Javascript Disabled Detected

You currently have javascript disabled. Several functions may not work. Please re-enable javascript to access full functionality.

Clicked on website link and got slammed with pop-ups RDN/Trojan.worm&#

Started by shorthaul99 , May 23 2017 04:19 PM

RDN/Trojan.worm!055BCCAC9FEC

Please log in to reply

#1
shorthaul99

Posted 23 May 2017 - 04:19 PM

Member

Member
133 posts

Hello,

I was doing a standard web search and I clicked on a link that had the green arrow next to it that is approved by KAS and instantly got locked out of IE with pop-up windows and to call a certain number to fix it etc and had to kill it all with end process in task manager. I have scanned with MBAM, windows defender and Kaspersky Small Office but they found nothing. Here are the FRST logs: Thanks for your help!! I will add screenshots taken with my phone.

Scan result of Farbar Recovery Scan Tool (FRST) (x64) Version: 22-05-2017
Ran by JB (administrator) on JB-HP (23-05-2017 16:57:15)
Running from C:\Users\JB\Desktop
Loaded Profiles: JB (Available Profiles: JB)
Platform: Windows 7 Professional Service Pack 1 (X64) Language: English (United States)
Internet Explorer Version 11 (Default browser: FF)
Boot Mode: Normal
Tutorial for Farbar Recovery Scan Tool: http://www.geekstogo...very-scan-tool/

==================== Processes (Whitelisted) =================

(If an entry is included in the fixlist, the process will be closed. The file will not be moved.)

(Intel Corporation) C:\Windows\System32\igfxCUIService.exe
(Realtek Semiconductor) C:\Program Files\Realtek\Audio\HDA\RtkAudioService64.exe
(Realtek Semiconductor) C:\Program Files\Realtek\Audio\HDA\RAVBg64.exe
(Apple Inc.) C:\Program Files\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe
(Alcatel-Lucent) C:\Program Files (x86)\ATT\8.5.0.48\ma\bin\MAHostService.exe
(AO Kaspersky Lab) C:\Program Files (x86)\Kaspersky Lab\Kaspersky Small Office Security 17.0.0\avp.exe
(Joyent, Inc) C:\Program Files (x86)\ATT\8.5.0.48\ma\bin\node.exe
(Apple Inc.) C:\Program Files\Bonjour\mDNSResponder.exe
(Broadcom Corporation.) C:\Program Files\WIDCOMM\Bluetooth Software\btwdins.exe
(Microsoft Corporation) C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe
(LogMeIn, Inc.) C:\Program Files (x86)\LogMeIn\x64\LMIGuardianSvc.exe
(LogMeIn, Inc.) C:\Program Files (x86)\LogMeIn\x64\ramaint.exe
(Malwarebytes) C:\Program Files\Malwarebytes\Anti-Ransomware\MB3Service.exe
(Malwarebytes Corporation) C:\Program Files (x86)\Malwarebytes Anti-Exploit\mbae-svc.exe
(Malwarebytes Corporation) C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamscheduler.exe
(Malwarebytes Corporation) C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamservice.exe
(Malwarebytes Corporation) C:\Program Files (x86)\Malwarebytes Anti-Exploit\mbae64.exe
(Alcatel-Lucent) C:\Program Files (x86)\Common Files\Motive\pcCMService.exe
(Alcatel-Lucent) C:\Program Files\Common Files\Motive\pcCMService.exe
(Intuit) C:\Program Files (x86)\Common Files\Intuit\QuickBooks\QBCFMonitorService.exe
(Intuit Inc.) C:\Program Files (x86)\Common Files\Intuit\DataProtect\QBIDPService.exe
(LogMeIn, Inc.) C:\Program Files (x86)\LogMeIn\x64\LogMeIn.exe
(Malwarebytes Corporation) C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamgui.exe
(Microsoft Corporation) C:\Windows\Microsoft.NET\Framework64\v3.0\WPF\PresentationFontCache.exe
(Intel Corporation) C:\Windows\System32\igfxEM.exe
(Intel Corporation) C:\Windows\System32\igfxHK.exe
(Realtek Semiconductor) C:\Program Files\Realtek\Audio\HDA\RtkNGUI64.exe
(Alcatel-Lucent) C:\Program Files\ATT\8.5.0.48\ma\bin\pcTrayApp.exe
(Malwarebytes) C:\Program Files\Malwarebytes\Anti-Ransomware\mbarw.exe
(LogMeIn, Inc.) C:\Program Files (x86)\LogMeIn\x64\LogMeInSystray.exe
(Apple Inc.) C:\Program Files\iTunes\iTunesHelper.exe
(Hewlett-Packard Development Company, LP) C:\Program Files\HP\HP Officejet Pro 8610\Bin\ScanToPCActivationApp.exe
(Alcatel-Lucent) C:\Program Files (x86)\Common Files\Motive\pcContextHookShim.exe
(Broadcom Corporation.) C:\Program Files\WIDCOMM\Bluetooth Software\BTTray.exe
(Intuit Inc.) C:\Program Files (x86)\Common Files\Intuit\QuickBooks\QBUpdate\qbupdate.exe
(Intuit Inc.) C:\Program Files (x86)\Intuit\QuickBooks 2015\QBW32.EXE
(AO Kaspersky Lab) C:\Program Files (x86)\Kaspersky Lab\Kaspersky Small Office Security 17.0.0\avpui.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Intel® USB 3.0 eXtensible Host Controller Driver\Application\iusb3mon.exe
(Hewlett-Packard) C:\Program Files (x86)\Hewlett-Packard\HP Desktop Keyboard\HPKEYBOARDx.EXE
(Malwarebytes Corporation) C:\Program Files (x86)\Malwarebytes Anti-Exploit\mbae.exe
(Hewlett-Packard Development Company, LP) C:\Program Files\HP\HP Officejet Pro 8610\Bin\HPNetworkCommunicatorCom.exe
(Apple Inc.) C:\Program Files\iPod\bin\iPodService.exe
() C:\Program Files (x86)\Hewlett-Packard\HP Desktop Keyboard\Keystatus.exe
(Microsoft Corporation) C:\Windows\SysWOW64\rundll32.exe
(Broadcom Corporation.) C:\Program Files\WIDCOMM\Bluetooth Software\BTStackServer.exe
(Samsung Electronics.) C:\Program Files (x86)\Samsung\Samsung Magician\Samsung Magician.exe
(CyberLink) C:\Program Files (x86)\CyberLink\Power2Go8\CLMLSvc_P2G8.exe
(HP Inc.) C:\Program Files (x86)\Hewlett-Packard\HP Support Solutions\HPSupportSolutionsFrameworkService.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Intel® Management Engine Components\DAL\jhi_service.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Intel® Management Engine Components\LMS\LMS.exe
(Microsoft Corporation) C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE
(Mozilla Corporation) C:\Program Files (x86)\Mozilla Firefox\firefox.exe

==================== Registry (Whitelisted) ====================

(If an entry is included in the fixlist, the registry item will be restored to default or removed. The file will not be moved.)

HKLM\...\Run: [RTHDVCPL] => C:\Program Files\Realtek\Audio\HDA\RtkNGUI64.exe [8781568 2015-11-26] (Realtek Semiconductor)
HKLM\...\Run: [ATT_McciTrayApp] => C:\Program Files\ATT\8.5.0.48\ma\bin\pcTrayApp.exe [2943488 2015-10-20] (Alcatel-Lucent)
HKLM\...\Run: [Logitech Download Assistant] => C:\Windows\system32\rundll32.exe C:\Windows\System32\LogiLDA.dll,LogiFetch
HKLM\...\Run: [Malwarebytes Anti-Ransomware] => C:\Program Files\Malwarebytes\Anti-Ransomware\mbarw.exe [723920 2016-09-09] (Malwarebytes)
HKLM\...\Run: [LogMeIn GUI] => C:\Program Files (x86)\LogMeIn\x64\LogMeInSystray.exe [423424 2016-12-27] (LogMeIn, Inc.)
HKLM\...\Run: [iTunesHelper] => C:\Program Files\iTunes\iTunesHelper.exe [303928 2017-05-09] (Apple Inc.)
HKLM-x32\...\Run: [USB3MON] => C:\Program Files (x86)\Intel\Intel® USB 3.0 eXtensible Host Controller Driver\Application\iusb3mon.exe [296208 2016-10-15] (Intel Corporation)
HKLM-x32\...\Run: [HP KEYBOARDx] => C:\Program Files (x86)\Hewlett-Packard\HP Desktop Keyboard\HPKEYBOARDx.EXE [710656 2010-02-11] (Hewlett-Packard)
HKLM-x32\...\Run: [Intuit SyncManager] => C:\Program Files (x86)\Common Files\Intuit\Sync\IntuitSyncManager.exe [3776824 2015-03-17] (Intuit Inc. All rights reserved.)
HKLM-x32\...\Run: [] => [X]
HKLM-x32\...\Run: [Malwarebytes Anti-Exploit] => C:\Program Files (x86)\Malwarebytes Anti-Exploit\mbae.exe [2645960 2017-05-15] (Malwarebytes Corporation)
HKU\S-1-5-21-2577112198-3913129868-2286876578-1000\...\Run: [HP Officejet Pro 8610 (NET)] => C:\Program Files\HP\HP Officejet Pro 8610\Bin\ScanToPCActivationApp.exe [3487240 2014-07-21] (Hewlett-Packard Development Company, LP)
HKU\S-1-5-21-2577112198-3913129868-2286876578-1000\...\MountPoints2: {6a451861-7f4b-11e5-a2cb-806e6f6e6963} - "E:\Install Navigator.exe"
HKU\S-1-5-21-2577112198-3913129868-2286876578-1000\Control Panel\Desktop\\SCRNSAVE.EXE -> C:\windows\system32\Bubbles.scr [899584 2010-11-20] (Microsoft Corporation)
Lsa: [Notification Packages] scecli C:\Program Files\WIDCOMM\Bluetooth Software\BtwProximityCP.dll
ShellIconOverlayIdentifiers: [00avast] -> {472083B0-C522-11CF-8763-00608CC02F24} => -> No File
Startup: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\Bluetooth.lnk [2015-05-28]
ShortcutTarget: Bluetooth.lnk -> C:\Program Files\WIDCOMM\Bluetooth Software\BTTray.exe (Broadcom Corporation.)
Startup: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\Intuit Data Protect.lnk [2015-11-02]
ShortcutTarget: Intuit Data Protect.lnk -> C:\Program Files (x86)\Common Files\Intuit\DataProtect\IntuitDataProtect.exe (Intuit Inc.)
Startup: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\QuickBooks Update Agent.lnk [2015-11-02]
ShortcutTarget: QuickBooks Update Agent.lnk -> C:\Program Files (x86)\Common Files\Intuit\QuickBooks\QBUpdate\qbupdate.exe (Intuit Inc.)
Startup: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\QuickBooks_Standard_21.lnk [2015-11-02]
ShortcutTarget: QuickBooks_Standard_21.lnk -> C:\Program Files (x86)\Intuit\QuickBooks 2015\QBW32.EXE (Intuit Inc.)
GroupPolicyScripts: Restriction <======= ATTENTION

==================== Internet (Whitelisted) ====================

(If an item is included in the fixlist, if it is a registry item it will be removed or restored to default.)

Tcpip\Parameters: [DhcpNameServer] 192.168.7.254
Tcpip\..\Interfaces\{5A134DD5-9609-460B-876D-D6D240D948BF}: [DhcpNameServer] 172.20.10.1
Tcpip\..\Interfaces\{D2D4F5EB-AB89-4FFB-ADEA-8610198B42F4}: [DhcpNameServer] 192.168.7.254

Internet Explorer:
==================
HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://hp13.msn.com
HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = hxxp://hp13.msn.com
HKU\.DEFAULT\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://hp13.msn.com
HKU\.DEFAULT\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = hxxp://hp13.msn.com
HKU\S-1-5-21-2577112198-3913129868-2286876578-1000\Software\Microsoft\Internet Explorer\Main,Start Page = hxxps://www.google.com/
SearchScopes: HKLM -> {C7F7AD88-4278-45CA-B849-F7365ABA9E62} URL = hxxp://www.amazon.com/s/ref=azs_osd_iea?ie=UTF-8&tag=hp-us1-vsb-20&link%5Fcode=qs&index=aps&field-keywords={searchTerms}
SearchScopes: HKLM-x32 -> {C7F7AD88-4278-45CA-B849-F7365ABA9E62} URL = hxxp://www.amazon.com/s/ref=azs_osd_iea?ie=UTF-8&tag=hp-us1-vsb-20&link%5Fcode=qs&index=aps&field-keywords={searchTerms}
BHO: Kaspersky Protection -> {2E38825B-8815-42CF-9126-C58BC28D4591} -> C:\Program Files (x86)\Kaspersky Lab\Kaspersky Small Office Security 17.0.0\x64\IEExt\ie_plugin.dll [2017-01-25] (AO Kaspersky Lab)
BHO: Lync Browser Helper -> {31D09BA0-12F5-4CCE-BE8A-2923E76605DA} -> C:\Program Files (x86)\Microsoft Office\root\VFS\ProgramFilesX64\Microsoft Office\Office16\OCHelper.dll [2017-05-14] (Microsoft Corporation)
BHO: avast! Online Security -> {8E5E2654-AD2D-48bf-AC2D-D17F00898D06} -> C:\Program Files\AVAST Software\Avast\aswWebRepIE64.dll => No File
BHO: Office Document Cache Handler -> {B4F3A835-0E21-4959-BA22-42B3008E02FF} -> C:\Program Files (x86)\Microsoft Office\root\VFS\ProgramFilesX64\Microsoft Office\Office16\URLREDIR.DLL [2017-05-14] (Microsoft Corporation)
BHO: Microsoft OneDrive for Business Browser Helper -> {D0498E0A-45B7-42AE-A9AA-ABA463DBD3BF} -> C:\Program Files (x86)\Microsoft Office\root\VFS\ProgramFilesX64\Microsoft Office\Office16\GROOVEEX.DLL [2017-05-14] (Microsoft Corporation)
BHO: HP Network Check Helper -> {E76FD755-C1BA-4DCB-9F13-99BD91223ADE} -> C:\Program Files (x86)\Hewlett-Packard\HP Support Framework\Resources\HPNetworkCheck\HPNetworkCheckPluginx64.dll => No File
BHO: Adblock Plus for IE Browser Helper Object -> {FFCB3198-32F3-4E8B-9539-4324694ED664} -> C:\Program Files\Adblock Plus for IE\AdblockPlus64.dll [2015-09-22] (Eyeo GmbH)
BHO-x32: Kaspersky Protection -> {2E38825B-8815-42CF-9126-C58BC28D4591} -> C:\Program Files (x86)\Kaspersky Lab\Kaspersky Small Office Security 17.0.0\IEExt\ie_plugin.dll [2017-01-25] (AO Kaspersky Lab)
BHO-x32: Office Document Cache Handler -> {B4F3A835-0E21-4959-BA22-42B3008E02FF} -> C:\Program Files (x86)\Microsoft Office\root\Office16\URLREDIR.DLL [2017-05-14] (Microsoft Corporation)
BHO-x32: Adblock Plus for IE Browser Helper Object -> {FFCB3198-32F3-4E8B-9539-4324694ED664} -> C:\Program Files\Adblock Plus for IE\AdblockPlus32.dll [2015-09-22] (Eyeo GmbH)
Toolbar: HKLM - Kaspersky Protection Toolbar - {093F479D-712E-46CD-9E06-62E734A05F68} - C:\Program Files (x86)\Kaspersky Lab\Kaspersky Small Office Security 17.0.0\x64\IEExt\ie_plugin.dll [2017-01-25] (AO Kaspersky Lab)
Toolbar: HKLM-x32 - Kaspersky Protection Toolbar - {093F479D-712E-46CD-9E06-62E734A05F68} - C:\Program Files (x86)\Kaspersky Lab\Kaspersky Small Office Security 17.0.0\IEExt\ie_plugin.dll [2017-01-25] (AO Kaspersky Lab)
Toolbar: HKU\S-1-5-21-2577112198-3913129868-2286876578-1000 -> No Name - {001032CB-B0AC-4F2C-A650-AD4B2B26E5DA} - No File
Toolbar: HKU\S-1-5-21-2577112198-3913129868-2286876578-1000 -> Kaspersky Protection Toolbar - {093F479D-712E-46CD-9E06-62E734A05F68} - C:\Program Files (x86)\Kaspersky Lab\Kaspersky Small Office Security 17.0.0\x64\IEExt\ie_plugin.dll [2017-01-25] (AO Kaspersky Lab)
Handler-x32: intu-help-qb8 - {CD17C364-2EC8-4929-91A9-C4839A20E909} - C:\Program Files (x86)\Intuit\QuickBooks 2015\HelpAsyncPluggableProtocol.dll [2017-04-25] (Intuit, Inc.)
Handler-x32: mso-minsb-roaming.16 - {83C25742-A9F7-49FB-9138-434302C88D07} - C:\Program Files (x86)\Microsoft Office\root\Office16\MSOSB.DLL [2017-05-14] (Microsoft Corporation)
Handler-x32: mso-minsb.16 - {42089D2D-912D-4018-9087-2B87803E93FB} - C:\Program Files (x86)\Microsoft Office\root\Office16\MSOSB.DLL [2017-05-14] (Microsoft Corporation)
Handler-x32: osf-roaming.16 - {42089D2D-912D-4018-9087-2B87803E93FB} - C:\Program Files (x86)\Microsoft Office\root\Office16\MSOSB.DLL [2017-05-14] (Microsoft Corporation)
Handler-x32: osf.16 - {5504BE45-A83B-4808-900A-3A5C36E7F77A} - C:\Program Files (x86)\Microsoft Office\root\Office16\MSOSB.DLL [2017-05-14] (Microsoft Corporation)
Handler-x32: qbwc - {FC598A64-626C-4447-85B8-53150405FD57} - C:\windows\system32\mscoree.dll [2010-11-20] (Microsoft Corporation)

FireFox:
========
FF ProfilePath: C:\Users\JB\AppData\Roaming\Mozilla\Firefox\Profiles\k39yo3t4.default [2017-05-23]
FF DefaultSearchEngine.US: Mozilla\Firefox\Profiles\k39yo3t4.default -> Google
FF Homepage: Mozilla\Firefox\Profiles\k39yo3t4.default -> hxxps://www.google.com/
FF Extension: (AT&T Extension) - C:\Program Files (x86)\Mozilla Firefox\browser\extensions\[email protected] [2015-11-06] [not signed]
FF HKLM\...\Firefox\Extensions: [[email protected]] - C:\Program Files (x86)\Kaspersky Lab\Kaspersky Small Office Security 17.0.0\FFExt\light_plugin_firefox\addon.xpi
FF Extension: (Kaspersky Protection) - C:\Program Files (x86)\Kaspersky Lab\Kaspersky Small Office Security 17.0.0\FFExt\light_plugin_firefox\addon.xpi [2017-01-25]
FF HKLM-x32\...\Firefox\Extensions: [[email protected]] - C:\Program Files (x86)\Kaspersky Lab\Kaspersky Small Office Security 17.0.0\FFExt\light_plugin_firefox\addon.xpi
FF Plugin: @adobe.com/FlashPlayer -> C:\windows\system32\Macromed\Flash\NPSWF64_25_0_0_171.dll [2017-05-09] ()
FF Plugin: @microsoft.com/GENUINE -> disabled [No File]
FF Plugin: @Microsoft.com/NpCtrl,version=1.0 -> c:\Program Files\Microsoft Silverlight\5.1.50906.0\npctrl.dll [2017-03-09] ( Microsoft Corporation)
FF Plugin-x32: @adobe.com/FlashPlayer -> C:\windows\SysWOW64\Macromed\Flash\NPSWF32_25_0_0_171.dll [2017-05-09] ()
FF Plugin-x32: @foxitsoftware.com/Foxit PhantomPDF Plugin,version=1.0,application/pdf -> C:\Program Files (x86)\Foxit PhantomPDF\plugins\npFoxitPhantomPDFPlugin.dll [2014-10-20] (Foxit Corporation)
FF Plugin-x32: @foxitsoftware.com/Foxit PhantomPDF Plugin,version=1.0,application/vnd.fdf -> C:\Program Files (x86)\Foxit PhantomPDF\plugins\npFoxitPhantomPDFPlugin.dll [2014-10-20] (Foxit Corporation)
FF Plugin-x32: @foxitsoftware.com/Foxit PhantomPDF Plugin,version=1.0,application/vnd.xdp -> C:\Program Files (x86)\Foxit PhantomPDF\plugins\npFoxitPhantomPDFPlugin.dll [2014-10-20] (Foxit Corporation)
FF Plugin-x32: @foxitsoftware.com/Foxit PhantomPDF Plugin,version=1.0,application/vnd.xfdf -> C:\Program Files (x86)\Foxit PhantomPDF\plugins\npFoxitPhantomPDFPlugin.dll [2014-10-20] (Foxit Corporation)
FF Plugin-x32: @intel-webapi.intel.com/Intel WebAPI ipt;version=4.0.56 -> C:\Program Files (x86)\Intel\Intel® Management Engine Components\IPT\npIntelWebAPIIPT.dll [2014-08-13] (Intel Corporation)
FF Plugin-x32: @intel-webapi.intel.com/Intel WebAPI updater -> C:\Program Files (x86)\Intel\Intel® Management Engine Components\IPT\npIntelWebAPIUpdater.dll [2014-08-13] (Intel Corporation)
FF Plugin-x32: @microsoft.com/GENUINE -> disabled [No File]
FF Plugin-x32: @Microsoft.com/NpCtrl,version=1.0 -> c:\Program Files (x86)\Microsoft Silverlight\5.1.50906.0\npctrl.dll [2017-03-09] ( Microsoft Corporation)
FF Plugin-x32: @microsoft.com/SharePoint,version=14.0 -> C:\Program Files (x86)\Microsoft Office\root\Office16\NPSPWRAP.DLL [2017-03-05] (Microsoft Corporation)
FF Plugin-x32: @Motive.com/NpMotive,version=1.1 -> C:\Program Files (x86)\ATT\8.5.0.48\ma\bin\npMotive.dll [2015-10-20] (AT&T)
FF Plugin-x32: @tools.google.com/Google Update;version=3 -> C:\Program Files (x86)\Google\Update\1.3.33.5\npGoogleUpdate3.dll [2017-04-27] (Google Inc.)
FF Plugin-x32: @tools.google.com/Google Update;version=9 -> C:\Program Files (x86)\Google\Update\1.3.33.5\npGoogleUpdate3.dll [2017-04-27] (Google Inc.)
FF Plugin-x32: Adobe Reader -> C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AIR\nppdf32.dll [2017-04-04] (Adobe Systems Inc.)

Chrome:
=======
CHR HKLM\...\Chrome\Extension: [fhoibnponjcgjgcnfacekaijdbbplhib] - hxxps://chrome.google.com/webstore/detail/fhoibnponjcgjgcnfacekaijdbbplhib
CHR HKLM-x32\...\Chrome\Extension: [fhoibnponjcgjgcnfacekaijdbbplhib] - hxxps://chrome.google.com/webstore/detail/fhoibnponjcgjgcnfacekaijdbbplhib

==================== Services (Whitelisted) ====================

(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)

R2 Apple Mobile Device Service; C:\Program Files\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe [83768 2017-04-03] (Apple Inc.)
R2 AT&T Troubleshoot & Resolve; C:\Program Files (x86)\ATT\8.5.0.48\ma\bin\MAHostService.exe [321024 2015-10-20] (Alcatel-Lucent) [File not signed]
R2 AVP17.0.0; C:\Program Files (x86)\Kaspersky Lab\Kaspersky Small Office Security 17.0.0\avp.exe [241544 2016-06-28] (AO Kaspersky Lab)
R2 ClickToRunSvc; C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe [3801280 2017-05-04] (Microsoft Corporation)
R2 HPSupportSolutionsFrameworkService; C:\Program Files (x86)\Hewlett-Packard\HP Support Solutions\HPSupportSolutionsFrameworkService.exe [31776 2016-12-07] (HP Inc.)
R2 igfxCUIService1.0.0.0; C:\windows\system32\igfxCUIService.exe [328296 2015-01-28] (Intel Corporation)
S3 Intel® Capability Licensing Service TCP IP Interface; C:\Program Files\Intel\iCLS Client\SocketHeciServer.exe [887256 2014-05-13] (Intel® Corporation)
R2 jhi_service; C:\Program Files (x86)\Intel\Intel® Management Engine Components\DAL\jhi_service.exe [154584 2014-08-13] (Intel Corporation)
S3 klvssbrigde64; C:\Program Files (x86)\Kaspersky Lab\Kaspersky Small Office Security 17.0.0\x64\vssbridge64.exe [77328 2016-06-28] (AO Kaspersky Lab)
R2 LMIGuardianSvc; C:\Program Files (x86)\LogMeIn\x64\LMIGuardianSvc.exe [419304 2017-05-17] (LogMeIn, Inc.)
R2 LMIMaint; C:\Program Files (x86)\LogMeIn\x64\RaMaint.exe [583144 2017-05-17] (LogMeIn, Inc.)
R2 LogMeIn; C:\Program Files (x86)\LogMeIn\x64\LogMeIn.exe [407424 2015-06-15] (LogMeIn, Inc.)
R2 MB3Service; C:\Program Files\Malwarebytes\Anti-Ransomware\MB3Service.exe [3291088 2016-09-09] (Malwarebytes)
R2 MbaeSvc; C:\Program Files (x86)\Malwarebytes Anti-Exploit\mbae-svc.exe [155080 2017-05-15] (Malwarebytes Corporation)
R2 MBAMScheduler; C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamscheduler.exe [452576 2016-02-09] (Malwarebytes Corporation)
R2 MBAMService; C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamservice.exe [901088 2016-02-09] (Malwarebytes Corporation)
R2 pcCMService; C:\Program Files (x86)\Common Files\Motive\pcCMService.exe [370176 2015-08-13] (Alcatel-Lucent) [File not signed]
R2 pcCMService64; C:\Program Files\Common Files\Motive\pcCMService.exe [462336 2015-08-13] (Alcatel-Lucent) [File not signed]
R2 QBCFMonitorService; C:\Program Files (x86)\Common Files\Intuit\QuickBooks\QBCFMonitorService.exe [45056 2017-04-25] (Intuit) [File not signed]
S3 QBFCService; C:\Program Files (x86)\Common Files\Intuit\QuickBooks\FCS\Intuit.QuickBooks.FCS.exe [65536 2014-12-06] (Intuit Inc.) [File not signed]
R2 QBVSS; C:\Program Files (x86)\Common Files\Intuit\DataProtect\QBIDPService.exe [1248256 2014-12-06] (Intuit Inc.) [File not signed]
R2 RtkAudioService; C:\Program Files\Realtek\Audio\HDA\RtkAudioService64.exe [307456 2015-11-26] (Realtek Semiconductor)
R2 WinDefend; C:\Program Files\Windows Defender\mpsvc.dll [1011712 2013-12-03] (Microsoft Corporation)

===================== Drivers (Whitelisted) ======================

(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)

R3 bcbtums; C:\windows\System32\drivers\bcbtums.sys [172760 2015-05-28] (Broadcom Corporation.)
R1 CLVirtualDrive; C:\windows\System32\DRIVERS\CLVirtualDrive.sys [91912 2013-11-12] (CyberLink)
R0 cm_km; C:\windows\System32\DRIVERS\cm_km.sys [238936 2016-06-10] (AO Kaspersky Lab)
R1 ESProtectionDriver; C:\Program Files (x86)\Malwarebytes Anti-Exploit\mbae64.sys [77408 2017-05-15] ()
R0 iaStorF; C:\windows\System32\drivers\iaStorF.sys [30360 2015-03-14] (Intel Corporation)
R0 kl1; C:\windows\System32\DRIVERS\kl1.sys [554416 2016-06-02] (AO Kaspersky Lab)
R0 klbackupdisk; C:\windows\System32\DRIVERS\klbackupdisk.sys [63920 2016-06-08] (AO Kaspersky Lab)
R1 klbackupflt; C:\windows\System32\DRIVERS\klbackupflt.sys [86352 2016-06-15] (AO Kaspersky Lab)
R2 kldisk; C:\windows\System32\DRIVERS\kldisk.sys [78216 2016-06-01] (AO Kaspersky Lab)
R3 klflt; C:\windows\System32\DRIVERS\klflt.sys [195296 2017-04-10] (AO Kaspersky Lab)
R1 klhk; C:\windows\System32\DRIVERS\klhk.sys [314864 2017-04-10] (AO Kaspersky Lab)
R1 KLIF; C:\windows\System32\DRIVERS\klif.sys [1035480 2017-04-10] (AO Kaspersky Lab)
R1 KLIM6; C:\windows\System32\DRIVERS\klim6.sys [57936 2017-01-25] (AO Kaspersky Lab)
R3 klkbdflt; C:\windows\System32\DRIVERS\klkbdflt.sys [52144 2016-05-19] (AO Kaspersky Lab)
R3 klmouflt; C:\windows\System32\DRIVERS\klmouflt.sys [41648 2015-06-07] (Kaspersky Lab ZAO)
R1 klpd; C:\windows\System32\DRIVERS\klpd.sys [45488 2016-06-01] (AO Kaspersky Lab)
R1 kltdi; C:\windows\System32\DRIVERS\kltdi.sys [75696 2016-05-18] (AO Kaspersky Lab)
R1 Klwtp; C:\windows\System32\DRIVERS\klwtp.sys [135904 2017-03-13] (AO Kaspersky Lab)
R1 kneps; C:\windows\System32\DRIVERS\kneps.sys [199392 2017-03-13] (AO Kaspersky Lab)
R2 LMIInfo; C:\windows\system32\drivers\LMIInfo.sys [30432 2017-01-11] (LogMeIn, Inc.)
S4 LMIRfsClientNP; no ImagePath
R0 MB3SwissArmy; C:\windows\System32\drivers\MB3SwissArmy.sys [228800 2017-05-23] (Malwarebytes)
R3 MBAMFarflt; C:\windows\system32\drivers\farflt.sys [113592 2017-05-23] (Malwarebytes)
R3 MBAMProtector; C:\windows\system32\drivers\mbam.sys [27008 2016-02-09] (Malwarebytes Corporation)
R3 MEIx64; C:\windows\system32\drivers\TeeDriverx64.sys [125952 2014-08-13] (Intel Corporation)
S3 MREMP50; C:\Program Files (x86)\Common Files\Motive\MREMP50.sys [21248 2010-02-02] (Printing Communications Assoc., Inc. (PCAUSA)) [File not signed]
S3 MREMP50a64; C:\Program Files\Common Files\Motive\MREMP50a64.SYS [43008 2010-02-02] (Printing Communications Assoc., Inc. (PCAUSA))
S3 MRESP50; C:\Program Files (x86)\Common Files\Motive\MRESP50.sys [20096 2010-02-02] (Printing Communications Assoc., Inc. (PCAUSA)) [File not signed]
S3 MRESP50a64; C:\Program Files\Common Files\Motive\MRESP50a64.SYS [40960 2010-02-02] (Printing Communications Assoc., Inc. (PCAUSA))
R3 RTSUER; C:\windows\System32\Drivers\RtsUer.sys [402136 2016-10-15] (Realsil Semiconductor Corporation)
S3 WirelessKeyboardFilter; C:\windows\System32\DRIVERS\WirelessKeyboardFilter.sys [49896 2016-07-22] (Microsoft Corporation)
U0 aswVmm; no ImagePath
S3 BCM42RLY; system32\drivers\BCM42RLY.sys [X]
S3 BCM43XX; system32\DRIVERS\bcmwl664.sys [X]
S3 MREMPR5; \??\C:\PROGRA~1\COMMON~1\Motive\MREMPR5.SYS [X]
S3 MRENDIS5; \??\C:\PROGRA~1\COMMON~1\Motive\MRENDIS5.SYS [X]
S3 RSUSBSTOR; \SystemRoot\System32\Drivers\RtsUStor.sys [X]

==================== NetSvcs (Whitelisted) ===================

(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)

==================== One Month Created files and folders ========

(If an entry is included in the fixlist, the file/folder will be moved.)

2017-05-23 16:57 - 2017-05-23 16:57 - 00024358 _____ C:\Users\JB\Desktop\FRST.txt
2017-05-23 16:55 - 2017-05-23 16:55 - 02429952 _____ (Farbar) C:\Users\JB\Desktop\FRST64.exe
2017-05-21 17:52 - 2017-05-21 17:52 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Samsung
2017-05-21 17:51 - 2017-05-23 11:48 - 00000000 ____D C:\Temp
2017-05-21 16:41 - 2017-05-21 16:41 - 01820860 _____ C:\Users\JB\Downloads\WD Backup Manual.pdf
2017-05-20 19:42 - 2017-05-20 19:42 - 00000023 _____ C:\windows\script.txt
2017-05-20 19:41 - 2017-05-21 17:52 - 00001862 _____ C:\Users\Public\Desktop\Data Migration.lnk
2017-05-20 19:38 - 2017-05-21 17:52 - 00000000 ____D C:\Program Files (x86)\Samsung
2017-05-20 19:38 - 2017-05-20 19:38 - 00003262 _____ C:\windows\System32\Tasks\SamsungMagician
2017-05-20 19:38 - 2017-05-20 19:38 - 00001191 _____ C:\Users\Public\Desktop\Samsung Magician.lnk
2017-05-20 19:38 - 2017-05-20 19:38 - 00000000 ____D C:\ProgramData\Samsung
2017-05-20 19:38 - 2017-05-20 19:38 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Samsung Magician
2017-05-20 17:37 - 2017-05-20 17:37 - 00000000 ___DC C:\Users\JB\AppData\Local\MigWiz
2017-05-19 14:19 - 2017-05-20 17:56 - 00000000 ____D C:\Program Files (x86)\Mozilla Firefox
2017-05-16 14:34 - 2017-05-16 14:34 - 00156136 _____ C:\Users\JB\Documents\Rock Steady Waiver.pdf
2017-05-16 14:02 - 2017-04-27 17:50 - 03550208 _____ (Microsoft Corporation) C:\windows\SysWOW64\D3DCompiler_47.dll
2017-05-16 14:02 - 2017-04-17 10:37 - 03165184 _____ (Microsoft Corporation) C:\windows\system32\wucltux.dll
2017-05-16 14:02 - 2017-04-17 10:37 - 00192512 _____ (Microsoft Corporation) C:\windows\system32\wuwebv.dll
2017-05-16 14:02 - 2017-04-17 10:37 - 00098816 _____ (Microsoft Corporation) C:\windows\system32\wudriver.dll
2017-05-16 14:02 - 2017-04-17 10:35 - 00091136 _____ (Microsoft Corporation) C:\windows\system32\WinSetupUI.dll
2017-05-16 14:02 - 2017-04-17 10:23 - 02651136 _____ (Microsoft Corporation) C:\windows\system32\wuaueng.dll
2017-05-16 14:02 - 2017-04-17 10:22 - 00709120 _____ (Microsoft Corporation) C:\windows\system32\wuapi.dll
2017-05-16 14:02 - 2017-04-17 10:21 - 00140288 _____ (Microsoft Corporation) C:\windows\system32\wuauclt.exe
2017-05-16 14:02 - 2017-04-17 10:21 - 00037888 _____ (Microsoft Corporation) C:\windows\system32\wups2.dll
2017-05-16 14:02 - 2017-04-17 10:21 - 00037888 _____ (Microsoft Corporation) C:\windows\system32\wuapp.exe
2017-05-16 14:02 - 2017-04-17 10:21 - 00036864 _____ (Microsoft Corporation) C:\windows\system32\wups.dll
2017-05-16 14:02 - 2017-04-17 10:21 - 00012288 _____ (Microsoft Corporation) C:\windows\system32\wu.upgrade.ps.dll
2017-05-16 14:02 - 2017-04-17 10:12 - 00174080 _____ (Microsoft Corporation) C:\windows\SysWOW64\wuwebv.dll
2017-05-16 14:02 - 2017-04-17 10:01 - 00573440 _____ (Microsoft Corporation) C:\windows\SysWOW64\wuapi.dll
2017-05-16 14:02 - 2017-04-17 10:01 - 00093696 _____ (Microsoft Corporation) C:\windows\SysWOW64\wudriver.dll
2017-05-16 14:02 - 2017-04-17 10:01 - 00035328 _____ (Microsoft Corporation) C:\windows\SysWOW64\wuapp.exe
2017-05-16 14:02 - 2017-04-17 10:01 - 00030208 _____ (Microsoft Corporation) C:\windows\SysWOW64\wups.dll
2017-05-16 14:02 - 2017-04-12 08:05 - 04296704 _____ (Microsoft Corporation) C:\windows\system32\D3DCompiler_47.dll
2017-05-16 13:38 - 2017-05-16 13:38 - 00001755 _____ C:\Users\Public\Desktop\iTunes.lnk
2017-05-16 13:38 - 2017-05-16 13:38 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\iTunes
2017-05-16 13:36 - 2017-05-16 13:38 - 00000000 ____D C:\Program Files\iTunes
2017-05-16 13:36 - 2017-05-16 13:36 - 00000000 ____D C:\Program Files\iPod
2017-05-10 19:23 - 2017-05-17 20:05 - 00000000 ____D C:\Users\JB\AppData\Local\LogMeInIgnition
2017-05-10 04:51 - 2017-04-27 20:14 - 05547240 _____ (Microsoft Corporation) C:\windows\system32\ntoskrnl.exe
2017-05-10 04:51 - 2017-04-27 20:14 - 00706792 _____ (Microsoft Corporation) C:\windows\system32\winload.efi
2017-05-10 04:51 - 2017-04-27 20:14 - 00631176 _____ (Microsoft Corporation) C:\windows\system32\winresume.efi
2017-05-10 04:51 - 2017-04-27 20:14 - 00154856 _____ (Microsoft Corporation) C:\windows\system32\Drivers\ksecpkg.sys
2017-05-10 04:51 - 2017-04-27 20:14 - 00095464 _____ (Microsoft Corporation) C:\windows\system32\Drivers\ksecdd.sys
2017-05-10 04:51 - 2017-04-27 20:11 - 01732864 _____ (Microsoft Corporation) C:\windows\system32\ntdll.dll
2017-05-10 04:51 - 2017-04-27 20:10 - 01460736 _____ (Microsoft Corporation) C:\windows\system32\lsasrv.dll
2017-05-10 04:51 - 2017-04-27 20:10 - 01212928 _____ (Microsoft Corporation) C:\windows\system32\rpcrt4.dll
2017-05-10 04:51 - 2017-04-27 20:10 - 01163264 _____ (Microsoft Corporation) C:\windows\system32\kernel32.dll
2017-05-10 04:51 - 2017-04-27 20:10 - 00730624 _____ (Microsoft Corporation) C:\windows\system32\kerberos.dll
2017-05-10 04:51 - 2017-04-27 20:10 - 00503808 _____ (Microsoft Corporation) C:\windows\system32\srcore.dll
2017-05-10 04:51 - 2017-04-27 20:10 - 00419840 _____ (Microsoft Corporation) C:\windows\system32\KernelBase.dll
2017-05-10 04:51 - 2017-04-27 20:10 - 00362496 _____ (Microsoft Corporation) C:\windows\system32\wow64win.dll
2017-05-10 04:51 - 2017-04-27 20:10 - 00345600 _____ (Microsoft Corporation) C:\windows\system32\schannel.dll
2017-05-10 04:51 - 2017-04-27 20:10 - 00316928 _____ (Microsoft Corporation) C:\windows\system32\msv1_0.dll
2017-05-10 04:51 - 2017-04-27 20:10 - 00312320 _____ (Microsoft Corporation) C:\windows\system32\ncrypt.dll
2017-05-10 04:51 - 2017-04-27 20:10 - 00243712 _____ (Microsoft Corporation) C:\windows\system32\wow64.dll
2017-05-10 04:51 - 2017-04-27 20:10 - 00215552 _____ (Microsoft Corporation) C:\windows\system32\winsrv.dll
2017-05-10 04:51 - 2017-04-27 20:10 - 00210432 _____ (Microsoft Corporation) C:\windows\system32\wdigest.dll
2017-05-10 04:51 - 2017-04-27 20:10 - 00190464 _____ (Microsoft Corporation) C:\windows\system32\rpchttp.dll
2017-05-10 04:51 - 2017-04-27 20:10 - 00135680 _____ (Microsoft Corporation) C:\windows\system32\sspicli.dll
2017-05-10 04:51 - 2017-04-27 20:10 - 00086528 _____ (Microsoft Corporation) C:\windows\system32\TSpkg.dll
2017-05-10 04:51 - 2017-04-27 20:10 - 00063488 _____ (Microsoft Corporation) C:\windows\system32\setbcdlocale.dll
2017-05-10 04:51 - 2017-04-27 20:10 - 00050176 _____ (Microsoft Corporation) C:\windows\system32\srclient.dll
2017-05-10 04:51 - 2017-04-27 20:10 - 00028672 _____ (Microsoft Corporation) C:\windows\system32\sspisrv.dll
2017-05-10 04:51 - 2017-04-27 20:10 - 00028160 _____ (Microsoft Corporation) C:\windows\system32\secur32.dll
2017-05-10 04:51 - 2017-04-27 20:10 - 00016384 _____ (Microsoft Corporation) C:\windows\system32\ntvdm64.dll
2017-05-10 04:51 - 2017-04-27 20:10 - 00013312 _____ (Microsoft Corporation) C:\windows\system32\wow64cpu.dll
2017-05-10 04:51 - 2017-04-27 20:09 - 00880640 _____ (Microsoft Corporation) C:\windows\system32\advapi32.dll
2017-05-10 04:51 - 2017-04-27 20:09 - 00463872 _____ (Microsoft Corporation) C:\windows\system32\certcli.dll
2017-05-10 04:51 - 2017-04-27 20:09 - 00123904 _____ (Microsoft Corporation) C:\windows\system32\bcrypt.dll
2017-05-10 04:51 - 2017-04-27 20:09 - 00059904 _____ (Microsoft Corporation) C:\windows\system32\appidapi.dll
2017-05-10 04:51 - 2017-04-27 20:09 - 00044032 _____ (Microsoft Corporation) C:\windows\system32\csrsrv.dll
2017-05-10 04:51 - 2017-04-27 20:09 - 00043520 _____ (Microsoft Corporation) C:\windows\system32\cryptbase.dll
2017-05-10 04:51 - 2017-04-27 20:09 - 00034816 _____ (Microsoft Corporation) C:\windows\system32\appidsvc.dll
2017-05-10 04:51 - 2017-04-27 20:09 - 00022016 _____ (Microsoft Corporation) C:\windows\system32\credssp.dll
2017-05-10 04:51 - 2017-04-27 20:09 - 00006656 _____ (Microsoft Corporation) C:\windows\system32\apisetschema.dll
2017-05-10 04:51 - 2017-04-27 20:09 - 00006144 ____H (Microsoft Corporation) C:\windows\system32\api-ms-win-security-base-l1-1-0.dll
2017-05-10 04:51 - 2017-04-27 20:09 - 00005120 ____H (Microsoft Corporation) C:\windows\system32\api-ms-win-core-file-l1-1-0.dll
2017-05-10 04:51 - 2017-04-27 20:09 - 00004608 ____H (Microsoft Corporation) C:\windows\system32\api-ms-win-core-threadpool-l1-1-0.dll
2017-05-10 04:51 - 2017-04-27 20:09 - 00004608 ____H (Microsoft Corporation) C:\windows\system32\api-ms-win-core-processthreads-l1-1-0.dll
2017-05-10 04:51 - 2017-04-27 20:09 - 00004096 ____H (Microsoft Corporation) C:\windows\system32\api-ms-win-core-sysinfo-l1-1-0.dll
2017-05-10 04:51 - 2017-04-27 20:09 - 00004096 ____H (Microsoft Corporation) C:\windows\system32\api-ms-win-core-synch-l1-1-0.dll
2017-05-10 04:51 - 2017-04-27 20:09 - 00004096 ____H (Microsoft Corporation) C:\windows\system32\api-ms-win-core-localregistry-l1-1-0.dll
2017-05-10 04:51 - 2017-04-27 20:09 - 00004096 ____H (Microsoft Corporation) C:\windows\system32\api-ms-win-core-localization-l1-1-0.dll
2017-05-10 04:51 - 2017-04-27 20:09 - 00003584 ____H (Microsoft Corporation) C:\windows\system32\api-ms-win-core-rtlsupport-l1-1-0.dll
2017-05-10 04:51 - 2017-04-27 20:09 - 00003584 ____H (Microsoft Corporation) C:\windows\system32\api-ms-win-core-processenvironment-l1-1-0.dll
2017-05-10 04:51 - 2017-04-27 20:09 - 00003584 ____H (Microsoft Corporation) C:\windows\system32\api-ms-win-core-namedpipe-l1-1-0.dll
2017-05-10 04:51 - 2017-04-27 20:09 - 00003584 ____H (Microsoft Corporation) C:\windows\system32\api-ms-win-core-misc-l1-1-0.dll
2017-05-10 04:51 - 2017-04-27 20:09 - 00003584 ____H (Microsoft Corporation) C:\windows\system32\api-ms-win-core-memory-l1-1-0.dll
2017-05-10 04:51 - 2017-04-27 20:09 - 00003584 ____H (Microsoft Corporation) C:\windows\system32\api-ms-win-core-libraryloader-l1-1-0.dll
2017-05-10 04:51 - 2017-04-27 20:09 - 00003584 ____H (Microsoft Corporation) C:\windows\system32\api-ms-win-core-heap-l1-1-0.dll
2017-05-10 04:51 - 2017-04-27 20:09 - 00003072 ____H (Microsoft Corporation) C:\windows\system32\api-ms-win-core-xstate-l1-1-0.dll
2017-05-10 04:51 - 2017-04-27 20:09 - 00003072 ____H (Microsoft Corporation) C:\windows\system32\api-ms-win-core-util-l1-1-0.dll
2017-05-10 04:51 - 2017-04-27 20:09 - 00003072 ____H (Microsoft Corporation) C:\windows\system32\api-ms-win-core-string-l1-1-0.dll
2017-05-10 04:51 - 2017-04-27 20:09 - 00003072 ____H (Microsoft Corporation) C:\windows\system32\api-ms-win-core-profile-l1-1-0.dll
2017-05-10 04:51 - 2017-04-27 20:09 - 00003072 ____H (Microsoft Corporation) C:\windows\system32\api-ms-win-core-io-l1-1-0.dll
2017-05-10 04:51 - 2017-04-27 20:09 - 00003072 ____H (Microsoft Corporation) C:\windows\system32\api-ms-win-core-interlocked-l1-1-0.dll
2017-05-10 04:51 - 2017-04-27 20:09 - 00003072 ____H (Microsoft Corporation) C:\windows\system32\api-ms-win-core-handle-l1-1-0.dll
2017-05-10 04:51 - 2017-04-27 20:09 - 00003072 ____H (Microsoft Corporation) C:\windows\system32\api-ms-win-core-fibers-l1-1-0.dll
2017-05-10 04:51 - 2017-04-27 20:09 - 00003072 ____H (Microsoft Corporation) C:\windows\system32\api-ms-win-core-errorhandling-l1-1-0.dll
2017-05-10 04:51 - 2017-04-27 20:09 - 00003072 ____H (Microsoft Corporation) C:\windows\system32\api-ms-win-core-delayload-l1-1-0.dll
2017-05-10 04:51 - 2017-04-27 20:09 - 00003072 ____H (Microsoft Corporation) C:\windows\system32\api-ms-win-core-debug-l1-1-0.dll
2017-05-10 04:51 - 2017-04-27 20:09 - 00003072 ____H (Microsoft Corporation) C:\windows\system32\api-ms-win-core-datetime-l1-1-0.dll
2017-05-10 04:51 - 2017-04-27 20:09 - 00003072 ____H (Microsoft Corporation) C:\windows\system32\api-ms-win-core-console-l1-1-0.dll
2017-05-10 04:51 - 2017-04-27 19:36 - 04000488 _____ (Microsoft Corporation) C:\windows\SysWOW64\ntkrnlpa.exe
2017-05-10 04:51 - 2017-04-27 19:36 - 03945192 _____ (Microsoft Corporation) C:\windows\SysWOW64\ntoskrnl.exe
2017-05-10 04:51 - 2017-04-27 19:34 - 01314112 _____ (Microsoft Corporation) C:\windows\SysWOW64\ntdll.dll
2017-05-10 04:51 - 2017-04-27 19:32 - 01114112 _____ (Microsoft Corporation) C:\windows\SysWOW64\kernel32.dll
2017-05-10 04:51 - 2017-04-27 19:32 - 00666112 _____ (Microsoft Corporation) C:\windows\SysWOW64\rpcrt4.dll
2017-05-10 04:51 - 2017-04-27 19:32 - 00644096 _____ (Microsoft Corporation) C:\windows\SysWOW64\advapi32.dll
2017-05-10 04:51 - 2017-04-27 19:32 - 00553472 _____ (Microsoft Corporation) C:\windows\SysWOW64\kerberos.dll
2017-05-10 04:51 - 2017-04-27 19:32 - 00342528 _____ (Microsoft Corporation) C:\windows\SysWOW64\certcli.dll
2017-05-10 04:51 - 2017-04-27 19:32 - 00275456 _____ (Microsoft Corporation) C:\windows\SysWOW64\KernelBase.dll
2017-05-10 04:51 - 2017-04-27 19:32 - 00261120 _____ (Microsoft Corporation) C:\windows\SysWOW64\msv1_0.dll
2017-05-10 04:51 - 2017-04-27 19:32 - 00254464 _____ (Microsoft Corporation) C:\windows\SysWOW64\schannel.dll
2017-05-10 04:51 - 2017-04-27 19:32 - 00223232 _____ (Microsoft Corporation) C:\windows\SysWOW64\ncrypt.dll
2017-05-10 04:51 - 2017-04-27 19:32 - 00172032 _____ (Microsoft Corporation) C:\windows\SysWOW64\wdigest.dll
2017-05-10 04:51 - 2017-04-27 19:32 - 00141312 _____ (Microsoft Corporation) C:\windows\SysWOW64\rpchttp.dll
2017-05-10 04:51 - 2017-04-27 19:32 - 00096768 _____ (Microsoft Corporation) C:\windows\SysWOW64\sspicli.dll
2017-05-10 04:51 - 2017-04-27 19:32 - 00082944 _____ (Microsoft Corporation) C:\windows\SysWOW64\bcrypt.dll
2017-05-10 04:51 - 2017-04-27 19:32 - 00065536 _____ (Microsoft Corporation) C:\windows\SysWOW64\TSpkg.dll
2017-05-10 04:51 - 2017-04-27 19:32 - 00050688 _____ (Microsoft Corporation) C:\windows\SysWOW64\appidapi.dll
2017-05-10 04:51 - 2017-04-27 19:32 - 00043008 _____ (Microsoft Corporation) C:\windows\SysWOW64\srclient.dll
2017-05-10 04:51 - 2017-04-27 19:32 - 00022016 _____ (Microsoft Corporation) C:\windows\SysWOW64\secur32.dll
2017-05-10 04:51 - 2017-04-27 19:32 - 00017408 _____ (Microsoft Corporation) C:\windows\SysWOW64\credssp.dll
2017-05-10 04:51 - 2017-04-27 19:32 - 00006656 _____ (Microsoft Corporation) C:\windows\SysWOW64\apisetschema.dll
2017-05-10 04:51 - 2017-04-27 19:32 - 00005120 ____H (Microsoft Corporation) C:\windows\SysWOW64\api-ms-win-core-file-l1-1-0.dll
2017-05-10 04:51 - 2017-04-27 19:32 - 00005120 _____ (Microsoft Corporation) C:\windows\SysWOW64\wow32.dll
2017-05-10 04:51 - 2017-04-27 19:32 - 00004608 ____H (Microsoft Corporation) C:\windows\SysWOW64\api-ms-win-core-processthreads-l1-1-0.dll
2017-05-10 04:51 - 2017-04-27 19:32 - 00004096 ____H (Microsoft Corporation) C:\windows\SysWOW64\api-ms-win-core-sysinfo-l1-1-0.dll
2017-05-10 04:51 - 2017-04-27 19:32 - 00004096 ____H (Microsoft Corporation) C:\windows\SysWOW64\api-ms-win-core-synch-l1-1-0.dll
2017-05-10 04:51 - 2017-04-27 19:32 - 00004096 ____H (Microsoft Corporation) C:\windows\SysWOW64\api-ms-win-core-misc-l1-1-0.dll
2017-05-10 04:51 - 2017-04-27 19:32 - 00004096 ____H (Microsoft Corporation) C:\windows\SysWOW64\api-ms-win-core-localregistry-l1-1-0.dll
2017-05-10 04:51 - 2017-04-27 19:32 - 00004096 ____H (Microsoft Corporation) C:\windows\SysWOW64\api-ms-win-core-localization-l1-1-0.dll
2017-05-10 04:51 - 2017-04-27 19:32 - 00003584 ____H (Microsoft Corporation) C:\windows\SysWOW64\api-ms-win-core-processenvironment-l1-1-0.dll
2017-05-10 04:51 - 2017-04-27 19:32 - 00003584 ____H (Microsoft Corporation) C:\windows\SysWOW64\api-ms-win-core-namedpipe-l1-1-0.dll
2017-05-10 04:51 - 2017-04-27 19:32 - 00003584 ____H (Microsoft Corporation) C:\windows\SysWOW64\api-ms-win-core-memory-l1-1-0.dll
2017-05-10 04:51 - 2017-04-27 19:32 - 00003584 ____H (Microsoft Corporation) C:\windows\SysWOW64\api-ms-win-core-libraryloader-l1-1-0.dll
2017-05-10 04:51 - 2017-04-27 19:32 - 00003584 ____H (Microsoft Corporation) C:\windows\SysWOW64\api-ms-win-core-interlocked-l1-1-0.dll
2017-05-10 04:51 - 2017-04-27 19:32 - 00003584 ____H (Microsoft Corporation) C:\windows\SysWOW64\api-ms-win-core-heap-l1-1-0.dll
2017-05-10 04:51 - 2017-04-27 19:32 - 00003072 ____H (Microsoft Corporation) C:\windows\SysWOW64\api-ms-win-core-string-l1-1-0.dll
2017-05-10 04:51 - 2017-04-27 19:32 - 00003072 ____H (Microsoft Corporation) C:\windows\SysWOW64\api-ms-win-core-rtlsupport-l1-1-0.dll
2017-05-10 04:51 - 2017-04-27 19:32 - 00003072 ____H (Microsoft Corporation) C:\windows\SysWOW64\api-ms-win-core-profile-l1-1-0.dll
2017-05-10 04:51 - 2017-04-27 19:32 - 00003072 ____H (Microsoft Corporation) C:\windows\SysWOW64\api-ms-win-core-io-l1-1-0.dll
2017-05-10 04:51 - 2017-04-27 19:32 - 00003072 ____H (Microsoft Corporation) C:\windows\SysWOW64\api-ms-win-core-handle-l1-1-0.dll
2017-05-10 04:51 - 2017-04-27 19:32 - 00003072 ____H (Microsoft Corporation) C:\windows\SysWOW64\api-ms-win-core-fibers-l1-1-0.dll
2017-05-10 04:51 - 2017-04-27 19:32 - 00003072 ____H (Microsoft Corporation) C:\windows\SysWOW64\api-ms-win-core-errorhandling-l1-1-0.dll
2017-05-10 04:51 - 2017-04-27 19:32 - 00003072 ____H (Microsoft Corporation) C:\windows\SysWOW64\api-ms-win-core-delayload-l1-1-0.dll
2017-05-10 04:51 - 2017-04-27 19:32 - 00003072 ____H (Microsoft Corporation) C:\windows\SysWOW64\api-ms-win-core-debug-l1-1-0.dll
2017-05-10 04:51 - 2017-04-27 19:32 - 00003072 ____H (Microsoft Corporation) C:\windows\SysWOW64\api-ms-win-core-datetime-l1-1-0.dll
2017-05-10 04:51 - 2017-04-27 19:19 - 00148480 _____ (Microsoft Corporation) C:\windows\system32\appidpolicyconverter.exe
2017-05-10 04:51 - 2017-04-27 19:19 - 00062464 _____ (Microsoft Corporation) C:\windows\system32\Drivers\appid.sys
2017-05-10 04:51 - 2017-04-27 19:19 - 00017920 _____ (Microsoft Corporation) C:\windows\system32\appidcertstorecheck.exe
2017-05-10 04:51 - 2017-04-27 19:18 - 00064000 _____ (Microsoft Corporation) C:\windows\system32\auditpol.exe
2017-05-10 04:51 - 2017-04-27 19:15 - 00338432 _____ (Microsoft Corporation) C:\windows\system32\conhost.exe
2017-05-10 04:51 - 2017-04-27 19:14 - 00296960 _____ (Microsoft Corporation) C:\windows\system32\rstrui.exe
2017-05-10 04:51 - 2017-04-27 19:12 - 00159744 _____ (Microsoft Corporation) C:\windows\system32\Drivers\mrxsmb.sys
2017-05-10 04:51 - 2017-04-27 19:11 - 00291328 _____ (Microsoft Corporation) C:\windows\system32\Drivers\mrxsmb10.sys
2017-05-10 04:51 - 2017-04-27 19:11 - 00129536 _____ (Microsoft Corporation) C:\windows\system32\Drivers\mrxsmb20.sys
2017-05-10 04:51 - 2017-04-27 19:11 - 00050176 _____ (Microsoft Corporation) C:\windows\SysWOW64\auditpol.exe
2017-05-10 04:51 - 2017-04-27 19:10 - 00112640 _____ (Microsoft Corporation) C:\windows\system32\smss.exe
2017-05-10 04:51 - 2017-04-27 19:10 - 00030720 _____ (Microsoft Corporation) C:\windows\system32\lsass.exe
2017-05-10 04:51 - 2017-04-27 19:08 - 00025600 _____ (Microsoft Corporation) C:\windows\SysWOW64\setup16.exe
2017-05-10 04:51 - 2017-04-27 19:08 - 00014336 _____ (Microsoft Corporation) C:\windows\SysWOW64\ntvdm64.dll
2017-05-10 04:51 - 2017-04-27 19:07 - 00036352 _____ (Microsoft Corporation) C:\windows\SysWOW64\cryptbase.dll
2017-05-10 04:51 - 2017-04-27 19:07 - 00006144 ____H (Microsoft Corporation) C:\windows\SysWOW64\api-ms-win-security-base-l1-1-0.dll
2017-05-10 04:51 - 2017-04-27 19:07 - 00004608 ____H (Microsoft Corporation) C:\windows\SysWOW64\api-ms-win-core-threadpool-l1-1-0.dll
2017-05-10 04:51 - 2017-04-27 19:07 - 00003584 ____H (Microsoft Corporation) C:\windows\SysWOW64\api-ms-win-core-xstate-l1-1-0.dll
2017-05-10 04:51 - 2017-04-27 19:07 - 00003072 ____H (Microsoft Corporation) C:\windows\SysWOW64\api-ms-win-core-util-l1-1-0.dll
2017-05-10 04:51 - 2017-04-26 09:59 - 03220992 _____ (Microsoft Corporation) C:\windows\system32\win32k.sys
2017-05-10 04:51 - 2017-04-21 10:34 - 01133568 _____ (Microsoft Corporation) C:\windows\system32\cdosys.dll
2017-05-10 04:51 - 2017-04-21 10:15 - 00805376 _____ (Microsoft Corporation) C:\windows\SysWOW64\cdosys.dll
2017-05-10 04:51 - 2017-04-19 19:00 - 00394448 _____ (Microsoft Corporation) C:\windows\system32\iedkcs32.dll
2017-05-10 04:51 - 2017-04-19 18:16 - 00346320 _____ (Microsoft Corporation) C:\windows\SysWOW64\iedkcs32.dll
2017-05-10 04:51 - 2017-04-17 10:37 - 02065408 _____ (Microsoft Corporation) C:\windows\system32\ole32.dll
2017-05-10 04:51 - 2017-04-17 10:37 - 00876544 _____ (Microsoft Corporation) C:\windows\system32\oleaut32.dll
2017-05-10 04:51 - 2017-04-17 10:37 - 00512000 _____ (Microsoft Corporation) C:\windows\system32\rpcss.dll
2017-05-10 04:51 - 2017-04-17 10:37 - 00026112 _____ (Microsoft Corporation) C:\windows\system32\oleres.dll
2017-05-10 04:51 - 2017-04-17 10:37 - 00008704 _____ (Microsoft Corporation) C:\windows\system32\comcat.dll
2017-05-10 04:51 - 2017-04-17 10:12 - 01417728 _____ (Microsoft Corporation) C:\windows\SysWOW64\ole32.dll
2017-05-10 04:51 - 2017-04-17 10:12 - 00581632 _____ (Microsoft Corporation) C:\windows\SysWOW64\oleaut32.dll
2017-05-10 04:51 - 2017-04-17 10:12 - 00026112 _____ (Microsoft Corporation) C:\windows\SysWOW64\oleres.dll
2017-05-10 04:51 - 2017-04-17 09:54 - 00007168 _____ (Microsoft Corporation) C:\windows\SysWOW64\comcat.dll
2017-05-10 04:51 - 2017-04-16 03:57 - 00066560 _____ (Microsoft Corporation) C:\windows\system32\iesetup.dll
2017-05-10 04:51 - 2017-04-16 03:55 - 00417792 _____ (Microsoft Corporation) C:\windows\system32\html.iec
2017-05-10 04:51 - 2017-04-16 03:55 - 00048640 _____ (Microsoft Corporation) C:\windows\system32\ieetwproxystub.dll
2017-05-10 04:51 - 2017-04-16 03:54 - 00576512 _____ (Microsoft Corporation) C:\windows\system32\vbscript.dll
2017-05-10 04:51 - 2017-04-16 03:54 - 00088064 _____ (Microsoft Corporation) C:\windows\system32\MshtmlDac.dll
2017-05-10 04:51 - 2017-04-16 03:51 - 02899456 _____ (Microsoft Corporation) C:\windows\system32\iertutil.dll
2017-05-10 04:51 - 2017-04-16 03:44 - 00054784 _____ (Microsoft Corporation) C:\windows\system32\jsproxy.dll
2017-05-10 04:51 - 2017-04-16 03:43 - 00034304 _____ (Microsoft Corporation) C:\windows\system32\iernonce.dll
2017-05-10 04:51 - 2017-04-16 03:38 - 00615936 _____ (Microsoft Corporation) C:\windows\system32\ieui.dll
2017-05-10 04:51 - 2017-04-16 03:37 - 00144384 _____ (Microsoft Corporation) C:\windows\system32\ieUnatt.exe
2017-05-10 04:51 - 2017-04-16 03:37 - 00116224 _____ (Microsoft Corporation) C:\windows\system32\ieetwcollector.exe
2017-05-10 04:51 - 2017-04-16 03:36 - 00817664 _____ (Microsoft Corporation) C:\windows\system32\jscript.dll
2017-05-10 04:51 - 2017-04-16 03:36 - 00814080 _____ (Microsoft Corporation) C:\windows\system32\jscript9diag.dll
2017-05-10 04:51 - 2017-04-16 03:35 - 25741312 _____ (Microsoft Corporation) C:\windows\system32\mshtml.dll
2017-05-10 04:51 - 2017-04-16 03:25 - 00968704 _____ (Microsoft Corporation) C:\windows\system32\MsSpellCheckingFacility.exe
2017-05-10 04:51 - 2017-04-16 03:21 - 00489984 _____ (Microsoft Corporation) C:\windows\system32\dxtmsft.dll
2017-05-10 04:51 - 2017-04-16 03:18 - 05977600 _____ (Microsoft Corporation) C:\windows\system32\jscript9.dll
2017-05-10 04:51 - 2017-04-16 03:11 - 00077824 _____ (Microsoft Corporation) C:\windows\system32\JavaScriptCollectionAgent.dll
2017-05-10 04:51 - 2017-04-16 03:10 - 00087552 _____ (Microsoft Corporation) C:\windows\system32\tdc.ocx
2017-05-10 04:51 - 2017-04-16 03:09 - 00107520 _____ (Microsoft Corporation) C:\windows\system32\inseng.dll
2017-05-10 04:51 - 2017-04-16 03:04 - 00199680 _____ (Microsoft Corporation) C:\windows\system32\msrating.dll
2017-05-10 04:51 - 2017-04-16 03:03 - 00092160 _____ (Microsoft Corporation) C:\windows\system32\mshtmled.dll
2017-05-10 04:51 - 2017-04-16 03:02 - 00062464 _____ (Microsoft Corporation) C:\windows\SysWOW64\iesetup.dll
2017-05-10 04:51 - 2017-04-16 03:01 - 00499200 _____ (Microsoft Corporation) C:\windows\SysWOW64\vbscript.dll
2017-05-10 04:51 - 2017-04-16 03:01 - 00341504 _____ (Microsoft Corporation) C:\windows\SysWOW64\html.iec
2017-05-10 04:51 - 2017-04-16 03:01 - 00047616 _____ (Microsoft Corporation) C:\windows\SysWOW64\ieetwproxystub.dll
2017-05-10 04:51 - 2017-04-16 03:00 - 00315392 _____ (Microsoft Corporation) C:\windows\system32\dxtrans.dll
2017-05-10 04:51 - 2017-04-16 03:00 - 00064000 _____ (Microsoft Corporation) C:\windows\SysWOW64\MshtmlDac.dll
2017-05-10 04:51 - 2017-04-16 02:57 - 00152064 _____ (Microsoft Corporation) C:\windows\system32\occache.dll
2017-05-10 04:51 - 2017-04-16 02:53 - 02290176 _____ (Microsoft Corporation) C:\windows\SysWOW64\iertutil.dll
2017-05-10 04:51 - 2017-04-16 02:52 - 00047104 _____ (Microsoft Corporation) C:\windows\SysWOW64\jsproxy.dll
2017-05-10 04:51 - 2017-04-16 02:52 - 00030720 _____ (Microsoft Corporation) C:\windows\SysWOW64\iernonce.dll
2017-05-10 04:51 - 2017-04-16 02:49 - 20278272 _____ (Microsoft Corporation) C:\windows\SysWOW64\mshtml.dll
2017-05-10 04:51 - 2017-04-16 02:48 - 00476160 _____ (Microsoft Corporation) C:\windows\SysWOW64\ieui.dll
2017-05-10 04:51 - 2017-04-16 02:47 - 00663552 _____ (Microsoft Corporation) C:\windows\SysWOW64\jscript.dll
2017-05-10 04:51 - 2017-04-16 02:47 - 00115712 _____ (Microsoft Corporation) C:\windows\SysWOW64\ieUnatt.exe
2017-05-10 04:51 - 2017-04-16 02:46 - 00620032 _____ (Microsoft Corporation) C:\windows\SysWOW64\jscript9diag.dll
2017-05-10 04:51 - 2017-04-16 02:43 - 00262144 _____ (Microsoft Corporation) C:\windows\system32\webcheck.dll
2017-05-10 04:51 - 2017-04-16 02:40 - 00806912 _____ (Microsoft Corporation) C:\windows\system32\msfeeds.dll
2017-05-10 04:51 - 2017-04-16 02:40 - 00725504 _____ (Microsoft Corporation) C:\windows\system32\ie4uinit.exe
2017-05-10 04:51 - 2017-04-16 02:37 - 02132992 _____ (Microsoft Corporation) C:\windows\system32\inetcpl.cpl
2017-05-10 04:51 - 2017-04-16 02:37 - 01359360 _____ (Microsoft Corporation) C:\windows\system32\mshtmlmedia.dll
2017-05-10 04:51 - 2017-04-16 02:35 - 00416256 _____ (Microsoft Corporation) C:\windows\SysWOW64\dxtmsft.dll
2017-05-10 04:51 - 2017-04-16 02:30 - 00060416 _____ (Microsoft Corporation) C:\windows\SysWOW64\JavaScriptCollectionAgent.dll
2017-05-10 04:51 - 2017-04-16 02:29 - 00073216 _____ (Microsoft Corporation) C:\windows\SysWOW64\tdc.ocx
2017-05-10 04:51 - 2017-04-16 02:28 - 00091136 _____ (Microsoft Corporation) C:\windows\SysWOW64\inseng.dll
2017-05-10 04:51 - 2017-04-16 02:25 - 00168960 _____ (Microsoft Corporation) C:\windows\SysWOW64\msrating.dll
2017-05-10 04:51 - 2017-04-16 02:24 - 00076288 _____ (Microsoft Corporation) C:\windows\SysWOW64\mshtmled.dll
2017-05-10 04:51 - 2017-04-16 02:22 - 00279040 _____ (Microsoft Corporation) C:\windows\SysWOW64\dxtrans.dll
2017-05-10 04:51 - 2017-04-16 02:20 - 00130048 _____ (Microsoft Corporation) C:\windows\SysWOW64\occache.dll
2017-05-10 04:51 - 2017-04-16 02:12 - 00230400 _____ (Microsoft Corporation) C:\windows\SysWOW64\webcheck.dll
2017-05-10 04:51 - 2017-04-16 02:10 - 15250944 _____ (Microsoft Corporation) C:\windows\system32\ieframe.dll
2017-05-10 04:51 - 2017-04-16 02:10 - 00693248 _____ (Microsoft Corporation) C:\windows\SysWOW64\msfeeds.dll
2017-05-10 04:51 - 2017-04-16 02:08 - 04548608 _____ (Microsoft Corporation) C:\windows\SysWOW64\jscript9.dll
2017-05-10 04:51 - 2017-04-16 02:08 - 02057216 _____ (Microsoft Corporation) C:\windows\SysWOW64\inetcpl.cpl
2017-05-10 04:51 - 2017-04-16 02:08 - 01155072 _____ (Microsoft Corporation) C:\windows\SysWOW64\mshtmlmedia.dll
2017-05-10 04:51 - 2017-04-16 02:04 - 03241472 _____ (Microsoft Corporation) C:\windows\system32\wininet.dll
2017-05-10 04:51 - 2017-04-16 01:53 - 13661184 _____ (Microsoft Corporation) C:\windows\SysWOW64\ieframe.dll
2017-05-10 04:51 - 2017-04-16 01:50 - 01544704 _____ (Microsoft Corporation) C:\windows\system32\urlmon.dll
2017-05-10 04:51 - 2017-04-16 01:40 - 00800768 _____ (Microsoft Corporation) C:\windows\system32\ieapfltr.dll
2017-05-10 04:51 - 2017-04-16 01:37 - 02767872 _____ (Microsoft Corporation) C:\windows\SysWOW64\wininet.dll
2017-05-10 04:51 - 2017-04-16 01:34 - 01314816 _____ (Microsoft Corporation) C:\windows\SysWOW64\urlmon.dll
2017-05-10 04:51 - 2017-04-16 01:34 - 00710144 _____ (Microsoft Corporation) C:\windows\SysWOW64\ieapfltr.dll
2017-05-10 04:51 - 2017-04-12 10:32 - 01483776 _____ (Microsoft Corporation) C:\windows\system32\crypt32.dll
2017-05-10 04:51 - 2017-04-12 10:32 - 00229376 _____ (Microsoft Corporation) C:\windows\system32\wintrust.dll
2017-05-10 04:51 - 2017-04-12 10:32 - 00190976 _____ (Microsoft Corporation) C:\windows\system32\cryptsvc.dll
2017-05-10 04:51 - 2017-04-12 10:32 - 00141824 _____ (Microsoft Corporation) C:\windows\system32\cryptnet.dll
2017-05-10 04:51 - 2017-04-12 10:26 - 00179200 _____ (Microsoft Corporation) C:\windows\SysWOW64\wintrust.dll
2017-05-10 04:51 - 2017-04-12 10:25 - 01176064 _____ (Microsoft Corporation) C:\windows\SysWOW64\crypt32.dll
2017-05-10 04:51 - 2017-04-12 10:25 - 00145920 _____ (Microsoft Corporation) C:\windows\SysWOW64\cryptsvc.dll
2017-05-10 04:51 - 2017-04-12 10:25 - 00106496 _____ (Microsoft Corporation) C:\windows\SysWOW64\cryptnet.dll
2017-05-10 04:51 - 2017-04-07 10:34 - 00986856 _____ (Microsoft Corporation) C:\windows\system32\Drivers\dxgkrnl.sys
2017-05-10 04:51 - 2017-04-07 10:34 - 00265448 _____ (Microsoft Corporation) C:\windows\system32\Drivers\dxgmms1.sys
2017-05-10 04:51 - 2017-04-07 10:30 - 00405504 _____ (Microsoft Corporation) C:\windows\system32\gdi32.dll
2017-05-10 04:51 - 2017-04-07 10:30 - 00144384 _____ (Microsoft Corporation) C:\windows\system32\cdd.dll
2017-05-10 04:51 - 2017-04-07 10:22 - 00312832 _____ (Microsoft Corporation) C:\windows\SysWOW64\gdi32.dll
2017-05-10 04:51 - 2017-04-05 09:55 - 00460800 _____ (Microsoft Corporation) C:\windows\system32\Drivers\srv.sys
2017-05-10 04:51 - 2017-04-05 09:55 - 00405504 _____ (Microsoft Corporation) C:\windows\system32\Drivers\srv2.sys
2017-05-10 04:51 - 2017-04-05 09:55 - 00168960 _____ (Microsoft Corporation) C:\windows\system32\Drivers\srvnet.sys
2017-05-10 04:51 - 2017-04-04 10:34 - 01895656 _____ (Microsoft Corporation) C:\windows\system32\Drivers\tcpip.sys
2017-05-10 04:51 - 2017-04-04 10:34 - 00377576 _____ (Microsoft Corporation) C:\windows\system32\Drivers\netio.sys
2017-05-10 04:51 - 2017-04-04 10:34 - 00287976 _____ (Microsoft Corporation) C:\windows\system32\Drivers\FWPKCLNT.SYS
2017-05-10 04:51 - 2017-04-04 09:53 - 00496128 _____ (Microsoft Corporation) C:\windows\system32\Drivers\afd.sys
2017-05-10 04:51 - 2017-04-04 09:53 - 00117760 _____ (Microsoft Corporation) C:\windows\system32\Drivers\tdx.sys
2017-05-10 04:50 - 2017-04-27 20:10 - 00146432 _____ (Microsoft Corporation) C:\windows\system32\msaudite.dll
2017-05-10 04:50 - 2017-04-27 20:10 - 00060416 _____ (Microsoft Corporation) C:\windows\system32\msobjs.dll
2017-05-10 04:50 - 2017-04-27 20:09 - 00690688 _____ (Microsoft Corporation) C:\windows\system32\adtschema.dll
2017-05-10 04:50 - 2017-04-27 19:32 - 00690688 _____ (Microsoft Corporation) C:\windows\SysWOW64\adtschema.dll
2017-05-10 04:50 - 2017-04-27 19:32 - 00146432 _____ (Microsoft Corporation) C:\windows\SysWOW64\msaudite.dll
2017-05-10 04:50 - 2017-04-27 19:32 - 00060416 _____ (Microsoft Corporation) C:\windows\SysWOW64\msobjs.dll
2017-05-10 04:50 - 2017-04-27 19:32 - 00003072 ____H (Microsoft Corporation) C:\windows\SysWOW64\api-ms-win-core-console-l1-1-0.dll
2017-05-10 04:50 - 2017-04-27 19:08 - 00007680 _____ (Microsoft Corporation) C:\windows\SysWOW64\instnm.exe
2017-05-10 04:50 - 2017-04-27 19:08 - 00002048 _____ (Microsoft Corporation) C:\windows\SysWOW64\user.exe
2017-05-10 04:50 - 2017-04-16 04:17 - 02724864 _____ (Microsoft Corporation) C:\windows\system32\mshtml.tlb
2017-05-10 04:50 - 2017-04-16 04:16 - 00004096 _____ (Microsoft Corporation) C:\windows\system32\ieetwcollectorres.dll
2017-05-10 04:50 - 2017-04-16 03:19 - 02724864 _____ (Microsoft Corporation) C:\windows\SysWOW64\mshtml.tlb
2017-05-09 10:44 - 2017-05-23 16:23 - 00000000 ____D C:\ProgramData\LogMeIn
2017-05-09 10:44 - 2017-05-23 14:13 - 00000950 _____ C:\ProgramData\Microsoft\Windows\Start Menu\Programs\LogMeIn Control Panel.lnk
2017-05-09 10:44 - 2017-05-17 20:03 - 00114688 _____ (LogMeIn, Inc.) C:\windows\system32\LMIRfsClientNP.dll
2017-05-09 10:44 - 2017-05-17 20:03 - 00109024 _____ (LogMeIn, Inc.) C:\windows\system32\LMIinit.dll
2017-05-09 10:44 - 2017-05-09 10:44 - 00001914 _____ C:\ProgramData\Microsoft\Windows\Start Menu\Programs\LogMeIn Client.lnk
2017-05-09 10:44 - 2017-05-09 10:44 - 00001024 _____ C:\.rnd
2017-05-09 10:44 - 2017-05-09 10:44 - 00000000 ____D C:\Users\JB\AppData\Local\LogMeIn
2017-05-09 10:44 - 2017-05-09 10:44 - 00000000 ____D C:\Program Files (x86)\LogMeIn Ignition
2017-05-09 10:44 - 2017-01-11 03:08 - 00030432 _____ (LogMeIn, Inc.) C:\windows\system32\Drivers\LMIInfo.sys
2017-05-09 10:44 - 2017-01-10 11:04 - 00081088 _____ (LogMeIn, Inc.) C:\windows\system32\Drivers\LMIRfsDriver.sys
2017-05-09 10:44 - 2016-01-29 10:53 - 00035328 _____ (LogMeIn, Inc.) C:\windows\system32\LMIport.dll
2017-05-09 10:43 - 2017-05-17 20:04 - 00000000 ____D C:\Program Files (x86)\LogMeIn
2017-05-03 14:23 - 2017-05-03 14:23 - 00147490 _____ C:\Users\JB\Documents\Lien Release Rock Steady.pdf
2017-05-02 16:18 - 2017-05-02 16:23 - 00133967 _____ C:\Users\JB\Downloads\Electronic Change of Address.pdf
2017-05-02 16:05 - 2017-03-10 11:32 - 01389056 _____ (Microsoft Corporation) C:\windows\system32\pla.dll
2017-05-02 16:05 - 2017-03-10 11:32 - 00300544 _____ (Microsoft Corporation) C:\windows\system32\pdh.dll
2017-05-02 16:05 - 2017-03-10 11:20 - 01508352 _____ (Microsoft Corporation) C:\windows\SysWOW64\pla.dll
2017-05-02 16:05 - 2017-03-10 11:20 - 00237056 _____ (Microsoft Corporation) C:\windows\SysWOW64\pdh.dll
2017-05-02 16:05 - 2017-03-10 10:57 - 00009216 _____ (Microsoft Corporation) C:\windows\system32\plasrv.exe
2017-05-02 16:05 - 2017-03-10 10:55 - 00205312 _____ (Microsoft Corporation) C:\windows\system32\Drivers\fastfat.sys
2017-05-02 16:05 - 2017-03-10 10:55 - 00195584 _____ (Microsoft Corporation) C:\windows\system32\Drivers\exfat.sys
2017-05-02 16:05 - 2017-03-09 11:34 - 00002048 _____ (Microsoft Corporation) C:\windows\system32\tzres.dll
2017-05-02 16:05 - 2017-03-09 11:19 - 00002048 _____ (Microsoft Corporation) C:\windows\SysWOW64\tzres.dll
2017-04-23 15:48 - 2017-04-23 15:48 - 02882240 _____ C:\Users\JB\Downloads\Your-Tickets-5-7-2017-911839.pdf
2017-04-23 15:44 - 2017-04-23 15:44 - 02882711 _____ C:\Users\JB\Downloads\Your-Tickets-5-7-2017-601461.pdf

==================== One Month Modified files and folders ========

(If an entry is included in the fixlist, the file/folder will be moved.)

2017-05-23 16:57 - 2016-12-10 20:20 - 00000000 ____D C:\FRST
2017-05-23 16:40 - 2015-10-30 14:20 - 00003902 _____ C:\windows\System32\Tasks\User_Feed_Synchronization-{7827EECA-F2EA-4C06-969B-64B433542E61}
2017-05-23 15:56 - 2009-07-13 23:45 - 00027568 ____H C:\windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0
2017-05-23 15:56 - 2009-07-13 23:45 - 00027568 ____H C:\windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0
2017-05-23 15:46 - 2016-12-05 10:56 - 00000000 ____D C:\Users\JB\AppData\LocalLow\Mozilla
2017-05-23 15:42 - 2015-11-19 18:20 - 00000000 ____D C:\Users\JB\Documents\Outlook Files
2017-05-23 15:38 - 2017-02-09 21:34 - 00192216 _____ (Malwarebytes) C:\windows\system32\Drivers\MBAMSwissArmy.sys
2017-05-23 15:38 - 2016-07-19 12:40 - 02867624 _____ C:\windows\ntbtlog.txt
2017-05-23 15:26 - 2015-10-31 15:51 - 00000000 ____D C:\ProgramData\Kaspersky Lab
2017-05-23 14:29 - 2017-01-25 02:32 - 00003032 _____ C:\windows\System32\Tasks\Kaspersky_Upgrade_Launcher_{278ADC42-419D-4547-A6CA-5B74BE0AD901}
2017-05-23 14:17 - 2009-07-14 00:13 - 00781614 _____ C:\windows\system32\PerfStringBackup.INI
2017-05-23 14:17 - 2009-07-13 22:20 - 00000000 ____D C:\windows\inf
2017-05-23 14:13 - 2017-02-09 21:38 - 00228800 _____ (Malwarebytes) C:\windows\system32\Drivers\MB3SwissArmy.sys
2017-05-23 14:13 - 2017-02-09 21:38 - 00113592 _____ (Malwarebytes) C:\windows\system32\Drivers\farflt.sys
2017-05-23 14:12 - 2015-11-06 16:04 - 00000000 ____D C:\Program Files (x86)\ATT
2017-05-23 14:12 - 2009-07-14 00:08 - 00000006 ____H C:\windows\Tasks\SA.DAT
2017-05-23 14:10 - 2015-11-02 18:30 - 00000000 ____D C:\windows\system32\MRT
2017-05-23 14:09 - 2015-11-02 18:29 - 132223576 ____C (Microsoft Corporation) C:\windows\system32\MRT.exe
2017-05-23 14:07 - 2017-02-10 00:17 - 00000000 ____D C:\ProgramData\Malwarebytes Anti-Exploit
2017-05-22 20:37 - 2016-12-21 19:33 - 00000000 ____D C:\Users\JB\AppData\LocalLow\Adblock Plus for IE
2017-05-21 17:52 - 2015-05-28 16:30 - 00000000 ___HD C:\Program Files (x86)\InstallShield Installation Information
2017-05-21 17:06 - 2016-12-21 19:08 - 00000000 ____D C:\Program Files (x86)\SpeedFan
2017-05-21 15:55 - 2016-08-13 13:59 - 00003168 _____ C:\windows\System32\Tasks\HPCeeScheduleForJB
2017-05-21 15:55 - 2016-08-13 13:59 - 00000320 _____ C:\windows\Tasks\HPCeeScheduleForJB.job
2017-05-20 20:15 - 2009-07-14 00:32 - 00028672 _____ C:\windows\system32\config\BCD-Template
2017-05-20 17:56 - 2015-12-02 15:24 - 00000000 ____D C:\Program Files (x86)\Mozilla Maintenance Service
2017-05-20 17:16 - 2016-05-20 15:16 - 00000000 ____D C:\windows\Minidump
2017-05-18 10:35 - 2015-11-21 14:22 - 00004476 _____ C:\windows\System32\Tasks\Adobe Acrobat Update Task
2017-05-17 17:13 - 2017-02-10 00:17 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Malwarebytes Anti-Exploit
2017-05-17 17:13 - 2017-02-10 00:17 - 00000000 ____D C:\Program Files (x86)\Malwarebytes Anti-Exploit
2017-05-17 11:01 - 2015-11-02 12:41 - 00000090 _____ C:\windows\QBChanUtil_Trigger.ini
2017-05-16 18:04 - 2009-07-13 22:20 - 00000000 ____D C:\windows\rescache
2017-05-16 14:18 - 2016-11-15 02:42 - 00000000 ____D C:\ProgramData\regid.1991-06.com.microsoft
2017-05-16 14:12 - 2015-05-28 16:31 - 00000000 ____D C:\Program Files (x86)\Microsoft Office
2017-05-16 14:05 - 2013-12-03 15:26 - 00773736 _____ C:\windows\SysWOW64\PerfStringBackup.INI
2017-05-10 12:46 - 2009-07-13 23:45 - 00443280 _____ C:\windows\system32\FNTCACHE.DAT
2017-05-10 12:43 - 2009-07-13 22:20 - 00000000 ____D C:\windows\PolicyDefinitions
2017-05-09 15:47 - 2015-05-28 16:37 - 00803320 _____ (Adobe Systems Incorporated) C:\windows\SysWOW64\FlashPlayerApp.exe
2017-05-09 15:47 - 2015-05-28 16:37 - 00144888 _____ (Adobe Systems Incorporated) C:\windows\SysWOW64\FlashPlayerCPLApp.cpl
2017-05-09 15:47 - 2015-05-28 16:37 - 00004312 _____ C:\windows\System32\Tasks\Adobe Flash Player Updater
2017-05-09 15:47 - 2015-05-28 16:37 - 00000000 ____D C:\windows\SysWOW64\Macromed
2017-05-09 15:47 - 2015-05-28 16:37 - 00000000 ____D C:\windows\system32\Macromed
2017-04-27 16:32 - 2016-11-14 20:07 - 00003330 _____ C:\windows\System32\Tasks\GoogleUpdateTaskMachineUA
2017-04-27 16:32 - 2016-11-14 20:07 - 00003202 _____ C:\windows\System32\Tasks\GoogleUpdateTaskMachineCore

==================== Files in the root of some directories =======

2016-11-14 23:55 - 2016-11-14 23:55 - 0007605 _____ () C:\Users\JB\AppData\Local\Resmon.ResmonCfg
2017-04-09 16:08 - 2017-04-09 16:08 - 0000000 _____ () C:\Users\JB\AppData\Local\{E32D5016-8129-4AE8-84B7-3774A9FA5F62}
2017-02-02 14:20 - 2017-02-02 14:20 - 0000000 _____ () C:\Users\JB\AppData\Local\{EFFBA262-4F5B-4C9C-A254-B372422AB856}
2015-10-31 15:12 - 2015-10-31 15:12 - 0000057 _____ () C:\ProgramData\Ament.ini

==================== Bamital & volsnap ======================

(There is no automatic fix for files that do not pass verification.)

C:\windows\system32\winlogon.exe => File is digitally signed
C:\windows\system32\wininit.exe => File is digitally signed
C:\windows\SysWOW64\wininit.exe => File is digitally signed
C:\windows\explorer.exe => File is digitally signed
C:\windows\SysWOW64\explorer.exe => File is digitally signed
C:\windows\system32\svchost.exe => File is digitally signed
C:\windows\SysWOW64\svchost.exe => File is digitally signed
C:\windows\system32\services.exe => File is digitally signed
C:\windows\system32\User32.dll => File is digitally signed
C:\windows\SysWOW64\User32.dll => File is digitally signed
C:\windows\system32\userinit.exe => File is digitally signed
C:\windows\SysWOW64\userinit.exe => File is digitally signed
C:\windows\system32\rpcss.dll => File is digitally signed
C:\windows\system32\dnsapi.dll => File is digitally signed
C:\windows\SysWOW64\dnsapi.dll => File is digitally signed
C:\windows\system32\Drivers\volsnap.sys => File is digitally signed

LastRegBack: 2017-05-23 11:23

==================== End of FRST.txt ============================

Additional scan result of Farbar Recovery Scan Tool (x64) Version: 22-05-2017
Ran by JB (23-05-2017 16:57:30)
Running from C:\Users\JB\Desktop
Windows 7 Professional Service Pack 1 (X64) (2015-10-30 19:19:40)
Boot Mode: Normal
==========================================================

==================== Accounts: =============================

Administrator (S-1-5-21-2577112198-3913129868-2286876578-500 - Administrator - Disabled)
Guest (S-1-5-21-2577112198-3913129868-2286876578-501 - Limited - Disabled)
JB (S-1-5-21-2577112198-3913129868-2286876578-1000 - Administrator - Enabled) => C:\Users\JB

==================== Security Center ========================

(If an entry is included in the fixlist, it will be removed.)

AV: Kaspersky Small Office Security (Enabled - Up to date) {86367591-4BE4-AE08-2FD9-7FCB8259CD98}
AS: Kaspersky Small Office Security (Enabled - Up to date) {3D579475-6DDE-A186-1569-44B9F9DE8725}
AS: Windows Defender (Enabled - Up to date) {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
FW: Kaspersky Small Office Security (Enabled) {BE0DF4B4-018B-AF50-0486-D6FE7C8A8AE3}

==================== Installed Programs ======================

(Only the adware programs with "Hidden" flag could be added to the fixlist to unhide them. The adware programs should be uninstalled manually.)

7-Zip 16.04 (x64 edition) (HKLM\...\{23170F69-40C1-2702-1604-000001000000}) (Version: 16.04.00.0 - Igor Pavlov)
Adblock Plus for IE (32-bit and 64-bit) (HKLM\...\{0F347A49-E36C-4639-8D2E-003AD408B8B2}) (Version: 1.5 - Eyeo GmbH)
Adobe Acrobat Reader DC (HKLM-x32\...\{AC76BA86-7AD7-1033-7B44-AC0F074E4100}) (Version: 17.009.20044 - Adobe Systems Incorporated)
Adobe Flash Player 25 ActiveX (HKLM-x32\...\Adobe Flash Player ActiveX) (Version: 25.0.0.171 - Adobe Systems Incorporated)
Adobe Flash Player 25 NPAPI (HKLM-x32\...\Adobe Flash Player NPAPI) (Version: 25.0.0.171 - Adobe Systems Incorporated)
Apple Application Support (32-bit) (HKLM-x32\...\{E92BB800-BCC5-4C25-8102-AC2C3B7C7C1E}) (Version: 5.5 - Apple Inc.)
Apple Application Support (64-bit) (HKLM\...\{9C912B1E-06DD-43EF-BB2B-45CB2C88BAAE}) (Version: 5.5 - Apple Inc.)
Apple Mobile Device Support (HKLM\...\{0A596141-97D5-45FA-9281-98DFAF48D579}) (Version: 10.3.2.3 - Apple Inc.)
Apple Software Update (HKLM-x32\...\{52D87F32-70E4-4348-8148-C0B9F35B1314}) (Version: 2.3.0.177 - Apple Inc.)
ATT Management Agent (HKLM-x32\...\ATT-AT&T Troubleshoot & Resolve) (Version: 8.5.0.48 - AT&T)
Bonjour (HKLM\...\{56DDDFB8-7F79-4480-89D5-25E1F52AB28F}) (Version: 3.1.0.1 - Apple Inc.)
Broadcom Bluetooth Software (HKLM\...\{A1439D4F-FD46-47F2-A1D3-FEE097C29A09}) (Version: 6.5.1.6200 - Broadcom Corporation)
CyberLink LabelPrint (HKLM-x32\...\InstallShield_{C59C179C-668D-49A9-B6EA-0121CCFC1243}) (Version: 2.5.5.6805 - CyberLink Corp.)
CyberLink Power2Go 8 (HKLM-x32\...\InstallShield_{2A87D48D-3FDF-41fd-97CD-A1E370EFFFE2}) (Version: 8.0.5.3606 - CyberLink Corp.)
DisableMSDefender (Version: 1.0.0 - Hewlett-Packard Company) Hidden
Foxit PhantomPDF (HKLM-x32\...\{4E32271C-B55A-4CDF-8DB7-88FD1C45927C}) (Version: 7.0.310.226 - Foxit Software Inc.)
Google Earth (HKLM-x32\...\{F6430171-B86B-4639-839E-374913E7911D}) (Version: 7.1.8.3036 - Google)
Google Update Helper (x32 Version: 1.3.33.5 - Google Inc.) Hidden
Hewlett-Packard ACLM.NET v1.2.2.3 (x32 Version: 1.00.0000 - Hewlett-Packard Company) Hidden
HP Desktop Keyboard (HKLM-x32\...\HP Keyboard_is1) (Version: 1.0.0.13 - Hewlett-Packard)
HP Documentation (HKLM-x32\...\{E0E6FBA2-BF5B-4B79-9066-2BB5FA41291B}) (Version: 1.4.0.0 - Hewlett-Packard)
HP FWUpdateEDO2 (HKLM-x32\...\{415FA9AD-DA10-4ABE-97B6-5051D4795C90}) (Version: 1.2.0.0 - Hewlett-Packard)
HP Officejet Pro 8610 Basic Device Software (HKLM\...\{39DA3F40-0B9E-4002-8E01-108FEC9EFE43}) (Version: 32.3.198.49673 - Hewlett-Packard Co.)
HP Officejet Pro 8610 Help (HKLM-x32\...\{F9569D00-4576-46C8-B6C7-207A4FD39745}) (Version: 32.0.0 - Hewlett Packard)
HP Setup (HKLM-x32\...\{438363A8-F486-4C37-834C-4955773CB3D3}) (Version: 9.1.15453.4066 - Hewlett-Packard Company)
HP Support Information (HKLM-x32\...\{B2B7B1C8-7C8B-476C-BE2C-049731C55992}) (Version: 13.00.0000 - Hewlett-Packard)
HP Support Solutions Framework (HKLM-x32\...\{55065080-504F-43BB-BE00-36B80D7D39A5}) (Version: 12.5.32.203 - Hewlett-Packard Company)
HP Update (HKLM-x32\...\{912D30CF-F39E-4B31-AD9A-123C6B794EE2}) (Version: 5.005.002.002 - Hewlett-Packard)
HPDiagnosticAlert (x32 Version: 1.00.0001 - Microsoft) Hidden
I.R.I.S. OCR (HKLM-x32\...\{CA6BCA2F-EDEB-408F-850B-31404BE16A61}) (Version: 12.3.4.0 - HP)
Intel® Chipset Device Software (x32 Version: 10.0.22 - Intel® Corporation) Hidden
Intel® Management Engine Components (HKLM\...\{1CEAC85D-2590-4760-800F-8DE5E91F3700}) (Version: 10.0.27.1012 - Intel Corporation)
Intel® Processor Graphics (HKLM-x32\...\{F0E3AD40-2BBD-4360-9C76-B9AC9A5886EA}) (Version: 10.18.14.4029 - Intel Corporation)
Intel® USB 3.0 eXtensible Host Controller Driver (HKLM-x32\...\{240C3DDD-C5E9-4029-9DF7-95650D040CF2}) (Version: 3.0.3.60 - Intel Corporation)
iTunes (HKLM\...\{F0C7385A-9D20-45F3-8101-05D383885180}) (Version: 12.6.1.25 - Apple Inc.)
Kaspersky Small Office Security (HKLM-x32\...\InstallWIX_{51AE1D4F-1352-40FE-A0BE-DAA166663609}) (Version: 17.0.0.611 - Kaspersky Lab)
Kaspersky Small Office Security (x32 Version: 17.0.0.611 - Kaspersky Lab) Hidden
LogMeIn (HKLM-x32\...\{C356B55B-3967-4474-9D77-30C67A4EEBAC}) (Version: 4.1.9498 - LogMeIn, Inc.)
LogMeIn Client (HKLM-x32\...\{5C9FFE5E-C461-408D-804A-C2E2C339D783}) (Version: 1.3.2857 - LogMeIn, Inc.)
Malwarebytes Anti-Exploit version 1.9.2.1413 (HKLM\...\Malwarebytes Anti-Exploit_is1) (Version: 1.9.2.1413 - Malwarebytes)
Malwarebytes Anti-Malware version 1.80.2.1012 (HKLM-x32\...\Malwarebytes' Anti-Malware_is1) (Version: 1.80.2.1012 - Malwarebytes Corporation)
Malwarebytes Anti-Ransomware version 0.9.17.689 (HKLM\...\{6CA75021-FBB0-41A5-B95C-FC1C9E0421F0}_is1) (Version: 0.9.17.689 - Malwarebytes)
Microsoft .NET Framework 4.6.1 (HKLM\...\{92FB6C44-E685-45AD-9B20-CADF4CABA132} - 1033) (Version: 4.6.01055 - Microsoft Corporation)
Microsoft Office 365 - en-us (HKLM\...\O365HomePremRetail - en-us) (Version: 16.0.7967.2161 - Microsoft Corporation)
Microsoft OneDrive (HKU\.DEFAULT\...\OneDriveSetup.exe) (Version: 17.3.6390.0509 - Microsoft Corporation)
Microsoft OneDrive (HKU\S-1-5-21-2577112198-3913129868-2286876578-1000\...\OneDriveSetup.exe) (Version: 17.3.6390.0509 - Microsoft Corporation)
Microsoft Silverlight (HKLM\...\{89F4137D-6C26-4A84-BDB8-2E5A4BB71E00}) (Version: 5.1.50906.0 - Microsoft Corporation)
Microsoft Visual C++ 2005 Redistributable (HKLM-x32\...\{710f4c1c-cc18-4c49-8cbf-51240c89a1a2}) (Version: 8.0.61001 - Microsoft Corporation)
Microsoft Visual C++ 2005 Redistributable (HKLM-x32\...\{A49F249F-0C91-497F-86DF-B2585E8E76B7}) (Version: 8.0.50727.42 - Microsoft Corporation)
Microsoft Visual C++ 2005 Redistributable (x64) (HKLM\...\{071c9b48-7c32-4621-a0ac-3f809523288f}) (Version: 8.0.56336 - Microsoft Corporation)
Microsoft Visual C++ 2005 Redistributable (x64) (HKLM\...\{ad8a2fa1-06e7-4b0d-927d-6e54b3d31028}) (Version: 8.0.61000 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.17 (HKLM\...\{8220EEFE-38CD-377E-8595-13398D740ACE}) (Version: 9.0.30729 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.6161 (HKLM\...\{5FCE6D76-F5DC-37AB-B2B8-22AB8CEDB1D4}) (Version: 9.0.30729.6161 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17 (HKLM-x32\...\{9A25302D-30C0-39D9-BD6F-21E6EC160475}) (Version: 9.0.30729 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161 (HKLM-x32\...\{9BE518E6-ECC6-35A9-88E4-87755C07200F}) (Version: 9.0.30729.6161 - Microsoft Corporation)
Microsoft Visual C++ 2010 x64 Redistributable - 10.0.40219 (HKLM\...\{1D8E6291-B0D5-35EC-8441-6616F567A0F7}) (Version: 10.0.40219 - Microsoft Corporation)
Microsoft Visual C++ 2010 x86 Redistributable - 10.0.40219 (HKLM-x32\...\{F0C3E5D1-1ADE-321E-8167-68EF0DE699A5}) (Version: 10.0.40219 - Microsoft Corporation)
Microsoft Visual C++ 2012 Redistributable (x64) - 11.0.51106 (HKLM-x32\...\{6e8f74e0-43bd-4dce-8477-6ff6828acc07}) (Version: 11.0.51106.1 - Microsoft Corporation)
Microsoft Visual C++ 2012 Redistributable (x86) - 11.0.51106 (HKLM-x32\...\{8e70e4e1-06d7-470b-9f74-a51bef21088e}) (Version: 11.0.51106.1 - Microsoft Corporation)
Microsoft Visual C++ 2013 Redistributable (x64) - 12.0.30501 (HKLM-x32\...\{050d4fc8-5d48-4b8f-8972-47c82c46020f}) (Version: 12.0.30501.0 - Microsoft Corporation)
Mozilla Firefox 53.0.3 (x86 en-US) (HKLM-x32\...\Mozilla Firefox 53.0.3 (x86 en-US)) (Version: 53.0.3 - Mozilla)
Mozilla Maintenance Service (HKLM-x32\...\MozillaMaintenanceService) (Version: 53.0.3.6347 - Mozilla)
MSXML 4.0 SP2 (KB954430) (HKLM-x32\...\{86493ADD-824D-4B8E-BD72-8C5DCDC52A71}) (Version: 4.20.9870.0 - Microsoft Corporation)
MSXML 4.0 SP2 (KB973688) (HKLM-x32\...\{F662A8E6-F4DC-41A2-901E-8C11F044BDEC}) (Version: 4.20.9876.0 - Microsoft Corporation)
Office 16 Click-to-Run Extensibility Component (x32 Version: 16.0.7967.2161 - Microsoft Corporation) Hidden
Office 16 Click-to-Run Extensibility Component 64-bit Registration (Version: 16.0.7967.2161 - Microsoft Corporation) Hidden
Office 16 Click-to-Run Licensing Component (Version: 16.0.7967.2161 - Microsoft Corporation) Hidden
Office 16 Click-to-Run Localization Component (x32 Version: 16.0.7668.2066 - Microsoft Corporation) Hidden
opensource (x32 Version: 1.0.14960.3876 - Your Company Name) Hidden
PlayReady PC Runtime amd64 (HKLM\...\{BCA9334F-B6C9-4F65-9A73-AC5A329A4D04}) (Version: 1.3.0 - Microsoft Corporation)
Product Improvement Study for HP Officejet Pro 8610 (HKLM\...\{D2064264-3162-4DB1-AFE0-167BEFBBCD9C}) (Version: 32.3.198.49673 - Hewlett-Packard Co.)
QB Plugin (HKLM-x32\...\{EABA578B-1F45-4A5A-B1D1-1C4394AE0722}) (Version: 1.5.10 - Zenwork, Inc.)
QBFC 12.0 (HKLM-x32\...\{B1BEE7DF-8F06-4089-BFBB-FE754613D07E}) (Version: 12.0.0.29 - Intuit Developer Network)
QuickBooks (x32 Version: 25.0.4014.2506 - Intuit Inc.) Hidden
QuickBooks Pro 2015 (HKLM-x32\...\{8F02EFA1-8F5E-4E47-A6B5-D99E4FE90271}) (Version: 25.0.4013.2506 - Intuit Inc.)
QuickBooks Runtime Redistributable (HKLM\...\{F2A4F809-2DE6-4D27-888B-4D2BB8DAF20E}) (Version: 1.00.0000 - Intuit Inc.)
Realtek Card Reader (HKLM-x32\...\{5BC2B5AB-80DE-4E83-B8CF-426902051D0A}) (Version: 10.0.10125.31214 - Realtek Semiconductor Corp.)
Realtek Ethernet Controller Driver (HKLM-x32\...\{8833FFB6-5B0C-4764-81AA-06DFEED9A476}) (Version: 7.97.1001.2015 - Realtek)
Realtek High Definition Audio Driver (HKLM-x32\...\{F132AF7F-7BCA-4EDE-8A7C-958108FE7DBC}) (Version: 6.0.1.7673 - Realtek Semiconductor Corp.)
Recovery Manager (x32 Version: 5.5.0.6704 - CyberLink Corp.) Hidden
Revo Uninstaller 2.0.2 (HKLM\...\{A28DBDA2-3CC7-4ADC-8BFE-66D7743C6C97}_is1) (Version: 2.0.2 - VS Revo Group, Ltd.)
Revo Uninstaller Pro 3.1.4 (HKLM\...\{67579783-0FB7-4F7B-B881-E5BE47C9DBE0}_is1) (Version: 3.1.4 - VS Revo Group, Ltd.)
Samsung Data Migration (HKLM-x32\...\{3B304604-0BF5-488E-AB95-F2F2E31206F3}) (Version: 3.0 - Samsung)
Samsung Magician (HKLM-x32\...\{29AE3F9F-7158-4ca7-B1ED-28A73ECDB215}_is1) (Version: 4.5.1 - Samsung Electronics)
Skype™ 7.0 (HKLM-x32\...\{24991BA0-F0EE-44AD-9CC8-5EC50AECF6B7}) (Version: 7.0.102 - Skype Technologies S.A.)
Speccy (HKLM\...\Speccy) (Version: 1.30 - Piriform)
SpeedFan (remove only) (HKLM-x32\...\SpeedFan) (Version: - )
VC12X64Redist (HKLM\...\{B573CC21-AE24-4BC5-9B0B-15CF29A3F982}) (Version: 1.00.0000 - Intuit Inc.)
VC12X86Redist (HKLM-x32\...\{EA9886ED-21F8-4867-A049-CE6817291EE6}) (Version: 1.00.0000 - Intuit Inc.)

==================== Custom CLSID (Whitelisted): ==========================

(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)

CustomCLSID: HKU\S-1-5-21-2577112198-3913129868-2286876578-1000_Classes\CLSID\{162C6FB5-44D3-435B-903D-E613FA093FB5}\InprocServer32 -> C:\Users\JB\AppData\Local\Microsoft\OneDrive\17.3.6390.0509_1\amd64\FileCoAuthLib64.dll ()

==================== Scheduled Tasks (Whitelisted) =============

(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)

Task: {0ABDF49B-8511-4B16-A6BD-4E433953C6DF} - System32\Tasks\Adobe Acrobat Update Task => C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe [2017-04-25] (Adobe Systems Incorporated)
Task: {0BA3516E-5A5E-4C57-96DC-340802F9F83F} - System32\Tasks\Games\UpdateCheck_S-1-5-21-2577112198-3913129868-2286876578-1000
Task: {1A78062D-D82B-4A9F-B6FE-8FE68511BB24} - System32\Tasks\Microsoft\Office\Office Automatic Updates => C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeC2RClient.exe [2017-05-04] (Microsoft Corporation)
Task: {207428A7-CDF9-4D76-B61C-C1735D7A9F5D} - System32\Tasks\GoogleUpdateTaskMachineCore => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe [2016-11-14] (Google Inc.)
Task: {2E63BAF3-CE27-4491-9981-1CF3E2E68464} - System32\Tasks\Adobe Flash Player Updater => C:\windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe [2017-05-09] (Adobe Systems Incorporated)
Task: {396E368C-688F-4466-8EDD-018BF849C28C} - System32\Tasks\Microsoft\Office\Office ClickToRun Service Monitor => C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeC2RClient.exe [2017-05-04] (Microsoft Corporation)
Task: {42E03E44-42FB-459C-8C79-7FB6067BD543} - System32\Tasks\Microsoft\Office\Office Subscription Maintenance => C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonx86\Microsoft Shared\Office16\OLicenseHeartbeat.exe [2017-05-14] (Microsoft Corporation)
Task: {43A56EDF-14F0-4C5F-BCAC-EBC7E9D9257E} - System32\Tasks\Kaspersky_Upgrade_Launcher_{278ADC42-419D-4547-A6CA-5B74BE0AD901} => C:\Program Files\Common Files\AV\Kaspersky Lab\upgrade_launcher.exe [2016-05-06] (AO Kaspersky Lab)
Task: {4DB25382-8FC2-469E-9482-89FB9DA43ED8} - System32\Tasks\HPCeeScheduleForJB => C:\Program Files (x86)\Hewlett-Packard\HP Ceement\HPCEE.exe [2015-06-16] (Hewlett-Packard)
Task: {52CEA253-EE8C-4400-9FB2-F9E1E0471A53} - System32\Tasks\HPCustParticipation HP Officejet Pro 8610 => C:\Program Files\HP\HP Officejet Pro 8610\Bin\HPCustPartic.exe [2014-07-21] (Hewlett-Packard Development Company, LP)
Task: {5603B2DB-67EA-401E-AF43-921F95386D5F} - System32\Tasks\Hewlett-Packard\HP Active Health\HP Active Health Scan (HPSA) => C:\Program Files (x86)\Hewlett-Packard\HP Support Framework\Resources\HPActiveHealth\ActiveHealth.exe
Task: {5888BB80-09B2-481A-BD00-D73681A76A5B} - System32\Tasks\CLMLSvc_P2G8 => c:\Program Files (x86)\CyberLink\Power2Go8\CLMLSvc_P2G8.exe [2013-08-05] (CyberLink)
Task: {63E66B9F-7E9D-4832-B7CA-514645DA3F6E} - System32\Tasks\{5A0B0278-ECE8-458D-B84F-105F058C4D1E} => pcalua.exe -a E:\setup.exe -d E:\
Task: {65A45F29-5A16-4C86-B20A-26BEE99EDC16} - System32\Tasks\SamsungMagician => C:\Program Files (x86)\Samsung\Samsung Magician\Samsung Magician.exe [2014-09-28] (Samsung Electronics.)
Task: {68E3BA5C-B49A-41E2-81A1-7E4B42CDAD36} - System32\Tasks\{BAD2B040-9563-4C09-93BB-E95EAA487ECE} => pcalua.exe -a "C:\Program Files (x86)\VS Revo Group\Revo Uninstaller\Revouninstaller.exe" -d "C:\Program Files (x86)\VS Revo Group\Revo Uninstaller" -c -hunter
Task: {70BBE708-4954-40DC-B51B-FE79F7D18789} - System32\Tasks\Hewlett-Packard\HP Support Assistant\WarrantyChecker => C:\Program Files (x86)\Hewlett-Packard\HP Support Framework\Resources\HPWarrantyCheck\HPWarrantyChecker.exe
Task: {777E2AD1-AC29-46B9-97EB-7ACE76276CC0} - System32\Tasks\Hewlett-Packard\HP Support Assistant\HP Support Solutions Framework Updater - Resources => C:\Program Files (x86)\Hewlett-Packard\HP Support Solutions\Modules\HPSSFUpdater.exe [2016-12-07] (HP Inc.)
Task: {8BD99351-E25F-4DDD-B6E4-A4F038D461D6} - System32\Tasks\Hewlett-Packard\HP Support Assistant\HP Support Assistant Quick Start => C:\Program Files (x86)\Hewlett-Packard\HP Support Framework\HPSF.exe
Task: {93A2505E-778B-4DBA-8E8D-FB6B1CCCB578} - System32\Tasks\CLVDLauncher => c:\Program Files (x86)\CyberLink\Power2Go8\CLVDLauncher.exe [2013-03-12] (CyberLink Corp.)
Task: {95BD48E9-EF55-4F25-8180-C0115D994479} - System32\Tasks\Hewlett-Packard\HP Support Assistant\Product Configurator => C:\Program Files (x86)\Hewlett-Packard\HP Support Framework\Resources\ProductConfig.exe
Task: {96C1C8DF-0540-4C21-8373-0DC24A986B65} - System32\Tasks\Hewlett-Packard\HP Support Assistant\HP Support Solutions Framework Updater => C:\Program Files (x86)\Hewlett-Packard\HP Support Solutions\Modules\HPSSFUpdater.exe [2016-12-07] (HP Inc.)
Task: {981F98D4-E5B9-44C0-9AA3-FBA4F83A0D89} - System32\Tasks\Apple\AppleSoftwareUpdate => C:\Program Files (x86)\Apple Software Update\SoftwareUpdate.exe [2017-02-14] (Apple Inc.)
Task: {A6CB161F-8045-44C3-A038-609778720DDB} - System32\Tasks\ScanToPCActivationApp.exe_{7EBBA508-8695-4A8B-A46A-329BC252665A} => C:\Program Files\HP\HP Officejet Pro 8610\Bin\ScanToPCActivationApp.exe [2014-07-21] (Hewlett-Packard Development Company, LP)
Task: {B1CE85D8-2B4A-41B7-AE5A-93236D5C2DF0} - System32\Tasks\GoogleUpdateTaskMachineUA => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe [2016-11-14] (Google Inc.)
Task: {BDB0F986-BCB5-46F4-8510-A010EA4A7BE1} - System32\Tasks\Hewlett-Packard\HP Support Assistant\HP Support Solutions Framework Report => C:\Program Files (x86)\Hewlett-Packard\HP Support Solutions\Modules\HPSFReport.exe [2016-05-09] (Hewlett-Packard)
Task: {C8673A6A-492C-4744-A8B9-A355C536A65A} - System32\Tasks\AVAST Software\Avast settings backup => C:\Program Files\Common Files\AV\avast! Antivirus\backup.exe [2017-01-27] (AVAST Software)
Task: {D1DB0515-E631-4D74-BFEF-A3590D5F52D0} - System32\Tasks\Hewlett-Packard\HP Support Assistant\PC Health Analysis => C:\Program Files (x86)\Hewlett-Packard\HP Support Framework\HPSF.exe

(If an entry is included in the fixlist, the task (.job) file will be moved. The file which is running by the task will not be moved.)

Task: C:\windows\Tasks\HPCeeScheduleForJB.job => C:\Program Files (x86)\Hewlett-Packard\HP Ceement\HPCEE.exe

==================== Shortcuts =============================

(The entries could be listed to be restored or removed.)

==================== Loaded Modules (Whitelisted) ==============

2017-05-09 00:44 - 2017-05-09 00:44 - 01354040 _____ () C:\Program Files\Common Files\Apple\Apple Application Support\libxml2.dll
2016-09-01 18:12 - 2016-09-01 18:12 - 00092472 _____ () C:\Program Files\Common Files\Apple\Apple Application Support\zlib1.dll
2014-06-10 23:19 - 2014-06-10 23:19 - 00622080 _____ () C:\windows\system32\spool\DRIVERS\x64\3\JobCapsA.DLL
2016-11-15 02:08 - 2016-11-15 02:08 - 00959168 _____ () C:\Users\JB\AppData\Local\Microsoft\OneDrive\17.3.6390.0509_1\amd64\ClientTelemetry.dll
2016-11-15 02:46 - 2017-05-14 05:21 - 08931008 _____ () C:\Program Files (x86)\Microsoft Office\root\VFS\ProgramFilesX64\Microsoft Office\Office16\1033\GrooveIntlResource.dll
2017-02-09 21:38 - 2016-04-14 19:38 - 00745984 _____ () C:\Program Files\Malwarebytes\Anti-Ransomware\QtQuick\Controls\qtquickcontrolsplugin.dll
2017-05-09 03:05 - 2017-05-09 03:05 - 01354040 _____ () C:\Program Files\iTunes\libxml2.dll
2017-05-09 03:05 - 2017-05-09 03:05 - 00092472 _____ () C:\Program Files\iTunes\zlib1.dll
2015-05-28 16:37 - 2009-07-02 16:58 - 00406016 _____ () C:\Program Files (x86)\Hewlett-Packard\HP Desktop Keyboard\Keystatus.exe
2016-06-28 01:19 - 2016-06-28 01:19 - 00865232 _____ () C:\Program Files (x86)\Kaspersky Lab\Kaspersky Small Office Security 17.0.0\kpcengine.2.3.dll
2015-08-14 02:22 - 2015-08-14 02:22 - 00270336 _____ () C:\Program Files (x86)\ATT\8.5.0.48\ma\node_modules\motive-osbridge\build\Release\MotiveOSBridgeNodeModule.node
2015-08-14 02:22 - 2015-08-14 02:22 - 00244736 _____ () C:\Program Files (x86)\ATT\8.5.0.48\ma\node_modules\motive-activex-wrapper\build\Release\NodeActiveXWrapper.node
2013-04-24 08:55 - 2013-04-24 08:55 - 01581056 _____ () C:\Program Files (x86)\ATT\8.5.0.48\ma\node_modules\libxmljs\build\Release\xmljs.node
2015-08-14 02:21 - 2015-08-14 02:21 - 00237056 _____ () C:\Program Files (x86)\ATT\8.5.0.48\ma\node_modules\motive-xmpps\build\Release\MotiveXMPPSNode.node
2017-04-25 12:14 - 2017-04-25 12:14 - 00630784 _____ () C:\Program Files (x86)\Intuit\QuickBooks 2015\boost_regex-vc120-mt-1_55.dll
2017-04-25 16:35 - 2017-04-25 16:35 - 00031512 _____ () C:\Program Files (x86)\Intuit\QuickBooks 2015\QBCompressor.dll
2014-12-06 20:14 - 2014-12-06 20:14 - 00059904 _____ () C:\Program Files (x86)\Intuit\QuickBooks 2015\zlib1.dll
2017-04-25 16:35 - 2017-04-25 16:35 - 00102168 _____ () C:\Program Files (x86)\Intuit\QuickBooks 2015\QBMAPILibrary.dll
2017-04-25 16:34 - 2017-04-25 16:34 - 00245528 _____ () C:\Program Files (x86)\Intuit\QuickBooks 2015\boost_serialization-vc120-mt-1_55.dll
2017-04-25 16:35 - 2017-04-25 16:35 - 00662808 _____ () C:\Program Files (x86)\Intuit\QuickBooks 2015\FtuEngine.dll
2017-04-25 16:34 - 2017-04-25 16:34 - 00689432 _____ () C:\Program Files (x86)\Intuit\QuickBooks 2015\BackupLib.dll
2017-04-25 16:36 - 2017-04-25 16:36 - 00085784 _____ () C:\Program Files (x86)\Intuit\QuickBooks 2015\QBProActiveCore.dll
2014-12-06 20:11 - 2014-12-06 20:11 - 38715904 _____ () C:\Program Files (x86)\Intuit\QuickBooks 2015\libcef.dll
2017-04-25 16:35 - 2017-04-25 16:35 - 01215768 _____ () C:\Program Files (x86)\Intuit\QuickBooks 2015\FeaturesBridge.dll
2017-04-25 16:35 - 2017-04-25 16:35 - 00067864 _____ () C:\Program Files (x86)\Intuit\QuickBooks 2015\mbpopup.dll
2016-11-15 02:08 - 2016-11-15 02:08 - 00679624 _____ () C:\Users\JB\AppData\Local\Microsoft\OneDrive\17.3.6390.0509_1\ClientTelemetry.dll
2017-05-20 19:38 - 2014-09-28 17:59 - 00019872 _____ () C:\Program Files (x86)\Samsung\Samsung Magician\SAMSUNG_SSD.dll
2015-05-28 16:38 - 2013-08-05 02:49 - 00627672 _____ () c:\Program Files (x86)\CyberLink\Power2Go8\CLMediaLibrary.dll
2013-08-05 17:48 - 2013-08-05 17:48 - 00016856 _____ () c:\Program Files (x86)\CyberLink\Power2Go8\CLMLSvcPS.dll
2014-08-13 12:54 - 2014-08-13 12:54 - 01241560 _____ () C:\Program Files (x86)\Intel\Intel® Management Engine Components\LMS\ACE.dll
2016-11-15 02:41 - 2017-05-14 05:21 - 01010368 _____ () C:\Program Files (x86)\Microsoft Office\Root\Office16\ADDINS\UmOutlookAddin.dll

==================== Alternate Data Streams (Whitelisted) =========

(If an entry is included in the fixlist, only the ADS will be removed.)

==================== Safe Mode (Whitelisted) ===================

(If an entry is included in the fixlist, it will be removed from the registry. The "AlternateShell" will be restored.)

HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\MBAMService => ""="Service"
HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\mcpltsvc => ""=""
HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\MBAMService => ""="Service"
HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\mcpltsvc => ""=""

==================== Association (Whitelisted) ===============

(If an entry is included in the fixlist, the registry item will be restored to default or removed.)

==================== Internet Explorer trusted/restricted ===============

(If an entry is included in the fixlist, it will be removed from the registry.)

==================== Hosts content: ===============================

(If needed Hosts: directive could be included in the fixlist to reset Hosts.)

2009-07-13 21:34 - 2009-06-10 16:00 - 00000824 _____ C:\windows\system32\Drivers\etc\hosts

==================== Other Areas ============================

(Currently there is no automatic fix for this section.)

HKU\S-1-5-21-2577112198-3913129868-2286876578-1000\Control Panel\Desktop\\Wallpaper -> C:\Users\JB\AppData\Roaming\Microsoft\Windows\Themes\TranscodedWallpaper.jpg
DNS Servers: 192.168.7.254
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System => (ConsentPromptBehaviorAdmin: 5) (ConsentPromptBehaviorUser: 3) (EnableLUA: 1)
Windows Firewall is enabled.

==================== MSCONFIG/TASK MANAGER disabled items ==

==================== FirewallRules (Whitelisted) ===============

(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)

FirewallRules: [SPPSVC-In-TCP] => (Allow) %SystemRoot%\system32\sppsvc.exe
FirewallRules: [SPPSVC-In-TCP-NoScope] => (Allow) %SystemRoot%\system32\sppsvc.exe
FirewallRules: [{2C988C32-00EC-4F1A-9639-6CC7CC0F1196}] => (Allow) C:\Program Files\Bonjour\mDNSResponder.exe
FirewallRules: [{7EACA4E1-C82D-4D33-8CCE-C09CCB3C9096}] => (Allow) C:\Program Files\Bonjour\mDNSResponder.exe
FirewallRules: [{28C972C6-7FE5-4E36-AC49-9C658090833E}] => (Allow) C:\Program Files (x86)\Bonjour\mDNSResponder.exe
FirewallRules: [{B6E125F7-74A1-4486-AA09-26A2662D359A}] => (Allow) C:\Program Files (x86)\Bonjour\mDNSResponder.exe
FirewallRules: [{07B06AB4-522B-4C4F-B99D-9DE5873EDB03}] => (Allow) C:\Users\JB\AppData\Local\Temp\7zS16D5\HPDiagnosticCoreUI.exe
FirewallRules: [{78A2AA77-A970-43C6-98D7-C6C6D5659933}] => (Allow) C:\Users\JB\AppData\Local\Temp\7zS16D5\HPDiagnosticCoreUI.exe
FirewallRules: [{9077B2AE-2F18-4FB7-B757-AE122B015C53}] => (Allow) C:\Users\JB\AppData\Local\Temp\7zS18B2\HPDiagnosticCoreUI.exe
FirewallRules: [{88571F9F-D999-4DEA-B108-F9DF772450A7}] => (Allow) C:\Users\JB\AppData\Local\Temp\7zS18B2\HPDiagnosticCoreUI.exe
FirewallRules: [{1EBE8CAC-1668-492A-A813-28BE308F18DE}] => (Allow) C:\Program Files (x86)\Skype\Phone\Skype.exe
FirewallRules: [{D1A4495C-9B7C-4F59-BEF5-CF6CD90ED7C0}] => (Allow) C:\Program Files (x86)\Mozilla Firefox\firefox.exe
FirewallRules: [{5398916D-4F4E-4F74-B33B-711227F5C364}] => (Allow) C:\Program Files (x86)\Mozilla Firefox\firefox.exe
FirewallRules: [{F4B94CE2-A930-42A5-BD2B-140F04F736A0}] => (Allow) C:\Program Files (x86)\Mozilla Firefox\firefox.exe
FirewallRules: [{B6CD4BCB-5184-47C8-9B8E-8FD1EBF25EAA}] => (Allow) C:\Program Files (x86)\Mozilla Firefox\firefox.exe
FirewallRules: [{7A27F99D-B365-4AF9-A185-58ED93305AC1}] => (Allow) C:\Users\JB\AppData\Local\Temp\7zS2790\HPDiagnosticCoreUI.exe
FirewallRules: [{9E94AFF2-4632-42D9-8000-DCCE635A8EE7}] => (Allow) C:\Users\JB\AppData\Local\Temp\7zS2790\HPDiagnosticCoreUI.exe
FirewallRules: [{BC856DA0-34DF-48E9-9334-EDF9B9ED8258}] => (Allow) C:\Users\JB\AppData\Local\Temp\7zS27D8\HPDiagnosticCoreUI.exe
FirewallRules: [{A1038E70-2382-419D-9D8D-87CF1A1806A0}] => (Allow) C:\Users\JB\AppData\Local\Temp\7zS27D8\HPDiagnosticCoreUI.exe
FirewallRules: [{44A3F013-F920-4448-86CE-41B358FC2138}] => (Allow) C:\Users\JB\AppData\Local\Temp\7zS27A4\HPDiagnosticCoreUI.exe
FirewallRules: [{BADF1A0F-BBDF-4F91-895F-184DC93E6A3A}] => (Allow) C:\Users\JB\AppData\Local\Temp\7zS27A4\HPDiagnosticCoreUI.exe
FirewallRules: [{92652BF0-8A8A-49C6-A477-E349AD1C697F}] => (Allow) C:\Users\JB\AppData\Local\Temp\7zS2977\HPDiagnosticCoreUI.exe
FirewallRules: [{541920F7-9E3C-4240-93A5-2E9EB4EB3DDF}] => (Allow) C:\Users\JB\AppData\Local\Temp\7zS2977\HPDiagnosticCoreUI.exe
FirewallRules: [{5E9D6667-1689-46CE-9570-7CA0B0DE6A06}] => (Allow) C:\Program Files\Bonjour\mDNSResponder.exe
FirewallRules: [{4AB5FD05-8EE6-47FB-A477-B1089FD15124}] => (Allow) C:\Program Files\Bonjour\mDNSResponder.exe
FirewallRules: [{399A9869-E2CE-4176-8AA9-7A39B9055442}] => (Allow) C:\Program Files (x86)\Bonjour\mDNSResponder.exe
FirewallRules: [{B1543180-C933-4FFD-BF8E-9A33EB13AE14}] => (Allow) C:\Program Files (x86)\Bonjour\mDNSResponder.exe
FirewallRules: [{88D60679-EACF-4B70-882A-330A9B3BB57A}] => (Allow) C:\Users\JB\AppData\Local\Temp\7zS3DD2\HPDiagnosticCoreUI.exe
FirewallRules: [{633FA523-67CC-4FA3-B869-D090138C3265}] => (Allow) C:\Users\JB\AppData\Local\Temp\7zS3DD2\HPDiagnosticCoreUI.exe
FirewallRules: [{405C44A0-E411-46C2-AAFC-CC1F60B57B9B}] => (Allow) C:\Users\JB\AppData\Local\Temp\7zS3DFC\HPDiagnosticCoreUI.exe
FirewallRules: [{832B3613-2108-46B5-921B-1036F32016C6}] => (Allow) C:\Users\JB\AppData\Local\Temp\7zS3DFC\HPDiagnosticCoreUI.exe
FirewallRules: [{9DB2E288-D457-4FB1-B9B0-1354E8C6D2BA}] => (Allow) C:\Users\JB\AppData\Local\Temp\7zS2E35\HPDiagnosticCoreUI.exe
FirewallRules: [{D357794E-00DA-4B04-BE5F-AF1981ECB3B7}] => (Allow) C:\Users\JB\AppData\Local\Temp\7zS2E35\HPDiagnosticCoreUI.exe
FirewallRules: [{DEBC548D-0847-48F6-8034-07A8BE5D0D9A}] => (Allow) C:\Program Files\HP\HP Officejet Pro 8610\bin\FaxApplications.exe
FirewallRules: [{6508F4F0-D267-43DB-B409-D70A11FA192B}] => (Allow) C:\Program Files\HP\HP Officejet Pro 8610\bin\DigitalWizards.exe
FirewallRules: [{6A197DB2-B423-46AE-9740-4514C5C63093}] => (Allow) C:\Program Files\HP\HP Officejet Pro 8610\bin\SendAFax.exe
FirewallRules: [{35583826-B351-47E1-98C0-A7CCB22139F0}] => (Allow) C:\Program Files\HP\HP Officejet Pro 8610\Bin\DeviceSetup.exe
FirewallRules: [{0639805A-65B3-4BDE-A5D0-EBE181BF0870}] => (Allow) LPort=5357
FirewallRules: [{B6718541-226D-4DEB-9B7F-65FA76EA8326}] => (Allow) C:\Program Files\HP\HP Officejet Pro 8610\Bin\HPNetworkCommunicatorCom.exe
FirewallRules: [{0FBA7B3E-430D-4D27-90DF-DD0D9FCAD5A7}] => (Allow) C:\Program Files\7-Zip\7zFM.exe
FirewallRules: [{4935DE51-04F7-4CF0-8B72-3F7081212DD1}] => (Allow) C:\Program Files\7-Zip\7zFM.exe
FirewallRules: [{4E32449E-5E61-4FD8-B686-F071C71C6305}] => (Allow) C:\Program Files\7-Zip\7zFM.exe
FirewallRules: [{86BF4AC3-5991-43C5-AA34-9B2257CB50CA}] => (Allow) C:\Program Files\7-Zip\7zFM.exe
FirewallRules: [{2C310989-659B-4DC4-8DB3-5D6A49419C6F}] => (Allow) LPort=1935
FirewallRules: [{74EB24B3-A2A4-4FFB-9E20-09A8F78D6FBA}] => (Allow) C:\Program Files (x86)\Microsoft Office\root\Office16\outlook.exe
FirewallRules: [{203B6147-41C1-4DBC-A046-D2DEACE2A022}] => (Allow) C:\Program Files\iTunes\iTunes.exe

==================== Restore Points =========================

==================== Faulty Device Manager Devices =============

Name: Network Controller
Description: Network Controller
Class Guid:
Manufacturer:
Service:
Problem: : The drivers for this device are not installed. (Code 28)
Resolution: To install the drivers for this device, click "Update Driver", which starts the Hardware Update wizard.

==================== Event log errors: =========================

Application errors:
==================
Error: (05/23/2017 02:09:45 PM) (Source: System Restore) (EventID: 8193) (User: )
Description: Failed to create restore point (Process = C:\windows\system32\svchost.exe -k netsvcs; Description = Windows Update; Error = 0x80070422).

Error: (05/23/2017 02:09:18 PM) (Source: Application Hang) (EventID: 1002) (User: )
Description: The program iexplore.exe version 11.0.9600.18666 stopped interacting with Windows and was closed. To see if more information about the problem is available, check the problem history in the Action Center control panel.

Process ID: 3b0

Start Time: 01d2d3f7e87cd317

Termination Time: 13

Application Path: C:\Program Files\Internet Explorer\iexplore.exe

Report Id:

Error: (05/23/2017 02:07:48 PM) (Source: Application Hang) (EventID: 1002) (User: )
Description: The program iexplore.exe version 11.0.9600.18666 stopped interacting with Windows and was closed. To see if more information about the problem is available, check the problem history in the Action Center control panel.

Process ID: 1aac

Start Time: 01d2d3ef55504911

Termination Time: 8

Application Path: C:\Program Files\Internet Explorer\iexplore.exe

Report Id:

Error: (05/23/2017 01:55:39 PM) (Source: Application Error) (EventID: 1000) (User: )
Description: Faulting application name: AdblockPlusEngine.exe, version: 1.5.0.0, time stamp: 0x56017eff
Faulting module name: ntdll.dll, version: 6.1.7601.23796, time stamp: 0x590296ce
Exception code: 0xc0000374
Fault offset: 0x00000000000bf3e2
Faulting process id: 0xccc
Faulting application start time: 0x01d2d3ef561d2679
Faulting application path: C:\Program Files\Adblock Plus for IE\AdblockPlusEngine.exe
Faulting module path: C:\windows\SYSTEM32\ntdll.dll
Report Id: 69233b97-3fe9-11e7-bdd8-d85de2936b3c

Error: (05/23/2017 01:21:55 PM) (Source: Windows Search Service) (EventID: 3083) (User: )
Description: The protocol handler OneIndex16 cannot be loaded. Error description: (HRESULT : 0x800700c1).

Error: (05/23/2017 11:33:50 AM) (Source: System Restore) (EventID: 8193) (User: )
Description: Failed to create restore point (Process = C:\windows\system32\svchost.exe -k netsvcs; Description = Windows Update; Error = 0x80070422).

Error: (05/22/2017 04:13:05 PM) (Source: Application Error) (EventID: 1000) (User: )
Description: Faulting application name: AdblockPlusEngine.exe, version: 1.5.0.0, time stamp: 0x56017eff
Faulting module name: ntdll.dll, version: 6.1.7601.23796, time stamp: 0x590296ce
Exception code: 0xc0000374
Fault offset: 0x00000000000bf3e2
Faulting process id: 0x1ee4
Faulting application start time: 0x01d2d339b82da5a6
Faulting application path: C:\Program Files\Adblock Plus for IE\AdblockPlusEngine.exe
Faulting module path: C:\windows\SYSTEM32\ntdll.dll
Report Id: 71bae80b-3f33-11e7-bdd8-d85de2936b3c

Error: (05/22/2017 03:18:28 PM) (Source: QuickBooks) (EventID: 4) (User: )
Description: An unexpected error has occured in "QuickBooks Pro 2015":
****** WEBMAIL FAILURE ****** : Error code : 6

Error: (05/22/2017 03:18:18 PM) (Source: QuickBooks) (EventID: 4) (User: )
Description: An unexpected error has occured in "QuickBooks Pro 2015":
Host Start failed

Error: (05/22/2017 03:18:18 PM) (Source: QuickBooks) (EventID: 4) (User: )
Description: An unexpected error has occured in "QuickBooks Pro 2015":
Runtime not yet initialized

System errors:
=============
Error: (05/21/2017 07:17:14 PM) (Source: Service Control Manager) (EventID: 7034) (User: )
Description: The Adobe Acrobat Update Service service terminated unexpectedly. It has done this 1 time(s).

Error: (05/21/2017 06:47:15 PM) (Source: Schannel) (EventID: 4119) (User: NT AUTHORITY)
Description: The following fatal alert was received: 20.

Error: (05/21/2017 05:48:29 PM) (Source: Service Control Manager) (EventID: 7034) (User: )
Description: The Adobe Acrobat Update Service service terminated unexpectedly. It has done this 1 time(s).

Error: (05/20/2017 09:02:11 PM) (Source: EventLog) (EventID: 6008) (User: )
Description: The previous system shutdown at 8:59:13 PM on ‎5/‎20/‎2017 was unexpected.

Error: (05/20/2017 08:52:26 PM) (Source: Service Control Manager) (EventID: 7031) (User: )
Description: The Windows Search service terminated unexpectedly. It has done this 1 time(s). The following corrective action will be taken in 30000 milliseconds: Restart the service.

Error: (05/20/2017 08:52:26 PM) (Source: Service Control Manager) (EventID: 7024) (User: )
Description: The Windows Search service terminated with service-specific error %%-1073473535.

Error: (05/20/2017 08:48:54 PM) (Source: Microsoft-Windows-Directory-Services-SAM) (EventID: 12291) (User: NT AUTHORITY)
Description: SAM failed to start the TCP/IP or SPX/IPX listening thread

Error: (05/20/2017 08:48:44 PM) (Source: EventLog) (EventID: 6008) (User: )
Description: The previous system shutdown at 7:42:12 PM on ‎5/‎20/‎2017 was unexpected.

Error: (05/20/2017 04:57:52 PM) (Source: EventLog) (EventID: 6008) (User: )
Description: The previous system shutdown at 4:17:48 PM on ‎5/‎20/‎2017 was unexpected.

Error: (05/19/2017 03:17:05 PM) (Source: Schannel) (EventID: 4119) (User: NT AUTHORITY)
Description: The following fatal alert was received: 20.

==================== Memory info ===========================

Processor: Intel® Core™ i3-4170 CPU @ 3.70GHz
Percentage of memory in use: 15%
Total physical RAM: 16288.05 MB
Available physical RAM: 13825.63 MB
Total Virtual: 32574.29 MB
Available Virtual: 28783.8 MB

==================== Drives ================================

Drive c: (OS) (Fixed) (Total:476.71 GB) (Free:299.96 GB) NTFS ==>[system with boot components (obtained from drive)]

==================== MBR & Partition Table ==================

========================================================
Disk: 0 (Size: 476.9 GB) (Disk ID: 509A7961)

Partition: GPT.

==================== End of Addition.txt ============================

#2
zep516

Posted 24 May 2017 - 02:42 PM

Trusted Helper

Malware Removal
8,093 posts

Hi! My name is zep516 and Welcome to Geekstogo!
I'll do the best I can to resolve your computer issue
Please make sure to carefully read any instruction that I give you. If you're not sure, or if something unexpected happens, don't continue Stop and ask! Never be afraid to ask questions!

Not seeing much just some left overs.

NOTICE: This script was written specifically for this user, for use on that particular machine. Running this on another machine may cause damage to your operating system

Open notepad (Start =>All Programs => Accessories => Notepad).
Copy/Paste the contents of the code box below into Notepad.

start
CloseProcesses:
CreateRestorePoint:
HKLM-x32\...\Run: [] => [X]
ShellIconOverlayIdentifiers: [00avast] -> {472083B0-C522-11CF-8763-00608CC02F24} =>  -> No File
GroupPolicyScripts: Restriction <======= ATTENTION
SearchScopes: HKLM -> {C7F7AD88-4278-45CA-B849-F7365ABA9E62} URL = hxxp://www.amazon.com/s/ref=azs_osd_iea?ie=UTF-8&tag=hp-us1-vsb-20&link%5Fcode=qs&index=aps&field-keywords={searchTerms}
SearchScopes: HKLM-x32 -> {C7F7AD88-4278-45CA-B849-F7365ABA9E62} URL = hxxp://www.amazon.com/s/ref=azs_osd_iea?ie=UTF-8&tag=hp-us1-vsb-20&link%5Fcode=qs&index=aps&field-keywords={searchTerms}
Toolbar: HKU\S-1-5-21-2577112198-3913129868-2286876578-1000 -> No Name - {001032CB-B0AC-4F2C-A650-AD4B2B26E5DA} -  No File
U0 aswVmm; no ImagePath
S3 BCM42RLY; system32\drivers\BCM42RLY.sys [X]
S3 BCM43XX; system32\DRIVERS\bcmwl664.sys [X]
S3 MREMPR5; \??\C:\PROGRA~1\COMMON~1\Motive\MREMPR5.SYS [X]
S3 MRENDIS5; \??\C:\PROGRA~1\COMMON~1\Motive\MRENDIS5.SYS [X]
S3 RSUSBSTOR; \SystemRoot\System32\Drivers\RtsUStor.sys [X]
CMD: bitsadmin /reset /allusers
CMD: ipconfig /flushdns
hosts:
Emptytemp:

Click Format and ensure Wordwrap is unchecked.
Save as Fixlist.txt to your Desktop (Must be in this location)
Run FRST/FRST64 and press the Fix button just once and wait.
If the tool needed a restart please make sure you let the system to restart normally and let the tool completes its run after restart.
The tool will make a log on the Desktop (Fixlog.txt). Please post it to your reply.

Note: If the tool warns you about the version you're using being an outdated version please download and run the updated version.

#3
shorthaul99

Posted 24 May 2017 - 04:18 PM

Member

Topic Starter
Member
133 posts

Ran everything exactly as requested and the tool updated before I ran the fix list and it locked up on the "creating a system restore point" for 45 mins. The machine was non responsive so I finally had to kill the power with the power button. To my surprise, this log was generated when the desktop returned.

Fix result of Farbar Recovery Scan Tool (x64) Version: 24-05-2017
Ran by JB (24-05-2017 16:20:55) Run:11
Running from C:\Users\JB\Desktop
Loaded Profiles: JB (Available Profiles: JB)
Boot Mode: Normal
==============================================

fixlist content:
*****************
start
CloseProcesses:
CreateRestorePoint:
HKLM-x32\...\Run: [] => [X]
ShellIconOverlayIdentifiers: [00avast] -> {472083B0-C522-11CF-8763-00608CC02F24} => -> No File
GroupPolicyScripts: Restriction <======= ATTENTION
SearchScopes: HKLM -> {C7F7AD88-4278-45CA-B849-F7365ABA9E62} URL = hxxp://www.amazon.com/s/ref=azs_osd_iea?ie=UTF-8&tag=hp-us1-vsb-20&link%5Fcode=qs&index=aps&field-keywords={searchTerms}
SearchScopes: HKLM-x32 -> {C7F7AD88-4278-45CA-B849-F7365ABA9E62} URL = hxxp://www.amazon.com/s/ref=azs_osd_iea?ie=UTF-8&tag=hp-us1-vsb-20&link%5Fcode=qs&index=aps&field-keywords={searchTerms}
Toolbar: HKU\S-1-5-21-2577112198-3913129868-2286876578-1000 -> No Name - {001032CB-B0AC-4F2C-A650-AD4B2B26E5DA} - No File
U0 aswVmm; no ImagePath
S3 BCM42RLY; system32\drivers\BCM42RLY.sys [X]
S3 BCM43XX; system32\DRIVERS\bcmwl664.sys [X]
S3 MREMPR5; \??\C:\PROGRA~1\COMMON~1\Motive\MREMPR5.SYS [X]
S3 MRENDIS5; \??\C:\PROGRA~1\COMMON~1\Motive\MRENDIS5.SYS [X]
S3 RSUSBSTOR; \SystemRoot\System32\Drivers\RtsUStor.sys [X]
CMD: bitsadmin /reset /allusers
CMD: ipconfig /flushdns
hosts:
Emptytemp:
*****************

Processes closed successfully.

#4
zep516

Posted 24 May 2017 - 04:20 PM

Trusted Helper

Malware Removal
8,093 posts

Hello,

Are you still getting the pop ups ? If so what browser ?

#5
shorthaul99

Posted 24 May 2017 - 04:55 PM

Member

Topic Starter
Member
133 posts

No sir I am not getting any more popups and the browser was on IE.

#6
zep516

Posted 24 May 2017 - 04:59 PM

Trusted Helper

Malware Removal
8,093 posts

Hello,

The pop ups were generated from the website and nothing was installed on your computer.

Your logs are clean.

Some users do end up calling the number and that's when problems start.

This is called a Tech support pop up scam.

#7
shorthaul99

Posted 24 May 2017 - 05:17 PM

Member

Topic Starter
Member
133 posts

Thank you kind sir for jumping on this so quickly! Have a great day and a safe Memorial Day Weekend!

#8
zep516

Posted 24 May 2017 - 05:21 PM

Trusted Helper

Malware Removal
8,093 posts

Thank you very much !

You can remove the program FRST and any log files on the desktop now. Right click and delete.

We will close this ticket now.

Since this issue appears to be resolved ... this Topic has been closed. Glad we could help.

If you're the topic starter, and need this topic reopened, please contact a staff member with the address of the thread.

Everyone else please begin a New Topic.

Thanks
Joe

#9
zep516

Posted 24 May 2017 - 07:38 PM

Trusted Helper

Malware Removal
8,093 posts

Topic re-opened per user request.

#10
shorthaul99

Posted 25 May 2017 - 12:49 PM

Member

Topic Starter
Member
133 posts

Same thing as before. Pop up and threats to call number. I can go back and restore session on IE but I can't get back to the search box of what I was searching for a number that was calling me and spamming saying that they were with AT&T Fiber and offering us better service plan etc. The interesting thing is MBAM, KAS and MBAM Expolit never popped up as attempting to block these websites when this happened...

Here is FRST new log:

Scan result of Farbar Recovery Scan Tool (FRST) (x64) Version: 24-05-2017
Ran by JB (administrator) on JB-HP (25-05-2017 13:44:03)
Running from C:\Users\JB\Desktop
Loaded Profiles: JB (Available Profiles: JB)
Platform: Windows 7 Professional Service Pack 1 (X64) Language: English (United States)
Internet Explorer Version 11 (Default browser: FF)
Boot Mode: Normal
Tutorial for Farbar Recovery Scan Tool: http://www.geekstogo...very-scan-tool/

==================== Processes (Whitelisted) =================

(If an entry is included in the fixlist, the process will be closed. The file will not be moved.)

(Intel Corporation) C:\Windows\System32\igfxCUIService.exe
(Realtek Semiconductor) C:\Program Files\Realtek\Audio\HDA\RtkAudioService64.exe
(Apple Inc.) C:\Program Files\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe
(Alcatel-Lucent) C:\Program Files (x86)\ATT\8.5.0.48\ma\bin\MAHostService.exe
(AO Kaspersky Lab) C:\Program Files (x86)\Kaspersky Lab\Kaspersky Small Office Security 17.0.0\avp.exe
(Joyent, Inc) C:\Program Files (x86)\ATT\8.5.0.48\ma\bin\node.exe
(Apple Inc.) C:\Program Files\Bonjour\mDNSResponder.exe
(Broadcom Corporation.) C:\Program Files\WIDCOMM\Bluetooth Software\btwdins.exe
(Microsoft Corporation) C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe
(LogMeIn, Inc.) C:\Program Files (x86)\LogMeIn\x64\LMIGuardianSvc.exe
(Malwarebytes) C:\Program Files\Malwarebytes\Anti-Ransomware\MB3Service.exe
(Malwarebytes Corporation) C:\Program Files (x86)\Malwarebytes Anti-Exploit\mbae-svc.exe
(Malwarebytes Corporation) C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamscheduler.exe
(Malwarebytes Corporation) C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamservice.exe
(Malwarebytes Corporation) C:\Program Files (x86)\Malwarebytes Anti-Exploit\mbae64.exe
(Alcatel-Lucent) C:\Program Files (x86)\Common Files\Motive\pcCMService.exe
(Alcatel-Lucent) C:\Program Files\Common Files\Motive\pcCMService.exe
(Intuit) C:\Program Files (x86)\Common Files\Intuit\QuickBooks\QBCFMonitorService.exe
(Intuit Inc.) C:\Program Files (x86)\Common Files\Intuit\DataProtect\QBIDPService.exe
(Microsoft Corporation) C:\Windows\Microsoft.NET\Framework64\v3.0\WPF\PresentationFontCache.exe
(Apple Inc.) C:\Program Files\iPod\bin\iPodService.exe
(HP Inc.) C:\Program Files (x86)\Hewlett-Packard\HP Support Solutions\HPSupportSolutionsFrameworkService.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Intel® Management Engine Components\DAL\jhi_service.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Intel® Management Engine Components\LMS\LMS.exe
(Malwarebytes Corporation) C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamgui.exe
(Intel Corporation) C:\Windows\System32\igfxEM.exe
(Intel Corporation) C:\Windows\System32\igfxHK.exe
(Realtek Semiconductor) C:\Program Files\Realtek\Audio\HDA\RtkNGUI64.exe
(Alcatel-Lucent) C:\Program Files\ATT\8.5.0.48\ma\bin\pcTrayApp.exe
(Malwarebytes) C:\Program Files\Malwarebytes\Anti-Ransomware\mbarw.exe
(LogMeIn, Inc.) C:\Program Files (x86)\LogMeIn\x64\LogMeInSystray.exe
(Apple Inc.) C:\Program Files\iTunes\iTunesHelper.exe
(Hewlett-Packard Development Company, LP) C:\Program Files\HP\HP Officejet Pro 8610\Bin\ScanToPCActivationApp.exe
(Alcatel-Lucent) C:\Program Files (x86)\Common Files\Motive\pcContextHookShim.exe
(Broadcom Corporation.) C:\Program Files\WIDCOMM\Bluetooth Software\BTTray.exe
(Intuit Inc.) C:\Program Files (x86)\Common Files\Intuit\QuickBooks\QBUpdate\qbupdate.exe
(Intuit Inc.) C:\Program Files (x86)\Intuit\QuickBooks 2015\QBW32.EXE
(Hewlett-Packard Development Company, LP) C:\Program Files\HP\HP Officejet Pro 8610\Bin\HPNetworkCommunicatorCom.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Intel® USB 3.0 eXtensible Host Controller Driver\Application\iusb3mon.exe
(Hewlett-Packard) C:\Program Files (x86)\Hewlett-Packard\HP Desktop Keyboard\HPKEYBOARDx.EXE
(Malwarebytes Corporation) C:\Program Files (x86)\Malwarebytes Anti-Exploit\mbae.exe
(AO Kaspersky Lab) C:\Program Files (x86)\Kaspersky Lab\Kaspersky Small Office Security 17.0.0\avpui.exe
() C:\Program Files (x86)\Hewlett-Packard\HP Desktop Keyboard\Keystatus.exe
(Realtek Semiconductor) C:\Program Files\Realtek\Audio\HDA\RAVBg64.exe
(Microsoft Corporation) C:\Windows\SysWOW64\rundll32.exe
(Broadcom Corporation.) C:\Program Files\WIDCOMM\Bluetooth Software\BTStackServer.exe
(Samsung Electronics.) C:\Program Files (x86)\Samsung\Samsung Magician\Samsung Magician.exe
(CyberLink) C:\Program Files (x86)\CyberLink\Power2Go8\CLMLSvc_P2G8.exe
(Mozilla Corporation) C:\Program Files (x86)\Mozilla Firefox\firefox.exe
(Adobe Systems, Inc.) C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerPlugin_25_0_0_171.exe
(Adobe Systems, Inc.) C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerPlugin_25_0_0_171.exe

==================== Registry (Whitelisted) ====================

(If an entry is included in the fixlist, the registry item will be restored to default or removed. The file will not be moved.)

HKLM\...\Run: [RTHDVCPL] => C:\Program Files\Realtek\Audio\HDA\RtkNGUI64.exe [8781568 2015-11-26] (Realtek Semiconductor)
HKLM\...\Run: [ATT_McciTrayApp] => C:\Program Files\ATT\8.5.0.48\ma\bin\pcTrayApp.exe [2943488 2015-10-20] (Alcatel-Lucent)
HKLM\...\Run: [Logitech Download Assistant] => C:\Windows\system32\rundll32.exe C:\Windows\System32\LogiLDA.dll,LogiFetch
HKLM\...\Run: [Malwarebytes Anti-Ransomware] => C:\Program Files\Malwarebytes\Anti-Ransomware\mbarw.exe [723920 2016-09-09] (Malwarebytes)
HKLM\...\Run: [LogMeIn GUI] => C:\Program Files (x86)\LogMeIn\x64\LogMeInSystray.exe [423424 2016-12-27] (LogMeIn, Inc.)
HKLM\...\Run: [iTunesHelper] => C:\Program Files\iTunes\iTunesHelper.exe [303928 2017-05-09] (Apple Inc.)
HKLM-x32\...\Run: [USB3MON] => C:\Program Files (x86)\Intel\Intel® USB 3.0 eXtensible Host Controller Driver\Application\iusb3mon.exe [296208 2016-10-15] (Intel Corporation)
HKLM-x32\...\Run: [HP KEYBOARDx] => C:\Program Files (x86)\Hewlett-Packard\HP Desktop Keyboard\HPKEYBOARDx.EXE [710656 2010-02-11] (Hewlett-Packard)
HKLM-x32\...\Run: [Intuit SyncManager] => C:\Program Files (x86)\Common Files\Intuit\Sync\IntuitSyncManager.exe [3776824 2015-03-17] (Intuit Inc. All rights reserved.)
HKLM-x32\...\Run: [] => [X]
HKLM-x32\...\Run: [Malwarebytes Anti-Exploit] => C:\Program Files (x86)\Malwarebytes Anti-Exploit\mbae.exe [2645960 2017-05-15] (Malwarebytes Corporation)
HKU\S-1-5-21-2577112198-3913129868-2286876578-1000\...\Run: [HP Officejet Pro 8610 (NET)] => C:\Program Files\HP\HP Officejet Pro 8610\Bin\ScanToPCActivationApp.exe [3487240 2014-07-21] (Hewlett-Packard Development Company, LP)
HKU\S-1-5-21-2577112198-3913129868-2286876578-1000\...\MountPoints2: {6a451861-7f4b-11e5-a2cb-806e6f6e6963} - "E:\Install Navigator.exe"
HKU\S-1-5-21-2577112198-3913129868-2286876578-1000\Control Panel\Desktop\\SCRNSAVE.EXE -> C:\windows\system32\Bubbles.scr [899584 2010-11-20] (Microsoft Corporation)
Lsa: [Notification Packages] scecli C:\Program Files\WIDCOMM\Bluetooth Software\BtwProximityCP.dll
ShellIconOverlayIdentifiers: [00avast] -> {472083B0-C522-11CF-8763-00608CC02F24} => -> No File
Startup: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\Bluetooth.lnk [2015-05-28]
ShortcutTarget: Bluetooth.lnk -> C:\Program Files\WIDCOMM\Bluetooth Software\BTTray.exe (Broadcom Corporation.)
Startup: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\Intuit Data Protect.lnk [2015-11-02]
ShortcutTarget: Intuit Data Protect.lnk -> C:\Program Files (x86)\Common Files\Intuit\DataProtect\IntuitDataProtect.exe (Intuit Inc.)
Startup: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\QuickBooks Update Agent.lnk [2015-11-02]
ShortcutTarget: QuickBooks Update Agent.lnk -> C:\Program Files (x86)\Common Files\Intuit\QuickBooks\QBUpdate\qbupdate.exe (Intuit Inc.)
Startup: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\QuickBooks_Standard_21.lnk [2015-11-02]
ShortcutTarget: QuickBooks_Standard_21.lnk -> C:\Program Files (x86)\Intuit\QuickBooks 2015\QBW32.EXE (Intuit Inc.)
GroupPolicyScripts: Restriction <======= ATTENTION

==================== Internet (Whitelisted) ====================

(If an item is included in the fixlist, if it is a registry item it will be removed or restored to default.)

Tcpip\Parameters: [DhcpNameServer] 192.168.7.254
Tcpip\..\Interfaces\{5A134DD5-9609-460B-876D-D6D240D948BF}: [DhcpNameServer] 172.20.10.1
Tcpip\..\Interfaces\{D2D4F5EB-AB89-4FFB-ADEA-8610198B42F4}: [DhcpNameServer] 192.168.7.254

Internet Explorer:
==================
HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://hp13.msn.com
HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = hxxp://hp13.msn.com
HKU\.DEFAULT\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://hp13.msn.com
HKU\.DEFAULT\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = hxxp://hp13.msn.com
HKU\S-1-5-21-2577112198-3913129868-2286876578-1000\Software\Microsoft\Internet Explorer\Main,Start Page = hxxps://www.google.com/
SearchScopes: HKLM -> {C7F7AD88-4278-45CA-B849-F7365ABA9E62} URL = hxxp://www.amazon.com/s/ref=azs_osd_iea?ie=UTF-8&tag=hp-us1-vsb-20&link%5Fcode=qs&index=aps&field-keywords={searchTerms}
SearchScopes: HKLM-x32 -> {C7F7AD88-4278-45CA-B849-F7365ABA9E62} URL = hxxp://www.amazon.com/s/ref=azs_osd_iea?ie=UTF-8&tag=hp-us1-vsb-20&link%5Fcode=qs&index=aps&field-keywords={searchTerms}
BHO: Kaspersky Protection -> {2E38825B-8815-42CF-9126-C58BC28D4591} -> C:\Program Files (x86)\Kaspersky Lab\Kaspersky Small Office Security 17.0.0\x64\IEExt\ie_plugin.dll [2017-01-25] (AO Kaspersky Lab)
BHO: Lync Browser Helper -> {31D09BA0-12F5-4CCE-BE8A-2923E76605DA} -> C:\Program Files (x86)\Microsoft Office\root\VFS\ProgramFilesX64\Microsoft Office\Office16\OCHelper.dll [2017-05-14] (Microsoft Corporation)
BHO: avast! Online Security -> {8E5E2654-AD2D-48bf-AC2D-D17F00898D06} -> C:\Program Files\AVAST Software\Avast\aswWebRepIE64.dll => No File
BHO: Office Document Cache Handler -> {B4F3A835-0E21-4959-BA22-42B3008E02FF} -> C:\Program Files (x86)\Microsoft Office\root\VFS\ProgramFilesX64\Microsoft Office\Office16\URLREDIR.DLL [2017-05-14] (Microsoft Corporation)
BHO: Microsoft OneDrive for Business Browser Helper -> {D0498E0A-45B7-42AE-A9AA-ABA463DBD3BF} -> C:\Program Files (x86)\Microsoft Office\root\VFS\ProgramFilesX64\Microsoft Office\Office16\GROOVEEX.DLL [2017-05-14] (Microsoft Corporation)
BHO: HP Network Check Helper -> {E76FD755-C1BA-4DCB-9F13-99BD91223ADE} -> C:\Program Files (x86)\Hewlett-Packard\HP Support Framework\Resources\HPNetworkCheck\HPNetworkCheckPluginx64.dll => No File
BHO: Adblock Plus for IE Browser Helper Object -> {FFCB3198-32F3-4E8B-9539-4324694ED664} -> C:\Program Files\Adblock Plus for IE\AdblockPlus64.dll [2015-09-22] (Eyeo GmbH)
BHO-x32: Kaspersky Protection -> {2E38825B-8815-42CF-9126-C58BC28D4591} -> C:\Program Files (x86)\Kaspersky Lab\Kaspersky Small Office Security 17.0.0\IEExt\ie_plugin.dll [2017-01-25] (AO Kaspersky Lab)
BHO-x32: Office Document Cache Handler -> {B4F3A835-0E21-4959-BA22-42B3008E02FF} -> C:\Program Files (x86)\Microsoft Office\root\Office16\URLREDIR.DLL [2017-05-14] (Microsoft Corporation)
BHO-x32: Adblock Plus for IE Browser Helper Object -> {FFCB3198-32F3-4E8B-9539-4324694ED664} -> C:\Program Files\Adblock Plus for IE\AdblockPlus32.dll [2015-09-22] (Eyeo GmbH)
Toolbar: HKLM - Kaspersky Protection Toolbar - {093F479D-712E-46CD-9E06-62E734A05F68} - C:\Program Files (x86)\Kaspersky Lab\Kaspersky Small Office Security 17.0.0\x64\IEExt\ie_plugin.dll [2017-01-25] (AO Kaspersky Lab)
Toolbar: HKLM-x32 - Kaspersky Protection Toolbar - {093F479D-712E-46CD-9E06-62E734A05F68} - C:\Program Files (x86)\Kaspersky Lab\Kaspersky Small Office Security 17.0.0\IEExt\ie_plugin.dll [2017-01-25] (AO Kaspersky Lab)
Toolbar: HKU\S-1-5-21-2577112198-3913129868-2286876578-1000 -> No Name - {001032CB-B0AC-4F2C-A650-AD4B2B26E5DA} - No File
Toolbar: HKU\S-1-5-21-2577112198-3913129868-2286876578-1000 -> Kaspersky Protection Toolbar - {093F479D-712E-46CD-9E06-62E734A05F68} - C:\Program Files (x86)\Kaspersky Lab\Kaspersky Small Office Security 17.0.0\x64\IEExt\ie_plugin.dll [2017-01-25] (AO Kaspersky Lab)
Handler-x32: intu-help-qb8 - {CD17C364-2EC8-4929-91A9-C4839A20E909} - C:\Program Files (x86)\Intuit\QuickBooks 2015\HelpAsyncPluggableProtocol.dll [2017-04-25] (Intuit, Inc.)
Handler-x32: mso-minsb-roaming.16 - {83C25742-A9F7-49FB-9138-434302C88D07} - C:\Program Files (x86)\Microsoft Office\root\Office16\MSOSB.DLL [2017-05-14] (Microsoft Corporation)
Handler-x32: mso-minsb.16 - {42089D2D-912D-4018-9087-2B87803E93FB} - C:\Program Files (x86)\Microsoft Office\root\Office16\MSOSB.DLL [2017-05-14] (Microsoft Corporation)
Handler-x32: osf-roaming.16 - {42089D2D-912D-4018-9087-2B87803E93FB} - C:\Program Files (x86)\Microsoft Office\root\Office16\MSOSB.DLL [2017-05-14] (Microsoft Corporation)
Handler-x32: osf.16 - {5504BE45-A83B-4808-900A-3A5C36E7F77A} - C:\Program Files (x86)\Microsoft Office\root\Office16\MSOSB.DLL [2017-05-14] (Microsoft Corporation)
Handler-x32: qbwc - {FC598A64-626C-4447-85B8-53150405FD57} - C:\windows\system32\mscoree.dll [2010-11-20] (Microsoft Corporation)

FireFox:
========
FF ProfilePath: C:\Users\JB\AppData\Roaming\Mozilla\Firefox\Profiles\k39yo3t4.default [2017-05-25]
FF DefaultSearchEngine.US: Mozilla\Firefox\Profiles\k39yo3t4.default -> Google
FF Homepage: Mozilla\Firefox\Profiles\k39yo3t4.default -> hxxps://www.google.com/
FF Extension: (AT&T Extension) - C:\Program Files (x86)\Mozilla Firefox\browser\extensions\[email protected] [2015-11-06] [not signed]
FF HKLM\...\Firefox\Extensions: [[email protected]] - C:\Program Files (x86)\Kaspersky Lab\Kaspersky Small Office Security 17.0.0\FFExt\light_plugin_firefox\addon.xpi
FF Extension: (Kaspersky Protection) - C:\Program Files (x86)\Kaspersky Lab\Kaspersky Small Office Security 17.0.0\FFExt\light_plugin_firefox\addon.xpi [2017-01-25]
FF HKLM-x32\...\Firefox\Extensions: [[email protected]] - C:\Program Files (x86)\Kaspersky Lab\Kaspersky Small Office Security 17.0.0\FFExt\light_plugin_firefox\addon.xpi
FF Plugin: @adobe.com/FlashPlayer -> C:\windows\system32\Macromed\Flash\NPSWF64_25_0_0_171.dll [2017-05-09] ()
FF Plugin: @microsoft.com/GENUINE -> disabled [No File]
FF Plugin: @Microsoft.com/NpCtrl,version=1.0 -> c:\Program Files\Microsoft Silverlight\5.1.50906.0\npctrl.dll [2017-03-09] ( Microsoft Corporation)
FF Plugin-x32: @adobe.com/FlashPlayer -> C:\windows\SysWOW64\Macromed\Flash\NPSWF32_25_0_0_171.dll [2017-05-09] ()
FF Plugin-x32: @foxitsoftware.com/Foxit PhantomPDF Plugin,version=1.0,application/pdf -> C:\Program Files (x86)\Foxit PhantomPDF\plugins\npFoxitPhantomPDFPlugin.dll [2014-10-20] (Foxit Corporation)
FF Plugin-x32: @foxitsoftware.com/Foxit PhantomPDF Plugin,version=1.0,application/vnd.fdf -> C:\Program Files (x86)\Foxit PhantomPDF\plugins\npFoxitPhantomPDFPlugin.dll [2014-10-20] (Foxit Corporation)
FF Plugin-x32: @foxitsoftware.com/Foxit PhantomPDF Plugin,version=1.0,application/vnd.xdp -> C:\Program Files (x86)\Foxit PhantomPDF\plugins\npFoxitPhantomPDFPlugin.dll [2014-10-20] (Foxit Corporation)
FF Plugin-x32: @foxitsoftware.com/Foxit PhantomPDF Plugin,version=1.0,application/vnd.xfdf -> C:\Program Files (x86)\Foxit PhantomPDF\plugins\npFoxitPhantomPDFPlugin.dll [2014-10-20] (Foxit Corporation)
FF Plugin-x32: @intel-webapi.intel.com/Intel WebAPI ipt;version=4.0.56 -> C:\Program Files (x86)\Intel\Intel® Management Engine Components\IPT\npIntelWebAPIIPT.dll [2014-08-13] (Intel Corporation)
FF Plugin-x32: @intel-webapi.intel.com/Intel WebAPI updater -> C:\Program Files (x86)\Intel\Intel® Management Engine Components\IPT\npIntelWebAPIUpdater.dll [2014-08-13] (Intel Corporation)
FF Plugin-x32: @microsoft.com/GENUINE -> disabled [No File]
FF Plugin-x32: @Microsoft.com/NpCtrl,version=1.0 -> c:\Program Files (x86)\Microsoft Silverlight\5.1.50906.0\npctrl.dll [2017-03-09] ( Microsoft Corporation)
FF Plugin-x32: @microsoft.com/SharePoint,version=14.0 -> C:\Program Files (x86)\Microsoft Office\root\Office16\NPSPWRAP.DLL [2017-03-05] (Microsoft Corporation)
FF Plugin-x32: @Motive.com/NpMotive,version=1.1 -> C:\Program Files (x86)\ATT\8.5.0.48\ma\bin\npMotive.dll [2015-10-20] (AT&T)
FF Plugin-x32: @tools.google.com/Google Update;version=3 -> C:\Program Files (x86)\Google\Update\1.3.33.5\npGoogleUpdate3.dll [2017-04-27] (Google Inc.)
FF Plugin-x32: @tools.google.com/Google Update;version=9 -> C:\Program Files (x86)\Google\Update\1.3.33.5\npGoogleUpdate3.dll [2017-04-27] (Google Inc.)
FF Plugin-x32: Adobe Reader -> C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AIR\nppdf32.dll [2017-04-04] (Adobe Systems Inc.)

Chrome:
=======
CHR HKLM\...\Chrome\Extension: [fhoibnponjcgjgcnfacekaijdbbplhib] - hxxps://chrome.google.com/webstore/detail/fhoibnponjcgjgcnfacekaijdbbplhib
CHR HKLM-x32\...\Chrome\Extension: [fhoibnponjcgjgcnfacekaijdbbplhib] - hxxps://chrome.google.com/webstore/detail/fhoibnponjcgjgcnfacekaijdbbplhib

==================== Services (Whitelisted) ====================

(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)

R2 Apple Mobile Device Service; C:\Program Files\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe [83768 2017-04-03] (Apple Inc.)
R2 AT&T Troubleshoot & Resolve; C:\Program Files (x86)\ATT\8.5.0.48\ma\bin\MAHostService.exe [321024 2015-10-20] (Alcatel-Lucent) [File not signed]
R2 AVP17.0.0; C:\Program Files (x86)\Kaspersky Lab\Kaspersky Small Office Security 17.0.0\avp.exe [241544 2016-06-28] (AO Kaspersky Lab)
R2 ClickToRunSvc; C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe [3801280 2017-05-04] (Microsoft Corporation)
R2 HPSupportSolutionsFrameworkService; C:\Program Files (x86)\Hewlett-Packard\HP Support Solutions\HPSupportSolutionsFrameworkService.exe [31776 2016-12-07] (HP Inc.)
R2 igfxCUIService1.0.0.0; C:\windows\system32\igfxCUIService.exe [328296 2015-01-28] (Intel Corporation)
S3 Intel® Capability Licensing Service TCP IP Interface; C:\Program Files\Intel\iCLS Client\SocketHeciServer.exe [887256 2014-05-13] (Intel® Corporation)
R2 jhi_service; C:\Program Files (x86)\Intel\Intel® Management Engine Components\DAL\jhi_service.exe [154584 2014-08-13] (Intel Corporation)
S3 klvssbrigde64; C:\Program Files (x86)\Kaspersky Lab\Kaspersky Small Office Security 17.0.0\x64\vssbridge64.exe [77328 2016-06-28] (AO Kaspersky Lab)
R2 LMIGuardianSvc; C:\Program Files (x86)\LogMeIn\x64\LMIGuardianSvc.exe [419304 2017-05-17] (LogMeIn, Inc.)
S4 LMIMaint; C:\Program Files (x86)\LogMeIn\x64\RaMaint.exe [583144 2017-05-17] (LogMeIn, Inc.)
S4 LogMeIn; C:\Program Files (x86)\LogMeIn\x64\LogMeIn.exe [407424 2015-06-15] (LogMeIn, Inc.)
R2 MB3Service; C:\Program Files\Malwarebytes\Anti-Ransomware\MB3Service.exe [3291088 2016-09-09] (Malwarebytes)
R2 MbaeSvc; C:\Program Files (x86)\Malwarebytes Anti-Exploit\mbae-svc.exe [155080 2017-05-15] (Malwarebytes Corporation)
R2 MBAMScheduler; C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamscheduler.exe [452576 2016-02-09] (Malwarebytes Corporation)
R2 MBAMService; C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamservice.exe [901088 2016-02-09] (Malwarebytes Corporation)
R2 pcCMService; C:\Program Files (x86)\Common Files\Motive\pcCMService.exe [370176 2015-08-13] (Alcatel-Lucent) [File not signed]
R2 pcCMService64; C:\Program Files\Common Files\Motive\pcCMService.exe [462336 2015-08-13] (Alcatel-Lucent) [File not signed]
R2 QBCFMonitorService; C:\Program Files (x86)\Common Files\Intuit\QuickBooks\QBCFMonitorService.exe [45056 2017-04-25] (Intuit) [File not signed]
S3 QBFCService; C:\Program Files (x86)\Common Files\Intuit\QuickBooks\FCS\Intuit.QuickBooks.FCS.exe [65536 2014-12-06] (Intuit Inc.) [File not signed]
R2 QBVSS; C:\Program Files (x86)\Common Files\Intuit\DataProtect\QBIDPService.exe [1248256 2014-12-06] (Intuit Inc.) [File not signed]
R2 RtkAudioService; C:\Program Files\Realtek\Audio\HDA\RtkAudioService64.exe [307456 2015-11-26] (Realtek Semiconductor)
R2 WinDefend; C:\Program Files\Windows Defender\mpsvc.dll [1011712 2013-12-03] (Microsoft Corporation)

===================== Drivers (Whitelisted) ======================

(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)

R3 bcbtums; C:\windows\System32\drivers\bcbtums.sys [172760 2015-05-28] (Broadcom Corporation.)
R1 CLVirtualDrive; C:\windows\System32\DRIVERS\CLVirtualDrive.sys [91912 2013-11-12] (CyberLink)
R0 cm_km; C:\windows\System32\DRIVERS\cm_km.sys [238936 2016-06-10] (AO Kaspersky Lab)
R1 ESProtectionDriver; C:\Program Files (x86)\Malwarebytes Anti-Exploit\mbae64.sys [77408 2017-05-15] ()
R0 iaStorF; C:\windows\System32\drivers\iaStorF.sys [30360 2015-03-14] (Intel Corporation)
R0 kl1; C:\windows\System32\DRIVERS\kl1.sys [554416 2016-06-02] (AO Kaspersky Lab)
R0 klbackupdisk; C:\windows\System32\DRIVERS\klbackupdisk.sys [63920 2016-06-08] (AO Kaspersky Lab)
R1 klbackupflt; C:\windows\System32\DRIVERS\klbackupflt.sys [86352 2016-06-15] (AO Kaspersky Lab)
R2 kldisk; C:\windows\System32\DRIVERS\kldisk.sys [78216 2016-06-01] (AO Kaspersky Lab)
R3 klflt; C:\windows\System32\DRIVERS\klflt.sys [195296 2017-04-10] (AO Kaspersky Lab)
R1 klhk; C:\windows\System32\DRIVERS\klhk.sys [314864 2017-04-10] (AO Kaspersky Lab)
R1 KLIF; C:\windows\System32\DRIVERS\klif.sys [1035480 2017-04-10] (AO Kaspersky Lab)
R1 KLIM6; C:\windows\System32\DRIVERS\klim6.sys [57936 2017-01-25] (AO Kaspersky Lab)
R3 klkbdflt; C:\windows\System32\DRIVERS\klkbdflt.sys [52144 2016-05-19] (AO Kaspersky Lab)
R3 klmouflt; C:\windows\System32\DRIVERS\klmouflt.sys [41648 2015-06-07] (Kaspersky Lab ZAO)
R1 klpd; C:\windows\System32\DRIVERS\klpd.sys [45488 2016-06-01] (AO Kaspersky Lab)
R1 kltdi; C:\windows\System32\DRIVERS\kltdi.sys [75696 2016-05-18] (AO Kaspersky Lab)
R1 Klwtp; C:\windows\System32\DRIVERS\klwtp.sys [135904 2017-03-13] (AO Kaspersky Lab)
R1 kneps; C:\windows\System32\DRIVERS\kneps.sys [199392 2017-03-13] (AO Kaspersky Lab)
R2 LMIInfo; C:\windows\system32\drivers\LMIInfo.sys [30432 2017-01-11] (LogMeIn, Inc.)
S4 LMIRfsClientNP; no ImagePath
R0 MB3SwissArmy; C:\windows\System32\drivers\MB3SwissArmy.sys [228800 2017-05-24] (Malwarebytes)
R3 MBAMFarflt; C:\windows\system32\drivers\farflt.sys [113592 2017-05-24] (Malwarebytes)
R3 MBAMProtector; C:\windows\system32\drivers\mbam.sys [27008 2016-02-09] (Malwarebytes Corporation)
R3 MEIx64; C:\windows\system32\drivers\TeeDriverx64.sys [125952 2014-08-13] (Intel Corporation)
S3 MREMP50; C:\Program Files (x86)\Common Files\Motive\MREMP50.sys [21248 2010-02-02] (Printing Communications Assoc., Inc. (PCAUSA)) [File not signed]
S3 MREMP50a64; C:\Program Files\Common Files\Motive\MREMP50a64.SYS [43008 2010-02-02] (Printing Communications Assoc., Inc. (PCAUSA))
S3 MRESP50; C:\Program Files (x86)\Common Files\Motive\MRESP50.sys [20096 2010-02-02] (Printing Communications Assoc., Inc. (PCAUSA)) [File not signed]
S3 MRESP50a64; C:\Program Files\Common Files\Motive\MRESP50a64.SYS [40960 2010-02-02] (Printing Communications Assoc., Inc. (PCAUSA))
R3 RTSUER; C:\windows\System32\Drivers\RtsUer.sys [402136 2016-10-15] (Realsil Semiconductor Corporation)
S3 WirelessKeyboardFilter; C:\windows\System32\DRIVERS\WirelessKeyboardFilter.sys [49896 2016-07-22] (Microsoft Corporation)
U0 aswVmm; no ImagePath
S3 BCM42RLY; system32\drivers\BCM42RLY.sys [X]
S3 BCM43XX; system32\DRIVERS\bcmwl664.sys [X]
S3 MREMPR5; \??\C:\PROGRA~1\COMMON~1\Motive\MREMPR5.SYS [X]
S3 MRENDIS5; \??\C:\PROGRA~1\COMMON~1\Motive\MRENDIS5.SYS [X]
S3 RSUSBSTOR; \SystemRoot\System32\Drivers\RtsUStor.sys [X]

==================== NetSvcs (Whitelisted) ===================

(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)

==================== One Month Created files and folders ========

(If an entry is included in the fixlist, the file/folder will be moved.)

2017-05-25 13:44 - 2017-05-25 13:44 - 00024321 _____ C:\Users\JB\Desktop\FRST.txt
2017-05-25 13:41 - 2017-05-25 13:41 - 02429952 _____ (Farbar) C:\Users\JB\Desktop\FRST64.exe
2017-05-21 17:52 - 2017-05-21 17:52 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Samsung
2017-05-21 17:51 - 2017-05-24 17:43 - 00000000 ____D C:\Temp
2017-05-21 16:41 - 2017-05-21 16:41 - 01820860 _____ C:\Users\JB\Downloads\WD Backup Manual.pdf
2017-05-20 19:42 - 2017-05-20 19:42 - 00000023 _____ C:\windows\script.txt
2017-05-20 19:41 - 2017-05-21 17:52 - 00001862 _____ C:\Users\Public\Desktop\Data Migration.lnk
2017-05-20 19:38 - 2017-05-21 17:52 - 00000000 ____D C:\Program Files (x86)\Samsung
2017-05-20 19:38 - 2017-05-20 19:38 - 00003262 _____ C:\windows\System32\Tasks\SamsungMagician
2017-05-20 19:38 - 2017-05-20 19:38 - 00001191 _____ C:\Users\Public\Desktop\Samsung Magician.lnk
2017-05-20 19:38 - 2017-05-20 19:38 - 00000000 ____D C:\ProgramData\Samsung
2017-05-20 19:38 - 2017-05-20 19:38 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Samsung Magician
2017-05-20 17:37 - 2017-05-20 17:37 - 00000000 ___DC C:\Users\JB\AppData\Local\MigWiz
2017-05-19 14:19 - 2017-05-20 17:56 - 00000000 ____D C:\Program Files (x86)\Mozilla Firefox
2017-05-16 14:34 - 2017-05-16 14:34 - 00156136 _____ C:\Users\JB\Documents\Rock Steady Waiver.pdf
2017-05-16 14:02 - 2017-04-27 17:50 - 03550208 _____ (Microsoft Corporation) C:\windows\SysWOW64\D3DCompiler_47.dll
2017-05-16 14:02 - 2017-04-17 10:37 - 03165184 _____ (Microsoft Corporation) C:\windows\system32\wucltux.dll
2017-05-16 14:02 - 2017-04-17 10:37 - 00192512 _____ (Microsoft Corporation) C:\windows\system32\wuwebv.dll
2017-05-16 14:02 - 2017-04-17 10:37 - 00098816 _____ (Microsoft Corporation) C:\windows\system32\wudriver.dll
2017-05-16 14:02 - 2017-04-17 10:35 - 00091136 _____ (Microsoft Corporation) C:\windows\system32\WinSetupUI.dll
2017-05-16 14:02 - 2017-04-17 10:23 - 02651136 _____ (Microsoft Corporation) C:\windows\system32\wuaueng.dll
2017-05-16 14:02 - 2017-04-17 10:22 - 00709120 _____ (Microsoft Corporation) C:\windows\system32\wuapi.dll
2017-05-16 14:02 - 2017-04-17 10:21 - 00140288 _____ (Microsoft Corporation) C:\windows\system32\wuauclt.exe
2017-05-16 14:02 - 2017-04-17 10:21 - 00037888 _____ (Microsoft Corporation) C:\windows\system32\wups2.dll
2017-05-16 14:02 - 2017-04-17 10:21 - 00037888 _____ (Microsoft Corporation) C:\windows\system32\wuapp.exe
2017-05-16 14:02 - 2017-04-17 10:21 - 00036864 _____ (Microsoft Corporation) C:\windows\system32\wups.dll
2017-05-16 14:02 - 2017-04-17 10:21 - 00012288 _____ (Microsoft Corporation) C:\windows\system32\wu.upgrade.ps.dll
2017-05-16 14:02 - 2017-04-17 10:12 - 00174080 _____ (Microsoft Corporation) C:\windows\SysWOW64\wuwebv.dll
2017-05-16 14:02 - 2017-04-17 10:01 - 00573440 _____ (Microsoft Corporation) C:\windows\SysWOW64\wuapi.dll
2017-05-16 14:02 - 2017-04-17 10:01 - 00093696 _____ (Microsoft Corporation) C:\windows\SysWOW64\wudriver.dll
2017-05-16 14:02 - 2017-04-17 10:01 - 00035328 _____ (Microsoft Corporation) C:\windows\SysWOW64\wuapp.exe
2017-05-16 14:02 - 2017-04-17 10:01 - 00030208 _____ (Microsoft Corporation) C:\windows\SysWOW64\wups.dll
2017-05-16 14:02 - 2017-04-12 08:05 - 04296704 _____ (Microsoft Corporation) C:\windows\system32\D3DCompiler_47.dll
2017-05-16 13:38 - 2017-05-16 13:38 - 00001755 _____ C:\Users\Public\Desktop\iTunes.lnk
2017-05-16 13:38 - 2017-05-16 13:38 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\iTunes
2017-05-16 13:36 - 2017-05-16 13:38 - 00000000 ____D C:\Program Files\iTunes
2017-05-16 13:36 - 2017-05-16 13:36 - 00000000 ____D C:\Program Files\iPod
2017-05-10 19:23 - 2017-05-17 20:05 - 00000000 ____D C:\Users\JB\AppData\Local\LogMeInIgnition
2017-05-10 04:51 - 2017-04-27 20:14 - 05547240 _____ (Microsoft Corporation) C:\windows\system32\ntoskrnl.exe
2017-05-10 04:51 - 2017-04-27 20:14 - 00706792 _____ (Microsoft Corporation) C:\windows\system32\winload.efi
2017-05-10 04:51 - 2017-04-27 20:14 - 00631176 _____ (Microsoft Corporation) C:\windows\system32\winresume.efi
2017-05-10 04:51 - 2017-04-27 20:14 - 00154856 _____ (Microsoft Corporation) C:\windows\system32\Drivers\ksecpkg.sys
2017-05-10 04:51 - 2017-04-27 20:14 - 00095464 _____ (Microsoft Corporation) C:\windows\system32\Drivers\ksecdd.sys
2017-05-10 04:51 - 2017-04-27 20:11 - 01732864 _____ (Microsoft Corporation) C:\windows\system32\ntdll.dll
2017-05-10 04:51 - 2017-04-27 20:10 - 01460736 _____ (Microsoft Corporation) C:\windows\system32\lsasrv.dll
2017-05-10 04:51 - 2017-04-27 20:10 - 01212928 _____ (Microsoft Corporation) C:\windows\system32\rpcrt4.dll
2017-05-10 04:51 - 2017-04-27 20:10 - 01163264 _____ (Microsoft Corporation) C:\windows\system32\kernel32.dll
2017-05-10 04:51 - 2017-04-27 20:10 - 00730624 _____ (Microsoft Corporation) C:\windows\system32\kerberos.dll
2017-05-10 04:51 - 2017-04-27 20:10 - 00503808 _____ (Microsoft Corporation) C:\windows\system32\srcore.dll
2017-05-10 04:51 - 2017-04-27 20:10 - 00419840 _____ (Microsoft Corporation) C:\windows\system32\KernelBase.dll
2017-05-10 04:51 - 2017-04-27 20:10 - 00362496 _____ (Microsoft Corporation) C:\windows\system32\wow64win.dll
2017-05-10 04:51 - 2017-04-27 20:10 - 00345600 _____ (Microsoft Corporation) C:\windows\system32\schannel.dll
2017-05-10 04:51 - 2017-04-27 20:10 - 00316928 _____ (Microsoft Corporation) C:\windows\system32\msv1_0.dll
2017-05-10 04:51 - 2017-04-27 20:10 - 00312320 _____ (Microsoft Corporation) C:\windows\system32\ncrypt.dll
2017-05-10 04:51 - 2017-04-27 20:10 - 00243712 _____ (Microsoft Corporation) C:\windows\system32\wow64.dll
2017-05-10 04:51 - 2017-04-27 20:10 - 00215552 _____ (Microsoft Corporation) C:\windows\system32\winsrv.dll
2017-05-10 04:51 - 2017-04-27 20:10 - 00210432 _____ (Microsoft Corporation) C:\windows\system32\wdigest.dll
2017-05-10 04:51 - 2017-04-27 20:10 - 00190464 _____ (Microsoft Corporation) C:\windows\system32\rpchttp.dll
2017-05-10 04:51 - 2017-04-27 20:10 - 00135680 _____ (Microsoft Corporation) C:\windows\system32\sspicli.dll
2017-05-10 04:51 - 2017-04-27 20:10 - 00086528 _____ (Microsoft Corporation) C:\windows\system32\TSpkg.dll
2017-05-10 04:51 - 2017-04-27 20:10 - 00063488 _____ (Microsoft Corporation) C:\windows\system32\setbcdlocale.dll
2017-05-10 04:51 - 2017-04-27 20:10 - 00050176 _____ (Microsoft Corporation) C:\windows\system32\srclient.dll
2017-05-10 04:51 - 2017-04-27 20:10 - 00028672 _____ (Microsoft Corporation) C:\windows\system32\sspisrv.dll
2017-05-10 04:51 - 2017-04-27 20:10 - 00028160 _____ (Microsoft Corporation) C:\windows\system32\secur32.dll
2017-05-10 04:51 - 2017-04-27 20:10 - 00016384 _____ (Microsoft Corporation) C:\windows\system32\ntvdm64.dll
2017-05-10 04:51 - 2017-04-27 20:10 - 00013312 _____ (Microsoft Corporation) C:\windows\system32\wow64cpu.dll
2017-05-10 04:51 - 2017-04-27 20:09 - 00880640 _____ (Microsoft Corporation) C:\windows\system32\advapi32.dll
2017-05-10 04:51 - 2017-04-27 20:09 - 00463872 _____ (Microsoft Corporation) C:\windows\system32\certcli.dll
2017-05-10 04:51 - 2017-04-27 20:09 - 00123904 _____ (Microsoft Corporation) C:\windows\system32\bcrypt.dll
2017-05-10 04:51 - 2017-04-27 20:09 - 00059904 _____ (Microsoft Corporation) C:\windows\system32\appidapi.dll
2017-05-10 04:51 - 2017-04-27 20:09 - 00044032 _____ (Microsoft Corporation) C:\windows\system32\csrsrv.dll
2017-05-10 04:51 - 2017-04-27 20:09 - 00043520 _____ (Microsoft Corporation) C:\windows\system32\cryptbase.dll
2017-05-10 04:51 - 2017-04-27 20:09 - 00034816 _____ (Microsoft Corporation) C:\windows\system32\appidsvc.dll
2017-05-10 04:51 - 2017-04-27 20:09 - 00022016 _____ (Microsoft Corporation) C:\windows\system32\credssp.dll
2017-05-10 04:51 - 2017-04-27 20:09 - 00006656 _____ (Microsoft Corporation) C:\windows\system32\apisetschema.dll
2017-05-10 04:51 - 2017-04-27 20:09 - 00006144 ____H (Microsoft Corporation) C:\windows\system32\api-ms-win-security-base-l1-1-0.dll
2017-05-10 04:51 - 2017-04-27 20:09 - 00005120 ____H (Microsoft Corporation) C:\windows\system32\api-ms-win-core-file-l1-1-0.dll
2017-05-10 04:51 - 2017-04-27 20:09 - 00004608 ____H (Microsoft Corporation) C:\windows\system32\api-ms-win-core-threadpool-l1-1-0.dll
2017-05-10 04:51 - 2017-04-27 20:09 - 00004608 ____H (Microsoft Corporation) C:\windows\system32\api-ms-win-core-processthreads-l1-1-0.dll
2017-05-10 04:51 - 2017-04-27 20:09 - 00004096 ____H (Microsoft Corporation) C:\windows\system32\api-ms-win-core-sysinfo-l1-1-0.dll
2017-05-10 04:51 - 2017-04-27 20:09 - 00004096 ____H (Microsoft Corporation) C:\windows\system32\api-ms-win-core-synch-l1-1-0.dll
2017-05-10 04:51 - 2017-04-27 20:09 - 00004096 ____H (Microsoft Corporation) C:\windows\system32\api-ms-win-core-localregistry-l1-1-0.dll
2017-05-10 04:51 - 2017-04-27 20:09 - 00004096 ____H (Microsoft Corporation) C:\windows\system32\api-ms-win-core-localization-l1-1-0.dll
2017-05-10 04:51 - 2017-04-27 20:09 - 00003584 ____H (Microsoft Corporation) C:\windows\system32\api-ms-win-core-rtlsupport-l1-1-0.dll
2017-05-10 04:51 - 2017-04-27 20:09 - 00003584 ____H (Microsoft Corporation) C:\windows\system32\api-ms-win-core-processenvironment-l1-1-0.dll
2017-05-10 04:51 - 2017-04-27 20:09 - 00003584 ____H (Microsoft Corporation) C:\windows\system32\api-ms-win-core-namedpipe-l1-1-0.dll
2017-05-10 04:51 - 2017-04-27 20:09 - 00003584 ____H (Microsoft Corporation) C:\windows\system32\api-ms-win-core-misc-l1-1-0.dll
2017-05-10 04:51 - 2017-04-27 20:09 - 00003584 ____H (Microsoft Corporation) C:\windows\system32\api-ms-win-core-memory-l1-1-0.dll
2017-05-10 04:51 - 2017-04-27 20:09 - 00003584 ____H (Microsoft Corporation) C:\windows\system32\api-ms-win-core-libraryloader-l1-1-0.dll
2017-05-10 04:51 - 2017-04-27 20:09 - 00003584 ____H (Microsoft Corporation) C:\windows\system32\api-ms-win-core-heap-l1-1-0.dll
2017-05-10 04:51 - 2017-04-27 20:09 - 00003072 ____H (Microsoft Corporation) C:\windows\system32\api-ms-win-core-xstate-l1-1-0.dll
2017-05-10 04:51 - 2017-04-27 20:09 - 00003072 ____H (Microsoft Corporation) C:\windows\system32\api-ms-win-core-util-l1-1-0.dll
2017-05-10 04:51 - 2017-04-27 20:09 - 00003072 ____H (Microsoft Corporation) C:\windows\system32\api-ms-win-core-string-l1-1-0.dll
2017-05-10 04:51 - 2017-04-27 20:09 - 00003072 ____H (Microsoft Corporation) C:\windows\system32\api-ms-win-core-profile-l1-1-0.dll
2017-05-10 04:51 - 2017-04-27 20:09 - 00003072 ____H (Microsoft Corporation) C:\windows\system32\api-ms-win-core-io-l1-1-0.dll
2017-05-10 04:51 - 2017-04-27 20:09 - 00003072 ____H (Microsoft Corporation) C:\windows\system32\api-ms-win-core-interlocked-l1-1-0.dll
2017-05-10 04:51 - 2017-04-27 20:09 - 00003072 ____H (Microsoft Corporation) C:\windows\system32\api-ms-win-core-handle-l1-1-0.dll
2017-05-10 04:51 - 2017-04-27 20:09 - 00003072 ____H (Microsoft Corporation) C:\windows\system32\api-ms-win-core-fibers-l1-1-0.dll
2017-05-10 04:51 - 2017-04-27 20:09 - 00003072 ____H (Microsoft Corporation) C:\windows\system32\api-ms-win-core-errorhandling-l1-1-0.dll
2017-05-10 04:51 - 2017-04-27 20:09 - 00003072 ____H (Microsoft Corporation) C:\windows\system32\api-ms-win-core-delayload-l1-1-0.dll
2017-05-10 04:51 - 2017-04-27 20:09 - 00003072 ____H (Microsoft Corporation) C:\windows\system32\api-ms-win-core-debug-l1-1-0.dll
2017-05-10 04:51 - 2017-04-27 20:09 - 00003072 ____H (Microsoft Corporation) C:\windows\system32\api-ms-win-core-datetime-l1-1-0.dll
2017-05-10 04:51 - 2017-04-27 20:09 - 00003072 ____H (Microsoft Corporation) C:\windows\system32\api-ms-win-core-console-l1-1-0.dll
2017-05-10 04:51 - 2017-04-27 19:36 - 04000488 _____ (Microsoft Corporation) C:\windows\SysWOW64\ntkrnlpa.exe
2017-05-10 04:51 - 2017-04-27 19:36 - 03945192 _____ (Microsoft Corporation) C:\windows\SysWOW64\ntoskrnl.exe
2017-05-10 04:51 - 2017-04-27 19:34 - 01314112 _____ (Microsoft Corporation) C:\windows\SysWOW64\ntdll.dll
2017-05-10 04:51 - 2017-04-27 19:32 - 01114112 _____ (Microsoft Corporation) C:\windows\SysWOW64\kernel32.dll
2017-05-10 04:51 - 2017-04-27 19:32 - 00666112 _____ (Microsoft Corporation) C:\windows\SysWOW64\rpcrt4.dll
2017-05-10 04:51 - 2017-04-27 19:32 - 00644096 _____ (Microsoft Corporation) C:\windows\SysWOW64\advapi32.dll
2017-05-10 04:51 - 2017-04-27 19:32 - 00553472 _____ (Microsoft Corporation) C:\windows\SysWOW64\kerberos.dll
2017-05-10 04:51 - 2017-04-27 19:32 - 00342528 _____ (Microsoft Corporation) C:\windows\SysWOW64\certcli.dll
2017-05-10 04:51 - 2017-04-27 19:32 - 00275456 _____ (Microsoft Corporation) C:\windows\SysWOW64\KernelBase.dll
2017-05-10 04:51 - 2017-04-27 19:32 - 00261120 _____ (Microsoft Corporation) C:\windows\SysWOW64\msv1_0.dll
2017-05-10 04:51 - 2017-04-27 19:32 - 00254464 _____ (Microsoft Corporation) C:\windows\SysWOW64\schannel.dll
2017-05-10 04:51 - 2017-04-27 19:32 - 00223232 _____ (Microsoft Corporation) C:\windows\SysWOW64\ncrypt.dll
2017-05-10 04:51 - 2017-04-27 19:32 - 00172032 _____ (Microsoft Corporation) C:\windows\SysWOW64\wdigest.dll
2017-05-10 04:51 - 2017-04-27 19:32 - 00141312 _____ (Microsoft Corporation) C:\windows\SysWOW64\rpchttp.dll
2017-05-10 04:51 - 2017-04-27 19:32 - 00096768 _____ (Microsoft Corporation) C:\windows\SysWOW64\sspicli.dll
2017-05-10 04:51 - 2017-04-27 19:32 - 00082944 _____ (Microsoft Corporation) C:\windows\SysWOW64\bcrypt.dll
2017-05-10 04:51 - 2017-04-27 19:32 - 00065536 _____ (Microsoft Corporation) C:\windows\SysWOW64\TSpkg.dll
2017-05-10 04:51 - 2017-04-27 19:32 - 00050688 _____ (Microsoft Corporation) C:\windows\SysWOW64\appidapi.dll
2017-05-10 04:51 - 2017-04-27 19:32 - 00043008 _____ (Microsoft Corporation) C:\windows\SysWOW64\srclient.dll
2017-05-10 04:51 - 2017-04-27 19:32 - 00022016 _____ (Microsoft Corporation) C:\windows\SysWOW64\secur32.dll
2017-05-10 04:51 - 2017-04-27 19:32 - 00017408 _____ (Microsoft Corporation) C:\windows\SysWOW64\credssp.dll
2017-05-10 04:51 - 2017-04-27 19:32 - 00006656 _____ (Microsoft Corporation) C:\windows\SysWOW64\apisetschema.dll
2017-05-10 04:51 - 2017-04-27 19:32 - 00005120 ____H (Microsoft Corporation) C:\windows\SysWOW64\api-ms-win-core-file-l1-1-0.dll
2017-05-10 04:51 - 2017-04-27 19:32 - 00005120 _____ (Microsoft Corporation) C:\windows\SysWOW64\wow32.dll
2017-05-10 04:51 - 2017-04-27 19:32 - 00004608 ____H (Microsoft Corporation) C:\windows\SysWOW64\api-ms-win-core-processthreads-l1-1-0.dll
2017-05-10 04:51 - 2017-04-27 19:32 - 00004096 ____H (Microsoft Corporation) C:\windows\SysWOW64\api-ms-win-core-sysinfo-l1-1-0.dll
2017-05-10 04:51 - 2017-04-27 19:32 - 00004096 ____H (Microsoft Corporation) C:\windows\SysWOW64\api-ms-win-core-synch-l1-1-0.dll
2017-05-10 04:51 - 2017-04-27 19:32 - 00004096 ____H (Microsoft Corporation) C:\windows\SysWOW64\api-ms-win-core-misc-l1-1-0.dll
2017-05-10 04:51 - 2017-04-27 19:32 - 00004096 ____H (Microsoft Corporation) C:\windows\SysWOW64\api-ms-win-core-localregistry-l1-1-0.dll
2017-05-10 04:51 - 2017-04-27 19:32 - 00004096 ____H (Microsoft Corporation) C:\windows\SysWOW64\api-ms-win-core-localization-l1-1-0.dll
2017-05-10 04:51 - 2017-04-27 19:32 - 00003584 ____H (Microsoft Corporation) C:\windows\SysWOW64\api-ms-win-core-processenvironment-l1-1-0.dll
2017-05-10 04:51 - 2017-04-27 19:32 - 00003584 ____H (Microsoft Corporation) C:\windows\SysWOW64\api-ms-win-core-namedpipe-l1-1-0.dll
2017-05-10 04:51 - 2017-04-27 19:32 - 00003584 ____H (Microsoft Corporation) C:\windows\SysWOW64\api-ms-win-core-memory-l1-1-0.dll
2017-05-10 04:51 - 2017-04-27 19:32 - 00003584 ____H (Microsoft Corporation) C:\windows\SysWOW64\api-ms-win-core-libraryloader-l1-1-0.dll
2017-05-10 04:51 - 2017-04-27 19:32 - 00003584 ____H (Microsoft Corporation) C:\windows\SysWOW64\api-ms-win-core-interlocked-l1-1-0.dll
2017-05-10 04:51 - 2017-04-27 19:32 - 00003584 ____H (Microsoft Corporation) C:\windows\SysWOW64\api-ms-win-core-heap-l1-1-0.dll
2017-05-10 04:51 - 2017-04-27 19:32 - 00003072 ____H (Microsoft Corporation) C:\windows\SysWOW64\api-ms-win-core-string-l1-1-0.dll
2017-05-10 04:51 - 2017-04-27 19:32 - 00003072 ____H (Microsoft Corporation) C:\windows\SysWOW64\api-ms-win-core-rtlsupport-l1-1-0.dll
2017-05-10 04:51 - 2017-04-27 19:32 - 00003072 ____H (Microsoft Corporation) C:\windows\SysWOW64\api-ms-win-core-profile-l1-1-0.dll
2017-05-10 04:51 - 2017-04-27 19:32 - 00003072 ____H (Microsoft Corporation) C:\windows\SysWOW64\api-ms-win-core-io-l1-1-0.dll
2017-05-10 04:51 - 2017-04-27 19:32 - 00003072 ____H (Microsoft Corporation) C:\windows\SysWOW64\api-ms-win-core-handle-l1-1-0.dll
2017-05-10 04:51 - 2017-04-27 19:32 - 00003072 ____H (Microsoft Corporation) C:\windows\SysWOW64\api-ms-win-core-fibers-l1-1-0.dll
2017-05-10 04:51 - 2017-04-27 19:32 - 00003072 ____H (Microsoft Corporation) C:\windows\SysWOW64\api-ms-win-core-errorhandling-l1-1-0.dll
2017-05-10 04:51 - 2017-04-27 19:32 - 00003072 ____H (Microsoft Corporation) C:\windows\SysWOW64\api-ms-win-core-delayload-l1-1-0.dll
2017-05-10 04:51 - 2017-04-27 19:32 - 00003072 ____H (Microsoft Corporation) C:\windows\SysWOW64\api-ms-win-core-debug-l1-1-0.dll
2017-05-10 04:51 - 2017-04-27 19:32 - 00003072 ____H (Microsoft Corporation) C:\windows\SysWOW64\api-ms-win-core-datetime-l1-1-0.dll
2017-05-10 04:51 - 2017-04-27 19:19 - 00148480 _____ (Microsoft Corporation) C:\windows\system32\appidpolicyconverter.exe
2017-05-10 04:51 - 2017-04-27 19:19 - 00062464 _____ (Microsoft Corporation) C:\windows\system32\Drivers\appid.sys
2017-05-10 04:51 - 2017-04-27 19:19 - 00017920 _____ (Microsoft Corporation) C:\windows\system32\appidcertstorecheck.exe
2017-05-10 04:51 - 2017-04-27 19:18 - 00064000 _____ (Microsoft Corporation) C:\windows\system32\auditpol.exe
2017-05-10 04:51 - 2017-04-27 19:15 - 00338432 _____ (Microsoft Corporation) C:\windows\system32\conhost.exe
2017-05-10 04:51 - 2017-04-27 19:14 - 00296960 _____ (Microsoft Corporation) C:\windows\system32\rstrui.exe
2017-05-10 04:51 - 2017-04-27 19:12 - 00159744 _____ (Microsoft Corporation) C:\windows\system32\Drivers\mrxsmb.sys
2017-05-10 04:51 - 2017-04-27 19:11 - 00291328 _____ (Microsoft Corporation) C:\windows\system32\Drivers\mrxsmb10.sys
2017-05-10 04:51 - 2017-04-27 19:11 - 00129536 _____ (Microsoft Corporation) C:\windows\system32\Drivers\mrxsmb20.sys
2017-05-10 04:51 - 2017-04-27 19:11 - 00050176 _____ (Microsoft Corporation) C:\windows\SysWOW64\auditpol.exe
2017-05-10 04:51 - 2017-04-27 19:10 - 00112640 _____ (Microsoft Corporation) C:\windows\system32\smss.exe
2017-05-10 04:51 - 2017-04-27 19:10 - 00030720 _____ (Microsoft Corporation) C:\windows\system32\lsass.exe
2017-05-10 04:51 - 2017-04-27 19:08 - 00025600 _____ (Microsoft Corporation) C:\windows\SysWOW64\setup16.exe
2017-05-10 04:51 - 2017-04-27 19:08 - 00014336 _____ (Microsoft Corporation) C:\windows\SysWOW64\ntvdm64.dll
2017-05-10 04:51 - 2017-04-27 19:07 - 00036352 _____ (Microsoft Corporation) C:\windows\SysWOW64\cryptbase.dll
2017-05-10 04:51 - 2017-04-27 19:07 - 00006144 ____H (Microsoft Corporation) C:\windows\SysWOW64\api-ms-win-security-base-l1-1-0.dll
2017-05-10 04:51 - 2017-04-27 19:07 - 00004608 ____H (Microsoft Corporation) C:\windows\SysWOW64\api-ms-win-core-threadpool-l1-1-0.dll
2017-05-10 04:51 - 2017-04-27 19:07 - 00003584 ____H (Microsoft Corporation) C:\windows\SysWOW64\api-ms-win-core-xstate-l1-1-0.dll
2017-05-10 04:51 - 2017-04-27 19:07 - 00003072 ____H (Microsoft Corporation) C:\windows\SysWOW64\api-ms-win-core-util-l1-1-0.dll
2017-05-10 04:51 - 2017-04-26 09:59 - 03220992 _____ (Microsoft Corporation) C:\windows\system32\win32k.sys
2017-05-10 04:51 - 2017-04-21 10:34 - 01133568 _____ (Microsoft Corporation) C:\windows\system32\cdosys.dll
2017-05-10 04:51 - 2017-04-21 10:15 - 00805376 _____ (Microsoft Corporation) C:\windows\SysWOW64\cdosys.dll
2017-05-10 04:51 - 2017-04-19 19:00 - 00394448 _____ (Microsoft Corporation) C:\windows\system32\iedkcs32.dll
2017-05-10 04:51 - 2017-04-19 18:16 - 00346320 _____ (Microsoft Corporation) C:\windows\SysWOW64\iedkcs32.dll
2017-05-10 04:51 - 2017-04-17 10:37 - 02065408 _____ (Microsoft Corporation) C:\windows\system32\ole32.dll
2017-05-10 04:51 - 2017-04-17 10:37 - 00876544 _____ (Microsoft Corporation) C:\windows\system32\oleaut32.dll
2017-05-10 04:51 - 2017-04-17 10:37 - 00512000 _____ (Microsoft Corporation) C:\windows\system32\rpcss.dll
2017-05-10 04:51 - 2017-04-17 10:37 - 00026112 _____ (Microsoft Corporation) C:\windows\system32\oleres.dll
2017-05-10 04:51 - 2017-04-17 10:37 - 00008704 _____ (Microsoft Corporation) C:\windows\system32\comcat.dll
2017-05-10 04:51 - 2017-04-17 10:12 - 01417728 _____ (Microsoft Corporation) C:\windows\SysWOW64\ole32.dll
2017-05-10 04:51 - 2017-04-17 10:12 - 00581632 _____ (Microsoft Corporation) C:\windows\SysWOW64\oleaut32.dll
2017-05-10 04:51 - 2017-04-17 10:12 - 00026112 _____ (Microsoft Corporation) C:\windows\SysWOW64\oleres.dll
2017-05-10 04:51 - 2017-04-17 09:54 - 00007168 _____ (Microsoft Corporation) C:\windows\SysWOW64\comcat.dll
2017-05-10 04:51 - 2017-04-16 03:57 - 00066560 _____ (Microsoft Corporation) C:\windows\system32\iesetup.dll
2017-05-10 04:51 - 2017-04-16 03:55 - 00417792 _____ (Microsoft Corporation) C:\windows\system32\html.iec
2017-05-10 04:51 - 2017-04-16 03:55 - 00048640 _____ (Microsoft Corporation) C:\windows\system32\ieetwproxystub.dll
2017-05-10 04:51 - 2017-04-16 03:54 - 00576512 _____ (Microsoft Corporation) C:\windows\system32\vbscript.dll
2017-05-10 04:51 - 2017-04-16 03:54 - 00088064 _____ (Microsoft Corporation) C:\windows\system32\MshtmlDac.dll
2017-05-10 04:51 - 2017-04-16 03:51 - 02899456 _____ (Microsoft Corporation) C:\windows\system32\iertutil.dll
2017-05-10 04:51 - 2017-04-16 03:44 - 00054784 _____ (Microsoft Corporation) C:\windows\system32\jsproxy.dll
2017-05-10 04:51 - 2017-04-16 03:43 - 00034304 _____ (Microsoft Corporation) C:\windows\system32\iernonce.dll
2017-05-10 04:51 - 2017-04-16 03:38 - 00615936 _____ (Microsoft Corporation) C:\windows\system32\ieui.dll
2017-05-10 04:51 - 2017-04-16 03:37 - 00144384 _____ (Microsoft Corporation) C:\windows\system32\ieUnatt.exe
2017-05-10 04:51 - 2017-04-16 03:37 - 00116224 _____ (Microsoft Corporation) C:\windows\system32\ieetwcollector.exe
2017-05-10 04:51 - 2017-04-16 03:36 - 00817664 _____ (Microsoft Corporation) C:\windows\system32\jscript.dll
2017-05-10 04:51 - 2017-04-16 03:36 - 00814080 _____ (Microsoft Corporation) C:\windows\system32\jscript9diag.dll
2017-05-10 04:51 - 2017-04-16 03:35 - 25741312 _____ (Microsoft Corporation) C:\windows\system32\mshtml.dll
2017-05-10 04:51 - 2017-04-16 03:25 - 00968704 _____ (Microsoft Corporation) C:\windows\system32\MsSpellCheckingFacility.exe
2017-05-10 04:51 - 2017-04-16 03:21 - 00489984 _____ (Microsoft Corporation) C:\windows\system32\dxtmsft.dll
2017-05-10 04:51 - 2017-04-16 03:18 - 05977600 _____ (Microsoft Corporation) C:\windows\system32\jscript9.dll
2017-05-10 04:51 - 2017-04-16 03:11 - 00077824 _____ (Microsoft Corporation) C:\windows\system32\JavaScriptCollectionAgent.dll
2017-05-10 04:51 - 2017-04-16 03:10 - 00087552 _____ (Microsoft Corporation) C:\windows\system32\tdc.ocx
2017-05-10 04:51 - 2017-04-16 03:09 - 00107520 _____ (Microsoft Corporation) C:\windows\system32\inseng.dll
2017-05-10 04:51 - 2017-04-16 03:04 - 00199680 _____ (Microsoft Corporation) C:\windows\system32\msrating.dll
2017-05-10 04:51 - 2017-04-16 03:03 - 00092160 _____ (Microsoft Corporation) C:\windows\system32\mshtmled.dll
2017-05-10 04:51 - 2017-04-16 03:02 - 00062464 _____ (Microsoft Corporation) C:\windows\SysWOW64\iesetup.dll
2017-05-10 04:51 - 2017-04-16 03:01 - 00499200 _____ (Microsoft Corporation) C:\windows\SysWOW64\vbscript.dll
2017-05-10 04:51 - 2017-04-16 03:01 - 00341504 _____ (Microsoft Corporation) C:\windows\SysWOW64\html.iec
2017-05-10 04:51 - 2017-04-16 03:01 - 00047616 _____ (Microsoft Corporation) C:\windows\SysWOW64\ieetwproxystub.dll
2017-05-10 04:51 - 2017-04-16 03:00 - 00315392 _____ (Microsoft Corporation) C:\windows\system32\dxtrans.dll
2017-05-10 04:51 - 2017-04-16 03:00 - 00064000 _____ (Microsoft Corporation) C:\windows\SysWOW64\MshtmlDac.dll
2017-05-10 04:51 - 2017-04-16 02:57 - 00152064 _____ (Microsoft Corporation) C:\windows\system32\occache.dll
2017-05-10 04:51 - 2017-04-16 02:53 - 02290176 _____ (Microsoft Corporation) C:\windows\SysWOW64\iertutil.dll
2017-05-10 04:51 - 2017-04-16 02:52 - 00047104 _____ (Microsoft Corporation) C:\windows\SysWOW64\jsproxy.dll
2017-05-10 04:51 - 2017-04-16 02:52 - 00030720 _____ (Microsoft Corporation) C:\windows\SysWOW64\iernonce.dll
2017-05-10 04:51 - 2017-04-16 02:49 - 20278272 _____ (Microsoft Corporation) C:\windows\SysWOW64\mshtml.dll
2017-05-10 04:51 - 2017-04-16 02:48 - 00476160 _____ (Microsoft Corporation) C:\windows\SysWOW64\ieui.dll
2017-05-10 04:51 - 2017-04-16 02:47 - 00663552 _____ (Microsoft Corporation) C:\windows\SysWOW64\jscript.dll
2017-05-10 04:51 - 2017-04-16 02:47 - 00115712 _____ (Microsoft Corporation) C:\windows\SysWOW64\ieUnatt.exe
2017-05-10 04:51 - 2017-04-16 02:46 - 00620032 _____ (Microsoft Corporation) C:\windows\SysWOW64\jscript9diag.dll
2017-05-10 04:51 - 2017-04-16 02:43 - 00262144 _____ (Microsoft Corporation) C:\windows\system32\webcheck.dll
2017-05-10 04:51 - 2017-04-16 02:40 - 00806912 _____ (Microsoft Corporation) C:\windows\system32\msfeeds.dll
2017-05-10 04:51 - 2017-04-16 02:40 - 00725504 _____ (Microsoft Corporation) C:\windows\system32\ie4uinit.exe
2017-05-10 04:51 - 2017-04-16 02:37 - 02132992 _____ (Microsoft Corporation) C:\windows\system32\inetcpl.cpl
2017-05-10 04:51 - 2017-04-16 02:37 - 01359360 _____ (Microsoft Corporation) C:\windows\system32\mshtmlmedia.dll
2017-05-10 04:51 - 2017-04-16 02:35 - 00416256 _____ (Microsoft Corporation) C:\windows\SysWOW64\dxtmsft.dll
2017-05-10 04:51 - 2017-04-16 02:30 - 00060416 _____ (Microsoft Corporation) C:\windows\SysWOW64\JavaScriptCollectionAgent.dll
2017-05-10 04:51 - 2017-04-16 02:29 - 00073216 _____ (Microsoft Corporation) C:\windows\SysWOW64\tdc.ocx
2017-05-10 04:51 - 2017-04-16 02:28 - 00091136 _____ (Microsoft Corporation) C:\windows\SysWOW64\inseng.dll
2017-05-10 04:51 - 2017-04-16 02:25 - 00168960 _____ (Microsoft Corporation) C:\windows\SysWOW64\msrating.dll
2017-05-10 04:51 - 2017-04-16 02:24 - 00076288 _____ (Microsoft Corporation) C:\windows\SysWOW64\mshtmled.dll
2017-05-10 04:51 - 2017-04-16 02:22 - 00279040 _____ (Microsoft Corporation) C:\windows\SysWOW64\dxtrans.dll
2017-05-10 04:51 - 2017-04-16 02:20 - 00130048 _____ (Microsoft Corporation) C:\windows\SysWOW64\occache.dll
2017-05-10 04:51 - 2017-04-16 02:12 - 00230400 _____ (Microsoft Corporation) C:\windows\SysWOW64\webcheck.dll
2017-05-10 04:51 - 2017-04-16 02:10 - 15250944 _____ (Microsoft Corporation) C:\windows\system32\ieframe.dll
2017-05-10 04:51 - 2017-04-16 02:10 - 00693248 _____ (Microsoft Corporation) C:\windows\SysWOW64\msfeeds.dll
2017-05-10 04:51 - 2017-04-16 02:08 - 04548608 _____ (Microsoft Corporation) C:\windows\SysWOW64\jscript9.dll
2017-05-10 04:51 - 2017-04-16 02:08 - 02057216 _____ (Microsoft Corporation) C:\windows\SysWOW64\inetcpl.cpl
2017-05-10 04:51 - 2017-04-16 02:08 - 01155072 _____ (Microsoft Corporation) C:\windows\SysWOW64\mshtmlmedia.dll
2017-05-10 04:51 - 2017-04-16 02:04 - 03241472 _____ (Microsoft Corporation) C:\windows\system32\wininet.dll
2017-05-10 04:51 - 2017-04-16 01:53 - 13661184 _____ (Microsoft Corporation) C:\windows\SysWOW64\ieframe.dll
2017-05-10 04:51 - 2017-04-16 01:50 - 01544704 _____ (Microsoft Corporation) C:\windows\system32\urlmon.dll
2017-05-10 04:51 - 2017-04-16 01:40 - 00800768 _____ (Microsoft Corporation) C:\windows\system32\ieapfltr.dll
2017-05-10 04:51 - 2017-04-16 01:37 - 02767872 _____ (Microsoft Corporation) C:\windows\SysWOW64\wininet.dll
2017-05-10 04:51 - 2017-04-16 01:34 - 01314816 _____ (Microsoft Corporation) C:\windows\SysWOW64\urlmon.dll
2017-05-10 04:51 - 2017-04-16 01:34 - 00710144 _____ (Microsoft Corporation) C:\windows\SysWOW64\ieapfltr.dll
2017-05-10 04:51 - 2017-04-12 10:32 - 01483776 _____ (Microsoft Corporation) C:\windows\system32\crypt32.dll
2017-05-10 04:51 - 2017-04-12 10:32 - 00229376 _____ (Microsoft Corporation) C:\windows\system32\wintrust.dll
2017-05-10 04:51 - 2017-04-12 10:32 - 00190976 _____ (Microsoft Corporation) C:\windows\system32\cryptsvc.dll
2017-05-10 04:51 - 2017-04-12 10:32 - 00141824 _____ (Microsoft Corporation) C:\windows\system32\cryptnet.dll
2017-05-10 04:51 - 2017-04-12 10:26 - 00179200 _____ (Microsoft Corporation) C:\windows\SysWOW64\wintrust.dll
2017-05-10 04:51 - 2017-04-12 10:25 - 01176064 _____ (Microsoft Corporation) C:\windows\SysWOW64\crypt32.dll
2017-05-10 04:51 - 2017-04-12 10:25 - 00145920 _____ (Microsoft Corporation) C:\windows\SysWOW64\cryptsvc.dll
2017-05-10 04:51 - 2017-04-12 10:25 - 00106496 _____ (Microsoft Corporation) C:\windows\SysWOW64\cryptnet.dll
2017-05-10 04:51 - 2017-04-07 10:34 - 00986856 _____ (Microsoft Corporation) C:\windows\system32\Drivers\dxgkrnl.sys
2017-05-10 04:51 - 2017-04-07 10:34 - 00265448 _____ (Microsoft Corporation) C:\windows\system32\Drivers\dxgmms1.sys
2017-05-10 04:51 - 2017-04-07 10:30 - 00405504 _____ (Microsoft Corporation) C:\windows\system32\gdi32.dll
2017-05-10 04:51 - 2017-04-07 10:30 - 00144384 _____ (Microsoft Corporation) C:\windows\system32\cdd.dll
2017-05-10 04:51 - 2017-04-07 10:22 - 00312832 _____ (Microsoft Corporation) C:\windows\SysWOW64\gdi32.dll
2017-05-10 04:51 - 2017-04-05 09:55 - 00460800 _____ (Microsoft Corporation) C:\windows\system32\Drivers\srv.sys
2017-05-10 04:51 - 2017-04-05 09:55 - 00405504 _____ (Microsoft Corporation) C:\windows\system32\Drivers\srv2.sys
2017-05-10 04:51 - 2017-04-05 09:55 - 00168960 _____ (Microsoft Corporation) C:\windows\system32\Drivers\srvnet.sys
2017-05-10 04:51 - 2017-04-04 10:34 - 01895656 _____ (Microsoft Corporation) C:\windows\system32\Drivers\tcpip.sys
2017-05-10 04:51 - 2017-04-04 10:34 - 00377576 _____ (Microsoft Corporation) C:\windows\system32\Drivers\netio.sys
2017-05-10 04:51 - 2017-04-04 10:34 - 00287976 _____ (Microsoft Corporation) C:\windows\system32\Drivers\FWPKCLNT.SYS
2017-05-10 04:51 - 2017-04-04 09:53 - 00496128 _____ (Microsoft Corporation) C:\windows\system32\Drivers\afd.sys
2017-05-10 04:51 - 2017-04-04 09:53 - 00117760 _____ (Microsoft Corporation) C:\windows\system32\Drivers\tdx.sys
2017-05-10 04:50 - 2017-04-27 20:10 - 00146432 _____ (Microsoft Corporation) C:\windows\system32\msaudite.dll
2017-05-10 04:50 - 2017-04-27 20:10 - 00060416 _____ (Microsoft Corporation) C:\windows\system32\msobjs.dll
2017-05-10 04:50 - 2017-04-27 20:09 - 00690688 _____ (Microsoft Corporation) C:\windows\system32\adtschema.dll
2017-05-10 04:50 - 2017-04-27 19:32 - 00690688 _____ (Microsoft Corporation) C:\windows\SysWOW64\adtschema.dll
2017-05-10 04:50 - 2017-04-27 19:32 - 00146432 _____ (Microsoft Corporation) C:\windows\SysWOW64\msaudite.dll
2017-05-10 04:50 - 2017-04-27 19:32 - 00060416 _____ (Microsoft Corporation) C:\windows\SysWOW64\msobjs.dll
2017-05-10 04:50 - 2017-04-27 19:32 - 00003072 ____H (Microsoft Corporation) C:\windows\SysWOW64\api-ms-win-core-console-l1-1-0.dll
2017-05-10 04:50 - 2017-04-27 19:08 - 00007680 _____ (Microsoft Corporation) C:\windows\SysWOW64\instnm.exe
2017-05-10 04:50 - 2017-04-27 19:08 - 00002048 _____ (Microsoft Corporation) C:\windows\SysWOW64\user.exe
2017-05-10 04:50 - 2017-04-16 04:17 - 02724864 _____ (Microsoft Corporation) C:\windows\system32\mshtml.tlb
2017-05-10 04:50 - 2017-04-16 04:16 - 00004096 _____ (Microsoft Corporation) C:\windows\system32\ieetwcollectorres.dll
2017-05-10 04:50 - 2017-04-16 03:19 - 02724864 _____ (Microsoft Corporation) C:\windows\SysWOW64\mshtml.tlb
2017-05-09 10:44 - 2017-05-23 17:23 - 00000000 ____D C:\ProgramData\LogMeIn
2017-05-09 10:44 - 2017-05-23 14:13 - 00000950 _____ C:\ProgramData\Microsoft\Windows\Start Menu\Programs\LogMeIn Control Panel.lnk
2017-05-09 10:44 - 2017-05-17 20:03 - 00114688 _____ (LogMeIn, Inc.) C:\windows\system32\LMIRfsClientNP.dll
2017-05-09 10:44 - 2017-05-17 20:03 - 00109024 _____ (LogMeIn, Inc.) C:\windows\system32\LMIinit.dll
2017-05-09 10:44 - 2017-05-09 10:44 - 00001914 _____ C:\ProgramData\Microsoft\Windows\Start Menu\Programs\LogMeIn Client.lnk
2017-05-09 10:44 - 2017-05-09 10:44 - 00001024 _____ C:\.rnd
2017-05-09 10:44 - 2017-05-09 10:44 - 00000000 ____D C:\Users\JB\AppData\Local\LogMeIn
2017-05-09 10:44 - 2017-05-09 10:44 - 00000000 ____D C:\Program Files (x86)\LogMeIn Ignition
2017-05-09 10:44 - 2017-01-11 03:08 - 00030432 _____ (LogMeIn, Inc.) C:\windows\system32\Drivers\LMIInfo.sys
2017-05-09 10:44 - 2017-01-10 11:04 - 00081088 _____ (LogMeIn, Inc.) C:\windows\system32\Drivers\LMIRfsDriver.sys
2017-05-09 10:44 - 2016-01-29 10:53 - 00035328 _____ (LogMeIn, Inc.) C:\windows\system32\LMIport.dll
2017-05-09 10:43 - 2017-05-17 20:04 - 00000000 ____D C:\Program Files (x86)\LogMeIn
2017-05-03 14:23 - 2017-05-03 14:23 - 00147490 _____ C:\Users\JB\Documents\Lien Release Rock Steady.pdf
2017-05-02 16:18 - 2017-05-02 16:23 - 00133967 _____ C:\Users\JB\Downloads\Electronic Change of Address.pdf
2017-05-02 16:05 - 2017-03-10 11:32 - 01389056 _____ (Microsoft Corporation) C:\windows\system32\pla.dll
2017-05-02 16:05 - 2017-03-10 11:32 - 00300544 _____ (Microsoft Corporation) C:\windows\system32\pdh.dll
2017-05-02 16:05 - 2017-03-10 11:20 - 01508352 _____ (Microsoft Corporation) C:\windows\SysWOW64\pla.dll
2017-05-02 16:05 - 2017-03-10 11:20 - 00237056 _____ (Microsoft Corporation) C:\windows\SysWOW64\pdh.dll
2017-05-02 16:05 - 2017-03-10 10:57 - 00009216 _____ (Microsoft Corporation) C:\windows\system32\plasrv.exe
2017-05-02 16:05 - 2017-03-10 10:55 - 00205312 _____ (Microsoft Corporation) C:\windows\system32\Drivers\fastfat.sys
2017-05-02 16:05 - 2017-03-10 10:55 - 00195584 _____ (Microsoft Corporation) C:\windows\system32\Drivers\exfat.sys
2017-05-02 16:05 - 2017-03-09 11:34 - 00002048 _____ (Microsoft Corporation) C:\windows\system32\tzres.dll
2017-05-02 16:05 - 2017-03-09 11:19 - 00002048 _____ (Microsoft Corporation) C:\windows\SysWOW64\tzres.dll

==================== One Month Modified files and folders ========

(If an entry is included in the fixlist, the file/folder will be moved.)

2017-05-25 13:42 - 2017-02-10 00:17 - 00000000 ____D C:\ProgramData\Malwarebytes Anti-Exploit
2017-05-25 13:41 - 2009-07-13 23:45 - 00027568 ____H C:\windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0
2017-05-25 13:41 - 2009-07-13 23:45 - 00027568 ____H C:\windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0
2017-05-25 13:36 - 2015-11-19 18:20 - 00000000 ____D C:\Users\JB\Documents\Outlook Files
2017-05-25 12:09 - 2016-12-05 10:56 - 00000000 ____D C:\Users\JB\AppData\LocalLow\Mozilla
2017-05-25 11:59 - 2015-10-31 15:51 - 00000000 ____D C:\ProgramData\Kaspersky Lab
2017-05-25 11:43 - 2016-07-19 12:40 - 02906148 _____ C:\windows\ntbtlog.txt
2017-05-24 20:24 - 2017-01-25 02:32 - 00003032 _____ C:\windows\System32\Tasks\Kaspersky_Upgrade_Launcher_{278ADC42-419D-4547-A6CA-5B74BE0AD901}
2017-05-24 20:14 - 2009-07-14 00:13 - 00781614 _____ C:\windows\system32\PerfStringBackup.INI
2017-05-24 20:14 - 2009-07-13 22:20 - 00000000 ____D C:\windows\inf
2017-05-24 20:07 - 2017-02-09 21:38 - 00228800 _____ (Malwarebytes) C:\windows\system32\Drivers\MB3SwissArmy.sys
2017-05-24 20:07 - 2017-02-09 21:38 - 00113592 _____ (Malwarebytes) C:\windows\system32\Drivers\farflt.sys
2017-05-24 20:07 - 2015-11-06 16:04 - 00000000 ____D C:\Program Files (x86)\ATT
2017-05-24 20:07 - 2009-07-14 00:08 - 00000006 ____H C:\windows\Tasks\SA.DAT
2017-05-24 18:20 - 2015-10-30 14:20 - 00003902 _____ C:\windows\System32\Tasks\User_Feed_Synchronization-{7827EECA-F2EA-4C06-969B-64B433542E61}
2017-05-24 16:20 - 2016-12-10 20:20 - 00000000 ____D C:\FRST
2017-05-23 22:13 - 2016-12-21 19:33 - 00000000 ____D C:\Users\JB\AppData\LocalLow\Adblock Plus for IE
2017-05-23 15:38 - 2017-02-09 21:34 - 00192216 _____ (Malwarebytes) C:\windows\system32\Drivers\MBAMSwissArmy.sys
2017-05-23 14:10 - 2015-11-02 18:30 - 00000000 ____D C:\windows\system32\MRT
2017-05-23 14:09 - 2015-11-02 18:29 - 132223576 ____C (Microsoft Corporation) C:\windows\system32\MRT.exe
2017-05-21 17:52 - 2015-05-28 16:30 - 00000000 ___HD C:\Program Files (x86)\InstallShield Installation Information
2017-05-21 17:06 - 2016-12-21 19:08 - 00000000 ____D C:\Program Files (x86)\SpeedFan
2017-05-21 15:55 - 2016-08-13 13:59 - 00003168 _____ C:\windows\System32\Tasks\HPCeeScheduleForJB
2017-05-21 15:55 - 2016-08-13 13:59 - 00000320 _____ C:\windows\Tasks\HPCeeScheduleForJB.job
2017-05-20 20:15 - 2009-07-14 00:32 - 00028672 _____ C:\windows\system32\config\BCD-Template
2017-05-20 17:56 - 2015-12-02 15:24 - 00000000 ____D C:\Program Files (x86)\Mozilla Maintenance Service
2017-05-20 17:16 - 2016-05-20 15:16 - 00000000 ____D C:\windows\Minidump
2017-05-18 10:35 - 2015-11-21 14:22 - 00004476 _____ C:\windows\System32\Tasks\Adobe Acrobat Update Task
2017-05-17 17:13 - 2017-02-10 00:17 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Malwarebytes Anti-Exploit
2017-05-17 17:13 - 2017-02-10 00:17 - 00000000 ____D C:\Program Files (x86)\Malwarebytes Anti-Exploit
2017-05-17 11:01 - 2015-11-02 12:41 - 00000090 _____ C:\windows\QBChanUtil_Trigger.ini
2017-05-16 18:04 - 2009-07-13 22:20 - 00000000 ____D C:\windows\rescache
2017-05-16 14:18 - 2016-11-15 02:42 - 00000000 ____D C:\ProgramData\regid.1991-06.com.microsoft
2017-05-16 14:12 - 2015-05-28 16:31 - 00000000 ____D C:\Program Files (x86)\Microsoft Office
2017-05-16 14:05 - 2013-12-03 15:26 - 00773736 _____ C:\windows\SysWOW64\PerfStringBackup.INI
2017-05-10 12:46 - 2009-07-13 23:45 - 00443280 _____ C:\windows\system32\FNTCACHE.DAT
2017-05-10 12:43 - 2009-07-13 22:20 - 00000000 ____D C:\windows\PolicyDefinitions
2017-05-09 15:47 - 2015-05-28 16:37 - 00803320 _____ (Adobe Systems Incorporated) C:\windows\SysWOW64\FlashPlayerApp.exe
2017-05-09 15:47 - 2015-05-28 16:37 - 00144888 _____ (Adobe Systems Incorporated) C:\windows\SysWOW64\FlashPlayerCPLApp.cpl
2017-05-09 15:47 - 2015-05-28 16:37 - 00004312 _____ C:\windows\System32\Tasks\Adobe Flash Player Updater
2017-05-09 15:47 - 2015-05-28 16:37 - 00000000 ____D C:\windows\SysWOW64\Macromed
2017-05-09 15:47 - 2015-05-28 16:37 - 00000000 ____D C:\windows\system32\Macromed
2017-04-27 16:32 - 2016-11-14 20:07 - 00003330 _____ C:\windows\System32\Tasks\GoogleUpdateTaskMachineUA
2017-04-27 16:32 - 2016-11-14 20:07 - 00003202 _____ C:\windows\System32\Tasks\GoogleUpdateTaskMachineCore

==================== Files in the root of some directories =======

2016-11-14 23:55 - 2016-11-14 23:55 - 0007605 _____ () C:\Users\JB\AppData\Local\Resmon.ResmonCfg
2017-04-09 16:08 - 2017-04-09 16:08 - 0000000 _____ () C:\Users\JB\AppData\Local\{E32D5016-8129-4AE8-84B7-3774A9FA5F62}
2017-02-02 14:20 - 2017-02-02 14:20 - 0000000 _____ () C:\Users\JB\AppData\Local\{EFFBA262-4F5B-4C9C-A254-B372422AB856}
2015-10-31 15:12 - 2015-10-31 15:12 - 0000057 _____ () C:\ProgramData\Ament.ini

==================== Bamital & volsnap ======================

(There is no automatic fix for files that do not pass verification.)

C:\windows\system32\winlogon.exe => File is digitally signed
C:\windows\system32\wininit.exe => File is digitally signed
C:\windows\SysWOW64\wininit.exe => File is digitally signed
C:\windows\explorer.exe => File is digitally signed
C:\windows\SysWOW64\explorer.exe => File is digitally signed
C:\windows\system32\svchost.exe => File is digitally signed
C:\windows\SysWOW64\svchost.exe => File is digitally signed
C:\windows\system32\services.exe => File is digitally signed
C:\windows\system32\User32.dll => File is digitally signed
C:\windows\SysWOW64\User32.dll => File is digitally signed
C:\windows\system32\userinit.exe => File is digitally signed
C:\windows\SysWOW64\userinit.exe => File is digitally signed
C:\windows\system32\rpcss.dll => File is digitally signed
C:\windows\system32\dnsapi.dll => File is digitally signed
C:\windows\SysWOW64\dnsapi.dll => File is digitally signed
C:\windows\system32\Drivers\volsnap.sys => File is digitally signed

LastRegBack: 2017-05-23 11:23

==================== End of FRST.txt ============================

Additional scan result of Farbar Recovery Scan Tool (x64) Version: 24-05-2017
Ran by JB (25-05-2017 13:44:25)
Running from C:\Users\JB\Desktop
Windows 7 Professional Service Pack 1 (X64) (2015-10-30 19:19:40)
Boot Mode: Normal
==========================================================

==================== Accounts: =============================

Administrator (S-1-5-21-2577112198-3913129868-2286876578-500 - Administrator - Disabled)
Guest (S-1-5-21-2577112198-3913129868-2286876578-501 - Limited - Disabled)
JB (S-1-5-21-2577112198-3913129868-2286876578-1000 - Administrator - Enabled) => C:\Users\JB

==================== Security Center ========================

(If an entry is included in the fixlist, it will be removed.)

AV: Kaspersky Small Office Security (Enabled - Up to date) {86367591-4BE4-AE08-2FD9-7FCB8259CD98}
AS: Kaspersky Small Office Security (Enabled - Up to date) {3D579475-6DDE-A186-1569-44B9F9DE8725}
AS: Windows Defender (Enabled - Up to date) {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
FW: Kaspersky Small Office Security (Enabled) {BE0DF4B4-018B-AF50-0486-D6FE7C8A8AE3}

==================== Installed Programs ======================

(Only the adware programs with "Hidden" flag could be added to the fixlist to unhide them. The adware programs should be uninstalled manually.)

7-Zip 16.04 (x64 edition) (HKLM\...\{23170F69-40C1-2702-1604-000001000000}) (Version: 16.04.00.0 - Igor Pavlov)
Adblock Plus for IE (32-bit and 64-bit) (HKLM\...\{0F347A49-E36C-4639-8D2E-003AD408B8B2}) (Version: 1.5 - Eyeo GmbH)
Adobe Acrobat Reader DC (HKLM-x32\...\{AC76BA86-7AD7-1033-7B44-AC0F074E4100}) (Version: 17.009.20044 - Adobe Systems Incorporated)
Adobe Flash Player 25 ActiveX (HKLM-x32\...\Adobe Flash Player ActiveX) (Version: 25.0.0.171 - Adobe Systems Incorporated)
Adobe Flash Player 25 NPAPI (HKLM-x32\...\Adobe Flash Player NPAPI) (Version: 25.0.0.171 - Adobe Systems Incorporated)
Apple Application Support (32-bit) (HKLM-x32\...\{E92BB800-BCC5-4C25-8102-AC2C3B7C7C1E}) (Version: 5.5 - Apple Inc.)
Apple Application Support (64-bit) (HKLM\...\{9C912B1E-06DD-43EF-BB2B-45CB2C88BAAE}) (Version: 5.5 - Apple Inc.)
Apple Mobile Device Support (HKLM\...\{0A596141-97D5-45FA-9281-98DFAF48D579}) (Version: 10.3.2.3 - Apple Inc.)
Apple Software Update (HKLM-x32\...\{52D87F32-70E4-4348-8148-C0B9F35B1314}) (Version: 2.3.0.177 - Apple Inc.)
ATT Management Agent (HKLM-x32\...\ATT-AT&T Troubleshoot & Resolve) (Version: 8.5.0.48 - AT&T)
Bonjour (HKLM\...\{56DDDFB8-7F79-4480-89D5-25E1F52AB28F}) (Version: 3.1.0.1 - Apple Inc.)
Broadcom Bluetooth Software (HKLM\...\{A1439D4F-FD46-47F2-A1D3-FEE097C29A09}) (Version: 6.5.1.6200 - Broadcom Corporation)
CyberLink LabelPrint (HKLM-x32\...\InstallShield_{C59C179C-668D-49A9-B6EA-0121CCFC1243}) (Version: 2.5.5.6805 - CyberLink Corp.)
CyberLink Power2Go 8 (HKLM-x32\...\InstallShield_{2A87D48D-3FDF-41fd-97CD-A1E370EFFFE2}) (Version: 8.0.5.3606 - CyberLink Corp.)
DisableMSDefender (Version: 1.0.0 - Hewlett-Packard Company) Hidden
Foxit PhantomPDF (HKLM-x32\...\{4E32271C-B55A-4CDF-8DB7-88FD1C45927C}) (Version: 7.0.310.226 - Foxit Software Inc.)
Google Earth (HKLM-x32\...\{F6430171-B86B-4639-839E-374913E7911D}) (Version: 7.1.8.3036 - Google)
Google Update Helper (x32 Version: 1.3.33.5 - Google Inc.) Hidden
Hewlett-Packard ACLM.NET v1.2.2.3 (x32 Version: 1.00.0000 - Hewlett-Packard Company) Hidden
HP Desktop Keyboard (HKLM-x32\...\HP Keyboard_is1) (Version: 1.0.0.13 - Hewlett-Packard)
HP Documentation (HKLM-x32\...\{E0E6FBA2-BF5B-4B79-9066-2BB5FA41291B}) (Version: 1.4.0.0 - Hewlett-Packard)
HP FWUpdateEDO2 (HKLM-x32\...\{415FA9AD-DA10-4ABE-97B6-5051D4795C90}) (Version: 1.2.0.0 - Hewlett-Packard)
HP Officejet Pro 8610 Basic Device Software (HKLM\...\{39DA3F40-0B9E-4002-8E01-108FEC9EFE43}) (Version: 32.3.198.49673 - Hewlett-Packard Co.)
HP Officejet Pro 8610 Help (HKLM-x32\...\{F9569D00-4576-46C8-B6C7-207A4FD39745}) (Version: 32.0.0 - Hewlett Packard)
HP Setup (HKLM-x32\...\{438363A8-F486-4C37-834C-4955773CB3D3}) (Version: 9.1.15453.4066 - Hewlett-Packard Company)
HP Support Information (HKLM-x32\...\{B2B7B1C8-7C8B-476C-BE2C-049731C55992}) (Version: 13.00.0000 - Hewlett-Packard)
HP Support Solutions Framework (HKLM-x32\...\{55065080-504F-43BB-BE00-36B80D7D39A5}) (Version: 12.5.32.203 - Hewlett-Packard Company)
HP Update (HKLM-x32\...\{912D30CF-F39E-4B31-AD9A-123C6B794EE2}) (Version: 5.005.002.002 - Hewlett-Packard)
HPDiagnosticAlert (x32 Version: 1.00.0001 - Microsoft) Hidden
I.R.I.S. OCR (HKLM-x32\...\{CA6BCA2F-EDEB-408F-850B-31404BE16A61}) (Version: 12.3.4.0 - HP)
Intel® Chipset Device Software (x32 Version: 10.0.22 - Intel® Corporation) Hidden
Intel® Management Engine Components (HKLM\...\{1CEAC85D-2590-4760-800F-8DE5E91F3700}) (Version: 10.0.27.1012 - Intel Corporation)
Intel® Processor Graphics (HKLM-x32\...\{F0E3AD40-2BBD-4360-9C76-B9AC9A5886EA}) (Version: 10.18.14.4029 - Intel Corporation)
Intel® USB 3.0 eXtensible Host Controller Driver (HKLM-x32\...\{240C3DDD-C5E9-4029-9DF7-95650D040CF2}) (Version: 3.0.3.60 - Intel Corporation)
iTunes (HKLM\...\{F0C7385A-9D20-45F3-8101-05D383885180}) (Version: 12.6.1.25 - Apple Inc.)
Kaspersky Small Office Security (HKLM-x32\...\InstallWIX_{51AE1D4F-1352-40FE-A0BE-DAA166663609}) (Version: 17.0.0.611 - Kaspersky Lab)
Kaspersky Small Office Security (x32 Version: 17.0.0.611 - Kaspersky Lab) Hidden
LogMeIn (HKLM-x32\...\{C356B55B-3967-4474-9D77-30C67A4EEBAC}) (Version: 4.1.9498 - LogMeIn, Inc.)
LogMeIn Client (HKLM-x32\...\{5C9FFE5E-C461-408D-804A-C2E2C339D783}) (Version: 1.3.2857 - LogMeIn, Inc.)
Malwarebytes Anti-Exploit version 1.9.2.1413 (HKLM\...\Malwarebytes Anti-Exploit_is1) (Version: 1.9.2.1413 - Malwarebytes)
Malwarebytes Anti-Malware version 1.80.2.1012 (HKLM-x32\...\Malwarebytes' Anti-Malware_is1) (Version: 1.80.2.1012 - Malwarebytes Corporation)
Malwarebytes Anti-Ransomware version 0.9.17.689 (HKLM\...\{6CA75021-FBB0-41A5-B95C-FC1C9E0421F0}_is1) (Version: 0.9.17.689 - Malwarebytes)
Microsoft .NET Framework 4.6.1 (HKLM\...\{92FB6C44-E685-45AD-9B20-CADF4CABA132} - 1033) (Version: 4.6.01055 - Microsoft Corporation)
Microsoft Office 365 - en-us (HKLM\...\O365HomePremRetail - en-us) (Version: 16.0.7967.2161 - Microsoft Corporation)
Microsoft OneDrive (HKU\.DEFAULT\...\OneDriveSetup.exe) (Version: 17.3.6390.0509 - Microsoft Corporation)
Microsoft OneDrive (HKU\S-1-5-21-2577112198-3913129868-2286876578-1000\...\OneDriveSetup.exe) (Version: 17.3.6390.0509 - Microsoft Corporation)
Microsoft Silverlight (HKLM\...\{89F4137D-6C26-4A84-BDB8-2E5A4BB71E00}) (Version: 5.1.50906.0 - Microsoft Corporation)
Microsoft Visual C++ 2005 Redistributable (HKLM-x32\...\{710f4c1c-cc18-4c49-8cbf-51240c89a1a2}) (Version: 8.0.61001 - Microsoft Corporation)
Microsoft Visual C++ 2005 Redistributable (HKLM-x32\...\{A49F249F-0C91-497F-86DF-B2585E8E76B7}) (Version: 8.0.50727.42 - Microsoft Corporation)
Microsoft Visual C++ 2005 Redistributable (x64) (HKLM\...\{071c9b48-7c32-4621-a0ac-3f809523288f}) (Version: 8.0.56336 - Microsoft Corporation)
Microsoft Visual C++ 2005 Redistributable (x64) (HKLM\...\{ad8a2fa1-06e7-4b0d-927d-6e54b3d31028}) (Version: 8.0.61000 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.17 (HKLM\...\{8220EEFE-38CD-377E-8595-13398D740ACE}) (Version: 9.0.30729 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.6161 (HKLM\...\{5FCE6D76-F5DC-37AB-B2B8-22AB8CEDB1D4}) (Version: 9.0.30729.6161 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17 (HKLM-x32\...\{9A25302D-30C0-39D9-BD6F-21E6EC160475}) (Version: 9.0.30729 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161 (HKLM-x32\...\{9BE518E6-ECC6-35A9-88E4-87755C07200F}) (Version: 9.0.30729.6161 - Microsoft Corporation)
Microsoft Visual C++ 2010 x64 Redistributable - 10.0.40219 (HKLM\...\{1D8E6291-B0D5-35EC-8441-6616F567A0F7}) (Version: 10.0.40219 - Microsoft Corporation)
Microsoft Visual C++ 2010 x86 Redistributable - 10.0.40219 (HKLM-x32\...\{F0C3E5D1-1ADE-321E-8167-68EF0DE699A5}) (Version: 10.0.40219 - Microsoft Corporation)
Microsoft Visual C++ 2012 Redistributable (x64) - 11.0.51106 (HKLM-x32\...\{6e8f74e0-43bd-4dce-8477-6ff6828acc07}) (Version: 11.0.51106.1 - Microsoft Corporation)
Microsoft Visual C++ 2012 Redistributable (x86) - 11.0.51106 (HKLM-x32\...\{8e70e4e1-06d7-470b-9f74-a51bef21088e}) (Version: 11.0.51106.1 - Microsoft Corporation)
Microsoft Visual C++ 2013 Redistributable (x64) - 12.0.30501 (HKLM-x32\...\{050d4fc8-5d48-4b8f-8972-47c82c46020f}) (Version: 12.0.30501.0 - Microsoft Corporation)
Mozilla Firefox 53.0.3 (x86 en-US) (HKLM-x32\...\Mozilla Firefox 53.0.3 (x86 en-US)) (Version: 53.0.3 - Mozilla)
Mozilla Maintenance Service (HKLM-x32\...\MozillaMaintenanceService) (Version: 53.0.3.6347 - Mozilla)
MSXML 4.0 SP2 (KB954430) (HKLM-x32\...\{86493ADD-824D-4B8E-BD72-8C5DCDC52A71}) (Version: 4.20.9870.0 - Microsoft Corporation)
MSXML 4.0 SP2 (KB973688) (HKLM-x32\...\{F662A8E6-F4DC-41A2-901E-8C11F044BDEC}) (Version: 4.20.9876.0 - Microsoft Corporation)
Office 16 Click-to-Run Extensibility Component (x32 Version: 16.0.7967.2161 - Microsoft Corporation) Hidden
Office 16 Click-to-Run Extensibility Component 64-bit Registration (Version: 16.0.7967.2161 - Microsoft Corporation) Hidden
Office 16 Click-to-Run Licensing Component (Version: 16.0.7967.2161 - Microsoft Corporation) Hidden
Office 16 Click-to-Run Localization Component (x32 Version: 16.0.7668.2066 - Microsoft Corporation) Hidden
opensource (x32 Version: 1.0.14960.3876 - Your Company Name) Hidden
PlayReady PC Runtime amd64 (HKLM\...\{BCA9334F-B6C9-4F65-9A73-AC5A329A4D04}) (Version: 1.3.0 - Microsoft Corporation)
Product Improvement Study for HP Officejet Pro 8610 (HKLM\...\{D2064264-3162-4DB1-AFE0-167BEFBBCD9C}) (Version: 32.3.198.49673 - Hewlett-Packard Co.)
QB Plugin (HKLM-x32\...\{EABA578B-1F45-4A5A-B1D1-1C4394AE0722}) (Version: 1.5.10 - Zenwork, Inc.)
QBFC 12.0 (HKLM-x32\...\{B1BEE7DF-8F06-4089-BFBB-FE754613D07E}) (Version: 12.0.0.29 - Intuit Developer Network)
QuickBooks (x32 Version: 25.0.4014.2506 - Intuit Inc.) Hidden
QuickBooks Pro 2015 (HKLM-x32\...\{8F02EFA1-8F5E-4E47-A6B5-D99E4FE90271}) (Version: 25.0.4013.2506 - Intuit Inc.)
QuickBooks Runtime Redistributable (HKLM\...\{F2A4F809-2DE6-4D27-888B-4D2BB8DAF20E}) (Version: 1.00.0000 - Intuit Inc.)
Realtek Card Reader (HKLM-x32\...\{5BC2B5AB-80DE-4E83-B8CF-426902051D0A}) (Version: 10.0.10125.31214 - Realtek Semiconductor Corp.)
Realtek Ethernet Controller Driver (HKLM-x32\...\{8833FFB6-5B0C-4764-81AA-06DFEED9A476}) (Version: 7.97.1001.2015 - Realtek)
Realtek High Definition Audio Driver (HKLM-x32\...\{F132AF7F-7BCA-4EDE-8A7C-958108FE7DBC}) (Version: 6.0.1.7673 - Realtek Semiconductor Corp.)
Recovery Manager (x32 Version: 5.5.0.6704 - CyberLink Corp.) Hidden
Revo Uninstaller 2.0.2 (HKLM\...\{A28DBDA2-3CC7-4ADC-8BFE-66D7743C6C97}_is1) (Version: 2.0.2 - VS Revo Group, Ltd.)
Revo Uninstaller Pro 3.1.4 (HKLM\...\{67579783-0FB7-4F7B-B881-E5BE47C9DBE0}_is1) (Version: 3.1.4 - VS Revo Group, Ltd.)
Samsung Data Migration (HKLM-x32\...\{3B304604-0BF5-488E-AB95-F2F2E31206F3}) (Version: 3.0 - Samsung)
Samsung Magician (HKLM-x32\...\{29AE3F9F-7158-4ca7-B1ED-28A73ECDB215}_is1) (Version: 4.5.1 - Samsung Electronics)
Skype™ 7.0 (HKLM-x32\...\{24991BA0-F0EE-44AD-9CC8-5EC50AECF6B7}) (Version: 7.0.102 - Skype Technologies S.A.)
Speccy (HKLM\...\Speccy) (Version: 1.30 - Piriform)
SpeedFan (remove only) (HKLM-x32\...\SpeedFan) (Version: - )
VC12X64Redist (HKLM\...\{B573CC21-AE24-4BC5-9B0B-15CF29A3F982}) (Version: 1.00.0000 - Intuit Inc.)
VC12X86Redist (HKLM-x32\...\{EA9886ED-21F8-4867-A049-CE6817291EE6}) (Version: 1.00.0000 - Intuit Inc.)

==================== Custom CLSID (Whitelisted): ==========================

(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)

CustomCLSID: HKU\S-1-5-21-2577112198-3913129868-2286876578-1000_Classes\CLSID\{162C6FB5-44D3-435B-903D-E613FA093FB5}\InprocServer32 -> C:\Users\JB\AppData\Local\Microsoft\OneDrive\17.3.6390.0509_1\amd64\FileCoAuthLib64.dll ()

==================== Scheduled Tasks (Whitelisted) =============

(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)

Task: {0ABDF49B-8511-4B16-A6BD-4E433953C6DF} - System32\Tasks\Adobe Acrobat Update Task => C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe [2017-04-25] (Adobe Systems Incorporated)
Task: {0BA3516E-5A5E-4C57-96DC-340802F9F83F} - System32\Tasks\Games\UpdateCheck_S-1-5-21-2577112198-3913129868-2286876578-1000
Task: {1A78062D-D82B-4A9F-B6FE-8FE68511BB24} - System32\Tasks\Microsoft\Office\Office Automatic Updates => C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeC2RClient.exe [2017-05-04] (Microsoft Corporation)
Task: {207428A7-CDF9-4D76-B61C-C1735D7A9F5D} - System32\Tasks\GoogleUpdateTaskMachineCore => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe [2016-11-14] (Google Inc.)
Task: {2E63BAF3-CE27-4491-9981-1CF3E2E68464} - System32\Tasks\Adobe Flash Player Updater => C:\windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe [2017-05-09] (Adobe Systems Incorporated)
Task: {396E368C-688F-4466-8EDD-018BF849C28C} - System32\Tasks\Microsoft\Office\Office ClickToRun Service Monitor => C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeC2RClient.exe [2017-05-04] (Microsoft Corporation)
Task: {42E03E44-42FB-459C-8C79-7FB6067BD543} - System32\Tasks\Microsoft\Office\Office Subscription Maintenance => C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonx86\Microsoft Shared\Office16\OLicenseHeartbeat.exe [2017-05-14] (Microsoft Corporation)
Task: {4DB25382-8FC2-469E-9482-89FB9DA43ED8} - System32\Tasks\HPCeeScheduleForJB => C:\Program Files (x86)\Hewlett-Packard\HP Ceement\HPCEE.exe [2015-06-16] (Hewlett-Packard)
Task: {52CEA253-EE8C-4400-9FB2-F9E1E0471A53} - System32\Tasks\HPCustParticipation HP Officejet Pro 8610 => C:\Program Files\HP\HP Officejet Pro 8610\Bin\HPCustPartic.exe [2014-07-21] (Hewlett-Packard Development Company, LP)
Task: {5603B2DB-67EA-401E-AF43-921F95386D5F} - System32\Tasks\Hewlett-Packard\HP Active Health\HP Active Health Scan (HPSA) => C:\Program Files (x86)\Hewlett-Packard\HP Support Framework\Resources\HPActiveHealth\ActiveHealth.exe
Task: {5888BB80-09B2-481A-BD00-D73681A76A5B} - System32\Tasks\CLMLSvc_P2G8 => c:\Program Files (x86)\CyberLink\Power2Go8\CLMLSvc_P2G8.exe [2013-08-05] (CyberLink)
Task: {63E66B9F-7E9D-4832-B7CA-514645DA3F6E} - System32\Tasks\{5A0B0278-ECE8-458D-B84F-105F058C4D1E} => pcalua.exe -a E:\setup.exe -d E:\
Task: {65A45F29-5A16-4C86-B20A-26BEE99EDC16} - System32\Tasks\SamsungMagician => C:\Program Files (x86)\Samsung\Samsung Magician\Samsung Magician.exe [2014-09-28] (Samsung Electronics.)
Task: {68E3BA5C-B49A-41E2-81A1-7E4B42CDAD36} - System32\Tasks\{BAD2B040-9563-4C09-93BB-E95EAA487ECE} => pcalua.exe -a "C:\Program Files (x86)\VS Revo Group\Revo Uninstaller\Revouninstaller.exe" -d "C:\Program Files (x86)\VS Revo Group\Revo Uninstaller" -c -hunter
Task: {70BBE708-4954-40DC-B51B-FE79F7D18789} - System32\Tasks\Hewlett-Packard\HP Support Assistant\WarrantyChecker => C:\Program Files (x86)\Hewlett-Packard\HP Support Framework\Resources\HPWarrantyCheck\HPWarrantyChecker.exe
Task: {777E2AD1-AC29-46B9-97EB-7ACE76276CC0} - System32\Tasks\Hewlett-Packard\HP Support Assistant\HP Support Solutions Framework Updater - Resources => C:\Program Files (x86)\Hewlett-Packard\HP Support Solutions\Modules\HPSSFUpdater.exe [2016-12-07] (HP Inc.)
Task: {8BD99351-E25F-4DDD-B6E4-A4F038D461D6} - System32\Tasks\Hewlett-Packard\HP Support Assistant\HP Support Assistant Quick Start => C:\Program Files (x86)\Hewlett-Packard\HP Support Framework\HPSF.exe
Task: {93A2505E-778B-4DBA-8E8D-FB6B1CCCB578} - System32\Tasks\CLVDLauncher => c:\Program Files (x86)\CyberLink\Power2Go8\CLVDLauncher.exe [2013-03-12] (CyberLink Corp.)
Task: {95BD48E9-EF55-4F25-8180-C0115D994479} - System32\Tasks\Hewlett-Packard\HP Support Assistant\Product Configurator => C:\Program Files (x86)\Hewlett-Packard\HP Support Framework\Resources\ProductConfig.exe
Task: {96C1C8DF-0540-4C21-8373-0DC24A986B65} - System32\Tasks\Hewlett-Packard\HP Support Assistant\HP Support Solutions Framework Updater => C:\Program Files (x86)\Hewlett-Packard\HP Support Solutions\Modules\HPSSFUpdater.exe [2016-12-07] (HP Inc.)
Task: {981F98D4-E5B9-44C0-9AA3-FBA4F83A0D89} - System32\Tasks\Apple\AppleSoftwareUpdate => C:\Program Files (x86)\Apple Software Update\SoftwareUpdate.exe [2017-02-14] (Apple Inc.)
Task: {A6CB161F-8045-44C3-A038-609778720DDB} - System32\Tasks\ScanToPCActivationApp.exe_{7EBBA508-8695-4A8B-A46A-329BC252665A} => C:\Program Files\HP\HP Officejet Pro 8610\Bin\ScanToPCActivationApp.exe [2014-07-21] (Hewlett-Packard Development Company, LP)
Task: {A7586256-A7D0-44D8-9144-A6282DAFB3F9} - System32\Tasks\Kaspersky_Upgrade_Launcher_{278ADC42-419D-4547-A6CA-5B74BE0AD901} => C:\Program Files\Common Files\AV\Kaspersky Lab\upgrade_launcher.exe [2016-05-06] (AO Kaspersky Lab)
Task: {B1CE85D8-2B4A-41B7-AE5A-93236D5C2DF0} - System32\Tasks\GoogleUpdateTaskMachineUA => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe [2016-11-14] (Google Inc.)
Task: {BDB0F986-BCB5-46F4-8510-A010EA4A7BE1} - System32\Tasks\Hewlett-Packard\HP Support Assistant\HP Support Solutions Framework Report => C:\Program Files (x86)\Hewlett-Packard\HP Support Solutions\Modules\HPSFReport.exe [2016-05-09] (Hewlett-Packard)
Task: {C8673A6A-492C-4744-A8B9-A355C536A65A} - System32\Tasks\AVAST Software\Avast settings backup => C:\Program Files\Common Files\AV\avast! Antivirus\backup.exe [2017-01-27] (AVAST Software)
Task: {D1DB0515-E631-4D74-BFEF-A3590D5F52D0} - System32\Tasks\Hewlett-Packard\HP Support Assistant\PC Health Analysis => C:\Program Files (x86)\Hewlett-Packard\HP Support Framework\HPSF.exe

(If an entry is included in the fixlist, the task (.job) file will be moved. The file which is running by the task will not be moved.)

Task: C:\windows\Tasks\HPCeeScheduleForJB.job => C:\Program Files (x86)\Hewlett-Packard\HP Ceement\HPCEE.exe

==================== Shortcuts =============================

(The entries could be listed to be restored or removed.)

==================== Loaded Modules (Whitelisted) ==============

2017-05-09 00:44 - 2017-05-09 00:44 - 01354040 _____ () C:\Program Files\Common Files\Apple\Apple Application Support\libxml2.dll
2016-09-01 18:12 - 2016-09-01 18:12 - 00092472 _____ () C:\Program Files\Common Files\Apple\Apple Application Support\zlib1.dll
2016-11-15 02:08 - 2016-11-15 02:08 - 00959168 _____ () C:\Users\JB\AppData\Local\Microsoft\OneDrive\17.3.6390.0509_1\amd64\ClientTelemetry.dll
2016-11-15 02:46 - 2017-05-14 05:21 - 08931008 _____ () C:\Program Files (x86)\Microsoft Office\root\VFS\ProgramFilesX64\Microsoft Office\Office16\1033\GrooveIntlResource.dll
2017-02-09 21:38 - 2016-04-14 19:38 - 00745984 _____ () C:\Program Files\Malwarebytes\Anti-Ransomware\QtQuick\Controls\qtquickcontrolsplugin.dll
2017-05-09 03:05 - 2017-05-09 03:05 - 01354040 _____ () C:\Program Files\iTunes\libxml2.dll
2017-05-09 03:05 - 2017-05-09 03:05 - 00092472 _____ () C:\Program Files\iTunes\zlib1.dll
2015-05-28 16:37 - 2009-07-02 16:58 - 00406016 _____ () C:\Program Files (x86)\Hewlett-Packard\HP Desktop Keyboard\Keystatus.exe
2014-06-10 23:19 - 2014-06-10 23:19 - 00622080 _____ () C:\windows\system32\spool\DRIVERS\x64\3\JobCapsA.DLL
2016-06-28 01:19 - 2016-06-28 01:19 - 00865232 _____ () C:\Program Files (x86)\Kaspersky Lab\Kaspersky Small Office Security 17.0.0\kpcengine.2.3.dll
2015-08-14 02:22 - 2015-08-14 02:22 - 00270336 _____ () C:\Program Files (x86)\ATT\8.5.0.48\ma\node_modules\motive-osbridge\build\Release\MotiveOSBridgeNodeModule.node
2015-08-14 02:22 - 2015-08-14 02:22 - 00244736 _____ () C:\Program Files (x86)\ATT\8.5.0.48\ma\node_modules\motive-activex-wrapper\build\Release\NodeActiveXWrapper.node
2013-04-24 08:55 - 2013-04-24 08:55 - 01581056 _____ () C:\Program Files (x86)\ATT\8.5.0.48\ma\node_modules\libxmljs\build\Release\xmljs.node
2015-08-14 02:21 - 2015-08-14 02:21 - 00237056 _____ () C:\Program Files (x86)\ATT\8.5.0.48\ma\node_modules\motive-xmpps\build\Release\MotiveXMPPSNode.node
2014-08-13 12:54 - 2014-08-13 12:54 - 01241560 _____ () C:\Program Files (x86)\Intel\Intel® Management Engine Components\LMS\ACE.dll
2017-04-25 12:14 - 2017-04-25 12:14 - 00630784 _____ () C:\Program Files (x86)\Intuit\QuickBooks 2015\boost_regex-vc120-mt-1_55.dll
2017-04-25 16:35 - 2017-04-25 16:35 - 00031512 _____ () C:\Program Files (x86)\Intuit\QuickBooks 2015\QBCompressor.dll
2014-12-06 20:14 - 2014-12-06 20:14 - 00059904 _____ () C:\Program Files (x86)\Intuit\QuickBooks 2015\zlib1.dll
2017-04-25 16:35 - 2017-04-25 16:35 - 00102168 _____ () C:\Program Files (x86)\Intuit\QuickBooks 2015\QBMAPILibrary.dll
2017-04-25 16:34 - 2017-04-25 16:34 - 00245528 _____ () C:\Program Files (x86)\Intuit\QuickBooks 2015\boost_serialization-vc120-mt-1_55.dll
2017-04-25 16:35 - 2017-04-25 16:35 - 00662808 _____ () C:\Program Files (x86)\Intuit\QuickBooks 2015\FtuEngine.dll
2017-04-25 16:34 - 2017-04-25 16:34 - 00689432 _____ () C:\Program Files (x86)\Intuit\QuickBooks 2015\BackupLib.dll
2017-04-25 16:36 - 2017-04-25 16:36 - 00085784 _____ () C:\Program Files (x86)\Intuit\QuickBooks 2015\QBProActiveCore.dll
2014-12-06 20:11 - 2014-12-06 20:11 - 38715904 _____ () C:\Program Files (x86)\Intuit\QuickBooks 2015\libcef.dll
2017-04-25 16:35 - 2017-04-25 16:35 - 01215768 _____ () C:\Program Files (x86)\Intuit\QuickBooks 2015\FeaturesBridge.dll
2017-04-25 16:35 - 2017-04-25 16:35 - 00067864 _____ () C:\Program Files (x86)\Intuit\QuickBooks 2015\mbpopup.dll
2017-05-20 19:38 - 2014-09-28 17:59 - 00019872 _____ () C:\Program Files (x86)\Samsung\Samsung Magician\SAMSUNG_SSD.dll
2015-05-28 16:38 - 2013-08-05 02:49 - 00627672 _____ () c:\Program Files (x86)\CyberLink\Power2Go8\CLMediaLibrary.dll
2013-08-05 17:48 - 2013-08-05 17:48 - 00016856 _____ () c:\Program Files (x86)\CyberLink\Power2Go8\CLMLSvcPS.dll
2016-11-15 02:08 - 2016-11-15 02:08 - 00679624 _____ () C:\Users\JB\AppData\Local\Microsoft\OneDrive\17.3.6390.0509_1\ClientTelemetry.dll
2017-05-09 15:47 - 2017-05-09 15:47 - 19700728 _____ () C:\windows\SysWOW64\Macromed\Flash\NPSWF32_25_0_0_171.dll

==================== Alternate Data Streams (Whitelisted) =========

(If an entry is included in the fixlist, only the ADS will be removed.)

==================== Safe Mode (Whitelisted) ===================

(If an entry is included in the fixlist, it will be removed from the registry. The "AlternateShell" will be restored.)

HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\MBAMService => ""="Service"
HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\mcpltsvc => ""=""
HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\MBAMService => ""="Service"
HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\mcpltsvc => ""=""

==================== Association (Whitelisted) ===============

(If an entry is included in the fixlist, the registry item will be restored to default or removed.)

==================== Internet Explorer trusted/restricted ===============

(If an entry is included in the fixlist, it will be removed from the registry.)

==================== Hosts content: ===============================

(If needed Hosts: directive could be included in the fixlist to reset Hosts.)

2009-07-13 21:34 - 2009-06-10 16:00 - 00000824 _____ C:\windows\system32\Drivers\etc\hosts

==================== Other Areas ============================

(Currently there is no automatic fix for this section.)

HKU\S-1-5-21-2577112198-3913129868-2286876578-1000\Control Panel\Desktop\\Wallpaper -> C:\Users\JB\AppData\Roaming\Microsoft\Windows\Themes\TranscodedWallpaper.jpg
DNS Servers: 192.168.7.254
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System => (ConsentPromptBehaviorAdmin: 5) (ConsentPromptBehaviorUser: 3) (EnableLUA: 1)
Windows Firewall is enabled.

==================== MSCONFIG/TASK MANAGER disabled items ==

==================== FirewallRules (Whitelisted) ===============

(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)

FirewallRules: [SPPSVC-In-TCP] => (Allow) %SystemRoot%\system32\sppsvc.exe
FirewallRules: [SPPSVC-In-TCP-NoScope] => (Allow) %SystemRoot%\system32\sppsvc.exe
FirewallRules: [{2C988C32-00EC-4F1A-9639-6CC7CC0F1196}] => (Allow) C:\Program Files\Bonjour\mDNSResponder.exe
FirewallRules: [{7EACA4E1-C82D-4D33-8CCE-C09CCB3C9096}] => (Allow) C:\Program Files\Bonjour\mDNSResponder.exe
FirewallRules: [{28C972C6-7FE5-4E36-AC49-9C658090833E}] => (Allow) C:\Program Files (x86)\Bonjour\mDNSResponder.exe
FirewallRules: [{B6E125F7-74A1-4486-AA09-26A2662D359A}] => (Allow) C:\Program Files (x86)\Bonjour\mDNSResponder.exe
FirewallRules: [{07B06AB4-522B-4C4F-B99D-9DE5873EDB03}] => (Allow) C:\Users\JB\AppData\Local\Temp\7zS16D5\HPDiagnosticCoreUI.exe
FirewallRules: [{78A2AA77-A970-43C6-98D7-C6C6D5659933}] => (Allow) C:\Users\JB\AppData\Local\Temp\7zS16D5\HPDiagnosticCoreUI.exe
FirewallRules: [{9077B2AE-2F18-4FB7-B757-AE122B015C53}] => (Allow) C:\Users\JB\AppData\Local\Temp\7zS18B2\HPDiagnosticCoreUI.exe
FirewallRules: [{88571F9F-D999-4DEA-B108-F9DF772450A7}] => (Allow) C:\Users\JB\AppData\Local\Temp\7zS18B2\HPDiagnosticCoreUI.exe
FirewallRules: [{1EBE8CAC-1668-492A-A813-28BE308F18DE}] => (Allow) C:\Program Files (x86)\Skype\Phone\Skype.exe
FirewallRules: [{D1A4495C-9B7C-4F59-BEF5-CF6CD90ED7C0}] => (Allow) C:\Program Files (x86)\Mozilla Firefox\firefox.exe
FirewallRules: [{5398916D-4F4E-4F74-B33B-711227F5C364}] => (Allow) C:\Program Files (x86)\Mozilla Firefox\firefox.exe
FirewallRules: [{F4B94CE2-A930-42A5-BD2B-140F04F736A0}] => (Allow) C:\Program Files (x86)\Mozilla Firefox\firefox.exe
FirewallRules: [{B6CD4BCB-5184-47C8-9B8E-8FD1EBF25EAA}] => (Allow) C:\Program Files (x86)\Mozilla Firefox\firefox.exe
FirewallRules: [{7A27F99D-B365-4AF9-A185-58ED93305AC1}] => (Allow) C:\Users\JB\AppData\Local\Temp\7zS2790\HPDiagnosticCoreUI.exe
FirewallRules: [{9E94AFF2-4632-42D9-8000-DCCE635A8EE7}] => (Allow) C:\Users\JB\AppData\Local\Temp\7zS2790\HPDiagnosticCoreUI.exe
FirewallRules: [{BC856DA0-34DF-48E9-9334-EDF9B9ED8258}] => (Allow) C:\Users\JB\AppData\Local\Temp\7zS27D8\HPDiagnosticCoreUI.exe
FirewallRules: [{A1038E70-2382-419D-9D8D-87CF1A1806A0}] => (Allow) C:\Users\JB\AppData\Local\Temp\7zS27D8\HPDiagnosticCoreUI.exe
FirewallRules: [{44A3F013-F920-4448-86CE-41B358FC2138}] => (Allow) C:\Users\JB\AppData\Local\Temp\7zS27A4\HPDiagnosticCoreUI.exe
FirewallRules: [{BADF1A0F-BBDF-4F91-895F-184DC93E6A3A}] => (Allow) C:\Users\JB\AppData\Local\Temp\7zS27A4\HPDiagnosticCoreUI.exe
FirewallRules: [{92652BF0-8A8A-49C6-A477-E349AD1C697F}] => (Allow) C:\Users\JB\AppData\Local\Temp\7zS2977\HPDiagnosticCoreUI.exe
FirewallRules: [{541920F7-9E3C-4240-93A5-2E9EB4EB3DDF}] => (Allow) C:\Users\JB\AppData\Local\Temp\7zS2977\HPDiagnosticCoreUI.exe
FirewallRules: [{5E9D6667-1689-46CE-9570-7CA0B0DE6A06}] => (Allow) C:\Program Files\Bonjour\mDNSResponder.exe
FirewallRules: [{4AB5FD05-8EE6-47FB-A477-B1089FD15124}] => (Allow) C:\Program Files\Bonjour\mDNSResponder.exe
FirewallRules: [{399A9869-E2CE-4176-8AA9-7A39B9055442}] => (Allow) C:\Program Files (x86)\Bonjour\mDNSResponder.exe
FirewallRules: [{B1543180-C933-4FFD-BF8E-9A33EB13AE14}] => (Allow) C:\Program Files (x86)\Bonjour\mDNSResponder.exe
FirewallRules: [{88D60679-EACF-4B70-882A-330A9B3BB57A}] => (Allow) C:\Users\JB\AppData\Local\Temp\7zS3DD2\HPDiagnosticCoreUI.exe
FirewallRules: [{633FA523-67CC-4FA3-B869-D090138C3265}] => (Allow) C:\Users\JB\AppData\Local\Temp\7zS3DD2\HPDiagnosticCoreUI.exe
FirewallRules: [{405C44A0-E411-46C2-AAFC-CC1F60B57B9B}] => (Allow) C:\Users\JB\AppData\Local\Temp\7zS3DFC\HPDiagnosticCoreUI.exe
FirewallRules: [{832B3613-2108-46B5-921B-1036F32016C6}] => (Allow) C:\Users\JB\AppData\Local\Temp\7zS3DFC\HPDiagnosticCoreUI.exe
FirewallRules: [{9DB2E288-D457-4FB1-B9B0-1354E8C6D2BA}] => (Allow) C:\Users\JB\AppData\Local\Temp\7zS2E35\HPDiagnosticCoreUI.exe
FirewallRules: [{D357794E-00DA-4B04-BE5F-AF1981ECB3B7}] => (Allow) C:\Users\JB\AppData\Local\Temp\7zS2E35\HPDiagnosticCoreUI.exe
FirewallRules: [{DEBC548D-0847-48F6-8034-07A8BE5D0D9A}] => (Allow) C:\Program Files\HP\HP Officejet Pro 8610\bin\FaxApplications.exe
FirewallRules: [{6508F4F0-D267-43DB-B409-D70A11FA192B}] => (Allow) C:\Program Files\HP\HP Officejet Pro 8610\bin\DigitalWizards.exe
FirewallRules: [{6A197DB2-B423-46AE-9740-4514C5C63093}] => (Allow) C:\Program Files\HP\HP Officejet Pro 8610\bin\SendAFax.exe
FirewallRules: [{35583826-B351-47E1-98C0-A7CCB22139F0}] => (Allow) C:\Program Files\HP\HP Officejet Pro 8610\Bin\DeviceSetup.exe
FirewallRules: [{0639805A-65B3-4BDE-A5D0-EBE181BF0870}] => (Allow) LPort=5357
FirewallRules: [{B6718541-226D-4DEB-9B7F-65FA76EA8326}] => (Allow) C:\Program Files\HP\HP Officejet Pro 8610\Bin\HPNetworkCommunicatorCom.exe
FirewallRules: [{0FBA7B3E-430D-4D27-90DF-DD0D9FCAD5A7}] => (Allow) C:\Program Files\7-Zip\7zFM.exe
FirewallRules: [{4935DE51-04F7-4CF0-8B72-3F7081212DD1}] => (Allow) C:\Program Files\7-Zip\7zFM.exe
FirewallRules: [{4E32449E-5E61-4FD8-B686-F071C71C6305}] => (Allow) C:\Program Files\7-Zip\7zFM.exe
FirewallRules: [{86BF4AC3-5991-43C5-AA34-9B2257CB50CA}] => (Allow) C:\Program Files\7-Zip\7zFM.exe
FirewallRules: [{2C310989-659B-4DC4-8DB3-5D6A49419C6F}] => (Allow) LPort=1935
FirewallRules: [{74EB24B3-A2A4-4FFB-9E20-09A8F78D6FBA}] => (Allow) C:\Program Files (x86)\Microsoft Office\root\Office16\outlook.exe
FirewallRules: [{203B6147-41C1-4DBC-A046-D2DEACE2A022}] => (Allow) C:\Program Files\iTunes\iTunes.exe

==================== Restore Points =========================

==================== Faulty Device Manager Devices =============

Name: Network Controller
Description: Network Controller
Class Guid:
Manufacturer:
Service:
Problem: : The drivers for this device are not installed. (Code 28)
Resolution: To install the drivers for this device, click "Update Driver", which starts the Hardware Update wizard.

==================== Event log errors: =========================

Application errors:
==================
Error: (05/25/2017 12:09:21 PM) (Source: Application Hang) (EventID: 1002) (User: )
Description: The program iexplore.exe version 11.0.9600.18666 stopped interacting with Windows and was closed. To see if more information about the problem is available, check the problem history in the Action Center control panel.

Process ID: cf4

Start Time: 01d2d579922d335d

Termination Time: 0

Application Path: C:\Program Files\Internet Explorer\iexplore.exe

Report Id:

Error: (05/25/2017 12:01:19 PM) (Source: Application Hang) (EventID: 1002) (User: )
Description: The program iexplore.exe version 11.0.9600.18666 stopped interacting with Windows and was closed. To see if more information about the problem is available, check the problem history in the Action Center control panel.

Process ID: 1a70

Start Time: 01d2d5785e52e03a

Termination Time: 15

Application Path: C:\Program Files\Internet Explorer\iexplore.exe

Report Id:

Error: (05/25/2017 11:42:23 AM) (Source: System Restore) (EventID: 8193) (User: )
Description: Failed to create restore point (Process = C:\windows\system32\rundll32.exe /d srrstr.dll,ExecuteScheduledSPPCreation; Description = Scheduled Checkpoint; Error = 0x80070422).

Error: (05/24/2017 08:29:01 PM) (Source: Application Hang) (EventID: 1002) (User: )
Description: The program iexplore.exe version 11.0.9600.18666 stopped interacting with Windows and was closed. To see if more information about the problem is available, check the problem history in the Action Center control panel.

Process ID: 1684

Start Time: 01d2d4f3ac319455

Termination Time: 2

Application Path: C:\Program Files\Internet Explorer\iexplore.exe

Report Id:

Error: (05/24/2017 08:08:39 PM) (Source: Windows Search Service) (EventID: 3083) (User: )
Description: The protocol handler OneIndex16 cannot be loaded. Error description: (HRESULT : 0x800700c1).

Error: (05/24/2017 04:09:28 PM) (Source: System Restore) (EventID: 8193) (User: )
Description: Failed to create restore point (Process = C:\windows\system32\rundll32.exe /d srrstr.dll,ExecuteScheduledSPPCreation; Description = Scheduled Checkpoint; Error = 0x80070422).

Error: (05/23/2017 09:30:07 PM) (Source: System Restore) (EventID: 8193) (User: )
Description: Failed to create restore point (Process = C:\windows\system32\rundll32.exe /d srrstr.dll,ExecuteScheduledSPPCreation; Description = Scheduled Checkpoint; Error = 0x80070422).

Error: (05/23/2017 02:09:45 PM) (Source: System Restore) (EventID: 8193) (User: )
Description: Failed to create restore point (Process = C:\windows\system32\svchost.exe -k netsvcs; Description = Windows Update; Error = 0x80070422).

Error: (05/23/2017 02:09:18 PM) (Source: Application Hang) (EventID: 1002) (User: )
Description: The program iexplore.exe version 11.0.9600.18666 stopped interacting with Windows and was closed. To see if more information about the problem is available, check the problem history in the Action Center control panel.

Process ID: 3b0

Start Time: 01d2d3f7e87cd317

Termination Time: 13

Application Path: C:\Program Files\Internet Explorer\iexplore.exe

Report Id:

Error: (05/23/2017 02:07:48 PM) (Source: Application Hang) (EventID: 1002) (User: )
Description: The program iexplore.exe version 11.0.9600.18666 stopped interacting with Windows and was closed. To see if more information about the problem is available, check the problem history in the Action Center control panel.

Process ID: 1aac

Start Time: 01d2d3ef55504911

Termination Time: 8

Application Path: C:\Program Files\Internet Explorer\iexplore.exe

Report Id:

System errors:
=============
Error: (05/24/2017 07:18:38 PM) (Source: Service Control Manager) (EventID: 7034) (User: )
Description: The Adobe Acrobat Update Service service terminated unexpectedly. It has done this 1 time(s).

Error: (05/24/2017 05:03:37 PM) (Source: EventLog) (EventID: 6008) (User: )
Description: The previous system shutdown at 5:02:07 PM on ‎5/‎24/‎2017 was unexpected.

Error: (05/24/2017 04:21:25 PM) (Source: Service Control Manager) (EventID: 7000) (User: )
Description: The Microsoft Office Click-to-Run Service service failed to start due to the following error:
The service did not respond to the start or control request in a timely fashion.

Error: (05/24/2017 04:21:25 PM) (Source: Service Control Manager) (EventID: 7009) (User: )
Description: A timeout was reached (30000 milliseconds) while waiting for the Microsoft Office Click-to-Run Service service to connect.

Error: (05/24/2017 04:20:55 PM) (Source: Service Control Manager) (EventID: 7031) (User: )
Description: The Microsoft Office Click-to-Run Service service terminated unexpectedly. It has done this 1 time(s). The following corrective action will be taken in 0 milliseconds: Restart the service.

Error: (05/24/2017 04:20:55 PM) (Source: Service Control Manager) (EventID: 7031) (User: )
Description: The Bluetooth Service service terminated unexpectedly. It has done this 1 time(s). The following corrective action will be taken in 60000 milliseconds: Restart the service.

Error: (05/24/2017 04:20:55 PM) (Source: Service Control Manager) (EventID: 7034) (User: )
Description: The Bonjour Service service terminated unexpectedly. It has done this 1 time(s).

Error: (05/24/2017 04:20:55 PM) (Source: Service Control Manager) (EventID: 7031) (User: )
Description: The AT&T Troubleshoot & Resolve service terminated unexpectedly. It has done this 1 time(s). The following corrective action will be taken in 1000 milliseconds: Restart the service.

Error: (05/24/2017 04:20:55 PM) (Source: Service Control Manager) (EventID: 7031) (User: )
Description: The Apple Mobile Device Service service terminated unexpectedly. It has done this 1 time(s). The following corrective action will be taken in 60000 milliseconds: Restart the service.

Error: (05/24/2017 04:20:55 PM) (Source: Service Control Manager) (EventID: 7034) (User: )
Description: The Adobe Acrobat Update Service service terminated unexpectedly. It has done this 1 time(s).

==================== Memory info ===========================

Processor: Intel® Core™ i3-4170 CPU @ 3.70GHz
Percentage of memory in use: 17%
Total physical RAM: 16288.05 MB
Available physical RAM: 13369.28 MB
Total Virtual: 32574.29 MB
Available Virtual: 29169.95 MB

==================== Drives ================================

Drive c: (OS) (Fixed) (Total:476.71 GB) (Free:299.93 GB) NTFS ==>[system with boot components (obtained from drive)]

==================== MBR & Partition Table ==================

========================================================
Disk: 0 (Size: 476.9 GB) (Disk ID: 509A7961)

Partition: GPT.

==================== End of Addition.txt ============================

Attached Thumbnails

#11
zep516

Posted 25 May 2017 - 03:30 PM

Trusted Helper

Malware Removal
8,093 posts

Hello,

The interesting thing is MBAM, KAS and MBAM Expolit never popped up as attempting to block these websites when this happened...

Yes. That is strange.

Looks like the fix never ran the first time, lets run it again followed by an adware scan.

NOTICE: This script was written specifically for this user, for use on that particular machine. Running this on another machine may cause damage to your operating system
Open notepad (Start =>All Programs => Accessories => Notepad).
Copy/Paste the contents of the code box below into Notepad.

start
CloseProcesses:
CreateRestorePoint:
HKLM-x32\...\Run: [] => [X]
ShellIconOverlayIdentifiers: [00avast] -> {472083B0-C522-11CF-8763-00608CC02F24} =>  -> No File
GroupPolicyScripts: Restriction <======= ATTENTION
SearchScopes: HKLM -> {C7F7AD88-4278-45CA-B849-F7365ABA9E62} URL = hxxp://www.amazon.com/s/ref=azs_osd_iea?ie=UTF-8&tag=hp-us1-vsb-20&link%5Fcode=qs&index=aps&field-keywords={searchTerms}
SearchScopes: HKLM-x32 -> {C7F7AD88-4278-45CA-B849-F7365ABA9E62} URL = hxxp://www.amazon.com/s/ref=azs_osd_iea?ie=UTF-8&tag=hp-us1-vsb-20&link%5Fcode=qs&index=aps&field-keywords={searchTerms}
Toolbar: HKU\S-1-5-21-2577112198-3913129868-2286876578-1000 -> No Name - {001032CB-B0AC-4F2C-A650-AD4B2B26E5DA} -  No File
U0 aswVmm; no ImagePath
S3 BCM42RLY; system32\drivers\BCM42RLY.sys [X]
S3 BCM43XX; system32\DRIVERS\bcmwl664.sys [X]
S3 MREMPR5; \??\C:\PROGRA~1\COMMON~1\Motive\MREMPR5.SYS [X]
S3 MRENDIS5; \??\C:\PROGRA~1\COMMON~1\Motive\MRENDIS5.SYS [X]
S3 RSUSBSTOR; \SystemRoot\System32\Drivers\RtsUStor.sys [X]
CMD: bitsadmin /reset /allusers
CMD: netsh winsock reset catalog
CMD: ipconfig /flushdns
RemoveProxy:
hosts:
Emptytemp:

Click Format and ensure Wordwrap is unchecked.
Save as Fixlist.txt to your Desktop (Must be in this location)
Run FRST/FRST64 and press the Fix button just once and wait.
If the tool needed a restart please make sure you let the system to restart normally and let the tool completes its run after restart.
The tool will make a log on the Desktop (Fixlog.txt). Please post it to your reply.
Note: If the tool warns you about the version you're using being an outdated version please download and run the updated version.

Next

Download AdwCleaner from here. Save the file to the desktop.
NOTE: If you are using IE 8 or above you may get a warning that stops the program from downloading. Just click on the warning and allow the download to complete.
Close all open windows and browsers.
- XP users: Double click the AdwCleaner icon to start the program.
- Vista/7/8 users: Right click the AdwCleaner icon on the desktop, click Run as administrator and accept the UAC prompt to run AdwCleaner.
  You will see the following console:
- Click the Scan button and wait for the scan to finish.
- After the Scan has finished the window may or may not show what it found and above, in the progress bar, you will see: Pending. Please uncheck elements you don't want to remove.
- Click the Clean button.
- Everything checked will be moved to Quarantine.
- When the program has finished cleaning a report appears.Once done it will ask to reboot, allow this
- On reboot a log will be produced please copy / paste that in your next reply. This report is also saved to C:\AdwCleaner\AdwCleaner[C0].txt

#12
shorthaul99

Posted 25 May 2017 - 04:12 PM

Member

Topic Starter
Member
133 posts

It did the exact same thing it did yesterday and locked up for 45 mins after trying to apply the FixList and I had to reboot manually. After reboot, I skipped that and downloaded the ADW cleaner and ran it and it said no threats found but now the computer running much slower...

#13
zep516

Posted 25 May 2017 - 04:20 PM

Trusted Helper

Malware Removal
8,093 posts

Strange happenings with this computer, Delete FRST from the desktop, redownload FRST and run the fix again.

EDIT--> I see your computer is having issue creating a restore point, this maybe the problem in the fix as we do attempt to create a restore point. I also see Internet explorer is crashing perhaps resetting it may help.

#14
shorthaul99

Posted 25 May 2017 - 05:23 PM

Member

Topic Starter
Member
133 posts

I didn't catch the EDIT section of your last post until now. I tried twice to run the fix in normal mode and it crashed both times and so I finally ran it in safe mode and here is the log:

Fix result of Farbar Recovery Scan Tool (x64) Version: 24-05-2017
Ran by JB (25-05-2017 18:17:23) Run:15
Running from C:\Users\JB\Desktop
Loaded Profiles: JB (Available Profiles: JB)
Boot Mode: Safe Mode (with Networking)
==============================================

fixlist content:
*****************
start
CloseProcesses:
CreateRestorePoint:
HKLM-x32\...\Run: [] => [X]
ShellIconOverlayIdentifiers: [00avast] -> {472083B0-C522-11CF-8763-00608CC02F24} => -> No File
GroupPolicyScripts: Restriction <======= ATTENTION
SearchScopes: HKLM -> {C7F7AD88-4278-45CA-B849-F7365ABA9E62} URL = hxxp://www.amazon.com/s/ref=azs_osd_iea?ie=UTF-8&tag=hp-us1-vsb-20&link%5Fcode=qs&index=aps&field-keywords={searchTerms}
SearchScopes: HKLM-x32 -> {C7F7AD88-4278-45CA-B849-F7365ABA9E62} URL = hxxp://www.amazon.com/s/ref=azs_osd_iea?ie=UTF-8&tag=hp-us1-vsb-20&link%5Fcode=qs&index=aps&field-keywords={searchTerms}
Toolbar: HKU\S-1-5-21-2577112198-3913129868-2286876578-1000 -> No Name - {001032CB-B0AC-4F2C-A650-AD4B2B26E5DA} - No File
U0 aswVmm; no ImagePath
S3 BCM42RLY; system32\drivers\BCM42RLY.sys [X]
S3 BCM43XX; system32\DRIVERS\bcmwl664.sys [X]
S3 MREMPR5; \??\C:\PROGRA~1\COMMON~1\Motive\MREMPR5.SYS [X]
S3 MRENDIS5; \??\C:\PROGRA~1\COMMON~1\Motive\MRENDIS5.SYS [X]
S3 RSUSBSTOR; \SystemRoot\System32\Drivers\RtsUStor.sys [X]
CMD: bitsadmin /reset /allusers
CMD: netsh winsock reset catalog
CMD: ipconfig /flushdns
RemoveProxy:
hosts:
Emptytemp:
*****************

Processes closed successfully.
Error: Restore point can only be created in normal mode.
HKLM\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\\ => value removed successfully
HKLM\Software\Microsoft\Windows\CurrentVersion\Explorer\ShellIconOverlayIdentifiers\00avast => key removed successfully
HKCR\CLSID\{472083B0-C522-11CF-8763-00608CC02F24} => key not found.
C:\windows\system32\GroupPolicy\Machine => moved successfully
C:\windows\system32\GroupPolicy\GPT.ini => moved successfully
HKLM\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{C7F7AD88-4278-45CA-B849-F7365ABA9E62} => key removed successfully
HKCR\CLSID\{C7F7AD88-4278-45CA-B849-F7365ABA9E62} => key not found.
HKLM\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\SearchScopes\{C7F7AD88-4278-45CA-B849-F7365ABA9E62} => key removed successfully
HKCR\Wow6432Node\CLSID\{C7F7AD88-4278-45CA-B849-F7365ABA9E62} => key not found.
HKU\S-1-5-21-2577112198-3913129868-2286876578-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser\\{001032CB-B0AC-4F2C-A650-AD4B2B26E5DA} => value removed successfully
HKCR\CLSID\{001032CB-B0AC-4F2C-A650-AD4B2B26E5DA} => key not found.
HKLM\System\CurrentControlSet\Services\aswVmm => key removed successfully
aswVmm => service removed successfully
HKLM\System\CurrentControlSet\Services\BCM42RLY => key removed successfully
BCM42RLY => service removed successfully
HKLM\System\CurrentControlSet\Services\BCM43XX => key removed successfully
BCM43XX => service removed successfully
HKLM\System\CurrentControlSet\Services\MREMPR5 => key removed successfully
MREMPR5 => service removed successfully
HKLM\System\CurrentControlSet\Services\MRENDIS5 => key removed successfully
MRENDIS5 => service removed successfully
HKLM\System\CurrentControlSet\Services\RSUSBSTOR => key removed successfully
RSUSBSTOR => service removed successfully

========= bitsadmin /reset /allusers =========

BITSADMIN version 3.0 [ 7.5.7601 ]
BITS administration utility.
© Copyright 2000-2006 Microsoft Corp.

BITSAdmin is deprecated and is not guaranteed to be available in future versions of Windows.
Administrative tools for the BITS service are now provided by BITS PowerShell cmdlets.

Unable to connect to BITS - 0x8007042c
The dependency service or group failed to start.

========= End of CMD: =========

========= netsh winsock reset catalog =========

Sucessfully reset the Winsock Catalog.
You must restart the computer in order to complete the reset.

========= End of CMD: =========

========= ipconfig /flushdns =========

Windows IP Configuration

Successfully flushed the DNS Resolver Cache.

========= End of CMD: =========

========= RemoveProxy: =========

HKU\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\\DefaultConnectionSettings => value removed successfully
HKU\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\\SavedLegacySettings => value removed successfully
HKU\S-1-5-21-2577112198-3913129868-2286876578-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\\DefaultConnectionSettings => value removed successfully
HKU\S-1-5-21-2577112198-3913129868-2286876578-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\\SavedLegacySettings => value removed successfully

========= End of RemoveProxy: =========

C:\Windows\System32\Drivers\etc\hosts => moved successfully
Hosts restored successfully.

=========== EmptyTemp: ==========

BITS transfer queue => 0 B
DOMStore, IE Recovery, AppCache, Feeds Cache, Thumbcache, IconCache => 13551515 B
Java, Flash, Steam htmlcache => 506 B
Windows/system/drivers => 1085146 B
Edge => 0 B
Chrome => 0 B
Firefox => 10423419 B
Opera => 0 B

Temp, IE cache, history, cookies, recent:
Users => 0 B
Default => 0 B
Public => 0 B
ProgramData => 0 B
systemprofile => 16802 B
systemprofile32 => 33186 B
LocalService => 0 B
NetworkService => 499126 B
JB => 20736067 B

RecycleBin => 0 B
EmptyTemp: => 44.2 MB temporary data Removed.

================================

The system needed a reboot.

==== End of Fixlog 18:17:25 ====

#15
zep516

Posted 25 May 2017 - 05:27 PM

Trusted Helper

Malware Removal
8,093 posts

I think it might be system restore that messed things up, not sure what's wrong with that just yet.

Lets reset Internet explore since the log error reports shows it's crashing

To do that
https://www.howtogee...fault-settings/

Let me know when that is done.