14 replies to this topic

[Carlgrus]

Here we go again, please see if you can find anything that can help me.  Thank you in advance.

 

Malwarebytes

www.malwarebytes.com

 

-Log Details-

Scan Date: 6/21/20

Scan Time: 5:15 PM

Log File: 6741bf02-b404-11ea-81bd-f8bc129d5fc8.json

 

-Software Information-

Version: 4.1.0.56

Components Version: 1.0.931

Update Package Version: 1.0.25827

License: Premium

 

-System Information-

OS: Windows 10 (Build 18362.900)

CPU: x64

File System: NTFS

User: CARLSHOMEOFFICE\Carl's Home office

 

-Scan Summary-

Scan Type: Threat Scan

Scan Initiated By: Manual

Result: Completed

Objects Scanned: 320547

Threats Detected: 0

Threats Quarantined: 0

Time Elapsed: 19 min, 3 sec

 

-Scan Options-

Memory: Enabled

Startup: Enabled

Filesystem: Enabled

Archives: Enabled

Rootkits: Disabled

Heuristics: Enabled

PUP: Detect

PUM: Detect

 

-Scan Details-

Process: 0

(No malicious items detected)

 

Module: 0

(No malicious items detected)

 

Registry Key: 0

(No malicious items detected)

 

Registry Value: 0

(No malicious items detected)

 

Registry Data: 0

(No malicious items detected)

 

Data Stream: 0

(No malicious items detected)

 

Folder: 0

(No malicious items detected)

 

File: 0

(No malicious items detected)

 

Physical Sector: 0

(No malicious items detected)

 

WMI: 0

(No malicious items detected)

 

 

(end)

 

Here's Farbar:

 

Scan result of Farbar Recovery Scan Tool (FRST) (x64) Version: 21-06-2020
Ran by Carl's Home office (administrator) on CARLSHOMEOFFICE (Dell Inc. Inspiron 3847) (21-06-2020 19:51:59)
Running from C:\Users\Carl's Home office\Downloads
Loaded Profiles: Carl's Home office
Platform: Windows 10 Pro Version 1909 18363.900 (X64) Language: English (United States)
Default browser: FF
Boot Mode: Normal
Tutorial for Farbar Recovery Scan Tool: http://www.geekstogo...very-scan-tool/

==================== Processes (Whitelisted) =================

(If an entry is included in the fixlist, the process will be closed. The file will not be moved.)

() [File not signed] C:\Program Files (x86)\ACT\Act.Web.API\bin\act.web.api.hosting.exe
(Apple Inc. -> Apple Inc.) C:\Program Files\Bonjour\mDNSResponder.exe
(Apple Inc. -> Apple Inc.) C:\Program Files\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe
(Apple Inc. -> Apple Inc.) C:\Program Files\iPod\bin\iPodService.exe
(Apple Inc. -> Apple Inc.) C:\Program Files\iTunes\iTunesHelper.exe
(Dashlane USA, Inc. -> Dashlane, Inc.) C:\Users\Carl's Home office\AppData\Roaming\Dashlane\Dashlane.exe
(Dashlane USA, Inc. -> Dashlane, Inc.) C:\Users\Carl's Home office\AppData\Roaming\Dashlane\DashlanePlugin.exe
(Dropbox, Inc -> Dropbox, Inc.) C:\Program Files (x86)\Dropbox\Client\Dropbox.exe <3>
(Dropbox, Inc -> Dropbox, Inc.) C:\Program Files (x86)\Dropbox\Update\DropboxUpdate.exe
(Dropbox, Inc -> Dropbox, Inc.) C:\WINDOWS\System32\DbxSvc.exe
(Dropbox, Inc -> The Qt Company Ltd.) C:\Program Files (x86)\Dropbox\Client\99.4.501\QtWebEngineProcess.exe <2>
(Google LLC -> Google LLC) C:\Program Files (x86)\Google\Update\1.3.35.452\GoogleCrashHandler.exe
(Google LLC -> Google LLC) C:\Program Files (x86)\Google\Update\1.3.35.452\GoogleCrashHandler64.exe
(Intel® pGFX -> ) C:\WINDOWS\System32\igfxTray.exe
(Intel® pGFX -> Intel Corporation) C:\WINDOWS\System32\igfxCUIService.exe
(Intel® pGFX -> Intel Corporation) C:\WINDOWS\System32\igfxEM.exe
(Intel® pGFX -> Intel Corporation) C:\WINDOWS\System32\igfxHK.exe
(Keystroke Quality Computing Inc -> ) C:\Program Files (x86)\Keystroke\HHC Enterprise Edition\HHCService.exe
(Keystroke Quality Computing Inc -> ) C:\Program Files (x86)\Keystroke\HHC Enterprise Edition\HHCServiceMonitor.exe
(Logitech Inc -> Logitech) C:\Program Files\Logitech\LogiCapture\bin\Service\LogiFacecamService.exe
(Malwarebytes Inc -> Malwarebytes) C:\Program Files\Malwarebytes\Anti-Malware\MBAMService.exe
(Malwarebytes Inc -> Malwarebytes) C:\Program Files\Malwarebytes\Anti-Malware\mbamtray.exe
(Microsoft Corporation -> Microsoft Corporation) C:\Program Files (x86)\Microsoft SQL Server\90\Shared\sqlbrowser.exe
(Microsoft Corporation -> Microsoft Corporation) C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeClickToRun.exe
(Microsoft Corporation -> Microsoft Corporation) C:\Program Files\Microsoft Office\root\Office16\WINWORD.EXE
(Microsoft Corporation -> Microsoft Corporation) C:\Program Files\Microsoft SQL Server\90\Shared\sqlwriter.exe
(Microsoft Corporation -> Microsoft Corporation) C:\Program Files\Microsoft SQL Server\MSSQL12.ACT7\MSSQL\Binn\sqlservr.exe
(Microsoft Corporation -> Microsoft Corporation) C:\Users\Carl's Home office\AppData\Local\Microsoft\OneDrive\20.064.0329.0008\FileCoAuth.exe
(Microsoft Corporation -> Microsoft Corporation) C:\Users\Carl's Home office\AppData\Local\Microsoft\OneDrive\OneDrive.exe
(Microsoft Corporation -> Microsoft Corporation) C:\WINDOWS\Microsoft.NET\Framework64\v3.0\WPF\PresentationFontCache.exe
(Microsoft Corporation -> Microsoft Corporation) C:\WINDOWS\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdge.exe
(Microsoft Windows -> Microsoft Corporation) C:\WINDOWS\ImmersiveControlPanel\SystemSettings.exe
(Microsoft Windows -> Microsoft Corporation) C:\WINDOWS\System32\browser_broker.exe
(Microsoft Windows -> Microsoft Corporation) C:\WINDOWS\System32\dllhost.exe <3>
(Microsoft Windows -> Microsoft Corporation) C:\WINDOWS\System32\MicrosoftEdgeCP.exe
(Microsoft Windows -> Microsoft Corporation) C:\WINDOWS\System32\MicrosoftEdgeSH.exe
(Microsoft Windows -> Microsoft Corporation) C:\WINDOWS\System32\smartscreen.exe
(Microsoft Windows -> Microsoft Corporation) C:\WINDOWS\SysWOW64\notepad.exe
(Microsoft Windows -> Microsoft Corporation) C:\WINDOWS\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.18362.892_none_5efe5b5a590f76dc\TiWorker.exe
(Microsoft Windows Publisher -> Microsoft Corporation) C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.2005.5-0\MsMpEng.exe
(Microsoft Windows Publisher -> Microsoft Corporation) C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.2005.5-0\NisSrv.exe
(Microsoft) [File not signed] C:\Program Files (x86)\ACT\Act for Windows\Act.Server.Host.exe
(Mozilla Corporation -> Mozilla Corporation) C:\Program Files\Mozilla Firefox\firefox.exe <6>
(Realtek Semiconductor Corp -> Realtek Semiconductor) C:\Program Files\Realtek\Audio\HDA\RAVBg64.exe <2>
(Realtek Semiconductor Corp -> Realtek Semiconductor) C:\Program Files\Realtek\Audio\HDA\RtkAudioService64.exe
(Realtek Semiconductor Corp -> Realtek Semiconductor) C:\Program Files\Realtek\Audio\HDA\RtkNGUI64.exe
(Swiftpage ACT! LLC -> Swiftpage ACT! LLC) C:\Program Files (x86)\ACT\Act for Windows\Act!.exe

==================== Registry (Whitelisted) ===================

(If an entry is included in the fixlist, the registry item will be restored to default or removed. The file will not be moved.)

HKLM\...\Run: [RTHDVCPL] => C:\Program Files\Realtek\Audio\HDA\RtkNGUI64.exe [8849152 2016-04-07] (Realtek Semiconductor Corp -> Realtek Semiconductor)
HKLM\...\Run: [RtHDVBg] => C:\Program Files\Realtek\Audio\HDA\RAVBg64.exe [1419008 2016-04-07] (Realtek Semiconductor Corp -> Realtek Semiconductor)
HKLM\...\Run: [WinZip UN] => C:\Program Files\WinZip\WZUpdateNotifier.exe [2814096 2020-02-20] (Corel Corporation -> Corel Corporation)
HKLM\...\Run: [WinZip FAH] => C:\Program Files\WinZip\FAHConsole.exe [436704 2020-02-20] (Corel Corporation -> WinZip Computing, S.L.)
HKLM\...\Run: [iTunesHelper] => C:\Program Files\iTunes\iTunesHelper.exe [302392 2020-05-20] (Apple Inc. -> Apple Inc.)
HKLM-x32\...\Run: [Dropbox] => C:\Program Files (x86)\Dropbox\Client\Dropbox.exe [7916032 2020-06-09] (Dropbox, Inc -> Dropbox, Inc.)
HKLM-x32\...\Run: [LWS] => C:\Program Files (x86)\Logitech\LWS\Webcam Software\LWS.exe [204136 2012-09-13] (Logitech, Inc. -> Logitech Inc.)
HKLM-x32\...\Run: [Act! Preloader] => C:\Program Files (x86)\ACT\Act for Windows\Act!.exe [272336 2019-10-23] (Swiftpage ACT! LLC -> Swiftpage ACT! LLC)
HKLM-x32\...\Run: [ISPA] => C:\Program Files (x86)\ACT\Act for Windows\Integration Services Patch for Act!\ISPA.exe [15704064 2020-02-26] () [File not signed]
HKU\S-1-5-21-4082023381-4228950685-2120871074-1000\...\Run: [CCleaner Smart Cleaning] => C:\Program Files\CCleaner\CCleaner64.exe [29072568 2020-05-22] (Piriform Software Ltd -> Piriform Software Ltd)
HKU\S-1-5-21-4082023381-4228950685-2120871074-1000\...\Run: [Dashlane] => C:\Users\Carl's Home office\AppData\Roaming\Dashlane\Dashlane.exe [321536 2020-06-08] (Dashlane USA, Inc. -> Dashlane, Inc.)
HKU\S-1-5-21-4082023381-4228950685-2120871074-1000\...\Run: [DashlanePlugin] => C:\Users\Carl's Home office\AppData\Roaming\Dashlane\DashlanePlugin.exe [342528 2020-06-08] (Dashlane USA, Inc. -> Dashlane, Inc.)
HKLM\Software\Microsoft\Active Setup\Installed Components: [{8A69D345-D564-463c-AFF1-A69D9E530F96}] -> C:\Program Files (x86)\Google\Chrome\Application\83.0.4103.106\Installer\chrmstp.exe [2020-06-16] (Google LLC -> Google LLC)
Startup: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\Act! Integration.lnk [2020-06-20]
ShortcutTarget: Act! Integration.lnk -> C:\Program Files (x86)\ACT\Act for Windows\Act!.Integration.exe (Swiftpage ACT! LLC) [File not signed]
Startup: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\WinZip Preloader.lnk [2020-06-05]
ShortcutTarget: WinZip Preloader.lnk -> C:\Program Files\WinZip\WzPreloader.exe (Corel Corporation -> WinZip Computing)
Startup: C:\Users\Carl's Home office\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Logitech . Product Registration.lnk [2020-06-11]
ShortcutTarget: Logitech . Product Registration.lnk -> C:\Program Files (x86)\Logitech\Ereg\eReg.exe (Logitech -> Leader Technologies/Logitech)

==================== Scheduled Tasks (Whitelisted) ============

(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)

Task: {0B68A9F7-2831-4A5B-A8E0-40502CA3DB91} - System32\Tasks\GoogleUpdateTaskUserS-1-5-21-4082023381-4228950685-2120871074-1000UA => C:\Users\Carl's Home office\AppData\Local\Google\Update\GoogleUpdate.exe
Task: {0CCCBEDD-C3E4-4A93-A425-C96EFCD13344} - System32\Tasks\WinZip Update Notifier 1 => C:\Program Files\WinZip\WZUpdateNotifier.exe [2814096 2020-02-20] (Corel Corporation -> Corel Corporation)
Task: {1569F9C8-1FB3-444A-BBF0-2324889F209F} - System32\Tasks\Microsoft\Office\Office ClickToRun Service Monitor => C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeC2RClient.exe [23756168 2020-06-05] (Microsoft Corporation -> Microsoft Corporation)
Task: {1720D36B-4076-4FCF-A815-FF28940DDCC2} - System32\Tasks\WinZip Update Notifier 3 => C:\Program Files\WinZip\WZUpdateNotifier.exe [2814096 2020-02-20] (Corel Corporation -> Corel Corporation)
Task: {1D7DC455-EB4F-4E04-87BC-F57D82E78BBB} - System32\Tasks\Microsoft\Windows\Windows Defender\Windows Defender Scheduled Scan => C:\ProgramData\Microsoft\Windows Defender\platform\4.18.2005.5-0\MpCmdRun.exe [491104 2020-06-05] (Microsoft Windows Publisher -> Microsoft Corporation)
Task: {36805283-31CB-4AE8-84C3-83983FFBB281} - System32\Tasks\CCleaner Update => C:\Program Files\CCleaner\CCUpdate.exe [686384 2020-05-22] (Piriform Software Ltd -> Piriform Software Ltd)
Task: {3A2084CC-E167-41DA-8E51-D25632923700} - System32\Tasks\Microsoft\Office\Office Feature Updates Logon => C:\Program Files\Microsoft Office\root\Office16\sdxhelper.exe [171368 2020-06-19] (Microsoft Corporation -> Microsoft Corporation)
Task: {3AE0F4CA-1E00-4A92-9850-A9AB3C6B9C40} - System32\Tasks\DropboxUpdateTaskMachineCore => C:\Program Files (x86)\Dropbox\Update\DropboxUpdate.exe [143144 2020-06-02] (Dropbox, Inc -> Dropbox, Inc.)
Task: {4F458200-2F2F-4149-8B7D-01C7BCC7AE88} - System32\Tasks\Microsoft\Windows\Windows Defender\Windows Defender Cleanup => C:\ProgramData\Microsoft\Windows Defender\platform\4.18.2005.5-0\MpCmdRun.exe [491104 2020-06-05] (Microsoft Windows Publisher -> Microsoft Corporation)
Task: {6FD3A5AD-F32F-4DE4-B533-C89200AB102E} - System32\Tasks\Microsoft\Windows\Windows Defender\Windows Defender Cache Maintenance => C:\ProgramData\Microsoft\Windows Defender\platform\4.18.2005.5-0\MpCmdRun.exe [491104 2020-06-05] (Microsoft Windows Publisher -> Microsoft Corporation)
Task: {708EE37D-31A0-4411-BCA2-FB27EC7764E8} - System32\Tasks\Microsoft\Office\Office Subscription Maintenance => C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonx64\Microsoft Shared\Office16\OLicenseHeartbeat.exe [1861528 2020-06-20] (Microsoft Corporation -> Microsoft Corporation)
Task: {7370F111-EDE7-47B1-B043-A29FBA3AF05C} - System32\Tasks\GoogleUpdateTaskUserS-1-5-21-4082023381-4228950685-2120871074-1000Core => C:\Users\Carl's Home office\AppData\Local\Google\Update\GoogleUpdate.exe
Task: {7B6DED89-374C-4F26-82B6-8792AFDA6EB0} - System32\Tasks\CCleanerSkipUAC => C:\Program Files\CCleaner\CCleaner.exe [24690360 2020-05-22] (Piriform Software Ltd -> Piriform Software Ltd)
Task: {94B7E61E-565A-4BDA-B751-2A319E6B0FA8} - System32\Tasks\GoogleUpdateTaskMachineCore => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe [156104 2020-06-03] (Google LLC -> Google LLC)
Task: {A4659558-F6A8-47BE-8148-26E721BF6A5D} - System32\Tasks\GoogleUpdateTaskMachineUA => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe [156104 2020-06-03] (Google LLC -> Google LLC)
Task: {B56DC43A-3630-4424-8C93-E4EB7F889577} - System32\Tasks\DropboxUpdateTaskMachineUA => C:\Program Files (x86)\Dropbox\Update\DropboxUpdate.exe [143144 2020-06-02] (Dropbox, Inc -> Dropbox, Inc.)
Task: {C18E6CB1-30C1-4A60-AE57-D4CC4E8450F0} - System32\Tasks\Microsoft\Office\Office Feature Updates => C:\Program Files\Microsoft Office\root\Office16\sdxhelper.exe [171368 2020-06-19] (Microsoft Corporation -> Microsoft Corporation)
Task: {C44A81E7-40E7-433E-A249-643AA7BF5576} - System32\Tasks\Microsoft\Windows\Windows Defender\Windows Defender Verification => C:\ProgramData\Microsoft\Windows Defender\platform\4.18.2005.5-0\MpCmdRun.exe [491104 2020-06-05] (Microsoft Windows Publisher -> Microsoft Corporation)
Task: {CD3D90D2-1CB4-4C2E-963E-B60258F382CD} - System32\Tasks\Apple\AppleSoftwareUpdate => C:\Program Files (x86)\Apple Software Update\SoftwareUpdate.exe [616832 2019-09-04] (Apple Inc. -> Apple Inc.)
Task: {DF019340-F50E-404C-84D2-DC013F4417BD} - System32\Tasks\Mozilla\Firefox Default Browser Agent 308046B0AF4A39CB => C:\Program Files\Mozilla Firefox\default-browser-agent.exe [124624 2020-06-04] (Mozilla Corporation -> Mozilla Foundation)
Task: {F8DDCF0D-13C7-47FA-8785-4375BC0FA9BC} - System32\Tasks\WinZip Update Notifier 2 => C:\Program Files\WinZip\WZUpdateNotifier.exe [2814096 2020-02-20] (Corel Corporation -> Corel Corporation)
Task: {FF3E6A4A-8687-4935-B75C-B63B50BAD683} - System32\Tasks\Microsoft\Office\Office Automatic Updates 2.0 => C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeC2RClient.exe [23756168 2020-06-05] (Microsoft Corporation -> Microsoft Corporation)

(If an entry is included in the fixlist, the task (.job) file will be moved. The file which is running by the task will not be moved.)

Task: C:\WINDOWS\Tasks\DropboxUpdateTaskMachineCore.job => C:\Program Files (x86)\Dropbox\Update\DropboxUpdate.exe
Task: C:\WINDOWS\Tasks\DropboxUpdateTaskMachineUA.job => C:\Program Files (x86)\Dropbox\Update\DropboxUpdate.exe

==================== Internet (Whitelisted) ====================

(If an item is included in the fixlist, if it is a registry item it will be removed or restored to default.)

Winsock: Catalog5 08 C:\Program Files (x86)\Bonjour\mdnsNSP.dll [122128 2015-08-12] (Apple Inc. -> Apple Inc.)
Winsock: Catalog5-x64 08 C:\Program Files\Bonjour\mdnsNSP.dll [133392 2015-08-12] (Apple Inc. -> Apple Inc.)
Tcpip\Parameters: [DhcpNameServer] 192.168.0.1
Tcpip\..\Interfaces\{17d7fd91-b117-46d6-a6f4-9fd8d9cf732d}: [DhcpNameServer] 192.168.0.1

Internet Explorer:
==================
BHO-x32: Skype for Business Browser Helper -> {31D09BA0-12F5-4CCE-BE8A-2923E76605DA} -> C:\Program Files\Microsoft Office\root\VFS\ProgramFilesX86\Microsoft Office\Office16\OCHelper.dll [2020-06-02] (Microsoft Corporation -> Microsoft Corporation)
BHO-x32: Dashlane BHO -> {42D79B50-CC4A-4A8E-860F-BE674AF053A2} -> C:\Users\Carl's Home office\AppData\Roaming\Dashlane\ie\Dashlanei.dll [2020-06-08] (Dashlane USA, Inc. -> Dashlane, Inc.)
BHO-x32: Act.UI.InternetExplorer.Plugins.AttachFile.CAttachFile -> {D5233FCD-D258-4903-89B8-FB1568E7413D} -> C:\Program Files (x86)\ACT\Act for Windows\Plugins\Act.UI.InternetExplorer.Plugins.AttachFile.DLL [2019-10-23] (Swiftpage ACT! LLC) [File not signed]
Toolbar: HKLM-x32 - Dashlane Toolbar - {669695BC-A811-4A9D-8CDF-BA8C795F261C} - C:\Users\Carl's Home office\AppData\Roaming\Dashlane\ie\KWIEBar.dll [2020-06-08] (Dashlane USA, Inc. -> Dashlane, Inc.)
Handler: mso-minsb-roaming.16 - {83C25742-A9F7-49FB-9138-434302C88D07} - C:\Program Files\Microsoft Office\root\Office16\MSOSB.DLL [2020-06-09] (Microsoft Corporation -> Microsoft Corporation)
Handler-x32: mso-minsb-roaming.16 - {83C25742-A9F7-49FB-9138-434302C88D07} - C:\Program Files\Microsoft Office\root\VFS\ProgramFilesX86\Microsoft Office\Office16\MSOSB.DLL [2020-06-09] (Microsoft Corporation -> Microsoft Corporation)
Handler: mso-minsb.16 - {42089D2D-912D-4018-9087-2B87803E93FB} - C:\Program Files\Microsoft Office\root\Office16\MSOSB.DLL [2020-06-09] (Microsoft Corporation -> Microsoft Corporation)
Handler-x32: mso-minsb.16 - {42089D2D-912D-4018-9087-2B87803E93FB} - C:\Program Files\Microsoft Office\root\VFS\ProgramFilesX86\Microsoft Office\Office16\MSOSB.DLL [2020-06-09] (Microsoft Corporation -> Microsoft Corporation)
Handler: osf-roaming.16 - {42089D2D-912D-4018-9087-2B87803E93FB} - C:\Program Files\Microsoft Office\root\Office16\MSOSB.DLL [2020-06-09] (Microsoft Corporation -> Microsoft Corporation)
Handler-x32: osf-roaming.16 - {42089D2D-912D-4018-9087-2B87803E93FB} - C:\Program Files\Microsoft Office\root\VFS\ProgramFilesX86\Microsoft Office\Office16\MSOSB.DLL [2020-06-09] (Microsoft Corporation -> Microsoft Corporation)
Handler: osf.16 - {5504BE45-A83B-4808-900A-3A5C36E7F77A} - C:\Program Files\Microsoft Office\root\Office16\MSOSB.DLL [2020-06-09] (Microsoft Corporation -> Microsoft Corporation)
Handler-x32: osf.16 - {5504BE45-A83B-4808-900A-3A5C36E7F77A} - C:\Program Files\Microsoft Office\root\VFS\ProgramFilesX86\Microsoft Office\Office16\MSOSB.DLL [2020-06-09] (Microsoft Corporation -> Microsoft Corporation)

FireFox:
========
FF DefaultProfile: 7qlciglv.default
FF ProfilePath: C:\Users\Carl's Home office\AppData\Roaming\Mozilla\Firefox\Profiles\7qlciglv.default [2020-06-02]
FF ProfilePath: C:\Users\Carl's Home office\AppData\Roaming\Mozilla\Firefox\Profiles\h5m4c4uh.default-release [2020-06-21]
FF Homepage: Mozilla\Firefox\Profiles\h5m4c4uh.default-release -> hxxps://www.bing.com/?pc=U528
FF Extension: (Facebook Container) - C:\Users\Carl's Home office\AppData\Roaming\Mozilla\Firefox\Profiles\h5m4c4uh.default-release\Extensions\@contain-facebook.xpi [2020-06-02]
FF Extension: (Cisco Webex Extension) - C:\Users\Carl's Home office\AppData\Roaming\Mozilla\Firefox\Profiles\h5m4c4uh.default-release\Extensions\ciscowebexstart1@cisco.com.xpi [2020-06-02]
FF Extension: (iCloud Bookmarks) - C:\Users\Carl's Home office\AppData\Roaming\Mozilla\Firefox\Profiles\h5m4c4uh.default-release\Extensions\firefoxdav@icloud.com.xpi [2020-06-02]
FF Extension: (Dashlane) - C:\Users\Carl's Home office\AppData\Roaming\Mozilla\Firefox\Profiles\h5m4c4uh.default-release\Extensions\jetpack-extension@dashlane.com.xpi [2020-06-09] [UpdateUrl:hxxps://ws1.dashlane.com/5/binaries/query?logins=&platform=firefox&target=ff_web_extension&format=json&version=]
FF Extension: (Zoom Scheduler) - C:\Users\Carl's Home office\AppData\Roaming\Mozilla\Firefox\Profiles\h5m4c4uh.default-release\Extensions\{bf855ead-d7c3-4c7b-9f88-9a7e75c0efdf}.xpi [2020-06-16]
FF Extension: (Adblock Plus - free ad blocker) - C:\Users\Carl's Home office\AppData\Roaming\Mozilla\Firefox\Profiles\h5m4c4uh.default-release\Extensions\{d10d0bf8-f5b5-c8b4-a8b2-2b9879e08c5d}.xpi [2020-06-02]
FF Plugin: @microsoft.com/SharePoint,version=14.0 -> C:\Program Files\Microsoft Office\root\Office16\NPSPWRAP.DLL [2020-06-02] (Microsoft Corporation -> Microsoft Corporation)
FF Plugin-x32: @microsoft.com/SharePoint,version=14.0 -> C:\Program Files\Microsoft Office\root\VFS\ProgramFilesX86\Microsoft Office\Office16\NPSPWRAP.DLL [2020-06-02] (Microsoft Corporation -> Microsoft Corporation)

Chrome:
=======
CHR Profile: C:\Users\Carl's Home office\AppData\Local\Google\Chrome\User Data\Default [2020-06-21]
CHR HomePage: Default -> hxxps://www.bing.com/
CHR StartupUrls: Default -> "hxxps://www.google.com/"
CHR DefaultSearchURL: Default -> hxxps://ssl.gstatic.com/chromoting/chromoting_logo_512.png
CHR Extension: (Slides) - C:\Users\Carl's Home office\AppData\Local\Google\Chrome\User Data\Default\Extensions\aapocclcgogkmnckokdopfmhonfmgoek [2020-06-03]
CHR Extension: (Docs) - C:\Users\Carl's Home office\AppData\Local\Google\Chrome\User Data\Default\Extensions\aohghmighlieiainnegkcijnfilokake [2020-06-03]
CHR Extension: (Google Drive) - C:\Users\Carl's Home office\AppData\Local\Google\Chrome\User Data\Default\Extensions\apdfllckaahabafndbhieahigkjlhalf [2020-06-03]
CHR Extension: (YouTube) - C:\Users\Carl's Home office\AppData\Local\Google\Chrome\User Data\Default\Extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo [2020-06-03]
CHR Extension: (Adblock Plus - free ad blocker) - C:\Users\Carl's Home office\AppData\Local\Google\Chrome\User Data\Default\Extensions\cfhdojbkjhnklbpkdaibdccddilifddb [2020-06-03]
CHR Extension: (Chrome Remote Desktop) - C:\Users\Carl's Home office\AppData\Local\Google\Chrome\User Data\Default\Extensions\efmjfjelnicpmdcmfikempdhlmainjcb [2020-06-03]
CHR Extension: (Dashlane - Password Manager) - C:\Users\Carl's Home office\AppData\Local\Google\Chrome\User Data\Default\Extensions\fdjamakpfbbddfjaooikfcpapjohcfmg [2020-06-03]
CHR Extension: (Sheets) - C:\Users\Carl's Home office\AppData\Local\Google\Chrome\User Data\Default\Extensions\felcaaldnbdncclmgdcncolpebgiejap [2020-06-03]
CHR Extension: (Chrome Remote Desktop) - C:\Users\Carl's Home office\AppData\Local\Google\Chrome\User Data\Default\Extensions\gbchcmhmhahfdphkhkmpfmihenigjmpp [2020-06-03]
CHR Extension: (Google Docs Offline) - C:\Users\Carl's Home office\AppData\Local\Google\Chrome\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi [2020-06-03]
CHR Extension: (Chrome Remote Desktop) - C:\Users\Carl's Home office\AppData\Local\Google\Chrome\User Data\Default\Extensions\inomeogfingihgjfjlpeplalcfajhgai [2020-06-03]
CHR Extension: (Disconnect) - C:\Users\Carl's Home office\AppData\Local\Google\Chrome\User Data\Default\Extensions\jeoacafpbcihiomhlakheieifhpjdfeo [2020-06-03]
CHR Extension: (Cisco Webex Extension) - C:\Users\Carl's Home office\AppData\Local\Google\Chrome\User Data\Default\Extensions\jlhmfgmfgeifomenelglieieghnjghma [2020-06-03]
CHR Extension: (Chrome Web Store Payments) - C:\Users\Carl's Home office\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda [2020-06-03]
CHR Extension: (Gmail) - C:\Users\Carl's Home office\AppData\Local\Google\Chrome\User Data\Default\Extensions\pjkljhegncpnkpknbcohdijeoejaedia [2020-06-03]
CHR Extension: (Chrome Media Router) - C:\Users\Carl's Home office\AppData\Local\Google\Chrome\User Data\Default\Extensions\pkedcjkdefgpdelpbcmbmeomcjbeemfm [2020-06-03]

==================== Services (Whitelisted) ===================

(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)

S2 Act! Scheduler; C:\Program Files (x86)\ACT\Act for Windows\Act.Scheduler.exe [90112 2019-10-23] (Swiftpage ACT! LLC) [File not signed]
R2 ActService; C:\Program Files (x86)\ACT\Act for Windows\Act.Server.Host.exe [27136 2019-10-23] (Microsoft) [File not signed]
R2 ActSmartTaskService; C:\Program Files (x86)\ACT\Act for Windows\Act.Server.Host.exe [27136 2019-10-23] (Microsoft) [File not signed]
R2 ActWebApiService; C:\Program Files (x86)\ACT\Act.Web.API\bin\act.web.api.hosting.exe [22016 2020-05-30] () [File not signed]
R2 Apple Mobile Device Service; C:\Program Files\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe [96056 2020-05-20] (Apple Inc. -> Apple Inc.)
R2 ClickToRunSvc; C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe [10634632 2020-06-05] (Microsoft Corporation -> Microsoft Corporation)
S2 dbupdate; C:\Program Files (x86)\Dropbox\Update\DropboxUpdate.exe [143144 2020-06-02] (Dropbox, Inc -> Dropbox, Inc.)
S3 dbupdatem; C:\Program Files (x86)\Dropbox\Update\DropboxUpdate.exe [143144 2020-06-02] (Dropbox, Inc -> Dropbox, Inc.)
R2 DbxSvc; C:\WINDOWS\system32\DbxSvc.exe [44552 2020-06-09] (Dropbox, Inc -> Dropbox, Inc.)
R2 HHC7Service; C:\Program Files (x86)\Keystroke\HHC Enterprise Edition\HHCService.exe [19736 2020-03-17] (Keystroke Quality Computing Inc -> )
R2 HHC7ServiceMonitor; C:\Program Files (x86)\Keystroke\HHC Enterprise Edition\HHCServiceMonitor.exe [19232 2020-03-17] (Keystroke Quality Computing Inc -> )
R2 igfxCUIService2.0.0.0; C:\WINDOWS\system32\igfxCUIService.exe [382456 2017-03-13] (Intel® pGFX -> Intel Corporation)
R2 LogiFacecamService; C:\Program Files\Logitech\LogiCapture\bin\Service\LogiFacecamService.exe [446600 2020-01-08] (Logitech Inc -> Logitech)
R2 MBAMService; C:\Program Files\Malwarebytes\Anti-Malware\MBAMService.exe [6933272 2020-06-03] (Malwarebytes Inc -> Malwarebytes)
R2 MSSQL$ACT7; C:\Program Files\Microsoft SQL Server\MSSQL12.ACT7\MSSQL\Binn\sqlservr.exe [372312 2019-05-27] (Microsoft Corporation -> Microsoft Corporation)
R2 RtkAudioService; C:\Program Files\Realtek\Audio\HDA\RtkAudioService64.exe [310016 2016-04-07] (Realtek Semiconductor Corp -> Realtek Semiconductor)
S3 Sense; C:\Program Files\Windows Defender Advanced Threat Protection\MsSense.exe [5930136 2020-04-14] (Microsoft Windows Publisher -> Microsoft Corporation)
S2 SQLAgent$ACT7; C:\Program Files\Microsoft SQL Server\MSSQL12.ACT7\MSSQL\Binn\SQLAGENT.EXE [613168 2019-05-27] (Microsoft Corporation -> Microsoft Corporation)
R3 WdNisSvc; C:\ProgramData\Microsoft\Windows Defender\platform\4.18.2005.5-0\NisSrv.exe [2484256 2020-06-05] (Microsoft Windows Publisher -> Microsoft Corporation)
R2 WinDefend; C:\ProgramData\Microsoft\Windows Defender\platform\4.18.2005.5-0\MsMpEng.exe [103168 2020-06-05] (Microsoft Windows Publisher -> Microsoft Corporation)

===================== Drivers (Whitelisted) ===================

(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)

S3 AppleKmdfFilter; C:\WINDOWS\System32\drivers\AppleKmdfFilter.sys [20640 2018-05-10] (WDKTestCert build,131474841775766162 -> Apple Inc.)
S3 AppleLowerFilter; C:\WINDOWS\System32\drivers\AppleLowerFilter.sys [35560 2018-05-10] (WDKTestCert build,131474841775766162 -> Apple Inc.)
R3 athr; C:\WINDOWS\System32\drivers\athw10x.sys [4599728 2017-02-22] (Qualcomm Atheros -> Qualcomm Atheros Communications, Inc.)
R1 ESProtectionDriver; C:\WINDOWS\system32\drivers\mbae64.sys [153312 2020-06-03] (Malwarebytes Corporation -> Malwarebytes)
R2 MBAMChameleon; C:\WINDOWS\System32\Drivers\MbamChameleon.sys [214496 2020-06-03] (Malwarebytes Inc -> Malwarebytes)
S0 MbamElam; C:\WINDOWS\System32\DRIVERS\MbamElam.sys [19912 2020-06-03] (Microsoft Windows Early Launch Anti-malware Publisher -> Malwarebytes)
R3 MBAMFarflt; C:\WINDOWS\System32\DRIVERS\farflt.sys [195432 2020-06-21] (Malwarebytes Inc -> Malwarebytes)
R3 MBAMProtection; C:\WINDOWS\system32\DRIVERS\mbam.sys [73368 2020-06-21] (Malwarebytes Inc -> Malwarebytes)
R3 MBAMSwissArmy; C:\WINDOWS\System32\Drivers\mbamswissarmy.sys [248968 2020-06-03] (Malwarebytes Inc -> Malwarebytes)
R3 MBAMWebProtection; C:\WINDOWS\system32\DRIVERS\mwac.sys [131736 2020-06-20] (Malwarebytes Inc -> Malwarebytes)
S4 RsFx0321; C:\WINDOWS\System32\DRIVERS\RsFx0321.sys [258720 2019-05-01] (Microsoft Corporation -> Microsoft Corporation)
S3 SmbDrv; C:\WINDOWS\System32\drivers\Smb_driver_AMDASF.sys [42088 2016-04-07] (Synaptics Incorporated -> Synaptics Incorporated)
R3 SmbDrvI; C:\WINDOWS\System32\drivers\Smb_driver_Intel.sys [42600 2016-04-07] (Synaptics Incorporated -> Synaptics Incorporated)
S3 USBAAPL64; C:\WINDOWS\System32\Drivers\usbaapl64.sys [54784 2015-06-10] (Microsoft Windows Hardware Compatibility Publisher -> Apple, Inc.)
S0 WdBoot; C:\WINDOWS\System32\drivers\wd\WdBoot.sys [45960 2020-06-05] (Microsoft Windows Early Launch Anti-malware Publisher -> Microsoft Corporation)
R0 WdFilter; C:\WINDOWS\System32\drivers\wd\WdFilter.sys [401120 2020-06-05] (Microsoft Windows -> Microsoft Corporation)
R3 WdNisDrv; C:\WINDOWS\System32\drivers\wd\WdNisDrv.sys [64224 2020-06-05] (Microsoft Windows -> Microsoft Corporation)

==================== NetSvcs (Whitelisted) ===================

(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)


==================== One month (created) ===================

(If an entry is included in the fixlist, the file/folder will be moved.)

2020-06-21 19:48 - 2020-06-21 19:48 - 000899584 _____ C:\Users\Carl's Home office\Downloads\RGSA(1).exe
2020-06-21 18:46 - 2020-06-21 18:49 - 000002179 _____ C:\Users\Carl's Home office\Desktop\Clear Pending system Tasks.lnk
2020-06-21 18:42 - 2020-06-21 19:51 - 000047495 _____ C:\Users\Carl's Home office\Downloads\Addition.txt
2020-06-21 18:17 - 2020-06-21 19:53 - 000028064 _____ C:\Users\Carl's Home office\Downloads\FRST.txt
2020-06-21 17:58 - 2020-06-21 17:58 - 002290176 _____ (Farbar) C:\Users\Carl's Home office\Downloads\FRST64(1).exe
2020-06-21 17:52 - 2020-06-21 17:52 - 000195432 _____ (Malwarebytes) C:\WINDOWS\system32\Drivers\farflt.sys
2020-06-21 17:52 - 2020-06-21 17:52 - 000073368 _____ (Malwarebytes) C:\WINDOWS\system32\Drivers\mbam.sys
2020-06-21 08:18 - 2020-06-21 08:18 - 000002812 _____ C:\Users\Carl's Home office\OneDrive\Documents\cc_20200621_081822.reg
2020-06-20 20:31 - 2020-06-20 20:47 - 083491136 _____ (Cloud Elements ) C:\Users\Carl's Home office\Downloads\Act! Connect Link Setup 1.1.13.exe
2020-06-20 20:23 - 2020-06-20 20:23 - 000002095 _____ C:\Users\Public\Desktop\Act!.lnk
2020-06-20 20:23 - 2020-06-20 20:23 - 000002095 _____ C:\ProgramData\Desktop\Act!.lnk
2020-06-20 20:22 - 2020-06-20 20:22 - 000000000 ____D C:\ProgramData\Swiftpage ACT! LLC
2020-06-20 20:22 - 2019-10-23 12:46 - 000299008 ____N (Swiftpage ACT! LLC) C:\WINDOWS\system32\Act9AB32.dll
2020-06-20 18:28 - 2020-06-20 18:28 - 000131736 _____ (Malwarebytes) C:\WINDOWS\system32\Drivers\mwac.sys
2020-06-20 18:24 - 2020-06-20 18:24 - 000000532 _____ C:\Users\Carl's Home office\AppData\Roaming\NGEN_AppLog_Uninstall.txt
2020-06-20 13:17 - 2020-06-20 13:17 - 000000000 ____D C:\Users\Carl's Home office\AppData\Local\Swiftpage_ACT!_LLC
2020-06-20 08:16 - 2020-06-21 15:58 - 000000000 ____D C:\Users\Carl's Home office\AppData\Local\Deployment
2020-06-20 08:13 - 2020-06-20 08:13 - 000000000 ___HD C:\$SysReset
2020-06-19 16:35 - 2020-06-19 16:36 - 000008192 ___SH C:\DumpStack.log.tmp
2020-06-19 07:13 - 2020-06-19 07:12 - 000005146 _____ C:\Users\Carl's Home office\OneDrive\Documents\cc_20200619_071232.reg
2020-06-19 06:44 - 2020-06-19 06:44 - 000002003 _____ C:\Users\Carl's Home office\Desktop\Dashlane.lnk
2020-06-18 19:20 - 2020-06-19 14:01 - 000055248 _____ C:\WINDOWS\diagwrn.xml
2020-06-18 19:20 - 2020-06-19 14:01 - 000055248 _____ C:\WINDOWS\diagerr.xml
2020-06-18 15:36 - 2020-06-18 15:36 - 000000000 ___HD C:\$WinREAgent
2020-06-13 08:06 - 2020-06-13 08:06 - 001828080 _____ (Microsoft Corporation) C:\Users\Carl's Home office\Downloads\MicrosoftEdgeSetup.exe
2020-06-11 07:52 - 2020-06-19 20:53 - 000000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Dropbox
2020-06-11 07:16 - 2020-06-11 07:16 - 025859024 _____ (Piriform Software Ltd) C:\Users\Carl's Home office\Downloads\ccsetup567(1).exe
2020-06-11 07:08 - 2020-06-11 07:08 - 000006030 _____ C:\Users\Carl's Home office\OneDrive\Documents\cc_20200611_070826.reg
2020-06-11 06:48 - 2020-06-05 17:03 - 000835480 _____ (Adobe) C:\WINDOWS\SysWOW64\FlashPlayerApp.exe
2020-06-11 06:48 - 2020-06-05 17:03 - 000179608 _____ (Adobe) C:\WINDOWS\SysWOW64\FlashPlayerCPLApp.cpl
2020-06-11 00:58 - 2020-06-11 00:58 - 011608064 _____ (Microsoft Corporation) C:\WINDOWS\system32\wmp.dll
2020-06-11 00:58 - 2020-06-11 00:58 - 009712640 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\wmp.dll
2020-06-11 00:58 - 2020-06-11 00:58 - 004470272 _____ (Microsoft Corporation) C:\WINDOWS\system32\xpsrchvw.exe
2020-06-11 00:58 - 2020-06-11 00:58 - 003365376 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\xpsrchvw.exe
2020-06-11 00:58 - 2020-06-11 00:58 - 001539072 _____ (Microsoft Corporation) C:\WINDOWS\system32\wbengine.exe
2020-06-11 00:58 - 2020-06-11 00:58 - 000940544 _____ (Microsoft Corporation) C:\WINDOWS\system32\fveapi.dll
2020-06-11 00:58 - 2020-06-11 00:58 - 000920064 _____ (Microsoft Corporation) C:\WINDOWS\system32\MsSpellCheckingFacility.dll
2020-06-11 00:58 - 2020-06-11 00:58 - 000723968 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\fveapi.dll
2020-06-11 00:58 - 2020-06-11 00:58 - 000688640 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\MsSpellCheckingFacility.dll
2020-06-11 00:58 - 2020-06-11 00:58 - 000651264 _____ (Microsoft Corporation) C:\WINDOWS\system32\FXSCOMEX.dll
2020-06-11 00:58 - 2020-06-11 00:58 - 000588800 _____ (Microsoft Corporation) C:\WINDOWS\system32\msra.exe
2020-06-11 00:58 - 2020-06-11 00:58 - 000526336 _____ (Microsoft Corporation) C:\WINDOWS\system32\bdesvc.dll
2020-06-11 00:58 - 2020-06-11 00:58 - 000503808 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\FXSCOMEX.dll
2020-06-11 00:58 - 2020-06-11 00:58 - 000466944 _____ (Microsoft Corporation) C:\WINDOWS\system32\Windows.Devices.Picker.dll
2020-06-11 00:58 - 2020-06-11 00:58 - 000430592 _____ (Microsoft Corporation) C:\WINDOWS\system32\WalletService.dll
2020-06-11 00:58 - 2020-06-11 00:58 - 000338944 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\Windows.Devices.Picker.dll
2020-06-11 00:58 - 2020-06-11 00:58 - 000219136 _____ (Microsoft Corporation) C:\WINDOWS\system32\wmpdxm.dll
2020-06-11 00:58 - 2020-06-11 00:58 - 000166912 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\wmpdxm.dll
2020-06-11 00:58 - 2020-06-11 00:58 - 000053760 _____ (Microsoft Corporation) C:\WINDOWS\system32\BdeUISrv.exe
2020-06-11 00:57 - 2020-06-11 00:57 - 025902080 _____ (Microsoft Corporation) C:\WINDOWS\system32\edgehtml.dll
2020-06-11 00:57 - 2020-06-11 00:57 - 025444352 _____ (Microsoft Corporation) C:\WINDOWS\system32\Hydrogen.dll
2020-06-11 00:57 - 2020-06-11 00:57 - 019851776 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\edgehtml.dll
2020-06-11 00:57 - 2020-06-11 00:57 - 019812864 _____ (Microsoft Corporation) C:\WINDOWS\system32\HologramWorld.dll
2020-06-11 00:57 - 2020-06-11 00:57 - 018029056 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\mshtml.dll
2020-06-11 00:57 - 2020-06-11 00:57 - 008015360 _____ (Microsoft Corporation) C:\WINDOWS\system32\mstscax.dll
2020-06-11 00:57 - 2020-06-11 00:57 - 007760384 _____ (Microsoft Corporation) C:\WINDOWS\system32\Chakra.dll
2020-06-11 00:57 - 2020-06-11 00:57 - 007268864 _____ (Microsoft Corporation) C:\WINDOWS\system32\ieframe.dll
2020-06-11 00:57 - 2020-06-11 00:57 - 007012864 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\mstscax.dll
2020-06-11 00:57 - 2020-06-11 00:57 - 006526448 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\Windows.Media.Protection.PlayReady.dll
2020-06-11 00:57 - 2020-06-11 00:57 - 006292480 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\ieframe.dll
2020-06-11 00:57 - 2020-06-11 00:57 - 005909504 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\Chakra.dll
2020-06-11 00:57 - 2020-06-11 00:57 - 005765144 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\shell32.dll
2020-06-11 00:57 - 2020-06-11 00:57 - 004858880 _____ (Microsoft Corporation) C:\WINDOWS\system32\jscript9.dll
2020-06-11 00:57 - 2020-06-11 00:57 - 004610560 _____ (Microsoft Corporation) C:\WINDOWS\system32\msi.dll
2020-06-11 00:57 - 2020-06-11 00:57 - 004129416 _____ (Microsoft Corporation) C:\WINDOWS\system32\mfcore.dll
2020-06-11 00:57 - 2020-06-11 00:57 - 003822592 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\jscript9.dll
2020-06-11 00:57 - 2020-06-11 00:57 - 003525608 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\mfcore.dll
2020-06-11 00:57 - 2020-06-11 00:57 - 003515392 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\msi.dll
2020-06-11 00:57 - 2020-06-11 00:57 - 003398656 _____ (Microsoft Corporation) C:\WINDOWS\system32\MSVidCtl.dll
2020-06-11 00:57 - 2020-06-11 00:57 - 002831872 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\CertEnroll.dll
2020-06-11 00:57 - 2020-06-11 00:57 - 002798592 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\win32kfull.sys
2020-06-11 00:57 - 2020-06-11 00:57 - 002755584 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\mshtml.tlb
2020-06-11 00:57 - 2020-06-11 00:57 - 002755584 _____ (Microsoft Corporation) C:\WINDOWS\system32\mshtml.tlb
2020-06-11 00:57 - 2020-06-11 00:57 - 002583496 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\combase.dll
2020-06-11 00:57 - 2020-06-11 00:57 - 002494744 _____ (Microsoft Corporation) C:\WINDOWS\system32\msmpeg2vdec.dll
2020-06-11 00:57 - 2020-06-11 00:57 - 002281472 _____ (Microsoft Corporation) C:\WINDOWS\system32\mmcndmgr.dll
2020-06-11 00:57 - 2020-06-11 00:57 - 002230240 _____ (Microsoft Corporation) C:\WINDOWS\system32\mfasfsrcsnk.dll
2020-06-11 00:57 - 2020-06-11 00:57 - 002204160 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\MSVidCtl.dll
2020-06-11 00:57 - 2020-06-11 00:57 - 002190648 _____ (Microsoft Corporation) C:\WINDOWS\system32\AppVEntSubsystems64.dll
2020-06-11 00:57 - 2020-06-11 00:57 - 002184504 _____ (Microsoft Corporation) C:\WINDOWS\system32\workfolderssvc.dll
2020-06-11 00:57 - 2020-06-11 00:57 - 001803776 _____ (Microsoft Corporation) C:\WINDOWS\system32\mmc.exe
2020-06-11 00:57 - 2020-06-11 00:57 - 001704448 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\mmcndmgr.dll
2020-06-11 00:57 - 2020-06-11 00:57 - 001637888 _____ (Microsoft Corporation) C:\WINDOWS\system32\quartz.dll
2020-06-11 00:57 - 2020-06-11 00:57 - 001610240 _____ (Microsoft Corporation) C:\WINDOWS\system32\HologramCompositor.dll
2020-06-11 00:57 - 2020-06-11 00:57 - 001497400 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\AppVEntSubsystems32.dll
2020-06-11 00:57 - 2020-06-11 00:57 - 001467392 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\quartz.dll
2020-06-11 00:57 - 2020-06-11 00:57 - 001458688 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\GdiPlus.dll
2020-06-11 00:57 - 2020-06-11 00:57 - 001416224 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\gdi32full.dll
2020-06-11 00:57 - 2020-06-11 00:57 - 001410048 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\mmc.exe
2020-06-11 00:57 - 2020-06-11 00:57 - 001397560 _____ (Microsoft Corporation) C:\WINDOWS\system32\hvix64.exe
2020-06-11 00:57 - 2020-06-11 00:57 - 001348096 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\comsvcs.dll
2020-06-11 00:57 - 2020-06-11 00:57 - 001344512 _____ (Microsoft Corporation) C:\WINDOWS\system32\WMNetMgr.dll
2020-06-11 00:57 - 2020-06-11 00:57 - 001319936 _____ (Microsoft Corporation) C:\WINDOWS\system32\webplatstorageserver.dll
2020-06-11 00:57 - 2020-06-11 00:57 - 001316352 _____ (Microsoft Corporation) C:\WINDOWS\system32\srmclient.dll
2020-06-11 00:57 - 2020-06-11 00:57 - 001314304 _____ (Microsoft Corporation) C:\WINDOWS\system32\diagperf.dll
2020-06-11 00:57 - 2020-06-11 00:57 - 001312256 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\msjet40.dll
2020-06-11 00:57 - 2020-06-11 00:57 - 001284608 _____ (Microsoft Corporation) C:\WINDOWS\system32\werconcpl.dll
2020-06-11 00:57 - 2020-06-11 00:57 - 001272160 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\mfasfsrcsnk.dll
2020-06-11 00:57 - 2020-06-11 00:57 - 001215488 _____ (Microsoft Corporation) C:\WINDOWS\system32\sdclt.exe
2020-06-11 00:57 - 2020-06-11 00:57 - 001193984 _____ (Microsoft Corporation) C:\WINDOWS\system32\sdengin2.dll
2020-06-11 00:57 - 2020-06-11 00:57 - 001151824 _____ (Microsoft Corporation) C:\WINDOWS\system32\mfmpeg2srcsnk.dll
2020-06-11 00:57 - 2020-06-11 00:57 - 001138688 _____ (Microsoft Corporation) C:\WINDOWS\system32\nettrace.dll
2020-06-11 00:57 - 2020-06-11 00:57 - 001112576 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\WMNetMgr.dll
2020-06-11 00:57 - 2020-06-11 00:57 - 001099608 _____ (Microsoft Corporation) C:\WINDOWS\system32\mfds.dll
2020-06-11 00:57 - 2020-06-11 00:57 - 001077048 _____ (Microsoft Corporation) C:\WINDOWS\system32\hvax64.exe
2020-06-11 00:57 - 2020-06-11 00:57 - 001066496 _____ (Microsoft Corporation) C:\WINDOWS\system32\cdosys.dll
2020-06-11 00:57 - 2020-06-11 00:57 - 001012800 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\mfmpeg2srcsnk.dll
2020-06-11 00:57 - 2020-06-11 00:57 - 000994304 _____ (Microsoft Corporation) C:\WINDOWS\system32\EdgeManager.dll
2020-06-11 00:57 - 2020-06-11 00:57 - 000992256 _____ (Microsoft Corporation) C:\WINDOWS\system32\imapi2fs.dll
2020-06-11 00:57 - 2020-06-11 00:57 - 000982016 _____ (Microsoft Corporation) C:\WINDOWS\system32\tapi3.dll
2020-06-11 00:57 - 2020-06-11 00:57 - 000971264 _____ (Microsoft Corporation) C:\WINDOWS\system32\dsregcmd.exe
2020-06-11 00:57 - 2020-06-11 00:57 - 000932352 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\srmclient.dll
2020-06-11 00:57 - 2020-06-11 00:57 - 000897536 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\Windows.UI.Immersive.dll
2020-06-11 00:57 - 2020-06-11 00:57 - 000894024 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\WinTypes.dll
2020-06-11 00:57 - 2020-06-11 00:57 - 000893952 _____ (Microsoft Corporation) C:\WINDOWS\system32\ieapfltr.dll
2020-06-11 00:57 - 2020-06-11 00:57 - 000868864 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\windowsperformancerecordercontrol.dll
2020-06-11 00:57 - 2020-06-11 00:57 - 000868352 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\imapi2fs.dll
2020-06-11 00:57 - 2020-06-11 00:57 - 000850944 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\tapi3.dll
2020-06-11 00:57 - 2020-06-11 00:57 - 000843776 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\webplatstorageserver.dll
2020-06-11 00:57 - 2020-06-11 00:57 - 000836608 _____ (Microsoft Corporation) C:\WINDOWS\system32\WorkfoldersControl.dll
2020-06-11 00:57 - 2020-06-11 00:57 - 000836608 _____ (Microsoft Corporation) C:\WINDOWS\system32\jscript.dll
2020-06-11 00:57 - 2020-06-11 00:57 - 000832512 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\cdosys.dll
2020-06-11 00:57 - 2020-06-11 00:57 - 000783496 _____ (Microsoft Corporation) C:\WINDOWS\system32\tcblaunch.exe
2020-06-11 00:57 - 2020-06-11 00:57 - 000782336 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\kerberos.dll
2020-06-11 00:57 - 2020-06-11 00:57 - 000776192 _____ (Microsoft Corporation) C:\WINDOWS\system32\nshwfp.dll
2020-06-11 00:57 - 2020-06-11 00:57 - 000747832 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\mfds.dll
2020-06-11 00:57 - 2020-06-11 00:57 - 000740664 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\DismApi.dll
2020-06-11 00:57 - 2020-06-11 00:57 - 000740352 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\ieapfltr.dll
2020-06-11 00:57 - 2020-06-11 00:57 - 000739840 _____ (Microsoft Corporation) C:\WINDOWS\system32\cscsvc.dll
2020-06-11 00:57 - 2020-06-11 00:57 - 000705536 _____ (Microsoft Corporation) C:\WINDOWS\system32\jscript9diag.dll
2020-06-11 00:57 - 2020-06-11 00:57 - 000701440 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\Windows.Mirage.Internal.dll
2020-06-11 00:57 - 2020-06-11 00:57 - 000694784 _____ (Microsoft Corporation) C:\WINDOWS\system32\gpprefcl.dll
2020-06-11 00:57 - 2020-06-11 00:57 - 000692224 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\comdlg32.dll
2020-06-11 00:57 - 2020-06-11 00:57 - 000689152 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\CPFilters.dll
2020-06-11 00:57 - 2020-06-11 00:57 - 000686080 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\jscript.dll
2020-06-11 00:57 - 2020-06-11 00:57 - 000684856 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\wer.dll
2020-06-11 00:57 - 2020-06-11 00:57 - 000674304 _____ (Microsoft Corporation) C:\WINDOWS\system32\wiaaut.dll
2020-06-11 00:57 - 2020-06-11 00:57 - 000668672 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\EdgeManager.dll
2020-06-11 00:57 - 2020-06-11 00:57 - 000651776 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\Windows.Internal.Management.dll
2020-06-11 00:57 - 2020-06-11 00:57 - 000640000 _____ (Microsoft Corporation) C:\WINDOWS\system32\qedit.dll
2020-06-11 00:57 - 2020-06-11 00:57 - 000638464 _____ (Microsoft Corporation) C:\WINDOWS\system32\srmscan.dll
2020-06-11 00:57 - 2020-06-11 00:57 - 000632320 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\tdh.dll
2020-06-11 00:57 - 2020-06-11 00:57 - 000619008 _____ (Microsoft Corporation) C:\WINDOWS\system32\azroles.dll
2020-06-11 00:57 - 2020-06-11 00:57 - 000609280 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\nshwfp.dll
2020-06-11 00:57 - 2020-06-11 00:57 - 000593920 _____ (Microsoft Corporation) C:\WINDOWS\system32\psisdecd.dll
2020-06-11 00:57 - 2020-06-11 00:57 - 000593424 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\oleaut32.dll
2020-06-11 00:57 - 2020-06-11 00:57 - 000575488 _____ (Microsoft® Windows® Operating System) C:\WINDOWS\system32\wvc.dll
2020-06-11 00:57 - 2020-06-11 00:57 - 000574464 _____ (Microsoft Corporation) C:\WINDOWS\system32\msTextPrediction.dll
2020-06-11 00:57 - 2020-06-11 00:57 - 000571904 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\wiaaut.dll
2020-06-11 00:57 - 2020-06-11 00:57 - 000567808 _____ (Microsoft Corporation) C:\WINDOWS\system32\PhotoScreensaver.scr
2020-06-11 00:57 - 2020-06-11 00:57 - 000564736 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\gpprefcl.dll
2020-06-11 00:57 - 2020-06-11 00:57 - 000564496 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\StateRepository.Core.dll
2020-06-11 00:57 - 2020-06-11 00:57 - 000562176 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\jscript9diag.dll
2020-06-11 00:57 - 2020-06-11 00:57 - 000555520 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\qdvd.dll
2020-06-11 00:57 - 2020-06-11 00:57 - 000549376 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\qedit.dll
2020-06-11 00:57 - 2020-06-11 00:57 - 000533504 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\vbscript.dll
2020-06-11 00:57 - 2020-06-11 00:57 - 000529920 _____ (Microsoft Corporation) C:\WINDOWS\system32\wwanmm.dll
2020-06-11 00:57 - 2020-06-11 00:57 - 000529920 _____ (Microsoft Corporation) C:\WINDOWS\system32\nltest.exe
2020-06-11 00:57 - 2020-06-11 00:57 - 000516544 _____ (Microsoft Corporation) C:\WINDOWS\system32\mf.dll
2020-06-11 00:57 - 2020-06-11 00:57 - 000513536 _____ (Microsoft Corporation) C:\WINDOWS\system32\imapi2.dll
2020-06-11 00:57 - 2020-06-11 00:57 - 000500224 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\PhotoScreensaver.scr
2020-06-11 00:57 - 2020-06-11 00:57 - 000498688 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\wlidcli.dll
2020-06-11 00:57 - 2020-06-11 00:57 - 000498688 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\azroles.dll
2020-06-11 00:57 - 2020-06-11 00:57 - 000498176 _____ (Microsoft Corporation) C:\WINDOWS\system32\werui.dll
2020-06-11 00:57 - 2020-06-11 00:57 - 000490496 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\Windows.UI.FileExplorer.dll
2020-06-11 00:57 - 2020-06-11 00:57 - 000484864 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\psisdecd.dll
2020-06-11 00:57 - 2020-06-11 00:57 - 000478208 _____ (Microsoft® Windows® Operating System) C:\WINDOWS\SysWOW64\wvc.dll
2020-06-11 00:57 - 2020-06-11 00:57 - 000477184 _____ (Microsoft Corporation) C:\WINDOWS\system32\SharedRealitySvc.dll
2020-06-11 00:57 - 2020-06-11 00:57 - 000470016 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\daxexec.dll
2020-06-11 00:57 - 2020-06-11 00:57 - 000464896 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\srmscan.dll
2020-06-11 00:57 - 2020-06-11 00:57 - 000462848 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\schannel.dll
2020-06-11 00:57 - 2020-06-11 00:57 - 000462848 _____ (Microsoft Corporation) C:\WINDOWS\system32\iassdo.dll
2020-06-11 00:57 - 2020-06-11 00:57 - 000453944 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\WerFault.exe
2020-06-11 00:57 - 2020-06-11 00:57 - 000430592 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\werui.dll
2020-06-11 00:57 - 2020-06-11 00:57 - 000426496 _____ (Microsoft Corporation) C:\WINDOWS\system32\termmgr.dll
2020-06-11 00:57 - 2020-06-11 00:57 - 000423424 _____ (Microsoft Corporation) C:\WINDOWS\system32\rdpencom.dll
2020-06-11 00:57 - 2020-06-11 00:57 - 000422400 _____ (Microsoft Corporation) C:\WINDOWS\system32\mswmdm.dll
2020-06-11 00:57 - 2020-06-11 00:57 - 000420352 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\imapi2.dll
2020-06-11 00:57 - 2020-06-11 00:57 - 000407864 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\spwizeng.dll
2020-06-11 00:57 - 2020-06-11 00:57 - 000405936 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\Faultrep.dll
2020-06-11 00:57 - 2020-06-11 00:57 - 000398336 _____ (Microsoft Corporation) C:\WINDOWS\system32\WlanMM.dll
2020-06-11 00:57 - 2020-06-11 00:57 - 000398336 _____ (Microsoft Corporation) C:\WINDOWS\system32\LocationApi.dll
2020-06-11 00:57 - 2020-06-11 00:57 - 000391680 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\netshell.dll
2020-06-11 00:57 - 2020-06-11 00:57 - 000391680 _____ (Microsoft Corporation) C:\WINDOWS\system32\qdvd.dll
2020-06-11 00:57 - 2020-06-11 00:57 - 000384512 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\puiobj.dll
2020-06-11 00:57 - 2020-06-11 00:57 - 000384000 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\FirewallAPI.dll
2020-06-11 00:57 - 2020-06-11 00:57 - 000380728 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\msv1_0.dll
2020-06-11 00:57 - 2020-06-11 00:57 - 000361472 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\termmgr.dll
2020-06-11 00:57 - 2020-06-11 00:57 - 000359936 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\iassdo.dll
2020-06-11 00:57 - 2020-06-11 00:57 - 000354304 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\rdpencom.dll
2020-06-11 00:57 - 2020-06-11 00:57 - 000353792 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\msrd3x40.dll
2020-06-11 00:57 - 2020-06-11 00:57 - 000349184 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\mswmdm.dll
2020-06-11 00:57 - 2020-06-11 00:57 - 000342528 _____ (Microsoft Corporation) C:\WINDOWS\system32\Windows.Internal.Feedback.Analog.dll
2020-06-11 00:57 - 2020-06-11 00:57 - 000332800 _____ (Microsoft Corporation) C:\WINDOWS\system32\mqoa.dll
2020-06-11 00:57 - 2020-06-11 00:57 - 000328192 _____ (Microsoft Corporation) C:\WINDOWS\system32\VAN.dll
2020-06-11 00:57 - 2020-06-11 00:57 - 000324096 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\win32k.sys
2020-06-11 00:57 - 2020-06-11 00:57 - 000323584 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\LocationApi.dll
2020-06-11 00:57 - 2020-06-11 00:57 - 000312832 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\SensorsApi.dll
2020-06-11 00:57 - 2020-06-11 00:57 - 000307712 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\wincorlib.dll
2020-06-11 00:57 - 2020-06-11 00:57 - 000299520 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\WlanMM.dll
2020-06-11 00:57 - 2020-06-11 00:57 - 000293376 _____ (Microsoft Corporation) C:\WINDOWS\system32\CXHProvisioningServer.dll
2020-06-11 00:57 - 2020-06-11 00:57 - 000283136 _____ (Microsoft Corporation) C:\WINDOWS\system32\dxtrans.dll
2020-06-11 00:57 - 2020-06-11 00:57 - 000271360 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\rdpviewerax.dll
2020-06-11 00:57 - 2020-06-11 00:57 - 000267776 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\dxtrans.dll
2020-06-11 00:57 - 2020-06-11 00:57 - 000264192 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\mqoa.dll
2020-06-11 00:57 - 2020-06-11 00:57 - 000260096 _____ (Microsoft Corporation) C:\WINDOWS\system32\wavemsp.dll
2020-06-11 00:57 - 2020-06-11 00:57 - 000259584 _____ (Microsoft Corporation) C:\WINDOWS\system32\mpg2splt.ax
2020-06-11 00:57 - 2020-06-11 00:57 - 000249856 _____ (Microsoft Corporation) C:\WINDOWS\system32\FileHistory.exe
2020-06-11 00:57 - 2020-06-11 00:57 - 000248320 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\VAN.dll
2020-06-11 00:57 - 2020-06-11 00:57 - 000230912 _____ (Microsoft Corporation) C:\WINDOWS\system32\RdpRelayTransport.dll
2020-06-11 00:57 - 2020-06-11 00:57 - 000225792 _____ (Microsoft Corporation) C:\WINDOWS\system32\WorkFoldersShell.dll
2020-06-11 00:57 - 2020-06-11 00:57 - 000225280 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\wavemsp.dll
2020-06-11 00:57 - 2020-06-11 00:57 - 000223544 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\Dism.exe
2020-06-11 00:57 - 2020-06-11 00:57 - 000211256 _____ (Microsoft Corporation) C:\WINDOWS\system32\tcbloader.dll
2020-06-11 00:57 - 2020-06-11 00:57 - 000205824 _____ (Microsoft Corporation) C:\WINDOWS\system32\cic.dll
2020-06-11 00:57 - 2020-06-11 00:57 - 000204800 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\mpg2splt.ax
2020-06-11 00:57 - 2020-06-11 00:57 - 000204008 _____ (Microsoft Corporation) C:\WINDOWS\system32\SecurityCenterBroker.dll
2020-06-11 00:57 - 2020-06-11 00:57 - 000199992 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\wermgr.exe
2020-06-11 00:57 - 2020-06-11 00:57 - 000199168 _____ (Microsoft Corporation) C:\WINDOWS\system32\wmidx.dll
2020-06-11 00:57 - 2020-06-11 00:57 - 000196096 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\pku2u.dll
2020-06-11 00:57 - 2020-06-11 00:57 - 000194560 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\psr.exe
2020-06-11 00:57 - 2020-06-11 00:57 - 000193592 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\weretw.dll
2020-06-11 00:57 - 2020-06-11 00:57 - 000190048 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\logoncli.dll
2020-06-11 00:57 - 2020-06-11 00:57 - 000186368 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\wdigest.dll
2020-06-11 00:57 - 2020-06-11 00:57 - 000184320 _____ (Microsoft Corporation) C:\WINDOWS\system32\iasrecst.dll
2020-06-11 00:57 - 2020-06-11 00:57 - 000183808 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\netprofm.dll
2020-06-11 00:57 - 2020-06-11 00:57 - 000170496 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\Windows.StateRepositoryUpgrade.dll
2020-06-11 00:57 - 2020-06-11 00:57 - 000161792 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\cic.dll
2020-06-11 00:57 - 2020-06-11 00:57 - 000155136 _____ (Microsoft Corporation) C:\WINDOWS\system32\Chakradiag.dll
2020-06-11 00:57 - 2020-06-11 00:57 - 000150328 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\WerFaultSecure.exe
2020-06-11 00:57 - 2020-06-11 00:57 - 000148992 _____ (Microsoft Corporation) C:\WINDOWS\system32\sdrsvc.dll
2020-06-11 00:57 - 2020-06-11 00:57 - 000148992 _____ (Microsoft Corporation) C:\WINDOWS\system32\iasnap.dll
2020-06-11 00:57 - 2020-06-11 00:57 - 000146944 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\wmidx.dll
2020-06-11 00:57 - 2020-06-11 00:57 - 000139776 _____ (Microsoft Corporation) C:\WINDOWS\system32\Chakrathunk.dll
2020-06-11 00:57 - 2020-06-11 00:57 - 000137728 _____ (Microsoft Corporation) C:\WINDOWS\system32\imapi.dll
2020-06-11 00:57 - 2020-06-11 00:57 - 000133120 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\iasrecst.dll
2020-06-11 00:57 - 2020-06-11 00:57 - 000130112 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\dmcmnutils.dll
2020-06-11 00:57 - 2020-06-11 00:57 - 000127488 _____ (Microsoft Corporation) C:\WINDOWS\system32\wkspbrokerAx.dll
2020-06-11 00:57 - 2020-06-11 00:57 - 000125440 _____ (Microsoft Corporation) C:\WINDOWS\system32\sdshext.dll
2020-06-11 00:57 - 2020-06-11 00:57 - 000121856 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\msaatext.dll
2020-06-11 00:57 - 2020-06-11 00:57 - 000117248 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\Chakradiag.dll
2020-06-11 00:57 - 2020-06-11 00:57 - 000114688 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\imapi.dll
2020-06-11 00:57 - 2020-06-11 00:57 - 000107520 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\iasnap.dll
2020-06-11 00:57 - 2020-06-11 00:57 - 000105472 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\Chakrathunk.dll
2020-06-11 00:57 - 2020-06-11 00:57 - 000105472 _____ (Microsoft Corporation) C:\WINDOWS\system32\WorkFolders.exe
2020-06-11 00:57 - 2020-06-11 00:57 - 000099712 _____ (Microsoft Corporation) C:\WINDOWS\system32\FsIso.exe
2020-06-11 00:57 - 2020-06-11 00:57 - 000098816 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\wkspbrokerAx.dll
2020-06-11 00:57 - 2020-06-11 00:57 - 000098816 _____ (Microsoft Corporation) C:\WINDOWS\system32\mfmjpegdec.dll
2020-06-11 00:57 - 2020-06-11 00:57 - 000098304 _____ (Microsoft Corporation) C:\WINDOWS\system32\mshtmled.dll
2020-06-11 00:57 - 2020-06-11 00:57 - 000093448 _____ (Microsoft Corporation) C:\WINDOWS\system32\devenum.dll
2020-06-11 00:57 - 2020-06-11 00:57 - 000089344 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\win32u.dll
2020-06-11 00:57 - 2020-06-11 00:57 - 000086016 _____ (Microsoft Corporation) C:\WINDOWS\system32\WwanRadioManager.dll
2020-06-11 00:57 - 2020-06-11 00:57 - 000086016 _____ (Microsoft Corporation) C:\WINDOWS\system32\tdc.ocx
2020-06-11 00:57 - 2020-06-11 00:57 - 000083600 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\devenum.dll
2020-06-11 00:57 - 2020-06-11 00:57 - 000083456 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\mfmjpegdec.dll
2020-06-11 00:57 - 2020-06-11 00:57 - 000078848 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\mshtmled.dll
2020-06-11 00:57 - 2020-06-11 00:57 - 000077824 _____ (Microsoft Corporation) C:\WINDOWS\system32\iasads.dll
2020-06-11 00:57 - 2020-06-11 00:57 - 000072704 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\tdc.ocx
2020-06-11 00:57 - 2020-06-11 00:57 - 000065536 _____ (Microsoft Corporation) C:\WINDOWS\system32\iemigplugin.dll
2020-06-11 00:57 - 2020-06-11 00:57 - 000063488 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\iemigplugin.dll
2020-06-11 00:57 - 2020-06-11 00:57 - 000057344 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\iasads.dll
2020-06-11 00:57 - 2020-06-11 00:57 - 000053760 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\rtutils.dll
2020-06-11 00:57 - 2020-06-11 00:57 - 000051200 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\CertEnrollCtrl.exe
2020-06-11 00:57 - 2020-06-11 00:57 - 000041864 _____ (Microsoft Corporation) C:\WINDOWS\system32\SecurityCenterBrokerPS.dll
2020-06-11 00:57 - 2020-06-11 00:57 - 000038912 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\werdiagcontroller.dll
2020-06-11 00:57 - 2020-06-11 00:57 - 000028368 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\SecurityCenterBrokerPS.dll
2020-06-11 00:57 - 2020-06-11 00:57 - 000026112 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\msimsg.dll
2020-06-11 00:57 - 2020-06-11 00:57 - 000026112 _____ (Microsoft Corporation) C:\WINDOWS\system32\msimsg.dll
2020-06-11 00:57 - 2020-06-11 00:57 - 000007680 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\DMAlertListener.ProxyStub.dll
2020-06-11 00:57 - 2020-06-11 00:57 - 000000315 _____ C:\WINDOWS\system32\DrtmAuth9.bin
2020-06-11 00:57 - 2020-06-11 00:57 - 000000315 _____ C:\WINDOWS\system32\DrtmAuth8.bin
2020-06-11 00:57 - 2020-06-11 00:57 - 000000315 _____ C:\WINDOWS\system32\DrtmAuth7.bin
2020-06-11 00:57 - 2020-06-11 00:57 - 000000315 _____ C:\WINDOWS\system32\DrtmAuth6.bin
2020-06-11 00:57 - 2020-06-11 00:57 - 000000315 _____ C:\WINDOWS\system32\DrtmAuth5.bin
2020-06-11 00:57 - 2020-06-11 00:57 - 000000315 _____ C:\WINDOWS\system32\DrtmAuth4.bin
2020-06-11 00:57 - 2020-06-11 00:57 - 000000315 _____ C:\WINDOWS\system32\DrtmAuth3.bin
2020-06-11 00:57 - 2020-06-11 00:57 - 000000315 _____ C:\WINDOWS\system32\DrtmAuth2.bin
2020-06-11 00:57 - 2020-06-11 00:57 - 000000315 _____ C:\WINDOWS\system32\DrtmAuth12.bin
2020-06-11 00:57 - 2020-06-11 00:57 - 000000315 _____ C:\WINDOWS\system32\DrtmAuth11.bin
2020-06-11 00:57 - 2020-06-11 00:57 - 000000315 _____ C:\WINDOWS\system32\DrtmAuth10.bin
2020-06-11 00:57 - 2020-06-11 00:57 - 000000315 _____ C:\WINDOWS\system32\DrtmAuth1.bin
2020-06-11 00:56 - 2020-06-11 00:56 - 009931576 _____ (Microsoft Corporation) C:\WINDOWS\system32\ntoskrnl.exe
2020-06-11 00:56 - 2020-06-11 00:56 - 007911176 _____ (Microsoft Corporation) C:\WINDOWS\system32\windows.storage.dll
2020-06-11 00:56 - 2020-06-11 00:56 - 007604592 _____ (Microsoft Corporation) C:\WINDOWS\system32\Windows.Media.Protection.PlayReady.dll
2020-06-11 00:56 - 2020-06-11 00:56 - 007266080 _____ (Microsoft Corporation) C:\WINDOWS\system32\shell32.dll
2020-06-11 00:56 - 2020-06-11 00:56 - 006435840 _____ (Microsoft Corporation) C:\WINDOWS\system32\twinui.dll
2020-06-11 00:56 - 2020-06-11 00:56 - 006091048 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\windows.storage.dll
2020-06-11 00:56 - 2020-06-11 00:56 - 006066808 _____ (Microsoft Corporation) C:\WINDOWS\system32\d2d1.dll
2020-06-11 00:56 - 2020-06-11 00:56 - 005283264 _____ (Microsoft Corporation) C:\WINDOWS\system32\Windows.StateRepository.dll
2020-06-11 00:56 - 2020-06-11 00:56 - 005195432 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\d2d1.dll
2020-06-11 00:56 - 2020-06-11 00:56 - 005111808 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\twinui.dll
2020-06-11 00:56 - 2020-06-11 00:56 - 005004344 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\Windows.StateRepository.dll
2020-06-11 00:56 - 2020-06-11 00:56 - 004565248 _____ (Microsoft Corporation) C:\WINDOWS\system32\sppsvc.exe
2020-06-11 00:56 - 2020-06-11 00:56 - 004012032 _____ (Microsoft Corporation) C:\WINDOWS\system32\Microsoft.Bluetooth.Service.dll
2020-06-11 00:56 - 2020-06-11 00:56 - 003726848 _____ (Microsoft Corporation) C:\WINDOWS\system32\win32kfull.sys
2020-06-11 00:56 - 2020-06-11 00:56 - 003712000 _____ (Microsoft Corporation)

[nasdaq]

Hello, Welcome to SpywareInfoForum.

I'm nasdaq and will be helping you.

 

If you can please print this topic it will make it easier for you to follow the instructions and complete all of the necessary steps in the order listed.

===

 

Your logs are clean of malware.

 

Press the windows key Press the Windows key + r on your keyboard at the same time. This will open the RUN BOX.+ r on your keyboard at the same time. This will open the RUN BOX.

Type Notepad and and click the OK key.

Please copy the entire contents of the code box below to the a new file.

 

 

start::
 
CreateRestorePoint:
CloseProcesses:

CMD: bootrec /FixMbr

CMD: bootrec /rebuildbcd

CMD: netsh int ip reset

CMD: ipconfig /flushDNS  

CMD: "%WINDIR%\SYSTEM32\lodctr.exe" /R

CMD: "%WINDIR%\SysWOW64\lodctr.exe" /R

CMD: "C:\Windows\SYSTEM32\lodctr.exe" /R

CMD: "C:\Windows\SysWOW64\lodctr.exe" /R  

cmd: sfc /scannow

cmd: DISM.exe /Online /Cleanup-image /Restorehealth   EmptyTemp:  

End::

 

 

Save the file as fixlist.txt in the same folder where the Farbar tool is running from.

The location is listed in the 3rd line of the Farbar log you have submitted.

 

Run FRST and click Fix only once and wait.

 

The tool will create a log (Fixlog.txt) please post it to your reply.

===

 

Let me know if the problem persists.

[Carlgrus]

I did exactly as instructed.  The Fix took almost an hour, then I rebooted, that took almost 10 minutes to get me back to the desktop, and I'm still trying to get on the internet.  I'm actually typing this on my laptop, not the PC that is having the problem.  So, I guess it's safe to say the problem persists....

[nasdaq]

Hi,

 

 

 

The Addition.txt logs shows some bad blocks on the disk.

 

Run the Cmd.exe as an administrator.

 

At the DOS prompt execute chkdsk /r

 

Let it finish.

 

Restart the computer when completed.

 

===

 

If the problem persists please check for check the driver updates.

 

https://support.micr...-update-drivers

 

How is the computer running now?

[Carlgrus]

I started running Cmd.exe as administrator yesterday at 10 AM,  The screen went black after about 4 hours except for my cursor and a revolving circle in the lower center, like it's processing something...here I am 20 hours later and it's still doing that...what's your recommendation?  

[nasdaq]

Hi,

 

I need to know if you can enable the Recovery Environment.

 

Open FRST on the compromised computer:

 

copy/paste the following inside the text area of FRST. Once done, click on the Fix button. A file called fixlog.txt should appear on your desktop. Attach it in your next reply.

 

Start::

CMD: bcdedit.exe /set {bootmgr} displaybootmenu yes

CMD: bcdedit.exe /set {default} recoveryenabled yes

End::

 

On completion, a message will come up saying that the fix has been completed and it'll open a log in Notepad

Copy and paste its content in your next reply.

 

Wait for further instructions.

<<<>>>

[Carlgrus]

Good morning; after rebooting, Windows said it's diagnosing my PC, then it said it's repairing disk errors, and finally it booted up, and here's the fixlog.txt

 

Fix result of Farbar Recovery Scan Tool (x64) Version: 23-06-2020
Ran by Carl's Home office (24-06-2020 08:12:14) Run:4
Running from C:\Users\Carl's Home office\Desktop\Spyware Utilities
Loaded Profiles: Carl's Home office
Boot Mode: Normal
==============================================

fixlist content:
*****************
CMD: bcdedit.exe /set {bootmgr} displaybootmenu yes
CMD: bcdedit.exe /set {default} recoveryenabled yes

*****************


========= bcdedit.exe /set {bootmgr} displaybootmenu yes =========

The operation completed successfully.

========= End of CMD: =========


========= bcdedit.exe /set {default} recoveryenabled yes =========

The operation completed successfully.

========= End of CMD: =========


==== End of Fixlog 08:12:16 ====

[nasdaq]

Hi,

 

Navigate to this page and follow the instructions.

 

https://support.micr...eshoot-common-s

 

If at any time you need help please ask before proceeding.

 

p.s.

Additional information on how to enter the RD/

To enter the Recovery Environment with Windows 10, follow the instructions in this tutorial on TenForums

https://www.tenforum...ndows-10-a.html

 

Let me know if the problem persists.

[Carlgrus]

Before I received your response, the PC kicked into doing updates on it's own around noon yesterday.  After 18 hours, right now the screen says is 92% done, so I have to let this finish before I proceed with your next steps.  I'll stay on this, and let you know.  Thanks

[nasdaq]

Are you now able to access the computer?

[Carlgrus]

Since 6:00 AM, the computer says "Working on updates 92% Don't turn off your PC, this will take a while"...Hasn't changed...and this started, as I mentioned, yesterday at noon!!  How long should I wait?  I just came back, it's 12:15, so for over 6 hours that I'm aware of, it's been at 92%!!  Now almost 2:15 PM  still at 92%  any suggestions?

Edited by Carlgrus, 25 June 2020 - 12:08 PM.

[Carlgrus]

Well, finally at 7:00 PM I shut it down, still at 92%....I rebooted...went in followed the instructions you gave me yesterday.  Did the CHKDSK, then the SFC, and finally the DISM...the computer rebooted, and it's working, but still at a snails pace. None of the utilities said they found any problems. Really baffling.  I wonder if my hard drive is simply failing?  Please let me know if you have any other recommendations.  I'm writing all this on my other laptop.  Thanks again. 

 

Good Morning...so, last night around 10 PM, I downdloaded a free program to clearout bad blocks on a hard drive called EaseUS Partition Master 14.0, downloaded it, and ran it during the night.  It took over 4 hours while I slept, and this morning, it identified almost 20 bad blocks, it marks them in red, and makes them read only in case there is data stored there, but they can't be written to...bottom line is - this PC is working like I just took it out of the box!! Crazy but true....so, for the moment it's working fine.  I don't know if you would now suggest any other thing to do.  But please let me know, and thank you very much again.  

Edited by Carlgrus, 26 June 2020 - 04:13 AM.

[nasdaq]

Hi,

 

 

It took over 4 hours while I slept, and this morning, it identified almost 20 bad blocks, it marks them in red, and makes them read only in case there is data stored there

 

The tool found some bad blocks on the hard disk.

They were corrected.

 

I did suggest you execute the FSKDSK in post no 4. the the Cmd.exe failed.

 

You did well stay safe.

 

I will leave this topic open for 6 days

If you need to return please do.

 

p.s.

 

Make sure you have a good back up of all your personal file.

You never know if and when the hard drive will fail.

[Carlgrus]

Thanks again

[nasdaq]

Since the issue appears to be resolved this Topic is closed.

If you need this topic reopened, please tell the moderating team by replying here with the address of the thread. This applies only to the original topic starter. Everyone else please begin a New Topic.