Jump to content

Welcome to Geeks to Go - Register now for FREE

Geeks To Go is a helpful hub, where thousands of volunteer geeks quickly serve friendly answers and support. Check out the forums and get free advice from the experts. Register now to gain access to all of our features, it's FREE and only takes one minute. Once registered and logged in, you will be able to create topics, post replies to existing threads, give reputation to your fellow members, get your own private messenger, post status updates, manage your profile and so much more.

Create Account How it Works
Photo

exploit ROP I think, browsers get certificate error

Malware ROP

  • Please log in to reply

#1
bhzendner

bhzendner

    Member

  • Member
  • PipPipPip
  • 226 posts
Scan result of Farbar Recovery Scan Tool (FRST) (x64) Version: 06.06.2018 01
Ran by ah010073 (administrator) on LENOVO-KM-1335 (09-06-2018 18:15:33)
Running from C:\Users\ah010073\Downloads
Loaded Profiles: ah010073 (Available Profiles: admin & Setup & Katherine Hatcher & ah010073)
Platform: Windows 7 Professional Service Pack 1 (X64) Language: English (United States)
Internet Explorer Version 11 (Default browser: IE)
Boot Mode: Normal
Tutorial for Farbar Recovery Scan Tool: http://www.geekstogo...very-scan-tool/
 
==================== Processes (Whitelisted) =================
 
(If an entry is included in the fixlist, the process will be closed. The file will not be moved.)
 
(Lenovo.) C:\Windows\System32\ibmpmsvc.exe
(Lenovo.) C:\Windows\System32\LPlatSvc.exe
(Lenovo) C:\Program Files\Lenovo\Fingerprint Manager Pro\CoreService.exe
(Intel Corporation) C:\Windows\System32\igfxCUIService.exe
(DisplayLink Corp.) C:\Program Files\DisplayLink Core Software\DisplayLinkManager.exe
(Microsoft Corporation) C:\Windows\System32\wisptis.exe
(DisplayLink Corp.) C:\Program Files\DisplayLink Core Software\DisplayLinkUserAgent.exe
(Microsoft Corporation) C:\Windows\System32\wlanext.exe
(SUPERAntiSpyware.com) C:\Program Files\SUPERAntiSpyware\SASCore64.exe
(Intel® Corporation) C:\Program Files\Intel\WiFi\bin\EvtEng.exe
(Condusiv Technologies) C:\Program Files\Condusiv Technologies\ExpressCache\ExpressCache.exe
(Microsoft Corporation) C:\Windows\Microsoft.NET\Framework64\v3.0\WPF\PresentationFontCache.exe
(%CFullName%) C:\Program Files\Lenovo\Fingerprint Manager Pro\opvapp.exe
(IBM) C:\Program Files (x86)\IBM\Notes\nsd.exe
(Intel® Corporation) C:\Program Files\Intel Corporation\Intel® Technology Access\IntelTechnologyAccessService.exe
(Lenovo Group Limited) C:\Program Files\Lenovo\Communications Utility\CamMute.exe
(Lenovo Group Limited) C:\Program Files\Lenovo\Communications Utility\TPKNRSVC.exe
(Lenovo Group Limited) C:\Program Files\Lenovo\Communications Utility\vcamsvc.exe
(Lenovo Group Limited) C:\Program Files\Lenovo\VIRTSCRL\lvvsst.exe
(IBM Corp) C:\Program Files (x86)\IBM\Notes\SUService.exe
(IBM Corp) C:\Program Files (x86)\IBM\Notes\ntmulti.exe
(Trend Micro Inc.) C:\Program Files (x86)\Trend Micro\OfficeScan Client\NTRTScan.exe
(Intel® Corporation) C:\Program Files\Common Files\Intel\WirelessCommon\RegSrvc.exe
() C:\Program Files (x86)\ScreenConnect Client (2983e16809ce38ec)\ScreenConnect.ClientService.exe
(Synaptics Incorporated) C:\Program Files\Synaptics\SynTP\SynTPEnhService.exe
(Lenovo Group Limited) C:\Program Files\Lenovo\HOTKEY\TPHKSVC.exe
(Synaptics Incorporated) C:\Windows\System32\valWBFPolicyService.exe
(Intel® Corporation) C:\Program Files\Intel\WiFi\bin\ZeroConfigService.exe
(Malwarebytes) C:\Program Files\Malwarebytes\Anti-Malware\MBAMService.exe
(Trend Micro Inc.) C:\Program Files (x86)\Trend Micro\OfficeScan Client\TmListen.exe
(Lenovo Group Limited) C:\Program Files\Lenovo\HOTKEY\tphkload.exe
(Trend Micro Inc.) C:\Program Files (x86)\Trend Micro\OfficeScan Client\CNTAoSMgr.exe
(Microsoft Corporation) C:\Windows\System32\PrintIsolationHost.exe
(Microsoft Corporation) C:\Windows\System32\UI0Detect.exe
(Lenovo Group Limited) C:\Program Files (x86)\Lenovo\QuickControl\QuickControlService.exe
(ScreenConnect Software) C:\Program Files (x86)\ScreenConnect Client (2983e16809ce38ec)\ScreenConnect.WindowsClient.exe
(Motorola Solutions, Inc.) C:\Program Files (x86)\Intel\Bluetooth\devmonsrv.exe
(Motorola Solutions, Inc.) C:\Program Files (x86)\Intel\Bluetooth\mediasrv.exe
(Motorola Solutions, Inc.) C:\Program Files (x86)\Intel\Bluetooth\obexsrv.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Intel® Management Engine Components\DAL\jhi_service.exe
(Lenovo) C:\Program Files\Lenovo\Lenovo Peer Connect\LenovoDiscoverySvc.exe
(Lenovo Group Limited) C:\Program Files\Lenovo\VIRTSCRL\virtscrl.exe
(Lenovo.) C:\Windows\System32\LPlatSvc.exe
(Malwarebytes) C:\Program Files\Malwarebytes\Anti-Malware\mbamtray.exe
(ScreenConnect Software) C:\Program Files (x86)\ScreenConnect Client (2983e16809ce38ec)\ScreenConnect.WindowsClient.exe
(Lenovo Group Limited) C:\Program Files (x86)\Lenovo\QuickControl\QuickControl.exe
(Microsoft Corporation) C:\Windows\System32\wisptis.exe
(Microsoft Corporation) C:\Windows\System32\rundll32.exe
(Nok Nok Labs Inc.) C:\Program Files (x86)\Nok Nok Labs\MFACUpdater\MFACUpdate.exe
(Synaptics Incorporated) C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
(Lenovo Group Limited) C:\Program Files\Lenovo\HOTKEY\TPONSCR.exe
(Lenovo Group Limited) C:\Program Files\Lenovo\HOTKEY\shtctky.exe
(Lenovo.) C:\Windows\System32\TpShocks.exe
(Synaptics Incorporated) C:\Program Files\Synaptics\SynTP\SynTPHelper.exe
(Synaptics Incorporated) C:\Program Files\Synaptics\SynTP\SynTPLpr.exe
(Synaptics) C:\Program Files\Synaptics\SynTP\SynLenovoHelper.exe
(Intel Corporation) C:\Windows\System32\igfxEM.exe
(Intel Corporation) C:\Windows\System32\igfxHK.exe
(Realtek Semiconductor) C:\Program Files\Realtek\Audio\HDA\RAVBg64.exe
(Realtek Semiconductor) C:\Program Files\Realtek\Audio\HDA\RAVBg64.exe
(Realtek Semiconductor) C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe
(Realtek Semiconductor Corp.) C:\Windows\RtsCM64.exe
(Lenovo Group Limited) C:\Program Files\Lenovo\Communications Utility\TpKnrres.exe
(Nok Nok Labs, Inc.) C:\Program Files\Nok Nok Labs\Multifactor Authentication Client\bin\mfac.exe
(Microsoft Corporation) C:\Windows\System32\rundll32.exe
(SUPERAntiSpyware) C:\Program Files\SUPERAntiSpyware\SUPERANTISPYWARE.EXE
(Intel Corporation) C:\Program Files (x86)\Intel\Intel® USB 3.0 3.1 eXtensible Host Controller Driver\Application\iusb3mon.exe
(Microsoft Corporation) C:\Windows\SysWOW64\rundll32.exe
(Trend Micro Inc.) C:\Program Files (x86)\Trend Micro\OfficeScan Client\PccNTMon.exe
(Microsoft Corporation) C:\Windows\System32\rundll32.exe
() C:\Program Files (x86)\IdeaMax Server\Driver\IdeaMax Server.exe
(Oracle Corporation) C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe
(Lenovo Group Limited) C:\Program Files (x86)\ThinkPad\Utilities\SCHTASK.EXE
(Lenovo) C:\Program Files\Lenovo\Lenovo Solution Center\LSCNotify.exe
() C:\Program Files (x86)\Lenovo\System Update\SUService.exe
() C:\Program Files (x86)\Lenovo\System Update\UNCServer.exe
(Microsoft Corporation) C:\Windows\System32\cmd.exe
(Lenovo Group Limited) C:\Users\ah010073\AppData\Local\Programs\Lenovo\Lenovo Service Bridge\LSB.exe
(Microsoft Corporation) C:\Program Files\Common Files\Microsoft Shared\ink\InputPersonalization.exe
(Lenovo) C:\Program Files (x86)\ThinkPad\Utilities\PWMDBSVC.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Adobe Systems Incorporated) C:\Program Files (x86)\Adobe\Reader 11.0\Reader\reader_sl.exe
 
==================== Registry (Whitelisted) ===========================
 
(If an entry is included in the fixlist, the registry item will be restored to default or removed. The file will not be moved.)
 
HKLM\...\Run: [RtsCM] => C:\Windows\RTSCM64.EXE [195288 2014-12-09] (Realtek Semiconductor Corp.)
HKLM\...\Run: [LENOVO.TPKNRRES] => C:\Program Files\Lenovo\Communications Utility\TPKNRRES.exe [296664 2017-05-12] (Lenovo Group Limited)
HKLM\...\Run: [MFACApp] => C:\Program Files\Nok Nok Labs\Multifactor Authentication Client\bin\mfac.exe [5449544 2014-10-16] (Nok Nok Labs, Inc.)
HKLM\...\Run: [BTMTrayAgent] => rundll32.exe "C:\Program Files (x86)\Intel\Bluetooth\btmshellex.dll",TrayApp
HKLM\...\Run: [OfficeScanNT Monitor] =>  -HideWindow
HKLM-x32\...\Run: [IMSS] => C:\Program Files (x86)\Intel\Intel® Management Engine Components\IMSS\PrivacyIconClient.exe [1172256 2014-10-10] (Intel Corporation)
HKLM-x32\...\Run: [USB3MON] => C:\Program Files (x86)\Intel\Intel® USB 3.0 3.1 eXtensible Host Controller Driver\Application\iusb3mon.exe [299520 2017-03-28] (Intel Corporation)
HKLM-x32\...\Run: [PWMTRV] => rundll32 "C:\Program Files (x86)\ThinkPad\Utilities\PWMTR64V.DLL",PwrMgrBkGndMonitor
HKLM-x32\...\Run: [OfficeScanNT Monitor] => C:\Program Files (x86)\Trend Micro\OfficeScan Client\pccntmon.exe [1176880 2009-04-16] (Trend Micro Inc.)
HKLM-x32\...\Run: [IdeaMax Server] => C:\Program Files (x86)\IdeaMax Server\Driver\IdeaMax Server.exe [12172288 2013-06-18] ()
HKLM-x32\...\Run: [SunJavaUpdateSched] => C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe [588704 2018-03-28] (Oracle Corporation)
HKU\S-1-5-21-345086361-1354177263-1882197541-10279\...\Run: [McAfeeSafeConnect] => C:\Program Files (x86)\McAfee Safe Connect\McAfee Safe Connect.exe
HKU\S-1-5-21-345086361-1354177263-1882197541-10279\...\Run: [SUPERAntiSpyware] => C:\Program Files\SUPERAntiSpyware\SUPERAntiSpyware.exe [8887216 2018-06-08] (SUPERAntiSpyware)
HKU\S-1-5-21-345086361-1354177263-1882197541-10279\...\Winlogon: [Shell] C:\Windows\EXPLORER.EXE [3229696 2016-08-29] (Microsoft Corporation) <==== ATTENTION
Lsa: [Notification Packages] scecli C:\Program Files\TrueKey\McAfeeTrueKeyPasswordFilter
Startup: C:\Users\ah010073\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\bluejeans-helper.vbs [2017-04-21] ()
 
==================== Internet (Whitelisted) ====================
 
(If an item is included in the fixlist, if it is a registry item it will be removed or restored to default.)
 
Hosts: There are more than one entry in Hosts. See Hosts section of Addition.txt
Tcpip\Parameters: [DhcpNameServer] 10.0.0.1
Tcpip\..\Interfaces\{AF8D5019-11F7-4072-AD63-F3770B56EF97}: [DhcpNameServer] 10.0.0.1
Tcpip\..\Interfaces\{B56F0B4F-5A87-4D0B-9726-C877E2FC4722}: [DhcpNameServer] 10.128.0.122 10.128.0.123
 
Internet Explorer:
==================
HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://lenovo13.msn.com/?pc=LCTE
HKU\S-1-5-21-345086361-1354177263-1882197541-10279\Software\Microsoft\Internet Explorer\Main,Start Page = hxxps://direct.kdacentral.com/
HKU\S-1-5-21-345086361-1354177263-1882197541-10279\Software\Microsoft\Internet Explorer\Main,Secondary Start Pages = hxxps://vpn.kdaconnect.com/
SearchScopes: HKU\S-1-5-21-345086361-1354177263-1882197541-10279 -> {89B0AC89-AE64-4768-B92D-CDE93D715BD5} URL = 
BHO: Java™ Plug-In SSV Helper -> {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} -> C:\Program Files\Java\jre1.8.0_171\bin\ssv.dll [2018-06-08] (Oracle Corporation)
BHO: Office Document Cache Handler -> {B4F3A835-0E21-4959-BA22-42B3008E02FF} -> C:\Program Files\Microsoft Office\Office15\URLREDIR.DLL [2014-01-21] (Microsoft Corporation)
BHO: Microsoft SkyDrive Pro Browser Helper -> {D0498E0A-45B7-42AE-A9AA-ABA463DBD3BF} -> C:\Program Files\Microsoft Office\Office15\GROOVEEX.DLL [2018-05-15] (Microsoft Corporation)
BHO: Java™ Plug-In 2 SSV Helper -> {DBC80044-A445-435b-BC74-9C25C1C588A9} -> C:\Program Files\Java\jre1.8.0_171\bin\jp2ssv.dll [2018-06-08] (Oracle Corporation)
BHO-x32: Telephony Toolbar Services -> {431A60E6-675F-4b9f-B3F0-66E0FECC8B34} -> C:\Program Files (x86)\Evolve IP\bin\BW_Assistant_Enterprise_IE_S.dll [2012-01-16] (BroadSoft® Australia Pty Ltd)
BHO-x32: Telephony Toolbar Call Control -> {8F1FF1A7-C048-4d6b-B052-56E42CE427CB} -> C:\Program Files (x86)\Evolve IP\bin\BW_Assistant_Enterprise_IE_CC.dll [2012-01-16] (BroadSoft® Australia Pty Ltd)
BHO-x32: Office Document Cache Handler -> {B4F3A835-0E21-4959-BA22-42B3008E02FF} -> C:\Program Files (x86)\Microsoft Office\Office15\URLREDIR.DLL [2014-01-23] (Microsoft Corporation)
BHO-x32: Microsoft SkyDrive Pro Browser Helper -> {D0498E0A-45B7-42AE-A9AA-ABA463DBD3BF} -> C:\Program Files (x86)\Microsoft Office\Office15\GROOVEEX.DLL [2018-05-15] (Microsoft Corporation)
Toolbar: HKLM-x32 - Telephony Toolbar Call Control - {6F6690B9-C5DB-4F08-8833-F2EF4DEE956B} - C:\Program Files (x86)\Evolve IP\bin\BW_Assistant_Enterprise_IE_CC.dll [2012-01-16] (BroadSoft® Australia Pty Ltd)
Toolbar: HKLM-x32 - Telephony Toolbar Services - {F10D927F-D3DF-4734-98AB-DD258253F5FD} - C:\Program Files (x86)\Evolve IP\bin\BW_Assistant_Enterprise_IE_S.dll [2012-01-16] (BroadSoft® Australia Pty Ltd)
DPF: HKLM {D27CDB6E-AE6D-11CF-96B8-444553540000} hxxps://fpdownload.macromedia.com/get/shockwave/cabs/flash/swflash.cab
DPF: HKLM-x32 {F27237D7-93C8-44C2-AC6E-D6057B9A918F} hxxps://vpn.kdaconnect.com/dana-cached/sc/JuniperSetupClient.cab
 
FireFox:
========
FF HKLM\...\Firefox\Extensions: [[email protected]] - C:\Program Files\Nok Nok Labs\Multifactor Authentication Client\bin\firefox\x86\FIDOaddon
FF Extension: (MFAC Extension) - C:\Program Files\Nok Nok Labs\Multifactor Authentication Client\bin\firefox\x86\FIDOaddon [2015-12-24] [Legacy] [not signed]
FF HKLM-x32\...\Firefox\Extensions: [[email protected]] - C:\Program Files\Nok Nok Labs\Multifactor Authentication Client\bin\firefox\x86\FIDOaddon
FF Plugin: @java.com/DTPlugin,version=11.171.2 -> C:\Program Files\Java\jre1.8.0_171\bin\dtplugin\npDeployJava1.dll [2018-06-08] (Oracle Corporation)
FF Plugin: @java.com/JavaPlugin,version=11.171.2 -> C:\Program Files\Java\jre1.8.0_171\bin\plugin2\npjp2.dll [2018-06-08] (Oracle Corporation)
FF Plugin: @microsoft.com/GENUINE -> disabled [No File]
FF Plugin: @Microsoft.com/NpCtrl,version=1.0 -> c:\Program Files\Microsoft Silverlight\5.1.50907.0\npctrl.dll [2017-05-03] ( Microsoft Corporation)
FF Plugin-x32: @intel-webapi.intel.com/Intel WebAPI ipt;version=4.0.56 -> C:\Program Files (x86)\Intel\Intel® Management Engine Components\IPT\npIntelWebAPIIPT.dll [2014-10-10] (Intel Corporation)
FF Plugin-x32: @intel-webapi.intel.com/Intel WebAPI updater -> C:\Program Files (x86)\Intel\Intel® Management Engine Components\IPT\npIntelWebAPIUpdater.dll [2014-10-10] (Intel Corporation)
FF Plugin-x32: @microsoft.com/GENUINE -> disabled [No File]
FF Plugin-x32: @Microsoft.com/NpCtrl,version=1.0 -> c:\Program Files (x86)\Microsoft Silverlight\5.1.50907.0\npctrl.dll [2017-05-03] ( Microsoft Corporation)
FF Plugin-x32: @microsoft.com/SharePoint,version=14.0 -> C:\PROGRA~2\MICROS~1\Office15\NPSPWRAP.DLL [2014-01-23] (Microsoft Corporation)
FF Plugin-x32: @tools.google.com/Google Update;version=3 -> C:\Program Files (x86)\Google\Update\1.3.33.17\npGoogleUpdate3.dll [2018-05-17] (Google Inc.)
FF Plugin-x32: @tools.google.com/Google Update;version=9 -> C:\Program Files (x86)\Google\Update\1.3.33.17\npGoogleUpdate3.dll [2018-05-17] (Google Inc.)
FF Plugin-x32: @update.noknok.com/Nok Nok Labs MFACUpdater;version=3 -> C:\Program Files (x86)\Nok Nok Labs\MFACUpdater\1.3.27.0\npGoogleUpdate3.dll [2015-12-24] (Nok Nok Labs Inc.)
FF Plugin-x32: @update.noknok.com/Nok Nok Labs MFACUpdater;version=9 -> C:\Program Files (x86)\Nok Nok Labs\MFACUpdater\1.3.27.0\npGoogleUpdate3.dll [2015-12-24] (Nok Nok Labs Inc.)
FF Plugin-x32: Adobe Reader -> C:\Program Files (x86)\Adobe\Reader 11.0\Reader\AIR\nppdf32.dll [2017-11-01] (Adobe Systems Inc.)
FF Plugin HKU\S-1-5-21-345086361-1354177263-1882197541-10279: @zoom.us/ZoomVideoPlugin -> C:\Users\ah010073\AppData\Roaming\Zoom\bin\npzoomplugin.dll [2016-07-13] (Zoom Video Communications, Inc.)
 
Chrome: 
=======
CHR Profile: C:\Users\ah010073\AppData\Local\Google\Chrome\User Data\Default [2018-06-09]
CHR Extension: (Docs) - C:\Users\ah010073\AppData\Local\Google\Chrome\User Data\Default\Extensions\aohghmighlieiainnegkcijnfilokake [2017-10-16]
CHR Extension: (Google Drive) - C:\Users\ah010073\AppData\Local\Google\Chrome\User Data\Default\Extensions\apdfllckaahabafndbhieahigkjlhalf [2016-05-02]
CHR Extension: (YouTube) - C:\Users\ah010073\AppData\Local\Google\Chrome\User Data\Default\Extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo [2016-05-02]
CHR Extension: (Sheets) - C:\Users\ah010073\AppData\Local\Google\Chrome\User Data\Default\Extensions\felcaaldnbdncclmgdcncolpebgiejap [2017-10-16]
CHR Extension: (GoToMeeting Pro Screensharing) - C:\Users\ah010073\AppData\Local\Google\Chrome\User Data\Default\Extensions\gcgikpombjkodabhbdalkcdhmllafipp [2018-06-08]
CHR Extension: (Google Docs Offline) - C:\Users\ah010073\AppData\Local\Google\Chrome\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi [2016-05-02]
CHR Extension: () - C:\Users\ah010073\AppData\Local\Google\Chrome\User Data\Default\Extensions\mbgbpjganndfjjmlamggkkkjafblbahl [2018-06-08]
CHR Extension: (Chrome Web Store Payments) - C:\Users\ah010073\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda [2018-04-13]
CHR Extension: (Gmail) - C:\Users\ah010073\AppData\Local\Google\Chrome\User Data\Default\Extensions\pjkljhegncpnkpknbcohdijeoejaedia [2016-05-02]
CHR Extension: (Chrome Media Router) - C:\Users\ah010073\AppData\Local\Google\Chrome\User Data\Default\Extensions\pkedcjkdefgpdelpbcmbmeomcjbeemfm [2018-06-08]
CHR HKLM-x32\...\Chrome\Extension: [mbgbpjganndfjjmlamggkkkjafblbahl] - C:\Program Files\Nok Nok Labs\Multifactor Authentication Client\bin\Chrome\x86\FidoExtension.crx [2014-10-16]
 
==================== Services (Whitelisted) ====================
 
(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)
 
R2 !SASCORE; C:\Program Files\SUPERAntiSpyware\SASCORE64.EXE [173472 2017-01-30] (SUPERAntiSpyware.com)
R2 CoreService; C:\Program Files\Lenovo\Fingerprint Manager Pro\CoreService.exe [858896 2017-10-11] (Lenovo)
R2 DisplayLinkService; C:\Program Files\DisplayLink Core Software\DisplayLinkManager.exe [9954096 2014-03-31] (DisplayLink Corp.)
S3 DozeSvc; C:\Program Files (x86)\ThinkPad\Utilities\DZSVC64.EXE [326160 2016-04-14] (Lenovo.)
R2 ExpressCache; C:\Program Files\Condusiv Technologies\ExpressCache\ExpressCache.exe [828656 2013-11-18] (Condusiv Technologies)
R2 IBM Notes Diagnostics; C:\Program Files (x86)\IBM\Notes\nsd.exe [5164136 2013-10-15] (IBM)
S2 iBtSiva; C:\Program Files (x86)\Intel\Bluetooth\ibtsiva.exe [124520 2014-12-24] (Intel Corporation)
R2 igfxCUIService2.0.0.0; C:\Windows\system32\igfxCUIService.exe [373704 2017-09-21] (Intel Corporation)
S3 Intel® Capability Licensing Service TCP IP Interface; C:\Program Files\Intel\iCLS Client\SocketHeciServer.exe [887256 2014-05-13] (Intel® Corporation)
R2 Intel® TechnologyAccessService; C:\Program Files\Intel Corporation\Intel® Technology Access\IntelTechnologyAccessService.exe [95624 2015-01-23] (Intel® Corporation)
S3 iumsvc; C:\Program Files (x86)\Intel\Intel® Update Manager\bin\iumsvc.exe [177376 2016-08-12] (Intel Corporation)
R2 jhi_service; C:\Program Files (x86)\Intel\Intel® Management Engine Components\DAL\jhi_service.exe [158496 2014-10-10] (Intel Corporation)
S3 Lenovo EasyPlus Hotspot; C:\Program Files (x86)\Common Files\lenovo\easyplussdk\bin\EPHotspot64.exe [619776 2014-12-05] (Lenovo)
R2 LENOVO.TVTVCAM; C:\Program Files\Lenovo\Communications Utility\vcamsvc.exe [169176 2017-05-12] (Lenovo Group Limited)
R2 Lenovo.VIRTSCRLSVC; C:\Program Files\LENOVO\VIRTSCRL\lvvsst.exe [120400 2017-04-03] (Lenovo Group Limited)
S3 LenovoProdRegManager; C:\Program Files (x86)\Lenovo Registration\EngageService.exe [293416 2015-01-09] (Aviata, Inc.)
R2 LNSUSvc; C:\Program Files (x86)\IBM\Notes\SUService.exe [1654376 2013-10-15] (IBM Corp)
R2 lnvDiscoveryWinSvc; C:\Program Files\Lenovo\Lenovo Peer Connect\LenovoDiscoverySvc.exe [21552 2014-02-21] (Lenovo)
R2 LPlatSvc; C:\Windows\system32\LPlatSvc.exe [774736 2017-09-05] (Lenovo.)
S3 LSC.Services.SystemService; C:\Program Files\Lenovo\Lenovo Solution Center\App\LSC.Services.SystemService.exe [271128 2017-06-09] (Lenovo)
R2 MBAMService; C:\Program Files\Malwarebytes\Anti-Malware\mbamservice.exe [6541008 2018-05-09] (Malwarebytes)
R2 Multi-user Cleanup Service; C:\Program Files (x86)\IBM\Notes\ntmulti.exe [38504 2013-10-15] (IBM Corp)
S3 MyWiFiDHCPDNS; C:\Program Files\Intel\WiFi\bin\PanDhcpDns.exe [268968 2017-10-24] ()
R2 ntrtscan; C:\Program Files (x86)\Trend Micro\OfficeScan Client\ntrtscan.exe [1834800 2009-04-15] (Trend Micro Inc.)
S2 QuickControlMasterSvc; C:\Program Files (x86)\Lenovo\QuickControl\QuickControlMasterSvc.exe [61232 2014-12-05] (Lenovo Group Limited)
R3 QuickControlService; C:\Program Files (x86)\Lenovo\QuickControl\QuickControlService.exe [317224 2014-12-05] (Lenovo Group Limited)
R2 ScreenConnect Client (2983e16809ce38ec); C:\Program Files (x86)\ScreenConnect Client (2983e16809ce38ec)\ScreenConnect.ClientService.exe [90768 2017-06-14] ()
S3 ShareItSvc; C:\Program Files (x86)\Lenovo\SHAREit\Shareit.Service.exe [31176 2016-01-20] (SHAREit Technologies Co.Ltd)
R3 SUService; C:\Program Files (x86)\Lenovo\System Update\SUService.exe [23920 2017-12-12] ()
R2 SynTPEnhService; C:\Program Files\Synaptics\SynTP\SynTPEnhService.exe [270424 2017-05-26] (Synaptics Incorporated)
R2 tmlisten; C:\Program Files (x86)\Trend Micro\OfficeScan Client\tmlisten.exe [1867480 2009-04-21] (Trend Micro Inc.)
S3 TmProxy; C:\Program Files (x86)\Trend Micro\OfficeScan Client\TmProxy.exe [865032 2009-02-23] (Trend Micro Inc.)
R2 valWBFPolicyService; C:\Windows\system32\valWBFPolicyService.exe [95016 2016-08-01] (Synaptics Incorporated)
R2 WinDefend; C:\Program Files\Windows Defender\mpsvc.dll [1011712 2013-05-26] (Microsoft Corporation)
R2 ZeroConfigService; C:\Program Files\Intel\WiFi\bin\ZeroConfigService.exe [3758760 2017-10-24] (Intel® Corporation)
 
===================== Drivers (Whitelisted) ======================
 
(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)
 
S3 aftap0901; C:\Windows\System32\DRIVERS\aftap0901.sys [48624 2018-03-06] (The OpenVPN Project)
R3 btmaux; C:\Windows\System32\DRIVERS\btmaux.sys [153616 2016-04-11] (Motorola Solutions, Inc.)
R3 btmhsf; C:\Windows\System32\DRIVERS\btmhsf.sys [1447736 2014-11-24] (Motorola Solutions, Inc.)
S3 btmlehid; C:\Windows\system32\drivers\btmlehid.sys [83768 2014-11-05] (Motorola Solutions, Inc.)
R3 e1dexpress; C:\Windows\System32\DRIVERS\e1d62x64.sys [533496 2017-02-01] (Intel Corporation)
R1 ESProtectionDriver; C:\Windows\system32\drivers\mbae64.sys [152184 2018-04-26] (Malwarebytes)
R1 excfs; C:\Windows\System32\DRIVERS\excfs.sys [25840 2013-11-18] (Condusiv Technologies)
R0 excsd; C:\Windows\System32\DRIVERS\excsd.sys [117488 2013-11-18] (Condusiv Technologies)
R3 HHTHid; C:\Windows\System32\DRIVERS\HHTHid.sys [8192 2011-11-29] (HHT-Tech)
R3 HHTHid_ArtvhMouFiltr; C:\Windows\System32\DRIVERS\HHTHidMouFiltr.sys [7168 2011-11-29] (HHT-Tech)
R3 hhusb5; C:\Windows\System32\DRIVERS\hhusb5.sys [37944 2012-05-11] ()
R0 iaStorF; C:\Windows\System32\drivers\iaStorF.sys [31712 2016-06-16] (Intel Corporation)
R3 ibtusb; C:\Windows\System32\DRIVERS\ibtusb.sys [231152 2014-12-24] (Intel Corporation)
R2 MBAMChameleon; C:\Windows\System32\Drivers\MbamChameleon.sys [190696 2018-06-09] (Malwarebytes)
R3 MBAMFarflt; C:\Windows\System32\DRIVERS\farflt.sys [112864 2018-06-09] (Malwarebytes)
R3 MBAMProtection; C:\Windows\System32\DRIVERS\mbam.sys [44768 2018-06-09] (Malwarebytes)
R3 MBAMSwissArmy; C:\Windows\System32\Drivers\mbamswissarmy.sys [253664 2018-06-09] (Malwarebytes)
R3 MBAMWebProtection; C:\Windows\System32\DRIVERS\mwac.sys [94328 2018-06-09] (Malwarebytes)
R3 MEIx64; C:\Windows\System32\DRIVERS\TeeDriverx64.sys [129312 2014-10-10] (Intel Corporation)
R1 ndisrd; C:\Windows\System32\DRIVERS\ndisrfl.sys [41176 2014-10-30] (Intel Corporation)
R3 NETwNs64; C:\Windows\System32\DRIVERS\Netwsw04.sys [3472392 2017-10-29] (Intel Corporation)
R1 OMNISMI; C:\Windows\SysWOW64\drivers\omnismi.sys [14776 2014-09-25] ()
R3 RTSPER; C:\Windows\System32\DRIVERS\RtsPer.sys [466136 2014-01-13] (Realsil Semiconductor Corporation)
R3 rtsuvc; C:\Windows\System32\DRIVERS\rtsuvc.sys [2980568 2014-12-09] (Realtek Semiconductor Corp.)
R1 SASDIFSV; C:\Program Files\SUPERAntiSpyware\SASDIFSV64.SYS [14928 2011-07-22] (SUPERAdBlocker.com and SUPERAntiSpyware.com)
R1 SASKUTIL; C:\Program Files\SUPERAntiSpyware\SASKUTIL64.SYS [12368 2011-07-12] (SUPERAdBlocker.com and SUPERAntiSpyware.com)
S3 SmbDrv; C:\Windows\system32\drivers\Smb_driver_AMDASF.sys [32424 2015-02-12] (Synaptics Incorporated)
R3 SmbDrvI; C:\Windows\System32\DRIVERS\Smb_driver_Intel.sys [64088 2017-05-26] (Synaptics Incorporated)
R2 TmFilter; C:\Program Files (x86)\Trend Micro\OfficeScan Client\TmXPFlt.sys [344864 2013-08-14] (Trend Micro Inc.)
R2 TmPreFilter; C:\Program Files (x86)\Trend Micro\OfficeScan Client\TmPreFlt.sys [42272 2013-08-14] (Trend Micro Inc.)
R1 tmtdi; C:\Windows\System32\DRIVERS\tmtdi.sys [93200 2009-02-23] (Trend Micro Inc.)
R2 VSApiNt; C:\Program Files (x86)\Trend Micro\OfficeScan Client\VSApiNt.sys [2260768 2013-08-14] (Trend Micro Inc.)
 
==================== NetSvcs (Whitelisted) ===================
 
(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)
 
 
==================== One Month Created files and folders ========
 
(If an entry is included in the fixlist, the file/folder will be moved.)
 
2018-06-09 18:15 - 2018-06-09 18:16 - 000025466 _____ C:\Users\ah010073\Downloads\FRST.txt
2018-06-09 18:15 - 2018-06-09 18:15 - 000000000 ____D C:\FRST
2018-06-09 18:13 - 2018-06-09 18:14 - 002413056 _____ (Farbar) C:\Users\ah010073\Downloads\FRST64.exe
2018-06-09 17:24 - 2018-06-09 17:24 - 000000000 ____D C:\Users\ah010073\Downloads\ROPgadget-master
2018-06-09 17:23 - 2018-06-09 17:23 - 006087385 ____N C:\Users\ah010073\Downloads\ROPgadget-master.zip
2018-06-09 16:58 - 2018-06-09 16:58 - 000000000 ____D C:\Users\ah010073\Downloads\58153ea29ba78_MalwarebytesAnti-Exploit
2018-06-09 16:57 - 2018-06-09 16:57 - 002106590 ____N C:\Users\ah010073\Downloads\58153ea29ba78_MalwarebytesAnti-Exploit.zip
2018-06-09 08:00 - 2018-06-09 17:49 - 000112864 _____ (Malwarebytes) C:\Windows\system32\Drivers\farflt.sys
2018-06-09 08:00 - 2018-06-09 17:49 - 000094328 _____ (Malwarebytes) C:\Windows\system32\Drivers\mwac.sys
2018-06-09 08:00 - 2018-06-09 17:49 - 000044768 _____ (Malwarebytes) C:\Windows\system32\Drivers\mbam.sys
2018-06-09 08:00 - 2018-06-09 08:00 - 000190696 _____ (Malwarebytes) C:\Windows\system32\Drivers\MbamChameleon.sys
2018-06-09 07:59 - 2018-06-09 07:59 - 000000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Malwarebytes
2018-06-09 01:13 - 2018-06-09 01:13 - 000905932 _____ C:\Users\ah010073\AppData\Local\census.cache
2018-06-09 01:12 - 2018-06-09 01:12 - 000335286 _____ C:\Users\ah010073\AppData\Local\ars.cache
2018-06-08 22:08 - 2018-06-08 22:08 - 000000010 _____ C:\Users\ah010073\AppData\Local\sponge.last.runtime.cache
2018-06-08 22:03 - 2018-06-08 22:03 - 000000000 ____D C:\ProgramData\Trend Micro
2018-06-08 22:02 - 2018-06-08 22:02 - 000000000 ____D C:\Windows\Trend Micro
2018-06-08 22:00 - 2018-06-09 08:01 - 000000036 _____ C:\Users\ah010073\AppData\Local\housecall.guid.cache
2018-06-08 22:00 - 2017-10-17 09:40 - 000334488 _____ (Trend Micro Inc.) C:\Windows\system32\Drivers\tmcomm.sys
2018-06-08 21:59 - 2018-06-08 21:59 - 002527376 _____ (Trend Micro Inc.) C:\Users\ah010073\Downloads\HousecallLauncher64.exe
2018-06-08 21:50 - 2018-06-08 21:50 - 000313560 _____ (Mozilla) C:\Users\ah010073\Downloads\Firefox Installer.exe
2018-06-08 21:44 - 2018-06-08 21:44 - 001419864 _____ (Juniper Networks, Inc.) C:\Users\ah010073\Downloads\JuniperSetupClientInstaller.exe
2018-06-08 21:42 - 2016-07-22 07:58 - 000142336 _____ (Microsoft Corporation) C:\Windows\system32\poqexec.exe
2018-06-08 21:42 - 2016-07-22 07:51 - 000123904 _____ (Microsoft Corporation) C:\Windows\SysWOW64\poqexec.exe
2018-06-08 21:38 - 2018-06-09 17:52 - 000003918 _____ C:\Windows\System32\Tasks\User_Feed_Synchronization-{0B2000A5-2D6C-4F6E-97A4-1D8F87BD032F}
2018-06-08 20:54 - 2018-06-08 20:55 - 000000000 ____D C:\Users\ah010073\Downloads\TeamViewerMSI
2018-06-08 20:16 - 2018-06-08 20:20 - 031130880 _____ C:\Users\ah010073\Downloads\TeamViewerMSI.zip
2018-06-08 20:09 - 2018-06-08 20:09 - 000000000 ____D C:\Users\ah010073\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Lenovo
2018-06-08 20:08 - 2018-06-08 20:08 - 002721640 _____ (Lenovo ) C:\Users\ah010073\Downloads\LSBSetup.exe
2018-06-08 19:23 - 2018-06-09 14:15 - 000000000 ____D C:\Users\ah010073\Documents\Kyocera Support
2018-06-08 19:15 - 2018-06-08 19:15 - 000000000 ____D C:\Users\ah010073\AppData\Roaming\Sun
2018-06-08 19:13 - 2018-06-08 19:13 - 000111048 _____ (Oracle Corporation) C:\Windows\system32\WindowsAccessBridge-64.dll
2018-06-08 19:13 - 2018-06-08 19:13 - 000000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Java
2018-06-08 19:12 - 2018-06-08 19:12 - 000000000 ____D C:\Program Files\Java
2018-06-08 19:06 - 2018-06-08 19:09 - 071830472 _____ (Oracle Corporation) C:\Users\ah010073\Downloads\jre-8u171-windows-x64.exe
2018-06-08 17:29 - 2018-06-08 17:29 - 000000000 ____D C:\Users\ah010073\AppData\Roaming\SUPERAntiSpyware.com
2018-06-08 17:29 - 2018-05-11 14:19 - 000977408 _____ (Microsoft Corporation) C:\Windows\system32\inetcomm.dll
2018-06-08 17:29 - 2018-05-11 14:19 - 000109568 _____ (Microsoft Corporation) C:\Windows\system32\hlink.dll
2018-06-08 17:29 - 2018-05-11 14:19 - 000084480 _____ (Microsoft Corporation) C:\Windows\system32\INETRES.dll
2018-06-08 17:29 - 2018-05-10 17:40 - 000741888 _____ (Microsoft Corporation) C:\Windows\SysWOW64\inetcomm.dll
2018-06-08 17:29 - 2018-05-10 17:40 - 000084480 _____ (Microsoft Corporation) C:\Windows\SysWOW64\INETRES.dll
2018-06-08 17:29 - 2018-05-10 17:39 - 000084992 _____ (Microsoft Corporation) C:\Windows\SysWOW64\hlink.dll
2018-06-08 17:29 - 2018-04-23 11:57 - 000396960 _____ (Microsoft Corporation) C:\Windows\system32\iedkcs32.dll
2018-06-08 17:29 - 2018-04-23 11:02 - 000348832 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iedkcs32.dll
2018-06-08 17:29 - 2018-04-22 17:35 - 005583552 _____ (Microsoft Corporation) C:\Windows\system32\ntoskrnl.exe
2018-06-08 17:29 - 2018-04-22 17:35 - 000708288 _____ (Microsoft Corporation) C:\Windows\system32\winload.efi
2018-06-08 17:29 - 2018-04-22 17:35 - 000262336 _____ (Microsoft Corporation) C:\Windows\system32\hal.dll
2018-06-08 17:29 - 2018-04-22 17:35 - 000154816 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\ksecpkg.sys
2018-06-08 17:29 - 2018-04-22 17:35 - 000095424 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\ksecdd.sys
2018-06-08 17:29 - 2018-04-22 17:12 - 004047040 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ntkrnlpa.exe
2018-06-08 17:29 - 2018-04-22 17:12 - 003958464 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ntoskrnl.exe
2018-06-08 17:29 - 2018-04-22 17:10 - 000631640 _____ (Microsoft Corporation) C:\Windows\system32\winresume.efi
2018-06-08 17:29 - 2018-04-22 17:07 - 001665336 _____ (Microsoft Corporation) C:\Windows\system32\ntdll.dll
2018-06-08 17:29 - 2018-04-22 17:00 - 002066432 _____ (Microsoft Corporation) C:\Windows\system32\ole32.dll
2018-06-08 17:29 - 2018-04-22 17:00 - 001461248 _____ (Microsoft Corporation) C:\Windows\system32\lsasrv.dll
2018-06-08 17:29 - 2018-04-22 17:00 - 001212928 _____ (Microsoft Corporation) C:\Windows\system32\rpcrt4.dll
2018-06-08 17:29 - 2018-04-22 17:00 - 001163264 _____ (Microsoft Corporation) C:\Windows\system32\kernel32.dll
2018-06-08 17:29 - 2018-04-22 17:00 - 000880640 _____ (Microsoft Corporation) C:\Windows\system32\advapi32.dll
2018-06-08 17:29 - 2018-04-22 17:00 - 000876032 _____ (Microsoft Corporation) C:\Windows\system32\oleaut32.dll
2018-06-08 17:29 - 2018-04-22 17:00 - 000731648 _____ (Microsoft Corporation) C:\Windows\system32\kerberos.dll
2018-06-08 17:29 - 2018-04-22 17:00 - 000690688 _____ (Microsoft Corporation) C:\Windows\system32\adtschema.dll
2018-06-08 17:29 - 2018-04-22 17:00 - 000512512 _____ (Microsoft Corporation) C:\Windows\system32\rpcss.dll
2018-06-08 17:29 - 2018-04-22 17:00 - 000503808 _____ (Microsoft Corporation) C:\Windows\system32\srcore.dll
2018-06-08 17:29 - 2018-04-22 17:00 - 000463872 _____ (Microsoft Corporation) C:\Windows\system32\certcli.dll
2018-06-08 17:29 - 2018-04-22 17:00 - 000419840 _____ (Microsoft Corporation) C:\Windows\system32\KernelBase.dll
2018-06-08 17:29 - 2018-04-22 17:00 - 000361984 _____ (Microsoft Corporation) C:\Windows\system32\wow64win.dll
2018-06-08 17:29 - 2018-04-22 17:00 - 000345600 _____ (Microsoft Corporation) C:\Windows\system32\schannel.dll
2018-06-08 17:29 - 2018-04-22 17:00 - 000316928 _____ (Microsoft Corporation) C:\Windows\system32\msv1_0.dll
2018-06-08 17:29 - 2018-04-22 17:00 - 000312320 _____ (Microsoft Corporation) C:\Windows\system32\ncrypt.dll
2018-06-08 17:29 - 2018-04-22 17:00 - 000243712 _____ (Microsoft Corporation) C:\Windows\system32\wow64.dll
2018-06-08 17:29 - 2018-04-22 17:00 - 000215552 _____ (Microsoft Corporation) C:\Windows\system32\winsrv.dll
2018-06-08 17:29 - 2018-04-22 17:00 - 000210432 _____ (Microsoft Corporation) C:\Windows\system32\wdigest.dll
2018-06-08 17:29 - 2018-04-22 17:00 - 000190464 _____ (Microsoft Corporation) C:\Windows\system32\rpchttp.dll
2018-06-08 17:29 - 2018-04-22 17:00 - 000146432 _____ (Microsoft Corporation) C:\Windows\system32\msaudite.dll
2018-06-08 17:29 - 2018-04-22 17:00 - 000135680 _____ (Microsoft Corporation) C:\Windows\system32\sspicli.dll
2018-06-08 17:29 - 2018-04-22 17:00 - 000123904 _____ (Microsoft Corporation) C:\Windows\system32\bcrypt.dll
2018-06-08 17:29 - 2018-04-22 17:00 - 000094208 _____ (Microsoft Corporation) C:\Windows\system32\TSpkg.dll
2018-06-08 17:29 - 2018-04-22 17:00 - 000063488 _____ (Microsoft Corporation) C:\Windows\system32\setbcdlocale.dll
2018-06-08 17:29 - 2018-04-22 17:00 - 000060416 _____ (Microsoft Corporation) C:\Windows\system32\msobjs.dll
2018-06-08 17:29 - 2018-04-22 17:00 - 000059904 _____ (Microsoft Corporation) C:\Windows\system32\appidapi.dll
2018-06-08 17:29 - 2018-04-22 17:00 - 000050176 _____ (Microsoft Corporation) C:\Windows\system32\srclient.dll
2018-06-08 17:29 - 2018-04-22 17:00 - 000044032 _____ (Microsoft Corporation) C:\Windows\system32\csrsrv.dll
2018-06-08 17:29 - 2018-04-22 17:00 - 000043520 _____ (Microsoft Corporation) C:\Windows\system32\cryptbase.dll
2018-06-08 17:29 - 2018-04-22 17:00 - 000034816 _____ (Microsoft Corporation) C:\Windows\system32\appidsvc.dll
2018-06-08 17:29 - 2018-04-22 17:00 - 000028672 _____ (Microsoft Corporation) C:\Windows\system32\sspisrv.dll
2018-06-08 17:29 - 2018-04-22 17:00 - 000028160 _____ (Microsoft Corporation) C:\Windows\system32\secur32.dll
2018-06-08 17:29 - 2018-04-22 17:00 - 000026112 _____ (Microsoft Corporation) C:\Windows\system32\oleres.dll
2018-06-08 17:29 - 2018-04-22 17:00 - 000022016 _____ (Microsoft Corporation) C:\Windows\system32\credssp.dll
2018-06-08 17:29 - 2018-04-22 17:00 - 000016384 _____ (Microsoft Corporation) C:\Windows\system32\ntvdm64.dll
2018-06-08 17:29 - 2018-04-22 17:00 - 000013312 _____ (Microsoft Corporation) C:\Windows\system32\wow64cpu.dll
2018-06-08 17:29 - 2018-04-22 17:00 - 000008704 _____ (Microsoft Corporation) C:\Windows\system32\comcat.dll
2018-06-08 17:29 - 2018-04-22 17:00 - 000007168 _____ (Microsoft Corporation) C:\Windows\system32\apisetschema.dll
2018-06-08 17:29 - 2018-04-22 17:00 - 000006144 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-security-base-l1-1-0.dll
2018-06-08 17:29 - 2018-04-22 17:00 - 000005120 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-file-l1-1-0.dll
2018-06-08 17:29 - 2018-04-22 17:00 - 000004608 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-threadpool-l1-1-0.dll
2018-06-08 17:29 - 2018-04-22 17:00 - 000004608 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-processthreads-l1-1-0.dll
2018-06-08 17:29 - 2018-04-22 17:00 - 000004096 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-sysinfo-l1-1-0.dll
2018-06-08 17:29 - 2018-04-22 17:00 - 000004096 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-synch-l1-1-0.dll
2018-06-08 17:29 - 2018-04-22 17:00 - 000004096 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-localregistry-l1-1-0.dll
2018-06-08 17:29 - 2018-04-22 17:00 - 000004096 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-localization-l1-1-0.dll
2018-06-08 17:29 - 2018-04-22 17:00 - 000003584 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-rtlsupport-l1-1-0.dll
2018-06-08 17:29 - 2018-04-22 17:00 - 000003584 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-processenvironment-l1-1-0.dll
2018-06-08 17:29 - 2018-04-22 17:00 - 000003584 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-namedpipe-l1-1-0.dll
2018-06-08 17:29 - 2018-04-22 17:00 - 000003584 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-misc-l1-1-0.dll
2018-06-08 17:29 - 2018-04-22 17:00 - 000003584 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-memory-l1-1-0.dll
2018-06-08 17:29 - 2018-04-22 17:00 - 000003584 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-libraryloader-l1-1-0.dll
2018-06-08 17:29 - 2018-04-22 17:00 - 000003584 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-heap-l1-1-0.dll
2018-06-08 17:29 - 2018-04-22 17:00 - 000003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-xstate-l1-1-0.dll
2018-06-08 17:29 - 2018-04-22 17:00 - 000003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-util-l1-1-0.dll
2018-06-08 17:29 - 2018-04-22 17:00 - 000003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-string-l1-1-0.dll
2018-06-08 17:29 - 2018-04-22 17:00 - 000003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-profile-l1-1-0.dll
2018-06-08 17:29 - 2018-04-22 17:00 - 000003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-io-l1-1-0.dll
2018-06-08 17:29 - 2018-04-22 17:00 - 000003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-interlocked-l1-1-0.dll
2018-06-08 17:29 - 2018-04-22 17:00 - 000003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-handle-l1-1-0.dll
2018-06-08 17:29 - 2018-04-22 17:00 - 000003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-fibers-l1-1-0.dll
2018-06-08 17:29 - 2018-04-22 17:00 - 000003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-errorhandling-l1-1-0.dll
2018-06-08 17:29 - 2018-04-22 17:00 - 000003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-delayload-l1-1-0.dll
2018-06-08 17:29 - 2018-04-22 17:00 - 000003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-debug-l1-1-0.dll
2018-06-08 17:29 - 2018-04-22 17:00 - 000003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-datetime-l1-1-0.dll
2018-06-08 17:29 - 2018-04-22 17:00 - 000003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-console-l1-1-0.dll
2018-06-08 17:29 - 2018-04-22 16:44 - 001314064 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ntdll.dll
2018-06-08 17:29 - 2018-04-22 16:41 - 001114112 _____ (Microsoft Corporation) C:\Windows\SysWOW64\kernel32.dll
2018-06-08 17:29 - 2018-04-22 16:41 - 000666112 _____ (Microsoft Corporation) C:\Windows\SysWOW64\rpcrt4.dll
2018-06-08 17:29 - 2018-04-22 16:41 - 000275456 _____ (Microsoft Corporation) C:\Windows\SysWOW64\KernelBase.dll
2018-06-08 17:29 - 2018-04-22 16:41 - 000172032 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wdigest.dll
2018-06-08 17:29 - 2018-04-22 16:41 - 000096768 _____ (Microsoft Corporation) C:\Windows\SysWOW64\sspicli.dll
2018-06-08 17:29 - 2018-04-22 16:41 - 000082944 _____ (Microsoft Corporation) C:\Windows\SysWOW64\bcrypt.dll
2018-06-08 17:29 - 2018-04-22 16:41 - 000070144 _____ (Microsoft Corporation) C:\Windows\SysWOW64\TSpkg.dll
2018-06-08 17:29 - 2018-04-22 16:41 - 000043008 _____ (Microsoft Corporation) C:\Windows\SysWOW64\srclient.dll
2018-06-08 17:29 - 2018-04-22 16:41 - 000005120 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wow32.dll
2018-06-08 17:29 - 2018-04-22 16:40 - 001417728 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ole32.dll
2018-06-08 17:29 - 2018-04-22 16:40 - 000690688 _____ (Microsoft Corporation) C:\Windows\SysWOW64\adtschema.dll
2018-06-08 17:29 - 2018-04-22 16:40 - 000644096 _____ (Microsoft Corporation) C:\Windows\SysWOW64\advapi32.dll
2018-06-08 17:29 - 2018-04-22 16:40 - 000582144 _____ (Microsoft Corporation) C:\Windows\SysWOW64\oleaut32.dll
2018-06-08 17:29 - 2018-04-22 16:40 - 000554496 _____ (Microsoft Corporation) C:\Windows\SysWOW64\kerberos.dll
2018-06-08 17:29 - 2018-04-22 16:40 - 000342528 _____ (Microsoft Corporation) C:\Windows\SysWOW64\certcli.dll
2018-06-08 17:29 - 2018-04-22 16:40 - 000261120 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msv1_0.dll
2018-06-08 17:29 - 2018-04-22 16:40 - 000254464 _____ (Microsoft Corporation) C:\Windows\SysWOW64\schannel.dll
2018-06-08 17:29 - 2018-04-22 16:40 - 000223232 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ncrypt.dll
2018-06-08 17:29 - 2018-04-22 16:40 - 000146432 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msaudite.dll
2018-06-08 17:29 - 2018-04-22 16:40 - 000141312 _____ (Microsoft Corporation) C:\Windows\SysWOW64\rpchttp.dll
2018-06-08 17:29 - 2018-04-22 16:40 - 000060416 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msobjs.dll
2018-06-08 17:29 - 2018-04-22 16:40 - 000050688 _____ (Microsoft Corporation) C:\Windows\SysWOW64\appidapi.dll
2018-06-08 17:29 - 2018-04-22 16:40 - 000026112 _____ (Microsoft Corporation) C:\Windows\SysWOW64\oleres.dll
2018-06-08 17:29 - 2018-04-22 16:40 - 000022016 _____ (Microsoft Corporation) C:\Windows\SysWOW64\secur32.dll
2018-06-08 17:29 - 2018-04-22 16:40 - 000017408 _____ (Microsoft Corporation) C:\Windows\SysWOW64\credssp.dll
2018-06-08 17:29 - 2018-04-22 16:40 - 000007168 _____ (Microsoft Corporation) C:\Windows\SysWOW64\apisetschema.dll
2018-06-08 17:29 - 2018-04-22 16:40 - 000005120 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-file-l1-1-0.dll
2018-06-08 17:29 - 2018-04-22 16:40 - 000004608 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-processthreads-l1-1-0.dll
2018-06-08 17:29 - 2018-04-22 16:40 - 000004096 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-sysinfo-l1-1-0.dll
2018-06-08 17:29 - 2018-04-22 16:40 - 000004096 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-synch-l1-1-0.dll
2018-06-08 17:29 - 2018-04-22 16:40 - 000004096 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-misc-l1-1-0.dll
2018-06-08 17:29 - 2018-04-22 16:40 - 000004096 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-localregistry-l1-1-0.dll
2018-06-08 17:29 - 2018-04-22 16:40 - 000004096 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-localization-l1-1-0.dll
2018-06-08 17:29 - 2018-04-22 16:40 - 000003584 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-processenvironment-l1-1-0.dll
2018-06-08 17:29 - 2018-04-22 16:40 - 000003584 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-namedpipe-l1-1-0.dll
2018-06-08 17:29 - 2018-04-22 16:40 - 000003584 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-memory-l1-1-0.dll
2018-06-08 17:29 - 2018-04-22 16:40 - 000003584 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-libraryloader-l1-1-0.dll
2018-06-08 17:29 - 2018-04-22 16:40 - 000003584 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-interlocked-l1-1-0.dll
2018-06-08 17:29 - 2018-04-22 16:40 - 000003584 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-heap-l1-1-0.dll
2018-06-08 17:29 - 2018-04-22 16:40 - 000003072 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-string-l1-1-0.dll
2018-06-08 17:29 - 2018-04-22 16:40 - 000003072 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-rtlsupport-l1-1-0.dll
2018-06-08 17:29 - 2018-04-22 16:40 - 000003072 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-profile-l1-1-0.dll
2018-06-08 17:29 - 2018-04-22 16:40 - 000003072 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-io-l1-1-0.dll
2018-06-08 17:29 - 2018-04-22 16:40 - 000003072 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-handle-l1-1-0.dll
2018-06-08 17:29 - 2018-04-22 16:40 - 000003072 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-fibers-l1-1-0.dll
2018-06-08 17:29 - 2018-04-22 16:40 - 000003072 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-errorhandling-l1-1-0.dll
2018-06-08 17:29 - 2018-04-22 16:40 - 000003072 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-delayload-l1-1-0.dll
2018-06-08 17:29 - 2018-04-22 16:40 - 000003072 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-debug-l1-1-0.dll
2018-06-08 17:29 - 2018-04-22 16:40 - 000003072 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-datetime-l1-1-0.dll
2018-06-08 17:29 - 2018-04-22 16:40 - 000003072 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-console-l1-1-0.dll
2018-06-08 17:29 - 2018-04-22 16:32 - 000148480 _____ (Microsoft Corporation) C:\Windows\system32\appidpolicyconverter.exe
2018-06-08 17:29 - 2018-04-22 16:32 - 000062464 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\appid.sys
2018-06-08 17:29 - 2018-04-22 16:32 - 000017920 _____ (Microsoft Corporation) C:\Windows\system32\appidcertstorecheck.exe
2018-06-08 17:29 - 2018-04-22 16:31 - 000064512 _____ (Microsoft Corporation) C:\Windows\system32\auditpol.exe
2018-06-08 17:29 - 2018-04-22 16:28 - 000338432 _____ (Microsoft Corporation) C:\Windows\system32\conhost.exe
2018-06-08 17:29 - 2018-04-22 16:28 - 000129536 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\videoprt.sys
2018-06-08 17:29 - 2018-04-22 16:27 - 000296960 _____ (Microsoft Corporation) C:\Windows\system32\rstrui.exe
2018-06-08 17:29 - 2018-04-22 16:25 - 000160256 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\mrxsmb.sys
2018-06-08 17:29 - 2018-04-22 16:24 - 000291328 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\mrxsmb10.sys
2018-06-08 17:29 - 2018-04-22 16:24 - 000129536 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\mrxsmb20.sys
2018-06-08 17:29 - 2018-04-22 16:24 - 000007168 _____ (Microsoft Corporation) C:\Windows\SysWOW64\comcat.dll
2018-06-08 17:29 - 2018-04-22 16:23 - 000112640 _____ (Microsoft Corporation) C:\Windows\system32\smss.exe
2018-06-08 17:29 - 2018-04-22 16:23 - 000030720 _____ (Microsoft Corporation) C:\Windows\system32\lsass.exe
2018-06-08 17:29 - 2018-04-22 16:22 - 000050688 _____ (Microsoft Corporation) C:\Windows\SysWOW64\auditpol.exe
2018-06-08 17:29 - 2018-04-22 16:19 - 000025600 _____ (Microsoft Corporation) C:\Windows\SysWOW64\setup16.exe
2018-06-08 17:29 - 2018-04-22 16:19 - 000014336 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ntvdm64.dll
2018-06-08 17:29 - 2018-04-22 16:19 - 000007680 _____ (Microsoft Corporation) C:\Windows\SysWOW64\instnm.exe
2018-06-08 17:29 - 2018-04-22 16:19 - 000002048 _____ (Microsoft Corporation) C:\Windows\SysWOW64\user.exe
2018-06-08 17:29 - 2018-04-22 16:18 - 000036352 _____ (Microsoft Corporation) C:\Windows\SysWOW64\cryptbase.dll
2018-06-08 17:29 - 2018-04-22 16:18 - 000006144 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-security-base-l1-1-0.dll
2018-06-08 17:29 - 2018-04-22 16:18 - 000004608 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-threadpool-l1-1-0.dll
2018-06-08 17:29 - 2018-04-22 16:18 - 000003584 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-xstate-l1-1-0.dll
2018-06-08 17:29 - 2018-04-22 16:18 - 000003072 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-util-l1-1-0.dll
2018-06-08 17:29 - 2018-04-22 01:04 - 025744896 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.dll
2018-06-08 17:29 - 2018-04-22 00:53 - 002724864 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.tlb
2018-06-08 17:29 - 2018-04-22 00:53 - 000004096 _____ (Microsoft Corporation) C:\Windows\system32\ieetwcollectorres.dll
2018-06-08 17:29 - 2018-04-22 00:40 - 002902016 _____ (Microsoft Corporation) C:\Windows\system32\iertutil.dll
2018-06-08 17:29 - 2018-04-22 00:39 - 000066560 _____ (Microsoft Corporation) C:\Windows\system32\iesetup.dll
2018-06-08 17:29 - 2018-04-22 00:38 - 000578048 _____ (Microsoft Corporation) C:\Windows\system32\vbscript.dll
2018-06-08 17:29 - 2018-04-22 00:38 - 000417280 _____ (Microsoft Corporation) C:\Windows\system32\html.iec
2018-06-08 17:29 - 2018-04-22 00:38 - 000048640 _____ (Microsoft Corporation) C:\Windows\system32\ieetwproxystub.dll
2018-06-08 17:29 - 2018-04-22 00:37 - 000088064 _____ (Microsoft Corporation) C:\Windows\system32\MshtmlDac.dll
2018-06-08 17:29 - 2018-04-22 00:32 - 005779456 _____ (Microsoft Corporation) C:\Windows\system32\jscript9.dll
2018-06-08 17:29 - 2018-04-22 00:31 - 000054784 _____ (Microsoft Corporation) C:\Windows\system32\jsproxy.dll
2018-06-08 17:29 - 2018-04-22 00:30 - 000034304 _____ (Microsoft Corporation) C:\Windows\system32\iernonce.dll
2018-06-08 17:29 - 2018-04-22 00:27 - 000615936 _____ (Microsoft Corporation) C:\Windows\system32\ieui.dll
2018-06-08 17:29 - 2018-04-22 00:26 - 000814080 _____ (Microsoft Corporation) C:\Windows\system32\jscript9diag.dll
2018-06-08 17:29 - 2018-04-22 00:26 - 000794624 _____ (Microsoft Corporation) C:\Windows\system32\jscript.dll
2018-06-08 17:29 - 2018-04-22 00:26 - 000144384 _____ (Microsoft Corporation) C:\Windows\system32\ieUnatt.exe
2018-06-08 17:29 - 2018-04-22 00:26 - 000116224 _____ (Microsoft Corporation) C:\Windows\system32\ieetwcollector.exe
2018-06-08 17:29 - 2018-04-22 00:24 - 020286464 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.dll
2018-06-08 17:29 - 2018-04-22 00:18 - 000969216 _____ (Microsoft Corporation) C:\Windows\system32\MsSpellCheckingFacility.exe
2018-06-08 17:29 - 2018-04-22 00:16 - 002724864 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.tlb
2018-06-08 17:29 - 2018-04-22 00:15 - 000489984 _____ (Microsoft Corporation) C:\Windows\system32\dxtmsft.dll
2018-06-08 17:29 - 2018-04-22 00:08 - 000087552 _____ (Microsoft Corporation) C:\Windows\system32\tdc.ocx
2018-06-08 17:29 - 2018-04-22 00:08 - 000077824 _____ (Microsoft Corporation) C:\Windows\system32\JavaScriptCollectionAgent.dll
2018-06-08 17:29 - 2018-04-22 00:07 - 000107520 _____ (Microsoft Corporation) C:\Windows\system32\inseng.dll
2018-06-08 17:29 - 2018-04-22 00:04 - 000499712 _____ (Microsoft Corporation) C:\Windows\SysWOW64\vbscript.dll
2018-06-08 17:29 - 2018-04-22 00:04 - 000199680 _____ (Microsoft Corporation) C:\Windows\system32\msrating.dll
2018-06-08 17:29 - 2018-04-22 00:04 - 000092160 _____ (Microsoft Corporation) C:\Windows\system32\mshtmled.dll
2018-06-08 17:29 - 2018-04-22 00:04 - 000062464 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iesetup.dll
2018-06-08 17:29 - 2018-04-22 00:03 - 000341504 _____ (Microsoft Corporation) C:\Windows\SysWOW64\html.iec
2018-06-08 17:29 - 2018-04-22 00:03 - 000047616 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieetwproxystub.dll
2018-06-08 17:29 - 2018-04-22 00:02 - 000315392 _____ (Microsoft Corporation) C:\Windows\system32\dxtrans.dll
2018-06-08 17:29 - 2018-04-22 00:02 - 000064000 _____ (Microsoft Corporation) C:\Windows\SysWOW64\MshtmlDac.dll
2018-06-08 17:29 - 2018-04-22 00:00 - 002295296 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iertutil.dll
2018-06-08 17:29 - 2018-04-22 00:00 - 000152064 _____ (Microsoft Corporation) C:\Windows\system32\occache.dll
2018-06-08 17:29 - 2018-04-21 23:57 - 000047104 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jsproxy.dll
2018-06-08 17:29 - 2018-04-21 23:56 - 000030720 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iernonce.dll
2018-06-08 17:29 - 2018-04-21 23:55 - 000476160 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieui.dll
2018-06-08 17:29 - 2018-04-21 23:54 - 000661504 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript.dll
2018-06-08 17:29 - 2018-04-21 23:53 - 000620032 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript9diag.dll
2018-06-08 17:29 - 2018-04-21 23:53 - 000115712 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieUnatt.exe
2018-06-08 17:29 - 2018-04-21 23:51 - 000262144 _____ (Microsoft Corporation) C:\Windows\system32\webcheck.dll
2018-06-08 17:29 - 2018-04-21 23:49 - 000809472 _____ (Microsoft Corporation) C:\Windows\system32\msfeeds.dll
2018-06-08 17:29 - 2018-04-21 23:49 - 000728064 _____ (Microsoft Corporation) C:\Windows\system32\ie4uinit.exe
2018-06-08 17:29 - 2018-04-21 23:48 - 015283200 _____ (Microsoft Corporation) C:\Windows\system32\ieframe.dll
2018-06-08 17:29 - 2018-04-21 23:46 - 002135552 _____ (Microsoft Corporation) C:\Windows\system32\inetcpl.cpl
2018-06-08 17:29 - 2018-04-21 23:46 - 001359360 _____ (Microsoft Corporation) C:\Windows\system32\mshtmlmedia.dll
2018-06-08 17:29 - 2018-04-21 23:45 - 000416256 _____ (Microsoft Corporation) C:\Windows\SysWOW64\dxtmsft.dll
2018-06-08 17:29 - 2018-04-21 23:40 - 000073216 _____ (Microsoft Corporation) C:\Windows\SysWOW64\tdc.ocx
2018-06-08 17:29 - 2018-04-21 23:40 - 000060416 _____ (Microsoft Corporation) C:\Windows\SysWOW64\JavaScriptCollectionAgent.dll
2018-06-08 17:29 - 2018-04-21 23:39 - 000091136 _____ (Microsoft Corporation) C:\Windows\SysWOW64\inseng.dll
2018-06-08 17:29 - 2018-04-21 23:37 - 000168960 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msrating.dll
2018-06-08 17:29 - 2018-04-21 23:37 - 000076288 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtmled.dll
2018-06-08 17:29 - 2018-04-21 23:35 - 000279040 _____ (Microsoft Corporation) C:\Windows\SysWOW64\dxtrans.dll
2018-06-08 17:29 - 2018-04-21 23:34 - 000130048 _____ (Microsoft Corporation) C:\Windows\SysWOW64\occache.dll
2018-06-08 17:29 - 2018-04-21 23:33 - 003241472 _____ (Microsoft Corporation) C:\Windows\system32\wininet.dll
2018-06-08 17:29 - 2018-04-21 23:31 - 004496896 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript9.dll
2018-06-08 17:29 - 2018-04-21 23:29 - 000230400 _____ (Microsoft Corporation) C:\Windows\SysWOW64\webcheck.dll
2018-06-08 17:29 - 2018-04-21 23:27 - 000696320 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msfeeds.dll
2018-06-08 17:29 - 2018-04-21 23:26 - 013679616 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieframe.dll
2018-06-08 17:29 - 2018-04-21 23:26 - 002059776 _____ (Microsoft Corporation) C:\Windows\SysWOW64\inetcpl.cpl
2018-06-08 17:29 - 2018-04-21 23:26 - 001155072 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtmlmedia.dll
2018-06-08 17:29 - 2018-04-21 23:22 - 001546240 _____ (Microsoft Corporation) C:\Windows\system32\urlmon.dll
2018-06-08 17:29 - 2018-04-21 23:11 - 000800768 _____ (Microsoft Corporation) C:\Windows\system32\ieapfltr.dll
2018-06-08 17:29 - 2018-04-21 23:08 - 002767872 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wininet.dll
2018-06-08 17:29 - 2018-04-21 23:04 - 001314304 _____ (Microsoft Corporation) C:\Windows\SysWOW64\urlmon.dll
2018-06-08 17:29 - 2018-04-21 23:03 - 000710144 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieapfltr.dll
2018-06-08 17:29 - 2018-04-18 09:03 - 000701952 _____ (Microsoft Corporation) C:\Windows\system32\hhctrl.ocx
2018-06-08 17:29 - 2018-04-18 09:03 - 000053248 _____ (Microsoft Corporation) C:\Windows\system32\hhsetup.dll
2018-06-08 17:29 - 2018-04-18 08:51 - 000523776 _____ (Microsoft Corporation) C:\Windows\SysWOW64\hhctrl.ocx
2018-06-08 17:29 - 2018-04-18 08:51 - 000043008 _____ (Microsoft Corporation) C:\Windows\SysWOW64\hhsetup.dll
2018-06-08 17:29 - 2018-04-18 08:41 - 000016896 _____ (Microsoft Corporation) C:\Windows\hh.exe
2018-06-08 17:29 - 2018-04-18 08:35 - 000015360 _____ (Microsoft Corporation) C:\Windows\SysWOW64\hh.exe
2018-06-08 17:29 - 2018-04-11 09:38 - 000194048 _____ (Microsoft Corporation) C:\Windows\system32\itircl.dll
2018-06-08 17:29 - 2018-04-11 09:38 - 000170496 _____ (Microsoft Corporation) C:\Windows\system32\itss.dll
2018-06-08 17:29 - 2018-04-11 09:36 - 000158720 _____ (Microsoft Corporation) C:\Windows\SysWOW64\itircl.dll
2018-06-08 17:29 - 2018-04-11 09:36 - 000142848 _____ (Microsoft Corporation) C:\Windows\SysWOW64\itss.dll
2018-06-08 17:29 - 2018-04-10 12:45 - 000634272 _____ (Microsoft Corporation) C:\Windows\system32\winload.exe
2018-06-08 17:29 - 2018-04-10 09:36 - 000236032 _____ (Microsoft Corporation) C:\Windows\system32\srvsvc.dll
2018-06-08 17:29 - 2018-04-10 09:36 - 000013312 _____ (Microsoft Corporation) C:\Windows\system32\sscore.dll
2018-06-08 17:29 - 2018-04-10 09:35 - 001735168 _____ (Microsoft Corporation) C:\Windows\system32\comsvcs.dll
2018-06-08 17:29 - 2018-04-10 09:34 - 000525824 _____ (Microsoft Corporation) C:\Windows\system32\catsrvut.dll
2018-06-08 17:29 - 2018-04-10 09:33 - 001241600 _____ (Microsoft Corporation) C:\Windows\SysWOW64\comsvcs.dll
2018-06-08 17:29 - 2018-04-10 09:32 - 000487936 _____ (Microsoft Corporation) C:\Windows\SysWOW64\catsrvut.dll
2018-06-08 17:29 - 2018-04-10 09:00 - 000009728 _____ (Microsoft Corporation) C:\Windows\SysWOW64\sscore.dll
2018-06-08 17:29 - 2018-04-10 08:54 - 003226112 _____ (Microsoft Corporation) C:\Windows\system32\win32k.sys
2018-06-08 17:29 - 2018-04-10 08:48 - 000464384 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\srv.sys
2018-06-08 17:29 - 2018-04-10 08:47 - 000406016 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\srv2.sys
2018-06-08 17:29 - 2018-04-10 08:47 - 000169984 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\srvnet.sys
2018-06-08 17:29 - 2018-04-07 09:41 - 000371392 _____ (Microsoft Corporation) C:\Windows\system32\clfs.sys
2018-06-08 17:29 - 2018-04-06 09:39 - 000002048 _____ (Microsoft Corporation) C:\Windows\system32\tzres.dll
2018-06-08 17:29 - 2018-04-06 09:38 - 000002048 _____ (Microsoft Corporation) C:\Windows\SysWOW64\tzres.dll
2018-06-08 17:29 - 2018-03-14 10:16 - 000174080 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wuwebv.dll
2018-06-08 17:29 - 2018-03-14 10:12 - 003165184 _____ (Microsoft Corporation) C:\Windows\system32\wucltux.dll
2018-06-08 17:29 - 2018-03-14 10:12 - 000192512 _____ (Microsoft Corporation) C:\Windows\system32\wuwebv.dll
2018-06-08 17:29 - 2018-03-14 10:12 - 000098816 _____ (Microsoft Corporation) C:\Windows\system32\wudriver.dll
2018-06-08 17:29 - 2018-03-14 10:07 - 000091136 _____ (Microsoft Corporation) C:\Windows\system32\WinSetupUI.dll
2018-06-08 17:29 - 2018-03-14 09:57 - 000573440 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wuapi.dll
2018-06-08 17:29 - 2018-03-14 09:57 - 000093696 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wudriver.dll
2018-06-08 17:29 - 2018-03-14 09:57 - 000035328 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wuapp.exe
2018-06-08 17:29 - 2018-03-14 09:57 - 000030208 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wups.dll
2018-06-08 17:29 - 2018-03-14 09:53 - 002651648 _____ (Microsoft Corporation) C:\Windows\system32\wuaueng.dll
2018-06-08 17:29 - 2018-03-14 09:53 - 000709120 _____ (Microsoft Corporation) C:\Windows\system32\wuapi.dll
2018-06-08 17:29 - 2018-03-14 09:52 - 000140288 _____ (Microsoft Corporation) C:\Windows\system32\wuauclt.exe
2018-06-08 17:29 - 2018-03-14 09:52 - 000037888 _____ (Microsoft Corporation) C:\Windows\system32\wups2.dll
2018-06-08 17:29 - 2018-03-14 09:52 - 000037888 _____ (Microsoft Corporation) C:\Windows\system32\wuapp.exe
2018-06-08 17:29 - 2018-03-14 09:52 - 000036864 _____ (Microsoft Corporation) C:\Windows\system32\wups.dll
2018-06-08 17:29 - 2018-03-14 09:52 - 000012288 _____ (Microsoft Corporation) C:\Windows\system32\wu.upgrade.ps.dll
2018-06-08 17:29 - 2018-03-10 10:11 - 000340480 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msexcl40.dll
2018-06-08 17:29 - 2018-03-09 11:18 - 000309440 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\atmfd.dll
2018-06-08 17:29 - 2018-03-09 11:12 - 000383680 _____ (Adobe Systems Incorporated) C:\Windows\system32\atmfd.dll
2018-06-08 17:29 - 2018-03-09 11:12 - 000111616 _____ (Microsoft Corporation) C:\Windows\SysWOW64\t2embed.dll
2018-06-08 17:29 - 2018-03-09 11:12 - 000071680 _____ (Microsoft Corporation) C:\Windows\SysWOW64\fontsub.dll
2018-06-08 17:29 - 2018-03-09 11:12 - 000025600 _____ (Microsoft Corporation) C:\Windows\SysWOW64\lpk.dll
2018-06-08 17:29 - 2018-03-09 11:11 - 000010240 _____ (Microsoft Corporation) C:\Windows\SysWOW64\dciman32.dll
2018-06-08 17:29 - 2018-03-09 11:07 - 000152064 _____ (Microsoft Corporation) C:\Windows\system32\t2embed.dll
2018-06-08 17:29 - 2018-03-09 11:07 - 000100864 _____ (Microsoft Corporation) C:\Windows\system32\fontsub.dll
2018-06-08 17:29 - 2018-03-09 11:07 - 000041472 _____ (Microsoft Corporation) C:\Windows\system32\lpk.dll
2018-06-08 17:29 - 2018-03-09 11:06 - 000046080 _____ (Adobe Systems) C:\Windows\system32\atmlib.dll
2018-06-08 17:29 - 2018-03-09 11:06 - 000014336 _____ (Microsoft Corporation) C:\Windows\system32\dciman32.dll
2018-06-08 17:29 - 2018-03-09 10:31 - 000034304 _____ (Adobe Systems) C:\Windows\SysWOW64\atmlib.dll
2018-06-08 17:29 - 2018-03-06 11:13 - 000148160 _____ (Microsoft Corporation) C:\Windows\SysWOW64\basecsp.dll
2018-06-08 17:29 - 2018-03-06 11:11 - 000184320 _____ (Microsoft Corporation) C:\Windows\SysWOW64\scksp.dll
2018-06-08 17:29 - 2018-03-06 11:11 - 000052224 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wsnmp32.dll
2018-06-08 17:29 - 2018-03-06 11:10 - 000170176 _____ (Microsoft Corporation) C:\Windows\system32\basecsp.dll
2018-06-08 17:29 - 2018-03-06 11:07 - 000229376 _____ (Microsoft Corporation) C:\Windows\system32\scksp.dll
2018-06-08 17:29 - 2018-03-06 11:07 - 000067072 _____ (Microsoft Corporation) C:\Windows\system32\wsnmp32.dll
2018-06-08 17:29 - 2018-02-21 20:28 - 000217600 _____ (Microsoft Corporation) C:\Windows\system32\WinSCard.dll
2018-06-08 17:29 - 2018-02-21 20:06 - 000134656 _____ (Microsoft Corporation) C:\Windows\SysWOW64\WinSCard.dll
2018-06-08 17:29 - 2018-02-10 11:35 - 000367296 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\msrpc.sys
2018-06-08 17:29 - 2018-02-10 11:35 - 000334528 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\acpi.sys
2018-06-08 17:29 - 2018-02-10 11:35 - 000185024 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\pci.sys
2018-06-08 17:29 - 2018-02-10 11:35 - 000122560 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\NV_AGP.SYS
2018-06-08 17:29 - 2018-02-10 11:35 - 000068288 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\volmgr.sys
2018-06-08 17:29 - 2018-02-10 11:35 - 000064192 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\ULIAGPKX.SYS
2018-06-08 17:29 - 2018-02-10 11:35 - 000063168 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\termdd.sys
2018-06-08 17:29 - 2018-02-10 11:35 - 000060608 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\AGP440.sys
2018-06-08 17:29 - 2018-02-10 11:35 - 000036032 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\vdrvroot.sys
2018-06-08 17:29 - 2018-02-10 11:35 - 000031936 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\mssmbios.sys
2018-06-08 17:29 - 2018-02-10 11:35 - 000023744 _____ (Microsoft Corporation) C:\Windows\system32\streamci.dll
2018-06-08 17:29 - 2018-02-10 11:35 - 000020160 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\isapnp.sys
2018-06-08 17:29 - 2018-02-10 11:35 - 000015040 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\msisadrv.sys
2018-06-08 17:29 - 2018-02-10 11:35 - 000012096 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\swenum.sys
2018-06-08 17:29 - 2018-02-10 11:23 - 002292224 _____ (Microsoft Corporation) C:\Windows\SysWOW64\MSVidCtl.dll
2018-06-08 17:29 - 2018-02-10 11:23 - 000330240 _____ (Microsoft Corporation) C:\Windows\SysWOW64\zipfldr.dll
2018-06-08 17:29 - 2018-02-10 11:23 - 000111616 _____ (Microsoft Corporation) C:\Windows\SysWOW64\racpldlg.dll
2018-06-08 17:29 - 2018-02-10 11:11 - 003665920 _____ (Microsoft Corporation) C:\Windows\system32\MSVidCtl.dll
2018-06-08 17:29 - 2018-02-10 11:11 - 000369664 _____ (Microsoft Corporation) C:\Windows\system32\zipfldr.dll
2018-06-08 17:29 - 2018-02-10 11:11 - 000133120 _____ (Microsoft Corporation) C:\Windows\system32\msrahc.dll
2018-06-08 17:29 - 2018-02-10 11:11 - 000119296 _____ (Microsoft Corporation) C:\Windows\system32\racpldlg.dll
2018-06-08 17:29 - 2018-02-10 10:36 - 000108032 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msra.exe
2018-06-08 17:29 - 2018-02-10 10:36 - 000040960 _____ (Microsoft Corporation) C:\Windows\SysWOW64\sdchange.exe
2018-06-08 17:29 - 2018-02-10 10:36 - 000007168 _____ (Microsoft Corporation) C:\Windows\SysWOW64\MsraLegacy.tlb
2018-06-08 17:29 - 2018-02-10 10:26 - 000653312 _____ (Microsoft Corporation) C:\Windows\system32\msra.exe
2018-06-08 17:29 - 2018-02-10 10:26 - 000051712 _____ (Microsoft Corporation) C:\Windows\system32\sdchange.exe
2018-06-08 17:29 - 2018-02-10 10:25 - 000014336 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\wmiacpi.sys
2018-06-08 17:29 - 2018-02-10 10:25 - 000009728 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\errdev.sys
2018-06-08 17:29 - 2018-02-10 10:25 - 000007168 _____ (Microsoft Corporation) C:\Windows\system32\MsraLegacy.tlb
2018-06-08 17:29 - 2018-02-02 11:40 - 000114368 _____ (Microsoft Corporation) C:\Windows\system32\consent.exe
2018-06-08 17:29 - 2018-02-02 11:29 - 002365952 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msi.dll
2018-06-08 17:29 - 2018-02-02 11:29 - 000337408 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msihnd.dll
2018-06-08 17:29 - 2018-02-02 11:29 - 000025088 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msimsg.dll
2018-06-08 17:29 - 2018-02-02 11:28 - 001806848 _____ (Microsoft Corporation) C:\Windows\SysWOW64\authui.dll
2018-06-08 17:29 - 2018-02-02 11:16 - 003246080 _____ (Microsoft Corporation) C:\Windows\system32\msi.dll
2018-06-08 17:29 - 2018-02-02 11:16 - 000504320 _____ (Microsoft Corporation) C:\Windows\system32\msihnd.dll
2018-06-08 17:29 - 2018-02-02 11:16 - 000025088 _____ (Microsoft Corporation) C:\Windows\system32\msimsg.dll
2018-06-08 17:29 - 2018-02-02 11:14 - 001942016 _____ (Microsoft Corporation) C:\Windows\system32\authui.dll
2018-06-08 17:29 - 2018-02-02 11:14 - 000070144 _____ (Microsoft Corporation) C:\Windows\system32\appinfo.dll
2018-06-08 17:29 - 2018-02-02 10:46 - 000073216 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msiexec.exe
2018-06-08 17:29 - 2018-02-02 10:36 - 000128512 _____ (Microsoft Corporation) C:\Windows\system32\msiexec.exe
2018-06-08 17:29 - 2018-01-25 07:05 - 000995272 _____ (Microsoft Corporation) C:\Windows\system32\ucrtbase.dll
2018-06-08 17:29 - 2018-01-25 07:05 - 000063832 _____ (Microsoft Corporation) C:\Windows\system32\api-ms-win-crt-private-l1-1-0.dll
2018-06-08 17:29 - 2018-01-25 07:05 - 000020824 _____ (Microsoft Corporation) C:\Windows\system32\api-ms-win-crt-math-l1-1-0.dll
2018-06-08 17:29 - 2018-01-25 07:05 - 000019800 _____ (Microsoft Corporation) C:\Windows\system32\api-ms-win-crt-multibyte-l1-1-0.dll
2018-06-08 17:29 - 2018-01-25 07:05 - 000017752 _____ (Microsoft Corporation) C:\Windows\system32\api-ms-win-crt-string-l1-1-0.dll
2018-06-08 17:29 - 2018-01-25 07:05 - 000017752 _____ (Microsoft Corporation) C:\Windows\system32\api-ms-win-crt-stdio-l1-1-0.dll
2018-06-08 17:29 - 2018-01-25 07:05 - 000016216 _____ (Microsoft Corporation) C:\Windows\system32\api-ms-win-crt-runtime-l1-1-0.dll
2018-06-08 17:29 - 2018-01-25 07:05 - 000015704 _____ (Microsoft Corporation) C:\Windows\system32\api-ms-win-crt-convert-l1-1-0.dll
2018-06-08 17:29 - 2018-01-25 07:05 - 000014168 _____ (Microsoft Corporation) C:\Windows\system32\api-ms-win-crt-time-l1-1-0.dll
2018-06-08 17:29 - 2018-01-25 07:05 - 000014168 _____ (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-localization-l1-2-0.dll
2018-06-08 17:29 - 2018-01-25 07:05 - 000013656 _____ (Microsoft Corporation) C:\Windows\system32\api-ms-win-crt-filesystem-l1-1-0.dll
2018-06-08 17:29 - 2018-01-25 07:05 - 000012632 _____ (Microsoft Corporation) C:\Windows\system32\api-ms-win-crt-process-l1-1-0.dll
2018-06-08 17:29 - 2018-01-25 07:05 - 000012632 _____ (Microsoft Corporation) C:\Windows\system32\api-ms-win-crt-heap-l1-1-0.dll
2018-06-08 17:29 - 2018-01-25 07:05 - 000012632 _____ (Microsoft Corporation) C:\Windows\system32\api-ms-win-crt-conio-l1-1-0.dll
2018-06-08 17:29 - 2018-01-25 07:05 - 000012120 _____ (Microsoft Corporation) C:\Windows\system32\api-ms-win-crt-utility-l1-1-0.dll
2018-06-08 17:29 - 2018-01-25 07:05 - 000012120 _____ (Microsoft Corporation) C:\Windows\system32\api-ms-win-crt-locale-l1-1-0.dll
2018-06-08 17:29 - 2018-01-25 07:05 - 000012120 _____ (Microsoft Corporation) C:\Windows\system32\api-ms-win-crt-environment-l1-1-0.dll
2018-06-08 17:29 - 2018-01-25 07:05 - 000012120 _____ (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-synch-l1-2-0.dll
2018-06-08 17:29 - 2018-01-25 07:05 - 000012120 _____ (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-processthreads-l1-1-1.dll
2018-06-08 17:29 - 2018-01-25 07:05 - 000011608 _____ (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-xstate-l2-1-0.dll
2018-06-08 17:29 - 2018-01-25 07:05 - 000011608 _____ (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-timezone-l1-1-0.dll
2018-06-08 17:29 - 2018-01-25 07:05 - 000011608 _____ (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-file-l2-1-0.dll
2018-06-08 17:29 - 2018-01-25 07:05 - 000011608 _____ (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-file-l1-2-0.dll
2018-06-08 17:29 - 2018-01-25 07:04 - 000922944 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ucrtbase.dll
2018-06-08 17:29 - 2018-01-25 07:04 - 000066392 _____ (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-crt-private-l1-1-0.dll
2018-06-08 17:29 - 2018-01-25 07:04 - 000022360 _____ (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-crt-math-l1-1-0.dll
2018-06-08 17:29 - 2018-01-25 07:04 - 000019800 _____ (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-crt-multibyte-l1-1-0.dll
2018-06-08 17:29 - 2018-01-25 07:04 - 000017752 _____ (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-crt-string-l1-1-0.dll
2018-06-08 17:29 - 2018-01-25 07:04 - 000017752 _____ (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-crt-stdio-l1-1-0.dll
2018-06-08 17:29 - 2018-01-25 07:04 - 000016216 _____ (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-crt-runtime-l1-1-0.dll
2018-06-08 17:29 - 2018-01-25 07:04 - 000015704 _____ (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-crt-convert-l1-1-0.dll
2018-06-08 17:29 - 2018-01-25 07:04 - 000014168 _____ (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-crt-time-l1-1-0.dll
2018-06-08 17:29 - 2018-01-25 07:04 - 000014168 _____ (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-localization-l1-2-0.dll
2018-06-08 17:29 - 2018-01-25 07:04 - 000013656 _____ (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-crt-filesystem-l1-1-0.dll
2018-06-08 17:29 - 2018-01-25 07:04 - 000012632 _____ (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-crt-process-l1-1-0.dll
2018-06-08 17:29 - 2018-01-25 07:04 - 000012632 _____ (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-crt-heap-l1-1-0.dll
2018-06-08 17:29 - 2018-01-25 07:04 - 000012632 _____ (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-crt-conio-l1-1-0.dll
2018-06-08 17:29 - 2018-01-25 07:04 - 000012120 _____ (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-crt-utility-l1-1-0.dll
2018-06-08 17:29 - 2018-01-25 07:04 - 000012120 _____ (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-crt-locale-l1-1-0.dll
2018-06-08 17:29 - 2018-01-25 07:04 - 000012120 _____ (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-crt-environment-l1-1-0.dll
2018-06-08 17:29 - 2018-01-25 07:04 - 000012120 _____ (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-synch-l1-2-0.dll
2018-06-08 17:29 - 2018-01-25 07:04 - 000012120 _____ (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-processthreads-l1-1-1.dll
2018-06-08 17:29 - 2018-01-25 07:04 - 000011608 _____ (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-xstate-l2-1-0.dll
2018-06-08 17:29 - 2018-01-25 07:04 - 000011608 _____ (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-timezone-l1-1-0.dll
2018-06-08 17:29 - 2018-01-25 07:04 - 000011608 _____ (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-file-l2-1-0.dll
2018-06-08 17:29 - 2018-01-25 07:04 - 000011608 _____ (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-file-l1-2-0.dll
2018-06-08 17:29 - 2018-01-12 09:44 - 001894120 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\tcpip.sys
2018-06-08 17:29 - 2018-01-12 09:44 - 000377064 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\netio.sys
2018-06-08 17:29 - 2018-01-12 09:44 - 000287976 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\FWPKCLNT.SYS
2018-06-08 17:29 - 2018-01-12 09:40 - 000484864 _____ (Microsoft Corporation) C:\Windows\system32\StructuredQuery.dll
2018-06-08 17:29 - 2018-01-12 09:40 - 000407040 _____ (Microsoft Corporation) C:\Windows\system32\scesrv.dll
2018-06-08 17:29 - 2018-01-12 09:27 - 004834816 _____ (Microsoft Corporation) C:\Windows\system32\xpsrchvw.exe
2018-06-08 17:29 - 2018-01-12 09:26 - 000363520 _____ (Microsoft Corporation) C:\Windows\SysWOW64\StructuredQuery.dll
2018-06-08 17:29 - 2018-01-12 09:26 - 000308224 _____ (Microsoft Corporation) C:\Windows\SysWOW64\scesrv.dll
2018-06-08 17:29 - 2018-01-12 09:16 - 003405824 _____ (Microsoft Corporation) C:\Windows\SysWOW64\xpsrchvw.exe
2018-06-08 17:29 - 2018-01-12 09:16 - 000076288 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\hidclass.sys
2018-06-08 17:29 - 2018-01-12 09:16 - 000030208 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\hidusb.sys
2018-06-08 17:29 - 2018-01-12 09:15 - 000032896 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\hidparse.sys
2018-06-08 17:29 - 2018-01-11 09:41 - 001133568 _____ (Microsoft Corporation) C:\Windows\system32\cdosys.dll
2018-06-08 17:29 - 2018-01-11 09:22 - 000805376 _____ (Microsoft Corporation) C:\Windows\SysWOW64\cdosys.dll
2018-06-08 17:29 - 2017-12-31 19:21 - 001680616 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\ntfs.sys
2018-06-08 17:29 - 2017-12-31 19:21 - 000948968 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\ndis.sys
2018-06-08 17:29 - 2017-12-31 19:21 - 000288488 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\fltMgr.sys
2018-06-08 17:29 - 2017-12-31 19:21 - 000213736 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\rdyboost.sys
2018-06-08 17:29 - 2017-12-31 19:18 - 014183936 _____ (Microsoft Corporation) C:\Windows\system32\shell32.dll
2018-06-08 17:29 - 2017-12-31 19:18 - 002004480 _____ (Microsoft Corporation) C:\Windows\system32\msxml6.dll
2018-06-08 17:29 - 2017-12-31 19:18 - 001867776 _____ (Microsoft Corporation) C:\Windows\system32\ExplorerFrame.dll
2018-06-08 17:29 - 2017-12-31 19:18 - 001741312 _____ (Microsoft Corporation) C:\Windows\system32\sysmain.dll
2018-06-08 17:29 - 2017-12-31 19:18 - 001361408 _____ (Microsoft Corporation) C:\Windows\system32\PeerDistSvc.dll
2018-06-08 17:29 - 2017-12-31 19:18 - 001110528 _____ (Microsoft Corporation) C:\Windows\system32\schedsvc.dll
2018-06-08 17:29 - 2017-12-31 19:18 - 000961024 _____ (Microsoft Corporation) C:\Windows\system32\actxprxy.dll
2018-06-08 17:29 - 2017-12-31 19:18 - 000863232 _____ (Microsoft Corporation) C:\Windows\system32\IKEEXT.DLL
2018-06-08 17:29 - 2017-12-31 19:18 - 000842752 _____ (Microsoft Corporation) C:\Windows\system32\nshwfp.dll
2018-06-08 17:29 - 2017-12-31 19:18 - 000828928 _____ (Microsoft Corporation) C:\Windows\system32\MPSSVC.dll
2018-06-08 17:29 - 2017-12-31 19:18 - 000749568 _____ (Microsoft Corporation) C:\Windows\system32\FirewallAPI.dll
2018-06-08 17:29 - 2017-12-31 19:18 - 000705024 _____ (Microsoft Corporation) C:\Windows\system32\BFE.DLL
2018-06-08 17:29 - 2017-12-31 19:18 - 000473600 _____ (Microsoft Corporation) C:\Windows\system32\taskcomp.dll
2018-06-08 17:29 - 2017-12-31 19:18 - 000444928 _____ (Microsoft Corporation) C:\Windows\system32\winhttp.dll
2018-06-08 17:29 - 2017-12-31 19:18 - 000439296 _____ (Microsoft Corporation) C:\Windows\system32\p2psvc.dll
2018-06-08 17:29 - 2017-12-31 19:18 - 000366592 _____ (Microsoft Corporation) C:\Windows\system32\wcncsvc.dll
2018-06-08 17:29 - 2017-12-31 19:18 - 000327168 _____ (Microsoft Corporation) C:\Windows\system32\pnrpsvc.dll
2018-06-08 17:29 - 2017-12-31 19:18 - 000324096 _____ (Microsoft Corporation) C:\Windows\system32\FWPUCLNT.DLL
2018-06-08 17:29 - 2017-12-31 19:18 - 000303104 _____ (Microsoft Corporation) C:\Windows\system32\nlasvc.dll
2018-06-08 17:29 - 2017-12-31 19:18 - 000264704 _____ (Microsoft Corporation) C:\Windows\system32\P2P.dll
2018-06-08 17:29 - 2017-12-31 19:18 - 000223232 _____ (Microsoft Corporation) C:\Windows\system32\ncsi.dll
2018-06-08 17:29 - 2017-12-31 19:18 - 000181760 _____ (Microsoft Corporation) C:\Windows\system32\PeerDist.dll
2018-06-08 17:29 - 2017-12-31 19:18 - 000131584 _____ (Microsoft Corporation) C:\Windows\system32\PeerDistWSDDiscoProv.dll
2018-06-08 17:29 - 2017-12-31 19:18 - 000120320 _____ (Microsoft Corporation) C:\Windows\system32\WcnApi.dll
2018-06-08 17:29 - 2017-12-31 19:18 - 000108544 _____ (Microsoft Corporation) C:\Windows\system32\icfupgd.dll
2018-06-08 17:29 - 2017-12-31 19:18 - 000101376 _____ (Microsoft Corporation) C:\Windows\system32\fdWCN.dll
2018-06-08 17:29 - 2017-12-31 19:18 - 000095744 _____ (Microsoft Corporation) C:\Windows\system32\rascfg.dll
2018-06-08 17:29 - 2017-12-31 19:18 - 000076288 _____ (Microsoft Corporation) C:\Windows\system32\rasdiag.dll
2018-06-08 17:29 - 2017-12-31 19:18 - 000070656 _____ (Microsoft Corporation) C:\Windows\system32\nlaapi.dll
2018-06-08 17:29 - 2017-12-31 19:18 - 000060928 _____ (Microsoft Corporation) C:\Windows\system32\ndptsp.tsp
2018-06-08 17:29 - 2017-12-31 19:18 - 000053760 _____ (Microsoft Corporation) C:\Windows\system32\vmicres.dll
2018-06-08 17:29 - 2017-12-31 19:18 - 000051200 _____ (Microsoft Corporation) C:\Windows\system32\PeerDistHttpTrans.dll
2018-06-08 17:29 - 2017-12-31 19:18 - 000047104 _____ (Microsoft Corporation) C:\Windows\system32\kmddsp.tsp
2018-06-08 17:29 - 2017-12-31 19:18 - 000041472 _____ (Microsoft Corporation) C:\Windows\system32\rasmxs.dll
2018-06-08 17:29 - 2017-12-31 19:18 - 000039424 _____ (Microsoft Corporation) C:\Windows\system32\traffic.dll
2018-06-08 17:29 - 2017-12-31 19:18 - 000029696 _____ (Microsoft Corporation) C:\Windows\system32\rasser.dll
2018-06-08 17:29 - 2017-12-31 19:18 - 000024576 _____ (Microsoft Corporation) C:\Windows\system32\WcnEapPeerProxy.dll
2018-06-08 17:29 - 2017-12-31 19:18 - 000024064 _____ (Microsoft Corporation) C:\Windows\system32\WcnEapAuthProxy.dll
2018-06-08 17:29 - 2017-12-31 19:18 - 000022528 _____ (Microsoft Corporation) C:\Windows\system32\wfapigp.dll
2018-06-08 17:29 - 2017-12-31 19:18 - 000016896 _____ (Microsoft Corporation) C:\Windows\system32\wshqos.dll
2018-06-08 17:29 - 2017-12-31 19:18 - 000013312 _____ (Microsoft Corporation) C:\Windows\system32\wshnetbs.dll
2018-06-08 17:29 - 2017-12-31 19:18 - 000002048 _____ (Microsoft Corporation) C:\Windows\system32\msxml6r.dll
2018-06-08 17:29 - 2017-12-31 19:04 - 000559616 _____ (Microsoft Corporation) C:\Windows\system32\spoolsv.exe
2018-06-08 17:29 - 2017-12-31 19:00 - 012880384 _____ (Microsoft Corporation) C:\Windows\SysWOW64\shell32.dll
2018-06-08 17:29 - 2017-12-31 19:00 - 001499648 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ExplorerFrame.dll
2018-06-08 17:29 - 2017-12-31 19:00 - 001390080 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msxml6.dll
2018-06-08 17:29 - 2017-12-31 19:00 - 000666624 _____ (Microsoft Corporation) C:\Windows\SysWOW64\nshwfp.dll
2018-06-08 17:29 - 2017-12-31 19:00 - 000463360 _____ (Microsoft Corporation) C:\Windows\SysWOW64\FirewallAPI.dll
2018-06-08 17:29 - 2017-12-31 19:00 - 000351744 _____ (Microsoft Corporation) C:\Windows\SysWOW64\winhttp.dll
2018-06-08 17:29 - 2017-12-31 19:00 - 000304640 _____ (Microsoft Corporation) C:\Windows\SysWOW64\taskcomp.dll
2018-06-08 17:29 - 2017-12-31 19:00 - 000276992 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wcncsvc.dll
2018-06-08 17:29 - 2017-12-31 19:00 - 000217600 _____ (Microsoft Corporation) C:\Windows\SysWOW64\P2P.dll
2018-06-08 17:29 - 2017-12-31 19:00 - 000216576 _____ (Microsoft Corporation) C:\Windows\SysWOW64\FWPUCLNT.DLL
2018-06-08 17:29 - 2017-12-31 19:00 - 000162304 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ncsi.dll
2018-06-08 17:29 - 2017-12-31 19:00 - 000139776 _____ (Microsoft Corporation) C:\Windows\SysWOW64\PeerDist.dll
2018-06-08 17:29 - 2017-12-31 19:00 - 000081920 _____ (Microsoft Corporation) C:\Windows\SysWOW64\fdWCN.dll
2018-06-08 17:29 - 2017-12-31 19:00 - 000081408 _____ (Microsoft Corporation) C:\Windows\SysWOW64\rascfg.dll
2018-06-08 17:29 - 2017-12-31 19:00 - 000061952 _____ (Microsoft Corporation) C:\Windows\SysWOW64\rasdiag.dll
2018-06-08 17:29 - 2017-12-31 19:00 - 000052224 _____ (Microsoft Corporation) C:\Windows\SysWOW64\nlaapi.dll
2018-06-08 17:29 - 2017-12-31 19:00 - 000050688 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ndptsp.tsp
2018-06-08 17:29 - 2017-12-31 19:00 - 000033280 _____ (Microsoft Corporation) C:\Windows\SysWOW64\traffic.dll
2018-06-08 17:29 - 2017-12-31 19:00 - 000002048 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msxml6r.dll
2018-06-08 17:29 - 2017-12-31 18:59 - 000309760 _____ (Microsoft Corporation) C:\Windows\SysWOW64\actxprxy.dll
2018-06-08 17:29 - 2017-12-31 18:55 - 000131584 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\pacer.sys
2018-06-08 17:29 - 2017-12-31 18:55 - 000088576 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\wanarp.sys
2018-06-08 17:29 - 2017-12-31 18:55 - 000058368 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\ndproxy.sys
2018-06-08 17:29 - 2017-12-31 18:55 - 000045056 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\netbios.sys
2018-06-08 17:29 - 2017-12-31 18:55 - 000024064 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\ndistapi.sys
2018-06-08 17:29 - 2017-12-31 18:54 - 000077312 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\mpsdrv.sys
2018-06-08 17:29 - 2017-12-31 18:50 - 000455680 _____ (Microsoft Corporation) C:\Windows\system32\winlogon.exe
2018-06-08 17:29 - 2017-12-31 18:47 - 000244224 _____ (Microsoft Corporation) C:\Windows\system32\vmicsvc.exe
2018-06-08 17:29 - 2017-12-31 18:46 - 000128512 _____ (Microsoft Corporation) C:\Windows\system32\IcCoinstall.dll
2018-06-08 17:29 - 2017-12-31 18:43 - 000086528 _____ (Microsoft Corporation) C:\Windows\SysWOW64\WcnApi.dll
2018-06-08 17:29 - 2017-12-31 18:43 - 000038912 _____ (Microsoft Corporation) C:\Windows\SysWOW64\kmddsp.tsp
2018-06-08 17:29 - 2017-12-31 18:43 - 000033280 _____ (Microsoft Corporation) C:\Windows\SysWOW64\rasmxs.dll
2018-06-08 17:29 - 2017-12-31 18:43 - 000022528 _____ (Microsoft Corporation) C:\Windows\SysWOW64\rasser.dll
2018-06-08 17:29 - 2017-12-31 18:43 - 000020480 _____ (Microsoft Corporation) C:\Windows\SysWOW64\WcnEapPeerProxy.dll
2018-06-08 17:29 - 2017-12-31 18:43 - 000019968 _____ (Microsoft Corporation) C:\Windows\SysWOW64\WcnEapAuthProxy.dll
2018-06-08 17:29 - 2017-12-31 18:43 - 000018944 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wfapigp.dll
2018-06-08 17:29 - 2017-12-31 18:43 - 000013824 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wshqos.dll
2018-06-08 17:29 - 2017-12-31 18:41 - 000754176 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\http.sys
2018-06-08 17:29 - 2017-12-31 18:41 - 000106496 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\dfsc.sys
2018-06-08 17:29 - 2017-12-05 10:36 - 001484288 _____ (Microsoft Corporation) C:\Windows\system32\crypt32.dll
2018-06-08 17:29 - 2017-12-05 10:36 - 000625664 _____ (Microsoft Corporation) C:\Windows\system32\mscms.dll
2018-06-08 17:29 - 2017-12-05 10:36 - 000250880 _____ (Microsoft Corporation) C:\Windows\system32\icm32.dll
2018-06-08 17:29 - 2017-12-05 10:36 - 000229376 _____ (Microsoft Corporation) C:\Windows\system32\wintrust.dll
2018-06-08 17:29 - 2017-12-05 10:36 - 000190976 _____ (Microsoft Corporation) C:\Windows\system32\cryptsvc.dll
2018-06-08 17:29 - 2017-12-05 10:36 - 000141824 _____ (Microsoft Corporation) C:\Windows\system32\cryptnet.dll
2018-06-08 17:29 - 2017-12-05 10:36 - 000092160 _____ (Microsoft Corporation) C:\Windows\system32\TabSvc.dll
2018-06-08 17:29 - 2017-12-05 10:36 - 000040960 _____ (Microsoft Corporation) C:\Windows\system32\WcsPlugInService.dll
2018-06-08 17:29 - 2017-12-05 10:08 - 001176576 _____ (Microsoft Corporation) C:\Windows\SysWOW64\crypt32.dll
2018-06-08 17:29 - 2017-12-05 10:08 - 000481792 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mscms.dll
2018-06-08 17:29 - 2017-12-05 10:08 - 000215040 _____ (Microsoft Corporation) C:\Windows\SysWOW64\icm32.dll
2018-06-08 17:29 - 2017-12-05 10:08 - 000179200 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wintrust.dll
2018-06-08 17:29 - 2017-12-05 10:08 - 000145920 _____ (Microsoft Corporation) C:\Windows\SysWOW64\cryptsvc.dll
2018-06-08 17:29 - 2017-12-05 10:08 - 000106496 _____ (Microsoft Corporation) C:\Windows\SysWOW64\cryptnet.dll
2018-06-08 17:29 - 2017-12-05 09:04 - 000404992 _____ (Microsoft Corporation) C:\Windows\system32\wisptis.exe
2018-06-08 17:29 - 2017-12-05 08:49 - 000032768 _____ (Microsoft Corporation) C:\Windows\SysWOW64\WcsPlugInService.dll
2018-06-08 17:28 - 2018-06-08 17:49 - 000000000 ____D C:\Program Files\SUPERAntiSpyware
2018-06-08 17:28 - 2018-06-08 17:28 - 000001819 _____ C:\Users\Public\Desktop\SUPERAntiSpyware Free Edition.lnk
2018-06-08 17:28 - 2018-06-08 17:28 - 000000000 ____D C:\ProgramData\SUPERAntiSpyware.com
2018-06-08 17:28 - 2018-06-08 17:28 - 000000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\SUPERAntiSpyware
2018-06-08 17:21 - 2018-06-08 17:23 - 000000000 ____D C:\AdwCleaner
2018-06-08 17:15 - 2016-05-12 08:18 - 000090624 _____ (Microsoft Corporation) C:\Windows\SysWOW64\olepro32.dll
2018-06-08 16:28 - 2018-06-08 16:28 - 000300984 _____ (LogMeIn, Inc.) C:\Users\ah010073\Downloads\GoToMeeting Opener.exe
2018-06-08 16:05 - 2018-06-08 16:06 - 012205752 _____ (TeamViewer) C:\Users\ah010073\Downloads\TeamViewerQS.exe
2018-06-08 16:05 - 2018-06-08 16:06 - 000000000 ____D C:\Users\ah010073\AppData\Roaming\TeamViewer
2018-06-07 13:54 - 2018-06-09 16:42 - 000000000 ____D C:\Users\ah010073\AppData\Local\linear-26
2018-06-07 12:40 - 2018-06-07 12:40 - 005776384 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerInstaller.exe
2018-06-06 12:16 - 2018-06-06 12:16 - 000076349 _____ C:\Users\ah010073\Desktop\Mountain View Tosa signed d and a.pdf
2018-06-06 09:29 - 2018-06-06 09:29 - 000011907 _____ C:\Users\ah010073\Downloads\RFP1718-04IT_Copier_EquipmentSpecificationsResponseTemplate.xlsx
2018-06-04 09:32 - 2018-06-04 09:32 - 000000000 ____D C:\Users\ah010073\AppData\Roaming\smkits
2018-05-31 14:33 - 2018-05-31 14:33 - 000174736 _____ C:\Users\ah010073\Desktop\Mountain View Madrid Tosa units d and a.pdf
2018-05-31 10:11 - 2018-05-31 12:50 - 000458810 _____ C:\Users\ah010073\Desktop\Mock Trial - Mock Trial - Lease Proposal Longm 5-31-2018.docm
2018-05-30 15:17 - 2018-06-01 12:36 - 000012720 _____ C:\Users\ah010073\Desktop\Irvine USD Kyocera Proposed Equipment.xlsx
2018-05-29 11:21 - 2018-05-29 11:21 - 000040255 _____ C:\Users\ah010073\Desktop\AHMC Whittier for Rob V.xlsx
2018-05-29 10:04 - 2018-05-29 10:04 - 000983917 _____ C:\Users\ah010073\Desktop\2018 Summer Tech Show - IE.pdf
2018-05-29 10:02 - 2018-05-29 10:02 - 000984147 _____ C:\Users\ah010073\Desktop\2018 Summer Tech Show - Irvine.pdf
2018-05-25 09:29 - 2018-05-25 09:29 - 000098209 _____ C:\Users\ah010073\Downloads\DS11_Complete.pdf
2018-05-25 09:19 - 2018-05-25 09:19 - 000086201 _____ C:\Users\ah010073\Downloads\DS82_Complete.pdf
2018-05-25 09:19 - 2018-05-25 09:19 - 000086201 _____ C:\Users\ah010073\Downloads\DS82_Complete (1).pdf
2018-05-25 08:27 - 2018-05-25 08:27 - 000458236 _____ C:\Users\ah010073\Desktop\Mock Trial - Mock Trial - Lease Proposal Longm 5-25-2018.docm
2018-05-24 15:59 - 2018-05-24 15:59 - 003183785 _____ C:\Users\ah010073\Desktop\Mountain View Madrid Middle School closing package.pdf
2018-05-24 15:49 - 2018-05-24 15:49 - 003183785 _____ C:\Users\ah010073\Documents\Mountain View Madrid Elementary.pdf
2018-05-24 14:44 - 2018-05-24 15:55 - 000806009 _____ C:\Users\ah010073\Desktop\MOUNTAIN VIEW SCHOOL DISTRICT - Madrid MiddleSchool - Closing Sales Order Packet - Sherpa 4 - April 1st FY19 5-24-2018.xlsx
2018-05-24 12:03 - 2018-05-24 12:03 - 000458889 _____ C:\Users\ah010073\Desktop\PACIFIC ADVISORS - Pacific Advisors Refresh Option 2 - Lease Proposal Longm 5-24-2018.docm
2018-05-22 10:39 - 2018-05-22 10:39 - 000159058 _____ C:\Users\ah010073\Desktop\1bpFLJnXpU6KWRKh5RUqX97It-dpqQTb7.htm
2018-05-22 09:57 - 2018-05-22 09:57 - 000677315 _____ C:\Users\ah010073\Downloads\ECOSYS_P6130cdn_specs_2015_FNL.pdf
2018-05-18 12:25 - 2018-05-18 12:25 - 000204467 _____ C:\Users\ah010073\Desktop\Mountain View Madrid Middle School Lease doc.pdf
2018-05-17 16:57 - 2018-05-23 09:40 - 000014542 _____ C:\Users\ah010073\Desktop\SJUSD- units.xlsx
2018-05-17 15:14 - 2018-05-17 15:14 - 000272597 _____ C:\Users\ah010073\Desktop\Mountain View Transportation Copier signed d and a.pdf
2018-05-17 13:12 - 2018-05-17 13:12 - 010317494 _____ C:\Users\ah010073\Desktop\San Jacinto ASB unit signed agreements.pdf
2018-05-17 11:28 - 2018-05-30 11:08 - 000806034 _____ C:\Users\ah010073\Desktop\San Jacinto Unified School District -  SJHS ASB 6535cidn updated - Closing Sales Order Packet - Sherpa 4 - April 1st FY19 5-17-2018.xlsx
2018-05-16 16:24 - 2018-05-16 16:33 - 000458687 _____ C:\Users\ah010073\Desktop\PACIFIC ADVISORS - Removed 4052.docm
2018-05-16 16:10 - 2018-05-16 16:22 - 000458931 _____ C:\Users\ah010073\Desktop\PACIFIC ADVISORS - Removed Desktops and 4052 - Lease Proposal Longm 5-16-2018.docm
2018-05-16 15:32 - 2018-05-16 15:56 - 000440095 _____ C:\Users\ah010073\Desktop\PACIFIC ADVISORS - Removed 4052 and desktops added San Jose units.docm
2018-05-15 19:11 - 2018-05-15 19:11 - 000000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Microsoft Silverlight
2018-05-15 19:10 - 2018-05-15 19:10 - 000000000 ____D C:\Program Files\Microsoft Silverlight
2018-05-15 19:10 - 2018-05-15 19:10 - 000000000 ____D C:\Program Files (x86)\Microsoft Silverlight
2018-05-15 18:58 - 2018-05-15 18:58 - 141696960 ____C (Microsoft Corporation) C:\Windows\system32\MRT-KB890830.exe
2018-05-15 18:52 - 2018-05-15 18:52 - 000000000 _____ C:\Windows\system32\GfxValDisplayLog.bin
2018-05-15 18:44 - 2018-05-15 18:44 - 000000000 ____D C:\Users\ah010073\AppData\Local\Microsoft Help
2018-05-15 18:34 - 2018-03-14 10:14 - 000135360 _____ (Microsoft Corporation) C:\Windows\system32\CompatTelRunner.exe
2018-05-15 18:34 - 2018-03-14 10:09 - 000656384 _____ (Microsoft Corporation) C:\Windows\system32\aeinv.dll
2018-05-15 18:34 - 2018-03-14 06:05 - 001993728 _____ (Microsoft Corporation) C:\Windows\system32\aitstatic.exe
2018-05-15 18:34 - 2018-03-14 06:05 - 001559552 _____ (Microsoft Corporation) C:\Windows\system32\appraiser.dll
2018-05-15 18:34 - 2018-03-14 06:05 - 000739840 _____ (Microsoft Corporation) C:\Windows\system32\generaltel.dll
2018-05-15 18:34 - 2018-03-14 06:05 - 000599552 _____ (Microsoft Corporation) C:\Windows\system32\devinv.dll
2018-05-15 18:34 - 2018-03-14 06:05 - 000450048 _____ (Microsoft Corporation) C:\Windows\system32\centel.dll
2018-05-15 18:34 - 2018-03-14 06:05 - 000414720 _____ (Microsoft Corporation) C:\Windows\system32\invagent.dll
2018-05-15 18:34 - 2018-03-14 06:05 - 000291840 _____ (Microsoft Corporation) C:\Windows\system32\acmigration.dll
2018-05-15 18:34 - 2018-03-14 06:05 - 000237056 _____ (Microsoft Corporation) C:\Windows\system32\aepic.dll
2018-05-15 18:34 - 2016-08-29 08:04 - 003229696 _____ (Microsoft Corporation) C:\Windows\explorer.exe
2018-05-15 18:34 - 2016-08-29 07:55 - 002972672 _____ (Microsoft Corporation) C:\Windows\SysWOW64\explorer.exe
2018-05-15 18:33 - 2016-07-07 08:08 - 000046080 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\tcpipreg.sys
2018-05-15 17:24 - 2016-03-09 12:00 - 000396800 _____ (Microsoft Corporation) C:\Windows\system32\webio.dll
2018-05-15 17:24 - 2016-03-09 11:40 - 000316416 _____ (Microsoft Corporation) C:\Windows\SysWOW64\webio.dll
2018-05-15 17:20 - 2016-03-09 11:54 - 000275456 _____ (Microsoft Corporation) C:\Windows\system32\InkEd.dll
2018-05-15 17:20 - 2016-03-09 11:34 - 000216064 _____ (Microsoft Corporation) C:\Windows\SysWOW64\InkEd.dll
2018-05-15 14:31 - 2018-06-09 17:49 - 000253664 _____ (Malwarebytes) C:\Windows\system32\Drivers\mbamswissarmy.sys
2018-05-15 14:31 - 2018-06-09 07:59 - 000001878 _____ C:\Users\Public\Desktop\Malwarebytes.lnk
2018-05-15 14:30 - 2018-05-15 14:30 - 000000000 ____D C:\ProgramData\Malwarebytes
2018-05-15 14:30 - 2018-05-15 14:30 - 000000000 ____D C:\Program Files\Malwarebytes
2018-05-15 14:30 - 2018-04-26 05:36 - 000152184 _____ (Malwarebytes) C:\Windows\system32\Drivers\mbae64.sys
2018-05-15 12:29 - 2018-05-15 12:29 - 000050748 _____ C:\Users\ah010073\Desktop\Health Source MSO signed d and a.pdf
2018-05-15 09:24 - 2018-05-15 09:24 - 000173864 _____ C:\Users\ah010073\Desktop\Health Source d and a.pdf
2018-05-14 19:53 - 2018-05-14 19:53 - 000125016 _____ C:\Users\ah010073\Desktop\AHMC Whittier Sch A.pdf
2018-05-14 19:41 - 2018-05-18 12:56 - 000617810 _____ C:\Users\ah010073\Desktop\AHMC Whittier agreements.pdf
2018-05-10 14:22 - 2018-05-10 14:22 - 003878506 _____ C:\Users\ah010073\Desktop\Mountain View Transportation closing package.pdf
2018-05-10 13:52 - 2018-05-10 13:52 - 000099284 _____ C:\Users\ah010073\Desktop\Exhibit C - Device Pricing Template.xlsx
2018-05-10 13:51 - 2018-05-10 13:51 - 000354343 _____ C:\Users\ah010073\Desktop\RFP 1817 Specifications.pdf
2018-05-10 13:51 - 2018-05-10 13:51 - 000277627 _____ C:\Users\ah010073\Desktop\Exhibit D - Price Proposal Form with Change Management Plan.xlsx
2018-05-10 13:51 - 2018-05-10 13:51 - 000275729 _____ C:\Users\ah010073\Desktop\Exhibit A - Statement of Work.pdf
2018-05-10 13:22 - 2018-05-10 14:20 - 000806685 _____ C:\Users\ah010073\Desktop\MOUNTAIN VIEW SCHOOL DISTRICT - Transportation Department - Closing Sales Order Packet - Sherpa 4 - April 1st FY19 5-10-2018.xlsx
2018-05-10 11:34 - 2018-05-10 11:34 - 000224968 _____ C:\Users\ah010073\Desktop\EOS signed d and a.pdf
2018-05-10 08:17 - 2018-05-11 12:23 - 007046805 _____ C:\Users\ah010073\Desktop\UCI Demo Presentation.pptx
 
==================== One Month Modified files and folders ========
 
(If an entry is included in the fixlist, the file/folder will be moved.)
 
2018-06-09 18:03 - 2015-12-24 01:53 - 000000952 _____ C:\Windows\Tasks\Nok Nok LabsMFACUpdaterTaskMachineUA.job
2018-06-09 17:57 - 2009-07-13 21:45 - 000031296 ____H C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0
2018-06-09 17:57 - 2009-07-13 21:45 - 000031296 ____H C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0
2018-06-09 17:53 - 2009-07-13 22:13 - 000801102 _____ C:\Windows\system32\PerfStringBackup.INI
2018-06-09 17:53 - 2009-07-13 20:20 - 000000000 ____D C:\Windows\inf
2018-06-09 17:51 - 2017-04-04 08:16 - 000000222 _____ C:\Windows\Tasks\Lenovo Active Protection System.job
2018-06-09 17:51 - 2016-05-02 16:03 - 000141288 _____ C:\Users\ah010073\AppData\Local\GDIPFONTCACHEV1.DAT
2018-06-09 17:51 - 2016-05-02 16:03 - 000000000 __SHD C:\Users\ah010073\IntelGraphicsProfiles
2018-06-09 17:51 - 2015-12-24 01:53 - 000000948 _____ C:\Windows\Tasks\Nok Nok LabsMFACUpdaterTaskMachineCore.job
2018-06-09 17:49 - 2016-05-02 16:56 - 000000000 ____D C:\ProgramData\ScreenConnect Client (2983e16809ce38ec)
2018-06-09 17:48 - 2018-02-14 13:32 - 000000000 ____D C:\ProgramData\Synaptics
2018-06-09 17:48 - 2017-02-24 11:24 - 000000000 ____D C:\Program Files\Common Files\McAfee
2018-06-09 17:48 - 2015-12-24 01:54 - 000000000 ____D C:\ProgramData\McAfee
2018-06-09 17:48 - 2009-07-13 22:08 - 000000006 ____H C:\Windows\Tasks\SA.DAT
2018-06-09 17:48 - 2009-07-13 21:45 - 000546896 _____ C:\Windows\system32\FNTCACHE.DAT
2018-06-09 17:46 - 2017-08-02 09:09 - 000000552 _____ C:\Windows\Tasks\G2MUpdateTask-S-1-5-21-345086361-1354177263-1882197541-10279.job
2018-06-09 17:46 - 2016-11-21 15:28 - 000000000 ____D C:\Program Files\Common Files\Intel
2018-06-09 17:35 - 2017-08-02 09:09 - 000000648 _____ C:\Windows\Tasks\G2MUploadTask-S-1-5-21-345086361-1354177263-1882197541-10279.job
2018-06-09 17:33 - 2016-04-09 18:05 - 000000000 ____D C:\Program Files (x86)\TeamViewer
2018-06-09 17:22 - 2016-05-23 16:05 - 000000000 ____D C:\Windows\SysWOW64\Macromed
2018-06-09 16:42 - 2015-04-18 20:50 - 000000000 ____D C:\ProgramData\algae-89
2018-06-09 16:42 - 2012-03-03 08:19 - 000000000 ____D C:\ProgramData\circle-4
2018-06-09 14:26 - 2017-10-05 01:48 - 000000000 ____D C:\Users\ah010073\AppData\Local\adhesion-85
2018-06-08 21:45 - 2016-05-02 16:25 - 000000000 ____D C:\Users\ah010073\AppData\Roaming\Juniper Networks
2018-06-08 21:24 - 2016-04-09 18:02 - 000000000 ___RD C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Microsoft Office 2013
2018-06-08 20:13 - 2016-07-26 14:07 - 000002096 _____ C:\Users\Public\Desktop\Lenovo Solution Center.lnk
2018-06-08 20:13 - 2015-12-24 01:49 - 000000000 ____D C:\Program Files\Lenovo
2018-06-08 20:13 - 2015-12-24 01:32 - 000000000 ____D C:\Windows\System32\Tasks\Lenovo
2018-06-08 20:13 - 2015-12-24 01:31 - 000000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Lenovo
2018-06-08 20:11 - 2015-12-24 01:49 - 000000000 ____D C:\Windows\Downloaded Installations
2018-06-08 19:09 - 2012-01-25 13:07 - 000000000 ____D C:\ProgramData\pk
2018-06-08 17:47 - 2009-07-13 20:20 - 000000000 ____D C:\Windows\PolicyDefinitions
2018-06-08 17:46 - 2016-05-02 16:03 - 000000000 ____D C:\Users\ah010073
2018-06-08 08:15 - 2016-05-02 15:59 - 000002776 _____ C:\Windows\system32\config\netlogon.ftl
2018-06-07 13:41 - 2016-04-09 18:30 - 000002235 _____ C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Google Chrome.lnk
2018-06-07 13:41 - 2016-04-09 18:30 - 000002194 _____ C:\Users\Public\Desktop\Google Chrome.lnk
2018-06-07 12:40 - 2018-04-16 11:16 - 000004470 _____ C:\Windows\System32\Tasks\Adobe Flash Player PPAPI Notifier
2018-06-07 12:40 - 2016-05-23 16:05 - 000842240 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerApp.exe
2018-06-07 12:40 - 2016-05-23 16:05 - 000175104 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerCPLApp.cpl
2018-06-07 12:40 - 2016-05-23 16:05 - 000004312 _____ C:\Windows\System32\Tasks\Adobe Flash Player Updater
2018-06-07 12:40 - 2016-05-23 16:05 - 000000000 ____D C:\Windows\system32\Macromed
2018-06-06 09:46 - 2018-03-08 11:43 - 000000000 ____D C:\Users\ah010073\AppData\Local\GoToMeeting
2018-06-04 11:44 - 2016-11-21 17:41 - 000000000 ____D C:\Users\ah010073\Desktop\to file away
2018-06-04 09:19 - 2017-02-24 11:24 - 000000000 ____D C:\Program Files (x86)\McAfee
2018-05-29 12:30 - 2017-07-28 15:11 - 000000000 ____D C:\Users\ah010073\Desktop\Stuff
2018-05-24 15:57 - 2018-04-17 14:51 - 000474092 _____ C:\Users\ah010073\Desktop\PACIFIC ADVISORS - Proposal.docm
2018-05-24 11:43 - 2017-08-02 09:09 - 000003674 _____ C:\Windows\System32\Tasks\G2MUploadTask-S-1-5-21-345086361-1354177263-1882197541-10279
2018-05-24 11:43 - 2017-08-02 09:09 - 000003578 _____ C:\Windows\System32\Tasks\G2MUpdateTask-S-1-5-21-345086361-1354177263-1882197541-10279
2018-05-24 10:36 - 2018-02-16 17:51 - 000039477 _____ C:\Users\ah010073\Desktop\Pacific Advisors 2 units revised 25 months.xlsx
2018-05-18 09:33 - 2018-02-28 17:01 - 000889344 _____ C:\Users\ah010073\Desktop\kyocera report card 1 2016.pub
2018-05-17 22:29 - 2016-04-09 18:30 - 000003332 _____ C:\Windows\System32\Tasks\GoogleUpdateTaskMachineUA
2018-05-17 22:29 - 2016-04-09 18:30 - 000003204 _____ C:\Windows\System32\Tasks\GoogleUpdateTaskMachineCore
2018-05-16 18:32 - 2016-05-02 16:01 - 000010817 __RSH C:\ProgramData\ntuser.pol
2018-05-16 18:26 - 2009-07-13 20:20 - 000000000 ____D C:\Windows\system32\NDF
2018-05-16 18:25 - 2016-05-24 19:27 - 000000000 ____D C:\Users\ah010073\AppData\Local\ElevatedDiagnostics
2018-05-16 08:15 - 2016-04-09 11:53 - 000000000 ___SD C:\Windows\system32\CompatTel
2018-05-16 08:15 - 2016-04-09 11:53 - 000000000 ____D C:\Windows\system32\appraiser
2018-05-16 08:15 - 2014-11-14 12:29 - 000000000 ____D C:\Windows\ShellNew
2018-05-15 19:17 - 2009-07-13 19:34 - 000004979 _____ C:\Windows\win.ini
2018-05-15 19:06 - 2014-11-13 15:07 - 000793716 _____ C:\Windows\SysWOW64\PerfStringBackup.INI
2018-05-15 19:03 - 2016-04-09 10:49 - 000000000 ____D C:\Windows\system32\MRT
2018-05-15 18:58 - 2016-04-09 10:49 - 141696960 ____C (Microsoft Corporation) C:\Windows\system32\MRT.exe
2018-05-15 18:53 - 2015-12-24 01:32 - 000000000 ____D C:\Program Files\Intel
2018-05-15 18:53 - 2015-12-24 01:32 - 000000000 ____D C:\Program Files (x86)\Intel
2018-05-15 17:07 - 2015-12-24 01:52 - 000002441 _____ C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Adobe Reader XI.lnk
2018-05-15 16:53 - 2018-04-16 11:22 - 000000000 ____D C:\Program Files (x86)\McAfee Safe Connect
2018-05-15 11:45 - 2018-05-08 14:14 - 000324382 _____ C:\Users\ah010073\Desktop\City of Riverside Exhibit D - Price Proposal Form with Change Management Plan.xlsx
2018-05-15 11:43 - 2018-05-08 14:13 - 000106525 _____ C:\Users\ah010073\Desktop\City of Riverside Exhibit C - Device Pricing Template.xlsx
 
==================== Files in the root of some directories =======
 
2017-06-14 08:41 - 2017-06-29 11:55 - 000181271 _____ () C:\Users\ah010073\AppData\Roaming\sherpa.dat
2018-06-09 01:12 - 2018-06-09 01:12 - 000335286 _____ () C:\Users\ah010073\AppData\Local\ars.cache
2018-06-09 01:13 - 2018-06-09 01:13 - 000905932 _____ () C:\Users\ah010073\AppData\Local\census.cache
2018-06-08 22:00 - 2018-06-09 08:01 - 000000036 _____ () C:\Users\ah010073\AppData\Local\housecall.guid.cache
2018-06-08 22:08 - 2018-06-08 22:08 - 000000010 _____ () C:\Users\ah010073\AppData\Local\sponge.last.runtime.cache
2018-02-02 15:51 - 2018-02-02 15:51 - 000000000 _____ () C:\Users\ah010073\AppData\Local\{127D0699-062C-4A83-A71A-892AA4BFC615}
2018-02-07 11:58 - 2018-02-07 11:58 - 000000000 _____ () C:\Users\ah010073\AppData\Local\{19FED61A-C305-490F-8587-4E566E4E949C}
2018-01-30 14:36 - 2018-01-30 14:36 - 000000000 _____ () C:\Users\ah010073\AppData\Local\{294DBCCA-A0B1-4652-9F1A-553794B00CBA}
 
Some files in TEMP:
====================
2018-06-09 17:46 - 2018-03-06 19:05 - 001013200 _____ (McAfee, Inc.) C:\Users\ah010073\AppData\Local\Temp\0236891528591588McInst.exe
 
Some zero byte size files/folders:
==========================
C:\Windows\SysWOW64\dlumd10.dll
C:\Windows\SysWOW64\dlumd11.dll
C:\Windows\SysWOW64\dlumd9.dll
C:\Windows\System32\dlumd10.dll
C:\Windows\System32\dlumd11.dll
C:\Windows\System32\dlumd9.dll
 
==================== Bamital & volsnap ======================
 
(There is no automatic fix for files that do not pass verification.)
 
C:\Windows\system32\winlogon.exe => File is digitally signed
C:\Windows\system32\wininit.exe => File is digitally signed
C:\Windows\SysWOW64\wininit.exe => File is digitally signed
C:\Windows\explorer.exe => File is digitally signed
C:\Windows\SysWOW64\explorer.exe => File is digitally signed
C:\Windows\system32\svchost.exe => File is digitally signed
C:\Windows\SysWOW64\svchost.exe => File is digitally signed
C:\Windows\system32\services.exe => File is digitally signed
C:\Windows\system32\User32.dll => File is digitally signed
C:\Windows\SysWOW64\User32.dll => File is digitally signed
C:\Windows\system32\userinit.exe => File is digitally signed
C:\Windows\SysWOW64\userinit.exe => File is digitally signed
C:\Windows\system32\rpcss.dll => File is digitally signed
C:\Windows\system32\dnsapi.dll => File is digitally signed
C:\Windows\SysWOW64\dnsapi.dll => File is digitally signed
C:\Windows\system32\Drivers\volsnap.sys => File is digitally signed
 
LastRegBack: 2018-06-07 00:05
 
==================== End of FRST.txt ============================
 
Additional scan result of Farbar Recovery Scan Tool (x64) Version: 06.06.2018 01
Ran by ah010073 (09-06-2018 18:17:31)
Running from C:\Users\ah010073\Downloads
Windows 7 Professional Service Pack 1 (X64) (2016-05-02 22:53:42)
Boot Mode: Normal
==========================================================
 
 
==================== Accounts: =============================
 
admin (S-1-5-21-201262395-2737818422-147992042-1000 - Administrator - Enabled) => C:\Users\admin
Administrator (S-1-5-21-201262395-2737818422-147992042-500 - Administrator - Disabled)
Guest (S-1-5-21-201262395-2737818422-147992042-501 - Limited - Disabled)
Katherine Hatcher (S-1-5-21-201262395-2737818422-147992042-1004 - Administrator - Enabled) => C:\Users\Katherine Hatcher
Setup (S-1-5-21-201262395-2737818422-147992042-1003 - Administrator - Enabled) => C:\Users\Setup
 
==================== Security Center ========================
 
(If an entry is included in the fixlist, it will be removed.)
 
AV: Malwarebytes (Enabled - Up to date) {23007AD3-69FE-687C-2629-D584AFFAF72B}
AV: Trend Micro OfficeScan Antivirus (Enabled - Up to date) {48929DFC-7A52-A34F-8351-C4DBEDBD9C50}
AS: Trend Micro OfficeScan Anti-spyware (Enabled - Up to date) {F3F37C18-5C68-ACC1-B9E1-FFA9963AD6ED}
AS: Malwarebytes (Enabled - Up to date) {98619B37-4FC4-67F2-1C99-EEF6D47DBD96}
AS: Windows Defender (Enabled - Up to date) {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
 
==================== Installed Programs ======================
 
(Only the adware programs with "Hidden" flag could be added to the fixlist to unhide them. The adware programs should be uninstalled manually.)
 
Adobe AIR (HKLM-x32\...\Adobe AIR) (Version: 21.0.0.176 - Adobe Systems Incorporated)
Adobe Flash Player 30 ActiveX (HKLM-x32\...\Adobe Flash Player ActiveX) (Version: 30.0.0.113 - Adobe Systems Incorporated)
Adobe Flash Player 30 PPAPI (HKLM-x32\...\Adobe Flash Player PPAPI) (Version: 30.0.0.113 - Adobe Systems Incorporated)
Adobe Reader XI (11.0.23)  MUI (HKLM-x32\...\{AC76BA86-7AD7-FFFF-7B44-AB0000000001}) (Version: 11.0.23 - Adobe Systems Incorporated)
Compass Sherpa v3 (HKLM-x32\...\{1D8ABB3C-AFD4-4FBE-92AF-99E9A0D6D3FB}) (Version: 3.00.0000 - Compass Sales Solutions)
Create Recovery Media (HKLM-x32\...\{50DC5136-21E8-48BC-97E5-1AD055F6B0B6}) (Version: 1.20.0.00 - Lenovo Group Limited)
DisplayLink Core Software (HKLM\...\{58F4C39B-D946-4A45-A314-DEFC2AFDF397}) (Version: 7.5.54609.0 - DisplayLink Corp.)
Dolby Home Theater v4 (HKLM-x32\...\{B26438B4-BF51-49C3-9567-7F14A5E40CB9}) (Version: 7.2.8000.17 - Dolby Laboratories Inc)
ExpressCache (HKLM\...\{44EAE7F6-8BBF-4C3F-A573-3CD5A3C067FA}) (Version: 1.3.110.0 - Condusiv Technologies)
Google Chrome (HKLM-x32\...\Google Chrome) (Version: 67.0.3396.79 - Google Inc.)
Google Update Helper (HKLM-x32\...\{60EC980A-BDA2-4CB6-A427-B07A5498B4CA}) (Version: 1.3.33.17 - Google Inc.) Hidden
Google Update Helper (HKLM-x32\...\{A92DAB39-4E2C-4304-9AB6-BC44E68B55E2}) (Version: 1.3.27.0 - Google Inc.) Hidden
GoTo Opener (HKLM-x32\...\{1F803452-798F-49FB-A5DD-9F527F7017E4}) (Version: 1.0.473 - LogMeIn, Inc.)
GoToMeeting 8.28.0.8847 (HKU\S-1-5-21-345086361-1354177263-1882197541-10279\...\GoToMeeting) (Version: 8.28.0.8847 - LogMeIn, Inc.)
HOST File Installer version 1.1 (HKLM-x32\...\{78D45494-2393-4A7E-AE10-6FD3B8237FB1}_is1) (Version: 1.1 - KDA SoCal)
IBM Notes 9.0.1 Social Edition (HKLM-x32\...\{FFEBEBC7-7761-4D1F-9C7C-562EA3752590}) (Version: 9.01.13294 - IBM)
IdeaMax 2.0.9.20140123 (HKLM-x32\...\{CA733A1D-AB25-452A-8228-BE14C0236A03}_is1) (Version: 2.0.9 - Newline Interactive)
IdeaMax Server 13.06.18 (HKLM-x32\...\{F7978EFB-25E0-4043-A68C-5FE25C4BA905}_is1) (Version: 13.06.18 - Newline Interactive)
Inst5676 (HKLM\...\{878F6913-7421-4713-97F7-0A736EE2A188}) (Version: 8.01.87 - Softex Inc.) Hidden
Integrated Camera (HKLM-x32\...\{E0A7ED39-8CD6-4351-93C3-69CCA00D12B4}) (Version: 6.2.9200.10291 - Realtek Semiconductor Corp.)
Integrated Camera (HKLM-x32\...\{E399A5B3-ED53-4DEA-AF04-8011E1EB1EAC}) (Version: 6.3.9600.11073 - Realtek Semiconductor Corp.)
Intel® Chipset Device Software (HKLM-x32\...\{f5d71765-7cd1-4e68-998f-5b379e725da3}) (Version: 10.0.22 - Intel® Corporation) Hidden
Intel® Management Engine Components (HKLM\...\{1CEAC85D-2590-4760-800F-8DE5E91F3700}) (Version: 10.0.30.1072 - Intel Corporation)
Intel® Processor Graphics (HKLM-x32\...\{F0E3AD40-2BBD-4360-9C76-B9AC9A5886EA}) (Version: 20.19.15.4703 - Intel Corporation)
Intel® Technology Access (HKLM-x32\...\{a3294ccc-6d01-43c2-9249-3f50bd113bb8}) (Version: 1.3.2.1030 - Intel Corporation)
Intel® Update Manager (HKLM-x32\...\{7224B7CE-196C-4E2A-A1AE-1D7BF259FD36}) (Version: 3.4.1942 - Intel Corporation)
Intel® USB 3.0\3.1 eXtensible Host Controller Driver (HKLM-x32\...\{240C3DDD-C5E9-4029-9DF7-95650D040CF2}) (Version: 5.0.3.42 - Intel Corporation)
Intel® WiDi (HKLM\...\{3F5D407B-86F5-4CA5-8F83-7C00BBB69080}) (Version: 5.1.23.0 - Intel Corporation)
Intel® Wireless Bluetooth®(patch version 17.1.1450.402) (HKLM\...\{302600C1-6BDF-4FD1-1411-148929CC1385}) (Version: 17.1.1411.0502 - Intel Corporation)
Intel® PROSet/Wireless Software (HKLM-x32\...\{a0f22a81-00d1-45d6-9cad-d93c57053e53}) (Version: 20.10.2 - Intel Corporation)
Java 8 Update 171 (64-bit) (HKLM\...\{26A24AE4-039D-4CA4-87B4-2F64180171F0}) (Version: 8.0.1710.11 - Oracle Corporation)
Juniper Networks, Inc. Setup Client (HKU\S-1-5-21-345086361-1354177263-1882197541-10279\...\Juniper_Setup_Client) (Version: 7.1.10.21853 - Juniper Networks, Inc.)
Kyocera Product Library (HKLM\...\Kyocera Product Library) (Version: 5.0.1120 - KYOCERA Document Solutions Inc.)
Lenovo Active Protection System (HKLM\...\{46A84694-59EC-48F0-964C-7E76E9F8A2ED}) (Version: 1.82.00.14 - Lenovo)
Lenovo Auto Scroll Utility (HKLM\...\LenovoAutoScrollUtility) (Version: 2.21 - Lenovo)
Lenovo Communications Utility (HKLM\...\{88C6A6D9-324C-46E8-BA87-563D14021442}_is1) (Version: 3.1.22.0 - Lenovo)
Lenovo Fingerprint Manager Pro (HKLM\...\{314FAD12-F785-4471-BCE8-AB506642B9A1}) (Version: 8.01.87 - Lenovo) Hidden
Lenovo Fingerprint Manager Pro (HKLM-x32\...\InstallShield_{314FAD12-F785-4471-BCE8-AB506642B9A1}) (Version: 8.01.87 - Lenovo)
Lenovo On Screen Display (HKLM\...\OnScreenDisplay) (Version: 8.86.25 - Lenovo)
Lenovo Peer Connect SDK (HKLM\...\{75C87855-9CBB-4892-B1A9-74C73A19CACA}_is1) (Version: 1.0.0.7 - Lenovo)
Lenovo Power Management Driver (HKLM\...\Power Management Driver) (Version: 1.67.12.16 - Lenovo) Hidden
Lenovo PowerENGAGE (HKLM-x32\...\{15B15395-FF53-44E1-ADAD-FCC279E3CA10}) (Version: 2.51.0040 - Lenovo Inc.)
Lenovo QuickControl (HKLM-x32\...\{04128C8C-7812-4DCC-816E-9C8AB1D6EECE}) (Version: 2.40 - Lenovo Group Limited)
Lenovo Service Bridge (HKU\S-1-5-21-345086361-1354177263-1882197541-10279\...\{2C74547D-EF88-47F4-85F5-BE46A31E26B7}_is1) (Version: 4.0.6.3 - Lenovo)
Lenovo Solution Center (HKLM\...\{06913C0C-88EB-42AF-9D94-3E9136CEE9BC}) (Version: 3.6.002.003 - Lenovo)
Lenovo System Update (HKLM-x32\...\TVSU_is1) (Version: 5.07.0070 - Lenovo)
Lenovo USB Graphics (HKLM\...\{E6B1FE9A-CB1E-4096-A0AF-163419CB971C}) (Version: 7.5.54614.0 - Lenovo)
Lenovo USB3.0 to DVI VGA Monitor Adapter (HKLM-x32\...\{454D32AD-C149-49BE-9F2E-8C089C3D6620}) (Version: 1.07.17 - Lenovo)
Lenovo User Guide (HKLM-x32\...\{13F59938-C595-479C-B479-F171AB9AF64F}) (Version: 1.0.0009.00 - Lenovo Group Limited)
Lenovo Warranty Information (HKLM-x32\...\{FD4EC278-C1B1-4496-99ED-C0BE1B0AA521}) (Version: 1.0.0011.00 - Lenovo)
Malwarebytes version 3.5.1.2522 (HKLM\...\{35065F43-4BB2-439A-BFF7-0F1014F2E0CD}_is1) (Version: 3.5.1.2522 - Malwarebytes)
Metric Collection SDK (HKLM-x32\...\{DDAA788F-52E6-44EA-ADB8-92837B11BF26}) (Version: 1.1.0012.00 - Lenovo Group Limited) Hidden
Metric Collection SDK 35 (HKLM-x32\...\{C2B5B5B0-2545-4E94-B4BA-548D4BF0B196}) (Version: 1.2.0006.00 - Lenovo Group Limited) Hidden
Microsoft .NET Framework 4.7.1 (HKLM\...\{92FB6C44-E685-45AD-9B20-CADF4CABA132} - 1033) (Version: 4.7.02558 - Microsoft Corporation)
Microsoft Office Standard 2013 (HKLM-x32\...\Office15.STANDARD) (Version: 15.0.4569.1506 - Microsoft Corporation)
Microsoft Silverlight (HKLM\...\{89F4137D-6C26-4A84-BDB8-2E5A4BB71E00}) (Version: 5.1.50907.0 - Microsoft Corporation)
Microsoft Visual C++ 2005 Redistributable (HKLM-x32\...\{710f4c1c-cc18-4c49-8cbf-51240c89a1a2}) (Version: 8.0.61001 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729 (HKLM-x32\...\{86CE1746-9EFF-3C9C-8755-81EA8903AC34}) (Version: 9.0.30729 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17 (HKLM-x32\...\{9A25302D-30C0-39D9-BD6F-21E6EC160475}) (Version: 9.0.30729 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161 (HKLM-x32\...\{9BE518E6-ECC6-35A9-88E4-87755C07200F}) (Version: 9.0.30729.6161 - Microsoft Corporation)
Microsoft Visual C++ 2010  x64 Redistributable - 10.0.40219 (HKLM\...\{1D8E6291-B0D5-35EC-8441-6616F567A0F7}) (Version: 10.0.40219 - Microsoft Corporation)
Microsoft Visual C++ 2010  x86 Redistributable - 10.0.40219 (HKLM-x32\...\{F0C3E5D1-1ADE-321E-8167-68EF0DE699A5}) (Version: 10.0.40219 - Microsoft Corporation)
Microsoft Visual C++ 2012 Redistributable (x64) - 11.0.60610 (HKLM-x32\...\{a1909659-0a08-4554-8af1-2175904903a1}) (Version: 11.0.60610.1 - Microsoft Corporation)
Microsoft Visual C++ 2012 Redistributable (x64) - 11.0.61030 (HKLM-x32\...\{ca67548a-5ebe-413a-b50c-4b9ceb6d66c6}) (Version: 11.0.61030.0 - Microsoft Corporation)
Microsoft Visual C++ 2012 Redistributable (x86) - 11.0.60610 (HKLM-x32\...\{95716cce-fc71-413f-8ad5-56c2892d4b3a}) (Version: 11.0.60610.1 - Microsoft Corporation)
Microsoft Visual C++ 2013 Redistributable (x64) - 12.0.30501 (HKLM-x32\...\{050d4fc8-5d48-4b8f-8972-47c82c46020f}) (Version: 12.0.30501.0 - Microsoft Corporation)
Microsoft Visual Studio 2010 Tools for Office Runtime (x64) (HKLM\...\Microsoft Visual Studio 2010 Tools for Office Runtime (x64)) (Version: 10.0.50903 - Microsoft Corporation)
MSXML 4.0 SP2 (KB954430) (HKLM-x32\...\{86493ADD-824D-4B8E-BD72-8C5DCDC52A71}) (Version: 4.20.9870.0 - Microsoft Corporation)
MSXML 4.0 SP2 (KB973688) (HKLM-x32\...\{F662A8E6-F4DC-41A2-901E-8C11F044BDEC}) (Version: 4.20.9876.0 - Microsoft Corporation)
Multifactor Authentication Client (HKLM\...\{89F955AF-7274-4C60-B5ED-3530AFB88163}) (Version: 1.3.2.3008 - Nok Nok Labs)
Outils de vérification linguistique 2013 de Microsoft Office - Français (HKLM-x32\...\{90150000-001F-040C-0000-0000000FF1CE}) (Version: 15.0.4569.1506 - Microsoft Corporation) Hidden
Power Manager (HKLM-x32\...\{DAC01CEE-5BAE-42D5-81FC-B687E84E8405}) (Version: 6.68.10 - Lenovo Group Limited)
Realtek Card Reader (HKLM-x32\...\{5BC2B5AB-80DE-4E83-B8CF-426902051D0A}) (Version: 6.3.9600.21247 - Realtek Semiconductor Corp.)
Realtek High Definition Audio Driver (HKLM-x32\...\{F132AF7F-7BCA-4EDE-8A7C-958108FE7DBC}) (Version: 6.0.1.7368 - Realtek Semiconductor Corp.)
SAP Crystal Reports runtime engine for .NET Framework 4 (32-bit) (HKLM-x32\...\{8D6181F3-CACB-4B48-8B08-981F3A7F318B}) (Version: 13.0.0.99 - SAP)
ScreenConnect Client (2983e16809ce38ec) (HKLM-x32\...\{29247120-196E-4E92-9E10-C99613DC6D02}) (Version: 6.3.13446.6374 - ScreenConnect Software)
SHAREit (HKLM-x32\...\SHAREit_is1) (Version: 3.2.0.543 - Lenovo)
SSClient (HKLM-x32\...\{FBD62A5C-F9AF-4545-976F-A6FE59E488E1}) (Version: 2.00.0000 - Square 9 Softworks)
SUPERAntiSpyware (HKLM\...\{CDDCBBF1-2703-46BC-938B-BCC81A1EEAAA}) (Version: 6.0.1254 - SUPERAntiSpyware.com)
Synaptics Pointing Device Driver (HKLM\...\SynTPDeinstKey) (Version: 19.3.4.91 - Synaptics Incorporated)
Synaptics WBF DDK 5011 (HKLM\...\{4C261AE9-A217-4509-B00A-629C35D33A7A}) (Version: 4.5.336.0 - Synaptics)
Synaptics WBF DDK 5011 (HKLM\...\{4D70781C-36A9-4335-9568-565C6F61B5EB}) (Version: 4.5.336.0 - )
The Evolved Office Assistant 17 SP4 (17.4.68.1) MB3 (HKLM-x32\...\{48B802C2-F24B-4374-BE45-84F4C9B395F3}) (Version: 17.4.68.1 - Evolve IP)
Thinkpad USB Ethernet Adapter Driver (HKLM-x32\...\{D8102684-7BA1-4948-88B9-535F84E6E588}) (Version: 7.14.1114.2014 - Lenovo)
Trend Micro OfficeScan Client (HKLM-x32\...\{ECEA7878-2100-4525-915D-B09174E36971}) (Version: 10.0.1068 - Trend Micro)
Update for Skype for Business 2015 (KB4022170) 32-Bit Edition (HKLM-x32\...\{90150000-002A-0000-1000-0000000FF1CE}_Office15.STANDARD_{4F70C8C6-F2BE-4892-81EF-019021C921DD}) (Version:  - Microsoft)
Windows Driver Package - Intel (e1dexpress) Net  (07/15/2014 12.12.50.7202) (HKLM\...\9831220A78BC6CDB16870D8F80FF2AB41814019A) (Version: 07/15/2014 12.12.50.7202 - Intel)
Windows Driver Package - Intel Corporation (iaStorA) HDC  (11/06/2014 13.6.0.1002) (HKLM\...\55320B67E6FF26D5CF6A352973677B5A68BD028B) (Version: 11/06/2014 13.6.0.1002 - Intel Corporation)
Windows Driver Package - Lenovo 1.67.09.03 (11/07/2014 1.67.09.03) (HKLM\...\FA3F6F3D6E8958FDDEE1E09CC77DFA71B0D7835A) (Version: 11/07/2014 1.67.09.03 - Lenovo)
Zoom (HKU\S-1-5-21-345086361-1354177263-1882197541-10279\...\ZoomUMX) (Version: 3.5 - Zoom Video Communications, Inc.)
 
==================== Custom CLSID (Whitelisted): ==========================
 
(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)
 
CustomCLSID: HKU\S-1-5-21-345086361-1354177263-1882197541-10279_Classes\CLSID\{84B5A313-CD5D-4904-8BA2-AFDC81C1B309}\InprocServer32 -> C:\Users\ah010073\AppData\Local\GoToMeeting\8679\G2MOutlookAddin64.dll (LogMeIn, Inc.)
ContextMenuHandlers3: [MBAMShlExt] -> {57CE581A-0CB6-4266-9CA0-19364C90A0B3} => C:\Program Files\Malwarebytes\Anti-Malware\mbshlext.dll [2018-05-09] (Malwarebytes)
ContextMenuHandlers5: [igfxcui] -> {3AB1675A-CCFF-11D2-8B20-00A0C93CB1F4} =>  -> No File
ContextMenuHandlers5: [igfxDTCM] -> {9B5F5829-A529-4B12-814A-E81BCB8D93FC} => C:\Windows\system32\igfxDTCM.dll [2017-09-21] (Intel Corporation)
ContextMenuHandlers6: [MBAMShlExt] -> {57CE581A-0CB6-4266-9CA0-19364C90A0B3} => C:\Program Files\Malwarebytes\Anti-Malware\mbshlext.dll [2018-05-09] (Malwarebytes)
 
==================== Scheduled Tasks (Whitelisted) =============
 
(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)
 
Task: {169C8004-7148-40D2-9BF3-5ECDFC89A16D} - System32\Tasks\Lenovo Active Protection System => C:\Windows\system32\TpShUI.exe [2017-03-21] (Lenovo.)
Task: {172E3044-68B2-48A1-B07F-E2AD3FDB1B64} - System32\Tasks\Adobe Flash Player PPAPI Notifier => C:\Windows\SysWOW64\Macromed\Flash\FlashUtil32_30_0_0_113_pepper.exe [2018-06-07] (Adobe Systems Incorporated)
Task: {27D4B4B9-49F5-4CD9-AD11-2B8D7F34E362} - System32\Tasks\G2MUploadTask-S-1-5-21-345086361-1354177263-1882197541-10279 => C:\Users\ah010073\AppData\Local\GoToMeeting\8847\g2mupload.exe [2018-05-24] (LogMeIn, Inc.)
Task: {28833BE3-1659-4250-B59E-6677F52274F6} - System32\Tasks\TVT\TVSUUpdateTask => C:\Program Files (x86)\Lenovo\System Update\tvsuShim.exe [2017-12-12] ()
Task: {39C06327-290D-4D84-BD91-F82223468DF3} - System32\Tasks\IUM-F1E24CA0-B63E-4F13-A9E3-4ADE3BFF3473 => C:\Program Files (x86)\Intel\Intel® Update Manager\bin\iumsvc.exe [2016-08-12] (Intel Corporation)
Task: {3A119009-E8E6-435D-BA45-AEAB7077BE24} - System32\Tasks\DiskUpdate => C:\SWTOOLS\OSFIXES\DISKUPDT\DiskUpdate.exe [2009-02-09] ()
Task: {424B0FB6-D827-4540-B912-93B11775F286} - System32\Tasks\PMTask => C:\Program Files (x86)\ThinkPad\Utilities\PwmIdTsv.exe [2016-04-14] (Lenovo Group Limited)
Task: {45EF69EA-0F1A-453D-AEEA-410AFB32ACCA} - System32\Tasks\Lenovo\Lenovo PowerENGAGE Update => C:\Program Files (x86)\Lenovo Registration\lenovoreg.exe [2015-01-09] (Aviata Inc)
Task: {48DDF359-CF8B-40EC-85E4-8AC7F8D39A07} - System32\Tasks\Adobe Acrobat Update Task => C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe [2018-02-09] (Adobe Systems Incorporated)
Task: {4CF93D02-F568-4F59-ADF7-FFAE26531CC9} - System32\Tasks\Lenovo\LSC\Lenovo Solution Center Notifications => C:\Program Files\Lenovo\Lenovo Solution Center\LSCNotify.exe [2017-06-09] (Lenovo)
Task: {5ABB0435-DA2B-4E3B-A8A4-DFFC43F5FFF6} - System32\Tasks\Microsoft\Office\OfficeTelemetryAgentFallBack => C:\Program Files\Microsoft Office\Office15\msoia.exe [2014-01-21] (Microsoft Corporation)
Task: {5B215934-C3C7-4828-B58F-20B7C12CB50B} - System32\Tasks\Lenovo\Lenovo PowerENGAGE => C:\Program Files (x86)\Lenovo Registration\lenovoreg.exe [2015-01-09] (Aviata Inc)
Task: {5FFE73F0-C94E-461E-9789-E1F510EA8FD5} - System32\Tasks\Lenovo\Lenovo Service Bridge\S-1-5-21-345086361-1354177263-1882197541-10279 => C:\Users\ah010073\AppData\Local\Programs\Lenovo\Lenovo Service Bridge\LSBUpdater.exe [2018-05-24] (Lenovo Group Limited)
Task: {64DB42FE-2AAD-4907-A1CC-6AA6E2AC8D43} - System32\Tasks\Lenovo\Lenovo Solution Center Launcher => C:\Program Files\Lenovo\Lenovo Solution Center\App\LSC.Services.UpdateStatusService.exe [2017-06-09] ()
Task: {64F6D8DE-59EB-4396-97C4-967CF361F528} - System32\Tasks\Adobe Flash Player Updater => C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe [2018-06-07] (Adobe Systems Incorporated)
Task: {720A0EA8-FA25-44F9-906D-EB750DE55582} - System32\Tasks\Lenovo\Lenovo Customer Feedback Program 64 35 => C:\Program Files (x86)\Lenovo\Customer Feedback Program 35\Lenovo.TVT.CustomerFeedback.Agent35.exe [2015-12-10] (Lenovo)
Task: {743B0CD6-E95D-42FA-86BA-2D92AA28A91A} - System32\Tasks\Microsoft\Office\OfficeTelemetryAgentLogOn => C:\Program Files\Microsoft Office\Office15\msoia.exe [2014-01-21] (Microsoft Corporation)
Task: {9278EC00-FF37-4F9D-BD35-44A88CB07EED} - System32\Tasks\Lenovo\LSC\LSCHardwareScan => C:\Program Files\Lenovo\Lenovo Solution Center\LSC.exe [2017-06-09] (Lenovo)
Task: {93AB8562-630F-4C22-B784-66D7392724DE} - System32\Tasks\RtHDVBg_Dolby => C:\Program Files\Realtek\Audio\HDA\RAVBg64.exe [2014-09-01] (Realtek Semiconductor)
Task: {9B164283-4B9B-4E51-86A7-6393285CEEBA} - System32\Tasks\{E26DAA6C-7E37-458B-9172-0192A05B90B8} => C:\Program Files (x86)\IBM\Notes\notes.exe [2013-10-15] (IBM Corp)
Task: {9C99CB8B-D44A-44CF-8F89-5AD2A32E52E0} - System32\Tasks\GoogleUpdateTaskMachineCore => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe [2016-04-09] (Google Inc.)
Task: {9E72018A-BAAC-484F-AEDD-20420C9CB3D0} - System32\Tasks\Nok Nok LabsMFACUpdaterTaskMachineUA => C:\Program Files (x86)\Nok Nok Labs\MFACUpdater\MFACUpdate.exe [2015-12-24] (Nok Nok Labs Inc.)
Task: {A6294065-A8C8-40FA-BF4A-E9C08B7E2B9D} - System32\Tasks\Lenovo\Lenovo Customer Feedback Program 64 => C:\Program Files (x86)\Lenovo\Customer Feedback Program\Lenovo.TVT.CustomerFeedback.Agent.exe [2015-07-01] (Lenovo)
Task: {C181E375-A64E-4797-870F-98903A425980} - System32\Tasks\RtHDVBg_LENOVO_MICPKEY => C:\Program Files\Realtek\Audio\HDA\RAVBg64.exe [2014-09-01] (Realtek Semiconductor)
Task: {C3A0CE5C-5A3A-4940-B7C3-CCF6E733D612} - System32\Tasks\Nok Nok LabsMFACUpdaterTaskMachineCore => C:\Program Files (x86)\Nok Nok Labs\MFACUpdater\MFACUpdate.exe [2015-12-24] (Nok Nok Labs Inc.)
Task: {D364947E-A24C-4677-877F-4D655F5CE142} - System32\Tasks\TVT\TVSUUpdateTask_UserLogOn => C:\Program Files (x86)\Lenovo\System Update\tvsuShim.exe [2017-12-12] ()
Task: {D5239B7F-175A-4A15-BFA4-096491873DEC} - System32\Tasks\{91AFAEFA-0F53-4B3A-BC8F-AFDBD9664896} => C:\Program Files (x86)\IBM\Notes\notes.exe [2013-10-15] (IBM Corp)
Task: {D937F23D-FD9A-4942-BDAF-783EFB22AD18} - System32\Tasks\GoogleUpdateTaskMachineUA => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe [2016-04-09] (Google Inc.)
Task: {DB22557B-35D1-4017-B70F-C53C08CC310D} - System32\Tasks\Lenovo\Lenovo Customer Feedback Program => C:\Program Files\Lenovo\Customer Feedback Program\Lenovo.TVT.CustomerFeedback.Agent.exe
Task: {DEA34CC3-702A-4693-9192-582F127E86CB} - System32\Tasks\IUM-F1E24CA0-B63E-4F13-A9E3-4ADE3BFF3473-Logon => C:\Program Files (x86)\Intel\Intel® Update Manager\bin\iumsvc.exe [2016-08-12] (Intel Corporation)
Task: {E0DF0E84-BC06-445E-8EE1-826331F7908A} - System32\Tasks\RTKCPL => C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe [2014-10-07] (Realtek Semiconductor)
Task: {E9D1CE3C-AF2A-4279-845B-820DE7A90014} - System32\Tasks\G2MUpdateTask-S-1-5-21-345086361-1354177263-1882197541-10279 => C:\Users\ah010073\AppData\Local\GoToMeeting\8847\g2mupdate.exe [2018-05-24] (LogMeIn, Inc.)
Task: {F4761B47-875A-423E-8549-4398E4F93CB4} - System32\Tasks\Microsoft\Office\Office 15 Subscription Heartbeat => C:\Program Files\Common Files\Microsoft Shared\Office15\OLicenseHeartbeat.exe
Task: {FA2AD0A7-6FC1-46DC-A208-82AEAD9D2682} - System32\Tasks\Microsoft\Windows\PLA\LSC Memory => C:\Windows\system32\rundll32.exe C:\Windows\system32\pla.dll,PlaHost "LSC Memory" "$(Arg0)"
Task: {FF0A5E76-829A-41F4-956E-FA09F0BAD809} - System32\Tasks\TVT\LaunchFR => C:\Program Files (x86)\Lenovo\Factory Recovery\FRReminder.exe [2014-08-20] (TODO: <Company name>)
 
(If an entry is included in the fixlist, the task (.job) file will be moved. The file which is running by the task will not be moved.)
 
Task: C:\Windows\Tasks\G2MUpdateTask-S-1-5-21-345086361-1354177263-1882197541-10279.job => C:\Users\ah010073\AppData\Local\GoToMeeting\8847\g2mupdate.exe
Task: C:\Windows\Tasks\G2MUploadTask-S-1-5-21-345086361-1354177263-1882197541-10279.job => C:\Users\ah010073\AppData\Local\GoToMeeting\8847\g2mupload.exe
Task: C:\Windows\Tasks\Lenovo Active Protection System.job => C:\Windows\system32\TpShUI.exe
Task: C:\Windows\Tasks\Nok Nok LabsMFACUpdaterTaskMachineCore.job => C:\Program Files (x86)\Nok Nok Labs\MFACUpdater\MFACUpdate.exe
Task: C:\Windows\Tasks\Nok Nok LabsMFACUpdaterTaskMachineUA.job => C:\Program Files (x86)\Nok Nok Labs\MFACUpdater\MFACUpdate.exe
 
==================== Shortcuts & WMI ========================
 
(The entries could be listed to be restored or removed.)
 
 
==================== Loaded Modules (Whitelisted) ==============
 
2015-01-23 17:58 - 2015-01-23 17:58 - 001795976 _____ () C:\Program Files\Intel Corporation\Intel® Technology Access\cpprest120_1_4.dll
2015-01-23 17:42 - 2015-01-23 17:42 - 000087552 _____ () C:\Program Files\Intel Corporation\Intel® Technology Access\libglog.dll
2015-01-23 17:58 - 2015-01-23 17:58 - 000357768 _____ () C:\Program Files\Intel Corporation\Intel® Technology Access\JsonCpp.dll
2017-06-14 17:59 - 2017-06-14 17:59 - 000090768 _____ () C:\Program Files (x86)\ScreenConnect Client (2983e16809ce38ec)\ScreenConnect.ClientService.exe
2018-05-15 14:30 - 2018-04-30 12:54 - 002493648 _____ () C:\PROGRAM FILES\MALWAREBYTES\ANTI-MALWARE\MwacLib.dll
2018-05-15 14:30 - 2018-04-25 13:16 - 002297040 _____ () C:\PROGRAM FILES\MALWAREBYTES\ANTI-MALWARE\SelfProtectionSdk.dll
2007-05-16 11:42 - 2007-05-16 11:42 - 000089088 _____ () C:\Program Files (x86)\Trend Micro\OfficeScan Client\zlibwapi.dll
2017-02-23 08:29 - 2017-02-23 08:29 - 008909512 _____ () C:\Program Files\Microsoft Office\Office15\1033\GrooveIntlResource.dll
2015-12-24 01:48 - 2016-04-14 06:08 - 000107008 ____N () C:\Program Files (x86)\ThinkPad\Utilities\US\PWMRT64V.DLL
2017-04-12 13:08 - 2013-06-18 10:59 - 012172288 _____ () C:\Program Files (x86)\IdeaMax Server\Driver\IdeaMax Server.exe
2018-02-07 09:28 - 2017-12-12 11:25 - 000023920 _____ () C:\Program Files (x86)\Lenovo\System Update\SUService.exe
2018-02-07 09:28 - 2017-12-12 11:25 - 000028016 _____ () C:\Program Files (x86)\Lenovo\System Update\uncserver.exe
2018-06-07 13:41 - 2018-06-05 18:25 - 004608856 _____ () C:\Program Files (x86)\Google\Chrome\Application\67.0.3396.79\libglesv2.dll
2018-06-07 13:41 - 2018-06-05 18:25 - 000099672 _____ () C:\Program Files (x86)\Google\Chrome\Application\67.0.3396.79\libegl.dll
 
==================== Alternate Data Streams (Whitelisted) =========
 
(If an entry is included in the fixlist, only the ADS will be removed.)
 
 
==================== Safe Mode (Whitelisted) ===================
 
(If an entry is included in the fixlist, it will be removed from the registry. The "AlternateShell" will be restored.)
 
HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\MBAMService => ""="Service"
HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\mcpltsvc => ""=""
HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\atashost => ""="Service"
HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\MBAMService => ""="Service"
HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\mcpltsvc => ""=""
HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\ScreenConnect Client (2983e16809ce38ec) => ""="Service"
 
==================== Association (Whitelisted) ===============
 
(If an entry is included in the fixlist, the registry item will be restored to default or removed.)
 
 
==================== Internet Explorer trusted/restricted ===============
 
(If an entry is included in the fixlist, it will be removed from the registry.)
 
IE trusted site: HKU\S-1-5-21-345086361-1354177263-1882197541-10279\...\kdacentral.com -> hxxps://direct.kdacentral.com
IE trusted site: HKU\S-1-5-21-345086361-1354177263-1882197541-10279\...\kdaconnect.com -> hxxps://vpn.kdaconnect.com
 
==================== Hosts content: ==========================
 
(If needed Hosts: directive could be included in the fixlist to reset Hosts.)
 
2009-07-13 19:34 - 2018-05-17 06:28 - 000001167 _____ C:\Windows\system32\Drivers\etc\hosts
 
10.128.18.6 CANotes01
10.128.18.12 KDAmailCA01
10.128.18.7 irvinesvr
10.128.0.205 kmawestern
10.128.0.12 HQNotes01
10.128.0.11 HQNotes03
10.128.0.67 HQNotes04
10.128.0.59 KMASametime
10.128.71.17 KDANotesPrd03
10.128.33.3 Server-473
10.128.33.5 SynologySD
10.128.18.5 IRVSQUARE9
 
==================== Other Areas ============================
 
(Currently there is no automatic fix for this section.)
 
HKU\S-1-5-21-345086361-1354177263-1882197541-10279\Control Panel\Desktop\\Wallpaper -> C:\Users\ah010073\AppData\Roaming\Microsoft\Windows\Themes\TranscodedWallpaper.jpg
DNS Servers: 10.0.0.1
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System => (ConsentPromptBehaviorAdmin: 0) (ConsentPromptBehaviorUser: 3) (EnableLUA: 0)
Windows Firewall is enabled.
 
==================== MSCONFIG/TASK MANAGER disabled items ==
 
 
==================== FirewallRules (Whitelisted) ===============
 
(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)
 
FirewallRules: [SPPSVC-In-TCP] => (Allow) %SystemRoot%\system32\sppsvc.exe
FirewallRules: [SPPSVC-In-TCP-NoScope] => (Allow) %SystemRoot%\system32\sppsvc.exe
FirewallRules: [{7675C09A-F59D-4F91-B3C1-3D70AC8D3FE9}] => (Allow) C:\Program Files (x86)\Lenovo\QuickControl\QuickControlService.exe
FirewallRules: [{78A1CD28-645D-4832-9F18-B136BD6BCC3A}] => (Allow) C:\Program Files (x86)\Lenovo\QuickControl\QuickControlService.exe
FirewallRules: [{853E278B-3C49-4D97-8610-49DA714D15DD}] => (Allow) C:\Program Files\Intel Corporation\Intel WiDi\WiDiApp.exe
FirewallRules: [{2277C52B-B7CF-4425-AE5B-B8457BAC63BE}] => (Allow) C:\Program Files (x86)\Lenovo\SHAREit\SHAREit.exe
FirewallRules: [{46058CFB-D992-4A3E-8E90-8514C1FE501C}] => (Allow) C:\Program Files (x86)\Lenovo\SHAREit\SHAREit.exe
FirewallRules: [{92CDA2DB-39DE-4B5F-8353-F85E3B4415EA}] => (Allow) LPort=35115
FirewallRules: [{A84A253D-AE9C-4857-9C64-DAB98CA6ECEE}] => (Allow) LPort=9422
FirewallRules: [{F6A2F008-2EB0-418C-B81A-56DA8FDDA203}] => (Allow) LPort=9245
FirewallRules: [{576E80E5-AC37-468B-960C-C58C99773077}] => (Allow) LPort=9246
FirewallRules: [{D434E0F7-8E76-49C2-9015-EB8C237EBDA9}] => (Allow) LPort=9247
FirewallRules: [TCP Query User{9DE18238-669C-48DF-9793-67AC5FF1D47A}C:\users\ah010073\appdata\local\blue jeans\app\bluejeans.exe] => (Allow) C:\users\ah010073\appdata\local\blue jeans\app\bluejeans.exe
FirewallRules: [UDP Query User{26C54FEF-1AE2-416E-8F3D-4463BDC4B7B2}C:\users\ah010073\appdata\local\blue jeans\app\bluejeans.exe] => (Allow) C:\users\ah010073\appdata\local\blue jeans\app\bluejeans.exe
FirewallRules: [TCP Query User{0565B383-5556-4653-B296-A1AC83B4B73B}C:\users\ah010073\appdata\local\blue jeans\app\bluejeans.exe] => (Allow) C:\users\ah010073\appdata\local\blue jeans\app\bluejeans.exe
FirewallRules: [UDP Query User{66A76758-6506-4E61-BBD5-61B869E9A42D}C:\users\ah010073\appdata\local\blue jeans\app\bluejeans.exe] => (Allow) C:\users\ah010073\appdata\local\blue jeans\app\bluejeans.exe
FirewallRules: [{5E901942-FAE8-4203-A8C2-B2B18DAF1A81}] => (Allow) LPort=35115
FirewallRules: [{C917DCD4-0CCE-4209-BEE5-2D7CA38E025C}] => (Allow) C:\Program Files\Intel\WiFi\bin\PanDhcpDns.exe
FirewallRules: [{CDEB1D8C-31EE-476E-BF03-863C21709AD7}] => (Allow) C:\Program Files (x86)\Lenovo\System Update\uncserver.exe
FirewallRules: [{62F1C4EF-3B75-41DD-989E-E3E4108A7B68}] => (Allow) C:\Program Files (x86)\Lenovo\System Update\uncserver.exe
FirewallRules: [{D8D95F4B-F798-4121-B0DC-3120F7BB907B}] => (Allow) LPort=9422
FirewallRules: [{24D32618-BE13-4D53-80DD-24A8021BBB19}] => (Allow) LPort=9245
FirewallRules: [{A71B4FB7-CE90-4A65-8466-E03B57C80043}] => (Allow) LPort=9246
FirewallRules: [{154A613B-DA73-49C5-8EA8-6F0C5534F66D}] => (Allow) LPort=9247
FirewallRules: [{D2CB2F10-E5C2-41FB-97FA-35541E9B1D25}] => (Allow) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
FirewallRules: [{B46103BC-6043-4334-BCAD-B20AC3AC3A01}] => (Allow) C:\Users\ah010073\AppData\Local\Temp\HouseCall\tmase\nmap\nmap.exe
FirewallRules: [{8FE9C12D-5DAB-454C-BF4D-BA505D2D4E67}] => (Allow) C:\Users\ah010073\AppData\Local\Temp\HouseCall\tmase\nmap\bonjour.exe
FirewallRules: [{14762308-3CE6-4B2D-90F0-6826FA191F5E}] => (Allow) LPort=35115
 
==================== Restore Points =========================
 
08-06-2018 17:30:29 Windows Update
08-06-2018 18:59:54 Windows Modules Installer
08-06-2018 19:02:28 Removed Java 8 Update 171 (64-bit)
08-06-2018 20:03:40 Windows Modules Installer
08-06-2018 20:12:20 Installed Lenovo Solution Center.
08-06-2018 20:17:27 Windows Update
08-06-2018 20:55:52 Installed TeamViewer 12 (MSI Wrapper)
08-06-2018 21:07:32 Windows Update
08-06-2018 21:15:06 Windows Update
08-06-2018 21:17:08 Windows Update
08-06-2018 21:23:38 Windows Update
08-06-2018 21:42:30 Windows Update
08-06-2018 21:57:42 Windows Update
09-06-2018 17:32:57 Removed TeamViewer 12 (MSI Wrapper)
 
==================== Faulty Device Manager Devices =============
 
 
==================== Event log errors: =========================
 
Application errors:
==================
Error: (06/09/2018 05:48:54 PM) (Source: WinMgmt) (EventID: 10) (User: )
Description: Event filter with query "SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 99" could not be reactivated in namespace "//./root/CIMV2" because of error 0x80041003. Events cannot be delivered through this filter until the problem is corrected.
 
Error: (06/09/2018 02:16:13 PM) (Source: WinMgmt) (EventID: 10) (User: )
Description: Event filter with query "SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 99" could not be reactivated in namespace "//./root/CIMV2" because of error 0x80041003. Events cannot be delivered through this filter until the problem is corrected.
 
Error: (06/09/2018 07:57:20 AM) (Source: Application Error) (EventID: 1000) (User: )
Description: Faulting application name: mbamtray.exe, version: 3.0.0.1284, time stamp: 0x5a15a98e
Faulting module name: Qt5Qml.dll, version: 5.6.2.0, time stamp: 0x59a6405a
Exception code: 0xc0000005
Fault offset: 0x000aaf25
Faulting process id: 0x684
Faulting application start time: 0x01d3ffaa4dccaef1
Faulting application path: C:\Program Files\Malwarebytes\Anti-Malware\mbamtray.exe
Faulting module path: C:\Program Files\Malwarebytes\Anti-Malware\Qt5Qml.dll
Report Id: 68180112-6bf5-11e8-90a8-185e0f706b46
 
Error: (06/09/2018 07:57:10 AM) (Source: Application Error) (EventID: 1000) (User: )
Description: Faulting application name: mbamtray.exe, version: 3.0.0.1284, time stamp: 0x5a15a98e
Faulting module name: mbamtray.exe, version: 3.0.0.1284, time stamp: 0x5a15a98e
Exception code: 0xc0000005
Fault offset: 0x000098a8
Faulting process id: 0x684
Faulting application start time: 0x01d3ffaa4dccaef1
Faulting application path: C:\Program Files\Malwarebytes\Anti-Malware\mbamtray.exe
Faulting module path: C:\Program Files\Malwarebytes\Anti-Malware\mbamtray.exe
Report Id: 6284c49d-6bf5-11e8-90a8-185e0f706b46
 
Error: (06/08/2018 09:25:59 PM) (Source: WinMgmt) (EventID: 10) (User: )
Description: Event filter with query "SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 99" could not be reactivated in namespace "//./root/CIMV2" because of error 0x80041003. Events cannot be delivered through this filter until the problem is corrected.
 
Error: (06/08/2018 08:31:34 PM) (Source: WinMgmt) (EventID: 10) (User: )
Description: Event filter with query "SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 99" could not be reactivated in namespace "//./root/CIMV2" because of error 0x80041003. Events cannot be delivered through this filter until the problem is corrected.
 
Error: (06/08/2018 05:51:15 PM) (Source: WinMgmt) (EventID: 10) (User: )
Description: Event filter with query "SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 99" could not be reactivated in namespace "//./root/CIMV2" because of error 0x80041003. Events cannot be delivered through this filter until the problem is corrected.
 
Error: (06/08/2018 05:09:52 PM) (Source: Application Error) (EventID: 1000) (User: )
Description: Faulting application name: mfac.exe, version: 1.3.2.3008, time stamp: 0x54402675
Faulting module name: ole32.dll, version: 6.1.7601.23889, time stamp: 0x598d5026
Exception code: 0xc0000005
Fault offset: 0x00000000000268eb
Faulting process id: 0x17fc
Faulting application start time: 0x01d3ff8322446e3b
Faulting application path: C:\Program Files\Nok Nok Labs\Multifactor Authentication Client\bin\mfac.exe
Faulting module path: C:\Windows\system32\ole32.dll
Report Id: 6e3cd629-6b79-11e8-b217-185e0f706b46
 
 
System errors:
=============
Error: (06/09/2018 05:55:55 PM) (Source: Disk) (EventID: 7) (User: )
Description: The device, \Device\Harddisk1\DR1, has a bad block.
 
Error: (06/09/2018 05:51:26 PM) (Source: Microsoft-Windows-GroupPolicy) (EventID: 1129) (User: KMA)
Description: The processing of Group Policy failed because of lack of network connectivity to a domain controller. This may be a transient condition. A success message would be generated once the machine gets connected to the domain controller and Group Policy has succesfully processed. If you do not see a success message for several hours, then contact your administrator.
 
Error: (06/09/2018 05:49:58 PM) (Source: DCOM) (EventID: 10016) (User: NT AUTHORITY)
Description: The application-specific permission settings do not grant Local Launch permission for the COM Server application with CLSID 
{C97FCC79-E628-407D-AE68-A06AD6D8B4D1}
 and APPID 
{344ED43D-D086-4961-86A6-1106F4ACAD9B}
 to the user NT AUTHORITY\SYSTEM SID (S-1-5-18) from address LocalHost (Using LRPC). This security permission can be modified using the Component Services administrative tool.
 
Error: (06/09/2018 05:48:51 PM) (Source: Microsoft-Windows-GroupPolicy) (EventID: 1055) (User: NT AUTHORITY)
Description: The processing of Group Policy failed. Windows could not resolve the computer name. This could be caused by one of more of the following: 
a) Name Resolution failure on the current domain controller. 
b) Active Directory Replication Latency (an account created on another domain controller has not replicated to the current domain controller).
 
Error: (06/09/2018 05:48:49 PM) (Source: NETLOGON) (EventID: 5719) (User: )
Description: This computer was not able to set up a secure session with a domain
controller in domain KMA due to the following: 
There are currently no logon servers available to service the logon request.
 
 
This may lead to authentication problems. Make sure that this
computer is connected to the network. If the problem persists,
please contact your domain administrator.
 
 
 
ADDITIONAL INFO
 
If this computer is a domain controller for the specified domain, it
sets up the secure session to the primary domain controller emulator in the specified
domain. Otherwise, this computer sets up the secure session to any domain controller
in the specified domain.
 
Error: (06/09/2018 05:13:02 PM) (Source: Disk) (EventID: 7) (User: )
Description: The device, \Device\Harddisk1\DR1, has a bad block.
 
Error: (06/09/2018 03:59:29 PM) (Source: Microsoft-Windows-GroupPolicy) (EventID: 1129) (User: KMA)
Description: The processing of Group Policy failed because of lack of network connectivity to a domain controller. This may be a transient condition. A success message would be generated once the machine gets connected to the domain controller and Group Policy has succesfully processed. If you do not see a success message for several hours, then contact your administrator.
 
Error: (06/09/2018 03:58:23 PM) (Source: Microsoft-Windows-GroupPolicy) (EventID: 1129) (User: NT AUTHORITY)
Description: The processing of Group Policy failed because of lack of network connectivity to a domain controller. This may be a transient condition. A success message would be generated once the machine gets connected to the domain controller and Group Policy has succesfully processed. If you do not see a success message for several hours, then contact your administrator.
 
 
Windows Defender:
===================================
Date: 2016-04-11 15:28:53.154
Description: 
Windows Defender scan has been stopped before completion.
Scan ID:{3ACB7E49-DD3A-4A94-94DA-54B13D47CD29}
Scan Type:AntiSpyware
Scan Parameters:Quick Scan
 
CodeIntegrity:
===================================
 
Date: 2017-04-04 08:15:27.489
Description: 
Windows is unable to verify the image integrity of the file \Device\HarddiskVolume1\Program Files (x86)\Lenovo\System Update\ApsIns64.sys because file hash could not be found on the system. A recent hardware or software change might have installed a file that is signed incorrectly or damaged, or that might be malicious software from an unknown source.
 
Date: 2017-04-04 08:15:27.481
Description: 
Windows is unable to verify the image integrity of the file \Device\HarddiskVolume1\Program Files (x86)\Lenovo\System Update\ApsIns64.sys because file hash could not be found on the system. A recent hardware or software change might have installed a file that is signed incorrectly or damaged, or that might be malicious software from an unknown source.
 
Date: 2017-04-04 08:15:13.966
Description: 
Windows is unable to verify the image integrity of the file \Device\HarddiskVolume1\Program Files (x86)\Lenovo\System Update\ApsIns64.sys because file hash could not be found on the system. A recent hardware or software change might have installed a file that is signed incorrectly or damaged, or that might be malicious software from an unknown source.
 
Date: 2017-04-04 08:15:13.957
Description: 
Windows is unable to verify the image integrity of the file \Device\HarddiskVolume1\Program Files (x86)\Lenovo\System Update\ApsIns64.sys because file hash could not be found on the system. A recent hardware or software change might have installed a file that is signed incorrectly or damaged, or that might be malicious software from an unknown source.
 
Date: 2017-04-04 08:15:02.676
Description: 
Windows is unable to verify the image integrity of the file \Device\HarddiskVolume1\Program Files (x86)\Lenovo\System Update\ApsIns64.sys because file hash could not be found on the system. A recent hardware or software change might have installed a file that is signed incorrectly or damaged, or that might be malicious software from an unknown source.
 
Date: 2017-04-04 08:15:02.675
Description: 
Windows is unable to verify the image integrity of the file \Device\HarddiskVolume1\Program Files (x86)\Lenovo\System Update\ApsIns64.sys because file hash could not be found on the system. A recent hardware or software change might have installed a file that is signed incorrectly or damaged, or that might be malicious software from an unknown source.
 
Date: 2017-03-28 08:24:59.103
Description: 
Windows is unable to verify the image integrity of the file \Device\HarddiskVolume1\Program Files (x86)\Lenovo\System Update\ApsIns64.sys because file hash could not be found on the system. A recent hardware or software change might have installed a file that is signed incorrectly or damaged, or that might be malicious software from an unknown source.
 
Date: 2017-03-28 08:24:59.102
Description: 
Windows is unable to verify the image integrity of the file \Device\HarddiskVolume1\Program Files (x86)\Lenovo\System Update\ApsIns64.sys because file hash could not be found on the system. A recent hardware or software change might have installed a file that is signed incorrectly or damaged, or that might be malicious software from an unknown source.
 
==================== Memory info =========================== 
 
Processor: Intel® Core™ i5-5200U CPU @ 2.20GHz
Percentage of memory in use: 77%
Total physical RAM: 3792.36 MB
Available physical RAM: 835 MB
Total Virtual: 7582.89 MB
Available Virtual: 4010.84 MB
 
==================== Drives ================================
 
Drive c: (Windows7_OS) (Fixed) (Total:465.76 GB) (Free:393.43 GB) NTFS ==>[drive with boot components (obtained from BCD)]
 
 
==================== MBR & Partition Table ==================
 
========================================================
Disk: 0 (Size: 465.8 GB) (Disk ID: 5E1E98E7)
Partition 1: (Active) - (Size=465.8 GB) - (Type=07 NTFS)
 
========================================================
Disk: 1 (MBR Code: Windows 7/8/10) (Size: 14.9 GB) (Disk ID: C5B4DB3D)
Partition 1: (Not Active) - (Size=14.9 GB) - (Type=73)
 
==================== End of Addition.txt ============================

 


  • 0

Advertisements


#2
RKinner

RKinner

    Malware Expert

  • Expert
  • 20,885 posts
  • MVP
Error: (06/08/2018 05:09:52 PM) (Source: Application Error) (EventID: 1000) (User: )
Description: Faulting application name: mfac.exe, version: 1.3.2.3008, time stamp: 0x54402675
Faulting module name: ole32.dll, version: 6.1.7601.23889, time stamp: 0x598d5026
Exception code: 0xc0000005
Fault offset: 0x00000000000268eb
Faulting process id: 0x17fc
Faulting application start time: 0x01d3ff8322446e3b
Faulting application path: C:\Program Files\Nok Nok Labs\Multifactor Authentication Client\bin\mfac.exe
Faulting module path: C:\Windows\system32\ole32.dll
Report Id: 6e3cd629-6b79-11e8-b217-185e0f706b46

 

 

Appears to be this program:
 
Multifactor Authentication Client (HKLM\...\{89F955AF-7274-4C60-B5ED-3530AFB88163}) (Version: 1.3.2.3008 - Nok Nok Labs)
 
Do you need it?  If not uninstall it.  If you need it then try downloading a fresh version.
 
Is this computer part of a Domain?
 

Right click on (My) Computer and select Manage (Continue) Then click on the arrow in front of Event Viewer. Next Click on the arrow in front of Windows Logs Right click on System and Clear Log, Clear. Repeat for Application.

Reboot.

Start, All Programs, Accessories then right click on Command Prompt and Run as Administrator.  Then type (with an Enter after each line).

sfc  /scannow

(This will check your critical system files. Does this finish without complaint?  IF it says it couldn't fix everything then:

Copy the next two lines:

findstr  /c:"[SR]"  \windows\logs\cbs\cbs.log  >  %UserProfile%\desktop\junk.txt
notepad %UserProfile%\desktop\junk.txt

Start, All Programs, Accessories, right click on Command Prompt and Run as Administrator, Continue.  Right click and Paste or Edit then Paste and the copied line should appear.
Hit Enter. Copy and paste the text from notepad or if it is too big, just attach the file.)


1. Please download the Event Viewer Tool by Vino Rosso
http://images.malwar...om/vino/VEW.exe
and save it to your Desktop:
2. Right-click VEW.exe and Run AS Administrator
3. Under 'Select log to query', select:

* System
4. Under 'Select type to list', select:
* Error
* Warning


Then use the 'Number of events' as follows:


1. Click the radio button for 'Number of events'
Type 20 in the 1 to 20 box
Then click the Run button.
Notepad will open with the output log.


Please post the Output log in your next reply then repeat but select Application.  (Each time you run VEW it overwrites the log so copy the first one to a Reply or rename it before running it a second time.)

 

 

et Process Explorer

http://live.sysinter...com/procexp.exe
Save it to your desktop then run it (Vista or Win7+ - right click and Run As Administrator).  

View, Select Column, check Verified Signer, OK
Options, Verify Image Signatures


Click twice on the CPU column header  to sort things by CPU usage with the big hitters at the top.  

Wait a full minute then:

File, Save As, Save.  Note the file name.   Open the file  on your desktop and copy and paste the text to a reply.


Copy the next 2 lines:

TASKLIST /SVC  > \junk.txt
notepad \junk.txt

Open an Elevated Command Prompt:
Win 7: Start, All Programs, Accessories then right click on Command Prompt and Run as Administrator
Win 8: http://www.eightforu...indows-8-a.html
win 10: http://www.howtogeek...-in-windows-10/

Right click and Paste (or Edit then Paste) and the copied lines should appear.
Hit Enter if notepad does not open.  Copy and paste the text from notepad into a reply.


Get the free version of Speccy:

http://www.filehippo...ownload_speccy/ 

(Look in the upper right for the Download
Latest Version button  - Do NOT press the large Start Download button on the upper left!)  
Download, Save and Install it.  Tell it you do not need CCLEANER.    Run Speccy.  When it finishes (the little icon in the bottom left will stop moving),
File, Save as Text File,  (to your desktop) note the name it gives. OK.  Open the file in notepad and delete the line that gives the serial number of your Operating System.  
(It will be near the top,  10-20  lines down.) Save the file.  Attach the file to your next post.  Attaching the log is the best option as it is too big for the forum.  Attaching is a multi step process.

First click on More Reply Options
Then scroll down to where you see
Choose File and click on it.  Point it at the file and hit Open.
Now click on Attach this file.


 


  • 0

#3
bhzendner

bhzendner

    Member

  • Topic Starter
  • Member
  • PipPipPip
  • 226 posts
Noc Noc removed / rebooted 
 
SFC found no issues 
 
Vino's Event Viewer v01c run on Windows 2008 in English
Report run at 18/06/2018 3:47:05 PM
 
Note: All dates below are in the format dd/mm/yyyy
 
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
'System' Log - Critical Type
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
'System' Log - Error Type
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Log: 'System' Date/Time: 18/06/2018 10:29:19 PM
Type: Error Category: 0
Event: 1030 Source: Microsoft-Windows-GroupPolicy
The processing of Group Policy failed. Windows attempted to retrieve new Group Policy settings for this user or computer. Look in the details tab for error code and description. Windows will automatically retry this operation at the next refresh cycle. Computers joined to the domain must have proper name resolution and network connectivity to a domain controller for discovery of new Group Policy objects and settings. An event will be logged when Group Policy is successful.
 
Log: 'System' Date/Time: 18/06/2018 10:28:10 PM
Type: Error Category: 0
Event: 10016 Source: Microsoft-Windows-DistributedCOM
The application-specific permission settings do not grant Local Launch permission for the COM Server application with CLSID  {C97FCC79-E628-407D-AE68-A06AD6D8B4D1}  and APPID  {344ED43D-D086-4961-86A6-1106F4ACAD9B}  to the user NT AUTHORITY\SYSTEM SID (S-1-5-18) from address LocalHost (Using LRPC). This security permission can be modified using the Component Services administrative tool.
 
Log: 'System' Date/Time: 18/06/2018 10:27:11 PM
Type: Error Category: 0
Event: 1030 Source: Microsoft-Windows-GroupPolicy
The processing of Group Policy failed. Windows attempted to retrieve new Group Policy settings for this user or computer. Look in the details tab for error code and description. Windows will automatically retry this operation at the next refresh cycle. Computers joined to the domain must have proper name resolution and network connectivity to a domain controller for discovery of new Group Policy objects and settings. An event will be logged when Group Policy is successful.
 
Log: 'System' Date/Time: 18/06/2018 10:25:32 PM
Type: Error Category: 0
Event: 7 Source: Disk
The device, \Device\Harddisk1\DR1, has a bad block.
 
Log: 'System' Date/Time: 18/06/2018 10:25:25 PM
Type: Error Category: 0
Event: 10010 Source: Microsoft-Windows-DistributedCOM
The server {995C996E-D918-4A8C-A302-45719A6F4EA7} did not register with DCOM within the required timeout.
 
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
'System' Log - Warning Type
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Log: 'System' Date/Time: 18/06/2018 10:27:50 PM
Type: Warning Category: 7
Event: 37 Source: Microsoft-Windows-Kernel-Processor-Power
The speed of processor 1 in group 0 is being limited by system firmware. The processor has been in this reduced performance state for 71 seconds since the last report.
 
Log: 'System' Date/Time: 18/06/2018 10:27:50 PM
Type: Warning Category: 7
Event: 37 Source: Microsoft-Windows-Kernel-Processor-Power
The speed of processor 2 in group 0 is being limited by system firmware. The processor has been in this reduced performance state for 71 seconds since the last report.
 
Log: 'System' Date/Time: 18/06/2018 10:27:50 PM
Type: Warning Category: 7
Event: 37 Source: Microsoft-Windows-Kernel-Processor-Power
The speed of processor 3 in group 0 is being limited by system firmware. The processor has been in this reduced performance state for 71 seconds since the last report.
 
Log: 'System' Date/Time: 18/06/2018 10:27:50 PM
Type: Warning Category: 7
Event: 37 Source: Microsoft-Windows-Kernel-Processor-Power
The speed of processor 0 in group 0 is being limited by system firmware. The processor has been in this reduced performance state for 71 seconds since the last report.
 
Log: 'System' Date/Time: 18/06/2018 10:26:41 PM
Type: Warning Category: 212
Event: 219 Source: Microsoft-Windows-Kernel-PnP
The driver \Driver\WUDFRd failed to load for the device USB\VID_138A&PID_0017\0de61c0d575d.
 
Vino's Event Viewer v01c run on Windows 2008 in English
Report run at 18/06/2018 3:47:05 PM
 
Note: All dates below are in the format dd/mm/yyyy
 
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
'System' Log - Critical Type
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
'System' Log - Error Type
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Log: 'System' Date/Time: 18/06/2018 10:29:19 PM
Type: Error Category: 0
Event: 1030 Source: Microsoft-Windows-GroupPolicy
The processing of Group Policy failed. Windows attempted to retrieve new Group Policy settings for this user or computer. Look in the details tab for error code and description. Windows will automatically retry this operation at the next refresh cycle. Computers joined to the domain must have proper name resolution and network connectivity to a domain controller for discovery of new Group Policy objects and settings. An event will be logged when Group Policy is successful.
 
Log: 'System' Date/Time: 18/06/2018 10:28:10 PM
Type: Error Category: 0
Event: 10016 Source: Microsoft-Windows-DistributedCOM
The application-specific permission settings do not grant Local Launch permission for the COM Server application with CLSID  {C97FCC79-E628-407D-AE68-A06AD6D8B4D1}  and APPID  {344ED43D-D086-4961-86A6-1106F4ACAD9B}  to the user NT AUTHORITY\SYSTEM SID (S-1-5-18) from address LocalHost (Using LRPC). This security permission can be modified using the Component Services administrative tool.
 
Log: 'System' Date/Time: 18/06/2018 10:27:11 PM
Type: Error Category: 0
Event: 1030 Source: Microsoft-Windows-GroupPolicy
The processing of Group Policy failed. Windows attempted to retrieve new Group Policy settings for this user or computer. Look in the details tab for error code and description. Windows will automatically retry this operation at the next refresh cycle. Computers joined to the domain must have proper name resolution and network connectivity to a domain controller for discovery of new Group Policy objects and settings. An event will be logged when Group Policy is successful.
 
Log: 'System' Date/Time: 18/06/2018 10:25:32 PM
Type: Error Category: 0
Event: 7 Source: Disk
The device, \Device\Harddisk1\DR1, has a bad block.
 
Log: 'System' Date/Time: 18/06/2018 10:25:25 PM
Type: Error Category: 0
Event: 10010 Source: Microsoft-Windows-DistributedCOM
The server {995C996E-D918-4A8C-A302-45719A6F4EA7} did not register with DCOM within the required timeout.
 
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
'System' Log - Warning Type
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Log: 'System' Date/Time: 18/06/2018 10:27:50 PM
Type: Warning Category: 7
Event: 37 Source: Microsoft-Windows-Kernel-Processor-Power
The speed of processor 1 in group 0 is being limited by system firmware. The processor has been in this reduced performance state for 71 seconds since the last report.
 
Log: 'System' Date/Time: 18/06/2018 10:27:50 PM
Type: Warning Category: 7
Event: 37 Source: Microsoft-Windows-Kernel-Processor-Power
The speed of processor 2 in group 0 is being limited by system firmware. The processor has been in this reduced performance state for 71 seconds since the last report.
 
Log: 'System' Date/Time: 18/06/2018 10:27:50 PM
Type: Warning Category: 7
Event: 37 Source: Microsoft-Windows-Kernel-Processor-Power
The speed of processor 3 in group 0 is being limited by system firmware. The processor has been in this reduced performance state for 71 seconds since the last report.
 
Log: 'System' Date/Time: 18/06/2018 10:27:50 PM
Type: Warning Category: 7
Event: 37 Source: Microsoft-Windows-Kernel-Processor-Power
The speed of processor 0 in group 0 is being limited by system firmware. The processor has been in this reduced performance state for 71 seconds since the last report.
 
Log: 'System' Date/Time: 18/06/2018 10:26:41 PM
Type: Warning Category: 212
Event: 219 Source: Microsoft-Windows-Kernel-PnP
The driver \Driver\WUDFRd failed to load for the device USB\VID_138A&PID_0017\0de61c0d575d.
 
Process CPU Private Bytes Working Set PID Description Company Name Verified Signer
System Idle Process 79.27 0 K 24 K 0
ScreenConnect.WindowsClient.exe 7.15 132,920 K 140,616 K 5404 ScreenConnect Client ScreenConnect Software (Verified) ScreenConnect Software
System 4.19 148 K 1,324 K 4
dwm.exe 3.72 37,892 K 41,872 K 6576 Desktop Window Manager Microsoft Corporation (Verified) Microsoft Windows
ExpressCache.exe 1.63 24,824 K 79,648 K 2428 ExpressCache Service Condusiv Technologies (Verified) CONDUSIV TECHNOLOGIES
procexp64.exe 1.33 52,520 K 68,312 K 1644 Sysinternals Process Explorer Sysinternals - www.sysinternals.com (Verified) Microsoft Corporation
WmiPrvSE.exe 1.03 6,940 K 14,016 K 4348 WMI Provider Host Microsoft Corporation (Verified) Microsoft Windows
Interrupts 0.77 0 K 0 K n/a Hardware Interrupts and DPCs
ScreenConnect.ClientService.exe 0.22 18,188 K 24,224 K 2820 (Verified) ScreenConnect Software
csrss.exe 0.20 2,896 K 25,752 K 732 Client Server Runtime Process Microsoft Corporation (Verified) Microsoft Windows
svchost.exe 0.13 35,452 K 52,516 K 1348 Host Process for Windows Services Microsoft Corporation (Verified) Microsoft Windows
svchost.exe 0.11 84,548 K 92,500 K 1280 Host Process for Windows Services Microsoft Corporation (Verified) Microsoft Windows
virtscrl.exe 0.04 1,640 K 5,040 K 4632 Lenovo Auto Scroll Utility Lenovo Group Limited (Verified) Lenovo
IdeaMax Server.exe 0.04 17,624 K 14,724 K 7548 (No signature was present in the subject)
wisptis.exe 0.03 4,268 K 11,308 K 3460 Microsoft Pen and Touch Input Component Microsoft Corporation (Verified) Microsoft Windows
SUPERANTISPYWARE.EXE 0.02 18,596 K 11,220 K 7212 SUPERAntiSpyware Application SUPERAntiSpyware (Verified) Support.com
TpKnrres.exe 0.02 6,940 K 8,224 K 6656 Communications Utility launcher Lenovo Group Limited (Verified) Lenovo
svchost.exe 0.02 17,680 K 20,652 K 1232 Host Process for Windows Services Microsoft Corporation (Verified) Microsoft Windows
PccNTMon.exe 0.01 7,904 K 15,912 K 7532 Trend Micro OfficeScan Monitor Trend Micro Inc. (Verified) Trend Micro
DisplayLinkManager.exe 0.01 9,220 K 14,836 K 1588 DisplayLinkManager Application DisplayLink Corp. (Verified) DISPLAYLINK
explorer.exe 0.01 69,688 K 82,612 K 6604 Windows Explorer Microsoft Corporation (Verified) Microsoft Windows
lsass.exe 0.01 6,028 K 15,332 K 788 Local Security Authority Process Microsoft Corporation (Verified) Microsoft Windows
TmListen.exe < 0.01 13,436 K 23,632 K 3496 Trend Micro Common Client Communication Service Trend Micro Inc. (Verified) Trend Micro
SASCore64.exe < 0.01 1,640 K 4,260 K 2276 Core Service SUPERAntiSpyware.com (Verified) SUPERAntiSpyware.com
LSB.exe < 0.01 76,056 K 1,464 K 5012 Lenovo Service Bridge Lenovo Group Limited (Verified) Lenovo (Beijing) Limited
SearchIndexer.exe < 0.01 32,004 K 21,060 K 7072 Microsoft Windows Search Indexer Microsoft Corporation (Verified) Microsoft Windows
taskhost.exe < 0.01 13,988 K 16,848 K 4240 Host Process for Windows Tasks Microsoft Corporation (Verified) Microsoft Windows
WUDFHost.exe < 0.01 4,008 K 10,752 K 1748 Windows Driver Foundation - User-mode Driver Framework Host Process Microsoft Corporation (Verified) Microsoft Windows
EvtEng.exe < 0.01 7,172 K 15,072 K 2396 Intel® PROSet/Wireless Event Log Service Intel® Corporation (Verified) Intel® Wireless Connectivity Solutions
svchost.exe < 0.01 10,792 K 17,868 K 1304 Host Process for Windows Services Microsoft Corporation (Verified) Microsoft Windows
lsm.exe < 0.01 2,976 K 4,932 K 796 Local Session Manager Service Microsoft Corporation (Verified) Microsoft Windows
NTRTScan.exe < 0.01 25,596 K 34,096 K 2340 Trend Micro Common Client Real-time Scan Service (64-bit) Trend Micro Inc. (Verified) Trend Micro
svchost.exe < 0.01 14,048 K 16,052 K 2212 Host Process for Windows Services Microsoft Corporation (Verified) Microsoft Windows
valWBFPolicyService.exe < 0.01 3,872 K 7,144 K 3256 Synaptics WBF Policy Service (CMN) Synaptics Incorporated (Verified) Synaptics Inc.
wmpnetwk.exe < 0.01 11,092 K 7,624 K 7024 Windows Media Player Network Sharing Service Microsoft Corporation (Verified) Microsoft Windows
SynTPEnh.exe < 0.01 14,332 K 22,732 K 4244 Synaptics TouchPad 64-bit Enhancements Synaptics Incorporated (Verified) Synaptics Incorporated
spoolsv.exe < 0.01 19,332 K 25,196 K 2020 Spooler SubSystem App Microsoft Corporation (Verified) Microsoft Windows
IntelTechnologyAccessService.exe < 0.01 14,520 K 23,352 K 2864 Intel® Technology Access - Service Intel® Corporation (Verified) Intel® Technology Access
ibmpmsvc.exe < 0.01 1,784 K 5,104 K 1004 Lenovo Power Management Service Lenovo. (Verified) Lenovo
RtsCM64.exe < 0.01 2,400 K 7,224 K 6584 Realtek Camera Man Realtek Semiconductor Corp. (Verified) Realtek Semiconductor Corp
SynLenovoHelper.exe < 0.01 3,000 K 7,228 K 6180 SynLenovo Helper tool Synaptics (Verified) Synaptics Incorporated
LPlatSvc.exe < 0.01 2,224 K 5,944 K 164 Lenovo Platform Service Lenovo. (Verified) Lenovo
svchost.exe < 0.01 56,236 K 31,116 K 3336 Host Process for Windows Services Microsoft Corporation (Verified) Microsoft Windows
SynTPEnhService.exe < 0.01 2,336 K 6,404 K 3112 64-bit Synaptics Pointing Enhance Service Synaptics Incorporated (Verified) Synaptics Incorporated
LPlatSvc.exe < 0.01 1,916 K 5,900 K 4636 Lenovo Platform Service Lenovo. (Verified) Lenovo
ZeroConfigService.exe 6,104 K 15,120 K 3368 Intel® PROSet/Wireless Zero Configure Service Intel® Corporation (Verified) Intel® Wireless Connectivity Solutions
WmiPrvSE.exe 4,504 K 11,104 K 4356 WMI Provider Host Microsoft Corporation (Verified) Microsoft Windows
wlanext.exe 6,884 K 17,108 K 2036 Windows Wireless LAN 802.11 Extensibility Framework Microsoft Corporation (Verified) Microsoft Windows
wisptis.exe 3,548 K 8,404 K 1728 Microsoft Pen and Touch Input Component Microsoft Corporation (Verified) Microsoft Windows
winlogon.exe 3,368 K 8,196 K 1116 Windows Logon Application Microsoft Corporation (Verified) Microsoft Windows
wininit.exe 1,952 K 5,196 K 712 Windows Start-Up Application Microsoft Corporation (Verified) Microsoft Windows
vcamsvc.exe 14,120 K 11,808 K 2988 Lenovo Virtual Camera Controller Lenovo Group Limited (Verified) Lenovo
unsecapp.exe 1,864 K 5,656 K 4812 Sink to receive asynchronous callbacks for WMI client application Microsoft Corporation (Verified) Microsoft Windows
unsecapp.exe 2,212 K 6,724 K 5500 Sink to receive asynchronous callbacks for WMI client application Microsoft Corporation (Verified) Microsoft Windows
UNCServer.exe 16,428 K 1,152 K 8460 UNCServer (Verified) Lenovo
UI0Detect.exe 2,452 K 7,360 K 4380 Interactive services detection Microsoft Corporation (Verified) Microsoft Windows
TpShocks.exe 2,504 K 804 K 4200 Active Protection System Lenovo. (Verified) Lenovo
TPONSCR.exe 2,364 K 8,940 K 4620 On screen display drawer Lenovo Group Limited (Verified) Lenovo
TPKNRSVC.exe 1,088 K 3,636 K 2964 Microphone volume control service Lenovo Group Limited (Verified) Lenovo
TPHKSVC.exe 1,612 K 5,012 K 3184 On screen display Fn+Fx handler Lenovo Group Limited (Verified) LENOVO
tphkload.exe 7,612 K 9,864 K 3680 ThinkPad Message Client Loader Lenovo Group Limited (Verified) Lenovo
taskeng.exe 2,044 K 5,748 K 7468 Task Scheduler Engine Microsoft Corporation (Verified) Microsoft Windows
taskeng.exe 2,832 K 7,620 K 5672 Task Scheduler Engine Microsoft Corporation (Verified) Microsoft Windows
TabTip32.exe 844 K 3,176 K 3568 Tablet PC Input Panel Helper Microsoft Corporation (Verified) Microsoft Windows
TabTip.exe 5,748 K 14,280 K 2856 Tablet PC Input Panel Accessory Microsoft Corporation (Verified) Microsoft Windows
SynTPLpr.exe 2,100 K 5,780 K 6172 TouchPad Driver Helper Application Synaptics Incorporated (Verified) Synaptics Incorporated
SynTPHelper.exe 1,484 K 4,256 K 2668 Synaptics Pointing Device Helper Synaptics Incorporated (Verified) Synaptics Incorporated
svchost.exe 4,980 K 10,528 K 916 Host Process for Windows Services Microsoft Corporation (Verified) Microsoft Windows
svchost.exe 7,064 K 13,732 K 2528 Host Process for Windows Services Microsoft Corporation (Verified) Microsoft Windows
svchost.exe 5,448 K 9,596 K 848 Host Process for Windows Services Microsoft Corporation (Verified) Microsoft Windows
svchost.exe 14,508 K 16,932 K 2112 Host Process for Windows Services Microsoft Corporation (Verified) Microsoft Windows
svchost.exe 3,616 K 7,376 K 1944 Host Process for Windows Services Microsoft Corporation (Verified) Microsoft Windows
svchost.exe 4,860 K 8,476 K 2364 Host Process for Windows Services Microsoft Corporation (Verified) Microsoft Windows
svchost.exe 1,852 K 5,228 K 4884 Host Process for Windows Services Microsoft Corporation (Verified) Microsoft Windows
svchost.exe 4,724 K 8,932 K 1424 Host Process for Windows Services Microsoft Corporation (Verified) Microsoft Windows
svchost.exe 2,096 K 6,196 K 3092 Host Process for Windows Services Microsoft Corporation (Verified) Microsoft Windows
svchost.exe 2,392 K 6,364 K 4932 Host Process for Windows Services Microsoft Corporation (Verified) Microsoft Windows
SUService.exe 1,836 K 5,796 K 3044 IBM Notes/Domino IBM Corp (Verified) International Business Machines Corporation
SUService.exe 8,984 K 15,780 K 8356 Lenovo System Update Service (Verified) Lenovo
smss.exe 584 K 1,340 K 460 Windows Session Manager Microsoft Corporation (Verified) Microsoft Windows
shtctky.exe 2,048 K 5,728 K 4576 ThinkPad Message Receiver for Shortcut Hot Keys Lenovo Group Limited (Verified) Lenovo
services.exe 7,612 K 11,788 K 768 Services and Controller app Microsoft Corporation (Verified) Microsoft Windows
ScreenConnect.WindowsClient.exe 29,384 K 36,756 K 2836 ScreenConnect Client ScreenConnect Software (Verified) ScreenConnect Software
SCHTASK.EXE 2,644 K 6,620 K 8188 Power Manager Power Agenda Lenovo Group Limited (Verified) LENOVO
rundll32.exe 4,032 K 13,740 K 6996 Windows host process (Rundll32) Microsoft Corporation (Verified) Microsoft Windows
rundll32.exe 6,788 K 18,352 K 7556 Windows host process (Rundll32) Microsoft Corporation (Verified) Microsoft Windows
rundll32.exe 1,668 K 4,416 K 5300 Windows host process (Rundll32) Microsoft Corporation (Verified) Microsoft Windows
rundll32.exe 1,252 K 4,196 K 7424 Windows host process (Rundll32) Microsoft Corporation (Verified) Microsoft Windows
RegSrvc.exe 1,980 K 6,824 K 2520 Intel® PROSet/Wireless Registry Service Intel® Corporation (Verified) Intel® Wireless Connectivity Solutions
RAVCpl64.exe 8,768 K 1,192 K 8076 Realtek HD Audio Manager Realtek Semiconductor (Verified) Realtek Semiconductor Corp
RAVBg64.exe 14,764 K 1,016 K 8024 HD Audio Background Process Realtek Semiconductor (Verified) Realtek Semiconductor Corp
RAVBg64.exe 14,740 K 972 K 6104 HD Audio Background Process Realtek Semiconductor (Verified) Realtek Semiconductor Corp
QuickControlService.exe 6,828 K 10,376 K 4316 Lenovo QuickControl Service Lenovo Group Limited (Verified) LENOVO
QuickControl.exe 12,396 K 15,588 K 4228 Lenovo QuickControl Resident Lenovo Group Limited (Verified) LENOVO
PWMDBSVC.exe 2,268 K 7,428 K 8208 Power Manager Dynamic Brightness Control Service Lenovo (Verified) LENOVO
procexp.exe 2,352 K 7,532 K 7648 Sysinternals Process Explorer Sysinternals - www.sysinternals.com (Verified) Microsoft Corporation
PrintIsolationHost.exe 26,124 K 36,344 K 4716 PrintIsolationHost Microsoft Corporation (Verified) Microsoft Windows
PresentationFontCache.exe 30,256 K 23,972 K 2556 PresentationFontCache.exe Microsoft Corporation (Verified) Microsoft Corporation
opvapp.exe 3,044 K 7,796 K 2164 opvapp.exe %CFullName% (No signature was present in the subject) %CFullName%
obexsrv.exe 3,116 K 7,464 K 6420 Bluetooth OBEX Service Motorola Solutions, Inc. (Verified) Motorola Solutions Inc.
ntmulti.exe 1,216 K 4,252 K 2152 IBM Notes/Domino IBM Corp (Verified) International Business Machines Corporation
nsd.exe 11,472 K 6,404 K 2772 wnsd IBM (Verified) International Business Machines Corporation
mediasrv.exe 4,856 K 9,024 K 6284 Bluetooth Media Service Motorola Solutions, Inc. (Verified) Motorola Solutions Inc.
lvvsst.exe 2,284 K 6,308 K 3020 Auto Scroll Start Service Lenovo Group Limited (Verified) Lenovo
LSCNotify.exe 1,376 K 688 K 8212 Lenovo Solution Center Notifications Lenovo (Verified) Lenovo
LenovoDiscoverySvc.exe 18,576 K 18,400 K 6892 Lenovo Peer Connect Service Lenovo (Verified) Lenovo(Japan)Ltd.
jusched.exe 4,572 K 11,772 K 7620 Java Update Scheduler Oracle Corporation (Verified) Oracle America
jhi_service.exe 1,412 K 4,728 K 6824 Intel® Dynamic Application Loader Host Interface Intel Corporation (Verified) Intel Corporation - Embedded Subsystems and IP Blocks Group
iusb3mon.exe 1,840 K 5,844 K 7372 iusb3mon Intel Corporation (Verified) Intel® USB eXtensible Host Controller Drivers
InputPersonalization.exe 2,880 K 860 K 2160 Input Personalization Server Microsoft Corporation (Verified) Microsoft Windows
igfxHK.exe 2,864 K 8,608 K 6672 igfxHK Module Intel Corporation (Verified) Intel® pGFX
igfxEM.exe 4,004 K 10,576 K 6648 igfxEM Module Intel Corporation (Verified) Intel® pGFX
igfxCUIService.exe 2,520 K 7,896 K 1548 igfxCUIService Module Intel Corporation (Verified) Intel® pGFX
DisplayLinkUserAgent.exe 3,528 K 7,252 K 1804 DisplayLinkUserAgent Application DisplayLink Corp. (Verified) DISPLAYLINK
devmonsrv.exe 3,580 K 8,060 K 6212 Bluetooth Device Monitor Motorola Solutions, Inc. (Verified) Motorola Solutions Inc.
csrss.exe 2,568 K 5,492 K 664 Client Server Runtime Process Microsoft Corporation (Verified) Microsoft Windows
CoreService.exe 2,672 K 7,572 K 1072 Core Service Lenovo (Verified) Softex Incorporated
conhost.exe 1,084 K 3,120 K 2044 Console Window Host Microsoft Corporation (Verified) Microsoft Windows
conhost.exe 1,084 K 3,140 K 3904 Console Window Host Microsoft Corporation (Verified) Microsoft Windows
conhost.exe 1,460 K 3,876 K 3416 Console Window Host Microsoft Corporation (Verified) Microsoft Windows
conhost.exe 1,460 K 3,924 K 5360 Console Window Host Microsoft Corporation (Verified) Microsoft Windows
CNTAoSMgr.exe 1,808 K 4,440 K 3892 Trend Micro OfficeScan Client Plug-in Service Manager Trend Micro Inc. (Verified) Trend Micro
cmd.exe 2,316 K 528 K 3564 Windows Command Processor Microsoft Corporation (Verified) Microsoft Windows
CamMute.exe 1,616 K 5,352 K 2908 Camera Mute Control Service for Lenovo Lenovo Group Limited (Verified) Lenovo
armsvc.exe 1,236 K 4,260 K 2304 Adobe Acrobat Update Service Adobe Systems Incorporated (Verified) Adobe Systems
 
 
Image Name                     PID Services                                    
========================= ======== ============================================
System Idle Process              0 N/A                                         
System                           4 N/A                                         
smss.exe                       460 N/A                                         
csrss.exe                      664 N/A                                         
wininit.exe                    712 N/A                                         
csrss.exe                      732 N/A                                         
services.exe                   768 N/A                                         
lsass.exe                      788 EFS, KeyIso, Netlogon, SamSs, VaultSvc      
lsm.exe                        796 N/A                                         
svchost.exe                    916 DcomLaunch, PlugPlay, Power                 
ibmpmsvc.exe                  1004 IBMPMSVC                                    
LPlatSvc.exe                   164 LPlatSvc                                    
svchost.exe                    848 RpcEptMapper, RpcSs                         
CoreService.exe               1072 CoreService                                 
winlogon.exe                  1116 N/A                                         
svchost.exe                   1232 AudioSrv, Dhcp, eventlog, lmhosts, wscsvc   
svchost.exe                   1280 AudioEndpointBuilder, CscService, hidserv,  
                                   IPBusEnum, Netman, PcaSvc, SysMain,         
                                   TabletInputService, TrkWks, UxSms,          
                                   WdiSystemHost, Wlansvc, wudfsvc             
svchost.exe                   1304 EventSystem, fdPHost, FontCache, netprofm,  
                                   nsi, W32Time, WdiServiceHost,               
                                   WinHttpAutoProxySvc                         
svchost.exe                   1348 AeLookupSvc, BITS, Browser, EapHost,        
                                   IKEEXT, iphlpsvc, LanmanServer, MMCSS,      
                                   ProfSvc, Schedule, SENS, ShellHWDetection,  
                                   Themes, Winmgmt, wuauserv                   
svchost.exe                   1424 gpsvc                                       
igfxCUIService.exe            1548 igfxCUIService2.0.0.0                       
DisplayLinkManager.exe        1588 DisplayLinkService                          
wisptis.exe                   1728 N/A                                         
WUDFHost.exe                  1748 N/A                                         
DisplayLinkUserAgent.exe      1804 N/A                                         
svchost.exe                   1944 Dnscache                                    
wlanext.exe                   2036 N/A                                         
conhost.exe                   2044 N/A                                         
spoolsv.exe                   2020 Spooler                                     
svchost.exe                   2112 BFE, DPS, MpsSvc                            
opvapp.exe                    2164 N/A                                         
svchost.exe                   2212 CryptSvc, LanmanWorkstation, NlaSvc         
SASCore64.exe                 2276 !SASCORE                                    
armsvc.exe                    2304 AdobeARMservice                             
svchost.exe                   2364 DiagTrack                                   
EvtEng.exe                    2396 EvtEng                                      
ExpressCache.exe              2428 ExpressCache                                
svchost.exe                   2528 FDResPub, SSDPSRV, upnphost                 
PresentationFontCache.exe     2556 FontCache3.0.0.0                            
nsd.exe                       2772 IBM Notes Diagnostics                       
IntelTechnologyAccessServ     2864 Intel® TechnologyAccessService            
CamMute.exe                   2908 LENOVO.CAMMUTE                              
TPKNRSVC.exe                  2964 LENOVO.TPKNRSVC                             
vcamsvc.exe                   2988 LENOVO.TVTVCAM                              
lvvsst.exe                    3020 Lenovo.VIRTSCRLSVC                          
SUService.exe                 3044 LNSUSvc                                     
ntmulti.exe                   2152 Multi-user Cleanup Service                  
NTRTScan.exe                  2340 ntrtscan                                    
RegSrvc.exe                   2520 RegSrvc                                     
ScreenConnect.ClientServi     2820 ScreenConnect Client (2983e16809ce38ec)     
svchost.exe                   3092 stisvc                                      
SynTPEnhService.exe           3112 SynTPEnhService                             
TPHKSVC.exe                   3184 TPHKSVC                                     
valWBFPolicyService.exe       3256 valWBFPolicyService                         
svchost.exe                   3336 WinDefend                                   
ZeroConfigService.exe         3368 ZeroConfigService                           
TmListen.exe                  3496 tmlisten                                    
tphkload.exe                  3680 TPHKLOAD                                    
CNTAoSMgr.exe                 3892 N/A                                         
conhost.exe                   3904 N/A                                         
QuickControlService.exe       4316 QuickControlService                         
UI0Detect.exe                 4380 UI0Detect                                   
PrintIsolationHost.exe        4716 N/A                                         
unsecapp.exe                  4812 N/A                                         
svchost.exe                   4884 bthserv                                     
svchost.exe                   4932 PolicyAgent                                 
WmiPrvSE.exe                  4356 N/A                                         
WmiPrvSE.exe                  4348 N/A                                         
ScreenConnect.WindowsClie     5404 N/A                                         
taskhost.exe                  4240 N/A                                         
virtscrl.exe                  4632 N/A                                         
LPlatSvc.exe                  4636 N/A                                         
ScreenConnect.WindowsClie     2836 N/A                                         
SynTPEnh.exe                  4244 N/A                                         
QuickControl.exe              4228 N/A                                         
wisptis.exe                   3460 N/A                                         
conhost.exe                   3416 N/A                                         
TabTip.exe                    2856 N/A                                         
rundll32.exe                  5300 N/A                                         
TabTip32.exe                  3568 N/A                                         
TPONSCR.exe                   4620 N/A                                         
shtctky.exe                   4576 N/A                                         
SynTPHelper.exe               2668 N/A                                         
taskeng.exe                   5672 N/A                                         
TpShocks.exe                  4200 N/A                                         
unsecapp.exe                  5500 N/A                                         
SynTPLpr.exe                  6172 N/A                                         
SynLenovoHelper.exe           6180 N/A                                         
devmonsrv.exe                 6212 Bluetooth Device Monitor                    
mediasrv.exe                  6284 Bluetooth Media Service                     
obexsrv.exe                   6420 Bluetooth OBEX Service                      
jhi_service.exe               6824 jhi_service                                 
LenovoDiscoverySvc.exe        6892 lnvDiscoveryWinSvc                          
wmpnetwk.exe                  7024 WMPNetworkSvc                               
SearchIndexer.exe             7072 WSearch                                     
dwm.exe                       6576 N/A                                         
explorer.exe                  6604 N/A                                         
igfxEM.exe                    6648 N/A                                         
igfxHK.exe                    6672 N/A                                         
RtsCM64.exe                   6584 N/A                                         
TpKnrres.exe                  6656 N/A                                         
rundll32.exe                  6996 N/A                                         
SUPERANTISPYWARE.EXE          7212 N/A                                         
iusb3mon.exe                  7372 N/A                                         
rundll32.exe                  7424 N/A                                         
PccNTMon.exe                  7532 N/A                                         
IdeaMax Server.exe            7548 N/A                                         
rundll32.exe                  7556 N/A                                         
jusched.exe                   7620 N/A                                         
SCHTASK.EXE                   8188 N/A                                         
RAVCpl64.exe                  8076 N/A                                         
RAVBg64.exe                   8024 N/A                                         
RAVBg64.exe                   6104 N/A                                         
LSCNotify.exe                 8212 N/A                                         
SUService.exe                 8356 SUService                                   
UNCServer.exe                 8460 N/A                                         
PWMDBSVC.exe                  8208 Power Manager DBC Service                   
InputPersonalization.exe      2160 N/A                                         
cmd.exe                       3564 N/A                                         
conhost.exe                   5360 N/A                                         
LSB.exe                       5012 N/A                                         
taskeng.exe                   7468 N/A                                         
audiodg.exe                   8416 N/A                                         
cmd.exe                       8536 N/A                                         
conhost.exe                   8764 N/A                                         
tasklist.exe                  7916 N/A                                         
 
 
 
 
 

Attached Files


  • 0

#4
RKinner

RKinner

    Malware Expert

  • Expert
  • 20,885 posts
  • MVP

Are you using ScreenConnect to remote into this PC?  If not please uninstall it.

 

Speccy shows two drives, one a small  SSD.  Windows is complaining about one of your drives. 

Log: 'System' Date/Time: 18/06/2018 10:25:32 PM
Type: Error Category: 0
Event: 7 Source: Disk
The device, \Device\Harddisk1\DR1, has a bad block.
 
Their numbering is difficult to decipher.
 

Probably not the SSD.  Worth running a disk check on the C: drive:

1. Double-click My Computer, and then right-click the hard disk that you want to check. C:
2. Click Properties, and then click Tools.
3. Under Error-checking, click Check Now. A dialog box that shows the Check disk options is displayed,
4. Check both boxes and then click Start.
You will receive the following message:
The disk check could not be performed because the disk check utility needs exclusive access to some Windows files on the disk. These files can be accessed by restarting Windows. Do you want to schedule the disk check to occur the next time you restart the computer?
Click Yes to schedule the disk check, but don't restart yet.

Right click on (My) Computer and select Manage (Continue) Then the Event Viewer. Next select Windows Logs.  Right click on System and Clear Log, Clear. Repeat for Application.

 

 

Reboot.

 

The disk check will run and will probably take an hour or more to finish.

 

Run VEW again as before.

 

Is the PC normally part of a domain?


  • 0

#5
bhzendner

bhzendner

    Member

  • Topic Starter
  • Member
  • PipPipPip
  • 226 posts

Small SSD not being used.

Yes, I am using ScreenConnect to connect but if necessary can remove.

Looks like it was or is a part of a domain?

 

Vino's Event Viewer v01c run on Windows 2008 in English
Report run at 20/06/2018 3:47:13 PM
 
Note: All dates below are in the format dd/mm/yyyy
 
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
'Application' Log - Critical Type
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
'Application' Log - Error Type
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Log: 'Application' Date/Time: 20/06/2018 9:36:05 PM
Type: Error Category: 0
Event: 10 Source: Microsoft-Windows-WMI
Event filter with query "SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 99" could not be reactivated in namespace "//./root/CIMV2" because of error 0x80041003. Events cannot be delivered through this filter until the problem is corrected.
 
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
'Application' Log - Warning Type
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Log: 'Application' Date/Time: 20/06/2018 8:00:22 PM
Type: Warning Category: 0
Event: 1530 Source: Microsoft-Windows-User Profiles Service
Windows detected your registry file is still in use by other applications or services. The file will be unloaded now. The applications or services that hold your registry file may not function properly afterwards.     DETAIL -   5 user registry handles leaked from \Registry\User\S-1-5-21-345086361-1354177263-1882197541-10279:
Process 788 (\Device\HarddiskVolume1\Windows\System32\lsass.exe) has opened key \REGISTRY\USER\S-1-5-21-345086361-1354177263-1882197541-10279
Process 788 (\Device\HarddiskVolume1\Windows\System32\lsass.exe) has opened key \REGISTRY\USER\S-1-5-21-345086361-1354177263-1882197541-10279
Process 788 (\Device\HarddiskVolume1\Windows\System32\lsass.exe) has opened key \REGISTRY\USER\S-1-5-21-345086361-1354177263-1882197541-10279\Software\Microsoft\SystemCertificates\Disallowed
Process 788 (\Device\HarddiskVolume1\Windows\System32\lsass.exe) has opened key \REGISTRY\USER\S-1-5-21-345086361-1354177263-1882197541-10279\Software\Microsoft\SystemCertificates\My
Process 788 (\Device\HarddiskVolume1\Windows\System32\lsass.exe) has opened key \REGISTRY\USER\S-1-5-21-345086361-1354177263-1882197541-10279\Software\Microsoft\SystemCertificates\CA
 
 
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
'System' Log - Critical Type
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
'System' Log - Error Type
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Log: 'System' Date/Time: 20/06/2018 10:45:30 PM
Type: Error Category: 0
Event: 1030 Source: Microsoft-Windows-GroupPolicy
The processing of Group Policy failed. Windows attempted to retrieve new Group Policy settings for this user or computer. Look in the details tab for error code and description. Windows will automatically retry this operation at the next refresh cycle. Computers joined to the domain must have proper name resolution and network connectivity to a domain controller for discovery of new Group Policy objects and settings. An event will be logged when Group Policy is successful.
 
Log: 'System' Date/Time: 20/06/2018 10:11:04 PM
Type: Error Category: 0
Event: 8032 Source: BROWSER
The browser service has failed to retrieve the backup list too many times on transport \Device\NetBT_Tcpip_{B56F0B4F-5A87-4D0B-9726-C877E2FC4722}. The backup browser is stopping.
 
Log: 'System' Date/Time: 20/06/2018 9:37:05 PM
Type: Error Category: 0
Event: 10016 Source: Microsoft-Windows-DistributedCOM
The application-specific permission settings do not grant Local Launch permission for the COM Server application with CLSID  {C97FCC79-E628-407D-AE68-A06AD6D8B4D1}  and APPID  {344ED43D-D086-4961-86A6-1106F4ACAD9B}  to the user NT AUTHORITY\SYSTEM SID (S-1-5-18) from address LocalHost (Using LRPC). This security permission can be modified using the Component Services administrative tool.
 
Log: 'System' Date/Time: 20/06/2018 9:35:49 PM
Type: Error Category: 0
Event: 1030 Source: Microsoft-Windows-GroupPolicy
The processing of Group Policy failed. Windows attempted to retrieve new Group Policy settings for this user or computer. Look in the details tab for error code and description. Windows will automatically retry this operation at the next refresh cycle. Computers joined to the domain must have proper name resolution and network connectivity to a domain controller for discovery of new Group Policy objects and settings. An event will be logged when Group Policy is successful.
 
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
'System' Log - Warning Type
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Log: 'System' Date/Time: 20/06/2018 10:09:57 PM
Type: Warning Category: 0
Event: 8021 Source: BROWSER
The browser service was unable to retrieve a list of servers from the browser master \\LENOVO-KM-1396 on the network \Device\NetBT_Tcpip_{B56F0B4F-5A87-4D0B-9726-C877E2FC4722}.    Browser master: \\LENOVO-KM-1396  Network: \Device\NetBT_Tcpip_{B56F0B4F-5A87-4D0B-9726-C877E2FC4722}    This event may be caused by a temporary loss of network connectivity. If this message appears again, verify that the server is still connected to the network. The return code is in the Data text box.
 
Log: 'System' Date/Time: 20/06/2018 9:36:17 PM
Type: Warning Category: 7
Event: 37 Source: Microsoft-Windows-Kernel-Processor-Power
The speed of processor 0 in group 0 is being limited by system firmware. The processor has been in this reduced performance state for 71 seconds since the last report.
 
Log: 'System' Date/Time: 20/06/2018 9:36:17 PM
Type: Warning Category: 7
Event: 37 Source: Microsoft-Windows-Kernel-Processor-Power
The speed of processor 3 in group 0 is being limited by system firmware. The processor has been in this reduced performance state for 71 seconds since the last report.
 
Log: 'System' Date/Time: 20/06/2018 9:36:17 PM
Type: Warning Category: 7
Event: 37 Source: Microsoft-Windows-Kernel-Processor-Power
The speed of processor 2 in group 0 is being limited by system firmware. The processor has been in this reduced performance state for 71 seconds since the last report.
 
Log: 'System' Date/Time: 20/06/2018 9:36:17 PM
Type: Warning Category: 7
Event: 37 Source: Microsoft-Windows-Kernel-Processor-Power
The speed of processor 1 in group 0 is being limited by system firmware. The processor has been in this reduced performance state for 71 seconds since the last report.
 
Log: 'System' Date/Time: 20/06/2018 9:35:09 PM
Type: Warning Category: 212
Event: 219 Source: Microsoft-Windows-Kernel-PnP
The driver \Driver\WUDFRd failed to load for the device USB\VID_138A&PID_0017\0de61c0d575d.
 
Log: 'System' Date/Time: 20/06/2018 8:00:33 PM
Type: Warning Category: 0
Event: 4001 Source: Microsoft-Windows-WLAN-AutoConfig
WLAN AutoConfig service has successfully stopped. 
 
Log: 'System' Date/Time: 20/06/2018 8:00:32 PM
Type: Warning Category: 0
Event: 10002 Source: Microsoft-Windows-WLAN-AutoConfig
WLAN Extensibility Module has stopped.  Module Path: C:\Windows\System32\IWMSSvc.dll 

  • 0

#6
RKinner

RKinner

    Malware Expert

  • Expert
  • 20,885 posts
  • MVP
Log: 'Application' Date/Time: 20/06/2018 8:00:22 PM
Type: Warning Category: 0
Event: 1530 Source: Microsoft-Windows-User Profiles Service
Windows detected your registry file is still in use by other applications or services. The file will be unloaded now. The applications or services that hold your registry file may not function properly afterwards.     DETAIL -   5 user registry handles leaked from \Registry\User\S-1-5-21-345086361-1354177263-1882197541-10279:
Process 788 (\Device\HarddiskVolume1\Windows\System32\lsass.exe) has opened key \REGISTRY\USER\S-1-5-21-345086361-1354177263-1882197541-10279
Process 788 (\Device\HarddiskVolume1\Windows\System32\lsass.exe) has opened key \REGISTRY\USER\S-1-5-21-345086361-1354177263-1882197541-10279
Process 788 (\Device\HarddiskVolume1\Windows\System32\lsass.exe) has opened key \REGISTRY\USER\S-1-5-21-345086361-1354177263-1882197541-10279\Software\Microsoft\SystemCertificates\Disallowed
Process 788 (\Device\HarddiskVolume1\Windows\System32\lsass.exe) has opened key \REGISTRY\USER\S-1-5-21-345086361-1354177263-1882197541-10279\Software\Microsoft\SystemCertificates\My
Process 788 (\Device\HarddiskVolume1\Windows\System32\lsass.exe) has opened key \REGISTRY\USER\S-1-5-21-345086361-1354177263-1882197541-10279\Software\Microsoft\SystemCertificates\CA

 

 

 
This is odd because FRST does not see a user with this ID: S-1-5-21-345086361-1354177263-1882197541-10279
 
==================== Accounts: =============================
 
admin (S-1-5-21-201262395-2737818422-147992042-1000 - Administrator - Enabled) => C:\Users\admin
Administrator (S-1-5-21-201262395-2737818422-147992042-500 - Administrator - Disabled)
Guest (S-1-5-21-201262395-2737818422-147992042-501 - Limited - Disabled)
Katherine Hatcher (S-1-5-21-201262395-2737818422-147992042-1004 - Administrator - Enabled) => C:\Users\Katherine Hatcher
Setup (S-1-5-21-201262395-2737818422-147992042-1003 - Administrator - Enabled) => C:\Users\Setup

 

Copy the next 5 lines:

set
net user > \junk.txt
reg query HKEY_USERS >> \junk.txt
reg query HKEY_USERS\S-1-5-21-345086361-1354177263-1882197541-10279\Environment >> \junk.txt
notepad \junk.txt

 

Start, All Programs, Accessories then right click on Command Prompt and Run as Administrator.  Right click and Paste (or Edit then Paste) and the copied lines should appear.  Hit Enter if notepad does not open.  Copy and paste the text from notepad into a reply.

  • 0

#7
bhzendner

bhzendner

    Member

  • Topic Starter
  • Member
  • PipPipPip
  • 226 posts
 
User accounts for \\LENOVO-KM-1335
 
-------------------------------------------------------------------------------
admin                    Administrator            Guest                    
Katherine Hatcher        Setup                    
The command completed successfully.
 
 
HKEY_USERS\.DEFAULT
HKEY_USERS\S-1-5-19
HKEY_USERS\S-1-5-20
HKEY_USERS\S-1-5-21-345086361-1354177263-1882197541-10279
HKEY_USERS\S-1-5-21-345086361-1354177263-1882197541-10279_Classes
HKEY_USERS\S-1-5-18
 
HKEY_USERS\S-1-5-21-345086361-1354177263-1882197541-10279\Environment
    TEMP    REG_EXPAND_SZ    %USERPROFILE%\AppData\Local\Temp
    TMP    REG_EXPAND_SZ    %USERPROFILE%\AppData\Local\Temp
    Path    REG_SZ    C:\Program Files\Intel\WiFi\bin\;C:\Program Files\Common Files\Intel\WirelessCommon\

  • 0

#8
RKinner

RKinner

    Malware Expert

  • Expert
  • 20,885 posts
  • MVP

Something funny going on here.  Normally there should be an entry in HKEY_USERS\S-1-5-21- for each of the accounts which is not disabled.  Instead we just see one which is not listed.  Expect something has hidden the normal accounts.  The unlisted account looks like it might have been created by intel for some installation purpose.

 

Let's reset the permissions on the registry.

 

try
Windows Repair all in one

http://www.tweaking....all_in_one.html

Download it and save it then run it.

 

They keep changing the interface but usually there are several steps where they want you to back up the registry and so on.  Skip to where they actually run the program.  The last time there were several preset versions.  Doesn't matter which you choose.  Before you run it uncheck everything but

 

Reset Registry Permissions

Then run it and after it finishes reboot and create the same junk file as before.  Let's see if it is any different.
 


  • 0

#9
bhzendner

bhzendner

    Member

  • Topic Starter
  • Member
  • PipPipPip
  • 226 posts

It gets stuck loading at 67%, when you click on it it gives you the option to switch, retry or cancel, if you switch then it get to 71% but can not get past that. Tried a reboot same result. Ran as Administrator, same result. 

 

Hang on, I got it to run by starting a second instance of the application, first one still stuck but second one appears to be running and going to town


Edited by bhzendner, 24 June 2018 - 05:29 PM.

  • 0

#10
RKinner

RKinner

    Malware Expert

  • Expert
  • 20,885 posts
  • MVP

Sometimes pausing your anti-virus or running in Safe Mode will help.


  • 0

#11
bhzendner

bhzendner

    Member

  • Topic Starter
  • Member
  • PipPipPip
  • 226 posts
 
User accounts for \\LENOVO-KM-1335
 
-------------------------------------------------------------------------------
admin                    Administrator            Guest                    
Katherine Hatcher        Setup                    
The command completed successfully.
 
 
HKEY_USERS\.DEFAULT
HKEY_USERS\S-1-5-19
HKEY_USERS\S-1-5-20
HKEY_USERS\S-1-5-21-345086361-1354177263-1882197541-10279
HKEY_USERS\S-1-5-21-345086361-1354177263-1882197541-10279_Classes
HKEY_USERS\S-1-5-18
 
HKEY_USERS\S-1-5-21-345086361-1354177263-1882197541-10279\Environment
    TEMP    REG_EXPAND_SZ    %USERPROFILE%\AppData\Local\Temp
    TMP    REG_EXPAND_SZ    %USERPROFILE%\AppData\Local\Temp
    Path    REG_SZ    C:\Program Files\Intel\WiFi\bin\;C:\Program Files\Common Files\Intel\WirelessCommon\
 
Looks like it is working!
What do you think?

  • 0

#12
RKinner

RKinner

    Malware Expert

  • Expert
  • 20,885 posts
  • MVP

Not really.  I would expect to see the 3 enabled account numbers that FRST reports.

 

==================== Accounts: =============================
 
admin (S-1-5-21-201262395-2737818422-147992042-1000 - Administrator - Enabled) => C:\Users\admin
Administrator (S-1-5-21-201262395-2737818422-147992042-500 - Administrator - Disabled)
Guest (S-1-5-21-201262395-2737818422-147992042-501 - Limited - Disabled)
Katherine Hatcher (S-1-5-21-201262395-2737818422-147992042-1004 - Administrator - Enabled) => C:\Users\Katherine Hatcher
Setup (S-1-5-21-201262395-2737818422-147992042-1003 - Administrator - Enabled) => C:\Users\Setup
 

 

 

and I don't know why we are seeing this one: S-1-5-21-345086361-1354177263-1882197541-10279

 

If you run reboot and run VEW again do you still get new Event: 1530 lsass errors? 


  • 0






Similar Topics

0 user(s) are reading this topic

0 members, 0 guests, 0 anonymous users

As Featured On:

Microsoft Yahoo BBC MSN PC Magazine Washington Post HP