Jump to content

Welcome to Geeks to Go - Register now for FREE

Geeks To Go is a helpful hub, where thousands of volunteer geeks quickly serve friendly answers and support. Check out the forums and get free advice from the experts. Register now to gain access to all of our features, it's FREE and only takes one minute. Once registered and logged in, you will be able to create topics, post replies to existing threads, give reputation to your fellow members, get your own private messenger, post status updates, manage your profile and so much more.

Create Account How it Works
Photo

MBAMswissarmy.sys is killing me!

mbamswissarmy.sys

  • This topic is locked This topic is locked

#1
dotson98

dotson98

    New Member

  • Member
  • Pip
  • 2 posts

HI all-

 

I've got the MBAM problem.  The PC just won't boot.  It looks like a very common problem.  The only place that seems to be fixing it is here, with the FRST tool.

 

I've downloaded and run it.  I'm hoping someone can give me a hand. -Thank you in advance.

 

Dan

 

------------------------------

 

Scan result of Farbar Recovery Scan Tool (FRST) (x64) Version: 20-08-2017
Ran by SYSTEM on MININT-QLNITRG (21-08-2017 19:05:28)
Running from F:\
Platform: Windows 7 Enterprise Service Pack 1 (X64) Language: English (United States)
Internet Explorer Version 11
Boot Mode: Recovery
Default: ControlSet001
ATTENTION!:=====> If the system is bootable FRST must be run from normal or Safe mode to create a complete log.
 
Tutorial for Farbar Recovery Scan Tool: http://www.geekstogo...very-scan-tool/
 
==================== Registry (Whitelisted) ====================
 
(If an entry is included in the fixlist, the registry item will be restored to default or removed. The file will not be moved.)
 
HKLM\...\Run: [DFEPApplication] => C:\Program Files\Dell\Feature Enhancement Pack\DFEPApplication.exe [6930856 2011-02-15] (Dell Inc.)
HKLM\...\Run: [Apoint] => C:\Program Files\DellTPad\Apoint.exe [592240 2011-01-04] (Alps Electric Co., Ltd.)
HKLM\...\Run: [SysTrayApp] => C:\Program Files\IDT\WDM\sttray64.exe [525312 2011-01-25] (IDT, Inc.)
HKLM\...\Run: [AvgUi] => C:\Program Files (x86)\AVG\Framework\Common\avguirna.exe [239592 2017-08-01] (AVG Technologies CZ, s.r.o.)
HKLM\...\Run: [AVGUI.exe] => C:\Program Files (x86)\AVG\Antivirus\AvLaunch.exe [263232 2017-07-24] (AVG Technologies CZ, s.r.o.)
HKLM\...\Run: [Malwarebytes TrayApp] => C:\PROGRAM FILES\MALWAREBYTES\ANTI-MALWARE\mbamtray.exe [3146704 2017-05-09] (Malwarebytes)
HKLM\...\Run: [IntelPROSet] => C:\Program Files\Common Files\Intel\WirelessCommon\iFrmewrk.exe [4791024 2013-07-17] (Intel® Corporation)
HKLM\...\Run: [nwiz] => C:\Program Files\NVIDIA Corporation\nview\nwiz.exe [1694016 2012-05-10] ()
HKLM-x32\...\Run: [IAStorIcon] => C:\Program Files (x86)\Intel\Intel® Rapid Storage Technology\IAStorIcon.exe [283160 2010-11-05] (Intel Corporation)
HKLM-x32\...\Run: [NUSB3MON] => C:\Program Files (x86)\Renesas Electronics\USB 3.0 Host Controller Driver\Application\nusb3mon.exe [113288 2010-11-17] (Renesas Electronics Corporation)
HKLM-x32\...\Run: [RemoteControl9] => C:\Program Files (x86)\CyberLink\PowerDVD9\PDVD9Serv.exe [87336 2010-10-01] (CyberLink Corp.)
HKLM-x32\...\Run: [PDVD9LanguageShortcut] => C:\Program Files (x86)\CyberLink\PowerDVD9\Language\Language.exe [50472 2010-09-17] (CyberLink Corp.)
HKLM-x32\...\Run: [] => [X]
HKLM-x32\...\Run: [RoxWatchTray] => C:\Program Files (x86)\Common Files\Roxio Shared\OEM\12.0\SharedCOM\RoxWatchTray12OEM.exe [240112 2010-11-25] (Sonic Solutions)
HKLM-x32\...\Run: [Desktop Disc Tool] => C:\Program Files (x86)\Roxio\OEM\Roxio Burn\RoxioBurnLauncher.exe [514544 2010-11-17] ()
HKLM-x32\...\Run: [BCSSync] => C:\Program Files (x86)\Microsoft Office\Office14\BCSSync.exe [91520 2010-03-13] (Microsoft Corporation)
HKLM-x32\...\Run: [APSDaemon] => "C:\Program Files (x86)\Common Files\Apple\Apple Application Support\APSDaemon.exe"
HKLM-x32\...\Run: [BrStsMon00] => C:\Program Files (x86)\Browny02\Brother\BrStMonW.exe [2621440 2010-06-10] (Brother Industries, Ltd.)
Winlogon\Notify\igfxcui: C:\Windows\system32\igfxdev.dll (Intel Corporation)
Winlogon\Notify\spba: C:\Program Files\Common Files\SPBA\homefus2.dll (UPEK Inc.)
AppInit_DLLs: C:\Windows\system32\nvinitx.dll => C:\Windows\system32\nvinitx.dll [184048 2013-12-04] (NVIDIA Corporation)
AppInit_DLLs-x32: C:\Windows\SysWOW64\nvinit.dll => C:\Windows\SysWOW64\nvinit.dll [156256 2013-12-04] (NVIDIA Corporation)
Lsa: [Authentication Packages] msv1_0 wvauth
Startup: C:\Users\Ault\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Dropbox.lnk [2017-08-04]
ShortcutTarget: Dropbox.lnk ->  (No File)
Startup: C:\Users\Ault\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Smart Settings.lnk [2011-06-30]
ShortcutTarget: Smart Settings.lnk -> C:\Program Files\Dell\Feature Enhancement Pack\SmartSettings.exe (Microsoft)
Startup: C:\Users\Default\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\ClearStart.vbs [2011-05-12] ()
Startup: C:\Users\Default\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Smart Settings.lnk [2011-06-30]
ShortcutTarget: Smart Settings.lnk -> C:\Program Files\Dell\Feature Enhancement Pack\SmartSettings.exe (Microsoft)
Startup: C:\Users\Default User\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\ClearStart.vbs [2011-05-12] ()
Startup: C:\Users\Default User\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Smart Settings.lnk [2011-06-30]
ShortcutTarget: Smart Settings.lnk -> C:\Program Files\Dell\Feature Enhancement Pack\SmartSettings.exe (Microsoft)
Startup: C:\Users\NWS\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Smart Settings.lnk [2011-06-30]
ShortcutTarget: Smart Settings.lnk -> C:\Program Files\Dell\Feature Enhancement Pack\SmartSettings.exe (Microsoft)
Startup: C:\Users\UpdatusUser\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Smart Settings.lnk [2011-06-30]
ShortcutTarget: Smart Settings.lnk -> C:\Program Files\Dell\Feature Enhancement Pack\SmartSettings.exe (Microsoft)
GroupPolicyScripts: Restriction <==== ATTENTION
 
==================== Services (Whitelisted) ====================
 
(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)
 
S2 AVG Antivirus; C:\Program Files (x86)\AVG\Antivirus\AVGSvc.exe [264432 2017-07-24] (AVG Technologies CZ, s.r.o.)
S3 avgbIDSAgent; C:\Program Files (x86)\AVG\Antivirus\x64\aswidsagenta.exe [7481648 2017-07-24] (AVG Technologies CZ, s.r.o.)
S2 avgsvc; C:\Program Files (x86)\AVG\Framework\Common\avgsvca.exe [1428656 2017-08-01] (AVG Technologies CZ, s.r.o.)
S2 DFEPService; C:\Program Files\Dell\Feature Enhancement Pack\DFEPService.exe [2269608 2011-02-15] (Dell Inc.)
S2 HPSLPSVC; C:\Users\Ault\AppData\Local\Temp\7zS5799\hpslpsvc64.dll [1039360 2012-08-27] (Hewlett-Packard Co.) <==== ATTENTION
S2 MBAMService; C:\Program Files\Malwarebytes\Anti-Malware\mbamservice.exe [4470736 2017-05-09] (Malwarebytes)
S2 mfevtp; C:\Windows\system32\mfevtps.exe [185280 2014-02-21] (McAfee, Inc.)
S2 O2SDIOAssist; C:\Windows\SysWOW64\srvany.exe [8192 2003-04-18] ()
S2 tcsd_win32.exe; C:\Program Files (x86)\NTRU Cryptosystems\NTRU TCG Software Stack\bin\tcsd_win32.exe [1629696 2010-07-13] ()
S3 WinDefend; C:\Program Files\Windows Defender\mpsvc.dll [1011712 2013-05-26] (Microsoft Corporation)
S2 ZeroConfigService; C:\Program Files\Intel\WiFi\bin\ZeroConfigService.exe [3377904 2013-07-17] (Intel® Corporation)
 
===================== Drivers (Whitelisted) ======================
 
(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)
 
S1 avgbdisk; C:\Windows\system32\drivers\avgbdiska.sys [166624 2017-07-24] (AVG Technologies CZ, s.r.o.)
S1 avgbidsdriver; C:\Windows\system32\drivers\avgbidsdrivera.sys [313616 2017-07-24] (AVG Technologies CZ, s.r.o.)
S0 avgbidsh; C:\Windows\system32\drivers\avgbidsha.sys [192584 2017-07-24] (AVG Technologies CZ, s.r.o.)
S0 avgblog; C:\Windows\system32\drivers\avgbloga.sys [336896 2017-07-24] (AVG Technologies CZ, s.r.o.)
S0 avgbuniv; C:\Windows\system32\drivers\avgbuniva.sys [51336 2017-07-24] (AVG Technologies CZ, s.r.o.)
S3 avgHwid; C:\Windows\system32\drivers\avgHwid.sys [39424 2017-07-24] (AVG Technologies CZ, s.r.o.)
S2 avgMonFlt; C:\Windows\system32\drivers\avgMonFlt.sys [139112 2017-08-09] (AVG Technologies CZ, s.r.o.)
S1 avgRdr; C:\Windows\system32\drivers\avgRdr2.sys [102792 2017-07-24] (AVG Technologies CZ, s.r.o.)
S0 avgRvrt; C:\Windows\system32\drivers\avgRvrt.sys [76832 2017-07-24] (AVG Technologies CZ, s.r.o.)
S1 avgSnx; C:\Windows\system32\drivers\avgSnx.sys [1008288 2017-08-09] (AVG Technologies CZ, s.r.o.)
S1 avgSP; C:\Windows\system32\drivers\avgSP.sys [578048 2017-07-24] (AVG Technologies CZ, s.r.o.)
S2 avgStm; C:\Windows\system32\drivers\avgStm.sys [191208 2017-07-24] (AVG Technologies CZ, s.r.o.)
S0 avgVmm; C:\Windows\system32\drivers\avgVmm.sys [353744 2017-07-24] (AVG Technologies CZ, s.r.o.)
S0 MBAMSwissArmy; C:\Windows\System32\drivers\MBAMSwissArmy.sys [253856 2017-08-10] ()
S0 mfehidk; C:\Windows\System32\drivers\mfehidk.sys [782968 2014-02-21] (McAfee, Inc.)
S0 mfewfpk; C:\Windows\System32\drivers\mfewfpk.sys [344176 2014-02-21] (McAfee, Inc.)
S1 nvkflt; C:\Windows\System32\DRIVERS\nvkflt.sys [300320 2013-12-04] (NVIDIA Corporation)
S3 VNUSB; C:\Windows\System32\Drivers\VNUSB.sys [22528 2009-09-29] (OLYMPUS IMAGING CORP.)
 
==================== NetSvcs (Whitelisted) ===================
 
(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)
 
 
==================== One Month Created files and folders ========
 
(If an entry is included in the fixlist, the file/folder will be moved.)
 
2017-08-21 19:05 - 2017-08-21 19:05 - 000000000 ____D C:\FRST
2017-08-10 10:44 - 2017-08-10 10:44 - 000000000 __SHD C:\found.000
2017-08-09 16:58 - 2017-07-29 06:56 - 000117248 _____ (Microsoft Corporation) C:\Windows\System32\Drivers\tdx.sys
2017-08-09 16:58 - 2017-07-21 06:26 - 000518144 _____ C:\Windows\SysWOW64\msjetoledb40.dll
2017-08-09 16:58 - 2017-07-21 06:26 - 000409600 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msexch40.dll
2017-08-09 16:58 - 2017-07-21 06:26 - 000290816 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msjtes40.dll
2017-08-09 16:58 - 2017-07-21 06:26 - 000282624 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mstext40.dll
2017-08-09 16:58 - 2017-07-15 10:35 - 000394448 _____ (Microsoft Corporation) C:\Windows\System32\iedkcs32.dll
2017-08-09 16:58 - 2017-07-15 09:52 - 000346320 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iedkcs32.dll
2017-08-09 16:58 - 2017-07-14 07:29 - 002319872 _____ (Microsoft Corporation) C:\Windows\System32\tquery.dll
2017-08-09 16:58 - 2017-07-14 07:29 - 002222080 _____ (Microsoft Corporation) C:\Windows\System32\mssrch.dll
2017-08-09 16:58 - 2017-07-14 07:29 - 002058240 _____ (Microsoft Corporation) C:\Windows\System32\Query.dll
2017-08-09 16:58 - 2017-07-14 07:29 - 000778240 _____ (Microsoft Corporation) C:\Windows\System32\mssvp.dll
2017-08-09 16:58 - 2017-07-14 07:29 - 000491520 _____ (Microsoft Corporation) C:\Windows\System32\mssph.dll
2017-08-09 16:58 - 2017-07-14 07:29 - 000486400 _____ (Microsoft Corporation) C:\Windows\System32\wer.dll
2017-08-09 16:58 - 2017-07-14 07:29 - 000288256 _____ (Microsoft Corporation) C:\Windows\System32\mssphtb.dll
2017-08-09 16:58 - 2017-07-14 07:29 - 000115200 _____ (Microsoft Corporation) C:\Windows\System32\mssitlb.dll
2017-08-09 16:58 - 2017-07-14 07:29 - 000099840 _____ (Microsoft Corporation) C:\Windows\System32\mssprxy.dll
2017-08-09 16:58 - 2017-07-14 07:29 - 000075264 _____ (Microsoft Corporation) C:\Windows\System32\msscntrs.dll
2017-08-09 16:58 - 2017-07-14 07:29 - 000034304 _____ (Microsoft Corporation) C:\Windows\System32\werdiagcontroller.dll
2017-08-09 16:58 - 2017-07-14 07:29 - 000014336 _____ (Microsoft Corporation) C:\Windows\System32\msshooks.dll
2017-08-09 16:58 - 2017-07-14 07:12 - 000591872 _____ (Microsoft Corporation) C:\Windows\System32\SearchIndexer.exe
2017-08-09 16:58 - 2017-07-14 07:12 - 000249856 _____ (Microsoft Corporation) C:\Windows\System32\SearchProtocolHost.exe
2017-08-09 16:58 - 2017-07-14 07:11 - 000113664 _____ (Microsoft Corporation) C:\Windows\System32\SearchFilterHost.exe
2017-08-09 16:58 - 2017-07-14 07:10 - 001549824 _____ (Microsoft Corporation) C:\Windows\SysWOW64\tquery.dll
2017-08-09 16:58 - 2017-07-14 07:10 - 001400320 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mssrch.dll
2017-08-09 16:58 - 2017-07-14 07:10 - 001363968 _____ (Microsoft Corporation) C:\Windows\SysWOW64\Query.dll
2017-08-09 16:58 - 2017-07-14 07:10 - 000666624 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mssvp.dll
2017-08-09 16:58 - 2017-07-14 07:10 - 000382976 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wer.dll
2017-08-09 16:58 - 2017-07-14 07:10 - 000337408 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mssph.dll
2017-08-09 16:58 - 2017-07-14 07:10 - 000197120 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mssphtb.dll
2017-08-09 16:58 - 2017-07-14 07:10 - 000104448 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mssitlb.dll
2017-08-09 16:58 - 2017-07-14 07:10 - 000059392 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msscntrs.dll
2017-08-09 16:58 - 2017-07-14 07:10 - 000034816 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mssprxy.dll
2017-08-09 16:58 - 2017-07-14 07:00 - 000427520 _____ (Microsoft Corporation) C:\Windows\SysWOW64\SearchIndexer.exe
2017-08-09 16:58 - 2017-07-14 07:00 - 000164352 _____ (Microsoft Corporation) C:\Windows\SysWOW64\SearchProtocolHost.exe
2017-08-09 16:58 - 2017-07-14 06:59 - 000086528 _____ (Microsoft Corporation) C:\Windows\SysWOW64\SearchFilterHost.exe
2017-08-09 16:58 - 2017-07-14 06:59 - 000009728 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msshooks.dll
2017-08-09 16:58 - 2017-07-14 06:57 - 000050688 _____ (Microsoft Corporation) C:\Windows\System32\wermgr.exe
2017-08-09 16:58 - 2017-07-14 06:50 - 000054272 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wermgr.exe
2017-08-09 16:58 - 2017-07-14 06:50 - 000028672 _____ (Microsoft Corporation) C:\Windows\SysWOW64\werdiagcontroller.dll
2017-08-09 16:58 - 2017-07-13 23:16 - 002724864 _____ (Microsoft Corporation) C:\Windows\System32\mshtml.tlb
2017-08-09 16:58 - 2017-07-13 23:15 - 000004096 _____ (Microsoft Corporation) C:\Windows\System32\ieetwcollectorres.dll
2017-08-09 16:58 - 2017-07-13 22:49 - 025733632 _____ (Microsoft Corporation) C:\Windows\System32\mshtml.dll
2017-08-09 16:58 - 2017-07-13 22:47 - 000066560 _____ (Microsoft Corporation) C:\Windows\System32\iesetup.dll
2017-08-09 16:58 - 2017-07-13 22:45 - 000417792 _____ (Microsoft Corporation) C:\Windows\System32\html.iec
2017-08-09 16:58 - 2017-07-13 22:45 - 000048640 _____ (Microsoft Corporation) C:\Windows\System32\ieetwproxystub.dll
2017-08-09 16:58 - 2017-07-13 22:44 - 000576512 _____ (Microsoft Corporation) C:\Windows\System32\vbscript.dll
2017-08-09 16:58 - 2017-07-13 22:44 - 000088064 _____ (Microsoft Corporation) C:\Windows\System32\MshtmlDac.dll
2017-08-09 16:58 - 2017-07-13 22:38 - 002899456 _____ (Microsoft Corporation) C:\Windows\System32\iertutil.dll
2017-08-09 16:58 - 2017-07-13 22:29 - 000054784 _____ (Microsoft Corporation) C:\Windows\System32\jsproxy.dll
2017-08-09 16:58 - 2017-07-13 22:28 - 000034304 _____ (Microsoft Corporation) C:\Windows\System32\iernonce.dll
2017-08-09 16:58 - 2017-07-13 22:22 - 000615936 _____ (Microsoft Corporation) C:\Windows\System32\ieui.dll
2017-08-09 16:58 - 2017-07-13 22:20 - 000144384 _____ (Microsoft Corporation) C:\Windows\System32\ieUnatt.exe
2017-08-09 16:58 - 2017-07-13 22:20 - 000116224 _____ (Microsoft Corporation) C:\Windows\System32\ieetwcollector.exe
2017-08-09 16:58 - 2017-07-13 22:19 - 000817664 _____ (Microsoft Corporation) C:\Windows\System32\jscript.dll
2017-08-09 16:58 - 2017-07-13 22:19 - 000814080 _____ (Microsoft Corporation) C:\Windows\System32\jscript9diag.dll
2017-08-09 16:58 - 2017-07-13 22:08 - 000968704 _____ (Microsoft Corporation) C:\Windows\System32\MsSpellCheckingFacility.exe
2017-08-09 16:58 - 2017-07-13 22:02 - 000489984 _____ (Microsoft Corporation) C:\Windows\System32\dxtmsft.dll
2017-08-09 16:58 - 2017-07-13 21:49 - 000077824 _____ (Microsoft Corporation) C:\Windows\System32\JavaScriptCollectionAgent.dll
2017-08-09 16:58 - 2017-07-13 21:48 - 000087552 _____ (Microsoft Corporation) C:\Windows\System32\tdc.ocx
2017-08-09 16:58 - 2017-07-13 21:47 - 000107520 _____ (Microsoft Corporation) C:\Windows\System32\inseng.dll
2017-08-09 16:58 - 2017-07-13 21:42 - 000199680 _____ (Microsoft Corporation) C:\Windows\System32\msrating.dll
2017-08-09 16:58 - 2017-07-13 21:40 - 000092160 _____ (Microsoft Corporation) C:\Windows\System32\mshtmled.dll
2017-08-09 16:58 - 2017-07-13 21:35 - 005981184 _____ (Microsoft Corporation) C:\Windows\System32\jscript9.dll
2017-08-09 16:58 - 2017-07-13 21:35 - 000315392 _____ (Microsoft Corporation) C:\Windows\System32\dxtrans.dll
2017-08-09 16:58 - 2017-07-13 21:33 - 000152064 _____ (Microsoft Corporation) C:\Windows\System32\occache.dll
2017-08-09 16:58 - 2017-07-13 21:16 - 000262144 _____ (Microsoft Corporation) C:\Windows\System32\webcheck.dll
2017-08-09 16:58 - 2017-07-13 21:11 - 000725504 _____ (Microsoft Corporation) C:\Windows\System32\ie4uinit.exe
2017-08-09 16:58 - 2017-07-13 21:10 - 000806912 _____ (Microsoft Corporation) C:\Windows\System32\msfeeds.dll
2017-08-09 16:58 - 2017-07-13 21:09 - 002132992 _____ (Microsoft Corporation) C:\Windows\System32\inetcpl.cpl
2017-08-09 16:58 - 2017-07-13 21:09 - 001359360 _____ (Microsoft Corporation) C:\Windows\System32\mshtmlmedia.dll
2017-08-09 16:58 - 2017-07-13 20:40 - 015254016 _____ (Microsoft Corporation) C:\Windows\System32\ieframe.dll
2017-08-09 16:58 - 2017-07-13 20:23 - 003240960 _____ (Microsoft Corporation) C:\Windows\System32\wininet.dll
2017-08-09 16:58 - 2017-07-13 20:07 - 001545728 _____ (Microsoft Corporation) C:\Windows\System32\urlmon.dll
2017-08-09 16:58 - 2017-07-13 19:58 - 000800768 _____ (Microsoft Corporation) C:\Windows\System32\ieapfltr.dll
2017-08-09 16:58 - 2017-07-13 19:01 - 002724864 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.tlb
2017-08-09 16:58 - 2017-07-13 18:54 - 020270080 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.dll
2017-08-09 16:58 - 2017-07-13 18:48 - 000499200 _____ (Microsoft Corporation) C:\Windows\SysWOW64\vbscript.dll
2017-08-09 16:58 - 2017-07-13 18:48 - 000341504 _____ (Microsoft Corporation) C:\Windows\SysWOW64\html.iec
2017-08-09 16:58 - 2017-07-13 18:48 - 000062464 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iesetup.dll
2017-08-09 16:58 - 2017-07-13 18:48 - 000047616 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieetwproxystub.dll
2017-08-09 16:58 - 2017-07-13 18:47 - 000064000 _____ (Microsoft Corporation) C:\Windows\SysWOW64\MshtmlDac.dll
2017-08-09 16:58 - 2017-07-13 18:44 - 002290176 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iertutil.dll
2017-08-09 16:58 - 2017-07-13 18:42 - 000047104 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jsproxy.dll
2017-08-09 16:58 - 2017-07-13 18:41 - 000030720 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iernonce.dll
2017-08-09 16:58 - 2017-07-13 18:39 - 000476160 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieui.dll
2017-08-09 16:58 - 2017-07-13 18:38 - 000663552 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript.dll
2017-08-09 16:58 - 2017-07-13 18:38 - 000620032 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript9diag.dll
2017-08-09 16:58 - 2017-07-13 18:38 - 000115712 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieUnatt.exe
2017-08-09 16:58 - 2017-07-13 18:30 - 000416256 _____ (Microsoft Corporation) C:\Windows\SysWOW64\dxtmsft.dll
2017-08-09 16:58 - 2017-07-13 18:26 - 000060416 _____ (Microsoft Corporation) C:\Windows\SysWOW64\JavaScriptCollectionAgent.dll
2017-08-09 16:58 - 2017-07-13 18:25 - 000091136 _____ (Microsoft Corporation) C:\Windows\SysWOW64\inseng.dll
2017-08-09 16:58 - 2017-07-13 18:25 - 000073216 _____ (Microsoft Corporation) C:\Windows\SysWOW64\tdc.ocx
2017-08-09 16:58 - 2017-07-13 18:23 - 000168960 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msrating.dll
2017-08-09 16:58 - 2017-07-13 18:22 - 000076288 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtmled.dll
2017-08-09 16:58 - 2017-07-13 18:21 - 000279040 _____ (Microsoft Corporation) C:\Windows\SysWOW64\dxtrans.dll
2017-08-09 16:58 - 2017-07-13 18:20 - 000130048 _____ (Microsoft Corporation) C:\Windows\SysWOW64\occache.dll
2017-08-09 16:58 - 2017-07-13 18:17 - 004546048 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript9.dll
2017-08-09 16:58 - 2017-07-13 18:13 - 000230400 _____ (Microsoft Corporation) C:\Windows\SysWOW64\webcheck.dll
2017-08-09 16:58 - 2017-07-13 18:12 - 000693248 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msfeeds.dll
2017-08-09 16:58 - 2017-07-13 18:11 - 002057216 _____ (Microsoft Corporation) C:\Windows\SysWOW64\inetcpl.cpl
2017-08-09 16:58 - 2017-07-13 18:11 - 001155072 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtmlmedia.dll
2017-08-09 16:58 - 2017-07-13 18:09 - 013663744 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieframe.dll
2017-08-09 16:58 - 2017-07-13 17:53 - 002767872 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wininet.dll
2017-08-09 16:58 - 2017-07-13 17:50 - 001314816 _____ (Microsoft Corporation) C:\Windows\SysWOW64\urlmon.dll
2017-08-09 16:58 - 2017-07-13 17:48 - 000710144 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieapfltr.dll
2017-08-09 16:58 - 2017-07-08 07:34 - 000370920 _____ (Microsoft Corporation) C:\Windows\System32\clfs.sys
2017-08-09 16:58 - 2017-07-08 07:00 - 003224064 _____ (Microsoft Corporation) C:\Windows\System32\win32k.sys
2017-08-09 16:58 - 2017-07-07 07:37 - 000631176 _____ (Microsoft Corporation) C:\Windows\System32\winresume.efi
2017-08-09 16:58 - 2017-07-07 07:33 - 005547752 _____ (Microsoft Corporation) C:\Windows\System32\ntoskrnl.exe
2017-08-09 16:58 - 2017-07-07 07:33 - 000706792 _____ (Microsoft Corporation) C:\Windows\System32\winload.efi
2017-08-09 16:58 - 2017-07-07 07:33 - 000363752 _____ (Microsoft Corporation) C:\Windows\System32\Drivers\volmgrx.sys
2017-08-09 16:58 - 2017-07-07 07:33 - 000154856 _____ (Microsoft Corporation) C:\Windows\System32\Drivers\ksecpkg.sys
2017-08-09 16:58 - 2017-07-07 07:33 - 000095464 _____ (Microsoft Corporation) C:\Windows\System32\Drivers\ksecdd.sys
2017-08-09 16:58 - 2017-07-07 07:31 - 001732864 _____ (Microsoft Corporation) C:\Windows\System32\ntdll.dll
2017-08-09 16:58 - 2017-07-07 07:29 - 001460736 _____ (Microsoft Corporation) C:\Windows\System32\lsasrv.dll
2017-08-09 16:58 - 2017-07-07 07:29 - 001212928 _____ (Microsoft Corporation) C:\Windows\System32\rpcrt4.dll
2017-08-09 16:58 - 2017-07-07 07:29 - 001163264 _____ (Microsoft Corporation) C:\Windows\System32\kernel32.dll
2017-08-09 16:58 - 2017-07-07 07:29 - 000880640 _____ (Microsoft Corporation) C:\Windows\System32\advapi32.dll
2017-08-09 16:58 - 2017-07-07 07:29 - 000731648 _____ (Microsoft Corporation) C:\Windows\System32\kerberos.dll
2017-08-09 16:58 - 2017-07-07 07:29 - 000690688 _____ (Microsoft Corporation) C:\Windows\System32\adtschema.dll
2017-08-09 16:58 - 2017-07-07 07:29 - 000503808 _____ (Microsoft Corporation) C:\Windows\System32\srcore.dll
2017-08-09 16:58 - 2017-07-07 07:29 - 000463872 _____ (Microsoft Corporation) C:\Windows\System32\certcli.dll
2017-08-09 16:58 - 2017-07-07 07:29 - 000419840 _____ (Microsoft Corporation) C:\Windows\System32\KernelBase.dll
2017-08-09 16:58 - 2017-07-07 07:29 - 000362496 _____ (Microsoft Corporation) C:\Windows\System32\wow64win.dll
2017-08-09 16:58 - 2017-07-07 07:29 - 000345600 _____ (Microsoft Corporation) C:\Windows\System32\schannel.dll
2017-08-09 16:58 - 2017-07-07 07:29 - 000316928 _____ (Microsoft Corporation) C:\Windows\System32\msv1_0.dll
2017-08-09 16:58 - 2017-07-07 07:29 - 000312320 _____ (Microsoft Corporation) C:\Windows\System32\ncrypt.dll
2017-08-09 16:58 - 2017-07-07 07:29 - 000243712 _____ (Microsoft Corporation) C:\Windows\System32\wow64.dll
2017-08-09 16:58 - 2017-07-07 07:29 - 000215552 _____ (Microsoft Corporation) C:\Windows\System32\winsrv.dll
2017-08-09 16:58 - 2017-07-07 07:29 - 000210432 _____ (Microsoft Corporation) C:\Windows\System32\wdigest.dll
2017-08-09 16:58 - 2017-07-07 07:29 - 000190464 _____ (Microsoft Corporation) C:\Windows\System32\rpchttp.dll
2017-08-09 16:58 - 2017-07-07 07:29 - 000149504 _____ (Microsoft Corporation) C:\Windows\System32\t2embed.dll
2017-08-09 16:58 - 2017-07-07 07:29 - 000146432 _____ (Microsoft Corporation) C:\Windows\System32\msaudite.dll
2017-08-09 16:58 - 2017-07-07 07:29 - 000135680 _____ (Microsoft Corporation) C:\Windows\System32\sspicli.dll
2017-08-09 16:58 - 2017-07-07 07:29 - 000123904 _____ (Microsoft Corporation) C:\Windows\System32\bcrypt.dll
2017-08-09 16:58 - 2017-07-07 07:29 - 000086528 _____ (Microsoft Corporation) C:\Windows\System32\TSpkg.dll
2017-08-09 16:58 - 2017-07-07 07:29 - 000063488 _____ (Microsoft Corporation) C:\Windows\System32\setbcdlocale.dll
2017-08-09 16:58 - 2017-07-07 07:29 - 000060416 _____ (Microsoft Corporation) C:\Windows\System32\msobjs.dll
2017-08-09 16:58 - 2017-07-07 07:29 - 000059904 _____ (Microsoft Corporation) C:\Windows\System32\appidapi.dll
2017-08-09 16:58 - 2017-07-07 07:29 - 000050176 _____ (Microsoft Corporation) C:\Windows\System32\srclient.dll
2017-08-09 16:58 - 2017-07-07 07:29 - 000044032 _____ (Microsoft Corporation) C:\Windows\System32\csrsrv.dll
2017-08-09 16:58 - 2017-07-07 07:29 - 000043520 _____ (Microsoft Corporation) C:\Windows\System32\cryptbase.dll
2017-08-09 16:58 - 2017-07-07 07:29 - 000034816 _____ (Microsoft Corporation) C:\Windows\System32\appidsvc.dll
2017-08-09 16:58 - 2017-07-07 07:29 - 000028672 _____ (Microsoft Corporation) C:\Windows\System32\sspisrv.dll
2017-08-09 16:58 - 2017-07-07 07:29 - 000028160 _____ (Microsoft Corporation) C:\Windows\System32\secur32.dll
2017-08-09 16:58 - 2017-07-07 07:29 - 000022016 _____ (Microsoft Corporation) C:\Windows\System32\credssp.dll
2017-08-09 16:58 - 2017-07-07 07:29 - 000016384 _____ (Microsoft Corporation) C:\Windows\System32\ntvdm64.dll
2017-08-09 16:58 - 2017-07-07 07:29 - 000013312 _____ (Microsoft Corporation) C:\Windows\System32\wow64cpu.dll
2017-08-09 16:58 - 2017-07-07 07:29 - 000006656 _____ (Microsoft Corporation) C:\Windows\System32\apisetschema.dll
2017-08-09 16:58 - 2017-07-07 07:29 - 000006144 ____H (Microsoft Corporation) C:\Windows\System32\api-ms-win-security-base-l1-1-0.dll
2017-08-09 16:58 - 2017-07-07 07:29 - 000005120 ____H (Microsoft Corporation) C:\Windows\System32\api-ms-win-core-file-l1-1-0.dll
2017-08-09 16:58 - 2017-07-07 07:29 - 000004608 ____H (Microsoft Corporation) C:\Windows\System32\api-ms-win-core-threadpool-l1-1-0.dll
2017-08-09 16:58 - 2017-07-07 07:29 - 000004608 ____H (Microsoft Corporation) C:\Windows\System32\api-ms-win-core-processthreads-l1-1-0.dll
2017-08-09 16:58 - 2017-07-07 07:29 - 000004096 ____H (Microsoft Corporation) C:\Windows\System32\api-ms-win-core-sysinfo-l1-1-0.dll
2017-08-09 16:58 - 2017-07-07 07:29 - 000004096 ____H (Microsoft Corporation) C:\Windows\System32\api-ms-win-core-synch-l1-1-0.dll
2017-08-09 16:58 - 2017-07-07 07:29 - 000004096 ____H (Microsoft Corporation) C:\Windows\System32\api-ms-win-core-localregistry-l1-1-0.dll
2017-08-09 16:58 - 2017-07-07 07:29 - 000004096 ____H (Microsoft Corporation) C:\Windows\System32\api-ms-win-core-localization-l1-1-0.dll
2017-08-09 16:58 - 2017-07-07 07:29 - 000003584 ____H (Microsoft Corporation) C:\Windows\System32\api-ms-win-core-rtlsupport-l1-1-0.dll
2017-08-09 16:58 - 2017-07-07 07:29 - 000003584 ____H (Microsoft Corporation) C:\Windows\System32\api-ms-win-core-processenvironment-l1-1-0.dll
2017-08-09 16:58 - 2017-07-07 07:29 - 000003584 ____H (Microsoft Corporation) C:\Windows\System32\api-ms-win-core-namedpipe-l1-1-0.dll
2017-08-09 16:58 - 2017-07-07 07:29 - 000003584 ____H (Microsoft Corporation) C:\Windows\System32\api-ms-win-core-misc-l1-1-0.dll
2017-08-09 16:58 - 2017-07-07 07:29 - 000003584 ____H (Microsoft Corporation) C:\Windows\System32\api-ms-win-core-memory-l1-1-0.dll
2017-08-09 16:58 - 2017-07-07 07:29 - 000003584 ____H (Microsoft Corporation) C:\Windows\System32\api-ms-win-core-libraryloader-l1-1-0.dll
2017-08-09 16:58 - 2017-07-07 07:29 - 000003584 ____H (Microsoft Corporation) C:\Windows\System32\api-ms-win-core-heap-l1-1-0.dll
2017-08-09 16:58 - 2017-07-07 07:29 - 000003072 ____H (Microsoft Corporation) C:\Windows\System32\api-ms-win-core-xstate-l1-1-0.dll
2017-08-09 16:58 - 2017-07-07 07:29 - 000003072 ____H (Microsoft Corporation) C:\Windows\System32\api-ms-win-core-util-l1-1-0.dll
2017-08-09 16:58 - 2017-07-07 07:29 - 000003072 ____H (Microsoft Corporation) C:\Windows\System32\api-ms-win-core-string-l1-1-0.dll
2017-08-09 16:58 - 2017-07-07 07:29 - 000003072 ____H (Microsoft Corporation) C:\Windows\System32\api-ms-win-core-profile-l1-1-0.dll
2017-08-09 16:58 - 2017-07-07 07:29 - 000003072 ____H (Microsoft Corporation) C:\Windows\System32\api-ms-win-core-io-l1-1-0.dll
2017-08-09 16:58 - 2017-07-07 07:29 - 000003072 ____H (Microsoft Corporation) C:\Windows\System32\api-ms-win-core-interlocked-l1-1-0.dll
2017-08-09 16:58 - 2017-07-07 07:29 - 000003072 ____H (Microsoft Corporation) C:\Windows\System32\api-ms-win-core-handle-l1-1-0.dll
2017-08-09 16:58 - 2017-07-07 07:29 - 000003072 ____H (Microsoft Corporation) C:\Windows\System32\api-ms-win-core-fibers-l1-1-0.dll
2017-08-09 16:58 - 2017-07-07 07:29 - 000003072 ____H (Microsoft Corporation) C:\Windows\System32\api-ms-win-core-errorhandling-l1-1-0.dll
2017-08-09 16:58 - 2017-07-07 07:29 - 000003072 ____H (Microsoft Corporation) C:\Windows\System32\api-ms-win-core-delayload-l1-1-0.dll
2017-08-09 16:58 - 2017-07-07 07:29 - 000003072 ____H (Microsoft Corporation) C:\Windows\System32\api-ms-win-core-debug-l1-1-0.dll
2017-08-09 16:58 - 2017-07-07 07:29 - 000003072 ____H (Microsoft Corporation) C:\Windows\System32\api-ms-win-core-datetime-l1-1-0.dll
2017-08-09 16:58 - 2017-07-07 07:29 - 000003072 ____H (Microsoft Corporation) C:\Windows\System32\api-ms-win-core-console-l1-1-0.dll
2017-08-09 16:58 - 2017-07-07 07:15 - 004001000 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ntkrnlpa.exe
2017-08-09 16:58 - 2017-07-07 07:15 - 003945192 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ntoskrnl.exe
2017-08-09 16:58 - 2017-07-07 07:13 - 001314112 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ntdll.dll
2017-08-09 16:58 - 2017-07-07 07:11 - 001114112 _____ (Microsoft Corporation) C:\Windows\SysWOW64\kernel32.dll
2017-08-09 16:58 - 2017-07-07 07:11 - 000666112 _____ (Microsoft Corporation) C:\Windows\SysWOW64\rpcrt4.dll
2017-08-09 16:58 - 2017-07-07 07:11 - 000275456 _____ (Microsoft Corporation) C:\Windows\SysWOW64\KernelBase.dll
2017-08-09 16:58 - 2017-07-07 07:11 - 000261120 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msv1_0.dll
2017-08-09 16:58 - 2017-07-07 07:11 - 000254464 _____ (Microsoft Corporation) C:\Windows\SysWOW64\schannel.dll
2017-08-09 16:58 - 2017-07-07 07:11 - 000223232 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ncrypt.dll
2017-08-09 16:58 - 2017-07-07 07:11 - 000172032 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wdigest.dll
2017-08-09 16:58 - 2017-07-07 07:11 - 000141312 _____ (Microsoft Corporation) C:\Windows\SysWOW64\rpchttp.dll
2017-08-09 16:58 - 2017-07-07 07:11 - 000109568 _____ (Microsoft Corporation) C:\Windows\SysWOW64\t2embed.dll
2017-08-09 16:58 - 2017-07-07 07:11 - 000096768 _____ (Microsoft Corporation) C:\Windows\SysWOW64\sspicli.dll
2017-08-09 16:58 - 2017-07-07 07:11 - 000082944 _____ (Microsoft Corporation) C:\Windows\SysWOW64\bcrypt.dll
2017-08-09 16:58 - 2017-07-07 07:11 - 000065536 _____ (Microsoft Corporation) C:\Windows\SysWOW64\TSpkg.dll
2017-08-09 16:58 - 2017-07-07 07:11 - 000043008 _____ (Microsoft Corporation) C:\Windows\SysWOW64\srclient.dll
2017-08-09 16:58 - 2017-07-07 07:11 - 000022016 _____ (Microsoft Corporation) C:\Windows\SysWOW64\secur32.dll
2017-08-09 16:58 - 2017-07-07 07:11 - 000005120 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wow32.dll
2017-08-09 16:58 - 2017-07-07 07:10 - 000690688 _____ (Microsoft Corporation) C:\Windows\SysWOW64\adtschema.dll
2017-08-09 16:58 - 2017-07-07 07:10 - 000644096 _____ (Microsoft Corporation) C:\Windows\SysWOW64\advapi32.dll
2017-08-09 16:58 - 2017-07-07 07:10 - 000554496 _____ (Microsoft Corporation) C:\Windows\SysWOW64\kerberos.dll
2017-08-09 16:58 - 2017-07-07 07:10 - 000342528 _____ (Microsoft Corporation) C:\Windows\SysWOW64\certcli.dll
2017-08-09 16:58 - 2017-07-07 07:10 - 000146432 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msaudite.dll
2017-08-09 16:58 - 2017-07-07 07:10 - 000060416 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msobjs.dll
2017-08-09 16:58 - 2017-07-07 07:10 - 000050688 _____ (Microsoft Corporation) C:\Windows\SysWOW64\appidapi.dll
2017-08-09 16:58 - 2017-07-07 07:10 - 000017408 _____ (Microsoft Corporation) C:\Windows\SysWOW64\credssp.dll
2017-08-09 16:58 - 2017-07-07 07:10 - 000006656 _____ (Microsoft Corporation) C:\Windows\SysWOW64\apisetschema.dll
2017-08-09 16:58 - 2017-07-07 07:10 - 000005120 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-file-l1-1-0.dll
2017-08-09 16:58 - 2017-07-07 07:10 - 000004608 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-processthreads-l1-1-0.dll
2017-08-09 16:58 - 2017-07-07 07:10 - 000004096 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-sysinfo-l1-1-0.dll
2017-08-09 16:58 - 2017-07-07 07:10 - 000004096 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-synch-l1-1-0.dll
2017-08-09 16:58 - 2017-07-07 07:10 - 000004096 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-misc-l1-1-0.dll
2017-08-09 16:58 - 2017-07-07 07:10 - 000004096 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-localregistry-l1-1-0.dll
2017-08-09 16:58 - 2017-07-07 07:10 - 000004096 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-localization-l1-1-0.dll
2017-08-09 16:58 - 2017-07-07 07:10 - 000003584 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-processenvironment-l1-1-0.dll
2017-08-09 16:58 - 2017-07-07 07:10 - 000003584 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-namedpipe-l1-1-0.dll
2017-08-09 16:58 - 2017-07-07 07:10 - 000003584 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-memory-l1-1-0.dll
2017-08-09 16:58 - 2017-07-07 07:10 - 000003584 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-libraryloader-l1-1-0.dll
2017-08-09 16:58 - 2017-07-07 07:10 - 000003584 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-interlocked-l1-1-0.dll
2017-08-09 16:58 - 2017-07-07 07:10 - 000003584 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-heap-l1-1-0.dll
2017-08-09 16:58 - 2017-07-07 07:10 - 000003072 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-string-l1-1-0.dll
2017-08-09 16:58 - 2017-07-07 07:10 - 000003072 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-rtlsupport-l1-1-0.dll
2017-08-09 16:58 - 2017-07-07 07:10 - 000003072 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-profile-l1-1-0.dll
2017-08-09 16:58 - 2017-07-07 07:10 - 000003072 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-io-l1-1-0.dll
2017-08-09 16:58 - 2017-07-07 07:10 - 000003072 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-handle-l1-1-0.dll
2017-08-09 16:58 - 2017-07-07 07:10 - 000003072 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-fibers-l1-1-0.dll
2017-08-09 16:58 - 2017-07-07 07:10 - 000003072 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-errorhandling-l1-1-0.dll
2017-08-09 16:58 - 2017-07-07 07:10 - 000003072 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-delayload-l1-1-0.dll
2017-08-09 16:58 - 2017-07-07 07:10 - 000003072 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-debug-l1-1-0.dll
2017-08-09 16:58 - 2017-07-07 07:10 - 000003072 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-datetime-l1-1-0.dll
2017-08-09 16:58 - 2017-07-07 07:10 - 000003072 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-console-l1-1-0.dll
2017-08-09 16:58 - 2017-07-07 07:02 - 000148480 _____ (Microsoft Corporation) C:\Windows\System32\appidpolicyconverter.exe
2017-08-09 16:58 - 2017-07-07 07:01 - 000064000 _____ (Microsoft Corporation) C:\Windows\System32\auditpol.exe
2017-08-09 16:58 - 2017-07-07 07:01 - 000062464 _____ (Microsoft Corporation) C:\Windows\System32\Drivers\appid.sys
2017-08-09 16:58 - 2017-07-07 07:01 - 000017920 _____ (Microsoft Corporation) C:\Windows\System32\appidcertstorecheck.exe
2017-08-09 16:58 - 2017-07-07 06:58 - 000338432 _____ (Microsoft Corporation) C:\Windows\System32\conhost.exe
2017-08-09 16:58 - 2017-07-07 06:57 - 000296960 _____ (Microsoft Corporation) C:\Windows\System32\rstrui.exe
2017-08-09 16:58 - 2017-07-07 06:54 - 000291328 _____ (Microsoft Corporation) C:\Windows\System32\Drivers\mrxsmb10.sys
2017-08-09 16:58 - 2017-07-07 06:54 - 000159744 _____ (Microsoft Corporation) C:\Windows\System32\Drivers\mrxsmb.sys
2017-08-09 16:58 - 2017-07-07 06:54 - 000129536 _____ (Microsoft Corporation) C:\Windows\System32\Drivers\mrxsmb20.sys
2017-08-09 16:58 - 2017-07-07 06:53 - 000112640 _____ (Microsoft Corporation) C:\Windows\System32\smss.exe
2017-08-09 16:58 - 2017-07-07 06:53 - 000030720 _____ (Microsoft Corporation) C:\Windows\System32\lsass.exe
2017-08-09 16:58 - 2017-07-07 06:51 - 000050176 _____ (Microsoft Corporation) C:\Windows\SysWOW64\auditpol.exe
2017-08-09 16:58 - 2017-07-07 06:48 - 000025600 _____ (Microsoft Corporation) C:\Windows\SysWOW64\setup16.exe
2017-08-09 16:58 - 2017-07-07 06:48 - 000014336 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ntvdm64.dll
2017-08-09 16:58 - 2017-07-07 06:48 - 000007680 _____ (Microsoft Corporation) C:\Windows\SysWOW64\instnm.exe
2017-08-09 16:58 - 2017-07-07 06:48 - 000002048 _____ (Microsoft Corporation) C:\Windows\SysWOW64\user.exe
2017-08-09 16:58 - 2017-07-07 06:47 - 000036352 _____ (Microsoft Corporation) C:\Windows\SysWOW64\cryptbase.dll
2017-08-09 16:58 - 2017-07-07 06:47 - 000006144 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-security-base-l1-1-0.dll
2017-08-09 16:58 - 2017-07-07 06:47 - 000004608 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-threadpool-l1-1-0.dll
2017-08-09 16:58 - 2017-07-07 06:47 - 000003584 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-xstate-l1-1-0.dll
2017-08-09 16:58 - 2017-07-07 06:47 - 000003072 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-util-l1-1-0.dll
2017-08-09 16:58 - 2017-07-01 05:05 - 001311744 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msjet40.dll
2017-08-09 16:58 - 2017-07-01 05:05 - 000866816 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mswdat10.dll
2017-08-09 16:58 - 2017-07-01 05:05 - 000641536 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mswstr10.dll
2017-08-09 16:58 - 2017-07-01 05:05 - 000616448 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msrepl40.dll
2017-08-09 16:58 - 2017-07-01 05:05 - 000475648 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msxbde40.dll
2017-08-09 16:58 - 2017-07-01 05:05 - 000375808 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mspbde40.dll
2017-08-09 16:58 - 2017-07-01 05:05 - 000343552 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msrd3x40.dll
2017-08-09 16:58 - 2017-07-01 05:05 - 000339968 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msexcl40.dll
2017-08-09 16:58 - 2017-07-01 05:05 - 000310272 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msrd2x40.dll
2017-08-09 16:58 - 2017-07-01 05:05 - 000240640 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msltus40.dll
2017-08-09 16:58 - 2017-07-01 05:05 - 000144896 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msjint40.dll
2017-08-09 16:58 - 2017-07-01 05:05 - 000083968 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msjter40.dll
2017-07-24 12:21 - 2017-07-24 12:21 - 000401584 _____ (AVG Technologies CZ, s.r.o.) C:\Windows\System32\avgBoot.exe
 
==================== One Month Modified files and folders ========
 
(If an entry is included in the fixlist, the file/folder will be moved.)
 
2017-08-10 08:30 - 2017-07-16 15:02 - 000253856 _____ C:\Windows\System32\Drivers\MBAMSwissArmy.sys
2017-08-10 08:30 - 2009-07-13 21:08 - 000000006 ____H C:\Windows\Tasks\SA.DAT
2017-08-10 08:30 - 2009-07-13 20:45 - 000024240 ____H C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0
2017-08-10 08:30 - 2009-07-13 20:45 - 000024240 ____H C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0
2017-08-10 08:29 - 2012-02-08 16:10 - 000000000 ____D C:\ProgramData\NVIDIA
2017-08-10 08:29 - 2009-07-13 20:45 - 000457224 _____ C:\Windows\System32\FNTCACHE.DAT
2017-08-09 21:44 - 2013-08-07 06:25 - 000000000 ____D C:\Windows\System32\MRT
2017-08-09 21:41 - 2011-06-30 08:49 - 140394280 ____C (Microsoft Corporation) C:\Windows\System32\MRT.exe
2017-08-09 21:38 - 2016-11-18 12:23 - 000000000 ____D C:\Users\Ault\AppData\LocalLow\Mozilla
2017-08-09 21:27 - 2015-07-11 13:19 - 000000862 _____ C:\Windows\Tasks\DropboxUpdateTaskUserS-1-5-21-2161296594-2788071731-988794887-1000Core.job
2017-08-09 21:13 - 2015-07-11 13:19 - 000000914 _____ C:\Windows\Tasks\DropboxUpdateTaskUserS-1-5-21-2161296594-2788071731-988794887-1000UA.job
2017-08-09 19:00 - 2011-06-30 13:49 - 000000000 ____D C:\ProgramData\Sonic
2017-08-09 16:27 - 2017-07-13 22:19 - 000003600 _____ C:\Windows\System32\Tasks\AVG EUpdate Task
2017-08-09 16:22 - 2017-07-13 22:26 - 001008288 _____ (AVG Technologies CZ, s.r.o.) C:\Windows\System32\Drivers\avgsnx.sys
2017-08-09 16:22 - 2017-07-13 22:26 - 000139112 _____ (AVG Technologies CZ, s.r.o.) C:\Windows\System32\Drivers\avgmonflt.sys
2017-08-08 09:23 - 2012-04-08 05:07 - 000803328 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerApp.exe
2017-08-08 09:23 - 2012-04-08 05:07 - 000004312 _____ C:\Windows\System32\Tasks\Adobe Flash Player Updater
2017-08-08 09:23 - 2012-02-20 09:49 - 000000000 ____D C:\Windows\System32\Macromed
2017-08-08 09:23 - 2012-02-08 16:36 - 000144896 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerCPLApp.cpl
2017-08-08 09:23 - 2012-02-08 16:36 - 000000000 ____D C:\Windows\SysWOW64\Macromed
2017-08-07 06:36 - 2011-06-30 09:48 - 000000000 ___HD C:\Windows\System32\WLANProfiles
2017-08-07 06:24 - 2017-07-13 22:26 - 000004178 _____ C:\Windows\System32\Tasks\Antivirus Emergency Update
2017-08-06 20:27 - 2012-02-10 12:56 - 000000000 ____D C:\(E) JOHN'S
2017-08-04 18:40 - 2015-05-11 18:09 - 000004476 _____ C:\Windows\System32\Tasks\Adobe Acrobat Update Task
2017-08-04 18:37 - 2012-02-10 15:49 - 000000000 ____D C:\Users\Ault\AppData\Roaming\Dropbox
2017-08-04 18:29 - 2009-07-13 21:08 - 000032656 _____ C:\Windows\Tasks\SCHEDLGU.TXT
2017-07-30 15:11 - 2017-07-16 15:02 - 000101784 _____ (Malwarebytes) C:\Windows\System32\Drivers\farflt.sys
2017-07-30 15:11 - 2017-07-16 15:02 - 000084256 _____ (Malwarebytes) C:\Windows\System32\Drivers\mwac.sys
2017-07-30 15:11 - 2017-07-16 15:02 - 000045472 _____ (Malwarebytes) C:\Windows\System32\Drivers\mbam.sys
2017-07-25 07:48 - 2009-07-13 21:13 - 000006218 _____ C:\Windows\System32\PerfStringBackup.INI
2017-07-24 12:21 - 2017-07-13 22:26 - 000578048 _____ (AVG Technologies CZ, s.r.o.) C:\Windows\System32\Drivers\avgSP.sys
2017-07-24 12:21 - 2017-07-13 22:26 - 000353744 _____ (AVG Technologies CZ, s.r.o.) C:\Windows\System32\Drivers\avgVmm.sys
2017-07-24 12:21 - 2017-07-13 22:26 - 000191208 _____ (AVG Technologies CZ, s.r.o.) C:\Windows\System32\Drivers\avgStm.sys
2017-07-24 12:21 - 2017-07-13 22:26 - 000139112 _____ (AVG Technologies CZ, s.r.o.) C:\Windows\System32\Drivers\avgmonflt.sys.150092770766701
2017-07-24 12:21 - 2017-07-13 22:26 - 000102792 _____ (AVG Technologies CZ, s.r.o.) C:\Windows\System32\Drivers\avgRdr2.sys
2017-07-24 12:21 - 2017-07-13 22:26 - 000076832 _____ (AVG Technologies CZ, s.r.o.) C:\Windows\System32\Drivers\avgRvrt.sys
2017-07-24 12:21 - 2017-07-13 22:26 - 000039424 _____ (AVG Technologies CZ, s.r.o.) C:\Windows\System32\Drivers\avgHwid.sys
2017-07-24 12:20 - 2017-07-13 22:26 - 000336896 _____ (AVG Technologies CZ, s.r.o.) C:\Windows\System32\Drivers\avgbloga.sys
2017-07-24 12:20 - 2017-07-13 22:26 - 000313616 _____ (AVG Technologies CZ, s.r.o.) C:\Windows\System32\Drivers\avgbidsdrivera.sys
2017-07-24 12:20 - 2017-07-13 22:26 - 000192584 _____ (AVG Technologies CZ, s.r.o.) C:\Windows\System32\Drivers\avgbidsha.sys
2017-07-24 12:20 - 2017-07-13 22:26 - 000166624 _____ (AVG Technologies CZ, s.r.o.) C:\Windows\System32\Drivers\avgbdiska.sys
2017-07-24 12:20 - 2017-07-13 22:26 - 000051336 _____ (AVG Technologies CZ, s.r.o.) C:\Windows\System32\Drivers\avgbuniva.sys
 
Files to move or delete:
====================
C:\Users\Ault\df.cmd
C:\Users\Ault\provorder.reg
C:\Users\Default\provorder.reg
C:\Users\NWS\provorder.reg
C:\Users\UpdatusUser\provorder.reg
 
 
Some files in TEMP:
====================
2015-12-13 13:44 - 2015-12-13 13:44 - 000071168 _____ () C:\Users\Ault\AppData\Local\Temp\dropbox_sqlite_ext.{5f3e3153-5bce-5766-8f84-3e3e7ecf0d81}.tmp0ea6zs.dll
 
==================== Known DLLs (Whitelisted) =========================
 
 
==================== Bamital & volsnap ======================
 
(There is no automatic fix for files that do not pass verification.)
 
C:\Windows\System32\winlogon.exe => MD5 is legit
C:\Windows\System32\wininit.exe => MD5 is legit
C:\Windows\SysWOW64\wininit.exe => MD5 is legit
C:\Windows\explorer.exe => MD5 is legit
C:\Windows\SysWOW64\explorer.exe => MD5 is legit
C:\Windows\System32\svchost.exe => MD5 is legit
C:\Windows\SysWOW64\svchost.exe => MD5 is legit
C:\Windows\System32\services.exe => MD5 is legit
C:\Windows\System32\User32.dll => MD5 is legit
C:\Windows\SysWOW64\User32.dll => MD5 is legit
C:\Windows\System32\userinit.exe => MD5 is legit
C:\Windows\SysWOW64\userinit.exe => MD5 is legit
C:\Windows\System32\rpcss.dll
[2017-05-09 12:18] - [2017-04-17 07:37] - 000512000 _____ (Microsoft Corporation) 5E9F8D029D9B03110D835CBFC058068B
 
C:\Windows\System32\dnsapi.dll => MD5 is legit
C:\Windows\SysWOW64\dnsapi.dll => MD5 is legit
C:\Windows\System32\Drivers\volsnap.sys => MD5 is legit
 
==================== Association (Whitelisted) =============
 
 
==================== Restore Points  =========================
 
 
==================== Memory info =========================== 
 
Percentage of memory in use: 16%
Total physical RAM: 4053.02 MB
Available physical RAM: 3389.16 MB
Total Virtual: 4051.21 MB
Available Virtual: 3375.53 MB
 
==================== Drives ================================
 
Drive c: () (Fixed) (Total:297.99 GB) (Free:215.6 GB) NTFS
Drive f: () (Removable) (Total:1.95 GB) (Free:1.91 GB) FAT
Drive x: (Boot) (Fixed) (Total:0.03 GB) (Free:0.03 GB) NTFS
Drive y: (System Reserved) (Fixed) (Total:0.1 GB) (Free:0.05 GB) NTFS ==>[system with boot components (obtained from drive)]
 
==================== MBR & Partition Table ==================
 
========================================================
Disk: 0 (MBR Code: Windows 7 or 8) (Size: 298.1 GB) (Disk ID: 14DC4038)
Partition 1: (Active) - (Size=101 MB) - (Type=07 NTFS)
Partition 2: (Not Active) - (Size=298 GB) - (Type=07 NTFS)
 
========================================================
Disk: 1 (MBR Code: Windows XP) (Size: 2 GB) (Disk ID: C3072E18)
Partition 1: (Active) - (Size=2 GB) - (Type=06)
 
LastRegBack: 2017-08-01 13:42
 
==================== End of FRST.txt ============================

  • 0

Advertisements


#2
zep516

zep516

    Trusted Helper

  • Malware Removal
  • 6,650 posts
Hi! My name is zep516 and Welcome to Geekstogo!
I'll do the best I can to resolve your computer issue
Please make sure to carefully read any instruction that I give you. If you're not sure, or if something unexpected happens, don't continue Stop and ask! Never be afraid to ask questions! :)



A few items to fix

NOTICE: This script was written specifically for this user, for use on that particular machine. Running this on another machine may cause damage to your operating system
Open notepad (Start =>All Programs => Accessories => Notepad).
Copy/Paste the contents of the code box below into Notepad.
start
CloseProcesses:
CreateRestorePoint:
S0 MBAMSwissArmy; C:\Windows\System32\drivers\MBAMSwissArmy.sys [253856 2017-08-10] ()
2017-08-10 08:30 - 2017-07-16 15:02 - 000253856 _____ C:\Windows\System32\Drivers\MBAMSwissArmy.sys
HKLM-x32\...\Run: [] => [X]
ShortcutTarget: Dropbox.lnk ->  (No File)
GroupPolicyScripts: Restriction <==== ATTENTION
C:\Users\Ault\df.cmd
C:\Users\Ault\provorder.reg
C:\Users\Default\provorder.reg
C:\Users\NWS\provorder.reg
C:\Users\UpdatusUser\provorder.reg
S2 HPSLPSVC; C:\Users\Ault\AppData\Local\Temp\7zS5799\hpslpsvc64.dll [1039360 2012-08-27] (Hewlett-Packard Co.) <==== ATTENTION
Emptytemp:
  • Click Format and ensure Wordwrap is unchecked.
  • Save as Fixlist.txt to F:\ (Must be in this location)
  • Run FRST/FRST64 and press the Fix button just once and wait.
  • If the tool needed a restart please make sure you let the system to restart normally and let the tool completes its run after restart.
  • The tool will make a log in F:\ (Fixlog.txt). Please post it to your reply.
Note: If the tool warns you about the version you're using being an outdated version please download and run the updated version.


See if you can boot to normal mode now
  • 0

#3
dotson98

dotson98

    New Member

  • Topic Starter
  • Member
  • Pip
  • 2 posts

It looks like I am able to get back in.  Thank you very much.

 

Here is the log file:

 

Fix result of Farbar Recovery Scan Tool (x64) Version: 20-08-2017
Ran by SYSTEM (22-08-2017 18:34:45) Run:1
Running from F:\
Boot Mode: Recovery
==============================================
 
fixlist content:
*****************
start
CloseProcesses:
CreateRestorePoint:
S0 MBAMSwissArmy; C:\Windows\System32\drivers\MBAMSwissArmy.sys [253856 2017-08-10] ()
2017-08-10 08:30 - 2017-07-16 15:02 - 000253856 _____ C:\Windows\System32\Drivers\MBAMSwissArmy.sys
HKLM-x32\...\Run: [] => [X]
ShortcutTarget: Dropbox.lnk ->  (No File)
GroupPolicyScripts: Restriction <==== ATTENTION
C:\Users\Ault\df.cmd
C:\Users\Ault\provorder.reg
C:\Users\Default\provorder.reg
C:\Users\NWS\provorder.reg
C:\Users\UpdatusUser\provorder.reg
S2 HPSLPSVC; C:\Users\Ault\AppData\Local\Temp\7zS5799\hpslpsvc64.dll [1039360 2012-08-27] (Hewlett-Packard Co.) <==== ATTENTION
Emptytemp:
*****************
 
CloseProcesses: => Error: This directive works only outside recovery mode.
Error: Restore point can only be created in normal mode.
HKLM\System\ControlSet001\Services\MBAMSwissArmy => key removed successfully
MBAMSwissArmy => service removed successfully
C:\Windows\System32\Drivers\MBAMSwissArmy.sys => moved successfully
HKLM\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\\ => value removed successfully
ShortcutTarget: Dropbox.lnk ->  (No File) => not found.
C:\Windows\System32\GroupPolicy\Machine => moved successfully
C:\Windows\System32\GroupPolicy\GPT.ini => moved successfully
C:\Users\Ault\df.cmd => moved successfully
C:\Users\Ault\provorder.reg => moved successfully
C:\Users\Default\provorder.reg => moved successfully
C:\Users\NWS\provorder.reg => moved successfully
C:\Users\UpdatusUser\provorder.reg => moved successfully
HKLM\System\ControlSet001\Services\HPSLPSVC => key removed successfully
HPSLPSVC => service removed successfully
Emptytemp: => Error: This directive works only outside recovery mode.
 
==== End of Fixlog 18:34:46 ====

  • 0

#4
zep516

zep516

    Trusted Helper

  • Malware Removal
  • 6,650 posts
Hello,

Can we move FRST to the desktop and run a scan now, there may be a few items to clean up.

Post both log files.

FRST.txt
Addition.txt

I'll review the logs and fix what maybe necessary.

Thanks
Joe :)
  • 0

#5
zep516

zep516

    Trusted Helper

  • Malware Removal
  • 6,650 posts
Due to lack of feedback, this topic has been closed.

If you need this topic reopened, please contact a staff member. This applies only to the original topic starter. Everyone else please begin a New Topic.
  • 0






Similar Topics


Also tagged with one or more of these keywords: mbamswissarmy.sys

0 user(s) are reading this topic

0 members, 0 guests, 0 anonymous users

As Featured On:

Microsoft Yahoo BBC MSN PC Magazine Washington Post HP