1. Computer problem? Tech Support Guy is completely free -- paid for by advertisers and donations. Click here to join today! If you're new to Tech Support Guy, we highly recommend that you visit our Guide for New Members.

In Progress Computer Has Been Acting A Bit Slow

Discussion in 'Virus & Other Malware Removal' started by HaroRider, Jun 1, 2019.

Advertisement
  1. HaroRider

    HaroRider Thread Starter

    Joined:
    Aug 9, 2006
    Messages:
    385
    Hello, I have been having issues with my computer running slow and was just wondering if maybe there could possibly be any malware or spyware causing this?

    In addition, my credit card information was recently stolen. The credit card company did not think it was from an on-line transaction, however I figure I better be safe than sorry. Thanks!
    ____________________________________________________________________________

    Tech Support Guy System Info Utility version 1.0.0.4
    OS Version: Microsoft Windows 7 Ultimate, Service Pack 1, 64 bit
    Processor: Intel(R) Core(TM)2 CPU 6420 @ 2.13GHz, Intel64 Family 6 Model 15 Stepping 6
    Processor Count: 2
    RAM: 7167 Mb
    Graphics Card: NVIDIA GeForce GT 630, -2048 Mb
    Hard Drives: C: 232 GB (81 GB Free);
    Motherboard: ASUSTeK Computer INC., P5B-E Plus
    Antivirus: Microsoft Security Essentials, Enabled and Updated
     
    Laurardhodes14 likes this.
  2. flavallee

    flavallee Trusted Advisor

    Joined:
    May 12, 2002
    Messages:
    79,276
    First Name:
    Frank
    cpu.JPG

    gpu.JPG

    8 GB DDR2 RAM
    ASUS P5B-E Plus motherboard

    ----------------------------------------------------------------

    The main reasons that I can see why your computer is running slow is:
    It has a very weak-performing Intel processor
    Its running the most system-hungry/feature-rich version of Windows 7.
    It has older slower hardware.

    ----------------------------------------------------------------
     
  3. HaroRider

    HaroRider Thread Starter

    Joined:
    Aug 9, 2006
    Messages:
    385
    Hmm, I understand. I'm still a bit worried about my credit card info being stolen again. Is it possible to know if there is something on my computer that could steal my info?
     
  4. flavallee

    flavallee Trusted Advisor

    Joined:
    May 12, 2002
    Messages:
    79,276
    First Name:
    Frank
    I don't believe this is something that we can help you with, but that decision can be made by a Malware Specialist.

    The "Virus & Other Malware Removal" section is very busy, so be patient until a Malware Specialist replies.

    ----------------------------------------------------------------
     
  5. iMacg3

    iMacg3 Malware Specialist

    Joined:
    Nov 3, 2018
    Messages:
    417
    Hi HaroRider, Welcome to the Tech Support Guy malware removal forum.

    I am iMacg3 and will be helping you with your computer problems.

    Please keep the following information in mind before we begin:
    • Back up any important data before we continue.
      • Back up any important data on your computer to external media. I will not knowingly suggest any steps that will damage your computer; however, malware infections are often unpredictable and it may be necessary to reformat and reinstall your operating system depending on the infection.
    • Do not run any fixes or tools on your system unless I request that you do so.
      • Running additional tools on your system can interfere with the clean-up process, or cause issues such as false positives.
    • Please read all instructions carefully, and complete them in the order listed.
      • Items that are especially important will be highlighted in bold or red.
    • If your computer seems to start working normally, please don't abandon the topic.
      • Even if your system is behaving normally, there may still be some malware remnants left over. Additionally, malware can re-infect the computer if some remnants are left. Therefore, please complete all requested steps to make sure any malware is successfully eradicated from your PC.
    • If you have pirated or illegal software on your computer, uninstall it now before proceeding.
      • Using pirated/cracked software is an easy way to infect your computer - almost as easy as intentionally downloading malware. Therefore, please remove any, if present, before we begin the clean-up.
    • If you have questions at any time during the cleanup, feel free to ask.

    ---------------------------------------------------
    Farbar Recovery Scan Tool (FRST)
    • Download FRST to your Desktop. (for 32 bit systems)
    • Download FRST64 to your Desktop. (for 64 bit systems)
    • Double click Frst.exe/Frst64.exe to launch it.
    • FRST will start to run.
      • When the tool opens click Yes to the disclaimer.
      • Press the Scan button.
      • When finished scanning 2 logs will open on your Desktop, FRST.txt and Addition.txt
      • Please post them in your next reply.
     
  6. Couriant

    Couriant Trusted Advisor

    Joined:
    Mar 26, 2002
    Messages:
    32,963
    First Name:
    James
    To add to this: this board I believe is 10+ years old so I assume the hard drive is also old? (i.e. mechanical) If so, then that could also be an issue. If you haven't did a fresh install of Windows in a while a refresh may help (along with more memory) but if it's a hardware issue you may need to replace the drive for a faster one that can be supported.
     
  7. HaroRider

    HaroRider Thread Starter

    Joined:
    Aug 9, 2006
    Messages:
    385
    Scan result of Farbar Recovery Scan Tool (FRST) (x64) Version: 04-06-2019
    Ran by Thomas (administrator) on THOMAS-PC (04-06-2019 22:36:15)
    Running from C:\Users\Thomas\Desktop
    Loaded Profiles: Thomas (Available Profiles: Thomas)
    Platform: Windows 7 Ultimate Service Pack 1 (X64) Language: English (United States)
    Internet Explorer Version 11 (Default browser: IE)
    Boot Mode: Normal
    Tutorial for Farbar Recovery Scan Tool: http://www.geekstogo.com/forum/topic/335081-frst-tutorial-how-to-use-farbar-recovery-scan-tool/

    ==================== Processes (Whitelisted) =================

    (If an entry is included in the fixlist, the process will be closed. The file will not be moved.)

    (Adobe Systems, Incorporated -> Adobe Systems Incorporated) C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe
    (Apple Inc. -> Apple Inc.) C:\Program Files\Bonjour\mDNSResponder.exe
    (Apple Inc. -> Apple Inc.) C:\Program Files\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe
    (Apple Inc. -> Apple Inc.) C:\Program Files\iPod\bin\iPodService.exe
    (Apple Inc. -> Apple Inc.) C:\Program Files\iTunes\iTunesHelper.exe
    (Microsoft Corporation -> Microsoft Corporation) C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE
    (Microsoft Corporation -> Microsoft Corporation) C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVCM.EXE
    (Microsoft Corporation -> Microsoft Corporation) C:\Program Files\Microsoft Security Client\MsMpEng.exe
    (Microsoft Corporation -> Microsoft Corporation) C:\Program Files\Microsoft Security Client\msseces.exe
    (Microsoft Corporation -> Microsoft Corporation) C:\Program Files\Microsoft Security Client\NisSrv.exe
    (Microsoft Windows -> Microsoft Corporation) C:\Program Files\Windows Sidebar\sidebar.exe
    (Microsoft Windows -> Microsoft Corporation) C:\Windows\System32\dllhost.exe
    (Microsoft Windows Hardware Compatibility Publisher -> Creative Technology Ltd) C:\Windows\SysWOW64\CtHelper.exe
    (NVIDIA Corporation -> NVIDIA Corporation) C:\Program Files (x86)\NVIDIA Corporation\3D Vision\nvSCPAPISvr.exe
    (NVIDIA Corporation -> NVIDIA Corporation) C:\Program Files (x86)\NVIDIA Corporation\NetService\NvNetworkService.exe
    (NVIDIA Corporation -> NVIDIA Corporation) C:\Program Files (x86)\NVIDIA Corporation\Update Core\NvBackend.exe
    (NVIDIA Corporation -> NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\Display\nvxdsync.exe
    (NVIDIA Corporation -> NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\GeForce Experience Service\GfExperienceService.exe
    (NVIDIA Corporation -> NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\NvStreamSrv\nvstreamsvc.exe
    (NVIDIA Corporation -> NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\NvStreamSrv\nvstreamsvc.exe
    (NVIDIA Corporation -> NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\NvStreamSrv\nvstreamsvc.exe
    (NVIDIA Corporation -> NVIDIA Corporation) C:\Windows\System32\nvvsvc.exe
    (NVIDIA Corporation -> NVIDIA Corporation) C:\Windows\System32\nvvsvc.exe
    (SEIKO EPSON CORPORATION -> Seiko Epson Corporation) C:\Windows\System32\escsvc64.exe

    ==================== Registry (Whitelisted) ===========================

    (If an entry is included in the fixlist, the registry item will be restored to default or removed. The file will not be moved.)

    HKLM\...\Run: [AsioReg] => REGSVR32.EXE /S CTASIO.DLL
    HKLM\...\Run: [NvBackend] => C:\Program Files (x86)\NVIDIA Corporation\Update Core\NvBackend.exe [2465088 2014-11-17] (NVIDIA Corporation -> NVIDIA Corporation)
    HKLM\...\Run: [ShadowPlay] => C:\Windows\system32\nvspcap64.dll [2800296 2014-11-17] (NVIDIA Corporation PE Sign v2014 -> NVIDIA Corporation) [File not signed]
    HKLM\...\Run: [MSC] => c:\Program Files\Microsoft Security Client\msseces.exe [1353680 2016-11-14] (Microsoft Corporation -> Microsoft Corporation)
    HKLM\...\Run: [iTunesHelper] => C:\Program Files\iTunes\iTunesHelper.exe [176952 2016-05-11] (Apple Inc. -> Apple Inc.)
    HKLM-x32\...\Run: [AsioThk32Reg] => REGSVR32.EXE /S CTASIO.DLL
    HKLM-x32\...\Run: [CTHelper] => C:\Windows\SysWOW64\CTHELPER.EXE [19456 2007-04-09] (Microsoft Windows Hardware Compatibility Publisher -> Creative Technology Ltd)
    HKLM-x32\...\Run: [CTxfiHlp] => C:\Windows\SysWOW64\CTXFIHLP.EXE [19968 2007-04-09] (Microsoft Windows Hardware Compatibility Publisher -> Creative Technology Ltd)
    HKU\S-1-5-21-2475564236-1283100031-3943380601-1001\...\Run: [Chromium] => "c:\users\thomas\appdata\local\chromium\application\chrome.exe" --auto-launch-at-startup --profile-directory="Default" --restore-last-session
    HKU\S-1-5-21-2475564236-1283100031-3943380601-1001\...\Run: [McAfeeSafeConnect] => C:\Program Files (x86)\McAfee Safe Connect\McAfee Safe Connect.exe isAutoLaunch
    HKU\S-1-5-21-2475564236-1283100031-3943380601-1001\...\MountPoints2: {4d231d87-7835-11e4-a18d-806e6f6e6963} - D:\Setup.exe
    HKU\S-1-5-21-2475564236-1283100031-3943380601-1001\...\MountPoints2: {6089965c-9de3-11e4-8f8f-001a92d2f743} - K:\LG_PC_Programs.exe
    HKU\S-1-5-18\...\Run: [DevconDefaultDB] => C:\Windows\system32\READREG /SILENT /FAIL=1
    HKLM\...\Drivers32: [vidc.dvsd] => C:\Windows\SysWOW64\pdvcodec.dll [265797 2014-05-21] (Matsushita Electric Industrial Co., Ltd.) [File not signed]
    HKLM\Software\Microsoft\Active Setup\Installed Components: [{8A69D345-D564-463c-AFF1-A69D9E530F96}] -> C:\Program Files (x86)\Google\Chrome\Application\74.0.3729.169\Installer\chrmstp.exe [2019-05-21] (Google LLC -> Google Inc.)
    HKLM\Software\Wow6432Node\Microsoft\Active Setup\Installed Components: [{8A69D345-D564-463c-AFF1-A69D9E530F96}] -> "C:\Program Files (x86)\Google\Chrome\Application\63.0.3239.132\Installer\chrmstp.exe" --configure-user-settings --verbose-logging --system-level
    HKLM\Software\Wow6432Node\Microsoft\Active Setup\Installed Components: [{A6EADE66-0000-0000-484E-7E8A45000000}] -> C:\Program Files (x86)\Adobe\Acrobat Reader DC\Esl\AiodLite.dll [2019-05-02] (Adobe Inc. -> Adobe Systems, Inc.)
    HKLM\Software\...\Authentication\Credential Providers: [{F8A0B131-5F68-486c-8040-7E8FC3C85BB6}] -> C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDCREDPROV.DLL [2009-08-18] (Microsoft Corporation -> Microsoft Corporation)

    ==================== Scheduled Tasks (Whitelisted) =============

    (If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)

    Task: {08CC7756-255F-4331-9FD4-B178EF47401F} - System32\Tasks\{655F5D48-1233-4C71-9614-1DBCF12EA07D} => "C:\Program Files\Internet Explorer\iexplore.exe" hxxp://ui.skype.com/ui/0/7.18.85.112/en/abandoninstall?page=tsProgressBar
    Task: {19ABE31F-D481-4CFE-BE34-CB02B20B9AC6} - System32\Tasks\Adobe Acrobat Update Task => C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe [1195544 2018-12-16] (Adobe Systems, Incorporated -> Adobe Systems Incorporated)
    Task: {25FDDB0C-50E4-4C51-82C7-083B337ED473} - System32\Tasks\GoogleUpdateTaskMachineCore => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe [144200 2015-08-29] (Google Inc -> Google Inc.)
    Task: {333D8719-A7F8-46D0-B297-0F68AA80916C} - System32\Tasks\MyDefrag v4.3.1 Daily => C:\Program Files\MyDefrag v4.3.1\Scripts\AutomaticDaily.MyD [5663 2010-05-21] () [File not signed]
    Task: {474B85D1-CA50-4EAF-8096-2C98C6775606} - System32\Tasks\GoogleUpdateTaskMachineUA => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe [144200 2015-08-29] (Google Inc -> Google Inc.)
    Task: {4960080B-A8B1-4886-883D-9B2FE4986648} - System32\Tasks\{4D025105-9C12-4688-8867-D34681DE77DD} => C:\Windows\system32\pcalua.exe -a "C:\Users\Thomas\Desktop\Honda Civic\2\SetupCivic.exe" -d "C:\Users\Thomas\Desktop\Honda Civic\2"
    Task: {4EBC6494-DFA8-4BAD-B454-E3B1A03A372D} - System32\Tasks\MyDefrag v4.3.1 Monthly => C:\Program Files\MyDefrag v4.3.1\Scripts\AutomaticMonthly.MyD [5626 2010-05-21] () [File not signed]
    Task: {51CED45B-5258-4D5C-AFAB-EE28B3EA6E92} - System32\Tasks\Adobe Flash Player Updater => C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe [335416 2019-05-14] (Adobe Inc. -> Adobe)
    Task: {884D045C-4B8F-4751-80B6-05A158B46B7E} - System32\Tasks\{B3FC8E5E-4391-4124-9091-548B3D7877BD} => C:\Windows\system32\pcalua.exe -a C:\Windows\IsUninst.exe -c -f"C:\Program Files (x86)\Maxis\The Sims\Uninst.isu"
    Task: {8C8D0618-D888-4296-BED9-4AAA0AA16E12} - System32\Tasks\EPSON ES-200 Update => C:\Program Files (x86)\epson\Epson Scan 2\Update\e_dtsksd.exe [690176 2018-05-08] (SEIKO EPSON CORPORATION -> SEIKO EPSON CORPORATION)
    Task: {ABB6EBAF-5C52-492E-B8CF-45C767898DE6} - System32\Tasks\{C7A0B69A-D81B-4C3E-9FB6-93EC947E6E79} => C:\Program Files (x86)\Starcraft\StarCraft.exe [1220608 2009-01-09] (Blizzard Entertainment) [File not signed]
    Task: {B88B07C2-98A3-4072-B62F-8DF41C59EC93} - System32\Tasks\{D9FF4F6F-7E8B-4AE6-9500-9FEF40A01EC3} => "C:\Program Files\Internet Explorer\iexplore.exe" hxxps://ui.skype.com/ui/0/7.31.80.104/en/abandoninstall?page=tsProgressBar
    Task: {F659FCA4-2B25-4D56-A43F-5D04171E7610} - System32\Tasks\Adobe Flash Player PPAPI Notifier => C:\Windows\SysWOW64\Macromed\Flash\FlashUtil32_32_0_0_192_pepper.exe [1452600 2019-05-14] (Adobe Inc. -> Adobe)
    Task: {FA6D450D-2FC5-4274-A608-71880EAF0C96} - System32\Tasks\Microsoft\Microsoft Antimalware\Microsoft Antimalware Scheduled Scan => c:\Program Files\Microsoft Security Client\\MpCmdRun.exe [410784 2016-11-14] (Microsoft Corporation -> Microsoft Corporation)

    (If an entry is included in the fixlist, the task (.job) file will be moved. The file which is running by the task will not be moved.)

    Task: C:\Windows\Tasks\EPSON ES-200 Update.job => C:\Program Files (x86)\epson\Epson Scan 2\Update\e_dtsksd.exe/EXE_S:EPSON ES-200,ES013E.DAT /F:UpdateThomasĊSearches for EPSON software updates, and notifies you when updates are available.If this task is disabled or stopped, your EPSON software will not be automatically kept up to date.Thi

    ==================== Internet (Whitelisted) ====================

    (If an item is included in the fixlist, if it is a registry item it will be removed or restored to default.)

    Tcpip\Parameters: [DhcpNameServer] 192.168.1.1
    Tcpip\..\Interfaces\{E87E5278-7B44-4C37-A056-15845EC0C4B6}: [DhcpNameServer] 192.168.1.1

    Internet Explorer:
    ==================
    HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://go.microsoft.com/fwlink/?LinkID=617911&ResetID=131150147890209734&GUID=747F00F6-E610-406C-9766-3ED9D690C322
    HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Start Page = hxxp://go.microsoft.com/fwlink/?LinkID=617911&ResetID=131150147890239736&GUID=747F00F6-E610-406C-9766-3ED9D690C322
    HKU\S-1-5-21-2475564236-1283100031-3943380601-1001\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://aol.com/
    SearchScopes: HKLM -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL =
    SearchScopes: HKLM -> {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL =
    SearchScopes: HKLM-x32 -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL =
    SearchScopes: HKLM-x32 -> {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL =
    SearchScopes: HKU\S-1-5-21-2475564236-1283100031-3943380601-1001 -> DefaultScope {3CB5156A-D232-492D-909F-684FB77B1F64} URL = hxxps://www.google.com/search?q={searchTerms}&sourceid=ie7&rls=com.microsoft:{language}:{referrer:source}&ie={inputEncoding?}&oe={outputEncoding?}
    SearchScopes: HKU\S-1-5-21-2475564236-1283100031-3943380601-1001 -> {2f23ab71-4ac6-41f2-a955-ea576e553146} URL =
    SearchScopes: HKU\S-1-5-21-2475564236-1283100031-3943380601-1001 -> {3CB5156A-D232-492D-909F-684FB77B1F64} URL = hxxps://www.google.com/search?q={searchTerms}&sourceid=ie7&rls=com.microsoft:{language}:{referrer:source}&ie={inputEncoding?}&oe={outputEncoding?}
    BHO: Windows Live ID Sign-in Helper -> {9030D464-4C02-4ABF-8ECC-5164760863C6} -> C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll [2009-08-18] (Microsoft Corporation -> Microsoft Corporation)
    BHO-x32: Windows Live ID Sign-in Helper -> {9030D464-4C02-4ABF-8ECC-5164760863C6} -> C:\Program Files (x86)\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll [2009-08-18] (Microsoft Corporation -> Microsoft Corporation)
    DPF: HKLM-x32 {D27CDB6E-AE6D-11CF-96B8-444553540000} hxxp://fpdownload2.macromedia.com/get/shockwave/cabs/flash/swflash.cab
    StartMenuInternet: IEXPLORE.EXE - iexplore.exe

    FireFox:
    ========
    FF Plugin: @microsoft.com/GENUINE -> disabled [No File]
    FF Plugin: @Microsoft.com/NpCtrl,version=1.0 -> c:\Program Files\Microsoft Silverlight\5.1.50918.0\npctrl.dll [2018-10-23] (Microsoft Corporation -> Microsoft Corporation)
    FF Plugin-x32: @Apple.com/iTunes,version=1.0 -> C:\Program Files (x86)\iTunes\Mozilla Plugins\npitunes.dll [2015-12-18] (Apple Inc. -> )
    FF Plugin-x32: @microsoft.com/GENUINE -> disabled [No File]
    FF Plugin-x32: @Microsoft.com/NpCtrl,version=1.0 -> c:\Program Files (x86)\Microsoft Silverlight\5.1.50918.0\npctrl.dll [2018-10-23] (Microsoft Corporation -> Microsoft Corporation)
    FF Plugin-x32: @nvidia.com/3DVision -> C:\Program Files (x86)\NVIDIA Corporation\3D Vision\npnv3dv.dll [2014-11-12] (NVIDIA Corporation PE Sign v2014 -> NVIDIA Corporation) [File not signed]
    FF Plugin-x32: @nvidia.com/3DVisionStreaming -> C:\Program Files (x86)\NVIDIA Corporation\3D Vision\npnv3dvstreaming.dll [2014-11-12] (NVIDIA Corporation PE Sign v2014 -> NVIDIA Corporation) [File not signed]
    FF Plugin-x32: @tools.google.com/Google Update;version=3 -> C:\Program Files (x86)\Google\Update\1.3.34.11\npGoogleUpdate3.dll [2019-05-14] (Google Inc -> Google LLC)
    FF Plugin-x32: @tools.google.com/Google Update;version=9 -> C:\Program Files (x86)\Google\Update\1.3.34.11\npGoogleUpdate3.dll [2019-05-14] (Google Inc -> Google LLC)
    FF Plugin-x32: Adobe Reader -> C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AIR\nppdf32.dll [2019-05-02] (Adobe Inc. -> Adobe Systems Inc.)
    FF Plugin HKU\S-1-5-21-2475564236-1283100031-3943380601-1001: temasys.com.sg/TemWebRTCPlugin -> C:\Users\Thomas\AppData\Roaming\Tem\TemWebRTCPlugin\0.8.902\npTemWebRTCPlugin.dll [2017-10-26] (Temasys Communications Pte Ltd -> Temasys)

    Chrome:
    =======
    CHR DefaultProfile: Default
    CHR Profile: C:\Users\Thomas\AppData\Local\Google\Chrome\User Data\Default [2019-06-02]
    CHR Extension: (YouTube) - C:\Users\Thomas\AppData\Local\Google\Chrome\User Data\Default\Extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo [2015-11-22]
    CHR Extension: (Google Search) - C:\Users\Thomas\AppData\Local\Google\Chrome\User Data\Default\Extensions\coobgpohoikkiipiblmjeljniedjpjpf [2015-11-22]
    CHR Extension: (Chrome Web Store Payments) - C:\Users\Thomas\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda [2018-05-24]
    CHR Extension: (Gmail) - C:\Users\Thomas\AppData\Local\Google\Chrome\User Data\Default\Extensions\pjkljhegncpnkpknbcohdijeoejaedia [2019-05-06]
    CHR Extension: (Chrome Media Router) - C:\Users\Thomas\AppData\Local\Google\Chrome\User Data\Default\Extensions\pkedcjkdefgpdelpbcmbmeomcjbeemfm [2019-06-02]

    ==================== Services (Whitelisted) ====================

    (If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)

    R2 Apple Mobile Device Service; C:\Program Files\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe [83768 2016-03-02] (Apple Inc. -> Apple Inc.)
    R2 EpsonScanSvc; C:\Windows\system32\EscSvc64.exe [145224 2018-05-08] (SEIKO EPSON CORPORATION -> Seiko Epson Corporation)
    R2 GfExperienceService; C:\Program Files\NVIDIA Corporation\GeForce Experience Service\GfExperienceService.exe [1149760 2014-11-17] (NVIDIA Corporation -> NVIDIA Corporation)
    S3 MBAMService; C:\Program Files\Malwarebytes\Anti-Malware\mbamservice.exe [6347056 2018-09-19] (Malwarebytes Corporation -> Malwarebytes)
    R2 MsMpSvc; c:\Program Files\Microsoft Security Client\MsMpEng.exe [119864 2016-11-14] (Microsoft Corporation -> Microsoft Corporation)
    R3 NisSrv; c:\Program Files\Microsoft Security Client\NisSrv.exe [361816 2016-11-14] (Microsoft Corporation -> Microsoft Corporation)
    R2 NvNetworkService; C:\Program Files (x86)\NVIDIA Corporation\NetService\NvNetworkService.exe [1796928 2014-11-17] (NVIDIA Corporation -> NVIDIA Corporation)
    R2 NvStreamSvc; C:\Program Files\NVIDIA Corporation\NvStreamSrv\nvstreamsvc.exe [19821376 2014-11-17] (NVIDIA Corporation -> NVIDIA Corporation)
    S3 WinDefend; C:\Program Files\Windows Defender\mpsvc.dll [1011712 2013-05-27] (Microsoft Windows -> Microsoft Corporation)

    ===================== Drivers (Whitelisted) ======================

    (If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)

    S3 aftap0901; C:\Windows\System32\DRIVERS\aftap0901.sys [48624 2018-07-26] (AnchorFree Inc -> The OpenVPN Project)
    S3 andnetadb; C:\Windows\System32\Drivers\lgandnetadb.sys [31744 2012-07-03] (Microsoft Windows Hardware Compatibility Publisher -> Google Inc)
    S3 AndNetDiag; C:\Windows\System32\DRIVERS\lgandnetdiag64.sys [29184 2012-07-03] (Microsoft Windows Hardware Compatibility Publisher -> LG Electronics Inc.)
    S3 ANDNetModem; C:\Windows\System32\DRIVERS\lgandnetmodem64.sys [36352 2012-07-03] (Microsoft Windows Hardware Compatibility Publisher -> LG Electronics Inc.)
    S3 COMMONFX.DLL; C:\Windows\System32\COMMONFX.DLL [151296 2007-04-12] (Creative -> Creative Technology Ltd)
    S3 CT20XUT.DLL; C:\Windows\System32\CT20XUT.DLL [252712 2007-04-10] (Creative Labs Inc -> Creative Technology Ltd.)
    S3 CTAUDFX.DLL; C:\Windows\System32\CTAUDFX.DLL [700200 2007-04-10] (Creative Labs Inc -> Creative Technology Ltd)
    S3 CTEAPSFX.DLL; C:\Windows\System32\CTEAPSFX.DLL [219432 2007-04-10] (Creative Labs Inc -> Creative Technology Ltd)
    S3 CTEDSPFX.DLL; C:\Windows\System32\CTEDSPFX.DLL [321832 2007-04-10] (Creative Labs Inc -> Creative Technology Ltd)
    S3 CTEDSPIO.DLL; C:\Windows\System32\CTEDSPIO.DLL [190248 2007-04-10] (Creative Labs Inc -> Creative Technology Ltd)
    S3 CTEDSPSY.DLL; C:\Windows\System32\CTEDSPSY.DLL [363304 2007-04-10] (Creative Labs Inc -> Creative Technology Ltd)
    S3 CTERFXFX.DLL; C:\Windows\System32\CTERFXFX.DLL [142120 2007-04-10] (Creative Labs Inc -> Creative Technology Ltd)
    S3 CTEXFIFX.DLL; C:\Windows\System32\CTEXFIFX.DLL [1571112 2007-04-10] (Creative Labs Inc -> Creative Technology Ltd.)
    S3 CTHWIUT.DLL; C:\Windows\System32\CTHWIUT.DLL [123688 2007-04-10] (Creative Labs Inc -> Creative Technology Ltd.)
    S3 CTSBLFX.DLL; C:\Windows\System32\CTSBLFX.DLL [681256 2007-04-10] (Creative Labs Inc -> Creative Technology Ltd)
    S3 DroidCam; C:\Windows\System32\DRIVERS\droidcam.sys [33592 2015-05-24] (DEV47 APPS -> Dev47Apps)
    S3 DroidCamVideo; C:\Windows\System32\DRIVERS\droidcamvideo.sys [229432 2016-04-14] (DEV47 APPS -> Dev47Apps)
    S3 FTDIBUS; C:\Windows\System32\drivers\ftdibus.sys [108352 2018-04-21] (Future Technology Devices International Ltd -> FTDI Ltd.)
    S3 FTSER2K; C:\Windows\System32\drivers\ftser2k.sys [95168 2018-04-21] (Future Technology Devices International Ltd -> FTDI Ltd.)
    R0 MpFilter; C:\Windows\System32\DRIVERS\MpFilter.sys [295000 2016-08-25] (Microsoft Corporation -> Microsoft Corporation)
    R3 MTsensor; C:\Windows\System32\DRIVERS\ASACPI.sys [8192 2005-03-29] (Microsoft Windows Hardware Compatibility Publisher -> )
    R3 NisDrv; C:\Windows\System32\DRIVERS\NisDrvWFP.sys [135928 2016-08-25] (Microsoft Corporation -> Microsoft Corporation)
    R3 NvStreamKms; C:\Program Files\NVIDIA Corporation\NvStreamSrv\NvStreamKms.sys [20800 2014-11-17] (NVIDIA Corporation -> NVIDIA Corporation)
    S3 nvvad_WaveExtensible; C:\Windows\System32\drivers\nvvad64v.sys [38216 2014-10-03] (NVIDIA Corporation -> NVIDIA Corporation)
    S4 secdrv; C:\Windows\SysWow64\Drivers\secdrv.sys [10848 2000-04-10] () [File not signed]
    S3 USBAAPL64; C:\Windows\System32\Drivers\usbaapl64.sys [54784 2015-11-05] (Microsoft Windows Hardware Compatibility Publisher -> Apple, Inc.)
    S3 WinUsb; C:\Windows\SysWOW64\DRIVERS\WinUsb.sys [42944 2018-04-21] (深圳市道通科技股份有限公司 -> Microsoft Corporation)
    S3 Synth3dVsc; System32\drivers\synth3dvsc.sys [X]
    S3 tsusbhub; system32\drivers\tsusbhub.sys [X]
    S3 VGPU; System32\drivers\rdvgkmd.sys [X]

    ==================== NetSvcs (Whitelisted) ===================

    (If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)


    ==================== One month (created) ========

    (If an entry is included in the fixlist, the file/folder will be moved.)

    2019-06-04 22:36 - 2019-06-04 22:37 - 000020460 _____ C:\Users\Thomas\Desktop\FRST.txt
    2019-06-04 22:35 - 2019-06-04 22:35 - 002416640 _____ (Farbar) C:\Users\Thomas\Desktop\FRST64.exe
    2019-06-01 14:32 - 2019-06-01 14:33 - 000000000 ____D C:\Users\Thomas\Desktop\Work
    2019-06-01 14:31 - 2019-06-01 14:32 - 000000000 ____D C:\Users\Thomas\Desktop\Parts
    2019-06-01 14:30 - 2019-06-01 14:45 - 000001177 _____ C:\Users\Thomas\Desktop\New - Computer Has Been Acting A Bit Slow Tech Support Guy.url
    2019-05-15 20:55 - 2019-04-30 15:28 - 000397112 _____ (Microsoft Corporation) C:\Windows\system32\iedkcs32.dll
    2019-05-15 20:55 - 2019-04-30 14:37 - 000348984 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iedkcs32.dll
    2019-05-15 20:55 - 2019-04-29 20:51 - 000578560 _____ (Microsoft Corporation) C:\Windows\system32\vbscript.dll
    2019-05-15 20:55 - 2019-04-29 20:51 - 000499200 _____ (Microsoft Corporation) C:\Windows\SysWOW64\vbscript.dll
    2019-05-15 20:55 - 2019-04-25 00:01 - 025730560 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.dll
    2019-05-15 20:55 - 2019-04-24 23:52 - 002724864 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.tlb
    2019-05-15 20:55 - 2019-04-24 23:52 - 000004096 _____ (Microsoft Corporation) C:\Windows\system32\ieetwcollectorres.dll
    2019-05-15 20:55 - 2019-04-24 23:40 - 002902016 _____ (Microsoft Corporation) C:\Windows\system32\iertutil.dll
    2019-05-15 20:55 - 2019-04-24 23:38 - 000417280 _____ (Microsoft Corporation) C:\Windows\system32\html.iec
    2019-05-15 20:55 - 2019-04-24 23:38 - 000066560 _____ (Microsoft Corporation) C:\Windows\system32\iesetup.dll
    2019-05-15 20:55 - 2019-04-24 23:38 - 000048640 _____ (Microsoft Corporation) C:\Windows\system32\ieetwproxystub.dll
    2019-05-15 20:55 - 2019-04-24 23:37 - 000088064 _____ (Microsoft Corporation) C:\Windows\system32\MshtmlDac.dll
    2019-05-15 20:55 - 2019-04-24 23:31 - 020279296 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.dll
    2019-05-15 20:55 - 2019-04-24 23:31 - 000054784 _____ (Microsoft Corporation) C:\Windows\system32\jsproxy.dll
    2019-05-15 20:55 - 2019-04-24 23:30 - 000034304 _____ (Microsoft Corporation) C:\Windows\system32\iernonce.dll
    2019-05-15 20:55 - 2019-04-24 23:28 - 005775360 _____ (Microsoft Corporation) C:\Windows\system32\jscript9.dll
    2019-05-15 20:55 - 2019-04-24 23:28 - 000615936 _____ (Microsoft Corporation) C:\Windows\system32\ieui.dll
    2019-05-15 20:55 - 2019-04-24 23:26 - 000814080 _____ (Microsoft Corporation) C:\Windows\system32\jscript9diag.dll
    2019-05-15 20:55 - 2019-04-24 23:26 - 000790528 _____ (Microsoft Corporation) C:\Windows\system32\jscript.dll
    2019-05-15 20:55 - 2019-04-24 23:26 - 000144384 _____ (Microsoft Corporation) C:\Windows\system32\ieUnatt.exe
    2019-05-15 20:55 - 2019-04-24 23:26 - 000116224 _____ (Microsoft Corporation) C:\Windows\system32\ieetwcollector.exe
    2019-05-15 20:55 - 2019-04-24 23:24 - 002724864 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.tlb
    2019-05-15 20:55 - 2019-04-24 23:19 - 000969216 _____ (Microsoft Corporation) C:\Windows\system32\MsSpellCheckingFacility.exe
    2019-05-15 20:55 - 2019-04-24 23:16 - 000489984 _____ (Microsoft Corporation) C:\Windows\system32\dxtmsft.dll
    2019-05-15 20:55 - 2019-04-24 23:12 - 000062464 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iesetup.dll
    2019-05-15 20:55 - 2019-04-24 23:12 - 000047616 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieetwproxystub.dll
    2019-05-15 20:55 - 2019-04-24 23:11 - 000341504 _____ (Microsoft Corporation) C:\Windows\SysWOW64\html.iec
    2019-05-15 20:55 - 2019-04-24 23:11 - 000064000 _____ (Microsoft Corporation) C:\Windows\SysWOW64\MshtmlDac.dll
    2019-05-15 20:55 - 2019-04-24 23:09 - 002295808 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iertutil.dll
    2019-05-15 20:55 - 2019-04-24 23:09 - 000087552 _____ (Microsoft Corporation) C:\Windows\system32\tdc.ocx
    2019-05-15 20:55 - 2019-04-24 23:09 - 000077824 _____ (Microsoft Corporation) C:\Windows\system32\JavaScriptCollectionAgent.dll
    2019-05-15 20:55 - 2019-04-24 23:08 - 000107520 _____ (Microsoft Corporation) C:\Windows\system32\inseng.dll
    2019-05-15 20:55 - 2019-04-24 23:06 - 000047104 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jsproxy.dll
    2019-05-15 20:55 - 2019-04-24 23:05 - 000199680 _____ (Microsoft Corporation) C:\Windows\system32\msrating.dll
    2019-05-15 20:55 - 2019-04-24 23:05 - 000092160 _____ (Microsoft Corporation) C:\Windows\system32\mshtmled.dll
    2019-05-15 20:55 - 2019-04-24 23:05 - 000030720 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iernonce.dll
    2019-05-15 20:55 - 2019-04-24 23:04 - 000476160 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieui.dll
    2019-05-15 20:55 - 2019-04-24 23:03 - 000663040 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript.dll
    2019-05-15 20:55 - 2019-04-24 23:03 - 000315392 _____ (Microsoft Corporation) C:\Windows\system32\dxtrans.dll
    2019-05-15 20:55 - 2019-04-24 23:02 - 000620032 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript9diag.dll
    2019-05-15 20:55 - 2019-04-24 23:02 - 000115712 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieUnatt.exe
    2019-05-15 20:55 - 2019-04-24 23:01 - 000152064 _____ (Microsoft Corporation) C:\Windows\system32\occache.dll
    2019-05-15 20:55 - 2019-04-24 22:54 - 000416256 _____ (Microsoft Corporation) C:\Windows\SysWOW64\dxtmsft.dll
    2019-05-15 20:55 - 2019-04-24 22:52 - 000262144 _____ (Microsoft Corporation) C:\Windows\system32\webcheck.dll
    2019-05-15 20:55 - 2019-04-24 22:50 - 000809472 _____ (Microsoft Corporation) C:\Windows\system32\msfeeds.dll
    2019-05-15 20:55 - 2019-04-24 22:50 - 000728064 _____ (Microsoft Corporation) C:\Windows\system32\ie4uinit.exe
    2019-05-15 20:55 - 2019-04-24 22:50 - 000060416 _____ (Microsoft Corporation) C:\Windows\SysWOW64\JavaScriptCollectionAgent.dll
    2019-05-15 20:55 - 2019-04-24 22:49 - 000091136 _____ (Microsoft Corporation) C:\Windows\SysWOW64\inseng.dll
    2019-05-15 20:55 - 2019-04-24 22:49 - 000073216 _____ (Microsoft Corporation) C:\Windows\SysWOW64\tdc.ocx
    2019-05-15 20:55 - 2019-04-24 22:48 - 001359360 _____ (Microsoft Corporation) C:\Windows\system32\mshtmlmedia.dll
    2019-05-15 20:55 - 2019-04-24 22:47 - 002135552 _____ (Microsoft Corporation) C:\Windows\system32\inetcpl.cpl
    2019-05-15 20:55 - 2019-04-24 22:47 - 000168960 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msrating.dll
    2019-05-15 20:55 - 2019-04-24 22:46 - 015285248 _____ (Microsoft Corporation) C:\Windows\system32\ieframe.dll
    2019-05-15 20:55 - 2019-04-24 22:46 - 000076288 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtmled.dll
    2019-05-15 20:55 - 2019-04-24 22:45 - 000279040 _____ (Microsoft Corporation) C:\Windows\SysWOW64\dxtrans.dll
    2019-05-15 20:55 - 2019-04-24 22:43 - 000130048 _____ (Microsoft Corporation) C:\Windows\SysWOW64\occache.dll
    2019-05-15 20:55 - 2019-04-24 22:40 - 004493312 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript9.dll
    2019-05-15 20:55 - 2019-04-24 22:38 - 000230400 _____ (Microsoft Corporation) C:\Windows\SysWOW64\webcheck.dll
    2019-05-15 20:55 - 2019-04-24 22:37 - 000696320 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msfeeds.dll
    2019-05-15 20:55 - 2019-04-24 22:36 - 002059776 _____ (Microsoft Corporation) C:\Windows\SysWOW64\inetcpl.cpl
    2019-05-15 20:55 - 2019-04-24 22:35 - 013682176 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieframe.dll
    2019-05-15 20:55 - 2019-04-24 22:35 - 005303808 _____ (Microsoft Corporation) C:\Windows\system32\wininet.dll
    2019-05-15 20:55 - 2019-04-24 22:35 - 001155072 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtmlmedia.dll
    2019-05-15 20:55 - 2019-04-24 22:24 - 001557504 _____ (Microsoft Corporation) C:\Windows\system32\urlmon.dll
    2019-05-15 20:55 - 2019-04-24 22:18 - 004831232 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wininet.dll
    2019-05-15 20:55 - 2019-04-24 22:14 - 001323008 _____ (Microsoft Corporation) C:\Windows\SysWOW64\urlmon.dll
    2019-05-15 20:55 - 2019-04-24 22:14 - 000800768 _____ (Microsoft Corporation) C:\Windows\system32\ieapfltr.dll
    2019-05-15 20:55 - 2019-04-24 22:12 - 000710144 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieapfltr.dll
    2019-05-15 20:55 - 2019-04-18 22:54 - 004057320 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ntkrnlpa.exe
    2019-05-15 20:55 - 2019-04-18 22:53 - 003963624 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ntoskrnl.exe
    2019-05-15 20:55 - 2019-04-18 22:53 - 001314104 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ntdll.dll
    2019-05-15 20:55 - 2019-04-18 22:51 - 001114112 _____ (Microsoft Corporation) C:\Windows\SysWOW64\kernel32.dll
    2019-05-15 20:55 - 2019-04-18 22:51 - 000666112 _____ (Microsoft Corporation) C:\Windows\SysWOW64\rpcrt4.dll
    2019-05-15 20:55 - 2019-04-18 22:51 - 000555520 _____ (Microsoft Corporation) C:\Windows\SysWOW64\kerberos.dll
    2019-05-15 20:55 - 2019-04-18 22:51 - 000275968 _____ (Microsoft Corporation) C:\Windows\SysWOW64\KernelBase.dll
    2019-05-15 20:55 - 2019-04-18 22:51 - 000261120 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msv1_0.dll
    2019-05-15 20:55 - 2019-04-18 22:51 - 000254464 _____ (Microsoft Corporation) C:\Windows\SysWOW64\schannel.dll
    2019-05-15 20:55 - 2019-04-18 22:51 - 000223232 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ncrypt.dll
    2019-05-15 20:55 - 2019-04-18 22:51 - 000172032 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wdigest.dll
    2019-05-15 20:55 - 2019-04-18 22:51 - 000146432 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msaudite.dll
    2019-05-15 20:55 - 2019-04-18 22:51 - 000141312 _____ (Microsoft Corporation) C:\Windows\SysWOW64\rpchttp.dll
    2019-05-15 20:55 - 2019-04-18 22:51 - 000096768 _____ (Microsoft Corporation) C:\Windows\SysWOW64\sspicli.dll
    2019-05-15 20:55 - 2019-04-18 22:51 - 000082944 _____ (Microsoft Corporation) C:\Windows\SysWOW64\bcrypt.dll
    2019-05-15 20:55 - 2019-04-18 22:51 - 000070144 _____ (Microsoft Corporation) C:\Windows\SysWOW64\TSpkg.dll
    2019-05-15 20:55 - 2019-04-18 22:51 - 000060416 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msobjs.dll
    2019-05-15 20:55 - 2019-04-18 22:51 - 000043008 _____ (Microsoft Corporation) C:\Windows\SysWOW64\srclient.dll
    2019-05-15 20:55 - 2019-04-18 22:51 - 000022016 _____ (Microsoft Corporation) C:\Windows\SysWOW64\secur32.dll
    2019-05-15 20:55 - 2019-04-18 22:51 - 000005120 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wow32.dll
    2019-05-15 20:55 - 2019-04-18 22:50 - 000690688 _____ (Microsoft Corporation) C:\Windows\SysWOW64\adtschema.dll
    2019-05-15 20:55 - 2019-04-18 22:50 - 000644096 _____ (Microsoft Corporation) C:\Windows\SysWOW64\advapi32.dll
    2019-05-15 20:55 - 2019-04-18 22:50 - 000342528 _____ (Microsoft Corporation) C:\Windows\SysWOW64\certcli.dll
    2019-05-15 20:55 - 2019-04-18 22:50 - 000050688 _____ (Microsoft Corporation) C:\Windows\SysWOW64\appidapi.dll
    2019-05-15 20:55 - 2019-04-18 22:50 - 000017408 _____ (Microsoft Corporation) C:\Windows\SysWOW64\credssp.dll
    2019-05-15 20:55 - 2019-04-18 22:50 - 000006656 _____ (Microsoft Corporation) C:\Windows\SysWOW64\apisetschema.dll
    2019-05-15 20:55 - 2019-04-18 22:50 - 000005120 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-file-l1-1-0.dll
    2019-05-15 20:55 - 2019-04-18 22:50 - 000004608 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-processthreads-l1-1-0.dll
    2019-05-15 20:55 - 2019-04-18 22:50 - 000004096 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-sysinfo-l1-1-0.dll
    2019-05-15 20:55 - 2019-04-18 22:50 - 000004096 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-synch-l1-1-0.dll
    2019-05-15 20:55 - 2019-04-18 22:50 - 000004096 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-misc-l1-1-0.dll
    2019-05-15 20:55 - 2019-04-18 22:50 - 000004096 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-localregistry-l1-1-0.dll
    2019-05-15 20:55 - 2019-04-18 22:50 - 000004096 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-localization-l1-1-0.dll
    2019-05-15 20:55 - 2019-04-18 22:50 - 000003584 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-processenvironment-l1-1-0.dll
    2019-05-15 20:55 - 2019-04-18 22:50 - 000003584 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-namedpipe-l1-1-0.dll
    2019-05-15 20:55 - 2019-04-18 22:50 - 000003584 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-memory-l1-1-0.dll
    2019-05-15 20:55 - 2019-04-18 22:50 - 000003584 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-libraryloader-l1-1-0.dll
    2019-05-15 20:55 - 2019-04-18 22:50 - 000003584 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-interlocked-l1-1-0.dll
    2019-05-15 20:55 - 2019-04-18 22:50 - 000003584 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-heap-l1-1-0.dll
    2019-05-15 20:55 - 2019-04-18 22:50 - 000003072 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-string-l1-1-0.dll
    2019-05-15 20:55 - 2019-04-18 22:50 - 000003072 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-rtlsupport-l1-1-0.dll
    2019-05-15 20:55 - 2019-04-18 22:50 - 000003072 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-profile-l1-1-0.dll
    2019-05-15 20:55 - 2019-04-18 22:50 - 000003072 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-io-l1-1-0.dll
    2019-05-15 20:55 - 2019-04-18 22:50 - 000003072 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-handle-l1-1-0.dll
    2019-05-15 20:55 - 2019-04-18 22:50 - 000003072 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-fibers-l1-1-0.dll
    2019-05-15 20:55 - 2019-04-18 22:50 - 000003072 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-errorhandling-l1-1-0.dll
    2019-05-15 20:55 - 2019-04-18 22:50 - 000003072 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-delayload-l1-1-0.dll
    2019-05-15 20:55 - 2019-04-18 22:50 - 000003072 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-debug-l1-1-0.dll
    2019-05-15 20:55 - 2019-04-18 22:50 - 000003072 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-datetime-l1-1-0.dll
    2019-05-15 20:55 - 2019-04-18 22:50 - 000003072 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-console-l1-1-0.dll
    2019-05-15 20:55 - 2019-04-18 22:44 - 000185064 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\pci.sys
    2019-05-15 20:55 - 2019-04-18 22:44 - 000095456 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\ksecdd.sys
    2019-05-15 20:55 - 2019-04-18 22:43 - 000708328 _____ (Microsoft Corporation) C:\Windows\system32\winload.efi
    2019-05-15 20:55 - 2019-04-18 22:43 - 000631680 _____ (Microsoft Corporation) C:\Windows\system32\winresume.efi
    2019-05-15 20:55 - 2019-04-18 22:43 - 000153832 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\ksecpkg.sys
    2019-05-15 20:55 - 2019-04-18 22:43 - 000064232 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\ULIAGPKX.SYS
    2019-05-15 20:55 - 2019-04-18 22:43 - 000063208 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\termdd.sys
    2019-05-15 20:55 - 2019-04-18 22:43 - 000060648 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\AGP440.sys
    2019-05-15 20:55 - 2019-04-18 22:43 - 000031976 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\mssmbios.sys
    2019-05-15 20:55 - 2019-04-18 22:43 - 000023784 _____ (Microsoft Corporation) C:\Windows\system32\streamci.dll
    2019-05-15 20:55 - 2019-04-18 22:43 - 000020200 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\isapnp.sys
    2019-05-15 20:55 - 2019-04-18 22:42 - 005552864 _____ (Microsoft Corporation) C:\Windows\system32\ntoskrnl.exe
    2019-05-15 20:55 - 2019-04-18 22:42 - 001664360 _____ (Microsoft Corporation) C:\Windows\system32\ntdll.dll
    2019-05-15 20:55 - 2019-04-18 22:42 - 000262376 _____ (Microsoft Corporation) C:\Windows\system32\hal.dll
    2019-05-15 20:55 - 2019-04-18 22:42 - 000122600 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\NV_AGP.SYS
    2019-05-15 20:55 - 2019-04-18 22:42 - 000068328 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\volmgr.sys
    2019-05-15 20:55 - 2019-04-18 22:42 - 000036064 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\vdrvroot.sys
    2019-05-15 20:55 - 2019-04-18 22:42 - 000015080 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\msisadrv.sys
    2019-05-15 20:55 - 2019-04-18 22:42 - 000012136 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\swenum.sys
    2019-05-15 20:55 - 2019-04-18 22:40 - 001211392 _____ (Microsoft Corporation) C:\Windows\system32\rpcrt4.dll
    2019-05-15 20:55 - 2019-04-18 22:40 - 000503808 _____ (Microsoft Corporation) C:\Windows\system32\srcore.dll
    2019-05-15 20:55 - 2019-04-18 22:40 - 000361984 _____ (Microsoft Corporation) C:\Windows\system32\wow64win.dll
    2019-05-15 20:55 - 2019-04-18 22:40 - 000345600 _____ (Microsoft Corporation) C:\Windows\system32\schannel.dll
    2019-05-15 20:55 - 2019-04-18 22:40 - 000316928 _____ (Microsoft Corporation) C:\Windows\system32\msv1_0.dll
    2019-05-15 20:55 - 2019-04-18 22:40 - 000312320 _____ (Microsoft Corporation) C:\Windows\system32\ncrypt.dll
    2019-05-15 20:55 - 2019-04-18 22:40 - 000243712 _____ (Microsoft Corporation) C:\Windows\system32\wow64.dll
    2019-05-15 20:55 - 2019-04-18 22:40 - 000236032 _____ (Microsoft Corporation) C:\Windows\system32\srvsvc.dll
    2019-05-15 20:55 - 2019-04-18 22:40 - 000215552 _____ (Microsoft Corporation) C:\Windows\system32\winsrv.dll
    2019-05-15 20:55 - 2019-04-18 22:40 - 000210432 _____ (Microsoft Corporation) C:\Windows\system32\wdigest.dll
    2019-05-15 20:55 - 2019-04-18 22:40 - 000190464 _____ (Microsoft Corporation) C:\Windows\system32\rpchttp.dll
    2019-05-15 20:55 - 2019-04-18 22:40 - 000146432 _____ (Microsoft Corporation) C:\Windows\system32\msaudite.dll
    2019-05-15 20:55 - 2019-04-18 22:40 - 000135680 _____ (Microsoft Corporation) C:\Windows\system32\sspicli.dll
    2019-05-15 20:55 - 2019-04-18 22:40 - 000094208 _____ (Microsoft Corporation) C:\Windows\system32\TSpkg.dll
    2019-05-15 20:55 - 2019-04-18 22:40 - 000063488 _____ (Microsoft Corporation) C:\Windows\system32\setbcdlocale.dll
    2019-05-15 20:55 - 2019-04-18 22:40 - 000060416 _____ (Microsoft Corporation) C:\Windows\system32\msobjs.dll
    2019-05-15 20:55 - 2019-04-18 22:40 - 000050176 _____ (Microsoft Corporation) C:\Windows\system32\srclient.dll
    2019-05-15 20:55 - 2019-04-18 22:40 - 000028672 _____ (Microsoft Corporation) C:\Windows\system32\sspisrv.dll
    2019-05-15 20:55 - 2019-04-18 22:40 - 000028160 _____ (Microsoft Corporation) C:\Windows\system32\secur32.dll
    2019-05-15 20:55 - 2019-04-18 22:40 - 000016384 _____ (Microsoft Corporation) C:\Windows\system32\ntvdm64.dll
    2019-05-15 20:55 - 2019-04-18 22:40 - 000013312 _____ (Microsoft Corporation) C:\Windows\system32\wow64cpu.dll
    2019-05-15 20:55 - 2019-04-18 22:40 - 000013312 _____ (Microsoft Corporation) C:\Windows\system32\sscore.dll
    2019-05-15 20:55 - 2019-04-18 22:39 - 001472512 _____ (Microsoft Corporation) C:\Windows\system32\lsasrv.dll
    2019-05-15 20:55 - 2019-04-18 22:39 - 001162752 _____ (Microsoft Corporation) C:\Windows\system32\kernel32.dll
    2019-05-15 20:55 - 2019-04-18 22:39 - 000880640 _____ (Microsoft Corporation) C:\Windows\system32\advapi32.dll
    2019-05-15 20:55 - 2019-04-18 22:39 - 000733184 _____ (Microsoft Corporation) C:\Windows\system32\kerberos.dll
    2019-05-15 20:55 - 2019-04-18 22:39 - 000690688 _____ (Microsoft Corporation) C:\Windows\system32\adtschema.dll
    2019-05-15 20:55 - 2019-04-18 22:39 - 000463872 _____ (Microsoft Corporation) C:\Windows\system32\certcli.dll
    2019-05-15 20:55 - 2019-04-18 22:39 - 000419840 _____ (Microsoft Corporation) C:\Windows\system32\KernelBase.dll
    2019-05-15 20:55 - 2019-04-18 22:39 - 000123904 _____ (Microsoft Corporation) C:\Windows\system32\bcrypt.dll
    2019-05-15 20:55 - 2019-04-18 22:39 - 000059904 _____ (Microsoft Corporation) C:\Windows\system32\appidapi.dll
    2019-05-15 20:55 - 2019-04-18 22:39 - 000044032 _____ (Microsoft Corporation) C:\Windows\system32\csrsrv.dll
    2019-05-15 20:55 - 2019-04-18 22:39 - 000043520 _____ (Microsoft Corporation) C:\Windows\system32\cryptbase.dll
    2019-05-15 20:55 - 2019-04-18 22:39 - 000034816 _____ (Microsoft Corporation) C:\Windows\system32\appidsvc.dll
    2019-05-15 20:55 - 2019-04-18 22:39 - 000022016 _____ (Microsoft Corporation) C:\Windows\system32\credssp.dll
    2019-05-15 20:55 - 2019-04-18 22:39 - 000006656 _____ (Microsoft Corporation) C:\Windows\system32\apisetschema.dll
    2019-05-15 20:55 - 2019-04-18 22:39 - 000006144 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-security-base-l1-1-0.dll
    2019-05-15 20:55 - 2019-04-18 22:39 - 000005120 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-file-l1-1-0.dll
    2019-05-15 20:55 - 2019-04-18 22:39 - 000004608 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-threadpool-l1-1-0.dll
    2019-05-15 20:55 - 2019-04-18 22:39 - 000004608 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-processthreads-l1-1-0.dll
    2019-05-15 20:55 - 2019-04-18 22:39 - 000004096 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-sysinfo-l1-1-0.dll
    2019-05-15 20:55 - 2019-04-18 22:39 - 000004096 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-synch-l1-1-0.dll
    2019-05-15 20:55 - 2019-04-18 22:39 - 000004096 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-localregistry-l1-1-0.dll
    2019-05-15 20:55 - 2019-04-18 22:39 - 000004096 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-localization-l1-1-0.dll
    2019-05-15 20:55 - 2019-04-18 22:39 - 000003584 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-rtlsupport-l1-1-0.dll
    2019-05-15 20:55 - 2019-04-18 22:39 - 000003584 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-processenvironment-l1-1-0.dll
    2019-05-15 20:55 - 2019-04-18 22:39 - 000003584 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-namedpipe-l1-1-0.dll
    2019-05-15 20:55 - 2019-04-18 22:39 - 000003584 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-misc-l1-1-0.dll
    2019-05-15 20:55 - 2019-04-18 22:39 - 000003584 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-memory-l1-1-0.dll
    2019-05-15 20:55 - 2019-04-18 22:39 - 000003584 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-libraryloader-l1-1-0.dll
    2019-05-15 20:55 - 2019-04-18 22:39 - 000003584 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-heap-l1-1-0.dll
    2019-05-15 20:55 - 2019-04-18 22:39 - 000003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-xstate-l1-1-0.dll
    2019-05-15 20:55 - 2019-04-18 22:39 - 000003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-util-l1-1-0.dll
    2019-05-15 20:55 - 2019-04-18 22:39 - 000003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-string-l1-1-0.dll
    2019-05-15 20:55 - 2019-04-18 22:39 - 000003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-profile-l1-1-0.dll
    2019-05-15 20:55 - 2019-04-18 22:39 - 000003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-io-l1-1-0.dll
    2019-05-15 20:55 - 2019-04-18 22:39 - 000003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-interlocked-l1-1-0.dll
    2019-05-15 20:55 - 2019-04-18 22:39 - 000003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-handle-l1-1-0.dll
    2019-05-15 20:55 - 2019-04-18 22:39 - 000003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-fibers-l1-1-0.dll
    2019-05-15 20:55 - 2019-04-18 22:39 - 000003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-errorhandling-l1-1-0.dll
    2019-05-15 20:55 - 2019-04-18 22:39 - 000003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-delayload-l1-1-0.dll
    2019-05-15 20:55 - 2019-04-18 22:39 - 000003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-debug-l1-1-0.dll
    2019-05-15 20:55 - 2019-04-18 22:39 - 000003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-datetime-l1-1-0.dll
    2019-05-15 20:55 - 2019-04-18 22:39 - 000003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-console-l1-1-0.dll
    2019-05-15 20:55 - 2019-04-18 22:27 - 000009728 _____ (Microsoft Corporation) C:\Windows\SysWOW64\sscore.dll
    2019-05-15 20:55 - 2019-04-18 22:26 - 000050176 _____ (Microsoft Corporation) C:\Windows\SysWOW64\auditpol.exe
    2019-05-15 20:55 - 2019-04-18 22:20 - 000025600 _____ (Microsoft Corporation) C:\Windows\SysWOW64\setup16.exe
    2019-05-15 20:55 - 2019-04-18 22:20 - 000014336 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ntvdm64.dll
    2019-05-15 20:55 - 2019-04-18 22:20 - 000007680 _____ (Microsoft Corporation) C:\Windows\SysWOW64\instnm.exe
    2019-05-15 20:55 - 2019-04-18 22:20 - 000002048 _____ (Microsoft Corporation) C:\Windows\SysWOW64\user.exe
    2019-05-15 20:55 - 2019-04-18 22:19 - 000036352 _____ (Microsoft Corporation) C:\Windows\SysWOW64\cryptbase.dll
    2019-05-15 20:55 - 2019-04-18 22:18 - 000006144 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-security-base-l1-1-0.dll
    2019-05-15 20:55 - 2019-04-18 22:18 - 000004608 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-threadpool-l1-1-0.dll
    2019-05-15 20:55 - 2019-04-18 22:18 - 000003584 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-xstate-l1-1-0.dll
    2019-05-15 20:55 - 2019-04-18 22:18 - 000003072 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-util-l1-1-0.dll
    2019-05-15 20:55 - 2019-04-18 22:15 - 000148480 _____ (Microsoft Corporation) C:\Windows\system32\appidpolicyconverter.exe
    2019-05-15 20:55 - 2019-04-18 22:15 - 000062464 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\appid.sys
    2019-05-15 20:55 - 2019-04-18 22:15 - 000017920 _____ (Microsoft Corporation) C:\Windows\system32\appidcertstorecheck.exe
    2019-05-15 20:55 - 2019-04-18 22:14 - 000064000 _____ (Microsoft Corporation) C:\Windows\system32\auditpol.exe
    2019-05-15 20:55 - 2019-04-18 22:12 - 000338432 _____ (Microsoft Corporation) C:\Windows\system32\conhost.exe
    2019-05-15 20:55 - 2019-04-18 22:11 - 000296960 _____ (Microsoft Corporation) C:\Windows\system32\rstrui.exe
    2019-05-15 20:55 - 2019-04-18 22:11 - 000129024 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\videoprt.sys
    2019-05-15 20:55 - 2019-04-18 22:08 - 000464384 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\srv.sys
    2019-05-15 20:55 - 2019-04-18 22:08 - 000406016 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\srv2.sys
    2019-05-15 20:55 - 2019-04-18 22:08 - 000291328 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\mrxsmb10.sys
    2019-05-15 20:55 - 2019-04-18 22:08 - 000169472 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\srvnet.sys
    2019-05-15 20:55 - 2019-04-18 22:08 - 000160768 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\mrxsmb.sys
    2019-05-15 20:55 - 2019-04-18 22:08 - 000129536 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\mrxsmb20.sys
    2019-05-15 20:55 - 2019-04-18 22:07 - 000112640 _____ (Microsoft Corporation) C:\Windows\system32\smss.exe
    2019-05-15 20:55 - 2019-04-18 22:07 - 000064512 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\amdk8.sys
    2019-05-15 20:55 - 2019-04-18 22:07 - 000062464 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\intelppm.sys
    2019-05-15 20:55 - 2019-04-18 22:07 - 000060928 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\processr.sys
    2019-05-15 20:55 - 2019-04-18 22:07 - 000060928 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\amdppm.sys
    2019-05-15 20:55 - 2019-04-18 22:07 - 000044544 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\npfs.sys
    2019-05-15 20:55 - 2019-04-18 22:07 - 000030720 _____ (Microsoft Corporation) C:\Windows\system32\lsass.exe
    2019-05-15 20:55 - 2019-04-16 11:17 - 012880896 _____ (Microsoft Corporation) C:\Windows\SysWOW64\shell32.dll
    2019-05-15 20:55 - 2019-04-16 11:17 - 001425920 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ole32.dll
    2019-05-15 20:55 - 2019-04-16 11:17 - 000628224 _____ (Microsoft Corporation) C:\Windows\SysWOW64\usp10.dll
    2019-05-15 20:55 - 2019-04-16 11:17 - 000583680 _____ (Microsoft Corporation) C:\Windows\SysWOW64\oleaut32.dll
    2019-05-15 20:55 - 2019-04-16 11:17 - 000313344 _____ (Microsoft Corporation) C:\Windows\SysWOW64\gdi32.dll
    2019-05-15 20:55 - 2019-04-16 11:17 - 000026112 _____ (Microsoft Corporation) C:\Windows\SysWOW64\oleres.dll
    2019-05-15 20:55 - 2019-04-16 11:16 - 001499648 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ExplorerFrame.dll
    2019-05-15 20:55 - 2019-04-16 11:05 - 014184448 _____ (Microsoft Corporation) C:\Windows\system32\shell32.dll
    2019-05-15 20:55 - 2019-04-16 11:05 - 002072576 _____ (Microsoft Corporation) C:\Windows\system32\ole32.dll
    2019-05-15 20:55 - 2019-04-16 11:05 - 001867776 _____ (Microsoft Corporation) C:\Windows\system32\ExplorerFrame.dll
    2019-05-15 20:55 - 2019-04-16 11:05 - 000878080 _____ (Microsoft Corporation) C:\Windows\system32\oleaut32.dll
    2019-05-15 20:55 - 2019-04-16 11:05 - 000806400 _____ (Microsoft Corporation) C:\Windows\system32\usp10.dll
    2019-05-15 20:55 - 2019-04-16 11:05 - 000516096 _____ (Microsoft Corporation) C:\Windows\system32\rpcss.dll
    2019-05-15 20:55 - 2019-04-16 11:05 - 000405504 _____ (Microsoft Corporation) C:\Windows\system32\gdi32.dll
    2019-05-15 20:55 - 2019-04-16 11:05 - 000026112 _____ (Microsoft Corporation) C:\Windows\system32\oleres.dll
    2019-05-15 20:55 - 2019-04-16 11:05 - 000008704 _____ (Microsoft Corporation) C:\Windows\system32\comcat.dll
    2019-05-15 20:55 - 2019-04-16 10:55 - 000007168 _____ (Microsoft Corporation) C:\Windows\SysWOW64\comcat.dll
    2019-05-15 20:55 - 2019-04-16 09:15 - 000419648 _____ C:\Windows\SysWOW64\locale.nls
    2019-05-15 20:55 - 2019-04-16 09:15 - 000419648 _____ C:\Windows\system32\locale.nls
    2019-05-15 20:55 - 2019-04-14 01:42 - 000309480 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\atmfd.dll
    2019-05-15 20:55 - 2019-04-14 01:40 - 000111616 _____ (Microsoft Corporation) C:\Windows\SysWOW64\t2embed.dll
    2019-05-15 20:55 - 2019-04-14 01:40 - 000025600 _____ (Microsoft Corporation) C:\Windows\SysWOW64\lpk.dll
    2019-05-15 20:55 - 2019-04-14 01:39 - 000071680 _____ (Microsoft Corporation) C:\Windows\SysWOW64\fontsub.dll
    2019-05-15 20:55 - 2019-04-14 01:39 - 000010240 _____ (Microsoft Corporation) C:\Windows\SysWOW64\dciman32.dll
    2019-05-15 20:55 - 2019-04-14 01:28 - 000383720 _____ (Adobe Systems Incorporated) C:\Windows\system32\atmfd.dll
    2019-05-15 20:55 - 2019-04-14 01:26 - 000151552 _____ (Microsoft Corporation) C:\Windows\system32\t2embed.dll
    2019-05-15 20:55 - 2019-04-14 01:26 - 000101376 _____ (Microsoft Corporation) C:\Windows\system32\fontsub.dll
    2019-05-15 20:55 - 2019-04-14 01:26 - 000046080 _____ (Adobe Systems) C:\Windows\system32\atmlib.dll
    2019-05-15 20:55 - 2019-04-14 01:26 - 000041472 _____ (Microsoft Corporation) C:\Windows\system32\lpk.dll
    2019-05-15 20:55 - 2019-04-14 01:26 - 000014336 _____ (Microsoft Corporation) C:\Windows\system32\dciman32.dll
    2019-05-15 20:55 - 2019-04-14 01:12 - 000034304 _____ (Adobe Systems) C:\Windows\SysWOW64\atmlib.dll
    2019-05-15 20:55 - 2019-04-07 11:17 - 012574208 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wmploc.DLL
    2019-05-15 20:55 - 2019-04-07 11:17 - 011411968 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wmp.dll
    2019-05-15 20:55 - 2019-04-07 11:17 - 000617984 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wmdrmsdk.dll
    2019-05-15 20:55 - 2019-04-07 11:17 - 000382976 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wer.dll
    2019-05-15 20:55 - 2019-04-07 11:17 - 000179712 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wintrust.dll
    2019-05-15 20:55 - 2019-04-07 11:17 - 000160256 _____ (Microsoft Corporation) C:\Windows\SysWOW64\werui.dll
    2019-05-15 20:55 - 2019-04-07 11:16 - 003207168 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mf.dll
    2019-05-15 20:55 - 2019-04-07 11:16 - 001329664 _____ (Microsoft Corporation) C:\Windows\SysWOW64\quartz.dll
    2019-05-15 20:55 - 2019-04-07 11:16 - 000519680 _____ (Microsoft Corporation) C:\Windows\SysWOW64\qdvd.dll
    2019-05-15 20:55 - 2019-04-07 11:16 - 000504320 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msscp.dll
    2019-05-15 20:55 - 2019-04-07 11:16 - 000442368 _____ (Microsoft Corporation) C:\Windows\SysWOW64\AUDIOKSE.dll
    2019-05-15 20:55 - 2019-04-07 11:16 - 000354816 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mfplat.dll
    2019-05-15 20:55 - 2019-04-07 11:16 - 000265216 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msnetobj.dll
    2019-05-15 20:55 - 2019-04-07 11:16 - 000103424 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mfps.dll
    2019-05-15 20:55 - 2019-04-07 11:16 - 000046592 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mssign32.dll
    2019-05-15 20:55 - 2019-04-07 11:16 - 000002048 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mferror.dll
    2019-05-15 20:55 - 2019-04-07 11:15 - 001177088 _____ (Microsoft Corporation) C:\Windows\SysWOW64\crypt32.dll
    2019-05-15 20:55 - 2019-04-07 11:15 - 001005056 _____ (Microsoft Corporation) C:\Windows\SysWOW64\cryptui.dll
    2019-05-15 20:55 - 2019-04-07 11:15 - 000988160 _____ (Microsoft Corporation) C:\Windows\SysWOW64\drmv2clt.dll
    2019-05-15 20:55 - 2019-04-07 11:15 - 000744960 _____ (Microsoft Corporation) C:\Windows\SysWOW64\blackbox.dll
    2019-05-15 20:55 - 2019-04-07 11:15 - 000489984 _____ (Microsoft Corporation) C:\Windows\SysWOW64\evr.dll
    2019-05-15 20:55 - 2019-04-07 11:15 - 000406016 _____ (Microsoft Corporation) C:\Windows\SysWOW64\drmmgrtn.dll
    2019-05-15 20:55 - 2019-04-07 11:15 - 000373248 _____ (Microsoft Corporation) C:\Windows\SysWOW64\AudioEng.dll
    2019-05-15 20:55 - 2019-04-07 11:15 - 000195072 _____ (Microsoft Corporation) C:\Windows\SysWOW64\AudioSes.dll
    2019-05-15 20:55 - 2019-04-07 11:15 - 000146432 _____ (Microsoft Corporation) C:\Windows\SysWOW64\cryptsvc.dll
    2019-05-15 20:55 - 2019-04-07 11:15 - 000106496 _____ (Microsoft Corporation) C:\Windows\SysWOW64\cryptnet.dll
    2019-05-15 20:55 - 2019-04-07 11:15 - 000080896 _____ (Microsoft Corporation) C:\Windows\SysWOW64\cryptsp.dll
    2019-05-15 20:55 - 2019-04-07 11:05 - 000094440 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\mountmgr.sys
    2019-05-15 20:55 - 2019-04-07 11:03 - 014637568 _____ (Microsoft Corporation) C:\Windows\system32\wmp.dll
    2019-05-15 20:55 - 2019-04-07 11:03 - 012574720 _____ (Microsoft Corporation) C:\Windows\system32\wmploc.DLL
    2019-05-15 20:55 - 2019-04-07 11:03 - 001574400 _____ (Microsoft Corporation) C:\Windows\system32\quartz.dll
    2019-05-15 20:55 - 2019-04-07 11:03 - 001281536 _____ (Microsoft Corporation) C:\Windows\system32\werconcpl.dll
    2019-05-15 20:55 - 2019-04-07 11:03 - 000782848 _____ (Microsoft Corporation) C:\Windows\system32\wmdrmsdk.dll
    2019-05-15 20:55 - 2019-04-07 11:03 - 000499712 _____ (Microsoft Corporation) C:\Windows\system32\AUDIOKSE.dll
    2019-05-15 20:55 - 2019-04-07 11:03 - 000486400 _____ (Microsoft Corporation) C:\Windows\system32\wer.dll
    2019-05-15 20:55 - 2019-04-07 11:03 - 000371712 _____ (Microsoft Corporation) C:\Windows\system32\qdvd.dll
    2019-05-15 20:55 - 2019-04-07 11:03 - 000229376 _____ (Microsoft Corporation) C:\Windows\system32\wintrust.dll
    2019-05-15 20:55 - 2019-04-07 11:03 - 000187904 _____ (Microsoft Corporation) C:\Windows\system32\pcasvc.dll
    2019-05-15 20:55 - 2019-04-07 11:03 - 000174080 _____ (Microsoft Corporation) C:\Windows\system32\werui.dll
    2019-05-15 20:55 - 2019-04-07 11:03 - 000086016 _____ (Microsoft Corporation) C:\Windows\system32\wercplsupport.dll
    2019-05-15 20:55 - 2019-04-07 11:03 - 000037376 _____ (Microsoft Corporation) C:\Windows\system32\pcadm.dll
    2019-05-15 20:55 - 2019-04-07 11:03 - 000034304 _____ (Microsoft Corporation) C:\Windows\system32\werdiagcontroller.dll
    2019-05-15 20:55 - 2019-04-07 11:03 - 000009728 _____ (Microsoft Corporation) C:\Windows\system32\spwmp.dll
    2019-05-15 20:55 - 2019-04-07 11:03 - 000008704 _____ (Microsoft Corporation) C:\Windows\system32\pcaevts.dll
    2019-05-15 20:55 - 2019-04-07 11:03 - 000005120 _____ (Microsoft Corporation) C:\Windows\system32\msdxm.ocx
    2019-05-15 20:55 - 2019-04-07 11:03 - 000005120 _____ (Microsoft Corporation) C:\Windows\system32\dxmasf.dll
    2019-05-15 20:55 - 2019-04-07 11:02 - 004120576 _____ (Microsoft Corporation) C:\Windows\system32\mf.dll
    2019-05-15 20:55 - 2019-04-07 11:02 - 001484800 _____ (Microsoft Corporation) C:\Windows\system32\crypt32.dll
    2019-05-15 20:55 - 2019-04-07 11:02 - 001202176 _____ (Microsoft Corporation) C:\Windows\system32\drmv2clt.dll
    2019-05-15 20:55 - 2019-04-07 11:02 - 001068544 _____ (Microsoft Corporation) C:\Windows\system32\cryptui.dll
    2019-05-15 20:55 - 2019-04-07 11:02 - 000842240 _____ (Microsoft Corporation) C:\Windows\system32\blackbox.dll
    2019-05-15 20:55 - 2019-04-07 11:02 - 000680448 _____ (Microsoft Corporation) C:\Windows\system32\audiosrv.dll
    2019-05-15 20:55 - 2019-04-07 11:02 - 000641024 _____ (Microsoft Corporation) C:\Windows\system32\msscp.dll
    2019-05-15 20:55 - 2019-04-07 11:02 - 000632320 _____ (Microsoft Corporation) C:\Windows\system32\evr.dll
    2019-05-15 20:55 - 2019-04-07 11:02 - 000497664 _____ (Microsoft Corporation) C:\Windows\system32\drmmgrtn.dll
    2019-05-15 20:55 - 2019-04-07 11:02 - 000438784 _____ (Microsoft Corporation) C:\Windows\system32\AudioEng.dll
    2019-05-15 20:55 - 2019-04-07 11:02 - 000433152 _____ (Microsoft Corporation) C:\Windows\system32\mfplat.dll
    2019-05-15 20:55 - 2019-04-07 11:02 - 000325632 _____ (Microsoft Corporation) C:\Windows\system32\msnetobj.dll
    2019-05-15 20:55 - 2019-04-07 11:02 - 000295936 _____ (Microsoft Corporation) C:\Windows\system32\AudioSes.dll
    2019-05-15 20:55 - 2019-04-07 11:02 - 000284672 _____ (Microsoft Corporation) C:\Windows\system32\EncDump.dll
    2019-05-15 20:55 - 2019-04-07 11:02 - 000206848 _____ (Microsoft Corporation) C:\Windows\system32\mfps.dll
    2019-05-15 20:55 - 2019-04-07 11:02 - 000190976 _____ (Microsoft Corporation) C:\Windows\system32\cryptsvc.dll
    2019-05-15 20:55 - 2019-04-07 11:02 - 000141824 _____ (Microsoft Corporation) C:\Windows\system32\cryptnet.dll
    2019-05-15 20:55 - 2019-04-07 11:02 - 000081920 _____ (Microsoft Corporation) C:\Windows\system32\cryptsp.dll
    2019-05-15 20:55 - 2019-04-07 11:02 - 000060416 _____ (Microsoft Corporation) C:\Windows\system32\mssign32.dll
    2019-05-15 20:55 - 2019-04-07 11:02 - 000011264 _____ (Microsoft Corporation) C:\Windows\system32\msmmsp.dll
    2019-05-15 20:55 - 2019-04-07 11:02 - 000008192 _____ (Microsoft Corporation) C:\Windows\SysWOW64\spwmp.dll
    2019-05-15 20:55 - 2019-04-07 11:02 - 000004096 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msdxm.ocx
    2019-05-15 20:55 - 2019-04-07 11:02 - 000004096 _____ (Microsoft Corporation) C:\Windows\SysWOW64\dxmasf.dll
    2019-05-15 20:55 - 2019-04-07 11:02 - 000002048 _____ (Microsoft Corporation) C:\Windows\system32\mferror.dll
    2019-05-15 20:55 - 2019-04-07 11:01 - 000050176 _____ (Microsoft Corporation) C:\Windows\SysWOW64\rrinstaller.exe
    2019-05-15 20:55 - 2019-04-07 11:01 - 000023040 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mfpmp.exe
    2019-05-15 20:55 - 2019-04-07 10:57 - 000663552 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\PEAuth.sys
    2019-05-15 20:55 - 2019-04-07 10:49 - 000054272 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wermgr.exe
    2019-05-15 20:55 - 2019-04-07 10:48 - 000028672 _____ (Microsoft Corporation) C:\Windows\SysWOW64\werdiagcontroller.dll
    2019-05-15 20:55 - 2019-04-07 10:45 - 000125952 _____ (Microsoft Corporation) C:\Windows\system32\audiodg.exe
    2019-05-15 20:55 - 2019-04-07 10:45 - 000055808 _____ (Microsoft Corporation) C:\Windows\system32\rrinstaller.exe
    2019-05-15 20:55 - 2019-04-07 10:45 - 000024576 _____ (Microsoft Corporation) C:\Windows\system32\mfpmp.exe
    2019-05-15 20:55 - 2019-04-07 10:42 - 001311744 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msjet40.dll
    2019-05-15 20:55 - 2019-04-07 10:42 - 000376320 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mspbde40.dll
    2019-05-15 20:55 - 2019-04-07 10:42 - 000353280 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msrd3x40.dll
    2019-05-15 20:55 - 2019-04-07 10:42 - 000341504 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msexcl40.dll
    2019-05-15 20:55 - 2019-04-07 10:42 - 000240640 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msltus40.dll
    2019-05-15 20:55 - 2019-04-07 10:38 - 000407040 _____ (Microsoft Corporation) C:\Windows\system32\nltest.exe
    2019-05-15 20:55 - 2019-04-07 10:35 - 000050688 _____ (Microsoft Corporation) C:\Windows\system32\wermgr.exe
    2019-05-15 20:55 - 2019-04-07 10:33 - 000011264 _____ (Microsoft Corporation) C:\Windows\system32\pcawrk.exe
    2019-05-15 20:55 - 2019-04-07 10:33 - 000009728 _____ (Microsoft Corporation) C:\Windows\system32\pcalua.exe
    2019-05-15 20:55 - 2019-04-07 09:05 - 000634312 _____ (Microsoft Corporation) C:\Windows\system32\winload.exe
    2019-05-15 20:55 - 2019-04-04 20:34 - 000064000 _____ (Microsoft Corporation) C:\Windows\system32\cryptdll.dll
    2019-05-15 20:55 - 2019-04-04 20:23 - 000057856 _____ (Microsoft Corporation) C:\Windows\SysWOW64\cryptdll.dll

    ==================== One month (modified) ========

    (If an entry is included in the fixlist, the file/folder will be moved.)

    2019-06-04 22:37 - 2018-07-27 20:43 - 000000907 _____ C:\Windows\Tasks\EPSON ES-200 Update.job
    2019-06-04 22:36 - 2018-11-04 21:45 - 000000000 ____D C:\FRST
    2019-06-04 22:33 - 2014-11-29 22:58 - 000000000 ____D C:\ProgramData\NVIDIA
    2019-06-04 22:33 - 2009-07-14 01:08 - 000000006 ____H C:\Windows\Tasks\SA.DAT
    2019-06-03 21:46 - 2009-07-14 00:45 - 000021808 ____H C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0
    2019-06-03 21:46 - 2009-07-14 00:45 - 000021808 ____H C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0
    2019-06-03 21:43 - 2009-07-14 01:13 - 000781790 _____ C:\Windows\system32\PerfStringBackup.INI
    2019-06-03 21:43 - 2009-07-13 23:20 - 000000000 ____D C:\Windows\inf
    2019-06-01 14:42 - 2018-07-27 20:43 - 000000000 ____D C:\Program Files (x86)\EPSON Software
    2019-06-01 14:42 - 2014-12-26 01:20 - 000000000 ___HD C:\Program Files (x86)\InstallShield Installation Information
    2019-06-01 14:42 - 2014-12-11 21:37 - 000000000 ____D C:\Program Files (x86)\epson
    2019-06-01 14:32 - 2014-11-29 22:12 - 000000000 ____D C:\Users\Thomas
    2019-05-23 18:18 - 2009-07-13 23:20 - 000000000 ____D C:\Windows\rescache
    2019-05-21 17:28 - 2015-02-04 01:06 - 000002224 _____ C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Google Chrome.lnk
    2019-05-18 11:08 - 2018-11-05 18:04 - 007838904 ____H C:\Users\Thomas\AppData\Local\IconCache.db.backup
    2019-05-18 10:58 - 2009-07-14 00:45 - 000295616 _____ C:\Windows\system32\FNTCACHE.DAT
    2019-05-18 10:56 - 2009-07-13 23:20 - 000000000 ____D C:\Windows\SysWOW64\Dism
    2019-05-18 10:56 - 2009-07-13 23:20 - 000000000 ____D C:\Windows\system32\Dism
    2019-05-14 22:48 - 2014-11-29 19:31 - 000000000 ____D C:\Windows\system32\MRT
    2019-05-14 22:44 - 2014-11-29 19:31 - 132445408 ____C (Microsoft Corporation) C:\Windows\system32\MRT.exe
    2019-05-14 22:41 - 2014-11-30 02:11 - 000773912 _____ C:\Windows\SysWOW64\PerfStringBackup.INI
    2019-05-14 22:06 - 2016-04-14 18:13 - 000000035 _____ C:\ProgramData\droidcam-settings
    2019-05-14 22:03 - 2015-02-04 01:06 - 000003332 _____ C:\Windows\System32\Tasks\GoogleUpdateTaskMachineUA
    2019-05-14 22:03 - 2015-02-04 01:06 - 000003204 _____ C:\Windows\System32\Tasks\GoogleUpdateTaskMachineCore
    2019-05-14 17:10 - 2019-03-02 02:07 - 000004478 _____ C:\Windows\System32\Tasks\Adobe Flash Player PPAPI Notifier
    2019-05-14 17:10 - 2014-11-30 03:41 - 000842296 _____ (Adobe) C:\Windows\SysWOW64\FlashPlayerApp.exe
    2019-05-14 17:10 - 2014-11-30 03:41 - 000175160 _____ (Adobe) C:\Windows\SysWOW64\FlashPlayerCPLApp.cpl
    2019-05-14 17:10 - 2014-11-30 03:41 - 000004312 _____ C:\Windows\System32\Tasks\Adobe Flash Player Updater
    2019-05-14 17:10 - 2014-11-30 03:41 - 000000000 ____D C:\Windows\SysWOW64\Macromed
    2019-05-14 17:10 - 2014-11-30 03:41 - 000000000 ____D C:\Windows\system32\Macromed
    2019-05-14 16:59 - 2015-11-25 16:58 - 000002441 _____ C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Acrobat Reader DC.lnk

    ==================== Files in the root of some directories =======

    2015-05-16 15:24 - 2015-05-16 15:24 - 000000000 _____ () C:\Users\Thomas\AppData\Local\Temp.dat

    ==================== SigCheck ===============================

    (There is no automatic fix for files that do not pass verification.)


    LastRegBack: 2019-05-23 18:09
    ==================== End of FRST.txt ============================
     
  8. HaroRider

    HaroRider Thread Starter

    Joined:
    Aug 9, 2006
    Messages:
    385
    Additional scan result of Farbar Recovery Scan Tool (x64) Version: 04-06-2019
    Ran by Thomas (04-06-2019 22:37:41)
    Running from C:\Users\Thomas\Desktop
    Windows 7 Ultimate Service Pack 1 (X64) (2014-11-30 02:11:55)
    Boot Mode: Normal
    ==========================================================


    ==================== Accounts: =============================

    Administrator (S-1-5-21-2475564236-1283100031-3943380601-500 - Administrator - Disabled)
    Guest (S-1-5-21-2475564236-1283100031-3943380601-501 - Limited - Disabled)
    HomeGroupUser$ (S-1-5-21-2475564236-1283100031-3943380601-1002 - Limited - Enabled)
    Thomas (S-1-5-21-2475564236-1283100031-3943380601-1001 - Administrator - Enabled) => C:\Users\Thomas

    ==================== Security Center ========================

    (If an entry is included in the fixlist, it will be removed.)

    AV: Microsoft Security Essentials (Enabled - Up to date) {71A27EC9-3DA6-45FC-60A7-004F623C6189}
    AS: Microsoft Security Essentials (Enabled - Up to date) {CAC39F2D-1B9C-4A72-5A17-3B3D19BB2B34}
    AS: Windows Defender (Disabled - Up to date) {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}

    ==================== Installed Programs ======================

    (Only the adware programs with "Hidden" flag could be added to the fixlist to unhide them. The adware programs should be uninstalled manually.)

    Adobe Acrobat Reader DC (HKLM-x32\...\{AC76BA86-7AD7-1033-7B44-AC0F074E4100}) (Version: 19.012.20034 - Adobe Systems Incorporated)
    Adobe Flash Player 32 ActiveX (HKLM-x32\...\Adobe Flash Player ActiveX) (Version: 32.0.0.192 - Adobe)
    Adobe Flash Player 32 PPAPI (HKLM-x32\...\Adobe Flash Player PPAPI) (Version: 32.0.0.192 - Adobe)
    AIM 7 (HKLM-x32\...\AIM_7) (Version: - )
    Apple Application Support (32-bit) (HKLM-x32\...\{26356515-5821-40FA-9C3D-9785052A1062}) (Version: 4.3.1 - Apple Inc.)
    Apple Application Support (64-bit) (HKLM\...\{C2651553-6CA3-4822-B2E6-BC4ACA6E0EA2}) (Version: 4.3.1 - Apple Inc.)
    Apple Mobile Device Support (HKLM\...\{2E4AF2A6-50EA-4260-9BA4-5E582D11879A}) (Version: 9.3.0.15 - Apple Inc.)
    Apple Software Update (HKLM-x32\...\{56EC47AA-5813-4FF6-8E75-544026FBEA83}) (Version: 2.2.0.150 - Apple Inc.)
    Batch PDF Merger version 5.1.1 (HKLM-x32\...\{43CF388F-EB3B-4AF2-9A3C-0E5A2013F598}_is1) (Version: 5.1.1 - Essex Software, LLC)
    Bonjour (HKLM\...\{56DDDFB8-7F79-4480-89D5-25E1F52AB28F}) (Version: 3.1.0.1 - Apple Inc.)
    Call of Duty(R) - World at War(TM) (HKLM-x32\...\{D80A6A73-E58A-4673-AFF5-F12D7110661F}) (Version: 1.0 - Activision) Hidden
    Call of Duty(R) - World at War(TM) (HKLM-x32\...\InstallShield_{D80A6A73-E58A-4673-AFF5-F12D7110661F}) (Version: 1.0 - Activision)
    Compatibility Pack for the 2007 Office system (HKLM-x32\...\{90120000-0020-0409-0000-0000000FF1CE}) (Version: 12.0.6612.1000 - Microsoft Corporation)
    Document Capture Pro (HKLM-x32\...\{3FB9973F-8927-4739-B2B4-898A04FC2961}) (Version: 2.01.0004 - Seiko Epson Corporation)
    Epson ES-200_ES-300W_ES-300WR Guide (HKLM-x32\...\UsersGuideEpson ES-200_ES-300W_ES-300WR Guide_is1) (Version: 1.0 - Epson America, Inc.)
    EPSON Scan (HKLM-x32\...\EPSON Scanner) (Version: - Seiko Epson Corporation)
    Epson Scan 2 (HKLM-x32\...\Epson Scan 2) (Version: - Seiko Epson Corporation)
    EPSON Scan OCR Component (HKLM-x32\...\{563B99D8-8895-4E3E-AE8D-15BE8C05F1C1}) (Version: 3.00.04 - SEIKO EPSON Corp.)
    Epson ScanSmart (HKLM-x32\...\{0759F4C1-F260-41C6-9EC3-D5C7CAE4F462}) (Version: 1.0.4 - Seiko Epson Corporation)
    Epson ScanSmart Receipt Manager Plug-In (HKLM-x32\...\{DECE351A-225E-430D-84CD-83B178BBF2B5}) (Version: 1.01.0000 - Seiko Epson Corporation)
    Epson Software Updater (HKLM-x32\...\{60A3CB9F-4429-4C7A-AA97-77CC4FE10671}) (Version: 4.4.9 - Seiko Epson Corporation)
    EPSON WorkForce 500 Series Printer Uninstall (HKLM\...\EPSON WorkForce 500 Series) (Version: - SEIKO EPSON Corporation)
    ES-200_ES-300W User’s Guide (HKLM-x32\...\UsersGuideES-200_ES-300W User’s Guide_is1) (Version: 1.0 - Epson America, Inc.)
    Extended Asian Language font pack for Adobe Acrobat Reader DC (HKLM-x32\...\{AC76BA86-7AD7-2530-0000-AC13084E6700}) (Version: 19.008.20071 - Adobe Systems Incorporated)
    Google Chrome (HKLM-x32\...\Google Chrome) (Version: 74.0.3729.169 - Google Inc.)
    Google Update Helper (HKLM-x32\...\{60EC980A-BDA2-4CB6-A427-B07A5498B4CA}) (Version: 1.3.34.11 - Google LLC) Hidden
    Google Update Helper (HKLM-x32\...\{A92DAB39-4E2C-4304-9AB6-BC44E68B55E2}) (Version: 1.3.25.11 - Google Inc.) Hidden
    GWX Control Panel (HKLM-x32\...\UltimateOutsider_GwxControlPanel) (Version: - UltimateOutsider)
    Intel® Hardware Accelerated Execution Manager (HKLM\...\{27276DC1-66AA-4B16-918D-5AB1EEDF09C6}) (Version: 6.0.5 - Intel Corporation)
    iTunes (HKLM\...\{58D7E5F7-BAD1-49C5-93C8-B655736EDA00}) (Version: 12.4.0.119 - Apple Inc.)
    LG United Mobile Drivers (HKLM-x32\...\{5DB849D6-9392-4FB7-9ABB-87ED433152E5}) (Version: 3.8.1 - LG Electronics)
    Malwarebytes version 3.6.1.2711 (HKLM\...\{35065F43-4BB2-439A-BFF7-0F1014F2E0CD}_is1) (Version: 3.6.1.2711 - Malwarebytes)
    Maxi PC Suite (HKLM-x32\...\{4BB75795-621C-424A-8886-9F054F01A187}) (Version: 1.23 - Autel) Hidden
    Maxi PC Suite (HKLM-x32\...\InstallShield_{4BB75795-621C-424A-8886-9F054F01A187}) (Version: 1.23 - Autel)
    Microsoft .NET Framework 4.7.2 (HKLM\...\{92FB6C44-E685-45AD-9B20-CADF4CABA132} - 1033) (Version: 4.7.03062 - Microsoft Corporation)
    Microsoft Games for Windows - LIVE Redistributable (HKLM-x32\...\{42AA4CA8-DCD8-4308-BCAB-0B6D75856A9D}) (Version: 3.5.95.0 - Microsoft Corporation)
    Microsoft Office Word Viewer 2003 (HKLM-x32\...\{90850409-6000-11D3-8CFE-0150048383C9}) (Version: 11.0.8173.0 - Microsoft Corporation)
    Microsoft Security Essentials (HKLM\...\Microsoft Security Client) (Version: 4.10.209.0 - Microsoft Corporation)
    Microsoft Silverlight (HKLM\...\{89F4137D-6C26-4A84-BDB8-2E5A4BB71E00}) (Version: 5.1.50918.0 - Microsoft Corporation)
    Microsoft Visual C++ 2005 Redistributable (HKLM-x32\...\{710f4c1c-cc18-4c49-8cbf-51240c89a1a2}) (Version: 8.0.61001 - Microsoft Corporation)
    Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.6161 (HKLM\...\{5FCE6D76-F5DC-37AB-B2B8-22AB8CEDB1D4}) (Version: 9.0.30729.6161 - Microsoft Corporation)
    Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.4148 (HKLM-x32\...\{1F1C2DFC-2D24-3E06-BCB8-725134ADF989}) (Version: 9.0.30729.4148 - Microsoft Corporation)
    Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161 (HKLM-x32\...\{9BE518E6-ECC6-35A9-88E4-87755C07200F}) (Version: 9.0.30729.6161 - Microsoft Corporation)
    Microsoft Visual C++ 2010 x64 Redistributable - 10.0.40219 (HKLM\...\{1D8E6291-B0D5-35EC-8441-6616F567A0F7}) (Version: 10.0.40219 - Microsoft Corporation)
    Microsoft Visual C++ 2010 x86 Redistributable - 10.0.40219 (HKLM-x32\...\{F0C3E5D1-1ADE-321E-8167-68EF0DE699A5}) (Version: 10.0.40219 - Microsoft Corporation)
    Microsoft Visual C++ 2015 Redistributable (x86) - 14.0.24215 (HKLM-x32\...\{e2803110-78b3-4664-a479-3611a381656a}) (Version: 14.0.24215.1 - Microsoft Corporation)
    MS Access 97 SP2 (HKLM-x32\...\MS Access 97 SP2) (Version: - )
    MyDefrag v4.3.1 (HKLM\...\MyDefrag v4.3.1_is1) (Version: 4.0.0.0 - J.C. Kessels)
    Network Play System (Patching) (HKLM-x32\...\Network Play System (Patching)) (Version: - )
    NVIDIA 3D Vision Controller Driver 344.75 (HKLM\...\{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_Display.NVIRUSB) (Version: 344.75 - NVIDIA Corporation)
    NVIDIA 3D Vision Driver 344.75 (HKLM\...\{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_Display.3DVision) (Version: 344.75 - NVIDIA Corporation)
    NVIDIA GeForce Experience 2.1.4.1 (HKLM\...\{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_Display.GFExperience) (Version: 2.1.4.1 - NVIDIA Corporation)
    NVIDIA Graphics Driver 344.75 (HKLM\...\{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_Display.Driver) (Version: 344.75 - NVIDIA Corporation)
    NVIDIA HD Audio Driver 1.3.32.1 (HKLM\...\{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_HDAudio.Driver) (Version: 1.3.32.1 - NVIDIA Corporation)
    NVIDIA PhysX System Software 9.14.0702 (HKLM\...\{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_Display.PhysX) (Version: 9.14.0702 - NVIDIA Corporation)
    OpenOffice 4.1.2 (HKLM-x32\...\{E6AD67BB-1C33-4AB3-A387-E0D48137AB70}) (Version: 4.12.9782 - Apache Software Foundation)
    SHIELD Streaming (HKLM\...\{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_GFExperience.NvStreamSrv) (Version: 3.1.2000 - NVIDIA Corporation) Hidden
    SHIELD Wireless Controller Driver (HKLM\...\{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_ShieldWirelessController) (Version: 16.13.69 - NVIDIA Corporation) Hidden
    SimCity 3000 Unlimited (HKLM-x32\...\SimCity 3000 Unlimited) (Version: - )
    Starcraft (HKLM-x32\...\Starcraft) (Version: - )
    Steam (HKLM-x32\...\Steam) (Version: 2.10.91.91 - Valve Corporation)
    TeamSpeak 3 Client (HKLM\...\TeamSpeak 3 Client) (Version: 3.0.16 - TeamSpeak Systems GmbH)
    TemWebRTCPlugin (HKLM-x32\...\{00A96020-0597-4602-9E6F-FDACD74483B4}) (Version: 0.8.902 - Temasys)
    The Sims (HKLM-x32\...\The Sims) (Version: - )
    Windows Live ID Sign-in Assistant (HKLM\...\{9B48B0AC-C813-4174-9042-476A887592C7}) (Version: 6.500.3165.0 - Microsoft Corporation)
    WinRAR 5.21 (64-bit) (HKLM\...\WinRAR archiver) (Version: 5.21.0 - win.rar GmbH)

    ==================== Custom CLSID (Whitelisted): ==========================

    (If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)

    ContextMenuHandlers1: [EPP] -> {09A47860-11B0-4DA5-AFA5-26D86198A780} => c:\Program Files\Microsoft Security Client\shellext.dll [2016-11-14] (Microsoft Corporation -> Microsoft Corporation)
    ContextMenuHandlers1: [WinRAR] -> {B41DB860-64E4-11D2-9906-E49FADC173CA} => C:\Program Files\WinRAR\rarext.dll [2015-02-15] (win.rar GmbH -> Alexander Roshal)
    ContextMenuHandlers1-x32: [WinRAR32] -> {B41DB860-8EE4-11D2-9906-E49FADC173CA} => C:\Program Files\WinRAR\rarext32.dll [2015-02-15] (win.rar GmbH -> Alexander Roshal)
    ContextMenuHandlers2: [EPP] -> {09A47860-11B0-4DA5-AFA5-26D86198A780} => c:\Program Files\Microsoft Security Client\shellext.dll [2016-11-14] (Microsoft Corporation -> Microsoft Corporation)
    ContextMenuHandlers4: [EPP] -> {09A47860-11B0-4DA5-AFA5-26D86198A780} => c:\Program Files\Microsoft Security Client\shellext.dll [2016-11-14] (Microsoft Corporation -> Microsoft Corporation)
    ContextMenuHandlers5: [NvCplDesktopContext] -> {3D1975AF-48C6-4f8e-A182-BE0E08FA86A9} => C:\Windows\system32\nvshext.dll [2014-11-12] (NVIDIA Corporation -> NVIDIA Corporation)
    ContextMenuHandlers6: [WinRAR] -> {B41DB860-64E4-11D2-9906-E49FADC173CA} => C:\Program Files\WinRAR\rarext.dll [2015-02-15] (win.rar GmbH -> Alexander Roshal)
    ContextMenuHandlers6-x32: [WinRAR32] -> {B41DB860-8EE4-11D2-9906-E49FADC173CA} => C:\Program Files\WinRAR\rarext32.dll [2015-02-15] (win.rar GmbH -> Alexander Roshal)

    ==================== Shortcuts & WMI ========================

    (The entries could be listed to be restored or removed.)


    ==================== Loaded Modules (Whitelisted) ==============

    2009-08-18 12:24 - 2009-08-18 12:24 - 000167424 _____ (Microsoft Corporation) [File not signed] C:\Program Files\Common Files\Microsoft Shared\Windows Live\sqmapi.dll
    2014-11-30 02:54 - 2014-11-17 16:02 - 000906704 _____ (NVIDIA Corporation PE Sign v2014 -> NVIDIA Corporation) [File not signed] C:\Program Files\NVIDIA Corporation\NvStreamSrv\rxinput.dll

    ==================== Alternate Data Streams (Whitelisted) =========

    (If an entry is included in the fixlist, only the ADS will be removed.)

    AlternateDataStreams: C:\ProgramData\TEMP:972E3A44 [127]

    ==================== Safe Mode (Whitelisted) ===================

    (If an entry is included in the fixlist, it will be removed from the registry. The "AlternateShell" will be restored.)

    HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\MBAMService => ""="Service"
    HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\MBAMService => ""="Service"

    ==================== Association (Whitelisted) ===============

    (If an entry is included in the fixlist, the registry item will be restored to default or removed.)


    ==================== Internet Explorer trusted/restricted ===============

    (If an entry is included in the fixlist, it will be removed from the registry.)


    ==================== Hosts content: ===============================

    (If needed Hosts: directive could be included in the fixlist to reset Hosts.)

    2009-07-13 22:34 - 2019-03-02 05:27 - 000000826 _____ C:\Windows\system32\drivers\etc\hosts


    ==================== Other Areas ============================

    (Currently there is no automatic fix for this section.)

    HKLM\System\CurrentControlSet\Control\Session Manager\Environment\\Path -> %CommonProgramFiles%\Microsoft Shared\Windows Live;C:\Program Files (x86)\NVIDIA Corporation\PhysX\Common;%SystemRoot%\system32;%SystemRoot%;%SystemRoot%\System32\Wbem;%SYSTEMROOT%\System32\WindowsPowerShell\v1.0\
    HKU\S-1-5-21-2475564236-1283100031-3943380601-1001\Control Panel\Desktop\\Wallpaper -> C:\Users\Thomas\AppData\Roaming\Microsoft\Windows\Themes\TranscodedWallpaper.jpg
    DNS Servers: 192.168.1.1
    HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System => (ConsentPromptBehaviorAdmin: 5) (ConsentPromptBehaviorUser: 3) (EnableLUA: 1)
    Windows Firewall is enabled.

    ==================== MSCONFIG/TASK MANAGER disabled items ==

    If an entry is included in the fixlist, it will be removed.


    ==================== FirewallRules (Whitelisted) ===============

    (If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)

    FirewallRules: [{4687C519-3D42-4627-B437-336323F33362}] => (Allow) C:\Program Files (x86)\Steam\Steam.exe (Valve -> Valve Corporation)
    FirewallRules: [{0CB79711-8767-421B-BB68-61C4A73D4CC0}] => (Allow) C:\Program Files (x86)\Steam\Steam.exe (Valve -> Valve Corporation)
    FirewallRules: [{97C3A49E-4037-4945-9951-A0D4A19CC7E0}] => (Allow) C:\Program Files (x86)\Steam\bin\steamwebhelper.exe No File
    FirewallRules: [{32E1F334-F1B7-4424-A286-35ED6B2C2857}] => (Allow) C:\Program Files (x86)\Steam\bin\steamwebhelper.exe No File
    FirewallRules: [{112B7127-E66A-4FA1-AB4F-A33B24592095}] => (Allow) C:\Program Files (x86)\NVIDIA Corporation\NetService\NvNetworkService.exe (NVIDIA Corporation -> NVIDIA Corporation)
    FirewallRules: [{0B9B1959-5766-450B-AFD3-1DEA93B95558}] => (Allow) C:\Program Files (x86)\NVIDIA Corporation\NetService\NvNetworkService.exe (NVIDIA Corporation -> NVIDIA Corporation)
    FirewallRules: [{D55DA5C4-2670-4B7A-AD34-EC8D5BE68632}] => (Allow) C:\Program Files\NVIDIA Corporation\NvStreamSrv\nvstreamsvc.exe (NVIDIA Corporation -> NVIDIA Corporation)
    FirewallRules: [{2ADDA51D-D26C-4972-8993-A13028AB39B6}] => (Allow) C:\Program Files\NVIDIA Corporation\NvStreamSrv\nvstreamsvc.exe (NVIDIA Corporation -> NVIDIA Corporation)
    FirewallRules: [{CBC5CF28-4AB4-4D40-A2B3-9462929A5928}] => (Allow) C:\Program Files\NVIDIA Corporation\NvStreamSrv\nvstreamer.exe (NVIDIA Corporation -> NVIDIA Corporation)
    FirewallRules: [{86876A32-356C-4624-98EE-7A1D1D1DA088}] => (Allow) C:\Program Files\NVIDIA Corporation\NvStreamSrv\nvstreamer.exe (NVIDIA Corporation -> NVIDIA Corporation)
    FirewallRules: [{498B6236-4E1E-4EA7-9DD2-03900AC05E71}] => (Allow) C:\Program Files (x86)\Steam\steamapps\common\Counter-Strike Source\hl2.exe (Valve -> )
    FirewallRules: [{5663B212-F6BB-4512-BFEF-9B4C9A3F6B3A}] => (Allow) C:\Program Files (x86)\Steam\steamapps\common\Counter-Strike Source\hl2.exe (Valve -> )
    FirewallRules: [{E627DF3B-8D43-4003-8FBC-7E530D0DAB2F}] => (Allow) C:\Program Files (x86)\AIM\aim.exe (AOL Inc. -> AOL Inc.)
    FirewallRules: [{1AE9E2D5-3C54-4068-9758-5D4B7785C820}] => (Allow) C:\Program Files (x86)\AIM\aim.exe (AOL Inc. -> AOL Inc.)
    FirewallRules: [{F68609E6-1A18-48C0-9CFD-ADD9D3AABE4B}] => (Allow) C:\Windows\SysWOW64\PnkBstrA.exe No File
    FirewallRules: [{756BD68C-E730-43A5-A133-7642EDD073A8}] => (Allow) C:\Windows\SysWOW64\PnkBstrA.exe No File
    FirewallRules: [{543349FD-E7D0-4E47-8A86-9544C699EF16}] => (Allow) C:\Windows\SysWOW64\PnkBstrB.exe No File
    FirewallRules: [{BC698ACF-DAD7-48EB-AEFC-4B65C51D4CC6}] => (Allow) C:\Windows\SysWOW64\PnkBstrB.exe No File
    FirewallRules: [{0315A52C-2D3B-4A48-817C-EC77234C199C}] => (Allow) C:\Program Files (x86)\Activision\Call of Duty - World at War\CoDWaWmp.exe (Activision Publishing -> Activision Blizzard, Inc.)
    FirewallRules: [{5564A70C-44E0-4B94-93E2-851F8E10730A}] => (Allow) C:\Program Files (x86)\Activision\Call of Duty - World at War\CoDWaWmp.exe (Activision Publishing -> Activision Blizzard, Inc.)
    FirewallRules: [{31CBFA62-6DEB-411F-9381-EA1CB317D87E}] => (Allow) C:\Program Files (x86)\Activision\Call of Duty - World at War\CoDWaW.exe (Activision Publishing -> Activision Blizzard, Inc.)
    FirewallRules: [{53F7DFB9-45D6-4FC7-A445-0AA0D356A644}] => (Allow) C:\Program Files (x86)\Activision\Call of Duty - World at War\CoDWaW.exe (Activision Publishing -> Activision Blizzard, Inc.)
    FirewallRules: [TCP Query User{2C198AED-F8F6-4187-9A6F-B0BC2CA54B2A}C:\program files (x86)\starcraft\starcraft.exe] => (Allow) C:\program files (x86)\starcraft\starcraft.exe (Blizzard Entertainment) [File not signed]
    FirewallRules: [UDP Query User{EF72E5B4-61F6-43C2-91B3-F24CBF8AD40E}C:\program files (x86)\starcraft\starcraft.exe] => (Allow) C:\program files (x86)\starcraft\starcraft.exe (Blizzard Entertainment) [File not signed]
    FirewallRules: [{EC9B18AA-CB0E-46E0-8172-F7266137CEF9}] => (Allow) C:\Program Files (x86)\Steam\steamapps\common\Half-Life\hl.exe (Valve -> Valve)
    FirewallRules: [{8DC7E831-AD56-43ED-A4D9-B0D5F9FB317E}] => (Allow) C:\Program Files (x86)\Steam\steamapps\common\Half-Life\hl.exe (Valve -> Valve)
    FirewallRules: [TCP Query User{097A5515-E7F0-4E82-BF44-D2798B741008}C:\program files (x86)\internet explorer\iexplore.exe] => (Block) C:\program files (x86)\internet explorer\iexplore.exe (Microsoft Corporation -> Microsoft Corporation)
    FirewallRules: [UDP Query User{5D1866C6-EC05-4313-8949-66E83305FECE}C:\program files (x86)\internet explorer\iexplore.exe] => (Block) C:\program files (x86)\internet explorer\iexplore.exe (Microsoft Corporation -> Microsoft Corporation)
    FirewallRules: [TCP Query User{9BA18054-0D32-4BAC-8BC6-8A0A50F89118}C:\program files (x86)\secondlifeviewer\slvoice.exe] => (Block) C:\program files (x86)\secondlifeviewer\slvoice.exe No File
    FirewallRules: [UDP Query User{ED951674-C95D-4BE2-94B7-56C4E808C87B}C:\program files (x86)\secondlifeviewer\slvoice.exe] => (Block) C:\program files (x86)\secondlifeviewer\slvoice.exe No File
    FirewallRules: [{8FA1E749-C69B-4320-A060-BED0CAFF3341}] => (Allow) C:\Program Files\Bonjour\mDNSResponder.exe (Apple Inc. -> Apple Inc.)
    FirewallRules: [{ADB6AFD1-B056-47AC-8809-DA5AD208423D}] => (Allow) C:\Program Files\Bonjour\mDNSResponder.exe (Apple Inc. -> Apple Inc.)
    FirewallRules: [{6311EA5B-18EC-40BD-83B6-77AD6EE6FFE3}] => (Allow) C:\Program Files (x86)\Bonjour\mDNSResponder.exe (Apple Inc. -> Apple Inc.)
    FirewallRules: [{9EA2AC88-7417-4427-9828-1C5F3C1DB8A9}] => (Allow) C:\Program Files (x86)\Bonjour\mDNSResponder.exe (Apple Inc. -> Apple Inc.)
    FirewallRules: [{53C6944D-3839-4436-8AE5-78193CEF0D77}] => (Allow) C:\Program Files\iTunes\iTunes.exe (Apple Inc. -> Apple Inc.)
    FirewallRules: [{691349F7-53C9-4E72-9D8C-BCAB259431D4}] => (Allow) C:\Program Files (x86)\Steam\bin\cef\cef.win7\steamwebhelper.exe No File
    FirewallRules: [{5A90D081-0928-4487-8337-FE55568DC5D5}] => (Allow) C:\Program Files (x86)\Steam\bin\cef\cef.win7\steamwebhelper.exe No File
    FirewallRules: [{C8E4309B-8281-4ADC-AD5F-15D7C1EEE2BE}] => (Allow) C:\Program Files (x86)\Steam\steamapps\common\Counter-Strike Global Offensive\csgo.exe (Valve -> )
    FirewallRules: [{B5C1DBC1-C623-483D-B865-3E276D2366B7}] => (Allow) C:\Program Files (x86)\Steam\steamapps\common\Counter-Strike Global Offensive\csgo.exe (Valve -> )
    FirewallRules: [{D6BCCC3E-383E-4CAA-AC33-124746872D6C}] => (Allow) C:\Program Files (x86)\Steam\steamapps\common\Grand Theft Auto IV\GTAIV\LaunchGTAIV.exe (Sony DADC Austria AG -> Sony DADC Austria AG) [File not signed]
    FirewallRules: [{A6C18709-879B-4089-8CC6-1335EF1CD679}] => (Allow) C:\Program Files (x86)\Steam\steamapps\common\Grand Theft Auto IV\GTAIV\LaunchGTAIV.exe (Sony DADC Austria AG -> Sony DADC Austria AG) [File not signed]
    FirewallRules: [TCP Query User{24974B3D-45FF-4D52-9309-2C44B428CED8}C:\program files (x86)\steam\steamapps\common\grand theft auto iv\gtaiv\gtaiv.exe] => (Allow) C:\program files (x86)\steam\steamapps\common\grand theft auto iv\gtaiv\gtaiv.exe (Rockstar Games, Inc. -> Take-Two Interactive Software, Inc.)
    FirewallRules: [UDP Query User{341905C4-E075-467F-8511-462143BF7C7D}C:\program files (x86)\steam\steamapps\common\grand theft auto iv\gtaiv\gtaiv.exe] => (Allow) C:\program files (x86)\steam\steamapps\common\grand theft auto iv\gtaiv\gtaiv.exe (Rockstar Games, Inc. -> Take-Two Interactive Software, Inc.)
    FirewallRules: [TCP Query User{CF7CD6A5-FE19-41EC-8C70-3963275AE604}C:\users\thomas\appdata\local\skypeplugin\pluginhost.exe] => (Allow) C:\users\thomas\appdata\local\skypeplugin\pluginhost.exe No File
    FirewallRules: [UDP Query User{A19A7966-D66B-4DB1-A2B1-6820C7616CCE}C:\users\thomas\appdata\local\skypeplugin\pluginhost.exe] => (Allow) C:\users\thomas\appdata\local\skypeplugin\pluginhost.exe No File
    FirewallRules: [{637C394F-FE83-4E3E-97FA-9E521F142CB3}] => (Allow) C:\Program Files (x86)\DroidCam\DroidCamApp.exe No File
    FirewallRules: [{B67E8A06-3366-419C-B56B-5B49BB55B592}] => (Allow) C:\Program Files (x86)\DroidCam\DroidCamApp.exe No File
    FirewallRules: [{DF12EE0E-9A5A-4020-967E-5D17B7FE5FD7}] => (Allow) C:\Program Files (x86)\Autel\PassThru\Maxi PC Suit\PCLink.exe (Autel) [File not signed]
    FirewallRules: [{BEA35DC2-48E4-4237-9626-4FD9751C6575}] => (Allow) C:\Program Files (x86)\Autel\PassThru\Maxi PC Suit\PCLink.exe (Autel) [File not signed]
    FirewallRules: [{9EEA2958-95C4-42E1-8613-BE03309BCD40}] => (Allow) LPort=5150
    FirewallRules: [{6AC572BB-2D17-4990-A65F-582D1E7F731B}] => (Allow) C:\Program Files (x86)\EPSON Software\Event Manager\EEventManager.exe No File
    FirewallRules: [{C7EF1E7B-ABC8-49E4-A89A-B49B4F3EE6BF}] => (Allow) C:\Program Files (x86)\EPSON Software\Event Manager\EEventManager.exe No File
    FirewallRules: [{3AB2EEC1-1E63-407E-B4F4-A0FBF7427929}] => (Allow) C:\Program Files (x86)\Steam\bin\cef\cef.win7x64\steamwebhelper.exe (Valve -> Valve Corporation)
    FirewallRules: [{054D39BD-473C-4571-AA7A-A145F582F5FB}] => (Allow) C:\Program Files (x86)\Steam\bin\cef\cef.win7x64\steamwebhelper.exe (Valve -> Valve Corporation)
    FirewallRules: [{1571C5CD-C0A1-4363-A6F8-C465932CB086}] => (Allow) C:\Program Files (x86)\Epson Software\Event Manager\EEventManager.exe No File
    FirewallRules: [{D4B7EB47-9510-4972-98EF-5A385BC5066F}] => (Allow) C:\Program Files (x86)\Epson Software\Event Manager\EEventManager.exe No File
    FirewallRules: [TCP Query User{8DE86726-A402-4E80-9723-A1DE5C86E56C}C:\program files (x86)\maxis\simcity 3000 unlimited\apps\updater\updater.exe] => (Allow) C:\program files (x86)\maxis\simcity 3000 unlimited\apps\updater\updater.exe () [File not signed]
    FirewallRules: [UDP Query User{F04AC7A6-6FA8-478C-84CD-BF268FFCCC88}C:\program files (x86)\maxis\simcity 3000 unlimited\apps\updater\updater.exe] => (Allow) C:\program files (x86)\maxis\simcity 3000 unlimited\apps\updater\updater.exe () [File not signed]
    FirewallRules: [{36D0CED3-01F7-4252-AF17-066430F25CF2}] => (Allow) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe (Google LLC -> Google Inc.)

    ==================== Restore Points =========================

    23-05-2019 16:55:52 Windows Update
    28-05-2019 17:46:29 Windows Update
    01-06-2019 13:34:03 Windows Update
    01-06-2019 14:41:59 Removed Epson Event Manager

    ==================== Faulty Device Manager Devices =============

    Name: AT91 USB to Serial Converter (COM3)
    Description: AT91 USB to Serial Converter
    Class Guid: {4d36e978-e325-11ce-bfc1-08002be10318}
    Manufacturer: ATMEL Corp.
    Service: usbser
    Problem: : This device cannot start. (Code10)
    Resolution: Device failed to start. Click "Update Driver" to update the drivers for this device.
    On the "General Properties" tab of the device, click "Troubleshoot" to start the troubleshooting wizard.

    Name: NVIDIA Virtual Audio Device (Wave Extensible) (WDM)
    Description: NVIDIA Virtual Audio Device (Wave Extensible) (WDM)
    Class Guid: {4d36e96c-e325-11ce-bfc1-08002be10318}
    Manufacturer: NVIDIA
    Service: nvvad_WaveExtensible
    Problem: : This device is disabled. (Code 22)
    Resolution: In Device Manager, click "Action", and then click "Enable Device". This starts the Enable Device wizard. Follow the instructions.

    Name: NVIDIA High Definition Audio
    Description: NVIDIA High Definition Audio
    Class Guid: {4d36e96c-e325-11ce-bfc1-08002be10318}
    Manufacturer: NVIDIA
    Service: NVHDA
    Problem: : This device is disabled. (Code 22)
    Resolution: In Device Manager, click "Action", and then click "Enable Device". This starts the Enable Device wizard. Follow the instructions.


    ==================== Event log errors: =========================

    Application errors:
    ==================
    Error: (06/04/2019 10:36:41 PM) (Source: Microsoft-Windows-CAPI2) (EventID: 4107) (User: )
    Description: Failed extract of third-party root list from auto update cab at: <http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootstl.cab> with error: The data is invalid.
    .

    Error: (06/04/2019 10:36:40 PM) (Source: Microsoft-Windows-CAPI2) (EventID: 4107) (User: )
    Description: Failed extract of third-party root list from auto update cab at: <http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootstl.cab> with error: The data is invalid.
    .

    Error: (06/04/2019 10:36:40 PM) (Source: Microsoft-Windows-CAPI2) (EventID: 4107) (User: )
    Description: Failed extract of third-party root list from auto update cab at: <http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootstl.cab> with error: The data is invalid.
    .

    Error: (06/04/2019 10:36:40 PM) (Source: Microsoft-Windows-CAPI2) (EventID: 4107) (User: )
    Description: Failed extract of third-party root list from auto update cab at: <http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootstl.cab> with error: The data is invalid.
    .

    Error: (06/04/2019 10:36:40 PM) (Source: Microsoft-Windows-CAPI2) (EventID: 4107) (User: )
    Description: Failed extract of third-party root list from auto update cab at: <http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootstl.cab> with error: The data is invalid.
    .

    Error: (06/04/2019 10:36:40 PM) (Source: Microsoft-Windows-CAPI2) (EventID: 4107) (User: )
    Description: Failed extract of third-party root list from auto update cab at: <http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootstl.cab> with error: The data is invalid.
    .

    Error: (06/04/2019 10:36:40 PM) (Source: Microsoft-Windows-CAPI2) (EventID: 4107) (User: )
    Description: Failed extract of third-party root list from auto update cab at: <http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootstl.cab> with error: The data is invalid.
    .

    Error: (06/04/2019 10:36:40 PM) (Source: Microsoft-Windows-CAPI2) (EventID: 4107) (User: )
    Description: Failed extract of third-party root list from auto update cab at: <http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootstl.cab> with error: The data is invalid.
    .


    System errors:
    =============
    Error: (06/04/2019 10:33:47 PM) (Source: Schannel) (EventID: 4119) (User: NT AUTHORITY)
    Description: The following fatal alert was received: 40.

    Error: (06/04/2019 10:33:47 PM) (Source: Schannel) (EventID: 4119) (User: NT AUTHORITY)
    Description: The following fatal alert was received: 70.

    Error: (06/03/2019 09:57:45 PM) (Source: Schannel) (EventID: 4119) (User: NT AUTHORITY)
    Description: The following fatal alert was received: 70.

    Error: (06/03/2019 09:52:30 PM) (Source: Schannel) (EventID: 4119) (User: NT AUTHORITY)
    Description: The following fatal alert was received: 70.

    Error: (06/03/2019 09:49:40 PM) (Source: Schannel) (EventID: 4119) (User: NT AUTHORITY)
    Description: The following fatal alert was received: 70.

    Error: (06/03/2019 09:49:11 PM) (Source: Schannel) (EventID: 4119) (User: NT AUTHORITY)
    Description: The following fatal alert was received: 70.

    Error: (06/03/2019 09:36:44 PM) (Source: Schannel) (EventID: 4119) (User: NT AUTHORITY)
    Description: The following fatal alert was received: 40.

    Error: (06/03/2019 09:36:44 PM) (Source: Schannel) (EventID: 4119) (User: NT AUTHORITY)
    Description: The following fatal alert was received: 70.


    ==================== Memory info ===========================

    BIOS: American Megatrends Inc. 0636 07/15/2008
    Motherboard: ASUSTeK Computer INC. P5B-E Plus
    Processor: Intel(R) Core(TM)2 CPU 6420 @ 2.13GHz
    Percentage of memory in use: 61%
    Total physical RAM: 7167.18 MB
    Available physical RAM: 2771.21 MB
    Total Virtual: 14332.5 MB
    Available Virtual: 10418.55 MB

    ==================== Drives ================================

    Drive c: () (Fixed) (Total:232.79 GB) (Free:80.52 GB) NTFS

    \\?\Volume{4d231d83-7835-11e4-a18d-806e6f6e6963}\ (System Reserved) (Fixed) (Total:0.1 GB) (Free:0.07 GB) NTFS

    ==================== MBR & Partition Table ==================

    ========================================================
    Disk: 0 (MBR Code: Windows 7/8/10) (Size: 232.9 GB) (Disk ID: 2E26A10E)
    Partition 1: (Active) - (Size=100 MB) - (Type=07 NTFS)
    Partition 2: (Not Active) - (Size=232.8 GB) - (Type=07 NTFS)

    ==================== End of Addition.txt ============================
     
  9. iMacg3

    iMacg3 Malware Specialist

    Joined:
    Nov 3, 2018
    Messages:
    417
    Hi,

    Did you intentionally install Chromium? (Open source browser, not Google Chrome)
     
  10. HaroRider

    HaroRider Thread Starter

    Joined:
    Aug 9, 2006
    Messages:
    385
    No, I did not intentionally install Chromium.
     
  11. iMacg3

    iMacg3 Malware Specialist

    Joined:
    Nov 3, 2018
    Messages:
    417
    Hi,
    Did you set a firewall restriction for Internet Explorer?

    ---------------------------------------------------
    Farbar Recovery Scan Tool - Fix
    • Start FRST in a similar manner to when you ran a scan earlier, but this time when it opens ....
    • Press Ctrl+y (Ctrl and y keys at the same time)
    • A blank, randomly named notepad file will open.
    • Copy and paste the following into it ....
    Code:
    start
    
    CreateRestorePoint:
    EmptyTemp:
    CloseProcesses:
    
    HKU\S-1-5-21-2475564236-1283100031-3943380601-1001\...\Run: [Chromium] => "c:\users\thomas\appdata\local\chromium\application\chrome.exe" --auto-launch-at-startup --profile-directory="Default" --restore-last-session
    Task: {4960080B-A8B1-4886-883D-9B2FE4986648} - System32\Tasks\{4D025105-9C12-4688-8867-D34681DE77DD} => C:\Windows\system32\pcalua.exe -a "C:\Users\Thomas\Desktop\Honda Civic\2\SetupCivic.exe" -d "C:\Users\Thomas\Desktop\Honda Civic\2"
    Task: {884D045C-4B8F-4751-80B6-05A158B46B7E} - System32\Tasks\{B3FC8E5E-4391-4124-9091-548B3D7877BD} => C:\Windows\system32\pcalua.exe -a C:\Windows\IsUninst.exe -c -f"C:\Program Files (x86)\Maxis\The Sims\Uninst.isu"
    SearchScopes: HKLM -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL =
    SearchScopes: HKLM -> {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL =
    SearchScopes: HKLM-x32 -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL =
    SearchScopes: HKLM-x32 -> {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL =
    SearchScopes: HKU\S-1-5-21-2475564236-1283100031-3943380601-1001 -> {2f23ab71-4ac6-41f2-a955-ea576e553146} URL =
    FF Plugin: @microsoft.com/GENUINE -> disabled [No File]
    FF Plugin-x32: @microsoft.com/GENUINE -> disabled [No File]
    S3 Synth3dVsc; System32\drivers\synth3dvsc.sys [X]
    S3 tsusbhub; system32\drivers\tsusbhub.sys [X]
    S3 VGPU; System32\drivers\rdvgkmd.sys [X]
    
    FirewallRules: [{97C3A49E-4037-4945-9951-A0D4A19CC7E0}] => (Allow) C:\Program Files (x86)\Steam\bin\steamwebhelper.exe No File
    FirewallRules: [{32E1F334-F1B7-4424-A286-35ED6B2C2857}] => (Allow) C:\Program Files (x86)\Steam\bin\steamwebhelper.exe No File
    FirewallRules: [{F68609E6-1A18-48C0-9CFD-ADD9D3AABE4B}] => (Allow) C:\Windows\SysWOW64\PnkBstrA.exe No File
    FirewallRules: [{756BD68C-E730-43A5-A133-7642EDD073A8}] => (Allow) C:\Windows\SysWOW64\PnkBstrA.exe No File
    FirewallRules: [{543349FD-E7D0-4E47-8A86-9544C699EF16}] => (Allow) C:\Windows\SysWOW64\PnkBstrB.exe No File
    FirewallRules: [{BC698ACF-DAD7-48EB-AEFC-4B65C51D4CC6}] => (Allow) C:\Windows\SysWOW64\PnkBstrB.exe No File
    FirewallRules: [TCP Query User{9BA18054-0D32-4BAC-8BC6-8A0A50F89118}C:\program files (x86)\secondlifeviewer\slvoice.exe] => (Block) C:\program files (x86)\secondlifeviewer\slvoice.exe No File
    FirewallRules: [UDP Query User{ED951674-C95D-4BE2-94B7-56C4E808C87B}C:\program files (x86)\secondlifeviewer\slvoice.exe] => (Block) C:\program files (x86)\secondlifeviewer\slvoice.exe No File
    FirewallRules: [{691349F7-53C9-4E72-9D8C-BCAB259431D4}] => (Allow) C:\Program Files (x86)\Steam\bin\cef\cef.win7\steamwebhelper.exe No File
    FirewallRules: [{5A90D081-0928-4487-8337-FE55568DC5D5}] => (Allow) C:\Program Files (x86)\Steam\bin\cef\cef.win7\steamwebhelper.exe No File
    FirewallRules: [TCP Query User{CF7CD6A5-FE19-41EC-8C70-3963275AE604}C:\users\thomas\appdata\local\skypeplugin\pluginhost.exe] => (Allow) C:\users\thomas\appdata\local\skypeplugin\pluginhost.exe No File
    FirewallRules: [UDP Query User{A19A7966-D66B-4DB1-A2B1-6820C7616CCE}C:\users\thomas\appdata\local\skypeplugin\pluginhost.exe] => (Allow) C:\users\thomas\appdata\local\skypeplugin\pluginhost.exe No File
    FirewallRules: [{637C394F-FE83-4E3E-97FA-9E521F142CB3}] => (Allow) C:\Program Files (x86)\DroidCam\DroidCamApp.exe No File
    FirewallRules: [{B67E8A06-3366-419C-B56B-5B49BB55B592}] => (Allow) C:\Program Files (x86)\DroidCam\DroidCamApp.exe No File
    FirewallRules: [{6AC572BB-2D17-4990-A65F-582D1E7F731B}] => (Allow) C:\Program Files (x86)\EPSON Software\Event Manager\EEventManager.exe No File
    FirewallRules: [{C7EF1E7B-ABC8-49E4-A89A-B49B4F3EE6BF}] => (Allow) C:\Program Files (x86)\EPSON Software\Event Manager\EEventManager.exe No File
    FirewallRules: [{1571C5CD-C0A1-4363-A6F8-C465932CB086}] => (Allow) C:\Program Files (x86)\Epson Software\Event Manager\EEventManager.exe No File
    FirewallRules: [{D4B7EB47-9510-4972-98EF-5A385BC5066F}] => (Allow) C:\Program Files (x86)\Epson Software\Event Manager\EEventManager.exe No File
    
    c:\users\thomas\appdata\local\chromium
    
    VirusTotal: C:\Windows\SysWOW64\pdvcodec.dll;C:\Windows\SysWow64\Drivers\secdrv.sys;C:\Windows\SysWOW64\DRIVERS\WinUsb.sys;C:\Users\Thomas\AppData\Local\Temp.dat
    
    CMD: Bitsadmin /Reset /Allusers
    
    end
    • Press Ctrl+s to save the file.
    NOTICE: This script was written specifically for this user. Running it on another machine may cause damage to your operating system
    • Now press the Fix button once and wait.
    • FRST will process the fixlist
    • When finished, it will produce a log (fixlog.txt) in the same folder/directory as FRST
    • Please post the log in your next reply.
     
  12. HaroRider

    HaroRider Thread Starter

    Joined:
    Aug 9, 2006
    Messages:
    385
    I have not set a firewall restriction for internet explorer that I know of.
    _____________________________________________________________________________________________________________________________________________________
    Fix result of Farbar Recovery Scan Tool (x64) Version: 05-06-2019 01
    Ran by Thomas (06-06-2019 12:57:20) Run:2
    Running from C:\Users\Thomas\Desktop
    Loaded Profiles: Thomas (Available Profiles: Thomas)
    Boot Mode: Normal
    ==============================================

    fixlist content:
    *****************
    start

    CreateRestorePoint:
    EmptyTemp:
    CloseProcesses:

    HKU\S-1-5-21-2475564236-1283100031-3943380601-1001\...\Run: [Chromium] => "c:\users\thomas\appdata\local\chromium\application\chrome.exe" --auto-launch-at-startup --profile-directory="Default" --restore-last-session
    Task: {4960080B-A8B1-4886-883D-9B2FE4986648} - System32\Tasks\{4D025105-9C12-4688-8867-D34681DE77DD} => C:\Windows\system32\pcalua.exe -a "C:\Users\Thomas\Desktop\Honda Civic\2\SetupCivic.exe" -d "C:\Users\Thomas\Desktop\Honda Civic\2"
    Task: {884D045C-4B8F-4751-80B6-05A158B46B7E} - System32\Tasks\{B3FC8E5E-4391-4124-9091-548B3D7877BD} => C:\Windows\system32\pcalua.exe -a C:\Windows\IsUninst.exe -c -f"C:\Program Files (x86)\Maxis\The Sims\Uninst.isu"
    SearchScopes: HKLM -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL =
    SearchScopes: HKLM -> {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL =
    SearchScopes: HKLM-x32 -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL =
    SearchScopes: HKLM-x32 -> {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL =
    SearchScopes: HKU\S-1-5-21-2475564236-1283100031-3943380601-1001 -> {2f23ab71-4ac6-41f2-a955-ea576e553146} URL =
    FF Plugin: @microsoft.com/GENUINE -> disabled [No File]
    FF Plugin-x32: @microsoft.com/GENUINE -> disabled [No File]
    S3 Synth3dVsc; System32\drivers\synth3dvsc.sys [X]
    S3 tsusbhub; system32\drivers\tsusbhub.sys [X]
    S3 VGPU; System32\drivers\rdvgkmd.sys [X]

    FirewallRules: [{97C3A49E-4037-4945-9951-A0D4A19CC7E0}] => (Allow) C:\Program Files (x86)\Steam\bin\steamwebhelper.exe No File
    FirewallRules: [{32E1F334-F1B7-4424-A286-35ED6B2C2857}] => (Allow) C:\Program Files (x86)\Steam\bin\steamwebhelper.exe No File
    FirewallRules: [{F68609E6-1A18-48C0-9CFD-ADD9D3AABE4B}] => (Allow) C:\Windows\SysWOW64\PnkBstrA.exe No File
    FirewallRules: [{756BD68C-E730-43A5-A133-7642EDD073A8}] => (Allow) C:\Windows\SysWOW64\PnkBstrA.exe No File
    FirewallRules: [{543349FD-E7D0-4E47-8A86-9544C699EF16}] => (Allow) C:\Windows\SysWOW64\PnkBstrB.exe No File
    FirewallRules: [{BC698ACF-DAD7-48EB-AEFC-4B65C51D4CC6}] => (Allow) C:\Windows\SysWOW64\PnkBstrB.exe No File
    FirewallRules: [TCP Query User{9BA18054-0D32-4BAC-8BC6-8A0A50F89118}C:\program files (x86)\secondlifeviewer\slvoice.exe] => (Block) C:\program files (x86)\secondlifeviewer\slvoice.exe No File
    FirewallRules: [UDP Query User{ED951674-C95D-4BE2-94B7-56C4E808C87B}C:\program files (x86)\secondlifeviewer\slvoice.exe] => (Block) C:\program files (x86)\secondlifeviewer\slvoice.exe No File
    FirewallRules: [{691349F7-53C9-4E72-9D8C-BCAB259431D4}] => (Allow) C:\Program Files (x86)\Steam\bin\cef\cef.win7\steamwebhelper.exe No File
    FirewallRules: [{5A90D081-0928-4487-8337-FE55568DC5D5}] => (Allow) C:\Program Files (x86)\Steam\bin\cef\cef.win7\steamwebhelper.exe No File
    FirewallRules: [TCP Query User{CF7CD6A5-FE19-41EC-8C70-3963275AE604}C:\users\thomas\appdata\local\skypeplugin\pluginhost.exe] => (Allow) C:\users\thomas\appdata\local\skypeplugin\pluginhost.exe No File
    FirewallRules: [UDP Query User{A19A7966-D66B-4DB1-A2B1-6820C7616CCE}C:\users\thomas\appdata\local\skypeplugin\pluginhost.exe] => (Allow) C:\users\thomas\appdata\local\skypeplugin\pluginhost.exe No File
    FirewallRules: [{637C394F-FE83-4E3E-97FA-9E521F142CB3}] => (Allow) C:\Program Files (x86)\DroidCam\DroidCamApp.exe No File
    FirewallRules: [{B67E8A06-3366-419C-B56B-5B49BB55B592}] => (Allow) C:\Program Files (x86)\DroidCam\DroidCamApp.exe No File
    FirewallRules: [{6AC572BB-2D17-4990-A65F-582D1E7F731B}] => (Allow) C:\Program Files (x86)\EPSON Software\Event Manager\EEventManager.exe No File
    FirewallRules: [{C7EF1E7B-ABC8-49E4-A89A-B49B4F3EE6BF}] => (Allow) C:\Program Files (x86)\EPSON Software\Event Manager\EEventManager.exe No File
    FirewallRules: [{1571C5CD-C0A1-4363-A6F8-C465932CB086}] => (Allow) C:\Program Files (x86)\Epson Software\Event Manager\EEventManager.exe No File
    FirewallRules: [{D4B7EB47-9510-4972-98EF-5A385BC5066F}] => (Allow) C:\Program Files (x86)\Epson Software\Event Manager\EEventManager.exe No File

    c:\users\thomas\appdata\local\chromium

    VirusTotal: C:\Windows\SysWOW64\pdvcodec.dll;C:\Windows\SysWow64\Drivers\secdrv.sys;C:\Windows\SysWOW64\DRIVERS\WinUsb.sys;C:\Users\Thomas\AppData\Local\Temp.dat

    CMD: Bitsadmin /Reset /Allusers

    end
    *****************

    Restore point was successfully created.
    Processes closed successfully.
    "HKU\S-1-5-21-2475564236-1283100031-3943380601-1001\Software\Microsoft\Windows\CurrentVersion\Run\\Chromium" => removed successfully
    "HKLM\Software\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Plain\{4960080B-A8B1-4886-883D-9B2FE4986648}" => removed successfully
    "HKLM\Software\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\{4960080B-A8B1-4886-883D-9B2FE4986648}" => removed successfully
    C:\Windows\System32\Tasks\{4D025105-9C12-4688-8867-D34681DE77DD} => moved successfully
    "HKLM\Software\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tree\{4D025105-9C12-4688-8867-D34681DE77DD}" => removed successfully
    "HKLM\Software\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Plain\{884D045C-4B8F-4751-80B6-05A158B46B7E}" => removed successfully
    "HKLM\Software\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\{884D045C-4B8F-4751-80B6-05A158B46B7E}" => removed successfully
    C:\Windows\System32\Tasks\{B3FC8E5E-4391-4124-9091-548B3D7877BD} => moved successfully
    "HKLM\Software\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tree\{B3FC8E5E-4391-4124-9091-548B3D7877BD}" => removed successfully
    HKLM\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\\DefaultScope => value restored successfully
    HKLM\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A} => removed successfully
    HKLM\Software\Classes\CLSID\{0633EE93-D776-472f-A0FF-E1416B8B2E3A} => not found
    HKLM\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\SearchScopes\\DefaultScope => value restored successfully
    HKLM\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A} => removed successfully
    HKLM\Software\Wow6432Node\Classes\CLSID\{0633EE93-D776-472f-A0FF-E1416B8B2E3A} => not found
    HKU\S-1-5-21-2475564236-1283100031-3943380601-1001\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{2f23ab71-4ac6-41f2-a955-ea576e553146} => removed successfully
    HKLM\Software\Classes\CLSID\{2f23ab71-4ac6-41f2-a955-ea576e553146} => not found
    HKLM\Software\MozillaPlugins\@microsoft.com/GENUINE => removed successfully
    HKLM\Software\Wow6432Node\MozillaPlugins\@microsoft.com/GENUINE => removed successfully
    HKLM\System\CurrentControlSet\Services\Synth3dVsc => removed successfully
    Synth3dVsc => service removed successfully
    HKLM\System\CurrentControlSet\Services\tsusbhub => removed successfully
    tsusbhub => service removed successfully
    HKLM\System\CurrentControlSet\Services\VGPU => removed successfully
    VGPU => service removed successfully
    "HKLM\SYSTEM\CurrentControlSet\services\SharedAccess\Parameters\FirewallPolicy\FirewallRules\\{97C3A49E-4037-4945-9951-A0D4A19CC7E0}" => removed successfully
    "HKLM\SYSTEM\CurrentControlSet\services\SharedAccess\Parameters\FirewallPolicy\FirewallRules\\{32E1F334-F1B7-4424-A286-35ED6B2C2857}" => removed successfully
    "HKLM\SYSTEM\CurrentControlSet\services\SharedAccess\Parameters\FirewallPolicy\FirewallRules\\{F68609E6-1A18-48C0-9CFD-ADD9D3AABE4B}" => removed successfully
    "HKLM\SYSTEM\CurrentControlSet\services\SharedAccess\Parameters\FirewallPolicy\FirewallRules\\{756BD68C-E730-43A5-A133-7642EDD073A8}" => removed successfully
    "HKLM\SYSTEM\CurrentControlSet\services\SharedAccess\Parameters\FirewallPolicy\FirewallRules\\{543349FD-E7D0-4E47-8A86-9544C699EF16}" => removed successfully
    "HKLM\SYSTEM\CurrentControlSet\services\SharedAccess\Parameters\FirewallPolicy\FirewallRules\\{BC698ACF-DAD7-48EB-AEFC-4B65C51D4CC6}" => removed successfully
    "HKLM\SYSTEM\CurrentControlSet\services\SharedAccess\Parameters\FirewallPolicy\FirewallRules\\TCP Query User{9BA18054-0D32-4BAC-8BC6-8A0A50F89118}C:\program files (x86)\secondlifeviewer\slvoice.exe" => removed successfully
    "HKLM\SYSTEM\CurrentControlSet\services\SharedAccess\Parameters\FirewallPolicy\FirewallRules\\UDP Query User{ED951674-C95D-4BE2-94B7-56C4E808C87B}C:\program files (x86)\secondlifeviewer\slvoice.exe" => removed successfully
    "HKLM\SYSTEM\CurrentControlSet\services\SharedAccess\Parameters\FirewallPolicy\FirewallRules\\{691349F7-53C9-4E72-9D8C-BCAB259431D4}" => removed successfully
    "HKLM\SYSTEM\CurrentControlSet\services\SharedAccess\Parameters\FirewallPolicy\FirewallRules\\{5A90D081-0928-4487-8337-FE55568DC5D5}" => removed successfully
    "HKLM\SYSTEM\CurrentControlSet\services\SharedAccess\Parameters\FirewallPolicy\FirewallRules\\TCP Query User{CF7CD6A5-FE19-41EC-8C70-3963275AE604}C:\users\thomas\appdata\local\skypeplugin\pluginhost.exe" => removed successfully
    "HKLM\SYSTEM\CurrentControlSet\services\SharedAccess\Parameters\FirewallPolicy\FirewallRules\\UDP Query User{A19A7966-D66B-4DB1-A2B1-6820C7616CCE}C:\users\thomas\appdata\local\skypeplugin\pluginhost.exe" => removed successfully
    "HKLM\SYSTEM\CurrentControlSet\services\SharedAccess\Parameters\FirewallPolicy\FirewallRules\\{637C394F-FE83-4E3E-97FA-9E521F142CB3}" => removed successfully
    "HKLM\SYSTEM\CurrentControlSet\services\SharedAccess\Parameters\FirewallPolicy\FirewallRules\\{B67E8A06-3366-419C-B56B-5B49BB55B592}" => removed successfully
    "HKLM\SYSTEM\CurrentControlSet\services\SharedAccess\Parameters\FirewallPolicy\FirewallRules\\{6AC572BB-2D17-4990-A65F-582D1E7F731B}" => removed successfully
    "HKLM\SYSTEM\CurrentControlSet\services\SharedAccess\Parameters\FirewallPolicy\FirewallRules\\{C7EF1E7B-ABC8-49E4-A89A-B49B4F3EE6BF}" => removed successfully
    "HKLM\SYSTEM\CurrentControlSet\services\SharedAccess\Parameters\FirewallPolicy\FirewallRules\\{1571C5CD-C0A1-4363-A6F8-C465932CB086}" => removed successfully
    "HKLM\SYSTEM\CurrentControlSet\services\SharedAccess\Parameters\FirewallPolicy\FirewallRules\\{D4B7EB47-9510-4972-98EF-5A385BC5066F}" => removed successfully
    c:\users\thomas\appdata\local\chromium => moved successfully
    VirusTotal: C:\Windows\SysWOW64\pdvcodec.dll => https://www.virustotal.com/file/546...4df403ec22b755981583b0fd/analysis/1555898398/
    VirusTotal: C:\Windows\SysWow64\Drivers\secdrv.sys => https://www.virustotal.com/file/4d0...954602f11556f7816185f4be/analysis/1470811061/
    VirusTotal: C:\Windows\SysWOW64\DRIVERS\WinUsb.sys => https://www.virustotal.com/file/1a1...128fb2c56c5a8d5d41237e23/analysis/1512669512/
    VirusTotal: C:\Users\Thomas\AppData\Local\Temp.dat => D41D8CD98F00B204E9800998ECF8427E (0-byte MD5)

    ========= Bitsadmin /Reset /Allusers =========


    BITSADMIN version 3.0 [ 7.5.7601 ]
    BITS administration utility.
    (C) Copyright 2000-2006 Microsoft Corp.

    BITSAdmin is deprecated and is not guaranteed to be available in future versions of Windows.
    Administrative tools for the BITS service are now provided by BITS PowerShell cmdlets.

    Unable to cancel {C6C60F18-E534-4639-B8B3-05C52C7936A3}.
    0 out of 1 jobs canceled.

    ========= End of CMD: =========


    =========== EmptyTemp: ==========

    BITS transfer queue => 8388608 B
    DOMStore, IE Recovery, AppCache, Feeds Cache, Thumbcache, IconCache => 78499627 B
    Java, Flash, Steam htmlcache => 69173310 B
    Windows/system/drivers => 104243259 B
    Edge => 0 B
    Chrome => 77100992 B
    Firefox => 0 B
    Opera => 0 B

    Temp, IE cache, history, cookies, recent:
    Users => 0 B
    Default => 0 B
    Public => 0 B
    ProgramData => 0 B
    systemprofile => 128 B
    systemprofile32 => 128 B
    LocalService => 0 B
    NetworkService => 301390 B
    Thomas => 9150841468 B

    RecycleBin => 0 B
    EmptyTemp: => 8.8 GB temporary data Removed.

    ================================


    The system needed a reboot.

    ==== End of Fixlog 12:58:21 ====
     
  13. iMacg3

    iMacg3 Malware Specialist

    Joined:
    Nov 3, 2018
    Messages:
    417
    Hi,

    ---------------------------------------------------
    Farbar Recovery Scan Tool - Fix
    • Start FRST in a similar manner to when you ran a scan earlier, but this time when it opens ....
    • Press Ctrl+y (Ctrl and y keys at the same time)
    • A blank, randomly named notepad file will open.
    • Copy and paste the following into it ....
    Code:
    start
    FirewallRules: [TCP Query User{097A5515-E7F0-4E82-BF44-D2798B741008}C:\program files (x86)\internet explorer\iexplore.exe] => (Block) C:\program files (x86)\internet explorer\iexplore.exe (Microsoft Corporation -> Microsoft Corporation)
    FirewallRules: [UDP Query User{5D1866C6-EC05-4313-8949-66E83305FECE}C:\program files (x86)\internet explorer\iexplore.exe] => (Block) C:\program files (x86)\internet explorer\iexplore.exe (Microsoft Corporation -> Microsoft Corporation)
    end
    • Press Ctrl+s to save the file.
    NOTICE: This script was written specifically for this user. Running it on another machine may cause damage to your operating system
    • Now press the Fix button once and wait.
    • FRST will process the fixlist
    • When finished, it will produce a log (fixlog.txt) in the same folder/directory as FRST
    • Please post the log in your next reply.

    ---------------------------------------------------
    AdwCleaner

    Download AdwCleaner and save it to your desktop.
    • Right-click on AdwCleaner.exe and select Run as Administrator
    • Accept the EULA (I accept), then click on Scan.
    • Let the scan complete. If no objects are detected, close the AdwCleaner window.
    • If any objects are detected, uncheck any items you want to keep.
    • Click on the Clean and Repair button.
    • Once the cleaning process is complete, AdwCleaner will ask to restart your computer. Allow it to do so.
    • After the restart, an AdwCleaner window will open. Click on View Log File, and the log will open in notepad. Copy and paste the contents of the log into your next reply.
    Note: the AdwCleaner log is also saved to C:\AdwCleaner\Logs\AdwCleaner[CXX].txt (where XX is two numbers).

    ---------------------------------------------------
    ESET Online Scanner

    Download ESET Online Scanner and save it to your desktop.
    • Right-click on esetonlinescanner_enu.exe and select Run as Administrator.
    • When the tool opens, click Get Started.
    • Read and accept the license agreement.
    • At the Welcome to ESET Online Scanner window, click Get Started.
    • Select whether you would like to send anonymous data to ESET.
    • Note: if you see the "Welcome Back to ESET Online Scanner" screen, click Computer Scan > Full Scan.
    • Click on the Full Scan option.
    • Select Enable ESET to detect and remove potentially unwanted applications, then click Start scan.
    • ESET will now begin scanning your computer. This may take some time.
    • When the scan is finished and if threats have been detected, select Save scan log. Save it to your desktop as eset.txt. Click on Continue.
    • ESET Online Scanner may ask if you'd like to turn on the Periodic Scan feature. Click on Continue.
    • On the next screen, you can leave feedback about the program if you wish. Check the box for Delete application data on closing. If you left feedback, click Submit and continue. If not, Close without feedback.
    • Open the scan log on your desktop (eset.txt) and copy and paste its contents into your next reply.
     
  14. HaroRider

    HaroRider Thread Starter

    Joined:
    Aug 9, 2006
    Messages:
    385
    Thanks for the help thus far!!
    _____________________________________________________________________________________________________________________________________________________
    Fix result of Farbar Recovery Scan Tool (x64) Version: 06-06-2019
    Ran by Thomas (07-06-2019 16:54:01) Run:3
    Running from C:\Users\Thomas\Desktop
    Loaded Profiles: Thomas (Available Profiles: Thomas)
    Boot Mode: Normal
    ==============================================

    fixlist content:
    *****************
    start
    FirewallRules: [TCP Query User{097A5515-E7F0-4E82-BF44-D2798B741008}C:\program files (x86)\internet explorer\iexplore.exe] => (Block) C:\program files (x86)\internet explorer\iexplore.exe (Microsoft Corporation -> Microsoft Corporation)
    FirewallRules: [UDP Query User{5D1866C6-EC05-4313-8949-66E83305FECE}C:\program files (x86)\internet explorer\iexplore.exe] => (Block) C:\program files (x86)\internet explorer\iexplore.exe (Microsoft Corporation -> Microsoft Corporation)
    end
    *****************

    "HKLM\SYSTEM\CurrentControlSet\services\SharedAccess\Parameters\FirewallPolicy\FirewallRules\\TCP Query User{097A5515-E7F0-4E82-BF44-D2798B741008}C:\program files (x86)\internet explorer\iexplore.exe" => removed successfully
    "HKLM\SYSTEM\CurrentControlSet\services\SharedAccess\Parameters\FirewallPolicy\FirewallRules\\UDP Query User{5D1866C6-EC05-4313-8949-66E83305FECE}C:\program files (x86)\internet explorer\iexplore.exe" => removed successfully

    ==== End of Fixlog 16:54:01 ====
     
  15. HaroRider

    HaroRider Thread Starter

    Joined:
    Aug 9, 2006
    Messages:
    385
    AdwCleaner - No threats Found
     
  16. Sponsor

As Seen On
As Seen On...

Welcome to Tech Support Guy!

Are you looking for the solution to your computer problem? Join our site today to ask your question. This site is completely free -- paid for by advertisers and donations.

If you're not already familiar with forums, watch our Welcome Guide to get started.

Join over 733,556 other people just like you!

Loading...

Short URL to this thread: https://techguy.org/1227984

  1. This site uses cookies to help personalise content, tailor your experience and to keep you logged in if you register.
    By continuing to use this site, you are consenting to our use of cookies.
    Dismiss Notice