sectors): 1931182080 | Size: 10904 MB

User = LL1 ... OK

User = LL2 ... OK

#13 Android 8888

SWI Malware Tracker

Trusted Advisor*
1,100 posts

Posted 20 February 2018 - 03:58 PM

Hello

Please re-run RogueKiller, check mark the entry below and leave all the other entries unchecked.

¤¤¤ Web browsers : 1 ¤¤¤
[PUP.Gen0][Chrome:Addon] Default : Honey [bmnlcjabgnpnenekpadlanbbkooimhnj] -> Found

Then click on the Remove Selected button and restart the computer.

Next, I would like you execute some repairs on the Operating System. I suggest printing out each set of instructions and reading the entire post before proceeding. It will make following them easier.

The following repairs can take some time consuming so please be patient. Please execute all the steps in the order listed.

Download the portable version of Windows Repair from here.

Move the compressed file tweaking.com_windows_repair_aio on your computer Desktop, and extract it there;
Boot in Safe Mode with Networking; Instructions on how to do it here: Safe Mode with Networking;
Go in the tweaking.com_windows_repair_aio folder, then Tweaking.com - Windows Repair folder, right-click on Repair_Windows.exe and select Run as Administrator;
Click Yes to accept the User Account Control security warning that may appear;
Wait a few seconds and click the I Agree button to accept the End User License Agreement;

Next, select the Step 2: (Optional) tab menu;

Click on the icon Open Repair Reparse Points;

Click on 1. Scan Reparse Points button;

Click on 2. Repair Selected button;

Close the current window;

Now, click the icon Open Repair Environment Variable;

1) Click the button 2. Apply New Paths;
2) Click the button 4. Apply New Paths;
3) Click the button 6. Apply New PathsExt;
4) Click the button 7. Apply Variables;

Close the current window;

Next, select the Step 3: (Important) tab menu;
Click on Open Check Disk At Next Boot button;

It will open a new window (see below);
1) Checkmark the second radio button (/R)...
2) Press the Add To Next Boot button;

Close the Check Disk (chkdsk) At Next Boot window;

Restart the computer to begin the Disk Check repair.
Then restart the computer again in Safe Mode with Networking;

Next, select the Step 4: (Optional) tab menu;
Click the Check button to start the scan and repair the System Files;

]

Next,
Select the + Repairs - Main tab menu;
Click the Preset: All Repairs button (it will open a new window with the repairs already preselected for this option);
Click the Start Repairs button and wait until the repairs are complete;
If you are being prompted with a Security Warning, allow it to go through;
Once the repairs are complete, it'll ask you to restart your computer, please do it.

Please let me know how is the computer behaving at this point. Test it for one day or two and let me know if the problem persists.

Android 8888

#14 floridalou

Member

Full Member
40 posts

Posted 07 April 2018 - 04:49 PM

Hello,

Sorry for my delay in responding, I wanted to give the computer the old college try!

It is still misbehaving and turning off as if by a "ghost".

What I have taken to doing is booting up the computer

then restarting it (this takes much longer than the initial booting up)

and THEN the computer is alright.

Please advise and Thank you.

#15 Android 8888

SWI Malware Tracker

Trusted Advisor*
1,100 posts

Posted 10 April 2018 - 02:43 PM

Hello floridalou.

Generally, when a computer powers down on its own suddenly that can be due to several causes such like power supply malfunction, malware, overheating or driver issues.

We already checked for malware and I don't think that is the reason. Your computer appears to be clean.

Due to the symptom (it just turns off suddenly) that you described, overheating is indeed a possibility likely.

I would like you to check some of the main temperatures on your computer by running a fast and lightweight tool called Speccy.

Please download the free portable version of Speccy from here and move it to the computer Desktop.
Right-click the ZIP file (spsetup131) and select Extract to spsetup131\
Open up the extracted folder, right-click on Speccy64 and select Run as administrator.
Click Yes to accept the User Account Control security warning that may appear.
Now once inside Speccy, in the menu bar at the top left, click File > Publish Snapshot
Click Yes and then Copy to Clipboard
In your next reply please right-click mouse in the reply box and select paste to post the link to the snapshot for my review.