Javascript Disabled Detected

You currently have javascript disabled. Several functions may not work. Please re-enable javascript to access full functionality.

mbamswissarmy.sys windows wont boot

Started by Bjohn24 , Dec 27 2017 05:53 AM

Please log in to reply

#1
Bjohn24

Posted 27 December 2017 - 05:53 AM

New Member

Member
7 posts

Using windows 10, after turning on laptop somehow it is stuck on automatic repair loop. I found out (using cmd) that mbamswissarmy.sys is causing the problem. i have attached my frst.txt log, hoping someone can help me. Thank you.

Scan result of Farbar Recovery Scan Tool (FRST) (x64) Version: 26-12-2017

Ran by SYSTEM on MININT-CT47GNL (27-12-2017 19:12:54)

Running from E:\

Platform: Windows 10 Home Single Language Version 1607 14393.693 (X64) Language: English (United States)

Internet Explorer Version 11

Boot Mode: Recovery

Default: ControlSet001

ATTENTION!:=====> If the system is bootable FRST must be run from normal or Safe mode to create a complete log.

Tutorial for Farbar Recovery Scan Tool: http://www.geekstogo...very-scan-tool/

==================== Registry (Whitelisted) ===========================

(If an entry is included in the fixlist, the registry item will be restored to default or removed. The file will not be moved.)

HKLM\...\Run: [DptfPolicyLpmServiceHelper] => C:\Windows\system32\DptfPolicyLpmServiceHelper.exe [114048 2013-10-17] (Intel Corporation)

HKLM\...\Run: [AdobeAAMUpdater-1.0] => C:\Program Files (x86)\Common Files\Adobe\OOBE\PDApp\UWA\UpdaterStartupUtility.exe [508128 2016-06-30] (Adobe Systems Incorporated)

HKLM\...\Run: [XboxStat] => C:\Program Files\Microsoft Xbox 360 Accessories\XboxStat.exe [825184 2009-09-30] (Microsoft Corporation)

HKLM\...\Run: [pac] => C:\Program Files\Autodesk\Personal Accelerator for Revit\RevitAccelerator.exe [339464 2016-02-09] (Autodesk, Inc.)

HKLM\...\Run: [WindowsDefender] => C:\Program Files\Windows Defender\MSASCuiL.exe [631808 2016-09-06] (Microsoft Corporation)

HKLM-x32\...\Run: [ADSKAppManager] => C:\Program Files (x86)\Autodesk\Autodesk Desktop App\AutodeskDesktopApp.exe [692160 2016-01-18] (Autodesk, Inc.)

HKLM-x32\...\Run: [Adobe Creative Cloud] => C:\Program Files (x86)\Adobe\Adobe Creative Cloud\ACC\Creative Cloud.exe [2383040 2016-10-24] (Adobe Systems Incorporated)

HKLM\...\RunOnce: [*Restore] => C:\Windows\system32\rstrui.exe [268288 2016-07-16] (Microsoft Corporation)

HKU\LIM\...\Run: [AdobeBridge] => [X]

HKU\LIM\...\Run: [uTorrent] => C:\Users\LIM\AppData\Roaming\uTorrent\uTorrent.exe [1981624 2017-12-26] (BitTorrent Inc.)

HKU\LIM\...\Run: [Steam] => C:\Program Files (x86)\Steam\steam.exe [3111712 2017-12-15] (Valve Corporation)

HKU\LIM\...\Run: [Spotify] => C:\Users\LIM\AppData\Roaming\Spotify\Spotify.exe [21074320 2017-12-08] (Spotify Ltd)

HKU\LIM\...\Run: [Akamai NetSession Interface] => C:\Users\LIM\AppData\Local\Akamai\netsession_win.exe [4490200 2017-09-07] (Akamai Technologies, Inc.)

HKU\LIM\...\Run: [Spotify Web Helper] => C:\Users\LIM\AppData\Roaming\Spotify\SpotifyWebHelper.exe [780688 2017-12-08] (Spotify Ltd)

HKU\LIM\...\Policies\Explorer: []

GroupPolicy: Restriction <==== ATTENTION

==================== Services (Whitelisted) ====================

(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)

S4 AdAppMgrSvc; C:\Program Files (x86)\Autodesk\Autodesk Desktop App\AdAppMgrSvc.exe [1222664 2016-01-18] (Autodesk Inc.)

S4 AdobeUpdateService; C:\Program Files (x86)\Common Files\Adobe\Adobe Desktop Common\ElevationManager\AdobeUpdateService.exe [744640 2016-10-24] (Adobe Systems Incorporated)

S4 AGSService; C:\Program Files (x86)\Common Files\Adobe\AdobeGCClient\AGSService.exe [2257016 2017-08-22] (Adobe Systems, Incorporated)

S4 Autodesk Content Service; C:\Program Files\Autodesk\Content Service\Connect.Service.ContentService.exe [31160 2015-02-05] (Autodesk, Inc.)

S2 DptfParticipantDisplayService; C:\Windows\System32\DptfParticipantDisplayService.exe [141944 2013-10-17] (Intel Corporation)

S2 DptfParticipantProcessorService; C:\Windows\system32\DptfParticipantProcessorService.exe [117704 2013-10-17] (Intel Corporation)

S2 DptfPolicyConfigTDPService; C:\Windows\system32\DptfPolicyConfigTDPService.exe [116680 2013-10-17] (Intel Corporation)

S2 DptfPolicyCriticalService; C:\Windows\system32\DptfPolicyCriticalService.exe [148160 2013-10-17] (Intel Corporation)

S2 DptfPolicyLpmService; C:\Windows\system32\DptfPolicyLpmService.exe [126952 2013-10-17] (Intel Corporation)

S2 Ds3Service; C:\Program Files (x86)\ScarletProduction\bin\ScpService.exe [388352 2013-05-05] (Scarlet.Crush Productions)

S2 igfxCUIService2.0.0.0; C:\Windows\system32\igfxCUIService.exe [373728 2016-11-30] (Intel Corporation)

S2 MBAMService; C:\Program Files\Malwarebytes\Anti-Malware\mbamservice.exe [6234056 2017-10-31] (Malwarebytes)

S3 QuickBooksDB26; C:\Program Files (x86)\Intuit\QuickBooks Enterprise Solutions 16.0\QBDBMgrN.exe [127792 2015-08-18] (Intuit, Inc.)

S2 vrswrm-service; C:\Program Files\Chaos Group\V-Ray Swarm\register-service.exe [90176 2017-11-14] ()

S3 WdNisSvc; C:\Program Files\Windows Defender\NisSrv.exe [347328 2016-07-16] (Microsoft Corporation)

S2 WinDefend; C:\Program Files\Windows Defender\MsMpEng.exe [103720 2016-07-16] (Microsoft Corporation)

S2 VRLService; C:\PROGRA~3\ASGVIS\DONGLE~1\STARTV~1.EXE [X]

===================== Drivers (Whitelisted) ======================

(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)

S3 AsusTP; C:\Windows\System32\drivers\AsusTP.sys [124928 2017-03-08] (ASUS Corporation)

S3 DptfDevDisplay; C:\Windows\System32\drivers\DptfDevDisplay.sys [70752 2013-10-17] (Intel Corporation)

S3 DptfDevDram; C:\Windows\System32\drivers\DptfDevDram.sys [145640 2013-10-17] (Intel Corporation)

S3 DptfDevFan; C:\Windows\System32\drivers\DptfDevFan.sys [50640 2013-10-17] (Intel Corporation)

S3 DptfDevGen; C:\Windows\System32\drivers\DptfDevGen.sys [78504 2013-10-17] (Intel Corporation)

S3 DptfDevPch; C:\Windows\System32\drivers\DptfDevPch.sys [116752 2013-10-17] (Intel Corporation)

S3 DptfDevPower; C:\Windows\System32\drivers\DptfDevPower.sys [71808 2013-10-17] (Intel Corporation)

S3 DptfDevProc; C:\Windows\System32\drivers\DptfDevProc.sys [289744 2013-10-17] (Intel Corporation)

S3 DptfManager; C:\Windows\System32\drivers\DptfManager.sys [494296 2013-10-17] (Intel Corporation)

S1 ESProtectionDriver; C:\Windows\system32\drivers\mbae64.sys [77432 2017-12-26] ()

S3 kbfiltr; C:\Windows\System32\drivers\kbfiltr.sys [17280 2012-08-05] ( )

S3 libusbK; C:\Windows\System32\drivers\libusbK.sys [47200 2017-02-13] (hxxp://libusb-win32.sourceforge.net)

S2 MBAMChameleon; C:\Windows\System32\Drivers\MbamChameleon.sys [193968 2017-12-26] (Malwarebytes)

S3 MBAMFarflt; C:\Windows\system32\DRIVERS\farflt.sys [110016 2017-12-26] (Malwarebytes)

S3 MBAMProtection; C:\Windows\system32\DRIVERS\mbam.sys [46008 2017-12-26] (Malwarebytes)

S0 MBAMSwissArmy; C:\Windows\System32\Drivers\mbamswissarmy.sys [253880 2017-12-26] ()

S3 MBAMWebProtection; C:\Windows\system32\DRIVERS\mwac.sys [94144 2017-12-26] (Malwarebytes)

S3 MEIx64; C:\Windows\System32\drivers\TeeDriverx64.sys [99288 2013-10-23] (Intel Corporation)

S3 NetAdapterCx; C:\Windows\System32\drivers\NetAdapterCx.sys [90624 2016-07-16] ()

S3 nvlddmkm; C:\Windows\System32\DriverStore\FileRepository\nvami.inf_amd64_11a67240324f74de\nvlddmkm.sys [14200880 2016-12-12] (NVIDIA Corporation)

S3 NVSWCFilter; C:\Windows\System32\drivers\nvswcfilter.sys [28344 2015-10-09] (Windows ® Win 7 DDK provider)

S3 rt640x64; C:\Windows\System32\drivers\rt640x64.sys [895256 2015-07-07] (Realtek )

S3 RTSPER; C:\Windows\system32\DRIVERS\RtsPer.sys [751632 2015-05-13] (Realsil Semiconductor Corporation)

S3 ScpVBus; C:\Windows\System32\drivers\ScpVBus.sys [39168 2013-05-18] (Scarlet.Crush Productions)

S0 WdBoot; C:\Windows\System32\drivers\WdBoot.sys [44056 2016-07-16] (Microsoft Corporation)

S0 WdFilter; C:\Windows\System32\drivers\WdFilter.sys [290144 2016-07-16] (Microsoft Corporation)

S3 WdNisDrv; C:\Windows\System32\Drivers\WdNisDrv.sys [123232 2016-07-16] (Microsoft Corporation)

S4 nvvad_WaveExtensible; \SystemRoot\system32\drivers\nvvad64v.sys [X]

S4 nvvhci; \SystemRoot\System32\drivers\nvvhci.sys [X]

==================== NetSvcs (Whitelisted) ===================

(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)

==================== One Month Created files and folders ========

(If an entry is included in the fixlist, the file/folder will be moved.)

2017-12-27 19:09 - 2017-12-27 19:10 - 000000000 ____D C:\FRST

2017-12-26 23:50 - 2017-12-26 23:50 - 000193968 _____ (Malwarebytes) C:\Windows\System32\Drivers\MbamChameleon.sys

2017-12-26 23:49 - 2017-12-26 23:50 - 000094144 _____ (Malwarebytes) C:\Windows\System32\Drivers\mwac.sys

2017-12-26 23:49 - 2017-12-26 23:49 - 000110016 _____ (Malwarebytes) C:\Windows\System32\Drivers\farflt.sys

2017-12-26 23:49 - 2017-12-26 23:49 - 000046008 _____ (Malwarebytes) C:\Windows\System32\Drivers\mbam.sys

2017-12-26 23:49 - 2017-12-26 23:49 - 000000000 ____D C:\temp

2017-12-26 23:18 - 2017-12-26 23:46 - 000000000 ____D C:\Users\LIM\AppData\LocalLow\uTorrent

2017-12-26 23:15 - 2017-12-26 23:41 - 000253880 _____ C:\Windows\System32\Drivers\mbamswissarmy.sys

2017-12-26 16:37 - 2017-12-26 16:37 - 000000000 ____D C:\Windows\pss

2017-12-25 01:21 - 2017-12-26 23:48 - 000077432 _____ C:\Windows\System32\Drivers\mbae64.sys

2017-12-25 01:20 - 2017-12-25 01:20 - 000000000 ____D C:\ProgramData\MB3CoreBackup

2017-12-23 15:55 - 2017-12-23 15:55 - 000104133 _____ C:\Users\LIM\Downloads\Philippine Airlines_Sunday Dec 24, 2017_WGTCJR_ANGELICAUY LIM.pdf

2017-12-23 15:55 - 2017-12-23 15:55 - 000103742 _____ C:\Users\LIM\Downloads\Philippine Airlines_Sunday Dec 24, 2017_ZCMHLR_LUNA BELLA LIM.pdf

2017-12-19 15:27 - 2017-12-19 16:06 - 000500145 _____ C:\Users\LIM\Downloads\LIMGEL.ai

2017-12-17 20:50 - 2017-12-17 20:51 - 000495460 _____ C:\Windows\Minidump\121817-42156-01.dmp

2017-12-14 15:28 - 2017-12-14 15:28 - 000000000 ___HD C:\$WINDOWS.~BT

2017-12-14 15:16 - 2017-12-14 15:16 - 002609535 _____ C:\Users\LIM\Downloads\Stripmall-Floor-Plan.pdf

2017-12-14 15:14 - 2017-12-14 15:14 - 003022155 _____ C:\Users\LIM\Downloads\SHER_FINAL-STRIPMALL-SECTIONS-A-B.dwg

2017-12-14 15:14 - 2017-12-14 15:14 - 002520432 _____ C:\Users\LIM\Downloads\SHER_STRIPMALL-SECTIONS-3-B.dwg

2017-12-13 04:11 - 2017-12-13 04:11 - 005341791 _____ C:\Users\LIM\Downloads\LOREGA SITE DEV.pdf

2017-12-12 16:37 - 2017-12-12 16:37 - 015696310 _____ C:\Users\LIM\Documents\AutoSave_Untitled_2.skp

2017-12-11 19:22 - 2017-12-11 19:22 - 014413952 _____ C:\Users\LIM\Documents\AutoSave_Untitled_1.skp

2017-12-11 17:41 - 2017-12-13 00:36 - 052446869 _____ C:\Users\LIM\Downloads\FP-FINAL.dwg

2017-12-11 17:41 - 2017-12-13 00:28 - 053163683 _____ C:\Users\LIM\Downloads\FP-FINAL.bak

2017-12-10 04:54 - 2017-12-10 04:54 - 000098312 _____ C:\Users\LIM\Downloads\market.dwg

2017-12-10 03:09 - 2017-12-10 03:09 - 001199593 _____ C:\Users\LIM\Downloads\parking+villa.skp

2017-12-10 03:06 - 2017-12-10 04:51 - 000000000 ____D C:\Users\LIM\Downloads\to delete

2017-12-10 03:05 - 2016-05-18 08:44 - 002567130 _____ C:\Users\LIM\Downloads\parque.dwg

2017-12-08 06:26 - 2017-12-08 05:54 - 001482024 _____ C:\Users\LIM\Downloads\black+and+white+pictures.skb

2017-12-08 06:26 - 2017-12-08 05:43 - 018791581 _____ C:\Users\LIM\Downloads\PodiumBrowser_sample_with_image.skb

2017-12-08 06:09 - 2017-12-08 06:10 - 006560616 _____ C:\Users\LIM\Downloads\Living+Room+Zach+lit+with+THORN+downlight+and+Floor+lamp.skp

2017-12-08 05:43 - 2017-12-08 06:26 - 019529108 _____ C:\Users\LIM\Downloads\PodiumBrowser_sample_with_image.skp

2017-12-08 05:43 - 2017-12-08 05:43 - 013304565 _____ C:\Users\LIM\Downloads\Dark+living.skp

2017-12-08 00:27 - 2017-12-08 00:28 - 039568905 _____ C:\Users\LIM\Downloads\AutoSave_AutoSave_Senza+titolo_2_1.skp

2017-12-06 05:16 - 2017-12-06 05:20 - 028724149 _____ C:\Users\LIM\Downloads\bedroom.skp

2017-12-06 05:06 - 2017-12-06 05:07 - 012843375 _____ C:\Users\LIM\Downloads\Bedroom.skp.crdownload

2017-12-06 05:03 - 2017-12-06 05:03 - 001581503 _____ C:\Users\LIM\Downloads\dads,moms+new+bedroom.skp

2017-12-06 04:35 - 2017-12-06 04:35 - 026709157 _____ C:\Users\LIM\Documents\AutoSave_Untitled.skp

2017-12-05 16:50 - 2017-12-05 16:50 - 000000000 ____D C:\Users\LIM\Downloads\111064v4586026_clothingandaccessories

2017-12-05 16:49 - 2017-06-19 18:51 - 000214826 _____ C:\Users\LIM\Downloads\roupaseacessorios.dwg

2017-12-05 16:38 - 2017-12-05 20:01 - 000000000 ____D C:\Users\LIM\Downloads\108773v4586026_bedroomfurniture

2017-12-05 16:38 - 2017-12-05 16:38 - 000188804 _____ C:\Users\LIM\Downloads\108773v4586026_bedroomfurniture.zip

2017-12-04 06:08 - 2017-12-04 06:09 - 033991721 _____ C:\Users\LIM\Downloads\32691+Garabaldi+Contemporary+2.skp

2017-12-03 02:48 - 2017-12-03 02:49 - 018570084 _____ C:\Users\LIM\Downloads\3d+birouri+daniel+varianta+2+a.skp

2017-11-29 05:29 - 2017-11-29 05:30 - 038411056 _____ C:\Users\LIM\Downloads\Cargill1.skp

2017-11-29 01:43 - 2017-11-29 01:43 - 002329671 _____ C:\Users\LIM\Downloads\Mountain+Branch+Bath.skp

==================== One Month Modified files and folders ========

(If an entry is included in the fixlist, the file/folder will be moved.)

2017-12-27 00:48 - 2016-12-27 20:24 - 000000006 ____H C:\Windows\Tasks\SA.DAT

2017-12-27 00:48 - 2016-12-27 19:23 - 000524288 _____ C:\Windows\System32\config\BBI

2017-12-27 00:46 - 2017-06-23 07:19 - 000000000 ____D C:\Program Files (x86)\Steam

2017-12-27 00:33 - 2016-12-27 19:30 - 000000000 ____D C:\Windows\CbsTemp

2017-12-27 00:22 - 2016-12-27 20:07 - 000000000 ___DC C:\Windows\Panther

2017-12-26 23:46 - 2016-12-27 20:32 - 000000000 ____D C:\ProgramData\NVIDIA Corporation

2017-12-26 23:46 - 2016-12-27 04:47 - 000000000 ____D C:\users\LIM

2017-12-26 23:45 - 2017-04-17 06:05 - 000000000 ____D C:\ProgramData\ASUS Smart Gesture

2017-12-26 23:45 - 2016-12-28 00:23 - 000000000 ____D C:\Users\LIM\AppData\Roaming\uTorrent

2017-12-26 23:45 - 2016-12-27 20:32 - 000000000 ____D C:\Program Files\NVIDIA Corporation

2017-12-26 23:44 - 2017-05-22 05:46 - 000000000 ____D C:\users\QBDataServiceUser26

2017-12-26 23:43 - 2016-12-27 20:32 - 000000180 _____ C:\Windows\System32\{A6D608F0-0BDE-491A-97AE-5C4B05D86E01}.bat

2017-12-26 23:43 - 2016-12-27 20:23 - 000000000 ____D C:\Windows\System32\SleepStudy

2017-12-26 23:43 - 2016-12-27 04:48 - 000000000 __SHD C:\Users\LIM\IntelGraphicsProfiles

2017-12-26 23:24 - 2016-12-27 23:14 - 000000000 ____D C:\Program Files (x86)\NVIDIA Corporation

2017-12-26 23:23 - 2016-12-27 23:16 - 000000000 ____D C:\Users\LIM\AppData\Local\NVIDIA Corporation

2017-12-26 23:23 - 2016-12-27 20:41 - 000000000 ____D C:\ProgramData\NVIDIA

2017-12-26 23:23 - 2016-12-27 19:45 - 000000000 ____D C:\Windows\Help

2017-12-26 23:22 - 2016-12-27 19:44 - 000000000 ____D C:\Windows\INF

2017-12-26 23:10 - 2016-12-27 19:23 - 000032768 _____ C:\Windows\System32\config\ELAM

2017-12-26 16:30 - 2016-12-28 03:01 - 000000000 ____D C:\Users\LIM\AppData\Local\CrashDumps

2017-12-26 16:27 - 2016-12-27 19:45 - 000000000 ____D C:\Windows\System32\NDF

2017-12-26 16:21 - 2016-12-27 19:45 - 000000000 ____D C:\Windows\AppReadiness

2017-12-25 02:10 - 2016-12-27 19:45 - 000000000 ___HD C:\Program Files\WindowsApps

2017-12-25 02:01 - 2017-02-14 08:00 - 000000000 ____D C:\Users\LIM\AppData\Local\Raroholo

2017-12-25 01:19 - 2017-02-13 15:59 - 000000000 ____D C:\Program Files (x86)\2K Games

2017-12-19 15:29 - 2016-12-28 04:57 - 000000034 _____ C:\Users\LIM\AppData\Roaming\AdobeWLCMCache.dat

2017-12-17 20:50 - 2017-06-19 03:15 - 1383704584 _____ C:\Windows\MEMORY.DMP

2017-12-17 20:50 - 2016-12-27 05:40 - 000000000 ____D C:\Windows\Minidump

2017-12-14 15:20 - 2016-12-27 05:00 - 000002262 _____ C:\Users\Public\Desktop\Google Chrome.lnk

2017-12-14 02:36 - 2017-11-05 19:29 - 000005168 _____ C:\Windows\System32\Tasks\Microsoft Office 15 Sync Maintenance for LIM-LIM LIM

2017-12-13 00:43 - 2017-01-23 00:27 - 000000000 ____D C:\Users\LIM\AppData\Local\Spotify

2017-12-12 23:08 - 2017-01-23 00:14 - 000000000 ____D C:\Users\LIM\AppData\Roaming\Spotify

2017-12-12 15:02 - 2016-12-28 04:58 - 000000000 ____D C:\Windows\System32\MRT

2017-12-12 14:55 - 2017-10-11 21:56 - 133326408 ____C (Microsoft Corporation) C:\Windows\System32\MRT-KB890830.exe

2017-12-12 14:55 - 2016-12-28 04:57 - 133326408 ____C (Microsoft Corporation) C:\Windows\System32\MRT.exe

2017-12-10 08:00 - 2017-02-15 09:13 - 000000410 _____ C:\Users\LIM\AppData\Roaming\WB.CFG

2017-12-07 23:51 - 2017-07-27 16:53 - 000000000 ____D C:\Program Files\rempl

2017-12-03 15:47 - 2017-11-14 01:16 - 000000000 ____D C:\Users\LIM\AppData\Roaming\vrayneui

2017-12-02 17:59 - 2016-12-26 23:01 - 000000000 ____D C:\Users\LIM\Documents\Shobe School

2017-12-01 17:06 - 2016-12-28 16:24 - 000835576 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerApp.exe

2017-12-01 17:06 - 2016-12-28 16:24 - 000177656 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerCPLApp.cpl

Files to move or delete:

====================

C:\Windows\Tasks\{0DE0382D-2791-53AD-406A-1C2AB49B2DAB}.job

Some files in TEMP:

====================

2017-11-21 06:12 - 2016-02-24 15:24 - 000066496 _____ (Autodesk, Inc.) C:\Users\LIM\AppData\Local\Temp\AcDeltree.exe

2017-11-14 01:13 - 2017-11-14 01:13 - 000314448 _____ () C:\Users\LIM\AppData\Local\Temp\setvrlservice.exe

2017-11-14 01:12 - 2017-11-14 01:12 - 005673816 _____ (Microsoft Corporation) C:\Users\LIM\AppData\Local\Temp\vcredist_vs2010sp1_x64.exe

2017-11-14 01:12 - 2017-11-14 01:12 - 020796920 _____ () C:\Users\LIM\AppData\Local\Temp\vrlservice_win_4.3.1.exe

==================== Known DLLs (Whitelisted) =========================

==================== Bamital & volsnap ======================

(There is no automatic fix for files that do not pass verification.)

C:\Windows\System32\winlogon.exe

[2017-01-10 18:10] - [2016-12-13 20:24] - 000673792 _____ (Microsoft Corporation) 917F081E2AB667C44F7D96DE1D16DFAE

C:\Windows\System32\wininit.exe

[2016-07-16 03:42] - [2016-07-16 03:42] - 000304240 _____ (Microsoft Corporation) 99A19C9A74E2F9820E501DCE77F84F70

C:\Windows\explorer.exe

[2016-12-19 20:06] - [2016-11-11 01:56] - 004673304 _____ (Microsoft Corporation) 4E10FB1A015B49AC68F76C1A3F4D9C0F

C:\Windows\SysWOW64\explorer.exe

[2016-12-19 20:06] - [2016-11-10 23:41] - 004311736 _____ (Microsoft Corporation) AF46710DDB8B0E304AA4FD2B940CABD8

C:\Windows\System32\svchost.exe

[2016-07-16 03:42] - [2016-07-16 03:42] - 000044496 _____ (Microsoft Corporation) 36F670D89040709013F6A460176767EC

C:\Windows\SysWOW64\svchost.exe

[2016-07-16 03:42] - [2016-07-16 03:42] - 000038792 _____ (Microsoft Corporation) 1F8434DD4907C832E6E90D6298EAB85B

C:\Windows\System32\services.exe

[2016-12-19 20:07] - [2016-11-11 01:51] - 000454592 _____ (Microsoft Corporation) 3C69CC28665854F1AAB4B4005005FA31

C:\Windows\System32\User32.dll

[2016-12-19 20:06] - [2016-12-09 02:10] - 001461200 _____ (Microsoft Corporation) C46EA86BF0E7C96235E9064CBAD6ED26

C:\Windows\SysWOW64\User32.dll

[2016-12-19 20:06] - [2016-12-09 01:52] - 001435896 _____ (Microsoft Corporation) 4BEC594A3D4AEAFAC400D88F7E328C7B

C:\Windows\System32\userinit.exe

[2016-07-16 03:42] - [2016-07-16 03:42] - 000033280 _____ (Microsoft Corporation) C1B1FFC800BE2F31EB2CF8CB40629C69

C:\Windows\SysWOW64\userinit.exe

[2016-07-16 03:42] - [2016-07-16 03:42] - 000027648 _____ (Microsoft Corporation) FA900E6CCCF0A429D5B720C6F0E2274B

C:\Windows\System32\rpcss.dll

[2016-07-16 03:42] - [2016-07-16 03:42] - 000888320 _____ (Microsoft Corporation) 7BD259FC59CF9C2AE1B979564B374CC6

C:\Windows\System32\dnsapi.dll

[2016-09-30 05:18] - [2016-09-15 09:30] - 000646136 _____ (Microsoft Corporation) 96B8A433F6407DE34850927C96C6CE9B

C:\Windows\SysWOW64\dnsapi.dll

[2016-09-30 05:18] - [2016-09-15 09:37] - 000496872 _____ (Microsoft Corporation) 227CFE3EDA82029AAC1C088A16297CD7

C:\Windows\System32\Drivers\volsnap.sys

[2016-07-16 03:42] - [2016-07-16 03:42] - 000391520 _____ (Microsoft Corporation) BF2546583BB75F01DDA60A7921DFB230

==================== Association (Whitelisted) =============

==================== Restore Points =========================

Restore point date: 2017-12-07 23:50

Restore point date: 2017-12-12 14:54

Restore point date: 2017-12-27 18:04

==================== Memory info ===========================

Percentage of memory in use: 12%

Total physical RAM: 8075.43 MB

Available physical RAM: 7033.72 MB

Total Virtual: 8075.43 MB

Available Virtual: 7106.06 MB

==================== Drives ================================

Drive c: (OS) (Fixed) (Total:372.6 GB) (Free:234.49 GB) NTFS ==>[system with boot components (obtained from drive)]

Drive d: (DATA) (Fixed) (Total:537.8 GB) (Free:187.29 GB) NTFS

Drive e: () (Removable) (Total:7.48 GB) (Free:7.48 GB) FAT32

Drive g: (Restore) (Fixed) (Total:20.01 GB) (Free:9.05 GB) NTFS

Drive x: (Boot) (Fixed) (Total:0.5 GB) (Free:0.5 GB) NTFS

==================== MBR & Partition Table ==================

========================================================

Disk: 0 (Size: 931.5 GB) (Disk ID: 85AEADEC)

Partition: GPT.

========================================================

Disk: 1 (Size: 7.5 GB) (Disk ID: 08FE6CD8)

Partition 1: (Not Active) - (Size=7.5 GB) - (Type=0B)

LastRegBack: 2017-12-27 00:16

==================== End of FRST.txt ============================

#2
RKinner

Posted 27 December 2017 - 08:33 AM

Malware Expert

Expert
24,625 posts

Download the attached fixlist.txt to the same location as FRST

[attachment=86434:fixlist.txt]

Run FRST and press Fix
A fix log will be generated please post that

Will it boot into regular mode now?

Run FRST again as before. Make sure Addition.txt is checked and hit Scan. Post both logs.

#3
Bjohn24

Posted 27 December 2017 - 06:58 PM

New Member

Topic Starter
Member
7 posts

attached here is the fixlog file

#4
Bjohn24

Posted 27 December 2017 - 07:01 PM

New Member

Topic Starter
Member
7 posts

having a hard time attaching the file, so i'll just paste the texts. Here you go,

Fix result of Farbar Recovery Scan Tool (x64) Version: 26-12-2017

Ran by LIM (28-12-2017 08:47:25) Run:2

Running from F:\

Loaded Profiles: LIM & QBDataServiceUser26 (Available Profiles: defaultuser0 & LIM & QBDataServiceUser26)

Boot Mode: Normal

==============================================

fixlist content:

*****************

GroupPolicy: Restriction <==== ATTENTION

HKU\LIM\...\Run: [AdobeBridge] => [X]

S1 ESProtectionDriver; C:\Windows\system32\drivers\mbae64.sys [77432 2017-12-26] ()

S2 MBAMService; C:\Program Files\Malwarebytes\Anti-Malware\mbamservice.exe [6234056 2017-10-31] (Malwarebytes)

S2 VRLService; C:\PROGRA~3\ASGVIS\DONGLE~1\STARTV~1.EXE [X]

S2 MBAMChameleon; C:\Windows\System32\Drivers\MbamChameleon.sys [193968 2017-12-26] (Malwarebytes)

S3 MBAMFarflt; C:\Windows\system32\DRIVERS\farflt.sys [110016 2017-12-26] (Malwarebytes)

S3 MBAMProtection; C:\Windows\system32\DRIVERS\mbam.sys [46008 2017-12-26] (Malwarebytes)

S0 MBAMSwissArmy; C:\Windows\System32\Drivers\mbamswissarmy.sys [253880 2017-12-26] ()

S3 MBAMWebProtection; C:\Windows\system32\DRIVERS\mwac.sys [94144 2017-12-26] (Malwarebytes)

S4 nvvad_WaveExtensible; \SystemRoot\system32\drivers\nvvad64v.sys [X]

S4 nvvhci; \SystemRoot\System32\drivers\nvvhci.sys [X]

C:\Windows\Tasks\{0DE0382D-2791-53AD-406A-1C2AB49B2DAB}.job

2017-11-21 06:12 - 2016-02-24 15:24 - 000066496 _____ (Autodesk, Inc.) C:\Users\LIM\AppData\Local\Temp\AcDeltree.exe

2017-11-14 01:13 - 2017-11-14 01:13 - 000314448 _____ () C:\Users\LIM\AppData\Local\Temp\setvrlservice.exe

2017-11-14 01:12 - 2017-11-14 01:12 - 005673816 _____ (Microsoft Corporation) C:\Users\LIM\AppData\Local\Temp\vcredist_vs2010sp1_x64.exe

2017-11-14 01:12 - 2017-11-14 01:12 - 020796920 _____ () C:\Users\LIM\AppData\Local\Temp\vrlservice_win_4.3.1.exe

C:\Program Files\Malwarebytes

CMD: FOR /F "usebackq delims==" %i IN (`wevtutil el`) DO wevtutil cl "%i"

*****************

"C:\Windows\system32\GroupPolicy\Machine" => not found

"HKU\LIM\Software\Microsoft\Windows\CurrentVersion\Run\\AdobeBridge" => not found

ESProtectionDriver => Unable to stop service.

HKLM\System\CurrentControlSet\Services\ESProtectionDriver => key could not remove, key could be protected

HKLM\System\CurrentControlSet\Services\MBAMService => key could not remove, key could be protected

VRLService => service not found.

MBAMChameleon => Unable to stop service.

HKLM\System\CurrentControlSet\Services\MBAMChameleon => key could not remove, key could be protected

HKLM\System\CurrentControlSet\Services\MBAMFarflt => key could not remove, key could be protected

HKLM\System\CurrentControlSet\Services\MBAMProtection => key could not remove, key could be protected

MBAMSwissArmy => Unable to stop service.

HKLM\System\CurrentControlSet\Services\MBAMSwissArmy => key could not remove, key could be protected

HKLM\System\CurrentControlSet\Services\MBAMWebProtection => key could not remove, key could be protected

nvvad_WaveExtensible => service not found.

nvvhci => service not found.

"C:\Windows\Tasks\{0DE0382D-2791-53AD-406A-1C2AB49B2DAB}.job" => not found

"C:\Users\LIM\AppData\Local\Temp\AcDeltree.exe" => not found

"C:\Users\LIM\AppData\Local\Temp\setvrlservice.exe" => not found

"C:\Users\LIM\AppData\Local\Temp\vcredist_vs2010sp1_x64.exe" => not found

"C:\Users\LIM\AppData\Local\Temp\vrlservice_win_4.3.1.exe" => not found

"C:\Program Files\Malwarebytes" => not found

========= FOR /F "usebackq delims==" %i IN (`wevtutil el`) DO wevtutil cl "%i" =========

Failed to clear log DebugChannel. The requested operation cannot be performed over an enabled direct channel. The channel must first be disabled before performing the requested operation.

Failed to clear log Microsoft-RMS-MSIPC/Debug. The instance name passed was not recognized as valid by a WMI data provider.

Failed to clear log Microsoft-Windows-LiveId/Analytic. Access is denied.

Failed to clear log Microsoft-Windows-LiveId/Operational. Access is denied.

Failed to clear log Microsoft-Windows-USBVideo/Analytic. The instance name passed was not recognized as valid by a WMI data provider.

========= End of CMD: =========

Result of scheduled files to move (Boot Mode: Normal) (Date&Time: 28-12-2017 08:51:31)

Result of scheduled keys to remove after reboot:

HKLM\System\CurrentControlSet\Services\ESProtectionDriver => key could not remove, key could be protected

HKLM\System\CurrentControlSet\Services\MBAMService => key could not remove, key could be protected

HKLM\System\CurrentControlSet\Services\MBAMChameleon => key could not remove, key could be protected

HKLM\System\CurrentControlSet\Services\MBAMFarflt => key could not remove, key could be protected

HKLM\System\CurrentControlSet\Services\MBAMProtection => key could not remove, key could be protected

HKLM\System\CurrentControlSet\Services\MBAMSwissArmy => key could not remove, key could be protected

HKLM\System\CurrentControlSet\Services\MBAMWebProtection => key could not remove, key could be protected

==== End of Fixlog 08:51:32 ====

#5
Bjohn24

Posted 27 December 2017 - 07:10 PM

New Member

Topic Starter
Member
7 posts

I ran thr FRST again and here is the log file,

Scan result of Farbar Recovery Scan Tool (FRST) (x64) Version: 26-12-2017

Ran by LIM (administrator) on LIM (28-12-2017 09:01:48)

Running from F:\

Loaded Profiles: LIM & QBDataServiceUser26 (Available Profiles: defaultuser0 & LIM & QBDataServiceUser26)

Platform: Windows 10 Home Single Language Version 1607 14393.693 (X64) Language: English (United States)

Internet Explorer Version 11 (Default browser: Chrome)

Boot Mode: Normal

Tutorial for Farbar Recovery Scan Tool: http://www.geekstogo...very-scan-tool/

==================== Processes (Whitelisted) =================

(If an entry is included in the fixlist, the process will be closed. The file will not be moved.)

(NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\Display.NvContainer\NVDisplay.Container.exe

(Intel Corporation) C:\Windows\System32\igfxCUIService.exe

(NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\Display\nvxdsync.exe

(Adobe Systems, Incorporated) C:\Program Files (x86)\Common Files\Adobe\AdobeGCClient\AGSService.exe

(Intel Corporation) C:\Windows\System32\DptfPolicyCriticalService.exe

(Autodesk Inc.) C:\Program Files (x86)\Autodesk\Autodesk Desktop App\AdAppMgrSvc.exe

(NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\NvContainer\nvcontainer.exe

(Intel Corporation) C:\Windows\System32\DptfPolicyConfigTDPService.exe

(Intel Corporation) C:\Windows\System32\DptfParticipantProcessorService.exe

(Intel Corporation) C:\Windows\System32\DptfPolicyLpmService.exe

() C:\Program Files\Chaos Group\V-Ray Swarm\register-service.exe

(Intuit) C:\Program Files (x86)\Common Files\Intuit\QuickBooks\QBCFMonitorService.exe

(Intel Corporation) C:\Windows\System32\DptfParticipantDisplayService.exe

(Intuit Inc.) C:\Program Files (x86)\Common Files\Intuit\DataProtect\QBIDPService.exe

(Microsoft Corporation) C:\Program Files\Windows Defender\MsMpEng.exe

(NVIDIA Corporation) C:\Program Files (x86)\NVIDIA Corporation\NvTelemetry\NvTelemetryContainer.exe

(Chaos Software Ltd.) C:\Program Files\Chaos Group\V-Ray Swarm\swrm.exe

(Microsoft Corporation) C:\Program Files\Windows Defender\NisSrv.exe

(Microsoft Corporation) C:\Windows\Microsoft.NET\Framework64\v3.0\WPF\PresentationFontCache.exe

(NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\Display\nvtray.exe

(Intel Corporation) C:\Windows\System32\igfxEM.exe

(Intel Corporation) C:\Windows\System32\igfxHK.exe

() C:\Windows\System32\igfxTray.exe

(Intuit, Inc.) C:\Program Files (x86)\Intuit\QuickBooks Enterprise Solutions 16.0\QBDBMgrN.exe

(Microsoft Corporation) C:\Program Files\Windows Defender\MpCmdRun.exe

(AsusTek) C:\Program Files (x86)\ASUS\ASUS Smart Gesture\AsTPCenter\x64\AsusTPLoader.exe

(Microsoft Corporation) C:\Program Files\Windows Defender\MSASCuiL.exe

(Intel Corporation) C:\Windows\System32\DptfPolicyLpmServiceHelper.exe

(Autodesk, Inc.) C:\Program Files\Autodesk\Personal Accelerator for Revit\RevitAccelerator.exe

(BitTorrent Inc.) C:\Users\LIM\AppData\Roaming\uTorrent\uTorrent.exe

(Akamai Technologies, Inc.) C:\Users\LIM\AppData\Local\Akamai\netsession_win.exe

(BitTorrent Inc.) C:\Users\LIM\AppData\Roaming\uTorrent\updates\3.5.0_44294\utorrentie.exe

(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe

(Microsoft Corporation) C:\Windows\System32\bcastdvr.exe

(Microsoft Corporation) C:\Windows\System32\GamePanel.exe

(AsusTek) C:\Program Files (x86)\ASUS\ASUS Smart Gesture\AsTPCenter\x64\AsusTPCenter.exe

(AsusTek) C:\Program Files (x86)\ASUS\ASUS Smart Gesture\AsTPCenter\x64\AsusTPHelper.exe

(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe

(Microsoft Corporation) C:\Windows\System32\InstallAgent.exe

(Microsoft Corporation) C:\Windows\System32\InstallAgentUserBroker.exe

(Microsoft Corporation) C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.14393.1561_none_7ef6e89821f9a6be\TiWorker.exe

(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe

==================== Registry (Whitelisted) ===========================

(If an entry is included in the fixlist, the registry item will be restored to default or removed. The file will not be moved.)

HKLM\...\Run: [WindowsDefender] => C:\Program Files\Windows Defender\MSASCuiL.exe [631808 2016-09-07] (Microsoft Corporation)

HKLM\...\Run: [DptfPolicyLpmServiceHelper] => C:\Windows\system32\DptfPolicyLpmServiceHelper.exe [114048 2013-10-18] (Intel Corporation)

HKLM\...\Run: [AdobeAAMUpdater-1.0] => C:\Program Files (x86)\Common Files\Adobe\OOBE\PDApp\UWA\UpdaterStartupUtility.exe [508128 2016-07-01] (Adobe Systems Incorporated)

HKLM\...\Run: [ShadowPlay] => "C:\Windows\system32\rundll32.exe" C:\Windows\system32\nvspcap64.dll,ShadowPlayOnSystemStart

HKLM\...\Run: [XboxStat] => C:\Program Files\Microsoft Xbox 360 Accessories\XboxStat.exe [825184 2009-09-30] (Microsoft Corporation)

HKLM\...\Run: [Malwarebytes TrayApp] => C:\PROGRAM FILES\MALWAREBYTES\ANTI-MALWARE\mbamtray.exe

HKLM\...\Run: [pac] => C:\Program Files\Autodesk\Personal Accelerator for Revit\RevitAccelerator.exe [339464 2016-02-10] (Autodesk, Inc.)

HKLM-x32\...\Run: [ADSKAppManager] => C:\Program Files (x86)\Autodesk\Autodesk Desktop App\AutodeskDesktopApp.exe [692160 2016-01-19] (Autodesk, Inc.)

HKLM-x32\...\Run: [Adobe Creative Cloud] => C:\Program Files (x86)\Adobe\Adobe Creative Cloud\ACC\Creative Cloud.exe [2383040 2016-10-25] (Adobe Systems Incorporated)

HKU\S-1-5-21-1694938941-4250371870-4056835700-1001\...\Run: [AdobeBridge] => [X]

HKU\S-1-5-21-1694938941-4250371870-4056835700-1001\...\Run: [uTorrent] => C:\Users\LIM\AppData\Roaming\uTorrent\uTorrent.exe [1981624 2017-11-29] (BitTorrent Inc.)

HKU\S-1-5-21-1694938941-4250371870-4056835700-1001\...\Run: [Steam] => C:\Program Files (x86)\Steam\steam.exe [3101984 2017-10-12] (Valve Corporation)

HKU\S-1-5-21-1694938941-4250371870-4056835700-1001\...\Run: [Spotify] => C:\Users\LIM\AppData\Roaming\Spotify\Spotify.exe [21074320 2017-12-09] (Spotify Ltd)

HKU\S-1-5-21-1694938941-4250371870-4056835700-1001\...\Run: [Akamai NetSession Interface] => C:\Users\LIM\AppData\Local\Akamai\netsession_win.exe [4490200 2017-09-08] (Akamai Technologies, Inc.)

HKU\S-1-5-21-1694938941-4250371870-4056835700-1001\...\Run: [Spotify Web Helper] => C:\Users\LIM\AppData\Roaming\Spotify\SpotifyWebHelper.exe [780688 2017-12-09] (Spotify Ltd)

HKU\S-1-5-21-1694938941-4250371870-4056835700-1001\...\Policies\Explorer: []

HKU\S-1-5-21-1694938941-4250371870-4056835700-1001\...\MountPoints2: {42e78860-ccb5-11e6-93e6-806e6f6e6963} - "E:\Msetup4.exe"

Startup: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\Intuit Data Protect.lnk [2017-06-17]

ShortcutTarget: Intuit Data Protect.lnk -> C:\Program Files (x86)\Common Files\Intuit\DataProtect\IntuitDataProtect.exe (Intuit Inc.)

Startup: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\QuickBooks Update Agent.lnk [2017-06-17]

ShortcutTarget: QuickBooks Update Agent.lnk -> C:\Program Files (x86)\Common Files\Intuit\QuickBooks\QBUpdate\qbupdate.exe (Intuit Inc.)

Startup: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\QuickBooks Web Connector.lnk [2017-06-17]

ShortcutTarget: QuickBooks Web Connector.lnk -> C:\Program Files (x86)\Common Files\Intuit\QuickBooks\QBWebConnector\QBWebConnector.exe (Intuit)

Startup: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\QuickBooks_Standard_21.lnk [2017-06-17]

ShortcutTarget: QuickBooks_Standard_21.lnk -> C:\Program Files (x86)\Intuit\QuickBooks Enterprise Solutions 16.0\QBW32.EXE (Intuit Inc.)

==================== Internet (Whitelisted) ====================

(If an item is included in the fixlist, if it is a registry item it will be removed or restored to default.)

Hosts: There are more than one entry in Hosts. See Hosts section of Addition.txt

Tcpip\Parameters: [DhcpNameServer] 192.168.254.254 192.168.254.254

Tcpip\..\Interfaces\{e902dbe4-8838-4bff-b8a3-4f4ca8347af2}: [DhcpNameServer] 192.168.254.254 192.168.254.254

Tcpip\..\Interfaces\{fc9d7448-82ed-4323-93b4-0980cff08923}: [NameServer] 192.168.254.254

Internet Explorer:

==================

HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = www.google.com

HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Start Page = www.google.com

HKU\S-1-5-21-1694938941-4250371870-4056835700-1001\Software\Microsoft\Internet Explorer\Main,Start Page Redirect Cache = hxxp://www.msn.com/en-ph/?ocid=iehp

SearchScopes: HKLM -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL =

SearchScopes: HKLM-x32 -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL =

BHO: Office Document Cache Handler -> {B4F3A835-0E21-4959-BA22-42B3008E02FF} -> C:\Program Files\Microsoft Office\Office15\URLREDIR.DLL [2012-10-01] (Microsoft Corporation)

BHO-x32: Office Document Cache Handler -> {B4F3A835-0E21-4959-BA22-42B3008E02FF} -> C:\Program Files (x86)\Microsoft Office\Office15\URLREDIR.DLL [2012-10-01] (Microsoft Corporation)

BHO-x32: Microsoft SkyDrive Pro Browser Helper -> {D0498E0A-45B7-42AE-A9AA-ABA463DBD3BF} -> C:\Program Files (x86)\Microsoft Office\Office15\GROOVEEX.DLL [2012-10-01] (Microsoft Corporation)

Handler-x32: intu-help-qb9 - {C1252096-0E63-4C06-A38B-03DF9A16AA12} - C:\Program Files (x86)\Intuit\QuickBooks Enterprise Solutions 16.0\HelpAsyncPluggableProtocol.dll [2015-08-19] (Intuit, Inc.)

Handler: osf - {D924BDC6-C83A-4BD5-90D0-095128A113D1} - C:\Program Files\Microsoft Office\Office15\MSOSB.DLL [2012-10-01] (Microsoft Corporation)

Handler-x32: qbwc - {FC598A64-626C-4447-85B8-53150405FD57} - C:\Windows\system32\mscoree.dll [2016-07-16] (Microsoft Corporation)

StartMenuInternet: IEXPLORE.EXE - iexplore.exe

FireFox:

========

FF Plugin: @Microsoft.com/NpCtrl,version=1.0 -> c:\Program Files\Microsoft Silverlight\5.1.50906.0\npctrl.dll [2017-03-09] ( Microsoft Corporation)

FF Plugin: @microsoft.com/SharePoint,version=14.0 -> C:\PROGRA~1\MICROS~1\Office15\NPSPWRAP.DLL [2012-10-01] (Microsoft Corporation)

FF Plugin: adobe.com/AdobeAAMDetect -> C:\Program Files (x86)\Adobe\Adobe Creative Cloud\Utils\npAdobeAAMDetect64.dll [2016-10-25] (Adobe Systems)

FF Plugin-x32: @Microsoft.com/NpCtrl,version=1.0 -> c:\Program Files (x86)\Microsoft Silverlight\5.1.50906.0\npctrl.dll [2017-03-09] ( Microsoft Corporation)

FF Plugin-x32: @microsoft.com/SharePoint,version=14.0 -> C:\PROGRA~2\MICROS~1\Office15\NPSPWRAP.DLL [2012-10-01] (Microsoft Corporation)

FF Plugin-x32: @tools.google.com/Google Update;version=3 -> C:\Program Files (x86)\Google\Update\1.3.33.7\npGoogleUpdate3.dll [2017-11-15] (Google Inc.)

FF Plugin-x32: @tools.google.com/Google Update;version=9 -> C:\Program Files (x86)\Google\Update\1.3.33.7\npGoogleUpdate3.dll [2017-11-15] (Google Inc.)

FF Plugin-x32: Adobe Reader -> C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AIR\nppdf32.dll [2017-11-05] (Adobe Systems Inc.)

FF Plugin-x32: adobe.com/AdobeAAMDetect -> C:\Program Files (x86)\Adobe\Adobe Creative Cloud\Utils\npAdobeAAMDetect32.dll [2016-10-25] (Adobe Systems)

Chrome:

=======

CHR DefaultSearchURL: Default -> hxxp://srchbar.com/?q={searchTerms}

CHR DefaultSuggestURL: Default -> hxxp://srch.bar/?s={searchTerms}

CHR Profile: C:\Users\LIM\AppData\Local\Google\Chrome\User Data\Default [2017-12-28]

CHR Extension: (Slides) - C:\Users\LIM\AppData\Local\Google\Chrome\User Data\Default\Extensions\aapocclcgogkmnckokdopfmhonfmgoek [2017-10-16]

CHR Extension: (Docs) - C:\Users\LIM\AppData\Local\Google\Chrome\User Data\Default\Extensions\aohghmighlieiainnegkcijnfilokake [2017-10-16]

CHR Extension: (Google Drive) - C:\Users\LIM\AppData\Local\Google\Chrome\User Data\Default\Extensions\apdfllckaahabafndbhieahigkjlhalf [2016-12-27]

CHR Extension: (YouTube) - C:\Users\LIM\AppData\Local\Google\Chrome\User Data\Default\Extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo [2016-12-27]

CHR Extension: (Adblock Plus) - C:\Users\LIM\AppData\Local\Google\Chrome\User Data\Default\Extensions\cfhdojbkjhnklbpkdaibdccddilifddb [2017-09-27]

CHR Extension: (Adobe Acrobat) - C:\Users\LIM\AppData\Local\Google\Chrome\User Data\Default\Extensions\efaidnbmnnnibpcajpcglclefindmkaj [2017-03-10]

CHR Extension: (hTab) - C:\Users\LIM\AppData\Local\Google\Chrome\User Data\Default\Extensions\elmkjjfkkchohaaoljobaffjeedcoocj [2017-12-06]

CHR Extension: (Sheets) - C:\Users\LIM\AppData\Local\Google\Chrome\User Data\Default\Extensions\felcaaldnbdncclmgdcncolpebgiejap [2017-10-16]

CHR Extension: (Google Docs Offline) - C:\Users\LIM\AppData\Local\Google\Chrome\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi [2016-12-27]

CHR Extension: (Search Manager) - C:\Users\LIM\AppData\Local\Google\Chrome\User Data\Default\Extensions\nahhmpbckpgdidfnmfkfgiflpjijilce [2017-11-27]

CHR Extension: (Chrome Web Store Payments) - C:\Users\LIM\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda [2017-08-25]

CHR Extension: (Gmail) - C:\Users\LIM\AppData\Local\Google\Chrome\User Data\Default\Extensions\pjkljhegncpnkpknbcohdijeoejaedia [2016-12-27]

CHR Extension: (Chrome Media Router) - C:\Users\LIM\AppData\Local\Google\Chrome\User Data\Default\Extensions\pkedcjkdefgpdelpbcmbmeomcjbeemfm [2017-12-28]

CHR HKLM\...\Chrome\Extension: [elmkjjfkkchohaaoljobaffjeedcoocj] - hxxps://clients2.google.com/service/update2/crx

CHR HKLM\...\Chrome\Extension: [nahhmpbckpgdidfnmfkfgiflpjijilce] - hxxps://clients2.google.com/service/update2/crx

CHR HKU\S-1-5-21-1694938941-4250371870-4056835700-1001\SOFTWARE\Google\Chrome\Extensions\...\Chrome\Extension: [efaidnbmnnnibpcajpcglclefindmkaj] - hxxps://clients2.google.com/service/update2/crx

CHR HKU\S-1-5-21-1694938941-4250371870-4056835700-1001\SOFTWARE\Google\Chrome\Extensions\...\Chrome\Extension: [elmkjjfkkchohaaoljobaffjeedcoocj] - hxxps://clients2.google.com/service/update2/crx

CHR HKU\S-1-5-21-1694938941-4250371870-4056835700-1001\SOFTWARE\Google\Chrome\Extensions\...\Chrome\Extension: [nahhmpbckpgdidfnmfkfgiflpjijilce] - hxxps://clients2.google.com/service/update2/crx

CHR HKLM-x32\...\Chrome\Extension: [elmkjjfkkchohaaoljobaffjeedcoocj] - hxxps://clients2.google.com/service/update2/crx

CHR HKLM-x32\...\Chrome\Extension: [nahhmpbckpgdidfnmfkfgiflpjijilce] - hxxps://clients2.google.com/service/update2/crx

==================== Services (Whitelisted) ====================

(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)

R2 AdAppMgrSvc; C:\Program Files (x86)\Autodesk\Autodesk Desktop App\AdAppMgrSvc.exe [1222664 2016-01-19] (Autodesk Inc.)

S4 AdobeUpdateService; C:\Program Files (x86)\Common Files\Adobe\Adobe Desktop Common\ElevationManager\AdobeUpdateService.exe [744640 2016-10-25] (Adobe Systems Incorporated)

R2 AGSService; C:\Program Files (x86)\Common Files\Adobe\AdobeGCClient\AGSService.exe [2257016 2017-08-23] (Adobe Systems, Incorporated)

S4 Autodesk Content Service; C:\Program Files\Autodesk\Content Service\Connect.Service.ContentService.exe [31160 2015-02-05] (Autodesk, Inc.)

R2 DptfParticipantDisplayService; C:\Windows\System32\DptfParticipantDisplayService.exe [141944 2013-10-18] (Intel Corporation)

R2 DptfParticipantProcessorService; C:\Windows\system32\DptfParticipantProcessorService.exe [117704 2013-10-18] (Intel Corporation)

R2 DptfPolicyConfigTDPService; C:\Windows\system32\DptfPolicyConfigTDPService.exe [116680 2013-10-18] (Intel Corporation)

R2 DptfPolicyCriticalService; C:\Windows\system32\DptfPolicyCriticalService.exe [148160 2013-10-18] (Intel Corporation)

R2 DptfPolicyLpmService; C:\Windows\system32\DptfPolicyLpmService.exe [126952 2013-10-18] (Intel Corporation)

S2 Ds3Service; C:\Program Files (x86)\ScarletProduction\bin\ScpService.exe [388352 2013-05-05] (Scarlet.Crush Productions)

R2 igfxCUIService2.0.0.0; C:\Windows\system32\igfxCUIService.exe [373728 2016-11-30] (Intel Corporation)

R2 NvContainerLocalSystem; C:\Program Files\NVIDIA Corporation\NvContainer\nvcontainer.exe [495224 2017-05-04] (NVIDIA Corporation)

S3 NvContainerNetworkService; C:\Program Files\NVIDIA Corporation\NvContainer\nvcontainer.exe [495224 2017-05-04] (NVIDIA Corporation)

R2 NVDisplay.ContainerLocalSystem; C:\Program Files\NVIDIA Corporation\Display.NvContainer\NVDisplay.Container.exe [464440 2017-01-20] (NVIDIA Corporation)

R2 NvTelemetryContainer; C:\Program Files (x86)\NVIDIA Corporation\NvTelemetry\NvTelemetryContainer.exe [450168 2017-05-04] (NVIDIA Corporation)

R2 QBCFMonitorService; C:\Program Files (x86)\Common Files\Intuit\QuickBooks\QBCFMonitorService.exe [45056 2015-08-19] (Intuit) [File not signed]

S3 QBFCService; C:\Program Files (x86)\Common Files\Intuit\QuickBooks\FCS\Intuit.QuickBooks.FCS.exe [65536 2015-08-19] (Intuit Inc.) [File not signed]

R2 QBVSS; C:\Program Files (x86)\Common Files\Intuit\DataProtect\QBIDPService.exe [1248256 2015-08-19] (Intuit Inc.) [File not signed]

R3 QuickBooksDB26; C:\Program Files (x86)\Intuit\QuickBooks Enterprise Solutions 16.0\QBDBMgrN.exe [127792 2015-08-19] (Intuit, Inc.) [File not signed]

R2 vrswrm-service; C:\Program Files\Chaos Group\V-Ray Swarm\register-service.exe [90176 2017-11-14] ()

R3 WdNisSvc; C:\Program Files\Windows Defender\NisSrv.exe [347328 2016-07-16] (Microsoft Corporation)

R2 WinDefend; C:\Program Files\Windows Defender\MsMpEng.exe [103720 2016-07-16] (Microsoft Corporation)

S2 MBAMService; "C:\Program Files\Malwarebytes\Anti-Malware\mbamservice.exe" [X]

S2 NVIDIA Wireless Controller Service; "C:\Program Files\NVIDIA Corporation\GeForce Experience Service\nvwirelesscontroller.exe" [X]

===================== Drivers (Whitelisted) ======================

(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)

R3 AsusTP; C:\Windows\System32\drivers\AsusTP.sys [124928 2017-03-09] (ASUS Corporation)

S3 DptfDevDisplay; C:\Windows\System32\drivers\DptfDevDisplay.sys [70752 2013-10-18] (Intel Corporation)

R3 DptfDevDram; C:\Windows\System32\drivers\DptfDevDram.sys [145640 2013-10-18] (Intel Corporation)

S3 DptfDevFan; C:\Windows\System32\drivers\DptfDevFan.sys [50640 2013-10-18] (Intel Corporation)

S3 DptfDevGen; C:\Windows\System32\drivers\DptfDevGen.sys [78504 2013-10-18] (Intel Corporation)

R3 DptfDevPch; C:\Windows\System32\drivers\DptfDevPch.sys [116752 2013-10-18] (Intel Corporation)

S3 DptfDevPower; C:\Windows\System32\drivers\DptfDevPower.sys [71808 2013-10-18] (Intel Corporation)

R3 DptfDevProc; C:\Windows\System32\drivers\DptfDevProc.sys [289744 2013-10-18] (Intel Corporation)

R3 DptfManager; C:\Windows\System32\drivers\DptfManager.sys [494296 2013-10-18] (Intel Corporation)

R1 ESProtectionDriver; C:\Windows\system32\drivers\mbae64.sys [77376 2017-07-15] ()

R3 kbfiltr; C:\Windows\System32\drivers\kbfiltr.sys [17280 2012-08-06] ( )

S3 libusbK; C:\Windows\System32\drivers\libusbK.sys [47200 2017-02-14] (hxxp://libusb-win32.sourceforge.net)

R2 MBAMChameleon; C:\Windows\system32\drivers\MBAMChameleon.sys [188352 2017-12-28] (Malwarebytes)

S3 MBAMFarflt; C:\Windows\system32\drivers\farflt.sys [101784 2017-12-28] (Malwarebytes)

S3 MBAMProtection; C:\Windows\system32\drivers\mbam.sys [45472 2017-12-28] (Malwarebytes)

R0 MBAMSwissArmy; C:\Windows\System32\drivers\MBAMSwissArmy.sys [253856 2017-12-28] (Malwarebytes)

S3 MBAMWebProtection; C:\Windows\system32\drivers\mwac.sys [93600 2017-12-28] (Malwarebytes)

R3 MEIx64; C:\Windows\System32\drivers\TeeDriverx64.sys [99288 2013-10-24] (Intel Corporation)

S3 NetAdapterCx; C:\Windows\System32\drivers\NetAdapterCx.sys [90624 2016-07-16] ()

R3 nvlddmkm; C:\Windows\System32\DriverStore\FileRepository\nvami.inf_amd64_01b64dec419235d3\nvlddmkm.sys [14427064 2017-01-21] (NVIDIA Corporation)

S3 NvStreamKms; C:\Program Files\NVIDIA Corporation\NvStreamSrv\NvStreamKms.sys [30328 2017-05-04] (NVIDIA Corporation)

S3 NVSWCFilter; C:\Windows\System32\drivers\nvswcfilter.sys [28344 2015-10-10] (Windows ® Win 7 DDK provider)

R3 rt640x64; C:\Windows\System32\drivers\rt640x64.sys [895256 2015-07-07] (Realtek )

R3 RTSPER; C:\Windows\system32\DRIVERS\RtsPer.sys [751632 2015-05-14] (Realsil Semiconductor Corporation)

R3 ScpVBus; C:\Windows\System32\drivers\ScpVBus.sys [39168 2013-05-19] (Scarlet.Crush Productions)

S0 WdBoot; C:\Windows\System32\drivers\WdBoot.sys [44056 2016-07-16] (Microsoft Corporation)

R0 WdFilter; C:\Windows\System32\drivers\WdFilter.sys [290144 2016-07-16] (Microsoft Corporation)

R3 WdNisDrv; C:\Windows\System32\Drivers\WdNisDrv.sys [123232 2016-07-16] (Microsoft Corporation)

==================== NetSvcs (Whitelisted) ===================

(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)

==================== One Month Created files and folders ========

(If an entry is included in the fixlist, the file/folder will be moved.)

2017-12-28 13:11 - 2017-12-28 13:11 - 000000000 ____D C:\Windows\system32\config\backup1

2017-12-28 12:28 - 2017-12-28 12:28 - 000071142 _____ C:\Windows\system32\config\mybackup

2017-12-28 12:27 - 2017-12-28 13:12 - 000000000 ____D C:\Windows\system32\config\backup

2017-12-28 11:09 - 2017-12-28 09:01 - 000000000 ____D C:\FRST

2017-12-28 08:41 - 2017-12-28 08:43 - 000051936 _____ C:\Users\LIM\Desktop\Addition.txt

2017-12-28 07:24 - 2017-12-28 07:25 - 000000000 ___HD C:\$WINDOWS.~BT

2017-12-28 07:00 - 2017-12-28 08:52 - 000000000 ____D C:\Users\LIM\AppData\LocalLow\uTorrent

2017-12-27 15:49 - 2017-12-27 15:49 - 000000000 ____D C:\temp

2017-12-27 08:37 - 2017-12-28 15:10 - 000000000 ____D C:\Windows\pss

2017-12-25 17:20 - 2017-12-28 15:11 - 000000000 ____D C:\ProgramData\MB3CoreBackup

2017-12-25 17:19 - 2017-12-25 17:19 - 000000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Games

2017-12-24 07:55 - 2017-12-24 07:55 - 000104133 _____ C:\Users\LIM\Downloads\Philippine Airlines_Sunday Dec 24, 2017_WGTCJR_ANGELICAUY LIM.pdf

2017-12-24 07:55 - 2017-12-24 07:55 - 000103742 _____ C:\Users\LIM\Downloads\Philippine Airlines_Sunday Dec 24, 2017_ZCMHLR_LUNA BELLA LIM.pdf

2017-12-20 07:27 - 2017-12-20 08:06 - 000500145 _____ C:\Users\LIM\Downloads\LIMGEL.ai

2017-12-15 07:16 - 2017-12-15 07:16 - 002609535 _____ C:\Users\LIM\Downloads\Stripmall-Floor-Plan.pdf

2017-12-15 07:14 - 2017-12-15 07:14 - 003022155 _____ C:\Users\LIM\Downloads\SHER_FINAL-STRIPMALL-SECTIONS-A-B.dwg

2017-12-15 07:14 - 2017-12-15 07:14 - 002520432 _____ C:\Users\LIM\Downloads\SHER_STRIPMALL-SECTIONS-3-B.dwg

2017-12-13 20:11 - 2017-12-13 20:11 - 005341791 _____ C:\Users\LIM\Downloads\LOREGA SITE DEV.pdf

2017-12-13 08:37 - 2017-12-13 08:37 - 015696310 _____ C:\Users\LIM\Documents\AutoSave_Untitled_2.skp

2017-12-12 11:22 - 2017-12-12 11:22 - 014413952 _____ C:\Users\LIM\Documents\AutoSave_Untitled_1.skp

2017-12-12 09:41 - 2017-12-13 16:36 - 052446869 _____ C:\Users\LIM\Downloads\FP-FINAL.dwg

2017-12-12 09:41 - 2017-12-13 16:28 - 053163683 _____ C:\Users\LIM\Downloads\FP-FINAL.bak

2017-12-10 20:54 - 2017-12-10 20:54 - 000098312 _____ C:\Users\LIM\Downloads\market.dwg

2017-12-10 19:09 - 2017-12-10 19:09 - 001199593 _____ C:\Users\LIM\Downloads\parking+villa.skp

2017-12-10 19:06 - 2017-12-10 20:51 - 000000000 ____D C:\Users\LIM\Downloads\to delete

2017-12-10 19:05 - 2016-05-19 00:44 - 002567130 _____ C:\Users\LIM\Downloads\parque.dwg

2017-12-08 22:26 - 2017-12-08 21:54 - 001482024 _____ C:\Users\LIM\Downloads\black+and+white+pictures.skb

2017-12-08 22:26 - 2017-12-08 21:43 - 018791581 _____ C:\Users\LIM\Downloads\PodiumBrowser_sample_with_image.skb

2017-12-08 22:09 - 2017-12-08 22:10 - 006560616 _____ C:\Users\LIM\Downloads\Living+Room+Zach+lit+with+THORN+downlight+and+Floor+lamp.skp

2017-12-08 21:43 - 2017-12-08 22:26 - 019529108 _____ C:\Users\LIM\Downloads\PodiumBrowser_sample_with_image.skp

2017-12-08 21:43 - 2017-12-08 21:43 - 013304565 _____ C:\Users\LIM\Downloads\Dark+living.skp

2017-12-08 16:27 - 2017-12-08 16:28 - 039568905 _____ C:\Users\LIM\Downloads\AutoSave_AutoSave_Senza+titolo_2_1.skp

2017-12-06 21:16 - 2017-12-06 21:20 - 028724149 _____ C:\Users\LIM\Downloads\bedroom.skp

2017-12-06 21:06 - 2017-12-06 21:07 - 012843375 _____ C:\Users\LIM\Downloads\Bedroom.skp.crdownload

2017-12-06 21:03 - 2017-12-06 21:03 - 001581503 _____ C:\Users\LIM\Downloads\dads,moms+new+bedroom.skp

2017-12-06 20:35 - 2017-12-06 20:35 - 026709157 _____ C:\Users\LIM\Documents\AutoSave_Untitled.skp

2017-12-06 08:50 - 2017-12-06 08:50 - 000000000 ____D C:\Users\LIM\Downloads\111064v4586026_clothingandaccessories

2017-12-06 08:49 - 2017-06-20 10:51 - 000214826 _____ C:\Users\LIM\Downloads\roupaseacessorios.dwg

2017-12-06 08:38 - 2017-12-06 12:01 - 000000000 ____D C:\Users\LIM\Downloads\108773v4586026_bedroomfurniture

2017-12-06 08:38 - 2017-12-06 08:38 - 000188804 _____ C:\Users\LIM\Downloads\108773v4586026_bedroomfurniture.zip

2017-12-04 22:08 - 2017-12-04 22:09 - 033991721 _____ C:\Users\LIM\Downloads\32691+Garabaldi+Contemporary+2.skp

2017-12-03 18:48 - 2017-12-03 18:49 - 018570084 _____ C:\Users\LIM\Downloads\3d+birouri+daniel+varianta+2+a.skp

2017-11-29 21:29 - 2017-11-29 21:30 - 038411056 _____ C:\Users\LIM\Downloads\Cargill1.skp

2017-11-29 17:43 - 2017-11-29 17:43 - 002329671 _____ C:\Users\LIM\Downloads\Mountain+Branch+Bath.skp

==================== One Month Modified files and folders ========

(If an entry is included in the fixlist, the file/folder will be moved.)

2017-12-28 15:12 - 2016-12-28 12:42 - 000000000 ____D C:\Users\defaultuser0

2017-12-28 15:12 - 2016-12-28 11:45 - 000000000 ____D C:\Windows\SysWOW64\Macromed

2017-12-28 15:12 - 2016-12-28 11:45 - 000000000 ____D C:\Windows\system32\Sysprep

2017-12-28 15:11 - 2017-11-20 12:08 - 000000000 ____D C:\Users\LIM\AppData\Local\Akamai

2017-12-28 15:11 - 2017-07-09 12:46 - 000000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\World in Conflict [GOG.com]

2017-12-28 15:11 - 2017-07-09 12:41 - 000000000 ____D C:\Program Files (x86)\World in Conflict - Complete Edition

2017-12-28 15:11 - 2017-06-23 23:19 - 000000000 ____D C:\Program Files (x86)\Steam

2017-12-28 15:11 - 2017-02-15 00:00 - 000000000 ____D C:\Users\LIM\AppData\Local\Raroholo

2017-12-28 15:11 - 2016-12-28 19:53 - 000000000 ____D C:\ProgramData\FLEXnet

2017-12-28 15:11 - 2016-12-28 19:08 - 000000000 ____D C:\ProgramData\Autodesk

2017-12-28 15:11 - 2016-12-28 15:16 - 000000000 ____D C:\Users\LIM\AppData\Local\NVIDIA

2017-12-28 15:11 - 2016-12-28 15:15 - 000000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\NVIDIA Corporation

2017-12-28 15:11 - 2016-12-28 12:32 - 000000000 ____D C:\Program Files\NVIDIA Corporation

2017-12-28 15:11 - 2016-12-28 11:45 - 000000000 ____D C:\Windows\Help

2017-12-28 14:54 - 2016-12-28 11:45 - 000000000 ____D C:\Windows\registration

2017-12-28 14:50 - 2017-01-23 16:27 - 000000000 ____D C:\Users\LIM\AppData\Local\Spotify

2017-12-28 14:49 - 2017-08-26 00:04 - 000000000 ____D C:\Users\LIM\AppData\Local\chromium

2017-12-28 14:48 - 2017-02-13 14:46 - 000000000 ____D C:\Program Files (x86)\VulkanRT

2017-12-28 14:48 - 2016-12-28 15:14 - 000000000 ____D C:\Program Files (x86)\NVIDIA Corporation

2017-12-28 14:47 - 2017-02-14 07:59 - 000000000 ____D C:\Program Files (x86)\2K Games

2017-12-28 09:04 - 2016-12-28 16:23 - 000000000 ____D C:\Users\LIM\AppData\Roaming\uTorrent

2017-12-28 09:02 - 2016-12-28 11:30 - 000000000 ____D C:\Windows\CbsTemp

2017-12-28 08:59 - 2016-12-28 11:45 - 000000000 ____D C:\Windows\AppReadiness

2017-12-28 08:53 - 2016-12-27 20:47 - 000000000 ____D C:\Users\LIM

2017-12-28 08:52 - 2017-04-17 22:05 - 000000000 ____D C:\ProgramData\ASUS Smart Gesture

2017-12-28 08:51 - 2016-12-28 12:32 - 000000180 _____ C:\Windows\system32\{A6D608F0-0BDE-491A-97AE-5C4B05D86E01}.bat

2017-12-28 08:51 - 2016-12-27 20:48 - 000000000 __SHD C:\Users\LIM\IntelGraphicsProfiles

2017-12-28 08:50 - 2016-12-28 12:41 - 000000000 ____D C:\ProgramData\NVIDIA

2017-12-28 08:49 - 2016-12-28 12:24 - 000000006 ____H C:\Windows\Tasks\SA.DAT

2017-12-28 08:49 - 2016-12-28 11:23 - 000524288 _____ C:\Windows\system32\config\BBI

2017-12-28 08:24 - 2016-12-28 12:23 - 000000000 ____D C:\Windows\system32\SleepStudy

2017-12-28 07:37 - 2016-12-28 11:45 - 000000000 ___HD C:\Program Files\WindowsApps

2017-12-28 07:30 - 2016-12-28 20:58 - 000000000 ____D C:\Windows\system32\MRT

2017-12-28 07:27 - 2017-10-12 13:56 - 133326408 ____C (Microsoft Corporation) C:\Windows\system32\MRT-KB890830.exe

2017-12-28 07:27 - 2016-12-28 20:57 - 133326408 ____C (Microsoft Corporation) C:\Windows\system32\MRT.exe

2017-12-28 07:26 - 2016-12-28 12:07 - 000000000 ___DC C:\Windows\Panther

2017-12-28 06:57 - 2017-02-14 12:53 - 000000008 __RSH C:\ProgramData\ntuser.pol

2017-12-28 06:52 - 2017-06-30 10:58 - 000093600 _____ (Malwarebytes) C:\Windows\system32\Drivers\mwac.sys

2017-12-28 06:52 - 2016-12-28 11:45 - 000000000 ___HD C:\Windows\system32\GroupPolicy

2017-12-28 06:52 - 2016-12-28 11:45 - 000000000 ____D C:\Windows\SysWOW64\GroupPolicy

2017-12-28 06:48 - 2016-12-27 21:00 - 000002274 _____ C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Google Chrome.lnk

2017-12-28 06:48 - 2016-12-27 21:00 - 000002262 _____ C:\Users\Public\Desktop\Google Chrome.lnk

2017-12-28 06:38 - 2017-06-30 10:58 - 000188352 _____ (Malwarebytes) C:\Windows\system32\Drivers\MBAMChameleon.sys

2017-12-28 06:38 - 2017-06-30 10:58 - 000101784 _____ (Malwarebytes) C:\Windows\system32\Drivers\farflt.sys

2017-12-28 06:38 - 2017-06-30 10:58 - 000045472 _____ (Malwarebytes) C:\Windows\system32\Drivers\mbam.sys

2017-12-28 06:38 - 2017-06-30 10:57 - 000253856 _____ (Malwarebytes) C:\Windows\system32\Drivers\MBAMSwissArmy.sys

2017-12-27 23:38 - 2016-12-27 20:48 - 000000000 ____D C:\Users\LIM\AppData\Local\Packages

2017-12-27 23:36 - 2017-05-22 21:46 - 000000000 ____D C:\Users\QBDataServiceUser26

2017-12-27 23:35 - 2016-12-28 11:44 - 000000000 ____D C:\Windows\INF

2017-12-27 23:29 - 2016-12-28 12:32 - 000000000 ____D C:\ProgramData\NVIDIA Corporation

2017-12-27 23:27 - 2016-12-28 15:16 - 000000000 ____D C:\Users\LIM\AppData\Local\NVIDIA Corporation

2017-12-27 15:10 - 2016-12-28 11:23 - 000032768 _____ C:\Windows\system32\config\ELAM

2017-12-27 08:30 - 2016-12-28 19:01 - 000000000 ____D C:\Users\LIM\AppData\Local\CrashDumps

2017-12-27 08:27 - 2016-12-28 11:45 - 000000000 ____D C:\Windows\system32\NDF

2017-12-20 07:29 - 2016-12-28 20:57 - 000000034 _____ C:\Users\LIM\AppData\Roaming\AdobeWLCMCache.dat

2017-12-12 23:31 - 2017-01-23 16:14 - 000000000 ____D C:\Users\LIM\AppData\Roaming\Spotify

2017-12-12 12:53 - 2017-11-06 11:29 - 000005168 _____ C:\Windows\System32\Tasks\Microsoft Office 15 Sync Maintenance for LIM-LIM LIM

2017-12-11 00:00 - 2017-02-16 01:13 - 000000410 _____ C:\Users\LIM\AppData\Roaming\WB.CFG

2017-12-08 15:51 - 2017-07-28 08:53 - 000000000 ____D C:\Program Files\rempl

2017-12-04 07:47 - 2017-11-14 17:16 - 000000000 ____D C:\Users\LIM\AppData\Roaming\vrayneui

2017-12-03 09:59 - 2016-12-27 15:01 - 000000000 ____D C:\Users\LIM\Documents\Shobe School

2017-12-03 08:08 - 2016-12-28 15:50 - 000002457 _____ C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Acrobat Reader DC.lnk

2017-12-02 09:06 - 2016-12-29 08:24 - 000835576 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerApp.exe

2017-12-02 09:06 - 2016-12-29 08:24 - 000177656 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerCPLApp.cpl

==================== Files in the root of some directories =======

2016-12-28 20:57 - 2017-12-20 07:29 - 000000034 _____ () C:\Users\LIM\AppData\Roaming\AdobeWLCMCache.dat

2017-08-26 00:01 - 2017-08-26 00:01 - 000576000 _____ () C:\Users\LIM\AppData\Roaming\Mahema.exe

2017-05-22 21:46 - 2017-06-17 07:47 - 000043737 _____ () C:\Users\LIM\AppData\Roaming\QBFileDrTool.log

2017-02-16 01:13 - 2017-12-11 00:00 - 000000410 _____ () C:\Users\LIM\AppData\Roaming\WB.CFG

2017-01-01 10:04 - 2017-01-01 17:00 - 000007602 _____ () C:\Users\LIM\AppData\Local\resmon.resmoncfg

==================== Bamital & volsnap ======================

(There is no automatic fix for files that do not pass verification.)

C:\Windows\system32\winlogon.exe => File is digitally signed

C:\Windows\system32\wininit.exe => File is digitally signed

C:\Windows\explorer.exe => File is digitally signed

C:\Windows\SysWOW64\explorer.exe => File is digitally signed

C:\Windows\system32\svchost.exe => File is digitally signed

C:\Windows\SysWOW64\svchost.exe => File is digitally signed

C:\Windows\system32\services.exe => File is digitally signed

C:\Windows\system32\User32.dll => File is digitally signed

C:\Windows\SysWOW64\User32.dll => File is digitally signed

C:\Windows\system32\userinit.exe => File is digitally signed

C:\Windows\SysWOW64\userinit.exe => File is digitally signed

C:\Windows\system32\rpcss.dll => File is digitally signed

C:\Windows\system32\dnsapi.dll => File is digitally signed

C:\Windows\SysWOW64\dnsapi.dll => File is digitally signed

C:\Windows\system32\Drivers\volsnap.sys => File is digitally signed

LastRegBack: 2017-12-28 07:38

==================== End of FRST.txt ============================

#6
Bjohn24

Posted 27 December 2017 - 07:11 PM

New Member

Topic Starter
Member
7 posts

here is the log file for Addition.txt

Additional scan result of Farbar Recovery Scan Tool (x64) Version: 26-12-2017

Ran by LIM (28-12-2017 09:05:43)

Running from F:\

Windows 10 Home Single Language Version 1607 14393.693 (X64) (2016-12-27 12:46:30)

Boot Mode: Normal

==========================================================

==================== Accounts: =============================

Administrator (S-1-5-21-1694938941-4250371870-4056835700-500 - Administrator - Disabled)

DefaultAccount (S-1-5-21-1694938941-4250371870-4056835700-503 - Limited - Disabled)

defaultuser0 (S-1-5-21-1694938941-4250371870-4056835700-1000 - Limited - Disabled) => C:\Users\defaultuser0

Guest (S-1-5-21-1694938941-4250371870-4056835700-501 - Limited - Disabled)

LIM (S-1-5-21-1694938941-4250371870-4056835700-1001 - Administrator - Enabled) => C:\Users\LIM

QBDataServiceUser26 (S-1-5-21-1694938941-4250371870-4056835700-1002 - Limited - Enabled) => C:\Users\QBDataServiceUser26

==================== Security Center ========================

(If an entry is included in the fixlist, it will be removed.)

AV: Windows Defender (Enabled - Up to date) {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}

AS: Windows Defender (Enabled - Up to date) {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}

==================== Installed Programs ======================

(Only the adware programs with "Hidden" flag could be added to the fixlist to unhide them. The adware programs should be uninstalled manually.)

µTorrent (HKU\S-1-5-21-1694938941-4250371870-4056835700-1001\...\uTorrent) (Version: 3.5.0.44294 - BitTorrent Inc.)

ACA & MEP 2016 Object Enabler (HKLM\...\{5783F2D7-F004-0000-5102-0060B0CE6BBA}) (Version: 7.8.41.0 - Autodesk) Hidden

ACAD Private (HKLM\...\{5783F2D7-F001-0000-3102-0060B0CE6BBA}) (Version: 20.1.49.0 - Autodesk) Hidden

Adobe Acrobat Reader DC (HKLM-x32\...\{AC76BA86-7AD7-1033-7B44-AC0F074E4100}) (Version: 18.009.20050 - Adobe Systems Incorporated)

Adobe Creative Cloud (HKLM-x32\...\Adobe Creative Cloud) (Version: 3.9.1.335 - Adobe Systems Incorporated)

Adobe Illustrator CC 2015 (HKLM-x32\...\{5680D629-B263-49CC-821E-3CEBD4507B51}) (Version: 19.0 - Adobe Systems Incorporated)

Adobe Photoshop CC 2015 (HKLM-x32\...\{793C2BF7-A4FE-4608-91C9-9282C5801C21}) (Version: 16.0 - Adobe Systems Incorporated)

Adobe Premiere (HKLM\...\{C1CB876C-A08E-4692-B525-42848BD154D7}) (Version: 1.0.0000 - Adobe Systems Incorporated) Hidden

Adobe Premiere Pro CC 2017 (HKLM-x32\...\PPRO_11_0_1) (Version: 11.0.1 - Adobe Systems Incorporated)

Akamai NetSession Interface (HKU\S-1-5-21-1694938941-4250371870-4056835700-1001\...\Akamai) (Version: - Akamai Technologies, Inc)

Ansel (HKLM\...\{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_Ansel) (Version: 378.49 - NVIDIA Corporation) Hidden

ASUS Smart Gesture (HKLM-x32\...\{4D3286A6-F6AB-498A-82A4-E4F040529F3D}) (Version: 4.0.18 - ASUS)

AutoCAD 2016 - English (HKLM\...\{5783F2D7-F001-0409-2102-0060B0CE6BBA}) (Version: 20.1.49.0 - Autodesk) Hidden

AutoCAD 2016 (HKLM\...\{5783F2D7-F001-0000-0102-0060B0CE6BBA}) (Version: 20.1.49.0 - Autodesk) Hidden

AutoCAD 2016 Language Pack - English (HKLM\...\{5783F2D7-F001-0409-1102-0060B0CE6BBA}) (Version: 20.1.49.0 - Autodesk) Hidden

Autodesk A360 Collaboration for Revit 2017 (HKLM\...\{AA384BE4-1700-0010-0000-97E7D7D00B17}) (Version: 17.0.416.0 - Autodesk) Hidden

Autodesk A360 Collaboration for Revit 2017 (HKLM\...\Autodesk A360 Collaboration for Revit 2017) (Version: 17.0.416.0 - Autodesk)

Autodesk Advanced Material Library Image Library 2016 (HKLM-x32\...\{94AD53E7-493B-4291-8714-7A3B761D2783}) (Version: 6.3.0.15 - Autodesk)

Autodesk App Manager 2016 (HKLM-x32\...\{4ECF9E00-2978-46AF-BD80-455EFEAB7A93}) (Version: 2.0.0 - Autodesk)

Autodesk AutoCAD 2016 - English (HKLM\...\AutoCAD 2016 - English) (Version: 20.1.49.0 - Autodesk)

Autodesk AutoCAD Performance Feedback Tool 1.2.4 (HKLM-x32\...\{4E20873D-BC20-495C-AFD9-B18877B7F9BB}) (Version: 1.2.4.0 - Autodesk)

Autodesk BIM 360 Glue AutoCAD 2016 Add-in 64 bit (HKLM\...\{4BEE127E-95C4-434D-ABAC-65155192BB24}) (Version: 4.35.1742 - Autodesk)

Autodesk BIM 360 Revit 2017 Add-in 64 bit (HKLM\...\{A26EBAD5-9591-407F-9D6C-C7A4F3DFE506}) (Version: 4.37.6853 - Autodesk)

Autodesk Content Service (HKLM\...\{A37CDB58-AAE8-0000-8C13-E0F7BACB0D5F}) (Version: 3.2.0.0 - Autodesk) Hidden

Autodesk Content Service (HKLM\...\Autodesk Content Service) (Version: 3.2.0.0 - Autodesk)

Autodesk Content Service Language Pack (HKLM\...\{A37CDB58-AAE8-0001-8C13-E0F7BACB0D5F}) (Version: 3.2.0.0 - Autodesk) Hidden

Autodesk Desktop App (HKLM-x32\...\Autodesk Desktop App) (Version: 6.0.45.5 - Autodesk)

Autodesk Featured Apps 2016 (HKLM-x32\...\{D42F37CD-9AF9-4435-A474-B387C5BB6B47}) (Version: 2.0.0 - Autodesk)

Autodesk License Service (x64) - 3.1 (HKLM\...\{EB6FE58F-8576-4272-BB9C-6B47D9EDFA4D}) (Version: 3.1.26.0 - Autodesk)

Autodesk Material Library 2016 (HKLM-x32\...\{29A7D6EC-63C2-42FD-8143-5812ABD2923F}) (Version: 6.3.0.15 - Autodesk)

Autodesk Material Library 2017 (HKLM-x32\...\{8FB9F735-D64C-4991-8D91-4CDDAB1ABDEE}) (Version: 15.11.3.0 - Autodesk)

Autodesk Material Library Base Resolution Image Library 2016 (HKLM-x32\...\{6B4CFC6E-ECB0-47FE-95D3-65C680ED0687}) (Version: 6.3.0.15 - Autodesk)

Autodesk Material Library Base Resolution Image Library 2017 (HKLM-x32\...\{3FBFBC43-9882-43FA-B979-2D53896747B3}) (Version: 15.11.3.0 - Autodesk)

Autodesk Material Library Low Resolution Image Library 2017 (HKLM-x32\...\{360AC116-6CD4-4E7D-8174-28D47B05E898}) (Version: 15.11.3.0 - Autodesk)

Autodesk Material Library Medium Resolution Image Library 2017 (HKLM-x32\...\{CB6E007E-701D-42CD-AF0E-4BE9C36C7F7C}) (Version: 15.11.3.0 - Autodesk)

Autodesk Revit 2017 (HKLM\...\Autodesk Revit 2017) (Version: 17.0.416.0 - Autodesk)

Autodesk Revit 2017 (HKLM\...\Revit 2017) (Version: - )

Autodesk Revit Content Libraries 2017 (HKLM\...\Autodesk Revit Content Libraries 2017) (Version: 17.0.416.0 - Autodesk)

Autodesk Revit Content Libraries 2017 (HKLM\...\Revit Content Libraries 2017) (Version: - )

Autodesk Revit MEP Imperial Content v2.0 (HKLM\...\{F2538944-3E07-4E97-B41A-FC48AB53EE9D}) (Version: 2.0 - Autodesk)

Autodesk Revit MEP Metric Content v2.0 (HKLM\...\{DEF775C7-84BF-4730-976A-FE3747F1757C}) (Version: 2.0 - Autodesk)

Autodesk Workflows 2017 (HKLM\...\{23A13F78-5B67-441A-ABF9-48BE8B5455DB}) (Version: 15.11.13.0 - Autodesk, Inc.)

Cheat Engine 6.6 (HKLM-x32\...\Cheat Engine 6.6_is1) (Version: - Cheat Engine)

Chromium (HKU\S-1-5-21-1694938941-4250371870-4056835700-1001\...\Chromium) (Version: 58.0.2991.0 - Chromium)

Dynamo 0.9.1 (HKLM\...\{85626FB3-CAF9-49C1-AA28-E3C75164BD6F}) (Version: 0.9.1.4062 - Autodesk)

FARO LS 1.1.501.0 (64bit) (HKLM-x32\...\{8A470330-70B2-49AD-86AF-79885EF9898A}) (Version: 5.1.0.30630 - FARO Scanner Production)

FormIt 360 Converter For Revit 2017 (HKLM\...\{637211B6-D2E9-474A-BF06-4F61F1254104}) (Version: 1.9.0.0 - Autodesk)

Google Chrome (HKLM-x32\...\Google Chrome) (Version: 63.0.3239.84 - Google Inc.)

Google Update Helper (HKLM-x32\...\{60EC980A-BDA2-4CB6-A427-B07A5498B4CA}) (Version: 1.3.33.7 - Google Inc.) Hidden

Intel® Processor Graphics (HKLM-x32\...\{F0E3AD40-2BBD-4360-9C76-B9AC9A5886EA}) (Version: 20.19.15.4549 - Intel Corporation)

IronPython 2.7.3 (HKLM-x32\...\{1EBADAEA-1A0F-40E3-848C-0DD8C5E5A10D}) (Version: 2.7.31000.0 - IronPython Team)

Lumion 6.0 (HKLM\...\Lumion 6.0_is1) (Version: 6.0 - Act-3D B.V.)

Malwarebytes version 3.1.2.1733 (HKLM\...\{35065F43-4BB2-439A-BFF7-0F1014F2E0CD}_is1) (Version: 3.1.2.1733 - Malwarebytes)

Microsoft Office Professional Plus 2013 (HKLM\...\Office15.PROPLUS) (Version: 15.0.4420.1017 - Microsoft Corporation)

Microsoft Silverlight (HKLM\...\{89F4137D-6C26-4A84-BDB8-2E5A4BB71E00}) (Version: 5.1.50906.0 - Microsoft Corporation)

Microsoft Visual C++ 2005 Redistributable (HKLM-x32\...\{710f4c1c-cc18-4c49-8cbf-51240c89a1a2}) (Version: 8.0.61001 - Microsoft Corporation)

Microsoft Visual C++ 2005 Redistributable (HKLM-x32\...\{837b34e3-7c30-493c-8f6a-2b0f04e2912c}) (Version: 8.0.59193 - Microsoft Corporation)

Microsoft Visual C++ 2005 Redistributable (x64) (HKLM\...\{071c9b48-7c32-4621-a0ac-3f809523288f}) (Version: 8.0.56336 - Microsoft Corporation)

Microsoft Visual C++ 2005 Redistributable (x64) (HKLM\...\{6ce5bae9-d3ca-4b99-891a-1dc6c118a5fc}) (Version: 8.0.59192 - Microsoft Corporation)

Microsoft Visual C++ 2005 Redistributable (x64) (HKLM\...\{ad8a2fa1-06e7-4b0d-927d-6e54b3d31028}) (Version: 8.0.61000 - Microsoft Corporation)

Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.4148 (HKLM\...\{4B6C7001-C7D6-3710-913E-5BC23FCE91E6}) (Version: 9.0.30729.4148 - Microsoft Corporation)

Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.6161 (HKLM\...\{5FCE6D76-F5DC-37AB-B2B8-22AB8CEDB1D4}) (Version: 9.0.30729.6161 - Microsoft Corporation)

Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.4148 (HKLM-x32\...\{1F1C2DFC-2D24-3E06-BCB8-725134ADF989}) (Version: 9.0.30729.4148 - Microsoft Corporation)

Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161 (HKLM-x32\...\{9BE518E6-ECC6-35A9-88E4-87755C07200F}) (Version: 9.0.30729.6161 - Microsoft Corporation)

Microsoft Visual C++ 2010 x64 Redistributable - 10.0.40219 (HKLM\...\{1D8E6291-B0D5-35EC-8441-6616F567A0F7}) (Version: 10.0.40219 - Microsoft Corporation)

Microsoft Visual C++ 2010 x86 Redistributable - 10.0.40219 (HKLM-x32\...\{F0C3E5D1-1ADE-321E-8167-68EF0DE699A5}) (Version: 10.0.40219 - Microsoft Corporation)

Microsoft Visual C++ 2012 Redistributable (x64) - 11.0.51106 (HKLM-x32\...\{6e8f74e0-43bd-4dce-8477-6ff6828acc07}) (Version: 11.0.51106.1 - Microsoft Corporation)

Microsoft Visual C++ 2012 Redistributable (x64) - 11.0.61030 (HKLM-x32\...\{ca67548a-5ebe-413a-b50c-4b9ceb6d66c6}) (Version: 11.0.61030.0 - Microsoft Corporation)

Microsoft Visual C++ 2012 Redistributable (x86) - 11.0.60610 (HKLM-x32\...\{95716cce-fc71-413f-8ad5-56c2892d4b3a}) (Version: 11.0.60610.1 - Microsoft Corporation)

Microsoft Visual C++ 2012 Redistributable (x86) - 11.0.61030 (HKLM-x32\...\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}) (Version: 11.0.61030.0 - Microsoft Corporation)

Microsoft Visual C++ 2013 Redistributable (x64) - 12.0.30501 (HKLM-x32\...\{050d4fc8-5d48-4b8f-8972-47c82c46020f}) (Version: 12.0.30501.0 - Microsoft Corporation)

Microsoft Visual C++ 2013 Redistributable (x86) - 12.0.30501 (HKLM-x32\...\{f65db027-aff3-4070-886a-0d87064aabb1}) (Version: 12.0.30501.0 - Microsoft Corporation)

Microsoft Visual C++ 2015 Redistributable (x64) - 14.0.24215 (HKLM-x32\...\{d992c12e-cab2-426f-bde3-fb8c53950b0d}) (Version: 14.0.24215.1 - Microsoft Corporation)

Microsoft Visual C++ 2015 Redistributable (x86) - 14.0.23026 (HKLM-x32\...\{74d0e5db-b326-4dae-a6b2-445b9de1836e}) (Version: 14.0.23026.0 - Microsoft Corporation)

Microsoft Visual Studio 2010 Tools for Office Runtime (x64) (HKLM\...\Microsoft Visual Studio 2010 Tools for Office Runtime (x64)) (Version: 10.0.31007 - Microsoft Corporation)

Microsoft Xbox 360 Accessories 1.2 (HKLM\...\{D9C50188-12D5-4D3E-8F00-682346C2AA5F}) (Version: 1.20.146.0 - Microsoft)

NBA 2K17 (HKLM-x32\...\NBA 2K17_is1) (Version: 1.0.0.0 - 2K Games)

NVIDIA GeForce Experience 3.6.0.74 (HKLM\...\{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_Display.GFExperience) (Version: 3.6.0.74 - NVIDIA Corporation)

NVIDIA Graphics Driver 378.49 (HKLM\...\{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_Display.Driver) (Version: 378.49 - NVIDIA Corporation)

NVIDIA PhysX System Software 9.16.0318 (HKLM\...\{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_Display.PhysX) (Version: 9.16.0318 - NVIDIA Corporation)

NvNodejs (HKLM\...\{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_NvNodejs) (Version: 3.6.0.74 - NVIDIA Corporation) Hidden

NvTelemetry (HKLM\...\{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_NvTelemetry) (Version: 2.4.10.0 - NVIDIA Corporation) Hidden

NvvHci (HKLM\...\{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_NvvHci) (Version: 2.02.0.5 - NVIDIA Corporation) Hidden

Outils de vérification linguistique 2013 de Microsoft Office - Français (HKLM\...\{90150000-001F-040C-1000-0000000FF1CE}) (Version: 15.0.4420.1017 - Microsoft Corporation) Hidden

Personal Accelerator for Revit (HKLM\...\{7C317DB0-F31F-4024-A289-92CF4B6FB256}) (Version: 16.0.1109.0 - Autodesk) Hidden

Personal Accelerator for Revit (HKLM\...\Personal Accelerator for Revit) (Version: 16.0.1109.0 - Autodesk)

QuickBooks (HKLM-x32\...\{550E322B-82B7-46E3-863A-14D8DB14AD54}) (Version: 26.0.4001.2607 - Intuit Inc.) Hidden

QuickBooks Enterprise Solutions: Accountant Edition 16.0 (HKLM-x32\...\{5DCE99D1-75F8-4D91-B233-1C3F3694AF06}) (Version: 26.0.4001.2607 - Intuit Inc.)

QuickBooks Runtime Redistributable (HKLM\...\{F2A4F809-2DE6-4D27-888B-4D2BB8DAF20E}) (Version: 1.00.0000 - Intuit Inc.)

Realtek High Definition Audio Driver (HKLM-x32\...\{F132AF7F-7BCA-4EDE-8A7C-958108FE7DBC}) (Version: 6.0.1.7095 - Realtek Semiconductor Corp.)

Revit 2017 (HKLM\...\{7346B4A0-1700-0510-0000-705C0D862004}) (Version: 17.0.416.0 - Autodesk) Hidden

Revit Content Libraries 2017 (HKLM\...\{941030D0-1700-0410-0000-818BB38A95FC}) (Version: 17.0.416.0 - Autodesk) Hidden

Search the Web (Yahoo) (HKLM-x32\...\{3BF8D338-6B78-02B8-DAF8-72380A78A1B8}) (Version: - ) <==== ATTENTION

SHIELD Streaming (HKLM\...\{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_GFExperience.NvStreamSrv) (Version: 7.1.0370 - NVIDIA Corporation) Hidden

SHIELD Wireless Controller Driver (HKLM\...\{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_ShieldWirelessController) (Version: 3.6.0.74 - NVIDIA Corporation) Hidden

SketchUp 2017 (HKLM\...\{F1E181BD-01D6-4754-92CC-DB8C259B9B28}) (Version: 17.0.18899 - Trimble, Inc.)

SketchUp Import 2016 (HKLM-x32\...\{C769FB7C-1F55-4B31-9A2A-21CEC50F4F92}) (Version: 2.0.0 - Autodesk)

Spatial Manager™ for AutoCAD (64-bit) (HKLM\...\{B669E14C-AF82-480C-9F67-DA6A54943D2F}) (Version: 3.3.2.6218 - Opencartis) Hidden

Spatial Manager™ for AutoCAD (HKLM-x32\...\{e457adef-8e2f-4d14-916e-c385f8cab7f7}) (Version: 3.3.2.6218 - Opencartis)

Spotify (HKU\S-1-5-21-1694938941-4250371870-4056835700-1001\...\Spotify) (Version: 1.0.69.336.g7edcc575 - Spotify AB)

Steam (HKLM-x32\...\Steam) (Version: 2.10.91.91 - Valve Corporation)

Update for Windows 10 for x64-based Systems (KB4023057) (HKLM\...\{DE083343-D24D-4495-919E-18C65EC0F289}) (Version: 2.8.0.0 - Microsoft Corporation)

Visual C++ 2008 - x64 (KB958357) - v9.0.30729.177 (HKLM-x32\...\{6DA2B636-698A-3294-BF4A-B5E11B238CDD}.KB958357) (Version: 9.0.30729.177 - Microsoft Corporation)

Visual C++ 2008 - x64 (KB958357) - v9.0.30729.177 (HKLM-x32\...\{8CCEA24C-51AE-3B71-9092-7D0C44DDA2DF}.KB958357) (Version: 9.0.30729.177 - Microsoft Corporation)

Visual C++ 2008 - x64 (KB958357) - v9.0.30729.177 (HKLM-x32\...\{C3A57BB3-9AA6-3F6F-9395-6C062BDD5FC4}.KB958357) (Version: 9.0.30729.177 - Microsoft Corporation)

Visual C++ 2008 - x64 (KB958357) - v9.0.30729.177 (HKLM-x32\...\{F6F09DD8-F39B-3A16-ADB9-C9E6B56903F9}.KB958357) (Version: 9.0.30729.177 - Microsoft Corporation)

Visual C++ 2008 - x86 (KB958357) - v9.0.30729.177 (HKLM-x32\...\{04B34E21-5BEE-3D2B-8D3D-E3E80D253F64}.KB958357) (Version: 9.0.30729.177 - Microsoft Corporation)

Visual C++ 2008 - x86 (KB958357) - v9.0.30729.177 (HKLM-x32\...\{14866AAD-1F23-39AC-A62B-7091ED1ADE64}.KB958357) (Version: 9.0.30729.177 - Microsoft Corporation)

Visual C++ 2008 - x86 (KB958357) - v9.0.30729.177 (HKLM-x32\...\{4B90093A-5D9C-3956-8ABB-95848BE6EFAD}.KB958357) (Version: 9.0.30729.177 - Microsoft Corporation)

Visual C++ 2008 - x86 (KB958357) - v9.0.30729.177 (HKLM-x32\...\{B42E259C-E4D4-37F1-A1B2-EB9C4FC5A04D}.KB958357) (Version: 9.0.30729.177 - Microsoft Corporation)

V-Ray 3.4 for SketchUp (HKLM\...\V-Ray 3.4 for SketchUp) (Version: 3.40.02 - Chaos Software Ltd)

V-Ray Online License Server (HKLM\...\V-Ray Online License Server) (Version: 4.3.1 - Chaos Software Ltd)

V-Ray Swarm (HKLM\...\V-Ray Swarm) (Version: 1.3.5 - Chaos Software Ltd)

Vulkan Run Time Libraries 1.0.37.0 (HKLM\...\VulkanRT1.0.37.0) (Version: 1.0.37.0 - LunarG, Inc.)

Windows 10 Update and Privacy Settings (HKLM\...\{4DFCD818-036A-4229-A67D-CF17DC461D92}) (Version: 1.0.14.0 - Microsoft Corporation)

WinRAR 5.40 (64-bit) (HKLM\...\WinRAR archiver) (Version: 5.40.0 - win.rar GmbH)

World in Conflict - Complete Edition (HKLM-x32\...\1438332414_is1) (Version: 2.0.0.3 - GOG.com)

==================== Custom CLSID (Whitelisted): ==========================

(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)

CustomCLSID: HKU\S-1-5-21-1694938941-4250371870-4056835700-1001_Classes\CLSID\{0a24e6bb-480e-e6cf-57ea-33fd34f4acd37}\InprocServer32 -> 0x60F410B9F4ECD201F40711B9F4ECD201010000000100000000000000 => No File

CustomCLSID: HKU\S-1-5-21-1694938941-4250371870-4056835700-1001_Classes\CLSID\{0B628DE4-07AD-4284-81CA-5B439F67C5E6}\localserver32 -> C:\Program Files\Autodesk\AutoCAD 2016\acad.exe (Autodesk, Inc.)

CustomCLSID: HKU\S-1-5-21-1694938941-4250371870-4056835700-1001_Classes\CLSID\{149DD748-EA85-45A6-93C5-AC50D0260C98}\localserver32 -> C:\Program Files\Autodesk\AutoCAD 2016\acad.exe (Autodesk, Inc.)

CustomCLSID: HKU\S-1-5-21-1694938941-4250371870-4056835700-1001_Classes\CLSID\{1b145bbd-ea0a-48d6-8d0f-1fa75499f8320}\InprocServer32 -> 0x9C64F5B8F4ECD2011BDEFDB8F4ECD201010000000100000000000000 => No File

CustomCLSID: HKU\S-1-5-21-1694938941-4250371870-4056835700-1001_Classes\CLSID\{5370C727-1451-4700-A960-77630950AF6D}\localserver32 -> C:\Program Files\Autodesk\AutoCAD 2016\acad.exe (Autodesk, Inc.)

CustomCLSID: HKU\S-1-5-21-1694938941-4250371870-4056835700-1001_Classes\CLSID\{E2C40589-DE61-11ce-BAE0-0020AF6D7005}\InprocServer32 -> C:\Program Files\Autodesk\AutoCAD 2016\en-US\acadficn.dll (Autodesk, Inc.)

CustomCLSID: HKU\S-1-5-21-1694938941-4250371870-4056835700-1001_Classes\CLSID\{f4842d96-3d17-aaa8-846e-beb437c33fc56}\InprocServer32 -> 0x4F5213B9F4ECD201EB0762BEEA72D301490000008D0A000000000000 => No File

ShellIconOverlayIdentifiers: [ AccExtIco1] -> {AB9CF9F8-8A96-4F9D-BF21-CE85714C3A47} => C:\Program Files (x86)\Adobe\Adobe Creative Cloud\CoreSyncExtension\CoreSync_x64.dll [2016-10-25] ()

ShellIconOverlayIdentifiers: [ AccExtIco2] -> {853B7E05-C47D-4985-909A-D0DC5C6D7303} => C:\Program Files (x86)\Adobe\Adobe Creative Cloud\CoreSyncExtension\CoreSync_x64.dll [2016-10-25] ()

ShellIconOverlayIdentifiers: [ AccExtIco3] -> {42D38F2E-98E9-4382-B546-E24E4D6D04BB} => C:\Program Files (x86)\Adobe\Adobe Creative Cloud\CoreSyncExtension\CoreSync_x64.dll [2016-10-25] ()

ShellIconOverlayIdentifiers: [AutoCAD Digital Signatures Icon Overlay Handler] -> {36A21736-36C2-4C11-8ACB-D4136F2B57BD} => C:\Windows\system32\AcSignIcon.dll [2015-02-06] (Autodesk, Inc.)

ContextMenuHandlers1: [AccExt] -> {2A118EB5-5797-4F5E-8B3D-F4ECBA3C98E4} => C:\Program Files (x86)\Adobe\Adobe Creative Cloud\CoreSyncExtension\CoreSync_x64.dll [2016-10-25] ()

ContextMenuHandlers1: [AcShellExtension.AcContextMenuHandler] -> {2E7A2C6C-B938-40a4-BA1C-C7EC982DC202} => C:\Program Files\Common Files\Autodesk Shared\AcShellEx\AcShellExtension.dll [2015-02-06] (Autodesk)

ContextMenuHandlers1: [WinRAR] -> {B41DB860-64E4-11D2-9906-E49FADC173CA} => C:\Program Files\WinRAR\rarext.dll [2016-08-15] (Alexander Roshal)

ContextMenuHandlers1-x32: [WinRAR32] -> {B41DB860-8EE4-11D2-9906-E49FADC173CA} => C:\Program Files\WinRAR\rarext32.dll [2016-08-15] (Alexander Roshal)

ContextMenuHandlers3: [MBAMShlExt] -> {57CE581A-0CB6-4266-9CA0-19364C90A0B3} => C:\Program Files\Malwarebytes\Anti-Malware\mbshlext.dll -> No File

ContextMenuHandlers5: [igfxcui] -> {3AB1675A-CCFF-11D2-8B20-00A0C93CB1F4} => -> No File

ContextMenuHandlers5: [igfxDTCM] -> {9B5F5829-A529-4B12-814A-E81BCB8D93FC} => C:\Windows\system32\igfxDTCM.dll [2016-11-30] (Intel Corporation)

ContextMenuHandlers5: [NvCplDesktopContext] -> {3D1975AF-48C6-4f8e-A182-BE0E08FA86A9} => C:\Windows\system32\nvshext.dll [2017-01-20] (NVIDIA Corporation)

ContextMenuHandlers6: [AccExt] -> {2A118EB5-5797-4F5E-8B3D-F4ECBA3C98E4} => C:\Program Files (x86)\Adobe\Adobe Creative Cloud\CoreSyncExtension\CoreSync_x64.dll [2016-10-25] ()

ContextMenuHandlers6: [MBAMShlExt] -> {57CE581A-0CB6-4266-9CA0-19364C90A0B3} => C:\Program Files\Malwarebytes\Anti-Malware\mbshlext.dll -> No File

ContextMenuHandlers6: [WinRAR] -> {B41DB860-64E4-11D2-9906-E49FADC173CA} => C:\Program Files\WinRAR\rarext.dll [2016-08-15] (Alexander Roshal)

ContextMenuHandlers6-x32: [WinRAR32] -> {B41DB860-8EE4-11D2-9906-E49FADC173CA} => C:\Program Files\WinRAR\rarext32.dll [2016-08-15] (Alexander Roshal)

==================== Scheduled Tasks (Whitelisted) =============

(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)

Task: {167EA4A1-9B2C-4409-9699-6264C0ADA4DF} - System32\Tasks\AdobeAAMUpdater-1.0-LIM-LIM => C:\Program Files (x86)\Common Files\Adobe\OOBE\PDApp\UWA\UpdaterStartupUtility.exe [2016-07-01] (Adobe Systems Incorporated)

Task: {2CD9D503-01B9-435F-B916-3D708B396ACF} - System32\Tasks\{0DE0382D-2791-53AD-406A-1C2AB49B2DAB} => C:\Users\LIM\AppData\Local\Raroholo\PRODUC~1.EXE [2013-04-23] ()

Task: {365D96DE-B500-4B31-BC27-DB1C8062CF65} - System32\Tasks\NvProfileUpdaterOnLogon_{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8} => C:\Program Files\NVIDIA Corporation\Update Core\NvProfileUpdater64.exe [2017-05-04] (NVIDIA Corporation)

Task: {51557E45-E011-43E0-BA30-0D9209F2F63F} - System32\Tasks\NvTmRepOnLogon_{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8} => C:\Program Files (x86)\NVIDIA Corporation\Update Core\NvTmRep.exe [2017-05-04] (NVIDIA Corporation)

Task: {53F10F87-A2F1-42EE-9C0C-C1DED3E603DF} - System32\Tasks\NvTmRep_{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8} => C:\Program Files (x86)\NVIDIA Corporation\Update Core\NvTmRep.exe [2017-05-04] (NVIDIA Corporation)

Task: {6B28D2FB-610A-4991-B490-ADFF76211248} - System32\Tasks\NvNodeLauncher_{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8} => C:\Program Files (x86)\NVIDIA Corporation\NvNode\nvnodejslauncher.exe [2017-05-04] (NVIDIA Corporation)

Task: {6E2BE130-8313-4B74-9D41-676C601C80AD} - System32\Tasks\NVIDIA GeForce Experience SelfUpdate_{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8} => C:\Program Files (x86)\NVIDIA Corporation\NVIDIA GeForce Experience\NVIDIA GeForce Experience.exe [2017-05-04] (NVIDIA Corporation)

Task: {7D61424C-308C-4A0F-9DBF-5A628288BD54} - System32\Tasks\GoogleUpdateTaskMachineCore => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe [2016-12-27] (Google Inc.)

Task: {872F9BAC-4858-45B4-9992-B8F31E0C62E7} - System32\Tasks\Adobe Acrobat Update Task => C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe [2017-09-27] (Adobe Systems Incorporated)

Task: {8F24F334-AC29-44E4-AD5C-75E8D706C2B6} - System32\Tasks\ASUS Smart Gesture Launcher => C:\Program Files (x86)\ASUS\ASUS Smart Gesture\AsTPCenter\x64\AsusTPLauncher.exe [2017-03-09] (AsusTek)

Task: {AC7290A8-F902-4DCD-B11D-2909D0400736} - System32\Tasks\GoogleUpdateTaskMachineUA => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe [2016-12-27] (Google Inc.)

Task: {B0B5ECBD-1CAE-4525-A1C1-DC35C8FF3E2A} - System32\Tasks\Microsoft\Office\Office 15 Subscription Heartbeat => C:\Program Files\Common Files\Microsoft Shared\Office15\OLicenseHeartbeat.exe [2012-10-01] (Microsoft Corporation)

Task: {BF07C018-759F-47BB-ABA5-EF2AEC605CEB} - System32\Tasks\NvProfileUpdaterDaily_{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8} => C:\Program Files\NVIDIA Corporation\Update Core\NvProfileUpdater64.exe [2017-05-04] (NVIDIA Corporation)

Task: {D7D876FB-2043-4761-B3BD-1C658F3A2CD3} - System32\Tasks\NvTmMon_{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8} => C:\Program Files (x86)\NVIDIA Corporation\Update Core\NvTmMon.exe [2017-05-04] (NVIDIA Corporation)

Task: {E251C2DD-36E2-42C3-AED8-D64050FD27DB} - System32\Tasks\AdobeAAMUpdater-1.0-DESKTOP-G07V13C-LIM => C:\Program Files (x86)\Common Files\Adobe\OOBE\PDApp\UWA\UpdaterStartupUtility.exe [2016-07-01] (Adobe Systems Incorporated)

Task: {E361C44D-B7F5-4CBD-B530-7652783D0952} - System32\Tasks\Microsoft Office 15 Sync Maintenance for LIM-LIM LIM => C:\Program Files\Microsoft Office\Office15\MsoSync.exe [2012-10-01] (Microsoft Corporation)

Task: {FA973858-6522-4116-9D36-8E1E66DDABC9} - System32\Tasks\NvDriverUpdateCheckDaily_{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8} => C:\Program Files\NVIDIA Corporation\NvContainer\nvcontainer.exe [2017-05-04] (NVIDIA Corporation)

(If an entry is included in the fixlist, the task (.job) file will be moved. The file which is running by the task will not be moved.)

==================== Shortcuts & WMI ========================

(The entries could be listed to be restored or removed.)

==================== Loaded Modules (Whitelisted) ==============

2016-07-16 19:42 - 2016-07-16 19:42 - 000231424 _____ () C:\Windows\SYSTEM32\ism32k.dll

2016-12-20 12:06 - 2016-12-09 18:29 - 002681200 _____ () C:\Windows\system32\CoreUIComponents.dll

2016-12-28 12:33 - 2017-01-20 23:13 - 000134712 _____ () C:\Program Files\NVIDIA Corporation\Display\NvSmartMax64.dll

2009-08-03 03:53 - 2009-08-03 03:53 - 000027648 _____ () C:\Windows\System32\sso2ml6.dll

2016-12-28 15:15 - 2017-05-04 04:21 - 001267320 _____ () C:\Program Files\NVIDIA Corporation\NvContainer\libprotobuf.dll

2017-11-14 17:13 - 2017-11-14 17:13 - 000090176 _____ () C:\Program Files\Chaos Group\V-Ray Swarm\register-service.exe

2017-11-14 17:13 - 2017-11-14 17:13 - 000204800 _____ () \\?\C:\Program Files\Chaos Group\V-Ray Swarm\node_modules\v8-profiler\build\profiler\v5.6.5\node-v48-win32-x64\profiler.node

2017-11-14 17:13 - 2017-11-14 17:13 - 000163328 _____ () \\?\C:\Program Files\Chaos Group\V-Ray Swarm\node_modules\ref\build\Release\binding.node

2017-11-14 17:13 - 2017-11-14 17:13 - 000174592 _____ () \\?\C:\Program Files\Chaos Group\V-Ray Swarm\node_modules\ffi\build\Release\ffi_bindings.node

2016-10-25 09:57 - 2016-10-25 09:57 - 000491184 _____ () C:\Program Files (x86)\Adobe\Adobe Creative Cloud\CoreSyncExtension\CoreSync_x64.dll

2016-12-27 20:51 - 2016-12-27 20:51 - 000959168 _____ () C:\Users\LIM\AppData\Local\Microsoft\OneDrive\17.3.6381.0405\amd64\ClientTelemetry.dll

2015-08-14 14:28 - 2016-11-30 21:57 - 000401888 _____ () C:\Windows\system32\igfxTray.exe

2016-09-17 08:23 - 2016-09-07 12:56 - 000134656 _____ () C:\Windows\ShellExperiences\Windows.UI.Shell.SharedUtilities.dll

2017-01-11 10:10 - 2016-12-21 15:09 - 000474112 _____ () C:\Windows\ShellExperiences\QuickActions.dll

2017-01-11 10:09 - 2016-12-21 14:54 - 009760768 _____ () C:\Windows\SystemApps\Microsoft.Windows.Cortana_cw5n1h2txyewy\CortanaApi.dll

2017-01-11 10:09 - 2016-12-21 14:48 - 001401856 _____ () C:\Windows\SystemApps\Microsoft.Windows.Cortana_cw5n1h2txyewy\Cortana.Core.dll

2017-01-11 10:09 - 2016-12-21 14:48 - 000757248 _____ () C:\Windows\SystemApps\Microsoft.Windows.Cortana_cw5n1h2txyewy\CSGSuggestLib.dll

2017-01-11 10:09 - 2016-12-21 14:48 - 002424320 _____ () C:\Windows\SystemApps\Microsoft.Windows.Cortana_cw5n1h2txyewy\Cortana.BackgroundTask.dll

2017-01-11 10:09 - 2016-12-21 14:53 - 004853760 _____ () C:\Windows\SystemApps\Microsoft.Windows.Cortana_cw5n1h2txyewy\RemindersUI.dll

2015-04-21 12:44 - 2015-04-21 12:44 - 000059784 _____ () C:\Program Files\Autodesk\Personal Accelerator for Revit\qoauth_Ad_1.dll

2015-04-21 12:44 - 2015-04-21 12:44 - 000232328 _____ () C:\Program Files\Autodesk\Personal Accelerator for Revit\qjson_Ad_0.dll

2015-04-21 12:44 - 2015-04-21 12:44 - 000922504 _____ () C:\Program Files\Autodesk\Personal Accelerator for Revit\qca_Ad_2.dll

2015-04-21 12:44 - 2015-04-21 12:44 - 000048520 _____ () C:\Program Files\Autodesk\Personal Accelerator for Revit\QtSolutions_MFCMigrationFramework_Ad_2.dll

2017-12-28 06:48 - 2017-12-06 12:24 - 004063064 _____ () C:\Program Files (x86)\Google\Chrome\Application\63.0.3239.84\libglesv2.dll

2017-12-28 06:48 - 2017-12-06 12:24 - 000099672 _____ () C:\Program Files (x86)\Google\Chrome\Application\63.0.3239.84\libegl.dll

2016-07-16 19:42 - 2016-07-16 19:42 - 000025088 _____ () C:\Windows\System32\GamePanelExternalHook.dll

2017-11-22 18:18 - 2016-01-19 13:15 - 000055304 _____ () C:\Program Files (x86)\Autodesk\Autodesk Desktop App\QtSolutions_Service-head.dll

2017-11-22 18:18 - 2016-01-19 13:15 - 000103944 _____ () C:\Program Files (x86)\Autodesk\Autodesk Desktop App\qjson0.dll

==================== Alternate Data Streams (Whitelisted) =========

(If an entry is included in the fixlist, only the ADS will be removed.)

AlternateDataStreams: C:\ProgramData\Reprise:wupeogjxlctlfudivq`qsp`28hfm [0]

AlternateDataStreams: C:\ProgramData\Reprise:wupeogjxldtlfudivq`qsp`27hfm [0]

==================== Safe Mode (Whitelisted) ===================

(If an entry is included in the fixlist, it will be removed from the registry. The "AlternateShell" will be restored.)

HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\MBAMService => ""="Service"

HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\MBAMService => ""="Service"

==================== Association (Whitelisted) ===============

(If an entry is included in the fixlist, the registry item will be restored to default or removed.)

HKU\S-1-5-21-1694938941-4250371870-4056835700-1001\Software\Classes\.scr: AutoCADScriptFile => C:\Windows\system32\notepad.exe "%1"

==================== Internet Explorer trusted/restricted ===============

(If an entry is included in the fixlist, it will be removed from the registry.)

==================== Hosts content: ==========================

(If needed Hosts: directive could be included in the fixlist to reset Hosts.)

2016-12-28 11:46 - 2016-12-27 22:12 - 000001023 _____ C:\Windows\system32\Drivers\etc\hosts

127.0.0.1 lmlicenses.wip4.adobe.com

127.0.0.1 lm.licenses.adobe.com

127.0.0.1 na1r.services.adobe.com

127.0.0.1 hlrcv.stage.adobe.com

127.0.0.1 practivate.adobe.com

127.0.0.1 activate.adobe.com

==================== Other Areas ============================

(Currently there is no automatic fix for this section.)

HKU\S-1-5-21-1694938941-4250371870-4056835700-1001\Control Panel\Desktop\\Wallpaper -> c:\windows\web\wallpaper\theme1\img13.jpg

HKU\S-1-5-21-1694938941-4250371870-4056835700-1002\Control Panel\Desktop\\Wallpaper -> C:\Windows\Web\Wallpaper\Windows\img0.jpg

DNS Servers: 192.168.254.254

HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System => (ConsentPromptBehaviorAdmin: 5) (ConsentPromptBehaviorUser: 3) (EnableLUA: 1)

HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer => (SmartScreenEnabled: Off)

Windows Firewall is enabled.

==================== MSCONFIG/TASK MANAGER disabled items ==

MSCONFIG\Services: AdAppMgrSvc => 2

MSCONFIG\Services: AdobeARMservice => 2

MSCONFIG\Services: AdobeUpdateService => 2

MSCONFIG\Services: Autodesk Content Service => 2

HKLM\...\StartupApproved\StartupFolder: => "ScpToolkit Tray Notifications.lnk"

HKLM\...\StartupApproved\StartupFolder: => "QuickBooks Web Connector.lnk"

HKLM\...\StartupApproved\StartupFolder: => "QuickBooks Update Agent.lnk"

HKLM\...\StartupApproved\StartupFolder: => "Intuit Data Protect.lnk"

HKLM\...\StartupApproved\StartupFolder: => "QuickBooks_Standard_21.lnk"

HKLM\...\StartupApproved\Run: => "AdobeAAMUpdater-1.0"

HKLM\...\StartupApproved\Run: => "ShadowPlay"

HKLM\...\StartupApproved\Run: => "XboxStat"

HKLM\...\StartupApproved\Run: => "Malwarebytes TrayApp"

HKLM\...\StartupApproved\Run32: => "ADSKAppManager"

HKLM\...\StartupApproved\Run32: => "Adobe Creative Cloud"

HKLM\...\StartupApproved\Run32: => "Intuit SyncManager"

HKU\S-1-5-21-1694938941-4250371870-4056835700-1001\...\StartupApproved\Run: => "OneDrive"

HKU\S-1-5-21-1694938941-4250371870-4056835700-1001\...\StartupApproved\Run: => "Spotify"

HKU\S-1-5-21-1694938941-4250371870-4056835700-1001\...\StartupApproved\Run: => "Spotify Web Helper"

HKU\S-1-5-21-1694938941-4250371870-4056835700-1001\...\StartupApproved\Run: => "Steam"

==================== FirewallRules (Whitelisted) ===============

(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)

FirewallRules: [{F6B4F9F3-FD24-497A-9379-F93AE3640F36}] => (Allow) C:\Program Files\NVIDIA Corporation\NvContainer\nvcontainer.exe

FirewallRules: [{1B796C16-1956-4197-8E2B-65CD1DA4F7DD}] => (Allow) C:\Program Files\NVIDIA Corporation\NvContainer\nvcontainer.exe

FirewallRules: [{7B73D304-D0A3-41D0-A18F-EEE379BFC1E5}] => (Allow) C:\Program Files\NVIDIA Corporation\NvStreamSrv\NvStreamUserAgent.exe

FirewallRules: [{06CE313C-B5E6-4FA5-931B-80B5E571BBC4}] => (Allow) C:\Program Files\NVIDIA Corporation\NvStreamSrv\nvstreamer.exe

FirewallRules: [{03FE52A1-E407-4F47-956E-A1133798EE0B}] => (Allow) C:\Program Files\NVIDIA Corporation\NvStreamSrv\nvstreamer.exe

FirewallRules: [{6A526C3E-9912-491A-A3C3-578D0054322C}] => (Allow) F:\from DRIVE D computer\Installers (important)\Microsoft Office Professional Plus 2013\Microsoft Toolkit.exe

FirewallRules: [{7AF38980-7029-4179-A9F3-73A8A3D77396}] => (Allow) C:\Users\LIM\AppData\Roaming\uTorrent\uTorrent.exe

FirewallRules: [{FBB86429-2184-4CBB-B8E4-CA2AF8442B99}] => (Allow) C:\Users\LIM\AppData\Roaming\uTorrent\uTorrent.exe

FirewallRules: [{63D3B672-A0F6-40B9-ABE9-6280D53228F6}] => (Allow) C:\Users\LIM\AppData\Roaming\uTorrent\uTorrent.exe

FirewallRules: [{CC6B7358-80A5-4EF6-86EA-7FC4CF0623DA}] => (Allow) C:\Users\LIM\AppData\Roaming\uTorrent\uTorrent.exe

FirewallRules: [{2EC77C86-06F5-4A73-BB52-C4E639A24AC1}] => (Allow) C:\Users\LIM\AppData\Roaming\uTorrent\uTorrent.exe

FirewallRules: [{741FA67B-8937-4A7D-9CCC-77867F5E4664}] => (Allow) C:\Users\LIM\AppData\Roaming\uTorrent\uTorrent.exe

FirewallRules: [{98AA678B-E228-41B7-AB75-F938140B94C8}] => (Allow) LPort=50248

FirewallRules: [TCP Query User{540D0C86-B20C-48BB-891E-AD716579C7C2}C:\program files\sketchup\sketchup 2016\sketchup.exe] => (Block) C:\program files\sketchup\sketchup 2016\sketchup.exe

FirewallRules: [UDP Query User{AFCE1BBC-73EE-4947-B932-ECC2D7AFEDCC}C:\program files\sketchup\sketchup 2016\sketchup.exe] => (Block) C:\program files\sketchup\sketchup 2016\sketchup.exe

FirewallRules: [TCP Query User{B2BF88CC-30B6-4C02-B9DF-5A785755385C}C:\programdata\asgvis\common\x64\vc101\distributed rendering\xmldrspawner.exe] => (Block) C:\programdata\asgvis\common\x64\vc101\distributed rendering\xmldrspawner.exe

FirewallRules: [UDP Query User{BDA800E3-FA9F-48A9-9165-E07F7A8ACB9F}C:\programdata\asgvis\common\x64\vc101\distributed rendering\xmldrspawner.exe] => (Block) C:\programdata\asgvis\common\x64\vc101\distributed rendering\xmldrspawner.exe

FirewallRules: [TCP Query User{01B9054B-C183-44FC-9090-7161A0A9BC23}C:\users\lim\appdata\roaming\spotify\spotify.exe] => (Allow) C:\users\lim\appdata\roaming\spotify\spotify.exe

FirewallRules: [UDP Query User{85045D50-1300-4D43-AFEE-BF0A4E850DEE}C:\users\lim\appdata\roaming\spotify\spotify.exe] => (Allow) C:\users\lim\appdata\roaming\spotify\spotify.exe

FirewallRules: [TCP Query User{C22A11F1-34A2-4A31-93CD-FDFE266F4F9D}C:\program files (x86)\2k games\nba 2k17\nba2k17.exe] => (Allow) C:\program files (x86)\2k games\nba 2k17\nba2k17.exe

FirewallRules: [UDP Query User{D422B3EE-4230-4C2B-B9CC-B8A146086D38}C:\program files (x86)\2k games\nba 2k17\nba2k17.exe] => (Allow) C:\program files (x86)\2k games\nba 2k17\nba2k17.exe

FirewallRules: [{E3FB2386-316A-41D9-81DF-0FC94B08514C}] => (Block) %ProgramFiles%\Adobe\Adobe Premiere Pro CC 2017\Adobe Premiere Pro.exe

FirewallRules: [{C8899157-8923-4CD5-BAC2-24A3D716FD07}] => (Block) %ProgramFiles%\Adobe\Adobe Photoshop CC 2015\Photoshop.exe

FirewallRules: [{E4237EEE-757C-48A6-AC89-935D5F79182A}] => (Allow) C:\Program Files (x86)\Intuit\QuickBooks Enterprise Solutions 16.0\qbdbmgrn.exe

FirewallRules: [{5F02E580-C370-48AB-9FFA-7DA51F0A8CB0}] => (Allow) C:\Program Files (x86)\Intuit\QuickBooks Enterprise Solutions 16.0\qbdbmgrn.exe

FirewallRules: [{5E20228F-3FFB-4923-8DFD-6E87BF669909}] => (Allow) C:\Program Files (x86)\Intuit\QuickBooks Enterprise Solutions 16.0\qbw32.exe

FirewallRules: [{5C5E8FD8-8D82-4C05-A14A-7EC81587B6A4}] => (Allow) C:\Program Files (x86)\Intuit\QuickBooks Enterprise Solutions 16.0\qbw32.exe

FirewallRules: [{A3980C04-B1F5-43B3-AC56-8978C299181E}] => (Allow) C:\Program Files (x86)\Intuit\QuickBooks Enterprise Solutions 16.0\dbmanagerexe.exe

FirewallRules: [{DE94AAE4-EC7A-4B10-9C3B-01F83455D148}] => (Allow) C:\Program Files (x86)\Intuit\QuickBooks Enterprise Solutions 16.0\dbmanagerexe.exe

FirewallRules: [{3A5F205C-734B-48D8-885B-16AAB43BDF2D}] => (Allow) C:\Program Files (x86)\Intuit\QuickBooks Enterprise Solutions 16.0\filemanagement.exe

FirewallRules: [{5E2F4969-2DFB-4088-BBF2-12EEB32F2885}] => (Allow) C:\Program Files (x86)\Intuit\QuickBooks Enterprise Solutions 16.0\filemanagement.exe

FirewallRules: [{D6BD718E-EA5A-4EF6-A3B2-66E2ACCF7E0F}] => (Allow) C:\Program Files (x86)\Common Files\Intuit\QuickBooks\qblaunch.exe

FirewallRules: [{753F30E8-7D12-4C1F-8ACB-3821C23FDC84}] => (Allow) C:\Program Files (x86)\Common Files\Intuit\QuickBooks\qblaunch.exe

FirewallRules: [{17CA482F-AA68-4931-B117-97923596299B}] => (Allow) C:\Program Files (x86)\Common Files\Intuit\QuickBooks\QBCFMonitorService.exe

FirewallRules: [{4C15C720-E936-433A-B8C4-C5C9775997C8}] => (Allow) C:\Program Files (x86)\Common Files\Intuit\QuickBooks\QBCFMonitorService.exe

FirewallRules: [{7508DB39-82D2-4FB7-94CA-1DFD02347587}] => (Allow) C:\Program Files (x86)\Steam\Steam.exe

FirewallRules: [{2E4DB797-E6E7-4017-8CE9-9742936612F9}] => (Allow) C:\Program Files (x86)\Steam\Steam.exe

FirewallRules: [{DDECBAB9-2A4A-4FBB-8842-3500469EA1E4}] => (Allow) C:\Program Files (x86)\Steam\bin\cef\cef.win7\steamwebhelper.exe

FirewallRules: [{22C4C7A6-3099-4D74-BC97-EC2880E5DAD6}] => (Allow) C:\Program Files (x86)\Steam\bin\cef\cef.win7\steamwebhelper.exe

FirewallRules: [{74D30090-C9E0-4310-8A0B-15E2DFC05F19}] => (Allow) C:\Program Files (x86)\Steam\steamapps\common\Prison Architect\Prison Architect.exe

FirewallRules: [{9A097499-C5EE-4DE3-9612-449E8C8F34A4}] => (Allow) C:\Program Files (x86)\Steam\steamapps\common\Prison Architect\Prison Architect.exe

FirewallRules: [TCP Query User{D7419773-F197-4BAF-A675-5F98199D4694}D:\movies\[pc] battlefield vietnam [dopeman]\battlefield vietnam\bfvietnam.exe] => (Block) D:\movies\[pc] battlefield vietnam [dopeman]\battlefield vietnam\bfvietnam.exe

FirewallRules: [UDP Query User{62B69899-E63E-4E37-9F96-43D100DCC3CB}D:\movies\[pc] battlefield vietnam [dopeman]\battlefield vietnam\bfvietnam.exe] => (Block) D:\movies\[pc] battlefield vietnam [dopeman]\battlefield vietnam\bfvietnam.exe

FirewallRules: [TCP Query User{DA98701B-62EC-4881-A1D0-FFC5993FD633}C:\program files (x86)\world in conflict - complete edition\wic.exe] => (Allow) C:\program files (x86)\world in conflict - complete edition\wic.exe

FirewallRules: [UDP Query User{88CD954B-2406-47E4-B084-DD316282F105}C:\program files (x86)\world in conflict - complete edition\wic.exe] => (Allow) C:\program files (x86)\world in conflict - complete edition\wic.exe

FirewallRules: [{0C329B36-A09C-4A3B-9C9F-B7A8D25F643A}] => (Allow) C:\Users\LIM\AppData\Local\Chromium\Application\chrome.exe

FirewallRules: [{A98F39EE-C585-40D0-A38B-64D2C869BD8F}] => (Allow) C:\Program Files\Chaos Group\V-Ray\V-Ray 3.4 for SketchUp\extension\vrayneui-win32-x64\vrayneui.exe

FirewallRules: [{D4B78C5C-24A0-4D52-BB87-D9088DDAB44A}] => (Allow) C:\Program Files\Chaos Group\V-Ray\V-Ray 3.4 for SketchUp\extension\vrayneui-win32-x64\vrayneui.exe

FirewallRules: [{F0BA7A48-8E54-46CE-8D4F-2A317562CBE4}] => (Allow) C:\Program Files\Chaos Group\VRLService\OLS\vrol.exe

FirewallRules: [{93321966-275B-4736-B20C-BA3E3644DED3}] => (Allow) C:\Program Files\Chaos Group\VRLService\OLS\vrol.exe

FirewallRules: [{5B9C6D6F-5900-4FB7-97D2-5D47948CA1C1}] => (Allow) LPort=20208

FirewallRules: [{47E200FD-FF30-49AE-AF8D-229AB63AA875}] => (Allow) LPort=20208

FirewallRules: [{57565F21-D9BE-4674-BFD9-21D2FF369CCE}] => (Allow) C:\Program Files\Chaos Group\V-Ray Swarm\swrm.exe

FirewallRules: [{E2CE141A-CED7-4BE9-8326-0B440DAB4725}] => (Allow) C:\Program Files\Chaos Group\V-Ray Swarm\swrm.exe

FirewallRules: [TCP Query User{CBE7DE90-F99B-4D1F-9B57-4864EB4EDE7F}C:\program files\sketchup\sketchup 2017\sketchup.exe] => (Allow) C:\program files\sketchup\sketchup 2017\sketchup.exe

FirewallRules: [UDP Query User{00C8D070-61B2-458A-A862-038D72C9F0E2}C:\program files\sketchup\sketchup 2017\sketchup.exe] => (Allow) C:\program files\sketchup\sketchup 2017\sketchup.exe

FirewallRules: [TCP Query User{10F120AB-69A5-4291-A674-B65E5562DF88}C:\users\lim\appdata\local\akamai\netsession_win.exe] => (Block) C:\users\lim\appdata\local\akamai\netsession_win.exe

FirewallRules: [UDP Query User{A98CCC44-BC8D-44F5-8801-61B54C1D8A2F}C:\users\lim\appdata\local\akamai\netsession_win.exe] => (Block) C:\users\lim\appdata\local\akamai\netsession_win.exe

FirewallRules: [{E3577175-03CC-4F0B-AED2-53019E34C6B5}] => (Allow) LPort=50395

FirewallRules: [{2E6AFBF5-0A0B-43AB-AF62-DA420FBEF236}] => (Allow) LPort=5000

FirewallRules: [{28AB18F4-6C4E-4688-B9B8-0447F1513CEF}] => (Allow) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe

==================== Restore Points =========================

08-12-2017 15:49:57 Windows Update

13-12-2017 06:54:05 Windows Update

28-12-2017 07:26:21 Windows Update

==================== Faulty Device Manager Devices =============

Name: NVIDIA Virtual Audio Device (Wave Extensible) (WDM)

Description: NVIDIA Virtual Audio Device (Wave Extensible) (WDM)

Class Guid: {4d36e96c-e325-11ce-bfc1-08002be10318}

Manufacturer: NVIDIA

Service: nvvad_WaveExtensible

Problem: : Windows cannot start this hardware device because its configuration information (in the registry) is incomplete or damaged. (Code 19)

Resolution: A registry problem was detected.

This can occur when more than one service is defined for a device, if there is a failure opening the service subkey, or if the driver name cannot be obtained from the service subkey. Try these options:

On the "General Properties" tab of the device, click "Troubleshoot" to start the troubleshooting wizard.

Click "Uninstall", and then click "Scan for hardware changes" to load a usable driver.

Name: NVVHCI Enumerator

Description: NVVHCI Enumerator

Class Guid: {4d36e97d-e325-11ce-bfc1-08002be10318}

Manufacturer: NVIDIA

Service: nvvhci

Problem: : Windows cannot start this hardware device because its configuration information (in the registry) is incomplete or damaged. (Code 19)

Resolution: A registry problem was detected.

On the "General Properties" tab of the device, click "Troubleshoot" to start the troubleshooting wizard.

Click "Uninstall", and then click "Scan for hardware changes" to load a usable driver.

==================== Event log errors: =========================

Application errors:

==================

Error: (12/28/2017 09:02:47 AM) (Source: ESENT) (EventID: 474) (User: )

Description: Catalog Database (1612) Catalog Database: The database page read from the file "C:\Windows\system32\CatRoot2\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\catdb" at offset 6283264 (0x00000000005fe000) (database page 1533 (0x5FD)) for 4096 (0x00001000) bytes failed verification due to a page checksum mismatch. The stored checksum was [1d991d99a310fa30] and the computed checksum was [1d991d99a310df98]. The read operation will fail with error -1018 (0xfffffc06). If this condition persists then please restore the database from a previous backup. This problem is likely due to faulty hardware. Please contact your hardware vendor for further assistance diagnosing the problem.

Error: (12/28/2017 08:50:11 AM) (Source: DptfEvent) (EventID: 1) (User: )

Description: DptfParticipantDisplayService

GetDisplayBrightnessFromPowerSettings: Could not inform driver of current brightness value.

Error: (12/28/2017 08:50:11 AM) (Source: DptfEvent) (EventID: 1) (User: )

Description: DptfParticipantDisplayService

SetBrightnessSettingInDriver: p_handle is NULL.

Error: (12/28/2017 08:50:11 AM) (Source: DptfEvent) (EventID: 1) (User: )

Description: DptfParticipantDisplayService

SetDisplayBrightnessViaPowerSettings: Could not obtain brightness value to set from driver.

Error: (12/28/2017 08:50:11 AM) (Source: DptfEvent) (EventID: 1) (User: )

Description: DptfParticipantDisplayService

GetBrightnessSettingFromDriver: p_handle is NULL.

Error: (12/28/2017 08:50:11 AM) (Source: DptfEvent) (EventID: 2) (User: )

Description: DptfParticipantDisplayService

ConnectToDptfDisplayDriver: SetupDiEnumDeviceInterfaces() failed.

Last error = [0x00000103]

System errors:

=============

Error: (12/28/2017 08:58:32 AM) (Source: DCOM) (EventID: 10016) (User: NT AUTHORITY)

Description: The application-specific permission settings do not grant Local Activation permission for the COM Server application with CLSID

{D63B10C5-BB46-4990-A94F-E40B9D520160}

and APPID

{9CA88EE3-ACB7-47C8-AFC4-AB702511C276}

to the user NT AUTHORITY\SYSTEM SID (S-1-5-18) from address LocalHost (Using LRPC) running in the application container Unavailable SID (Unavailable). This security permission can be modified using the Component Services administrative tool.

Error: (12/28/2017 08:53:50 AM) (Source: Service Control Manager) (EventID: 7023) (User: )

Description: The Connected Devices Platform Service service terminated with the following error:

Unspecified error

Error: (12/28/2017 08:51:25 AM) (Source: Service Control Manager) (EventID: 7000) (User: )

Description: The Windows Presentation Foundation Font Cache 3.0.0.0 service failed to start due to the following error:

The service did not respond to the start or control request in a timely fashion.

Error: (12/28/2017 08:51:25 AM) (Source: Service Control Manager) (EventID: 7009) (User: )

Description: A timeout was reached (30000 milliseconds) while waiting for the FontCache3.0.0.0 service to connect.

Error: (12/28/2017 08:50:55 AM) (Source: DCOM) (EventID: 10016) (User: NT AUTHORITY)

Description: The application-specific permission settings do not grant Local Activation permission for the COM Server application with CLSID

{8D8F4F83-3594-4F07-8369-FC3C3CAE4919}

and APPID

{F72671A9-012C-4725-9D2F-2A4D32D65169}

Error: (12/28/2017 08:50:39 AM) (Source: Service Control Manager) (EventID: 7000) (User: )

Description: The Ds3Service service failed to start due to the following error:

The service did not respond to the start or control request in a timely fashion.

Error: (12/28/2017 08:50:39 AM) (Source: Service Control Manager) (EventID: 7009) (User: )

Description: A timeout was reached (30000 milliseconds) while waiting for the Ds3Service service to connect.

Error: (12/28/2017 08:50:11 AM) (Source: Service Control Manager) (EventID: 7000) (User: )

Description: The MBAMService service failed to start due to the following error:

The system cannot find the file specified.

Error: (12/28/2017 08:48:41 AM) (Source: DCOM) (EventID: 10010) (User: LIM)

Description: The server Windows.Media.Capture.Internal.AppCaptureShell did not register with DCOM within the required timeout.

Error: (12/28/2017 08:48:40 AM) (Source: DCOM) (EventID: 10016) (User: NT AUTHORITY)

Description: The application-specific permission settings do not grant Local Activation permission for the COM Server application with CLSID

{D63B10C5-BB46-4990-A94F-E40B9D520160}

and APPID

{9CA88EE3-ACB7-47C8-AFC4-AB702511C276}

==================== Memory info ===========================

Processor: Intel® Core™ i7-4500U CPU @ 1.80GHz

Percentage of memory in use: 46%

Total physical RAM: 7321.43 MB

Available physical RAM: 3943.7 MB

Total Virtual: 11161.43 MB

Available Virtual: 7534.44 MB

==================== Drives ================================

Drive c: (OS) (Fixed) (Total:372.6 GB) (Free:235.76 GB) NTFS ==>[system with boot components (obtained from drive)]

Drive d: (DATA) (Fixed) (Total:537.8 GB) (Free:187.29 GB) NTFS

Drive f: () (Removable) (Total:7.48 GB) (Free:7.48 GB) FAT32

==================== MBR & Partition Table ==================

========================================================

Disk: 0 (Size: 931.5 GB) (Disk ID: 85AEADEC)

Partition: GPT.

========================================================

Disk: 1 (Size: 7.5 GB) (Disk ID: 08FE6CD8)

Partition 1: (Not Active) - (Size=7.5 GB) - (Type=0B)

==================== End of Addition.txt ============================

#7
RKinner

Posted 27 December 2017 - 09:04 PM

Malware Expert

Expert
24,625 posts

FRST wasn't as successful removing MBAM as I hoped but it does look like you were able to boot into regular mode.

Can you uninstall:

Malwarebytes version 3.1.2.1733

also

Search the Web (Yahoo) ?

#8
Bjohn24

Posted 27 December 2017 - 10:37 PM

New Member

Topic Starter
Member
7 posts

i cant uninstall Malwarebytes. It says windows cannot find the file unins000.exe.

#9
RKinner

Posted 28 December 2017 - 06:10 AM

Malware Expert

Expert
24,625 posts

OK. Get the MB-Clean program:

https://support.malw...m/docs/DOC-1112

The download for it is

on the same page down where it says:

What are the steps to use MB-Clean?

1. Download the latest version using the following link:

Back to Virus, Spyware, Malware Removal · Next Unread Topic →

As Featured On:

Geeks to Go Forum 343,325 topics
Quick Links FAQ Malware Cleaning Guide How it Works
Downloads 2+ million

View New Content

mbamswissarmy.sys windows wont boot

#1
Bjohn24

Posted 27 December 2017 - 05:53 AM

Advertisements

#2
RKinner

Posted 27 December 2017 - 08:33 AM

#3
Bjohn24

Posted 27 December 2017 - 06:58 PM

#4
Bjohn24

Posted 27 December 2017 - 07:01 PM

#5
Bjohn24

Posted 27 December 2017 - 07:10 PM

#6
Bjohn24

Posted 27 December 2017 - 07:11 PM

#7
RKinner

Posted 27 December 2017 - 09:04 PM

#8
Bjohn24

Posted 27 December 2017 - 10:37 PM

#9
RKinner

Posted 28 December 2017 - 06:10 AM

Similar Topics

0 user(s) are reading this topic

As Featured On:

Forums

Downloads

Members

Connect With Us

mbamswissarmy.sys windows wont boot

#1 Bjohn24 Posted 27 December 2017 - 05:53 AM

Advertisements

#2 RKinner Posted 27 December 2017 - 08:33 AM

#3 Bjohn24 Posted 27 December 2017 - 06:58 PM

#4 Bjohn24 Posted 27 December 2017 - 07:01 PM

#5 Bjohn24 Posted 27 December 2017 - 07:10 PM

#6 Bjohn24 Posted 27 December 2017 - 07:11 PM

#7 RKinner Posted 27 December 2017 - 09:04 PM

#8 Bjohn24 Posted 27 December 2017 - 10:37 PM

#9 RKinner Posted 28 December 2017 - 06:10 AM

Similar Topics

0 user(s) are reading this topic

As Featured On:

Forums

Downloads

Members

Connect With Us

Sign In

#1
Bjohn24

Posted 27 December 2017 - 05:53 AM

#2
RKinner

Posted 27 December 2017 - 08:33 AM

#3
Bjohn24

Posted 27 December 2017 - 06:58 PM

#4
Bjohn24

Posted 27 December 2017 - 07:01 PM

#5
Bjohn24

Posted 27 December 2017 - 07:10 PM

#6
Bjohn24

Posted 27 December 2017 - 07:11 PM

#7
RKinner

Posted 27 December 2017 - 09:04 PM

#8
Bjohn24

Posted 27 December 2017 - 10:37 PM

#9
RKinner

Posted 28 December 2017 - 06:10 AM