Javascript Disabled Detected

You currently have javascript disabled. Several functions may not work. Please re-enable javascript to access full functionality.

exploit ROP I think, browsers get certificate error

Started by bhzendner , Jun 09 2018 07:20 PM

Malware ROP

Please log in to reply

#1
bhzendner

Posted 09 June 2018 - 07:20 PM

Member

Member
226 posts

Scan result of Farbar Recovery Scan Tool (FRST) (x64) Version: 06.06.2018 01

Ran by ah010073 (administrator) on LENOVO-KM-1335 (09-06-2018 18:15:33)

Running from C:\Users\ah010073\Downloads

Loaded Profiles: ah010073 (Available Profiles: admin & Setup & Katherine Hatcher & ah010073)

Platform: Windows 7 Professional Service Pack 1 (X64) Language: English (United States)

Internet Explorer Version 11 (Default browser: IE)

Boot Mode: Normal

Tutorial for Farbar Recovery Scan Tool: http://www.geekstogo...very-scan-tool/

==================== Processes (Whitelisted) =================

(If an entry is included in the fixlist, the process will be closed. The file will not be moved.)

(Lenovo.) C:\Windows\System32\ibmpmsvc.exe

(Lenovo.) C:\Windows\System32\LPlatSvc.exe

(Lenovo) C:\Program Files\Lenovo\Fingerprint Manager Pro\CoreService.exe

(Intel Corporation) C:\Windows\System32\igfxCUIService.exe

(DisplayLink Corp.) C:\Program Files\DisplayLink Core Software\DisplayLinkManager.exe

(Microsoft Corporation) C:\Windows\System32\wisptis.exe

(DisplayLink Corp.) C:\Program Files\DisplayLink Core Software\DisplayLinkUserAgent.exe

(Microsoft Corporation) C:\Windows\System32\wlanext.exe

(SUPERAntiSpyware.com) C:\Program Files\SUPERAntiSpyware\SASCore64.exe

(Intel® Corporation) C:\Program Files\Intel\WiFi\bin\EvtEng.exe

(Condusiv Technologies) C:\Program Files\Condusiv Technologies\ExpressCache\ExpressCache.exe

(Microsoft Corporation) C:\Windows\Microsoft.NET\Framework64\v3.0\WPF\PresentationFontCache.exe

(%CFullName%) C:\Program Files\Lenovo\Fingerprint Manager Pro\opvapp.exe

(IBM) C:\Program Files (x86)\IBM\Notes\nsd.exe

(Intel® Corporation) C:\Program Files\Intel Corporation\Intel® Technology Access\IntelTechnologyAccessService.exe

(Lenovo Group Limited) C:\Program Files\Lenovo\Communications Utility\CamMute.exe

(Lenovo Group Limited) C:\Program Files\Lenovo\Communications Utility\TPKNRSVC.exe

(Lenovo Group Limited) C:\Program Files\Lenovo\Communications Utility\vcamsvc.exe

(Lenovo Group Limited) C:\Program Files\Lenovo\VIRTSCRL\lvvsst.exe

(IBM Corp) C:\Program Files (x86)\IBM\Notes\SUService.exe

(IBM Corp) C:\Program Files (x86)\IBM\Notes\ntmulti.exe

(Trend Micro Inc.) C:\Program Files (x86)\Trend Micro\OfficeScan Client\NTRTScan.exe

(Intel® Corporation) C:\Program Files\Common Files\Intel\WirelessCommon\RegSrvc.exe

() C:\Program Files (x86)\ScreenConnect Client (2983e16809ce38ec)\ScreenConnect.ClientService.exe

(Synaptics Incorporated) C:\Program Files\Synaptics\SynTP\SynTPEnhService.exe

(Lenovo Group Limited) C:\Program Files\Lenovo\HOTKEY\TPHKSVC.exe

(Synaptics Incorporated) C:\Windows\System32\valWBFPolicyService.exe

(Intel® Corporation) C:\Program Files\Intel\WiFi\bin\ZeroConfigService.exe

(Malwarebytes) C:\Program Files\Malwarebytes\Anti-Malware\MBAMService.exe

(Trend Micro Inc.) C:\Program Files (x86)\Trend Micro\OfficeScan Client\TmListen.exe

(Lenovo Group Limited) C:\Program Files\Lenovo\HOTKEY\tphkload.exe

(Trend Micro Inc.) C:\Program Files (x86)\Trend Micro\OfficeScan Client\CNTAoSMgr.exe

(Microsoft Corporation) C:\Windows\System32\PrintIsolationHost.exe

(Microsoft Corporation) C:\Windows\System32\UI0Detect.exe

(Lenovo Group Limited) C:\Program Files (x86)\Lenovo\QuickControl\QuickControlService.exe

(ScreenConnect Software) C:\Program Files (x86)\ScreenConnect Client (2983e16809ce38ec)\ScreenConnect.WindowsClient.exe

(Motorola Solutions, Inc.) C:\Program Files (x86)\Intel\Bluetooth\devmonsrv.exe

(Motorola Solutions, Inc.) C:\Program Files (x86)\Intel\Bluetooth\mediasrv.exe

(Motorola Solutions, Inc.) C:\Program Files (x86)\Intel\Bluetooth\obexsrv.exe

(Intel Corporation) C:\Program Files (x86)\Intel\Intel® Management Engine Components\DAL\jhi_service.exe

(Lenovo) C:\Program Files\Lenovo\Lenovo Peer Connect\LenovoDiscoverySvc.exe

(Lenovo Group Limited) C:\Program Files\Lenovo\VIRTSCRL\virtscrl.exe

(Lenovo.) C:\Windows\System32\LPlatSvc.exe

(Malwarebytes) C:\Program Files\Malwarebytes\Anti-Malware\mbamtray.exe

(ScreenConnect Software) C:\Program Files (x86)\ScreenConnect Client (2983e16809ce38ec)\ScreenConnect.WindowsClient.exe

(Lenovo Group Limited) C:\Program Files (x86)\Lenovo\QuickControl\QuickControl.exe

(Microsoft Corporation) C:\Windows\System32\wisptis.exe

(Microsoft Corporation) C:\Windows\System32\rundll32.exe

(Nok Nok Labs Inc.) C:\Program Files (x86)\Nok Nok Labs\MFACUpdater\MFACUpdate.exe

(Synaptics Incorporated) C:\Program Files\Synaptics\SynTP\SynTPEnh.exe

(Lenovo Group Limited) C:\Program Files\Lenovo\HOTKEY\TPONSCR.exe

(Lenovo Group Limited) C:\Program Files\Lenovo\HOTKEY\shtctky.exe

(Lenovo.) C:\Windows\System32\TpShocks.exe

(Synaptics Incorporated) C:\Program Files\Synaptics\SynTP\SynTPHelper.exe

(Synaptics Incorporated) C:\Program Files\Synaptics\SynTP\SynTPLpr.exe

(Synaptics) C:\Program Files\Synaptics\SynTP\SynLenovoHelper.exe

(Intel Corporation) C:\Windows\System32\igfxEM.exe

(Intel Corporation) C:\Windows\System32\igfxHK.exe

(Realtek Semiconductor) C:\Program Files\Realtek\Audio\HDA\RAVBg64.exe

(Realtek Semiconductor) C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe

(Realtek Semiconductor Corp.) C:\Windows\RtsCM64.exe

(Lenovo Group Limited) C:\Program Files\Lenovo\Communications Utility\TpKnrres.exe

(Nok Nok Labs, Inc.) C:\Program Files\Nok Nok Labs\Multifactor Authentication Client\bin\mfac.exe

(Microsoft Corporation) C:\Windows\System32\rundll32.exe

(SUPERAntiSpyware) C:\Program Files\SUPERAntiSpyware\SUPERANTISPYWARE.EXE

(Intel Corporation) C:\Program Files (x86)\Intel\Intel® USB 3.0 3.1 eXtensible Host Controller Driver\Application\iusb3mon.exe

(Microsoft Corporation) C:\Windows\SysWOW64\rundll32.exe

(Trend Micro Inc.) C:\Program Files (x86)\Trend Micro\OfficeScan Client\PccNTMon.exe

(Microsoft Corporation) C:\Windows\System32\rundll32.exe

() C:\Program Files (x86)\IdeaMax Server\Driver\IdeaMax Server.exe

(Oracle Corporation) C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe

(Lenovo Group Limited) C:\Program Files (x86)\ThinkPad\Utilities\SCHTASK.EXE

(Lenovo) C:\Program Files\Lenovo\Lenovo Solution Center\LSCNotify.exe

() C:\Program Files (x86)\Lenovo\System Update\SUService.exe

() C:\Program Files (x86)\Lenovo\System Update\UNCServer.exe

(Microsoft Corporation) C:\Windows\System32\cmd.exe

(Lenovo Group Limited) C:\Users\ah010073\AppData\Local\Programs\Lenovo\Lenovo Service Bridge\LSB.exe

(Microsoft Corporation) C:\Program Files\Common Files\Microsoft Shared\ink\InputPersonalization.exe

(Lenovo) C:\Program Files (x86)\ThinkPad\Utilities\PWMDBSVC.exe

(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe

(Adobe Systems Incorporated) C:\Program Files (x86)\Adobe\Reader 11.0\Reader\reader_sl.exe

==================== Registry (Whitelisted) ===========================

(If an entry is included in the fixlist, the registry item will be restored to default or removed. The file will not be moved.)

HKLM\...\Run: [RtsCM] => C:\Windows\RTSCM64.EXE [195288 2014-12-09] (Realtek Semiconductor Corp.)

HKLM\...\Run: [LENOVO.TPKNRRES] => C:\Program Files\Lenovo\Communications Utility\TPKNRRES.exe [296664 2017-05-12] (Lenovo Group Limited)

HKLM\...\Run: [MFACApp] => C:\Program Files\Nok Nok Labs\Multifactor Authentication Client\bin\mfac.exe [5449544 2014-10-16] (Nok Nok Labs, Inc.)

HKLM\...\Run: [BTMTrayAgent] => rundll32.exe "C:\Program Files (x86)\Intel\Bluetooth\btmshellex.dll",TrayApp

HKLM\...\Run: [OfficeScanNT Monitor] => -HideWindow

HKLM-x32\...\Run: [IMSS] => C:\Program Files (x86)\Intel\Intel® Management Engine Components\IMSS\PrivacyIconClient.exe [1172256 2014-10-10] (Intel Corporation)

HKLM-x32\...\Run: [USB3MON] => C:\Program Files (x86)\Intel\Intel® USB 3.0 3.1 eXtensible Host Controller Driver\Application\iusb3mon.exe [299520 2017-03-28] (Intel Corporation)

HKLM-x32\...\Run: [PWMTRV] => rundll32 "C:\Program Files (x86)\ThinkPad\Utilities\PWMTR64V.DLL",PwrMgrBkGndMonitor

HKLM-x32\...\Run: [OfficeScanNT Monitor] => C:\Program Files (x86)\Trend Micro\OfficeScan Client\pccntmon.exe [1176880 2009-04-16] (Trend Micro Inc.)

HKLM-x32\...\Run: [IdeaMax Server] => C:\Program Files (x86)\IdeaMax Server\Driver\IdeaMax Server.exe [12172288 2013-06-18] ()

HKLM-x32\...\Run: [SunJavaUpdateSched] => C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe [588704 2018-03-28] (Oracle Corporation)

HKU\S-1-5-21-345086361-1354177263-1882197541-10279\...\Run: [McAfeeSafeConnect] => C:\Program Files (x86)\McAfee Safe Connect\McAfee Safe Connect.exe

HKU\S-1-5-21-345086361-1354177263-1882197541-10279\...\Run: [SUPERAntiSpyware] => C:\Program Files\SUPERAntiSpyware\SUPERAntiSpyware.exe [8887216 2018-06-08] (SUPERAntiSpyware)

HKU\S-1-5-21-345086361-1354177263-1882197541-10279\...\Winlogon: [Shell] C:\Windows\EXPLORER.EXE [3229696 2016-08-29] (Microsoft Corporation) <==== ATTENTION

Lsa: [Notification Packages] scecli C:\Program Files\TrueKey\McAfeeTrueKeyPasswordFilter

Startup: C:\Users\ah010073\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\bluejeans-helper.vbs [2017-04-21] ()

==================== Internet (Whitelisted) ====================

(If an item is included in the fixlist, if it is a registry item it will be removed or restored to default.)

Hosts: There are more than one entry in Hosts. See Hosts section of Addition.txt

Tcpip\Parameters: [DhcpNameServer] 10.0.0.1

Tcpip\..\Interfaces\{AF8D5019-11F7-4072-AD63-F3770B56EF97}: [DhcpNameServer] 10.0.0.1

Tcpip\..\Interfaces\{B56F0B4F-5A87-4D0B-9726-C877E2FC4722}: [DhcpNameServer] 10.128.0.122 10.128.0.123

Internet Explorer:

==================

HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://lenovo13.msn.com/?pc=LCTE

HKU\S-1-5-21-345086361-1354177263-1882197541-10279\Software\Microsoft\Internet Explorer\Main,Start Page = hxxps://direct.kdacentral.com/

HKU\S-1-5-21-345086361-1354177263-1882197541-10279\Software\Microsoft\Internet Explorer\Main,Secondary Start Pages = hxxps://vpn.kdaconnect.com/

SearchScopes: HKU\S-1-5-21-345086361-1354177263-1882197541-10279 -> {89B0AC89-AE64-4768-B92D-CDE93D715BD5} URL =

BHO: Java™ Plug-In SSV Helper -> {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} -> C:\Program Files\Java\jre1.8.0_171\bin\ssv.dll [2018-06-08] (Oracle Corporation)

BHO: Office Document Cache Handler -> {B4F3A835-0E21-4959-BA22-42B3008E02FF} -> C:\Program Files\Microsoft Office\Office15\URLREDIR.DLL [2014-01-21] (Microsoft Corporation)

BHO: Microsoft SkyDrive Pro Browser Helper -> {D0498E0A-45B7-42AE-A9AA-ABA463DBD3BF} -> C:\Program Files\Microsoft Office\Office15\GROOVEEX.DLL [2018-05-15] (Microsoft Corporation)

BHO: Java™ Plug-In 2 SSV Helper -> {DBC80044-A445-435b-BC74-9C25C1C588A9} -> C:\Program Files\Java\jre1.8.0_171\bin\jp2ssv.dll [2018-06-08] (Oracle Corporation)

BHO-x32: Telephony Toolbar Services -> {431A60E6-675F-4b9f-B3F0-66E0FECC8B34} -> C:\Program Files (x86)\Evolve IP\bin\BW_Assistant_Enterprise_IE_S.dll [2012-01-16] (BroadSoft® Australia Pty Ltd)

BHO-x32: Telephony Toolbar Call Control -> {8F1FF1A7-C048-4d6b-B052-56E42CE427CB} -> C:\Program Files (x86)\Evolve IP\bin\BW_Assistant_Enterprise_IE_CC.dll [2012-01-16] (BroadSoft® Australia Pty Ltd)

BHO-x32: Office Document Cache Handler -> {B4F3A835-0E21-4959-BA22-42B3008E02FF} -> C:\Program Files (x86)\Microsoft Office\Office15\URLREDIR.DLL [2014-01-23] (Microsoft Corporation)

BHO-x32: Microsoft SkyDrive Pro Browser Helper -> {D0498E0A-45B7-42AE-A9AA-ABA463DBD3BF} -> C:\Program Files (x86)\Microsoft Office\Office15\GROOVEEX.DLL [2018-05-15] (Microsoft Corporation)

Toolbar: HKLM-x32 - Telephony Toolbar Call Control - {6F6690B9-C5DB-4F08-8833-F2EF4DEE956B} - C:\Program Files (x86)\Evolve IP\bin\BW_Assistant_Enterprise_IE_CC.dll [2012-01-16] (BroadSoft® Australia Pty Ltd)

Toolbar: HKLM-x32 - Telephony Toolbar Services - {F10D927F-D3DF-4734-98AB-DD258253F5FD} - C:\Program Files (x86)\Evolve IP\bin\BW_Assistant_Enterprise_IE_S.dll [2012-01-16] (BroadSoft® Australia Pty Ltd)

DPF: HKLM {D27CDB6E-AE6D-11CF-96B8-444553540000} hxxps://fpdownload.macromedia.com/get/shockwave/cabs/flash/swflash.cab

DPF: HKLM-x32 {F27237D7-93C8-44C2-AC6E-D6057B9A918F} hxxps://vpn.kdaconnect.com/dana-cached/sc/JuniperSetupClient.cab

FireFox:

========

FF HKLM\...\Firefox\Extensions: [[email protected]] - C:\Program Files\Nok Nok Labs\Multifactor Authentication Client\bin\firefox\x86\FIDOaddon

FF Extension: (MFAC Extension) - C:\Program Files\Nok Nok Labs\Multifactor Authentication Client\bin\firefox\x86\FIDOaddon [2015-12-24] [Legacy] [not signed]

FF HKLM-x32\...\Firefox\Extensions: [[email protected]] - C:\Program Files\Nok Nok Labs\Multifactor Authentication Client\bin\firefox\x86\FIDOaddon

FF Plugin: @java.com/DTPlugin,version=11.171.2 -> C:\Program Files\Java\jre1.8.0_171\bin\dtplugin\npDeployJava1.dll [2018-06-08] (Oracle Corporation)

FF Plugin: @java.com/JavaPlugin,version=11.171.2 -> C:\Program Files\Java\jre1.8.0_171\bin\plugin2\npjp2.dll [2018-06-08] (Oracle Corporation)

FF Plugin: @microsoft.com/GENUINE -> disabled [No File]

FF Plugin: @Microsoft.com/NpCtrl,version=1.0 -> c:\Program Files\Microsoft Silverlight\5.1.50907.0\npctrl.dll [2017-05-03] ( Microsoft Corporation)

FF Plugin-x32: @intel-webapi.intel.com/Intel WebAPI ipt;version=4.0.56 -> C:\Program Files (x86)\Intel\Intel® Management Engine Components\IPT\npIntelWebAPIIPT.dll [2014-10-10] (Intel Corporation)

FF Plugin-x32: @intel-webapi.intel.com/Intel WebAPI updater -> C:\Program Files (x86)\Intel\Intel® Management Engine Components\IPT\npIntelWebAPIUpdater.dll [2014-10-10] (Intel Corporation)

FF Plugin-x32: @microsoft.com/GENUINE -> disabled [No File]

FF Plugin-x32: @Microsoft.com/NpCtrl,version=1.0 -> c:\Program Files (x86)\Microsoft Silverlight\5.1.50907.0\npctrl.dll [2017-05-03] ( Microsoft Corporation)

FF Plugin-x32: @microsoft.com/SharePoint,version=14.0 -> C:\PROGRA~2\MICROS~1\Office15\NPSPWRAP.DLL [2014-01-23] (Microsoft Corporation)

FF Plugin-x32: @tools.google.com/Google Update;version=3 -> C:\Program Files (x86)\Google\Update\1.3.33.17\npGoogleUpdate3.dll [2018-05-17] (Google Inc.)

FF Plugin-x32: @tools.google.com/Google Update;version=9 -> C:\Program Files (x86)\Google\Update\1.3.33.17\npGoogleUpdate3.dll [2018-05-17] (Google Inc.)

FF Plugin-x32: @update.noknok.com/Nok Nok Labs MFACUpdater;version=3 -> C:\Program Files (x86)\Nok Nok Labs\MFACUpdater\1.3.27.0\npGoogleUpdate3.dll [2015-12-24] (Nok Nok Labs Inc.)

FF Plugin-x32: @update.noknok.com/Nok Nok Labs MFACUpdater;version=9 -> C:\Program Files (x86)\Nok Nok Labs\MFACUpdater\1.3.27.0\npGoogleUpdate3.dll [2015-12-24] (Nok Nok Labs Inc.)

FF Plugin-x32: Adobe Reader -> C:\Program Files (x86)\Adobe\Reader 11.0\Reader\AIR\nppdf32.dll [2017-11-01] (Adobe Systems Inc.)

FF Plugin HKU\S-1-5-21-345086361-1354177263-1882197541-10279: @zoom.us/ZoomVideoPlugin -> C:\Users\ah010073\AppData\Roaming\Zoom\bin\npzoomplugin.dll [2016-07-13] (Zoom Video Communications, Inc.)

Chrome:

=======

CHR Profile: C:\Users\ah010073\AppData\Local\Google\Chrome\User Data\Default [2018-06-09]

CHR Extension: (Docs) - C:\Users\ah010073\AppData\Local\Google\Chrome\User Data\Default\Extensions\aohghmighlieiainnegkcijnfilokake [2017-10-16]

CHR Extension: (Google Drive) - C:\Users\ah010073\AppData\Local\Google\Chrome\User Data\Default\Extensions\apdfllckaahabafndbhieahigkjlhalf [2016-05-02]

CHR Extension: (YouTube) - C:\Users\ah010073\AppData\Local\Google\Chrome\User Data\Default\Extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo [2016-05-02]

CHR Extension: (Sheets) - C:\Users\ah010073\AppData\Local\Google\Chrome\User Data\Default\Extensions\felcaaldnbdncclmgdcncolpebgiejap [2017-10-16]

CHR Extension: (GoToMeeting Pro Screensharing) - C:\Users\ah010073\AppData\Local\Google\Chrome\User Data\Default\Extensions\gcgikpombjkodabhbdalkcdhmllafipp [2018-06-08]

CHR Extension: (Google Docs Offline) - C:\Users\ah010073\AppData\Local\Google\Chrome\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi [2016-05-02]

CHR Extension: () - C:\Users\ah010073\AppData\Local\Google\Chrome\User Data\Default\Extensions\mbgbpjganndfjjmlamggkkkjafblbahl [2018-06-08]

CHR Extension: (Chrome Web Store Payments) - C:\Users\ah010073\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda [2018-04-13]

CHR Extension: (Gmail) - C:\Users\ah010073\AppData\Local\Google\Chrome\User Data\Default\Extensions\pjkljhegncpnkpknbcohdijeoejaedia [2016-05-02]

CHR Extension: (Chrome Media Router) - C:\Users\ah010073\AppData\Local\Google\Chrome\User Data\Default\Extensions\pkedcjkdefgpdelpbcmbmeomcjbeemfm [2018-06-08]

CHR HKLM-x32\...\Chrome\Extension: [mbgbpjganndfjjmlamggkkkjafblbahl] - C:\Program Files\Nok Nok Labs\Multifactor Authentication Client\bin\Chrome\x86\FidoExtension.crx [2014-10-16]

==================== Services (Whitelisted) ====================

(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)

R2 !SASCORE; C:\Program Files\SUPERAntiSpyware\SASCORE64.EXE [173472 2017-01-30] (SUPERAntiSpyware.com)

R2 CoreService; C:\Program Files\Lenovo\Fingerprint Manager Pro\CoreService.exe [858896 2017-10-11] (Lenovo)

R2 DisplayLinkService; C:\Program Files\DisplayLink Core Software\DisplayLinkManager.exe [9954096 2014-03-31] (DisplayLink Corp.)

S3 DozeSvc; C:\Program Files (x86)\ThinkPad\Utilities\DZSVC64.EXE [326160 2016-04-14] (Lenovo.)

R2 ExpressCache; C:\Program Files\Condusiv Technologies\ExpressCache\ExpressCache.exe [828656 2013-11-18] (Condusiv Technologies)

R2 IBM Notes Diagnostics; C:\Program Files (x86)\IBM\Notes\nsd.exe [5164136 2013-10-15] (IBM)

S2 iBtSiva; C:\Program Files (x86)\Intel\Bluetooth\ibtsiva.exe [124520 2014-12-24] (Intel Corporation)

R2 igfxCUIService2.0.0.0; C:\Windows\system32\igfxCUIService.exe [373704 2017-09-21] (Intel Corporation)

S3 Intel® Capability Licensing Service TCP IP Interface; C:\Program Files\Intel\iCLS Client\SocketHeciServer.exe [887256 2014-05-13] (Intel® Corporation)

R2 Intel® TechnologyAccessService; C:\Program Files\Intel Corporation\Intel® Technology Access\IntelTechnologyAccessService.exe [95624 2015-01-23] (Intel® Corporation)

S3 iumsvc; C:\Program Files (x86)\Intel\Intel® Update Manager\bin\iumsvc.exe [177376 2016-08-12] (Intel Corporation)

R2 jhi_service; C:\Program Files (x86)\Intel\Intel® Management Engine Components\DAL\jhi_service.exe [158496 2014-10-10] (Intel Corporation)

S3 Lenovo EasyPlus Hotspot; C:\Program Files (x86)\Common Files\lenovo\easyplussdk\bin\EPHotspot64.exe [619776 2014-12-05] (Lenovo)

R2 LENOVO.TVTVCAM; C:\Program Files\Lenovo\Communications Utility\vcamsvc.exe [169176 2017-05-12] (Lenovo Group Limited)

R2 Lenovo.VIRTSCRLSVC; C:\Program Files\LENOVO\VIRTSCRL\lvvsst.exe [120400 2017-04-03] (Lenovo Group Limited)

S3 LenovoProdRegManager; C:\Program Files (x86)\Lenovo Registration\EngageService.exe [293416 2015-01-09] (Aviata, Inc.)

R2 LNSUSvc; C:\Program Files (x86)\IBM\Notes\SUService.exe [1654376 2013-10-15] (IBM Corp)

R2 lnvDiscoveryWinSvc; C:\Program Files\Lenovo\Lenovo Peer Connect\LenovoDiscoverySvc.exe [21552 2014-02-21] (Lenovo)

R2 LPlatSvc; C:\Windows\system32\LPlatSvc.exe [774736 2017-09-05] (Lenovo.)

S3 LSC.Services.SystemService; C:\Program Files\Lenovo\Lenovo Solution Center\App\LSC.Services.SystemService.exe [271128 2017-06-09] (Lenovo)

R2 MBAMService; C:\Program Files\Malwarebytes\Anti-Malware\mbamservice.exe [6541008 2018-05-09] (Malwarebytes)

R2 Multi-user Cleanup Service; C:\Program Files (x86)\IBM\Notes\ntmulti.exe [38504 2013-10-15] (IBM Corp)

S3 MyWiFiDHCPDNS; C:\Program Files\Intel\WiFi\bin\PanDhcpDns.exe [268968 2017-10-24] ()

R2 ntrtscan; C:\Program Files (x86)\Trend Micro\OfficeScan Client\ntrtscan.exe [1834800 2009-04-15] (Trend Micro Inc.)

S2 QuickControlMasterSvc; C:\Program Files (x86)\Lenovo\QuickControl\QuickControlMasterSvc.exe [61232 2014-12-05] (Lenovo Group Limited)

R3 QuickControlService; C:\Program Files (x86)\Lenovo\QuickControl\QuickControlService.exe [317224 2014-12-05] (Lenovo Group Limited)

R2 ScreenConnect Client (2983e16809ce38ec); C:\Program Files (x86)\ScreenConnect Client (2983e16809ce38ec)\ScreenConnect.ClientService.exe [90768 2017-06-14] ()

S3 ShareItSvc; C:\Program Files (x86)\Lenovo\SHAREit\Shareit.Service.exe [31176 2016-01-20] (SHAREit Technologies Co.Ltd)

R3 SUService; C:\Program Files (x86)\Lenovo\System Update\SUService.exe [23920 2017-12-12] ()

R2 SynTPEnhService; C:\Program Files\Synaptics\SynTP\SynTPEnhService.exe [270424 2017-05-26] (Synaptics Incorporated)

R2 tmlisten; C:\Program Files (x86)\Trend Micro\OfficeScan Client\tmlisten.exe [1867480 2009-04-21] (Trend Micro Inc.)

S3 TmProxy; C:\Program Files (x86)\Trend Micro\OfficeScan Client\TmProxy.exe [865032 2009-02-23] (Trend Micro Inc.)

R2 valWBFPolicyService; C:\Windows\system32\valWBFPolicyService.exe [95016 2016-08-01] (Synaptics Incorporated)

R2 WinDefend; C:\Program Files\Windows Defender\mpsvc.dll [1011712 2013-05-26] (Microsoft Corporation)

R2 ZeroConfigService; C:\Program Files\Intel\WiFi\bin\ZeroConfigService.exe [3758760 2017-10-24] (Intel® Corporation)

===================== Drivers (Whitelisted) ======================

(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)

S3 aftap0901; C:\Windows\System32\DRIVERS\aftap0901.sys [48624 2018-03-06] (The OpenVPN Project)

R3 btmaux; C:\Windows\System32\DRIVERS\btmaux.sys [153616 2016-04-11] (Motorola Solutions, Inc.)

R3 btmhsf; C:\Windows\System32\DRIVERS\btmhsf.sys [1447736 2014-11-24] (Motorola Solutions, Inc.)

S3 btmlehid; C:\Windows\system32\drivers\btmlehid.sys [83768 2014-11-05] (Motorola Solutions, Inc.)

R3 e1dexpress; C:\Windows\System32\DRIVERS\e1d62x64.sys [533496 2017-02-01] (Intel Corporation)

R1 ESProtectionDriver; C:\Windows\system32\drivers\mbae64.sys [152184 2018-04-26] (Malwarebytes)

R1 excfs; C:\Windows\System32\DRIVERS\excfs.sys [25840 2013-11-18] (Condusiv Technologies)

R0 excsd; C:\Windows\System32\DRIVERS\excsd.sys [117488 2013-11-18] (Condusiv Technologies)

R3 HHTHid; C:\Windows\System32\DRIVERS\HHTHid.sys [8192 2011-11-29] (HHT-Tech)

R3 HHTHid_ArtvhMouFiltr; C:\Windows\System32\DRIVERS\HHTHidMouFiltr.sys [7168 2011-11-29] (HHT-Tech)

R3 hhusb5; C:\Windows\System32\DRIVERS\hhusb5.sys [37944 2012-05-11] ()

R0 iaStorF; C:\Windows\System32\drivers\iaStorF.sys [31712 2016-06-16] (Intel Corporation)

R3 ibtusb; C:\Windows\System32\DRIVERS\ibtusb.sys [231152 2014-12-24] (Intel Corporation)

R2 MBAMChameleon; C:\Windows\System32\Drivers\MbamChameleon.sys [190696 2018-06-09] (Malwarebytes)

R3 MBAMFarflt; C:\Windows\System32\DRIVERS\farflt.sys [112864 2018-06-09] (Malwarebytes)

R3 MBAMProtection; C:\Windows\System32\DRIVERS\mbam.sys [44768 2018-06-09] (Malwarebytes)

R3 MBAMSwissArmy; C:\Windows\System32\Drivers\mbamswissarmy.sys [253664 2018-06-09] (Malwarebytes)

R3 MBAMWebProtection; C:\Windows\System32\DRIVERS\mwac.sys [94328 2018-06-09] (Malwarebytes)

R3 MEIx64; C:\Windows\System32\DRIVERS\TeeDriverx64.sys [129312 2014-10-10] (Intel Corporation)

R1 ndisrd; C:\Windows\System32\DRIVERS\ndisrfl.sys [41176 2014-10-30] (Intel Corporation)

R3 NETwNs64; C:\Windows\System32\DRIVERS\Netwsw04.sys [3472392 2017-10-29] (Intel Corporation)

R1 OMNISMI; C:\Windows\SysWOW64\drivers\omnismi.sys [14776 2014-09-25] ()

R3 RTSPER; C:\Windows\System32\DRIVERS\RtsPer.sys [466136 2014-01-13] (Realsil Semiconductor Corporation)

R3 rtsuvc; C:\Windows\System32\DRIVERS\rtsuvc.sys [2980568 2014-12-09] (Realtek Semiconductor Corp.)

R1 SASDIFSV; C:\Program Files\SUPERAntiSpyware\SASDIFSV64.SYS [14928 2011-07-22] (SUPERAdBlocker.com and SUPERAntiSpyware.com)

R1 SASKUTIL; C:\Program Files\SUPERAntiSpyware\SASKUTIL64.SYS [12368 2011-07-12] (SUPERAdBlocker.com and SUPERAntiSpyware.com)

S3 SmbDrv; C:\Windows\system32\drivers\Smb_driver_AMDASF.sys [32424 2015-02-12] (Synaptics Incorporated)

R3 SmbDrvI; C:\Windows\System32\DRIVERS\Smb_driver_Intel.sys [64088 2017-05-26] (Synaptics Incorporated)

R2 TmFilter; C:\Program Files (x86)\Trend Micro\OfficeScan Client\TmXPFlt.sys [344864 2013-08-14] (Trend Micro Inc.)

R2 TmPreFilter; C:\Program Files (x86)\Trend Micro\OfficeScan Client\TmPreFlt.sys [42272 2013-08-14] (Trend Micro Inc.)

R1 tmtdi; C:\Windows\System32\DRIVERS\tmtdi.sys [93200 2009-02-23] (Trend Micro Inc.)

R2 VSApiNt; C:\Program Files (x86)\Trend Micro\OfficeScan Client\VSApiNt.sys [2260768 2013-08-14] (Trend Micro Inc.)

==================== NetSvcs (Whitelisted) ===================

(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)

==================== One Month Created files and folders ========

(If an entry is included in the fixlist, the file/folder will be moved.)

2018-06-09 18:15 - 2018-06-09 18:16 - 000025466 _____ C:\Users\ah010073\Downloads\FRST.txt

2018-06-09 18:15 - 2018-06-09 18:15 - 000000000 ____D C:\FRST

2018-06-09 18:13 - 2018-06-09 18:14 - 002413056 _____ (Farbar) C:\Users\ah010073\Downloads\FRST64.exe

2018-06-09 17:24 - 2018-06-09 17:24 - 000000000 ____D C:\Users\ah010073\Downloads\ROPgadget-master

2018-06-09 17:23 - 2018-06-09 17:23 - 006087385 ____N C:\Users\ah010073\Downloads\ROPgadget-master.zip

2018-06-09 16:58 - 2018-06-09 16:58 - 000000000 ____D C:\Users\ah010073\Downloads\58153ea29ba78_MalwarebytesAnti-Exploit

2018-06-09 16:57 - 2018-06-09 16:57 - 002106590 ____N C:\Users\ah010073\Downloads\58153ea29ba78_MalwarebytesAnti-Exploit.zip

2018-06-09 08:00 - 2018-06-09 17:49 - 000112864 _____ (Malwarebytes) C:\Windows\system32\Drivers\farflt.sys

2018-06-09 08:00 - 2018-06-09 17:49 - 000094328 _____ (Malwarebytes) C:\Windows\system32\Drivers\mwac.sys

2018-06-09 08:00 - 2018-06-09 17:49 - 000044768 _____ (Malwarebytes) C:\Windows\system32\Drivers\mbam.sys

2018-06-09 08:00 - 2018-06-09 08:00 - 000190696 _____ (Malwarebytes) C:\Windows\system32\Drivers\MbamChameleon.sys

2018-06-09 07:59 - 2018-06-09 07:59 - 000000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Malwarebytes

2018-06-09 01:13 - 2018-06-09 01:13 - 000905932 _____ C:\Users\ah010073\AppData\Local\census.cache

2018-06-09 01:12 - 2018-06-09 01:12 - 000335286 _____ C:\Users\ah010073\AppData\Local\ars.cache

2018-06-08 22:08 - 2018-06-08 22:08 - 000000010 _____ C:\Users\ah010073\AppData\Local\sponge.last.runtime.cache

2018-06-08 22:03 - 2018-06-08 22:03 - 000000000 ____D C:\ProgramData\Trend Micro

2018-06-08 22:02 - 2018-06-08 22:02 - 000000000 ____D C:\Windows\Trend Micro

2018-06-08 22:00 - 2018-06-09 08:01 - 000000036 _____ C:\Users\ah010073\AppData\Local\housecall.guid.cache

2018-06-08 22:00 - 2017-10-17 09:40 - 000334488 _____ (Trend Micro Inc.) C:\Windows\system32\Drivers\tmcomm.sys

2018-06-08 21:59 - 2018-06-08 21:59 - 002527376 _____ (Trend Micro Inc.) C:\Users\ah010073\Downloads\HousecallLauncher64.exe

2018-06-08 21:50 - 2018-06-08 21:50 - 000313560 _____ (Mozilla) C:\Users\ah010073\Downloads\Firefox Installer.exe

2018-06-08 21:44 - 2018-06-08 21:44 - 001419864 _____ (Juniper Networks, Inc.) C:\Users\ah010073\Downloads\JuniperSetupClientInstaller.exe

2018-06-08 21:42 - 2016-07-22 07:58 - 000142336 _____ (Microsoft Corporation) C:\Windows\system32\poqexec.exe

2018-06-08 21:42 - 2016-07-22 07:51 - 000123904 _____ (Microsoft Corporation) C:\Windows\SysWOW64\poqexec.exe

2018-06-08 21:38 - 2018-06-09 17:52 - 000003918 _____ C:\Windows\System32\Tasks\User_Feed_Synchronization-{0B2000A5-2D6C-4F6E-97A4-1D8F87BD032F}

2018-06-08 20:54 - 2018-06-08 20:55 - 000000000 ____D C:\Users\ah010073\Downloads\TeamViewerMSI

2018-06-08 20:16 - 2018-06-08 20:20 - 031130880 _____ C:\Users\ah010073\Downloads\TeamViewerMSI.zip

2018-06-08 20:09 - 2018-06-08 20:09 - 000000000 ____D C:\Users\ah010073\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Lenovo

2018-06-08 20:08 - 2018-06-08 20:08 - 002721640 _____ (Lenovo ) C:\Users\ah010073\Downloads\LSBSetup.exe

2018-06-08 19:23 - 2018-06-09 14:15 - 000000000 ____D C:\Users\ah010073\Documents\Kyocera Support

2018-06-08 19:15 - 2018-06-08 19:15 - 000000000 ____D C:\Users\ah010073\AppData\Roaming\Sun

2018-06-08 19:13 - 2018-06-08 19:13 - 000111048 _____ (Oracle Corporation) C:\Windows\system32\WindowsAccessBridge-64.dll

2018-06-08 19:13 - 2018-06-08 19:13 - 000000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Java

2018-06-08 19:12 - 2018-06-08 19:12 - 000000000 ____D C:\Program Files\Java

2018-06-08 19:06 - 2018-06-08 19:09 - 071830472 _____ (Oracle Corporation) C:\Users\ah010073\Downloads\jre-8u171-windows-x64.exe

2018-06-08 17:29 - 2018-06-08 17:29 - 000000000 ____D C:\Users\ah010073\AppData\Roaming\SUPERAntiSpyware.com

2018-06-08 17:29 - 2018-05-11 14:19 - 000977408 _____ (Microsoft Corporation) C:\Windows\system32\inetcomm.dll

2018-06-08 17:29 - 2018-05-11 14:19 - 000109568 _____ (Microsoft Corporation) C:\Windows\system32\hlink.dll

2018-06-08 17:29 - 2018-05-11 14:19 - 000084480 _____ (Microsoft Corporation) C:\Windows\system32\INETRES.dll

2018-06-08 17:29 - 2018-05-10 17:40 - 000741888 _____ (Microsoft Corporation) C:\Windows\SysWOW64\inetcomm.dll

2018-06-08 17:29 - 2018-05-10 17:40 - 000084480 _____ (Microsoft Corporation) C:\Windows\SysWOW64\INETRES.dll

2018-06-08 17:29 - 2018-05-10 17:39 - 000084992 _____ (Microsoft Corporation) C:\Windows\SysWOW64\hlink.dll

2018-06-08 17:29 - 2018-04-23 11:57 - 000396960 _____ (Microsoft Corporation) C:\Windows\system32\iedkcs32.dll

2018-06-08 17:29 - 2018-04-23 11:02 - 000348832 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iedkcs32.dll

2018-06-08 17:29 - 2018-04-22 17:35 - 005583552 _____ (Microsoft Corporation) C:\Windows\system32\ntoskrnl.exe

2018-06-08 17:29 - 2018-04-22 17:35 - 000708288 _____ (Microsoft Corporation) C:\Windows\system32\winload.efi

2018-06-08 17:29 - 2018-04-22 17:35 - 000262336 _____ (Microsoft Corporation) C:\Windows\system32\hal.dll

2018-06-08 17:29 - 2018-04-22 17:35 - 000154816 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\ksecpkg.sys

2018-06-08 17:29 - 2018-04-22 17:35 - 000095424 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\ksecdd.sys

2018-06-08 17:29 - 2018-04-22 17:12 - 004047040 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ntkrnlpa.exe

2018-06-08 17:29 - 2018-04-22 17:12 - 003958464 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ntoskrnl.exe

2018-06-08 17:29 - 2018-04-22 17:10 - 000631640 _____ (Microsoft Corporation) C:\Windows\system32\winresume.efi

2018-06-08 17:29 - 2018-04-22 17:07 - 001665336 _____ (Microsoft Corporation) C:\Windows\system32\ntdll.dll

2018-06-08 17:29 - 2018-04-22 17:00 - 002066432 _____ (Microsoft Corporation) C:\Windows\system32\ole32.dll

2018-06-08 17:29 - 2018-04-22 17:00 - 001461248 _____ (Microsoft Corporation) C:\Windows\system32\lsasrv.dll

2018-06-08 17:29 - 2018-04-22 17:00 - 001212928 _____ (Microsoft Corporation) C:\Windows\system32\rpcrt4.dll

2018-06-08 17:29 - 2018-04-22 17:00 - 001163264 _____ (Microsoft Corporation) C:\Windows\system32\kernel32.dll

2018-06-08 17:29 - 2018-04-22 17:00 - 000880640 _____ (Microsoft Corporation) C:\Windows\system32\advapi32.dll

2018-06-08 17:29 - 2018-04-22 17:00 - 000876032 _____ (Microsoft Corporation) C:\Windows\system32\oleaut32.dll

2018-06-08 17:29 - 2018-04-22 17:00 - 000731648 _____ (Microsoft Corporation) C:\Windows\system32\kerberos.dll

2018-06-08 17:29 - 2018-04-22 17:00 - 000690688 _____ (Microsoft Corporation) C:\Windows\system32\adtschema.dll

2018-06-08 17:29 - 2018-04-22 17:00 - 000512512 _____ (Microsoft Corporation) C:\Windows\system32\rpcss.dll

2018-06-08 17:29 - 2018-04-22 17:00 - 000503808 _____ (Microsoft Corporation) C:\Windows\system32\srcore.dll

2018-06-08 17:29 - 2018-04-22 17:00 - 000463872 _____ (Microsoft Corporation) C:\Windows\system32\certcli.dll

2018-06-08 17:29 - 2018-04-22 17:00 - 000419840 _____ (Microsoft Corporation) C:\Windows\system32\KernelBase.dll

2018-06-08 17:29 - 2018-04-22 17:00 - 000361984 _____ (Microsoft Corporation) C:\Windows\system32\wow64win.dll

2018-06-08 17:29 - 2018-04-22 17:00 - 000345600 _____ (Microsoft Corporation) C:\Windows\system32\schannel.dll

2018-06-08 17:29 - 2018-04-22 17:00 - 000316928 _____ (Microsoft Corporation) C:\Windows\system32\msv1_0.dll

2018-06-08 17:29 - 2018-04-22 17:00 - 000312320 _____ (Microsoft Corporation) C:\Windows\system32\ncrypt.dll

2018-06-08 17:29 - 2018-04-22 17:00 - 000243712 _____ (Microsoft Corporation) C:\Windows\system32\wow64.dll

2018-06-08 17:29 - 2018-04-22 17:00 - 000215552 _____ (Microsoft Corporation) C:\Windows\system32\winsrv.dll

2018-06-08 17:29 - 2018-04-22 17:00 - 000210432 _____ (Microsoft Corporation) C:\Windows\system32\wdigest.dll

2018-06-08 17:29 - 2018-04-22 17:00 - 000190464 _____ (Microsoft Corporation) C:\Windows\system32\rpchttp.dll

2018-06-08 17:29 - 2018-04-22 17:00 - 000146432 _____ (Microsoft Corporation) C:\Windows\system32\msaudite.dll

2018-06-08 17:29 - 2018-04-22 17:00 - 000135680 _____ (Microsoft Corporation) C:\Windows\system32\sspicli.dll

2018-06-08 17:29 - 2018-04-22 17:00 - 000123904 _____ (Microsoft Corporation) C:\Windows\system32\bcrypt.dll

2018-06-08 17:29 - 2018-04-22 17:00 - 000094208 _____ (Microsoft Corporation) C:\Windows\system32\TSpkg.dll

2018-06-08 17:29 - 2018-04-22 17:00 - 000063488 _____ (Microsoft Corporation) C:\Windows\system32\setbcdlocale.dll

2018-06-08 17:29 - 2018-04-22 17:00 - 000060416 _____ (Microsoft Corporation) C:\Windows\system32\msobjs.dll

2018-06-08 17:29 - 2018-04-22 17:00 - 000059904 _____ (Microsoft Corporation) C:\Windows\system32\appidapi.dll

2018-06-08 17:29 - 2018-04-22 17:00 - 000050176 _____ (Microsoft Corporation) C:\Windows\system32\srclient.dll

2018-06-08 17:29 - 2018-04-22 17:00 - 000044032 _____ (Microsoft Corporation) C:\Windows\system32\csrsrv.dll

2018-06-08 17:29 - 2018-04-22 17:00 - 000043520 _____ (Microsoft Corporation) C:\Windows\system32\cryptbase.dll

2018-06-08 17:29 - 2018-04-22 17:00 - 000034816 _____ (Microsoft Corporation) C:\Windows\system32\appidsvc.dll

2018-06-08 17:29 - 2018-04-22 17:00 - 000028672 _____ (Microsoft Corporation) C:\Windows\system32\sspisrv.dll

2018-06-08 17:29 - 2018-04-22 17:00 - 000028160 _____ (Microsoft Corporation) C:\Windows\system32\secur32.dll

2018-06-08 17:29 - 2018-04-22 17:00 - 000026112 _____ (Microsoft Corporation) C:\Windows\system32\oleres.dll

2018-06-08 17:29 - 2018-04-22 17:00 - 000022016 _____ (Microsoft Corporation) C:\Windows\system32\credssp.dll

2018-06-08 17:29 - 2018-04-22 17:00 - 000016384 _____ (Microsoft Corporation) C:\Windows\system32\ntvdm64.dll

2018-06-08 17:29 - 2018-04-22 17:00 - 000013312 _____ (Microsoft Corporation) C:\Windows\system32\wow64cpu.dll

2018-06-08 17:29 - 2018-04-22 17:00 - 000008704 _____ (Microsoft Corporation) C:\Windows\system32\comcat.dll

2018-06-08 17:29 - 2018-04-22 17:00 - 000007168 _____ (Microsoft Corporation) C:\Windows\system32\apisetschema.dll

2018-06-08 17:29 - 2018-04-22 17:00 - 000006144 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-security-base-l1-1-0.dll

2018-06-08 17:29 - 2018-04-22 17:00 - 000005120 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-file-l1-1-0.dll

2018-06-08 17:29 - 2018-04-22 17:00 - 000004608 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-threadpool-l1-1-0.dll

2018-06-08 17:29 - 2018-04-22 17:00 - 000004608 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-processthreads-l1-1-0.dll

2018-06-08 17:29 - 2018-04-22 17:00 - 000004096 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-sysinfo-l1-1-0.dll

2018-06-08 17:29 - 2018-04-22 17:00 - 000004096 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-synch-l1-1-0.dll

2018-06-08 17:29 - 2018-04-22 17:00 - 000004096 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-localregistry-l1-1-0.dll

2018-06-08 17:29 - 2018-04-22 17:00 - 000004096 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-localization-l1-1-0.dll

2018-06-08 17:29 - 2018-04-22 17:00 - 000003584 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-rtlsupport-l1-1-0.dll

2018-06-08 17:29 - 2018-04-22 17:00 - 000003584 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-processenvironment-l1-1-0.dll

2018-06-08 17:29 - 2018-04-22 17:00 - 000003584 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-namedpipe-l1-1-0.dll

2018-06-08 17:29 - 2018-04-22 17:00 - 000003584 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-misc-l1-1-0.dll

2018-06-08 17:29 - 2018-04-22 17:00 - 000003584 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-memory-l1-1-0.dll

2018-06-08 17:29 - 2018-04-22 17:00 - 000003584 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-libraryloader-l1-1-0.dll

2018-06-08 17:29 - 2018-04-22 17:00 - 000003584 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-heap-l1-1-0.dll

2018-06-08 17:29 - 2018-04-22 17:00 - 000003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-xstate-l1-1-0.dll

2018-06-08 17:29 - 2018-04-22 17:00 - 000003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-util-l1-1-0.dll

2018-06-08 17:29 - 2018-04-22 17:00 - 000003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-string-l1-1-0.dll

2018-06-08 17:29 - 2018-04-22 17:00 - 000003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-profile-l1-1-0.dll

2018-06-08 17:29 - 2018-04-22 17:00 - 000003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-io-l1-1-0.dll

2018-06-08 17:29 - 2018-04-22 17:00 - 000003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-interlocked-l1-1-0.dll

2018-06-08 17:29 - 2018-04-22 17:00 - 000003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-handle-l1-1-0.dll

2018-06-08 17:29 - 2018-04-22 17:00 - 000003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-fibers-l1-1-0.dll

2018-06-08 17:29 - 2018-04-22 17:00 - 000003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-errorhandling-l1-1-0.dll

2018-06-08 17:29 - 2018-04-22 17:00 - 000003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-delayload-l1-1-0.dll

2018-06-08 17:29 - 2018-04-22 17:00 - 000003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-debug-l1-1-0.dll

2018-06-08 17:29 - 2018-04-22 17:00 - 000003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-datetime-l1-1-0.dll

2018-06-08 17:29 - 2018-04-22 17:00 - 000003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-console-l1-1-0.dll

2018-06-08 17:29 - 2018-04-22 16:44 - 001314064 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ntdll.dll

2018-06-08 17:29 - 2018-04-22 16:41 - 001114112 _____ (Microsoft Corporation) C:\Windows\SysWOW64\kernel32.dll

2018-06-08 17:29 - 2018-04-22 16:41 - 000666112 _____ (Microsoft Corporation) C:\Windows\SysWOW64\rpcrt4.dll

2018-06-08 17:29 - 2018-04-22 16:41 - 000275456 _____ (Microsoft Corporation) C:\Windows\SysWOW64\KernelBase.dll

2018-06-08 17:29 - 2018-04-22 16:41 - 000172032 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wdigest.dll

2018-06-08 17:29 - 2018-04-22 16:41 - 000096768 _____ (Microsoft Corporation) C:\Windows\SysWOW64\sspicli.dll

2018-06-08 17:29 - 2018-04-22 16:41 - 000082944 _____ (Microsoft Corporation) C:\Windows\SysWOW64\bcrypt.dll

2018-06-08 17:29 - 2018-04-22 16:41 - 000070144 _____ (Microsoft Corporation) C:\Windows\SysWOW64\TSpkg.dll

2018-06-08 17:29 - 2018-04-22 16:41 - 000043008 _____ (Microsoft Corporation) C:\Windows\SysWOW64\srclient.dll

2018-06-08 17:29 - 2018-04-22 16:41 - 000005120 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wow32.dll

2018-06-08 17:29 - 2018-04-22 16:40 - 001417728 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ole32.dll

2018-06-08 17:29 - 2018-04-22 16:40 - 000690688 _____ (Microsoft Corporation) C:\Windows\SysWOW64\adtschema.dll

2018-06-08 17:29 - 2018-04-22 16:40 - 000644096 _____ (Microsoft Corporation) C:\Windows\SysWOW64\advapi32.dll

2018-06-08 17:29 - 2018-04-22 16:40 - 000582144 _____ (Microsoft Corporation) C:\Windows\SysWOW64\oleaut32.dll

2018-06-08 17:29 - 2018-04-22 16:40 - 000554496 _____ (Microsoft Corporation) C:\Windows\SysWOW64\kerberos.dll

2018-06-08 17:29 - 2018-04-22 16:40 - 000342528 _____ (Microsoft Corporation) C:\Windows\SysWOW64\certcli.dll

2018-06-08 17:29 - 2018-04-22 16:40 - 000261120 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msv1_0.dll

2018-06-08 17:29 - 2018-04-22 16:40 - 000254464 _____ (Microsoft Corporation) C:\Windows\SysWOW64\schannel.dll

2018-06-08 17:29 - 2018-04-22 16:40 - 000223232 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ncrypt.dll

2018-06-08 17:29 - 2018-04-22 16:40 - 000146432 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msaudite.dll

2018-06-08 17:29 - 2018-04-22 16:40 - 000141312 _____ (Microsoft Corporation) C:\Windows\SysWOW64\rpchttp.dll

2018-06-08 17:29 - 2018-04-22 16:40 - 000060416 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msobjs.dll

2018-06-08 17:29 - 2018-04-22 16:40 - 000050688 _____ (Microsoft Corporation) C:\Windows\SysWOW64\appidapi.dll

2018-06-08 17:29 - 2018-04-22 16:40 - 000026112 _____ (Microsoft Corporation) C:\Windows\SysWOW64\oleres.dll

2018-06-08 17:29 - 2018-04-22 16:40 - 000022016 _____ (Microsoft Corporation) C:\Windows\SysWOW64\secur32.dll

2018-06-08 17:29 - 2018-04-22 16:40 - 000017408 _____ (Microsoft Corporation) C:\Windows\SysWOW64\credssp.dll

2018-06-08 17:29 - 2018-04-22 16:40 - 000007168 _____ (Microsoft Corporation) C:\Windows\SysWOW64\apisetschema.dll

2018-06-08 17:29 - 2018-04-22 16:40 - 000005120 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-file-l1-1-0.dll

2018-06-08 17:29 - 2018-04-22 16:40 - 000004608 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-processthreads-l1-1-0.dll

2018-06-08 17:29 - 2018-04-22 16:40 - 000004096 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-sysinfo-l1-1-0.dll

2018-06-08 17:29 - 2018-04-22 16:40 - 000004096 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-synch-l1-1-0.dll

2018-06-08 17:29 - 2018-04-22 16:40 - 000004096 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-misc-l1-1-0.dll

2018-06-08 17:29 - 2018-04-22 16:40 - 000004096 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-localregistry-l1-1-0.dll

2018-06-08 17:29 - 2018-04-22 16:40 - 000004096 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-localization-l1-1-0.dll

2018-06-08 17:29 - 2018-04-22 16:40 - 000003584 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-processenvironment-l1-1-0.dll

2018-06-08 17:29 - 2018-04-22 16:40 - 000003584 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-namedpipe-l1-1-0.dll

2018-06-08 17:29 - 2018-04-22 16:40 - 000003584 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-memory-l1-1-0.dll

2018-06-08 17:29 - 2018-04-22 16:40 - 000003584 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-libraryloader-l1-1-0.dll

2018-06-08 17:29 - 2018-04-22 16:40 - 000003584 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-interlocked-l1-1-0.dll

2018-06-08 17:29 - 2018-04-22 16:40 - 000003584 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-heap-l1-1-0.dll

2018-06-08 17:29 - 2018-04-22 16:40 - 000003072 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-string-l1-1-0.dll

2018-06-08 17:29 - 2018-04-22 16:40 - 000003072 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-rtlsupport-l1-1-0.dll

2018-06-08 17:29 - 2018-04-22 16:40 - 000003072 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-profile-l1-1-0.dll

2018-06-08 17:29 - 2018-04-22 16:40 - 000003072 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-io-l1-1-0.dll

2018-06-08 17:29 - 2018-04-22 16:40 - 000003072 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-handle-l1-1-0.dll

2018-06-08 17:29 - 2018-04-22 16:40 - 000003072 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-fibers-l1-1-0.dll

2018-06-08 17:29 - 2018-04-22 16:40 - 000003072 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-errorhandling-l1-1-0.dll

2018-06-08 17:29 - 2018-04-22 16:40 - 000003072 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-delayload-l1-1-0.dll

2018-06-08 17:29 - 2018-04-22 16:40 - 000003072 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-debug-l1-1-0.dll

2018-06-08 17:29 - 2018-04-22 16:40 - 000003072 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-datetime-l1-1-0.dll

2018-06-08 17:29 - 2018-04-22 16:40 - 000003072 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-console-l1-1-0.dll

2018-06-08 17:29 - 2018-04-22 16:32 - 000148480 _____ (Microsoft Corporation) C:\Windows\system32\appidpolicyconverter.exe

2018-06-08 17:29 - 2018-04-22 16:32 - 000062464 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\appid.sys

2018-06-08 17:29 - 2018-04-22 16:32 - 000017920 _____ (Microsoft Corporation) C:\Windows\system32\appidcertstorecheck.exe

2018-06-08 17:29 - 2018-04-22 16:31 - 000064512 _____ (Microsoft Corporation) C:\Windows\system32\auditpol.exe

2018-06-08 17:29 - 2018-04-22 16:28 - 000338432 _____ (Microsoft Corporation) C:\Windows\system32\conhost.exe

2018-06-08 17:29 - 2018-04-22 16:28 - 000129536 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\videoprt.sys

2018-06-08 17:29 - 2018-04-22 16:27 - 000296960 _____ (Microsoft Corporation) C:\Windows\system32\rstrui.exe

2018-06-08 17:29 - 2018-04-22 16:25 - 000160256 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\mrxsmb.sys

2018-06-08 17:29 - 2018-04-22 16:24 - 000291328 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\mrxsmb10.sys

2018-06-08 17:29 - 2018-04-22 16:24 - 000129536 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\mrxsmb20.sys

2018-06-08 17:29 - 2018-04-22 16:24 - 000007168 _____ (Microsoft Corporation) C:\Windows\SysWOW64\comcat.dll

2018-06-08 17:29 - 2018-04-22 16:23 - 000112640 _____ (Microsoft Corporation) C:\Windows\system32\smss.exe

2018-06-08 17:29 - 2018-04-22 16:23 - 000030720 _____ (Microsoft Corporation) C:\Windows\system32\lsass.exe

2018-06-08 17:29 - 2018-04-22 16:22 - 000050688 _____ (Microsoft Corporation) C:\Windows\SysWOW64\auditpol.exe

2018-06-08 17:29 - 2018-04-22 16:19 - 000025600 _____ (Microsoft Corporation) C:\Windows\SysWOW64\setup16.exe

2018-06-08 17:29 - 2018-04-22 16:19 - 000014336 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ntvdm64.dll

2018-06-08 17:29 - 2018-04-22 16:19 - 000007680 _____ (Microsoft Corporation) C:\Windows\SysWOW64\instnm.exe

2018-06-08 17:29 - 2018-04-22 16:19 - 000002048 _____ (Microsoft Corporation) C:\Windows\SysWOW64\user.exe

2018-06-08 17:29 - 2018-04-22 16:18 - 000036352 _____ (Microsoft Corporation) C:\Windows\SysWOW64\cryptbase.dll

2018-06-08 17:29 - 2018-04-22 16:18 - 000006144 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-security-base-l1-1-0.dll

2018-06-08 17:29 - 2018-04-22 16:18 - 000004608 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-threadpool-l1-1-0.dll

2018-06-08 17:29 - 2018-04-22 16:18 - 000003584 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-xstate-l1-1-0.dll

2018-06-08 17:29 - 2018-04-22 16:18 - 000003072 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-util-l1-1-0.dll

2018-06-08 17:29 - 2018-04-22 01:04 - 025744896 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.dll

2018-06-08 17:29 - 2018-04-22 00:53 - 002724864 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.tlb

2018-06-08 17:29 - 2018-04-22 00:53 - 000004096 _____ (Microsoft Corporation) C:\Windows\system32\ieetwcollectorres.dll

2018-06-08 17:29 - 2018-04-22 00:40 - 002902016 _____ (Microsoft Corporation) C:\Windows\system32\iertutil.dll

2018-06-08 17:29 - 2018-04-22 00:39 - 000066560 _____ (Microsoft Corporation) C:\Windows\system32\iesetup.dll

2018-06-08 17:29 - 2018-04-22 00:38 - 000578048 _____ (Microsoft Corporation) C:\Windows\system32\vbscript.dll

2018-06-08 17:29 - 2018-04-22 00:38 - 000417280 _____ (Microsoft Corporation) C:\Windows\system32\html.iec

2018-06-08 17:29 - 2018-04-22 00:38 - 000048640 _____ (Microsoft Corporation) C:\Windows\system32\ieetwproxystub.dll

2018-06-08 17:29 - 2018-04-22 00:37 - 000088064 _____ (Microsoft Corporation) C:\Windows\system32\MshtmlDac.dll

2018-06-08 17:29 - 2018-04-22 00:32 - 005779456 _____ (Microsoft Corporation) C:\Windows\system32\jscript9.dll

2018-06-08 17:29 - 2018-04-22 00:31 - 000054784 _____ (Microsoft Corporation) C:\Windows\system32\jsproxy.dll

2018-06-08 17:29 - 2018-04-22 00:30 - 000034304 _____ (Microsoft Corporation) C:\Windows\system32\iernonce.dll

2018-06-08 17:29 - 2018-04-22 00:27 - 000615936 _____ (Microsoft Corporation) C:\Windows\system32\ieui.dll

2018-06-08 17:29 - 2018-04-22 00:26 - 000814080 _____ (Microsoft Corporation) C:\Windows\system32\jscript9diag.dll

2018-06-08 17:29 - 2018-04-22 00:26 - 000794624 _____ (Microsoft Corporation) C:\Windows\system32\jscript.dll

2018-06-08 17:29 - 2018-04-22 00:26 - 000144384 _____ (Microsoft Corporation) C:\Windows\system32\ieUnatt.exe

2018-06-08 17:29 - 2018-04-22 00:26 - 000116224 _____ (Microsoft Corporation) C:\Windows\system32\ieetwcollector.exe

2018-06-08 17:29 - 2018-04-22 00:24 - 020286464 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.dll

2018-06-08 17:29 - 2018-04-22 00:18 - 000969216 _____ (Microsoft Corporation) C:\Windows\system32\MsSpellCheckingFacility.exe

2018-06-08 17:29 - 2018-04-22 00:16 - 002724864 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.tlb

2018-06-08 17:29 - 2018-04-22 00:15 - 000489984 _____ (Microsoft Corporation) C:\Windows\system32\dxtmsft.dll

2018-06-08 17:29 - 2018-04-22 00:08 - 000087552 _____ (Microsoft Corporation) C:\Windows\system32\tdc.ocx

2018-06-08 17:29 - 2018-04-22 00:08 - 000077824 _____ (Microsoft Corporation) C:\Windows\system32\JavaScriptCollectionAgent.dll

2018-06-08 17:29 - 2018-04-22 00:07 - 000107520 _____ (Microsoft Corporation) C:\Windows\system32\inseng.dll

2018-06-08 17:29 - 2018-04-22 00:04 - 000499712 _____ (Microsoft Corporation) C:\Windows\SysWOW64\vbscript.dll

2018-06-08 17:29 - 2018-04-22 00:04 - 000199680 _____ (Microsoft Corporation) C:\Windows\system32\msrating.dll

2018-06-08 17:29 - 2018-04-22 00:04 - 000092160 _____ (Microsoft Corporation) C:\Windows\system32\mshtmled.dll

2018-06-08 17:29 - 2018-04-22 00:04 - 000062464 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iesetup.dll

2018-06-08 17:29 - 2018-04-22 00:03 - 000341504 _____ (Microsoft Corporation) C:\Windows\SysWOW64\html.iec

2018-06-08 17:29 - 2018-04-22 00:03 - 000047616 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieetwproxystub.dll

2018-06-08 17:29 - 2018-04-22 00:02 - 000315392 _____ (Microsoft Corporation) C:\Windows\system32\dxtrans.dll

2018-06-08 17:29 - 2018-04-22 00:02 - 000064000 _____ (Microsoft Corporation) C:\Windows\SysWOW64\MshtmlDac.dll

2018-06-08 17:29 - 2018-04-22 00:00 - 002295296 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iertutil.dll

2018-06-08 17:29 - 2018-04-22 00:00 - 000152064 _____ (Microsoft Corporation) C:\Windows\system32\occache.dll

2018-06-08 17:29 - 2018-04-21 23:57 - 000047104 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jsproxy.dll

2018-06-08 17:29 - 2018-04-21 23:56 - 000030720 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iernonce.dll

2018-06-08 17:29 - 2018-04-21 23:55 - 000476160 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieui.dll

2018-06-08 17:29 - 2018-04-21 23:54 - 000661504 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript.dll

2018-06-08 17:29 - 2018-04-21 23:53 - 000620032 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript9diag.dll

2018-06-08 17:29 - 2018-04-21 23:53 - 000115712 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieUnatt.exe

2018-06-08 17:29 - 2018-04-21 23:51 - 000262144 _____ (Microsoft Corporation) C:\Windows\system32\webcheck.dll

2018-06-08 17:29 - 2018-04-21 23:49 - 000809472 _____ (Microsoft Corporation) C:\Windows\system32\msfeeds.dll

2018-06-08 17:29 - 2018-04-21 23:49 - 000728064 _____ (Microsoft Corporation) C:\Windows\system32\ie4uinit.exe

2018-06-08 17:29 - 2018-04-21 23:48 - 015283200 _____ (Microsoft Corporation) C:\Windows\system32\ieframe.dll

2018-06-08 17:29 - 2018-04-21 23:46 - 002135552 _____ (Microsoft Corporation) C:\Windows\system32\inetcpl.cpl

2018-06-08 17:29 - 2018-04-21 23:46 - 001359360 _____ (Microsoft Corporation) C:\Windows\system32\mshtmlmedia.dll

2018-06-08 17:29 - 2018-04-21 23:45 - 000416256 _____ (Microsoft Corporation) C:\Windows\SysWOW64\dxtmsft.dll

2018-06-08 17:29 - 2018-04-21 23:40 - 000073216 _____ (Microsoft Corporation) C:\Windows\SysWOW64\tdc.ocx

2018-06-08 17:29 - 2018-04-21 23:40 - 000060416 _____ (Microsoft Corporation) C:\Windows\SysWOW64\JavaScriptCollectionAgent.dll

2018-06-08 17:29 - 2018-04-21 23:39 - 000091136 _____ (Microsoft Corporation) C:\Windows\SysWOW64\inseng.dll

2018-06-08 17:29 - 2018-04-21 23:37 - 000168960 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msrating.dll

2018-06-08 17:29 - 2018-04-21 23:37 - 000076288 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtmled.dll

2018-06-08 17:29 - 2018-04-21 23:35 - 000279040 _____ (Microsoft Corporation) C:\Windows\SysWOW64\dxtrans.dll

2018-06-08 17:29 - 2018-04-21 23:34 - 000130048 _____ (Microsoft Corporation) C:\Windows\SysWOW64\occache.dll

2018-06-08 17:29 - 2018-04-21 23:33 - 003241472 _____ (Microsoft Corporation) C:\Windows\system32\wininet.dll

2018-06-08 17:29 - 2018-04-21 23:31 - 004496896 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript9.dll

2018-06-08 17:29 - 2018-04-21 23:29 - 000230400 _____ (Microsoft Corporation) C:\Windows\SysWOW64\webcheck.dll

2018-06-08 17:29 - 2018-04-21 23:27 - 000696320 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msfeeds.dll

2018-06-08 17:29 - 2018-04-21 23:26 - 013679616 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieframe.dll

2018-06-08 17:29 - 2018-04-21 23:26 - 002059776 _____ (Microsoft Corporation) C:\Windows\SysWOW64\inetcpl.cpl

2018-06-08 17:29 - 2018-04-21 23:26 - 001155072 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtmlmedia.dll

2018-06-08 17:29 - 2018-04-21 23:22 - 001546240 _____ (Microsoft Corporation) C:\Windows\system32\urlmon.dll

2018-06-08 17:29 - 2018-04-21 23:11 - 000800768 _____ (Microsoft Corporation) C:\Windows\system32\ieapfltr.dll

2018-06-08 17:29 - 2018-04-21 23:08 - 002767872 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wininet.dll

2018-06-08 17:29 - 2018-04-21 23:04 - 001314304 _____ (Microsoft Corporation) C:\Windows\SysWOW64\urlmon.dll

2018-06-08 17:29 - 2018-04-21 23:03 - 000710144 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieapfltr.dll

2018-06-08 17:29 - 2018-04-18 09:03 - 000701952 _____ (Microsoft Corporation) C:\Windows\system32\hhctrl.ocx

2018-06-08 17:29 - 2018-04-18 09:03 - 000053248 _____ (Microsoft Corporation) C:\Windows\system32\hhsetup.dll

2018-06-08 17:29 - 2018-04-18 08:51 - 000523776 _____ (Microsoft Corporation) C:\Windows\SysWOW64\hhctrl.ocx

2018-06-08 17:29 - 2018-04-18 08:51 - 000043008 _____ (Microsoft Corporation) C:\Windows\SysWOW64\hhsetup.dll

2018-06-08 17:29 - 2018-04-18 08:41 - 000016896 _____ (Microsoft Corporation) C:\Windows\hh.exe

2018-06-08 17:29 - 2018-04-18 08:35 - 000015360 _____ (Microsoft Corporation) C:\Windows\SysWOW64\hh.exe

2018-06-08 17:29 - 2018-04-11 09:38 - 000194048 _____ (Microsoft Corporation) C:\Windows\system32\itircl.dll

2018-06-08 17:29 - 2018-04-11 09:38 - 000170496 _____ (Microsoft Corporation) C:\Windows\system32\itss.dll

2018-06-08 17:29 - 2018-04-11 09:36 - 000158720 _____ (Microsoft Corporation) C:\Windows\SysWOW64\itircl.dll

2018-06-08 17:29 - 2018-04-11 09:36 - 000142848 _____ (Microsoft Corporation) C:\Windows\SysWOW64\itss.dll

2018-06-08 17:29 - 2018-04-10 12:45 - 000634272 _____ (Microsoft Corporation) C:\Windows\system32\winload.exe

2018-06-08 17:29 - 2018-04-10 09:36 - 000236032 _____ (Microsoft Corporation) C:\Windows\system32\srvsvc.dll

2018-06-08 17:29 - 2018-04-10 09:36 - 000013312 _____ (Microsoft Corporation) C:\Windows\system32\sscore.dll

2018-06-08 17:29 - 2018-04-10 09:35 - 001735168 _____ (Microsoft Corporation) C:\Windows\system32\comsvcs.dll

2018-06-08 17:29 - 2018-04-10 09:34 - 000525824 _____ (Microsoft Corporation) C:\Windows\system32\catsrvut.dll

2018-06-08 17:29 - 2018-04-10 09:33 - 001241600 _____ (Microsoft Corporation) C:\Windows\SysWOW64\comsvcs.dll

2018-06-08 17:29 - 2018-04-10 09:32 - 000487936 _____ (Microsoft Corporation) C:\Windows\SysWOW64\catsrvut.dll

2018-06-08 17:29 - 2018-04-10 09:00 - 000009728 _____ (Microsoft Corporation) C:\Windows\SysWOW64\sscore.dll

2018-06-08 17:29 - 2018-04-10 08:54 - 003226112 _____ (Microsoft Corporation) C:\Windows\system32\win32k.sys

2018-06-08 17:29 - 2018-04-10 08:48 - 000464384 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\srv.sys

2018-06-08 17:29 - 2018-04-10 08:47 - 000406016 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\srv2.sys

2018-06-08 17:29 - 2018-04-10 08:47 - 000169984 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\srvnet.sys

2018-06-08 17:29 - 2018-04-07 09:41 - 000371392 _____ (Microsoft Corporation) C:\Windows\system32\clfs.sys

2018-06-08 17:29 - 2018-04-06 09:39 - 000002048 _____ (Microsoft Corporation) C:\Windows\system32\tzres.dll

2018-06-08 17:29 - 2018-04-06 09:38 - 000002048 _____ (Microsoft Corporation) C:\Windows\SysWOW64\tzres.dll

2018-06-08 17:29 - 2018-03-14 10:16 - 000174080 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wuwebv.dll

2018-06-08 17:29 - 2018-03-14 10:12 - 003165184 _____ (Microsoft Corporation) C:\Windows\system32\wucltux.dll

2018-06-08 17:29 - 2018-03-14 10:12 - 000192512 _____ (Microsoft Corporation) C:\Windows\system32\wuwebv.dll

2018-06-08 17:29 - 2018-03-14 10:12 - 000098816 _____ (Microsoft Corporation) C:\Windows\system32\wudriver.dll

2018-06-08 17:29 - 2018-03-14 10:07 - 000091136 _____ (Microsoft Corporation) C:\Windows\system32\WinSetupUI.dll

2018-06-08 17:29 - 2018-03-14 09:57 - 000573440 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wuapi.dll

2018-06-08 17:29 - 2018-03-14 09:57 - 000093696 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wudriver.dll

2018-06-08 17:29 - 2018-03-14 09:57 - 000035328 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wuapp.exe

2018-06-08 17:29 - 2018-03-14 09:57 - 000030208 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wups.dll

2018-06-08 17:29 - 2018-03-14 09:53 - 002651648 _____ (Microsoft Corporation) C:\Windows\system32\wuaueng.dll

2018-06-08 17:29 - 2018-03-14 09:53 - 000709120 _____ (Microsoft Corporation) C:\Windows\system32\wuapi.dll

2018-06-08 17:29 - 2018-03-14 09:52 - 000140288 _____ (Microsoft Corporation) C:\Windows\system32\wuauclt.exe

2018-06-08 17:29 - 2018-03-14 09:52 - 000037888 _____ (Microsoft Corporation) C:\Windows\system32\wups2.dll

2018-06-08 17:29 - 2018-03-14 09:52 - 000037888 _____ (Microsoft Corporation) C:\Windows\system32\wuapp.exe

2018-06-08 17:29 - 2018-03-14 09:52 - 000036864 _____ (Microsoft Corporation) C:\Windows\system32\wups.dll

2018-06-08 17:29 - 2018-03-14 09:52 - 000012288 _____ (Microsoft Corporation) C:\Windows\system32\wu.upgrade.ps.dll

2018-06-08 17:29 - 2018-03-10 10:11 - 000340480 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msexcl40.dll

2018-06-08 17:29 - 2018-03-09 11:18 - 000309440 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\atmfd.dll

2018-06-08 17:29 - 2018-03-09 11:12 - 000383680 _____ (Adobe Systems Incorporated) C:\Windows\system32\atmfd.dll

2018-06-08 17:29 - 2018-03-09 11:12 - 000111616 _____ (Microsoft Corporation) C:\Windows\SysWOW64\t2embed.dll

2018-06-08 17:29 - 2018-03-09 11:12 - 000071680 _____ (Microsoft Corporation) C:\Windows\SysWOW64\fontsub.dll

2018-06-08 17:29 - 2018-03-09 11:12 - 000025600 _____ (Microsoft Corporation) C:\Windows\SysWOW64\lpk.dll

2018-06-08 17:29 - 2018-03-09 11:11 - 000010240 _____ (Microsoft Corporation) C:\Windows\SysWOW64\dciman32.dll

2018-06-08 17:29 - 2018-03-09 11:07 - 000152064 _____ (Microsoft Corporation) C:\Windows\system32\t2embed.dll

2018-06-08 17:29 - 2018-03-09 11:07 - 000100864 _____ (Microsoft Corporation) C:\Windows\system32\fontsub.dll

2018-06-08 17:29 - 2018-03-09 11:07 - 000041472 _____ (Microsoft Corporation) C:\Windows\system32\lpk.dll

2018-06-08 17:29 - 2018-03-09 11:06 - 000046080 _____ (Adobe Systems) C:\Windows\system32\atmlib.dll

2018-06-08 17:29 - 2018-03-09 11:06 - 000014336 _____ (Microsoft Corporation) C:\Windows\system32\dciman32.dll

2018-06-08 17:29 - 2018-03-09 10:31 - 000034304 _____ (Adobe Systems) C:\Windows\SysWOW64\atmlib.dll

2018-06-08 17:29 - 2018-03-06 11:13 - 000148160 _____ (Microsoft Corporation) C:\Windows\SysWOW64\basecsp.dll

2018-06-08 17:29 - 2018-03-06 11:11 - 000184320 _____ (Microsoft Corporation) C:\Windows\SysWOW64\scksp.dll

2018-06-08 17:29 - 2018-03-06 11:11 - 000052224 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wsnmp32.dll

2018-06-08 17:29 - 2018-03-06 11:10 - 000170176 _____ (Microsoft Corporation) C:\Windows\system32\basecsp.dll

2018-06-08 17:29 - 2018-03-06 11:07 - 000229376 _____ (Microsoft Corporation) C:\Windows\system32\scksp.dll

2018-06-08 17:29 - 2018-03-06 11:07 - 000067072 _____ (Microsoft Corporation) C:\Windows\system32\wsnmp32.dll

2018-06-08 17:29 - 2018-02-21 20:28 - 000217600 _____ (Microsoft Corporation) C:\Windows\system32\WinSCard.dll

2018-06-08 17:29 - 2018-02-21 20:06 - 000134656 _____ (Microsoft Corporation) C:\Windows\SysWOW64\WinSCard.dll

2018-06-08 17:29 - 2018-02-10 11:35 - 000367296 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\msrpc.sys

2018-06-08 17:29 - 2018-02-10 11:35 - 000334528 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\acpi.sys

2018-06-08 17:29 - 2018-02-10 11:35 - 000185024 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\pci.sys

2018-06-08 17:29 - 2018-02-10 11:35 - 000122560 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\NV_AGP.SYS

2018-06-08 17:29 - 2018-02-10 11:35 - 000068288 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\volmgr.sys

2018-06-08 17:29 - 2018-02-10 11:35 - 000064192 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\ULIAGPKX.SYS

2018-06-08 17:29 - 2018-02-10 11:35 - 000063168 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\termdd.sys

2018-06-08 17:29 - 2018-02-10 11:35 - 000060608 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\AGP440.sys

2018-06-08 17:29 - 2018-02-10 11:35 - 000036032 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\vdrvroot.sys

2018-06-08 17:29 - 2018-02-10 11:35 - 000031936 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\mssmbios.sys

2018-06-08 17:29 - 2018-02-10 11:35 - 000023744 _____ (Microsoft Corporation) C:\Windows\system32\streamci.dll

2018-06-08 17:29 - 2018-02-10 11:35 - 000020160 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\isapnp.sys

2018-06-08 17:29 - 2018-02-10 11:35 - 000015040 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\msisadrv.sys

2018-06-08 17:29 - 2018-02-10 11:35 - 000012096 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\swenum.sys

2018-06-08 17:29 - 2018-02-10 11:23 - 002292224 _____ (Microsoft Corporation) C:\Windows\SysWOW64\MSVidCtl.dll

2018-06-08 17:29 - 2018-02-10 11:23 - 000330240 _____ (Microsoft Corporation) C:\Windows\SysWOW64\zipfldr.dll

2018-06-08 17:29 - 2018-02-10 11:23 - 000111616 _____ (Microsoft Corporation) C:\Windows\SysWOW64\racpldlg.dll

2018-06-08 17:29 - 2018-02-10 11:11 - 003665920 _____ (Microsoft Corporation) C:\Windows\system32\MSVidCtl.dll

2018-06-08 17:29 - 2018-02-10 11:11 - 000369664 _____ (Microsoft Corporation) C:\Windows\system32\zipfldr.dll

2018-06-08 17:29 - 2018-02-10 11:11 - 000133120 _____ (Microsoft Corporation) C:\Windows\system32\msrahc.dll

2018-06-08 17:29 - 2018-02-10 11:11 - 000119296 _____ (Microsoft Corporation) C:\Windows\system32\racpldlg.dll

2018-06-08 17:29 - 2018-02-10 10:36 - 000108032 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msra.exe

2018-06-08 17:29 - 2018-02-10 10:36 - 000040960 _____ (Microsoft Corporation) C:\Windows\SysWOW64\sdchange.exe

2018-06-08 17:29 - 2018-02-10 10:36 - 000007168 _____ (Microsoft Corporation) C:\Windows\SysWOW64\MsraLegacy.tlb

2018-06-08 17:29 - 2018-02-10 10:26 - 000653312 _____ (Microsoft Corporation) C:\Windows\system32\msra.exe

2018-06-08 17:29 - 2018-02-10 10:26 - 000051712 _____ (Microsoft Corporation) C:\Windows\system32\sdchange.exe

2018-06-08 17:29 - 2018-02-10 10:25 - 000014336 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\wmiacpi.sys

2018-06-08 17:29 - 2018-02-10 10:25 - 000009728 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\errdev.sys

2018-06-08 17:29 - 2018-02-10 10:25 - 000007168 _____ (Microsoft Corporation) C:\Windows\system32\MsraLegacy.tlb

2018-06-08 17:29 - 2018-02-02 11:40 - 000114368 _____ (Microsoft Corporation) C:\Windows\system32\consent.exe

2018-06-08 17:29 - 2018-02-02 11:29 - 002365952 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msi.dll

2018-06-08 17:29 - 2018-02-02 11:29 - 000337408 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msihnd.dll

2018-06-08 17:29 - 2018-02-02 11:29 - 000025088 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msimsg.dll

2018-06-08 17:29 - 2018-02-02 11:28 - 001806848 _____ (Microsoft Corporation) C:\Windows\SysWOW64\authui.dll

2018-06-08 17:29 - 2018-02-02 11:16 - 003246080 _____ (Microsoft Corporation) C:\Windows\system32\msi.dll

2018-06-08 17:29 - 2018-02-02 11:16 - 000504320 _____ (Microsoft Corporation) C:\Windows\system32\msihnd.dll

2018-06-08 17:29 - 2018-02-02 11:16 - 000025088 _____ (Microsoft Corporation) C:\Windows\system32\msimsg.dll

2018-06-08 17:29 - 2018-02-02 11:14 - 001942016 _____ (Microsoft Corporation) C:\Windows\system32\authui.dll

2018-06-08 17:29 - 2018-02-02 11:14 - 000070144 _____ (Microsoft Corporation) C:\Windows\system32\appinfo.dll

2018-06-08 17:29 - 2018-02-02 10:46 - 000073216 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msiexec.exe

2018-06-08 17:29 - 2018-02-02 10:36 - 000128512 _____ (Microsoft Corporation) C:\Windows\system32\msiexec.exe

2018-06-08 17:29 - 2018-01-25 07:05 - 000995272 _____ (Microsoft Corporation) C:\Windows\system32\ucrtbase.dll

2018-06-08 17:29 - 2018-01-25 07:05 - 000063832 _____ (Microsoft Corporation) C:\Windows\system32\api-ms-win-crt-private-l1-1-0.dll

2018-06-08 17:29 - 2018-01-25 07:05 - 000020824 _____ (Microsoft Corporation) C:\Windows\system32\api-ms-win-crt-math-l1-1-0.dll

2018-06-08 17:29 - 2018-01-25 07:05 - 000019800 _____ (Microsoft Corporation) C:\Windows\system32\api-ms-win-crt-multibyte-l1-1-0.dll

2018-06-08 17:29 - 2018-01-25 07:05 - 000017752 _____ (Microsoft Corporation) C:\Windows\system32\api-ms-win-crt-string-l1-1-0.dll

2018-06-08 17:29 - 2018-01-25 07:05 - 000017752 _____ (Microsoft Corporation) C:\Windows\system32\api-ms-win-crt-stdio-l1-1-0.dll

2018-06-08 17:29 - 2018-01-25 07:05 - 000016216 _____ (Microsoft Corporation) C:\Windows\system32\api-ms-win-crt-runtime-l1-1-0.dll

2018-06-08 17:29 - 2018-01-25 07:05 - 000015704 _____ (Microsoft Corporation) C:\Windows\system32\api-ms-win-crt-convert-l1-1-0.dll

2018-06-08 17:29 - 2018-01-25 07:05 - 000014168 _____ (Microsoft Corporation) C:\Windows\system32\api-ms-win-crt-time-l1-1-0.dll

2018-06-08 17:29 - 2018-01-25 07:05 - 000014168 _____ (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-localization-l1-2-0.dll

2018-06-08 17:29 - 2018-01-25 07:05 - 000013656 _____ (Microsoft Corporation) C:\Windows\system32\api-ms-win-crt-filesystem-l1-1-0.dll

2018-06-08 17:29 - 2018-01-25 07:05 - 000012632 _____ (Microsoft Corporation) C:\Windows\system32\api-ms-win-crt-process-l1-1-0.dll

2018-06-08 17:29 - 2018-01-25 07:05 - 000012632 _____ (Microsoft Corporation) C:\Windows\system32\api-ms-win-crt-heap-l1-1-0.dll

2018-06-08 17:29 - 2018-01-25 07:05 - 000012632 _____ (Microsoft Corporation) C:\Windows\system32\api-ms-win-crt-conio-l1-1-0.dll

2018-06-08 17:29 - 2018-01-25 07:05 - 000012120 _____ (Microsoft Corporation) C:\Windows\system32\api-ms-win-crt-utility-l1-1-0.dll

2018-06-08 17:29 - 2018-01-25 07:05 - 000012120 _____ (Microsoft Corporation) C:\Windows\system32\api-ms-win-crt-locale-l1-1-0.dll

2018-06-08 17:29 - 2018-01-25 07:05 - 000012120 _____ (Microsoft Corporation) C:\Windows\system32\api-ms-win-crt-environment-l1-1-0.dll

2018-06-08 17:29 - 2018-01-25 07:05 - 000012120 _____ (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-synch-l1-2-0.dll

2018-06-08 17:29 - 2018-01-25 07:05 - 000012120 _____ (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-processthreads-l1-1-1.dll

2018-06-08 17:29 - 2018-01-25 07:05 - 000011608 _____ (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-xstate-l2-1-0.dll

2018-06-08 17:29 - 2018-01-25 07:05 - 000011608 _____ (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-timezone-l1-1-0.dll

2018-06-08 17:29 - 2018-01-25 07:05 - 000011608 _____ (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-file-l2-1-0.dll

2018-06-08 17:29 - 2018-01-25 07:05 - 000011608 _____ (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-file-l1-2-0.dll

2018-06-08 17:29 - 2018-01-25 07:04 - 000922944 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ucrtbase.dll

2018-06-08 17:29 - 2018-01-25 07:04 - 000066392 _____ (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-crt-private-l1-1-0.dll

2018-06-08 17:29 - 2018-01-25 07:04 - 000022360 _____ (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-crt-math-l1-1-0.dll

2018-06-08 17:29 - 2018-01-25 07:04 - 000019800 _____ (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-crt-multibyte-l1-1-0.dll

2018-06-08 17:29 - 2018-01-25 07:04 - 000017752 _____ (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-crt-string-l1-1-0.dll

2018-06-08 17:29 - 2018-01-25 07:04 - 000017752 _____ (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-crt-stdio-l1-1-0.dll

2018-06-08 17:29 - 2018-01-25 07:04 - 000016216 _____ (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-crt-runtime-l1-1-0.dll

2018-06-08 17:29 - 2018-01-25 07:04 - 000015704 _____ (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-crt-convert-l1-1-0.dll

2018-06-08 17:29 - 2018-01-25 07:04 - 000014168 _____ (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-crt-time-l1-1-0.dll

2018-06-08 17:29 - 2018-01-25 07:04 - 000014168 _____ (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-localization-l1-2-0.dll

2018-06-08 17:29 - 2018-01-25 07:04 - 000013656 _____ (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-crt-filesystem-l1-1-0.dll

2018-06-08 17:29 - 2018-01-25 07:04 - 000012632 _____ (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-crt-process-l1-1-0.dll

2018-06-08 17:29 - 2018-01-25 07:04 - 000012632 _____ (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-crt-heap-l1-1-0.dll

2018-06-08 17:29 - 2018-01-25 07:04 - 000012632 _____ (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-crt-conio-l1-1-0.dll

2018-06-08 17:29 - 2018-01-25 07:04 - 000012120 _____ (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-crt-utility-l1-1-0.dll

2018-06-08 17:29 - 2018-01-25 07:04 - 000012120 _____ (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-crt-locale-l1-1-0.dll

2018-06-08 17:29 - 2018-01-25 07:04 - 000012120 _____ (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-crt-environment-l1-1-0.dll

2018-06-08 17:29 - 2018-01-25 07:04 - 000012120 _____ (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-synch-l1-2-0.dll

2018-06-08 17:29 - 2018-01-25 07:04 - 000012120 _____ (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-processthreads-l1-1-1.dll

2018-06-08 17:29 - 2018-01-25 07:04 - 000011608 _____ (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-xstate-l2-1-0.dll

2018-06-08 17:29 - 2018-01-25 07:04 - 000011608 _____ (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-timezone-l1-1-0.dll

2018-06-08 17:29 - 2018-01-25 07:04 - 000011608 _____ (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-file-l2-1-0.dll

2018-06-08 17:29 - 2018-01-25 07:04 - 000011608 _____ (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-file-l1-2-0.dll

2018-06-08 17:29 - 2018-01-12 09:44 - 001894120 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\tcpip.sys

2018-06-08 17:29 - 2018-01-12 09:44 - 000377064 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\netio.sys

2018-06-08 17:29 - 2018-01-12 09:44 - 000287976 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\FWPKCLNT.SYS

2018-06-08 17:29 - 2018-01-12 09:40 - 000484864 _____ (Microsoft Corporation) C:\Windows\system32\StructuredQuery.dll

2018-06-08 17:29 - 2018-01-12 09:40 - 000407040 _____ (Microsoft Corporation) C:\Windows\system32\scesrv.dll

2018-06-08 17:29 - 2018-01-12 09:27 - 004834816 _____ (Microsoft Corporation) C:\Windows\system32\xpsrchvw.exe

2018-06-08 17:29 - 2018-01-12 09:26 - 000363520 _____ (Microsoft Corporation) C:\Windows\SysWOW64\StructuredQuery.dll

2018-06-08 17:29 - 2018-01-12 09:26 - 000308224 _____ (Microsoft Corporation) C:\Windows\SysWOW64\scesrv.dll

2018-06-08 17:29 - 2018-01-12 09:16 - 003405824 _____ (Microsoft Corporation) C:\Windows\SysWOW64\xpsrchvw.exe

2018-06-08 17:29 - 2018-01-12 09:16 - 000076288 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\hidclass.sys

2018-06-08 17:29 - 2018-01-12 09:16 - 000030208 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\hidusb.sys

2018-06-08 17:29 - 2018-01-12 09:15 - 000032896 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\hidparse.sys

2018-06-08 17:29 - 2018-01-11 09:41 - 001133568 _____ (Microsoft Corporation) C:\Windows\system32\cdosys.dll

2018-06-08 17:29 - 2018-01-11 09:22 - 000805376 _____ (Microsoft Corporation) C:\Windows\SysWOW64\cdosys.dll

2018-06-08 17:29 - 2017-12-31 19:21 - 001680616 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\ntfs.sys

2018-06-08 17:29 - 2017-12-31 19:21 - 000948968 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\ndis.sys

2018-06-08 17:29 - 2017-12-31 19:21 - 000288488 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\fltMgr.sys

2018-06-08 17:29 - 2017-12-31 19:21 - 000213736 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\rdyboost.sys

2018-06-08 17:29 - 2017-12-31 19:18 - 014183936 _____ (Microsoft Corporation) C:\Windows\system32\shell32.dll

2018-06-08 17:29 - 2017-12-31 19:18 - 002004480 _____ (Microsoft Corporation) C:\Windows\system32\msxml6.dll

2018-06-08 17:29 - 2017-12-31 19:18 - 001867776 _____ (Microsoft Corporation) C:\Windows\system32\ExplorerFrame.dll

2018-06-08 17:29 - 2017-12-31 19:18 - 001741312 _____ (Microsoft Corporation) C:\Windows\system32\sysmain.dll

2018-06-08 17:29 - 2017-12-31 19:18 - 001361408 _____ (Microsoft Corporation) C:\Windows\system32\PeerDistSvc.dll

2018-06-08 17:29 - 2017-12-31 19:18 - 001110528 _____ (Microsoft Corporation) C:\Windows\system32\schedsvc.dll

2018-06-08 17:29 - 2017-12-31 19:18 - 000961024 _____ (Microsoft Corporation) C:\Windows\system32\actxprxy.dll

2018-06-08 17:29 - 2017-12-31 19:18 - 000863232 _____ (Microsoft Corporation) C:\Windows\system32\IKEEXT.DLL

2018-06-08 17:29 - 2017-12-31 19:18 - 000842752 _____ (Microsoft Corporation) C:\Windows\system32\nshwfp.dll

2018-06-08 17:29 - 2017-12-31 19:18 - 000828928 _____ (Microsoft Corporation) C:\Windows\system32\MPSSVC.dll

2018-06-08 17:29 - 2017-12-31 19:18 - 000749568 _____ (Microsoft Corporation) C:\Windows\system32\FirewallAPI.dll

2018-06-08 17:29 - 2017-12-31 19:18 - 000705024 _____ (Microsoft Corporation) C:\Windows\system32\BFE.DLL

2018-06-08 17:29 - 2017-12-31 19:18 - 000473600 _____ (Microsoft Corporation) C:\Windows\system32\taskcomp.dll

2018-06-08 17:29 - 2017-12-31 19:18 - 000444928 _____ (Microsoft Corporation) C:\Windows\system32\winhttp.dll

2018-06-08 17:29 - 2017-12-31 19:18 - 000439296 _____ (Microsoft Corporation) C:\Windows\system32\p2psvc.dll

2018-06-08 17:29 - 2017-12-31 19:18 - 000366592 _____ (Microsoft Corporation) C:\Windows\system32\wcncsvc.dll

2018-06-08 17:29 - 2017-12-31 19:18 - 000327168 _____ (Microsoft Corporation) C:\Windows\system32\pnrpsvc.dll

2018-06-08 17:29 - 2017-12-31 19:18 - 000324096 _____ (Microsoft Corporation) C:\Windows\system32\FWPUCLNT.DLL

2018-06-08 17:29 - 2017-12-31 19:18 - 000303104 _____ (Microsoft Corporation) C:\Windows\system32\nlasvc.dll

2018-06-08 17:29 - 2017-12-31 19:18 - 000264704 _____ (Microsoft Corporation) C:\Windows\system32\P2P.dll

2018-06-08 17:29 - 2017-12-31 19:18 - 000223232 _____ (Microsoft Corporation) C:\Windows\system32\ncsi.dll

2018-06-08 17:29 - 2017-12-31 19:18 - 000181760 _____ (Microsoft Corporation) C:\Windows\system32\PeerDist.dll

2018-06-08 17:29 - 2017-12-31 19:18 - 000131584 _____ (Microsoft Corporation) C:\Windows\system32\PeerDistWSDDiscoProv.dll

2018-06-08 17:29 - 2017-12-31 19:18 - 000120320 _____ (Microsoft Corporation) C:\Windows\system32\WcnApi.dll

2018-06-08 17:29 - 2017-12-31 19:18 - 000108544 _____ (Microsoft Corporation) C:\Windows\system32\icfupgd.dll

2018-06-08 17:29 - 2017-12-31 19:18 - 000101376 _____ (Microsoft Corporation) C:\Windows\system32\fdWCN.dll

2018-06-08 17:29 - 2017-12-31 19:18 - 000095744 _____ (Microsoft Corporation) C:\Windows\system32\rascfg.dll

2018-06-08 17:29 - 2017-12-31 19:18 - 000076288 _____ (Microsoft Corporation) C:\Windows\system32\rasdiag.dll

2018-06-08 17:29 - 2017-12-31 19:18 - 000070656 _____ (Microsoft Corporation) C:\Windows\system32\nlaapi.dll

2018-06-08 17:29 - 2017-12-31 19:18 - 000060928 _____ (Microsoft Corporation) C:\Windows\system32\ndptsp.tsp

2018-06-08 17:29 - 2017-12-31 19:18 - 000053760 _____ (Microsoft Corporation) C:\Windows\system32\vmicres.dll

2018-06-08 17:29 - 2017-12-31 19:18 - 000051200 _____ (Microsoft Corporation) C:\Windows\system32\PeerDistHttpTrans.dll

2018-06-08 17:29 - 2017-12-31 19:18 - 000047104 _____ (Microsoft Corporation) C:\Windows\system32\kmddsp.tsp

2018-06-08 17:29 - 2017-12-31 19:18 - 000041472 _____ (Microsoft Corporation) C:\Windows\system32\rasmxs.dll

2018-06-08 17:29 - 2017-12-31 19:18 - 000039424 _____ (Microsoft Corporation) C:\Windows\system32\traffic.dll

2018-06-08 17:29 - 2017-12-31 19:18 - 000029696 _____ (Microsoft Corporation) C:\Windows\system32\rasser.dll

2018-06-08 17:29 - 2017-12-31 19:18 - 000024576 _____ (Microsoft Corporation) C:\Windows\system32\WcnEapPeerProxy.dll

2018-06-08 17:29 - 2017-12-31 19:18 - 000024064 _____ (Microsoft Corporation) C:\Windows\system32\WcnEapAuthProxy.dll

2018-06-08 17:29 - 2017-12-31 19:18 - 000022528 _____ (Microsoft Corporation) C:\Windows\system32\wfapigp.dll

2018-06-08 17:29 - 2017-12-31 19:18 - 000016896 _____ (Microsoft Corporation) C:\Windows\system32\wshqos.dll

2018-06-08 17:29 - 2017-12-31 19:18 - 000013312 _____ (Microsoft Corporation) C:\Windows\system32\wshnetbs.dll

2018-06-08 17:29 - 2017-12-31 19:18 - 000002048 _____ (Microsoft Corporation) C:\Windows\system32\msxml6r.dll

2018-06-08 17:29 - 2017-12-31 19:04 - 000559616 _____ (Microsoft Corporation) C:\Windows\system32\spoolsv.exe

2018-06-08 17:29 - 2017-12-31 19:00 - 012880384 _____ (Microsoft Corporation) C:\Windows\SysWOW64\shell32.dll

2018-06-08 17:29 - 2017-12-31 19:00 - 001499648 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ExplorerFrame.dll

2018-06-08 17:29 - 2017-12-31 19:00 - 001390080 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msxml6.dll

2018-06-08 17:29 - 2017-12-31 19:00 - 000666624 _____ (Microsoft Corporation) C:\Windows\SysWOW64\nshwfp.dll

2018-06-08 17:29 - 2017-12-31 19:00 - 000463360 _____ (Microsoft Corporation) C:\Windows\SysWOW64\FirewallAPI.dll

2018-06-08 17:29 - 2017-12-31 19:00 - 000351744 _____ (Microsoft Corporation) C:\Windows\SysWOW64\winhttp.dll

2018-06-08 17:29 - 2017-12-31 19:00 - 000304640 _____ (Microsoft Corporation) C:\Windows\SysWOW64\taskcomp.dll

2018-06-08 17:29 - 2017-12-31 19:00 - 000276992 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wcncsvc.dll

2018-06-08 17:29 - 2017-12-31 19:00 - 000217600 _____ (Microsoft Corporation) C:\Windows\SysWOW64\P2P.dll

2018-06-08 17:29 - 2017-12-31 19:00 - 000216576 _____ (Microsoft Corporation) C:\Windows\SysWOW64\FWPUCLNT.DLL

2018-06-08 17:29 - 2017-12-31 19:00 - 000162304 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ncsi.dll

2018-06-08 17:29 - 2017-12-31 19:00 - 000139776 _____ (Microsoft Corporation) C:\Windows\SysWOW64\PeerDist.dll

2018-06-08 17:29 - 2017-12-31 19:00 - 000081920 _____ (Microsoft Corporation) C:\Windows\SysWOW64\fdWCN.dll

2018-06-08 17:29 - 2017-12-31 19:00 - 000081408 _____ (Microsoft Corporation) C:\Windows\SysWOW64\rascfg.dll

2018-06-08 17:29 - 2017-12-31 19:00 - 000061952 _____ (Microsoft Corporation) C:\Windows\SysWOW64\rasdiag.dll

2018-06-08 17:29 - 2017-12-31 19:00 - 000052224 _____ (Microsoft Corporation) C:\Windows\SysWOW64\nlaapi.dll

2018-06-08 17:29 - 2017-12-31 19:00 - 000050688 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ndptsp.tsp

2018-06-08 17:29 - 2017-12-31 19:00 - 000033280 _____ (Microsoft Corporation) C:\Windows\SysWOW64\traffic.dll

2018-06-08 17:29 - 2017-12-31 19:00 - 000002048 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msxml6r.dll

2018-06-08 17:29 - 2017-12-31 18:59 - 000309760 _____ (Microsoft Corporation) C:\Windows\SysWOW64\actxprxy.dll

2018-06-08 17:29 - 2017-12-31 18:55 - 000131584 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\pacer.sys

2018-06-08 17:29 - 2017-12-31 18:55 - 000088576 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\wanarp.sys

2018-06-08 17:29 - 2017-12-31 18:55 - 000058368 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\ndproxy.sys

2018-06-08 17:29 - 2017-12-31 18:55 - 000045056 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\netbios.sys

2018-06-08 17:29 - 2017-12-31 18:55 - 000024064 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\ndistapi.sys

2018-06-08 17:29 - 2017-12-31 18:54 - 000077312 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\mpsdrv.sys

2018-06-08 17:29 - 2017-12-31 18:50 - 000455680 _____ (Microsoft Corporation) C:\Windows\system32\winlogon.exe

2018-06-08 17:29 - 2017-12-31 18:47 - 000244224 _____ (Microsoft Corporation) C:\Windows\system32\vmicsvc.exe

2018-06-08 17:29 - 2017-12-31 18:46 - 000128512 _____ (Microsoft Corporation) C:\Windows\system32\IcCoinstall.dll

2018-06-08 17:29 - 2017-12-31 18:43 - 000086528 _____ (Microsoft Corporation) C:\Windows\SysWOW64\WcnApi.dll

2018-06-08 17:29 - 2017-12-31 18:43 - 000038912 _____ (Microsoft Corporation) C:\Windows\SysWOW64\kmddsp.tsp

2018-06-08 17:29 - 2017-12-31 18:43 - 000033280 _____ (Microsoft Corporation) C:\Windows\SysWOW64\rasmxs.dll

2018-06-08 17:29 - 2017-12-31 18:43 - 000022528 _____ (Microsoft Corporation) C:\Windows\SysWOW64\rasser.dll

2018-06-08 17:29 - 2017-12-31 18:43 - 000020480 _____ (Microsoft Corporation) C:\Windows\SysWOW64\WcnEapPeerProxy.dll

2018-06-08 17:29 - 2017-12-31 18:43 - 000019968 _____ (Microsoft Corporation) C:\Windows\SysWOW64\WcnEapAuthProxy.dll

2018-06-08 17:29 - 2017-12-31 18:43 - 000018944 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wfapigp.dll

2018-06-08 17:29 - 2017-12-31 18:43 - 000013824 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wshqos.dll

2018-06-08 17:29 - 2017-12-31 18:41 - 000754176 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\http.sys

2018-06-08 17:29 - 2017-12-31 18:41 - 000106496 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\dfsc.sys

2018-06-08 17:29 - 2017-12-05 10:36 - 001484288 _____ (Microsoft Corporation) C:\Windows\system32\crypt32.dll

2018-06-08 17:29 - 2017-12-05 10:36 - 000625664 _____ (Microsoft Corporation) C:\Windows\system32\mscms.dll

2018-06-08 17:29 - 2017-12-05 10:36 - 000250880 _____ (Microsoft Corporation) C:\Windows\system32\icm32.dll

2018-06-08 17:29 - 2017-12-05 10:36 - 000229376 _____ (Microsoft Corporation) C:\Windows\system32\wintrust.dll

2018-06-08 17:29 - 2017-12-05 10:36 - 000190976 _____ (Microsoft Corporation) C:\Windows\system32\cryptsvc.dll

2018-06-08 17:29 - 2017-12-05 10:36 - 000141824 _____ (Microsoft Corporation) C:\Windows\system32\cryptnet.dll

2018-06-08 17:29 - 2017-12-05 10:36 - 000092160 _____ (Microsoft Corporation) C:\Windows\system32\TabSvc.dll

2018-06-08 17:29 - 2017-12-05 10:36 - 000040960 _____ (Microsoft Corporation) C:\Windows\system32\WcsPlugInService.dll

2018-06-08 17:29 - 2017-12-05 10:08 - 001176576 _____ (Microsoft Corporation) C:\Windows\SysWOW64\crypt32.dll

2018-06-08 17:29 - 2017-12-05 10:08 - 000481792 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mscms.dll

2018-06-08 17:29 - 2017-12-05 10:08 - 000215040 _____ (Microsoft Corporation) C:\Windows\SysWOW64\icm32.dll

2018-06-08 17:29 - 2017-12-05 10:08 - 000179200 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wintrust.dll

2018-06-08 17:29 - 2017-12-05 10:08 - 000145920 _____ (Microsoft Corporation) C:\Windows\SysWOW64\cryptsvc.dll

2018-06-08 17:29 - 2017-12-05 10:08 - 000106496 _____ (Microsoft Corporation) C:\Windows\SysWOW64\cryptnet.dll

2018-06-08 17:29 - 2017-12-05 09:04 - 000404992 _____ (Microsoft Corporation) C:\Windows\system32\wisptis.exe

2018-06-08 17:29 - 2017-12-05 08:49 - 000032768 _____ (Microsoft Corporation) C:\Windows\SysWOW64\WcsPlugInService.dll

2018-06-08 17:28 - 2018-06-08 17:49 - 000000000 ____D C:\Program Files\SUPERAntiSpyware

2018-06-08 17:28 - 2018-06-08 17:28 - 000001819 _____ C:\Users\Public\Desktop\SUPERAntiSpyware Free Edition.lnk

2018-06-08 17:28 - 2018-06-08 17:28 - 000000000 ____D C:\ProgramData\SUPERAntiSpyware.com

2018-06-08 17:28 - 2018-06-08 17:28 - 000000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\SUPERAntiSpyware

2018-06-08 17:21 - 2018-06-08 17:23 - 000000000 ____D C:\AdwCleaner

2018-06-08 17:15 - 2016-05-12 08:18 - 000090624 _____ (Microsoft Corporation) C:\Windows\SysWOW64\olepro32.dll

2018-06-08 16:28 - 2018-06-08 16:28 - 000300984 _____ (LogMeIn, Inc.) C:\Users\ah010073\Downloads\GoToMeeting Opener.exe

2018-06-08 16:05 - 2018-06-08 16:06 - 012205752 _____ (TeamViewer) C:\Users\ah010073\Downloads\TeamViewerQS.exe

2018-06-08 16:05 - 2018-06-08 16:06 - 000000000 ____D C:\Users\ah010073\AppData\Roaming\TeamViewer

2018-06-07 13:54 - 2018-06-09 16:42 - 000000000 ____D C:\Users\ah010073\AppData\Local\linear-26

2018-06-07 12:40 - 2018-06-07 12:40 - 005776384 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerInstaller.exe

2018-06-06 12:16 - 2018-06-06 12:16 - 000076349 _____ C:\Users\ah010073\Desktop\Mountain View Tosa signed d and a.pdf

2018-06-06 09:29 - 2018-06-06 09:29 - 000011907 _____ C:\Users\ah010073\Downloads\RFP1718-04IT_Copier_EquipmentSpecificationsResponseTemplate.xlsx

2018-06-04 09:32 - 2018-06-04 09:32 - 000000000 ____D C:\Users\ah010073\AppData\Roaming\smkits

2018-05-31 14:33 - 2018-05-31 14:33 - 000174736 _____ C:\Users\ah010073\Desktop\Mountain View Madrid Tosa units d and a.pdf

2018-05-31 10:11 - 2018-05-31 12:50 - 000458810 _____ C:\Users\ah010073\Desktop\Mock Trial - Mock Trial - Lease Proposal Longm 5-31-2018.docm

2018-05-30 15:17 - 2018-06-01 12:36 - 000012720 _____ C:\Users\ah010073\Desktop\Irvine USD Kyocera Proposed Equipment.xlsx

2018-05-29 11:21 - 2018-05-29 11:21 - 000040255 _____ C:\Users\ah010073\Desktop\AHMC Whittier for Rob V.xlsx

2018-05-29 10:04 - 2018-05-29 10:04 - 000983917 _____ C:\Users\ah010073\Desktop\2018 Summer Tech Show - IE.pdf

2018-05-29 10:02 - 2018-05-29 10:02 - 000984147 _____ C:\Users\ah010073\Desktop\2018 Summer Tech Show - Irvine.pdf

2018-05-25 09:29 - 2018-05-25 09:29 - 000098209 _____ C:\Users\ah010073\Downloads\DS11_Complete.pdf

2018-05-25 09:19 - 2018-05-25 09:19 - 000086201 _____ C:\Users\ah010073\Downloads\DS82_Complete.pdf

2018-05-25 09:19 - 2018-05-25 09:19 - 000086201 _____ C:\Users\ah010073\Downloads\DS82_Complete (1).pdf

2018-05-25 08:27 - 2018-05-25 08:27 - 000458236 _____ C:\Users\ah010073\Desktop\Mock Trial - Mock Trial - Lease Proposal Longm 5-25-2018.docm

2018-05-24 15:59 - 2018-05-24 15:59 - 003183785 _____ C:\Users\ah010073\Desktop\Mountain View Madrid Middle School closing package.pdf

2018-05-24 15:49 - 2018-05-24 15:49 - 003183785 _____ C:\Users\ah010073\Documents\Mountain View Madrid Elementary.pdf

2018-05-24 14:44 - 2018-05-24 15:55 - 000806009 _____ C:\Users\ah010073\Desktop\MOUNTAIN VIEW SCHOOL DISTRICT - Madrid MiddleSchool - Closing Sales Order Packet - Sherpa 4 - April 1st FY19 5-24-2018.xlsx

2018-05-24 12:03 - 2018-05-24 12:03 - 000458889 _____ C:\Users\ah010073\Desktop\PACIFIC ADVISORS - Pacific Advisors Refresh Option 2 - Lease Proposal Longm 5-24-2018.docm

2018-05-22 10:39 - 2018-05-22 10:39 - 000159058 _____ C:\Users\ah010073\Desktop\1bpFLJnXpU6KWRKh5RUqX97It-dpqQTb7.htm

2018-05-22 09:57 - 2018-05-22 09:57 - 000677315 _____ C:\Users\ah010073\Downloads\ECOSYS_P6130cdn_specs_2015_FNL.pdf

2018-05-18 12:25 - 2018-05-18 12:25 - 000204467 _____ C:\Users\ah010073\Desktop\Mountain View Madrid Middle School Lease doc.pdf

2018-05-17 16:57 - 2018-05-23 09:40 - 000014542 _____ C:\Users\ah010073\Desktop\SJUSD- units.xlsx

2018-05-17 15:14 - 2018-05-17 15:14 - 000272597 _____ C:\Users\ah010073\Desktop\Mountain View Transportation Copier signed d and a.pdf

2018-05-17 13:12 - 2018-05-17 13:12 - 010317494 _____ C:\Users\ah010073\Desktop\San Jacinto ASB unit signed agreements.pdf

2018-05-17 11:28 - 2018-05-30 11:08 - 000806034 _____ C:\Users\ah010073\Desktop\San Jacinto Unified School District - SJHS ASB 6535cidn updated - Closing Sales Order Packet - Sherpa 4 - April 1st FY19 5-17-2018.xlsx

2018-05-16 16:24 - 2018-05-16 16:33 - 000458687 _____ C:\Users\ah010073\Desktop\PACIFIC ADVISORS - Removed 4052.docm

2018-05-16 16:10 - 2018-05-16 16:22 - 000458931 _____ C:\Users\ah010073\Desktop\PACIFIC ADVISORS - Removed Desktops and 4052 - Lease Proposal Longm 5-16-2018.docm

2018-05-16 15:32 - 2018-05-16 15:56 - 000440095 _____ C:\Users\ah010073\Desktop\PACIFIC ADVISORS - Removed 4052 and desktops added San Jose units.docm

2018-05-15 19:11 - 2018-05-15 19:11 - 000000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Microsoft Silverlight

2018-05-15 19:10 - 2018-05-15 19:10 - 000000000 ____D C:\Program Files\Microsoft Silverlight

2018-05-15 19:10 - 2018-05-15 19:10 - 000000000 ____D C:\Program Files (x86)\Microsoft Silverlight

2018-05-15 18:58 - 2018-05-15 18:58 - 141696960 ____C (Microsoft Corporation) C:\Windows\system32\MRT-KB890830.exe

2018-05-15 18:52 - 2018-05-15 18:52 - 000000000 _____ C:\Windows\system32\GfxValDisplayLog.bin

2018-05-15 18:44 - 2018-05-15 18:44 - 000000000 ____D C:\Users\ah010073\AppData\Local\Microsoft Help

2018-05-15 18:34 - 2018-03-14 10:14 - 000135360 _____ (Microsoft Corporation) C:\Windows\system32\CompatTelRunner.exe

2018-05-15 18:34 - 2018-03-14 10:09 - 000656384 _____ (Microsoft Corporation) C:\Windows\system32\aeinv.dll

2018-05-15 18:34 - 2018-03-14 06:05 - 001993728 _____ (Microsoft Corporation) C:\Windows\system32\aitstatic.exe

2018-05-15 18:34 - 2018-03-14 06:05 - 001559552 _____ (Microsoft Corporation) C:\Windows\system32\appraiser.dll

2018-05-15 18:34 - 2018-03-14 06:05 - 000739840 _____ (Microsoft Corporation) C:\Windows\system32\generaltel.dll

2018-05-15 18:34 - 2018-03-14 06:05 - 000599552 _____ (Microsoft Corporation) C:\Windows\system32\devinv.dll

2018-05-15 18:34 - 2018-03-14 06:05 - 000450048 _____ (Microsoft Corporation) C:\Windows\system32\centel.dll

2018-05-15 18:34 - 2018-03-14 06:05 - 000414720 _____ (Microsoft Corporation) C:\Windows\system32\invagent.dll

2018-05-15 18:34 - 2018-03-14 06:05 - 000291840 _____ (Microsoft Corporation) C:\Windows\system32\acmigration.dll

2018-05-15 18:34 - 2018-03-14 06:05 - 000237056 _____ (Microsoft Corporation) C:\Windows\system32\aepic.dll

2018-05-15 18:34 - 2016-08-29 08:04 - 003229696 _____ (Microsoft Corporation) C:\Windows\explorer.exe

2018-05-15 18:34 - 2016-08-29 07:55 - 002972672 _____ (Microsoft Corporation) C:\Windows\SysWOW64\explorer.exe

2018-05-15 18:33 - 2016-07-07 08:08 - 000046080 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\tcpipreg.sys

2018-05-15 17:24 - 2016-03-09 12:00 - 000396800 _____ (Microsoft Corporation) C:\Windows\system32\webio.dll

2018-05-15 17:24 - 2016-03-09 11:40 - 000316416 _____ (Microsoft Corporation) C:\Windows\SysWOW64\webio.dll

2018-05-15 17:20 - 2016-03-09 11:54 - 000275456 _____ (Microsoft Corporation) C:\Windows\system32\InkEd.dll

2018-05-15 17:20 - 2016-03-09 11:34 - 000216064 _____ (Microsoft Corporation) C:\Windows\SysWOW64\InkEd.dll

2018-05-15 14:31 - 2018-06-09 17:49 - 000253664 _____ (Malwarebytes) C:\Windows\system32\Drivers\mbamswissarmy.sys

2018-05-15 14:31 - 2018-06-09 07:59 - 000001878 _____ C:\Users\Public\Desktop\Malwarebytes.lnk

2018-05-15 14:30 - 2018-05-15 14:30 - 000000000 ____D C:\ProgramData\Malwarebytes

2018-05-15 14:30 - 2018-05-15 14:30 - 000000000 ____D C:\Program Files\Malwarebytes

2018-05-15 14:30 - 2018-04-26 05:36 - 000152184 _____ (Malwarebytes) C:\Windows\system32\Drivers\mbae64.sys

2018-05-15 12:29 - 2018-05-15 12:29 - 000050748 _____ C:\Users\ah010073\Desktop\Health Source MSO signed d and a.pdf

2018-05-15 09:24 - 2018-05-15 09:24 - 000173864 _____ C:\Users\ah010073\Desktop\Health Source d and a.pdf

2018-05-14 19:53 - 2018-05-14 19:53 - 000125016 _____ C:\Users\ah010073\Desktop\AHMC Whittier Sch A.pdf

2018-05-14 19:41 - 2018-05-18 12:56 - 000617810 _____ C:\Users\ah010073\Desktop\AHMC Whittier agreements.pdf

2018-05-10 14:22 - 2018-05-10 14:22 - 003878506 _____ C:\Users\ah010073\Desktop\Mountain View Transportation closing package.pdf

2018-05-10 13:52 - 2018-05-10 13:52 - 000099284 _____ C:\Users\ah010073\Desktop\Exhibit C - Device Pricing Template.xlsx

2018-05-10 13:51 - 2018-05-10 13:51 - 000354343 _____ C:\Users\ah010073\Desktop\RFP 1817 Specifications.pdf

2018-05-10 13:51 - 2018-05-10 13:51 - 000277627 _____ C:\Users\ah010073\Desktop\Exhibit D - Price Proposal Form with Change Management Plan.xlsx

2018-05-10 13:51 - 2018-05-10 13:51 - 000275729 _____ C:\Users\ah010073\Desktop\Exhibit A - Statement of Work.pdf

2018-05-10 13:22 - 2018-05-10 14:20 - 000806685 _____ C:\Users\ah010073\Desktop\MOUNTAIN VIEW SCHOOL DISTRICT - Transportation Department - Closing Sales Order Packet - Sherpa 4 - April 1st FY19 5-10-2018.xlsx

2018-05-10 11:34 - 2018-05-10 11:34 - 000224968 _____ C:\Users\ah010073\Desktop\EOS signed d and a.pdf

2018-05-10 08:17 - 2018-05-11 12:23 - 007046805 _____ C:\Users\ah010073\Desktop\UCI Demo Presentation.pptx

==================== One Month Modified files and folders ========

(If an entry is included in the fixlist, the file/folder will be moved.)

2018-06-09 18:03 - 2015-12-24 01:53 - 000000952 _____ C:\Windows\Tasks\Nok Nok LabsMFACUpdaterTaskMachineUA.job

2018-06-09 17:57 - 2009-07-13 21:45 - 000031296 ____H C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0

2018-06-09 17:57 - 2009-07-13 21:45 - 000031296 ____H C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0

2018-06-09 17:53 - 2009-07-13 22:13 - 000801102 _____ C:\Windows\system32\PerfStringBackup.INI

2018-06-09 17:53 - 2009-07-13 20:20 - 000000000 ____D C:\Windows\inf

2018-06-09 17:51 - 2017-04-04 08:16 - 000000222 _____ C:\Windows\Tasks\Lenovo Active Protection System.job

2018-06-09 17:51 - 2016-05-02 16:03 - 000141288 _____ C:\Users\ah010073\AppData\Local\GDIPFONTCACHEV1.DAT

2018-06-09 17:51 - 2016-05-02 16:03 - 000000000 __SHD C:\Users\ah010073\IntelGraphicsProfiles

2018-06-09 17:51 - 2015-12-24 01:53 - 000000948 _____ C:\Windows\Tasks\Nok Nok LabsMFACUpdaterTaskMachineCore.job

2018-06-09 17:49 - 2016-05-02 16:56 - 000000000 ____D C:\ProgramData\ScreenConnect Client (2983e16809ce38ec)

2018-06-09 17:48 - 2018-02-14 13:32 - 000000000 ____D C:\ProgramData\Synaptics

2018-06-09 17:48 - 2017-02-24 11:24 - 000000000 ____D C:\Program Files\Common Files\McAfee

2018-06-09 17:48 - 2015-12-24 01:54 - 000000000 ____D C:\ProgramData\McAfee

2018-06-09 17:48 - 2009-07-13 22:08 - 000000006 ____H C:\Windows\Tasks\SA.DAT

2018-06-09 17:48 - 2009-07-13 21:45 - 000546896 _____ C:\Windows\system32\FNTCACHE.DAT

2018-06-09 17:46 - 2017-08-02 09:09 - 000000552 _____ C:\Windows\Tasks\G2MUpdateTask-S-1-5-21-345086361-1354177263-1882197541-10279.job

2018-06-09 17:46 - 2016-11-21 15:28 - 000000000 ____D C:\Program Files\Common Files\Intel

2018-06-09 17:35 - 2017-08-02 09:09 - 000000648 _____ C:\Windows\Tasks\G2MUploadTask-S-1-5-21-345086361-1354177263-1882197541-10279.job

2018-06-09 17:33 - 2016-04-09 18:05 - 000000000 ____D C:\Program Files (x86)\TeamViewer

2018-06-09 17:22 - 2016-05-23 16:05 - 000000000 ____D C:\Windows\SysWOW64\Macromed

2018-06-09 16:42 - 2015-04-18 20:50 - 000000000 ____D C:\ProgramData\algae-89

2018-06-09 16:42 - 2012-03-03 08:19 - 000000000 ____D C:\ProgramData\circle-4

2018-06-09 14:26 - 2017-10-05 01:48 - 000000000 ____D C:\Users\ah010073\AppData\Local\adhesion-85

2018-06-08 21:45 - 2016-05-02 16:25 - 000000000 ____D C:\Users\ah010073\AppData\Roaming\Juniper Networks

2018-06-08 21:24 - 2016-04-09 18:02 - 000000000 ___RD C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Microsoft Office 2013

2018-06-08 20:13 - 2016-07-26 14:07 - 000002096 _____ C:\Users\Public\Desktop\Lenovo Solution Center.lnk

2018-06-08 20:13 - 2015-12-24 01:49 - 000000000 ____D C:\Program Files\Lenovo

2018-06-08 20:13 - 2015-12-24 01:32 - 000000000 ____D C:\Windows\System32\Tasks\Lenovo

2018-06-08 20:13 - 2015-12-24 01:31 - 000000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Lenovo

2018-06-08 20:11 - 2015-12-24 01:49 - 000000000 ____D C:\Windows\Downloaded Installations

2018-06-08 19:09 - 2012-01-25 13:07 - 000000000 ____D C:\ProgramData\pk

2018-06-08 17:47 - 2009-07-13 20:20 - 000000000 ____D C:\Windows\PolicyDefinitions

2018-06-08 17:46 - 2016-05-02 16:03 - 000000000 ____D C:\Users\ah010073

2018-06-08 08:15 - 2016-05-02 15:59 - 000002776 _____ C:\Windows\system32\config\netlogon.ftl

2018-06-07 13:41 - 2016-04-09 18:30 - 000002235 _____ C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Google Chrome.lnk

2018-06-07 13:41 - 2016-04-09 18:30 - 000002194 _____ C:\Users\Public\Desktop\Google Chrome.lnk

2018-06-07 12:40 - 2018-04-16 11:16 - 000004470 _____ C:\Windows\System32\Tasks\Adobe Flash Player PPAPI Notifier

2018-06-07 12:40 - 2016-05-23 16:05 - 000842240 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerApp.exe

2018-06-07 12:40 - 2016-05-23 16:05 - 000175104 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerCPLApp.cpl

2018-06-07 12:40 - 2016-05-23 16:05 - 000004312 _____ C:\Windows\System32\Tasks\Adobe Flash Player Updater

2018-06-07 12:40 - 2016-05-23 16:05 - 000000000 ____D C:\Windows\system32\Macromed

2018-06-06 09:46 - 2018-03-08 11:43 - 000000000 ____D C:\Users\ah010073\AppData\Local\GoToMeeting

2018-06-04 11:44 - 2016-11-21 17:41 - 000000000 ____D C:\Users\ah010073\Desktop\to file away

2018-06-04 09:19 - 2017-02-24 11:24 - 000000000 ____D C:\Program Files (x86)\McAfee

2018-05-29 12:30 - 2017-07-28 15:11 - 000000000 ____D C:\Users\ah010073\Desktop\Stuff

2018-05-24 15:57 - 2018-04-17 14:51 - 000474092 _____ C:\Users\ah010073\Desktop\PACIFIC ADVISORS - Proposal.docm

2018-05-24 11:43 - 2017-08-02 09:09 - 000003674 _____ C:\Windows\System32\Tasks\G2MUploadTask-S-1-5-21-345086361-1354177263-1882197541-10279

2018-05-24 11:43 - 2017-08-02 09:09 - 000003578 _____ C:\Windows\System32\Tasks\G2MUpdateTask-S-1-5-21-345086361-1354177263-1882197541-10279

2018-05-24 10:36 - 2018-02-16 17:51 - 000039477 _____ C:\Users\ah010073\Desktop\Pacific Advisors 2 units revised 25 months.xlsx

2018-05-18 09:33 - 2018-02-28 17:01 - 000889344 _____ C:\Users\ah010073\Desktop\kyocera report card 1 2016.pub

2018-05-17 22:29 - 2016-04-09 18:30 - 000003332 _____ C:\Windows\System32\Tasks\GoogleUpdateTaskMachineUA

2018-05-17 22:29 - 2016-04-09 18:30 - 000003204 _____ C:\Windows\System32\Tasks\GoogleUpdateTaskMachineCore

2018-05-16 18:32 - 2016-05-02 16:01 - 000010817 __RSH C:\ProgramData\ntuser.pol

2018-05-16 18:26 - 2009-07-13 20:20 - 000000000 ____D C:\Windows\system32\NDF

2018-05-16 18:25 - 2016-05-24 19:27 - 000000000 ____D C:\Users\ah010073\AppData\Local\ElevatedDiagnostics

2018-05-16 08:15 - 2016-04-09 11:53 - 000000000 ___SD C:\Windows\system32\CompatTel

2018-05-16 08:15 - 2016-04-09 11:53 - 000000000 ____D C:\Windows\system32\appraiser

2018-05-16 08:15 - 2014-11-14 12:29 - 000000000 ____D C:\Windows\ShellNew

2018-05-15 19:17 - 2009-07-13 19:34 - 000004979 _____ C:\Windows\win.ini

2018-05-15 19:06 - 2014-11-13 15:07 - 000793716 _____ C:\Windows\SysWOW64\PerfStringBackup.INI

2018-05-15 19:03 - 2016-04-09 10:49 - 000000000 ____D C:\Windows\system32\MRT

2018-05-15 18:58 - 2016-04-09 10:49 - 141696960 ____C (Microsoft Corporation) C:\Windows\system32\MRT.exe

2018-05-15 18:53 - 2015-12-24 01:32 - 000000000 ____D C:\Program Files\Intel

2018-05-15 18:53 - 2015-12-24 01:32 - 000000000 ____D C:\Program Files (x86)\Intel

2018-05-15 17:07 - 2015-12-24 01:52 - 000002441 _____ C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Adobe Reader XI.lnk

2018-05-15 16:53 - 2018-04-16 11:22 - 000000000 ____D C:\Program Files (x86)\McAfee Safe Connect

2018-05-15 11:45 - 2018-05-08 14:14 - 000324382 _____ C:\Users\ah010073\Desktop\City of Riverside Exhibit D - Price Proposal Form with Change Management Plan.xlsx

2018-05-15 11:43 - 2018-05-08 14:13 - 000106525 _____ C:\Users\ah010073\Desktop\City of Riverside Exhibit C - Device Pricing Template.xlsx

==================== Files in the root of some directories =======

2017-06-14 08:41 - 2017-06-29 11:55 - 000181271 _____ () C:\Users\ah010073\AppData\Roaming\sherpa.dat

2018-06-09 01:12 - 2018-06-09 01:12 - 000335286 _____ () C:\Users\ah010073\AppData\Local\ars.cache

2018-06-09 01:13 - 2018-06-09 01:13 - 000905932 _____ () C:\Users\ah010073\AppData\Local\census.cache

2018-06-08 22:00 - 2018-06-09 08:01 - 000000036 _____ () C:\Users\ah010073\AppData\Local\housecall.guid.cache

2018-06-08 22:08 - 2018-06-08 22:08 - 000000010 _____ () C:\Users\ah010073\AppData\Local\sponge.last.runtime.cache

2018-02-02 15:51 - 2018-02-02 15:51 - 000000000 _____ () C:\Users\ah010073\AppData\Local\{127D0699-062C-4A83-A71A-892AA4BFC615}

2018-02-07 11:58 - 2018-02-07 11:58 - 000000000 _____ () C:\Users\ah010073\AppData\Local\{19FED61A-C305-490F-8587-4E566E4E949C}

2018-01-30 14:36 - 2018-01-30 14:36 - 000000000 _____ () C:\Users\ah010073\AppData\Local\{294DBCCA-A0B1-4652-9F1A-553794B00CBA}

Some files in TEMP:

====================

2018-06-09 17:46 - 2018-03-06 19:05 - 001013200 _____ (McAfee, Inc.) C:\Users\ah010073\AppData\Local\Temp\0236891528591588McInst.exe

Some zero byte size files/folders:

==========================

C:\Windows\SysWOW64\dlumd10.dll

C:\Windows\SysWOW64\dlumd11.dll

C:\Windows\SysWOW64\dlumd9.dll

C:\Windows\System32\dlumd10.dll

C:\Windows\System32\dlumd11.dll

C:\Windows\System32\dlumd9.dll

==================== Bamital & volsnap ======================

(There is no automatic fix for files that do not pass verification.)

C:\Windows\system32\winlogon.exe => File is digitally signed

C:\Windows\system32\wininit.exe => File is digitally signed

C:\Windows\SysWOW64\wininit.exe => File is digitally signed

C:\Windows\explorer.exe => File is digitally signed

C:\Windows\SysWOW64\explorer.exe => File is digitally signed

C:\Windows\system32\svchost.exe => File is digitally signed

C:\Windows\SysWOW64\svchost.exe => File is digitally signed

C:\Windows\system32\services.exe => File is digitally signed

C:\Windows\system32\User32.dll => File is digitally signed

C:\Windows\SysWOW64\User32.dll => File is digitally signed

C:\Windows\system32\userinit.exe => File is digitally signed

C:\Windows\SysWOW64\userinit.exe => File is digitally signed

C:\Windows\system32\rpcss.dll => File is digitally signed

C:\Windows\system32\dnsapi.dll => File is digitally signed

C:\Windows\SysWOW64\dnsapi.dll => File is digitally signed

C:\Windows\system32\Drivers\volsnap.sys => File is digitally signed

LastRegBack: 2018-06-07 00:05

==================== End of FRST.txt ============================

Additional scan result of Farbar Recovery Scan Tool (x64) Version: 06.06.2018 01

Ran by ah010073 (09-06-2018 18:17:31)

Running from C:\Users\ah010073\Downloads

Windows 7 Professional Service Pack 1 (X64) (2016-05-02 22:53:42)

Boot Mode: Normal

==========================================================

==================== Accounts: =============================

admin (S-1-5-21-201262395-2737818422-147992042-1000 - Administrator - Enabled) => C:\Users\admin

Administrator (S-1-5-21-201262395-2737818422-147992042-500 - Administrator - Disabled)

Guest (S-1-5-21-201262395-2737818422-147992042-501 - Limited - Disabled)

Katherine Hatcher (S-1-5-21-201262395-2737818422-147992042-1004 - Administrator - Enabled) => C:\Users\Katherine Hatcher

Setup (S-1-5-21-201262395-2737818422-147992042-1003 - Administrator - Enabled) => C:\Users\Setup

==================== Security Center ========================

(If an entry is included in the fixlist, it will be removed.)

AV: Malwarebytes (Enabled - Up to date) {23007AD3-69FE-687C-2629-D584AFFAF72B}

AV: Trend Micro OfficeScan Antivirus (Enabled - Up to date) {48929DFC-7A52-A34F-8351-C4DBEDBD9C50}

AS: Trend Micro OfficeScan Anti-spyware (Enabled - Up to date) {F3F37C18-5C68-ACC1-B9E1-FFA9963AD6ED}

AS: Malwarebytes (Enabled - Up to date) {98619B37-4FC4-67F2-1C99-EEF6D47DBD96}

AS: Windows Defender (Enabled - Up to date) {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}

==================== Installed Programs ======================

(Only the adware programs with "Hidden" flag could be added to the fixlist to unhide them. The adware programs should be uninstalled manually.)

Adobe AIR (HKLM-x32\...\Adobe AIR) (Version: 21.0.0.176 - Adobe Systems Incorporated)

Adobe Flash Player 30 ActiveX (HKLM-x32\...\Adobe Flash Player ActiveX) (Version: 30.0.0.113 - Adobe Systems Incorporated)

Adobe Flash Player 30 PPAPI (HKLM-x32\...\Adobe Flash Player PPAPI) (Version: 30.0.0.113 - Adobe Systems Incorporated)

Adobe Reader XI (11.0.23) MUI (HKLM-x32\...\{AC76BA86-7AD7-FFFF-7B44-AB0000000001}) (Version: 11.0.23 - Adobe Systems Incorporated)

Compass Sherpa v3 (HKLM-x32\...\{1D8ABB3C-AFD4-4FBE-92AF-99E9A0D6D3FB}) (Version: 3.00.0000 - Compass Sales Solutions)

Create Recovery Media (HKLM-x32\...\{50DC5136-21E8-48BC-97E5-1AD055F6B0B6}) (Version: 1.20.0.00 - Lenovo Group Limited)

DisplayLink Core Software (HKLM\...\{58F4C39B-D946-4A45-A314-DEFC2AFDF397}) (Version: 7.5.54609.0 - DisplayLink Corp.)

Dolby Home Theater v4 (HKLM-x32\...\{B26438B4-BF51-49C3-9567-7F14A5E40CB9}) (Version: 7.2.8000.17 - Dolby Laboratories Inc)

ExpressCache (HKLM\...\{44EAE7F6-8BBF-4C3F-A573-3CD5A3C067FA}) (Version: 1.3.110.0 - Condusiv Technologies)

Google Chrome (HKLM-x32\...\Google Chrome) (Version: 67.0.3396.79 - Google Inc.)

Google Update Helper (HKLM-x32\...\{60EC980A-BDA2-4CB6-A427-B07A5498B4CA}) (Version: 1.3.33.17 - Google Inc.) Hidden

Google Update Helper (HKLM-x32\...\{A92DAB39-4E2C-4304-9AB6-BC44E68B55E2}) (Version: 1.3.27.0 - Google Inc.) Hidden

GoTo Opener (HKLM-x32\...\{1F803452-798F-49FB-A5DD-9F527F7017E4}) (Version: 1.0.473 - LogMeIn, Inc.)

GoToMeeting 8.28.0.8847 (HKU\S-1-5-21-345086361-1354177263-1882197541-10279\...\GoToMeeting) (Version: 8.28.0.8847 - LogMeIn, Inc.)

HOST File Installer version 1.1 (HKLM-x32\...\{78D45494-2393-4A7E-AE10-6FD3B8237FB1}_is1) (Version: 1.1 - KDA SoCal)

IBM Notes 9.0.1 Social Edition (HKLM-x32\...\{FFEBEBC7-7761-4D1F-9C7C-562EA3752590}) (Version: 9.01.13294 - IBM)

IdeaMax 2.0.9.20140123 (HKLM-x32\...\{CA733A1D-AB25-452A-8228-BE14C0236A03}_is1) (Version: 2.0.9 - Newline Interactive)

IdeaMax Server 13.06.18 (HKLM-x32\...\{F7978EFB-25E0-4043-A68C-5FE25C4BA905}_is1) (Version: 13.06.18 - Newline Interactive)

Inst5676 (HKLM\...\{878F6913-7421-4713-97F7-0A736EE2A188}) (Version: 8.01.87 - Softex Inc.) Hidden

Integrated Camera (HKLM-x32\...\{E0A7ED39-8CD6-4351-93C3-69CCA00D12B4}) (Version: 6.2.9200.10291 - Realtek Semiconductor Corp.)

Integrated Camera (HKLM-x32\...\{E399A5B3-ED53-4DEA-AF04-8011E1EB1EAC}) (Version: 6.3.9600.11073 - Realtek Semiconductor Corp.)

Intel® Chipset Device Software (HKLM-x32\...\{f5d71765-7cd1-4e68-998f-5b379e725da3}) (Version: 10.0.22 - Intel® Corporation) Hidden

Intel® Management Engine Components (HKLM\...\{1CEAC85D-2590-4760-800F-8DE5E91F3700}) (Version: 10.0.30.1072 - Intel Corporation)

Intel® Processor Graphics (HKLM-x32\...\{F0E3AD40-2BBD-4360-9C76-B9AC9A5886EA}) (Version: 20.19.15.4703 - Intel Corporation)

Intel® Technology Access (HKLM-x32\...\{a3294ccc-6d01-43c2-9249-3f50bd113bb8}) (Version: 1.3.2.1030 - Intel Corporation)

Intel® Update Manager (HKLM-x32\...\{7224B7CE-196C-4E2A-A1AE-1D7BF259FD36}) (Version: 3.4.1942 - Intel Corporation)

Intel® USB 3.0\3.1 eXtensible Host Controller Driver (HKLM-x32\...\{240C3DDD-C5E9-4029-9DF7-95650D040CF2}) (Version: 5.0.3.42 - Intel Corporation)

Intel® WiDi (HKLM\...\{3F5D407B-86F5-4CA5-8F83-7C00BBB69080}) (Version: 5.1.23.0 - Intel Corporation)

Intel® Wireless Bluetooth®(patch version 17.1.1450.402) (HKLM\...\{302600C1-6BDF-4FD1-1411-148929CC1385}) (Version: 17.1.1411.0502 - Intel Corporation)

Intel® PROSet/Wireless Software (HKLM-x32\...\{a0f22a81-00d1-45d6-9cad-d93c57053e53}) (Version: 20.10.2 - Intel Corporation)

Java 8 Update 171 (64-bit) (HKLM\...\{26A24AE4-039D-4CA4-87B4-2F64180171F0}) (Version: 8.0.1710.11 - Oracle Corporation)

Juniper Networks, Inc. Setup Client (HKU\S-1-5-21-345086361-1354177263-1882197541-10279\...\Juniper_Setup_Client) (Version: 7.1.10.21853 - Juniper Networks, Inc.)

Kyocera Product Library (HKLM\...\Kyocera Product Library) (Version: 5.0.1120 - KYOCERA Document Solutions Inc.)

Lenovo Active Protection System (HKLM\...\{46A84694-59EC-48F0-964C-7E76E9F8A2ED}) (Version: 1.82.00.14 - Lenovo)

Lenovo Auto Scroll Utility (HKLM\...\LenovoAutoScrollUtility) (Version: 2.21 - Lenovo)

Lenovo Communications Utility (HKLM\...\{88C6A6D9-324C-46E8-BA87-563D14021442}_is1) (Version: 3.1.22.0 - Lenovo)

Lenovo Fingerprint Manager Pro (HKLM\...\{314FAD12-F785-4471-BCE8-AB506642B9A1}) (Version: 8.01.87 - Lenovo) Hidden

Lenovo Fingerprint Manager Pro (HKLM-x32\...\InstallShield_{314FAD12-F785-4471-BCE8-AB506642B9A1}) (Version: 8.01.87 - Lenovo)

Lenovo On Screen Display (HKLM\...\OnScreenDisplay) (Version: 8.86.25 - Lenovo)

Lenovo Peer Connect SDK (HKLM\...\{75C87855-9CBB-4892-B1A9-74C73A19CACA}_is1) (Version: 1.0.0.7 - Lenovo)

Lenovo Power Management Driver (HKLM\...\Power Management Driver) (Version: 1.67.12.16 - Lenovo) Hidden

Lenovo PowerENGAGE (HKLM-x32\...\{15B15395-FF53-44E1-ADAD-FCC279E3CA10}) (Version: 2.51.0040 - Lenovo Inc.)

Lenovo QuickControl (HKLM-x32\...\{04128C8C-7812-4DCC-816E-9C8AB1D6EECE}) (Version: 2.40 - Lenovo Group Limited)

Lenovo Service Bridge (HKU\S-1-5-21-345086361-1354177263-1882197541-10279\...\{2C74547D-EF88-47F4-85F5-BE46A31E26B7}_is1) (Version: 4.0.6.3 - Lenovo)

Lenovo Solution Center (HKLM\...\{06913C0C-88EB-42AF-9D94-3E9136CEE9BC}) (Version: 3.6.002.003 - Lenovo)

Lenovo System Update (HKLM-x32\...\TVSU_is1) (Version: 5.07.0070 - Lenovo)

Lenovo USB Graphics (HKLM\...\{E6B1FE9A-CB1E-4096-A0AF-163419CB971C}) (Version: 7.5.54614.0 - Lenovo)

Lenovo USB3.0 to DVI VGA Monitor Adapter (HKLM-x32\...\{454D32AD-C149-49BE-9F2E-8C089C3D6620}) (Version: 1.07.17 - Lenovo)

Lenovo User Guide (HKLM-x32\...\{13F59938-C595-479C-B479-F171AB9AF64F}) (Version: 1.0.0009.00 - Lenovo Group Limited)

Lenovo Warranty Information (HKLM-x32\...\{FD4EC278-C1B1-4496-99ED-C0BE1B0AA521}) (Version: 1.0.0011.00 - Lenovo)

Malwarebytes version 3.5.1.2522 (HKLM\...\{35065F43-4BB2-439A-BFF7-0F1014F2E0CD}_is1) (Version: 3.5.1.2522 - Malwarebytes)

Metric Collection SDK (HKLM-x32\...\{DDAA788F-52E6-44EA-ADB8-92837B11BF26}) (Version: 1.1.0012.00 - Lenovo Group Limited) Hidden

Metric Collection SDK 35 (HKLM-x32\...\{C2B5B5B0-2545-4E94-B4BA-548D4BF0B196}) (Version: 1.2.0006.00 - Lenovo Group Limited) Hidden

Microsoft .NET Framework 4.7.1 (HKLM\...\{92FB6C44-E685-45AD-9B20-CADF4CABA132} - 1033) (Version: 4.7.02558 - Microsoft Corporation)

Microsoft Office Standard 2013 (HKLM-x32\...\Office15.STANDARD) (Version: 15.0.4569.1506 - Microsoft Corporation)

Microsoft Silverlight (HKLM\...\{89F4137D-6C26-4A84-BDB8-2E5A4BB71E00}) (Version: 5.1.50907.0 - Microsoft Corporation)

Microsoft Visual C++ 2005 Redistributable (HKLM-x32\...\{710f4c1c-cc18-4c49-8cbf-51240c89a1a2}) (Version: 8.0.61001 - Microsoft Corporation)

Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729 (HKLM-x32\...\{86CE1746-9EFF-3C9C-8755-81EA8903AC34}) (Version: 9.0.30729 - Microsoft Corporation)

Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17 (HKLM-x32\...\{9A25302D-30C0-39D9-BD6F-21E6EC160475}) (Version: 9.0.30729 - Microsoft Corporation)

Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161 (HKLM-x32\...\{9BE518E6-ECC6-35A9-88E4-87755C07200F}) (Version: 9.0.30729.6161 - Microsoft Corporation)

Microsoft Visual C++ 2010 x64 Redistributable - 10.0.40219 (HKLM\...\{1D8E6291-B0D5-35EC-8441-6616F567A0F7}) (Version: 10.0.40219 - Microsoft Corporation)

Microsoft Visual C++ 2010 x86 Redistributable - 10.0.40219 (HKLM-x32\...\{F0C3E5D1-1ADE-321E-8167-68EF0DE699A5}) (Version: 10.0.40219 - Microsoft Corporation)

Microsoft Visual C++ 2012 Redistributable (x64) - 11.0.60610 (HKLM-x32\...\{a1909659-0a08-4554-8af1-2175904903a1}) (Version: 11.0.60610.1 - Microsoft Corporation)

Microsoft Visual C++ 2012 Redistributable (x64) - 11.0.61030 (HKLM-x32\...\{ca67548a-5ebe-413a-b50c-4b9ceb6d66c6}) (Version: 11.0.61030.0 - Microsoft Corporation)

Microsoft Visual C++ 2012 Redistributable (x86) - 11.0.60610 (HKLM-x32\...\{95716cce-fc71-413f-8ad5-56c2892d4b3a}) (Version: 11.0.60610.1 - Microsoft Corporation)

Microsoft Visual C++ 2013 Redistributable (x64) - 12.0.30501 (HKLM-x32\...\{050d4fc8-5d48-4b8f-8972-47c82c46020f}) (Version: 12.0.30501.0 - Microsoft Corporation)

Microsoft Visual Studio 2010 Tools for Office Runtime (x64) (HKLM\...\Microsoft Visual Studio 2010 Tools for Office Runtime (x64)) (Version: 10.0.50903 - Microsoft Corporation)

MSXML 4.0 SP2 (KB954430) (HKLM-x32\...\{86493ADD-824D-4B8E-BD72-8C5DCDC52A71}) (Version: 4.20.9870.0 - Microsoft Corporation)

MSXML 4.0 SP2 (KB973688) (HKLM-x32\...\{F662A8E6-F4DC-41A2-901E-8C11F044BDEC}) (Version: 4.20.9876.0 - Microsoft Corporation)

Multifactor Authentication Client (HKLM\...\{89F955AF-7274-4C60-B5ED-3530AFB88163}) (Version: 1.3.2.3008 - Nok Nok Labs)

Outils de vérification linguistique 2013 de Microsoft Office - Français (HKLM-x32\...\{90150000-001F-040C-0000-0000000FF1CE}) (Version: 15.0.4569.1506 - Microsoft Corporation) Hidden

Power Manager (HKLM-x32\...\{DAC01CEE-5BAE-42D5-81FC-B687E84E8405}) (Version: 6.68.10 - Lenovo Group Limited)

Realtek Card Reader (HKLM-x32\...\{5BC2B5AB-80DE-4E83-B8CF-426902051D0A}) (Version: 6.3.9600.21247 - Realtek Semiconductor Corp.)

Realtek High Definition Audio Driver (HKLM-x32\...\{F132AF7F-7BCA-4EDE-8A7C-958108FE7DBC}) (Version: 6.0.1.7368 - Realtek Semiconductor Corp.)

SAP Crystal Reports runtime engine for .NET Framework 4 (32-bit) (HKLM-x32\...\{8D6181F3-CACB-4B48-8B08-981F3A7F318B}) (Version: 13.0.0.99 - SAP)

ScreenConnect Client (2983e16809ce38ec) (HKLM-x32\...\{29247120-196E-4E92-9E10-C99613DC6D02}) (Version: 6.3.13446.6374 - ScreenConnect Software)

SHAREit (HKLM-x32\...\SHAREit_is1) (Version: 3.2.0.543 - Lenovo)

SSClient (HKLM-x32\...\{FBD62A5C-F9AF-4545-976F-A6FE59E488E1}) (Version: 2.00.0000 - Square 9 Softworks)

SUPERAntiSpyware (HKLM\...\{CDDCBBF1-2703-46BC-938B-BCC81A1EEAAA}) (Version: 6.0.1254 - SUPERAntiSpyware.com)

Synaptics Pointing Device Driver (HKLM\...\SynTPDeinstKey) (Version: 19.3.4.91 - Synaptics Incorporated)

Synaptics WBF DDK 5011 (HKLM\...\{4C261AE9-A217-4509-B00A-629C35D33A7A}) (Version: 4.5.336.0 - Synaptics)

Synaptics WBF DDK 5011 (HKLM\...\{4D70781C-36A9-4335-9568-565C6F61B5EB}) (Version: 4.5.336.0 - )

The Evolved Office Assistant 17 SP4 (17.4.68.1) MB3 (HKLM-x32\...\{48B802C2-F24B-4374-BE45-84F4C9B395F3}) (Version: 17.4.68.1 - Evolve IP)

Thinkpad USB Ethernet Adapter Driver (HKLM-x32\...\{D8102684-7BA1-4948-88B9-535F84E6E588}) (Version: 7.14.1114.2014 - Lenovo)

Trend Micro OfficeScan Client (HKLM-x32\...\{ECEA7878-2100-4525-915D-B09174E36971}) (Version: 10.0.1068 - Trend Micro)

Update for Skype for Business 2015 (KB4022170) 32-Bit Edition (HKLM-x32\...\{90150000-002A-0000-1000-0000000FF1CE}_Office15.STANDARD_{4F70C8C6-F2BE-4892-81EF-019021C921DD}) (Version: - Microsoft)

Windows Driver Package - Intel (e1dexpress) Net (07/15/2014 12.12.50.7202) (HKLM\...\9831220A78BC6CDB16870D8F80FF2AB41814019A) (Version: 07/15/2014 12.12.50.7202 - Intel)

Windows Driver Package - Intel Corporation (iaStorA) HDC (11/06/2014 13.6.0.1002) (HKLM\...\55320B67E6FF26D5CF6A352973677B5A68BD028B) (Version: 11/06/2014 13.6.0.1002 - Intel Corporation)

Windows Driver Package - Lenovo 1.67.09.03 (11/07/2014 1.67.09.03) (HKLM\...\FA3F6F3D6E8958FDDEE1E09CC77DFA71B0D7835A) (Version: 11/07/2014 1.67.09.03 - Lenovo)

Zoom (HKU\S-1-5-21-345086361-1354177263-1882197541-10279\...\ZoomUMX) (Version: 3.5 - Zoom Video Communications, Inc.)

==================== Custom CLSID (Whitelisted): ==========================

(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)

CustomCLSID: HKU\S-1-5-21-345086361-1354177263-1882197541-10279_Classes\CLSID\{84B5A313-CD5D-4904-8BA2-AFDC81C1B309}\InprocServer32 -> C:\Users\ah010073\AppData\Local\GoToMeeting\8679\G2MOutlookAddin64.dll (LogMeIn, Inc.)

ContextMenuHandlers3: [MBAMShlExt] -> {57CE581A-0CB6-4266-9CA0-19364C90A0B3} => C:\Program Files\Malwarebytes\Anti-Malware\mbshlext.dll [2018-05-09] (Malwarebytes)

ContextMenuHandlers5: [igfxcui] -> {3AB1675A-CCFF-11D2-8B20-00A0C93CB1F4} => -> No File

ContextMenuHandlers5: [igfxDTCM] -> {9B5F5829-A529-4B12-814A-E81BCB8D93FC} => C:\Windows\system32\igfxDTCM.dll [2017-09-21] (Intel Corporation)

ContextMenuHandlers6: [MBAMShlExt] -> {57CE581A-0CB6-4266-9CA0-19364C90A0B3} => C:\Program Files\Malwarebytes\Anti-Malware\mbshlext.dll [2018-05-09] (Malwarebytes)

==================== Scheduled Tasks (Whitelisted) =============

(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)

Task: {169C8004-7148-40D2-9BF3-5ECDFC89A16D} - System32\Tasks\Lenovo Active Protection System => C:\Windows\system32\TpShUI.exe [2017-03-21] (Lenovo.)

Task: {172E3044-68B2-48A1-B07F-E2AD3FDB1B64} - System32\Tasks\Adobe Flash Player PPAPI Notifier => C:\Windows\SysWOW64\Macromed\Flash\FlashUtil32_30_0_0_113_pepper.exe [2018-06-07] (Adobe Systems Incorporated)

Task: {27D4B4B9-49F5-4CD9-AD11-2B8D7F34E362} - System32\Tasks\G2MUploadTask-S-1-5-21-345086361-1354177263-1882197541-10279 => C:\Users\ah010073\AppData\Local\GoToMeeting\8847\g2mupload.exe [2018-05-24] (LogMeIn, Inc.)

Task: {28833BE3-1659-4250-B59E-6677F52274F6} - System32\Tasks\TVT\TVSUUpdateTask => C:\Program Files (x86)\Lenovo\System Update\tvsuShim.exe [2017-12-12] ()

Task: {39C06327-290D-4D84-BD91-F82223468DF3} - System32\Tasks\IUM-F1E24CA0-B63E-4F13-A9E3-4ADE3BFF3473 => C:\Program Files (x86)\Intel\Intel® Update Manager\bin\iumsvc.exe [2016-08-12] (Intel Corporation)

Task: {3A119009-E8E6-435D-BA45-AEAB7077BE24} - System32\Tasks\DiskUpdate => C:\SWTOOLS\OSFIXES\DISKUPDT\DiskUpdate.exe [2009-02-09] ()

Task: {424B0FB6-D827-4540-B912-93B11775F286} - System32\Tasks\PMTask => C:\Program Files (x86)\ThinkPad\Utilities\PwmIdTsv.exe [2016-04-14] (Lenovo Group Limited)

Task: {45EF69EA-0F1A-453D-AEEA-410AFB32ACCA} - System32\Tasks\Lenovo\Lenovo PowerENGAGE Update => C:\Program Files (x86)\Lenovo Registration\lenovoreg.exe [2015-01-09] (Aviata Inc)

Task: {48DDF359-CF8B-40EC-85E4-8AC7F8D39A07} - System32\Tasks\Adobe Acrobat Update Task => C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe [2018-02-09] (Adobe Systems Incorporated)

Task: {4CF93D02-F568-4F59-ADF7-FFAE26531CC9} - System32\Tasks\Lenovo\LSC\Lenovo Solution Center Notifications => C:\Program Files\Lenovo\Lenovo Solution Center\LSCNotify.exe [2017-06-09] (Lenovo)

Task: {5ABB0435-DA2B-4E3B-A8A4-DFFC43F5FFF6} - System32\Tasks\Microsoft\Office\OfficeTelemetryAgentFallBack => C:\Program Files\Microsoft Office\Office15\msoia.exe [2014-01-21] (Microsoft Corporation)

Task: {5B215934-C3C7-4828-B58F-20B7C12CB50B} - System32\Tasks\Lenovo\Lenovo PowerENGAGE => C:\Program Files (x86)\Lenovo Registration\lenovoreg.exe [2015-01-09] (Aviata Inc)

Task: {5FFE73F0-C94E-461E-9789-E1F510EA8FD5} - System32\Tasks\Lenovo\Lenovo Service Bridge\S-1-5-21-345086361-1354177263-1882197541-10279 => C:\Users\ah010073\AppData\Local\Programs\Lenovo\Lenovo Service Bridge\LSBUpdater.exe [2018-05-24] (Lenovo Group Limited)

Task: {64DB42FE-2AAD-4907-A1CC-6AA6E2AC8D43} - System32\Tasks\Lenovo\Lenovo Solution Center Launcher => C:\Program Files\Lenovo\Lenovo Solution Center\App\LSC.Services.UpdateStatusService.exe [2017-06-09] ()

Task: {64F6D8DE-59EB-4396-97C4-967CF361F528} - System32\Tasks\Adobe Flash Player Updater => C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe [2018-06-07] (Adobe Systems Incorporated)

Task: {720A0EA8-FA25-44F9-906D-EB750DE55582} - System32\Tasks\Lenovo\Lenovo Customer Feedback Program 64 35 => C:\Program Files (x86)\Lenovo\Customer Feedback Program 35\Lenovo.TVT.CustomerFeedback.Agent35.exe [2015-12-10] (Lenovo)

Task: {743B0CD6-E95D-42FA-86BA-2D92AA28A91A} - System32\Tasks\Microsoft\Office\OfficeTelemetryAgentLogOn => C:\Program Files\Microsoft Office\Office15\msoia.exe [2014-01-21] (Microsoft Corporation)

Task: {9278EC00-FF37-4F9D-BD35-44A88CB07EED} - System32\Tasks\Lenovo\LSC\LSCHardwareScan => C:\Program Files\Lenovo\Lenovo Solution Center\LSC.exe [2017-06-09] (Lenovo)

Task: {93AB8562-630F-4C22-B784-66D7392724DE} - System32\Tasks\RtHDVBg_Dolby => C:\Program Files\Realtek\Audio\HDA\RAVBg64.exe [2014-09-01] (Realtek Semiconductor)

Task: {9B164283-4B9B-4E51-86A7-6393285CEEBA} - System32\Tasks\{E26DAA6C-7E37-458B-9172-0192A05B90B8} => C:\Program Files (x86)\IBM\Notes\notes.exe [2013-10-15] (IBM Corp)

Task: {9C99CB8B-D44A-44CF-8F89-5AD2A32E52E0} - System32\Tasks\GoogleUpdateTaskMachineCore => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe [2016-04-09] (Google Inc.)

Task: {9E72018A-BAAC-484F-AEDD-20420C9CB3D0} - System32\Tasks\Nok Nok LabsMFACUpdaterTaskMachineUA => C:\Program Files (x86)\Nok Nok Labs\MFACUpdater\MFACUpdate.exe [2015-12-24] (Nok Nok Labs Inc.)

Task: {A6294065-A8C8-40FA-BF4A-E9C08B7E2B9D} - System32\Tasks\Lenovo\Lenovo Customer Feedback Program 64 => C:\Program Files (x86)\Lenovo\Customer Feedback Program\Lenovo.TVT.CustomerFeedback.Agent.exe [2015-07-01] (Lenovo)

Task: {C181E375-A64E-4797-870F-98903A425980} - System32\Tasks\RtHDVBg_LENOVO_MICPKEY => C:\Program Files\Realtek\Audio\HDA\RAVBg64.exe [2014-09-01] (Realtek Semiconductor)

Task: {C3A0CE5C-5A3A-4940-B7C3-CCF6E733D612} - System32\Tasks\Nok Nok LabsMFACUpdaterTaskMachineCore => C:\Program Files (x86)\Nok Nok Labs\MFACUpdater\MFACUpdate.exe [2015-12-24] (Nok Nok Labs Inc.)

Task: {D364947E-A24C-4677-877F-4D655F5CE142} - System32\Tasks\TVT\TVSUUpdateTask_UserLogOn => C:\Program Files (x86)\Lenovo\System Update\tvsuShim.exe [2017-12-12] ()

Task: {D5239B7F-175A-4A15-BFA4-096491873DEC} - System32\Tasks\{91AFAEFA-0F53-4B3A-BC8F-AFDBD9664896} => C:\Program Files (x86)\IBM\Notes\notes.exe [2013-10-15] (IBM Corp)

Task: {D937F23D-FD9A-4942-BDAF-783EFB22AD18} - System32\Tasks\GoogleUpdateTaskMachineUA => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe [2016-04-09] (Google Inc.)

Task: {DB22557B-35D1-4017-B70F-C53C08CC310D} - System32\Tasks\Lenovo\Lenovo Customer Feedback Program => C:\Program Files\Lenovo\Customer Feedback Program\Lenovo.TVT.CustomerFeedback.Agent.exe

Task: {DEA34CC3-702A-4693-9192-582F127E86CB} - System32\Tasks\IUM-F1E24CA0-B63E-4F13-A9E3-4ADE3BFF3473-Logon => C:\Program Files (x86)\Intel\Intel® Update Manager\bin\iumsvc.exe [2016-08-12] (Intel Corporation)

Task: {E0DF0E84-BC06-445E-8EE1-826331F7908A} - System32\Tasks\RTKCPL => C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe [2014-10-07] (Realtek Semiconductor)

Task: {E9D1CE3C-AF2A-4279-845B-820DE7A90014} - System32\Tasks\G2MUpdateTask-S-1-5-21-345086361-1354177263-1882197541-10279 => C:\Users\ah010073\AppData\Local\GoToMeeting\8847\g2mupdate.exe [2018-05-24] (LogMeIn, Inc.)

Task: {F4761B47-875A-423E-8549-4398E4F93CB4} - System32\Tasks\Microsoft\Office\Office 15 Subscription Heartbeat => C:\Program Files\Common Files\Microsoft Shared\Office15\OLicenseHeartbeat.exe

Task: {FA2AD0A7-6FC1-46DC-A208-82AEAD9D2682} - System32\Tasks\Microsoft\Windows\PLA\LSC Memory => C:\Windows\system32\rundll32.exe C:\Windows\system32\pla.dll,PlaHost "LSC Memory" "$(Arg0)"

Task: {FF0A5E76-829A-41F4-956E-FA09F0BAD809} - System32\Tasks\TVT\LaunchFR => C:\Program Files (x86)\Lenovo\Factory Recovery\FRReminder.exe [2014-08-20] (TODO: <Company name>)

(If an entry is included in the fixlist, the task (.job) file will be moved. The file which is running by the task will not be moved.)

Task: C:\Windows\Tasks\G2MUpdateTask-S-1-5-21-345086361-1354177263-1882197541-10279.job => C:\Users\ah010073\AppData\Local\GoToMeeting\8847\g2mupdate.exe

Task: C:\Windows\Tasks\G2MUploadTask-S-1-5-21-345086361-1354177263-1882197541-10279.job => C:\Users\ah010073\AppData\Local\GoToMeeting\8847\g2mupload.exe

Task: C:\Windows\Tasks\Lenovo Active Protection System.job => C:\Windows\system32\TpShUI.exe

Task: C:\Windows\Tasks\Nok Nok LabsMFACUpdaterTaskMachineCore.job => C:\Program Files (x86)\Nok Nok Labs\MFACUpdater\MFACUpdate.exe

Task: C:\Windows\Tasks\Nok Nok LabsMFACUpdaterTaskMachineUA.job => C:\Program Files (x86)\Nok Nok Labs\MFACUpdater\MFACUpdate.exe

==================== Shortcuts & WMI ========================

(The entries could be listed to be restored or removed.)

==================== Loaded Modules (Whitelisted) ==============

2015-01-23 17:58 - 2015-01-23 17:58 - 001795976 _____ () C:\Program Files\Intel Corporation\Intel® Technology Access\cpprest120_1_4.dll

2015-01-23 17:42 - 2015-01-23 17:42 - 000087552 _____ () C:\Program Files\Intel Corporation\Intel® Technology Access\libglog.dll

2015-01-23 17:58 - 2015-01-23 17:58 - 000357768 _____ () C:\Program Files\Intel Corporation\Intel® Technology Access\JsonCpp.dll

2017-06-14 17:59 - 2017-06-14 17:59 - 000090768 _____ () C:\Program Files (x86)\ScreenConnect Client (2983e16809ce38ec)\ScreenConnect.ClientService.exe

2018-05-15 14:30 - 2018-04-30 12:54 - 002493648 _____ () C:\PROGRAM FILES\MALWAREBYTES\ANTI-MALWARE\MwacLib.dll

2018-05-15 14:30 - 2018-04-25 13:16 - 002297040 _____ () C:\PROGRAM FILES\MALWAREBYTES\ANTI-MALWARE\SelfProtectionSdk.dll

2007-05-16 11:42 - 2007-05-16 11:42 - 000089088 _____ () C:\Program Files (x86)\Trend Micro\OfficeScan Client\zlibwapi.dll

2017-02-23 08:29 - 2017-02-23 08:29 - 008909512 _____ () C:\Program Files\Microsoft Office\Office15\1033\GrooveIntlResource.dll

2015-12-24 01:48 - 2016-04-14 06:08 - 000107008 ____N () C:\Program Files (x86)\ThinkPad\Utilities\US\PWMRT64V.DLL

2017-04-12 13:08 - 2013-06-18 10:59 - 012172288 _____ () C:\Program Files (x86)\IdeaMax Server\Driver\IdeaMax Server.exe

2018-02-07 09:28 - 2017-12-12 11:25 - 000023920 _____ () C:\Program Files (x86)\Lenovo\System Update\SUService.exe

2018-02-07 09:28 - 2017-12-12 11:25 - 000028016 _____ () C:\Program Files (x86)\Lenovo\System Update\uncserver.exe

2018-06-07 13:41 - 2018-06-05 18:25 - 004608856 _____ () C:\Program Files (x86)\Google\Chrome\Application\67.0.3396.79\libglesv2.dll

2018-06-07 13:41 - 2018-06-05 18:25 - 000099672 _____ () C:\Program Files (x86)\Google\Chrome\Application\67.0.3396.79\libegl.dll

==================== Alternate Data Streams (Whitelisted) =========

(If an entry is included in the fixlist, only the ADS will be removed.)

==================== Safe Mode (Whitelisted) ===================

(If an entry is included in the fixlist, it will be removed from the registry. The "AlternateShell" will be restored.)

HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\MBAMService => ""="Service"

HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\mcpltsvc => ""=""

HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\atashost => ""="Service"

HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\MBAMService => ""="Service"

HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\mcpltsvc => ""=""

HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\ScreenConnect Client (2983e16809ce38ec) => ""="Service"

==================== Association (Whitelisted) ===============

(If an entry is included in the fixlist, the registry item will be restored to default or removed.)

==================== Internet Explorer trusted/restricted ===============

(If an entry is included in the fixlist, it will be removed from the registry.)

IE trusted site: HKU\S-1-5-21-345086361-1354177263-1882197541-10279\...\kdacentral.com -> hxxps://direct.kdacentral.com

IE trusted site: HKU\S-1-5-21-345086361-1354177263-1882197541-10279\...\kdaconnect.com -> hxxps://vpn.kdaconnect.com

==================== Hosts content: ==========================

(If needed Hosts: directive could be included in the fixlist to reset Hosts.)

2009-07-13 19:34 - 2018-05-17 06:28 - 000001167 _____ C:\Windows\system32\Drivers\etc\hosts

10.128.18.6 CANotes01

10.128.18.12 KDAmailCA01

10.128.18.7 irvinesvr

10.128.0.205 kmawestern

10.128.0.12 HQNotes01

10.128.0.11 HQNotes03

10.128.0.67 HQNotes04

10.128.0.59 KMASametime

10.128.71.17 KDANotesPrd03

10.128.33.3 Server-473

10.128.33.5 SynologySD

10.128.18.5 IRVSQUARE9

==================== Other Areas ============================

(Currently there is no automatic fix for this section.)

HKU\S-1-5-21-345086361-1354177263-1882197541-10279\Control Panel\Desktop\\Wallpaper -> C:\Users\ah010073\AppData\Roaming\Microsoft\Windows\Themes\TranscodedWallpaper.jpg

DNS Servers: 10.0.0.1

HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System => (ConsentPromptBehaviorAdmin: 0) (ConsentPromptBehaviorUser: 3) (EnableLUA: 0)

Windows Firewall is enabled.

==================== MSCONFIG/TASK MANAGER disabled items ==

==================== FirewallRules (Whitelisted) ===============

(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)

FirewallRules: [SPPSVC-In-TCP] => (Allow) %SystemRoot%\system32\sppsvc.exe

FirewallRules: [SPPSVC-In-TCP-NoScope] => (Allow) %SystemRoot%\system32\sppsvc.exe

FirewallRules: [{7675C09A-F59D-4F91-B3C1-3D70AC8D3FE9}] => (Allow) C:\Program Files (x86)\Lenovo\QuickControl\QuickControlService.exe

FirewallRules: [{78A1CD28-645D-4832-9F18-B136BD6BCC3A}] => (Allow) C:\Program Files (x86)\Lenovo\QuickControl\QuickControlService.exe

FirewallRules: [{853E278B-3C49-4D97-8610-49DA714D15DD}] => (Allow) C:\Program Files\Intel Corporation\Intel WiDi\WiDiApp.exe

FirewallRules: [{2277C52B-B7CF-4425-AE5B-B8457BAC63BE}] => (Allow) C:\Program Files (x86)\Lenovo\SHAREit\SHAREit.exe

FirewallRules: [{46058CFB-D992-4A3E-8E90-8514C1FE501C}] => (Allow) C:\Program Files (x86)\Lenovo\SHAREit\SHAREit.exe

FirewallRules: [{92CDA2DB-39DE-4B5F-8353-F85E3B4415EA}] => (Allow) LPort=35115

FirewallRules: [{A84A253D-AE9C-4857-9C64-DAB98CA6ECEE}] => (Allow) LPort=9422

FirewallRules: [{F6A2F008-2EB0-418C-B81A-56DA8FDDA203}] => (Allow) LPort=9245

FirewallRules: [{576E80E5-AC37-468B-960C-C58C99773077}] => (Allow) LPort=9246

FirewallRules: [{D434E0F7-8E76-49C2-9015-EB8C237EBDA9}] => (Allow) LPort=9247

FirewallRules: [TCP Query User{9DE18238-669C-48DF-9793-67AC5FF1D47A}C:\users\ah010073\appdata\local\blue jeans\app\bluejeans.exe] => (Allow) C:\users\ah010073\appdata\local\blue jeans\app\bluejeans.exe

FirewallRules: [UDP Query User{26C54FEF-1AE2-416E-8F3D-4463BDC4B7B2}C:\users\ah010073\appdata\local\blue jeans\app\bluejeans.exe] => (Allow) C:\users\ah010073\appdata\local\blue jeans\app\bluejeans.exe

FirewallRules: [TCP Query User{0565B383-5556-4653-B296-A1AC83B4B73B}C:\users\ah010073\appdata\local\blue jeans\app\bluejeans.exe] => (Allow) C:\users\ah010073\appdata\local\blue jeans\app\bluejeans.exe

FirewallRules: [UDP Query User{66A76758-6506-4E61-BBD5-61B869E9A42D}C:\users\ah010073\appdata\local\blue jeans\app\bluejeans.exe] => (Allow) C:\users\ah010073\appdata\local\blue jeans\app\bluejeans.exe

FirewallRules: [{5E901942-FAE8-4203-A8C2-B2B18DAF1A81}] => (Allow) LPort=35115

FirewallRules: [{C917DCD4-0CCE-4209-BEE5-2D7CA38E025C}] => (Allow) C:\Program Files\Intel\WiFi\bin\PanDhcpDns.exe

FirewallRules: [{CDEB1D8C-31EE-476E-BF03-863C21709AD7}] => (Allow) C:\Program Files (x86)\Lenovo\System Update\uncserver.exe

FirewallRules: [{62F1C4EF-3B75-41DD-989E-E3E4108A7B68}] => (Allow) C:\Program Files (x86)\Lenovo\System Update\uncserver.exe

FirewallRules: [{D8D95F4B-F798-4121-B0DC-3120F7BB907B}] => (Allow) LPort=9422

FirewallRules: [{24D32618-BE13-4D53-80DD-24A8021BBB19}] => (Allow) LPort=9245

FirewallRules: [{A71B4FB7-CE90-4A65-8466-E03B57C80043}] => (Allow) LPort=9246

FirewallRules: [{154A613B-DA73-49C5-8EA8-6F0C5534F66D}] => (Allow) LPort=9247

FirewallRules: [{D2CB2F10-E5C2-41FB-97FA-35541E9B1D25}] => (Allow) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe

FirewallRules: [{B46103BC-6043-4334-BCAD-B20AC3AC3A01}] => (Allow) C:\Users\ah010073\AppData\Local\Temp\HouseCall\tmase\nmap\nmap.exe

FirewallRules: [{8FE9C12D-5DAB-454C-BF4D-BA505D2D4E67}] => (Allow) C:\Users\ah010073\AppData\Local\Temp\HouseCall\tmase\nmap\bonjour.exe

FirewallRules: [{14762308-3CE6-4B2D-90F0-6826FA191F5E}] => (Allow) LPort=35115

==================== Restore Points =========================

08-06-2018 17:30:29 Windows Update

08-06-2018 18:59:54 Windows Modules Installer

08-06-2018 19:02:28 Removed Java 8 Update 171 (64-bit)

08-06-2018 20:03:40 Windows Modules Installer

08-06-2018 20:12:20 Installed Lenovo Solution Center.

08-06-2018 20:17:27 Windows Update

08-06-2018 20:55:52 Installed TeamViewer 12 (MSI Wrapper)

08-06-2018 21:07:32 Windows Update

08-06-2018 21:15:06 Windows Update

08-06-2018 21:17:08 Windows Update

08-06-2018 21:23:38 Windows Update

08-06-2018 21:42:30 Windows Update

08-06-2018 21:57:42 Windows Update

09-06-2018 17:32:57 Removed TeamViewer 12 (MSI Wrapper)

==================== Faulty Device Manager Devices =============

==================== Event log errors: =========================

Application errors:

==================

Error: (06/09/2018 05:48:54 PM) (Source: WinMgmt) (EventID: 10) (User: )

Description: Event filter with query "SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 99" could not be reactivated in namespace "//./root/CIMV2" because of error 0x80041003. Events cannot be delivered through this filter until the problem is corrected.

Error: (06/09/2018 02:16:13 PM) (Source: WinMgmt) (EventID: 10) (User: )

Error: (06/09/2018 07:57:20 AM) (Source: Application Error) (EventID: 1000) (User: )

Description: Faulting application name: mbamtray.exe, version: 3.0.0.1284, time stamp: 0x5a15a98e

Faulting module name: Qt5Qml.dll, version: 5.6.2.0, time stamp: 0x59a6405a

Exception code: 0xc0000005

Fault offset: 0x000aaf25

Faulting process id: 0x684

Faulting application start time: 0x01d3ffaa4dccaef1

Faulting application path: C:\Program Files\Malwarebytes\Anti-Malware\mbamtray.exe

Faulting module path: C:\Program Files\Malwarebytes\Anti-Malware\Qt5Qml.dll

Report Id: 68180112-6bf5-11e8-90a8-185e0f706b46

Error: (06/09/2018 07:57:10 AM) (Source: Application Error) (EventID: 1000) (User: )

Description: Faulting application name: mbamtray.exe, version: 3.0.0.1284, time stamp: 0x5a15a98e

Faulting module name: mbamtray.exe, version: 3.0.0.1284, time stamp: 0x5a15a98e

Exception code: 0xc0000005

Fault offset: 0x000098a8

Faulting process id: 0x684

Faulting application start time: 0x01d3ffaa4dccaef1

Faulting application path: C:\Program Files\Malwarebytes\Anti-Malware\mbamtray.exe

Faulting module path: C:\Program Files\Malwarebytes\Anti-Malware\mbamtray.exe

Report Id: 6284c49d-6bf5-11e8-90a8-185e0f706b46

Error: (06/08/2018 09:25:59 PM) (Source: WinMgmt) (EventID: 10) (User: )

Error: (06/08/2018 08:31:34 PM) (Source: WinMgmt) (EventID: 10) (User: )

Error: (06/08/2018 05:51:15 PM) (Source: WinMgmt) (EventID: 10) (User: )

Error: (06/08/2018 05:09:52 PM) (Source: Application Error) (EventID: 1000) (User: )

Description: Faulting application name: mfac.exe, version: 1.3.2.3008, time stamp: 0x54402675

Faulting module name: ole32.dll, version: 6.1.7601.23889, time stamp: 0x598d5026

Exception code: 0xc0000005

Fault offset: 0x00000000000268eb

Faulting process id: 0x17fc

Faulting application start time: 0x01d3ff8322446e3b

Faulting application path: C:\Program Files\Nok Nok Labs\Multifactor Authentication Client\bin\mfac.exe

Faulting module path: C:\Windows\system32\ole32.dll

Report Id: 6e3cd629-6b79-11e8-b217-185e0f706b46

System errors:

=============

Error: (06/09/2018 05:55:55 PM) (Source: Disk) (EventID: 7) (User: )

Description: The device, \Device\Harddisk1\DR1, has a bad block.

Error: (06/09/2018 05:51:26 PM) (Source: Microsoft-Windows-GroupPolicy) (EventID: 1129) (User: KMA)

Description: The processing of Group Policy failed because of lack of network connectivity to a domain controller. This may be a transient condition. A success message would be generated once the machine gets connected to the domain controller and Group Policy has succesfully processed. If you do not see a success message for several hours, then contact your administrator.

Error: (06/09/2018 05:49:58 PM) (Source: DCOM) (EventID: 10016) (User: NT AUTHORITY)

Description: The application-specific permission settings do not grant Local Launch permission for the COM Server application with CLSID

{C97FCC79-E628-407D-AE68-A06AD6D8B4D1}

and APPID

{344ED43D-D086-4961-86A6-1106F4ACAD9B}

to the user NT AUTHORITY\SYSTEM SID (S-1-5-18) from address LocalHost (Using LRPC). This security permission can be modified using the Component Services administrative tool.

Error: (06/09/2018 05:48:51 PM) (Source: Microsoft-Windows-GroupPolicy) (EventID: 1055) (User: NT AUTHORITY)

Description: The processing of Group Policy failed. Windows could not resolve the computer name. This could be caused by one of more of the following:

a) Name Resolution failure on the current domain controller.

b) Active Directory Replication Latency (an account created on another domain controller has not replicated to the current domain controller).

Error: (06/09/2018 05:48:49 PM) (Source: NETLOGON) (EventID: 5719) (User: )

Description: This computer was not able to set up a secure session with a domain

controller in domain KMA due to the following:

There are currently no logon servers available to service the logon request.

This may lead to authentication problems. Make sure that this

computer is connected to the network. If the problem persists,

please contact your domain administrator.

ADDITIONAL INFO

If this computer is a domain controller for the specified domain, it

sets up the secure session to the primary domain controller emulator in the specified

domain. Otherwise, this computer sets up the secure session to any domain controller

in the specified domain.

Error: (06/09/2018 05:13:02 PM) (Source: Disk) (EventID: 7) (User: )

Description: The device, \Device\Harddisk1\DR1, has a bad block.

Error: (06/09/2018 03:59:29 PM) (Source: Microsoft-Windows-GroupPolicy) (EventID: 1129) (User: KMA)

Error: (06/09/2018 03:58:23 PM) (Source: Microsoft-Windows-GroupPolicy) (EventID: 1129) (User: NT AUTHORITY)

Windows Defender:

===================================

Date: 2016-04-11 15:28:53.154

Description:

Windows Defender scan has been stopped before completion.

Scan ID:{3ACB7E49-DD3A-4A94-94DA-54B13D47CD29}

Scan Type:AntiSpyware

Scan Parameters:Quick Scan

CodeIntegrity:

===================================

Date: 2017-04-04 08:15:27.489

Description:

Windows is unable to verify the image integrity of the file \Device\HarddiskVolume1\Program Files (x86)\Lenovo\System Update\ApsIns64.sys because file hash could not be found on the system. A recent hardware or software change might have installed a file that is signed incorrectly or damaged, or that might be malicious software from an unknown source.

Date: 2017-04-04 08:15:27.481

Description:

Date: 2017-04-04 08:15:13.966

Description:

Date: 2017-04-04 08:15:13.957

Description:

Date: 2017-04-04 08:15:02.676

Description:

Date: 2017-04-04 08:15:02.675

Description:

Date: 2017-03-28 08:24:59.103

Description:

Date: 2017-03-28 08:24:59.102

Description:

==================== Memory info ===========================

Processor: Intel® Core™ i5-5200U CPU @ 2.20GHz

Percentage of memory in use: 77%

Total physical RAM: 3792.36 MB

Available physical RAM: 835 MB

Total Virtual: 7582.89 MB

Available Virtual: 4010.84 MB

==================== Drives ================================

Drive c: (Windows7_OS) (Fixed) (Total:465.76 GB) (Free:393.43 GB) NTFS ==>[drive with boot components (obtained from BCD)]

==================== MBR & Partition Table ==================

========================================================

Disk: 0 (Size: 465.8 GB) (Disk ID: 5E1E98E7)

Partition 1: (Active) - (Size=465.8 GB) - (Type=07 NTFS)

========================================================

Disk: 1 (MBR Code: Windows 7/8/10) (Size: 14.9 GB) (Disk ID: C5B4DB3D)

Partition 1: (Not Active) - (Size=14.9 GB) - (Type=73)

==================== End of Addition.txt ============================

#2
RKinner

Posted 16 June 2018 - 08:36 PM

Malware Expert

Expert
24,699 posts

Error: (06/08/2018 05:09:52 PM) (Source: Application Error) (EventID: 1000) (User: )

Description: Faulting application name: mfac.exe, version: 1.3.2.3008, time stamp: 0x54402675

Faulting module name: ole32.dll, version: 6.1.7601.23889, time stamp: 0x598d5026

Exception code: 0xc0000005

Fault offset: 0x00000000000268eb

Faulting process id: 0x17fc

Faulting application start time: 0x01d3ff8322446e3b

Faulting application path: C:\Program Files\Nok Nok Labs\Multifactor Authentication Client\bin\mfac.exe

Faulting module path: C:\Windows\system32\ole32.dll

Report Id: 6e3cd629-6b79-11e8-b217-185e0f706b46

Appears to be this program:

Multifactor Authentication Client (HKLM\...\{89F955AF-7274-4C60-B5ED-3530AFB88163}) (Version: 1.3.2.3008 - Nok Nok Labs)

Do you need it? If not uninstall it. If you need it then try downloading a fresh version.

Is this computer part of a Domain?

Right click on (My) Computer and select Manage (Continue) Then click on the arrow in front of Event Viewer. Next Click on the arrow in front of Windows Logs Right click on System and Clear Log, Clear. Repeat for Application.

Reboot.

Start, All Programs, Accessories then right click on Command Prompt and Run as Administrator. Then type (with an Enter after each line).

sfc  /scannow

(This will check your critical system files. Does this finish without complaint? IF it says it couldn't fix everything then:

Copy the next two lines:

findstr /c:"[SR]" \windows\logs\cbs\cbs.log > %UserProfile%\desktop\junk.txt
notepad %UserProfile%\desktop\junk.txt

Start, All Programs, Accessories, right click on Command Prompt and Run as Administrator, Continue. Right click and Paste or Edit then Paste and the copied line should appear.
Hit Enter. Copy and paste the text from notepad or if it is too big, just attach the file.)

1. Please download the Event Viewer Tool by Vino Rosso
http://images.malwar...om/vino/VEW.exe
and save it to your Desktop:
2. Right-click VEW.exe and Run AS Administrator
3. Under 'Select log to query', select:

* System
4. Under 'Select type to list', select:
* Error
* Warning

Then use the 'Number of events' as follows:

1. Click the radio button for 'Number of events'
Type 20 in the 1 to 20 box
Then click the Run button.
Notepad will open with the output log.

Please post the Output log in your next reply then repeat but select Application. (Each time you run VEW it overwrites the log so copy the first one to a Reply or rename it before running it a second time.)

et Process Explorer

http://live.sysinter...com/procexp.exe
Save it to your desktop then run it (Vista or Win7+ - right click and Run As Administrator).

View, Select Column, check Verified Signer, OK
Options, Verify Image Signatures

Click twice on the CPU column header to sort things by CPU usage with the big hitters at the top.

Wait a full minute then:

File, Save As, Save. Note the file name. Open the file on your desktop and copy and paste the text to a reply.

Copy the next 2 lines:

TASKLIST /SVC > \junk.txt
notepad \junk.txt

Open an Elevated Command Prompt:
Win 7: Start, All Programs, Accessories then right click on Command Prompt and Run as Administrator
Win 8: http://www.eightforu...indows-8-a.html
win 10: http://www.howtogeek...-in-windows-10/

Right click and Paste (or Edit then Paste) and the copied lines should appear.
Hit Enter if notepad does not open. Copy and paste the text from notepad into a reply.

Get the free version of Speccy:

http://www.filehippo...ownload_speccy/

(Look in the upper right for the Download
Latest Version button - Do NOT press the large Start Download button on the upper left!)
Download, Save and Install it. Tell it you do not need CCLEANER. Run Speccy. When it finishes (the little icon in the bottom left will stop moving),
File, Save as Text File, (to your desktop) note the name it gives. OK. Open the file in notepad and delete the line that gives the serial number of your Operating System.
(It will be near the top, 10-20 lines down.) Save the file. Attach the file to your next post. Attaching the log is the best option as it is too big for the forum. Attaching is a multi step process.

First click on More Reply Options
Then scroll down to where you see
Choose File and click on it. Point it at the file and hit Open.
Now click on Attach this file.

#3
bhzendner

Posted 18 June 2018 - 05:10 PM

Member

Topic Starter
Member
226 posts

Noc Noc removed / rebooted

SFC found no issues

Vino's Event Viewer v01c run on Windows 2008 in English

Report run at 18/06/2018 3:47:05 PM

Note: All dates below are in the format dd/mm/yyyy

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

'System' Log - Critical Type

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

'System' Log - Error Type

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

Log: 'System' Date/Time: 18/06/2018 10:29:19 PM

Type: Error Category: 0

Event: 1030 Source: Microsoft-Windows-GroupPolicy

The processing of Group Policy failed. Windows attempted to retrieve new Group Policy settings for this user or computer. Look in the details tab for error code and description. Windows will automatically retry this operation at the next refresh cycle. Computers joined to the domain must have proper name resolution and network connectivity to a domain controller for discovery of new Group Policy objects and settings. An event will be logged when Group Policy is successful.

Log: 'System' Date/Time: 18/06/2018 10:28:10 PM

Type: Error Category: 0

Event: 10016 Source: Microsoft-Windows-DistributedCOM

The application-specific permission settings do not grant Local Launch permission for the COM Server application with CLSID {C97FCC79-E628-407D-AE68-A06AD6D8B4D1} and APPID {344ED43D-D086-4961-86A6-1106F4ACAD9B} to the user NT AUTHORITY\SYSTEM SID (S-1-5-18) from address LocalHost (Using LRPC). This security permission can be modified using the Component Services administrative tool.

Log: 'System' Date/Time: 18/06/2018 10:27:11 PM

Type: Error Category: 0

Event: 1030 Source: Microsoft-Windows-GroupPolicy

Log: 'System' Date/Time: 18/06/2018 10:25:32 PM

Type: Error Category: 0

Event: 7 Source: Disk

The device, \Device\Harddisk1\DR1, has a bad block.

Log: 'System' Date/Time: 18/06/2018 10:25:25 PM

Type: Error Category: 0

Event: 10010 Source: Microsoft-Windows-DistributedCOM

The server {995C996E-D918-4A8C-A302-45719A6F4EA7} did not register with DCOM within the required timeout.

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

'System' Log - Warning Type

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

Log: 'System' Date/Time: 18/06/2018 10:27:50 PM

Type: Warning Category: 7

Event: 37 Source: Microsoft-Windows-Kernel-Processor-Power

The speed of processor 1 in group 0 is being limited by system firmware. The processor has been in this reduced performance state for 71 seconds since the last report.

Log: 'System' Date/Time: 18/06/2018 10:27:50 PM

Type: Warning Category: 7

Event: 37 Source: Microsoft-Windows-Kernel-Processor-Power

The speed of processor 2 in group 0 is being limited by system firmware. The processor has been in this reduced performance state for 71 seconds since the last report.

Log: 'System' Date/Time: 18/06/2018 10:27:50 PM

Type: Warning Category: 7

Event: 37 Source: Microsoft-Windows-Kernel-Processor-Power

The speed of processor 3 in group 0 is being limited by system firmware. The processor has been in this reduced performance state for 71 seconds since the last report.

Log: 'System' Date/Time: 18/06/2018 10:27:50 PM

Type: Warning Category: 7

Event: 37 Source: Microsoft-Windows-Kernel-Processor-Power

The speed of processor 0 in group 0 is being limited by system firmware. The processor has been in this reduced performance state for 71 seconds since the last report.

Log: 'System' Date/Time: 18/06/2018 10:26:41 PM

Type: Warning Category: 212

Event: 219 Source: Microsoft-Windows-Kernel-PnP

The driver \Driver\WUDFRd failed to load for the device USB\VID_138A&PID_0017\0de61c0d575d.

Vino's Event Viewer v01c run on Windows 2008 in English

Report run at 18/06/2018 3:47:05 PM

Note: All dates below are in the format dd/mm/yyyy

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

'System' Log - Critical Type

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

'System' Log - Error Type

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

Log: 'System' Date/Time: 18/06/2018 10:29:19 PM

Type: Error Category: 0

Event: 1030 Source: Microsoft-Windows-GroupPolicy

Log: 'System' Date/Time: 18/06/2018 10:28:10 PM

Type: Error Category: 0

Event: 10016 Source: Microsoft-Windows-DistributedCOM

Log: 'System' Date/Time: 18/06/2018 10:27:11 PM

Type: Error Category: 0

Event: 1030 Source: Microsoft-Windows-GroupPolicy

Log: 'System' Date/Time: 18/06/2018 10:25:32 PM

Type: Error Category: 0

Event: 7 Source: Disk

The device, \Device\Harddisk1\DR1, has a bad block.

Log: 'System' Date/Time: 18/06/2018 10:25:25 PM

Type: Error Category: 0

Event: 10010 Source: Microsoft-Windows-DistributedCOM

The server {995C996E-D918-4A8C-A302-45719A6F4EA7} did not register with DCOM within the required timeout.

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

'System' Log - Warning Type

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

Log: 'System' Date/Time: 18/06/2018 10:27:50 PM

Type: Warning Category: 7

Event: 37 Source: Microsoft-Windows-Kernel-Processor-Power

The speed of processor 1 in group 0 is being limited by system firmware. The processor has been in this reduced performance state for 71 seconds since the last report.

Log: 'System' Date/Time: 18/06/2018 10:27:50 PM

Type: Warning Category: 7

Event: 37 Source: Microsoft-Windows-Kernel-Processor-Power

The speed of processor 2 in group 0 is being limited by system firmware. The processor has been in this reduced performance state for 71 seconds since the last report.

Log: 'System' Date/Time: 18/06/2018 10:27:50 PM

Type: Warning Category: 7

Event: 37 Source: Microsoft-Windows-Kernel-Processor-Power

The speed of processor 3 in group 0 is being limited by system firmware. The processor has been in this reduced performance state for 71 seconds since the last report.

Log: 'System' Date/Time: 18/06/2018 10:27:50 PM

Type: Warning Category: 7

Event: 37 Source: Microsoft-Windows-Kernel-Processor-Power

The speed of processor 0 in group 0 is being limited by system firmware. The processor has been in this reduced performance state for 71 seconds since the last report.

Log: 'System' Date/Time: 18/06/2018 10:26:41 PM

Type: Warning Category: 212

Event: 219 Source: Microsoft-Windows-Kernel-PnP

The driver \Driver\WUDFRd failed to load for the device USB\VID_138A&PID_0017\0de61c0d575d.

Process CPU Private Bytes Working Set PID Description Company Name Verified Signer

System Idle Process 79.27 0 K 24 K 0

ScreenConnect.WindowsClient.exe 7.15 132,920 K 140,616 K 5404 ScreenConnect Client ScreenConnect Software (Verified) ScreenConnect Software

System 4.19 148 K 1,324 K 4

dwm.exe 3.72 37,892 K 41,872 K 6576 Desktop Window Manager Microsoft Corporation (Verified) Microsoft Windows

ExpressCache.exe 1.63 24,824 K 79,648 K 2428 ExpressCache Service Condusiv Technologies (Verified) CONDUSIV TECHNOLOGIES

procexp64.exe 1.33 52,520 K 68,312 K 1644 Sysinternals Process Explorer Sysinternals - www.sysinternals.com (Verified) Microsoft Corporation

WmiPrvSE.exe 1.03 6,940 K 14,016 K 4348 WMI Provider Host Microsoft Corporation (Verified) Microsoft Windows

Interrupts 0.77 0 K 0 K n/a Hardware Interrupts and DPCs

ScreenConnect.ClientService.exe 0.22 18,188 K 24,224 K 2820 (Verified) ScreenConnect Software

csrss.exe 0.20 2,896 K 25,752 K 732 Client Server Runtime Process Microsoft Corporation (Verified) Microsoft Windows

svchost.exe 0.13 35,452 K 52,516 K 1348 Host Process for Windows Services Microsoft Corporation (Verified) Microsoft Windows

svchost.exe 0.11 84,548 K 92,500 K 1280 Host Process for Windows Services Microsoft Corporation (Verified) Microsoft Windows

virtscrl.exe 0.04 1,640 K 5,040 K 4632 Lenovo Auto Scroll Utility Lenovo Group Limited (Verified) Lenovo

IdeaMax Server.exe 0.04 17,624 K 14,724 K 7548 (No signature was present in the subject)

wisptis.exe 0.03 4,268 K 11,308 K 3460 Microsoft Pen and Touch Input Component Microsoft Corporation (Verified) Microsoft Windows

SUPERANTISPYWARE.EXE 0.02 18,596 K 11,220 K 7212 SUPERAntiSpyware Application SUPERAntiSpyware (Verified) Support.com

TpKnrres.exe 0.02 6,940 K 8,224 K 6656 Communications Utility launcher Lenovo Group Limited (Verified) Lenovo

svchost.exe 0.02 17,680 K 20,652 K 1232 Host Process for Windows Services Microsoft Corporation (Verified) Microsoft Windows

PccNTMon.exe 0.01 7,904 K 15,912 K 7532 Trend Micro OfficeScan Monitor Trend Micro Inc. (Verified) Trend Micro

DisplayLinkManager.exe 0.01 9,220 K 14,836 K 1588 DisplayLinkManager Application DisplayLink Corp. (Verified) DISPLAYLINK

explorer.exe 0.01 69,688 K 82,612 K 6604 Windows Explorer Microsoft Corporation (Verified) Microsoft Windows

lsass.exe 0.01 6,028 K 15,332 K 788 Local Security Authority Process Microsoft Corporation (Verified) Microsoft Windows

TmListen.exe < 0.01 13,436 K 23,632 K 3496 Trend Micro Common Client Communication Service Trend Micro Inc. (Verified) Trend Micro

SASCore64.exe < 0.01 1,640 K 4,260 K 2276 Core Service SUPERAntiSpyware.com (Verified) SUPERAntiSpyware.com

LSB.exe < 0.01 76,056 K 1,464 K 5012 Lenovo Service Bridge Lenovo Group Limited (Verified) Lenovo (Beijing) Limited

SearchIndexer.exe < 0.01 32,004 K 21,060 K 7072 Microsoft Windows Search Indexer Microsoft Corporation (Verified) Microsoft Windows

taskhost.exe < 0.01 13,988 K 16,848 K 4240 Host Process for Windows Tasks Microsoft Corporation (Verified) Microsoft Windows

WUDFHost.exe < 0.01 4,008 K 10,752 K 1748 Windows Driver Foundation - User-mode Driver Framework Host Process Microsoft Corporation (Verified) Microsoft Windows

EvtEng.exe < 0.01 7,172 K 15,072 K 2396 Intel® PROSet/Wireless Event Log Service Intel® Corporation (Verified) Intel® Wireless Connectivity Solutions

svchost.exe < 0.01 10,792 K 17,868 K 1304 Host Process for Windows Services Microsoft Corporation (Verified) Microsoft Windows

lsm.exe < 0.01 2,976 K 4,932 K 796 Local Session Manager Service Microsoft Corporation (Verified) Microsoft Windows

NTRTScan.exe < 0.01 25,596 K 34,096 K 2340 Trend Micro Common Client Real-time Scan Service (64-bit) Trend Micro Inc. (Verified) Trend Micro

svchost.exe < 0.01 14,048 K 16,052 K 2212 Host Process for Windows Services Microsoft Corporation (Verified) Microsoft Windows

valWBFPolicyService.exe < 0.01 3,872 K 7,144 K 3256 Synaptics WBF Policy Service (CMN) Synaptics Incorporated (Verified) Synaptics Inc.

wmpnetwk.exe < 0.01 11,092 K 7,624 K 7024 Windows Media Player Network Sharing Service Microsoft Corporation (Verified) Microsoft Windows

SynTPEnh.exe < 0.01 14,332 K 22,732 K 4244 Synaptics TouchPad 64-bit Enhancements Synaptics Incorporated (Verified) Synaptics Incorporated

spoolsv.exe < 0.01 19,332 K 25,196 K 2020 Spooler SubSystem App Microsoft Corporation (Verified) Microsoft Windows

IntelTechnologyAccessService.exe < 0.01 14,520 K 23,352 K 2864 Intel® Technology Access - Service Intel® Corporation (Verified) Intel® Technology Access

ibmpmsvc.exe < 0.01 1,784 K 5,104 K 1004 Lenovo Power Management Service Lenovo. (Verified) Lenovo

RtsCM64.exe < 0.01 2,400 K 7,224 K 6584 Realtek Camera Man Realtek Semiconductor Corp. (Verified) Realtek Semiconductor Corp

SynLenovoHelper.exe < 0.01 3,000 K 7,228 K 6180 SynLenovo Helper tool Synaptics (Verified) Synaptics Incorporated

LPlatSvc.exe < 0.01 2,224 K 5,944 K 164 Lenovo Platform Service Lenovo. (Verified) Lenovo

svchost.exe < 0.01 56,236 K 31,116 K 3336 Host Process for Windows Services Microsoft Corporation (Verified) Microsoft Windows

SynTPEnhService.exe < 0.01 2,336 K 6,404 K 3112 64-bit Synaptics Pointing Enhance Service Synaptics Incorporated (Verified) Synaptics Incorporated

LPlatSvc.exe < 0.01 1,916 K 5,900 K 4636 Lenovo Platform Service Lenovo. (Verified) Lenovo

ZeroConfigService.exe 6,104 K 15,120 K 3368 Intel® PROSet/Wireless Zero Configure Service Intel® Corporation (Verified) Intel® Wireless Connectivity Solutions

WmiPrvSE.exe 4,504 K 11,104 K 4356 WMI Provider Host Microsoft Corporation (Verified) Microsoft Windows

wlanext.exe 6,884 K 17,108 K 2036 Windows Wireless LAN 802.11 Extensibility Framework Microsoft Corporation (Verified) Microsoft Windows

wisptis.exe 3,548 K 8,404 K 1728 Microsoft Pen and Touch Input Component Microsoft Corporation (Verified) Microsoft Windows

winlogon.exe 3,368 K 8,196 K 1116 Windows Logon Application Microsoft Corporation (Verified) Microsoft Windows

wininit.exe 1,952 K 5,196 K 712 Windows Start-Up Application Microsoft Corporation (Verified) Microsoft Windows

vcamsvc.exe 14,120 K 11,808 K 2988 Lenovo Virtual Camera Controller Lenovo Group Limited (Verified) Lenovo

unsecapp.exe 1,864 K 5,656 K 4812 Sink to receive asynchronous callbacks for WMI client application Microsoft Corporation (Verified) Microsoft Windows

unsecapp.exe 2,212 K 6,724 K 5500 Sink to receive asynchronous callbacks for WMI client application Microsoft Corporation (Verified) Microsoft Windows

UNCServer.exe 16,428 K 1,152 K 8460 UNCServer (Verified) Lenovo

UI0Detect.exe 2,452 K 7,360 K 4380 Interactive services detection Microsoft Corporation (Verified) Microsoft Windows

TpShocks.exe 2,504 K 804 K 4200 Active Protection System Lenovo. (Verified) Lenovo

TPONSCR.exe 2,364 K 8,940 K 4620 On screen display drawer Lenovo Group Limited (Verified) Lenovo

TPKNRSVC.exe 1,088 K 3,636 K 2964 Microphone volume control service Lenovo Group Limited (Verified) Lenovo

TPHKSVC.exe 1,612 K 5,012 K 3184 On screen display Fn+Fx handler Lenovo Group Limited (Verified) LENOVO

tphkload.exe 7,612 K 9,864 K 3680 ThinkPad Message Client Loader Lenovo Group Limited (Verified) Lenovo

taskeng.exe 2,044 K 5,748 K 7468 Task Scheduler Engine Microsoft Corporation (Verified) Microsoft Windows

taskeng.exe 2,832 K 7,620 K 5672 Task Scheduler Engine Microsoft Corporation (Verified) Microsoft Windows

TabTip32.exe 844 K 3,176 K 3568 Tablet PC Input Panel Helper Microsoft Corporation (Verified) Microsoft Windows

TabTip.exe 5,748 K 14,280 K 2856 Tablet PC Input Panel Accessory Microsoft Corporation (Verified) Microsoft Windows

SynTPLpr.exe 2,100 K 5,780 K 6172 TouchPad Driver Helper Application Synaptics Incorporated (Verified) Synaptics Incorporated

SynTPHelper.exe 1,484 K 4,256 K 2668 Synaptics Pointing Device Helper Synaptics Incorporated (Verified) Synaptics Incorporated

svchost.exe 4,980 K 10,528 K 916 Host Process for Windows Services Microsoft Corporation (Verified) Microsoft Windows

svchost.exe 7,064 K 13,732 K 2528 Host Process for Windows Services Microsoft Corporation (Verified) Microsoft Windows

svchost.exe 5,448 K 9,596 K 848 Host Process for Windows Services Microsoft Corporation (Verified) Microsoft Windows

svchost.exe 14,508 K 16,932 K 2112 Host Process for Windows Services Microsoft Corporation (Verified) Microsoft Windows

svchost.exe 3,616 K 7,376 K 1944 Host Process for Windows Services Microsoft Corporation (Verified) Microsoft Windows

svchost.exe 4,860 K 8,476 K 2364 Host Process for Windows Services Microsoft Corporation (Verified) Microsoft Windows

svchost.exe 1,852 K 5,228 K 4884 Host Process for Windows Services Microsoft Corporation (Verified) Microsoft Windows

svchost.exe 4,724 K 8,932 K 1424 Host Process for Windows Services Microsoft Corporation (Verified) Microsoft Windows

svchost.exe 2,096 K 6,196 K 3092 Host Process for Windows Services Microsoft Corporation (Verified) Microsoft Windows

svchost.exe 2,392 K 6,364 K 4932 Host Process for Windows Services Microsoft Corporation (Verified) Microsoft Windows

SUService.exe 1,836 K 5,796 K 3044 IBM Notes/Domino IBM Corp (Verified) International Business Machines Corporation

SUService.exe 8,984 K 15,780 K 8356 Lenovo System Update Service (Verified) Lenovo

smss.exe 584 K 1,340 K 460 Windows Session Manager Microsoft Corporation (Verified) Microsoft Windows

shtctky.exe 2,048 K 5,728 K 4576 ThinkPad Message Receiver for Shortcut Hot Keys Lenovo Group Limited (Verified) Lenovo

services.exe 7,612 K 11,788 K 768 Services and Controller app Microsoft Corporation (Verified) Microsoft Windows

ScreenConnect.WindowsClient.exe 29,384 K 36,756 K 2836 ScreenConnect Client ScreenConnect Software (Verified) ScreenConnect Software

SCHTASK.EXE 2,644 K 6,620 K 8188 Power Manager Power Agenda Lenovo Group Limited (Verified) LENOVO

rundll32.exe 4,032 K 13,740 K 6996 Windows host process (Rundll32) Microsoft Corporation (Verified) Microsoft Windows

rundll32.exe 6,788 K 18,352 K 7556 Windows host process (Rundll32) Microsoft Corporation (Verified) Microsoft Windows

rundll32.exe 1,668 K 4,416 K 5300 Windows host process (Rundll32) Microsoft Corporation (Verified) Microsoft Windows

rundll32.exe 1,252 K 4,196 K 7424 Windows host process (Rundll32) Microsoft Corporation (Verified) Microsoft Windows

RegSrvc.exe 1,980 K 6,824 K 2520 Intel® PROSet/Wireless Registry Service Intel® Corporation (Verified) Intel® Wireless Connectivity Solutions

RAVCpl64.exe 8,768 K 1,192 K 8076 Realtek HD Audio Manager Realtek Semiconductor (Verified) Realtek Semiconductor Corp

RAVBg64.exe 14,764 K 1,016 K 8024 HD Audio Background Process Realtek Semiconductor (Verified) Realtek Semiconductor Corp

RAVBg64.exe 14,740 K 972 K 6104 HD Audio Background Process Realtek Semiconductor (Verified) Realtek Semiconductor Corp

QuickControlService.exe 6,828 K 10,376 K 4316 Lenovo QuickControl Service Lenovo Group Limited (Verified) LENOVO

QuickControl.exe 12,396 K 15,588 K 4228 Lenovo QuickControl Resident Lenovo Group Limited (Verified) LENOVO

PWMDBSVC.exe 2,268 K 7,428 K 8208 Power Manager Dynamic Brightness Control Service Lenovo (Verified) LENOVO

procexp.exe 2,352 K 7,532 K 7648 Sysinternals Process Explorer Sysinternals - www.sysinternals.com (Verified) Microsoft Corporation

PrintIsolationHost.exe 26,124 K 36,344 K 4716 PrintIsolationHost Microsoft Corporation (Verified) Microsoft Windows

PresentationFontCache.exe 30,256 K 23,972 K 2556 PresentationFontCache.exe Microsoft Corporation (Verified) Microsoft Corporation

opvapp.exe 3,044 K 7,796 K 2164 opvapp.exe %CFullName% (No signature was present in the subject) %CFullName%

obexsrv.exe 3,116 K 7,464 K 6420 Bluetooth OBEX Service Motorola Solutions, Inc. (Verified) Motorola Solutions Inc.

ntmulti.exe 1,216 K 4,252 K 2152 IBM Notes/Domino IBM Corp (Verified) International Business Machines Corporation

nsd.exe 11,472 K 6,404 K 2772 wnsd IBM (Verified) International Business Machines Corporation

mediasrv.exe 4,856 K 9,024 K 6284 Bluetooth Media Service Motorola Solutions, Inc. (Verified) Motorola Solutions Inc.

lvvsst.exe 2,284 K 6,308 K 3020 Auto Scroll Start Service Lenovo Group Limited (Verified) Lenovo

LSCNotify.exe 1,376 K 688 K 8212 Lenovo Solution Center Notifications Lenovo (Verified) Lenovo

LenovoDiscoverySvc.exe 18,576 K 18,400 K 6892 Lenovo Peer Connect Service Lenovo (Verified) Lenovo(Japan)Ltd.

jusched.exe 4,572 K 11,772 K 7620 Java Update Scheduler Oracle Corporation (Verified) Oracle America

jhi_service.exe 1,412 K 4,728 K 6824 Intel® Dynamic Application Loader Host Interface Intel Corporation (Verified) Intel Corporation - Embedded Subsystems and IP Blocks Group

iusb3mon.exe 1,840 K 5,844 K 7372 iusb3mon Intel Corporation (Verified) Intel® USB eXtensible Host Controller Drivers

InputPersonalization.exe 2,880 K 860 K 2160 Input Personalization Server Microsoft Corporation (Verified) Microsoft Windows

igfxHK.exe 2,864 K 8,608 K 6672 igfxHK Module Intel Corporation (Verified) Intel® pGFX

igfxEM.exe 4,004 K 10,576 K 6648 igfxEM Module Intel Corporation (Verified) Intel® pGFX

igfxCUIService.exe 2,520 K 7,896 K 1548 igfxCUIService Module Intel Corporation (Verified) Intel® pGFX

DisplayLinkUserAgent.exe 3,528 K 7,252 K 1804 DisplayLinkUserAgent Application DisplayLink Corp. (Verified) DISPLAYLINK

devmonsrv.exe 3,580 K 8,060 K 6212 Bluetooth Device Monitor Motorola Solutions, Inc. (Verified) Motorola Solutions Inc.

csrss.exe 2,568 K 5,492 K 664 Client Server Runtime Process Microsoft Corporation (Verified) Microsoft Windows

CoreService.exe 2,672 K 7,572 K 1072 Core Service Lenovo (Verified) Softex Incorporated

conhost.exe 1,084 K 3,120 K 2044 Console Window Host Microsoft Corporation (Verified) Microsoft Windows

conhost.exe 1,084 K 3,140 K 3904 Console Window Host Microsoft Corporation (Verified) Microsoft Windows

conhost.exe 1,460 K 3,876 K 3416 Console Window Host Microsoft Corporation (Verified) Microsoft Windows

conhost.exe 1,460 K 3,924 K 5360 Console Window Host Microsoft Corporation (Verified) Microsoft Windows

CNTAoSMgr.exe 1,808 K 4,440 K 3892 Trend Micro OfficeScan Client Plug-in Service Manager Trend Micro Inc. (Verified) Trend Micro

cmd.exe 2,316 K 528 K 3564 Windows Command Processor Microsoft Corporation (Verified) Microsoft Windows

CamMute.exe 1,616 K 5,352 K 2908 Camera Mute Control Service for Lenovo Lenovo Group Limited (Verified) Lenovo

armsvc.exe 1,236 K 4,260 K 2304 Adobe Acrobat Update Service Adobe Systems Incorporated (Verified) Adobe Systems

Image Name PID Services

========================= ======== ============================================

System Idle Process 0 N/A

System 4 N/A

smss.exe 460 N/A

csrss.exe 664 N/A

wininit.exe 712 N/A

csrss.exe 732 N/A

services.exe 768 N/A

lsass.exe 788 EFS, KeyIso, Netlogon, SamSs, VaultSvc

lsm.exe 796 N/A

svchost.exe 916 DcomLaunch, PlugPlay, Power

ibmpmsvc.exe 1004 IBMPMSVC

LPlatSvc.exe 164 LPlatSvc

svchost.exe 848 RpcEptMapper, RpcSs

CoreService.exe 1072 CoreService

winlogon.exe 1116 N/A

svchost.exe 1232 AudioSrv, Dhcp, eventlog, lmhosts, wscsvc

svchost.exe 1280 AudioEndpointBuilder, CscService, hidserv,

IPBusEnum, Netman, PcaSvc, SysMain,

TabletInputService, TrkWks, UxSms,

WdiSystemHost, Wlansvc, wudfsvc

svchost.exe 1304 EventSystem, fdPHost, FontCache, netprofm,

nsi, W32Time, WdiServiceHost,

WinHttpAutoProxySvc

svchost.exe 1348 AeLookupSvc, BITS, Browser, EapHost,

IKEEXT, iphlpsvc, LanmanServer, MMCSS,

ProfSvc, Schedule, SENS, ShellHWDetection,

Themes, Winmgmt, wuauserv

svchost.exe 1424 gpsvc

igfxCUIService.exe 1548 igfxCUIService2.0.0.0

DisplayLinkManager.exe 1588 DisplayLinkService

wisptis.exe 1728 N/A

WUDFHost.exe 1748 N/A

DisplayLinkUserAgent.exe 1804 N/A

svchost.exe 1944 Dnscache

wlanext.exe 2036 N/A

conhost.exe 2044 N/A

spoolsv.exe 2020 Spooler

svchost.exe 2112 BFE, DPS, MpsSvc

opvapp.exe 2164 N/A

svchost.exe 2212 CryptSvc, LanmanWorkstation, NlaSvc

SASCore64.exe 2276 !SASCORE

armsvc.exe 2304 AdobeARMservice

svchost.exe 2364 DiagTrack

EvtEng.exe 2396 EvtEng

ExpressCache.exe 2428 ExpressCache

svchost.exe 2528 FDResPub, SSDPSRV, upnphost

PresentationFontCache.exe 2556 FontCache3.0.0.0

nsd.exe 2772 IBM Notes Diagnostics

IntelTechnologyAccessServ 2864 Intel® TechnologyAccessService

CamMute.exe 2908 LENOVO.CAMMUTE

TPKNRSVC.exe 2964 LENOVO.TPKNRSVC

vcamsvc.exe 2988 LENOVO.TVTVCAM

lvvsst.exe 3020 Lenovo.VIRTSCRLSVC

SUService.exe 3044 LNSUSvc

ntmulti.exe 2152 Multi-user Cleanup Service

NTRTScan.exe 2340 ntrtscan

RegSrvc.exe 2520 RegSrvc

ScreenConnect.ClientServi 2820 ScreenConnect Client (2983e16809ce38ec)

svchost.exe 3092 stisvc

SynTPEnhService.exe 3112 SynTPEnhService

TPHKSVC.exe 3184 TPHKSVC

valWBFPolicyService.exe 3256 valWBFPolicyService

svchost.exe 3336 WinDefend

ZeroConfigService.exe 3368 ZeroConfigService

TmListen.exe 3496 tmlisten

tphkload.exe 3680 TPHKLOAD

CNTAoSMgr.exe 3892 N/A

conhost.exe 3904 N/A

QuickControlService.exe 4316 QuickControlService

UI0Detect.exe 4380 UI0Detect

PrintIsolationHost.exe 4716 N/A

unsecapp.exe 4812 N/A

svchost.exe 4884 bthserv

svchost.exe 4932 PolicyAgent

WmiPrvSE.exe 4356 N/A

WmiPrvSE.exe 4348 N/A

ScreenConnect.WindowsClie 5404 N/A

taskhost.exe 4240 N/A

virtscrl.exe 4632 N/A

LPlatSvc.exe 4636 N/A

ScreenConnect.WindowsClie 2836 N/A

SynTPEnh.exe 4244 N/A

QuickControl.exe 4228 N/A

wisptis.exe 3460 N/A

conhost.exe 3416 N/A

TabTip.exe 2856 N/A

rundll32.exe 5300 N/A

TabTip32.exe 3568 N/A

TPONSCR.exe 4620 N/A

shtctky.exe 4576 N/A

SynTPHelper.exe 2668 N/A

taskeng.exe 5672 N/A

TpShocks.exe 4200 N/A

unsecapp.exe 5500 N/A

SynTPLpr.exe 6172 N/A

SynLenovoHelper.exe 6180 N/A

devmonsrv.exe 6212 Bluetooth Device Monitor

mediasrv.exe 6284 Bluetooth Media Service

obexsrv.exe 6420 Bluetooth OBEX Service

jhi_service.exe 6824 jhi_service

LenovoDiscoverySvc.exe 6892 lnvDiscoveryWinSvc

wmpnetwk.exe 7024 WMPNetworkSvc

SearchIndexer.exe 7072 WSearch

dwm.exe 6576 N/A

explorer.exe 6604 N/A

igfxEM.exe 6648 N/A

igfxHK.exe 6672 N/A

RtsCM64.exe 6584 N/A

TpKnrres.exe 6656 N/A

rundll32.exe 6996 N/A

SUPERANTISPYWARE.EXE 7212 N/A

iusb3mon.exe 7372 N/A

rundll32.exe 7424 N/A

PccNTMon.exe 7532 N/A

IdeaMax Server.exe 7548 N/A

rundll32.exe 7556 N/A

jusched.exe 7620 N/A

SCHTASK.EXE 8188 N/A

RAVCpl64.exe 8076 N/A

RAVBg64.exe 8024 N/A

RAVBg64.exe 6104 N/A

LSCNotify.exe 8212 N/A

SUService.exe 8356 SUService

UNCServer.exe 8460 N/A

PWMDBSVC.exe 8208 Power Manager DBC Service

InputPersonalization.exe 2160 N/A

cmd.exe 3564 N/A

conhost.exe 5360 N/A

LSB.exe 5012 N/A

taskeng.exe 7468 N/A

audiodg.exe 8416 N/A

cmd.exe 8536 N/A

conhost.exe 8764 N/A

tasklist.exe 7916 N/A

Attached Files

LENOVO-KM-1335.txt 880.4KB 1 downloads

#4
RKinner

Posted 18 June 2018 - 07:13 PM

Malware Expert

Expert
24,699 posts

Are you using ScreenConnect to remote into this PC? If not please uninstall it.

Speccy shows two drives, one a small SSD. Windows is complaining about one of your drives.

Log: 'System' Date/Time: 18/06/2018 10:25:32 PM

Type: Error Category: 0

Event: 7 Source: Disk

The device, \Device\Harddisk1\DR1, has a bad block.

Their numbering is difficult to decipher.

Probably not the SSD. Worth running a disk check on the C: drive:

1. Double-click My Computer, and then right-click the hard disk that you want to check. C:
2. Click Properties, and then click Tools.
3. Under Error-checking, click Check Now. A dialog box that shows the Check disk options is displayed,
4. Check both boxes and then click Start.
You will receive the following message:
The disk check could not be performed because the disk check utility needs exclusive access to some Windows files on the disk. These files can be accessed by restarting Windows. Do you want to schedule the disk check to occur the next time you restart the computer?
Click Yes to schedule the disk check, but don't restart yet.

Right click on (My) Computer and select Manage (Continue) Then the Event Viewer. Next select Windows Logs. Right click on System and Clear Log, Clear. Repeat for Application.

Reboot.

The disk check will run and will probably take an hour or more to finish.

Run VEW again as before.

Is the PC normally part of a domain?

#5
bhzendner

Posted 20 June 2018 - 04:48 PM

Member

Topic Starter
Member
226 posts

Small SSD not being used.

Yes, I am using ScreenConnect to connect but if necessary can remove.

Looks like it was or is a part of a domain?

Vino's Event Viewer v01c run on Windows 2008 in English

Report run at 20/06/2018 3:47:13 PM

Note: All dates below are in the format dd/mm/yyyy

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

'Application' Log - Critical Type

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

'Application' Log - Error Type

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

Log: 'Application' Date/Time: 20/06/2018 9:36:05 PM

Type: Error Category: 0

Event: 10 Source: Microsoft-Windows-WMI

Event filter with query "SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 99" could not be reactivated in namespace "//./root/CIMV2" because of error 0x80041003. Events cannot be delivered through this filter until the problem is corrected.

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

'Application' Log - Warning Type

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

Log: 'Application' Date/Time: 20/06/2018 8:00:22 PM

Type: Warning Category: 0

Event: 1530 Source: Microsoft-Windows-User Profiles Service

Windows detected your registry file is still in use by other applications or services. The file will be unloaded now. The applications or services that hold your registry file may not function properly afterwards. DETAIL - 5 user registry handles leaked from \Registry\User\S-1-5-21-345086361-1354177263-1882197541-10279:

Process 788 (\Device\HarddiskVolume1\Windows\System32\lsass.exe) has opened key \REGISTRY\USER\S-1-5-21-345086361-1354177263-1882197541-10279

Process 788 (\Device\HarddiskVolume1\Windows\System32\lsass.exe) has opened key \REGISTRY\USER\S-1-5-21-345086361-1354177263-1882197541-10279\Software\Microsoft\SystemCertificates\Disallowed

Process 788 (\Device\HarddiskVolume1\Windows\System32\lsass.exe) has opened key \REGISTRY\USER\S-1-5-21-345086361-1354177263-1882197541-10279\Software\Microsoft\SystemCertificates\My

Process 788 (\Device\HarddiskVolume1\Windows\System32\lsass.exe) has opened key \REGISTRY\USER\S-1-5-21-345086361-1354177263-1882197541-10279\Software\Microsoft\SystemCertificates\CA

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

'System' Log - Critical Type

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

'System' Log - Error Type

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

Log: 'System' Date/Time: 20/06/2018 10:45:30 PM

Type: Error Category: 0

Event: 1030 Source: Microsoft-Windows-GroupPolicy

Log: 'System' Date/Time: 20/06/2018 10:11:04 PM

Type: Error Category: 0

Event: 8032 Source: BROWSER

The browser service has failed to retrieve the backup list too many times on transport \Device\NetBT_Tcpip_{B56F0B4F-5A87-4D0B-9726-C877E2FC4722}. The backup browser is stopping.

Log: 'System' Date/Time: 20/06/2018 9:37:05 PM

Type: Error Category: 0

Event: 10016 Source: Microsoft-Windows-DistributedCOM

Log: 'System' Date/Time: 20/06/2018 9:35:49 PM

Type: Error Category: 0

Event: 1030 Source: Microsoft-Windows-GroupPolicy

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

'System' Log - Warning Type

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

Log: 'System' Date/Time: 20/06/2018 10:09:57 PM

Type: Warning Category: 0

Event: 8021 Source: BROWSER

The browser service was unable to retrieve a list of servers from the browser master \\LENOVO-KM-1396 on the network \Device\NetBT_Tcpip_{B56F0B4F-5A87-4D0B-9726-C877E2FC4722}. Browser master: \\LENOVO-KM-1396 Network: \Device\NetBT_Tcpip_{B56F0B4F-5A87-4D0B-9726-C877E2FC4722} This event may be caused by a temporary loss of network connectivity. If this message appears again, verify that the server is still connected to the network. The return code is in the Data text box.

Log: 'System' Date/Time: 20/06/2018 9:36:17 PM

Type: Warning Category: 7

Event: 37 Source: Microsoft-Windows-Kernel-Processor-Power

The speed of processor 0 in group 0 is being limited by system firmware. The processor has been in this reduced performance state for 71 seconds since the last report.

Log: 'System' Date/Time: 20/06/2018 9:36:17 PM

Type: Warning Category: 7

Event: 37 Source: Microsoft-Windows-Kernel-Processor-Power

The speed of processor 3 in group 0 is being limited by system firmware. The processor has been in this reduced performance state for 71 seconds since the last report.

Log: 'System' Date/Time: 20/06/2018 9:36:17 PM

Type: Warning Category: 7

Event: 37 Source: Microsoft-Windows-Kernel-Processor-Power

The speed of processor 2 in group 0 is being limited by system firmware. The processor has been in this reduced performance state for 71 seconds since the last report.

Log: 'System' Date/Time: 20/06/2018 9:36:17 PM

Type: Warning Category: 7

Event: 37 Source: Microsoft-Windows-Kernel-Processor-Power

The speed of processor 1 in group 0 is being limited by system firmware. The processor has been in this reduced performance state for 71 seconds since the last report.

Log: 'System' Date/Time: 20/06/2018 9:35:09 PM

Type: Warning Category: 212

Event: 219 Source: Microsoft-Windows-Kernel-PnP

The driver \Driver\WUDFRd failed to load for the device USB\VID_138A&PID_0017\0de61c0d575d.

Log: 'System' Date/Time: 20/06/2018 8:00:33 PM

Type: Warning Category: 0

Event: 4001 Source: Microsoft-Windows-WLAN-AutoConfig

WLAN AutoConfig service has successfully stopped.

Log: 'System' Date/Time: 20/06/2018 8:00:32 PM

Type: Warning Category: 0

Event: 10002 Source: Microsoft-Windows-WLAN-AutoConfig

WLAN Extensibility Module has stopped. Module Path: C:\Windows\System32\IWMSSvc.dll

#6
RKinner

Posted 20 June 2018 - 06:06 PM

Malware Expert

Expert
24,699 posts

Log: 'Application' Date/Time: 20/06/2018 8:00:22 PM

Type: Warning Category: 0

Event: 1530 Source: Microsoft-Windows-User Profiles Service

Windows detected your registry file is still in use by other applications or services. The file will be unloaded now. The applications or services that hold your registry file may not function properly afterwards. DETAIL - 5 user registry handles leaked from \Registry\User\S-1-5-21-345086361-1354177263-1882197541-10279:

Process 788 (\Device\HarddiskVolume1\Windows\System32\lsass.exe) has opened key \REGISTRY\USER\S-1-5-21-345086361-1354177263-1882197541-10279

Process 788 (\Device\HarddiskVolume1\Windows\System32\lsass.exe) has opened key \REGISTRY\USER\S-1-5-21-345086361-1354177263-1882197541-10279

Process 788 (\Device\HarddiskVolume1\Windows\System32\lsass.exe) has opened key \REGISTRY\USER\S-1-5-21-345086361-1354177263-1882197541-10279\Software\Microsoft\SystemCertificates\Disallowed

Process 788 (\Device\HarddiskVolume1\Windows\System32\lsass.exe) has opened key \REGISTRY\USER\S-1-5-21-345086361-1354177263-1882197541-10279\Software\Microsoft\SystemCertificates\My

Process 788 (\Device\HarddiskVolume1\Windows\System32\lsass.exe) has opened key \REGISTRY\USER\S-1-5-21-345086361-1354177263-1882197541-10279\Software\Microsoft\SystemCertificates\CA

This is odd because FRST does not see a user with this ID: S-1-5-21-345086361-1354177263-1882197541-10279

==================== Accounts: =============================

admin (S-1-5-21-201262395-2737818422-147992042-1000 - Administrator - Enabled) => C:\Users\admin
Administrator (S-1-5-21-201262395-2737818422-147992042-500 - Administrator - Disabled)
Guest (S-1-5-21-201262395-2737818422-147992042-501 - Limited - Disabled)
Katherine Hatcher (S-1-5-21-201262395-2737818422-147992042-1004 - Administrator - Enabled) => C:\Users\Katherine Hatcher
Setup (S-1-5-21-201262395-2737818422-147992042-1003 - Administrator - Enabled) => C:\Users\Setup

Copy the next 5 lines:

set

net user > \junk.txt

reg query HKEY_USERS >> \junk.txt

reg query HKEY_USERS\S-1-5-21-345086361-1354177263-1882197541-10279\Environment >> \junk.txt

notepad \junk.txt

Start, All Programs, Accessories then right click on Command Prompt and Run as Administrator. Right click and Paste (or Edit then Paste) and the copied lines should appear. Hit Enter if notepad does not open. Copy and paste the text from notepad into a reply.

#7
bhzendner

Posted 23 June 2018 - 10:37 AM

Member

Topic Starter
Member
226 posts

User accounts for \\LENOVO-KM-1335

-------------------------------------------------------------------------------

admin Administrator Guest

Katherine Hatcher Setup

The command completed successfully.

HKEY_USERS\.DEFAULT

HKEY_USERS\S-1-5-19

HKEY_USERS\S-1-5-20

HKEY_USERS\S-1-5-21-345086361-1354177263-1882197541-10279

HKEY_USERS\S-1-5-21-345086361-1354177263-1882197541-10279_Classes

HKEY_USERS\S-1-5-18

HKEY_USERS\S-1-5-21-345086361-1354177263-1882197541-10279\Environment

TEMP REG_EXPAND_SZ %USERPROFILE%\AppData\Local\Temp

TMP REG_EXPAND_SZ %USERPROFILE%\AppData\Local\Temp

Path REG_SZ C:\Program Files\Intel\WiFi\bin\;C:\Program Files\Common Files\Intel\WirelessCommon\

#8
RKinner

Posted 23 June 2018 - 11:15 AM

Malware Expert

Expert
24,699 posts

Something funny going on here. Normally there should be an entry in HKEY_USERS\S-1-5-21- for each of the accounts which is not disabled. Instead we just see one which is not listed. Expect something has hidden the normal accounts. The unlisted account looks like it might have been created by intel for some installation purpose.

Let's reset the permissions on the registry.

try
Windows Repair all in one

http://www.tweaking....all_in_one.html

Download it and save it then run it.

They keep changing the interface but usually there are several steps where they want you to back up the registry and so on. Skip to where they actually run the program. The last time there were several preset versions. Doesn't matter which you choose. Before you run it uncheck everything but

Reset Registry Permissions

Then run it and after it finishes reboot and create the same junk file as before. Let's see if it is any different.

#9
bhzendner

Posted 24 June 2018 - 05:20 PM

Member

Topic Starter
Member
226 posts

It gets stuck loading at 67%, when you click on it it gives you the option to switch, retry or cancel, if you switch then it get to 71% but can not get past that. Tried a reboot same result. Ran as Administrator, same result.

Hang on, I got it to run by starting a second instance of the application, first one still stuck but second one appears to be running and going to town

Edited by bhzendner, 24 June 2018 - 05:29 PM.

#10
RKinner

Posted 24 June 2018 - 08:34 PM

Malware Expert

Expert
24,699 posts

Sometimes pausing your anti-virus or running in Safe Mode will help.

#11
bhzendner

Posted 26 June 2018 - 02:15 PM

Member

Topic Starter
Member
226 posts

User accounts for \\LENOVO-KM-1335

-------------------------------------------------------------------------------

admin Administrator Guest

Katherine Hatcher Setup

The command completed successfully.

HKEY_USERS\.DEFAULT

HKEY_USERS\S-1-5-19

HKEY_USERS\S-1-5-20

HKEY_USERS\S-1-5-21-345086361-1354177263-1882197541-10279

HKEY_USERS\S-1-5-21-345086361-1354177263-1882197541-10279_Classes

HKEY_USERS\S-1-5-18

HKEY_USERS\S-1-5-21-345086361-1354177263-1882197541-10279\Environment

TEMP REG_EXPAND_SZ %USERPROFILE%\AppData\Local\Temp

TMP REG_EXPAND_SZ %USERPROFILE%\AppData\Local\Temp

Path REG_SZ C:\Program Files\Intel\WiFi\bin\;C:\Program Files\Common Files\Intel\WirelessCommon\

Looks like it is working!

What do you think?

#12
RKinner

Posted 26 June 2018 - 03:14 PM

Malware Expert

Expert
24,699 posts

Not really. I would expect to see the 3 enabled account numbers that FRST reports.

==================== Accounts: =============================

admin (S-1-5-21-201262395-2737818422-147992042-1000 - Administrator - Enabled) => C:\Users\admin

Administrator (S-1-5-21-201262395-2737818422-147992042-500 - Administrator - Disabled)

Guest (S-1-5-21-201262395-2737818422-147992042-501 - Limited - Disabled)

Katherine Hatcher (S-1-5-21-201262395-2737818422-147992042-1004 - Administrator - Enabled) => C:\Users\Katherine Hatcher

Setup (S-1-5-21-201262395-2737818422-147992042-1003 - Administrator - Enabled) => C:\Users\Setup