Welcome to MalwareRemoval.com,
What if we told you that you could get malware removal help from experts, and that it was 100% free? MalwareRemoval.com provides free support for people with infected computers. Our help, and the tools we use are always 100% free. No hidden catch. We simply enjoy helping others. You enjoy a clean, safe computer.

Malware Removal Instructions

spected malware although Avast finds no problems

MalwareRemoval.com provides free support for people with infected computers. Using plain language that anyone can understand, our community of volunteer experts will walk you through each step.

spected malware although Avast finds no problems

Unread postby humanerror » April 11th, 2017, 4:36 am

Hello.

I've had a new pc since June and it seems like it's time for its first Malware removal. The free version of Avast I have says I'm free from viruses. But I have another person telling me that the link to a photo that I sent her in a Facebook message has ads on it, when see uses Facebook with her Mac. I can't see those ads in my message. So, I think it might be best first to clean my pc.
You do not have the required permissions to view the files attached to this post.
humanerror
Regular Member
 
Posts: 50
Joined: October 14th, 2008, 8:36 am
Advertisement
Register to Remove

Re: spected malware although Avast finds no problems

Unread postby mAL_rEm018 » April 16th, 2017, 4:53 pm

Hello humanerror,

My apologies for the delay in getting to your topic. If you still need help please do the following..

  • Right-click on FRST64.exe and select Run as administrator.
  • The tool might update. Please allow it to do so.
  • Select Scan.
  • When the scan is over two windows will open, FRST.txt and Addition.txt.
  • Please post the contents of both logs in your next reply.

If you don't require help anymore, I would be grateful if you could let me know in your next reply.

mAL
User avatar
mAL_rEm018
MRU Teacher
MRU Teacher
 
Posts: 1323
Joined: November 11th, 2013, 6:26 pm
Location: Canada

Re: spected malware although Avast finds no problems

Unread postby humanerror » April 17th, 2017, 9:05 am

Hello mAL.

Thanks for your reply. I haven't been helped yet. I attached the logs to this message.
You do not have the required permissions to view the files attached to this post.
humanerror
Regular Member
 
Posts: 50
Joined: October 14th, 2008, 8:36 am

Re: spected malware although Avast finds no problems

Unread postby mAL_rEm018 » April 17th, 2017, 5:57 pm

Please note that all instructions given are customised for this computer only, the tools used may cause damage if used on a computer with different infections.

If you think you have similar problems, please post a log in the Malware Removal forum and wait for help.

Failure to post replies within 3 days will result in this thread being closed.


Hello humanerror,

Welcome back to Malware Removal! My name is mAL_rEm018, but feel free to call me mAL. I will be helping you with your malware related problems :)

Please be aware that removing Malware is a potentially hazardous undertaking. I will take care not to knowingly suggest courses of action that might damage your computer. However it is impossible for me to foresee all interactions that may happen between the software on your computer and those we'll use to clear you of infection, and I cannot guarantee the safety of your system. It is possible that we might encounter situations where the only recourse is to re-format and re-install your operating system, or to necessitate you taking your computer to a repair shop.


Because of this, I advise you to backup any personal files and folders before you start.

To make sure everything goes smoothly, I would like you to observe the following rules:
  • You must have Administrator rights, permissions for this computer.
  • Please reply to this thread. Do not start another topic.
  • Perform all actions in the order given.
  • If you don't know, stop and ask!
  • DO NOT run any other fix or removal tools unless instructed to do so!
  • Don't attempt to install any new software (other than those I ask you to) until your computer is clean.
  • DO NOT post for help at any other forum. Applying fixes from multiple help sites can cause problems.
  • I advise you to print the instructions if possible, since your internet connection might not be available during some of the fixes.
  • Absence of symptoms does not mean that everything is clear, therefore stick with this topic until I give you the "all clear".

Before proceeding, please read and get acquainted with the following topic: HOW TO GET HELP IN THIS FORUM - everyone must read this, where the conditions for receiving help here are explained.

Let's get started.. :)


Backup your registry using TCRB
  • Please download TCRB to your Desktop.
  • Open Tweaking.com Registry Backup.
  • Click on the Backup Registry tab and ensure that all options are checked.
  • Press on Backup Now.
  • Wait until the backup is complete and exit the program.

Adwcleaner
  • Please download AdwCleaner to your Desktop.
  • Close all your programs and right-click AdwCleaner.exe and select Run as administrator.
  • Click on Scan.
  • After the scan is over, select Logfile.
  • A notepad window will open. Please copy/paste the contents in your next reply.
    Note: do not select Clean at this point



-----------------------------------------
In your next reply, I would like to see..
  • Did you have any trouble performing the steps?
  • Adwcleaner report
User avatar
mAL_rEm018
MRU Teacher
MRU Teacher
 
Posts: 1323
Joined: November 11th, 2013, 6:26 pm
Location: Canada

Re: spected malware although Avast finds no problems

Unread postby humanerror » April 20th, 2017, 4:15 pm

Hi mAL:

Everything went well. Thanks for the instructions. Here's the log:

# AdwCleaner v6.045 - Logfile created 20/04/2017 at 23:12:13
# Updated on 28/03/2017 by Malwarebytes
# Database : 2017-04-19.2 [Server]
# Operating System : Windows 10 Home (X64)
# Username : vesam - DESKTOP-QL010TM
# Running from : C:\Users\vesam\Desktop\AdwCleaner.exe
# Mode: Scan
# Support : https://www.malwarebytes.com/support



***** [ Services ] *****

No malicious services found.


***** [ Folders ] *****

Folder Found: C:\Users\vesam\AppData\LocalLow\.acestream
Folder Found: C:\Users\vesam\AppData\Roaming\.acestream
Folder Found: C:\Users\vesam\AppData\Roaming\acestream
Folder Found: C:\_acestream_cache_


***** [ Files ] *****

No malicious files found.


***** [ DLL ] *****

No malicious DLLs found.


***** [ WMI ] *****

No malicious keys found.


***** [ Shortcuts ] *****

No infected shortcut found.


***** [ Scheduled Tasks ] *****

No malicious task found.


***** [ Registry ] *****

Key Found: HKU\S-1-5-21-386011426-3842006082-317715658-1001\Software\Classes\.acestream
Key Found: HKU\S-1-5-21-386011426-3842006082-317715658-1001\Software\Classes\acestream
Key Found: HKCU\Software\Classes\.acestream
Key Found: HKCU\Software\Classes\acestream
Key Found: [x64] HKCU\Software\Classes\.acestream
Key Found: [x64] HKCU\Software\Classes\acestream
Key Found: HKCU\Software\Classes\CLSID\{79690976-ED6E-403C-BBBA-F8928B5EDE17}
Key Found: HKCU\Software\Classes\MIME\Database\Content Type\application/x-acestream-plugin
Key Found: HKCU\SOFTWARE\Classes\MIME\Database\Content Type\application/x-acestream-plugin


***** [ Web browsers ] *****

No malicious Firefox based browser items found.
Chrome pref Found: [C:\Users\vesam\AppData\Local\Google\Chrome\User Data\Default\Secure Preferences ] - nbfhhpdigbbhgijjhhnmionhamjpggio

*************************

C:\AdwCleaner\AdwCleaner[S0].txt - [1855 Bytes] - [20/04/2017 23:12:13]

########## EOF - C:\AdwCleaner\AdwCleaner[S0].txt - [1928 Bytes] ##########
humanerror
Regular Member
 
Posts: 50
Joined: October 14th, 2008, 8:36 am

Re: spected malware although Avast finds no problems

Unread postby mAL_rEm018 » April 21st, 2017, 8:22 am

Hello humanerror,


MSConfig should not be used to disable programs from running as a long term solution. Why did you disable the following?
MSCONFIG\Services: cphs => 3
MSCONFIG\Services: cplspcon => 3
MSCONFIG\Services: gupdate => 2
MSCONFIG\Services: gupdatem => 3
MSCONFIG\Services: igfxCUIService2.0.0.0 => 2
HKLM\...\StartupApproved\Run: => "RTHDVCPL"
HKLM\...\StartupApproved\Run: => "boincmgr"
HKLM\...\StartupApproved\Run: => "boinctray"
HKU\S-1-5-21-386011426-3842006082-317715658-1001\...\StartupApproved\Run: => "OneDrive"



Adwcleaner
  • Close all your programs and right-click AdwCleaner.exe and select Run as administrator.
  • Click on Scan.
  • After the scan is over, select Clean.
  • Note: All programs will be closed and your computer will be rebooted, therefore I advise you to save any unsaved work.
  • A notepad window will open. Please copy/paste the contents in your next reply.


Please run the following fix..

  • Click Start
  • Type notepad.exe in the search programs and files box and click Enter.
  • A blank Notepad page should open.
    • Copy/Paste the contents of the code box below into Notepad.
Code: Select all
CreateRestorePoint:

HKU\S-1-5-21-386011426-3842006082-317715658-1001\...\RunOnce: [Uninstall C:\Users\vesam\AppData\Local\Microsoft\OneDrive\17.3.6390.0509_1\amd64] => C:\WINDOWS\system32\cmd.exe /q /c rmdir /s /q "C:\Users\vesam\AppData\Local\Microsoft\OneDrive\17.3.6390.0509_1\amd64"
2017-03-11 18:36 - 2017-03-11 18:36 - 0010240 _____ () C:\Users\vesam\AppData\Local\Temp\bwmn3xe0.dll
2016-10-17 23:44 - 2016-10-17 23:44 - 0035680 _____ () C:\Users\vesam\AppData\Local\Temp\i4jdel0.exe
2016-10-26 18:09 - 2016-10-26 18:09 - 0737856 _____ (Oracle Corporation) C:\Users\vesam\AppData\Local\Temp\jre-8u111-windows-au.exe
2017-01-24 08:39 - 2017-01-24 08:39 - 0739904 _____ (Oracle Corporation) C:\Users\vesam\AppData\Local\Temp\jre-8u121-windows-au.exe

CMD: type "C:\WINDOWS\system32\{A6D608F0-0BDE-491A-97AE-5C4B05D86E01}.bat"

Hosts:
EmptyTemp:

    • Save it to the same folder/directory that FRST.exe is in, naming it as fixlist.txt

NOTICE: This script was written specifically for this user. Running it on another machine may cause damage to your operating system

  • Start FRST in a similar manner to when you ran a scan earlier, but this time when it opens ....
    • Press the Fix button once and wait.
    • FRST will process fixlist.txt
    • When finished, it will produce a log fixlog.txt in the same folder/directory as FRST64.exe
    • Please post me the log


How is your computer behaving?


-----------------------------------------
In your next reply, I would like to see..
  • Did you encounter any problem while following my instructions?
  • Answer to my question.
  • Adwcleaner report
  • fixlog.txt
  • Update on your computer's behaviour
User avatar
mAL_rEm018
MRU Teacher
MRU Teacher
 
Posts: 1323
Joined: November 11th, 2013, 6:26 pm
Location: Canada

Re: spected malware although Avast finds no problems

Unread postby humanerror » April 21st, 2017, 9:56 am

- No problems, but I made two, hopefully minor mistakes. I saved the fixlist to wrong directory first, but when I moved it to where the frst.exe is, the thing worked. I also clicked "scan" first and after it finished, I clicked "fix". I saw no problems after this either.

- I'm sorry, I was not aware that Msconfig was running. I don't even know how to use it.


# AdwCleaner v6.045 - Logfile created 21/04/2017 at 16:12:09
# Updated on 28/03/2017 by Malwarebytes
# Database : 2017-04-21.1 [Server]
# Operating System : Windows 10 Home (X64)
# Username : vesam - DESKTOP-QL010TM
# Running from : C:\Users\vesam\Desktop\AdwCleaner.exe
# Mode: Clean
# Support : https://www.malwarebytes.com/support



***** [ Services ] *****



***** [ Folders ] *****

[-] Folder deleted: C:\Users\vesam\AppData\LocalLow\.acestream
[-] Folder deleted: C:\Users\vesam\AppData\Roaming\.acestream
[-] Folder deleted: C:\Users\vesam\AppData\Roaming\acestream
[-] Folder deleted: C:\_acestream_cache_


***** [ Files ] *****



***** [ DLL ] *****



***** [ WMI ] *****



***** [ Shortcuts ] *****



***** [ Scheduled Tasks ] *****



***** [ Registry ] *****

[-] Key deleted: HKU\S-1-5-21-386011426-3842006082-317715658-1001\Software\Classes\.acestream
[-] Key deleted: HKU\S-1-5-21-386011426-3842006082-317715658-1001\Software\Classes\acestream
[#] Key deleted on reboot: HKCU\Software\Classes\.acestream
[#] Key deleted on reboot: HKCU\Software\Classes\acestream
[#] Key deleted on reboot: [x64] HKCU\Software\Classes\.acestream
[#] Key deleted on reboot: [x64] HKCU\Software\Classes\acestream
[-] Key deleted: HKCU\Software\Classes\CLSID\{79690976-ED6E-403C-BBBA-F8928B5EDE17}
[-] Key deleted: HKCU\Software\Classes\MIME\Database\Content Type\application/x-acestream-plugin
[#] Key deleted on reboot: HKCU\SOFTWARE\Classes\MIME\Database\Content Type\application/x-acestream-plugin


***** [ Web browsers ] *****

[-] [C:\Users\vesam\AppData\Local\Google\Chrome\User Data\Default] [extension] Deleted: nbfhhpdigbbhgijjhhnmionhamjpggio


*************************

:: "Tracing" keys deleted
:: Winsock settings cleared

*************************

C:\AdwCleaner\AdwCleaner[C0].txt - [1830 Bytes] - [21/04/2017 16:12:09]
C:\AdwCleaner\AdwCleaner[S0].txt - [2015 Bytes] - [20/04/2017 23:12:13]
C:\AdwCleaner\AdwCleaner[S1].txt - [2088 Bytes] - [21/04/2017 16:08:27]

########## EOF - C:\AdwCleaner\AdwCleaner[C0].txt - [2049 Bytes] ##########

Fix result of Farbar Recovery Scan Tool (x64) Version: 20-04-2017
Ran by vesam (21-04-2017 16:37:54) Run:1
Running from C:\Users\vesam\Downloads
Loaded Profiles: vesam (Available Profiles: vesam)
Boot Mode: Normal
==============================================

fixlist content:
*****************
Code: Select all
CreateRestorePoint:

HKU\S-1-5-21-386011426-3842006082-317715658-1001\...\RunOnce: [Uninstall C:\Users\vesam\AppData\Local\Microsoft\OneDrive\17.3.6390.0509_1\amd64] => C:\WINDOWS\system32\cmd.exe /q /c rmdir /s /q "C:\Users\vesam\AppData\Local\Microsoft\OneDrive\17.3.6390.0509_1\amd64"
2017-03-11 18:36 - 2017-03-11 18:36 - 0010240 _____ () C:\Users\vesam\AppData\Local\Temp\bwmn3xe0.dll
2016-10-17 23:44 - 2016-10-17 23:44 - 0035680 _____ () C:\Users\vesam\AppData\Local\Temp\i4jdel0.exe
2016-10-26 18:09 - 2016-10-26 18:09 - 0737856 _____ (Oracle Corporation) C:\Users\vesam\AppData\Local\Temp\jre-8u111-windows-au.exe
2017-01-24 08:39 - 2017-01-24 08:39 - 0739904 _____ (Oracle Corporation) C:\Users\vesam\AppData\Local\Temp\jre-8u121-windows-au.exe

CMD: type "C:\WINDOWS\system32\{A6D608F0-0BDE-491A-97AE-5C4B05D86E01}.bat"

Hosts:
EmptyTemp:
*****************

Code: Select all => Error: No automatic fix found for this entry.
Restore point was successfully created.
HKU\S-1-5-21-386011426-3842006082-317715658-1001\Software\Microsoft\Windows\CurrentVersion\RunOnce\\Uninstall C:\Users\vesam\AppData\Local\Microsoft\OneDrive\17.3.6390.0509_1\amd64 => value removed successfully
C:\Users\vesam\AppData\Local\Temp\bwmn3xe0.dll => moved successfully
C:\Users\vesam\AppData\Local\Temp\i4jdel0.exe => moved successfully
C:\Users\vesam\AppData\Local\Temp\jre-8u111-windows-au.exe => moved successfully
C:\Users\vesam\AppData\Local\Temp\jre-8u121-windows-au.exe => moved successfully

========= type "C:\WINDOWS\system32\{A6D608F0-0BDE-491A-97AE-5C4B05D86E01}.bat" =========

@echo off
if exist igfxEM.exe start igfxEM.exe
if exist igfxHK.exe start igfxHK.exe
if exist igfxTray.exe start igfxTray.exe
del /Q {A6D608F0-0BDE-491A-97AE-5C4B05D86E01}.bat

========= End of CMD: =========

C:\Windows\System32\Drivers\etc\hosts => moved successfully
Hosts restored successfully.

=========== EmptyTemp: ==========

BITS transfer queue => 859088 B
DOMStore, IE Recovery, AppCache, Feeds Cache, Thumbcache, IconCache => 123971949 B
Java, Flash, Steam htmlcache => 558 B
Windows/system/drivers => 19721348 B
Edge => 23065815 B
Chrome => 500694027 B
Firefox => 61547829 B
Opera => 0 B

Temp, IE cache, history, cookies, recent:
Default => 0 B
Users => 0 B
ProgramData => 0 B
Public => 0 B
systemprofile => 128 B
systemprofile32 => 0 B
LocalService => 77520 B
NetworkService => 5086 B
vesam => 715429358 B

RecycleBin => 10185307017 B
EmptyTemp: => 10.8 GB temporary data Removed.

================================


The system needed a reboot.

==== End of Fixlog 16:40:49 ====


- My computer is behaving well.
humanerror
Regular Member
 
Posts: 50
Joined: October 14th, 2008, 8:36 am

Re: spected malware although Avast finds no problems

Unread postby mAL_rEm018 » April 22nd, 2017, 4:33 am

Hello humanerror,

humanerror wrote:- My computer is behaving well.

That's great! We still have more work to do, so please stick with this topic until I give you the all clear.

humanerror wrote:- I'm sorry, I was not aware that Msconfig was running. I don't even know how to use it.

It's not a problem. We will disable them the correct way, but for now I'd like you to do the following..

Please disable your Antivirus as shown in the following topic: How To Temporarily Disable Your Anti-virus, Firewall And Anti-malware Programs

  • Close all opened programs, open your browser and go to the following link: ESET Online Scanner.
  • Click on the SCAN NOW button under ESET Online Scanner.
    • Depending on which browser you are using, you might be prompted to download an executable file.
    • Please save it to your desktop.
    • Right-click on esetonlinescanner_enu.exe and select Run as administrator.
    • If you agree to the Terms of use, select Accept to continue.
  • Please check the following option:
    • Enable detection of potentially unwanted applications
  • Select Advanced settings and ensure that the following options are checked:
    • Enable detection of potentially unsafe applications
    • Enable detection of suspicious applications
    • Scan archives
    • Enable Anti-Stealth technology
  • Make sure that the following option is NOT checked: => Very important!
    • Clean threats automatically
  • Click Scan and the process will now begin. Please do not use your computer while the scan is running.
  • Once the scan is completed, click Copy to clipboard.
  • Open the Start menu and type notepad.exe in the search programs and files box.
  • Press Enter. A blank Notepad page should open, paste the contents inside the window.
  • Save the file as ESETScan.txt.
  • Please copy/paste the contents of ESETScan.txt in your next reply.
  • You can now safely close the program.
    Do not forget to re-activate your Antivirus at this point.


-----------------------------------------
In your next reply, I would like to see..
  • Did you encounter any problem while following my instructions?
  • ESETScan.txt
User avatar
mAL_rEm018
MRU Teacher
MRU Teacher
 
Posts: 1323
Joined: November 11th, 2013, 6:26 pm
Location: Canada

Re: spected malware although Avast finds no problems

Unread postby humanerror » April 22nd, 2017, 3:35 pm

- No problems.

D:\hellsten\muidenjutut\marjanvanhakone\Downloads\bsplayer236.990_clip.exe a variant of Win32/Toolbar.Conduit.B potentially unwanted application,Win32/Toolbar.Conduit.Y potentially unwanted application,Win32/Toolbar.Conduit.A potentially unwanted application
humanerror
Regular Member
 
Posts: 50
Joined: October 14th, 2008, 8:36 am

Re: spected malware although Avast finds no problems

Unread postby mAL_rEm018 » April 23rd, 2017, 11:11 am

Hello humanerror,

Please do the following..

  • Open the Start Menu.
  • In the Search Box, type msconfig and press enter.
  • A window will appear, select the General tab.
  • Put checkmark next to Normal Startup.
  • Select Apply and OK.

Please reboot your computer before proceeding with the next steps.


I need to see a fresh FRST log..

  • Right-click on FRST64.exe and select Run as administrator.
  • Ensure that Addition.txt is checked.
  • Select Scan.
  • When the scan is over two windows will open, FRST.txt and Addition.txt.
  • Please post the contents of both logs in your next reply.


-----------------------------------------
In your next reply, I would like to see..
  • Did you encounter any problem while following my instructions?
  • FRST.txt
  • Addition.txt

Please post each log separately to prevent it being cut off by the forum post size limiter.
Check each after you've posted it to make sure it's all present, if any log is cut off you'll have to post it in sections....
User avatar
mAL_rEm018
MRU Teacher
MRU Teacher
 
Posts: 1323
Joined: November 11th, 2013, 6:26 pm
Location: Canada

Re: spected malware although Avast finds no problems

Unread postby humanerror » April 23rd, 2017, 11:51 am

- No problems.

Scan result of Farbar Recovery Scan Tool (FRST) (x64) Version: 23-04-2017 01
Ran by vesam (administrator) on DESKTOP-QL010TM (23-04-2017 18:48:21)
Running from C:\Users\vesam\Downloads
Loaded Profiles: vesam (Available Profiles: vesam)
Platform: Windows 10 Home Version 1607 (X64) Language: suomi (Suomi)
Internet Explorer Version 11 (Default browser: Edge)
Boot Mode: Normal
Tutorial for Farbar Recovery Scan Tool: http://www.geekstogo.com/forum/topic/33 ... scan-tool/

==================== Processes (Whitelisted) =================

(If an entry is included in the fixlist, the process will be closed. The file will not be moved.)

(Intel Corporation) C:\Windows\System32\igfxCUIService.exe
(AVAST Software) C:\Program Files\AVAST Software\Avast\AvastSvc.exe
(Samsung) C:\Program Files\Samsung\AllShare Framework DMS\1.3.23\AllShareFrameworkManagerDMS.exe
(Samsung Electronics Co.,Ltd) C:\Program Files\Samsung\Samsung Link\Samsung Link.exe
(Samsung Electronics Co.,Ltd) C:\Program Files\Samsung\Samsung Link\Samsung Link.exe
(Samsung) C:\Program Files\Samsung\AllShare Framework DMS\1.3.23\AllShareFrameworkDMS.exe
(AVAST Software s.r.o.) C:\Program Files\AVAST Software\Avast\x64\aswidsagenta.exe
(Intel Corporation) C:\Windows\System32\igfxEM.exe
(Intel Corporation) C:\Windows\System32\igfxHK.exe
() C:\Windows\System32\igfxTray.exe
() C:\Program Files\WindowsApps\Microsoft.SkypeApp_11.13.133.0_x64__kzf8qxf38zg5c\SkypeHost.exe
(Microsoft Corporation) C:\Windows\System32\SettingSyncHost.exe
(Google Inc.) C:\Program Files (x86)\Google\Update\1.3.33.3\GoogleCrashHandler.exe
(Google Inc.) C:\Program Files (x86)\Google\Update\1.3.33.3\GoogleCrashHandler64.exe
(Microsoft Corporation) C:\Windows\System32\smartscreen.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Samsung Electronics Co.,Ltd) C:\Program Files\Samsung\Samsung Link\Samsung Link Tray Agent.exe
(AVAST Software) C:\Program Files\AVAST Software\Avast\AvastUI.exe
(Oracle Corporation) C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe

==================== Registry (Whitelisted) ====================

(If an entry is included in the fixlist, the registry item will be restored to default or removed. The file will not be moved.)

HKLM\...\Run: [RTHDVCPL] => C:\Program Files\Realtek\Audio\HDA\RtkNGUI64.exe [8822016 2016-06-02] (Realtek Semiconductor)
HKLM\...\Run: [Samsung Link] => C:\Program Files\Samsung\Samsung Link\Samsung Link Tray Agent.exe [615144 2016-03-09] (Samsung Electronics Co.,Ltd)
HKLM\...\Run: [boinctray] => C:\Program Files\BOINC\boinctray.exe [69928 2016-06-05] (Space Sciences Laboratory)
HKLM\...\Run: [boincmgr] => C:\Program Files\BOINC\boincmgr.exe [8738088 2016-06-05] (Space Sciences Laboratory)
HKLM\...\Run: [AvastUI.exe] => C:\Program Files\AVAST Software\Avast\AvLaunch.exe [213824 2017-04-05] (AVAST Software)
HKLM-x32\...\Run: [SunJavaUpdateSched] => C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe [587288 2016-12-12] (Oracle Corporation)
HKU\S-1-5-21-386011426-3842006082-317715658-1001\Control Panel\Desktop\\SCRNSAVE.EXE -> C:\WINDOWS\boinc.scr [1163560 2016-06-05] (Space Sciences Laboratory)
ShellIconOverlayIdentifiers: [00asw] -> {472083B0-C522-11CF-8763-00608CC02F24} => C:\Program Files\AVAST Software\Avast\ashShA64.dll [2017-04-05] (AVAST Software)
ShellIconOverlayIdentifiers: [00avast] -> {472083B0-C522-11CF-8763-00608CC02F24} => C:\Program Files\AVAST Software\Avast\ashShA64.dll [2017-04-05] (AVAST Software)

==================== Internet (Whitelisted) ====================

(If an item is included in the fixlist, if it is a registry item it will be removed or restored to default.)

Tcpip\Parameters: [DhcpNameServer] 192.168.8.1 192.168.8.1
Tcpip\..\Interfaces\{294a3d8b-c540-4481-8f5e-4ec86c1c29e1}: [DhcpNameServer] 192.168.8.1 192.168.8.1
Tcpip\..\Interfaces\{ba7207a8-c52b-47df-aaf0-4060a2d7da17}: [DhcpNameServer] 192.168.8.1 192.168.8.1

Internet Explorer:
==================
HKU\S-1-5-21-386011426-3842006082-317715658-1001\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://www.msn.com/?pc=AV01
BHO-x32: Java(tm) Plug-In SSV Helper -> {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} -> C:\Program Files (x86)\Java\jre1.8.0_121\bin\ssv.dll [2017-01-24] (Oracle Corporation)
BHO-x32: Java(tm) Plug-In 2 SSV Helper -> {DBC80044-A445-435b-BC74-9C25C1C588A9} -> C:\Program Files (x86)\Java\jre1.8.0_121\bin\jp2ssv.dll [2017-01-24] (Oracle Corporation)

FireFox:
========
FF DefaultProfile: t1jonrhq.default
FF ProfilePath: C:\Users\vesam\AppData\Roaming\Mozilla\Firefox\Profiles\t1jonrhq.default [2017-04-21]
FF HKLM\...\Firefox\Extensions: [wrc@avast.com] - C:\Program Files\AVAST Software\Avast\WebRep\FF48
FF Extension: (Avast Online Security) - C:\Program Files\AVAST Software\Avast\WebRep\FF48 [2017-04-05]
FF HKLM\...\Firefox\Extensions: [sp@avast.com] - C:\Program Files\AVAST Software\Avast\SafePrice\FF48
FF Extension: (Avast SafePrice) - C:\Program Files\AVAST Software\Avast\SafePrice\FF48 [2017-04-05]
FF HKLM-x32\...\Firefox\Extensions: [wrc@avast.com] - C:\Program Files\AVAST Software\Avast\WebRep\FF48
FF HKLM-x32\...\Firefox\Extensions: [sp@avast.com] - C:\Program Files\AVAST Software\Avast\SafePrice\FF48
FF Plugin: @Microsoft.com/NpCtrl,version=1.0 -> C:\Program Files\Microsoft Silverlight\5.1.50901.0\npctrl.dll [2016-08-31] ( Microsoft Corporation)
FF Plugin-x32: @java.com/DTPlugin,version=11.121.2 -> C:\Program Files (x86)\Java\jre1.8.0_121\bin\dtplugin\npDeployJava1.dll [2017-01-24] (Oracle Corporation)
FF Plugin-x32: @java.com/JavaPlugin,version=11.121.2 -> C:\Program Files (x86)\Java\jre1.8.0_121\bin\plugin2\npjp2.dll [2017-01-24] (Oracle Corporation)
FF Plugin-x32: @Microsoft.com/NpCtrl,version=1.0 -> C:\Program Files (x86)\Microsoft Silverlight\5.1.50901.0\npctrl.dll [2016-08-31] ( Microsoft Corporation)
FF Plugin-x32: @tools.google.com/Google Update;version=3 -> C:\Program Files (x86)\Google\Update\1.3.33.3\npGoogleUpdate3.dll [2017-04-11] (Google Inc.)
FF Plugin-x32: @tools.google.com/Google Update;version=9 -> C:\Program Files (x86)\Google\Update\1.3.33.3\npGoogleUpdate3.dll [2017-04-11] (Google Inc.)

Chrome:
=======
CHR HomePage: Default -> hxxps://easywallet.org/w/U9S4G2iotEMLG4XQhAT6ny
CHR StartupUrls: Default -> "hxxp://www.google.com/"
CHR Profile: C:\Users\vesam\AppData\Local\Google\Chrome\User Data\Default [2017-04-23]
CHR Extension: (Google-presentaatiot) - C:\Users\vesam\AppData\Local\Google\Chrome\User Data\Default\Extensions\aapocclcgogkmnckokdopfmhonfmgoek [2016-07-08]
CHR Extension: (Google-dokumentit) - C:\Users\vesam\AppData\Local\Google\Chrome\User Data\Default\Extensions\aohghmighlieiainnegkcijnfilokake [2016-07-08]
CHR Extension: (Google Drive) - C:\Users\vesam\AppData\Local\Google\Chrome\User Data\Default\Extensions\apdfllckaahabafndbhieahigkjlhalf [2016-07-08]
CHR Extension: (YouTube) - C:\Users\vesam\AppData\Local\Google\Chrome\User Data\Default\Extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo [2016-07-08]
CHR Extension: (Google-taulukot) - C:\Users\vesam\AppData\Local\Google\Chrome\User Data\Default\Extensions\felcaaldnbdncclmgdcncolpebgiejap [2016-07-08]
CHR Extension: (Google Docsin offline-tila) - C:\Users\vesam\AppData\Local\Google\Chrome\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi [2016-07-08]
CHR Extension: (Padlet Mini) - C:\Users\vesam\AppData\Local\Google\Chrome\User Data\Default\Extensions\kcljbbiddpoeaknnjaminoceoojdbikp [2016-08-08]
CHR Extension: (Chrome Web Storen maksut) - C:\Users\vesam\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda [2017-03-09]
CHR Extension: (Notifications for Instagram) - C:\Users\vesam\AppData\Local\Google\Chrome\User Data\Default\Extensions\opnbmdkdflhjiclaoiiifmheknpccalb [2017-04-23]
CHR Extension: (Gmail) - C:\Users\vesam\AppData\Local\Google\Chrome\User Data\Default\Extensions\pjkljhegncpnkpknbcohdijeoejaedia [2016-07-08]
CHR Extension: (Chrome Media Router) - C:\Users\vesam\AppData\Local\Google\Chrome\User Data\Default\Extensions\pkedcjkdefgpdelpbcmbmeomcjbeemfm [2017-04-06]
CHR HKLM-x32\...\Chrome\Extension: [eofcbnmajmjmplflapaojjnihcjkigck] - hxxps://clients2.google.com/service/update2/crx
CHR HKLM-x32\...\Chrome\Extension: [gomekmidlodglbbmalcneegieacbdmki] - hxxps://clients2.google.com/service/update2/crx

==================== Services (Whitelisted) ====================

(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)

R2 AllShare Framework DMS; C:\Program Files\Samsung\AllShare Framework DMS\1.3.23\AllShareFrameworkManagerDMS.exe [404360 2013-12-21] (Samsung) [File not signed]
R3 aswbIDSAgent; C:\Program Files\AVAST Software\Avast\x64\aswidsagenta.exe [7398336 2017-04-05] (AVAST Software s.r.o.)
R2 avast! Antivirus; C:\Program Files\AVAST Software\Avast\AvastSvc.exe [261712 2017-04-05] (AVAST Software)
S3 cplspcon; C:\WINDOWS\system32\IntelCpHDCPSvc.exe [449112 2016-07-28] (Intel Corporation)
R2 igfxCUIService2.0.0.0; C:\WINDOWS\system32\igfxCUIService.exe [374360 2016-07-28] (Intel Corporation)
R2 Samsung Link Service; C:\Program Files\Samsung\Samsung Link\Samsung Link.exe [623848 2016-03-09] (Samsung Electronics Co.,Ltd)
S3 WdNisSvc; C:\Program Files\Windows Defender\NisSrv.exe [347328 2017-03-28] (Microsoft Corporation)
S3 WinDefend; C:\Program Files\Windows Defender\MsMpEng.exe [103720 2017-03-28] (Microsoft Corporation)

===================== Drivers (Whitelisted) ======================

(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)

R1 aswbidsdriver; C:\WINDOWS\system32\drivers\aswbidsdrivera.sys [307736 2017-04-05] (AVAST Software s.r.o.)
R0 aswbidsh; C:\WINDOWS\system32\drivers\aswbidsha.sys [189768 2017-04-05] (AVAST Software s.r.o.)
R0 aswblog; C:\WINDOWS\system32\drivers\aswbloga.sys [334088 2017-04-05] (AVAST Software s.r.o.)
R0 aswbuniv; C:\WINDOWS\system32\drivers\aswbuniva.sys [48528 2017-04-05] (AVAST Software s.r.o.)
S3 aswHwid; C:\WINDOWS\system32\drivers\aswHwid.sys [38296 2017-04-05] (AVAST Software)
R1 aswKbd; C:\WINDOWS\system32\drivers\aswKbd.sys [32600 2017-04-05] (AVAST Software)
R2 aswMonFlt; C:\WINDOWS\system32\drivers\aswMonFlt.sys [127112 2017-04-05] (AVAST Software)
R1 aswRdr; C:\WINDOWS\system32\drivers\aswRdr2.sys [101152 2017-04-05] (AVAST Software)
R0 aswRvrt; C:\WINDOWS\system32\drivers\aswRvrt.sys [75704 2017-04-05] (AVAST Software)
R1 aswSnx; C:\WINDOWS\system32\drivers\aswSnx.sys [1005048 2017-04-05] (AVAST Software)
R1 aswSP; C:\WINDOWS\system32\drivers\aswSP.sys [556784 2017-04-05] (AVAST Software)
R2 aswStm; C:\WINDOWS\system32\drivers\aswStm.sys [164064 2017-04-05] (AVAST Software)
R0 aswVmm; C:\WINDOWS\system32\drivers\aswVmm.sys [339696 2017-04-05] (AVAST Software)
S3 NetAdapterCx; C:\WINDOWS\System32\drivers\NetAdapterCx.sys [90624 2016-07-16] ()
R3 rt640x64; C:\WINDOWS\System32\drivers\rt640x64.sys [589824 2016-07-16] (Realtek )
R3 RtkBtFilter; C:\WINDOWS\system32\DRIVERS\RtkBtfilter.sys [607488 2016-02-25] (Realtek Semiconductor Corporation)
R3 RTWlanE; C:\WINDOWS\System32\drivers\rtwlane.sys [5144064 2016-07-16] (Realtek Semiconductor Corporation )
R1 VBoxNetAdp; C:\WINDOWS\system32\DRIVERS\VBoxNetAdp6.sys [119712 2016-04-18] (Oracle Corporation)
R1 VBoxNetLwf; C:\WINDOWS\system32\DRIVERS\VBoxNetLwf.sys [192352 2016-04-18] (Oracle Corporation)
S3 WdBoot; C:\WINDOWS\system32\drivers\WdBoot.sys [44056 2016-07-16] (Microsoft Corporation)
S3 WdFilter; C:\WINDOWS\system32\drivers\WdFilter.sys [290144 2016-07-16] (Microsoft Corporation)
S3 WdNisDrv; C:\WINDOWS\System32\Drivers\WdNisDrv.sys [123232 2016-07-16] (Microsoft Corporation)

==================== NetSvcs (Whitelisted) ===================

(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)


==================== One Month Created files and folders ========

(If an entry is included in the fixlist, the file/folder will be moved.)

2017-04-23 18:47 - 2017-04-23 18:47 - 00000000 ____D C:\ProgramData\SWCUTemp
2017-04-22 22:34 - 2017-04-22 22:34 - 00000261 _____ C:\Users\vesam\Desktop\ESETScan.txt
2017-04-22 21:47 - 2017-04-22 21:47 - 00000000 ____D C:\Users\vesam\AppData\Local\ESET
2017-04-22 21:46 - 2017-04-22 21:47 - 06752896 _____ (ESET spol. s r.o.) C:\Users\vesam\Desktop\esetonlinescanner_enu.exe
2017-04-21 16:37 - 2017-04-21 16:40 - 00002958 _____ C:\Users\vesam\Downloads\Fixlog.txt
2017-04-20 23:10 - 2017-04-21 16:12 - 00000000 ____D C:\AdwCleaner
2017-04-20 23:10 - 2017-04-20 23:10 - 04089296 _____ C:\Users\vesam\Desktop\AdwCleaner.exe
2017-04-20 23:09 - 2017-04-20 23:09 - 00000207 _____ C:\WINDOWS\tweaking.com-regbackup-DESKTOP-QL010TM-Windows-10-Home-(64-bit).dat
2017-04-20 23:09 - 2017-04-20 23:09 - 00000000 ____D C:\RegBackup
2017-04-20 23:08 - 2017-04-20 23:09 - 00017986 _____ C:\WINDOWS\Tweaking.com - Registry Backup Setup Log.txt
2017-04-20 23:08 - 2017-04-20 23:08 - 00002315 _____ C:\Users\Public\Desktop\Tweaking.com - Registry Backup.lnk
2017-04-20 23:08 - 2017-04-20 23:08 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Tweaking.com
2017-04-20 23:08 - 2017-04-20 23:08 - 00000000 ____D C:\Program Files (x86)\Tweaking.com
2017-04-20 23:07 - 2017-04-20 23:08 - 05766144 _____ (Tweaking.com) C:\Users\vesam\Desktop\tweaking.com_registry_backup_setup.exe
2017-04-17 15:55 - 2017-04-23 18:48 - 00000000 ____D C:\Users\vesam\Downloads\FRST-OlderVersion
2017-04-11 21:45 - 2017-03-28 09:21 - 00167848 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\wscapi.dll
2017-04-11 21:45 - 2017-03-28 09:19 - 00601712 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\oleaut32.dll
2017-04-11 21:45 - 2017-03-28 09:07 - 00263472 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\Windows.Storage.ApplicationData.dll
2017-04-11 21:45 - 2017-03-28 09:05 - 01504056 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\WindowsCodecs.dll
2017-04-11 21:45 - 2017-03-28 09:04 - 02262776 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\iertutil.dll
2017-04-11 21:45 - 2017-03-28 09:04 - 01431232 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\Windows.ApplicationModel.Store.dll
2017-04-11 21:45 - 2017-03-28 09:04 - 00975744 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\twinapi.appcore.dll
2017-04-11 21:45 - 2017-03-28 09:04 - 00861024 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\LicenseManager.dll
2017-04-11 21:45 - 2017-03-28 08:59 - 06667520 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\Windows.Media.Protection.PlayReady.dll
2017-04-11 21:45 - 2017-03-28 08:58 - 20967840 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\shell32.dll
2017-04-11 21:45 - 2017-03-28 08:52 - 00306800 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\Windows.Media.MediaControl.dll
2017-04-11 21:45 - 2017-03-28 08:48 - 05685760 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\Windows.Data.Pdf.dll
2017-04-11 21:45 - 2017-03-28 08:42 - 00095232 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\UserDataTimeUtil.dll
2017-04-11 21:45 - 2017-03-28 08:42 - 00051712 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\usoapi.dll
2017-04-11 21:45 - 2017-03-28 08:40 - 00224256 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\ExSMime.dll
2017-04-11 21:45 - 2017-03-28 08:40 - 00049664 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\XblAuthManagerProxy.dll
2017-04-11 21:45 - 2017-03-28 08:39 - 00040960 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\TokenBrokerUI.dll
2017-04-11 21:45 - 2017-03-28 08:38 - 00584192 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\UIRibbonRes.dll
2017-04-11 21:45 - 2017-03-28 08:38 - 00156672 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\UserDeviceRegistration.dll
2017-04-11 21:45 - 2017-03-28 08:38 - 00070656 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\XblAuthTokenBrokerExt.dll
2017-04-11 21:45 - 2017-03-28 08:37 - 00255488 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\unimdm.tsp
2017-04-11 21:45 - 2017-03-28 08:37 - 00215552 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\apds.dll
2017-04-11 21:45 - 2017-03-28 08:37 - 00177664 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\Windows.Web.Diagnostics.dll
2017-04-11 21:45 - 2017-03-28 08:37 - 00097792 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\Windows.System.SystemManagement.dll
2017-04-11 21:45 - 2017-03-28 08:36 - 00769024 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\ipsecsnp.dll
2017-04-11 21:45 - 2017-03-28 08:36 - 00136192 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\WinRtTracing.dll
2017-04-11 21:45 - 2017-03-28 08:36 - 00094208 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\Windows.StateRepositoryClient.dll
2017-04-11 21:45 - 2017-03-28 08:36 - 00059904 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\Windows.System.UserDeviceAssociation.dll
2017-04-11 21:45 - 2017-03-28 08:35 - 00392192 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\Windows.Gaming.Input.dll
2017-04-11 21:45 - 2017-03-28 08:35 - 00315904 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\Windows.Gaming.XboxLive.Storage.dll
2017-04-11 21:45 - 2017-03-28 08:35 - 00180224 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\InstallAgent.exe
2017-04-11 21:45 - 2017-03-28 08:35 - 00118272 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\AppointmentActivation.dll
2017-04-11 21:45 - 2017-03-28 08:35 - 00092672 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\Windows.ApplicationModel.Background.SystemEventsBroker.dll
2017-04-11 21:45 - 2017-03-28 08:34 - 00299520 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\UserDataAccountApis.dll
2017-04-11 21:45 - 2017-03-28 08:34 - 00237568 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\SyncSettings.dll
2017-04-11 21:45 - 2017-03-28 08:34 - 00117760 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\AuthBroker.dll
2017-04-11 21:45 - 2017-03-28 08:34 - 00115712 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\Windows.ApplicationModel.Core.dll
2017-04-11 21:45 - 2017-03-28 08:33 - 00557568 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\StoreAgent.dll
2017-04-11 21:45 - 2017-03-28 08:33 - 00436736 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\ipsmsnap.dll
2017-04-11 21:45 - 2017-03-28 08:33 - 00265728 _____ C:\WINDOWS\SysWOW64\Windows.Perception.Stub.dll
2017-04-11 21:45 - 2017-03-28 08:32 - 01243136 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\Windows.Media.FaceAnalysis.dll
2017-04-11 21:45 - 2017-03-28 08:32 - 00426496 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\Windows.ApplicationModel.Wallet.dll
2017-04-11 21:45 - 2017-03-28 08:32 - 00325120 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\oleacc.dll
2017-04-11 21:45 - 2017-03-28 08:32 - 00306176 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\ieproxy.dll
2017-04-11 21:45 - 2017-03-28 08:32 - 00223232 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\InstallAgentUserBroker.exe
2017-04-11 21:45 - 2017-03-28 08:32 - 00218624 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\WwaApi.dll
2017-04-11 21:45 - 2017-03-28 08:32 - 00206336 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\vaultcli.dll
2017-04-11 21:45 - 2017-03-28 08:32 - 00185856 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\Windows.Security.Authentication.Identity.Provider.dll
2017-04-11 21:45 - 2017-03-28 08:32 - 00175616 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\Windows.Devices.Scanners.dll
2017-04-11 21:45 - 2017-03-28 08:31 - 00711680 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\wuapi.dll
2017-04-11 21:45 - 2017-03-28 08:31 - 00431616 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\efswrt.dll
2017-04-11 21:45 - 2017-03-28 08:30 - 00846336 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\WebcamUi.dll
2017-04-11 21:45 - 2017-03-28 08:30 - 00819200 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\AppContracts.dll
2017-04-11 21:45 - 2017-03-28 08:30 - 00816640 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\NaturalLanguage6.dll
2017-04-11 21:45 - 2017-03-28 08:30 - 00787968 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\sbe.dll
2017-04-11 21:45 - 2017-03-28 08:30 - 00340480 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\iedkcs32.dll
2017-04-11 21:45 - 2017-03-28 08:30 - 00075264 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\updatepolicy.dll
2017-04-11 21:45 - 2017-03-28 08:29 - 00747520 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\Windows.Media.Ocr.dll
2017-04-11 21:45 - 2017-03-28 08:29 - 00529920 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\StructuredQuery.dll
2017-04-11 21:45 - 2017-03-28 08:29 - 00284672 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\Windows.ApplicationModel.dll
2017-04-11 21:45 - 2017-03-28 08:28 - 00755712 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\kerberos.dll
2017-04-11 21:45 - 2017-03-28 08:28 - 00661504 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\WpcWebFilter.dll
2017-04-11 21:45 - 2017-03-28 08:28 - 00584192 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\Windows.Security.Authentication.Web.Core.dll
2017-04-11 21:45 - 2017-03-28 08:28 - 00500224 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\Windows.Graphics.Printing.dll
2017-04-11 21:45 - 2017-03-28 08:26 - 01534464 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\Windows.Graphics.Printing.3D.dll
2017-04-11 21:45 - 2017-03-28 08:26 - 00468992 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\Windows.UI.Xaml.InkControls.dll
2017-04-11 21:45 - 2017-03-28 08:25 - 02333184 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\WsmSvc.dll
2017-04-11 21:45 - 2017-03-28 08:25 - 01196544 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\wscui.cpl
2017-04-11 21:45 - 2017-03-28 08:24 - 04614656 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\Windows.Media.dll
2017-04-11 21:45 - 2017-03-28 08:23 - 00886272 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\aadtb.dll
2017-04-11 21:45 - 2017-03-28 08:23 - 00589312 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\Windows.Devices.Sensors.dll
2017-04-11 21:45 - 2017-03-28 08:22 - 00516096 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\wlidcli.dll
2017-04-11 21:45 - 2017-03-28 08:22 - 00355328 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\RTMediaFrame.dll
2017-04-11 21:45 - 2017-03-28 08:21 - 01077760 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\Windows.Media.Editing.dll
2017-04-11 21:45 - 2017-03-28 08:19 - 00713216 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\wpnapps.dll
2017-04-11 21:45 - 2017-03-28 08:19 - 00343040 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\PlayToDevice.dll
2017-04-11 21:45 - 2017-03-28 08:18 - 01255936 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\AzureSettingSyncProvider.dll
2017-04-11 21:45 - 2017-03-28 08:17 - 00220672 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\PlayToReceiver.dll
2017-04-11 21:45 - 2017-03-28 08:17 - 00090624 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\olepro32.dll
2017-04-11 21:45 - 2017-03-28 08:14 - 07468544 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\mstscax.dll
2017-04-11 21:45 - 2017-03-28 08:14 - 03520512 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\xpsrchvw.exe
2017-04-11 21:45 - 2017-03-28 08:14 - 00400384 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\PlayToManager.dll
2017-04-11 21:45 - 2017-03-28 08:13 - 06045184 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\Chakra.dll
2017-04-11 21:45 - 2017-03-28 08:13 - 01656320 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\Windows.Devices.Perception.dll
2017-04-11 21:45 - 2017-03-28 08:13 - 01232384 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\Windows.UI.Xaml.Maps.dll
2017-04-11 21:45 - 2017-03-28 08:13 - 01170944 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\Windows.Media.Speech.dll
2017-04-11 21:45 - 2017-03-28 08:13 - 00079360 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\asycfilt.dll
2017-04-11 21:45 - 2017-03-28 08:12 - 02682880 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\netshell.dll
2017-04-11 21:45 - 2017-03-28 08:12 - 02026496 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\inetcpl.cpl
2017-04-11 21:45 - 2017-03-28 08:12 - 01509376 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\ieapfltr.dll
2017-04-11 21:45 - 2017-03-28 08:12 - 01013248 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\Windows.Web.Http.dll
2017-04-11 21:45 - 2017-03-28 08:12 - 01004544 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\Windows.UI.Input.Inking.dll
2017-04-11 21:45 - 2017-03-28 08:12 - 00862208 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\SettingSyncCore.dll
2017-04-11 21:45 - 2017-03-28 08:12 - 00827904 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\twinui.appcore.dll
2017-04-11 21:45 - 2017-03-28 08:12 - 00691200 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\TokenBroker.dll
2017-04-11 21:45 - 2017-03-28 08:12 - 00620544 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\Windows.UI.dll
2017-04-11 21:45 - 2017-03-28 08:12 - 00598528 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\Windows.Web.dll
2017-04-11 21:45 - 2017-03-28 08:11 - 02994176 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\win32kfull.sys
2017-04-11 21:45 - 2017-03-28 08:11 - 02646528 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\CertEnroll.dll
2017-04-11 21:45 - 2017-03-28 08:11 - 01600000 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\urlmon.dll
2017-04-11 21:45 - 2017-03-28 08:11 - 01170944 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\Windows.UI.Xaml.Phone.dll
2017-04-11 21:45 - 2017-03-28 08:10 - 02483200 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\wininet.dll
2017-04-11 21:45 - 2017-03-28 08:09 - 03106304 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\mstsc.exe
2017-04-11 21:45 - 2017-03-28 08:08 - 00783360 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\TSWorkspace.dll
2017-04-11 21:45 - 2017-03-28 08:08 - 00299008 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\RADCUI.dll
2017-04-11 21:44 - 2017-03-28 10:10 - 00484584 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\AudioSes.dll
2017-04-11 21:44 - 2017-03-28 10:10 - 00315744 _____ (Adobe Systems Incorporated) C:\WINDOWS\SysWOW64\atmfd.dll
2017-04-11 21:44 - 2017-03-28 09:18 - 01705976 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\KernelBase.dll
2017-04-11 21:44 - 2017-03-28 09:15 - 02048496 _____ C:\WINDOWS\SysWOW64\CoreUIComponents.dll
2017-04-11 21:44 - 2017-03-28 09:04 - 05721808 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\windows.storage.dll
2017-04-11 21:44 - 2017-03-28 09:04 - 00136032 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\CloudExperienceHostUser.dll
2017-04-11 21:44 - 2017-03-28 09:04 - 00116568 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\CloudExperienceHostCommon.dll
2017-04-11 21:44 - 2017-03-28 09:02 - 01980768 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\msxml6.dll
2017-04-11 21:44 - 2017-03-28 09:02 - 00846560 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\WinTypes.dll
2017-04-11 21:44 - 2017-03-28 09:02 - 00576408 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\wer.dll
2017-04-11 21:44 - 2017-03-28 08:59 - 04023008 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\mfcore.dll
2017-04-11 21:44 - 2017-03-28 08:58 - 01851688 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\mfmp4srcsnk.dll
2017-04-11 21:44 - 2017-03-28 08:58 - 01360464 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\mfnetsrc.dll
2017-04-11 21:44 - 2017-03-28 08:58 - 01344448 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\mfsrcsnk.dll
2017-04-11 21:44 - 2017-03-28 08:58 - 01277856 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\mfasfsrcsnk.dll
2017-04-11 21:44 - 2017-03-28 08:58 - 01202936 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\mfmpeg2srcsnk.dll
2017-04-11 21:44 - 2017-03-28 08:58 - 00981888 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\mfnetcore.dll
2017-04-11 21:44 - 2017-03-28 08:58 - 00961192 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\ole32.dll
2017-04-11 21:44 - 2017-03-28 08:53 - 01414728 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\gdi32full.dll
2017-04-11 21:44 - 2017-03-28 08:53 - 00545944 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\fontdrvhost.exe
2017-04-11 21:44 - 2017-03-28 08:41 - 00026112 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\odbcconf.dll
2017-04-11 21:44 - 2017-03-28 08:40 - 00037376 _____ (Adobe Systems) C:\WINDOWS\SysWOW64\atmlib.dll
2017-04-11 21:44 - 2017-03-28 08:39 - 00141824 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\Windows.Devices.Radios.dll
2017-04-11 21:44 - 2017-03-28 08:38 - 00081408 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\mshtmled.dll
2017-04-11 21:44 - 2017-03-28 08:37 - 00138240 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\DisplayManager.dll
2017-04-11 21:44 - 2017-03-28 08:37 - 00123904 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\Windows.Networking.HostName.dll
2017-04-11 21:44 - 2017-03-28 08:36 - 00129024 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\Windows.Devices.SerialCommunication.dll
2017-04-11 21:44 - 2017-03-28 08:36 - 00087040 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\Windows.Networking.ServiceDiscovery.Dnssd.dll
2017-04-11 21:44 - 2017-03-28 08:35 - 00505856 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\bcastdvr.exe
2017-04-11 21:44 - 2017-03-28 08:35 - 00374784 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\Windows.Devices.LowLevel.dll
2017-04-11 21:44 - 2017-03-28 08:35 - 00231936 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\Windows.ApplicationModel.LockScreen.dll
2017-04-11 21:44 - 2017-03-28 08:35 - 00184320 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\UserMgrProxy.dll
2017-04-11 21:44 - 2017-03-28 08:35 - 00142336 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\Windows.Devices.WiFi.dll
2017-04-11 21:44 - 2017-03-28 08:35 - 00113152 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\Windows.Devices.Lights.dll
2017-04-11 21:44 - 2017-03-28 08:33 - 00670208 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\Windows.Devices.PointOfService.dll
2017-04-11 21:44 - 2017-03-28 08:33 - 00609280 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\Windows.Media.Import.dll
2017-04-11 21:44 - 2017-03-28 08:33 - 00483840 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\Windows.Devices.AllJoyn.dll
2017-04-11 21:44 - 2017-03-28 08:33 - 00270336 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\dxtrans.dll
2017-04-11 21:44 - 2017-03-28 08:32 - 00562176 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\Windows.Devices.SmartCards.dll
2017-04-11 21:44 - 2017-03-28 08:32 - 00386048 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\Windows.Devices.WiFiDirect.dll
2017-04-11 21:44 - 2017-03-28 08:32 - 00332288 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\Windows.Internal.Bluetooth.dll
2017-04-11 21:44 - 2017-03-28 08:32 - 00298496 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\Windows.Internal.Management.dll
2017-04-11 21:44 - 2017-03-28 08:32 - 00284672 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\apprepsync.dll
2017-04-11 21:44 - 2017-03-28 08:32 - 00271360 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\deviceaccess.dll
2017-04-11 21:44 - 2017-03-28 08:32 - 00202752 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\Windows.Devices.HumanInterfaceDevice.dll
2017-04-11 21:44 - 2017-03-28 08:32 - 00125952 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\apprepapi.dll
2017-04-11 21:44 - 2017-03-28 08:31 - 00498688 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\mbsmsapi.dll
2017-04-11 21:44 - 2017-03-28 08:31 - 00390656 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\CredProvDataModel.dll
2017-04-11 21:44 - 2017-03-28 08:31 - 00236544 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\webcheck.dll
2017-04-11 21:44 - 2017-03-28 08:30 - 00262144 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\Windows.Devices.Picker.dll
2017-04-11 21:44 - 2017-03-28 08:29 - 00314368 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\Windows.Devices.Usb.dll
2017-04-11 21:44 - 2017-03-28 08:29 - 00238080 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\AboveLockAppHost.dll
2017-04-11 21:44 - 2017-03-28 08:27 - 00288256 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\CryptoWinRT.dll
2017-04-11 21:44 - 2017-03-28 08:26 - 00313856 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\AppXDeploymentClient.dll
2017-04-11 21:44 - 2017-03-28 08:25 - 18364928 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\edgehtml.dll
2017-04-11 21:44 - 2017-03-28 08:25 - 00653312 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\Windows.AccountsControl.dll
2017-04-11 21:44 - 2017-03-28 08:24 - 19416576 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\mshtml.dll
2017-04-11 21:44 - 2017-03-28 08:24 - 06474752 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\mspaint.exe
2017-04-11 21:44 - 2017-03-28 08:24 - 00901120 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\Windows.Devices.Bluetooth.dll
2017-04-11 21:44 - 2017-03-28 08:24 - 00675840 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\Windows.Networking.dll
2017-04-11 21:44 - 2017-03-28 08:23 - 03733504 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\D3DCompiler_47.dll
2017-04-11 21:44 - 2017-03-28 08:23 - 00691712 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\msfeeds.dll
2017-04-11 21:44 - 2017-03-28 08:23 - 00395264 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\dmenrollengine.dll
2017-04-11 21:44 - 2017-03-28 08:22 - 00157696 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\enrollmentapi.dll
2017-04-11 21:44 - 2017-03-28 08:20 - 03307008 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\MFMediaEngine.dll
2017-04-11 21:44 - 2017-03-28 08:20 - 00795648 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\MiracastReceiver.dll
2017-04-11 21:44 - 2017-03-28 08:20 - 00078336 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\mfmjpegdec.dll
2017-04-11 21:44 - 2017-03-28 08:19 - 00746496 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\msdtcprx.dll
2017-04-11 21:44 - 2017-03-28 08:19 - 00248832 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\dlnashext.dll
2017-04-11 21:44 - 2017-03-28 08:19 - 00141312 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\dialclient.dll
2017-04-11 21:44 - 2017-03-28 08:18 - 12181504 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\ieframe.dll
2017-04-11 21:44 - 2017-03-28 08:17 - 06109696 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\mos.dll
2017-04-11 21:44 - 2017-03-28 08:17 - 00895488 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\Windows.Media.Streaming.dll
2017-04-11 21:44 - 2017-03-28 08:16 - 03198464 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\cdp.dll
2017-04-11 21:44 - 2017-03-28 08:16 - 01221120 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\Windows.Media.Audio.dll
2017-04-11 21:44 - 2017-03-28 08:16 - 00134144 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\ErrorDetails.dll
2017-04-11 21:44 - 2017-03-28 08:15 - 01247232 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\Windows.Globalization.dll
2017-04-11 21:44 - 2017-03-28 08:14 - 00641024 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\MCRecvSrc.dll
2017-04-11 21:44 - 2017-03-28 08:14 - 00357376 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\Geolocation.dll
2017-04-11 21:44 - 2017-03-28 08:14 - 00103936 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\Windows.Media.Devices.dll
2017-04-11 21:44 - 2017-03-28 08:13 - 02138112 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\InputService.dll
2017-04-11 21:44 - 2017-03-28 08:12 - 00654336 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\MbaeApiPublic.dll
2017-04-11 21:44 - 2017-03-28 08:12 - 00566784 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\ShareHost.dll
2017-04-11 21:44 - 2017-03-28 08:12 - 00542208 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\Windows.Networking.Connectivity.dll
2017-04-11 21:44 - 2017-03-28 08:12 - 00348160 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\Windows.Devices.Midi.dll
2017-04-11 21:44 - 2017-03-28 08:11 - 01576448 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\actxprxy.dll
2017-04-11 21:44 - 2017-03-28 08:11 - 00751104 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\Windows.Networking.BackgroundTransfer.dll
2017-04-11 21:44 - 2017-03-28 08:08 - 01564160 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\quartz.dll
2017-04-11 21:44 - 2017-03-28 07:48 - 00483840 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\CoreMessaging.dll
2017-04-11 21:44 - 2017-03-16 07:38 - 00034088 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\CompPkgSup.dll
2017-04-11 21:39 - 2017-03-28 09:12 - 00328008 _____ (Microsoft Corporation) C:\WINDOWS\system32\Windows.Storage.ApplicationData.dll
2017-04-11 21:39 - 2017-03-28 09:05 - 08168512 _____ (Microsoft Corporation) C:\WINDOWS\system32\Windows.Media.Protection.PlayReady.dll
2017-04-11 21:39 - 2017-03-28 08:36 - 00123904 _____ (Microsoft Corporation) C:\WINDOWS\system32\mssprxy.dll
2017-04-11 21:39 - 2017-03-28 08:33 - 00467968 _____ (Microsoft Corporation) C:\WINDOWS\system32\Windows.Gaming.XboxLive.Storage.dll
2017-04-11 21:39 - 2017-03-28 08:33 - 00193536 _____ (Microsoft Corporation) C:\WINDOWS\system32\WinRtTracing.dll
2017-04-11 21:39 - 2017-03-28 08:33 - 00149504 _____ (Microsoft Corporation) C:\WINDOWS\system32\Windows.ApplicationModel.Core.dll
2017-04-11 21:39 - 2017-03-28 08:33 - 00122880 _____ (Microsoft Corporation) C:\WINDOWS\system32\Windows.StateRepositoryClient.dll
2017-04-11 21:39 - 2017-03-28 08:33 - 00082432 _____ (Microsoft Corporation) C:\WINDOWS\system32\Windows.System.UserDeviceAssociation.dll
2017-04-11 21:39 - 2017-03-28 08:31 - 00547840 _____ (Microsoft Corporation) C:\WINDOWS\system32\Windows.Gaming.Input.dll
2017-04-11 21:39 - 2017-03-28 08:28 - 00358912 _____ (Microsoft Corporation) C:\WINDOWS\system32\Windows.ApplicationModel.dll
2017-04-11 21:39 - 2017-03-28 08:27 - 01060352 _____ (Microsoft Corporation) C:\WINDOWS\system32\AppContracts.dll
2017-04-11 21:39 - 2017-03-28 08:14 - 01643008 _____ (Microsoft Corporation) C:\WINDOWS\system32\Windows.Media.Speech.dll
2017-04-11 21:39 - 2017-03-28 08:14 - 01080320 _____ (Microsoft Corporation) C:\WINDOWS\system32\Windows.Media.Ocr.dll
2017-04-11 21:39 - 2017-03-28 08:10 - 02424320 _____ (Microsoft Corporation) C:\WINDOWS\system32\Windows.Devices.Perception.dll
2017-04-11 21:38 - 2017-03-28 09:32 - 00198856 _____ (Microsoft Corporation) C:\WINDOWS\system32\wscapi.dll
2017-04-11 21:38 - 2017-03-28 09:29 - 02213248 _____ (Microsoft Corporation) C:\WINDOWS\system32\KernelBase.dll
2017-04-11 21:38 - 2017-03-28 09:28 - 07786336 _____ (Microsoft Corporation) C:\WINDOWS\system32\ntoskrnl.exe
2017-04-11 21:38 - 2017-03-28 09:28 - 00773720 _____ (Microsoft Corporation) C:\WINDOWS\system32\oleaut32.dll
2017-04-11 21:38 - 2017-03-28 09:26 - 00218520 _____ (Microsoft Corporation) C:\WINDOWS\system32\LsaIso.exe
2017-04-11 21:38 - 2017-03-28 09:20 - 01181024 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\ndis.sys
2017-04-11 21:38 - 2017-03-28 09:11 - 02187616 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\dxgkrnl.sys
2017-04-11 21:38 - 2017-03-28 09:11 - 01860288 _____ (Microsoft Corporation) C:\WINDOWS\system32\Windows.ApplicationModel.Store.dll
2017-04-11 21:38 - 2017-03-28 09:11 - 01738560 _____ (Microsoft Corporation) C:\WINDOWS\system32\WindowsCodecs.dll
2017-04-11 21:38 - 2017-03-28 09:11 - 00402784 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\dxgmms1.sys
2017-04-11 21:38 - 2017-03-28 09:11 - 00360040 _____ (Microsoft Corporation) C:\WINDOWS\system32\SystemSettingsAdminFlows.exe
2017-04-11 21:38 - 2017-03-28 09:10 - 07220184 _____ (Microsoft Corporation) C:\WINDOWS\system32\windows.storage.dll
2017-04-11 21:38 - 2017-03-28 09:10 - 02758648 _____ (Microsoft Corporation) C:\WINDOWS\system32\iertutil.dll
2017-04-11 21:38 - 2017-03-28 09:10 - 01293152 _____ (Microsoft Corporation) C:\WINDOWS\system32\LicenseManager.dll
2017-04-11 21:38 - 2017-03-28 09:10 - 01157008 _____ (Microsoft Corporation) C:\WINDOWS\system32\twinapi.appcore.dll
2017-04-11 21:38 - 2017-03-28 09:09 - 02446704 _____ (Microsoft Corporation) C:\WINDOWS\system32\msxml6.dll
2017-04-11 21:38 - 2017-03-28 09:09 - 00624048 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\cng.sys
2017-04-11 21:38 - 2017-03-28 09:09 - 00097128 _____ (Microsoft Corporation) C:\WINDOWS\system32\Windows.Security.Credentials.UI.CredentialPicker.dll
2017-04-11 21:38 - 2017-03-28 09:06 - 00092512 _____ (Microsoft Corporation) C:\WINDOWS\system32\rdpudd.dll
2017-04-11 21:38 - 2017-03-28 09:05 - 22221368 _____ (Microsoft Corporation) C:\WINDOWS\system32\shell32.dll
2017-04-11 21:38 - 2017-03-28 09:05 - 04260576 _____ (Microsoft Corporation) C:\WINDOWS\system32\mfcore.dll
2017-04-11 21:38 - 2017-03-28 09:05 - 01988048 _____ (Microsoft Corporation) C:\WINDOWS\system32\mfmp4srcsnk.dll
2017-04-11 21:38 - 2017-03-28 09:05 - 01848584 _____ (Microsoft Corporation) C:\WINDOWS\system32\mfsrcsnk.dll
2017-04-11 21:38 - 2017-03-28 09:05 - 01702392 _____ (Microsoft Corporation) C:\WINDOWS\system32\mfasfsrcsnk.dll
2017-04-11 21:38 - 2017-03-28 09:05 - 01302136 _____ (Microsoft Corporation) C:\WINDOWS\system32\mfmpeg2srcsnk.dll
2017-04-11 21:38 - 2017-03-28 09:05 - 01072248 _____ (Microsoft Corporation) C:\WINDOWS\system32\mfnetcore.dll
2017-04-11 21:38 - 2017-03-28 09:04 - 01600632 _____ (Microsoft Corporation) C:\WINDOWS\system32\sppobjs.dll
2017-04-11 21:38 - 2017-03-28 08:59 - 02533728 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\tcpip.sys
2017-04-11 21:38 - 2017-03-28 08:58 - 00387872 _____ (Microsoft Corporation) C:\WINDOWS\system32\wmpps.dll
2017-04-11 21:38 - 2017-03-28 08:41 - 00372736 _____ (Microsoft Corporation) C:\WINDOWS\system32\RDXTaskFactory.dll
2017-04-11 21:38 - 2017-03-28 08:38 - 00119808 _____ (Microsoft Corporation) C:\WINDOWS\system32\UserDataTimeUtil.dll
2017-04-11 21:38 - 2017-03-28 08:37 - 22568960 _____ (Microsoft Corporation) C:\WINDOWS\system32\edgehtml.dll
2017-04-11 21:38 - 2017-03-28 08:37 - 00078848 _____ (Microsoft Corporation) C:\WINDOWS\system32\XblAuthManagerProxy.dll
2017-04-11 21:38 - 2017-03-28 08:37 - 00053248 _____ (Microsoft Corporation) C:\WINDOWS\system32\musdialoghandlers.dll
2017-04-11 21:38 - 2017-03-28 08:36 - 00584192 _____ (Microsoft Corporation) C:\WINDOWS\system32\UIRibbonRes.dll
2017-04-11 21:38 - 2017-03-28 08:36 - 00237568 _____ (Microsoft Corporation) C:\WINDOWS\system32\Windows.Web.Diagnostics.dll
2017-04-11 21:38 - 2017-03-28 08:36 - 00216576 _____ (Microsoft Corporation) C:\WINDOWS\system32\RdpRelayTransport.dll
2017-04-11 21:38 - 2017-03-28 08:36 - 00030208 _____ (Microsoft Corporation) C:\WINDOWS\system32\odbcconf.dll
2017-04-11 21:38 - 2017-03-28 08:35 - 00233472 _____ (Microsoft Corporation) C:\WINDOWS\system32\MusNotification.exe
2017-04-11 21:38 - 2017-03-28 08:35 - 00156160 _____ (Microsoft Corporation) C:\WINDOWS\system32\Family.Client.dll
2017-04-11 21:38 - 2017-03-28 08:35 - 00124416 _____ (Microsoft Corporation) C:\WINDOWS\system32\Windows.System.SystemManagement.dll
2017-04-11 21:38 - 2017-03-28 08:35 - 00093696 _____ (Microsoft Corporation) C:\WINDOWS\system32\MusNotificationUx.exe
2017-04-11 21:38 - 2017-03-28 08:34 - 00295424 _____ (Microsoft Corporation) C:\WINDOWS\system32\unimdm.tsp
2017-04-11 21:38 - 2017-03-28 08:34 - 00259072 _____ (Microsoft Corporation) C:\WINDOWS\system32\Family.SyncEngine.dll
2017-04-11 21:38 - 2017-03-28 08:34 - 00129536 _____ (Microsoft Corporation) C:\WINDOWS\system32\SettingsHandlers_ClosedCaptioning.dll
2017-04-11 21:38 - 2017-03-28 08:34 - 00113664 _____ (Microsoft Corporation) C:\WINDOWS\system32\Windows.Networking.ServiceDiscovery.Dnssd.dll
2017-04-11 21:38 - 2017-03-28 08:34 - 00088064 _____ (Microsoft Corporation) C:\WINDOWS\system32\XblAuthTokenBrokerExt.dll
2017-04-11 21:38 - 2017-03-28 08:33 - 00196096 _____ (Microsoft Corporation) C:\WINDOWS\system32\UserDeviceRegistration.dll
2017-04-11 21:38 - 2017-03-28 08:33 - 00101888 _____ (Microsoft Corporation) C:\WINDOWS\system32\UserDeviceRegistration.Ngc.dll
2017-04-11 21:38 - 2017-03-28 08:32 - 00368640 _____ (Microsoft Corporation) C:\WINDOWS\system32\OneBackupHandler.dll
2017-04-11 21:38 - 2017-03-28 08:31 - 00418304 _____ C:\WINDOWS\system32\Windows.Perception.Stub.dll
2017-04-11 21:38 - 2017-03-28 08:31 - 00418304 _____ (Microsoft Corporation) C:\WINDOWS\system32\Windows.UI.BlockedShutdown.dll
2017-04-11 21:38 - 2017-03-28 08:31 - 00360448 _____ (Microsoft Corporation) C:\WINDOWS\system32\rdpencom.dll
2017-04-11 21:38 - 2017-03-28 08:31 - 00337408 _____ (Microsoft Corporation) C:\WINDOWS\system32\NetworkBindingEngineMigPlugin.dll
2017-04-11 21:38 - 2017-03-28 08:31 - 00289792 _____ (Microsoft Corporation) C:\WINDOWS\system32\DeveloperOptionsSettingsHandlers.dll
2017-04-11 21:38 - 2017-03-28 08:31 - 00276992 _____ (Microsoft Corporation) C:\WINDOWS\system32\dxtrans.dll
2017-04-11 21:38 - 2017-03-28 08:31 - 00223744 _____ (Microsoft Corporation) C:\WINDOWS\system32\ie4uinit.exe
2017-04-11 21:38 - 2017-03-28 08:31 - 00211968 _____ (Microsoft Corporation) C:\WINDOWS\system32\InstallAgent.exe
2017-04-11 21:38 - 2017-03-28 08:30 - 00748544 _____ (Microsoft Corporation) C:\WINDOWS\system32\StoreAgent.dll
2017-04-11 21:38 - 2017-03-28 08:30 - 00049664 _____ (Microsoft Corporation) C:\WINDOWS\system32\TokenBrokerUI.dll
2017-04-11 21:38 - 2017-03-28 08:29 - 00852480 _____ (Microsoft Corporation) C:\WINDOWS\system32\Windows.Media.Import.dll
2017-04-11 21:38 - 2017-03-28 08:29 - 00590336 _____ (Microsoft Corporation) C:\WINDOWS\system32\efswrt.dll
2017-04-11 21:38 - 2017-03-28 08:29 - 00391168 _____ (Microsoft Corporation) C:\WINDOWS\system32\oleacc.dll
2017-04-11 21:38 - 2017-03-28 08:29 - 00387584 _____ (Microsoft Corporation) C:\WINDOWS\system32\iedkcs32.dll
2017-04-11 21:38 - 2017-03-28 08:29 - 00311296 _____ (Microsoft Corporation) C:\WINDOWS\system32\SyncSettings.dll
2017-04-11 21:38 - 2017-03-28 08:29 - 00293888 _____ (Microsoft Corporation) C:\WINDOWS\system32\updatehandlers.dll
2017-04-11 21:38 - 2017-03-28 08:29 - 00267264 _____ (Microsoft Corporation) C:\WINDOWS\system32\vaultcli.dll
2017-04-11 21:38 - 2017-03-28 08:29 - 00260608 _____ (Microsoft Corporation) C:\WINDOWS\system32\InstallAgentUserBroker.exe
2017-04-11 21:38 - 2017-03-28 08:29 - 00216576 _____ (Microsoft Corporation) C:\WINDOWS\system32\Windows.Devices.Scanners.dll
2017-04-11 21:38 - 2017-03-28 08:29 - 00206336 _____ (Microsoft Corporation) C:\WINDOWS\system32\psmsrv.dll
2017-04-11 21:38 - 2017-03-28 08:29 - 00147456 _____ (Microsoft Corporation) C:\WINDOWS\system32\winsrv.dll
2017-04-11 21:38 - 2017-03-28 08:29 - 00146432 _____ (Microsoft Corporation) C:\WINDOWS\system32\AuthBroker.dll
2017-04-11 21:38 - 2017-03-28 08:29 - 00088576 _____ (Microsoft Corporation) C:\WINDOWS\system32\mshtmled.dll
2017-04-11 21:38 - 2017-03-28 08:28 - 00561664 _____ (Microsoft Corporation) C:\WINDOWS\system32\Windows.ApplicationModel.Wallet.dll
2017-04-11 21:38 - 2017-03-28 08:28 - 00551936 _____ (Microsoft Corporation) C:\WINDOWS\system32\MusUpdateHandlers.dll
2017-04-11 21:38 - 2017-03-28 08:28 - 00456192 _____ (Microsoft Corporation) C:\WINDOWS\system32\puiobj.dll
2017-04-11 21:38 - 2017-03-28 08:28 - 00261632 _____ (Microsoft Corporation) C:\WINDOWS\system32\indexeddbserver.dll
2017-04-11 21:38 - 2017-03-28 08:28 - 00252416 _____ (Microsoft Corporation) C:\WINDOWS\system32\Windows.Security.Authentication.Identity.Provider.dll
2017-04-11 21:38 - 2017-03-28 08:27 - 01388544 _____ (Microsoft Corporation) C:\WINDOWS\system32\Windows.UI.Cred.dll
2017-04-11 21:38 - 2017-03-28 08:27 - 00671744 _____ (Microsoft Corporation) C:\WINDOWS\system32\mbsmsapi.dll
2017-04-11 21:38 - 2017-03-28 08:27 - 00645120 _____ (Microsoft Corporation) C:\WINDOWS\system32\qedit.dll
2017-04-11 21:38 - 2017-03-28 08:27 - 00472064 _____ (Microsoft Corporation) C:\WINDOWS\system32\Windows.Internal.Bluetooth.dll
2017-04-11 21:38 - 2017-03-28 08:27 - 00441856 _____ (Microsoft Corporation) C:\WINDOWS\system32\AccountsRt.dll
2017-04-11 21:38 - 2017-03-28 08:27 - 00425984 _____ (Microsoft Corporation) C:\WINDOWS\system32\aadcloudap.dll
2017-04-11 21:38 - 2017-03-28 08:27 - 00245760 _____ (Microsoft Corporation) C:\WINDOWS\system32\WwaApi.dll
2017-04-11 21:38 - 2017-03-28 08:27 - 00091136 _____ (Microsoft Corporation) C:\WINDOWS\system32\updatepolicy.dll
2017-04-11 21:38 - 2017-03-28 08:26 - 01145344 _____ (Microsoft Corporation) C:\WINDOWS\system32\EmailApis.dll
2017-04-11 21:38 - 2017-03-28 08:26 - 00642048 _____ (Microsoft Corporation) C:\WINDOWS\system32\Windows.UI.Xaml.InkControls.dll
2017-04-11 21:38 - 2017-03-28 08:26 - 00549376 _____ (Microsoft Corporation) C:\WINDOWS\system32\usocore.dll
2017-04-11 21:38 - 2017-03-28 08:26 - 00284160 _____ (Microsoft Corporation) C:\WINDOWS\system32\AboveLockAppHost.dll
2017-04-11 21:38 - 2017-03-28 08:25 - 00966144 _____ (Microsoft Corporation) C:\WINDOWS\system32\sbe.dll
2017-04-11 21:38 - 2017-03-28 08:25 - 00963584 _____ (Microsoft Corporation) C:\WINDOWS\system32\WebcamUi.dll
2017-04-11 21:38 - 2017-03-28 08:25 - 00775168 _____ (Microsoft Corporation) C:\WINDOWS\system32\GamePanel.exe
2017-04-11 21:38 - 2017-03-28 08:25 - 00262144 _____ (Microsoft Corporation) C:\WINDOWS\system32\webcheck.dll
2017-04-11 21:38 - 2017-03-28 08:24 - 06288384 _____ (Microsoft Corporation) C:\WINDOWS\system32\Windows.Media.dll
2017-04-11 21:38 - 2017-03-28 08:24 - 01220096 _____ (Microsoft Corporation) C:\WINDOWS\system32\wscui.cpl
2017-04-11 21:38 - 2017-03-28 08:23 - 09130496 _____ (Microsoft Corporation) C:\WINDOWS\system32\twinui.dll
2017-04-11 21:38 - 2017-03-28 08:23 - 00932864 _____ (Microsoft Corporation) C:\WINDOWS\system32\kerberos.dll
2017-04-11 21:38 - 2017-03-28 08:23 - 00073728 _____ (Microsoft Corporation) C:\WINDOWS\system32\WSManMigrationPlugin.dll
2017-04-11 21:38 - 2017-03-28 08:22 - 00175616 _____ (Microsoft Corporation) C:\WINDOWS\system32\SystemSettings.DeviceEncryptionHandlers.dll
2017-04-11 21:38 - 2017-03-28 08:21 - 23681536 _____ (Microsoft Corporation) C:\WINDOWS\system32\mshtml.dll
2017-04-11 21:38 - 2017-03-28 08:21 - 03778048 _____ (Microsoft Corporation) C:\WINDOWS\system32\MFMediaEngine.dll
2017-04-11 21:38 - 2017-03-28 08:21 - 01403392 _____ (Microsoft Corporation) C:\WINDOWS\system32\Windows.Media.Editing.dll
2017-04-11 21:38 - 2017-03-28 08:21 - 00458752 _____ (Microsoft Corporation) C:\WINDOWS\system32\RTMediaFrame.dll
2017-04-11 21:38 - 2017-03-28 08:20 - 01105408 _____ (Microsoft Corporation) C:\WINDOWS\system32\MiracastReceiver.dll
2017-04-11 21:38 - 2017-03-28 08:20 - 00090112 _____ (Microsoft Corporation) C:\WINDOWS\system32\mfmjpegdec.dll
2017-04-11 21:38 - 2017-03-28 08:19 - 07655424 _____ (Microsoft Corporation) C:\WINDOWS\system32\mos.dll
2017-04-11 21:38 - 2017-03-28 08:19 - 00864256 _____ (Microsoft Corporation) C:\WINDOWS\system32\wpnapps.dll
2017-04-11 21:38 - 2017-03-28 08:19 - 00442368 _____ (Microsoft Corporation) C:\WINDOWS\system32\PlayToDevice.dll
2017-04-11 21:38 - 2017-03-28 08:18 - 01908224 _____ (Microsoft Corporation) C:\WINDOWS\system32\AzureSettingSyncProvider.dll
2017-04-11 21:38 - 2017-03-28 08:18 - 01078784 _____ (Microsoft Corporation) C:\WINDOWS\system32\Windows.Media.Streaming.dll
2017-04-11 21:38 - 2017-03-28 08:18 - 00100864 _____ (Microsoft Corporation) C:\WINDOWS\system32\wpninprc.dll
2017-04-11 21:38 - 2017-03-28 08:17 - 13087232 _____ (Microsoft Corporation) C:\WINDOWS\system32\ieframe.dll
2017-04-11 21:38 - 2017-03-28 08:17 - 04749312 _____ (Microsoft Corporation) C:\WINDOWS\system32\SettingsHandlers_nt.dll
2017-04-11 21:38 - 2017-03-28 08:17 - 00279552 _____ (Microsoft Corporation) C:\WINDOWS\system32\PlayToReceiver.dll
2017-04-11 21:38 - 2017-03-28 08:16 - 01217024 _____ (Microsoft Corporation) C:\WINDOWS\system32\Windows.Media.Audio.dll
2017-04-11 21:38 - 2017-03-28 08:16 - 00061952 _____ (Microsoft Corporation) C:\WINDOWS\system32\vss_ps.dll
2017-04-11 21:38 - 2017-03-28 08:15 - 02390016 _____ (Microsoft Corporation) C:\WINDOWS\system32\smartscreen.exe
2017-04-11 21:38 - 2017-03-28 08:15 - 00981504 _____ (Microsoft Corporation) C:\WINDOWS\system32\Windows.Security.Authentication.OnlineId.dll
2017-04-11 21:38 - 2017-03-28 08:15 - 00945664 _____ (Microsoft Corporation) C:\WINDOWS\system32\WpcWebFilter.dll
2017-04-11 21:38 - 2017-03-28 08:15 - 00937984 _____ (Microsoft Corporation) C:\WINDOWS\system32\MCRecvSrc.dll
2017-04-11 21:38 - 2017-03-28 08:15 - 00539136 _____ (Microsoft Corporation) C:\WINDOWS\system32\PlayToManager.dll
2017-04-11 21:38 - 2017-03-28 08:15 - 00411648 _____ (Microsoft Corporation) C:\WINDOWS\system32\SensorsApi.dll
2017-04-11 21:38 - 2017-03-28 08:15 - 00139776 _____ (Microsoft Corporation) C:\WINDOWS\system32\Windows.Media.Devices.dll
2017-04-11 21:38 - 2017-03-28 08:14 - 08126976 _____ (Microsoft Corporation) C:\WINDOWS\system32\Chakra.dll
2017-04-11 21:38 - 2017-03-28 08:14 - 00947712 _____ (Microsoft Corporation) C:\WINDOWS\system32\MSVP9DEC.dll
2017-04-11 21:38 - 2017-03-28 08:14 - 00913920 _____ (Microsoft Corporation) C:\WINDOWS\system32\Windows.Networking.dll
2017-04-11 21:38 - 2017-03-28 08:14 - 00869888 _____ (Microsoft Corporation) C:\WINDOWS\system32\wuapi.dll
2017-04-11 21:38 - 2017-03-28 08:14 - 00800768 _____ (Microsoft Corporation) C:\WINDOWS\system32\Windows.Security.Authentication.Web.Core.dll
2017-04-11 21:38 - 2017-03-28 08:14 - 00089088 _____ (Microsoft Corporation) C:\WINDOWS\system32\asycfilt.dll
2017-04-11 21:38 - 2017-03-28 08:13 - 04596224 _____ (Microsoft Corporation) C:\WINDOWS\system32\xpsrchvw.exe
2017-04-11 21:38 - 2017-03-28 08:13 - 01359872 _____ (Microsoft Corporation) C:\WINDOWS\system32\SharedStartModel.dll
2017-04-11 21:38 - 2017-03-28 08:13 - 01040896 _____ (Microsoft Corporation) C:\WINDOWS\system32\NaturalLanguage6.dll
2017-04-11 21:38 - 2017-03-28 08:13 - 00816640 _____ (Microsoft Corporation) C:\WINDOWS\system32\Windows.UI.dll
2017-04-11 21:38 - 2017-03-28 08:13 - 00759296 _____ (Microsoft Corporation) C:\WINDOWS\system32\msfeeds.dll
2017-04-11 21:38 - 2017-03-28 08:13 - 00650752 _____ (Microsoft Corporation) C:\WINDOWS\system32\RDXService.dll
2017-04-11 21:38 - 2017-03-28 08:13 - 00611328 _____ (Microsoft Corporation) C:\WINDOWS\system32\Windows.Graphics.Printing.dll
2017-04-11 21:38 - 2017-03-28 08:12 - 02208768 _____ (Microsoft Corporation) C:\WINDOWS\system32\Windows.Graphics.Printing.3D.dll
2017-04-11 21:38 - 2017-03-28 08:12 - 00846336 _____ (Microsoft Corporation) C:\WINDOWS\system32\MbaeApiPublic.dll
2017-04-11 21:38 - 2017-03-28 08:11 - 02914816 _____ (Microsoft Corporation) C:\WINDOWS\system32\CertEnroll.dll
2017-04-11 21:38 - 2017-03-28 08:11 - 01981440 _____ (Microsoft Corporation) C:\WINDOWS\system32\diagtrack.dll
2017-04-11 21:38 - 2017-03-28 08:11 - 00765440 _____ (Microsoft Corporation) C:\WINDOWS\system32\Windows.Devices.Sensors.dll
2017-04-11 21:38 - 2017-03-28 08:10 - 08076288 _____ (Microsoft Corporation) C:\WINDOWS\system32\mstscax.dll
2017-04-11 21:38 - 2017-03-28 08:10 - 02316288 _____ (Microsoft Corporation) C:\WINDOWS\system32\wuaueng.dll
2017-04-11 21:38 - 2017-03-28 08:10 - 01637888 _____ (Microsoft Corporation) C:\WINDOWS\system32\ieapfltr.dll
2017-04-11 21:38 - 2017-03-28 08:10 - 01424896 _____ (Microsoft Corporation) C:\WINDOWS\system32\Windows.UI.Xaml.Maps.dll
2017-04-11 21:38 - 2017-03-28 08:10 - 01266176 _____ (Microsoft Corporation) C:\WINDOWS\system32\Windows.UI.Input.Inking.dll
2017-04-11 21:38 - 2017-03-28 08:10 - 00875520 _____ (Microsoft Corporation) C:\WINDOWS\system32\TokenBroker.dll
2017-04-11 21:38 - 2017-03-28 08:10 - 00774656 _____ (Microsoft Corporation) C:\WINDOWS\system32\Windows.Web.dll
2017-04-11 21:38 - 2017-03-28 08:10 - 00391168 _____ (Microsoft Corporation) C:\WINDOWS\system32\wuuhext.dll
2017-04-11 21:38 - 2017-03-28 08:09 - 04149248 _____ (Microsoft Corporation) C:\WINDOWS\system32\rdpcorets.dll
2017-04-11 21:38 - 2017-03-28 08:09 - 01513472 _____ (Microsoft Corporation) C:\WINDOWS\system32\win32kbase.sys
2017-04-11 21:38 - 2017-03-28 08:09 - 01369088 _____ (Microsoft Corporation) C:\WINDOWS\system32\Windows.UI.Xaml.Phone.dll
2017-04-11 21:38 - 2017-03-28 08:09 - 01328640 _____ (Microsoft Corporation) C:\WINDOWS\system32\Windows.Web.Http.dll
2017-04-11 21:38 - 2017-03-28 08:09 - 01131008 _____ (Microsoft Corporation) C:\WINDOWS\system32\localspl.dll
2017-04-11 21:38 - 2017-03-28 08:09 - 01064448 _____ (Microsoft Corporation) C:\WINDOWS\system32\SettingSyncCore.dll
2017-04-11 21:38 - 2017-03-28 08:08 - 03612672 _____ (Microsoft Corporation) C:\WINDOWS\system32\win32kfull.sys
2017-04-11 21:38 - 2017-03-28 08:08 - 02895872 _____ (Microsoft Corporation) C:\WINDOWS\system32\wininet.dll
2017-04-11 21:38 - 2017-03-28 08:07 - 00908800 _____ (Microsoft Corporation) C:\WINDOWS\system32\Windows.UI.Search.dll
2017-04-11 21:38 - 2017-03-28 08:07 - 00701952 _____ (Microsoft Corporation) C:\WINDOWS\system32\Windows.Networking.Connectivity.dll
2017-04-11 21:38 - 2017-03-28 08:06 - 01121280 _____ (Microsoft Corporation) C:\WINDOWS\system32\aadtb.dll
2017-04-11 21:38 - 2017-03-28 08:06 - 00999424 _____ (Microsoft Corporation) C:\WINDOWS\system32\TSWorkspace.dll
2017-04-11 21:38 - 2017-03-28 08:06 - 00924672 _____ (Microsoft Corporation) C:\WINDOWS\system32\Windows.Networking.BackgroundTransfer.dll
2017-04-11 21:37 - 2017-03-28 09:36 - 01617760 _____ (Microsoft Corporation) C:\WINDOWS\system32\appraiser.dll
2017-04-11 21:37 - 2017-03-28 09:36 - 01294688 _____ (Microsoft Corporation) C:\WINDOWS\system32\aeinv.dll
2017-04-11 21:37 - 2017-03-28 09:36 - 00565088 _____ (Microsoft Corporation) C:\WINDOWS\system32\devinv.dll
2017-04-11 21:37 - 2017-03-28 09:36 - 00343904 _____ (Microsoft Corporation) C:\WINDOWS\system32\invagent.dll
2017-04-11 21:37 - 2017-03-28 09:36 - 00142176 _____ (Microsoft Corporation) C:\WINDOWS\system32\acmigration.dll
2017-04-11 21:37 - 2017-03-28 09:35 - 00379232 _____ (Adobe Systems Incorporated) C:\WINDOWS\system32\atmfd.dll
2017-04-11 21:37 - 2017-03-28 09:26 - 00603488 _____ (Microsoft Corporation) C:\WINDOWS\system32\ContentDeliveryManager.Utilities.dll
2017-04-11 21:37 - 2017-03-28 09:22 - 02681200 _____ C:\WINDOWS\system32\CoreUIComponents.dll
2017-04-11 21:37 - 2017-03-28 09:20 - 00764392 _____ (Microsoft Corporation) C:\WINDOWS\system32\CoreMessaging.dll
2017-04-11 21:37 - 2017-03-28 09:10 - 00178528 _____ (Microsoft Corporation) C:\WINDOWS\system32\CloudExperienceHostUser.dll
2017-04-11 21:37 - 2017-03-28 09:10 - 00146776 _____ (Microsoft Corporation) C:\WINDOWS\system32\CloudExperienceHostCommon.dll
2017-04-11 21:37 - 2017-03-28 09:09 - 00682816 _____ (Microsoft Corporation) C:\WINDOWS\system32\wer.dll
2017-04-11 21:37 - 2017-03-28 09:08 - 01267504 _____ (Microsoft Corporation) C:\WINDOWS\system32\WinTypes.dll
2017-04-11 21:37 - 2017-03-28 09:08 - 01100128 _____ (Microsoft Corporation) C:\WINDOWS\system32\hvix64.exe
2017-04-11 21:37 - 2017-03-28 09:08 - 00989024 _____ (Microsoft Corporation) C:\WINDOWS\system32\hvax64.exe
2017-04-11 21:37 - 2017-03-28 09:04 - 01276760 _____ (Microsoft Corporation) C:\WINDOWS\system32\ole32.dll
2017-04-11 21:37 - 2017-03-28 09:04 - 00277344 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\msiscsi.sys
2017-04-11 21:37 - 2017-03-28 09:04 - 00241504 _____ (Microsoft Corporation) C:\WINDOWS\system32\CloudExperienceHost.dll
2017-04-11 21:37 - 2017-03-28 09:04 - 00160088 _____ (Microsoft Corporation) C:\WINDOWS\system32\CloudExperienceHostBroker.dll
2017-04-11 21:37 - 2017-03-28 09:00 - 01569184 _____ (Microsoft Corporation) C:\WINDOWS\system32\gdi32full.dll
2017-04-11 21:37 - 2017-03-28 09:00 - 00628552 _____ (Microsoft Corporation) C:\WINDOWS\system32\fontdrvhost.exe
2017-04-11 21:37 - 2017-03-28 08:58 - 00372440 _____ (Microsoft Corporation) C:\WINDOWS\system32\Windows.Media.MediaControl.dll
2017-04-11 21:37 - 2017-03-28 08:44 - 07216640 _____ (Microsoft Corporation) C:\WINDOWS\system32\Windows.Data.Pdf.dll
2017-04-11 21:37 - 2017-03-28 08:37 - 00041472 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\BasicRender.sys
2017-04-11 21:37 - 2017-03-28 08:37 - 00031232 _____ (Microsoft Corporation) C:\WINDOWS\system32\DdcWnsListener.dll
2017-04-11 21:37 - 2017-03-28 08:36 - 00056320 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\BasicDisplay.sys
2017-04-11 21:37 - 2017-03-28 08:36 - 00045056 _____ (Adobe Systems) C:\WINDOWS\system32\atmlib.dll
2017-04-11 21:37 - 2017-03-28 08:35 - 00185344 _____ (Microsoft Corporation) C:\WINDOWS\system32\DisplayManager.dll
2017-04-11 21:37 - 2017-03-28 08:35 - 00090624 _____ (Microsoft Corporation) C:\WINDOWS\system32\Windows.Devices.Printers.dll
2017-04-11 21:37 - 2017-03-28 08:34 - 00162304 _____ (Microsoft Corporation) C:\WINDOWS\system32\dmcertinst.exe
2017-04-11 21:37 - 2017-03-28 08:33 - 00193536 _____ (Microsoft Corporation) C:\WINDOWS\system32\Windows.Devices.WiFi.dll
2017-04-11 21:37 - 2017-03-28 08:33 - 00182272 _____ (Microsoft Corporation) C:\WINDOWS\system32\DeviceDirectoryClient.dll
2017-04-11 21:37 - 2017-03-28 08:32 - 00635904 _____ (Microsoft Corporation) C:\WINDOWS\system32\FlightSettings.dll
2017-04-11 21:37 - 2017-03-28 08:32 - 00186368 _____ (Microsoft Corporation) C:\WINDOWS\system32\Windows.Devices.Radios.dll
2017-04-11 21:37 - 2017-03-28 08:31 - 00343552 _____ (Microsoft Corporation) C:\WINDOWS\system32\Windows.Devices.SmartCards.Phone.dll
2017-04-11 21:37 - 2017-03-28 08:31 - 00257024 _____ (Microsoft Corporation) C:\WINDOWS\system32\CloudDomainJoinDataModelServer.dll
2017-04-11 21:37 - 2017-03-28 08:31 - 00171520 _____ (Microsoft Corporation) C:\WINDOWS\system32\Windows.Devices.SerialCommunication.dll
2017-04-11 21:37 - 2017-03-28 08:31 - 00144896 _____ (Microsoft Corporation) C:\WINDOWS\system32\Windows.Devices.Lights.dll
2017-04-11 21:37 - 2017-03-28 08:30 - 00692224 _____ (Microsoft Corporation) C:\WINDOWS\system32\CellularAPI.dll
2017-04-11 21:37 - 2017-03-28 08:30 - 00651264 _____ (Microsoft Corporation) C:\WINDOWS\system32\Windows.Devices.AllJoyn.dll
2017-04-11 21:37 - 2017-03-28 08:30 - 00568320 _____ (Microsoft Corporation) C:\WINDOWS\system32\Windows.Devices.LowLevel.dll
2017-04-11 21:37 - 2017-03-28 08:30 - 00505856 _____ (Microsoft Corporation) C:\WINDOWS\system32\Windows.Devices.WiFiDirect.dll
2017-04-11 21:37 - 2017-03-28 08:30 - 00268800 _____ (Microsoft Corporation) C:\WINDOWS\system32\UserMgrProxy.dll
2017-04-11 21:37 - 2017-03-28 08:30 - 00239104 _____ (Microsoft Corporation) C:\WINDOWS\system32\dafpos.dll
2017-04-11 21:37 - 2017-03-28 08:29 - 00912384 _____ (Microsoft Corporation) C:\WINDOWS\system32\Windows.Devices.SmartCards.dll
2017-04-11 21:37 - 2017-03-28 08:29 - 00379904 _____ (Microsoft Corporation) C:\WINDOWS\system32\apprepsync.dll
2017-04-11 21:37 - 2017-03-28 08:29 - 00324608 _____ (Microsoft Corporation) C:\WINDOWS\system32\Windows.ApplicationModel.LockScreen.dll
2017-04-11 21:37 - 2017-03-28 08:29 - 00279552 _____ (Microsoft Corporation) C:\WINDOWS\system32\Windows.Devices.HumanInterfaceDevice.dll
2017-04-11 21:37 - 2017-03-28 08:28 - 00431616 _____ (Microsoft Corporation) C:\WINDOWS\system32\WpAXHolder.dll
2017-04-11 21:37 - 2017-03-28 08:28 - 00407552 _____ (Microsoft Corporation) C:\WINDOWS\system32\Windows.Internal.Management.dll
2017-04-11 21:37 - 2017-03-28 08:28 - 00337408 _____ (Microsoft Corporation) C:\WINDOWS\system32\Windows.Devices.Picker.dll
2017-04-11 21:37 - 2017-03-28 08:28 - 00176128 _____ (Microsoft Corporation) C:\WINDOWS\system32\apprepapi.dll
2017-04-11 21:37 - 2017-03-28 08:27 - 00949248 _____ (Microsoft Corporation) C:\WINDOWS\system32\Windows.Devices.PointOfService.dll
2017-04-11 21:37 - 2017-03-28 08:26 - 00437248 _____ (Microsoft Corporation) C:\WINDOWS\system32\Windows.Devices.Usb.dll
2017-04-11 21:37 - 2017-03-28 08:26 - 00329728 _____ (Microsoft Corporation) C:\WINDOWS\system32\deviceaccess.dll
2017-04-11 21:37 - 2017-03-28 08:25 - 01010176 _____ (Microsoft Corporation) C:\WINDOWS\system32\enterprisecsps.dll
2017-04-11 21:37 - 2017-03-28 08:25 - 00896512 _____ (Microsoft Corporation) C:\WINDOWS\system32\Windows.AccountsControl.dll
2017-04-11 21:37 - 2017-03-28 08:24 - 00410112 _____ (Microsoft Corporation) C:\WINDOWS\system32\AppXDeploymentClient.dll
2017-04-11 21:37 - 2017-03-28 08:21 - 01589760 _____ (Microsoft Corporation) C:\WINDOWS\system32\msdtctm.dll
2017-04-11 21:37 - 2017-03-28 08:21 - 00104960 _____ (Microsoft Corporation) C:\WINDOWS\system32\CastLaunch.dll
2017-04-11 21:37 - 2017-03-28 08:19 - 00295424 _____ (Microsoft Corporation) C:\WINDOWS\system32\dlnashext.dll
2017-04-11 21:37 - 2017-03-28 08:19 - 00235520 _____ (Microsoft Corporation) C:\WINDOWS\system32\flvprophandler.dll
2017-04-11 21:37 - 2017-03-28 08:17 - 05114368 _____ (Microsoft Corporation) C:\WINDOWS\system32\cdp.dll
2017-04-11 21:37 - 2017-03-28 08:16 - 00167936 _____ (Microsoft Corporation) C:\WINDOWS\system32\ErrorDetails.dll
2017-04-11 21:37 - 2017-03-28 08:15 - 00467968 _____ (Microsoft Corporation) C:\WINDOWS\system32\Geolocation.dll
2017-04-11 21:37 - 2017-03-28 08:14 - 01692160 _____ (Microsoft Corporation) C:\WINDOWS\system32\AppXDeploymentExtensions.onecore.dll
2017-04-11 21:37 - 2017-03-28 08:14 - 00975872 _____ (Microsoft Corporation) C:\WINDOWS\HelpPane.exe
2017-04-11 21:37 - 2017-03-28 08:13 - 04474368 _____ (Microsoft Corporation) C:\WINDOWS\system32\D3DCompiler_47.dll
2017-04-11 21:37 - 2017-03-28 08:13 - 02095616 _____ (Microsoft Corporation) C:\WINDOWS\system32\inetcpl.cpl
2017-04-11 21:37 - 2017-03-28 08:13 - 00460800 _____ (Microsoft Corporation) C:\WINDOWS\system32\Windows.Devices.Midi.dll
2017-04-11 21:37 - 2017-03-28 08:12 - 05611008 _____ (Microsoft Corporation) C:\WINDOWS\system32\d2d1.dll
2017-04-11 21:37 - 2017-03-28 08:12 - 00376832 _____ (Microsoft Corporation) C:\WINDOWS\system32\CryptoWinRT.dll
2017-04-11 21:37 - 2017-03-28 08:11 - 01275392 _____ (Microsoft Corporation) C:\WINDOWS\system32\Windows.Devices.Bluetooth.dll
2017-04-11 21:37 - 2017-03-28 08:10 - 01783296 _____ (Microsoft Corporation) C:\WINDOWS\system32\urlmon.dll
2017-04-11 21:37 - 2017-03-28 08:10 - 01586176 _____ (Microsoft Corporation) C:\WINDOWS\system32\Windows.Globalization.dll
2017-04-11 21:37 - 2017-03-28 08:10 - 01231872 _____ (Microsoft Corporation) C:\WINDOWS\system32\dosvc.dll
2017-04-11 21:37 - 2017-03-28 08:09 - 00716800 _____ (Microsoft Corporation) C:\WINDOWS\system32\ShareHost.dll
2017-04-11 21:37 - 2017-03-28 08:08 - 03542016 _____ (Microsoft Corporation) C:\WINDOWS\system32\actxprxy.dll
2017-04-11 21:37 - 2017-03-28 08:08 - 00180224 _____ (Microsoft Corporation) C:\WINDOWS\system32\enrollmentapi.dll
2017-04-11 21:37 - 2017-03-28 08:07 - 00122368 _____ (Microsoft Corporation) C:\WINDOWS\system32\FontProvider.dll
2017-04-11 21:37 - 2017-03-28 08:05 - 01633792 _____ (Microsoft Corporation) C:\WINDOWS\system32\quartz.dll
2017-04-11 21:37 - 2017-03-18 19:50 - 00956416 _____ (Microsoft Corporation) C:\WINDOWS\system32\AppXDeploymentExtensions.desktop.dll
2017-04-11 21:37 - 2017-03-18 19:35 - 02278400 _____ (Microsoft Corporation) C:\WINDOWS\system32\AppXDeploymentServer.dll
2017-04-11 21:37 - 2017-03-16 07:47 - 00038768 _____ (Microsoft Corporation) C:\WINDOWS\system32\CompPkgSup.dll
2017-04-09 12:27 - 2017-04-21 16:35 - 00032210 _____ C:\Users\vesam\Downloads\Addition.txt
2017-04-09 12:26 - 2017-04-23 18:49 - 00012547 _____ C:\Users\vesam\Downloads\FRST.txt
2017-04-09 12:25 - 2017-04-23 18:48 - 02426368 _____ (Farbar) C:\Users\vesam\Downloads\FRST64.exe
2017-04-09 12:25 - 2017-04-23 18:48 - 00000000 ____D C:\FRST
2017-04-09 10:03 - 2017-04-09 10:03 - 00001605 _____ C:\Users\vesam\AppData\Local\recently-used.xbel
2017-04-05 23:28 - 2017-04-05 23:28 - 00399944 _____ (AVAST Software) C:\WINDOWS\system32\aswBoot.exe
2017-03-29 18:22 - 2017-04-05 19:26 - 00000000 ____D C:\WINDOWS\System32\Tasks\NCH Software
2017-03-29 18:22 - 2017-03-29 18:22 - 00002352 _____ C:\Users\vesam\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\NCH Suite.lnk
2017-03-29 18:22 - 2017-03-29 18:22 - 00002144 _____ C:\ProgramData\Microsoft\Windows\Start Menu\Programs\NCH Suite.lnk
2017-03-29 18:22 - 2017-03-29 18:22 - 00001380 _____ C:\Users\Public\Desktop\NCH Suite.lnk
2017-03-29 18:22 - 2017-03-29 18:22 - 00001256 _____ C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Crescendo Music Notation Editor.lnk
2017-03-29 18:22 - 2017-03-29 18:22 - 00001244 _____ C:\Users\Public\Desktop\Crescendo Music Notation Editor.lnk
2017-03-29 18:22 - 2017-03-29 18:22 - 00000000 ____D C:\Users\vesam\AppData\Roaming\NCH Software
2017-03-29 18:22 - 2017-03-29 18:22 - 00000000 ____D C:\ProgramData\NCH Software
2017-03-29 18:22 - 2017-03-29 18:22 - 00000000 ____D C:\Program Files (x86)\NCH Software
2017-03-29 18:21 - 2017-03-29 18:21 - 00775432 _____ (NCH Software) C:\Users\vesam\Desktop\crescendopsetup.exe
2017-03-28 17:54 - 2017-03-28 17:54 - 00347928 _____ C:\Users\vesam\Desktop\EUR4659052017ENGLISH.pdf
2017-03-26 19:26 - 2017-03-26 19:26 - 00030768 _____ C:\Users\vesam\Desktop\lasku_tilisiirroton_1103210317 Vesa-Matti Hellsten.pdf

==================== One Month Modified files and folders ========

(If an entry is included in the fixlist, the file/folder will be moved.)

2017-04-23 18:46 - 2016-08-15 17:08 - 00000006 ____H C:\WINDOWS\Tasks\SA.DAT
2017-04-23 18:46 - 2016-08-15 16:57 - 00000180 _____ C:\WINDOWS\system32\{A6D608F0-0BDE-491A-97AE-5C4B05D86E01}.bat
2017-04-23 18:46 - 2016-07-16 09:04 - 00524288 _____ C:\WINDOWS\system32\config\BBI
2017-04-23 18:46 - 2016-07-08 08:55 - 00000000 __SHD C:\Users\vesam\IntelGraphicsProfiles
2017-04-23 18:06 - 2016-08-15 16:55 - 00000000 ____D C:\WINDOWS\system32\SleepStudy
2017-04-23 15:03 - 2016-07-16 14:47 - 00000000 ____D C:\WINDOWS\AppReadiness
2017-04-23 10:45 - 2016-07-16 14:47 - 00000000 ____D C:\WINDOWS\rescache
2017-04-23 09:45 - 2016-07-17 01:10 - 01070612 _____ C:\WINDOWS\system32\perfh00B.dat
2017-04-23 09:45 - 2016-07-17 01:10 - 00286424 _____ C:\WINDOWS\system32\perfc00B.dat
2017-04-23 09:45 - 2016-04-27 09:13 - 02671780 _____ C:\WINDOWS\system32\PerfStringBackup.INI
2017-04-23 09:39 - 2016-08-17 20:35 - 00000000 ____D C:\WINDOWS\Minidump
2017-04-23 09:39 - 2016-07-16 14:45 - 00000000 ____D C:\WINDOWS\INF
2017-04-23 09:39 - 2016-07-08 03:07 - 00405794 ____N C:\WINDOWS\Minidump\042317-20703-01.dmp
2017-04-22 19:28 - 2016-07-16 14:47 - 00000000 ____D C:\WINDOWS\system32\appraiser
2017-04-22 19:28 - 2016-07-16 14:36 - 00000000 ____D C:\WINDOWS\CbsTemp
2017-04-22 13:57 - 2016-07-16 14:47 - 00000000 ___HD C:\Program Files\WindowsApps
2017-04-21 17:01 - 2016-07-10 20:47 - 00000000 ____D C:\Users\vesam\AppData\Local\ElevatedDiagnostics
2017-04-19 22:12 - 2016-07-10 22:29 - 00000000 ____D C:\ProgramData\BOINC
2017-04-19 21:52 - 2017-02-15 21:26 - 00000000 ____D C:\Users\vesam\.VirtualBox
2017-04-17 11:30 - 2017-02-08 20:37 - 00004268 _____ C:\WINDOWS\System32\Tasks\Avast Emergency Update
2017-04-12 13:00 - 2016-07-11 12:53 - 00000000 ___RD C:\Users\vesam\Documents\Scanned Documents
2017-04-12 10:26 - 2016-04-27 09:22 - 00000000 __RHD C:\Users\Public\AccountPictures
2017-04-12 10:09 - 2016-08-15 16:55 - 00224456 _____ C:\WINDOWS\system32\FNTCACHE.DAT
2017-04-11 23:59 - 2016-07-16 14:47 - 00000000 ___SD C:\WINDOWS\SysWOW64\F12
2017-04-11 23:59 - 2016-07-16 14:47 - 00000000 ___SD C:\WINDOWS\system32\F12
2017-04-11 23:59 - 2016-07-16 14:47 - 00000000 ____D C:\WINDOWS\SysWOW64\setup
2017-04-11 23:59 - 2016-07-16 14:47 - 00000000 ____D C:\WINDOWS\system32\setup
2017-04-11 23:59 - 2016-07-16 14:47 - 00000000 ____D C:\WINDOWS\ShellExperiences
2017-04-11 23:59 - 2016-07-16 14:47 - 00000000 ____D C:\WINDOWS\Provisioning
2017-04-11 23:59 - 2016-07-16 09:04 - 00000000 ____D C:\WINDOWS\system32\Dism
2017-04-11 23:58 - 2016-07-16 14:47 - 00000000 ___RD C:\WINDOWS\ImmersiveControlPanel
2017-04-11 23:58 - 2016-07-16 14:47 - 00000000 ___RD C:\Program Files\Windows Defender
2017-04-11 23:58 - 2016-07-16 14:47 - 00000000 ____D C:\Program Files\Windows Photo Viewer
2017-04-11 23:58 - 2016-07-16 14:47 - 00000000 ____D C:\Program Files (x86)\Windows Photo Viewer
2017-04-11 23:58 - 2016-07-16 14:47 - 00000000 ____D C:\Program Files (x86)\Windows Defender
2017-04-11 22:45 - 2016-07-08 09:02 - 00000000 ____D C:\WINDOWS\system32\MRT
2017-04-11 22:44 - 2016-07-08 09:02 - 148601744 ____C (Microsoft Corporation) C:\WINDOWS\system32\MRT.exe
2017-04-11 08:13 - 2016-08-15 17:08 - 00003526 _____ C:\WINDOWS\System32\Tasks\GoogleUpdateTaskMachineUA
2017-04-11 08:13 - 2016-08-15 17:08 - 00003402 _____ C:\WINDOWS\System32\Tasks\GoogleUpdateTaskMachineCore
2017-04-09 12:18 - 2016-07-25 19:48 - 00000000 ____D C:\Users\vesam\.gimp-2.8
2017-04-09 10:02 - 2016-07-08 08:51 - 00000000 ____D C:\Users\vesam\AppData\Local\VirtualStore
2017-04-06 08:52 - 2016-08-15 17:08 - 00004052 _____ C:\WINDOWS\System32\Tasks\SafeZone scheduled Autoupdate 1468256563
2017-04-06 08:52 - 2016-07-11 20:02 - 00001095 _____ C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Avast SafeZone Browser.lnk
2017-04-06 08:50 - 2016-07-08 09:20 - 00002273 _____ C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Google Chrome.lnk
2017-04-06 08:50 - 2016-07-08 09:20 - 00002261 _____ C:\Users\Public\Desktop\Google Chrome.lnk
2017-04-05 23:28 - 2017-02-08 20:37 - 00334088 _____ (AVAST Software s.r.o.) C:\WINDOWS\system32\Drivers\aswbloga.sys
2017-04-05 23:28 - 2017-02-08 20:37 - 00307736 _____ (AVAST Software s.r.o.) C:\WINDOWS\system32\Drivers\aswbidsdrivera.sys
2017-04-05 23:28 - 2017-02-08 20:37 - 00189768 _____ (AVAST Software s.r.o.) C:\WINDOWS\system32\Drivers\aswbidsha.sys
2017-04-05 23:28 - 2017-02-08 20:37 - 00048528 _____ (AVAST Software s.r.o.) C:\WINDOWS\system32\Drivers\aswbuniva.sys
2017-04-05 23:28 - 2016-07-11 20:02 - 00032600 _____ (AVAST Software) C:\WINDOWS\system32\Drivers\aswKbd.sys
2017-04-05 23:28 - 2016-07-11 20:01 - 01005048 _____ (AVAST Software) C:\WINDOWS\system32\Drivers\aswSnx.sys
2017-04-05 23:28 - 2016-07-11 20:01 - 00556784 _____ (AVAST Software) C:\WINDOWS\system32\Drivers\aswSP.sys
2017-04-05 23:28 - 2016-07-11 20:01 - 00339696 _____ (AVAST Software) C:\WINDOWS\system32\Drivers\aswVmm.sys
2017-04-05 23:28 - 2016-07-11 20:01 - 00164064 _____ (AVAST Software) C:\WINDOWS\system32\Drivers\aswStm.sys
2017-04-05 23:28 - 2016-07-11 20:01 - 00127112 _____ (AVAST Software) C:\WINDOWS\system32\Drivers\aswMonFlt.sys
2017-04-05 23:28 - 2016-07-11 20:01 - 00101152 _____ (AVAST Software) C:\WINDOWS\system32\Drivers\aswRdr2.sys
2017-04-05 23:28 - 2016-07-11 20:01 - 00075704 _____ (AVAST Software) C:\WINDOWS\system32\Drivers\aswRvrt.sys
2017-04-05 23:28 - 2016-07-11 20:01 - 00038296 _____ (AVAST Software) C:\WINDOWS\system32\Drivers\aswHwid.sys
2017-04-01 21:52 - 2016-07-16 14:49 - 00835576 _____ (Adobe Systems Incorporated) C:\WINDOWS\SysWOW64\FlashPlayerApp.exe
2017-04-01 21:52 - 2016-07-16 14:49 - 00177656 _____ (Adobe Systems Incorporated) C:\WINDOWS\SysWOW64\FlashPlayerCPLApp.cpl
2017-03-28 09:20 - 2016-08-15 16:57 - 02717184 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\PrintConfig.dll
2017-03-26 13:06 - 2016-07-25 19:50 - 00000000 ____D C:\Users\vesam\AppData\Local\gtk-2.0

==================== Files in the root of some directories =======

2017-04-09 10:03 - 2017-04-09 10:03 - 0001605 _____ () C:\Users\vesam\AppData\Local\recently-used.xbel
2016-08-15 16:57 - 2016-08-15 16:57 - 0000000 ____H () C:\ProgramData\DP45977C.lfl

==================== Bamital & volsnap ======================

(There is no automatic fix for files that do not pass verification.)

C:\WINDOWS\system32\winlogon.exe => File is digitally signed
C:\WINDOWS\system32\wininit.exe => File is digitally signed
C:\WINDOWS\explorer.exe => File is digitally signed
C:\WINDOWS\SysWOW64\explorer.exe => File is digitally signed
C:\WINDOWS\system32\svchost.exe => File is digitally signed
C:\WINDOWS\SysWOW64\svchost.exe => File is digitally signed
C:\WINDOWS\system32\services.exe => File is digitally signed
C:\WINDOWS\system32\User32.dll => File is digitally signed
C:\WINDOWS\SysWOW64\User32.dll => File is digitally signed
C:\WINDOWS\system32\userinit.exe => File is digitally signed
C:\WINDOWS\SysWOW64\userinit.exe => File is digitally signed
C:\WINDOWS\system32\rpcss.dll => File is digitally signed
C:\WINDOWS\system32\dnsapi.dll => File is digitally signed
C:\WINDOWS\SysWOW64\dnsapi.dll => File is digitally signed
C:\WINDOWS\system32\Drivers\volsnap.sys => File is digitally signed

LastRegBack: 2017-04-21 17:01

==================== End of FRST.txt ============================
humanerror
Regular Member
 
Posts: 50
Joined: October 14th, 2008, 8:36 am

Re: spected malware although Avast finds no problems

Unread postby humanerror » April 23rd, 2017, 11:51 am

Additional scan result of Farbar Recovery Scan Tool (x64) Version: 23-04-2017 01
Ran by vesam (23-04-2017 18:49:24)
Running from C:\Users\vesam\Downloads
Windows 10 Home Version 1607 (X64) (2016-08-15 14:15:29)
Boot Mode: Normal
==========================================================


==================== Accounts: =============================

DefaultAccount (S-1-5-21-386011426-3842006082-317715658-503 - Limited - Disabled)
Järjestelmänvalvoja (S-1-5-21-386011426-3842006082-317715658-500 - Administrator - Disabled)
vesam (S-1-5-21-386011426-3842006082-317715658-1001 - Administrator - Enabled) => C:\Users\vesam
Vieras (S-1-5-21-386011426-3842006082-317715658-501 - Limited - Disabled)

==================== Security Center ========================

(If an entry is included in the fixlist, it will be removed.)

AV: Avast Antivirus (Enabled - Up to date) {8EA8924E-BC81-DC44-8BB0-8BAE75D86EBF}
AV: Windows Defender (Disabled - Up to date) {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
AS: Windows Defender (Disabled - Up to date) {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
AS: Avast Antivirus (Enabled - Up to date) {35C973AA-9ABB-D3CA-B100-B0DC0E5F2402}

==================== Installed Programs ======================

(Only the adware programs with "Hidden" flag could be added to the fixlist to unhide them. The adware programs should be uninstalled manually.)

Adobe Flash Player 24 PPAPI (HKLM-x32\...\Adobe Flash Player PPAPI) (Version: 24.0.0.221 - Adobe Systems Incorporated)
AllShare Framework DMS (HKLM\...\{83232C27-8C3F-44A5-9EB2-BB7161228ADD}) (Version: 1.3.23 - Samsung)
Avast Free Antivirus (HKLM-x32\...\Avast Antivirus) (Version: 17.3.2291 - AVAST Software)
BOINC (HKLM\...\{1B6BCF3D-F66A-4E81-87EF-CDB97F350897}) (Version: 7.6.33 - Space Sciences Laboratory, U.C. Berkeley)
Crescendo Music Notation Editor (HKLM-x32\...\Crescendo) (Version: 1.86 - NCH Software)
GIMP 2.8.16 (HKLM\...\GIMP-2_is1) (Version: 2.8.16 - The GIMP Team)
Google Chrome (HKLM-x32\...\Google Chrome) (Version: 57.0.2987.133 - Google Inc.)
Google Update Helper (x32 Version: 1.3.33.3 - Google Inc.) Hidden
Intel(R) Processor Graphics (HKLM-x32\...\{F0E3AD40-2BBD-4360-9C76-B9AC9A5886EA}) (Version: 20.19.15.4444 - Intel Corporation)
Java 8 Update 121 (HKLM-x32\...\{26A24AE4-039D-4CA4-87B4-2F32180121F0}) (Version: 8.0.1210.13 - Oracle Corporation)
Microsoft OneDrive (HKU\S-1-5-21-386011426-3842006082-317715658-1001\...\OneDriveSetup.exe) (Version: 17.3.6743.1212 - Microsoft Corporation)
Microsoft Silverlight (HKLM\...\{89F4137D-6C26-4A84-BDB8-2E5A4BB71E00}) (Version: 5.1.50901.0 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.6161 (HKLM\...\{5FCE6D76-F5DC-37AB-B2B8-22AB8CEDB1D4}) (Version: 9.0.30729.6161 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161 (HKLM-x32\...\{9BE518E6-ECC6-35A9-88E4-87755C07200F}) (Version: 9.0.30729.6161 - Microsoft Corporation)
Mozilla Firefox 51.0.1 (x86 fi) (HKLM-x32\...\Mozilla Firefox 51.0.1 (x86 fi)) (Version: 51.0.1 - Mozilla)
Mozilla Maintenance Service (HKLM-x32\...\MozillaMaintenanceService) (Version: 51.0.1.6234 - Mozilla)
OpenOffice 4.1.2 (HKLM-x32\...\{048825E3-BDAC-4579-B8E8-F8BAF9D9A764}) (Version: 4.12.9782 - Apache Software Foundation)
Oracle VM VirtualBox 5.0.18 (HKLM\...\{4D4859BB-681D-45A1-81C8-520B382D3034}) (Version: 5.0.18 - Oracle Corporation)
Realtek High Definition Audio Driver (HKLM-x32\...\{F132AF7F-7BCA-4EDE-8A7C-958108FE7DBC}) (Version: 6.0.1.7836 - Realtek Semiconductor Corp.)
SafeZone Stable 3.55.2393.596 (x32 Version: 3.55.2393.596 - Avast Software) Hidden
Samsung Link 2.0.0.1603091618 (HKLM\...\8474-7877-9059-0204) (Version: 2.0.0.1603091618 - Samsung Electronics Co.,Ltd)
SopCast 4.2.0 (HKLM-x32\...\SopCast) (Version: 4.2.0 - www.sopcast.com)
Tweaking.com - Registry Backup (HKLM-x32\...\Tweaking.com - Registry Backup) (Version: 3.5.3 - Tweaking.com)

==================== Custom CLSID (Whitelisted): ==========================

(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)


==================== Scheduled Tasks (Whitelisted) =============

(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)

Task: {1D02958E-BC17-40B7-A6EF-EC1DB0130B1F} - System32\Tasks\GoogleUpdateTaskMachineUA => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe [2016-07-08] (Google Inc.)
Task: {493DC088-60AE-4392-A4C3-1AA252518A30} - System32\Tasks\Adobe Flash Player PPAPI Notifier => C:\WINDOWS\SysWoW64\Macromed\Flash\FlashUtil32_24_0_0_221_pepper.exe [2017-03-12] (Adobe Systems Incorporated)
Task: {49D37C30-3489-4EDF-8CEE-D6C43A947182} - System32\Tasks\GoogleUpdateTaskMachineCore => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe [2016-07-08] (Google Inc.)
Task: {5F20B910-B695-450C-9173-32EBD7734875} - System32\Tasks\Adobe Flash Player Updater => C:\WINDOWS\SysWoW64\Macromed\Flash\FlashPlayerUpdateService.exe [2017-03-12] (Adobe Systems Incorporated)
Task: {64A03DBE-1848-46F5-A90F-1E18D4BD76DC} - System32\Tasks\AVAST Software\Avast settings backup => C:\Program Files\Common Files\AV\avast! Antivirus\backup.exe [2017-04-17] (AVAST Software)
Task: {92E28131-34B3-4A2F-A023-9EB5B9773A98} - System32\Tasks\Avast Emergency Update => C:\Program Files\AVAST Software\Avast\AvEmUpdate.exe [2017-04-05] (AVAST Software)
Task: {C30C61E1-E586-480A-8339-FFBD4715BAAF} - System32\Tasks\SafeZone scheduled Autoupdate 1468256563 => C:\Program Files\AVAST Software\SZBrowser\launcher.exe [2017-03-22] (Avast Software)

(If an entry is included in the fixlist, the task (.job) file will be moved. The file which is running by the task will not be moved.)

Task: C:\WINDOWS\Tasks\Adobe Flash Player PPAPI Notifier.job => C:\WINDOWS\SysWoW64\Macromed\Flash\FlashUtil32_24_0_0_221_pepper.exe
Task: C:\WINDOWS\Tasks\Adobe Flash Player Updater.job => C:\WINDOWS\SysWoW64\Macromed\Flash\FlashPlayerUpdateService.exe
Task: C:\WINDOWS\Tasks\CreateExplorerShellUnelevatedTask.job => C:\Windows\explorer.exe

==================== Shortcuts =============================

(The entries could be listed to be restored or removed.)

Shortcut: C:\Users\vesam\Favorites\NCH Software Download Site.lnk -> hxxp://www.nch.com.au/index.htm

==================== Loaded Modules (Whitelisted) ==============

2016-07-16 14:42 - 2016-07-16 14:42 - 00231424 _____ () C:\WINDOWS\SYSTEM32\ism32k.dll
2017-04-11 21:37 - 2017-03-28 09:22 - 02681200 _____ () C:\WINDOWS\system32\CoreUIComponents.dll
2016-10-17 23:36 - 2016-03-09 17:18 - 00025088 _____ () C:\Program Files\Samsung\Samsung Link\JniSys.dll
2016-10-17 23:36 - 2016-03-09 17:18 - 02513920 _____ () C:\Program Files\Samsung\Samsung Link\scone_proxy.dll
2016-10-17 23:36 - 2016-03-09 17:18 - 02436096 _____ () C:\Program Files\Samsung\Samsung Link\scone_stub.dll
2013-12-21 11:25 - 2013-12-21 11:25 - 00036864 _____ () C:\Program Files\Samsung\AllShare Framework DMS\1.3.23\64bit\JNIInterface.dll
2013-12-21 11:26 - 2013-12-21 11:26 - 00144384 _____ () C:\Program Files\Samsung\AllShare Framework DMS\1.3.23\64bit\ASFAPI.dll
2013-12-21 11:27 - 2013-12-21 11:27 - 00018944 _____ () C:\Program Files\Samsung\AllShare Framework DMS\1.3.23\64bit\MediaDB_Manager.dll
2013-10-22 09:52 - 2013-10-22 09:52 - 00030720 _____ () C:\WINDOWS\SYSTEM32\MediaDB64.dll
2013-10-22 09:52 - 2013-10-22 09:52 - 00908800 _____ () C:\WINDOWS\SYSTEM32\ContentDirectoryPresenter64.dll
2013-12-21 11:27 - 2013-12-21 11:27 - 00521728 _____ () C:\Program Files\Samsung\AllShare Framework DMS\1.3.23\64bit\DMS_Manager.dll
2013-07-23 19:19 - 2013-07-23 19:19 - 00049152 _____ () C:\WINDOWS\SYSTEM32\boost_date_time-vc90-mt-1_47.dll
2013-07-23 19:19 - 2013-07-23 19:19 - 00016896 _____ () C:\WINDOWS\SYSTEM32\boost_system-vc90-mt-1_47.dll
2013-07-23 19:19 - 2013-07-23 19:19 - 00058880 _____ () C:\WINDOWS\SYSTEM32\boost_thread-vc90-mt-1_47.dll
2013-07-23 19:19 - 2013-07-23 19:19 - 00299520 _____ () C:\WINDOWS\SYSTEM32\boost_serialization-vc90-mt-1_47.dll
2016-07-28 01:27 - 2016-07-28 01:27 - 00402520 _____ () C:\WINDOWS\system32\igfxTray.exe
2017-04-11 21:37 - 2017-03-28 09:22 - 02681200 _____ () C:\WINDOWS\SYSTEM32\CoreUIComponents.dll
2016-09-14 10:13 - 2016-09-07 07:56 - 00134656 _____ () C:\Windows\ShellExperiences\Windows.UI.Shell.SharedUtilities.dll
2017-03-16 22:34 - 2017-03-04 09:31 - 00474112 _____ () C:\Windows\ShellExperiences\QuickActions.dll
2017-03-16 22:35 - 2017-03-04 09:12 - 09760768 _____ () C:\Windows\SystemApps\Microsoft.Windows.Cortana_cw5n1h2txyewy\CortanaApi.dll
2017-03-16 22:35 - 2017-03-04 09:05 - 01401856 _____ () C:\Windows\SystemApps\Microsoft.Windows.Cortana_cw5n1h2txyewy\Cortana.Core.dll
2017-03-16 22:35 - 2017-03-04 09:05 - 00757248 _____ () C:\Windows\SystemApps\Microsoft.Windows.Cortana_cw5n1h2txyewy\CSGSuggestLib.dll
2017-04-11 21:37 - 2017-03-28 08:08 - 02424320 _____ () C:\Windows\SystemApps\Microsoft.Windows.Cortana_cw5n1h2txyewy\Cortana.BackgroundTask.dll
2017-04-11 21:37 - 2017-03-28 08:11 - 04853760 _____ () C:\Windows\SystemApps\Microsoft.Windows.Cortana_cw5n1h2txyewy\RemindersUI.dll
2017-04-10 20:31 - 2017-04-10 20:31 - 00077312 _____ () C:\Program Files\WindowsApps\Microsoft.SkypeApp_11.13.133.0_x64__kzf8qxf38zg5c\SkypeHost.exe
2017-04-10 20:31 - 2017-04-10 20:31 - 00189952 _____ () C:\Program Files\WindowsApps\Microsoft.SkypeApp_11.13.133.0_x64__kzf8qxf38zg5c\SkypeBackgroundTasks.dll
2017-04-10 20:31 - 2017-04-10 20:31 - 42507264 _____ () C:\Program Files\WindowsApps\Microsoft.SkypeApp_11.13.133.0_x64__kzf8qxf38zg5c\SkyWrap.dll
2017-04-10 20:31 - 2017-04-10 20:31 - 02334184 _____ () C:\Program Files\WindowsApps\Microsoft.SkypeApp_11.13.133.0_x64__kzf8qxf38zg5c\skypert.dll
2017-03-16 22:35 - 2017-03-04 09:04 - 00114176 _____ () C:\Windows\SystemApps\Microsoft.Windows.Cortana_cw5n1h2txyewy\Cortana.Dss.BackgroundTask.dll
2016-10-17 23:36 - 2016-03-09 17:18 - 00049664 _____ () C:\Program Files\Samsung\Samsung Link\JniIO.dll
2017-04-06 08:50 - 2017-03-29 11:47 - 02885464 _____ () C:\Program Files (x86)\Google\Chrome\Application\57.0.2987.133\libglesv2.dll
2017-04-06 08:50 - 2017-03-29 11:47 - 00099672 _____ () C:\Program Files (x86)\Google\Chrome\Application\57.0.2987.133\libegl.dll
2013-12-11 16:46 - 2013-12-11 16:46 - 01114624 _____ () C:\Program Files\Samsung\AllShare Framework DMS\1.3.23\DMSManager.dll
2013-07-23 19:18 - 2013-07-23 19:18 - 00227840 _____ () C:\Program Files\Samsung\AllShare Framework DMS\1.3.23\boost_serialization-vc90-mt-1_47.dll
2013-07-23 19:18 - 2013-07-23 19:18 - 00038912 _____ () C:\Program Files\Samsung\AllShare Framework DMS\1.3.23\boost_date_time-vc90-mt-1_47.dll
2013-07-23 19:18 - 2013-07-23 19:18 - 00012800 _____ () C:\Program Files\Samsung\AllShare Framework DMS\1.3.23\boost_system-vc90-mt-1_47.dll
2013-07-23 19:18 - 2013-07-23 19:18 - 00046592 _____ () C:\Program Files\Samsung\AllShare Framework DMS\1.3.23\boost_thread-vc90-mt-1_47.dll
2013-10-22 09:48 - 2013-10-22 09:48 - 00707072 _____ () C:\Program Files\Samsung\AllShare Framework DMS\1.3.23\ContentDirectoryPresenter.dll
2013-10-24 16:53 - 2013-10-24 16:53 - 00107008 _____ () C:\Program Files\Samsung\AllShare Framework DMS\1.3.23\DCMCDP.dll
2013-12-11 16:46 - 2013-12-11 16:46 - 00102400 _____ () C:\Program Files\Samsung\AllShare Framework DMS\1.3.23\FolderCDP.dll
2013-10-24 16:53 - 2013-10-24 16:53 - 00032768 _____ () C:\Program Files\Samsung\AllShare Framework DMS\1.3.23\Autobackup.dll
2013-04-19 16:38 - 2013-04-19 16:38 - 00055808 _____ () C:\Program Files\Samsung\AllShare Framework DMS\1.3.23\RosettaAllShare.dll
2013-02-14 19:42 - 2013-02-14 19:42 - 00520234 _____ () C:\Program Files\Samsung\AllShare Framework DMS\1.3.23\sqlite3.dll
2013-12-11 16:46 - 2013-12-11 16:46 - 00077312 _____ () C:\Program Files\Samsung\AllShare Framework DMS\1.3.23\MetadataFramework.dll
2013-02-14 19:42 - 2013-02-14 19:42 - 00450560 _____ () C:\Program Files\Samsung\AllShare Framework DMS\1.3.23\MoodExtractor.dll
2013-02-14 19:42 - 2013-02-14 19:42 - 05717504 _____ () C:\Program Files\Samsung\AllShare Framework DMS\1.3.23\DCMImgExtractor.dll
2013-10-25 19:48 - 2013-10-25 19:48 - 00028672 _____ () C:\Program Files\Samsung\AllShare Framework DMS\1.3.23\AutoChaptering.dll
2013-10-25 19:49 - 2013-10-25 19:49 - 00028160 _____ () C:\Program Files\Samsung\AllShare Framework DMS\1.3.23\AudioExtractor.dll
2013-12-11 16:45 - 2013-12-11 16:45 - 00017920 _____ () C:\Program Files\Samsung\AllShare Framework DMS\1.3.23\VideoExtractor.dll
2013-10-25 19:53 - 2013-10-25 19:53 - 00012288 _____ () C:\Program Files\Samsung\AllShare Framework DMS\1.3.23\ImageExtractor.dll
2013-10-25 19:48 - 2013-10-25 19:48 - 00013824 _____ () C:\Program Files\Samsung\AllShare Framework DMS\1.3.23\TextExtractor.dll
2013-10-25 19:48 - 2013-10-25 19:48 - 00064000 _____ () C:\Program Files\Samsung\AllShare Framework DMS\1.3.23\ID3Driver.dll
2013-10-25 19:48 - 2013-10-25 19:48 - 00023040 _____ () C:\Program Files\Samsung\AllShare Framework DMS\1.3.23\RichInfoDriver.dll
2013-02-14 19:42 - 2013-02-14 19:42 - 00147456 _____ () C:\Program Files\Samsung\AllShare Framework DMS\1.3.23\libexpat.dll
2013-10-25 19:48 - 2013-10-25 19:48 - 00012288 _____ () C:\Program Files\Samsung\AllShare Framework DMS\1.3.23\VideoThumb.dll
2013-10-25 19:53 - 2013-10-25 19:53 - 00117248 _____ () C:\Program Files\Samsung\AllShare Framework DMS\1.3.23\ThumbnailMaker.dll
2013-12-11 16:45 - 2013-12-11 16:45 - 00134144 _____ () C:\Program Files\Samsung\AllShare Framework DMS\1.3.23\VideoMetadataDriver.dll
2013-10-25 19:48 - 2013-10-25 19:48 - 00024064 _____ () C:\Program Files\Samsung\AllShare Framework DMS\1.3.23\SECMetaDriver.dll
2013-10-25 19:48 - 2013-10-25 19:48 - 00024064 _____ () C:\Program Files\Samsung\AllShare Framework DMS\1.3.23\photoDriver.dll
2013-02-14 19:42 - 2013-02-14 19:42 - 00686080 _____ () C:\Program Files\Samsung\AllShare Framework DMS\1.3.23\avformat-52.dll
2013-02-14 19:42 - 2013-02-14 19:42 - 00366592 _____ () C:\Program Files\Samsung\AllShare Framework DMS\1.3.23\tag.dll
2013-10-25 19:48 - 2013-10-25 19:48 - 00289792 _____ () C:\Program Files\Samsung\AllShare Framework DMS\1.3.23\libThumbnail.dll
2013-10-25 19:53 - 2013-10-25 19:53 - 01033728 _____ () C:\Program Files\Samsung\AllShare Framework DMS\1.3.23\ImageMagickWrapper.dll
2013-02-14 19:42 - 2013-02-14 19:42 - 04671488 _____ () C:\Program Files\Samsung\AllShare Framework DMS\1.3.23\avcodec-52.dll
2013-10-25 19:48 - 2013-10-25 19:48 - 00290816 _____ () C:\Program Files\Samsung\AllShare Framework DMS\1.3.23\libKeyFrame.dll
2013-02-14 19:42 - 2013-02-14 19:42 - 00070656 _____ () C:\Program Files\Samsung\AllShare Framework DMS\1.3.23\avutil-50.dll
2013-02-14 19:42 - 2013-02-14 19:42 - 00152064 _____ () C:\Program Files\Samsung\AllShare Framework DMS\1.3.23\swscale-0.dll
2013-02-14 19:42 - 2013-02-14 19:42 - 00399826 _____ () C:\Program Files\Samsung\AllShare Framework DMS\1.3.23\libexif-12.dll.dll
2013-02-14 19:42 - 2013-02-14 19:42 - 00044032 _____ () C:\Program Files\Samsung\AllShare Framework DMS\1.3.23\us.dll
2017-04-05 23:28 - 2017-04-05 23:28 - 00170216 _____ () C:\Program Files\AVAST Software\Avast\JsonRpcServer.dll
2016-07-11 20:01 - 2016-07-11 20:01 - 48936448 _____ () C:\Program Files\AVAST Software\Avast\libcef.dll
2017-04-05 23:28 - 2017-04-05 23:28 - 00176480 _____ () C:\Program Files\AVAST Software\Avast\event_routing_rpc.dll
2017-04-05 23:28 - 2017-04-05 23:28 - 00293936 _____ () C:\Program Files\AVAST Software\Avast\gaming_mode_ui.dll
2017-03-24 17:24 - 2017-03-24 17:24 - 16058368 _____ () C:\Program Files\WindowsApps\9E2F88E3.Twitter_5.6.1.0_x86__wgeqdkkx372wm\Twitter.Windows.dll

==================== Alternate Data Streams (Whitelisted) =========

(If an entry is included in the fixlist, only the ADS will be removed.)


==================== Safe Mode (Whitelisted) ===================

(If an entry is included in the fixlist, it will be removed from the registry. The "AlternateShell" will be restored.)


==================== Association (Whitelisted) ===============

(If an entry is included in the fixlist, the registry item will be restored to default or removed.)


==================== Internet Explorer trusted/restricted ===============

(If an entry is included in the fixlist, it will be removed from the registry.)


==================== Hosts content: ===============================

(If needed Hosts: directive could be included in the fixlist to reset Hosts.)

2015-10-30 10:24 - 2017-04-21 16:38 - 00000027 ____A C:\WINDOWS\system32\Drivers\etc\hosts

127.0.0.1 localhost

==================== Other Areas ============================

(Currently there is no automatic fix for this section.)

HKU\S-1-5-21-386011426-3842006082-317715658-1001\Control Panel\Desktop\\Wallpaper -> C:\Users\vesam\AppData\Local\Microsoft\Windows\Themes\RoamedThemeFiles\DesktopBackground\thaimed.jpg
DNS Servers: 192.168.8.1
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System => (ConsentPromptBehaviorAdmin: 5) (ConsentPromptBehaviorUser: 3) (EnableLUA: 1)
Windows Firewall is enabled.

==================== MSCONFIG/TASK MANAGER disabled items ==

HKLM\...\StartupApproved\Run: => "RTHDVCPL"
HKLM\...\StartupApproved\Run: => "boincmgr"
HKLM\...\StartupApproved\Run: => "boinctray"
HKU\S-1-5-21-386011426-3842006082-317715658-1001\...\StartupApproved\Run: => "OneDrive"

==================== FirewallRules (Whitelisted) ===============

(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)

FirewallRules: [vm-monitoring-nb-session] => (Allow) LPort=139
FirewallRules: [TCP Query User{AA8FC19F-F9A2-4012-B0CB-E837D8907D5C}C:\users\vesam\appdata\roaming\acestream\engine\ace_engine.exe] => (Allow) C:\users\vesam\appdata\roaming\acestream\engine\ace_engine.exe
FirewallRules: [UDP Query User{BD2D86C8-CDA3-41B1-9341-AA2EBA6402CD}C:\users\vesam\appdata\roaming\acestream\engine\ace_engine.exe] => (Allow) C:\users\vesam\appdata\roaming\acestream\engine\ace_engine.exe
FirewallRules: [{DF6A6BFB-3899-49E3-A3BC-59BB0F3FFA8F}] => (Allow) C:\Program Files\Samsung\Samsung Link\Samsung Link Tray Agent.exe
FirewallRules: [{F12A5377-A548-4013-8F0E-AA55C246C7D3}] => (Allow) C:\Program Files\Samsung\Samsung Link\Samsung Link.exe
FirewallRules: [{D4D31348-0981-4099-B5D0-642DEC707E77}] => (Allow) C:\Program Files\Samsung\Samsung Link\Samsung Link Tray Agent.exe
FirewallRules: [{A9B240A4-1D8A-4B99-B8FA-E92D4338A9C7}] => (Allow) C:\Program Files\Samsung\Samsung Link\Samsung Link.exe
FirewallRules: [{3702482E-ECC1-47CC-A9BE-565EC036AE49}] => (Allow) C:\Program Files\Samsung\AllShare Framework DMS\1.3.23\AllShareFrameworkDMS.exe
FirewallRules: [{8A61E0D3-45E9-443B-9517-843CB47718C0}] => (Allow) C:\Program Files\Samsung\AllShare Framework DMS\1.3.23\AllShareFrameworkDMS.exe
FirewallRules: [{0B5E2334-0E7C-4DDA-B21A-ECE35C70CC4B}] => (Allow) LPort=8743
FirewallRules: [{C64A69C9-B79A-41AB-B7A0-1319093B6D9D}] => (Allow) LPort=8643
FirewallRules: [{C9607608-488D-4876-BAE9-781FFE87670F}] => (Allow) LPort=7676
FirewallRules: [{87FC6CF4-A061-4EEE-B2AE-D452CC427613}] => (Allow) LPort=7679
FirewallRules: [{014F17B2-4517-413F-AC8C-198C7246059B}] => (Allow) LPort=24234
FirewallRules: [{2940BD08-83A1-4207-BC5F-290CDB65D005}] => (Allow) LPort=7900
FirewallRules: [{4CF8D0E6-AC2B-449A-BD2D-111E99AA38A0}] => (Allow) LPort=1900
FirewallRules: [{2574A983-C49F-41A2-9F62-C78C9A1CEA7E}] => (Allow) C:\Program Files (x86)\Mozilla Firefox\firefox.exe
FirewallRules: [{F3DF5CFF-C259-486C-8833-5335A5A4078D}] => (Allow) C:\Program Files (x86)\Mozilla Firefox\firefox.exe
FirewallRules: [{00CDBF86-6FA2-4FB2-8EE4-E909FB62F665}] => (Allow) C:\Program Files\AVAST Software\SZBrowser\3.55.2393.590_0\SZBrowser.exe
FirewallRules: [{777E8E66-7D56-4189-AB98-B496E8A156FB}] => (Allow) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
FirewallRules: [{4095C78E-9851-4F95-90F2-620220F73E1F}] => (Allow) C:\Program Files\AVAST Software\SZBrowser\3.55.2393.596\SZBrowser.exe

==================== Restore Points =========================

11-04-2017 22:38:45 Windows Update
19-04-2017 20:31:03 malw

==================== Faulty Device Manager Devices =============

Name: USB-skannauslaite
Description: USB-skannauslaite
Class Guid: {6bdd1fc6-810f-11d0-bec7-08002be2092f}
Manufacturer: Microsoft
Service: usbscan
Problem: : This device cannot start. (Code10)
Resolution: Device failed to start. Click "Update Driver" to update the drivers for this device.
On the "General Properties" tab of the device, click "Troubleshoot" to start the troubleshooting wizard.


==================== Event log errors: =========================

Application errors:
==================
Error: (04/22/2017 07:21:09 PM) (Source: Application Error) (EventID: 1000) (User: )
Description: Viallisen sovelluksen nimi: svchost.exe_stisvc, versio: 10.0.14393.0, aikaleima: 0x57899b1c
Viallisen moduulin nimi: ntdll.dll, versio: 10.0.14393.479, aikaleima: 0x5825887f
Poikkeuskoodi: 0xc0000008
Virhepoikkeama: 0x00000000000a9d2a
Viallisen prosessin tunnus: 0x9ac
Viallisen sovelluksen käynnistysaika: 0x01d2baa53fcc52e1
Viallisen sovelluksen polku: C:\WINDOWS\system32\svchost.exe
Viallisen moduulin polku: C:\WINDOWS\SYSTEM32\ntdll.dll
Raportin tunnus: 019af07f-ada2-4aad-be34-283d78a07cac
Viallisen paketin koko nimi:
Viallisen paketin suhteellinen sovellustunnus:

Error: (04/22/2017 03:13:48 PM) (Source: Application Hang) (EventID: 1002) (User: )
Description: Ohjelman chrome.exe versio 57.0.2987.133, lakkasi olemasta yhteydessä Windowsiin, joten se suljettiin. Voit tarkistaa, onko ongelmasta saatavilla lisätietoja, tarkastelemalla ongelmahistoriaa ohjauspaneelin Suojaus ja ylläpito -kohdassa.

Prosessin tunnus: d48

Alkamisaika: 01d2bb56f046ce58

Päättymisaika: 4

Sovelluksen polku: C:\Program Files (x86)\Google\Chrome\Application\chrome.exe

Raportin tunnus: 1653529a-2755-11e7-824b-80a589a93236

Viallisen paketin koko nimi:

Viallisen paketin suhteellinen sovellustunnus:

Error: (04/22/2017 03:08:46 PM) (Source: Microsoft-Windows-Immersive-Shell) (EventID: 5973) (User: DESKTOP-QL010TM)
Description: Sovelluksen Microsoft.BingWeather_8wekyb3d8bbwe!App aktivointi epäonnistui, virhe: -2144927142. Lisätietoja on Microsoft-Windows-TWinUI/Toiminnassa-lokissa.

Error: (04/22/2017 03:08:20 PM) (Source: Microsoft-Windows-Immersive-Shell) (EventID: 5973) (User: DESKTOP-QL010TM)
Description: Sovelluksen windows.immersivecontrolpanel_cw5n1h2txyewy!microsoft.windows.immersivecontrolpanel aktivointi epäonnistui, virhe: -2144927142. Lisätietoja on Microsoft-Windows-TWinUI/Toiminnassa-lokissa.

Error: (04/22/2017 03:07:54 PM) (Source: Microsoft-Windows-Immersive-Shell) (EventID: 5973) (User: DESKTOP-QL010TM)
Description: Sovelluksen Microsoft.Windows.Photos_8wekyb3d8bbwe!App aktivointi epäonnistui, virhe: -2144927142. Lisätietoja on Microsoft-Windows-TWinUI/Toiminnassa-lokissa.

Error: (04/22/2017 01:57:30 PM) (Source: Microsoft-Windows-Immersive-Shell) (EventID: 5973) (User: DESKTOP-QL010TM)
Description: Sovelluksen Microsoft.BingWeather_8wekyb3d8bbwe!App aktivointi epäonnistui, virhe: -2144927148. Lisätietoja on Microsoft-Windows-TWinUI/Toiminnassa-lokissa.

Error: (04/21/2017 04:38:22 PM) (Source: VSS) (EventID: 8193) (User: )
Description: Aseman tilannevedospalvelun virhe: Odottamaton virhe kutsuttaessa toimintoa QueryFullProcessImageNameW. hr = 0x80070006, Kahva ei kelpaa.
.


Toiminto:
Suoritetaan asynkronista toimintoa

Sijainti:
Nykyinen tila: DoSnapshotSet

Error: (04/21/2017 04:38:09 PM) (Source: Microsoft-Windows-CAPI2) (EventID: 513) (User: )
Description: Salauspalvelut eivät voineet käsitellä OnIdentity()-kutsua järjestelmän kirjoitusobjektissa.

Details:
AddLegacyDriverFiles: Unable to back up image of binary Microsoftin linkkikerroksen etsintäprotokolla.

System Error:
Käyttö estetty.
.

Error: (04/21/2017 04:37:55 PM) (Source: VSS) (EventID: 8194) (User: )
Description: Aseman tilannevedospalvelun virhe: Odottamaton virhe kyseltäessä IVssWriterCallback-liittymää. hr = 0x80070005, Käyttö estetty.
.
Syynä ovat usein joko kirjoittaja- tai pyytäjäprosessin virheelliset suojausasetukset.


Toiminto:
Kerätään kirjoitustoiminnon tietoja

Sijainti:
Kirjoitustoiminnon luokkatunnus: {e8132975-6f93-4464-a53e-1050253ae220}
Kirjoitustoiminnon nimi: System Writer
Kirjoitustoiminnon esiintymän tunnus: {cd244b79-1a63-4cee-805b-2098afc95411}

Error: (04/20/2017 08:31:30 PM) (Source: Microsoft-Windows-Immersive-Shell) (EventID: 5973) (User: DESKTOP-QL010TM)
Description: Sovelluksen Microsoft.BingWeather_8wekyb3d8bbwe!App aktivointi epäonnistui, virhe: -2144927148. Lisätietoja on Microsoft-Windows-TWinUI/Toiminnassa-lokissa.


System errors:
=============
Error: (04/23/2017 06:46:51 PM) (Source: DCOM) (EventID: 10016) (User: NT-hallinta)
Description: Kohteen sovelluskohtainen käyttöoikeusasetukset eivät myönnä käyttäjälle NT-hallinta\Paikallinen palvelu, SID-tunnus (S-1-5-19) osoitteesta LocalHost (LRPC käytössä), käyttöoikeutta Paikallinen Aktivointi COM-palvelimen sovellukseen, jonka CLSID-tunnus on
{6B3B8D23-FA8D-40B9-8DBD-B950333E2C52}
ja APPID-tunnus on
{4839DDB7-58C2-48F5-8283-E1D1807D0D7D}
ja joka suoritetaan sovellussäilössä Ei käytettävissä, SID-tunnus (Ei käytettävissä). Tätä suojauskäyttöoikeutta voi muokata komponenttipalveluiden hallintatyökalulla.

Error: (04/23/2017 06:46:51 PM) (Source: DCOM) (EventID: 10016) (User: NT-hallinta)
Description: Kohteen sovelluskohtainen käyttöoikeusasetukset eivät myönnä käyttäjälle NT-hallinta\Paikallinen palvelu, SID-tunnus (S-1-5-19) osoitteesta LocalHost (LRPC käytössä), käyttöoikeutta Paikallinen Aktivointi COM-palvelimen sovellukseen, jonka CLSID-tunnus on
{6B3B8D23-FA8D-40B9-8DBD-B950333E2C52}
ja APPID-tunnus on
{4839DDB7-58C2-48F5-8283-E1D1807D0D7D}
ja joka suoritetaan sovellussäilössä Ei käytettävissä, SID-tunnus (Ei käytettävissä). Tätä suojauskäyttöoikeutta voi muokata komponenttipalveluiden hallintatyökalulla.

Error: (04/23/2017 06:46:50 PM) (Source: DCOM) (EventID: 10016) (User: NT-hallinta)
Description: Kohteen sovelluskohtainen käyttöoikeusasetukset eivät myönnä käyttäjälle NT-hallinta\SYSTEM, SID-tunnus (S-1-5-18) osoitteesta LocalHost (LRPC käytössä), käyttöoikeutta Paikallinen Aktivointi COM-palvelimen sovellukseen, jonka CLSID-tunnus on
{8D8F4F83-3594-4F07-8369-FC3C3CAE4919}
ja APPID-tunnus on
{F72671A9-012C-4725-9D2F-2A4D32D65169}
ja joka suoritetaan sovellussäilössä Ei käytettävissä, SID-tunnus (Ei käytettävissä). Tätä suojauskäyttöoikeutta voi muokata komponenttipalveluiden hallintatyökalulla.

Error: (04/23/2017 06:46:20 PM) (Source: Application Popup) (EventID: 56) (User: )
Description: ACPI5

Error: (04/23/2017 06:45:53 PM) (Source: DCOM) (EventID: 10016) (User: NT-hallinta)
Description: Kohteen sovelluskohtainen käyttöoikeusasetukset eivät myönnä käyttäjälle NT-hallinta\SYSTEM, SID-tunnus (S-1-5-18) osoitteesta LocalHost (LRPC käytössä), käyttöoikeutta Paikallinen Aktivointi COM-palvelimen sovellukseen, jonka CLSID-tunnus on
{D63B10C5-BB46-4990-A94F-E40B9D520160}
ja APPID-tunnus on
{9CA88EE3-ACB7-47C8-AFC4-AB702511C276}
ja joka suoritetaan sovellussäilössä Ei käytettävissä, SID-tunnus (Ei käytettävissä). Tätä suojauskäyttöoikeutta voi muokata komponenttipalveluiden hallintatyökalulla.

Error: (04/23/2017 03:02:46 PM) (Source: DCOM) (EventID: 10016) (User: NT-hallinta)
Description: Kohteen sovelluskohtainen käyttöoikeusasetukset eivät myönnä käyttäjälle NT-hallinta\Paikallinen palvelu, SID-tunnus (S-1-5-19) osoitteesta LocalHost (LRPC käytössä), käyttöoikeutta Paikallinen Aktivointi COM-palvelimen sovellukseen, jonka CLSID-tunnus on
{6B3B8D23-FA8D-40B9-8DBD-B950333E2C52}
ja APPID-tunnus on
{4839DDB7-58C2-48F5-8283-E1D1807D0D7D}
ja joka suoritetaan sovellussäilössä Ei käytettävissä, SID-tunnus (Ei käytettävissä). Tätä suojauskäyttöoikeutta voi muokata komponenttipalveluiden hallintatyökalulla.

Error: (04/23/2017 03:02:46 PM) (Source: DCOM) (EventID: 10016) (User: NT-hallinta)
Description: Kohteen sovelluskohtainen käyttöoikeusasetukset eivät myönnä käyttäjälle NT-hallinta\Paikallinen palvelu, SID-tunnus (S-1-5-19) osoitteesta LocalHost (LRPC käytössä), käyttöoikeutta Paikallinen Aktivointi COM-palvelimen sovellukseen, jonka CLSID-tunnus on
{6B3B8D23-FA8D-40B9-8DBD-B950333E2C52}
ja APPID-tunnus on
{4839DDB7-58C2-48F5-8283-E1D1807D0D7D}
ja joka suoritetaan sovellussäilössä Ei käytettävissä, SID-tunnus (Ei käytettävissä). Tätä suojauskäyttöoikeutta voi muokata komponenttipalveluiden hallintatyökalulla.

Error: (04/23/2017 03:02:44 PM) (Source: DCOM) (EventID: 10016) (User: NT-hallinta)
Description: Kohteen sovelluskohtainen käyttöoikeusasetukset eivät myönnä käyttäjälle NT-hallinta\SYSTEM, SID-tunnus (S-1-5-18) osoitteesta LocalHost (LRPC käytössä), käyttöoikeutta Paikallinen Aktivointi COM-palvelimen sovellukseen, jonka CLSID-tunnus on
{8D8F4F83-3594-4F07-8369-FC3C3CAE4919}
ja APPID-tunnus on
{F72671A9-012C-4725-9D2F-2A4D32D65169}
ja joka suoritetaan sovellussäilössä Ei käytettävissä, SID-tunnus (Ei käytettävissä). Tätä suojauskäyttöoikeutta voi muokata komponenttipalveluiden hallintatyökalulla.

Error: (04/23/2017 01:05:56 PM) (Source: DCOM) (EventID: 10016) (User: NT-hallinta)
Description: Kohteen sovelluskohtainen käyttöoikeusasetukset eivät myönnä käyttäjälle NT-hallinta\SYSTEM, SID-tunnus (S-1-5-18) osoitteesta LocalHost (LRPC käytössä), käyttöoikeutta Paikallinen Aktivointi COM-palvelimen sovellukseen, jonka CLSID-tunnus on
{D63B10C5-BB46-4990-A94F-E40B9D520160}
ja APPID-tunnus on
{9CA88EE3-ACB7-47C8-AFC4-AB702511C276}
ja joka suoritetaan sovellussäilössä Ei käytettävissä, SID-tunnus (Ei käytettävissä). Tätä suojauskäyttöoikeutta voi muokata komponenttipalveluiden hallintatyökalulla.

Error: (04/23/2017 09:40:40 AM) (Source: DCOM) (EventID: 10016) (User: NT-hallinta)
Description: Kohteen sovelluskohtainen käyttöoikeusasetukset eivät myönnä käyttäjälle NT-hallinta\Paikallinen palvelu, SID-tunnus (S-1-5-19) osoitteesta LocalHost (LRPC käytössä), käyttöoikeutta Paikallinen Aktivointi COM-palvelimen sovellukseen, jonka CLSID-tunnus on
{6B3B8D23-FA8D-40B9-8DBD-B950333E2C52}
ja APPID-tunnus on
{4839DDB7-58C2-48F5-8283-E1D1807D0D7D}
ja joka suoritetaan sovellussäilössä Ei käytettävissä, SID-tunnus (Ei käytettävissä). Tätä suojauskäyttöoikeutta voi muokata komponenttipalveluiden hallintatyökalulla.


==================== Memory info ===========================

Processor: Intel(R) Core(TM) i3-6100 CPU @ 3.70GHz
Percentage of memory in use: 27%
Total physical RAM: 8077.89 MB
Available physical RAM: 5881.24 MB
Total Virtual: 16269.89 MB
Available Virtual: 13943.78 MB

==================== Drives ================================

Drive c: (Windows) (Fixed) (Total:149.56 GB) (Free:91.83 GB) NTFS
Drive d: (Data) (Fixed) (Total:780.91 GB) (Free:734.03 GB) NTFS

==================== MBR & Partition Table ==================

========================================================
Disk: 0 (Size: 931.5 GB) (Disk ID: 35422FF6)

Partition: GPT.

==================== End of Addition.txt ============================
humanerror
Regular Member
 
Posts: 50
Joined: October 14th, 2008, 8:36 am

Re: spected malware although Avast finds no problems

Unread postby mAL_rEm018 » April 24th, 2017, 7:04 am

Hello humanerror,

We still have one minor fix to run. Please note that I did not disable any of the services that were re-enabled with Msconfig, since you mentioned that you had no idea they were disabled. If for any reason you want me to disable them with another fix, then just let me know.

  • Click Start
  • Type notepad.exe in the search programs and files box and click Enter.
  • A blank Notepad page should open.
    • Copy/Paste the contents of the code box below into Notepad.
Code: Select all
D:\hellsten\muidenjutut\marjanvanhakone\Downloads\bsplayer236.990_clip.exe
FirewallRules: [TCP Query User{AA8FC19F-F9A2-4012-B0CB-E837D8907D5C}C:\users\vesam\appdata\roaming\acestream\engine\ace_engine.exe] => (Allow) C:\users\vesam\appdata\roaming\acestream\engine\ace_engine.exe
FirewallRules: [UDP Query User{BD2D86C8-CDA3-41B1-9341-AA2EBA6402CD}C:\users\vesam\appdata\roaming\acestream\engine\ace_engine.exe] => (Allow) C:\users\vesam\appdata\roaming\acestream\engine\ace_engine.exe

EmptyTemp:
CreateRestorePoint:

    • Save it to the same folder/directory that FRST.exe is in, naming it as fixlist.txt

NOTICE: This script was written specifically for this user. Running it on another machine may cause damage to your operating system

  • Start FRST in a similar manner to when you ran a scan earlier, but this time when it opens ....
    • Press the Fix button once and wait.
    • FRST will process fixlist.txt
    • When finished, it will produce a log fixlog.txt in the same folder/directory as FRST64.exe
    • Please post me the log

Let me know how your computer is behaving at this point. If all is well, then I will post my all clean.
User avatar
mAL_rEm018
MRU Teacher
MRU Teacher
 
Posts: 1323
Joined: November 11th, 2013, 6:26 pm
Location: Canada

Re: spected malware although Avast finds no problems

Unread postby humanerror » April 24th, 2017, 7:34 am

- My computer is behaving well.

Fix result of Farbar Recovery Scan Tool (x64) Version: 23-04-2017 01
Ran by vesam (24-04-2017 14:24:12) Run:2
Running from C:\Users\vesam\Downloads
Loaded Profiles: vesam (Available Profiles: vesam)
Boot Mode: Normal
==============================================

fixlist content:
*****************
D:\hellsten\muidenjutut\marjanvanhakone\Downloads\bsplayer236.990_clip.exe
FirewallRules: [TCP Query User{AA8FC19F-F9A2-4012-B0CB-E837D8907D5C}C:\users\vesam\appdata\roaming\acestream\engine\ace_engine.exe] => (Allow) C:\users\vesam\appdata\roaming\acestream\engine\ace_engine.exe
FirewallRules: [UDP Query User{BD2D86C8-CDA3-41B1-9341-AA2EBA6402CD}C:\users\vesam\appdata\roaming\acestream\engine\ace_engine.exe] => (Allow) C:\users\vesam\appdata\roaming\acestream\engine\ace_engine.exe

EmptyTemp:
CreateRestorePoint:
*****************

D:\hellsten\muidenjutut\marjanvanhakone\Downloads\bsplayer236.990_clip.exe => moved successfully
HKLM\SYSTEM\CurrentControlSet\services\SharedAccess\Parameters\FirewallPolicy\FirewallRules\\TCP Query User{AA8FC19F-F9A2-4012-B0CB-E837D8907D5C}C:\users\vesam\appdata\roaming\acestream\engine\ace_engine.exe => value removed successfully
HKLM\SYSTEM\CurrentControlSet\services\SharedAccess\Parameters\FirewallPolicy\FirewallRules\\UDP Query User{BD2D86C8-CDA3-41B1-9341-AA2EBA6402CD}C:\users\vesam\appdata\roaming\acestream\engine\ace_engine.exe => value removed successfully
Restore point was successfully created.

=========== EmptyTemp: ==========

BITS transfer queue => 0 B
DOMStore, IE Recovery, AppCache, Feeds Cache, Thumbcache, IconCache => 20156433 B
Java, Flash, Steam htmlcache => 0 B
Windows/system/drivers => 104648 B
Edge => 0 B
Chrome => 419080958 B
Firefox => 0 B
Opera => 0 B

Temp, IE cache, history, cookies, recent:
Default => 0 B
Users => 0 B
ProgramData => 0 B
Public => 0 B
systemprofile => 128 B
systemprofile32 => 0 B
LocalService => 4222 B
NetworkService => 0 B
vesam => 11695099 B

RecycleBin => 0 B
EmptyTemp: => 430.1 MB temporary data Removed.

================================


The system needed a reboot.

==== End of Fixlog 14:24:49 ====
humanerror
Regular Member
 
Posts: 50
Joined: October 14th, 2008, 8:36 am

Re: spected malware although Avast finds no problems

Unread postby mAL_rEm018 » April 24th, 2017, 8:01 am

Hello humanerror,

I have good news..your computer appears to be all clean! :) Please follow the steps below and then you'll be all set to go.

Let's take care of the outdated software on your computer..

  • Please open the Start menu.
  • Click on Settings and then System.
  • Select Apps & Features.
  • Locate and click on the following programs:
      Java 8 Update 121
  • Select uninstall.
  • Answer any questions attentively.
  • When the process is finished, please restart your computer.
    Note: you can only remove one program at a time.

To re-install Java, follow the steps below..
  • Click on the following link: Java.
  • Save the executable file to your desktop and close your browser.
  • Right-click on jre-8u131-windows-i586-iftw.exe and select Run as administrator.
  • Make sure to read the license agreement and then click on Install.
    Uncheck all software offers bundled with Java.
  • Select Next.
  • When the process is over, select Close.
    Note: when you select Close your browser will automatically be opened to check if Java was properly installed.
  • You can now check to see if you have the latest Java version by clicking on Verify Java Version.


I noticed that your Firefox browser was outdated. If you have not already done so, please follow the steps below to update it.

Update Firefox
  • Open Firefox.
  • Click on Help in the Menu Bar.
  • Select About Firefox.
  • When the update has finished downloading, click Restart Firefox to Update.
    Firefox should now be updated. If you were unable to update FF, please let me know in your next post.

Let's remove the tools we have been using so far..
  • Please download Delfix to your desktop.
  • Right-click on delfix_1.013.exe and select Run as administrator.
  • Check the following boxes:
    • Remove disinfection tools
    • Purge system restore
  • You can now safely remove any tools and/or logs that may remain on your computer.


You should also read and get acquainted with the following topic: COMPUTER SECURITY - a short guide to staying safer online , which goes into depth on how to keep your computer secure. I bookmarked it for easy reference and so should you.


If you have any questions, feel free to ask them, otherwise please let me know that you've seen this post and I will request for this topic to be closed.
User avatar
mAL_rEm018
MRU Teacher
MRU Teacher
 
Posts: 1323
Joined: November 11th, 2013, 6:26 pm
Location: Canada
Advertisement
Register to Remove

Next

  • Similar Topics
    Replies
    Views
    Last post

Return to Infected? Virus, malware, adware, ransomware, oh my!



Who is online

Users browsing this forum: No registered users and 69 guests

Contact us:

Advertisements do not imply our endorsement of that product or service. Register to remove all ads. The forum is run by volunteers who donate their time and expertise. We make every attempt to ensure that the help and advice posted is accurate and will not cause harm to your computer. However, we do not guarantee that they are accurate and they are to be used at your own risk. All trademarks are the property of their respective owners.

Member site: UNITE Against Malware