1. You are viewing our forum as a guest. For full access please Register. WindowsBBS.com is completely free, paid for by advertisers and donations.

Solved Windows Script Error Message

Discussion in 'Malware and Virus Removal' started by joe645, 2020/02/23.

Page 1 of 2
  1. 2020/02/23
    joe645

    joe645 Well-Known Member Thread Starter

    Joined:
    2004/01/26
    Messages:
    435
    Likes Received:
    1
    I keep getting the following; "Can't find script file C:\Windows\System32\UpdateIP.vbs" I followed a suggestion that told me to create a file and insert it into the System32 dir. but it hasn't helped remove it.
     
    joe645,
    #1
  2. 2020/02/23
    MrBill

    MrBill SuperGeek WindowsBBS Team Member

    Joined:
    2006/01/14
    Messages:
    4,331
    Likes Received:
    270
    When do you get this?
     
    MrBill,
    #2


  3. to hide this advert.

  4. 2020/02/23
    joe645

    joe645 Well-Known Member Thread Starter

    Joined:
    2004/01/26
    Messages:
    435
    Likes Received:
    1
    Most of the time right after boot. Other times after closing browser
     
    joe645,
    #3
  5. 2020/02/24
    TonyT

    TonyT SuperGeek Staff

    Joined:
    2002/01/18
    Messages:
    9,072
    Likes Received:
    400
    It's probably either a script used for freedns or some other dynamic ip service if you have a home server, else it's part of or leftover malware. Some IP phone software uses such a script too.
     
    TonyT,
    #4
  6. 2020/02/24
    joe645

    joe645 Well-Known Member Thread Starter

    Joined:
    2004/01/26
    Messages:
    435
    Likes Received:
    1
    that doesn't tell me how to remove it.
     
    joe645,
    #5
  7. 2020/02/24
    MrBill

    MrBill SuperGeek WindowsBBS Team Member

    Joined:
    2006/01/14
    Messages:
    4,331
    Likes Received:
    270
    Go to the malware section in here and do what is asked there.
     
    MrBill,
    #6
  8. 2020/02/24
    joe645

    joe645 Well-Known Member Thread Starter

    Joined:
    2004/01/26
    Messages:
    435
    Likes Received:
    1
    Additional scan result of Farbar Recovery Scan Tool (x64) Version: 23-02-2020
    Ran by User (24-02-2020 15:23:44)
    Running from C:\Users\User\Downloads
    Windows 10 Home Version 1803 17134.1304 (X64) (2018-05-04 20:57:26)
    Boot Mode: Normal
    ==========================================================


    ==================== Accounts: =============================

    Administrator (S-1-5-21-507875857-259310543-1677438245-500 - Administrator - Disabled)
    DefaultAccount (S-1-5-21-507875857-259310543-1677438245-503 - Limited - Disabled)
    Guest (S-1-5-21-507875857-259310543-1677438245-501 - Limited - Disabled)
    User (S-1-5-21-507875857-259310543-1677438245-1001 - Administrator - Enabled) => C:\Users\User
    WDAGUtilityAccount (S-1-5-21-507875857-259310543-1677438245-504 - Limited - Disabled)

    ==================== Security Center ========================

    (If an entry is included in the fixlist, it will be removed.)

    AV: Windows Defender (Disabled - Up to date) {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
    AV: Malwarebytes (Enabled - Up to date) {23007AD3-69FE-687C-2629-D584AFFAF72B}
    AV: Bitdefender Antivirus (Enabled - Up to date) {0E17DB7D-A20F-62CE-B95B-17DB0CDFE318}
    AS: Malwarebytes (Disabled - Up to date) {98619B37-4FC4-67F2-1C99-EEF6D47DBD96}
    AS: Windows Defender (Disabled - Up to date) {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
    AS: Bitdefender Antispyware (Enabled - Up to date) {B5763A99-8435-6D40-83EB-2CA97758A9A5}

    ==================== Installed Programs ======================

    (Only the adware programs with "Hidden" flag could be added to the fixlist to unhide them. The adware programs should be uninstalled manually.)

    µTorrent (HKU\S-1-5-21-507875857-259310543-1677438245-1001\...\uTorrent) (Version: 3.5.5.45574 - BitTorrent Inc.)
    Adobe Acrobat 5.0 (HKLM-x32\...\Adobe Acrobat 5.0) (Version: 5.0 - Adobe Systems, Inc.)
    Adobe Acrobat Reader DC (HKLM-x32\...\{AC76BA86-7AD7-1033-7B44-AC0F074E4100}) (Version: 20.006.20034 - Adobe Systems Incorporated)
    Adobe Flash Player 32 NPAPI (HKLM-x32\...\Adobe Flash Player NPAPI) (Version: 32.0.0.330 - Adobe)
    Adobe PageMaker 7.0 (HKLM-x32\...\Adobe PageMaker 7.0) (Version: 7.0 - Adobe Systems, Inc.)
    Adobe Photoshop 7.0 (HKLM-x32\...\Adobe Photoshop 7.0) (Version: 7.0 - Adobe Systems, Inc.)
    AMD Catalyst Control Center (HKLM-x32\...\WUCCCApp) (Version: 1.00.0000 - AMD)
    ANT Drivers Installer x64 (HKLM\...\{96973E1F-5AA8-4D30-9E9C-00E580F8D1C5}) (Version: 2.3.4 - Garmin Ltd or its subsidiaries) Hidden
    ANT Drivers Installer x64 (HKLM\...\{C14C3A1D-B5B3-41BB-9358-6FEA3FC642AF}) (Version: 2.3.4 - Garmin Ltd or its subsidiaries) Hidden
    Any Video Converter 6.2.8 (HKLM-x32\...\Any Video Converter) (Version: 6.2.8 - Anvsoft)
    Apowersoft Video Converter Studio V4.7.9 (HKLM-x32\...\{195E8D7F-292B-4B04-A6E7-E96CAF04C767}_is1) (Version: 4.7.9 - APOWERSOFT LIMITED)
    Apple Application Support (32-bit) (HKLM-x32\...\{A7039CC9-4669-4799-92B1-C5CE346DBE3D}) (Version: 8.3 - Apple Inc.)
    Apple Application Support (64-bit) (HKLM\...\{DA78A9DC-3599-4D81-A960-B679687A6C14}) (Version: 8.3 - Apple Inc.)
    Apple Mobile Device Support (HKLM\...\{6CECF0FB-EE71-4FE5-8AE0-FA007408934A}) (Version: 13.0.0.38 - Apple Inc.)
    Apple Software Update (HKLM-x32\...\{A3985C05-7386-411F-A4BF-32A73F37EB44}) (Version: 2.6.3.1 - Apple Inc.)
    ArcSoft ShowBiz (HKLM-x32\...\{9D41D2EF-2D33-4CFD-8A3E-C7E6FCC3303B}) (Version: 3.5.13.64 - ArcSoft)
    ArcSoft Software Suite (HKLM-x32\...\{DC67641A-05C4-4FED-A462-1EB1DC6CF2F5}) (Version: - )
    AviSynth 2.6 (HKLM-x32\...\AviSynth) (Version: 2.6.0.6 - GPL Public release.)
    AVS Audio Converter 8.5.2 (HKLM-x32\...\AVS Audio Converter_is1) (Version: 8.5.2.589 - Online Media Technologies Ltd.)
    AVS Disc Creator 6.1.1 (HKLM-x32\...\AVS Disc Creator_is1) (Version: 6.1.1.550 - Online Media Technologies Ltd.)
    AVS Image Converter 5.2.1 (HKLM-x32\...\AVS Image Converter_is1) (Version: 5.2.1.300 - Online Media Technologies Ltd.)
    AVS Media Player 4.6.1 (HKLM-x32\...\AVS Media Player_is1) (Version: 4.6.1.126 - Online Media Technologies Ltd.)
    AVS Video Converter 10.0.4 (HKLM-x32\...\AVS4YOU Video Converter 7_is1) (Version: 10.0.4.616 - Online Media Technologies Ltd.)
    Bitdefender Agent (HKLM\...\Bitdefender Agent) (Version: 22.0.10.78 - Bitdefender)
    Bitdefender Antivirus Plus (HKLM\...\Bitdefender) (Version: 23.0.24.120 - Bitdefender)
    Bonjour (HKLM\...\{56DDDFB8-7F79-4480-89D5-25E1F52AB28F}) (Version: 3.1.0.1 - Apple Inc.)
    Canon Easy-WebPrint EX (HKLM-x32\...\Easy-WebPrint EX) (Version: 1.7.0.0 - Canon Inc.)
    Canon IJ Scan Utility (HKLM-x32\...\Canon_IJ_Scan_Utility) (Version: 1.3.1.4 - Canon Inc.)
    Canon My Image Garden (HKLM-x32\...\Canon My Image Garden) (Version: 3.6.1 - Canon Inc.)
    Canon My Image Garden Design Files (HKLM-x32\...\Canon My Image Garden Design Files) (Version: 3.6.0 - Canon Inc.)
    Canon Quick Menu (HKLM-x32\...\CanonQuickMenu) (Version: 2.8.5 - Canon Inc.)
    Canon TS5000 series MP Drivers (HKLM\...\{1199FAD5-9546-44f3-81CF-FFDB8040B7BF}_Canon_TS5000_series) (Version: 1.02 - Canon Inc.)
    Canon TS5000 series User Registration (HKLM-x32\...\Canon TS5000 series User Registration) (Version: - ‭Canon Inc.)
    CCleaner (HKLM\...\CCleaner) (Version: 5.61 - Piriform)
    Classic Shell (HKLM\...\{CABCE573-0A86-42FA-A52A-C7EA61D5BE08}) (Version: 4.3.1 - IvoSoft)
    CPUID CPU-Z 1.85 (HKLM\...\CPUID CPU-Z_is1) (Version: 1.85 - CPUID, Inc.)
    Dashlane (HKU\S-1-5-21-507875857-259310543-1677438245-1001\...\Dashlane) (Version: 6.2007.0.32704 - Dashlane, Inc.)
    Discord (HKU\S-1-5-21-507875857-259310543-1677438245-1001\...\Discord) (Version: 0.0.305 - Discord Inc.)
    Elevated Installer (HKLM-x32\...\{1EF3F348-0065-4ED7-884F-BBB8B1FA8CA1}) (Version: 6.19.3.0 - Garmin Ltd or its subsidiaries) Hidden
    EZ Grabber (HKLM-x32\...\{8543A572-5993-4101-BACC-C83884E183A4}) (Version: 2.00.0000 - EZ Grabber)
    Garmin BaseCamp (HKLM-x32\...\{1ac25e24-a380-4f68-bb3c-f9b1d7cdb2df}) (Version: 4.7.0.0 - Garmin Ltd or its subsidiaries)
    Garmin BaseCamp (HKLM-x32\...\{3B93218E-3D19-4063-A578-2722B8C4E161}) (Version: 4.7.0.0 - Garmin Ltd or its subsidiaries) Hidden
    Garmin Express (HKLM-x32\...\{8526ab9f-b231-461d-964e-45bbed08f381}) (Version: 6.19.3.0 - Garmin Ltd or its subsidiaries)
    Garmin Express (HKLM-x32\...\{9939845A-42CA-41A1-9A7E-848C95F02FD5}) (Version: 6.19.3.0 - Garmin Ltd or its subsidiaries) Hidden
    Garmin Express (HKLM-x32\...\{9BE7B09F-C8D2-4B1E-B83E-7387FDDA8BCD}) (Version: 6.15.0.0 - Garmin Ltd or its subsidiaries) Hidden
    Garmin USB Drivers (HKLM-x32\...\{3D5D6CFC-3097-425A-8D8F-7EAF5D57641D}) (Version: 2.3.1.0 - Garmin Ltd or its subsidiaries)
    Google Chrome (HKLM-x32\...\Google Chrome) (Version: 79.0.3945.130 - Google LLC)
    Google Earth Pro (HKLM\...\{70A0F34E-564B-4F93-ADD6-3BAEC6E44075}) (Version: 7.3.2.5776 - Google)
    Google Update Helper (HKLM-x32\...\{60EC980A-BDA2-4CB6-A427-B07A5498B4CA}) (Version: 1.3.35.441 - Google LLC) Hidden
    Icon Shepherd (HKLM\...\Icon Shepherd_is1) (Version: 19.10.2 - WinAbility Software Corp.)
    ImgBurn (HKLM-x32\...\ImgBurn) (Version: 2.5.8.0 - LIGHTNING UK!)
    IObit Uninstaller 9 (HKLM-x32\...\IObitUninstall) (Version: 9.0.2.38 - IObit)
    IPVanish (HKLM\...\{6A8264C4-1B1D-4FD4-B2E8-57BC87C6F544}) (Version: 3.4.8.17 - Mudhook Marketing, Inc) Hidden
    IPVanish (HKLM-x32\...\{3f831db8-040c-4395-acc9-16a603ff4cb5}) (Version: 3.4.8.17 - Mudhook Marketing, Inc)
    iSkysoft Helper Compact 2.5.2 (HKLM-x32\...\{9BF12010-8799-41A5-A671-E9CFDE9E79F3}_is1) (Version: 2.5.2 - iSkysoft)
    iTunes (HKLM\...\{49F48AA2-DEA7-453A-8735-9C862E7C8467}) (Version: 12.10.4.2 - Apple Inc.)
    Kindle fire video converter version V0.9.3 (HKLM-x32\...\{7ADFAD84-67E8-49FC-A9E7-DBF1E2ECA8E7}_is1) (Version: V0.9.3 - Epubor Inc.)
    LAV Filters 0.70.2 (HKLM-x32\...\lavfilters_is1) (Version: 0.70.2 - Hendrik Leppkes)
    Malwarebytes version 4.0.4.49 (HKLM\...\{35065F43-4BB2-439A-BFF7-0F1014F2E0CD}_is1) (Version: 4.0.4.49 - Malwarebytes)
    Microsoft Access database engine 2010 (English) (HKLM-x32\...\{90140000-00D1-0409-0000-0000000FF1CE}) (Version: 14.0.4763.1000 - Microsoft Corporation)
    Microsoft Office XP Professional with FrontPage (HKLM-x32\...\{90280409-6000-11D3-8CFE-0050048383C9}) (Version: 10.0.2627.0 - Microsoft Corporation)
    Microsoft OneDrive (HKU\S-1-5-21-507875857-259310543-1677438245-1001\...\OneDriveSetup.exe) (Version: 19.232.1124.0005 - Microsoft Corporation)
    Microsoft Streets & Trips 2013 (HKLM-x32\...\{C82185E8-C27B-4EF4-2013-4444BC2C2B6D}) (Version: 19.0.18.1100 - Microsoft Corporation)
    Microsoft Visual C++ 2005 Redistributable (HKLM-x32\...\{710f4c1c-cc18-4c49-8cbf-51240c89a1a2}) (Version: 8.0.61001 - Microsoft Corporation)
    Microsoft Visual C++ 2005 Redistributable (x64) (HKLM\...\{ad8a2fa1-06e7-4b0d-927d-6e54b3d31028}) (Version: 8.0.61000 - Microsoft Corporation)
    Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.17 (HKLM\...\{8220EEFE-38CD-377E-8595-13398D740ACE}) (Version: 9.0.30729 - Microsoft Corporation)
    Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.6161 (HKLM\...\{5FCE6D76-F5DC-37AB-B2B8-22AB8CEDB1D4}) (Version: 9.0.30729.6161 - Microsoft Corporation)
    Microsoft Visual C++ 2008 Redistributable - x86 9.0.21022 (HKLM-x32\...\{FF66E9F6-83E7-3A3E-AF14-8DE9A809A6A4}) (Version: 9.0.21022 - Microsoft Corporation)
    Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17 (HKLM-x32\...\{9A25302D-30C0-39D9-BD6F-21E6EC160475}) (Version: 9.0.30729 - Microsoft Corporation)
    Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161 (HKLM-x32\...\{9BE518E6-ECC6-35A9-88E4-87755C07200F}) (Version: 9.0.30729.6161 - Microsoft Corporation)
    Microsoft Visual C++ 2010 x64 Redistributable - 10.0.40219 (HKLM\...\{1D8E6291-B0D5-35EC-8441-6616F567A0F7}) (Version: 10.0.40219 - Microsoft Corporation)
    Microsoft Visual C++ 2010 x86 Redistributable - 10.0.40219 (HKLM-x32\...\{F0C3E5D1-1ADE-321E-8167-68EF0DE699A5}) (Version: 10.0.40219 - Microsoft Corporation)
    Microsoft Visual C++ 2012 Redistributable (x64) - 11.0.61030 (HKLM-x32\...\{ca67548a-5ebe-413a-b50c-4b9ceb6d66c6}) (Version: 11.0.61030.0 - Microsoft Corporation)
    Microsoft Visual C++ 2012 Redistributable (x86) - 11.0.61030 (HKLM-x32\...\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}) (Version: 11.0.61030.0 - Microsoft Corporation)
    Microsoft Visual C++ 2013 Redistributable (x64) - 12.0.40660 (HKLM-x32\...\{ef6b00ec-13e1-4c25-9064-b2f383cb8412}) (Version: 12.0.40660.0 - Microsoft Corporation)
    Microsoft Visual C++ 2013 Redistributable (x86) - 12.0.40660 (HKLM-x32\...\{61087a79-ac85-455c-934d-1fa22cc64f36}) (Version: 12.0.40660.0 - Microsoft Corporation)
    Microsoft Visual C++ 2015-2019 Redistributable (x86) - 14.23.27820 (HKLM-x32\...\{45231ab4-69fd-486a-859d-7a59fcd11013}) (Version: 14.23.27820.0 - Microsoft Corporation)
    Microsoft Visual C++ 2017 Redistributable (x64) - 14.15.26706 (HKLM-x32\...\{95ac1cfa-f4fb-4d1b-8912-7f9d5fbb140d}) (Version: 14.15.26706.0 - Microsoft Corporation)
    Mozilla Firefox 73.0.1 (x64 en-US) (HKLM\...\Mozilla Firefox 73.0.1 (x64 en-US)) (Version: 73.0.1 - Mozilla)
    Mozilla Maintenance Service (HKLM\...\MozillaMaintenanceService) (Version: 64.0 - Mozilla)
    Nikon Message Center (HKLM-x32\...\{D2FCC1AE-6311-47C5-8130-C6C66D77DD71}) (Version: 0.92.000 - Nikon)
    Nikon Transfer (HKLM-x32\...\{E9757890-7EC5-46C8-99AB-B00F07B6525C}) (Version: 1.0.2 - Nikon)
    OpenOffice 4.1.6 (HKLM-x32\...\{16E4FF6B-31E8-4037-B627-D87CF872E32B}) (Version: 4.16.9790 - Apache Software Foundation)
    PaperScan 3 Free Edition (HKLM-x32\...\{50CDE104-8606-46F6-BCB9-6FAE9FDD8590}) (Version: 3.0.71 - ORPALIS)
    Passport Photo Studio 1.5.1 (HKLM-x32\...\{FBBB318F-3769-4B1C-B8B2-AF7ED4DA2272}_is1) (Version: - Grogware LLC)
    PeaZip 6.6.0 (HKLM-x32\...\{5A2BC38A-406C-4A5B-BF45-6991F9A05325}_is1) (Version: 6.6.0 - Giorgio Tani)
    Picasa 3 (HKLM-x32\...\Picasa 3) (Version: 3.9 - Google, Inc.)
    Picture Control Utility (HKLM-x32\...\{87441A59-5E64-4096-A170-14EFE67200C3}) (Version: 1.0.3 - Nikon)
    Pixillion Image Converter (HKLM-x32\...\Pixillion) (Version: 6.15 - NCH Software)
    PowerDirector (HKLM\...\{2599B6F1-92AC-472C-BE60-9F17565E4938}) (Version: 11.0 - CyberLink Corp.) Hidden
    Python 2.7.8 (64-bit) (HKLM\...\{61121B12-88BD-4261-A6EE-AB32610A56DE}) (Version: 2.7.8150 - Python Software Foundation)
    QuickTime (HKLM-x32\...\{0E64B098-8018-4256-BA23-C316A43AD9B0}) (Version: 7.72.80.56 - Apple Inc.)
    Smart Defrag 6 (HKLM-x32\...\Smart Defrag_is1) (Version: 6.3 - IObit)
    SmartSound Quicktracks 5 (HKLM-x32\...\{2F8BA3FD-1FA9-4279-B696-712ABB12F09F}) (Version: 5.1.8 - SmartSound Software Inc.) Hidden
    SmartSound Quicktracks 5 (HKLM-x32\...\InstallShield_{2F8BA3FD-1FA9-4279-B696-712ABB12F09F}) (Version: 5.1.8 - SmartSound Software Inc.)
    SMI USB Grabber (HKLM-x32\...\{B03B98E3-2795-48F6-BA33-793BBF5DF685}) (Version: 1.0.0.02 - Somagic Inc)
    System Mechanic (HKLM-x32\...\{95129D61-FF52-4FA8-A403-3E31FC5D9696}) (Version: 18.7.3.176 - iolo Technologies, LLC)
    TAP-Windows 9.21.2 (HKLM\...\TAP-Windows) (Version: 9.21.2 - )
    TeamViewer 13 (HKLM-x32\...\TeamViewer) (Version: 13.1.3629 - TeamViewer)
    Total Video Converter 3.71 100812 (HKLM-x32\...\Total Video Converter 3.71_is1) (Version: - EffectMatrix Inc.)
    Ulead VideoStudio SE DVD (HKLM-x32\...\{8F8D9297-FDD2-405A-97E7-E52C7B2F97B3}) (Version: 10.0 - Ulead Systems)
    UltraMon (HKLM\...\{2CB51501-DA86-4216-9C9B-2C52A64BA047}) (Version: 3.4.1 - Realtime Soft AG)
    Update for Windows 10 for x64-based Systems (KB4023057) (HKLM\...\{32DC821E-4A7D-4878-BEE8-337FA153D7F2}) (Version: 2.63.0.0 - Microsoft Corporation) Hidden
    Update for Windows 10 for x64-based Systems (KB4480730) (HKLM\...\{3BAE4496-6F6C-4330-A8AA-B93D3D346FA5}) (Version: 2.53.0.0 - Microsoft Corporation)
    USB2.0 Audio Capture (HKLM\...\VID_1F4D&PID_0102&MI_00) (Version: 1.0.0.0 - Conexant Systems)
    USB2.0 Video Capture (HKLM\...\VID_1F4D&PID_0102&MI_01) (Version: 1.0.0.0 - Conexant Systems)
    ViewNX (HKLM-x32\...\{F007CBCE-D714-4C0B-8CE9-9B0D78116468}) (Version: 1.0.3 - Nikon)
    VLC media player (HKLM-x32\...\VLC media player) (Version: 3.0.8 - VideoLAN)
    VSO ConvertXToDVD 7 (HKLM-x32\...\{A021D003-6933-4EA4-B582-F1D0C3E52409}_is1) (Version: 7.0.0.69 - VSO Software)
    Wallpaper Master (HKLM-x32\...\{D676B6BB-C30B-4EC5-B135-0E989DB76F2D}_is1) (Version: 2.0.5.6 - James Garton)
    Webshots Desktop (HKLM-x32\...\Webshots Desktop_is1) (Version: - AGCM)
    Webshots Toolbar (HKLM-x32\...\Webshots Toolbar) (Version: - )
    Windows Driver Package - Dynastream Innovations, Inc. ANT LibUSB Drivers (04/11/2012 1.2.40.201) (HKLM\...\F9D2A789F9CFF8CEC36B544F53877C80F1F73C46) (Version: 04/11/2012 1.2.40.201 - Dynastream Innovations, Inc.)
    Windows Driver Package - Garmin (grmnusb) GARMIN Devices (04/19/2012 2.3.1.0) (HKLM\...\98157A226B40B173301B0F53C8E98C47805D5152) (Version: 04/19/2012 2.3.1.0 - Garmin)
    Windows Driver Package - Silicon Labs Software (DSI_SiUSBXp_3_1) USB (02/06/2007 3.1) (HKLM\...\D1506E0025B5A3F9EB8270FE81C1EEDD9388B8A2) (Version: 02/06/2007 3.1 - Silicon Labs Software)
    WinZip 23.0 (HKLM\...\{CD95F661-A5C4-44F5-A6AA-ECDD91C2411F}) (Version: 23.0.13431 - Corel Corporation)
    Wondershare Helper Compact 2.5.3 (HKLM-x32\...\{5363CE84-5F09-48A1-8B6C-6BB590FFEDF2}_is1) (Version: 2.5.3 - Wondershare)

    Packages:
    =========
    Autodesk SketchBook -> C:\Program Files\WindowsApps\89006A2E.AutodeskSketchBook_5.1.0.0_x64__tf1gferkr813w [2019-11-05] (Autodesk Inc.)
    backiee - Wallpaper Studio 10 -> C:\Program Files\WindowsApps\35010GOOD2CREATE.LIVELOCKTHEMES_8.0.174.0_x64__cxjy25q2av1xg [2020-01-07] (Good2Create) [MS Ad]
    Bubble Witch 3 Saga -> C:\Program Files\WindowsApps\king.com.BubbleWitch3Saga_6.5.9.0_x86__kgqvnymyfvs32 [2020-02-20] (king.com)
    Candy Crush Soda Saga -> C:\Program Files\WindowsApps\king.com.CandyCrushSodaSaga_1.162.100.0_x86__kgqvnymyfvs32 [2020-02-20] (king.com)
    Canon Inkjet Print Utility -> C:\Program Files\WindowsApps\34791E63.CanonInkjetPrintUtility_2.8.0.1_neutral__6e5tt8cgb93ep [2019-05-23] (Canon Inc.)
    Disney Magic Kingdoms -> C:\Program Files\WindowsApps\A278AB0D.DisneyMagicKingdoms_4.8.1.3_x86__h6adky7gbf63m [2020-02-14] (Gameloft.)
    Dolby Access -> C:\Program Files\WindowsApps\DolbyLaboratories.DolbyAccess_2.4.2070.0_x64__rz1tebttyb220 [2019-09-11] (Dolby Laboratories)
    Microsoft Advertising SDK for XAML -> C:\Program Files\WindowsApps\Microsoft.Advertising.Xaml_10.1811.1.0_x64__8wekyb3d8bbwe [2019-01-13] (Microsoft Corporation) [MS Ad]
    Microsoft Advertising SDK for XAML -> C:\Program Files\WindowsApps\Microsoft.Advertising.Xaml_10.1811.1.0_x86__8wekyb3d8bbwe [2019-01-13] (Microsoft Corporation) [MS Ad]
    Microsoft News -> C:\Program Files\WindowsApps\Microsoft.BingNews_4.35.20273.0_x64__8wekyb3d8bbwe [2020-02-04] (Microsoft Corporation) [MS Ad]
    Microsoft Solitaire Collection -> C:\Program Files\WindowsApps\Microsoft.MicrosoftSolitaireCollection_4.5.12061.0_x64__8wekyb3d8bbwe [2019-12-10] (Microsoft Studios) [MS Ad]
    Mini Golf Club -> C:\Program Files\WindowsApps\2724ZOLTNGUBICS.MINIGOLFCLUB_3.15.0.0_x64__d5xggy273m32g [2020-02-20] (Zoltán Gubics) [MS Ad]
    Mini Golf Mundo Free -> C:\Program Files\WindowsApps\664D3057.MiniGolfMundoFree_1.1.1.0_x86__wwtpmf9bcrwqj [2019-01-13] (EnsenaSoft S.A. de C.V.) [MS Ad]
    MPEG-2 Video Extension -> C:\Program Files\WindowsApps\Microsoft.MPEG2VideoExtension_1.0.22661.0_x64__8wekyb3d8bbwe [2019-09-25] (Microsoft Corporation)
    MSN Weather -> C:\Program Files\WindowsApps\Microsoft.BingWeather_4.34.13393.0_x64__8wekyb3d8bbwe [2019-12-18] (Microsoft Corporation) [MS Ad]
    Photos Media Engine Add-on -> C:\Program Files\WindowsApps\Microsoft.Photos.MediaEngineDLC_1.0.0.0_x64__8wekyb3d8bbwe [2019-12-10] (Microsoft Corporation)
    Reader Notification Client -> C:\Program Files\WindowsApps\ReaderNotificationClient_1.0.4.0_x86__e1rzdqpraam7r [2019-12-19] (Adobe Systems Incorporated)
    Scatter HoldEm Poker -> C:\Program Files\WindowsApps\Fishsticksserviceslimited.ScatterHoldEmPoker_1.29.0.0_x64__bcx82fedc2d04 [2019-12-23] (Murka Games Limited)
    The Chess Lv.100 -> C:\Program Files\WindowsApps\6918E89D.TheChessLv.100_1.2.8.0_x64__66n08swfvvka0 [2018-05-14] (UNBALANCE corp.) [MS Ad]
    VLC -> C:\Program Files\WindowsApps\VideoLAN.VLC_3.2.1.0_x64__paz6r1rewnh0a [2019-06-05] (VideoLAN)

    ==================== Custom CLSID (Whitelisted): ==============

    (If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)

    ShellIconOverlayIdentifiers: [00asw] -> {472083B0-C522-11CF-8763-00608CC02F24} => -> No File
    ShellIconOverlayIdentifiers: [ShareOverlay] -> {594D4122-1F87-41E2-96C7-825FB4796516} => C:\Program Files\Classic Shell\ClassicExplorer64.dll [2017-08-13] (Ivaylo Beltchev -> IvoSoft) [File not signed]
    ShellIconOverlayIdentifiers-x32: [ShareOverlay] -> {594D4122-1F87-41E2-96C7-825FB4796516} => C:\Program Files\Classic Shell\ClassicExplorer64.dll [2017-08-13] (Ivaylo Beltchev -> IvoSoft) [File not signed]
    ContextMenuHandlers1: [Incinerator] -> [CC]{E8215BEA-3290-4C73-964B-75502B9B41B2} => -> No File
    ContextMenuHandlers1: [IObitUnstaler] -> [CC]{836AB26C-2DE4-41D3-AC24-4C6C2699B960} => -> No File
    ContextMenuHandlers1: [IOTransferMenu] -> {96C86AD1-055D-457D-9C00-0D4A91ECF1B5} => C:\Program Files (x86)\IOTransfer\IOT\StartMenuExtension_64.dll [2019-08-30] (Chengdu Zhagu Technology Co., Ltd. -> )
    ContextMenuHandlers1: [iSkysoftVideoConverterFileOpreation] -> [CC]{BB35DE05-89D6-4D8F-95DE-A27DF8156D91} => -> No File
    ContextMenuHandlers1: [ShellConverter] -> [CC]{30A4E07E-068A-4d91-8F05-691283A1336B} => -> No File
    ContextMenuHandlers1: [SmartDefragExtension] -> {189F1E63-33A7-404B-B2F6-8C76A452CC54} => C:\Windows\System32\IObitSmartDefragExtension.dll [2016-03-25] (IObit Information Technology -> IObit)
    ContextMenuHandlers2: [IOTransferMenu] -> {96C86AD1-055D-457D-9C00-0D4A91ECF1B5} => C:\Program Files (x86)\IOTransfer\IOT\StartMenuExtension_64.dll [2019-08-30] (Chengdu Zhagu Technology Co., Ltd. -> )
    ContextMenuHandlers2: [Ulead UDF Driver] -> [CC]{DBD8E168-244D-448C-9922-25508950D1DC} => -> No File
    ContextMenuHandlers3: [IOTransferMenu] -> {96C86AD1-055D-457D-9C00-0D4A91ECF1B5} => C:\Program Files (x86)\IOTransfer\IOT\StartMenuExtension_64.dll [2019-08-30] (Chengdu Zhagu Technology Co., Ltd. -> )
    ContextMenuHandlers4: [Incinerator] -> [CC]{E8215BEA-3290-4C73-964B-75502B9B41B2} => -> No File
    ContextMenuHandlers4: [IObitUnstaler] -> [CC]{836AB26C-2DE4-41D3-AC24-4C6C2699B960} => -> No File
    ContextMenuHandlers4: [IOTransferMenu] -> {96C86AD1-055D-457D-9C00-0D4A91ECF1B5} => C:\Program Files (x86)\IOTransfer\IOT\StartMenuExtension_64.dll [2019-08-30] (Chengdu Zhagu Technology Co., Ltd. -> )
    ContextMenuHandlers5: [ACE] -> {5E2121EE-0300-11D4-8D3B-444553540000} => C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\atiacm64.dll [2015-08-21] (Advanced Micro Devices, Inc. -> Advanced Micro Devices, Inc.)
    ContextMenuHandlers6: [IObitUnstaler] -> [CC]{836AB26C-2DE4-41D3-AC24-4C6C2699B960} => -> No File
    ContextMenuHandlers6: [IOTransferMenu] -> {96C86AD1-055D-457D-9C00-0D4A91ECF1B5} => C:\Program Files (x86)\IOTransfer\IOT\StartMenuExtension_64.dll [2019-08-30] (Chengdu Zhagu Technology Co., Ltd. -> )
    ContextMenuHandlers6: [SmartDefragExtension] -> {189F1E63-33A7-404B-B2F6-8C76A452CC54} => C:\Windows\System32\IObitSmartDefragExtension.dll [2016-03-25] (IObit Information Technology -> IObit)
    ContextMenuHandlers6: [StartMenuExt] -> [CC]{E595F05F-903F-4318-8B0A-7F633B520D2B} => -> No File

    ==================== Codecs (Whitelisted) ====================

    (If an entry is included in the fixlist, the registry item will be restored to default or removed. The file will not be moved.)

    HKLM\...\Drivers32: [vidc.MPG4] => C:\Windows\SysWOW64\MPG4c32.dll [413760 2001-09-20] (Microsoft Corporation) [File not signed]
    HKLM\...\Drivers32: [vidc.MP42] => C:\Windows\SysWOW64\MPG4c32.dll [413760 2001-09-20] (Microsoft Corporation) [File not signed]
    HKLM\...\Drivers32: [vidc.MP43] => C:\Windows\SysWOW64\MPG4c32.dll [413760 2001-09-20] (Microsoft Corporation) [File not signed]
    HKLM\...\Drivers32: [msacm.dvacm] => C:\Program Files (x86)\Common Files\Ulead Systems\VIO\DVACM.acm [32768 2006-03-06] (Ulead Systems, Inc.) [File not signed]
    HKLM\...\Drivers32: [msacm.MPEGacm] => C:\Program Files (x86)\Common Files\Ulead Systems\MPEG\MPEGACM.acm [69632 2004-07-23] (Ulead Systems, Inc.) [File not signed]
    HKLM\...\Drivers32: [msacm.ulmp3acm] => C:\Program Files (x86)\Common Files\Ulead Systems\MPEG\ulmp3acm.acm [319488 2006-01-23] (Ulead systems) [File not signed]

    ==================== Shortcuts & WMI ========================

    (The entries could be listed to be restored or removed.)

    ShortcutWithArgument: C:\Users\User\Desktop\AudioVideo\Google Chrome.lnk -> C:\Program Files (x86)\Google\Chrome\Application\chrome.exe (Google LLC) -> --disable-quic
    ShortcutWithArgument: C:\Users\User\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\User Pinned\ImplicitAppShortcuts\d249d9ddd424b688\Google Chrome.lnk -> C:\Program Files (x86)\Google\Chrome\Application\chrome.exe (Google LLC) -> --profile-directory=Default

    ==================== Loaded Modules (Whitelisted) =============

    2014-02-11 07:08 - 2014-02-11 07:08 - 000817152 _____ () [File not signed] C:\Program Files\ATI Technologies\ATI.ACE\Fuel\Device.dll
    2015-08-21 22:09 - 2015-08-21 22:09 - 000214528 _____ () [File not signed] C:\Program Files\ATI Technologies\ATI.ACE\Fuel\Fuel.Container.PerformanceTuning.dll
    2014-02-11 07:08 - 2014-02-11 07:08 - 003650560 _____ () [File not signed] C:\Program Files\ATI Technologies\ATI.ACE\Fuel\Platform.dll
    2019-09-11 17:07 - 2019-09-11 17:07 - 001131008 _____ () [File not signed] C:\Windows\assembly\NativeImages_v2.0.50727_32\FreeImageNET\81fdf85b604f68df182ff3a7bc76746a\FreeImageNET.ni.dll
    2020-01-15 18:48 - 2020-01-15 18:48 - 000910848 _____ () [File not signed] C:\Windows\assembly\NativeImages_v2.0.50727_32\ImageListView\ec7b7e6a1a8dcef06636ebc8c2c92a46\ImageListView.ni.dll
    2019-09-11 18:33 - 2019-09-11 18:33 - 000071680 _____ () [File not signed] C:\Windows\assembly\NativeImages_v2.0.50727_32\Owf.Controls.Office#\f3dd3cfd7c9e89d816bac9fac91d952e\Owf.Controls.Office2007ColorPicker.ni.dll
    2020-01-15 18:48 - 2020-01-15 18:48 - 000341504 _____ () [File not signed] C:\Windows\assembly\NativeImages_v2.0.50727_32\Transitionals\9f59455765a6a93d1aa2ba9ef7a05d8e\Transitionals.ni.dll
    2019-09-11 18:33 - 2019-09-11 18:33 - 000076288 _____ () [File not signed] C:\Windows\assembly\NativeImages_v2.0.50727_32\WPMVBClasses\a9519656043166b6193ed3479ad8644e\WPMVBClasses.ni.dll
    2020-01-15 18:48 - 2020-01-15 18:48 - 000039424 _____ () [File not signed] C:\Windows\assembly\NativeImages_v2.0.50727_32\WPMWPFControls\919d8aaf2eacda25419b16f29c5a4308\WPMWPFControls.ni.dll
    2018-06-08 12:01 - 2015-03-15 14:48 - 005647872 _____ (FreeImage) [File not signed] C:\Program Files (x86)\Wallpaper Master\FreeImage.DLL
    2019-09-11 17:07 - 2019-09-11 17:07 - 001090560 _____ (hxxps://system.data.sqlite.org/) [File not signed] C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Data.SQLite\4ab9454923aed93d416a6e4f27bfbba7\System.Data.SQLite.ni.dll
    2019-09-11 18:33 - 2019-09-11 18:33 - 000123392 _____ (IT) [File not signed] C:\Windows\assembly\NativeImages_v2.0.50727_32\CheckBoxComboBox\9d405a6dd67346bc0b05a46a2b294d62\CheckBoxComboBox.ni.dll
    2017-08-13 07:49 - 2017-08-13 07:49 - 000885560 _____ (Ivaylo Beltchev -> IvoSoft) [File not signed] C:\Program Files\Classic Shell\ClassicExplorer64.dll
    2017-08-13 07:49 - 2017-08-13 07:49 - 003664184 _____ (Ivaylo Beltchev -> IvoSoft) [File not signed] C:\Program Files\Classic Shell\ClassicStartMenuDLL.dll
    2019-09-11 17:07 - 2019-09-11 17:07 - 000117760 _____ (Microsoft) [File not signed] C:\Windows\assembly\NativeImages_v2.0.50727_32\WPMControls\b0be4fbee48302c415a189ce3b1f66f2\WPMControls.ni.dll
    2018-05-27 19:05 - 2015-02-27 09:35 - 000489984 _____ (Newtonsoft) [File not signed] C:\Program Files (x86)\Wondershare\WAF\2.2.0.5\Newtonsoft.Json.dll
    2019-09-11 15:46 - 2019-09-11 15:46 - 001247232 _____ (NLog) [File not signed] C:\Windows\assembly\NativeImages_v2.0.50727_32\NLog\7b1449cf1d5063d92cd5d939e7e98e63\NLog.ni.dll
    2019-09-11 18:33 - 2019-09-11 18:33 - 000181760 _____ (RBSoft) [File not signed] C:\Windows\assembly\NativeImages_v2.0.50727_32\AutoUpdater.NET\a8b4f605b9143a054ca30d9135fe5b02\AutoUpdater.NET.ni.dll
    2018-06-08 12:01 - 2016-06-22 18:44 - 000870400 _____ (Robert Simpson, et al.) [File not signed] C:\Program Files (x86)\Wallpaper Master\SQLite.Interop.dll
    2018-08-22 19:12 - 2020-02-11 06:24 - 001240064 _____ (The OpenSSL Project, hxxp://www.openssl.org/) [File not signed] C:\Users\User\AppData\Roaming\Dashlane\libeay32.dll
    2018-08-22 19:12 - 2020-02-11 06:24 - 000281600 _____ (The OpenSSL Project, hxxp://www.openssl.org/) [File not signed] C:\Users\User\AppData\Roaming\Dashlane\ssleay32.dll
    2020-02-18 11:24 - 2020-02-11 06:24 - 000026112 _____ (The Qt Company Ltd.) [File not signed] C:\Users\User\AppData\Roaming\Dashlane\6.2007.0.32704\bin\Qt\imageformats\qgif.dll
    2020-02-18 11:24 - 2020-02-11 06:24 - 000034816 _____ (The Qt Company Ltd.) [File not signed] C:\Users\User\AppData\Roaming\Dashlane\6.2007.0.32704\bin\Qt\imageformats\qicns.dll
    2020-02-18 11:24 - 2020-02-11 06:24 - 000025600 _____ (The Qt Company Ltd.) [File not signed] C:\Users\User\AppData\Roaming\Dashlane\6.2007.0.32704\bin\Qt\imageformats\qico.dll
    2020-02-18 11:24 - 2020-02-11 06:24 - 000298496 _____ (The Qt Company Ltd.) [File not signed] C:\Users\User\AppData\Roaming\Dashlane\6.2007.0.32704\bin\Qt\imageformats\qjpeg.dll
    2020-02-18 11:24 - 2020-02-11 06:24 - 000020992 _____ (The Qt Company Ltd.) [File not signed] C:\Users\User\AppData\Roaming\Dashlane\6.2007.0.32704\bin\Qt\imageformats\qsvg.dll
    2020-02-18 11:24 - 2020-02-11 06:24 - 000019968 _____ (The Qt Company Ltd.) [File not signed] C:\Users\User\AppData\Roaming\Dashlane\6.2007.0.32704\bin\Qt\imageformats\qtga.dll
    2020-02-18 11:24 - 2020-02-11 06:24 - 000332288 _____ (The Qt Company Ltd.) [File not signed] C:\Users\User\AppData\Roaming\Dashlane\6.2007.0.32704\bin\Qt\imageformats\qtiff.dll
    2020-02-18 11:24 - 2020-02-11 06:24 - 000019456 _____ (The Qt Company Ltd.) [File not signed] C:\Users\User\AppData\Roaming\Dashlane\6.2007.0.32704\bin\Qt\imageformats\qwbmp.dll
    2020-02-18 11:24 - 2020-02-11 06:24 - 000414720 _____ (The Qt Company Ltd.) [File not signed] C:\Users\User\AppData\Roaming\Dashlane\6.2007.0.32704\bin\Qt\imageformats\qwebp.dll
    2020-02-18 11:24 - 2020-02-11 06:24 - 001126400 _____ (The Qt Company Ltd.) [File not signed] C:\Users\User\AppData\Roaming\Dashlane\6.2007.0.32704\bin\Qt\platforms\qwindows.dll
    2020-02-18 11:24 - 2020-02-11 06:24 - 004994048 _____ (The Qt Company Ltd.) [File not signed] C:\Users\User\AppData\Roaming\Dashlane\6.2007.0.32704\bin\Qt\Qt5Core.dll
    2020-02-18 11:24 - 2020-02-11 06:24 - 003637248 _____ (The Qt Company Ltd.) [File not signed] C:\Users\User\AppData\Roaming\Dashlane\6.2007.0.32704\bin\Qt\Qt5Gui.dll
    2020-02-18 11:24 - 2020-02-11 06:24 - 001088512 _____ (The Qt Company Ltd.) [File not signed] C:\Users\User\AppData\Roaming\Dashlane\6.2007.0.32704\bin\Qt\Qt5Network.dll
    2020-02-18 11:24 - 2020-02-11 06:24 - 000280576 _____ (The Qt Company Ltd.) [File not signed] C:\Users\User\AppData\Roaming\Dashlane\6.2007.0.32704\bin\Qt\Qt5Positioning.dll
    2020-02-18 11:24 - 2020-02-11 06:24 - 000278016 _____ (The Qt Company Ltd.) [File not signed] C:\Users\User\AppData\Roaming\Dashlane\6.2007.0.32704\bin\Qt\Qt5PrintSupport.dll
    2020-02-18 11:24 - 2020-02-11 06:24 - 002966016 _____ (The Qt Company Ltd.) [File not signed] C:\Users\User\AppData\Roaming\Dashlane\6.2007.0.32704\bin\Qt\Qt5Qml.dll
    2020-02-18 11:24 - 2020-02-11 06:24 - 002796032 _____ (The Qt Company Ltd.) [File not signed] C:\Users\User\AppData\Roaming\Dashlane\6.2007.0.32704\bin\Qt\Qt5Quick.dll
    2020-02-18 11:24 - 2020-02-11 06:24 - 000048640 _____ (The Qt Company Ltd.) [File not signed] C:\Users\User\AppData\Roaming\Dashlane\6.2007.0.32704\bin\Qt\Qt5QuickWidgets.dll
    2020-02-18 11:24 - 2020-02-11 06:24 - 000163840 _____ (The Qt Company Ltd.) [File not signed] C:\Users\User\AppData\Roaming\Dashlane\6.2007.0.32704\bin\Qt\Qt5Sql.dll
    2020-02-18 11:24 - 2020-02-11 06:24 - 000268288 _____ (The Qt Company Ltd.) [File not signed] C:\Users\User\AppData\Roaming\Dashlane\6.2007.0.32704\bin\Qt\Qt5Svg.dll
    2020-02-18 11:24 - 2020-02-11 06:24 - 000092160 _____ (The Qt Company Ltd.) [File not signed] C:\Users\User\AppData\Roaming\Dashlane\6.2007.0.32704\bin\Qt\Qt5WebChannel.dll
    2020-02-18 11:24 - 2020-02-11 06:24 - 055062528 _____ (The Qt Company Ltd.) [File not signed] C:\Users\User\AppData\Roaming\Dashlane\6.2007.0.32704\bin\Qt\Qt5WebEngineCore.dll
    2020-02-18 11:24 - 2020-02-11 06:24 - 000190976 _____ (The Qt Company Ltd.) [File not signed] C:\Users\User\AppData\Roaming\Dashlane\6.2007.0.32704\bin\Qt\Qt5WebEngineWidgets.dll
    2020-02-18 11:24 - 2020-02-11 06:24 - 004590592 _____ (The Qt Company Ltd.) [File not signed] C:\Users\User\AppData\Roaming\Dashlane\6.2007.0.32704\bin\Qt\Qt5Widgets.dll
    2020-02-18 11:24 - 2020-02-11 06:24 - 000122368 _____ (The Qt Company Ltd.) [File not signed] C:\Users\User\AppData\Roaming\Dashlane\6.2007.0.32704\bin\Qt\styles\qwindowsvistastyle.dll
    2018-05-27 19:05 - 2016-03-31 15:39 - 000072704 _____ (Wondershare) [File not signed] C:\Program Files (x86)\Wondershare\WAF\2.2.0.5\WsAppCollect.dll
    2018-05-27 19:05 - 2016-03-31 15:39 - 000321024 _____ (Wondershare) [File not signed] C:\Program Files (x86)\Wondershare\WAF\2.2.0.5\WsAppCommon.dll

    ==================== Alternate Data Streams (Whitelisted) ========

    (If an entry is included in the fixlist, only the ADS will be removed.)

    AlternateDataStreams: C:\Users\User\FreeHideIP-4.1.5.6.Setup.exe:BDU [0]
    AlternateDataStreams: C:\Users\User\OneDrive:${3D0CE612-FDEE-43f7-8ACA-957BEC0CCBA0}.SyncRootIdentity [130]

    ==================== Safe Mode (Whitelisted) ==================

    (If an entry is included in the fixlist, it will be removed from the registry. The "AlternateShell" will be restored.)

    HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\MBAMService => ""="Service"
    HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\MBAMService => ""="Service"

    ==================== Association (Whitelisted) =================

    ==================== Internet Explorer trusted/restricted ==========

    (If an entry is included in the fixlist, it will be removed from the registry.)

    IE trusted site: HKU\.DEFAULT\...\localhost -> localhost
    IE trusted site: HKU\S-1-5-21-507875857-259310543-1677438245-1001\...\localhost -> localhost

    ==================== Hosts content: =========================

    (If needed Hosts: directive could be included in the fixlist to reset Hosts.)

    2018-04-11 15:38 - 2020-02-24 15:23 - 000000000 _____ C:\Windows\system32\drivers\etc\hosts

    ==================== Other Areas ===========================

    (Currently there is no automatic fix for this section.)

    HKU\S-1-5-21-507875857-259310543-1677438245-1001\Control Panel\Desktop\\Wallpaper -> C:\Users\User\AppData\Local\WallpaperMasterPro\WallImage.jpg
    DNS Servers: 192.168.1.1
    HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System => (ConsentPromptBehaviorAdmin: 5) (ConsentPromptBehaviorUser: 3) (EnableLUA: 1)
    HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer => (SmartScreenEnabled: )
    Windows Firewall is enabled.

    ==================== MSCONFIG/TASK MANAGER disabled items ==

    (If an entry is included in the fixlist, it will be removed.)

    HKLM\...\StartupApproved\StartupFolder: => "Adobe Gamma Loader.lnk"
    HKLM\...\StartupApproved\StartupFolder: => "UltraMon.lnk"
    HKLM\...\StartupApproved\Run: => "RTHDVCPL"
    HKLM\...\StartupApproved\Run: => "WinZip UN"
    HKLM\...\StartupApproved\Run: => "BdVpnApp"
    HKLM\...\StartupApproved\Run: => "iTunesHelper"
    HKLM\...\StartupApproved\Run: => "StartCCC"
    HKLM\...\StartupApproved\Run32: => "CanonQuickMenu"
    HKLM\...\StartupApproved\Run32: => "WinZip PreLoader"
    HKLM\...\StartupApproved\Run32: => "DelaypluginInstall"
    HKLM\...\StartupApproved\Run32: => "iSkysoft Helper Compact.exe"
    HKLM\...\StartupApproved\Run32: => "Aimersoft Helper Compact.exe"
    HKLM\...\StartupApproved\Run32: => "APSDaemon"
    HKLM\...\StartupApproved\Run32: => "ArcSoft Connection Service"
    HKLM\...\StartupApproved\Run32: => "QuickTime Task"
    HKLM\...\StartupApproved\Run32: => "UVS10 Preload"
    HKLM\...\StartupApproved\Run32: => "IObit Malware Fighter"
    HKLM\...\StartupApproved\Run32: => "Wondershare Helper Compact.exe"
    HKLM\...\StartupApproved\Run32: => "SecurityHealth"
    HKLM\...\StartupApproved\Run32: => "Family Tree Builder Update"
    HKU\S-1-5-21-507875857-259310543-1677438245-1001\...\StartupApproved\StartupFolder: => "Webshots.lnk"
    HKU\S-1-5-21-507875857-259310543-1677438245-1001\...\StartupApproved\StartupFolder: => "Nikon Monitor.lnk"
    HKU\S-1-5-21-507875857-259310543-1677438245-1001\...\StartupApproved\Run: => "uTorrent"
    HKU\S-1-5-21-507875857-259310543-1677438245-1001\...\StartupApproved\Run: => "GarminExpress"
    HKU\S-1-5-21-507875857-259310543-1677438245-1001\...\StartupApproved\Run: => "Discord"
    HKU\S-1-5-21-507875857-259310543-1677438245-1001\...\StartupApproved\Run: => "CCleaner Smart Cleaning"

    ==================== FirewallRules (Whitelisted) ================

    (If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)

    FirewallRules: [TCP Query User{7062EC17-586F-4DA8-9B2B-4782C09236D5}M:\snappy driver jan 2018\sdi_x64_r1803.exe] => (Allow) M:\snappy driver jan 2018\sdi_x64_r1803.exe No File
    FirewallRules: [UDP Query User{534774C8-733A-4BCE-B3D8-CF172C4A35AE}M:\snappy driver jan 2018\sdi_x64_r1803.exe] => (Allow) M:\snappy driver jan 2018\sdi_x64_r1803.exe No File
    FirewallRules: [{C13A9EF6-24BB-4EAA-877F-5D3E3AA43DBD}] => (Allow) C:\Program Files\Mozilla Firefox\firefox.exe (Mozilla Corporation -> Mozilla Corporation)
    FirewallRules: [{FB8DF9CF-A8A7-41AF-914F-4D3F8CE5D8E5}] => (Allow) C:\Program Files\Mozilla Firefox\firefox.exe (Mozilla Corporation -> Mozilla Corporation)
    FirewallRules: [{276F183A-EBC9-402C-B810-D185A2AE2309}] => (Allow) C:\Program Files (x86)\TeamViewer\TeamViewer.exe (TeamViewer GmbH -> TeamViewer GmbH)
    FirewallRules: [{1B150EFC-3D42-4EB5-8DA8-A5E42CDB8348}] => (Allow) C:\Program Files (x86)\TeamViewer\TeamViewer.exe (TeamViewer GmbH -> TeamViewer GmbH)
    FirewallRules: [{8DE1606D-66FA-47E3-B1E3-10F4D32B7206}] => (Allow) C:\Program Files (x86)\TeamViewer\TeamViewer_Service.exe (TeamViewer GmbH -> TeamViewer GmbH)
    FirewallRules: [{DE7BBBD4-65C3-41BB-8C68-F05CA4B4ED47}] => (Allow) C:\Program Files (x86)\TeamViewer\TeamViewer_Service.exe (TeamViewer GmbH -> TeamViewer GmbH)
    FirewallRules: [{6A0AE86C-F488-4FC7-8234-913EEBB65121}] => (Allow) C:\Users\User\AppData\Roaming\uTorrent\uTorrent.exe (BitTorrent Inc -> BitTorrent Inc.)
    FirewallRules: [{57DA329B-5EE0-4EB4-9FD4-1D25A3C6376B}] => (Allow) C:\Users\User\AppData\Roaming\uTorrent\uTorrent.exe (BitTorrent Inc -> BitTorrent Inc.)
    FirewallRules: [{A911632D-8C86-4D57-A568-80DCCD3F83A9}] => (Allow) C:\Program Files\Bonjour\mDNSResponder.exe (Apple Inc. -> Apple Inc.)
    FirewallRules: [{390635CA-20CE-4FE2-93CC-FCFB2E488062}] => (Allow) C:\Program Files\Bonjour\mDNSResponder.exe (Apple Inc. -> Apple Inc.)
    FirewallRules: [{05A02561-91C2-4EA2-83CF-35E26ED1D821}] => (Allow) C:\Program Files (x86)\Bonjour\mDNSResponder.exe (Apple Inc. -> Apple Inc.)
    FirewallRules: [{9CCA496D-727D-4F51-BE19-78AB54F450D7}] => (Allow) C:\Program Files (x86)\Bonjour\mDNSResponder.exe (Apple Inc. -> Apple Inc.)
    FirewallRules: [{3588F379-06EF-4A31-903D-19203FF45580}] => (Allow) C:\Program Files (x86)\Common Files\Apple\Apple Application Support\APSDaemon.exe (Apple Inc. -> Apple Inc.)
    FirewallRules: [{9EF01002-A5AF-4CEB-9B54-360EB975BB97}] => (Allow) C:\Program Files\CCleaner\CCUpdate.exe (Piriform Software Ltd -> Piriform Software Ltd)
    FirewallRules: [{3A24FC38-14EC-4FE3-86F7-E043D5819367}] => (Allow) C:\Program Files\CCleaner\CCUpdate.exe (Piriform Software Ltd -> Piriform Software Ltd)
    FirewallRules: [{C948DDAA-44B5-4C8B-8920-C527894C040E}] => (Allow) C:\Program Files (x86)\Apowersoft\Video Converter Studio\Video Converter Studio.exe (Apowersoft Ltd -> Apowersoft)
    FirewallRules: [{CA3EF1FA-220B-49A9-859B-8B5FCA9EB5B9}] => (Allow) C:\Program Files (x86)\Apowersoft\Video Converter Studio\Video Converter Studio.exe (Apowersoft Ltd -> Apowersoft)
    FirewallRules: [{67A67B26-2BC7-41A4-BCDE-1537F5D88847}] => (Allow) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe (Google LLC -> Google LLC)
    FirewallRules: [{363EF132-9FF9-4FCA-BF52-6EF5FD0F4A55}] => (Allow) C:\Program Files\iTunes\iTunes.exe (Apple Inc. -> Apple Inc.)

    ==================== Restore Points =========================

    23-02-2020 19:01:02 Windows Backup

    ==================== Faulty Device Manager Devices ============


    ==================== Event log errors: ========================

    Application errors:
    ==================
    Error: (02/24/2020 10:32:16 AM) (Source: Application Error) (EventID: 1000) (User: )
    Description: Faulting application name: esu.exe, version: 1.0.0.0, time stamp: 0x5d093b02
    Faulting module name: KERNELBASE.dll, version: 10.0.17134.1184, time stamp: 0xda43ec6b
    Exception code: 0xe0434352
    Fault offset: 0x00114622
    Faulting process id: 0x2228
    Faulting application start time: 0x01d5eb40814d9dd8
    Faulting application path: C:\Program Files (x86)\Garmin\Express SelfUpdater\esu.exe
    Faulting module path: C:\Windows\System32\KERNELBASE.dll
    Report Id: 4115cdd2-ff01-4870-978f-db52e186e8c2
    Faulting package full name:
    Faulting package-relative application ID:

    Error: (02/24/2020 10:32:15 AM) (Source: .NET Runtime) (EventID: 1026) (User: )
    Description: Application: esu.exe
    Framework Version: v4.0.30319
    Description: The process was terminated due to an unhandled exception.
    Exception Info: System.IO.FileLoadException
    at Garmin.Omt.Service.Shared.Overrides+<UpdateDatacenterOverridesAsync>d__69.MoveNext()
    at System.Runtime.CompilerServices.AsyncTaskMethodBuilder.Start[[Garmin.Omt.Service.Shared.Overrides+<UpdateDatacenterOverridesAsync>d__69, ExpressSelfUpdater, Version=1.0.0.0, Culture=neutral, PublicKeyToken=null]](<UpdateDatacenterOverridesAsync>d__69 ByRef)
    at Garmin.Omt.Service.Shared.Overrides.UpdateDatacenterOverridesAsync(Boolean)
    at Garmin.Omt.Service.Shared.Overrides..cctor()

    Exception Info: System.TypeInitializationException
    at Garmin.Omt.Service.Shared.Overrides.get_OmtBaseUrl()
    at Garmin.Omt.Express.SelfUpdater.Program.RealMain()
    at Garmin.Omt.Express.SelfUpdater.Program.Main(System.String[])

    Error: (02/24/2020 10:23:33 AM) (Source: COM) (EventID: 10031) (User: )
    Description: An unmarshaling policy check was performed when unmarshaling a custom marshaled object and the class {41FD88F7-F295-4D39-91AC-A85F3149A05B} was rejected

    Error: (02/24/2020 10:23:33 AM) (Source: COM) (EventID: 10031) (User: )
    Description: An unmarshaling policy check was performed when unmarshaling a custom marshaled object and the class {95CABCC9-BC57-4C12-B8DF-BA193232AA01} was rejected

    Error: (02/24/2020 10:17:42 AM) (Source: Application Error) (EventID: 1000) (User: )
    Description: Faulting application name: svchost.exe_MapsBroker, version: 10.0.17134.1276, time stamp: 0xf598dc78
    Faulting module name: unknown, version: 0.0.0.0, time stamp: 0x00000000
    Exception code: 0x8400000e
    Fault offset: 0x0000000000000000
    Faulting process id: 0x18a4
    Faulting application start time: 0x01d5eb3ea0157371
    Faulting application path: C:\Windows\System32\svchost.exe
    Faulting module path: unknown
    Report Id: 89735cec-823f-46d0-bb31-e71c779959cc
    Faulting package full name:
    Faulting package-relative application ID:

    Error: (02/23/2020 10:59:23 AM) (Source: Application Error) (EventID: 1000) (User: )
    Description: Faulting application name: esu.exe, version: 1.0.0.0, time stamp: 0x5d093b02
    Faulting module name: KERNELBASE.dll, version: 10.0.17134.1184, time stamp: 0xda43ec6b
    Exception code: 0xe0434352
    Fault offset: 0x00114622
    Faulting process id: 0x21c4
    Faulting application start time: 0x01d5ea7b31029b7b
    Faulting application path: C:\Program Files (x86)\Garmin\Express SelfUpdater\esu.exe
    Faulting module path: C:\Windows\System32\KERNELBASE.dll
    Report Id: e0d133dc-00f0-4915-a401-f5e543330b59
    Faulting package full name:
    Faulting package-relative application ID:

    Error: (02/23/2020 10:59:21 AM) (Source: .NET Runtime) (EventID: 1026) (User: )
    Description: Application: esu.exe
    Framework Version: v4.0.30319
    Description: The process was terminated due to an unhandled exception.
    Exception Info: System.IO.FileLoadException
    at Garmin.Omt.Service.Shared.Overrides+<UpdateDatacenterOverridesAsync>d__69.MoveNext()
    at System.Runtime.CompilerServices.AsyncTaskMethodBuilder.Start[[Garmin.Omt.Service.Shared.Overrides+<UpdateDatacenterOverridesAsync>d__69, ExpressSelfUpdater, Version=1.0.0.0, Culture=neutral, PublicKeyToken=null]](<UpdateDatacenterOverridesAsync>d__69 ByRef)
    at Garmin.Omt.Service.Shared.Overrides.UpdateDatacenterOverridesAsync(Boolean)
    at Garmin.Omt.Service.Shared.Overrides..cctor()

    Exception Info: System.TypeInitializationException
    at Garmin.Omt.Service.Shared.Overrides.get_OmtBaseUrl()
    at Garmin.Omt.Express.SelfUpdater.Program.RealMain()
    at Garmin.Omt.Express.SelfUpdater.Program.Main(System.String[])

    Error: (02/22/2020 12:45:25 PM) (Source: Application Error) (EventID: 1000) (User: )
    Description: Faulting application name: LockApp.exe, version: 10.0.17134.1, time stamp: 0x5acd88b2
    Faulting module name: msvcrt.dll, version: 7.0.17134.1, time stamp: 0x5cbba6fd
    Exception code: 0x40000015
    Fault offset: 0x000000000000add2
    Faulting process id: 0x1e70
    Faulting application start time: 0x01d5e9c020b3c925
    Faulting application path: C:\Windows\SystemApps\Microsoft.LockApp_cw5n1h2txyewy\LockApp.exe
    Faulting module path: C:\Windows\System32\msvcrt.dll
    Report Id: a827dfb5-d46a-4982-9fd3-b1101915c4c6
    Faulting package full name: Microsoft.LockApp_10.0.17134.1_neutral__cw5n1h2txyewy
    Faulting package-relative application ID: WindowsDefaultLockScreen


    System errors:
    =============
    Error: (02/24/2020 03:28:05 PM) (Source: Server) (EventID: 2505) (User: )
    Description: The server could not bind to the transport \Device\NetBT_Tcpip_{1B16637A-A5E3-4F5D-948A-E7F44B6EE4D1} because another computer on the network has the same name. The server could not start.

    Error: (02/24/2020 10:57:56 AM) (Source: DCOM) (EventID: 10016) (User: DESKTOP-LTP8JAE)
    Description: The application-specific permission settings do not grant Local Activation permission for the COM Server application with CLSID
    {8BC3F05E-D86B-11D0-A075-00C04FB68820}
    and APPID
    {8BC3F05E-D86B-11D0-A075-00C04FB68820}
    to the user DESKTOP-LTP8JAE\User SID (S-1-5-21-507875857-259310543-1677438245-1001) from address LocalHost (Using LRPC) running in the application container Microsoft.Windows.ContentDeliveryManager_10.0.17134.1_neutral_neutral_cw5n1h2txyewy SID (S-1-15-2-350187224-1905355452-1037786396-3028148496-2624191407-3283318427-1255436723). This security permission can be modified using the Component Services administrative tool.

    Error: (02/24/2020 10:23:24 AM) (Source: DCOM) (EventID: 10016) (User: NT AUTHORITY)
    Description: The application-specific permission settings do not grant Local Launch permission for the COM Server application with CLSID
    Windows.SecurityCenter.WscBrokerManager
    and APPID
    Unavailable
    to the user NT AUTHORITY\SYSTEM SID (S-1-5-18) from address LocalHost (Using LRPC) running in the application container Unavailable SID (Unavailable). This security permission can be modified using the Component Services administrative tool.

    Error: (02/24/2020 10:23:15 AM) (Source: Service Control Manager) (EventID: 7022) (User: )
    Description: The Security Center service hung on starting.

    Error: (02/24/2020 10:21:01 AM) (Source: Service Control Manager) (EventID: 7022) (User: )
    Description: The System Guard Runtime Monitor Broker service hung on starting.

    Error: (02/24/2020 10:20:39 AM) (Source: Service Control Manager) (EventID: 7034) (User: )
    Description: The Downloaded Maps Manager service terminated unexpectedly. It has done this 1 time(s).

    Error: (02/24/2020 10:18:41 AM) (Source: Service Control Manager) (EventID: 7022) (User: )
    Description: The Delivery Optimization service hung on starting.

    Error: (02/23/2020 07:49:37 PM) (Source: DCOM) (EventID: 10010) (User: NT AUTHORITY)
    Description: The server {A677570A-2BA2-4E9A-B2E2-8A02CD8B4FD3} did not register with DCOM within the required timeout.


    Windows Defender:
    ===================================
    Date: 2018-08-16 11:12:51.147
    Description:
    Windows Defender Antivirus has encountered an error trying to update signatures.
    New Signature Version:
    Previous Signature Version: 1.267.1013.0
    Update Source: Microsoft Update Server
    Signature Type: AntiVirus
    Update Type: Full
    Current Engine Version:
    Previous Engine Version: 1.1.14800.3
    Error code: 0x80240022
    Error description: The program can't check for definition updates.

    Date: 2018-08-16 11:12:51.131
    Description:
    Windows Defender Antivirus has encountered an error trying to update signatures.
    New Signature Version:
    Previous Signature Version: 1.267.1013.0
    Update Source: Microsoft Update Server
    Signature Type: AntiVirus
    Update Type: Full
    Current Engine Version:
    Previous Engine Version: 1.1.14800.3
    Error code: 0x80240022
    Error description: The program can't check for definition updates.

    CodeIntegrity:
    ===================================

    Date: 2020-02-24 15:24:56.373
    Description:
    Code Integrity determined that a process (\Device\HarddiskVolume2\Program Files\Malwarebytes\Anti-Malware\MBAMService.exe) attempted to load \Device\HarddiskVolume2\Program Files\Bonjour\mdnsNSP.dll that did not meet the Custom 3 / Antimalware signing level requirements.

    Date: 2020-02-24 15:24:56.368
    Description:
    Code Integrity determined that a process (\Device\HarddiskVolume2\Program Files\Malwarebytes\Anti-Malware\MBAMService.exe) attempted to load \Device\HarddiskVolume2\Program Files\Bonjour\mdnsNSP.dll that did not meet the Custom 3 / Antimalware signing level requirements.

    Date: 2020-02-24 15:24:56.147
    Description:
    Code Integrity determined that a process (\Device\HarddiskVolume2\Program Files\Malwarebytes\Anti-Malware\MBAMService.exe) attempted to load \Device\HarddiskVolume2\Program Files\Bonjour\mdnsNSP.dll that did not meet the Custom 3 / Antimalware signing level requirements.

    Date: 2020-02-24 15:24:56.137
    Description:
    Code Integrity determined that a process (\Device\HarddiskVolume2\Program Files\Malwarebytes\Anti-Malware\MBAMService.exe) attempted to load \Device\HarddiskVolume2\Program Files\Bonjour\mdnsNSP.dll that did not meet the Custom 3 / Antimalware signing level requirements.

    Date: 2020-02-24 15:24:20.694
    Description:
    Code Integrity determined that a process (\Device\HarddiskVolume2\Program Files\Malwarebytes\Anti-Malware\MBAMService.exe) attempted to load \Device\HarddiskVolume2\Program Files\Bonjour\mdnsNSP.dll that did not meet the Custom 3 / Antimalware signing level requirements.

    Date: 2020-02-24 15:24:20.691
    Description:
    Code Integrity determined that a process (\Device\HarddiskVolume2\Program Files\Malwarebytes\Anti-Malware\MBAMService.exe) attempted to load \Device\HarddiskVolume2\Program Files\Bonjour\mdnsNSP.dll that did not meet the Custom 3 / Antimalware signing level requirements.

    Date: 2020-02-24 15:24:19.468
    Description:
    Code Integrity determined that a process (\Device\HarddiskVolume2\Program Files\Malwarebytes\Anti-Malware\MBAMService.exe) attempted to load \Device\HarddiskVolume2\Program Files\Bonjour\mdnsNSP.dll that did not meet the Custom 3 / Antimalware signing level requirements.

    Date: 2020-02-24 15:24:19.466
    Description:
    Code Integrity determined that a process (\Device\HarddiskVolume2\Program Files\Malwarebytes\Anti-Malware\MBAMService.exe) attempted to load \Device\HarddiskVolume2\Program Files\Bonjour\mdnsNSP.dll that did not meet the Custom 3 / Antimalware signing level requirements.

    ==================== Memory info ===========================

    BIOS: American Megatrends Inc. 2201 01/16/2012
    Motherboard: ASUSTeK COMPUTER INC. F1A75-V PRO
    Processor: AMD A4-3400 APU with Radeon(tm) HD Graphics
    Percentage of memory in use: 49%
    Total physical RAM: 7656.25 MB
    Available physical RAM: 3896.29 MB
    Total Virtual: 8168.25 MB
    Available Virtual: 3490.29 MB

    ==================== Drives ================================

    Drive c: () (Fixed) (Total:931.5 GB) (Free:566.75 GB) NTFS
    Drive d: (Data) (Fixed) (Total:931.29 GB) (Free:130.48 GB) NTFS
    Drive k: (CCW_DISC2) (CDROM) (Total:4.2 GB) (Free:0 GB) UDF

    \\?\Volume{0cc9e3e0-8da9-11e6-906e-b8cf9f2f7c2f}\ () (Fixed) (Total:0.09 GB) (Free:0.07 GB) FAT32

    ==================== MBR & Partition Table ====================

    ==========================================================
    Disk: 0 (Size: 931.5 GB) (Disk ID: B9DCE103)

    Partition: GPT.

    ==========================================================
    Disk: 1 (MBR Code: Windows 7/8/10) (Size: 931.5 GB) (Disk ID: 0435786A)

    Partition: GPT.

    ==================== End of Addition.txt =======================
     
    joe645,
    #7
  9. 2020/02/24
    joe645

    joe645 Well-Known Member Thread Starter

    Joined:
    2004/01/26
    Messages:
    435
    Likes Received:
    1
    Part ONE
    Scan result of Farbar Recovery Scan Tool (FRST) (x64) Version: 23-02-2020
    Ran by User (administrator) on DESKTOP-LTP8JAE (24-02-2020 15:16:44)
    Running from C:\Users\User\Downloads
    Loaded Profiles: User (Available Profiles: User)
    Platform: Windows 10 Home Version 1803 17134.1304 (X64) Language: English (United States)
    Default browser: FF
    Boot Mode: Normal
    Tutorial for Farbar Recovery Scan Tool: FRST Tutorial - How to use Farbar Recovery Scan Tool - Malware Removal Guides and Tutorials

    ==================== Processes (Whitelisted) =================

    (If an entry is included in the fixlist, the process will be closed. The file will not be moved.)

    (Adobe Inc. -> Adobe Systems) C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe
    (Adobe Systems Inc.) [File not signed] C:\Program Files (x86)\Adobe\Acrobat 5.0\Distillr\AcroTray.exe
    (Adobe Systems Incorporated) C:\Program Files\WindowsApps\ReaderNotificationClient_1.0.4.0_x86__e1rzdqpraam7r\AcrobatNotificationClient.exe
    (Advanced Micro Devices, Inc.) [File not signed] C:\Program Files\ATI Technologies\ATI.ACE\Fuel\Fuel.Service.exe
    (Apple Inc. -> Apple Inc.) C:\Program Files\Bonjour\mDNSResponder.exe
    (Apple Inc. -> Apple Inc.) C:\Program Files\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe
    (Apple Inc. -> Apple Inc.) C:\Program Files\iPod\bin\iPodService.exe
    (ArcSoft, Inc. -> ArcSoft Inc.) C:\Program Files (x86)\Common Files\ArcSoft\Connection Service\Bin\ACService.exe
    (Bitdefender SRL -> Bitdefender) C:\Program Files\Bitdefender Agent\DiscoverySrv.exe
    (Bitdefender SRL -> Bitdefender) C:\Program Files\Bitdefender Agent\ProductAgentService.exe
    (Bitdefender SRL -> Bitdefender) C:\Program Files\Bitdefender\Bitdefender Security\bdagent.exe
    (Bitdefender SRL -> Bitdefender) C:\Program Files\Bitdefender\Bitdefender Security\bdservicehost.exe
    (Bitdefender SRL -> Bitdefender) C:\Program Files\Bitdefender\Bitdefender Security\bdservicehost.exe
    (Bitdefender SRL -> Bitdefender) C:\Program Files\Bitdefender\Bitdefender Security\bdservicehost.exe
    (Bitdefender SRL -> Bitdefender) C:\Program Files\Bitdefender\Bitdefender Security\updatesrv.exe
    (Bitdefender SRL -> Bitdefender) C:\Program Files\Common Files\Bitdefender\SetupInformation\Bitdefender RedLine\bdredline.exe
    (Canon Inc. -> CANON INC.) C:\Program Files (x86)\Canon\IJ Scan Utility\SETEVENT.exe
    (Corel Corporation -> WinZip Computing) C:\Program Files\WinZip\WzPreloader.exe
    (Dashlane USA, Inc. -> Dashlane, Inc.) C:\Users\User\AppData\Roaming\Dashlane\Dashlane.exe
    (Dashlane USA, Inc. -> Dashlane, Inc.) C:\Users\User\AppData\Roaming\Dashlane\DashlanePlugin.exe
    (Google LLC -> Google LLC) C:\Program Files (x86)\Google\Update\1.3.35.442\GoogleCrashHandler.exe
    (Google LLC -> Google LLC) C:\Program Files (x86)\Google\Update\1.3.35.442\GoogleCrashHandler64.exe
    (IObit Information Technology -> IObit) C:\Program Files (x86)\IObit\IObit Uninstaller\UninstallMonitor.exe
    (Ivaylo Beltchev -> IvoSoft) [File not signed] C:\Program Files\Classic Shell\ClassicStartMenu.exe
    (James Garton) [File not signed] C:\Program Files (x86)\Wallpaper Master\Wallpaper Master Pro.exe
    (Malwarebytes Inc -> Malwarebytes) C:\Program Files\Malwarebytes\Anti-Malware\MBAMService.exe
    (Malwarebytes Inc -> Malwarebytes) C:\Program Files\Malwarebytes\Anti-Malware\mbamtray.exe
    (Microsoft Corporation) C:\Program Files\WindowsApps\Microsoft.Windows.Photos_2020.19081.28230.0_x64__8wekyb3d8bbwe\Microsoft.Photos.exe
    (Microsoft Corporation) C:\Program Files\WindowsApps\Microsoft.ZuneVideo_10.20011.10711.0_x64__8wekyb3d8bbwe\Video.UI.exe
    (Microsoft Windows -> Microsoft Corporation) C:\Program Files\Windows Defender\MSASCuiL.exe
    (Microsoft Windows -> Microsoft Corporation) C:\Windows\System32\dllhost.exe
    (Microsoft Windows -> Microsoft Corporation) C:\Windows\System32\smartscreen.exe
    (Microsoft Windows Hardware Compatibility Publisher -> AMD) C:\Windows\System32\atieclxx.exe
    (Microsoft Windows Hardware Compatibility Publisher -> AMD) C:\Windows\System32\atiesrxx.exe
    (Mozilla Corporation -> Mozilla Corporation) C:\Program Files\Mozilla Firefox\firefox.exe
    (Mozilla Corporation -> Mozilla Corporation) C:\Program Files\Mozilla Firefox\firefox.exe
    (Mozilla Corporation -> Mozilla Corporation) C:\Program Files\Mozilla Firefox\firefox.exe
    (Mozilla Corporation -> Mozilla Corporation) C:\Program Files\Mozilla Firefox\firefox.exe
    (Mozilla Corporation -> Mozilla Corporation) C:\Program Files\Mozilla Firefox\firefox.exe
    (Mozilla Corporation -> Mozilla Corporation) C:\Program Files\Mozilla Firefox\firefox.exe
    (TeamViewer GmbH -> TeamViewer GmbH) C:\Program Files (x86)\TeamViewer\TeamViewer_Service.exe
    (Ulead Systems, Inc.) [File not signed] C:\Program Files (x86)\Common Files\Ulead Systems\DVD\ULCDRSvr.exe
    (WinAbility Software Corporation -> WinAbility® Software Corporation) C:\Program Files\IconShepherd\ISEXE64.exe
    (Wondershare) [File not signed] C:\Program Files (x86)\Wondershare\WAF\2.2.0.5\WsAppService.exe
    Failed to access process -> svchost.exe

    ==================== Registry (Whitelisted) ===================

    (If an entry is included in the fixlist, the registry item will be restored to default or removed. The file will not be moved.)

    HKLM\...\Run: [SecurityHealth] => C:\Program Files\Windows Defender\MSASCuiL.exe [638872 2018-04-11] (Microsoft Windows -> Microsoft Corporation)
    HKLM\...\Run: [RTHDVCPL] => C:\Program Files\Realtek\Audio\HDA\RtkNGUI64.exe [9268672 2018-03-07] (Realtek Semiconductor Corp. -> Realtek Semiconductor)
    HKLM\...\Run: [Classic Start Menu] => C:\Program Files\Classic Shell\ClassicStartMenu.exe [163640 2017-08-13] (Ivaylo Beltchev -> IvoSoft) [File not signed]
    HKLM\...\Run: [WinZip PreLoader] => C:\Program Files\WinZip\WzPreloader.exe [130624 2019-05-16] (Corel Corporation -> WinZip Computing)
    HKLM\...\Run: [iTunesHelper] => C:\Program Files\iTunes\iTunesHelper.exe [302904 2020-01-16] (Apple Inc. -> Apple Inc.)
    HKLM-x32\...\Run: [StartCCC] => C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\amd64\CLIStart.exe [767176 2015-08-21] (Advanced Micro Devices, Inc. -> Advanced Micro Devices, Inc.)
    HKLM-x32\...\Run: [CanonQuickMenu] => C:\Program Files (x86)\Canon\Quick Menu\CNQMMAIN.EXE [1313408 2017-07-05] (Canon Inc. -> CANON INC.)
    HKLM-x32\...\Run: [iSkysoft Helper Compact.exe] => C:\Program Files (x86)\Common Files\iSkysoft\iSkysoft Helper Compact\ISHelper.exe [2138272 2016-10-08] (Shenzhen Yi Xing Investment Co., Ltd. -> iSkySoft)
    HKLM-x32\...\Run: [ArcSoft Connection Service] => C:\Program Files (x86)\Common Files\ArcSoft\Connection Service\Bin\ACDaemon.exe [170496 2009-02-06] (ArcSoft, Inc. -> ArcSoft Inc.)
    HKLM-x32\...\Run: [UVS10 Preload] => C:\Program Files (x86)\Ulead Systems\Ulead VideoStudio SE DVD\uvPL.exe [36864 2011-08-09] (Ulead Systems, Inc.) [File not signed]
    HKLM-x32\...\Run: [APSDaemon] => C:\Program Files (x86)\Common Files\Apple\Apple Application Support\APSDaemon.exe [76600 2020-01-16] (Apple Inc. -> Apple Inc.)
    HKLM-x32\...\Run: [QuickTime Task] => C:\Program Files (x86)\QuickTime\QTTask.exe [421888 2012-04-18] (Apple Inc.) [File not signed]
    HKLM-x32\...\Run: [Aimersoft Helper Compact.exe] => C:\Program Files (x86)\Common Files\Aimersoft\Aimersoft Helper Compact\ASHelper.exe [2001920 2014-04-04] (AimerSoft) [File not signed]
    HKLM-x32\...\Run: [Wondershare Helper Compact.exe] => C:\Program Files (x86)\Common Files\Wondershare\Wondershare Helper Compact\WSHelper.exe [2133216 2017-03-23] (Wondershare Technology Co.,Ltd -> Wondershare)
    HKU\S-1-5-21-507875857-259310543-1677438245-1001\...\Run: [Wallpaper Master] => C:\Program Files (x86)\Wallpaper Master\Wallpaper Master Pro.exe [1159680 2016-06-28] (James Garton) [File not signed]
    HKU\S-1-5-21-507875857-259310543-1677438245-1001\...\Run: [Dashlane] => C:\Users\User\AppData\Roaming\Dashlane\Dashlane.exe [321536 2020-02-11] (Dashlane USA, Inc. -> Dashlane, Inc.)
    HKU\S-1-5-21-507875857-259310543-1677438245-1001\...\Run: [DashlanePlugin] => C:\Users\User\AppData\Roaming\Dashlane\DashlanePlugin.exe [342528 2020-02-11] (Dashlane USA, Inc. -> Dashlane, Inc.)
    HKU\S-1-5-21-507875857-259310543-1677438245-1001\...\Run: [CCleaner Smart Cleaning] => C:\Program Files\CCleaner\CCleaner64.exe [24552064 2019-10-16] (Piriform Software Ltd -> Piriform Ltd)
    HKU\S-1-5-21-507875857-259310543-1677438245-1001\...\Run: [Discord] => C:\Users\User\AppData\Local\Discord\app-0.0.305\Discord.exe [81780056 2019-03-07] (Discord Inc. -> Discord Inc.)
    HKU\S-1-5-21-507875857-259310543-1677438245-1001\...\Run: [GarminExpress] => C:\Program Files (x86)\Garmin\Express\express.exe [30868464 2019-11-21] (Garmin International, Inc. -> Garmin Ltd. or its subsidiaries)
    HKU\S-1-5-21-507875857-259310543-1677438245-1001\Control Panel\Desktop\\SCRNSAVE.EXE -> C:\Windows\WALLPA~1.SCR [37376 2013-12-17] () [File not signed]
    HKU\S-1-5-18\...\Run: [GarminExpress] => C:\Program Files (x86)\Garmin\Express\express.exe [30868464 2019-11-21] (Garmin International, Inc. -> Garmin Ltd. or its subsidiaries)
    HKLM\Software\Microsoft\Active Setup\Installed Components: [{8A69D345-D564-463c-AFF1-A69D9E530F96}] -> C:\Program Files (x86)\Google\Chrome\Application\79.0.3945.130\Installer\chrmstp.exe [2020-01-22] (Google LLC -> Google LLC)
    HKLM\Software\Wow6432Node\Microsoft\Active Setup\Installed Components: [{73FA19D0-2D75-11D2-995D-00C04F98BBC9}] ->
    Startup: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\Acrobat Assistant.lnk [2019-09-29]
    ShortcutTarget: Acrobat Assistant.lnk -> C:\Program Files (x86)\Adobe\Acrobat 5.0\Distillr\AcroTray.exe (Adobe Systems Inc.) [File not signed]
    Startup: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\Adobe Gamma Loader.lnk [2018-05-09]
    ShortcutTarget: Adobe Gamma Loader.lnk -> C:\Program Files (x86)\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe (Adobe Systems, Inc.) [File not signed]
    Startup: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\Icon Shepherd.lnk [2019-11-01]
    ShortcutTarget: Icon Shepherd.lnk -> C:\Program Files\IconShepherd\ISEXE64.exe (WinAbility Software Corporation -> WinAbility® Software Corporation)
    Startup: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\Microsoft Office.lnk [2019-09-30]
    ShortcutTarget: Microsoft Office.lnk -> C:\Program Files (x86)\Microsoft Office\Office10\OSA.EXE (Microsoft Corporation -> Microsoft Corporation)
    Startup: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\UltraMon.lnk [2019-09-26]
    ShortcutTarget: UltraMon.lnk -> C:\Windows\Installer\{2CB51501-DA86-4216-9C9B-2C52A64BA047}\IcoUltraMon.ico () [File not signed]
    Startup: C:\Users\User\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Nikon Monitor.lnk [2018-05-09]
    ShortcutTarget: Nikon Monitor.lnk -> C:\Program Files (x86)\Common Files\Nikon\Monitor\NkMonitor.exe (Nikon Corporation) [File not signed]
    Startup: C:\Users\User\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Webshots.lnk [2018-06-10]
    ShortcutTarget: Webshots.lnk -> C:\Program Files (x86)\Webshots\Launcher.exe (American Greetings, Inc. -> Webshots.com)

    ==================== Scheduled Tasks (Whitelisted) ============

    (If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)

    Task: {07FCBD0E-3EF3-4EFD-9652-17128A6F97C4} - System32\Tasks\Phoenix360\ActiveReporter-SystemMechanic => C:\Program Files (x86)\Common Files\Phoenix360\ActiveCore\ActiveBridge.exe [556816 2019-08-26] (iolo technologies, LLC -> iolo technologies, LLC)
    Task: {2D84E5AC-1704-4B19-B180-7CDB6FB68A99} - System32\Tasks\Phoenix360\ActiveSync-SystemMechanic => C:\Program Files (x86)\Common Files\Phoenix360\ActiveCore\activebridge.exe [556816 2019-08-26] (iolo technologies, LLC -> iolo technologies, LLC)
    Task: {33880C7F-2EC3-47C4-A160-DAA00EBE271D} - System32\Tasks\CCleaner Update => C:\Program Files\CCleaner\CCUpdate.exe [608384 2019-10-16] (Piriform Software Ltd -> Piriform Software Ltd)
    Task: {3793B711-CE38-46BD-9D4D-134C2741FC41} - System32\Tasks\ClouDNS => C:\Windows\System32\updateIP.vbs
    Task: {3915F969-8CEF-4A89-BCD3-D629669885F2} - System32\Tasks\SmartDefrag_Startup => C:\Program Files (x86)\IObit\Smart Defrag\SmartDefrag.exe [5849872 2019-07-05] (IObit Information Technology -> IObit)
    Task: {3A57542B-5C22-4832-83D2-6C282AFC95A6} - System32\Tasks\Apple\AppleSoftwareUpdate => C:\Program Files (x86)\Apple Software Update\SoftwareUpdate.exe [616832 2019-09-04] (Apple Inc. -> Apple Inc.)
    Task: {453367FB-67AB-4057-AB02-33AA1B513FDE} - System32\Tasks\IObitSelfCheckTask => C:\Program Files (x86)\IObit\Smart Defrag\IObitSelfCheck.exe
    Task: {48B51215-9EC4-42E2-8A22-E9E6FB5E1C6D} - System32\Tasks\Adobe Flash Player Updater => C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe [335416 2020-02-11] (Adobe Inc. -> Adobe)
    Task: {4CB6F6D9-0834-44E2-BEF5-3ADFA9E3DFE7} - System32\Tasks\Adobe Flash Player NPAPI Notifier => C:\Windows\SysWOW64\Macromed\Flash\FlashUtil32_32_0_0_330_Plugin.exe [1458232 2020-02-11] (Adobe Inc. -> Adobe)
    Task: {4D60F02E-4256-43F1-8219-EF50F704AC8B} - System32\Tasks\IOTransfer SkipUAC (User) => C:\Program Files (x86)\IOTransfer\IOT\IOTransfer.exe
    Task: {5AFA4B39-9C11-4E95-A3FF-D31026521FB0} - System32\Tasks\SmartDefrag_AutoAnalyze => C:\Program Files (x86)\IObit\Smart Defrag\AutoDefrag.exe [314128 2018-05-02] (IObit Information Technology -> IObit)
    Task: {8BC01496-D548-4652-908B-0576D54D4E80} - System32\Tasks\GoogleUpdateTaskMachineUA => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe [152216 2018-05-04] (Google Inc -> Google Inc.)
    Task: {9620D62D-B80A-4BD1-9AA1-2A9AC9ABAB2F} - System32\Tasks\GoogleUpdateTaskMachineCore => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe [152216 2018-05-04] (Google Inc -> Google Inc.)
    Task: {97A54C17-8DD9-4CF7-AA11-2CB71D4ABEDE} - System32\Tasks\GarminUpdaterTask => C:\Program Files (x86)\Garmin\Express SelfUpdater\ExpressSelfUpdater.exe [40432 2019-06-18] (Garmin International, Inc. -> )
    Task: {9C930B32-4EB6-49A2-BE9E-733558BF97A6} - System32\Tasks\Avast Software\Overseer => C:\Program Files\Common Files\AVAST Software\Overseer\overseer.exe [1835112 2020-02-19] (Avast Software s.r.o. -> AVAST Software)
    Task: {A990ABBF-264A-4DCF-9704-A8B4DCA702A8} - System32\Tasks\Bitdefender AgentTask_AD394AE64E874073B10A89FEEC305A3C => C:\Program Files\Bitdefender\Bitdefender Security\bdagent.exe [525632 2020-02-20] (Bitdefender SRL -> Bitdefender)
    Task: {AFFDDD1D-E27C-4956-BB89-4D602733E7DA} - System32\Tasks\SmartDefrag_Update => C:\Program Files (x86)\IObit\Smart Defrag\AutoUpdate.exe [3007760 2019-04-24] (IObit Information Technology -> IObit)
    Task: {B39FB0BC-2588-4016-8F0D-B32009FF940E} - System32\Tasks\Bitdefender Agent WatchDog_65D6944A0EF74FDAB96E31112AD39864 => C:\Program Files\Bitdefender Agent\WatchDog.exe [488760 2019-07-15] (Bitdefender SRL -> Bitdefender)
    Task: {C95E7FE3-0B15-453F-9FFC-FF7BD09253B2} - System32\Tasks\CreateExplorerShellUnelevatedTask => C:\Windows\explorer.exe /NOUACCHECK
    Task: {C95FB597-4743-4518-9302-4C915695DF70} - System32\Tasks\Uninstaller_SkipUac_User => C:\Program Files (x86)\IObit\IObit Uninstaller\IObitUninstaler.exe [5900560 2019-08-27] (IObit Information Technology -> IObit)
    Task: {D0E5A4F8-E735-47F1-8106-B4CFCFEBB4AD} - System32\Tasks\Phoenix360\ActiveMessenger-SystemMechanic => C:\Program Files (x86)\Common Files\Phoenix360\ActiveCore\ActiveBridge.exe [556816 2019-08-26] (iolo technologies, LLC -> iolo technologies, LLC)
    Task: {DB812ECB-58E8-4D87-B6D0-96BAD05E8C2C} - System32\Tasks\Driver Booster SkipUAC (User) => C:\Program Files (x86)\IObit\Driver Booster\5.5.1\DriverBooster.exe
    Task: {E96C2BD5-51B2-4812-893F-D6258E8D58F0} - System32\Tasks\CCleanerSkipUAC => C:\Program Files\CCleaner\CCleaner.exe [18458752 2019-10-16] (Piriform Software Ltd -> Piriform Ltd)
    Task: {F6C05138-2BD1-49F4-A931-19D6C9FAB85C} - System32\Tasks\NCH Software\PixillionDowngrade => C:\Program Files (x86)\NCH Software\Pixillion\pixillion.exe [1641544 2019-11-07] (NCH Software, Inc. -> NCH Software)
    Task: {FCD7A466-BEB6-4009-9E1B-EA4A7FE22346} - System32\Tasks\Adobe Acrobat Update Task => C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe [1240656 2019-09-10] (Adobe Inc. -> Adobe Systems)

    (If an entry is included in the fixlist, the task (.job) file will be moved. The file which is running by the task will not be moved.)


    ==================== Internet (Whitelisted) ====================

    (If an item is included in the fixlist, if it is a registry item it will be removed or restored to default.)

    Winsock: Catalog5 07 C:\Program Files (x86)\Bonjour\mdnsNSP.dll [122128 2015-08-12] (Apple Inc. -> Apple Inc.)
    Winsock: Catalog5-x64 07 C:\Program Files\Bonjour\mdnsNSP.dll [133392 2015-08-12] (Apple Inc. -> Apple Inc.)
    Tcpip\Parameters: [DhcpNameServer] 192.168.1.1
    Tcpip\..\Interfaces\{1b16637a-a5e3-4f5d-948a-e7f44b6ee4d1}: [DhcpNameServer] 192.168.1.1
    Tcpip\..\Interfaces\{3ac56bc6-bfe0-4571-8301-6c79976d2c0a}: [DhcpNameServer] 8.8.8.8 8.8.4.4
    Tcpip\..\Interfaces\{b78170d5-96ca-48c9-8770-cce38dc0aec0}: [DhcpNameServer] 198.18.0.1 198.18.0.2

    Internet Explorer:
    ==================
    HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = about:blank
    HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Start Page = about:blank
    HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL =
    HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Default_Page_URL =
    HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL =
    HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Default_Search_URL =
    HKU\S-1-5-21-507875857-259310543-1677438245-1001\Software\Microsoft\Internet Explorer\Main,Start Page = hxxps://go.microsoft.com/fwlink/p/?LinkId=620947&OCID=AVRES000&pc=UE00
    SearchScopes: HKLM -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL =
    SearchScopes: HKLM-x32 -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL =
    SearchScopes: HKU\S-1-5-21-507875857-259310543-1677438245-1001 -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = hxxps://www.bing.com/search?q={searchTerms}&src=IE-SearchBox&FORM=IESR02&pc=UE00
    SearchScopes: HKU\S-1-5-21-507875857-259310543-1677438245-1001 -> {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = hxxps://www.bing.com/search?q={searchTerms}&src=IE-SearchBox&FORM=IESR02&pc=UE00
    BHO: ExplorerWnd Helper -> {10921475-03CE-4E04-90CE-E2E7EF20C814} -> C:\Program Files (x86)\IObit\IObit Uninstaller\UninstallExplorer.dll [2019-06-20] (IObit Information Technology -> IObit)
    BHO: Bitdefender Trackers Blocking -> {159ff5d5-55f1-4d2f-b706-767a55f77abb} -> C:\Program Files\Bitdefender\Bitdefender Security\bdtbie.dll [2020-02-20] (Bitdefender SRL -> Bitdefender)
    BHO: Bitdefender Wallet -> {1DAC0C53-7D23-4AB3-856A-B04D98CD982A} -> C:\Program Files\Bitdefender\Bitdefender Security\pmbxie.dll [2020-02-20] (Bitdefender SRL -> Bitdefender)
    BHO: Canon Easy-WebPrint EX BHO -> {3785D0AD-BFFF-47F6-BF5B-A587C162FED9} -> C:\Program Files\Canon\Easy-WebPrint EX\ewpexbho.dll [2016-02-23] (Canon Inc. -> CANON INC.)
    BHO: ExplorerBHO Class -> {449D0D6E-2412-4E61-B68F-1CB625CD9E52} -> C:\Program Files\Classic Shell\ClassicExplorer64.dll [2017-08-13] (Ivaylo Beltchev -> IvoSoft) [File not signed]
    BHO: ClassicIEBHO Class -> {EA801577-E6AD-4BD5-8F71-4BE0154331A4} -> C:\Program Files\Classic Shell\ClassicIEDLL_64.dll [2017-08-13] (Ivaylo Beltchev -> IvoSoft) [File not signed]
    BHO-x32: Bitdefender Trackers Blocking -> {159ff5d5-55f1-4d2f-b706-767a55f77abb} -> C:\Program Files\Bitdefender\Bitdefender Security\antispam32\bdtbie.dll [2020-02-20] (Bitdefender SRL -> Bitdefender)
    BHO-x32: Bitdefender Wallet -> {1DAC0C53-7D23-4AB3-856A-B04D98CD982A} -> C:\Program Files\Bitdefender\Bitdefender Security\Antispam32\pmbxie.dll [2020-02-20] (Bitdefender SRL -> Bitdefender)
    BHO-x32: Canon Easy-WebPrint EX BHO -> {3785D0AD-BFFF-47F6-BF5B-A587C162FED9} -> C:\Program Files (x86)\Canon\Easy-WebPrint EX\ewpexbho.dll [2016-02-23] (Canon Inc. -> CANON INC.)
    BHO-x32: Dashlane BHO -> {42D79B50-CC4A-4A8E-860F-BE674AF053A2} -> C:\Users\User\AppData\Roaming\Dashlane\ie\Dashlanei.dll [2020-02-11] (Dashlane USA, Inc. -> Dashlane, Inc.)
    Toolbar: HKLM - Canon Easy-WebPrint EX - {759D9886-0C6F-4498-BAB6-4A5F47C6C72F} - C:\Program Files\Canon\Easy-WebPrint EX\ewpexhlp.dll [2016-02-23] (Canon Inc. -> CANON INC.)
    Toolbar: HKLM - Bitdefender Wallet - {1DAC0C53-7D23-4AB3-856A-B04D98CD982A} - C:\Program Files\Bitdefender\Bitdefender Security\pmbxie.dll [2020-02-20] (Bitdefender SRL -> Bitdefender)
    Toolbar: HKLM-x32 - Canon Easy-WebPrint EX - {759D9886-0C6F-4498-BAB6-4A5F47C6C72F} - C:\Program Files (x86)\Canon\Easy-WebPrint EX\ewpexhlp.dll [2016-02-23] (Canon Inc. -> CANON INC.)
    Toolbar: HKLM-x32 - Webshots Toolbar - {C17590D2-ECB4-4b15-8820-F58798DCC118} - C:\Program Files (x86)\Webshots\WSToolbar4IE.dll [2008-08-15] (Webshots.com) [File not signed]
    Toolbar: HKLM-x32 - Dashlane Toolbar - {669695BC-A811-4A9D-8CDF-BA8C795F261C} - C:\Users\User\AppData\Roaming\Dashlane\ie\KWIEBar.dll [2020-02-11] (Dashlane USA, Inc. -> Dashlane, Inc.)
    Toolbar: HKLM-x32 - Bitdefender Wallet - {1DAC0C53-7D23-4AB3-856A-B04D98CD982A} - C:\Program Files\Bitdefender\Bitdefender Security\Antispam32\pmbxie.dll [2020-02-20] (Bitdefender SRL -> Bitdefender)
    Handler-x32: cdo - {CD00020A-8B95-11D1-82DB-00C04FB1625D} - C:\Program Files (x86)\Common Files\Microsoft Shared\Web Folders\PKMCDO.DLL [2001-01-22] (Microsoft Corporation) [File not signed]
    Handler-x32: http - {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - C:\Program Files (x86)\Common Files\System\OLE DB\msdaipp.dll [2001-02-12] (Microsoft Corporation) [File not signed]
    Handler-x32: http - {E1D2BF40-A96B-11d1-9C6B-0000F875AC61} - C:\Program Files (x86)\Common Files\System\OLE DB\msdaipp.dll [2001-02-12] (Microsoft Corporation) [File not signed]
    Handler-x32: https - {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - C:\Program Files (x86)\Common Files\System\OLE DB\msdaipp.dll [2001-02-12] (Microsoft Corporation) [File not signed]
    Handler-x32: https - {E1D2BF40-A96B-11d1-9C6B-0000F875AC61} - C:\Program Files (x86)\Common Files\System\OLE DB\msdaipp.dll [2001-02-12] (Microsoft Corporation) [File not signed]
    Handler-x32: msdaipp - {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - C:\Program Files (x86)\Common Files\System\OLE DB\msdaipp.dll [2001-02-12] (Microsoft Corporation) [File not signed]
    Handler-x32: msdaipp - {E1D2BF40-A96B-11d1-9C6B-0000F875AC61} - C:\Program Files (x86)\Common Files\System\OLE DB\msdaipp.dll [2001-02-12] (Microsoft Corporation) [File not signed]
    Handler: WSWSVCUchrome - No CLSID Value

    Edge:
    ======
    DownloadDir: C:\Users\User\Downloads

    FireFox:
    ========
    FF DefaultProfile: r1629r1m.default-1540956538169
    FF DefaultProfile: d9604b0q.default
    FF ProfilePath: C:\Users\User\AppData\Roaming\Mozilla\Firefox\Profiles.BAK\Profiles\d9604b0q.default [not found] <==== ATTENTION
    FF ProfilePath: C:\Users\User\AppData\Roaming\Mozilla\Firefox\Profiles\p2v80k5k.Default User [2018-10-30]
    FF ProfilePath: C:\Users\User\AppData\Roaming\Mozilla\Firefox\Profiles\r1629r1m.default-1540956538169 [2020-02-24]
    FF Homepage: Mozilla\Firefox\Profiles\r1629r1m.default-1540956538169 -> hxxps://www.msn.com/
    FF Notifications: Mozilla\Firefox\Profiles\r1629r1m.default-1540956538169 -> hxxps://freemusicdownloads.world; hxxps://mail.google.com; hxxps://www.digitaltrends.com; hxxps://en.softonic.com; hxxps://www.cbssports.com; hxxps://www.alibaba.com; hxxps://www.lightinthebox.com; hxxps://www.luckyvitamin.com; hxxps://www.magazine.store; hxxps://www.ketoconnect.net; hxxps://dietseekers.com; hxxps://offerup.com; hxxps://www.bulbhead.com; hxxps://www.aspicyperspective.com; hxxps://lowcarbyum.com; hxxps://www.pinterest.com; hxxps://troypoint.com; hxxps://www.reviewjournal.com; hxxps://www.pipingrock.com; hxxps://crm.zoho.com; hxxps://www.facebook.com; hxxps://www.reddit.com; hxxps://www.tomsguide.com; hxxps://www.hometalk.com; hxxps://www.gearbest.com; hxxps://yts.am; hxxps://www.technadu.com; hxxps://www.pewpewtactical.com; hxxps://mail.protonmail.com; hxxps://www.youtube.com; hxxps://www.cnet.com; hxxps://www.truthfinder.com; hxxps://www.instantcheckmate.com; hxxps://watch-television.com; hxxps://unzipper.com; hxxps://fileconvertor.org; hxxps://pseudocumylife.info; hxxps://hydrobuilder.com; hxxps://www.iptvinsider.com; hxxps://www.newstrackerdaily.com; hxxps://manualslibrary.org; hxxps://fossbytes.com; hxxps://www.wayfair.com; hxxps://www.vegasworld.com; hxxps://www.thenewstribune.com
    FF HomepageOverride: Mozilla\Firefox\Profiles\r1629r1m.default-1540956538169 -> Enabled: web@Packages
    FF NewTabOverride: Mozilla\Firefox\Profiles\r1629r1m.default-1540956538169 -> Enabled: web@Packages
    FF NewTabOverride: Mozilla\Firefox\Profiles\r1629r1m.default-1540956538169 -> Enabled: jetpack-extension@dashlane.com
    FF Extension: (Hide My IP) - C:\Users\User\AppData\Roaming\Mozilla\Firefox\Profiles\r1629r1m.default-1540956538169\Extensions\admin@myprivacytools.com.xpi [2019-12-14]
    FF Extension: (Dashlane) - C:\Users\User\AppData\Roaming\Mozilla\Firefox\Profiles\r1629r1m.default-1540956538169\Extensions\jetpack-extension@dashlane.com.xpi [2020-02-10] [UpdateUrl:hxxps://ws1.dashlane.com/5/binaries/query?logins=&platform=firefox&target=ff_web_extension&format=json&version=]
    FF Extension: (Manuals Search) - C:\Users\User\AppData\Roaming\Mozilla\Firefox\Profiles\r1629r1m.default-1540956538169\Extensions\{60a58bf1-08ae-46d7-9010-5cfe8eb5f282}.xpi [2020-01-24] [UpdateUrl:hxxps://cdn.manualsearch-cdn.org/xpi/manualsearch/settings_Api/0119/signature/updates.json]
    FF HKLM\...\Firefox\Extensions: [bdwtwe@bitdefender.com] - C:\Program Files\Bitdefender\Bitdefender Security\bdwteff.xpi
    FF Extension: (Bitdefender Wallet) - C:\Program Files\Bitdefender\Bitdefender Security\bdwteff.xpi [2020-02-20]
    FF HKLM\...\Firefox\Extensions: [bdtbe@bitdefender.com] - C:\Program Files\Bitdefender\Bitdefender Security\bdtbef.xpi
    FF Extension: (Bitdefender Anti-tracker) - C:\Program Files\Bitdefender\Bitdefender Security\bdtbef.xpi [2020-02-20]
    FF HKLM\...\Thunderbird\Extensions: [bdThunderbird@bitdefender.com] - C:\Program Files\Bitdefender\Bitdefender Security\bdtbext
    FF Extension: (Bitdefender Antispam Toolbar) - C:\Program Files\Bitdefender\Bitdefender Security\bdtbext [2019-06-05] [Legacy] [not signed]
    FF HKLM-x32\...\Firefox\Extensions: [bdwtwe@bitdefender.com] - C:\Program Files\Bitdefender\Bitdefender Security\bdwteff.xpi
    FF HKLM-x32\...\Firefox\Extensions: [ISVCU@iSkysoft.com] - C:\ProgramData\iSkysoft\Video Converter Ultimate\ISVCU@iSkysoft.com => not found
    FF HKLM-x32\...\Firefox\Extensions: [bdtbe@bitdefender.com] - C:\Program Files\Bitdefender\Bitdefender Security\bdtbef.xpi
    FF HKLM-x32\...\Thunderbird\Extensions: [bdThunderbird@bitdefender.com] - C:\Program Files\Bitdefender\Bitdefender Security\bdtbext
    FF HKU\S-1-5-21-507875857-259310543-1677438245-1001\...\Firefox\Extensions: [{442718d9-475e-452a-b3e1-fb1ee16b8e9f}] - C:\Users\User\AppData\Roaming\Dashlane\6.2007.0.32704\bin\Firefox_Extension\{442718d9-475e-452a-b3e1-fb1ee16b8e9f}
    FF Extension: (No Name) - C:\Users\User\AppData\Roaming\Dashlane\6.2007.0.32704\bin\Firefox_Extension\{442718d9-475e-452a-b3e1-fb1ee16b8e9f} [2020-02-11] [not signed]
    FF Plugin: @adobe.com/FlashPlayer -> C:\Windows\system32\Macromed\Flash\NPSWF64_32_0_0_330.dll [2020-02-11] (Adobe Inc. -> )
    FF Plugin-x32: @adobe.com/FlashPlayer -> C:\Windows\SysWOW64\Macromed\Flash\NPSWF32_32_0_0_330.dll [2020-02-11] (Adobe Inc. -> )
    FF Plugin-x32: @canon.com/EPPEX -> C:\Program Files (x86)\Canon\My Image Garden\AddOn\CIG\npmigfpi.dll [2017-10-17] (CANON INC.) [File not signed]
    FF Plugin-x32: @google.com/npPicasa3,version=3.0.0 -> C:\Program Files (x86)\Google\Picasa3\npPicasa3.dll [2014-07-31] (Google Inc -> Google, Inc.)
    FF Plugin-x32: @videolan.org/vlc,version=3.0.8 -> C:\Program Files (x86)\VideoLAN\VLC\npvlc.dll [2019-08-14] (VideoLAN -> VideoLAN)
    FF Plugin-x32: Adobe Reader -> C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AIR\nppdf32.dll [2020-02-04] (Adobe Inc. -> Adobe Systems Inc.)
    FF ExtraCheck: C:\Program Files\mozilla firefox\defaults\pref\bd_js_config.js [2019-09-14] <==== ATTENTION (Points to *.cfg file)
    FF ExtraCheck: C:\Program Files\mozilla firefox\bd_config.cfg [2019-09-14] <==== ATTENTION

    Chrome:
    =======
    CHR Profile: C:\Users\User\AppData\Local\Google\Chrome\User Data\Default [2020-02-24]
    CHR HomePage: Default -> hxxp://www.msn.com/
    CHR NewTab: Default -> "active": true,
    "entry": "chrome-extension://hjlopiihmpomlfgifjmoipmnaloobipg/html/index.html"

    CHR Extension: (Adobe Acrobat) - C:\Users\User\AppData\Local\Google\Chrome\User Data\Default\Extensions\efaidnbmnnnibpcajpcglclefindmkaj [2020-02-08]
    CHR Extension: (Converter Suite) - C:\Users\User\AppData\Local\Google\Chrome\User Data\Default\Extensions\hjlopiihmpomlfgifjmoipmnaloobipg [2019-12-28]
    CHR Extension: (Bitdefender Anti-tracker) - C:\Users\User\AppData\Local\Google\Chrome\User Data\Default\Extensions\khndhdhbebhaddchcgnalcjlaekbbeof [2019-11-20]
    CHR Extension: (Chrome Web Store Payments) - C:\Users\User\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda [2019-11-20]
    CHR Extension: (Chrome Media Router) - C:\Users\User\AppData\Local\Google\Chrome\User Data\Default\Extensions\pkedcjkdefgpdelpbcmbmeomcjbeemfm [2019-12-28]
    CHR HKLM-x32\...\Chrome\Extension: [efaidnbmnnnibpcajpcglclefindmkaj]
    CHR HKLM-x32\...\Chrome\Extension: [gannpgaobkkhmpomoijebaigcapoeebl]
    CHR HKLM-x32\...\Chrome\Extension: [khndhdhbebhaddchcgnalcjlaekbbeof]

    ==================== Services (Whitelisted) ===================

    (If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)

    R2 ACDaemon; C:\Program Files (x86)\Common Files\ArcSoft\Connection Service\Bin\ACService.exe [109056 2009-02-06] (ArcSoft, Inc. -> ArcSoft Inc.)
    R2 AMD External Events Utility; C:\Windows\system32\atiesrxx.exe [255472 2015-10-21] (Microsoft Windows Hardware Compatibility Publisher -> AMD)
    R2 AMD FUEL Service; C:\Program Files\ATI Technologies\ATI.ACE\Fuel\Fuel.Service.exe [344064 2015-08-21] (Advanced Micro Devices, Inc.) [File not signed]
    R2 Apple Mobile Device Service; C:\Program Files\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe [96056 2019-08-26] (Apple Inc. -> Apple Inc.)
    R2 BDAuxSrv; C:\Program Files\Bitdefender\Bitdefender Security\bdservicehost.exe [803576 2020-02-20] (Bitdefender SRL -> Bitdefender)
    R2 BDProtSrv; C:\Program Files\Bitdefender\Bitdefender Security\bdservicehost.exe [803576 2020-02-20] (Bitdefender SRL -> Bitdefender)
    R2 bdredline; C:\Program Files\Common Files\Bitdefender\SetupInformation\Bitdefender RedLine\bdredline.exe [2195320 2018-03-22] (Bitdefender SRL -> Bitdefender)
    R2 CIJSRegister; C:\Program Files (x86)\Canon\IJ Scan Utility\SETEVENT.exe [153736 2016-06-02] (Canon Inc. -> CANON INC.)
    S3 IDriverT; C:\Program Files (x86)\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe [69632 2005-04-03] (Macrovision Corporation) [File not signed]
    S2 IObitUnSvr; C:\Program Files (x86)\IObit\IObit Uninstaller\IUService.exe [156944 2019-08-23] (IObit Information Technology -> IObit)
    R2 MBAMService; C:\Program Files\Malwarebytes\Anti-Malware\mbamservice.exe [6960640 2019-11-21] (Malwarebytes Inc -> Malwarebytes)
    R2 ProductAgentService; C:\Program Files\Bitdefender Agent\ProductAgentService.exe [1291888 2019-07-15] (Bitdefender SRL -> Bitdefender)
    R2 TeamViewer; C:\Program Files (x86)\TeamViewer\TeamViewer_Service.exe [11293936 2018-04-03] (TeamViewer GmbH -> TeamViewer GmbH)
    R2 UleadBurningHelper; C:\Program Files (x86)\Common Files\Ulead Systems\DVD\ULCDRSvr.exe [49152 2011-09-28] (Ulead Systems, Inc.) [File not signed]
    R2 UPDATESRV; C:\Program Files\Bitdefender\Bitdefender Security\updatesrv.exe [151656 2020-02-20] (Bitdefender SRL -> Bitdefender)
    R2 VSSERV; C:\Program Files\Bitdefender\Bitdefender Security\bdservicehost.exe [803576 2020-02-20] (Bitdefender SRL -> Bitdefender)
    S3 WdNisSvc; C:\ProgramData\Microsoft\Windows Defender\platform\4.18.1807.18075-0\NisSrv.exe [3905952 2018-09-22] (Microsoft Corporation -> Microsoft Corporation)
    S3 WinDefend; C:\ProgramData\Microsoft\Windows Defender\platform\4.18.1807.18075-0\MsMpEng.exe [110944 2018-09-22] (Microsoft Corporation -> Microsoft Corporation)
    R2 WsAppService; C:\Program Files (x86)\Wondershare\WAF\2.2.0.5\WsAppService.exe [411648 2016-03-31] (Wondershare) [File not signed]

    ===================== Drivers (Whitelisted) ===================

    (If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)

    R3 amdkmdag; C:\Windows\system32\DRIVERS\atikmdag.sys [21648880 2015-10-21] (Microsoft Windows Hardware Compatibility Publisher -> Advanced Micro Devices, Inc.)
    R3 amdkmdap; C:\Windows\system32\DRIVERS\atikmpag.sys [674288 2015-10-21] (Microsoft Windows Hardware Compatibility Publisher -> Advanced Micro Devices, Inc.)
    R0 amd_sata; C:\Windows\System32\drivers\amd_sata.sys [93240 2018-08-21] (Microsoft Windows Hardware Compatibility Publisher -> Advanced Micro Devices)
    R0 amd_xata; C:\Windows\System32\drivers\amd_xata.sys [33336 2018-08-21] (Microsoft Windows Hardware Compatibility Publisher -> Advanced Micro Devices)
    R3 AmUStor; C:\Windows\system32\drivers\AmUStor.SYS [109008 2018-08-21] (Alcor Micro, Corp. -> )
    R2 AODDriver4.3; C:\Program Files\ATI Technologies\ATI.ACE\Fuel\amd64\AODDriver2.sys [59616 2014-02-11] (Advanced Micro Devices, Inc. -> Advanced Micro Devices)
    R1 atc; C:\Windows\System32\DRIVERS\atc.sys [1693368 2019-11-20] (Bitdefender SRL -> Bitdefender S.R.L. Bucharest, ROMANIA)
    S3 AtiDCM; C:\AMD\Win10-64Bit-Radeon-Software-Adrenalin-Edition-18.5.1-May23\Bin64\atdcm64a.sys [51104 2016-07-11] (Advanced Micro Devices, Inc. -> Advanced Micro Devices, Inc.)
    R3 AtiHDAudioService; C:\Windows\system32\drivers\AtihdWT6.sys [110096 2018-08-21] (Microsoft Windows Hardware Compatibility Publisher -> Advanced Micro Devices)
    R2 BdDci; C:\Windows\system32\DRIVERS\bddci.sys [739264 2019-11-20] (Bitdefender SRL -> Bitdefender)
    S0 bdelam; C:\Windows\System32\drivers\bdelam.sys [22960 2019-03-20] (Microsoft Windows Early Launch Anti-malware Publisher -> Bitdefender)
    S3 bdprivmon; C:\Windows\System32\DRIVERS\bdprivmon.sys [46056 2020-02-20] (Bitdefender SRL -> © Bitdefender SRL)
    S3 BDVEDISK; C:\Windows\system32\DRIVERS\bdvedisk.sys [96448 2018-04-27] (Bitdefender SRL -> BitDefender)
    S3 dg_ssudbus; C:\Windows\system32\DRIVERS\ssudbus.sys [131984 2017-05-18] (Samsung Electronics Co., Ltd. -> Samsung Electronics Co., Ltd.)
    R1 ESProtectionDriver; C:\Windows\system32\drivers\mbae64.sys [153312 2020-02-07] (Malwarebytes Corporation -> Malwarebytes)
    R0 Gemma; C:\Windows\System32\DRIVERS\gemma.sys [564136 2020-02-20] (Bitdefender SRL -> BitDefender S.R.L. Bucharest, ROMANIA)
    R0 gzflt; C:\Windows\System32\DRIVERS\gzflt.sys [188384 2018-11-28] (Bitdefender SRL -> BitDefender LLC)
    R1 HWiNFO32; C:\Windows\SysWOW64\drivers\HWiNFO64A.SYS [27552 2018-08-21] (Martin Malik - REALiX -> REALiX(tm))
    S3 Ignis; C:\Windows\system32\DRIVERS\ignis.sys [196392 2019-09-13] (Bitdefender SRL -> Bitdefender)
    R3 IUFileFilter; C:\Program Files (x86)\IObit\IObit Uninstaller\drivers\win10_amd64\IUFileFilter.sys [44112 2019-07-30] (IObit Information Technology -> IObit)
    R3 IUProcessFilter; C:\Program Files (x86)\IObit\IObit Uninstaller\drivers\win10_amd64\IUProcessFilter.sys [37328 2019-07-30] (IObit Information Technology -> IObit)
    R3 IURegistryFilter; C:\Program Files (x86)\IObit\IObit Uninstaller\drivers\win10_amd64\IURegistryFilter.sys [49800 2019-07-30] (IObit Information Technology -> IObit)
    R2 MBAMChameleon; C:\Windows\System32\Drivers\MbamChameleon.sys [214496 2020-02-07] (Malwarebytes Inc -> Malwarebytes)
    S0 MbamElam; C:\Windows\System32\DRIVERS\MbamElam.sys [20936 2019-11-21] (Microsoft Windows Early Launch Anti-malware Publisher -> Malwarebytes)
    R3 MBAMFarflt; C:\Windows\System32\DRIVERS\farflt.sys [226448 2020-02-24] (Malwarebytes Inc -> Malwarebytes)
    R3 MBAMProtection; C:\Windows\system32\DRIVERS\mbam.sys [73584 2020-02-24] (Malwarebytes Corporation -> Malwarebytes)
    R3 MBAMSwissArmy; C:\Windows\System32\Drivers\mbamswissarmy.sys [248968 2020-02-24] (Malwarebytes Inc -> Malwarebytes)
    R3 MBAMWebProtection; C:\Windows\system32\DRIVERS\mwac.sys [119960 2020-02-24] (Malwarebytes Inc -> Malwarebytes)
    R2 npf; C:\Windows\system32\drivers\npf.sys [36600 2018-12-19] (Riverbed Technology, Inc. -> Riverbed Technology, Inc.)
    R0 pwdrvio; C:\Windows\System32\pwdrvio.sys [19152 2013-09-30] (MiniTool Solution Ltd -> )
    S3 pwdspio; C:\Windows\system32\pwdspio.sys [12504 2013-09-30] (MiniTool Solution Ltd -> )
    R3 rt640x64; C:\Windows\System32\drivers\rt640x64.sys [1139424 2018-08-21] (Realtek Semiconductor Corp. -> Realtek )
    R0 SmartDefragDriver; C:\Windows\System32\Drivers\SmartDefragDriver.sys [30744 2017-03-09] (IObit Information Technology -> IObit)
    S3 ssudmdm; C:\Windows\system32\DRIVERS\ssudmdm.sys [166288 2017-05-18] (Samsung Electronics Co., Ltd. -> Samsung Electronics Co., Ltd.)
    R3 tap0901; C:\Windows\System32\drivers\tap0901.sys [27136 2016-04-21] (OpenVPN Technologies, Inc. -> The OpenVPN Project)
    R0 trufos; C:\Windows\System32\DRIVERS\trufos.sys [610640 2019-01-14] (Bitdefender SRL -> Bitdefender)
    S3 USBAAPL64; C:\Windows\System32\Drivers\usbaapl64.sys [54784 2018-02-01] (Microsoft Windows Hardware Compatibility Publisher -> Apple, Inc.)
    S3 WdBoot; C:\Windows\system32\drivers\wd\WdBoot.sys [45664 2019-12-27] (Microsoft Windows Early Launch Anti-malware Publisher -> Microsoft Corporation)
    S3 WdFilter; C:\Windows\system32\drivers\wd\WdFilter.sys [355760 2019-12-27] (Microsoft Windows -> Microsoft Corporation)
    S3 wdm_usb; C:\Windows\system32\DRIVERS\usb2ser.sys [151184 2016-07-15] (NGO -> MBB)
    S3 WdNisDrv; C:\Windows\System32\drivers\wd\WdNisDrv.sys [54192 2019-12-27] (Microsoft Windows -> Microsoft Corporation)
    R1 ZAM_Guard; C:\Windows\System32\drivers\zamguard64.sys [250024 2018-09-14] (Zemana Ltd. -> Copyright 2017.)
    U3 aswbdisk; no ImagePath
    S3 CXCVBS; \SystemRoot\system32\drivers\cxCVBS.sys [X]
    S4 IMFMBRProtect; \??\C:\Program Files (x86)\IObit\IObit Malware Fighter\drivers\win10_amd64\IMFMBRProtect.sys [X]
    S4 IMFSafeBox; \??\C:\Program Files (x86)\IObit\IObit Malware Fighter\drivers\win10_amd64\IMFSafeBox.sys [X]
    S3 pfc; system32\drivers\pfc.sys [X]
    S3 VIDBOX8B30; \SystemRoot\system32\drivers\cxCVBS.sys [X]
    S1 ZAM; \??\C:\Windows\System32\drivers\zam64.sys [X]
     
    joe645,
    #8
  10. 2020/02/24
    joe645

    joe645 Well-Known Member Thread Starter

    Joined:
    2004/01/26
    Messages:
    435
    Likes Received:
    1
    First.TXT Part TWO
    ==================== NetSvcs (Whitelisted) ===================

    (If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)


    ==================== One month (created) ===================

    (If an entry is included in the fixlist, the file/folder will be moved.)

    2020-02-24 15:16 - 2020-02-24 15:21 - 000038982 _____ C:\Users\User\Downloads\FRST.txt
    2020-02-24 15:16 - 2020-02-24 15:20 - 000000000 ____D C:\FRST
    2020-02-24 15:14 - 2020-02-24 15:14 - 002279424 _____ (Farbar) C:\Users\User\Downloads\FRST64.exe
    2020-02-24 10:18 - 2020-02-24 10:18 - 000226448 _____ (Malwarebytes) C:\Windows\system32\Drivers\farflt.sys
    2020-02-24 10:18 - 2020-02-24 10:18 - 000073584 _____ (Malwarebytes) C:\Windows\system32\Drivers\mbam.sys
    2020-02-24 10:17 - 2020-02-24 10:18 - 000119960 _____ (Malwarebytes) C:\Windows\system32\Drivers\mwac.sys
    2020-02-24 10:14 - 2020-02-24 10:14 - 000248968 _____ (Malwarebytes) C:\Windows\system32\Drivers\mbamswissarmy.sys
    2020-02-22 17:52 - 2020-02-22 17:53 - 000011198 _____ C:\Users\User\Documents\CarolynLdgr.ods
    2020-02-22 12:54 - 2020-02-22 12:53 - 000000012 _____ C:\Windows\system32\StartupCheck.vbs
    2020-02-21 13:14 - 2020-02-21 13:14 - 000000000 ___HD C:\Windows\AxInstSV
    2020-02-21 13:08 - 2020-02-21 13:08 - 000003538 _____ C:\Windows\system32\Tasks\ClouDNS
    2020-02-20 10:13 - 2020-02-20 10:13 - 000103520 _____ C:\ProgramData\vpn.uninstall.1582222212.bdinstall.v2.bin
    2020-02-20 10:13 - 2020-02-20 10:13 - 000038530 _____ C:\ProgramData\vpn.uninstall.1582222352.bdinstall.bin
    2020-02-18 17:29 - 2020-02-18 17:29 - 000282734 _____ C:\Users\User\Downloads\Auto Policy 02132020.pdf
    2020-02-17 16:54 - 2020-02-17 16:54 - 000000000 ____D C:\Users\User\Downloads\ConvertXtoDVD.7.0.0.68
    2020-02-17 16:53 - 2020-02-17 16:53 - 038763710 _____ C:\Users\User\Downloads\VSO ConvertXtoDVD 7.0.0.61 Full - PortableAppz [4REALTORRENTZ.COM].ZIP
    2020-02-17 16:52 - 2020-02-17 17:29 - 000000000 ____D C:\Users\User\AppData\LocalLow\uTorrent
    2020-02-17 16:50 - 2020-02-17 16:54 - 000000000 ____D C:\Users\User\Documents\ConvertXtoDVD_Resources
    2020-02-17 16:49 - 2020-02-17 16:49 - 000099384 _____ C:\Users\User\AppData\Roaming\inst.exe
    2020-02-17 16:49 - 2020-02-17 16:49 - 000082816 _____ (VSO Software) C:\Users\User\AppData\Roaming\pcouffin.sys
    2020-02-17 16:49 - 2020-02-17 16:49 - 000007859 _____ C:\Users\User\AppData\Roaming\pcouffin.cat
    2020-02-17 16:49 - 2020-02-17 16:49 - 000000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\VSO
    2020-02-17 16:48 - 2020-02-18 13:15 - 000000000 ____D C:\ProgramData\VSO
    2020-02-17 16:48 - 2020-02-17 16:56 - 000000000 ____D C:\Users\User\Documents\ConvertXToDVD
    2020-02-17 16:48 - 2020-02-17 16:50 - 000000000 ____D C:\Users\User\AppData\Roaming\VSO
    2020-02-17 16:48 - 2020-02-17 16:48 - 000000000 ____D C:\Program Files (x86)\VSO
    2020-02-17 16:46 - 2020-02-17 16:46 - 038112216 _____ (VSO Software ) C:\Users\User\Downloads\vsoConvertXtoDVD7_setup.exe
    2020-02-15 16:13 - 2020-02-15 16:43 - 000000000 ____D C:\Users\User\Downloads\Midway (2019) [1080p] [BluRay] [5.1] [YTS.MX]
    2020-02-11 11:19 - 2020-02-05 04:34 - 004527584 _____ (Microsoft Corporation) C:\Windows\system32\sppsvc.exe
    2020-02-11 11:19 - 2020-02-05 04:33 - 021412488 _____ (Microsoft Corporation) C:\Windows\system32\shell32.dll
    2020-02-11 11:19 - 2020-02-05 04:18 - 012879872 _____ (Microsoft Corporation) C:\Windows\system32\ieframe.dll
    2020-02-11 11:19 - 2020-02-05 02:52 - 012075520 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieframe.dll
    2020-02-11 11:19 - 2020-02-04 23:25 - 001213264 _____ (Microsoft Corporation) C:\Windows\system32\ClipUp.exe
    2020-02-11 11:19 - 2020-02-04 23:23 - 005627792 _____ (Microsoft Corporation) C:\Windows\system32\StartTileData.dll
    2020-02-11 11:19 - 2020-02-04 23:21 - 009081656 _____ (Microsoft Corporation) C:\Windows\system32\ntoskrnl.exe
    2020-02-11 11:19 - 2020-02-04 23:21 - 007519896 _____ (Microsoft Corporation) C:\Windows\system32\Windows.Media.Protection.PlayReady.dll
    2020-02-11 11:19 - 2020-02-04 23:21 - 007447904 _____ (Microsoft Corporation) C:\Windows\system32\windows.storage.dll
    2020-02-11 11:19 - 2020-02-04 23:19 - 006570368 _____ (Microsoft Corporation) C:\Windows\SysWOW64\Windows.Media.Protection.PlayReady.dll
    2020-02-11 11:19 - 2020-02-04 23:11 - 022016512 _____ (Microsoft Corporation) C:\Windows\SysWOW64\edgehtml.dll
    2020-02-11 11:19 - 2020-02-04 23:04 - 025854976 _____ (Microsoft Corporation) C:\Windows\system32\edgehtml.dll
    2020-02-11 11:19 - 2020-02-04 23:03 - 019393536 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.dll
    2020-02-11 11:19 - 2020-02-04 23:00 - 022745088 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.dll
    2020-02-11 11:19 - 2020-02-04 22:59 - 005770752 _____ (Microsoft Corporation) C:\Windows\SysWOW64\Chakra.dll
    2020-02-11 11:19 - 2020-02-04 22:58 - 004710400 _____ (Microsoft Corporation) C:\Windows\system32\cdp.dll
    2020-02-11 11:19 - 2020-02-04 22:57 - 004516864 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wininet.dll
    2020-02-11 11:19 - 2020-02-04 22:54 - 007572992 _____ (Microsoft Corporation) C:\Windows\system32\Chakra.dll
    2020-02-11 11:19 - 2020-02-04 22:52 - 004938240 _____ (Microsoft Corporation) C:\Windows\system32\wininet.dll
    2020-02-11 11:18 - 2020-02-05 04:34 - 001639864 _____ (Microsoft Corporation) C:\Windows\system32\user32.dll
    2020-02-11 11:18 - 2020-02-05 04:34 - 001617360 _____ (Microsoft Corporation) C:\Windows\system32\sppobjs.dll
    2020-02-11 11:18 - 2020-02-05 04:32 - 001047352 _____ (Microsoft Corporation) C:\Windows\system32\ReAgent.dll
    2020-02-11 11:18 - 2020-02-05 04:17 - 008629760 _____ (Microsoft Corporation) C:\Windows\system32\mstscax.dll
    2020-02-11 11:18 - 2020-02-05 04:16 - 001030144 _____ (Microsoft Corporation) C:\Windows\system32\termsrv.dll
    2020-02-11 11:18 - 2020-02-05 04:15 - 002019840 _____ (Microsoft Corporation) C:\Windows\system32\ResetEngine.dll
    2020-02-11 11:18 - 2020-02-05 04:15 - 001609728 _____ (Microsoft Corporation) C:\Windows\system32\rdpcorets.dll
    2020-02-11 11:18 - 2020-02-05 04:14 - 000957440 _____ (Microsoft Corporation) C:\Windows\system32\sppcext.dll
    2020-02-11 11:18 - 2020-02-05 04:13 - 004054016 _____ (Microsoft Corporation) C:\Windows\system32\msi.dll
    2020-02-11 11:18 - 2020-02-05 04:13 - 003613696 _____ (Microsoft Corporation) C:\Windows\system32\win32kfull.sys
    2020-02-11 11:18 - 2020-02-05 04:13 - 001364992 _____ (Microsoft Corporation) C:\Windows\system32\bcastdvruserservice.dll
    2020-02-11 11:18 - 2020-02-05 04:13 - 000878592 _____ (Microsoft Corporation) C:\Windows\system32\CPFilters.dll
    2020-02-11 11:18 - 2020-02-05 04:13 - 000577024 _____ (Microsoft Corporation) C:\Windows\system32\SppExtComObj.Exe
    2020-02-11 11:18 - 2020-02-05 04:12 - 001290240 _____ (Microsoft Corporation) C:\Windows\system32\werconcpl.dll
    2020-02-11 11:18 - 2020-02-05 04:12 - 000440832 _____ (Microsoft Corporation) C:\Windows\system32\LockAppBroker.dll
    2020-02-11 11:18 - 2020-02-05 03:07 - 001628488 _____ (Microsoft Corporation) C:\Windows\SysWOW64\user32.dll
    2020-02-11 11:18 - 2020-02-05 03:06 - 020402192 _____ (Microsoft Corporation) C:\Windows\SysWOW64\shell32.dll
    2020-02-11 11:18 - 2020-02-05 02:50 - 007992832 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mstscax.dll
    2020-02-11 11:18 - 2020-02-05 02:48 - 002881536 _____ (Microsoft Corporation) C:\Windows\SysWOW64\win32kfull.sys
    2020-02-11 11:18 - 2020-02-05 02:48 - 000901120 _____ (Microsoft Corporation) C:\Windows\SysWOW64\sppcext.dll
    2020-02-11 11:18 - 2020-02-05 02:48 - 000704000 _____ (Microsoft Corporation) C:\Windows\SysWOW64\CPFilters.dll
    2020-02-11 11:18 - 2020-02-05 02:48 - 000375808 _____ (Microsoft Corporation) C:\Windows\SysWOW64\LockAppBroker.dll
    2020-02-11 11:18 - 2020-02-05 02:47 - 004053504 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msi.dll
    2020-02-11 11:18 - 2020-02-04 23:42 - 003180080 _____ (Microsoft Corporation) C:\Windows\system32\d3d11.dll
    2020-02-11 11:18 - 2020-02-04 23:42 - 001613096 _____ (Microsoft Corporation) C:\Windows\system32\D3D12.dll
    2020-02-11 11:18 - 2020-02-04 23:41 - 001299168 _____ (Microsoft Corporation) C:\Windows\SysWOW64\D3D12.dll
    2020-02-11 11:18 - 2020-02-04 23:40 - 002417952 _____ (Microsoft Corporation) C:\Windows\SysWOW64\d3d11.dll
    2020-02-11 11:18 - 2020-02-04 23:25 - 001035040 _____ (Microsoft Corporation) C:\Windows\system32\ApplyTrustOffline.exe
    2020-02-11 11:18 - 2020-02-04 23:23 - 001224504 _____ (Microsoft Corporation) C:\Windows\system32\hvix64.exe
    2020-02-11 11:18 - 2020-02-04 23:23 - 001027384 _____ (Microsoft Corporation) C:\Windows\system32\hvax64.exe
    2020-02-11 11:18 - 2020-02-04 23:23 - 000568104 _____ (Microsoft Corporation) C:\Windows\system32\tcblaunch.exe
    2020-02-11 11:18 - 2020-02-04 23:23 - 000491208 _____ (Microsoft Corporation) C:\Windows\system32\mf.dll
    2020-02-11 11:18 - 2020-02-04 23:23 - 000324928 _____ (Microsoft Corporation) C:\Windows\system32\wow64.dll
    2020-02-11 11:18 - 2020-02-04 23:22 - 000777304 _____ (Microsoft Corporation) C:\Windows\system32\wer.dll
    2020-02-11 11:18 - 2020-02-04 23:22 - 000495416 _____ (Microsoft Corporation) C:\Windows\system32\WerFault.exe
    2020-02-11 11:18 - 2020-02-04 23:22 - 000441072 _____ (Microsoft Corporation) C:\Windows\system32\Faultrep.dll
    2020-02-11 11:18 - 2020-02-04 23:21 - 004404720 _____ (Microsoft Corporation) C:\Windows\system32\mfcore.dll
    2020-02-11 11:18 - 2020-02-04 23:21 - 002811192 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\dxgkrnl.sys
    2020-02-11 11:18 - 2020-02-04 23:21 - 002371296 _____ (Microsoft Corporation) C:\Windows\system32\msmpeg2vdec.dll
    2020-02-11 11:18 - 2020-02-04 23:21 - 001943128 _____ (Microsoft Corporation) C:\Windows\system32\ntdll.dll
    2020-02-11 11:18 - 2020-02-04 23:21 - 001934808 _____ (Microsoft Corporation) C:\Windows\system32\AudioEng.dll
    2020-02-11 11:18 - 2020-02-04 23:21 - 001780352 _____ (Microsoft Corporation) C:\Windows\system32\mfasfsrcsnk.dll
    2020-02-11 11:18 - 2020-02-04 23:21 - 001459120 _____ (Microsoft Corporation) C:\Windows\system32\winload.efi
    2020-02-11 11:18 - 2020-02-04 23:21 - 001285432 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\ndis.sys
    2020-02-11 11:18 - 2020-02-04 23:21 - 001260776 _____ (Microsoft Corporation) C:\Windows\system32\winload.exe
    2020-02-11 11:18 - 2020-02-04 23:21 - 001209696 _____ (Microsoft Corporation) C:\Windows\system32\AudioSes.dll
    2020-02-11 11:18 - 2020-02-04 23:21 - 001141504 _____ (Microsoft Corporation) C:\Windows\system32\winresume.efi
    2020-02-11 11:18 - 2020-02-04 23:21 - 001098064 _____ (Microsoft Corporation) C:\Windows\system32\msvproc.dll
    2020-02-11 11:18 - 2020-02-04 23:21 - 001032968 _____ (Microsoft Corporation) C:\Windows\system32\ClipSVC.dll
    2020-02-11 11:18 - 2020-02-04 23:21 - 000983936 _____ (Microsoft Corporation) C:\Windows\system32\winresume.exe
    2020-02-11 11:18 - 2020-02-04 23:21 - 000930616 _____ (Microsoft Corporation) C:\Windows\system32\WWAHost.exe
    2020-02-11 11:18 - 2020-02-04 23:21 - 000791352 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\dxgmms2.sys
    2020-02-11 11:18 - 2020-02-04 23:21 - 000694184 _____ (Microsoft Corporation) C:\Windows\system32\StructuredQuery.dll
    2020-02-11 11:18 - 2020-02-04 23:21 - 000605496 _____ (Microsoft Corporation) C:\Windows\system32\securekernel.exe
    2020-02-11 11:18 - 2020-02-04 23:21 - 000594032 _____ (Microsoft Corporation) C:\Windows\system32\audiodg.exe
    2020-02-11 11:18 - 2020-02-04 23:21 - 000550520 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mf.dll
    2020-02-11 11:18 - 2020-02-04 23:21 - 000383288 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\clfs.sys
    2020-02-11 11:18 - 2020-02-04 23:21 - 000260800 _____ (Microsoft Corporation) C:\Windows\system32\mfps.dll
    2020-02-11 11:18 - 2020-02-04 23:20 - 000665736 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wer.dll
    2020-02-11 11:18 - 2020-02-04 23:19 - 006054320 _____ (Microsoft Corporation) C:\Windows\SysWOW64\windows.storage.dll
    2020-02-11 11:18 - 2020-02-04 23:19 - 004790184 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mfcore.dll
    2020-02-11 11:18 - 2020-02-04 23:19 - 002331480 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msmpeg2vdec.dll
    2020-02-11 11:18 - 2020-02-04 23:19 - 001805656 _____ (Microsoft Corporation) C:\Windows\SysWOW64\AudioEng.dll
    2020-02-11 11:18 - 2020-02-04 23:19 - 001620472 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ntdll.dll
    2020-02-11 11:18 - 2020-02-04 23:19 - 001379280 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mfasfsrcsnk.dll
    2020-02-11 11:18 - 2020-02-04 23:19 - 001130568 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msvproc.dll
    2020-02-11 11:18 - 2020-02-04 23:19 - 001011872 _____ (Microsoft Corporation) C:\Windows\SysWOW64\AudioSes.dll
    2020-02-11 11:18 - 2020-02-04 23:19 - 000829752 _____ (Microsoft Corporation) C:\Windows\SysWOW64\WWAHost.exe
    2020-02-11 11:18 - 2020-02-04 23:19 - 000538704 _____ (Microsoft Corporation) C:\Windows\SysWOW64\StructuredQuery.dll
    2020-02-11 11:18 - 2020-02-04 23:02 - 006647296 _____ (Microsoft Corporation) C:\Windows\SysWOW64\BingMaps.dll
    2020-02-11 11:18 - 2020-02-04 23:02 - 002700800 _____ (Microsoft Corporation) C:\Windows\SysWOW64\tquery.dll
    2020-02-11 11:18 - 2020-02-04 23:01 - 005883904 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mos.dll
    2020-02-11 11:18 - 2020-02-04 23:01 - 002969600 _____ (Microsoft Corporation) C:\Windows\SysWOW64\cdp.dll
    2020-02-11 11:18 - 2020-02-04 23:00 - 003687936 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript9.dll
    2020-02-11 11:18 - 2020-02-04 22:59 - 009084928 _____ (Microsoft Corporation) C:\Windows\system32\BingMaps.dll
    2020-02-11 11:18 - 2020-02-04 22:59 - 007057920 _____ (Microsoft Corporation) C:\Windows\system32\mos.dll
    2020-02-11 11:18 - 2020-02-04 22:58 - 005307392 _____ (Microsoft Corporation) C:\Windows\SysWOW64\d2d1.dll
    2020-02-11 11:18 - 2020-02-04 22:58 - 002258432 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mssrch.dll
    2020-02-11 11:18 - 2020-02-04 22:58 - 001540096 _____ (Microsoft Corporation) C:\Windows\SysWOW64\rdpserverbase.dll
    2020-02-11 11:18 - 2020-02-04 22:58 - 000608768 _____ (Microsoft Corporation) C:\Windows\SysWOW64\EdgeManager.dll
    2020-02-11 11:18 - 2020-02-04 22:57 - 004382720 _____ (Microsoft Corporation) C:\Windows\system32\EdgeContent.dll
    2020-02-11 11:18 - 2020-02-04 22:57 - 003403264 _____ (Microsoft Corporation) C:\Windows\system32\AppXDeploymentServer.dll
    2020-02-11 11:18 - 2020-02-04 22:57 - 002449408 _____ (Microsoft Corporation) C:\Windows\SysWOW64\MapRouter.dll
    2020-02-11 11:18 - 2020-02-04 22:56 - 003392512 _____ (Microsoft Corporation) C:\Windows\system32\tquery.dll
    2020-02-11 11:18 - 2020-02-04 22:56 - 000859136 _____ (Microsoft Corporation) C:\Windows\SysWOW64\SearchIndexer.exe
    2020-02-11 11:18 - 2020-02-04 22:56 - 000669696 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript.dll
    2020-02-11 11:18 - 2020-02-04 22:56 - 000162304 _____ (Microsoft Corporation) C:\Windows\system32\dssvc.dll
    2020-02-11 11:18 - 2020-02-04 22:55 - 006031360 _____ (Microsoft Corporation) C:\Windows\system32\d2d1.dll
    2020-02-11 11:18 - 2020-02-04 22:55 - 004849664 _____ (Microsoft Corporation) C:\Windows\system32\jscript9.dll
    2020-02-11 11:18 - 2020-02-04 22:55 - 001765888 _____ (Microsoft Corporation) C:\Windows\system32\audiosrv.dll
    2020-02-11 11:18 - 2020-02-04 22:55 - 000894464 _____ (Microsoft Corporation) C:\Windows\system32\webplatstorageserver.dll
    2020-02-11 11:18 - 2020-02-04 22:55 - 000795648 _____ (Microsoft Corporation) C:\Windows\SysWOW64\Windows.Security.Authentication.OnlineId.dll
    2020-02-11 11:18 - 2020-02-04 22:55 - 000782336 _____ (Microsoft Corporation) C:\Windows\SysWOW64\kerberos.dll
    2020-02-11 11:18 - 2020-02-04 22:55 - 000713216 _____ (Microsoft Corporation) C:\Windows\SysWOW64\BingOnlineServices.dll
    2020-02-11 11:18 - 2020-02-04 22:54 - 003381248 _____ (Microsoft Corporation) C:\Windows\system32\MapRouter.dll
    2020-02-11 11:18 - 2020-02-04 22:54 - 003093504 _____ (Microsoft Corporation) C:\Windows\system32\diagtrack.dll
    2020-02-11 11:18 - 2020-02-04 22:54 - 002929152 _____ (Microsoft Corporation) C:\Windows\system32\xpsservices.dll
    2020-02-11 11:18 - 2020-02-04 22:54 - 002825728 _____ (Microsoft Corporation) C:\Windows\system32\MapGeocoder.dll
    2020-02-11 11:18 - 2020-02-04 22:54 - 001932288 _____ (Microsoft Corporation) C:\Windows\system32\edgeangle.dll
    2020-02-11 11:18 - 2020-02-04 22:54 - 001549824 _____ (Microsoft Corporation) C:\Windows\system32\lsasrv.dll
    2020-02-11 11:18 - 2020-02-04 22:54 - 001218048 _____ (Microsoft Corporation) C:\Windows\system32\rdpcore.dll
    2020-02-11 11:18 - 2020-02-04 22:54 - 000808960 _____ (Microsoft Corporation) C:\Windows\system32\EdgeManager.dll
    2020-02-11 11:18 - 2020-02-04 22:54 - 000396800 _____ (Microsoft Corporation) C:\Windows\system32\profsvc.dll
    2020-02-11 11:18 - 2020-02-04 22:53 - 002922496 _____ (Microsoft Corporation) C:\Windows\system32\wuaueng.dll
    2020-02-11 11:18 - 2020-02-04 22:53 - 002739200 _____ (Microsoft Corporation) C:\Windows\system32\mssrch.dll
    2020-02-11 11:18 - 2020-02-04 22:53 - 002179584 _____ (Microsoft Corporation) C:\Windows\system32\AppXDeploymentExtensions.onecore.dll
    2020-02-11 11:18 - 2020-02-04 22:53 - 001563648 _____ (Microsoft Corporation) C:\Windows\system32\AppXDeploymentExtensions.desktop.dll
    2020-02-11 11:18 - 2020-02-04 22:53 - 001023488 _____ (Microsoft Corporation) C:\Windows\system32\ShareHost.dll
    2020-02-11 11:18 - 2020-02-04 22:53 - 000686592 _____ (Microsoft Corporation) C:\Windows\system32\AudioEndpointBuilder.dll
    2020-02-11 11:18 - 2020-02-04 22:53 - 000491520 _____ (Microsoft Corporation) C:\Windows\system32\defragsvc.dll
    2020-02-11 11:18 - 2020-02-04 22:52 - 002379264 _____ (Microsoft Corporation) C:\Windows\system32\WebRuntimeManager.dll
    2020-02-11 11:18 - 2020-02-04 22:52 - 002161152 _____ (Microsoft Corporation) C:\Windows\system32\win32kbase.sys
    2020-02-11 11:18 - 2020-02-04 22:52 - 001264640 _____ (Microsoft Corporation) C:\Windows\system32\JpMapControl.dll
    2020-02-11 11:18 - 2020-02-04 22:52 - 001225216 _____ (Microsoft Corporation) C:\Windows\system32\MapsStore.dll
    2020-02-11 11:18 - 2020-02-04 22:52 - 001059840 _____ (Microsoft Corporation) C:\Windows\system32\SearchIndexer.exe
    2020-02-11 11:18 - 2020-02-04 22:51 - 001724928 _____ (Microsoft Corporation) C:\Windows\system32\rdpserverbase.dll
    2020-02-11 11:18 - 2020-02-04 22:51 - 001421312 _____ (Microsoft Corporation) C:\Windows\system32\rdpbase.dll
    2020-02-11 11:18 - 2020-02-04 22:51 - 001084928 _____ (Microsoft Corporation) C:\Windows\system32\wifinetworkmanager.dll
    2020-02-11 11:18 - 2020-02-04 22:51 - 000943616 _____ (Microsoft Corporation) C:\Windows\system32\BingOnlineServices.dll
    2020-02-11 11:18 - 2020-02-04 22:51 - 000927232 _____ (Microsoft Corporation) C:\Windows\system32\MsSpellCheckingFacility.dll
    2020-02-11 11:18 - 2020-02-04 22:51 - 000910848 _____ (Microsoft Corporation) C:\Windows\system32\kerberos.dll
    2020-02-11 11:18 - 2020-02-04 22:51 - 000896000 _____ (Microsoft Corporation) C:\Windows\system32\Windows.Security.Authentication.OnlineId.dll
    2020-02-11 11:18 - 2020-02-04 22:51 - 000884736 _____ (Microsoft Corporation) C:\Windows\system32\MapControlCore.dll
    2020-02-11 11:18 - 2020-02-04 22:51 - 000884224 _____ (Microsoft Corporation) C:\Windows\system32\NMAA.dll
    2020-02-11 11:18 - 2020-02-04 22:51 - 000776704 _____ (Microsoft Corporation) C:\Windows\system32\jscript.dll
    2020-02-11 11:18 - 2020-02-04 22:51 - 000637440 _____ (Microsoft Corporation) C:\Windows\system32\cdpsvc.dll
    2020-02-11 11:18 - 2020-01-07 02:06 - 001726480 _____ (Microsoft Corporation) C:\Windows\system32\appraiser.dll
    2020-02-11 11:18 - 2020-01-07 02:05 - 000747528 _____ (Microsoft Corporation) C:\Windows\system32\aeinv.dll
    2020-02-11 11:18 - 2020-01-07 02:05 - 000638480 _____ (Microsoft Corporation) C:\Windows\system32\devinv.dll
    2020-02-11 11:18 - 2020-01-07 02:05 - 000465424 _____ (Microsoft Corporation) C:\Windows\system32\invagent.dll
    2020-02-11 11:18 - 2020-01-07 02:05 - 000324624 _____ (Microsoft Corporation) C:\Windows\system32\acmigration.dll
    2020-02-11 11:18 - 2020-01-07 01:53 - 004103224 _____ (Microsoft Corporation) C:\Windows\explorer.exe
    2020-02-11 11:18 - 2020-01-07 01:52 - 000288872 _____ (Microsoft Corporation) C:\Windows\system32\wscapi.dll
    2020-02-11 11:18 - 2020-01-07 01:47 - 001517176 _____ (Microsoft Corporation) C:\Windows\system32\msctf.dll
    2020-02-11 11:18 - 2020-01-07 01:47 - 000790928 _____ (Microsoft Corporation) C:\Windows\system32\fontdrvhost.exe
    2020-02-11 11:18 - 2020-01-07 01:30 - 006603776 _____ (Microsoft Corporation) C:\Windows\system32\twinui.dll
    2020-02-11 11:18 - 2020-01-07 01:28 - 000093696 _____ (Microsoft Corporation) C:\Windows\system32\msfeedsbs.dll
    2020-02-11 11:18 - 2020-01-07 01:24 - 001262592 _____ (Microsoft Corporation) C:\Windows\system32\SystemSettings.Handlers.dll
    2020-02-11 11:18 - 2020-01-07 00:33 - 001320336 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msctf.dll
    2020-02-11 11:18 - 2020-01-07 00:33 - 000662840 _____ (Microsoft Corporation) C:\Windows\SysWOW64\fontdrvhost.exe
    2020-02-11 11:18 - 2020-01-07 00:31 - 003755408 _____ (Microsoft Corporation) C:\Windows\SysWOW64\explorer.exe
    2020-02-11 11:18 - 2020-01-07 00:21 - 005670400 _____ (Microsoft Corporation) C:\Windows\SysWOW64\twinui.dll
    2020-02-11 11:18 - 2020-01-07 00:19 - 000080896 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msfeedsbs.dll
    2020-02-11 11:18 - 2020-01-06 20:18 - 000376848 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\pci.sys
    2020-02-11 11:18 - 2020-01-06 20:11 - 000797984 _____ (Microsoft Corporation) C:\Windows\system32\SecurityHealthService.exe
    2020-02-11 11:18 - 2020-01-06 20:11 - 000266040 _____ (Microsoft Corporation) C:\Windows\system32\SecurityHealthAgent.dll
    2020-02-11 11:18 - 2020-01-06 20:08 - 002773088 _____ (Microsoft Corporation) C:\Windows\system32\iertutil.dll
    2020-02-11 11:18 - 2020-01-06 20:08 - 002711352 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\tcpip.sys
    2020-02-11 11:18 - 2020-01-06 20:08 - 002421768 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\ntfs.sys
    2020-02-11 11:18 - 2020-01-06 20:08 - 001030672 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\http.sys
    2020-02-11 11:18 - 2020-01-06 20:08 - 000722744 _____ (Microsoft Corporation) C:\Windows\system32\SettingsHandlers_StorageSense.dll
    2020-02-11 11:18 - 2020-01-06 20:01 - 002261448 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iertutil.dll
    2020-02-11 11:18 - 2020-01-06 19:42 - 003553792 _____ (Microsoft Corporation) C:\Windows\SysWOW64\InputService.dll
    2020-02-11 11:18 - 2020-01-06 19:41 - 000150528 _____ (Microsoft Corporation) C:\Windows\system32\SettingsHandlers_BackgroundApps.dll
    2020-02-11 11:18 - 2020-01-06 19:40 - 000384512 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieproxy.dll
    2020-02-11 11:18 - 2020-01-06 19:39 - 002789376 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msftedit.dll
    2020-02-11 11:18 - 2020-01-06 19:39 - 000203264 _____ (Microsoft Corporation) C:\Windows\system32\SettingsHandlers_CapabilityAccess.dll
    2020-02-11 11:18 - 2020-01-06 19:39 - 000154112 _____ (Microsoft Corporation) C:\Windows\system32\SettingsHandlers_AppExecutionAlias.dll
    2020-02-11 11:18 - 2020-01-06 19:38 - 001655296 _____ (Microsoft Corporation) C:\Windows\SysWOW64\winmsipc.dll
    2020-02-11 11:18 - 2020-01-06 19:38 - 001644032 _____ (Microsoft Corporation) C:\Windows\SysWOW64\urlmon.dll
    2020-02-11 11:18 - 2020-01-06 19:38 - 000537088 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ActivationManager.dll
    2020-02-11 11:18 - 2020-01-06 19:38 - 000487936 _____ (Microsoft Corporation) C:\Windows\system32\MusNotification.exe
    2020-02-11 11:18 - 2020-01-06 19:38 - 000463872 _____ (Microsoft Corporation) C:\Windows\system32\cloudAP.dll
    2020-02-11 11:18 - 2020-01-06 19:38 - 000229888 _____ (Microsoft Corporation) C:\Windows\system32\SettingsHandlers_Geolocation.dll
    2020-02-11 11:18 - 2020-01-06 19:37 - 004771328 _____ (Microsoft Corporation) C:\Windows\system32\InputService.dll
    2020-02-11 11:18 - 2020-01-06 19:37 - 000369152 _____ (Microsoft Corporation) C:\Windows\system32\MusNotificationUx.exe
    2020-02-11 11:18 - 2020-01-06 19:37 - 000272896 _____ (Microsoft Corporation) C:\Windows\system32\Windows.UI.AppDefaults.dll
    2020-02-11 11:18 - 2020-01-06 19:36 - 000929280 _____ (Microsoft Corporation) C:\Windows\system32\MusUpdateHandlers.dll
    2020-02-11 11:18 - 2020-01-06 19:35 - 000517632 _____ (Microsoft Corporation) C:\Windows\system32\SettingsHandlers_Notifications.dll
    2020-02-11 11:18 - 2020-01-06 19:35 - 000498688 _____ (Microsoft Corporation) C:\Windows\system32\CredProvDataModel.dll
    2020-02-11 11:18 - 2020-01-06 19:34 - 003348992 _____ (Microsoft Corporation) C:\Windows\system32\msftedit.dll
    2020-02-11 11:18 - 2020-01-06 19:34 - 000933888 _____ (Microsoft Corporation) C:\Windows\system32\rasapi32.dll
    2020-02-11 11:18 - 2020-01-06 19:34 - 000863744 _____ (Microsoft Corporation) C:\Windows\system32\ieproxy.dll
    2020-02-11 11:18 - 2020-01-06 19:33 - 002328064 _____ (Microsoft Corporation) C:\Windows\system32\winmsipc.dll
    2020-02-11 11:18 - 2020-01-06 19:33 - 001821184 _____ (Microsoft Corporation) C:\Windows\system32\urlmon.dll
    2020-02-11 11:18 - 2020-01-06 19:33 - 001458688 _____ (Microsoft Corporation) C:\Windows\system32\dosvc.dll
    2020-02-11 11:18 - 2020-01-06 19:33 - 001419776 _____ (Microsoft Corporation) C:\Windows\system32\usocore.dll
    2020-02-11 11:18 - 2020-01-06 19:33 - 001222656 _____ (Microsoft Corporation) C:\Windows\system32\NotificationController.dll
    2020-02-11 11:18 - 2020-01-06 19:33 - 000663040 _____ (Microsoft Corporation) C:\Windows\system32\ActivationManager.dll
    2020-02-11 11:18 - 2020-01-06 19:33 - 000629760 _____ (Microsoft Corporation) C:\Windows\system32\updatehandlers.dll
    2020-02-11 11:18 - 2020-01-06 19:33 - 000506368 _____ (Microsoft Corporation) C:\Windows\system32\edgeIso.dll
    2020-02-11 11:18 - 2019-08-07 00:08 - 000710232 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\cng.sys
    2020-02-11 11:17 - 2020-02-05 04:42 - 000506088 _____ (Microsoft Corporation) C:\Windows\system32\systemreset.exe
    2020-02-11 11:17 - 2020-02-05 04:39 - 000094224 _____ (Microsoft Corporation) C:\Windows\system32\rdpudd.dll
    2020-02-11 11:17 - 2020-02-05 04:20 - 000064000 _____ (Microsoft Corporation) C:\Windows\system32\iemigplugin.dll
    2020-02-11 11:17 - 2020-02-05 04:19 - 000008704 _____ (Microsoft Corporation) C:\Windows\system32\f3ahvoas.dll
    2020-02-11 11:17 - 2020-02-05 04:18 - 000172544 _____ (Microsoft Corporation) C:\Windows\system32\rdsdwmdr.dll
    2020-02-11 11:17 - 2020-02-05 04:18 - 000106496 _____ (Microsoft Corporation) C:\Windows\system32\fdSSDP.dll
    2020-02-11 11:17 - 2020-02-05 04:17 - 000056832 _____ (Microsoft Corporation) C:\Windows\system32\SrTasks.exe
    2020-02-11 11:17 - 2020-02-05 04:16 - 000810496 _____ C:\Windows\system32\MBR2GPT.EXE
    2020-02-11 11:17 - 2020-02-05 04:16 - 000575488 _____ (Microsoft Corporation) C:\Windows\system32\dfrgui.exe
    2020-02-11 11:17 - 2020-02-05 04:16 - 000247808 _____ (Microsoft Corporation) C:\Windows\system32\srrstr.dll
    2020-02-11 11:17 - 2020-02-05 04:16 - 000192512 _____ (Microsoft Corporation) C:\Windows\system32\recdisc.exe
    2020-02-11 11:17 - 2020-02-05 04:16 - 000147456 _____ (Microsoft Corporation) C:\Windows\system32\sdrsvc.dll
    2020-02-11 11:17 - 2020-02-05 04:16 - 000091136 _____ (Microsoft Corporation) C:\Windows\system32\wsqmcons.exe
    2020-02-11 11:17 - 2020-02-05 04:15 - 001194496 _____ (Microsoft Corporation) C:\Windows\system32\sdengin2.dll
    2020-02-11 11:17 - 2020-02-05 04:15 - 000625152 _____ (Microsoft Corporation) C:\Windows\system32\BootMenuUX.dll
    2020-02-11 11:17 - 2020-02-05 04:15 - 000482304 _____ (Microsoft Corporation) C:\Windows\system32\srcore.dll
    2020-02-11 11:17 - 2020-02-05 04:15 - 000308224 _____ (Microsoft Corporation) C:\Windows\system32\tapisrv.dll
    2020-02-11 11:17 - 2020-02-05 04:15 - 000266752 _____ (Microsoft Corporation) C:\Windows\system32\rstrui.exe
    2020-02-11 11:17 - 2020-02-05 04:15 - 000120832 _____ (Microsoft Corporation) C:\Windows\system32\wercplsupport.dll
    2020-02-11 11:17 - 2020-02-05 04:14 - 001211904 _____ (Microsoft Corporation) C:\Windows\system32\sdclt.exe
    2020-02-11 11:17 - 2020-02-05 04:14 - 000489472 _____ (Microsoft Corporation) C:\Windows\system32\werui.dll
    2020-02-11 11:17 - 2020-02-05 04:14 - 000420864 _____ (Microsoft Corporation) C:\Windows\system32\rdpclip.exe
    2020-02-11 11:17 - 2020-02-05 04:12 - 001180672 _____ (Microsoft Corporation) C:\Windows\system32\reseteng.dll
    2020-02-11 11:17 - 2020-02-05 04:12 - 000210944 _____ (Microsoft Corporation) C:\Windows\system32\DWWIN.EXE
    2020-02-11 11:17 - 2020-02-05 04:11 - 000174080 _____ (Microsoft Corporation) C:\Windows\system32\ResetEngOnline.dll
    2020-02-11 11:17 - 2020-02-05 04:11 - 000149504 _____ (Microsoft Corporation) C:\Windows\system32\fdWSD.dll
    2020-02-11 11:17 - 2020-02-05 03:02 - 000917816 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ReAgent.dll
    2020-02-11 11:17 - 2020-02-05 02:54 - 000090112 _____ (Microsoft Corporation) C:\Windows\SysWOW64\fdSSDP.dll
    2020-02-11 11:17 - 2020-02-05 02:53 - 000131072 _____ (Microsoft Corporation) C:\Windows\SysWOW64\fdWSD.dll
    2020-02-11 11:17 - 2020-02-05 02:51 - 000561152 _____ (Microsoft Corporation) C:\Windows\SysWOW64\dfrgui.exe
    2020-02-11 11:17 - 2020-02-05 02:49 - 000425984 _____ (Microsoft Corporation) C:\Windows\SysWOW64\werui.dll
    2020-02-11 11:17 - 2020-02-05 02:49 - 000176640 _____ (Microsoft Corporation) C:\Windows\SysWOW64\DWWIN.EXE
    2020-02-11 11:17 - 2020-02-05 02:48 - 000254464 _____ (Microsoft Corporation) C:\Windows\SysWOW64\tapisrv.dll
    2020-02-11 11:17 - 2020-02-04 23:23 - 000722744 _____ (Microsoft Corporation) C:\Windows\system32\wimgapi.dll
    2020-02-11 11:17 - 2020-02-04 23:23 - 000527376 _____ (Microsoft Corporation) C:\Windows\system32\wimserv.exe
    2020-02-11 11:17 - 2020-02-04 23:23 - 000405816 _____ (Microsoft Corporation) C:\Windows\system32\wifitask.exe
    2020-02-11 11:17 - 2020-02-04 23:23 - 000076088 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\hvservice.sys
    2020-02-11 11:17 - 2020-02-04 23:22 - 000248880 _____ (Microsoft Corporation) C:\Windows\system32\weretw.dll
    2020-02-11 11:17 - 2020-02-04 23:22 - 000210448 _____ (Microsoft Corporation) C:\Windows\system32\wermgr.exe
    2020-02-11 11:17 - 2020-02-04 23:22 - 000159656 _____ (Microsoft Corporation) C:\Windows\system32\WerFaultSecure.exe
    2020-02-11 11:17 - 2020-02-04 23:21 - 000413720 _____ (Microsoft Corporation) C:\Windows\system32\AUDIOKSE.dll
    2020-02-11 11:17 - 2020-02-04 23:21 - 000412984 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\dxgmms1.sys
    2020-02-11 11:17 - 2020-02-04 23:21 - 000335672 _____ (Microsoft Corporation) C:\Windows\system32\moshostcore.dll
    2020-02-11 11:17 - 2020-02-04 23:20 - 000435512 _____ (Microsoft Corporation) C:\Windows\SysWOW64\WerFault.exe
    2020-02-11 11:17 - 2020-02-04 23:20 - 000385784 _____ (Microsoft Corporation) C:\Windows\SysWOW64\Faultrep.dll
    2020-02-11 11:17 - 2020-02-04 23:20 - 000192312 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wermgr.exe
    2020-02-11 11:17 - 2020-02-04 23:20 - 000146712 _____ (Microsoft Corporation) C:\Windows\SysWOW64\WerFaultSecure.exe
    2020-02-11 11:17 - 2020-02-04 23:19 - 000607544 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wimgapi.dll
    2020-02-11 11:17 - 2020-02-04 23:19 - 000385816 _____ (Microsoft Corporation) C:\Windows\SysWOW64\AUDIOKSE.dll
    2020-02-11 11:17 - 2020-02-04 23:19 - 000129296 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mfps.dll
    2020-02-11 11:17 - 2020-02-04 23:00 - 001361408 _____ (Microsoft Corporation) C:\Windows\SysWOW64\MSPhotography.dll
    2020-02-11 11:17 - 2020-02-04 23:00 - 000074240 _____ (Microsoft Corporation) C:\Windows\SysWOW64\dtdump.exe
    2020-02-11 11:17 - 2020-02-04 23:00 - 000037888 _____ (Microsoft Corporation) C:\Windows\SysWOW64\Websocket.dll
    2020-02-11 11:17 - 2020-02-04 23:00 - 000032768 _____ (Microsoft Corporation) C:\Windows\SysWOW64\werdiagcontroller.dll
    2020-02-11 11:17 - 2020-02-04 22:59 - 001295360 _____ (Microsoft Corporation) C:\Windows\SysWOW64\MSVPXENC.dll
    2020-02-11 11:17 - 2020-02-04 22:59 - 000392704 _____ (Microsoft Corporation) C:\Windows\SysWOW64\MapConfiguration.dll
    2020-02-11 11:17 - 2020-02-04 22:59 - 000365568 _____ (Microsoft Corporation) C:\Windows\SysWOW64\rdpencom.dll
    2020-02-11 11:17 - 2020-02-04 22:59 - 000288768 _____ (Microsoft Corporation) C:\Windows\SysWOW64\Search.ProtocolHandler.MAPI2.dll
    2020-02-11 11:17 - 2020-02-04 22:59 - 000071168 _____ (Microsoft Corporation) C:\Windows\SysWOW64\keyiso.dll
    2020-02-11 11:17 - 2020-02-04 22:59 - 000052736 _____ (Microsoft Corporation) C:\Windows\SysWOW64\rtutils.dll
    2020-02-11 11:17 - 2020-02-04 22:58 - 001986560 _____ (Microsoft Corporation) C:\Windows\SysWOW64\MapGeocoder.dll
    2020-02-11 11:17 - 2020-02-04 22:58 - 000578560 _____ (Microsoft Corporation) C:\Windows\SysWOW64\webplatstorageserver.dll
    2020-02-11 11:17 - 2020-02-04 22:58 - 000144384 _____ (Microsoft Corporation) C:\Windows\system32\mssprxy.dll
    2020-02-11 11:17 - 2020-02-04 22:58 - 000094720 _____ (Microsoft Corporation) C:\Windows\system32\MapsCSP.dll
    2020-02-11 11:17 - 2020-02-04 22:57 - 001862656 _____ (Microsoft Corporation) C:\Windows\SysWOW64\xpsservices.dll
    2020-02-11 11:17 - 2020-02-04 22:57 - 001236480 _____ (Microsoft Corporation) C:\Windows\SysWOW64\rdpbase.dll
    2020-02-11 11:17 - 2020-02-04 22:57 - 000185856 _____ (Microsoft Corp.) C:\Windows\system32\Defrag.exe
    2020-02-11 11:17 - 2020-02-04 22:57 - 000099328 _____ (Microsoft Corporation) C:\Windows\system32\utcutil.dll
    2020-02-11 11:17 - 2020-02-04 22:57 - 000046080 _____ (Microsoft Corporation) C:\Windows\system32\Websocket.dll
    2020-02-11 11:17 - 2020-02-04 22:56 - 001076736 _____ (Microsoft Corporation) C:\Windows\SysWOW64\rdpcore.dll
    2020-02-11 11:17 - 2020-02-04 22:56 - 000978944 _____ (Microsoft Corporation) C:\Windows\SysWOW64\JpMapControl.dll
    2020-02-11 11:17 - 2020-02-04 22:56 - 000848384 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ShareHost.dll
    2020-02-11 11:17 - 2020-02-04 22:56 - 000735744 _____ (Microsoft Corporation) C:\Windows\SysWOW64\MsSpellCheckingFacility.dll
    2020-02-11 11:17 - 2020-02-04 22:56 - 000530432 _____ (Microsoft Corporation) C:\Windows\system32\MapConfiguration.dll
    2020-02-11 11:17 - 2020-02-04 22:56 - 000409088 _____ (Microsoft Corporation) C:\Windows\system32\rdpencom.dll
    2020-02-11 11:17 - 2020-02-04 22:56 - 000395776 _____ (Microsoft Corporation) C:\Windows\system32\Search.ProtocolHandler.MAPI2.dll
    2020-02-11 11:17 - 2020-02-04 22:56 - 000334336 _____ (Microsoft Corporation) C:\Windows\system32\NmaDirect.dll
    2020-02-11 11:17 - 2020-02-04 22:56 - 000326144 _____ (Microsoft Corporation) C:\Windows\system32\SettingsHandlers_Flights.dll
    2020-02-11 11:17 - 2020-02-04 22:56 - 000227328 _____ (Microsoft Corporation) C:\Windows\system32\SearchFilterHost.exe
    2020-02-11 11:17 - 2020-02-04 22:56 - 000203264 _____ (Microsoft Corporation) C:\Windows\system32\wersvc.dll
    2020-02-11 11:17 - 2020-02-04 22:56 - 000145408 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mssph.dll
    2020-02-11 11:17 - 2020-02-04 22:56 - 000064000 _____ (Microsoft Corporation) C:\Windows\system32\rtutils.dll
    2020-02-11 11:17 - 2020-02-04 22:55 - 000735744 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mssvp.dll
    2020-02-11 11:17 - 2020-02-04 22:55 - 000729088 _____ (Microsoft Corporation) C:\Windows\SysWOW64\NMAA.dll
    2020-02-11 11:17 - 2020-02-04 22:55 - 000726528 _____ (Microsoft Corporation) C:\Windows\system32\jscript9diag.dll
    2020-02-11 11:17 - 2020-02-04 22:55 - 000705024 _____ (Microsoft Corporation) C:\Windows\SysWOW64\MapControlCore.dll
    2020-02-11 11:17 - 2020-02-04 22:55 - 000345088 _____ (Microsoft Corporation) C:\Windows\SysWOW64\SearchProtocolHost.exe
    2020-02-11 11:17 - 2020-02-04 22:55 - 000089088 _____ (Microsoft Corporation) C:\Windows\system32\keyiso.dll
    2020-02-11 11:17 - 2020-02-04 22:54 - 001708544 _____ (Microsoft Corporation) C:\Windows\system32\MSPhotography.dll
    2020-02-11 11:17 - 2020-02-04 22:54 - 000972800 _____ (Microsoft Corporation) C:\Windows\system32\sysmain.dll
    2020-02-11 11:17 - 2020-02-04 22:52 - 000604672 _____ (Microsoft Corporation) C:\Windows\system32\ipnathlp.dll
    2020-02-11 11:17 - 2020-02-04 22:51 - 000796672 _____ (Microsoft Corporation) C:\Windows\system32\mssvp.dll
    2020-02-11 11:17 - 2020-02-04 22:51 - 000406528 _____ (Microsoft Corporation) C:\Windows\system32\SearchProtocolHost.exe
    2020-02-11 11:17 - 2020-02-04 22:51 - 000176640 _____ (Microsoft Corporation) C:\Windows\system32\mssph.dll
    2020-02-11 11:17 - 2020-02-04 21:31 - 000001314 _____ C:\Windows\system32\tcbres.wim
    2020-02-11 11:17 - 2020-01-07 01:52 - 000349424 _____ (Microsoft Corporation) C:\Windows\system32\MusNotifyIcon.exe
    2020-02-11 11:17 - 2020-01-07 01:47 - 000396304 _____ (Adobe Systems Incorporated) C:\Windows\system32\atmfd.dll
    2020-02-11 11:17 - 2020-01-07 01:30 - 000123904 _____ (Microsoft Corporation) C:\Windows\system32\fontsub.dll
    2020-02-11 11:17 - 2020-01-07 01:29 - 000914944 _____ (Microsoft Corporation) C:\Windows\system32\SecurityHealthSSO.dll
    2020-02-11 11:17 - 2020-01-07 01:29 - 000058368 _____ (Microsoft Corporation) C:\Windows\system32\RDSPnf.exe
    2020-02-11 11:17 - 2020-01-07 01:28 - 000035328 _____ (Microsoft Corporation) C:\Windows\system32\rasphone.exe
    2020-02-11 11:17 - 2020-01-07 01:26 - 001210368 _____ (Microsoft Corporation) C:\Windows\system32\wscui.cpl
    2020-02-11 11:17 - 2020-01-07 01:26 - 000947200 _____ (Microsoft Corporation) C:\Windows\system32\rasgcw.dll
    2020-02-11 11:17 - 2020-01-07 01:26 - 000265728 _____ (Microsoft Corporation) C:\Windows\system32\wscsvc.dll
    2020-02-11 11:17 - 2020-01-07 01:25 - 000205824 _____ (Microsoft Corporation) C:\Windows\system32\wscinterop.dll
    2020-02-11 11:17 - 2020-01-07 01:24 - 001535488 _____ (Microsoft Corporation) C:\Windows\system32\wbengine.exe
    2020-02-11 11:17 - 2020-01-07 01:24 - 000941056 _____ (Microsoft Corporation) C:\Windows\system32\rasdlg.dll
    2020-02-11 11:17 - 2020-01-07 00:36 - 000256160 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wscapi.dll
    2020-02-11 11:17 - 2020-01-07 00:33 - 000322576 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\atmfd.dll
    2020-02-11 11:17 - 2020-01-07 00:21 - 000098816 _____ (Microsoft Corporation) C:\Windows\SysWOW64\fontsub.dll
    2020-02-11 11:17 - 2020-01-07 00:18 - 000032256 _____ (Microsoft Corporation) C:\Windows\SysWOW64\rasphone.exe
    2020-02-11 11:17 - 2020-01-07 00:17 - 001189376 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wscui.cpl
    2020-02-11 11:17 - 2020-01-07 00:17 - 000159232 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wscinterop.dll
    2020-02-11 11:17 - 2020-01-07 00:16 - 000863744 _____ (Microsoft Corporation) C:\Windows\SysWOW64\rasdlg.dll
    2020-02-11 11:17 - 2020-01-07 00:15 - 000855552 _____ (Microsoft Corporation) C:\Windows\SysWOW64\rasgcw.dll
    2020-02-11 11:17 - 2020-01-06 20:11 - 000094008 _____ (Microsoft Corporation) C:\Windows\system32\SecurityHealthProxyStub.dll
    2020-02-11 11:17 - 2020-01-06 20:08 - 000713480 _____ (Microsoft Corporation) C:\Windows\system32\MSVideoDSP.dll
    2020-02-11 11:17 - 2020-01-06 20:08 - 000243760 _____ (Microsoft Corporation) C:\Windows\system32\logoncli.dll
    2020-02-11 11:17 - 2020-01-06 20:08 - 000051400 _____ (Microsoft Corporation) C:\Windows\system32\svchost.exe
    2020-02-11 11:17 - 2020-01-06 20:07 - 000466744 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\FWPKCLNT.SYS
    2020-02-11 11:17 - 2020-01-06 20:01 - 000186120 _____ (Microsoft Corporation) C:\Windows\SysWOW64\logoncli.dll
    2020-02-11 11:17 - 2020-01-06 20:01 - 000044632 _____ (Microsoft Corporation) C:\Windows\SysWOW64\svchost.exe
    2020-02-11 11:17 - 2020-01-06 20:00 - 000581600 _____ (Microsoft Corporation) C:\Windows\SysWOW64\MSVideoDSP.dll
    2020-02-11 11:17 - 2020-01-06 19:41 - 000331776 _____ (Microsoft Corporation) C:\Windows\SysWOW64\edgeIso.dll
    2020-02-11 11:17 - 2020-01-06 19:40 - 000860160 _____ (Microsoft Corporation) C:\Windows\SysWOW64\rasapi32.dll
    2020-02-11 11:17 - 2020-01-06 19:40 - 000582144 _____ (Microsoft Corporation) C:\Windows\SysWOW64\Windows.UI.Core.TextInput.dll
    2020-02-11 11:17 - 2020-01-06 19:39 - 000659456 _____ (Microsoft Corporation) C:\Windows\SysWOW64\netlogon.dll
    2020-02-11 11:17 - 2020-01-06 19:39 - 000420864 _____ (Microsoft Corporation) C:\Windows\SysWOW64\CredProvDataModel.dll
    2020-02-11 11:17 - 2020-01-06 19:39 - 000415232 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\cldflt.sys
    2020-02-11 11:17 - 2020-01-06 19:39 - 000187904 _____ (Microsoft Corporation) C:\Windows\system32\policymanagerprecheck.dll
    2020-02-11 11:17 - 2020-01-06 19:39 - 000067584 _____ (Microsoft Corporation) C:\Windows\system32\fveskybackup.dll
    2020-02-11 11:17 - 2020-01-06 19:39 - 000051712 _____ (Microsoft Corporation) C:\Windows\system32\DdcAntiTheftApi.dll
    2020-02-11 11:17 - 2020-01-06 19:38 - 000807936 _____ (Microsoft Corporation) C:\Windows\SysWOW64\winipcsecproc.dll
    2020-02-11 11:17 - 2020-01-06 19:38 - 000344576 _____ (Microsoft Corporation) C:\Windows\system32\RasMediaManager.dll
    2020-02-11 11:17 - 2020-01-06 19:38 - 000137728 _____ (Microsoft Corporation) C:\Windows\system32\InputLocaleManager.dll
    2020-02-11 11:17 - 2020-01-06 19:37 - 000318976 _____ (Microsoft Corporation) C:\Windows\system32\DeviceDirectoryClient.dll
    2020-02-11 11:17 - 2020-01-06 19:37 - 000177152 _____ (Microsoft Corporation) C:\Windows\system32\wuuhosdeployment.dll
    2020-02-11 11:17 - 2020-01-06 19:36 - 000499200 _____ (Microsoft Corporation) C:\Windows\system32\winipcfile.dll
    2020-02-11 11:17 - 2020-01-06 19:35 - 000773120 _____ (Microsoft Corporation) C:\Windows\system32\netlogon.dll
    2020-02-11 11:17 - 2020-01-06 19:34 - 000401920 _____ (Microsoft Corporation) C:\Windows\system32\rascustom.dll
    2020-02-11 11:17 - 2020-01-06 19:33 - 000882176 _____ (Microsoft Corporation) C:\Windows\system32\winipcsecproc.dll
    2020-02-11 11:17 - 2020-01-06 19:33 - 000755712 _____ (Microsoft Corporation) C:\Windows\system32\Windows.UI.Core.TextInput.dll
    2020-02-11 11:17 - 2020-01-06 19:33 - 000466432 _____ (Microsoft Corporation) C:\Windows\system32\wuuhext.dll
    2020-02-11 11:17 - 2019-08-07 00:08 - 000170296 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\ksecpkg.sys
    2020-02-07 12:37 - 2020-02-07 12:37 - 000214496 _____ (Malwarebytes) C:\Windows\system32\Drivers\MbamChameleon.sys
    2020-02-01 21:40 - 2020-02-01 21:40 - 000000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\IPVanish
    2020-02-01 21:34 - 2020-02-01 21:35 - 017962448 _____ (Mudhook Marketing, Inc) C:\Users\User\Downloads\IPVanish-3.4.8.17-beta.exe
    2020-02-01 15:50 - 2020-02-01 15:50 - 000000000 ____D C:\ProgramData\VS Revo Group
    2020-02-01 15:49 - 2020-02-01 15:49 - 016701336 _____ (VS Revo Group ) C:\Users\User\Downloads\RevoUninProSetup.exe
    2020-01-31 17:30 - 2020-01-31 17:30 - 000000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\iTunes
    2020-01-31 17:30 - 2020-01-31 17:30 - 000000000 ____D C:\Program Files\iPod
    2020-01-31 17:24 - 2020-01-31 17:30 - 000000000 ____D C:\Program Files\iTunes
    2020-01-30 22:26 - 2020-01-30 22:27 - 000000000 ____D C:\UniConverter
    2020-01-30 22:22 - 2020-01-31 18:41 - 000000000 ____D C:\Users\User\Jessie Stone
    2020-01-26 22:11 - 2020-01-30 14:57 - 000027995 _____ C:\Users\User\Documents\Kylie-Gun Facts.odt

    ==================== One month (modified) ==================

    (If an entry is included in the fixlist, the file/folder will be moved.)

    2020-02-24 15:20 - 2018-06-08 12:03 - 000000000 ____D C:\Users\User\AppData\Roaming\WallpaperMasterPro
    2020-02-24 15:19 - 2018-09-14 18:12 - 000097670 _____ C:\Windows\ZAM_Guard.krnl.trace
    2020-02-24 15:11 - 2018-04-11 15:38 - 000000000 ____D C:\ProgramData\regid.1991-06.com.microsoft
    2020-02-24 15:10 - 2018-05-08 09:35 - 000000000 ____D C:\Users\User\AppData\LocalLow\Mozilla
    2020-02-24 14:57 - 2018-05-04 12:51 - 000000000 ____D C:\Windows\system32\SleepStudy
    2020-02-24 10:28 - 2018-06-23 17:55 - 000004162 _____ C:\Windows\system32\Tasks\User_Feed_Synchronization-{7A28977F-3557-4E1C-93F2-440A1943C72D}
    2020-02-24 10:14 - 2018-05-08 14:39 - 000000000 ____D C:\Program Files (x86)\TeamViewer
    2020-02-24 10:14 - 2018-05-04 12:51 - 000000006 ____H C:\Windows\Tasks\SA.DAT
    2020-02-23 19:49 - 2018-04-11 13:04 - 000524288 _____ C:\Windows\system32\config\BBI
    2020-02-23 19:48 - 2018-05-08 09:35 - 000000000 ____D C:\Users\User\AppData\Local\ClassicShell
    2020-02-22 18:02 - 2018-07-22 14:13 - 000020361 _____ C:\Users\User\Documents\WayneLdgr.ods
    2020-02-22 17:33 - 2018-06-25 11:04 - 000000000 ____D C:\Users\User\Documents\backup
    2020-02-22 17:33 - 2018-05-09 12:30 - 000005415 _____ C:\Users\User\Documents\config.xml
    2020-02-22 17:33 - 2018-05-09 12:30 - 000001146 _____ C:\Users\User\Documents\session.xml
    2020-02-22 12:49 - 2018-09-15 11:56 - 000000000 _____ C:\Users\User\AppData\LocalLow\rightsCheck_1.txt
    2020-02-22 12:45 - 2019-01-31 20:49 - 000000000 ____D C:\Users\User\AppData\Local\CrashDumps
    2020-02-22 11:42 - 2018-04-11 13:04 - 000131072 _____ C:\Windows\system32\config\ELAM
    2020-02-22 11:41 - 2018-05-08 19:31 - 000000000 ____D C:\ProgramData\ProductData
    2020-02-22 11:35 - 2020-01-22 11:09 - 000000000 ____D C:\Program Files\Mozilla Firefox
    2020-02-22 11:35 - 2018-05-08 14:14 - 000000000 ____D C:\Program Files\Bitdefender
    2020-02-22 11:35 - 2018-05-08 09:35 - 000000000 ____D C:\Program Files (x86)\Mozilla Maintenance Service
    2020-02-22 11:33 - 2018-08-21 18:08 - 000000000 ____D C:\Users\User\AppData\Roaming\Dashlane
    2020-02-22 11:33 - 2018-04-11 15:36 - 000000000 ____D C:\Windows\INF
    2020-02-22 10:08 - 2018-04-11 15:38 - 000000000 ____D C:\Windows\AppReadiness
    2020-02-21 19:26 - 2018-04-11 15:38 - 000000000 ___HD C:\Program Files\WindowsApps
    2020-02-20 11:11 - 2019-06-20 15:16 - 000564136 _____ (BitDefender S.R.L. Bucharest, ROMANIA) C:\Windows\system32\Drivers\gemma.sys
    2020-02-20 11:11 - 2019-06-20 15:16 - 000046056 _____ (© Bitdefender SRL) C:\Windows\system32\Drivers\bdprivmon.sys
    2020-02-18 14:12 - 2019-10-10 16:53 - 000008192 _____ C:\Users\User\Documents\SLakeTahoe.est
    2020-02-18 14:07 - 2019-04-26 18:54 - 000006144 _____ C:\Users\User\Documents\2020 Road Trip.est
    2020-02-18 13:15 - 2018-05-08 14:50 - 000000000 ____D C:\Users\User\AppData\Roaming\uTorrent
    2020-02-18 10:49 - 2018-05-08 09:35 - 000001005 _____ C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Firefox.lnk
    2020-02-18 10:45 - 2018-06-14 10:57 - 000000000 ____D C:\Windows\system32\Tasks\NCH Software
    2020-02-17 22:06 - 2018-08-21 17:58 - 000000000 ____D C:\Users\User\AppData\Local\IPVanish
    2020-02-17 18:52 - 2018-05-04 15:21 - 000000000 ___RD C:\Users\User\Desktop\AudioVideo
    2020-02-17 17:29 - 2019-06-20 16:29 - 000000000 ____D C:\Users\User\AppData\Local\BitTorrentHelper
    2020-02-15 21:17 - 2020-01-17 18:57 - 000000000 ____D C:\Users\User\AppData\Roaming\vlc
    2020-02-15 21:16 - 2020-01-17 18:57 - 000000000 ____D C:\Users\User\AppData\Roaming\dvdcss
    2020-02-15 14:41 - 2018-07-09 14:30 - 000026765 _____ C:\Users\User\Documents\SonyDVDLibrary.ods
    2020-02-13 18:40 - 2018-05-04 14:19 - 000002457 _____ C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Acrobat Reader DC.lnk
    2020-02-12 15:12 - 2018-06-23 20:14 - 000000000 ____D C:\ProgramData\NCH Software
    2020-02-12 15:01 - 2018-06-14 10:57 - 000000000 ____D C:\Program Files (x86)\NCH Software
    2020-02-11 19:25 - 2018-05-04 13:03 - 000838564 _____ C:\Windows\system32\PerfStringBackup.INI
    2020-02-11 19:17 - 2018-05-04 12:51 - 000372488 _____ C:\Windows\system32\FNTCACHE.DAT
    2020-02-11 19:13 - 2018-04-11 15:38 - 000000000 ____D C:\Windows\TextInput
    2020-02-11 19:13 - 2018-04-11 15:38 - 000000000 ____D C:\Windows\SysWOW64\oobe
    2020-02-11 19:13 - 2018-04-11 15:38 - 000000000 ____D C:\Windows\SysWOW64\Dism
    2020-02-11 19:13 - 2018-04-11 15:38 - 000000000 ____D C:\Windows\system32\SystemResetPlatform
    2020-02-11 19:13 - 2018-04-11 15:38 - 000000000 ____D C:\Windows\system32\oobe
    2020-02-11 19:13 - 2018-04-11 15:38 - 000000000 ____D C:\Windows\ShellExperiences
    2020-02-11 19:13 - 2018-04-11 15:38 - 000000000 ____D C:\Windows\ShellComponents
    2020-02-11 19:13 - 2018-04-11 15:38 - 000000000 ____D C:\Windows\bcastdvr
    2020-02-11 19:13 - 2018-04-11 13:04 - 000000000 ____D C:\Windows\system32\Dism
    2020-02-11 19:13 - 2018-04-11 13:04 - 000000000 ____D C:\Windows\servicing
    2020-02-11 18:51 - 2018-05-19 18:30 - 000004588 _____ C:\Windows\system32\Tasks\Adobe Flash Player NPAPI Notifier
    2020-02-11 18:50 - 2018-04-11 15:38 - 000000000 ____D C:\Windows\SysWOW64\Macromed
    2020-02-11 18:50 - 2018-04-11 15:38 - 000000000 ____D C:\Windows\system32\Macromed
    2020-02-11 11:40 - 2018-04-11 15:30 - 000000000 ____D C:\Windows\CbsTemp
    2020-02-11 11:14 - 2018-05-08 09:53 - 000000000 ____D C:\Windows\system32\MRT
    2020-02-11 11:14 - 2018-04-11 15:38 - 000000000 ____D C:\Windows\system32\SecureBootUpdates
    2020-02-11 11:03 - 2018-05-08 09:52 - 120407888 ____C (Microsoft Corporation) C:\Windows\system32\MRT.exe
    2020-02-09 21:26 - 2018-06-08 12:01 - 000001192 _____ C:\Users\User\Desktop\Wallpaper Master.lnk
    2020-02-09 18:38 - 2018-05-04 13:06 - 000003374 _____ C:\Windows\system32\Tasks\OneDrive Standalone Update Task-S-1-5-21-507875857-259310543-1677438245-1001
    2020-02-09 18:38 - 2018-05-04 13:04 - 000000000 ___RD C:\Users\User\OneDrive
    2020-02-09 18:38 - 2018-05-04 13:00 - 000002360 _____ C:\Users\User\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\OneDrive.lnk
    2020-02-09 15:08 - 2019-09-30 10:21 - 000000000 ____D C:\Users\User\Desktop\Historyt
    2020-02-07 12:37 - 2019-07-07 09:47 - 000153312 _____ (Malwarebytes) C:\Windows\system32\Drivers\mbae64.sys
    2020-02-04 16:50 - 2018-05-04 14:20 - 000003420 _____ C:\Windows\system32\Tasks\GoogleUpdateTaskMachineUA
    2020-02-04 16:50 - 2018-05-04 14:20 - 000003296 _____ C:\Windows\system32\Tasks\GoogleUpdateTaskMachineCore
    2020-02-03 15:18 - 2018-11-13 22:11 - 000835688 _____ (Adobe) C:\Windows\SysWOW64\FlashPlayerApp.exe
    2020-02-03 15:18 - 2018-11-13 22:11 - 000179608 _____ (Adobe) C:\Windows\SysWOW64\FlashPlayerCPLApp.cpl
    2020-02-01 21:43 - 2018-05-04 15:22 - 000000000 ___RD C:\Users\User\Desktop\Security
    2020-02-01 21:40 - 2019-06-20 14:34 - 000000000 ____D C:\Program Files\IPVanish VPN
    2020-02-01 21:40 - 2018-05-04 13:03 - 000000000 ____D C:\ProgramData\Package Cache
    2020-02-01 20:37 - 2019-08-28 09:41 - 000000000 ____D C:\Program Files (x86)\MyHeritage
    2020-02-01 15:22 - 2018-05-04 13:00 - 000000000 ____D C:\Users\User\AppData\Local\Packages
    2020-02-01 14:45 - 2019-11-21 20:56 - 000000000 ____D C:\Users\User\AppData\Local\cache
    2020-01-31 19:49 - 2018-11-13 18:48 - 000000000 ____D C:\Users\User\AppData\Roaming\Anvsoft
    2020-01-31 17:24 - 2019-03-20 14:34 - 000000000 ____D C:\Users\User\Documents\Apowersoft
    2020-01-31 10:41 - 2019-03-20 14:34 - 000000000 ____D C:\Users\User\AppData\Roaming\Apowersoft
    2020-01-27 15:33 - 2018-08-08 18:19 - 000019278 _____ C:\Users\User\Documents\Login.odt
    2020-01-25 12:10 - 2018-11-23 16:03 - 000041934 _____ C:\Users\User\Downloads\Budget.ods

    ==================== Files in the root of some directories ========

    2018-05-04 15:49 - 2016-11-19 18:41 - 002351339 _____ () C:\Users\User\FreeHideIP-4.1.5.6.Setup.exe
    2003-02-20 09:00 - 2003-02-20 09:00 - 000013387 _____ () C:\Program Files (x86)\license.txt
    2003-03-17 12:46 - 2003-03-17 12:46 - 000000048 _____ () C:\Program Files (x86)\vssver.scc
    2018-06-21 17:48 - 2003-03-24 12:55 - 000049123 ____R () C:\Program Files (x86)\WM9Cap.chm
    2003-03-18 17:14 - 2003-03-18 17:14 - 000110592 _____ (Microsoft Corporation) C:\Program Files (x86)\WM9Cap.exe
    2018-05-09 16:47 - 2018-05-09 16:47 - 000000268 ___RH () C:\Users\User\AppData\Roaming\docInfo
    2018-05-09 17:25 - 2018-05-09 17:25 - 000000268 ___RH () C:\Users\User\AppData\Roaming\grep
    2020-02-17 16:49 - 2020-02-17 16:49 - 000099384 _____ () C:\Users\User\AppData\Roaming\inst.exe
    2020-02-17 16:49 - 2020-02-17 16:49 - 000007859 _____ () C:\Users\User\AppData\Roaming\pcouffin.cat
    2020-02-17 16:49 - 2020-02-17 16:49 - 000001167 _____ () C:\Users\User\AppData\Roaming\pcouffin.inf
    2020-02-17 16:49 - 2020-02-17 16:49 - 000000055 _____ () C:\Users\User\AppData\Roaming\pcouffin.log
    2020-02-17 16:49 - 2020-02-17 16:49 - 000082816 _____ (VSO Software) C:\Users\User\AppData\Roaming\pcouffin.sys
    2019-10-31 17:46 - 2019-10-31 17:46 - 000003584 _____ () C:\Users\User\AppData\Local\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini
    2018-07-10 16:33 - 2018-07-10 16:33 - 000000017 _____ () C:\Users\User\AppData\Local\resmon.resmoncfg
    2019-03-12 09:21 - 2019-03-12 09:21 - 000000000 _____ () C:\Users\User\AppData\Local\{13365B2E-52FE-449F-B71B-9A8C257E4D8E}

    ==================== SigCheck ============================

    (There is no automatic fix for files that do not pass verification.)

    ==================== End of FRST.txt ========================
     
    joe645,
    #9
  11. 2020/02/25
    broni

    broni Moderator Malware Analyst

    Joined:
    2002/08/01
    Messages:
    21,701
    Likes Received:
    116
    Please, observe following rules:
    • Read all of my instructions very carefully. Your mistakes during cleaning process may have very serious consequences, like unbootable computer.
    • If you're stuck, or you're not sure about certain step, always ask before doing anything else.
    • Please refrain from running any tools, fixes or applying any changes to your computer other than those I suggest.
    • Never run more than one scan at a time.
    • Keep updating me regarding your computer behavior, good, or bad.
    • The cleaning process, once started, has to be completed. Even if your computer appears to act better, it may still be infected. Once the computer is totally clean, I'll certainly let you know.
    • If you leave the topic without explanation in the middle of a cleaning process, you may not be eligible to receive any more help in malware removal forum.
    • I close my topics if you have not replied in 5 days. If you need more time, simply let me know. If I closed your topic and you need it to be reopened, simply PM me.

    ====================================

    Do you use ClouDNS?
     
    Last edited: 2020/02/25
    broni,
    #10
  12. 2020/02/25
    joe645

    joe645 Well-Known Member Thread Starter

    Joined:
    2004/01/26
    Messages:
    435
    Likes Received:
    1
    Not that I am aware of.
     
    joe645,
    #11
  13. 2020/02/25
    broni

    broni Moderator Malware Analyst

    Joined:
    2002/08/01
    Messages:
    21,701
    Likes Received:
    116
    Task Manager calls for the file in question.
    It may be some leftover.
    In any case, I don't see anything malicious there and we can fix your issue easily.

    Download attached fixlist.txt file and save it to the Desktop.
    NOTE. It's important that both files, FRST and fixlist.txt are in the same location or the fix will not work.

    NOTICE: This script was written specifically for this user, for use on that particular machine. Running this on another machine may cause damage to your operating system

    Run FRST(FRST64) and press the Fix button just once and wait.
    The tool will make a log on the Desktop (Fixlog.txt). Please post it to your reply.
     

    Attached Files:

    broni,
    #12
  14. 2020/02/25
    joe645

    joe645 Well-Known Member Thread Starter

    Joined:
    2004/01/26
    Messages:
    435
    Likes Received:
    1
    I don't find a download option for fixfst.txt
     
    joe645,
    #13
  15. 2020/02/25
    joe645

    joe645 Well-Known Member Thread Starter

    Joined:
    2004/01/26
    Messages:
    435
    Likes Received:
    1
    Fix result of Farbar Recovery Scan Tool (x64) Version: 23-02-2020
    Ran by User (25-02-2020 13:22:43) Run:1
    Running from C:\Users\User\Desktop
    Loaded Profiles: User (Available Profiles: User)
    Boot Mode: Normal
    ==============================================

    fixlist content:
    *****************
    Task: {3793B711-CE38-46BD-9D4D-134C2741FC41} - System32\Tasks\ClouDNS => C:\Windows\System32\updateIP.vbs
    C:\Windows\System32\updateIP.vbs
    *****************

    "HKLM\Software\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Plain\{3793B711-CE38-46BD-9D4D-134C2741FC41}" => removed successfully
    "HKLM\Software\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\{3793B711-CE38-46BD-9D4D-134C2741FC41}" => removed successfully
    C:\Windows\System32\Tasks\ClouDNS => moved successfully
    "HKLM\Software\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tree\ClouDNS" => removed successfully
    "C:\Windows\System32\updateIP.vbs" => not found

    ==== End of Fixlog 13:22:43 ====
     
    joe645,
    #14
  16. 2020/02/25
    joe645

    joe645 Well-Known Member Thread Starter

    Joined:
    2004/01/26
    Messages:
    435
    Likes Received:
    1
    For 30 minutes or so, I thought that removed it but unfortunately it did not.
     
    joe645,
    #15
  17. 2020/02/25
    broni

    broni Moderator Malware Analyst

    Joined:
    2002/08/01
    Messages:
    21,701
    Likes Received:
    116
    Same error?

    If so, rerun FRST again and post fresh logs.
     
    broni,
    #16
  18. 2020/02/25
    joe645

    joe645 Well-Known Member Thread Starter

    Joined:
    2004/01/26
    Messages:
    435
    Likes Received:
    1
    broni, as you are aware these logs can exceed max characters. Is there a better way of posting other than splitting into multiple logs?
     
    joe645,
    #17
  19. 2020/02/25
    joe645

    joe645 Well-Known Member Thread Starter

    Joined:
    2004/01/26
    Messages:
    435
    Likes Received:
    1
    Scan result of Farbar Recovery Scan Tool (FRST) (x64) Version: 23-02-2020
    Ran by User (administrator) on DESKTOP-LTP8JAE (25-02-2020 14:44:47)
    Running from C:\Users\User\Desktop\Security
    Loaded Profiles: User (Available Profiles: User)
    Platform: Windows 10 Home Version 1803 17134.1304 (X64) Language: English (United States)
    Default browser: FF
    Boot Mode: Normal
    Tutorial for Farbar Recovery Scan Tool: FRST Tutorial - How to use Farbar Recovery Scan Tool - Malware Removal Guides and Tutorials

    ==================== Processes (Whitelisted) =================

    (If an entry is included in the fixlist, the process will be closed. The file will not be moved.)

    (Adobe Inc. -> Adobe Systems Incorporated) C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AdobeCollabSync.exe
    (Adobe Inc. -> Adobe Systems Incorporated) C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AdobeCollabSync.exe
    (Adobe Inc. -> Adobe Systems) C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe
    (Adobe Systems Inc.) [File not signed] C:\Program Files (x86)\Adobe\Acrobat 5.0\Distillr\AcroTray.exe
    (Adobe Systems Incorporated) C:\Program Files\WindowsApps\ReaderNotificationClient_1.0.4.0_x86__e1rzdqpraam7r\AcrobatNotificationClient.exe
    (Advanced Micro Devices, Inc. -> Advanced Micro Devices Inc.) C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\CCC.exe
    (Advanced Micro Devices, Inc. -> Advanced Micro Devices Inc.) C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\MOM.exe
    (Advanced Micro Devices, Inc.) [File not signed] C:\Program Files\ATI Technologies\ATI.ACE\Fuel\Fuel.Service.exe
    (Apple Inc. -> Apple Inc.) C:\Program Files\Bonjour\mDNSResponder.exe
    (Apple Inc. -> Apple Inc.) C:\Program Files\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe
    (ArcSoft, Inc. -> ArcSoft Inc.) C:\Program Files (x86)\Common Files\ArcSoft\Connection Service\Bin\ACService.exe
    (Bitdefender SRL -> Bitdefender) C:\Program Files\Bitdefender Agent\DiscoverySrv.exe
    (Bitdefender SRL -> Bitdefender) C:\Program Files\Bitdefender Agent\ProductAgentService.exe
    (Bitdefender SRL -> Bitdefender) C:\Program Files\Bitdefender\Bitdefender Security\bdagent.exe
    (Bitdefender SRL -> Bitdefender) C:\Program Files\Bitdefender\Bitdefender Security\bdservicehost.exe
    (Bitdefender SRL -> Bitdefender) C:\Program Files\Bitdefender\Bitdefender Security\bdservicehost.exe
    (Bitdefender SRL -> Bitdefender) C:\Program Files\Bitdefender\Bitdefender Security\bdservicehost.exe
    (Bitdefender SRL -> Bitdefender) C:\Program Files\Bitdefender\Bitdefender Security\updatesrv.exe
    (Bitdefender SRL -> Bitdefender) C:\Program Files\Common Files\Bitdefender\SetupInformation\Bitdefender RedLine\bdredline.exe
    (Canon Inc. -> CANON INC.) C:\Program Files (x86)\Canon\IJ Scan Utility\SETEVENT.exe
    (Corel Corporation -> WinZip Computing) C:\Program Files\WinZip\WzPreloader.exe
    (Dashlane USA, Inc. -> Dashlane, Inc.) C:\Users\User\AppData\Roaming\Dashlane\Dashlane.exe
    (Dashlane USA, Inc. -> Dashlane, Inc.) C:\Users\User\AppData\Roaming\Dashlane\DashlanePlugin.exe
    (Google LLC -> Google LLC) C:\Program Files (x86)\Google\Update\1.3.35.442\GoogleCrashHandler.exe
    (Google LLC -> Google LLC) C:\Program Files (x86)\Google\Update\1.3.35.442\GoogleCrashHandler64.exe
    (IObit Information Technology -> IObit) C:\Program Files (x86)\IObit\IObit Uninstaller\UninstallMonitor.exe
    (Ivaylo Beltchev -> IvoSoft) [File not signed] C:\Program Files\Classic Shell\ClassicStartMenu.exe
    (James Garton) [File not signed] C:\Program Files (x86)\Wallpaper Master\Wallpaper Master Pro.exe
    (Malwarebytes Inc -> Malwarebytes) C:\Program Files\Malwarebytes\Anti-Malware\MBAMService.exe
    (Malwarebytes Inc -> Malwarebytes) C:\Program Files\Malwarebytes\Anti-Malware\mbamtray.exe
    (Microsoft Corporation) C:\Program Files\WindowsApps\Microsoft.Windows.Photos_2020.19081.28230.0_x64__8wekyb3d8bbwe\Microsoft.Photos.exe
    (Microsoft Corporation) C:\Program Files\WindowsApps\Microsoft.ZuneVideo_10.20011.10711.0_x64__8wekyb3d8bbwe\Video.UI.exe
    (Microsoft Windows -> Microsoft Corporation) C:\Program Files\Windows Defender\MSASCuiL.exe
    (Microsoft Windows -> Microsoft Corporation) C:\Windows\System32\dllhost.exe
    (Microsoft Windows -> Microsoft Corporation) C:\Windows\System32\smartscreen.exe
    (Microsoft Windows Hardware Compatibility Publisher -> AMD) C:\Windows\System32\atieclxx.exe
    (Microsoft Windows Hardware Compatibility Publisher -> AMD) C:\Windows\System32\atiesrxx.exe
    (Mozilla Corporation -> Mozilla Corporation) C:\Program Files\Mozilla Firefox\firefox.exe
    (Mozilla Corporation -> Mozilla Corporation) C:\Program Files\Mozilla Firefox\firefox.exe
    (Mozilla Corporation -> Mozilla Corporation) C:\Program Files\Mozilla Firefox\firefox.exe
    (Mozilla Corporation -> Mozilla Corporation) C:\Program Files\Mozilla Firefox\firefox.exe
    (Mozilla Corporation -> Mozilla Corporation) C:\Program Files\Mozilla Firefox\firefox.exe
    (Piriform Software Ltd -> Piriform Ltd) C:\Program Files\CCleaner\CCleaner64.exe
    (TeamViewer GmbH -> TeamViewer GmbH) C:\Program Files (x86)\TeamViewer\TeamViewer_Service.exe
    (Ulead Systems, Inc.) [File not signed] C:\Program Files (x86)\Common Files\Ulead Systems\DVD\ULCDRSvr.exe
    (WinAbility Software Corporation -> WinAbility® Software Corporation) C:\Program Files\IconShepherd\ISEXE64.exe
    (Wondershare) [File not signed] C:\Program Files (x86)\Wondershare\WAF\2.2.0.5\WsAppService.exe

    ==================== Registry (Whitelisted) ===================

    (If an entry is included in the fixlist, the registry item will be restored to default or removed. The file will not be moved.)

    HKLM\...\Run: [SecurityHealth] => C:\Program Files\Windows Defender\MSASCuiL.exe [638872 2018-04-11] (Microsoft Windows -> Microsoft Corporation)
    HKLM\...\Run: [RTHDVCPL] => C:\Program Files\Realtek\Audio\HDA\RtkNGUI64.exe [9268672 2018-03-07] (Realtek Semiconductor Corp. -> Realtek Semiconductor)
    HKLM\...\Run: [Classic Start Menu] => C:\Program Files\Classic Shell\ClassicStartMenu.exe [163640 2017-08-13] (Ivaylo Beltchev -> IvoSoft) [File not signed]
    HKLM\...\Run: [WinZip PreLoader] => C:\Program Files\WinZip\WzPreloader.exe [130624 2019-05-16] (Corel Corporation -> WinZip Computing)
    HKLM\...\Run: [iTunesHelper] => C:\Program Files\iTunes\iTunesHelper.exe [302904 2020-01-16] (Apple Inc. -> Apple Inc.)
    HKLM-x32\...\Run: [StartCCC] => C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\amd64\CLIStart.exe [767176 2015-08-21] (Advanced Micro Devices, Inc. -> Advanced Micro Devices, Inc.)
    HKLM-x32\...\Run: [CanonQuickMenu] => C:\Program Files (x86)\Canon\Quick Menu\CNQMMAIN.EXE [1313408 2017-07-05] (Canon Inc. -> CANON INC.)
    HKLM-x32\...\Run: [iSkysoft Helper Compact.exe] => C:\Program Files (x86)\Common Files\iSkysoft\iSkysoft Helper Compact\ISHelper.exe [2138272 2016-10-08] (Shenzhen Yi Xing Investment Co., Ltd. -> iSkySoft)
    HKLM-x32\...\Run: [ArcSoft Connection Service] => C:\Program Files (x86)\Common Files\ArcSoft\Connection Service\Bin\ACDaemon.exe [170496 2009-02-06] (ArcSoft, Inc. -> ArcSoft Inc.)
    HKLM-x32\...\Run: [UVS10 Preload] => C:\Program Files (x86)\Ulead Systems\Ulead VideoStudio SE DVD\uvPL.exe [36864 2011-08-09] (Ulead Systems, Inc.) [File not signed]
    HKLM-x32\...\Run: [APSDaemon] => C:\Program Files (x86)\Common Files\Apple\Apple Application Support\APSDaemon.exe [76600 2020-01-16] (Apple Inc. -> Apple Inc.)
    HKLM-x32\...\Run: [QuickTime Task] => C:\Program Files (x86)\QuickTime\QTTask.exe [421888 2012-04-18] (Apple Inc.) [File not signed]
    HKLM-x32\...\Run: [Aimersoft Helper Compact.exe] => C:\Program Files (x86)\Common Files\Aimersoft\Aimersoft Helper Compact\ASHelper.exe [2001920 2014-04-04] (AimerSoft) [File not signed]
    HKLM-x32\...\Run: [Wondershare Helper Compact.exe] => C:\Program Files (x86)\Common Files\Wondershare\Wondershare Helper Compact\WSHelper.exe [2133216 2017-03-23] (Wondershare Technology Co.,Ltd -> Wondershare)
    HKU\S-1-5-21-507875857-259310543-1677438245-1001\...\Run: [Wallpaper Master] => C:\Program Files (x86)\Wallpaper Master\Wallpaper Master Pro.exe [1159680 2016-06-28] (James Garton) [File not signed]
    HKU\S-1-5-21-507875857-259310543-1677438245-1001\...\Run: [Dashlane] => C:\Users\User\AppData\Roaming\Dashlane\Dashlane.exe [321536 2020-02-11] (Dashlane USA, Inc. -> Dashlane, Inc.)
    HKU\S-1-5-21-507875857-259310543-1677438245-1001\...\Run: [DashlanePlugin] => C:\Users\User\AppData\Roaming\Dashlane\DashlanePlugin.exe [342528 2020-02-11] (Dashlane USA, Inc. -> Dashlane, Inc.)
    HKU\S-1-5-21-507875857-259310543-1677438245-1001\...\Run: [CCleaner Smart Cleaning] => C:\Program Files\CCleaner\CCleaner64.exe [24552064 2019-10-16] (Piriform Software Ltd -> Piriform Ltd)
    HKU\S-1-5-21-507875857-259310543-1677438245-1001\...\Run: [Discord] => C:\Users\User\AppData\Local\Discord\app-0.0.305\Discord.exe [81780056 2019-03-07] (Discord Inc. -> Discord Inc.)
    HKU\S-1-5-21-507875857-259310543-1677438245-1001\...\Run: [GarminExpress] => C:\Program Files (x86)\Garmin\Express\express.exe [30868464 2019-11-21] (Garmin International, Inc. -> Garmin Ltd. or its subsidiaries)
    HKU\S-1-5-21-507875857-259310543-1677438245-1001\Control Panel\Desktop\\SCRNSAVE.EXE -> C:\Windows\WALLPA~1.SCR [37376 2013-12-17] () [File not signed]
    HKU\S-1-5-18\...\Run: [GarminExpress] => C:\Program Files (x86)\Garmin\Express\express.exe [30868464 2019-11-21] (Garmin International, Inc. -> Garmin Ltd. or its subsidiaries)
    HKLM\Software\Microsoft\Active Setup\Installed Components: [{8A69D345-D564-463c-AFF1-A69D9E530F96}] -> C:\Program Files (x86)\Google\Chrome\Application\79.0.3945.130\Installer\chrmstp.exe [2020-01-22] (Google LLC -> Google LLC)
    HKLM\Software\Wow6432Node\Microsoft\Active Setup\Installed Components: [{73FA19D0-2D75-11D2-995D-00C04F98BBC9}] ->
    Startup: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\Acrobat Assistant.lnk [2019-09-29]
    ShortcutTarget: Acrobat Assistant.lnk -> C:\Program Files (x86)\Adobe\Acrobat 5.0\Distillr\AcroTray.exe (Adobe Systems Inc.) [File not signed]
    Startup: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\Adobe Gamma Loader.lnk [2018-05-09]
    ShortcutTarget: Adobe Gamma Loader.lnk -> C:\Program Files (x86)\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe (Adobe Systems, Inc.) [File not signed]
    Startup: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\Icon Shepherd.lnk [2019-11-01]
    ShortcutTarget: Icon Shepherd.lnk -> C:\Program Files\IconShepherd\ISEXE64.exe (WinAbility Software Corporation -> WinAbility® Software Corporation)
    Startup: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\Microsoft Office.lnk [2019-09-30]
    ShortcutTarget: Microsoft Office.lnk -> C:\Program Files (x86)\Microsoft Office\Office10\OSA.EXE (Microsoft Corporation -> Microsoft Corporation)
    Startup: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\UltraMon.lnk [2019-09-26]
    ShortcutTarget: UltraMon.lnk -> C:\Windows\Installer\{2CB51501-DA86-4216-9C9B-2C52A64BA047}\IcoUltraMon.ico () [File not signed]
    Startup: C:\Users\User\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Nikon Monitor.lnk [2018-05-09]
    ShortcutTarget: Nikon Monitor.lnk -> C:\Program Files (x86)\Common Files\Nikon\Monitor\NkMonitor.exe (Nikon Corporation) [File not signed]
    Startup: C:\Users\User\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Webshots.lnk [2018-06-10]
    ShortcutTarget: Webshots.lnk -> C:\Program Files (x86)\Webshots\Launcher.exe (American Greetings, Inc. -> Webshots.com)

    ==================== Scheduled Tasks (Whitelisted) ============

    (If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)

    Task: {07FCBD0E-3EF3-4EFD-9652-17128A6F97C4} - System32\Tasks\Phoenix360\ActiveReporter-SystemMechanic => C:\Program Files (x86)\Common Files\Phoenix360\ActiveCore\ActiveBridge.exe [556816 2019-08-26] (iolo technologies, LLC -> iolo technologies, LLC)
    Task: {2D84E5AC-1704-4B19-B180-7CDB6FB68A99} - System32\Tasks\Phoenix360\ActiveSync-SystemMechanic => C:\Program Files (x86)\Common Files\Phoenix360\ActiveCore\activebridge.exe [556816 2019-08-26] (iolo technologies, LLC -> iolo technologies, LLC)
    Task: {33880C7F-2EC3-47C4-A160-DAA00EBE271D} - System32\Tasks\CCleaner Update => C:\Program Files\CCleaner\CCUpdate.exe [608384 2019-10-16] (Piriform Software Ltd -> Piriform Software Ltd)
    Task: {3915F969-8CEF-4A89-BCD3-D629669885F2} - System32\Tasks\SmartDefrag_Startup => C:\Program Files (x86)\IObit\Smart Defrag\SmartDefrag.exe [5849872 2019-07-05] (IObit Information Technology -> IObit)
    Task: {3A57542B-5C22-4832-83D2-6C282AFC95A6} - System32\Tasks\Apple\AppleSoftwareUpdate => C:\Program Files (x86)\Apple Software Update\SoftwareUpdate.exe [616832 2019-09-04] (Apple Inc. -> Apple Inc.)
    Task: {453367FB-67AB-4057-AB02-33AA1B513FDE} - System32\Tasks\IObitSelfCheckTask => C:\Program Files (x86)\IObit\Smart Defrag\IObitSelfCheck.exe
    Task: {48B51215-9EC4-42E2-8A22-E9E6FB5E1C6D} - System32\Tasks\Adobe Flash Player Updater => C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe [335416 2020-02-11] (Adobe Inc. -> Adobe)
    Task: {4CB6F6D9-0834-44E2-BEF5-3ADFA9E3DFE7} - System32\Tasks\Adobe Flash Player NPAPI Notifier => C:\Windows\SysWOW64\Macromed\Flash\FlashUtil32_32_0_0_330_Plugin.exe [1458232 2020-02-11] (Adobe Inc. -> Adobe)
    Task: {4D60F02E-4256-43F1-8219-EF50F704AC8B} - System32\Tasks\IOTransfer SkipUAC (User) => C:\Program Files (x86)\IOTransfer\IOT\IOTransfer.exe
    Task: {5AFA4B39-9C11-4E95-A3FF-D31026521FB0} - System32\Tasks\SmartDefrag_AutoAnalyze => C:\Program Files (x86)\IObit\Smart Defrag\AutoDefrag.exe [314128 2018-05-02] (IObit Information Technology -> IObit)
    Task: {8BC01496-D548-4652-908B-0576D54D4E80} - System32\Tasks\GoogleUpdateTaskMachineUA => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe [152216 2018-05-04] (Google Inc -> Google Inc.)
    Task: {9620D62D-B80A-4BD1-9AA1-2A9AC9ABAB2F} - System32\Tasks\GoogleUpdateTaskMachineCore => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe [152216 2018-05-04] (Google Inc -> Google Inc.)
    Task: {97A54C17-8DD9-4CF7-AA11-2CB71D4ABEDE} - System32\Tasks\GarminUpdaterTask => C:\Program Files (x86)\Garmin\Express SelfUpdater\ExpressSelfUpdater.exe [40432 2019-06-18] (Garmin International, Inc. -> )
    Task: {9C930B32-4EB6-49A2-BE9E-733558BF97A6} - System32\Tasks\Avast Software\Overseer => C:\Program Files\Common Files\AVAST Software\Overseer\overseer.exe [1835112 2020-02-19] (Avast Software s.r.o. -> AVAST Software)
    Task: {A990ABBF-264A-4DCF-9704-A8B4DCA702A8} - System32\Tasks\Bitdefender AgentTask_AD394AE64E874073B10A89FEEC305A3C => C:\Program Files\Bitdefender\Bitdefender Security\bdagent.exe [525632 2020-02-20] (Bitdefender SRL -> Bitdefender)
    Task: {AFFDDD1D-E27C-4956-BB89-4D602733E7DA} - System32\Tasks\SmartDefrag_Update => C:\Program Files (x86)\IObit\Smart Defrag\AutoUpdate.exe [3007760 2019-04-24] (IObit Information Technology -> IObit)
    Task: {B39FB0BC-2588-4016-8F0D-B32009FF940E} - System32\Tasks\Bitdefender Agent WatchDog_65D6944A0EF74FDAB96E31112AD39864 => C:\Program Files\Bitdefender Agent\WatchDog.exe [488760 2019-07-15] (Bitdefender SRL -> Bitdefender)
    Task: {C95E7FE3-0B15-453F-9FFC-FF7BD09253B2} - System32\Tasks\CreateExplorerShellUnelevatedTask => C:\Windows\explorer.exe /NOUACCHECK
    Task: {C95FB597-4743-4518-9302-4C915695DF70} - System32\Tasks\Uninstaller_SkipUac_User => C:\Program Files (x86)\IObit\IObit Uninstaller\IObitUninstaler.exe [5900560 2019-08-27] (IObit Information Technology -> IObit)
    Task: {D0E5A4F8-E735-47F1-8106-B4CFCFEBB4AD} - System32\Tasks\Phoenix360\ActiveMessenger-SystemMechanic => C:\Program Files (x86)\Common Files\Phoenix360\ActiveCore\ActiveBridge.exe [556816 2019-08-26] (iolo technologies, LLC -> iolo technologies, LLC)
    Task: {DB812ECB-58E8-4D87-B6D0-96BAD05E8C2C} - System32\Tasks\Driver Booster SkipUAC (User) => C:\Program Files (x86)\IObit\Driver Booster\5.5.1\DriverBooster.exe
    Task: {E96C2BD5-51B2-4812-893F-D6258E8D58F0} - System32\Tasks\CCleanerSkipUAC => C:\Program Files\CCleaner\CCleaner.exe [18458752 2019-10-16] (Piriform Software Ltd -> Piriform Ltd)
    Task: {F6C05138-2BD1-49F4-A931-19D6C9FAB85C} - System32\Tasks\NCH Software\PixillionDowngrade => C:\Program Files (x86)\NCH Software\Pixillion\pixillion.exe [1641544 2019-11-07] (NCH Software, Inc. -> NCH Software)
    Task: {FCD7A466-BEB6-4009-9E1B-EA4A7FE22346} - System32\Tasks\Adobe Acrobat Update Task => C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe [1240656 2019-09-10] (Adobe Inc. -> Adobe Systems)

    (If an entry is included in the fixlist, the task (.job) file will be moved. The file which is running by the task will not be moved.)


    ==================== Internet (Whitelisted) ====================

    (If an item is included in the fixlist, if it is a registry item it will be removed or restored to default.)

    Winsock: Catalog5 07 C:\Program Files (x86)\Bonjour\mdnsNSP.dll [122128 2015-08-12] (Apple Inc. -> Apple Inc.)
    Winsock: Catalog5-x64 07 C:\Program Files\Bonjour\mdnsNSP.dll [133392 2015-08-12] (Apple Inc. -> Apple Inc.)
    Tcpip\Parameters: [DhcpNameServer] 192.168.1.1
    Tcpip\..\Interfaces\{1b16637a-a5e3-4f5d-948a-e7f44b6ee4d1}: [DhcpNameServer] 192.168.1.1
    Tcpip\..\Interfaces\{b78170d5-96ca-48c9-8770-cce38dc0aec0}: [DhcpNameServer] 198.18.0.1 198.18.0.2

    Internet Explorer:
    ==================
    HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = about:blank
    HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Start Page = about:blank
    HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL =
    HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Default_Page_URL =
    HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL =
    HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Default_Search_URL =
    HKU\S-1-5-21-507875857-259310543-1677438245-1001\Software\Microsoft\Internet Explorer\Main,Start Page = hxxps://go.microsoft.com/fwlink/p/?LinkId=620947&OCID=AVRES000&pc=UE00
    SearchScopes: HKLM -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL =
    SearchScopes: HKLM-x32 -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL =
    SearchScopes: HKU\S-1-5-21-507875857-259310543-1677438245-1001 -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = hxxps://www.bing.com/search?q={searchTerms}&src=IE-SearchBox&FORM=IESR02&pc=UE00
    SearchScopes: HKU\S-1-5-21-507875857-259310543-1677438245-1001 -> {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = hxxps://www.bing.com/search?q={searchTerms}&src=IE-SearchBox&FORM=IESR02&pc=UE00
    BHO: ExplorerWnd Helper -> {10921475-03CE-4E04-90CE-E2E7EF20C814} -> C:\Program Files (x86)\IObit\IObit Uninstaller\UninstallExplorer.dll [2019-06-20] (IObit Information Technology -> IObit)
    BHO: Bitdefender Trackers Blocking -> {159ff5d5-55f1-4d2f-b706-767a55f77abb} -> C:\Program Files\Bitdefender\Bitdefender Security\bdtbie.dll [2020-02-20] (Bitdefender SRL -> Bitdefender)
    BHO: Bitdefender Wallet -> {1DAC0C53-7D23-4AB3-856A-B04D98CD982A} -> C:\Program Files\Bitdefender\Bitdefender Security\pmbxie.dll [2020-02-20] (Bitdefender SRL -> Bitdefender)
    BHO: Canon Easy-WebPrint EX BHO -> {3785D0AD-BFFF-47F6-BF5B-A587C162FED9} -> C:\Program Files\Canon\Easy-WebPrint EX\ewpexbho.dll [2016-02-23] (Canon Inc. -> CANON INC.)
    BHO: ExplorerBHO Class -> {449D0D6E-2412-4E61-B68F-1CB625CD9E52} -> C:\Program Files\Classic Shell\ClassicExplorer64.dll [2017-08-13] (Ivaylo Beltchev -> IvoSoft) [File not signed]
    BHO: ClassicIEBHO Class -> {EA801577-E6AD-4BD5-8F71-4BE0154331A4} -> C:\Program Files\Classic Shell\ClassicIEDLL_64.dll [2017-08-13] (Ivaylo Beltchev -> IvoSoft) [File not signed]
    BHO-x32: Bitdefender Trackers Blocking -> {159ff5d5-55f1-4d2f-b706-767a55f77abb} -> C:\Program Files\Bitdefender\Bitdefender Security\antispam32\bdtbie.dll [2020-02-20] (Bitdefender SRL -> Bitdefender)
    BHO-x32: Bitdefender Wallet -> {1DAC0C53-7D23-4AB3-856A-B04D98CD982A} -> C:\Program Files\Bitdefender\Bitdefender Security\Antispam32\pmbxie.dll [2020-02-20] (Bitdefender SRL -> Bitdefender)
    BHO-x32: Canon Easy-WebPrint EX BHO -> {3785D0AD-BFFF-47F6-BF5B-A587C162FED9} -> C:\Program Files (x86)\Canon\Easy-WebPrint EX\ewpexbho.dll [2016-02-23] (Canon Inc. -> CANON INC.)
    BHO-x32: Dashlane BHO -> {42D79B50-CC4A-4A8E-860F-BE674AF053A2} -> C:\Users\User\AppData\Roaming\Dashlane\ie\Dashlanei.dll [2020-02-11] (Dashlane USA, Inc. -> Dashlane, Inc.)
    Toolbar: HKLM - Canon Easy-WebPrint EX - {759D9886-0C6F-4498-BAB6-4A5F47C6C72F} - C:\Program Files\Canon\Easy-WebPrint EX\ewpexhlp.dll [2016-02-23] (Canon Inc. -> CANON INC.)
    Toolbar: HKLM - Bitdefender Wallet - {1DAC0C53-7D23-4AB3-856A-B04D98CD982A} - C:\Program Files\Bitdefender\Bitdefender Security\pmbxie.dll [2020-02-20] (Bitdefender SRL -> Bitdefender)
    Toolbar: HKLM-x32 - Canon Easy-WebPrint EX - {759D9886-0C6F-4498-BAB6-4A5F47C6C72F} - C:\Program Files (x86)\Canon\Easy-WebPrint EX\ewpexhlp.dll [2016-02-23] (Canon Inc. -> CANON INC.)
    Toolbar: HKLM-x32 - Webshots Toolbar - {C17590D2-ECB4-4b15-8820-F58798DCC118} - C:\Program Files (x86)\Webshots\WSToolbar4IE.dll [2008-08-15] (Webshots.com) [File not signed]
    Toolbar: HKLM-x32 - Dashlane Toolbar - {669695BC-A811-4A9D-8CDF-BA8C795F261C} - C:\Users\User\AppData\Roaming\Dashlane\ie\KWIEBar.dll [2020-02-11] (Dashlane USA, Inc. -> Dashlane, Inc.)
    Toolbar: HKLM-x32 - Bitdefender Wallet - {1DAC0C53-7D23-4AB3-856A-B04D98CD982A} - C:\Program Files\Bitdefender\Bitdefender Security\Antispam32\pmbxie.dll [2020-02-20] (Bitdefender SRL -> Bitdefender)
    Handler-x32: cdo - {CD00020A-8B95-11D1-82DB-00C04FB1625D} - C:\Program Files (x86)\Common Files\Microsoft Shared\Web Folders\PKMCDO.DLL [2001-01-22] (Microsoft Corporation) [File not signed]
    Handler-x32: http - {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - C:\Program Files (x86)\Common Files\System\OLE DB\msdaipp.dll [2001-02-12] (Microsoft Corporation) [File not signed]
    Handler-x32: http - {E1D2BF40-A96B-11d1-9C6B-0000F875AC61} - C:\Program Files (x86)\Common Files\System\OLE DB\msdaipp.dll [2001-02-12] (Microsoft Corporation) [File not signed]
    Handler-x32: https - {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - C:\Program Files (x86)\Common Files\System\OLE DB\msdaipp.dll [2001-02-12] (Microsoft Corporation) [File not signed]
    Handler-x32: https - {E1D2BF40-A96B-11d1-9C6B-0000F875AC61} - C:\Program Files (x86)\Common Files\System\OLE DB\msdaipp.dll [2001-02-12] (Microsoft Corporation) [File not signed]
    Handler-x32: msdaipp - {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - C:\Program Files (x86)\Common Files\System\OLE DB\msdaipp.dll [2001-02-12] (Microsoft Corporation) [File not signed]
    Handler-x32: msdaipp - {E1D2BF40-A96B-11d1-9C6B-0000F875AC61} - C:\Program Files (x86)\Common Files\System\OLE DB\msdaipp.dll [2001-02-12] (Microsoft Corporation) [File not signed]
    Handler: WSWSVCUchrome - No CLSID Value

    Edge:
    ======
    DownloadDir: C:\Users\User\Downloads

    FireFox:
    ========
    FF DefaultProfile: r1629r1m.default-1540956538169
    FF DefaultProfile: d9604b0q.default
    FF ProfilePath: C:\Users\User\AppData\Roaming\Mozilla\Firefox\Profiles.BAK\Profiles\d9604b0q.default [not found] <==== ATTENTION
    FF ProfilePath: C:\Users\User\AppData\Roaming\Mozilla\Firefox\Profiles\p2v80k5k.Default User [2018-10-30]
    FF ProfilePath: C:\Users\User\AppData\Roaming\Mozilla\Firefox\Profiles\r1629r1m.default-1540956538169 [2020-02-25]
    FF Homepage: Mozilla\Firefox\Profiles\r1629r1m.default-1540956538169 -> hxxps://www.msn.com/
    FF Notifications: Mozilla\Firefox\Profiles\r1629r1m.default-1540956538169 -> hxxps://freemusicdownloads.world; hxxps://mail.google.com; hxxps://www.digitaltrends.com; hxxps://en.softonic.com; hxxps://www.cbssports.com; hxxps://www.alibaba.com; hxxps://www.lightinthebox.com; hxxps://www.luckyvitamin.com; hxxps://www.magazine.store; hxxps://www.ketoconnect.net; hxxps://dietseekers.com; hxxps://offerup.com; hxxps://www.bulbhead.com; hxxps://www.aspicyperspective.com; hxxps://lowcarbyum.com; hxxps://www.pinterest.com; hxxps://troypoint.com; hxxps://www.reviewjournal.com; hxxps://www.pipingrock.com; hxxps://crm.zoho.com; hxxps://www.facebook.com; hxxps://www.reddit.com; hxxps://www.tomsguide.com; hxxps://www.hometalk.com; hxxps://www.gearbest.com; hxxps://yts.am; hxxps://www.technadu.com; hxxps://www.pewpewtactical.com; hxxps://mail.protonmail.com; hxxps://www.youtube.com; hxxps://www.cnet.com; hxxps://www.truthfinder.com; hxxps://www.instantcheckmate.com; hxxps://watch-television.com; hxxps://unzipper.com; hxxps://fileconvertor.org; hxxps://pseudocumylife.info; hxxps://hydrobuilder.com; hxxps://www.iptvinsider.com; hxxps://www.newstrackerdaily.com; hxxps://manualslibrary.org; hxxps://fossbytes.com; hxxps://www.wayfair.com; hxxps://www.vegasworld.com; hxxps://www.thenewstribune.com
    FF HomepageOverride: Mozilla\Firefox\Profiles\r1629r1m.default-1540956538169 -> Enabled: web@Packages
    FF NewTabOverride: Mozilla\Firefox\Profiles\r1629r1m.default-1540956538169 -> Enabled: web@Packages
    FF NewTabOverride: Mozilla\Firefox\Profiles\r1629r1m.default-1540956538169 -> Enabled: jetpack-extension@dashlane.com
    FF Extension: (Hide My IP) - C:\Users\User\AppData\Roaming\Mozilla\Firefox\Profiles\r1629r1m.default-1540956538169\Extensions\admin@myprivacytools.com.xpi [2019-12-14]
    FF Extension: (Dashlane) - C:\Users\User\AppData\Roaming\Mozilla\Firefox\Profiles\r1629r1m.default-1540956538169\Extensions\jetpack-extension@dashlane.com.xpi [2020-02-10] [UpdateUrl:hxxps://ws1.dashlane.com/5/binaries/query?logins=&platform=firefox&target=ff_web_extension&format=json&version=]
    FF Extension: (Manuals Search) - C:\Users\User\AppData\Roaming\Mozilla\Firefox\Profiles\r1629r1m.default-1540956538169\Extensions\{60a58bf1-08ae-46d7-9010-5cfe8eb5f282}.xpi [2020-01-24] [UpdateUrl:hxxps://cdn.manualsearch-cdn.org/xpi/manualsearch/settings_Api/0119/signature/updates.json]
    FF HKLM\...\Firefox\Extensions: [bdwtwe@bitdefender.com] - C:\Program Files\Bitdefender\Bitdefender Security\bdwteff.xpi
    FF Extension: (Bitdefender Wallet) - C:\Program Files\Bitdefender\Bitdefender Security\bdwteff.xpi [2020-02-20]
    FF HKLM\...\Firefox\Extensions: [bdtbe@bitdefender.com] - C:\Program Files\Bitdefender\Bitdefender Security\bdtbef.xpi
    FF Extension: (Bitdefender Anti-tracker) - C:\Program Files\Bitdefender\Bitdefender Security\bdtbef.xpi [2020-02-20]
    FF HKLM\...\Thunderbird\Extensions: [bdThunderbird@bitdefender.com] - C:\Program Files\Bitdefender\Bitdefender Security\bdtbext
    FF Extension: (Bitdefender Antispam Toolbar) - C:\Program Files\Bitdefender\Bitdefender Security\bdtbext [2019-06-05] [Legacy] [not signed]
    FF HKLM-x32\...\Firefox\Extensions: [bdwtwe@bitdefender.com] - C:\Program Files\Bitdefender\Bitdefender Security\bdwteff.xpi
    FF HKLM-x32\...\Firefox\Extensions: [ISVCU@iSkysoft.com] - C:\ProgramData\iSkysoft\Video Converter Ultimate\ISVCU@iSkysoft.com => not found
    FF HKLM-x32\...\Firefox\Extensions: [bdtbe@bitdefender.com] - C:\Program Files\Bitdefender\Bitdefender Security\bdtbef.xpi
    FF HKLM-x32\...\Thunderbird\Extensions: [bdThunderbird@bitdefender.com] - C:\Program Files\Bitdefender\Bitdefender Security\bdtbext
    FF HKU\S-1-5-21-507875857-259310543-1677438245-1001\...\Firefox\Extensions: [{442718d9-475e-452a-b3e1-fb1ee16b8e9f}] - C:\Users\User\AppData\Roaming\Dashlane\6.2007.0.32704\bin\Firefox_Extension\{442718d9-475e-452a-b3e1-fb1ee16b8e9f}
    FF Extension: (No Name) - C:\Users\User\AppData\Roaming\Dashlane\6.2007.0.32704\bin\Firefox_Extension\{442718d9-475e-452a-b3e1-fb1ee16b8e9f} [2020-02-11] [not signed]
    FF Plugin: @adobe.com/FlashPlayer -> C:\Windows\system32\Macromed\Flash\NPSWF64_32_0_0_330.dll [2020-02-11] (Adobe Inc. -> )
    FF Plugin-x32: @adobe.com/FlashPlayer -> C:\Windows\SysWOW64\Macromed\Flash\NPSWF32_32_0_0_330.dll [2020-02-11] (Adobe Inc. -> )
    FF Plugin-x32: @canon.com/EPPEX -> C:\Program Files (x86)\Canon\My Image Garden\AddOn\CIG\npmigfpi.dll [2017-10-17] (CANON INC.) [File not signed]
    FF Plugin-x32: @google.com/npPicasa3,version=3.0.0 -> C:\Program Files (x86)\Google\Picasa3\npPicasa3.dll [2014-07-31] (Google Inc -> Google, Inc.)
    FF Plugin-x32: @videolan.org/vlc,version=3.0.8 -> C:\Program Files (x86)\VideoLAN\VLC\npvlc.dll [2019-08-14] (VideoLAN -> VideoLAN)
    FF Plugin-x32: Adobe Reader -> C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AIR\nppdf32.dll [2020-02-04] (Adobe Inc. -> Adobe Systems Inc.)
    FF ExtraCheck: C:\Program Files\mozilla firefox\defaults\pref\bd_js_config.js [2019-09-14] <==== ATTENTION (Points to *.cfg file)
    FF ExtraCheck: C:\Program Files\mozilla firefox\bd_config.cfg [2019-09-14] <==== ATTENTION

    Chrome:
    =======
    CHR Profile: C:\Users\User\AppData\Local\Google\Chrome\User Data\Default [2020-02-25]
    CHR HomePage: Default -> hxxp://www.msn.com/
    CHR NewTab: Default -> "active": true,
    "entry": "chrome-extension://hjlopiihmpomlfgifjmoipmnaloobipg/html/index.html"

    CHR Extension: (Adobe Acrobat) - C:\Users\User\AppData\Local\Google\Chrome\User Data\Default\Extensions\efaidnbmnnnibpcajpcglclefindmkaj [2020-02-08]
    CHR Extension: (Converter Suite) - C:\Users\User\AppData\Local\Google\Chrome\User Data\Default\Extensions\hjlopiihmpomlfgifjmoipmnaloobipg [2019-12-28]
    CHR Extension: (Bitdefender Anti-tracker) - C:\Users\User\AppData\Local\Google\Chrome\User Data\Default\Extensions\khndhdhbebhaddchcgnalcjlaekbbeof [2019-11-20]
    CHR Extension: (Chrome Web Store Payments) - C:\Users\User\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda [2019-11-20]
    CHR Extension: (Chrome Media Router) - C:\Users\User\AppData\Local\Google\Chrome\User Data\Default\Extensions\pkedcjkdefgpdelpbcmbmeomcjbeemfm [2019-12-28]
    CHR HKLM-x32\...\Chrome\Extension: [efaidnbmnnnibpcajpcglclefindmkaj]
    CHR HKLM-x32\...\Chrome\Extension: [gannpgaobkkhmpomoijebaigcapoeebl]
    CHR HKLM-x32\...\Chrome\Extension: [khndhdhbebhaddchcgnalcjlaekbbeof]

    ==================== Services (Whitelisted) ===================

    (If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)

    R2 ACDaemon; C:\Program Files (x86)\Common Files\ArcSoft\Connection Service\Bin\ACService.exe [109056 2009-02-06] (ArcSoft, Inc. -> ArcSoft Inc.)
    R2 AMD External Events Utility; C:\Windows\system32\atiesrxx.exe [255472 2015-10-21] (Microsoft Windows Hardware Compatibility Publisher -> AMD)
    R2 AMD FUEL Service; C:\Program Files\ATI Technologies\ATI.ACE\Fuel\Fuel.Service.exe [344064 2015-08-21] (Advanced Micro Devices, Inc.) [File not signed]
    R2 Apple Mobile Device Service; C:\Program Files\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe [96056 2019-08-26] (Apple Inc. -> Apple Inc.)
    R2 BDAuxSrv; C:\Program Files\Bitdefender\Bitdefender Security\bdservicehost.exe [803576 2020-02-20] (Bitdefender SRL -> Bitdefender)
    R2 BDProtSrv; C:\Program Files\Bitdefender\Bitdefender Security\bdservicehost.exe [803576 2020-02-20] (Bitdefender SRL -> Bitdefender)
    R2 bdredline; C:\Program Files\Common Files\Bitdefender\SetupInformation\Bitdefender RedLine\bdredline.exe [2195320 2018-03-22] (Bitdefender SRL -> Bitdefender)
    R2 CIJSRegister; C:\Program Files (x86)\Canon\IJ Scan Utility\SETEVENT.exe [153736 2016-06-02] (Canon Inc. -> CANON INC.)
    S3 IDriverT; C:\Program Files (x86)\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe [69632 2005-04-03] (Macrovision Corporation) [File not signed]
    S2 IObitUnSvr; C:\Program Files (x86)\IObit\IObit Uninstaller\IUService.exe [156944 2019-08-23] (IObit Information Technology -> IObit)
    R2 MBAMService; C:\Program Files\Malwarebytes\Anti-Malware\mbamservice.exe [6960640 2019-11-21] (Malwarebytes Inc -> Malwarebytes)
    R2 ProductAgentService; C:\Program Files\Bitdefender Agent\ProductAgentService.exe [1291888 2019-07-15] (Bitdefender SRL -> Bitdefender)
    R2 TeamViewer; C:\Program Files (x86)\TeamViewer\TeamViewer_Service.exe [11293936 2018-04-03] (TeamViewer GmbH -> TeamViewer GmbH)
    R2 UleadBurningHelper; C:\Program Files (x86)\Common Files\Ulead Systems\DVD\ULCDRSvr.exe [49152 2011-09-28] (Ulead Systems, Inc.) [File not signed]
    R2 UPDATESRV; C:\Program Files\Bitdefender\Bitdefender Security\updatesrv.exe [151656 2020-02-20] (Bitdefender SRL -> Bitdefender)
    R2 VSSERV; C:\Program Files\Bitdefender\Bitdefender Security\bdservicehost.exe [803576 2020-02-20] (Bitdefender SRL -> Bitdefender)
    S3 WdNisSvc; C:\ProgramData\Microsoft\Windows Defender\platform\4.18.1807.18075-0\NisSrv.exe [3905952 2018-09-22] (Microsoft Corporation -> Microsoft Corporation)
    S3 WinDefend; C:\ProgramData\Microsoft\Windows Defender\platform\4.18.1807.18075-0\MsMpEng.exe [110944 2018-09-22] (Microsoft Corporation -> Microsoft Corporation)
    R2 WsAppService; C:\Program Files (x86)\Wondershare\WAF\2.2.0.5\WsAppService.exe [411648 2016-03-31] (Wondershare) [File not signed]

    ===================== Drivers (Whitelisted) ===================

    (If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)

    R3 amdkmdag; C:\Windows\system32\DRIVERS\atikmdag.sys [21648880 2015-10-21] (Microsoft Windows Hardware Compatibility Publisher -> Advanced Micro Devices, Inc.)
    R3 amdkmdap; C:\Windows\system32\DRIVERS\atikmpag.sys [674288 2015-10-21] (Microsoft Windows Hardware Compatibility Publisher -> Advanced Micro Devices, Inc.)
    R0 amd_sata; C:\Windows\System32\drivers\amd_sata.sys [93240 2018-08-21] (Microsoft Windows Hardware Compatibility Publisher -> Advanced Micro Devices)
    R0 amd_xata; C:\Windows\System32\drivers\amd_xata.sys [33336 2018-08-21] (Microsoft Windows Hardware Compatibility Publisher -> Advanced Micro Devices)
    R3 AmUStor; C:\Windows\system32\drivers\AmUStor.SYS [109008 2018-08-21] (Alcor Micro, Corp. -> )
    R2 AODDriver4.3; C:\Program Files\ATI Technologies\ATI.ACE\Fuel\amd64\AODDriver2.sys [59616 2014-02-11] (Advanced Micro Devices, Inc. -> Advanced Micro Devices)
    R1 atc; C:\Windows\System32\DRIVERS\atc.sys [1693368 2019-11-20] (Bitdefender SRL -> Bitdefender S.R.L. Bucharest, ROMANIA)
    S3 AtiDCM; C:\AMD\Win10-64Bit-Radeon-Software-Adrenalin-Edition-18.5.1-May23\Bin64\atdcm64a.sys [51104 2016-07-11] (Advanced Micro Devices, Inc. -> Advanced Micro Devices, Inc.)
    R3 AtiHDAudioService; C:\Windows\system32\drivers\AtihdWT6.sys [110096 2018-08-21] (Microsoft Windows Hardware Compatibility Publisher -> Advanced Micro Devices)
    R2 BdDci; C:\Windows\system32\DRIVERS\bddci.sys [739264 2019-11-20] (Bitdefender SRL -> Bitdefender)
    S0 bdelam; C:\Windows\System32\drivers\bdelam.sys [22960 2019-03-20] (Microsoft Windows Early Launch Anti-malware Publisher -> Bitdefender)
    S3 bdprivmon; C:\Windows\System32\DRIVERS\bdprivmon.sys [46056 2020-02-20] (Bitdefender SRL -> © Bitdefender SRL)
    S3 BDVEDISK; C:\Windows\system32\DRIVERS\bdvedisk.sys [96448 2018-04-27] (Bitdefender SRL -> BitDefender)
    S3 dg_ssudbus; C:\Windows\system32\DRIVERS\ssudbus.sys [131984 2017-05-18] (Samsung Electronics Co., Ltd. -> Samsung Electronics Co., Ltd.)
    R1 ESProtectionDriver; C:\Windows\system32\drivers\mbae64.sys [153312 2020-02-07] (Malwarebytes Corporation -> Malwarebytes)
    R0 Gemma; C:\Windows\System32\DRIVERS\gemma.sys [564136 2020-02-20] (Bitdefender SRL -> BitDefender S.R.L. Bucharest, ROMANIA)
    R0 gzflt; C:\Windows\System32\DRIVERS\gzflt.sys [188384 2018-11-28] (Bitdefender SRL -> BitDefender LLC)
    R1 HWiNFO32; C:\Windows\SysWOW64\drivers\HWiNFO64A.SYS [27552 2018-08-21] (Martin Malik - REALiX -> REALiX(tm))
    S3 Ignis; C:\Windows\system32\DRIVERS\ignis.sys [196392 2019-09-13] (Bitdefender SRL -> Bitdefender)
    R3 IUFileFilter; C:\Program Files (x86)\IObit\IObit Uninstaller\drivers\win10_amd64\IUFileFilter.sys [44112 2019-07-30] (IObit Information Technology -> IObit)
    R3 IUProcessFilter; C:\Program Files (x86)\IObit\IObit Uninstaller\drivers\win10_amd64\IUProcessFilter.sys [37328 2019-07-30] (IObit Information Technology -> IObit)
    R3 IURegistryFilter; C:\Program Files (x86)\IObit\IObit Uninstaller\drivers\win10_amd64\IURegistryFilter.sys [49800 2019-07-30] (IObit Information Technology -> IObit)
    R2 MBAMChameleon; C:\Windows\System32\Drivers\MbamChameleon.sys [214496 2020-02-07] (Malwarebytes Inc -> Malwarebytes)
    S0 MbamElam; C:\Windows\System32\DRIVERS\MbamElam.sys [20936 2019-11-21] (Microsoft Windows Early Launch Anti-malware Publisher -> Malwarebytes)
    R3 MBAMFarflt; C:\Windows\System32\DRIVERS\farflt.sys [226448 2020-02-25] (Malwarebytes Inc -> Malwarebytes)
    R3 MBAMProtection; C:\Windows\system32\DRIVERS\mbam.sys [73584 2020-02-25] (Malwarebytes Corporation -> Malwarebytes)
    R3 MBAMSwissArmy; C:\Windows\System32\Drivers\mbamswissarmy.sys [248968 2020-02-25] (Malwarebytes Inc -> Malwarebytes)
    R3 MBAMWebProtection; C:\Windows\system32\DRIVERS\mwac.sys [119960 2020-02-25] (Malwarebytes Inc -> Malwarebytes)
    R2 npf; C:\Windows\system32\drivers\npf.sys [36600 2018-12-19] (Riverbed Technology, Inc. -> Riverbed Technology, Inc.)
    R0 pwdrvio; C:\Windows\System32\pwdrvio.sys [19152 2013-09-30] (MiniTool Solution Ltd -> )
    S3 pwdspio; C:\Windows\system32\pwdspio.sys [12504 2013-09-30] (MiniTool Solution Ltd -> )
    R3 rt640x64; C:\Windows\System32\drivers\rt640x64.sys [1139424 2018-08-21] (Realtek Semiconductor Corp. -> Realtek )
    R0 SmartDefragDriver; C:\Windows\System32\Drivers\SmartDefragDriver.sys [30744 2017-03-09] (IObit Information Technology -> IObit)
    S3 ssudmdm; C:\Windows\system32\DRIVERS\ssudmdm.sys [166288 2017-05-18] (Samsung Electronics Co., Ltd. -> Samsung Electronics Co., Ltd.)
    R3 tap0901; C:\Windows\System32\drivers\tap0901.sys [27136 2016-04-21] (OpenVPN Technologies, Inc. -> The OpenVPN Project)
    R0 trufos; C:\Windows\System32\DRIVERS\trufos.sys [610640 2019-01-14] (Bitdefender SRL -> Bitdefender)
    S3 USBAAPL64; C:\Windows\System32\Drivers\usbaapl64.sys [54784 2018-02-01] (Microsoft Windows Hardware Compatibility Publisher -> Apple, Inc.)
    S3 WdBoot; C:\Windows\system32\drivers\wd\WdBoot.sys [45664 2019-12-27] (Microsoft Windows Early Launch Anti-malware Publisher -> Microsoft Corporation)
    S3 WdFilter; C:\Windows\system32\drivers\wd\WdFilter.sys [355760 2019-12-27] (Microsoft Windows -> Microsoft Corporation)
    S3 wdm_usb; C:\Windows\system32\DRIVERS\usb2ser.sys [151184 2016-07-15] (NGO -> MBB)
    S3 WdNisDrv; C:\Windows\System32\drivers\wd\WdNisDrv.sys [54192 2019-12-27] (Microsoft Windows -> Microsoft Corporation)
    R1 ZAM_Guard; C:\Windows\System32\drivers\zamguard64.sys [250024 2018-09-14] (Zemana Ltd. -> Copyright 2017.)
    U3 aswbdisk; no ImagePath
    S3 CXCVBS; \SystemRoot\system32\drivers\cxCVBS.sys [X]
    S4 IMFMBRProtect; \??\C:\Program Files (x86)\IObit\IObit Malware Fighter\drivers\win10_amd64\IMFMBRProtect.sys [X]
    S4 IMFSafeBox; \??\C:\Program Files (x86)\IObit\IObit Malware Fighter\drivers\win10_amd64\IMFSafeBox.sys [X]
    S3 pfc; system32\drivers\pfc.sys [X]
    S3 VIDBOX8B30; \SystemRoot\system32\drivers\cxCVBS.sys [X]
    S1 ZAM; \??\C:\Windows\System32\drivers\zam64.sys [X]

    ==================== NetSvcs (Whitelisted) ===================

    (If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)
     
    joe645,
    #18
  20. 2020/02/25
    joe645

    joe645 Well-Known Member Thread Starter

    Joined:
    2004/01/26
    Messages:
    435
    Likes Received:
    1
    ==================== One month (created) ===================

    (If an entry is included in the fixlist, the file/folder will be moved.)

    2020-02-25 12:10 - 2020-02-25 12:10 - 000073584 _____ (Malwarebytes) C:\Windows\system32\Drivers\mbam.sys
    2020-02-25 12:08 - 2020-02-25 12:08 - 000226448 _____ (Malwarebytes) C:\Windows\system32\Drivers\farflt.sys
    2020-02-25 12:08 - 2020-02-25 12:08 - 000119960 _____ (Malwarebytes) C:\Windows\system32\Drivers\mwac.sys
    2020-02-25 12:07 - 2020-02-25 12:07 - 000248968 _____ (Malwarebytes) C:\Windows\system32\Drivers\mbamswissarmy.sys
    2020-02-24 15:16 - 2020-02-25 14:46 - 000000000 ____D C:\FRST
    2020-02-22 17:52 - 2020-02-22 17:53 - 000011198 _____ C:\Users\User\Documents\CarolynLdgr.ods
    2020-02-22 12:54 - 2020-02-22 12:53 - 000000012 _____ C:\Windows\system32\StartupCheck.vbs
    2020-02-21 13:14 - 2020-02-21 13:14 - 000000000 ___HD C:\Windows\AxInstSV
    2020-02-20 10:13 - 2020-02-20 10:13 - 000103520 _____ C:\ProgramData\vpn.uninstall.1582222212.bdinstall.v2.bin
    2020-02-20 10:13 - 2020-02-20 10:13 - 000038530 _____ C:\ProgramData\vpn.uninstall.1582222352.bdinstall.bin
    2020-02-17 16:54 - 2020-02-17 16:54 - 000000000 ____D C:\Users\User\Downloads\ConvertXtoDVD.7.0.0.68
    2020-02-17 16:53 - 2020-02-17 16:53 - 038763710 _____ C:\Users\User\Downloads\VSO ConvertXtoDVD 7.0.0.61 Full - PortableAppz [4REALTORRENTZ.COM].ZIP
    2020-02-17 16:52 - 2020-02-17 17:29 - 000000000 ____D C:\Users\User\AppData\LocalLow\uTorrent
    2020-02-17 16:50 - 2020-02-17 16:54 - 000000000 ____D C:\Users\User\Documents\ConvertXtoDVD_Resources
    2020-02-17 16:49 - 2020-02-17 16:49 - 000099384 _____ C:\Users\User\AppData\Roaming\inst.exe
    2020-02-17 16:49 - 2020-02-17 16:49 - 000082816 _____ (VSO Software) C:\Users\User\AppData\Roaming\pcouffin.sys
    2020-02-17 16:49 - 2020-02-17 16:49 - 000007859 _____ C:\Users\User\AppData\Roaming\pcouffin.cat
    2020-02-17 16:49 - 2020-02-17 16:49 - 000000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\VSO
    2020-02-17 16:48 - 2020-02-18 13:15 - 000000000 ____D C:\ProgramData\VSO
    2020-02-17 16:48 - 2020-02-17 16:56 - 000000000 ____D C:\Users\User\Documents\ConvertXToDVD
    2020-02-17 16:48 - 2020-02-17 16:50 - 000000000 ____D C:\Users\User\AppData\Roaming\VSO
    2020-02-17 16:48 - 2020-02-17 16:48 - 000000000 ____D C:\Program Files (x86)\VSO
    2020-02-17 16:46 - 2020-02-17 16:46 - 038112216 _____ (VSO Software ) C:\Users\User\Downloads\vsoConvertXtoDVD7_setup.exe
    2020-02-15 16:13 - 2020-02-15 16:43 - 000000000 ____D C:\Users\User\Downloads\Midway (2019) [1080p] [BluRay] [5.1] [YTS.MX]
    2020-02-11 11:19 - 2020-02-05 04:34 - 004527584 _____ (Microsoft Corporation) C:\Windows\system32\sppsvc.exe
    2020-02-11 11:19 - 2020-02-05 04:33 - 021412488 _____ (Microsoft Corporation) C:\Windows\system32\shell32.dll
    2020-02-11 11:19 - 2020-02-05 04:18 - 012879872 _____ (Microsoft Corporation) C:\Windows\system32\ieframe.dll
    2020-02-11 11:19 - 2020-02-05 02:52 - 012075520 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieframe.dll
    2020-02-11 11:19 - 2020-02-04 23:25 - 001213264 _____ (Microsoft Corporation) C:\Windows\system32\ClipUp.exe
    2020-02-11 11:19 - 2020-02-04 23:23 - 005627792 _____ (Microsoft Corporation) C:\Windows\system32\StartTileData.dll
    2020-02-11 11:19 - 2020-02-04 23:21 - 009081656 _____ (Microsoft Corporation) C:\Windows\system32\ntoskrnl.exe
    2020-02-11 11:19 - 2020-02-04 23:21 - 007519896 _____ (Microsoft Corporation) C:\Windows\system32\Windows.Media.Protection.PlayReady.dll
    2020-02-11 11:19 - 2020-02-04 23:21 - 007447904 _____ (Microsoft Corporation) C:\Windows\system32\windows.storage.dll
    2020-02-11 11:19 - 2020-02-04 23:19 - 006570368 _____ (Microsoft Corporation) C:\Windows\SysWOW64\Windows.Media.Protection.PlayReady.dll
    2020-02-11 11:19 - 2020-02-04 23:11 - 022016512 _____ (Microsoft Corporation) C:\Windows\SysWOW64\edgehtml.dll
    2020-02-11 11:19 - 2020-02-04 23:04 - 025854976 _____ (Microsoft Corporation) C:\Windows\system32\edgehtml.dll
    2020-02-11 11:19 - 2020-02-04 23:03 - 019393536 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.dll
    2020-02-11 11:19 - 2020-02-04 23:00 - 022745088 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.dll
    2020-02-11 11:19 - 2020-02-04 22:59 - 005770752 _____ (Microsoft Corporation) C:\Windows\SysWOW64\Chakra.dll
    2020-02-11 11:19 - 2020-02-04 22:58 - 004710400 _____ (Microsoft Corporation) C:\Windows\system32\cdp.dll
    2020-02-11 11:19 - 2020-02-04 22:57 - 004516864 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wininet.dll
    2020-02-11 11:19 - 2020-02-04 22:54 - 007572992 _____ (Microsoft Corporation) C:\Windows\system32\Chakra.dll
    2020-02-11 11:19 - 2020-02-04 22:52 - 004938240 _____ (Microsoft Corporation) C:\Windows\system32\wininet.dll
    2020-02-11 11:18 - 2020-02-05 04:34 - 001639864 _____ (Microsoft Corporation) C:\Windows\system32\user32.dll
    2020-02-11 11:18 - 2020-02-05 04:34 - 001617360 _____ (Microsoft Corporation) C:\Windows\system32\sppobjs.dll
    2020-02-11 11:18 - 2020-02-05 04:32 - 001047352 _____ (Microsoft Corporation) C:\Windows\system32\ReAgent.dll
    2020-02-11 11:18 - 2020-02-05 04:17 - 008629760 _____ (Microsoft Corporation) C:\Windows\system32\mstscax.dll
    2020-02-11 11:18 - 2020-02-05 04:16 - 001030144 _____ (Microsoft Corporation) C:\Windows\system32\termsrv.dll
    2020-02-11 11:18 - 2020-02-05 04:15 - 002019840 _____ (Microsoft Corporation) C:\Windows\system32\ResetEngine.dll
    2020-02-11 11:18 - 2020-02-05 04:15 - 001609728 _____ (Microsoft Corporation) C:\Windows\system32\rdpcorets.dll
    2020-02-11 11:18 - 2020-02-05 04:14 - 000957440 _____ (Microsoft Corporation) C:\Windows\system32\sppcext.dll
    2020-02-11 11:18 - 2020-02-05 04:13 - 004054016 _____ (Microsoft Corporation) C:\Windows\system32\msi.dll
    2020-02-11 11:18 - 2020-02-05 04:13 - 003613696 _____ (Microsoft Corporation) C:\Windows\system32\win32kfull.sys
    2020-02-11 11:18 - 2020-02-05 04:13 - 001364992 _____ (Microsoft Corporation) C:\Windows\system32\bcastdvruserservice.dll
    2020-02-11 11:18 - 2020-02-05 04:13 - 000878592 _____ (Microsoft Corporation) C:\Windows\system32\CPFilters.dll
    2020-02-11 11:18 - 2020-02-05 04:13 - 000577024 _____ (Microsoft Corporation) C:\Windows\system32\SppExtComObj.Exe
    2020-02-11 11:18 - 2020-02-05 04:12 - 001290240 _____ (Microsoft Corporation) C:\Windows\system32\werconcpl.dll
    2020-02-11 11:18 - 2020-02-05 04:12 - 000440832 _____ (Microsoft Corporation) C:\Windows\system32\LockAppBroker.dll
    2020-02-11 11:18 - 2020-02-05 03:07 - 001628488 _____ (Microsoft Corporation) C:\Windows\SysWOW64\user32.dll
    2020-02-11 11:18 - 2020-02-05 03:06 - 020402192 _____ (Microsoft Corporation) C:\Windows\SysWOW64\shell32.dll
    2020-02-11 11:18 - 2020-02-05 02:50 - 007992832 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mstscax.dll
    2020-02-11 11:18 - 2020-02-05 02:48 - 002881536 _____ (Microsoft Corporation) C:\Windows\SysWOW64\win32kfull.sys
    2020-02-11 11:18 - 2020-02-05 02:48 - 000901120 _____ (Microsoft Corporation) C:\Windows\SysWOW64\sppcext.dll
    2020-02-11 11:18 - 2020-02-05 02:48 - 000704000 _____ (Microsoft Corporation) C:\Windows\SysWOW64\CPFilters.dll
    2020-02-11 11:18 - 2020-02-05 02:48 - 000375808 _____ (Microsoft Corporation) C:\Windows\SysWOW64\LockAppBroker.dll
    2020-02-11 11:18 - 2020-02-05 02:47 - 004053504 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msi.dll
    2020-02-11 11:18 - 2020-02-04 23:42 - 003180080 _____ (Microsoft Corporation) C:\Windows\system32\d3d11.dll
    2020-02-11 11:18 - 2020-02-04 23:42 - 001613096 _____ (Microsoft Corporation) C:\Windows\system32\D3D12.dll
    2020-02-11 11:18 - 2020-02-04 23:41 - 001299168 _____ (Microsoft Corporation) C:\Windows\SysWOW64\D3D12.dll
    2020-02-11 11:18 - 2020-02-04 23:40 - 002417952 _____ (Microsoft Corporation) C:\Windows\SysWOW64\d3d11.dll
    2020-02-11 11:18 - 2020-02-04 23:25 - 001035040 _____ (Microsoft Corporation) C:\Windows\system32\ApplyTrustOffline.exe
    2020-02-11 11:18 - 2020-02-04 23:23 - 001224504 _____ (Microsoft Corporation) C:\Windows\system32\hvix64.exe
    2020-02-11 11:18 - 2020-02-04 23:23 - 001027384 _____ (Microsoft Corporation) C:\Windows\system32\hvax64.exe
    2020-02-11 11:18 - 2020-02-04 23:23 - 000568104 _____ (Microsoft Corporation) C:\Windows\system32\tcblaunch.exe
    2020-02-11 11:18 - 2020-02-04 23:23 - 000491208 _____ (Microsoft Corporation) C:\Windows\system32\mf.dll
    2020-02-11 11:18 - 2020-02-04 23:23 - 000324928 _____ (Microsoft Corporation) C:\Windows\system32\wow64.dll
    2020-02-11 11:18 - 2020-02-04 23:22 - 000777304 _____ (Microsoft Corporation) C:\Windows\system32\wer.dll
    2020-02-11 11:18 - 2020-02-04 23:22 - 000495416 _____ (Microsoft Corporation) C:\Windows\system32\WerFault.exe
    2020-02-11 11:18 - 2020-02-04 23:22 - 000441072 _____ (Microsoft Corporation) C:\Windows\system32\Faultrep.dll
    2020-02-11 11:18 - 2020-02-04 23:21 - 004404720 _____ (Microsoft Corporation) C:\Windows\system32\mfcore.dll
    2020-02-11 11:18 - 2020-02-04 23:21 - 002811192 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\dxgkrnl.sys
    2020-02-11 11:18 - 2020-02-04 23:21 - 002371296 _____ (Microsoft Corporation) C:\Windows\system32\msmpeg2vdec.dll
    2020-02-11 11:18 - 2020-02-04 23:21 - 001943128 _____ (Microsoft Corporation) C:\Windows\system32\ntdll.dll
    2020-02-11 11:18 - 2020-02-04 23:21 - 001934808 _____ (Microsoft Corporation) C:\Windows\system32\AudioEng.dll
    2020-02-11 11:18 - 2020-02-04 23:21 - 001780352 _____ (Microsoft Corporation) C:\Windows\system32\mfasfsrcsnk.dll
    2020-02-11 11:18 - 2020-02-04 23:21 - 001459120 _____ (Microsoft Corporation) C:\Windows\system32\winload.efi
    2020-02-11 11:18 - 2020-02-04 23:21 - 001285432 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\ndis.sys
    2020-02-11 11:18 - 2020-02-04 23:21 - 001260776 _____ (Microsoft Corporation) C:\Windows\system32\winload.exe
    2020-02-11 11:18 - 2020-02-04 23:21 - 001209696 _____ (Microsoft Corporation) C:\Windows\system32\AudioSes.dll
    2020-02-11 11:18 - 2020-02-04 23:21 - 001141504 _____ (Microsoft Corporation) C:\Windows\system32\winresume.efi
    2020-02-11 11:18 - 2020-02-04 23:21 - 001098064 _____ (Microsoft Corporation) C:\Windows\system32\msvproc.dll
    2020-02-11 11:18 - 2020-02-04 23:21 - 001032968 _____ (Microsoft Corporation) C:\Windows\system32\ClipSVC.dll
    2020-02-11 11:18 - 2020-02-04 23:21 - 000983936 _____ (Microsoft Corporation) C:\Windows\system32\winresume.exe
    2020-02-11 11:18 - 2020-02-04 23:21 - 000930616 _____ (Microsoft Corporation) C:\Windows\system32\WWAHost.exe
    2020-02-11 11:18 - 2020-02-04 23:21 - 000791352 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\dxgmms2.sys
    2020-02-11 11:18 - 2020-02-04 23:21 - 000694184 _____ (Microsoft Corporation) C:\Windows\system32\StructuredQuery.dll
    2020-02-11 11:18 - 2020-02-04 23:21 - 000605496 _____ (Microsoft Corporation) C:\Windows\system32\securekernel.exe
    2020-02-11 11:18 - 2020-02-04 23:21 - 000594032 _____ (Microsoft Corporation) C:\Windows\system32\audiodg.exe
    2020-02-11 11:18 - 2020-02-04 23:21 - 000550520 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mf.dll
    2020-02-11 11:18 - 2020-02-04 23:21 - 000383288 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\clfs.sys
    2020-02-11 11:18 - 2020-02-04 23:21 - 000260800 _____ (Microsoft Corporation) C:\Windows\system32\mfps.dll
    2020-02-11 11:18 - 2020-02-04 23:20 - 000665736 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wer.dll
    2020-02-11 11:18 - 2020-02-04 23:19 - 006054320 _____ (Microsoft Corporation) C:\Windows\SysWOW64\windows.storage.dll
    2020-02-11 11:18 - 2020-02-04 23:19 - 004790184 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mfcore.dll
    2020-02-11 11:18 - 2020-02-04 23:19 - 002331480 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msmpeg2vdec.dll
    2020-02-11 11:18 - 2020-02-04 23:19 - 001805656 _____ (Microsoft Corporation) C:\Windows\SysWOW64\AudioEng.dll
    2020-02-11 11:18 - 2020-02-04 23:19 - 001620472 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ntdll.dll
    2020-02-11 11:18 - 2020-02-04 23:19 - 001379280 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mfasfsrcsnk.dll
    2020-02-11 11:18 - 2020-02-04 23:19 - 001130568 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msvproc.dll
    2020-02-11 11:18 - 2020-02-04 23:19 - 001011872 _____ (Microsoft Corporation) C:\Windows\SysWOW64\AudioSes.dll
    2020-02-11 11:18 - 2020-02-04 23:19 - 000829752 _____ (Microsoft Corporation) C:\Windows\SysWOW64\WWAHost.exe
    2020-02-11 11:18 - 2020-02-04 23:19 - 000538704 _____ (Microsoft Corporation) C:\Windows\SysWOW64\StructuredQuery.dll
    2020-02-11 11:18 - 2020-02-04 23:02 - 006647296 _____ (Microsoft Corporation) C:\Windows\SysWOW64\BingMaps.dll
    2020-02-11 11:18 - 2020-02-04 23:02 - 002700800 _____ (Microsoft Corporation) C:\Windows\SysWOW64\tquery.dll
    2020-02-11 11:18 - 2020-02-04 23:01 - 005883904 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mos.dll
    2020-02-11 11:18 - 2020-02-04 23:01 - 002969600 _____ (Microsoft Corporation) C:\Windows\SysWOW64\cdp.dll
    2020-02-11 11:18 - 2020-02-04 23:00 - 003687936 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript9.dll
    2020-02-11 11:18 - 2020-02-04 22:59 - 009084928 _____ (Microsoft Corporation) C:\Windows\system32\BingMaps.dll
    2020-02-11 11:18 - 2020-02-04 22:59 - 007057920 _____ (Microsoft Corporation) C:\Windows\system32\mos.dll
    2020-02-11 11:18 - 2020-02-04 22:58 - 005307392 _____ (Microsoft Corporation) C:\Windows\SysWOW64\d2d1.dll
    2020-02-11 11:18 - 2020-02-04 22:58 - 002258432 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mssrch.dll
    2020-02-11 11:18 - 2020-02-04 22:58 - 001540096 _____ (Microsoft Corporation) C:\Windows\SysWOW64\rdpserverbase.dll
    2020-02-11 11:18 - 2020-02-04 22:58 - 000608768 _____ (Microsoft Corporation) C:\Windows\SysWOW64\EdgeManager.dll
    2020-02-11 11:18 - 2020-02-04 22:57 - 004382720 _____ (Microsoft Corporation) C:\Windows\system32\EdgeContent.dll
    2020-02-11 11:18 - 2020-02-04 22:57 - 003403264 _____ (Microsoft Corporation) C:\Windows\system32\AppXDeploymentServer.dll
    2020-02-11 11:18 - 2020-02-04 22:57 - 002449408 _____ (Microsoft Corporation) C:\Windows\SysWOW64\MapRouter.dll
    2020-02-11 11:18 - 2020-02-04 22:56 - 003392512 _____ (Microsoft Corporation) C:\Windows\system32\tquery.dll
    2020-02-11 11:18 - 2020-02-04 22:56 - 000859136 _____ (Microsoft Corporation) C:\Windows\SysWOW64\SearchIndexer.exe
    2020-02-11 11:18 - 2020-02-04 22:56 - 000669696 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript.dll
    2020-02-11 11:18 - 2020-02-04 22:56 - 000162304 _____ (Microsoft Corporation) C:\Windows\system32\dssvc.dll
    2020-02-11 11:18 - 2020-02-04 22:55 - 006031360 _____ (Microsoft Corporation) C:\Windows\system32\d2d1.dll
    2020-02-11 11:18 - 2020-02-04 22:55 - 004849664 _____ (Microsoft Corporation) C:\Windows\system32\jscript9.dll
    2020-02-11 11:18 - 2020-02-04 22:55 - 001765888 _____ (Microsoft Corporation) C:\Windows\system32\audiosrv.dll
    2020-02-11 11:18 - 2020-02-04 22:55 - 000894464 _____ (Microsoft Corporation) C:\Windows\system32\webplatstorageserver.dll
    2020-02-11 11:18 - 2020-02-04 22:55 - 000795648 _____ (Microsoft Corporation) C:\Windows\SysWOW64\Windows.Security.Authentication.OnlineId.dll
    2020-02-11 11:18 - 2020-02-04 22:55 - 000782336 _____ (Microsoft Corporation) C:\Windows\SysWOW64\kerberos.dll
    2020-02-11 11:18 - 2020-02-04 22:55 - 000713216 _____ (Microsoft Corporation) C:\Windows\SysWOW64\BingOnlineServices.dll
    2020-02-11 11:18 - 2020-02-04 22:54 - 003381248 _____ (Microsoft Corporation) C:\Windows\system32\MapRouter.dll
    2020-02-11 11:18 - 2020-02-04 22:54 - 003093504 _____ (Microsoft Corporation) C:\Windows\system32\diagtrack.dll
    2020-02-11 11:18 - 2020-02-04 22:54 - 002929152 _____ (Microsoft Corporation) C:\Windows\system32\xpsservices.dll
    2020-02-11 11:18 - 2020-02-04 22:54 - 002825728 _____ (Microsoft Corporation) C:\Windows\system32\MapGeocoder.dll
    2020-02-11 11:18 - 2020-02-04 22:54 - 001932288 _____ (Microsoft Corporation) C:\Windows\system32\edgeangle.dll
    2020-02-11 11:18 - 2020-02-04 22:54 - 001549824 _____ (Microsoft Corporation) C:\Windows\system32\lsasrv.dll
    2020-02-11 11:18 - 2020-02-04 22:54 - 001218048 _____ (Microsoft Corporation) C:\Windows\system32\rdpcore.dll
    2020-02-11 11:18 - 2020-02-04 22:54 - 000808960 _____ (Microsoft Corporation) C:\Windows\system32\EdgeManager.dll
    2020-02-11 11:18 - 2020-02-04 22:54 - 000396800 _____ (Microsoft Corporation) C:\Windows\system32\profsvc.dll
    2020-02-11 11:18 - 2020-02-04 22:53 - 002922496 _____ (Microsoft Corporation) C:\Windows\system32\wuaueng.dll
    2020-02-11 11:18 - 2020-02-04 22:53 - 002739200 _____ (Microsoft Corporation) C:\Windows\system32\mssrch.dll
    2020-02-11 11:18 - 2020-02-04 22:53 - 002179584 _____ (Microsoft Corporation) C:\Windows\system32\AppXDeploymentExtensions.onecore.dll
    2020-02-11 11:18 - 2020-02-04 22:53 - 001563648 _____ (Microsoft Corporation) C:\Windows\system32\AppXDeploymentExtensions.desktop.dll
    2020-02-11 11:18 - 2020-02-04 22:53 - 001023488 _____ (Microsoft Corporation) C:\Windows\system32\ShareHost.dll
    2020-02-11 11:18 - 2020-02-04 22:53 - 000686592 _____ (Microsoft Corporation) C:\Windows\system32\AudioEndpointBuilder.dll
    2020-02-11 11:18 - 2020-02-04 22:53 - 000491520 _____ (Microsoft Corporation) C:\Windows\system32\defragsvc.dll
    2020-02-11 11:18 - 2020-02-04 22:52 - 002379264 _____ (Microsoft Corporation) C:\Windows\system32\WebRuntimeManager.dll
    2020-02-11 11:18 - 2020-02-04 22:52 - 002161152 _____ (Microsoft Corporation) C:\Windows\system32\win32kbase.sys
    2020-02-11 11:18 - 2020-02-04 22:52 - 001264640 _____ (Microsoft Corporation) C:\Windows\system32\JpMapControl.dll
    2020-02-11 11:18 - 2020-02-04 22:52 - 001225216 _____ (Microsoft Corporation) C:\Windows\system32\MapsStore.dll
    2020-02-11 11:18 - 2020-02-04 22:52 - 001059840 _____ (Microsoft Corporation) C:\Windows\system32\SearchIndexer.exe
    2020-02-11 11:18 - 2020-02-04 22:51 - 001724928 _____ (Microsoft Corporation) C:\Windows\system32\rdpserverbase.dll
    2020-02-11 11:18 - 2020-02-04 22:51 - 001421312 _____ (Microsoft Corporation) C:\Windows\system32\rdpbase.dll
    2020-02-11 11:18 - 2020-02-04 22:51 - 001084928 _____ (Microsoft Corporation) C:\Windows\system32\wifinetworkmanager.dll
    2020-02-11 11:18 - 2020-02-04 22:51 - 000943616 _____ (Microsoft Corporation) C:\Windows\system32\BingOnlineServices.dll
    2020-02-11 11:18 - 2020-02-04 22:51 - 000927232 _____ (Microsoft Corporation) C:\Windows\system32\MsSpellCheckingFacility.dll
    2020-02-11 11:18 - 2020-02-04 22:51 - 000910848 _____ (Microsoft Corporation) C:\Windows\system32\kerberos.dll
    2020-02-11 11:18 - 2020-02-04 22:51 - 000896000 _____ (Microsoft Corporation) C:\Windows\system32\Windows.Security.Authentication.OnlineId.dll
    2020-02-11 11:18 - 2020-02-04 22:51 - 000884736 _____ (Microsoft Corporation) C:\Windows\system32\MapControlCore.dll
    2020-02-11 11:18 - 2020-02-04 22:51 - 000884224 _____ (Microsoft Corporation) C:\Windows\system32\NMAA.dll
    2020-02-11 11:18 - 2020-02-04 22:51 - 000776704 _____ (Microsoft Corporation) C:\Windows\system32\jscript.dll
    2020-02-11 11:18 - 2020-02-04 22:51 - 000637440 _____ (Microsoft Corporation) C:\Windows\system32\cdpsvc.dll
    2020-02-11 11:18 - 2020-01-07 02:06 - 001726480 _____ (Microsoft Corporation) C:\Windows\system32\appraiser.dll
    2020-02-11 11:18 - 2020-01-07 02:05 - 000747528 _____ (Microsoft Corporation) C:\Windows\system32\aeinv.dll
    2020-02-11 11:18 - 2020-01-07 02:05 - 000638480 _____ (Microsoft Corporation) C:\Windows\system32\devinv.dll
    2020-02-11 11:18 - 2020-01-07 02:05 - 000465424 _____ (Microsoft Corporation) C:\Windows\system32\invagent.dll
    2020-02-11 11:18 - 2020-01-07 02:05 - 000324624 _____ (Microsoft Corporation) C:\Windows\system32\acmigration.dll
    2020-02-11 11:18 - 2020-01-07 01:53 - 004103224 _____ (Microsoft Corporation) C:\Windows\explorer.exe
    2020-02-11 11:18 - 2020-01-07 01:52 - 000288872 _____ (Microsoft Corporation) C:\Windows\system32\wscapi.dll
    2020-02-11 11:18 - 2020-01-07 01:47 - 001517176 _____ (Microsoft Corporation) C:\Windows\system32\msctf.dll
    2020-02-11 11:18 - 2020-01-07 01:47 - 000790928 _____ (Microsoft Corporation) C:\Windows\system32\fontdrvhost.exe
    2020-02-11 11:18 - 2020-01-07 01:30 - 006603776 _____ (Microsoft Corporation) C:\Windows\system32\twinui.dll
    2020-02-11 11:18 - 2020-01-07 01:28 - 000093696 _____ (Microsoft Corporation) C:\Windows\system32\msfeedsbs.dll
    2020-02-11 11:18 - 2020-01-07 01:24 - 001262592 _____ (Microsoft Corporation) C:\Windows\system32\SystemSettings.Handlers.dll
    2020-02-11 11:18 - 2020-01-07 00:33 - 001320336 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msctf.dll
    2020-02-11 11:18 - 2020-01-07 00:33 - 000662840 _____ (Microsoft Corporation) C:\Windows\SysWOW64\fontdrvhost.exe
    2020-02-11 11:18 - 2020-01-07 00:31 - 003755408 _____ (Microsoft Corporation) C:\Windows\SysWOW64\explorer.exe
    2020-02-11 11:18 - 2020-01-07 00:21 - 005670400 _____ (Microsoft Corporation) C:\Windows\SysWOW64\twinui.dll
    2020-02-11 11:18 - 2020-01-07 00:19 - 000080896 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msfeedsbs.dll
    2020-02-11 11:18 - 2020-01-06 20:18 - 000376848 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\pci.sys
    2020-02-11 11:18 - 2020-01-06 20:11 - 000797984 _____ (Microsoft Corporation) C:\Windows\system32\SecurityHealthService.exe
    2020-02-11 11:18 - 2020-01-06 20:11 - 000266040 _____ (Microsoft Corporation) C:\Windows\system32\SecurityHealthAgent.dll
    2020-02-11 11:18 - 2020-01-06 20:08 - 002773088 _____ (Microsoft Corporation) C:\Windows\system32\iertutil.dll
    2020-02-11 11:18 - 2020-01-06 20:08 - 002711352 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\tcpip.sys
    2020-02-11 11:18 - 2020-01-06 20:08 - 002421768 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\ntfs.sys
    2020-02-11 11:18 - 2020-01-06 20:08 - 001030672 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\http.sys
    2020-02-11 11:18 - 2020-01-06 20:08 - 000722744 _____ (Microsoft Corporation) C:\Windows\system32\SettingsHandlers_StorageSense.dll
    2020-02-11 11:18 - 2020-01-06 20:01 - 002261448 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iertutil.dll
    2020-02-11 11:18 - 2020-01-06 19:42 - 003553792 _____ (Microsoft Corporation) C:\Windows\SysWOW64\InputService.dll
    2020-02-11 11:18 - 2020-01-06 19:41 - 000150528 _____ (Microsoft Corporation) C:\Windows\system32\SettingsHandlers_BackgroundApps.dll
    2020-02-11 11:18 - 2020-01-06 19:40 - 000384512 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieproxy.dll
    2020-02-11 11:18 - 2020-01-06 19:39 - 002789376 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msftedit.dll
    2020-02-11 11:18 - 2020-01-06 19:39 - 000203264 _____ (Microsoft Corporation) C:\Windows\system32\SettingsHandlers_CapabilityAccess.dll
    2020-02-11 11:18 - 2020-01-06 19:39 - 000154112 _____ (Microsoft Corporation) C:\Windows\system32\SettingsHandlers_AppExecutionAlias.dll
    2020-02-11 11:18 - 2020-01-06 19:38 - 001655296 _____ (Microsoft Corporation) C:\Windows\SysWOW64\winmsipc.dll
    2020-02-11 11:18 - 2020-01-06 19:38 - 001644032 _____ (Microsoft Corporation) C:\Windows\SysWOW64\urlmon.dll
    2020-02-11 11:18 - 2020-01-06 19:38 - 000537088 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ActivationManager.dll
    2020-02-11 11:18 - 2020-01-06 19:38 - 000487936 _____ (Microsoft Corporation) C:\Windows\system32\MusNotification.exe
    2020-02-11 11:18 - 2020-01-06 19:38 - 000463872 _____ (Microsoft Corporation) C:\Windows\system32\cloudAP.dll
    2020-02-11 11:18 - 2020-01-06 19:38 - 000229888 _____ (Microsoft Corporation) C:\Windows\system32\SettingsHandlers_Geolocation.dll
    2020-02-11 11:18 - 2020-01-06 19:37 - 004771328 _____ (Microsoft Corporation) C:\Windows\system32\InputService.dll
    2020-02-11 11:18 - 2020-01-06 19:37 - 000369152 _____ (Microsoft Corporation) C:\Windows\system32\MusNotificationUx.exe
    2020-02-11 11:18 - 2020-01-06 19:37 - 000272896 _____ (Microsoft Corporation) C:\Windows\system32\Windows.UI.AppDefaults.dll
    2020-02-11 11:18 - 2020-01-06 19:36 - 000929280 _____ (Microsoft Corporation) C:\Windows\system32\MusUpdateHandlers.dll
    2020-02-11 11:18 - 2020-01-06 19:35 - 000517632 _____ (Microsoft Corporation) C:\Windows\system32\SettingsHandlers_Notifications.dll
    2020-02-11 11:18 - 2020-01-06 19:35 - 000498688 _____ (Microsoft Corporation) C:\Windows\system32\CredProvDataModel.dll
    2020-02-11 11:18 - 2020-01-06 19:34 - 003348992 _____ (Microsoft Corporation) C:\Windows\system32\msftedit.dll
    2020-02-11 11:18 - 2020-01-06 19:34 - 000933888 _____ (Microsoft Corporation) C:\Windows\system32\rasapi32.dll
    2020-02-11 11:18 - 2020-01-06 19:34 - 000863744 _____ (Microsoft Corporation) C:\Windows\system32\ieproxy.dll
    2020-02-11 11:18 - 2020-01-06 19:33 - 002328064 _____ (Microsoft Corporation) C:\Windows\system32\winmsipc.dll
    2020-02-11 11:18 - 2020-01-06 19:33 - 001821184 _____ (Microsoft Corporation) C:\Windows\system32\urlmon.dll
    2020-02-11 11:18 - 2020-01-06 19:33 - 001458688 _____ (Microsoft Corporation) C:\Windows\system32\dosvc.dll
    2020-02-11 11:18 - 2020-01-06 19:33 - 001419776 _____ (Microsoft Corporation) C:\Windows\system32\usocore.dll
    2020-02-11 11:18 - 2020-01-06 19:33 - 001222656 _____ (Microsoft Corporation) C:\Windows\system32\NotificationController.dll
    2020-02-11 11:18 - 2020-01-06 19:33 - 000663040 _____ (Microsoft Corporation) C:\Windows\system32\ActivationManager.dll
    2020-02-11 11:18 - 2020-01-06 19:33 - 000629760 _____ (Microsoft Corporation) C:\Windows\system32\updatehandlers.dll
    2020-02-11 11:18 - 2020-01-06 19:33 - 000506368 _____ (Microsoft Corporation) C:\Windows\system32\edgeIso.dll
    2020-02-11 11:18 - 2019-08-07 00:08 - 000710232 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\cng.sys
    2020-02-11 11:17 - 2020-02-05 04:42 - 000506088 _____ (Microsoft Corporation) C:\Windows\system32\systemreset.exe
    2020-02-11 11:17 - 2020-02-05 04:39 - 000094224 _____ (Microsoft Corporation) C:\Windows\system32\rdpudd.dll
    2020-02-11 11:17 - 2020-02-05 04:20 - 000064000 _____ (Microsoft Corporation) C:\Windows\system32\iemigplugin.dll
    2020-02-11 11:17 - 2020-02-05 04:19 - 000008704 _____ (Microsoft Corporation) C:\Windows\system32\f3ahvoas.dll
    2020-02-11 11:17 - 2020-02-05 04:18 - 000172544 _____ (Microsoft Corporation) C:\Windows\system32\rdsdwmdr.dll
    2020-02-11 11:17 - 2020-02-05 04:18 - 000106496 _____ (Microsoft Corporation) C:\Windows\system32\fdSSDP.dll
    2020-02-11 11:17 - 2020-02-05 04:17 - 000056832 _____ (Microsoft Corporation) C:\Windows\system32\SrTasks.exe
    2020-02-11 11:17 - 2020-02-05 04:16 - 000810496 _____ C:\Windows\system32\MBR2GPT.EXE
    2020-02-11 11:17 - 2020-02-05 04:16 - 000575488 _____ (Microsoft Corporation) C:\Windows\system32\dfrgui.exe
    2020-02-11 11:17 - 2020-02-05 04:16 - 000247808 _____ (Microsoft Corporation) C:\Windows\system32\srrstr.dll
    2020-02-11 11:17 - 2020-02-05 04:16 - 000192512 _____ (Microsoft Corporation) C:\Windows\system32\recdisc.exe
    2020-02-11 11:17 - 2020-02-05 04:16 - 000147456 _____ (Microsoft Corporation) C:\Windows\system32\sdrsvc.dll
    2020-02-11 11:17 - 2020-02-05 04:16 - 000091136 _____ (Microsoft Corporation) C:\Windows\system32\wsqmcons.exe
    2020-02-11 11:17 - 2020-02-05 04:15 - 001194496 _____ (Microsoft Corporation) C:\Windows\system32\sdengin2.dll
    2020-02-11 11:17 - 2020-02-05 04:15 - 000625152 _____ (Microsoft Corporation) C:\Windows\system32\BootMenuUX.dll
    2020-02-11 11:17 - 2020-02-05 04:15 - 000482304 _____ (Microsoft Corporation) C:\Windows\system32\srcore.dll
    2020-02-11 11:17 - 2020-02-05 04:15 - 000308224 _____ (Microsoft Corporation) C:\Windows\system32\tapisrv.dll
    2020-02-11 11:17 - 2020-02-05 04:15 - 000266752 _____ (Microsoft Corporation) C:\Windows\system32\rstrui.exe
    2020-02-11 11:17 - 2020-02-05 04:15 - 000120832 _____ (Microsoft Corporation) C:\Windows\system32\wercplsupport.dll
    2020-02-11 11:17 - 2020-02-05 04:14 - 001211904 _____ (Microsoft Corporation) C:\Windows\system32\sdclt.exe
    2020-02-11 11:17 - 2020-02-05 04:14 - 000489472 _____ (Microsoft Corporation) C:\Windows\system32\werui.dll
    2020-02-11 11:17 - 2020-02-05 04:14 - 000420864 _____ (Microsoft Corporation) C:\Windows\system32\rdpclip.exe
    2020-02-11 11:17 - 2020-02-05 04:12 - 001180672 _____ (Microsoft Corporation) C:\Windows\system32\reseteng.dll
    2020-02-11 11:17 - 2020-02-05 04:12 - 000210944 _____ (Microsoft Corporation) C:\Windows\system32\DWWIN.EXE
    2020-02-11 11:17 - 2020-02-05 04:11 - 000174080 _____ (Microsoft Corporation) C:\Windows\system32\ResetEngOnline.dll
    2020-02-11 11:17 - 2020-02-05 04:11 - 000149504 _____ (Microsoft Corporation) C:\Windows\system32\fdWSD.dll
    2020-02-11 11:17 - 2020-02-05 03:02 - 000917816 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ReAgent.dll
    2020-02-11 11:17 - 2020-02-05 02:54 - 000090112 _____ (Microsoft Corporation) C:\Windows\SysWOW64\fdSSDP.dll
    2020-02-11 11:17 - 2020-02-05 02:53 - 000131072 _____ (Microsoft Corporation) C:\Windows\SysWOW64\fdWSD.dll
    2020-02-11 11:17 - 2020-02-05 02:51 - 000561152 _____ (Microsoft Corporation) C:\Windows\SysWOW64\dfrgui.exe
    2020-02-11 11:17 - 2020-02-05 02:49 - 000425984 _____ (Microsoft Corporation) C:\Windows\SysWOW64\werui.dll
    2020-02-11 11:17 - 2020-02-05 02:49 - 000176640 _____ (Microsoft Corporation) C:\Windows\SysWOW64\DWWIN.EXE
    2020-02-11 11:17 - 2020-02-05 02:48 - 000254464 _____ (Microsoft Corporation) C:\Windows\SysWOW64\tapisrv.dll
    2020-02-11 11:17 - 2020-02-04 23:23 - 000722744 _____ (Microsoft Corporation) C:\Windows\system32\wimgapi.dll
    2020-02-11 11:17 - 2020-02-04 23:23 - 000527376 _____ (Microsoft Corporation) C:\Windows\system32\wimserv.exe
    2020-02-11 11:17 - 2020-02-04 23:23 - 000405816 _____ (Microsoft Corporation) C:\Windows\system32\wifitask.exe
    2020-02-11 11:17 - 2020-02-04 23:23 - 000076088 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\hvservice.sys
    2020-02-11 11:17 - 2020-02-04 23:22 - 000248880 _____ (Microsoft Corporation) C:\Windows\system32\weretw.dll
    2020-02-11 11:17 - 2020-02-04 23:22 - 000210448 _____ (Microsoft Corporation) C:\Windows\system32\wermgr.exe
    2020-02-11 11:17 - 2020-02-04 23:22 - 000159656 _____ (Microsoft Corporation) C:\Windows\system32\WerFaultSecure.exe
    2020-02-11 11:17 - 2020-02-04 23:21 - 000413720 _____ (Microsoft Corporation) C:\Windows\system32\AUDIOKSE.dll
    2020-02-11 11:17 - 2020-02-04 23:21 - 000412984 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\dxgmms1.sys
    2020-02-11 11:17 - 2020-02-04 23:21 - 000335672 _____ (Microsoft Corporation) C:\Windows\system32\moshostcore.dll
    2020-02-11 11:17 - 2020-02-04 23:20 - 000435512 _____ (Microsoft Corporation) C:\Windows\SysWOW64\WerFault.exe
    2020-02-11 11:17 - 2020-02-04 23:20 - 000385784 _____ (Microsoft Corporation) C:\Windows\SysWOW64\Faultrep.dll
    2020-02-11 11:17 - 2020-02-04 23:20 - 000192312 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wermgr.exe
    2020-02-11 11:17 - 2020-02-04 23:20 - 000146712 _____ (Microsoft Corporation) C:\Windows\SysWOW64\WerFaultSecure.exe
    2020-02-11 11:17 - 2020-02-04 23:19 - 000607544 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wimgapi.dll
    2020-02-11 11:17 - 2020-02-04 23:19 - 000385816 _____ (Microsoft Corporation) C:\Windows\SysWOW64\AUDIOKSE.dll
    2020-02-11 11:17 - 2020-02-04 23:19 - 000129296 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mfps.dll
    2020-02-11 11:17 - 2020-02-04 23:00 - 001361408 _____ (Microsoft Corporation) C:\Windows\SysWOW64\MSPhotography.dll
    2020-02-11 11:17 - 2020-02-04 23:00 - 000074240 _____ (Microsoft Corporation) C:\Windows\SysWOW64\dtdump.exe
    2020-02-11 11:17 - 2020-02-04 23:00 - 000037888 _____ (Microsoft Corporation) C:\Windows\SysWOW64\Websocket.dll
    2020-02-11 11:17 - 2020-02-04 23:00 - 000032768 _____ (Microsoft Corporation) C:\Windows\SysWOW64\werdiagcontroller.dll
    2020-02-11 11:17 - 2020-02-04 22:59 - 001295360 _____ (Microsoft Corporation) C:\Windows\SysWOW64\MSVPXENC.dll
    2020-02-11 11:17 - 2020-02-04 22:59 - 000392704 _____ (Microsoft Corporation) C:\Windows\SysWOW64\MapConfiguration.dll
    2020-02-11 11:17 - 2020-02-04 22:59 - 000365568 _____ (Microsoft Corporation) C:\Windows\SysWOW64\rdpencom.dll
    2020-02-11 11:17 - 2020-02-04 22:59 - 000288768 _____ (Microsoft Corporation) C:\Windows\SysWOW64\Search.ProtocolHandler.MAPI2.dll
    2020-02-11 11:17 - 2020-02-04 22:59 - 000071168 _____ (Microsoft Corporation) C:\Windows\SysWOW64\keyiso.dll
    2020-02-11 11:17 - 2020-02-04 22:59 - 000052736 _____ (Microsoft Corporation) C:\Windows\SysWOW64\rtutils.dll
    2020-02-11 11:17 - 2020-02-04 22:58 - 001986560 _____ (Microsoft Corporation) C:\Windows\SysWOW64\MapGeocoder.dll
    2020-02-11 11:17 - 2020-02-04 22:58 - 000578560 _____ (Microsoft Corporation) C:\Windows\SysWOW64\webplatstorageserver.dll
    2020-02-11 11:17 - 2020-02-04 22:58 - 000144384 _____ (Microsoft Corporation) C:\Windows\system32\mssprxy.dll
    2020-02-11 11:17 - 2020-02-04 22:58 - 000094720 _____ (Microsoft Corporation) C:\Windows\system32\MapsCSP.dll
    2020-02-11 11:17 - 2020-02-04 22:57 - 001862656 _____ (Microsoft Corporation) C:\Windows\SysWOW64\xpsservices.dll
    2020-02-11 11:17 - 2020-02-04 22:57 - 001236480 _____ (Microsoft Corporation) C:\Windows\SysWOW64\rdpbase.dll
    2020-02-11 11:17 - 2020-02-04 22:57 - 000185856 _____ (Microsoft Corp.) C:\Windows\system32\Defrag.exe
    2020-02-11 11:17 - 2020-02-04 22:57 - 000099328 _____ (Microsoft Corporation) C:\Windows\system32\utcutil.dll
    2020-02-11 11:17 - 2020-02-04 22:57 - 000046080 _____ (Microsoft Corporation) C:\Windows\system32\Websocket.dll
    2020-02-11 11:17 - 2020-02-04 22:56 - 001076736 _____ (Microsoft Corporation) C:\Windows\SysWOW64\rdpcore.dll
    2020-02-11 11:17 - 2020-02-04 22:56 - 000978944 _____ (Microsoft Corporation) C:\Windows\SysWOW64\JpMapControl.dll
    2020-02-11 11:17 - 2020-02-04 22:56 - 000848384 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ShareHost.dll
    2020-02-11 11:17 - 2020-02-04 22:56 - 000735744 _____ (Microsoft Corporation) C:\Windows\SysWOW64\MsSpellCheckingFacility.dll
    2020-02-11 11:17 - 2020-02-04 22:56 - 000530432 _____ (Microsoft Corporation) C:\Windows\system32\MapConfiguration.dll
    2020-02-11 11:17 - 2020-02-04 22:56 - 000409088 _____ (Microsoft Corporation) C:\Windows\system32\rdpencom.dll
    2020-02-11 11:17 - 2020-02-04 22:56 - 000395776 _____ (Microsoft Corporation) C:\Windows\system32\Search.ProtocolHandler.MAPI2.dll
    2020-02-11 11:17 - 2020-02-04 22:56 - 000334336 _____ (Microsoft Corporation) C:\Windows\system32\NmaDirect.dll
    2020-02-11 11:17 - 2020-02-04 22:56 - 000326144 _____ (Microsoft Corporation) C:\Windows\system32\SettingsHandlers_Flights.dll
    2020-02-11 11:17 - 2020-02-04 22:56 - 000227328 _____ (Microsoft Corporation) C:\Windows\system32\SearchFilterHost.exe
    2020-02-11 11:17 - 2020-02-04 22:56 - 000203264 _____ (Microsoft Corporation) C:\Windows\system32\wersvc.dll
    2020-02-11 11:17 - 2020-02-04 22:56 - 000145408 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mssph.dll
    2020-02-11 11:17 - 2020-02-04 22:56 - 000064000 _____ (Microsoft Corporation) C:\Windows\system32\rtutils.dll
    2020-02-11 11:17 - 2020-02-04 22:55 - 000735744 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mssvp.dll
    2020-02-11 11:17 - 2020-02-04 22:55 - 000729088 _____ (Microsoft Corporation) C:\Windows\SysWOW64\NMAA.dll
    2020-02-11 11:17 - 2020-02-04 22:55 - 000726528 _____ (Microsoft Corporation) C:\Windows\system32\jscript9diag.dll
    2020-02-11 11:17 - 2020-02-04 22:55 - 000705024 _____ (Microsoft Corporation) C:\Windows\SysWOW64\MapControlCore.dll
    2020-02-11 11:17 - 2020-02-04 22:55 - 000345088 _____ (Microsoft Corporation) C:\Windows\SysWOW64\SearchProtocolHost.exe
    2020-02-11 11:17 - 2020-02-04 22:55 - 000089088 _____ (Microsoft Corporation) C:\Windows\system32\keyiso.dll
    2020-02-11 11:17 - 2020-02-04 22:54 - 001708544 _____ (Microsoft Corporation) C:\Windows\system32\MSPhotography.dll
    2020-02-11 11:17 - 2020-02-04 22:54 - 000972800 _____ (Microsoft Corporation) C:\Windows\system32\sysmain.dll
    2020-02-11 11:17 - 2020-02-04 22:52 - 000604672 _____ (Microsoft Corporation) C:\Windows\system32\ipnathlp.dll
    2020-02-11 11:17 - 2020-02-04 22:51 - 000796672 _____ (Microsoft Corporation) C:\Windows\system32\mssvp.dll
    2020-02-11 11:17 - 2020-02-04 22:51 - 000406528 _____ (Microsoft Corporation) C:\Windows\system32\SearchProtocolHost.exe
    2020-02-11 11:17 - 2020-02-04 22:51 - 000176640 _____ (Microsoft Corporation) C:\Windows\system32\mssph.dll
    2020-02-11 11:17 - 2020-02-04 21:31 - 000001314 _____ C:\Windows\system32\tcbres.wim
    2020-02-11 11:17 - 2020-01-07 01:52 - 000349424 _____ (Microsoft Corporation) C:\Windows\system32\MusNotifyIcon.exe
    2020-02-11 11:17 - 2020-01-07 01:47 - 000396304 _____ (Adobe Systems Incorporated) C:\Windows\system32\atmfd.dll
    2020-02-11 11:17 - 2020-01-07 01:30 - 000123904 _____ (Microsoft Corporation) C:\Windows\system32\fontsub.dll
    2020-02-11 11:17 - 2020-01-07 01:29 - 000914944 _____ (Microsoft Corporation) C:\Windows\system32\SecurityHealthSSO.dll
    2020-02-11 11:17 - 2020-01-07 01:29 - 000058368 _____ (Microsoft Corporation) C:\Windows\system32\RDSPnf.exe
    2020-02-11 11:17 - 2020-01-07 01:28 - 000035328 _____ (Microsoft Corporation) C:\Windows\system32\rasphone.exe
    2020-02-11 11:17 - 2020-01-07 01:26 - 001210368 _____ (Microsoft Corporation) C:\Windows\system32\wscui.cpl
    2020-02-11 11:17 - 2020-01-07 01:26 - 000947200 _____ (Microsoft Corporation) C:\Windows\system32\rasgcw.dll
    2020-02-11 11:17 - 2020-01-07 01:26 - 000265728 _____ (Microsoft Corporation) C:\Windows\system32\wscsvc.dll
    2020-02-11 11:17 - 2020-01-07 01:25 - 000205824 _____ (Microsoft Corporation) C:\Windows\system32\wscinterop.dll
    2020-02-11 11:17 - 2020-01-07 01:24 - 001535488 _____ (Microsoft Corporation) C:\Windows\system32\wbengine.exe
    2020-02-11 11:17 - 2020-01-07 01:24 - 000941056 _____ (Microsoft Corporation) C:\Windows\system32\rasdlg.dll
    2020-02-11 11:17 - 2020-01-07 00:36 - 000256160 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wscapi.dll
    2020-02-11 11:17 - 2020-01-07 00:33 - 000322576 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\atmfd.dll
    2020-02-11 11:17 - 2020-01-07 00:21 - 000098816 _____ (Microsoft Corporation) C:\Windows\SysWOW64\fontsub.dll
    2020-02-11 11:17 - 2020-01-07 00:18 - 000032256 _____ (Microsoft Corporation) C:\Windows\SysWOW64\rasphone.exe
    2020-02-11 11:17 - 2020-01-07 00:17 - 001189376 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wscui.cpl
    2020-02-11 11:17 - 2020-01-07 00:17 - 000159232 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wscinterop.dll
    2020-02-11 11:17 - 2020-01-07 00:16 - 000863744 _____ (Microsoft Corporation) C:\Windows\SysWOW64\rasdlg.dll
    2020-02-11 11:17 - 2020-01-07 00:15 - 000855552 _____ (Microsoft Corporation) C:\Windows\SysWOW64\rasgcw.dll
    2020-02-11 11:17 - 2020-01-06 20:11 - 000094008 _____ (Microsoft Corporation) C:\Windows\system32\SecurityHealthProxyStub.dll
    2020-02-11 11:17 - 2020-01-06 20:08 - 000713480 _____ (Microsoft Corporation) C:\Windows\system32\MSVideoDSP.dll
    2020-02-11 11:17 - 2020-01-06 20:08 - 000243760 _____ (Microsoft Corporation) C:\Windows\system32\logoncli.dll
    2020-02-11 11:17 - 2020-01-06 20:08 - 000051400 _____ (Microsoft Corporation) C:\Windows\system32\svchost.exe
    2020-02-11 11:17 - 2020-01-06 20:07 - 000466744 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\FWPKCLNT.SYS
    2020-02-11 11:17 - 2020-01-06 20:01 - 000186120 _____ (Microsoft Corporation) C:\Windows\SysWOW64\logoncli.dll
    2020-02-11 11:17 - 2020-01-06 20:01 - 000044632 _____ (Microsoft Corporation) C:\Windows\SysWOW64\svchost.exe
    2020-02-11 11:17 - 2020-01-06 20:00 - 000581600 _____ (Microsoft Corporation) C:\Windows\SysWOW64\MSVideoDSP.dll
    2020-02-11 11:17 - 2020-01-06 19:41 - 000331776 _____ (Microsoft Corporation) C:\Windows\SysWOW64\edgeIso.dll
    2020-02-11 11:17 - 2020-01-06 19:40 - 000860160 _____ (Microsoft Corporation) C:\Windows\SysWOW64\rasapi32.dll
    2020-02-11 11:17 - 2020-01-06 19:40 - 000582144 _____ (Microsoft Corporation) C:\Windows\SysWOW64\Windows.UI.Core.TextInput.dll
    2020-02-11 11:17 - 2020-01-06 19:39 - 000659456 _____ (Microsoft Corporation) C:\Windows\SysWOW64\netlogon.dll
    2020-02-11 11:17 - 2020-01-06 19:39 - 000420864 _____ (Microsoft Corporation) C:\Windows\SysWOW64\CredProvDataModel.dll
    2020-02-11 11:17 - 2020-01-06 19:39 - 000415232 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\cldflt.sys
    2020-02-11 11:17 - 2020-01-06 19:39 - 000187904 _____ (Microsoft Corporation) C:\Windows\system32\policymanagerprecheck.dll
    2020-02-11 11:17 - 2020-01-06 19:39 - 000067584 _____ (Microsoft Corporation) C:\Windows\system32\fveskybackup.dll
    2020-02-11 11:17 - 2020-01-06 19:39 - 000051712 _____ (Microsoft Corporation) C:\Windows\system32\DdcAntiTheftApi.dll
    2020-02-11 11:17 - 2020-01-06 19:38 - 000807936 _____ (Microsoft Corporation) C:\Windows\SysWOW64\winipcsecproc.dll
    2020-02-11 11:17 - 2020-01-06 19:38 - 000344576 _____ (Microsoft Corporation) C:\Windows\system32\RasMediaManager.dll
    2020-02-11 11:17 - 2020-01-06 19:38 - 000137728 _____ (Microsoft Corporation) C:\Windows\system32\InputLocaleManager.dll
    2020-02-11 11:17 - 2020-01-06 19:37 - 000318976 _____ (Microsoft Corporation) C:\Windows\system32\DeviceDirectoryClient.dll
    2020-02-11 11:17 - 2020-01-06 19:37 - 000177152 _____ (Microsoft Corporation) C:\Windows\system32\wuuhosdeployment.dll
    2020-02-11 11:17 - 2020-01-06 19:36 - 000499200 _____ (Microsoft Corporation) C:\Windows\system32\winipcfile.dll
    2020-02-11 11:17 - 2020-01-06 19:35 - 000773120 _____ (Microsoft Corporation) C:\Windows\system32\netlogon.dll
    2020-02-11 11:17 - 2020-01-06 19:34 - 000401920 _____ (Microsoft Corporation) C:\Windows\system32\rascustom.dll
    2020-02-11 11:17 - 2020-01-06 19:33 - 000882176 _____ (Microsoft Corporation) C:\Windows\system32\winipcsecproc.dll
    2020-02-11 11:17 - 2020-01-06 19:33 - 000755712 _____ (Microsoft Corporation) C:\Windows\system32\Windows.UI.Core.TextInput.dll
    2020-02-11 11:17 - 2020-01-06 19:33 - 000466432 _____ (Microsoft Corporation) C:\Windows\system32\wuuhext.dll
    2020-02-11 11:17 - 2019-08-07 00:08 - 000170296 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\ksecpkg.sys
    2020-02-07 12:37 - 2020-02-07 12:37 - 000214496 _____ (Malwarebytes) C:\Windows\system32\Drivers\MbamChameleon.sys
    2020-02-01 21:40 - 2020-02-01 21:40 - 000000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\IPVanish
    2020-02-01 21:34 - 2020-02-01 21:35 - 017962448 _____ (Mudhook Marketing, Inc) C:\Users\User\Downloads\IPVanish-3.4.8.17-beta.exe
    2020-02-01 15:50 - 2020-02-01 15:50 - 000000000 ____D C:\ProgramData\VS Revo Group
    2020-02-01 15:49 - 2020-02-01 15:49 - 016701336 _____ (VS Revo Group ) C:\Users\User\Downloads\RevoUninProSetup.exe
    2020-01-31 17:30 - 2020-01-31 17:30 - 000000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\iTunes
    2020-01-31 17:30 - 2020-01-31 17:30 - 000000000 ____D C:\Program Files\iPod
    2020-01-31 17:24 - 2020-01-31 17:30 - 000000000 ____D C:\Program Files\iTunes
    2020-01-30 22:26 - 2020-01-30 22:27 - 000000000 ____D C:\UniConverter
    2020-01-30 22:22 - 2020-01-31 18:41 - 000000000 ____D C:\Users\User\Jessie Stone
    2020-01-26 22:11 - 2020-01-30 14:57 - 000027995 _____ C:\Users\User\Documents\Kylie-Gun Facts.odt

    ==================== One month (modified) ==================

    (If an entry is included in the fixlist, the file/folder will be moved.)

    2020-02-25 14:48 - 2018-09-14 18:12 - 000093293 _____ C:\Windows\ZAM_Guard.krnl.trace
    2020-02-25 14:45 - 2018-06-08 12:03 - 000000000 ____D C:\Users\User\AppData\Roaming\WallpaperMasterPro
    2020-02-25 14:44 - 2018-05-04 15:22 - 000000000 ___RD C:\Users\User\Desktop\Security
    2020-02-25 14:41 - 2018-05-08 09:35 - 000000000 ____D C:\Users\User\AppData\LocalLow\Mozilla
    2020-02-25 14:40 - 2018-04-11 15:38 - 000000000 ____D C:\ProgramData\regid.1991-06.com.microsoft
    2020-02-25 14:10 - 2018-05-04 12:51 - 000000000 ____D C:\Windows\system32\SleepStudy
    2020-02-25 12:57 - 2018-04-11 15:36 - 000000000 ____D C:\Windows\INF
    2020-02-25 12:32 - 2019-01-31 20:49 - 000000000 ____D C:\Users\User\AppData\Local\CrashDumps
    2020-02-25 12:27 - 2018-05-08 09:35 - 000000000 ____D C:\Users\User\AppData\Local\ClassicShell
    2020-02-25 12:25 - 2018-04-11 15:38 - 000000000 ___HD C:\Program Files\WindowsApps
    2020-02-25 12:25 - 2018-04-11 15:38 - 000000000 ____D C:\Windows\AppReadiness
    2020-02-25 12:19 - 2018-06-23 17:55 - 000004162 _____ C:\Windows\system32\Tasks\User_Feed_Synchronization-{7A28977F-3557-4E1C-93F2-440A1943C72D}
    2020-02-25 12:04 - 2018-05-08 14:39 - 000000000 ____D C:\Program Files (x86)\TeamViewer
    2020-02-25 12:04 - 2018-05-04 12:51 - 000000006 ____H C:\Windows\Tasks\SA.DAT
    2020-02-24 21:23 - 2018-04-11 13:04 - 000524288 _____ C:\Windows\system32\config\BBI
    2020-02-24 18:09 - 2018-07-22 14:13 - 000023912 _____ C:\Users\User\Documents\WayneLdgr.ods
    2020-02-22 17:33 - 2018-06-25 11:04 - 000000000 ____D C:\Users\User\Documents\backup
    2020-02-22 17:33 - 2018-05-09 12:30 - 000005415 _____ C:\Users\User\Documents\config.xml
    2020-02-22 17:33 - 2018-05-09 12:30 - 000001146 _____ C:\Users\User\Documents\session.xml
    2020-02-22 12:49 - 2018-09-15 11:56 - 000000000 _____ C:\Users\User\AppData\LocalLow\rightsCheck_1.txt
    2020-02-22 11:42 - 2018-04-11 13:04 - 000131072 _____ C:\Windows\system32\config\ELAM
    2020-02-22 11:41 - 2018-05-08 19:31 - 000000000 ____D C:\ProgramData\ProductData
    2020-02-22 11:35 - 2020-01-22 11:09 - 000000000 ____D C:\Program Files\Mozilla Firefox
    2020-02-22 11:35 - 2018-05-08 14:14 - 000000000 ____D C:\Program Files\Bitdefender
    2020-02-22 11:35 - 2018-05-08 09:35 - 000000000 ____D C:\Program Files (x86)\Mozilla Maintenance Service
    2020-02-22 11:33 - 2018-08-21 18:08 - 000000000 ____D C:\Users\User\AppData\Roaming\Dashlane
    2020-02-20 11:11 - 2019-06-20 15:16 - 000564136 _____ (BitDefender S.R.L. Bucharest, ROMANIA) C:\Windows\system32\Drivers\gemma.sys
    2020-02-20 11:11 - 2019-06-20 15:16 - 000046056 _____ (© Bitdefender SRL) C:\Windows\system32\Drivers\bdprivmon.sys
    2020-02-18 14:12 - 2019-10-10 16:53 - 000008192 _____ C:\Users\User\Documents\SLakeTahoe.est
    2020-02-18 14:07 - 2019-04-26 18:54 - 000006144 _____ C:\Users\User\Documents\2020 Road Trip.est
    2020-02-18 13:15 - 2018-05-08 14:50 - 000000000 ____D C:\Users\User\AppData\Roaming\uTorrent
    2020-02-18 10:49 - 2018-05-08 09:35 - 000001005 _____ C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Firefox.lnk
    2020-02-18 10:45 - 2018-06-14 10:57 - 000000000 ____D C:\Windows\system32\Tasks\NCH Software
    2020-02-17 22:06 - 2018-08-21 17:58 - 000000000 ____D C:\Users\User\AppData\Local\IPVanish
    2020-02-17 18:52 - 2018-05-04 15:21 - 000000000 ___RD C:\Users\User\Desktop\AudioVideo
    2020-02-17 17:29 - 2019-06-20 16:29 - 000000000 ____D C:\Users\User\AppData\Local\BitTorrentHelper
    2020-02-15 21:17 - 2020-01-17 18:57 - 000000000 ____D C:\Users\User\AppData\Roaming\vlc
    2020-02-15 21:16 - 2020-01-17 18:57 - 000000000 ____D C:\Users\User\AppData\Roaming\dvdcss
    2020-02-15 14:41 - 2018-07-09 14:30 - 000026765 _____ C:\Users\User\Documents\SonyDVDLibrary.ods
    2020-02-13 18:40 - 2018-05-04 14:19 - 000002457 _____ C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Acrobat Reader DC.lnk
    2020-02-12 15:12 - 2018-06-23 20:14 - 000000000 ____D C:\ProgramData\NCH Software
    2020-02-12 15:01 - 2018-06-14 10:57 - 000000000 ____D C:\Program Files (x86)\NCH Software
    2020-02-11 19:25 - 2018-05-04 13:03 - 000838564 _____ C:\Windows\system32\PerfStringBackup.INI
    2020-02-11 19:17 - 2018-05-04 12:51 - 000372488 _____ C:\Windows\system32\FNTCACHE.DAT
    2020-02-11 19:13 - 2018-04-11 15:38 - 000000000 ____D C:\Windows\TextInput
    2020-02-11 19:13 - 2018-04-11 15:38 - 000000000 ____D C:\Windows\SysWOW64\oobe
    2020-02-11 19:13 - 2018-04-11 15:38 - 000000000 ____D C:\Windows\SysWOW64\Dism
    2020-02-11 19:13 - 2018-04-11 15:38 - 000000000 ____D C:\Windows\system32\SystemResetPlatform
    2020-02-11 19:13 - 2018-04-11 15:38 - 000000000 ____D C:\Windows\system32\oobe
    2020-02-11 19:13 - 2018-04-11 15:38 - 000000000 ____D C:\Windows\ShellExperiences
    2020-02-11 19:13 - 2018-04-11 15:38 - 000000000 ____D C:\Windows\ShellComponents
    2020-02-11 19:13 - 2018-04-11 15:38 - 000000000 ____D C:\Windows\bcastdvr
    2020-02-11 19:13 - 2018-04-11 13:04 - 000000000 ____D C:\Windows\system32\Dism
    2020-02-11 19:13 - 2018-04-11 13:04 - 000000000 ____D C:\Windows\servicing
    2020-02-11 18:51 - 2018-05-19 18:30 - 000004588 _____ C:\Windows\system32\Tasks\Adobe Flash Player NPAPI Notifier
    2020-02-11 18:50 - 2018-04-11 15:38 - 000000000 ____D C:\Windows\SysWOW64\Macromed
    2020-02-11 18:50 - 2018-04-11 15:38 - 000000000 ____D C:\Windows\system32\Macromed
    2020-02-11 11:40 - 2018-04-11 15:30 - 000000000 ____D C:\Windows\CbsTemp
    2020-02-11 11:14 - 2018-05-08 09:53 - 000000000 ____D C:\Windows\system32\MRT
    2020-02-11 11:14 - 2018-04-11 15:38 - 000000000 ____D C:\Windows\system32\SecureBootUpdates
    2020-02-11 11:03 - 2018-05-08 09:52 - 120407888 ____C (Microsoft Corporation) C:\Windows\system32\MRT.exe
    2020-02-09 21:26 - 2018-06-08 12:01 - 000001192 _____ C:\Users\User\Desktop\Wallpaper Master.lnk
    2020-02-09 18:38 - 2018-05-04 13:06 - 000003374 _____ C:\Windows\system32\Tasks\OneDrive Standalone Update Task-S-1-5-21-507875857-259310543-1677438245-1001
    2020-02-09 18:38 - 2018-05-04 13:04 - 000000000 ___RD C:\Users\User\OneDrive
    2020-02-09 18:38 - 2018-05-04 13:00 - 000002360 _____ C:\Users\User\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\OneDrive.lnk
    2020-02-09 15:08 - 2019-09-30 10:21 - 000000000 ____D C:\Users\User\Desktop\Historyt
    2020-02-07 12:37 - 2019-07-07 09:47 - 000153312 _____ (Malwarebytes) C:\Windows\system32\Drivers\mbae64.sys
    2020-02-04 16:50 - 2018-05-04 14:20 - 000003420 _____ C:\Windows\system32\Tasks\GoogleUpdateTaskMachineUA
    2020-02-04 16:50 - 2018-05-04 14:20 - 000003296 _____ C:\Windows\system32\Tasks\GoogleUpdateTaskMachineCore
    2020-02-03 15:18 - 2018-11-13 22:11 - 000835688 _____ (Adobe) C:\Windows\SysWOW64\FlashPlayerApp.exe
    2020-02-03 15:18 - 2018-11-13 22:11 - 000179608 _____ (Adobe) C:\Windows\SysWOW64\FlashPlayerCPLApp.cpl
    2020-02-01 21:40 - 2019-06-20 14:34 - 000000000 ____D C:\Program Files\IPVanish VPN
    2020-02-01 21:40 - 2018-05-04 13:03 - 000000000 ____D C:\ProgramData\Package Cache
    2020-02-01 20:37 - 2019-08-28 09:41 - 000000000 ____D C:\Program Files (x86)\MyHeritage
    2020-02-01 15:22 - 2018-05-04 13:00 - 000000000 ____D C:\Users\User\AppData\Local\Packages
    2020-02-01 14:45 - 2019-11-21 20:56 - 000000000 ____D C:\Users\User\AppData\Local\cache
    2020-01-31 19:49 - 2018-11-13 18:48 - 000000000 ____D C:\Users\User\AppData\Roaming\Anvsoft
    2020-01-31 17:24 - 2019-03-20 14:34 - 000000000 ____D C:\Users\User\Documents\Apowersoft
    2020-01-31 10:41 - 2019-03-20 14:34 - 000000000 ____D C:\Users\User\AppData\Roaming\Apowersoft
    2020-01-27 15:33 - 2018-08-08 18:19 - 000019278 _____ C:\Users\User\Documents\Login.odt

    ==================== Files in the root of some directories ========

    2018-05-04 15:49 - 2016-11-19 18:41 - 002351339 _____ () C:\Users\User\FreeHideIP-4.1.5.6.Setup.exe
    2003-02-20 09:00 - 2003-02-20 09:00 - 000013387 _____ () C:\Program Files (x86)\license.txt
    2003-03-17 12:46 - 2003-03-17 12:46 - 000000048 _____ () C:\Program Files (x86)\vssver.scc
    2018-06-21 17:48 - 2003-03-24 12:55 - 000049123 ____R () C:\Program Files (x86)\WM9Cap.chm
    2003-03-18 17:14 - 2003-03-18 17:14 - 000110592 _____ (Microsoft Corporation) C:\Program Files (x86)\WM9Cap.exe
    2018-05-09 16:47 - 2018-05-09 16:47 - 000000268 ___RH () C:\Users\User\AppData\Roaming\docInfo
    2018-05-09 17:25 - 2018-05-09 17:25 - 000000268 ___RH () C:\Users\User\AppData\Roaming\grep
    2020-02-17 16:49 - 2020-02-17 16:49 - 000099384 _____ () C:\Users\User\AppData\Roaming\inst.exe
    2020-02-17 16:49 - 2020-02-17 16:49 - 000007859 _____ () C:\Users\User\AppData\Roaming\pcouffin.cat
    2020-02-17 16:49 - 2020-02-17 16:49 - 000001167 _____ () C:\Users\User\AppData\Roaming\pcouffin.inf
    2020-02-17 16:49 - 2020-02-17 16:49 - 000000055 _____ () C:\Users\User\AppData\Roaming\pcouffin.log
    2020-02-17 16:49 - 2020-02-17 16:49 - 000082816 _____ (VSO Software) C:\Users\User\AppData\Roaming\pcouffin.sys
    2019-10-31 17:46 - 2019-10-31 17:46 - 000003584 _____ () C:\Users\User\AppData\Local\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini
    2018-07-10 16:33 - 2018-07-10 16:33 - 000000017 _____ () C:\Users\User\AppData\Local\resmon.resmoncfg
    2019-03-12 09:21 - 2019-03-12 09:21 - 000000000 _____ () C:\Users\User\AppData\Local\{13365B2E-52FE-449F-B71B-9A8C257E4D8E}

    ==================== SigCheck ============================

    (There is no automatic fix for files that do not pass verification.)

    ==================== End of FRST.txt ========================
     
    joe645,
    #19
  21. 2020/02/26
    broni

    broni Moderator Malware Analyst

    Joined:
    2002/08/01
    Messages:
    21,701
    Likes Received:
    116
    Splitting is the only way. That's how the board is set up.

    I still need second log from FRST but so far I don't see any presence of the file in question.
     
    broni,
    #20
Page 1 of 2

Share This Page

  1. This site uses cookies to help personalise content, tailor your experience and to keep you logged in if you register.
    By continuing to use this site, you are consenting to our use of cookies.
    Accept Learn More...