Hello folks,
I recently believe I have gotten a Trojan on my HP Envy DV7 running Windows 10. When I login it'll function properly for 2-5 minutes then go to a blue screen with an error stop code. It then tells me that NDISTPR64.sys failed. I currently have my hard drive out of the computer because I can't do any troubleshooting running my computer. I have my hard drive connected to a Windows Surface Pro via a usb adapter. Right now I am a scan on the hard drive with Malwarebytes. I was wondering if anyone has anymore advice that will help me correct my issue.

Hello,

Just did a virus scan and got the following listed as adware ;

followonsearch@mozilla.com.xpi

The file address is here ;

C:\Users\Windows7\AppData\Roaming\Mozilla\Firefox\Profiles\s4aphmxj.default-1445320282788\features\{87495b26-64d8-4819-9ce5-bdf7c6ee5d87}

Is that just Mozilla counting my searches?

Thanks for any help.

Earlier today, I was streaming a video on a site. However, to be able to watch the video I had to pause my adblock and by the end of the hour long video, I have noticed that many chrome windows have opened in the background due to ads. I didn't think much of it at first, but almost instantly I noticed a huge difference in my computer speed. My steam would take about 3 seconds to respond to any clicks, my discord would pause for a few seconds before it would load all of the texts I have typed, and just random clicks in general on my computer would take a few seconds to register. I have restarted my computer and the pauses were still there. I have ran Malwarebytes but the scans showed nothing. I'm not sure if this is due to my computer getting old but I just wanted to make sure. Thanks in advance!








DDS (Ver_2012-11-20.01) - NTFS_AMD64
Internet Explorer: 11.0.15063.0
Run by Crystal at 19:59:09 on 2017-07-24
Microsoft Windows 10 Enterprise 10.0.15063.0.1252.1.1033.18.16274.13689 [GMT -4:00]
.
AV: Windows Defender *Enabled/Updated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
SP: Windows Defender *Enabled/Updated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
.
============== Running Processes ===============
.
c:\windows\system32\svchost.exe -k dcomlaunch -s PlugPlay
C:\WINDOWS\system32\svchost.exe -k DcomLaunch
C:\WINDOWS\system32\fontdrvhost.exe
c:\windows\system32\svchost.exe -k rpcss
c:\windows\system32\svchost.exe -k dcomlaunch -s LSM
C:\WINDOWS\system32\fontdrvhost.exe
C:\WINDOWS\system32\svchost.exe -k LocalSystemNetworkRestricted
C:\WINDOWS\system32\dwm.exe
c:\windows\system32\svchost.exe -k localsystemnetworkrestricted -s NcbService
c:\windows\system32\svchost.exe -k localservicenetworkrestricted -s EventLog
c:\windows\system32\svchost.exe -k localservicenetworkrestricted -s TimeBrokerSvc
C:\Windows\System32\WUDFHost.exe
c:\windows\system32\svchost.exe -k localsystemnetworkrestricted -s hidserv
c:\windows\system32\svchost.exe -k netsvcs -s Schedule
c:\windows\system32\svchost.exe -k localservice -s nsi
c:\windows\system32\svchost.exe -k netsvcs -s ProfSvc
c:\windows\system32\svchost.exe -k localservicenetworkrestricted -s Dhcp
C:\Program Files\NVIDIA Corporation\Display.NvContainer\NVDisplay.Container.exe
c:\windows\system32\svchost.exe -k networkservice -s NlaSvc
c:\windows\system32\svchost.exe -k netsvcs -s UserManager
c:\windows\system32\svchost.exe -k netsvcs -s Themes
c:\windows\system32\svchost.exe -k localservice -s EventSystem
C:\WINDOWS\system32\svchost.exe -k LocalServiceNoNetwork
c:\windows\system32\svchost.exe -k localservice -s netprofm
c:\windows\system32\svchost.exe -k appmodel -s StateRepository
c:\windows\system32\svchost.exe -k netsvcs -s SENS
C:\WINDOWS\system32\igfxCUIService.exe
C:\Program Files\NVIDIA Corporation\Display.NvContainer\NVDisplay.Container.exe
c:\windows\system32\svchost.exe -k localsystemnetworkrestricted -s AudioEndpointBuilder
c:\windows\system32\svchost.exe -k localservice -s FontCache
c:\windows\system32\svchost.exe -k netsvcs -s Winmgmt
c:\windows\system32\svchost.exe -k networkservice -s Dnscache
C:\WINDOWS\System32\svchost.exe -k LocalServiceNetworkRestricted
c:\windows\system32\svchost.exe -k localservicenetworkrestricted -s lmhosts
C:\WINDOWS\System32\svchost.exe -k LocalServiceNetworkRestricted
C:\WINDOWS\system32\svchost.exe -k LocalServiceNetworkRestricted
c:\windows\system32\svchost.exe -k localservice -s WinHttpAutoProxySvc
c:\windows\system32\svchost.exe -k netsvcs -s ShellHWDetection
C:\WINDOWS\System32\spoolsv.exe
c:\windows\system32\svchost.exe -k networkservice -s LanmanWorkstation
c:\windows\system32\svchost.exe -k networkservice -s CryptSvc
C:\WINDOWS\System32\svchost.exe -k utcsvc
C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe
c:\windows\system32\svchost.exe -k localservicenonetwork -s DPS
c:\windows\system32\svchost.exe -k netsvcs -s iphlpsvc
C:\Program Files\NVIDIA Corporation\NvContainer\nvcontainer.exe
c:\windows\system32\svchost.exe -k localsystemnetworkrestricted -s PcaSvc
c:\windows\system32\svchost.exe -k netsvcs -s LanmanServer
C:\Program Files (x86)\Razer\Razer Services\GSS\GameScannerService.exe
C:\Program Files (x86)\NVIDIA Corporation\NvTelemetry\NvTelemetryContainer.exe
C:\WINDOWS\system32\svchost.exe -k imgsvc
c:\windows\system32\svchost.exe -k localsystemnetworkrestricted -s SysMain
c:\windows\system32\svchost.exe -k localsystemnetworkrestricted -s TrkWks
c:\windows\system32\svchost.exe -k appmodel -s tiledatamodelsvc
c:\windows\system32\svchost.exe -k netsvcs -s WpnService
c:\windows\system32\svchost.exe -k localservice -s WdiServiceHost
c:\windows\system32\svchost.exe -k localsystemnetworkrestricted -s DeviceAssociationService
C:\WINDOWS\system32\SearchIndexer.exe
c:\windows\system32\svchost.exe -k localservice -s CDPSvc
c:\windows\system32\svchost.exe -k localserviceandnoimpersonation -s SSDPSRV
c:\windows\system32\svchost.exe -k localservicenetworkrestricted -s wscsvc
C:\Program Files (x86)\NVIDIA Corporation\NvContainer\nvcontainer.exe
c:\windows\system32\sihost.exe
c:\windows\system32\svchost.exe -k unistacksvcgroup -s CDPUserSvc
c:\windows\system32\svchost.exe -k unistacksvcgroup -s WpnUserService
C:\WINDOWS\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe
c:\windows\system32\taskhostw.exe
c:\windows\system32\svchost.exe -k netsvcs -s TokenBroker
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\igfxEM.exe
C:\Windows\SystemApps\ShellExperienceHost_cw5n1h2txyewy\ShellExperienceHost.exe
C:\Windows\SystemApps\Microsoft.Windows.Cortana_cw5n1h2txyewy\SearchUI.exe
C:\Windows\System32\RuntimeBroker.exe
C:\WINDOWS\system32\wbem\wmiprvse.exe
C:\WINDOWS\system32\wbem\wmiprvse.exe
C:\Program Files\NVIDIA Corporation\Display\nvtray.exe
C:\Program Files\Windows Defender\MSASCuiL.exe
C:\Users\Crystal\AppData\Local\Discord\app-0.0.297\Discord.exe
C:\Program Files\NVIDIA Corporation\ShadowPlay\nvspcaps64.exe
C:\Program Files\NVIDIA Corporation\ShadowPlay\nvsphelper64.exe
C:\Program Files (x86)\NVIDIA Corporation\NVIDIA GeForce Experience\NVIDIA Share.exe
C:\Users\Crystal\AppData\Local\Discord\app-0.0.297\Discord.exe
C:\Program Files (x86)\NVIDIA Corporation\NVIDIA GeForce Experience\NVIDIA Share.exe
C:\Program Files (x86)\NVIDIA Corporation\NvNode\NVIDIA Web Helper.exe
C:\Users\Crystal\AppData\Roaming\Spotify\SpotifyWebHelper.exe
C:\Users\Crystal\AppData\Local\Discord\app-0.0.297\Discord.exe
D:\Program Files\Corsair\Corsair Utility Engine\CUE.exe
D:\Program Files\ShareX\ShareX.exe
c:\windows\system32\svchost.exe -k netsvcs -s lfsvc
C:\WINDOWS\system32\ApplicationFrameHost.exe
c:\windows\system32\svchost.exe -k unistacksvcgroup
c:\windows\system32\svchost.exe -k netsvcs -s Appinfo
c:\windows\system32\svchost.exe -k localsystemnetworkrestricted -s WdiSystemHost
D:\Anti-Malware\mbamservice.exe
D:\Anti-Malware\mbamtray.exe
c:\windows\system32\svchost.exe -k localsystemnetworkrestricted -s StorSvc
C:\Program Files\WindowsApps\Microsoft.WindowsStore_11706.1001.25.0_x64__8wekyb3d8bbwe\WinStore.App.exe
C:\Program Files\WindowsApps\Microsoft.ZuneVideo_10.17062.12911.0_x64__8wekyb3d8bbwe\Video.UI.exe
C:\Program Files\WindowsApps\Microsoft.Windows.Photos_2017.18062.13720.0_x64__8wekyb3d8bbwe\Microsoft.Photos.exe
C:\WINDOWS\system32\AUDIODG.EXE
c:\windows\system32\svchost.exe -k localserviceandnoimpersonation -s QWAVE
C:\ProgramData\Battle.net\Agent\Agent.5725\Agent.exe
C:\Windows\System32\smartscreen.exe
C:\WINDOWS\System32\cscript.exe
.
============== Pseudo HJT Report ===============
.
uLocal Page = %11%\blank.htm
BHO: Skype for Business Browser Helper: {31D09BA0-12F5-4CCE-BE8A-2923E76605DA} - C:\Program Files (x86)\Microsoft Office\Office15\OCHelper.dll
BHO: Microsoft SkyDrive Pro Browser Helper: {D0498E0A-45B7-42AE-A9AA-ABA463DBD3BF} - C:\Program Files (x86)\Microsoft Office\Office15\GROOVEEX.DLL
uRun: [Steam] "D:\Steam\steam.exe" -silent
uRun: [Discord] C:\Users\Crystal\AppData\Local\Discord\app-0.0.297\Discord.exe
uRun: [Spotify] C:\Users\Crystal\AppData\Roaming\Spotify\Spotify.exe --autostart
uRun: [Spotify Web Helper] C:\Users\Crystal\AppData\Roaming\Spotify\SpotifyWebHelper.exe --autostart
mRun: [Corsair Utility Engine] "D:\Program Files\Corsair\Corsair Utility Engine\CUE.exe" --autorun
mRun: [Razer Synapse] "C:\Program Files (x86)\Razer\Synapse\RzSynapse.exe"
StartupFolder: C:\Users\Crystal\AppData\Roaming\MICROS~1\Windows\STARTM~1\Programs\Startup\ShareX.lnk - D:\Program Files\ShareX\ShareX.exe
mPolicies-System: DSCAutomationHostEnabled = dword:2
IE: E&xport to Microsoft Excel - C:\PROGRA~1\MICROS~1\Office15\EXCEL.EXE/3000
IE: Se&nd to OneNote - C:\PROGRA~1\MICROS~1\Office15\ONBttnIE.dll/105
IE: {2670000A-7350-4f3c-8081-5663EE0C6C49} - {48E73304-E1D6-4330-914C-F5F514E3486C} - C:\Program Files (x86)\Microsoft Office\Office15\ONBttnIE.dll
IE: {31D09BA0-12F5-4CCE-BE8A-2923E76605DA} - {31D09BA0-12F5-4CCE-BE8A-2923E76605DA} - C:\Program Files (x86)\Microsoft Office\Office15\OCHelper.dll
IE: {789FE86F-6FC4-46A1-9849-EDE0DB0C95CA} - {FFFDC614-B694-4AE6-AB38-5D6374584B52} - C:\Program Files (x86)\Microsoft Office\Office15\ONBttnIELinkedNotes.dll
TCP: NameServer = 192.168.0.1
TCP: Interfaces\{f0e83e58-8766-4927-a2e2-43f894ea7516} : DHCPNameServer = 192.168.0.1
Filter: text/xml - {807583E5-5146-11D5-A672-00B0D022E945} - C:\Program Files (x86)\Common Files\Microsoft Shared\OFFICE15\MSOXMLMF.DLL
Handler: osf - {D924BDC6-C83A-4BD5-90D0-095128A113D1} - C:\Program Files (x86)\Microsoft Office\Office15\MSOSB.DLL
Handler: tbauth - {14654CA6-5711-491D-B89A-58E571679951} - C:\Windows\SysWOW64\tbauth.dll
Handler: windows.tbauth - {14654CA6-5711-491D-B89A-58E571679951} - C:\Windows\SysWOW64\tbauth.dll
SSODL: WebCheck - <orphaned>
LSA: Security Packages = ""
CLSID: {603D3801-BD81-11d0-A3A5-00C04FD706EC} - C:\WINDOWS\System32\windows.storage.dll
x64-BHO: Skype for Business Browser Helper: {31D09BA0-12F5-4CCE-BE8A-2923E76605DA} - C:\Program Files\Microsoft Office\Office15\OCHelper.dll
x64-BHO: Microsoft SkyDrive Pro Browser Helper: {D0498E0A-45B7-42AE-A9AA-ABA463DBD3BF} - C:\Program Files\Microsoft Office\Office15\GROOVEEX.DLL
x64-Run: [SecurityHealth] C:\Program Files (x86)\Windows Defender\MSASCuiL.exe
x64-Run: [ShadowPlay] "C:\WINDOWS\System32\rundll32.exe" C:\WINDOWS\System32\nvspcap64.dll,ShadowPlayOnSystemStart
x64-Run: [Malwarebytes TrayApp] D:\ANTI-MALWARE\mbamtray.exe
x64-mPolicies-System: DSCAutomationHostEnabled = dword:2
x64-IE: {2670000A-7350-4f3c-8081-5663EE0C6C49} - {48E73304-E1D6-4330-914C-F5F514E3486C} - C:\Program Files\Microsoft Office\Office15\ONBttnIE.dll
x64-IE: {31D09BA0-12F5-4CCE-BE8A-2923E76605DA} - {31D09BA0-12F5-4CCE-BE8A-2923E76605DA} - C:\Program Files\Microsoft Office\Office15\OCHelper.dll
x64-IE: {789FE86F-6FC4-46A1-9849-EDE0DB0C95CA} - {FFFDC614-B694-4AE6-AB38-5D6374584B52} - C:\Program Files\Microsoft Office\Office15\ONBttnIELinkedNotes.dll
x64-Filter: text/xml - {807583E5-5146-11D5-A672-00B0D022E945} - C:\Program Files\Common Files\Microsoft Shared\OFFICE15\MSOXMLMF.DLL
x64-Handler: osf - {D924BDC6-C83A-4BD5-90D0-095128A113D1} - C:\Program Files\Microsoft Office\Office15\MSOSB.DLL
x64-Handler: tbauth - {14654CA6-5711-491D-B89A-58E571679951} - C:\WINDOWS\System32\tbauth.dll
x64-Handler: windows.tbauth - {14654CA6-5711-491D-B89A-58E571679951} - C:\WINDOWS\System32\tbauth.dll
x64-SSODL: WebCheck - <orphaned>
x64-mASetup: {2C7339CF-2B09-4501-B3F3-F3508C9228ED} - /UserInstall
x64-mASetup: {89820200-ECBD-11cf-8B85-00AA005B4340} - U
x64-mASetup: {8A69D345-D564-463c-AFF1-A69D9E530F96} - "C:\Program Files (x86)\Google\Chrome\Application\59.0.3071.115\Installer\chrmstp.exe" --configure-user-settings --verbose-logging --system-level
x64-CLSID: {603D3801-BD81-11d0-A3A5-00C04FD706EC} - C:\WINDOWS\System32\windows.storage.dll
.
============= SERVICES / DRIVERS ===============
.
R0 intelpep;Intel(R) Power Engine Plug-in Driver;C:\WINDOWS\System32\drivers\intelpep.sys [2017-3-18 74840]
R0 iorate;Disk I/O Rate Filter Driver;C:\WINDOWS\System32\drivers\iorate.sys [2017-3-18 49568]
R0 volume;Volume driver;C:\WINDOWS\System32\drivers\volume.sys [2017-3-18 16288]
R0 WindowsTrustedRT;Windows Trusted Execution Environment Class Extension;C:\WINDOWS\System32\drivers\WindowsTrustedRT.sys [2017-3-18 70232]
R0 WindowsTrustedRTProxy;Microsoft Windows Trusted Runtime Secure Service;C:\WINDOWS\System32\drivers\WindowsTrustedRTProxy.sys [2017-3-18 18520]
R0 Wof;Windows Overlay File System Filter Driver;C:\WINDOWS\System32\drivers\wof.sys [2017-3-18 208288]
R1 ahcache;Application Compatibility Cache;C:\WINDOWS\System32\drivers\ahcache.sys [2017-3-18 239616]
R1 ESProtectionDriver;Malwarebytes Anti-Exploit;C:\WINDOWS\System32\drivers\mbae64.sys [2017-7-24 77376]
R1 FileCrypt;FileCrypt;C:\WINDOWS\System32\drivers\filecrypt.sys [2017-3-18 54272]
R1 GpuEnergyDrv;GPU Energy Driver;C:\WINDOWS\System32\drivers\gpuenergydrv.sys [2017-3-18 8192]
R2 CDPSvc;Connected Devices Platform Service;C:\WINDOWS\System32\svchost.exe -k LocalService [2017-3-18 47664]
R2 CDPUserSvc_5550c;Connected Devices Platform User Service_5550c;C:\WINDOWS\System32\svchost.exe -k UnistackSvcGroup [2017-3-18 47664]
R2 clreg;Virtual Registry for Containers;C:\WINDOWS\System32\drivers\registry.sys [2017-3-18 14336]
R2 CoreMessagingRegistrar;CoreMessaging;C:\WINDOWS\System32\svchost.exe -k LocalServiceNoNetwork [2017-3-18 47664]
R2 DiagTrack;Connected User Experiences and Telemetry;C:\WINDOWS\System32\svchost.exe -k utcsvc [2017-3-18 47664]
R2 DusmSvc;Data Usage;C:\WINDOWS\System32\svchost.exe -k LocalServiceNetworkRestricted [2017-3-18 47664]
R2 igfxCUIService2.0.0.0;Intel(R) HD Graphics Control Panel Service;C:\WINDOWS\System32\igfxCUIService.exe [2016-11-2 373744]
R2 MBAMChameleon;MBAMChameleon;C:\WINDOWS\System32\drivers\MBAMChameleon.sys [2017-7-24 188352]
R2 MBAMService;Malwarebytes Service;D:\Anti-Malware\MBAMService.exe [2017-7-24 4470736]
R2 NvContainerLocalSystem;NVIDIA LocalSystem Container;C:\Program Files\NVIDIA Corporation\NvContainer\nvcontainer.exe [2017-3-21 495224]
R2 NVDisplay.ContainerLocalSystem;NVIDIA Display Container LS;C:\Program Files\NVIDIA Corporation\Display.NvContainer\NVDisplay.Container.exe [2017-6-17 462968]
R2 NvTelemetryContainer;NVIDIA Telemetry Container;C:\Program Files (x86)\NVIDIA Corporation\NvTelemetry\NvTelemetryContainer.exe [2017-3-21 450168]
R2 OneSyncSvc_5550c;Sync Host_5550c;C:\WINDOWS\System32\svchost.exe -k UnistackSvcGroup [2017-3-18 47664]
R2 Razer Game Scanner Service;Razer Game Scanner;C:\Program Files (x86)\Razer\Razer Services\GSS\GameScannerService.exe [2016-9-24 189264]
R2 rzpmgrk;rzpmgrk;C:\WINDOWS\System32\drivers\rzpmgrk.sys [2017-6-17 44144]
R2 rzpnk;rzpnk;C:\WINDOWS\System32\drivers\rzpnk.sys [2017-6-17 137840]
R2 SecurityHealthService;Windows Defender Security Center Service;C:\WINDOWS\System32\SecurityHealthService.exe [2017-7-11 336320]
R2 storqosflt;Storage QoS Filter Driver;C:\WINDOWS\System32\drivers\storqosflt.sys [2017-3-18 79872]
R2 tiledatamodelsvc;Tile Data model server;C:\WINDOWS\System32\svchost.exe -k appmodel [2017-3-18 47664]
R2 UserManager;User Manager;C:\WINDOWS\System32\svchost.exe -k netsvcs [2017-3-18 47664]
R2 wcifs;Windows Container Isolation;C:\WINDOWS\System32\drivers\wcifs.sys [2017-6-28 142752]
R2 WpnService;Windows Push Notifications System Service;C:\WINDOWS\System32\svchost.exe -k netsvcs [2017-3-18 47664]
R2 WpnUserService_5550c;Windows Push Notifications User Service_5550c;C:\WINDOWS\System32\svchost.exe -k UnistackSvcGroup [2017-3-18 47664]
R3 CorsairVBusDriver;Corsair Bus;C:\WINDOWS\System32\drivers\CorsairVBusDriver.sys [2017-1-31 43000]
R3 CorsairVHidDriver;Corsair virtual device;C:\WINDOWS\System32\drivers\CorsairVHidDriver.sys [2017-1-31 27640]
R3 dg_ssudbus;SAMSUNG Mobile USB Composite Device Driver (DEVGURU Ver.);C:\WINDOWS\System32\drivers\ssudbus.sys [2016-9-5 131712]
R3 IntcDAud;Intel(R) Display Audio;C:\WINDOWS\System32\drivers\IntcDAud.sys [2016-5-12 481768]
R3 lfsvc;Geolocation Service;C:\WINDOWS\System32\svchost.exe -k netsvcs [2017-3-18 47664]
R3 lvrs64;Logitech RightSound Filter Driver;C:\WINDOWS\System32\drivers\lvrs64.sys [2012-10-26 351520]
R3 LVUVC64;@oem19.inf,%PID_081A_DD%(UVC);Logitech Webcam C260(UVC);C:\WINDOWS\System32\drivers\lvuvc64.sys [2012-10-26 4758176]
R3 MBAMFarflt;MBAMFarflt;C:\WINDOWS\System32\drivers\farflt.sys [2017-7-24 101784]
R3 MBAMProtection;MBAMProtection;C:\WINDOWS\System32\drivers\mbam.sys [2017-7-24 45472]
R3 MBAMSwissArmy;MBAMSwissArmy;C:\WINDOWS\System32\drivers\MBAMSwissArmy.sys [2017-7-24 253856]
R3 MBAMWebProtection;MBAMWebProtection;C:\WINDOWS\System32\drivers\mwac.sys [2017-7-24 93600]
R3 NcbService;Network Connection Broker;C:\WINDOWS\System32\svchost.exe -k LocalSystemNetworkRestricted [2017-3-18 47664]
R3 NdisVirtualBus;Microsoft Virtual Network Adapter Enumerator;C:\WINDOWS\System32\drivers\NdisVirtualBus.sys [2017-3-18 20992]
R3 nvvad_WaveExtensible;NVIDIA Virtual Audio Device (Wave Extensible) (WDM);C:\WINDOWS\System32\drivers\nvvad64v.sys [2017-3-21 48248]
R3 nvvhci;NVVHCI Enumerator Service;C:\WINDOWS\System32\drivers\nvvhci.sys [2017-3-21 57976]
R3 rzdaendpt;Razer DeathAdder end point;C:\WINDOWS\System32\drivers\rzdaendpt.sys [2015-8-13 43720]
R3 rzudd;Razer Mouse Driver;C:\WINDOWS\System32\drivers\rzudd.sys [2015-8-13 202952]
R3 rzvkeyboard;Razer Virtual Keyboard Driver;C:\WINDOWS\System32\drivers\rzvkeyboard.sys [2015-8-13 44232]
R3 ssudmdm;SAMSUNG Mobile USB Modem Drivers (DEVGURU Ver.);C:\WINDOWS\System32\drivers\ssudmdm.sys [2016-9-5 165504]
R3 StateRepository;State Repository Service;C:\WINDOWS\System32\svchost.exe -k appmodel [2017-3-18 47664]
R3 TimeBrokerSvc;Time Broker;C:\WINDOWS\System32\svchost.exe -k LocalServiceNetworkRestricted [2017-3-18 47664]
R3 TokenBroker;TokenBroker;C:\WINDOWS\System32\svchost.exe -k netsvcs [2017-3-18 47664]
R3 WdNisDrv;Windows Defender Antivirus Network Inspection System Driver;C:\WINDOWS\System32\drivers\WdNisDrv.sys [2017-3-18 121248]
R3 WdNisSvc;Windows Defender Antivirus Network Inspection Service;C:\Program Files\Windows Defender\NisSrv.exe [2017-3-18 342264]
R3 WUDFWpdMtp;WUDFWpdMtp;C:\WINDOWS\System32\drivers\WUDFRd.sys [2017-3-18 220672]
R3 XtuAcpiDriver;Intel(R) Extreme Tuning Utility Service;C:\WINDOWS\System32\drivers\XtuAcpiDriver.sys [2015-6-6 63840]
S2 CldFlt;Windows Cloud Files Filter Driver;C:\WINDOWS\System32\drivers\cldflt.sys [2017-3-18 12288]
S2 DoSvc;Delivery Optimization;C:\WINDOWS\System32\svchost.exe -k netsvcs [2017-3-18 47664]
S2 MapsBroker;Downloaded Maps Manager;C:\WINDOWS\System32\svchost.exe -k NetworkService [2017-3-18 47664]
S2 SkypeUpdate;Skype Updater;C:\Program Files (x86)\Skype\Updater\Updater.exe [2017-2-27 317400]
S3 AcpiDev;ACPI Devices driver;C:\WINDOWS\System32\drivers\AcpiDev.sys [2017-3-18 20480]
S3 ADP80XX;ADP80XX;C:\WINDOWS\System32\drivers\adp80xx.sys [2017-3-18 1135512]
S3 AJRouter;AllJoyn Router Service;C:\WINDOWS\System32\svchost.exe -k LocalServiceNetworkRestricted [2017-3-18 47664]
S3 applockerfltr;Smartlocker Filter Driver;C:\WINDOWS\System32\drivers\applockerfltr.sys [2017-3-18 17920]
S3 AppReadiness;App Readiness;C:\WINDOWS\System32\svchost.exe -k AppReadiness [2017-3-18 47664]
S3 AppvStrm;AppvStrm;C:\WINDOWS\System32\drivers\AppVStrm.sys [2017-3-18 127904]
S3 AppvVemgr;AppvVemgr;C:\WINDOWS\System32\drivers\AppvVemgr.sys [2017-3-18 161696]
S3 AppvVfs;AppvVfs;C:\WINDOWS\System32\drivers\AppvVfs.sys [2017-3-18 143776]
S3 AppXSvc;AppX Deployment Service (AppXSVC);C:\WINDOWS\System32\svchost.exe -k wsappx [2017-3-18 47664]
S3 bcmfn2;bcmfn2 Service;C:\WINDOWS\System32\drivers\bcmfn2.sys [2017-3-18 9728]
S3 BEService;BattlEye Service;C:\Program Files (x86)\Common Files\BattlEye\BEService.exe [2017-7-9 1522184]
S3 BthHFSrv;Bluetooth Handsfree Service;C:\WINDOWS\System32\svchost.exe -k LocalServiceAndNoImpersonation [2017-3-18 47664]
S3 buttonconverter;Service for Portable Device Control devices;C:\WINDOWS\System32\drivers\buttonconverter.sys [2017-3-18 39424]
S3 CAD;Charge Arbitration Driver;C:\WINDOWS\System32\drivers\CAD.sys [2017-3-18 53664]
S3 CapImg;HID driver for CapImg touch screen;C:\WINDOWS\System32\drivers\capimg.sys [2017-3-18 122880]
S3 cht4iscsi;cht4iscsi;C:\WINDOWS\System32\drivers\cht4sx64.sys [2017-3-18 347032]
S3 cht4vbd;Chelsio Virtual Bus Driver;C:\WINDOWS\System32\drivers\cht4vx64.sys [2017-3-18 2104224]
S3 ClipSVC;Client License Service (ClipSVC);C:\WINDOWS\System32\svchost.exe -k wsappx [2017-3-18 47664]
S3 DevicesFlowUserSvc_5550c;DevicesFlow_5550c;C:\WINDOWS\System32\svchost.exe -k DevicesFlow [2017-3-18 47664]
S3 DevQueryBroker;DevQuery Background Discovery Broker;C:\WINDOWS\System32\svchost.exe -k LocalSystemNetworkRestricted [2017-3-18 47664]
S3 diagnosticshub.standardcollector.service;Microsoft (R) Diagnostics Hub Standard Collector Service;C:\WINDOWS\System32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe [2017-3-18 86528]
S3 DmEnrollmentSvc;Device Management Enrollment Service;C:\WINDOWS\System32\svchost.exe -k netsvcs [2017-3-18 47664]
S3 dmwappushservice;dmwappushsvc;C:\WINDOWS\System32\svchost.exe -k netsvcs [2017-3-18 47664]
S3 DsSvc;Data Sharing Service;C:\WINDOWS\System32\svchost.exe -k LocalSystemNetworkRestricted [2017-3-18 47664]
S3 embeddedmode;Embedded Mode;C:\WINDOWS\System32\svchost.exe -k LocalSystemNetworkRestricted [2017-3-18 47664]
S3 EntAppSvc;Enterprise App Management Service;C:\WINDOWS\System32\svchost.exe -k appmodel [2017-3-18 47664]
S3 FrameServer;Windows Camera Frame Server;C:\WINDOWS\System32\svchost.exe -k Camera [2017-3-18 47664]
S3 genericusbfn;Generic USB Function Class;C:\WINDOWS\System32\drivers\genericusbfn.sys [2017-3-18 21504]
S3 hidinterrupt;Common Driver for HID Buttons implemented with interrupts;C:\WINDOWS\System32\drivers\hidinterrupt.sys [2017-3-18 51104]
S3 HvHost;HV Host Service;C:\WINDOWS\System32\svchost.exe -k LocalSystemNetworkRestricted [2017-3-18 47664]
S3 iagpio;Intel Serial IO GPIO Controller Driver;C:\WINDOWS\System32\drivers\iagpio.sys [2017-3-18 33280]
S3 iai2c;Intel(R) Serial IO I2C Host Controller;C:\WINDOWS\System32\drivers\iai2c.sys [2017-3-18 81408]
S3 iaLPSS2i_GPIO2;Intel(R) Serial IO GPIO Driver v2;C:\WINDOWS\System32\drivers\iaLPSS2i_GPIO2.sys [2017-3-18 70656]
S3 iaLPSS2i_GPIO2_BXT_P;Intel(R) Serial IO GPIO Driver v2;C:\WINDOWS\System32\drivers\iaLPSS2i_GPIO2_BXT_P.sys [2017-3-18 85504]
S3 iaLPSS2i_I2C;Intel(R) Serial IO I2C Driver v2;C:\WINDOWS\System32\drivers\iaLPSS2i_I2C.sys [2017-3-18 165376]
S3 iaLPSS2i_I2C_BXT_P;Intel(R) Serial IO I2C Driver v2;C:\WINDOWS\System32\drivers\iaLPSS2i_I2C_BXT_P.sys [2017-3-18 168448]
S3 iaLPSSi_GPIO;Intel(R) Serial IO GPIO Controller Driver;C:\WINDOWS\System32\drivers\iaLPSSi_GPIO.sys [2017-3-18 38128]
S3 iaLPSSi_I2C;Intel(R) Serial IO I2C Controller Driver;C:\WINDOWS\System32\drivers\iaLPSSi_I2C.sys [2017-3-18 113152]
S3 iaStorAV;Intel(R) SATA RAID Controller Windows;C:\WINDOWS\System32\drivers\iaStorAV.sys [2017-3-18 673184]
S3 ibbus;Mellanox InfiniBand Bus/AL (Filter Driver);C:\WINDOWS\System32\drivers\ibbus.sys [2017-3-18 526240]
S3 icssvc;Windows Mobile Hotspot Service;C:\WINDOWS\System32\svchost.exe -k LocalServiceNetworkRestricted [2017-3-18 47664]
S3 IndirectKmd;Indirect Displays Kernel-Mode Driver;C:\WINDOWS\System32\drivers\IndirectKmd.sys [2017-3-18 36864]
S3 IpxlatCfgSvc;IP Translation Configuration Service;C:\WINDOWS\System32\svchost.exe -k LocalSystemNetworkRestricted [2017-3-18 47664]
S3 LicenseManager;Windows License Manager Service;C:\WINDOWS\System32\svchost.exe -k LocalService [2017-3-18 47664]
S3 LSI_SAS2i;LSI_SAS2i;C:\WINDOWS\System32\drivers\lsi_sas2i.sys [2017-3-18 123808]
S3 LSI_SAS3i;LSI_SAS3i;C:\WINDOWS\System32\drivers\lsi_sas3i.sys [2017-3-18 103328]
S3 mausbhost;MA-USB Host Controller Driver;C:\WINDOWS\System32\drivers\mausbhost.sys [2017-3-18 405408]
S3 mausbip;MA-USB IP Filter Driver;C:\WINDOWS\System32\drivers\mausbip.sys [2017-3-18 51104]
S3 megasas2i;megasas2i;C:\WINDOWS\System32\drivers\MegaSas2i.sys [2017-3-18 64416]
S3 MessagingService_5550c;MessagingService_5550c;C:\WINDOWS\System32\svchost.exe -k UnistackSvcGroup [2017-3-18 47664]
S3 mlx4_bus;Mellanox ConnectX Bus Enumerator;C:\WINDOWS\System32\drivers\mlx4_bus.sys [2017-3-18 842656]
S3 MsSecFlt;Microsoft Security Events Component Minifilter;C:\WINDOWS\System32\drivers\mssecflt.sys [2017-3-18 230816]
S3 NaturalAuthentication;Natural Authentication;C:\WINDOWS\System32\svchost.exe -k netsvcs [2017-3-18 47664]
S3 ndfltr;NetworkDirect Service;C:\WINDOWS\System32\drivers\ndfltr.sys [2017-3-18 108960]
S3 NetAdapterCx;Network Adapter Wdf Class Extension Library;C:\WINDOWS\System32\drivers\NetAdapterCx.sys [2017-3-18 122368]
S3 NetSetupSvc;Network Setup Service;C:\WINDOWS\System32\svchost.exe -k netsvcs [2017-3-18 47664]
S3 netvsc;netvsc;C:\WINDOWS\System32\drivers\netvsc.sys [2017-6-17 118784]
S3 NgcCtnrSvc;Microsoft Passport Container;C:\WINDOWS\System32\svchost.exe -k LocalServiceNetworkRestricted [2017-3-18 47664]
S3 NgcSvc;Microsoft Passport;C:\WINDOWS\System32\svchost.exe -k LocalSystemNetworkRestricted [2017-3-18 47664]
S3 npggsvc;nProtect GameGuard Service;C:\WINDOWS\System32\GameMon.des -service --> C:\WINDOWS\System32\GameMon.des -service [?]
S3 NvContainerNetworkService;NVIDIA NetworkService Container;C:\Program Files\NVIDIA Corporation\NvContainer\nvcontainer.exe [2017-3-21 495224]
S3 nvdimmn;Microsoft NVDIMM-N device driver;C:\WINDOWS\System32\drivers\nvdimmn.sys [2017-3-18 80896]
S3 NvStreamKms;NVIDIA KMS;C:\Program Files\NVIDIA Corporation\NvStreamSrv\NvStreamKms.sys [2017-7-14 30328]
S3 ose64;Office 64 Source Engine;C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE [2014-1-23 178760]
S3 percsas2i;percsas2i;C:\WINDOWS\System32\drivers\percsas2i.sys [2017-3-18 58784]
S3 percsas3i;percsas3i;C:\WINDOWS\System32\drivers\percsas3i.sys [2017-3-18 61848]
S3 PhoneSvc;Phone Service;C:\WINDOWS\System32\svchost.exe -k LocalService [2017-3-18 47664]
S3 PimIndexMaintenanceSvc_5550c;Contact Data_5550c;C:\WINDOWS\System32\svchost.exe -k UnistackSvcGroup [2017-3-18 47664]
S3 ReFS;ReFS;C:\WINDOWS\System32\drivers\refs.sys [2017-3-18 1735584]
S3 ReFSv1;ReFSv1;C:\WINDOWS\System32\drivers\refsv1.sys [2017-3-18 936864]
S3 RetailDemo;Retail Demo Service;C:\WINDOWS\System32\svchost.exe -k rdxgroup [2017-3-18 47664]
S3 ScDeviceEnum;Smart Card Device Enumeration Service;C:\WINDOWS\System32\svchost.exe -k LocalSystemNetworkRestricted [2017-3-18 47664]
S3 scmbus;Microsoft Storage Class Memory Bus Driver;C:\WINDOWS\System32\drivers\scmbus.sys [2017-3-18 91040]
S3 SDFRd;SDF Reflector;C:\WINDOWS\System32\drivers\SDFRd.sys [2017-3-18 31128]
S3 SEMgrSvc;Payments and NFC/SE Manager;C:\WINDOWS\System32\svchost.exe -k LocalService [2017-3-18 47664]
S3 Sense;Windows Defender Advanced Threat Protection Service;C:\Program Files\Windows Defender Advanced Threat Protection\MsSense.exe [2017-3-18 3913064]
S3 SensorDataService;Sensor Data Service;C:\WINDOWS\System32\SensorDataService.exe [2017-3-18 1284608]
S3 SensorService;Sensor Service;C:\WINDOWS\System32\svchost.exe -k LocalSystemNetworkRestricted [2017-3-18 47664]
S3 SerCx2;Serial UART Support Library;C:\WINDOWS\System32\drivers\SerCx2.sys [2017-3-18 154016]
S3 smphost;Microsoft Storage Spaces SMP;C:\WINDOWS\System32\svchost.exe -k smphost [2017-3-18 47664]
S3 SmsRouter;Microsoft Windows SMS Router Service.;C:\WINDOWS\System32\svchost.exe -k LocalSystemNetworkRestricted [2017-3-18 47664]
S3 SpatialGraphFilter;Holographic Spatial Graph Filter;C:\WINDOWS\System32\drivers\SpatialGraphFilter.sys [2017-3-18 40352]
S3 spectrum;Windows Perception Service;C:\WINDOWS\System32\Spectrum.exe [2017-3-18 891904]
S3 stornvme;Microsoft Standard NVM Express Driver;C:\WINDOWS\System32\drivers\stornvme.sys [2017-3-18 95648]
S3 storufs;Microsoft Universal Flash Storage (UFS) Driver;C:\WINDOWS\System32\drivers\storufs.sys [2017-3-18 36760]
S3 TieringEngineService;Storage Tiers Management;C:\WINDOWS\System32\TieringEngineService.exe [2017-3-18 302592]
S3 UcmCx0101;USB Connector Manager KMDF Class Extension;C:\WINDOWS\System32\drivers\UcmCx.sys [2017-3-18 104448]
S3 UcmTcpciCx0101;UCM-TCPCI KMDF Class Extension;C:\WINDOWS\System32\drivers\UcmTcpciCx.sys [2017-3-18 179200]
S3 UcmUcsi;USB Connector Manager UCSI Client;C:\WINDOWS\System32\drivers\UcmUcsi.sys [2017-3-18 51712]
S3 UdeCx;USB Device Emulation Support Library;C:\WINDOWS\System32\drivers\Udecx.sys [2017-3-18 45568]
S3 UEFI;Microsoft UEFI Driver;C:\WINDOWS\System32\drivers\uefi.sys [2017-3-18 29600]
S3 Ufx01000;USB Function Class Extension;C:\WINDOWS\System32\drivers\ufx01000.sys [2017-3-18 263584]
S3 UfxChipidea;USB Chipidea Controller;C:\WINDOWS\System32\drivers\UfxChipidea.sys [2017-3-18 98712]
S3 ufxsynopsys;USB Synopsys Controller;C:\WINDOWS\System32\drivers\ufxsynopsys.sys [2017-3-18 138656]
S3 UnistoreSvc_5550c;User Data Storage_5550c;C:\WINDOWS\System32\svchost.exe -k UnistackSvcGroup [2017-3-18 47664]
S3 UrsChipidea;Chipidea USB Role-Switch Driver;C:\WINDOWS\System32\drivers\urschipidea.sys [2017-3-18 29600]
S3 UrsCx01000;USB Role-Switch Support Library;C:\WINDOWS\System32\drivers\urscx01000.sys [2017-3-18 59288]
S3 UrsSynopsys;Synopsys USB Role-Switch Driver;C:\WINDOWS\System32\drivers\urssynopsys.sys [2017-3-18 28064]
S3 UserDataSvc_5550c;User Data Access_5550c;C:\WINDOWS\System32\svchost.exe -k UnistackSvcGroup [2017-3-18 47664]
S3 UsoSvc;Update Orchestrator Service;C:\WINDOWS\System32\svchost.exe -k netsvcs [2017-3-18 47664]
S3 vhf;Virtual HID Framework (VHF) Driver;C:\WINDOWS\System32\drivers\vhf.sys [2017-3-18 35328]
S3 vmgid;Microsoft Hyper-V Guest Infrastructure Driver;C:\WINDOWS\System32\drivers\vmgid.sys [2017-3-18 10240]
S3 vmicguestinterface;Hyper-V Guest Service Interface;C:\WINDOWS\System32\svchost.exe -k LocalSystemNetworkRestricted [2017-3-18 47664]
S3 vmicvmsession;Hyper-V PowerShell Direct Service;C:\WINDOWS\System32\svchost.exe -k LocalSystemNetworkRestricted [2017-3-18 47664]
S3 WalletService;WalletService;C:\WINDOWS\System32\svchost.exe -k appmodel [2017-3-18 47664]
S3 wcnfs;Windows Container Name Virtualization;C:\WINDOWS\System32\drivers\wcnfs.sys [2017-3-18 72192]
S3 wdiwifi;WDI Driver Framework;C:\WINDOWS\System32\drivers\WdiWiFi.sys [2017-6-28 757248]
S3 WEPHOSTSVC;Windows Encryption Provider Host Service;C:\WINDOWS\System32\svchost.exe -k WepHostSvcGroup [2017-3-18 47664]
S3 WFDSConMgrSvc;Wi-Fi Direct Services Connection Manager Service;C:\WINDOWS\System32\svchost.exe -k LocalServiceNetworkRestricted [2017-3-18 47664]
S3 WinMad;WinMad Service;C:\WINDOWS\System32\drivers\winmad.sys [2017-3-18 32160]
S3 WinNat;Windows NAT Driver;C:\WINDOWS\System32\drivers\winnat.sys [2017-3-18 217088]
S3 WinVerbs;WinVerbs Service;C:\WINDOWS\System32\drivers\winverbs.sys [2017-3-18 64920]
S3 wisvc;Windows Insider Service;C:\WINDOWS\System32\svchost.exe -k netsvcs [2017-3-18 47664]
S3 wlpasvc;LPA Service;C:\WINDOWS\System32\svchost.exe -k LocalService [2017-3-18 47664]
S3 workfolderssvc;Work Folders;C:\WINDOWS\System32\svchost.exe -k LocalService [2017-3-18 47664]
S3 xbgm;Xbox Game Monitoring;C:\WINDOWS\System32\svchost.exe -k netsvcs [2017-3-18 47664]
S3 XblAuthManager;Xbox Live Auth Manager;C:\WINDOWS\System32\svchost.exe -k netsvcs [2017-3-18 47664]
S3 XblGameSave;Xbox Live Game Save;C:\WINDOWS\System32\svchost.exe -k netsvcs [2017-3-18 47664]
S3 xboxgip;Xbox Game Input Protocol Driver;C:\WINDOWS\System32\drivers\xboxgip.sys [2017-6-17 277504]
S3 XboxGipSvc;Xbox Accessory Management Service;C:\WINDOWS\System32\svchost.exe -k netsvcs [2017-3-18 47664]
S3 XboxNetApiSvc;Xbox Live Networking Service;C:\WINDOWS\System32\svchost.exe -k netsvcs [2017-3-18 47664]
S3 xinputhid;XINPUT HID Filter Driver;C:\WINDOWS\System32\drivers\xinputhid.sys [2017-3-18 46592]
S3 YSDrv;VBox Support Driver;C:\Program Files (x86)\Bignox\BigNoxVM\RT\YSDrv.sys [2017-4-4 270608]
S4 AppVClient;Microsoft App-V Client;C:\WINDOWS\System32\AppVClient.exe [2017-7-11 846752]
S4 shpamsvc;Shared PC Account Manager;C:\WINDOWS\System32\svchost.exe -k netsvcs [2017-3-18 47664]
S4 tzautoupdate;Auto Time Zone Updater;C:\WINDOWS\System32\svchost.exe -k LocalService [2017-3-18 47664]
S4 UevAgentDriver;UevAgentDriver;C:\WINDOWS\System32\drivers\UevAgentDriver.sys [2017-3-18 40344]
S4 UevAgentService;User Experience Virtualization Service;C:\WINDOWS\System32\AgentService.exe [2017-3-18 1200640]
.
=============== File Associations ===============
.
FileExt: .txt: txtfile=C:\WINDOWS\System32\NOTEPAD.EXE %1 [UserChoice]
.
=============== Created Last 30 ================
.
2017-07-24 23:32:00 188352 ----a-w- C:\WINDOWS\System32\drivers\MBAMChameleon.sys
2017-07-24 23:31:53 93600 ----a-w- C:\WINDOWS\System32\drivers\mwac.sys
2017-07-24 23:31:53 101784 ----a-w- C:\WINDOWS\System32\drivers\farflt.sys
2017-07-24 23:31:49 45472 ----a-w- C:\WINDOWS\System32\drivers\mbam.sys
2017-07-24 23:31:47 253856 ----a-w- C:\WINDOWS\System32\drivers\MBAMSwissArmy.sys
2017-07-24 23:31:44 77376 ----a-w- C:\WINDOWS\System32\drivers\mbae64.sys
2017-07-24 23:31:39 -------- d-----w- C:\ProgramData\Malwarebytes
2017-07-24 21:48:38 44928 ----a-w- C:\ProgramData\Microsoft\Windows Defender\Definition Updates\{D823137E-664B-49B2-971C-54C5614B29D5}\MpKsldad9bbb7.sys
2017-07-24 21:48:27 13476768 ----a-w- C:\ProgramData\Microsoft\Windows Defender\Definition Updates\{D823137E-664B-49B2-971C-54C5614B29D5}\mpengine.dll
2017-07-24 10:30:31 13476768 ----a-w- C:\ProgramData\Microsoft\Windows Defender\Definition Updates\Backup\mpengine.dll
2017-07-15 00:50:48 -------- d-----w- C:\WINDOWS\LastGood.Tmp
2017-07-15 00:50:46 179320 ----a-w- C:\WINDOWS\System32\nvaudcap64v.dll
2017-07-15 00:50:46 146552 ----a-w- C:\WINDOWS\SysWow64\nvaudcap32v.dll
2017-07-11 22:37:58 8211968 ----a-w- C:\WINDOWS\System32\mstscax.dll
2017-07-09 19:43:27 -------- d-----w- C:\Users\Crystal\AppData\Local\UnrealEngine
2017-07-09 19:43:27 -------- d-----w- C:\Users\Crystal\AppData\Local\TslGame
2017-07-09 19:43:22 -------- d-----w- C:\Program Files (x86)\Common Files\BattlEye
2017-06-28 06:15:28 -------- d-----w- C:\Users\Crystal\AppData\Local\DBG
2017-06-28 04:23:14 2132480 ----a-w- C:\WINDOWS\SysWow64\mssrch.dll
2017-06-28 04:23:13 2679296 ----a-w- C:\WINDOWS\SysWow64\SRH.dll
2017-06-28 04:23:13 2671616 ----a-w- C:\WINDOWS\SysWow64\tquery.dll
2017-06-28 04:23:12 2597888 ----a-w- C:\WINDOWS\System32\mssrch.dll
2017-06-28 04:23:11 1451008 ----a-w- C:\WINDOWS\SysWow64\UIAutomationCore.dll
2017-06-28 04:23:06 3332096 ----a-w- C:\WINDOWS\System32\SRH.dll
2017-06-28 04:21:55 3667456 ----a-w- C:\WINDOWS\SysWow64\D3DCompiler_47.dll
2017-06-28 04:20:58 6554928 ----a-w- C:\WINDOWS\System32\Windows.Media.dll
2017-06-28 04:20:30 2681760 ----a-w- C:\WINDOWS\System32\drivers\tcpip.sys
2017-06-28 04:20:25 847872 ----a-w- C:\WINDOWS\System32\bisrv.dll
2017-06-28 04:20:17 2938880 ----a-w- C:\WINDOWS\System32\InputService.dll
2017-06-28 04:18:59 985600 ----a-w- C:\WINDOWS\System32\TSWorkspace.dll
2017-06-25 13:27:56 26942720 ----a-w- C:\Program Files (x86)\Common Files\Microsoft Shared\OFFICE15\MSO.DLL
2017-06-25 13:24:24 37559040 ----a-w- C:\Program Files\Common Files\Microsoft Shared\OFFICE15\MSO.DLL
.
==================== Find3M ====================
.
2017-07-24 23:28:39 180 ----a-w- C:\WINDOWS\System32\{A6D608F0-0BDE-491A-97AE-5C4B05D86E01}.bat
2017-07-07 14:00:12 947712 ----a-w- C:\WINDOWS\System32\HoloSI.PCShell.dll
2017-07-07 07:27:41 750560 ----a-w- C:\WINDOWS\System32\fontdrvhost.exe
2017-07-07 07:27:37 965024 ----a-w- C:\WINDOWS\System32\hvloader.efi
2017-07-07 07:27:35 821664 ----a-w- C:\WINDOWS\System32\hvloader.exe
2017-07-07 07:27:35 1024928 ----a-w- C:\WINDOWS\System32\hvax64.exe
2017-07-07 07:27:32 1147288 ----a-w- C:\WINDOWS\System32\hvix64.exe
2017-07-07 07:26:00 1065104 ----a-w- C:\WINDOWS\System32\winresume.efi
2017-07-07 07:25:40 899824 ----a-w- C:\WINDOWS\System32\winresume.exe
2017-07-07 07:24:00 117664 ----a-w- C:\WINDOWS\System32\drivers\pdc.sys
2017-07-07 07:23:03 2399728 ----a-w- C:\WINDOWS\System32\KernelBase.dll
2017-07-07 07:22:45 1186464 ----a-w- C:\WINDOWS\System32\winload.exe
2017-07-07 07:22:32 8318880 ----a-w- C:\WINDOWS\System32\ntoskrnl.exe
2017-07-07 07:22:11 119384 ----a-w- C:\WINDOWS\System32\dmcmnutils.dll
2017-07-07 07:21:28 32688336 ----a-w- C:\WINDOWS\System32\WindowsCodecsRaw.dll
2017-07-07 07:21:07 2969880 ----a-w- C:\WINDOWS\System32\CoreUIComponents.dll
2017-07-07 07:20:52 382368 ----a-w- C:\WINDOWS\System32\drivers\clfs.sys
2017-07-07 07:20:23 2021680 ----a-w- C:\WINDOWS\System32\wmpmde.dll
2017-07-07 07:20:19 923040 ----a-w- C:\WINDOWS\System32\CoreMessaging.dll
2017-07-07 07:20:19 519584 ----a-w- C:\WINDOWS\System32\drivers\netio.sys
2017-07-07 07:17:42 1017760 ----a-w- C:\WINDOWS\System32\SecConfig.efi
2017-07-07 07:15:09 2444696 ----a-w- C:\WINDOWS\System32\drivers\dxgkrnl.sys
2017-07-07 07:14:55 1760264 ----a-w- C:\WINDOWS\System32\WindowsCodecs.dll
2017-07-07 07:14:39 7325584 ----a-w- C:\WINDOWS\System32\windows.storage.dll
2017-07-07 07:14:31 1171032 ----a-w- C:\WINDOWS\System32\dcomp.dll
2017-07-07 07:14:30 5477088 ----a-w- C:\WINDOWS\System32\OneCoreUAPCommonProxyStub.dll
2017-07-07 07:13:20 554392 ----a-w- C:\WINDOWS\System32\drivers\USBHUB3.SYS
2017-07-07 07:13:19 872472 ----a-w- C:\WINDOWS\System32\ClipSVC.dll
2017-07-07 07:13:13 147800 ----a-w- C:\WINDOWS\System32\Clipc.dll
2017-07-07 07:13:07 336320 ----a-w- C:\WINDOWS\System32\SecurityHealthService.exe
2017-07-07 07:12:57 228256 ----a-w- C:\WINDOWS\System32\drivers\mrxsmb20.sys
2017-07-07 07:12:43 411040 ----a-w- C:\WINDOWS\System32\msv1_0.dll
2017-07-07 07:12:23 318232 ----a-w- C:\WINDOWS\System32\wininit.exe
2017-07-07 07:11:14 94624 ----a-w- C:\WINDOWS\System32\rdpudd.dll
2017-07-07 07:11:12 7904784 ----a-w- C:\WINDOWS\System32\Windows.Media.Protection.PlayReady.dll
2017-07-07 07:10:50 1670496 ----a-w- C:\WINDOWS\System32\winmde.dll
2017-07-07 07:10:40 254168 ----a-w- C:\WINDOWS\System32\mfps.dll
2017-07-07 07:10:37 1337848 ----a-w- C:\WINDOWS\System32\AudioEng.dll
2017-07-07 07:10:26 1325968 ----a-w- C:\WINDOWS\System32\ole32.dll
2017-07-07 07:10:00 372128 ----a-w- C:\WINDOWS\System32\CloudExperienceHost.dll
2017-07-07 07:09:24 41376 ----a-w- C:\WINDOWS\System32\wininitext.dll
2017-07-07 07:07:47 1106848 ----a-w- C:\WINDOWS\System32\drivers\http.sys
2017-07-07 07:07:38 58488 ----a-w- C:\WINDOWS\System32\lsass.exe
2017-07-07 06:57:25 626528 ----a-w- C:\WINDOWS\SysWow64\fontdrvhost.exe
2017-07-07 06:57:23 125344 ----a-w- C:\WINDOWS\SysWow64\dwmapi.dll
2017-07-07 06:40:44 23677440 ----a-w- C:\WINDOWS\System32\edgehtml.dll
2017-07-07 06:39:10 96128 ----a-w- C:\WINDOWS\SysWow64\dmcmnutils.dll
2017-07-07 06:39:01 1839872 ----a-w- C:\WINDOWS\SysWow64\KernelBase.dll
2017-07-07 06:37:56 31652264 ----a-w- C:\WINDOWS\SysWow64\WindowsCodecsRaw.dll
2017-07-07 06:37:56 2259760 ----a-w- C:\WINDOWS\SysWow64\CoreUIComponents.dll
2017-07-07 06:37:24 1339352 ----a-w- C:\WINDOWS\SysWow64\wmpmde.dll
2017-07-07 06:31:24 129184 ----a-w- C:\WINDOWS\SysWow64\gdi32.dll
2017-07-07 06:31:19 1518088 ----a-w- C:\WINDOWS\SysWow64\WindowsCodecs.dll
2017-07-07 06:31:01 5820984 ----a-w- C:\WINDOWS\SysWow64\windows.storage.dll
2017-07-07 06:31:00 322976 ----a-w- C:\WINDOWS\apppatch\AcRes.dll
2017-07-07 06:30:56 750496 ----a-w- C:\WINDOWS\SysWow64\WWAHost.exe
2017-07-07 06:30:55 949920 ----a-w- C:\WINDOWS\SysWow64\dcomp.dll
2017-07-07 06:29:31 123520 ----a-w- C:\WINDOWS\SysWow64\Clipc.dll
2017-07-07 06:29:06 349600 ----a-w- C:\WINDOWS\SysWow64\msv1_0.dll
2017-07-07 06:27:57 3670016 ----a-w- C:\WINDOWS\System32\win32kfull.sys
2017-07-07 06:27:53 859136 ----a-w- C:\WINDOWS\System32\uDWM.dll
2017-07-07 06:27:51 1050624 ----a-w- C:\WINDOWS\System32\Windows.UI.dll
2017-07-07 06:27:28 1640448 ----a-w- C:\WINDOWS\System32\GdiPlus.dll
2017-07-07 06:27:23 360960 ----a-w- C:\WINDOWS\System32\ConhostV2.dll
2017-07-07 06:27:21 6759512 ----a-w- C:\WINDOWS\SysWow64\Windows.Media.Protection.PlayReady.dll
2017-07-07 06:27:17 577024 ----a-w- C:\WINDOWS\System32\duser.dll
2017-07-07 06:27:00 443392 ----a-w- C:\WINDOWS\System32\PerceptionSimulationExtensions.dll
2017-07-07 06:26:52 1529384 ----a-w- C:\WINDOWS\SysWow64\winmde.dll
2017-07-07 06:26:51 1195240 ----a-w- C:\WINDOWS\SysWow64\AudioEng.dll
2017-07-07 06:26:36 988168 ----a-w- C:\WINDOWS\SysWow64\ole32.dll
2017-07-07 06:26:09 17364992 ----a-w- C:\WINDOWS\System32\Windows.UI.Xaml.dll
2017-07-07 06:25:37 35232 ----a-w- C:\WINDOWS\SysWow64\wininitext.dll
2017-07-07 06:25:29 2199552 ----a-w- C:\WINDOWS\System32\Windows.UI.Xaml.Resources.dll
2017-07-07 06:24:51 1517472 ----a-w- C:\WINDOWS\SysWow64\AppVEntSubsystems32.dll
2017-07-07 06:24:13 114688 ----a-w- C:\WINDOWS\System32\officecsp.dll
2017-07-07 06:23:50 95232 ----a-w- C:\WINDOWS\System32\wudriver.dll
2017-07-07 06:23:46 583160 ----a-w- C:\WINDOWS\SysWow64\CoreMessaging.dll
2017-07-07 06:23:35 110592 ----a-w- C:\WINDOWS\System32\Chakradiag.dll
2017-07-07 06:23:20 113152 ----a-w- C:\WINDOWS\System32\wuuhosdeployment.dll
2017-07-07 06:23:17 29696 ----a-w- C:\WINDOWS\System32\eapprovp.dll
2017-07-07 06:22:55 7931392 ----a-w- C:\WINDOWS\System32\twinui.dll
2017-07-07 06:22:08 520704 ----a-w- C:\WINDOWS\System32\daxexec.dll
2017-07-07 06:21:56 64512 ----a-w- C:\WINDOWS\System32\winsrv.dll
2017-07-07 06:21:18 96256 ----a-w- C:\WINDOWS\System32\ActiveSyncCsp.dll
2017-07-07 06:20:59 8331264 ----a-w- C:\WINDOWS\System32\BingMaps.dll
2017-07-07 06:20:13 175616 ----a-w- C:\WINDOWS\System32\prntvpt.dll
2017-07-07 06:19:47 137216 ----a-w- C:\WINDOWS\System32\raschap.dll
2017-07-07 06:19:46 256000 ----a-w- C:\WINDOWS\System32\domgmt.dll
2017-07-07 06:19:38 527360 ----a-w- C:\WINDOWS\System32\aadcloudap.dll
2017-07-07 06:19:26 165888 ----a-w- C:\WINDOWS\System32\storewuauth.dll
2017-07-07 06:19:02 7149056 ----a-w- C:\WINDOWS\System32\mos.dll
2017-07-07 06:18:55 7336448 ----a-w- C:\WINDOWS\System32\Windows.Data.Pdf.dll
2017-07-07 06:18:36 548864 ----a-w- C:\WINDOWS\System32\SensorService.dll
2017-07-07 06:18:34 274944 ----a-w- C:\WINDOWS\System32\WindowsCodecsExt.dll
2017-07-07 06:18:18 563712 ----a-w- C:\WINDOWS\System32\DevicePairing.dll
2017-07-07 06:18:16 353280 ----a-w- C:\WINDOWS\System32\Wldap32.dll
2017-07-07 06:17:46 1260544 ----a-w- C:\WINDOWS\System32\GamePanel.exe
2017-07-07 06:17:45 422400 ----a-w- C:\WINDOWS\System32\WpAXHolder.dll
2017-07-07 06:17:34 692736 ----a-w- C:\WINDOWS\System32\jscript9diag.dll
2017-07-07 06:17:30 229888 ----a-w- C:\WINDOWS\System32\SIHClient.exe
.
============= FINISH: 19:59:22.07 ===============

Attached Files

attach.txt (9.4 KB)

Hi,
I installed an accountability program yesterday called, Covenant Eyes. Unfortunately, since I did that, msn.com does not open properly in Opera, my husband's preferred browser. It loads very slow and then does not have any images. The address window displays, "http://www.msn.com/g00/?i10c.referrer=" which, from what I'v read, sounds like a referrer. How do I get rid of this? Everything else seems to be working fine and msn.com comes up fine in other browsers.

Thanks, Jen

Malwarebytes keeps randomly popping up a notice that says:

Website blocked
You may exclude sites or applications from website protection by clicking Manage Exclusions.

IP Address 93.171.173.13
Port 52154
Type: Outbound
File: C:\Windows\System32\svchost.exe

Yes. I have install disc.

DDS Follows:
DDS (Ver_2012-11-20.01) - NTFS_AMD64
Internet Explorer: 11.0.9600.18739
Run by April at 10:05:14 on 2017-08-01
Microsoft Windows 7 Professional 6.1.7601.1.1252.1.1033.18.8122.5837 [GMT -5:00]
.
AV: Avast Antivirus *Enabled/Updated* {8EA8924E-BC81-DC44-8BB0-8BAE75D86EBF}
AV: Malwarebytes *Enabled/Updated* {23007AD3-69FE-687C-2629-D584AFFAF72B}
SP: Malwarebytes *Enabled/Updated* {98619B37-4FC4-67F2-1C99-EEF6D47DBD96}
SP: Windows Defender *Disabled/Outdated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
SP: Avast Antivirus *Enabled/Updated* {35C973AA-9ABB-D3CA-B100-B0DC0E5F2402}
.
============== Running Processes ===============
.
C:\Windows\system32\lsm.exe
C:\Windows\system32\svchost.exe -k DcomLaunch
C:\Program Files\NVIDIA Corporation\Display.NvContainer\NVDisplay.Container.exe
C:\Windows\system32\svchost.exe -k RPCSS
C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted
C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted
C:\Windows\system32\svchost.exe -k LocalService
C:\Windows\system32\svchost.exe -k netsvcs
C:\Program Files\NVIDIA Corporation\Display\nvxdsync.exe
C:\Windows\system32\svchost.exe -k GPSvcGroup
C:\Windows\servicing\TrustedInstaller.exe
C:\Windows\system32\svchost.exe -k NetworkService
C:\Program Files\AVAST Software\Avast\AvastSvc.exe
C:\Windows\system32\taskeng.exe
C:\Windows\System32\spoolsv.exe
C:\Windows\system32\svchost.exe -k LocalServiceNoNetwork
C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe
C:\Windows\System32\svchost.exe -k utcsvc
C:\Program Files\Dassault Systemes\DraftSight\bin\dsHttpApiService.exe
C:\Program Files (x86)\Comodo\Dragon\dragon_updater.exe
C:\Program Files (x86)\Foxit Software\Foxit Reader\FoxitConnectedPDFService.exe
C:\Program Files\Intel\iCLS Client\HeciServer.exe
C:\Windows\system32\IProsetMonitor.exe
C:\Program Files\Logitech Gaming Software\Drivers\APOService\LogiRegistryService.exe
C:\Program Files\NVIDIA Corporation\NvContainer\nvcontainer.exe
C:\Program Files (x86)\NVIDIA Corporation\NvTelemetry\NvTelemetryContainer.exe
C:\Windows\system32\svchost.exe -k imgsvc
C:\Program Files\Malwarebytes\Anti-Malware\mbamservice.exe
C:\Windows\system32\wbem\wmiprvse.exe
C:\Windows\system32\svchost.exe -k NetworkServiceNetworkRestricted
C:\Program Files\AVAST Software\Avast\x64\aswidsagenta.exe
C:\Windows\system32\sppsvc.exe
C:\Windows\system32\taskhost.exe
C:\Windows\system32\taskeng.exe
C:\Program Files (x86)\NVIDIA Corporation\NvContainer\nvcontainer.exe
C:\Windows\system32\Dwm.exe
C:\Windows\Explorer.EXE
C:\Program Files\Logitech Gaming Software\LCore.exe
C:\Program Files\AVAST Software\Avast\AvastUI.exe
C:\Program Files\Malwarebytes\Anti-Malware\mbamtray.exe
C:\Program Files\HP\HP ENVY 4500 series\Bin\ScanToPCActivationApp.exe
C:\Program Files\NVIDIA Corporation\ShadowPlay\nvspcaps64.exe
C:\Program Files (x86)\Intel\Intel(R) USB 3.0 eXtensible Host Controller Driver\Application\iusb3mon.exe
C:\Program Files\NVIDIA Corporation\Display\nvtray.exe
C:\Program Files\HP\HP ENVY 4500 series\Bin\HPNetworkCommunicatorCom.exe
C:\Program Files (x86)\Cooler Master\MasterKeys Pro L With intelligent RGB\Masterkeys pro L RGB HID.exe
C:\Windows\system32\SearchIndexer.exe
C:\Program Files\NVIDIA Corporation\ShadowPlay\nvsphelper64.exe
C:\Program Files\Windows Media Player\wmpnetwk.exe
C:\Windows\system32\svchost.exe -k LocalServiceAndNoImpersonation
C:\Program Files (x86)\NVIDIA Corporation\NVIDIA GeForce Experience\NVIDIA Share.exe
C:\Program Files (x86)\NVIDIA Corporation\NVIDIA GeForce Experience\NVIDIA Share.exe
C:\Program Files (x86)\NVIDIA Corporation\NvNode\NVIDIA Web Helper.exe
C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\FWService\IntelMeFWService.exe
C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\DAL\jhi_service.exe
C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\LMS\LMS.exe
C:\Windows\system32\vssvc.exe
C:\Windows\System32\svchost.exe -k swprv
C:\Windows\System32\cscript.exe
.
============== Pseudo HJT Report ===============
.
uProxyServer = 8.8.8.8:80
mWinlogon: Userinit = userinit.exe
BHO: Lync Browser Helper: {31D09BA0-12F5-4CCE-BE8A-2923E76605DA} - C:\Program Files\Microsoft Office\root\VFS\ProgramFilesX86\Microsoft Office\Office16\OCHelper.dll
BHO: avast! Online Security: {8E5E2654-AD2D-48bf-AC2D-D17F00898D06} - C:\Program Files\AVAST Software\Avast\aswWebRepIE.dll
BHO: Office Document Cache Handler: {B4F3A835-0E21-4959-BA22-42B3008E02FF} - C:\Program Files\Microsoft Office\root\VFS\ProgramFilesX86\Microsoft Office\Office16\URLREDIR.DLL
BHO: Microsoft OneDrive for Business Browser Helper: {D0498E0A-45B7-42AE-A9AA-ABA463DBD3BF} - C:\Program Files\Microsoft Office\root\VFS\ProgramFilesX86\Microsoft Office\Office16\GROOVEEX.DLL
uRun: [BlueStacks Agent] C:\Program Files (x86)\Bluestacks\HD-Agent.exe
uRun: [HP ENVY 4500 series (NET)] "C:\Program Files\HP\HP ENVY 4500 series\Bin\ScanToPCActivationApp.exe" -deviceID "CN4851209F05X4:NW" -scfn "HP ENVY 4500 series (NET)" -AutoStart 1
mRun: [USB3MON] "C:\Program Files (x86)\Intel\Intel(R) USB 3.0 eXtensible Host Controller Driver\Application\iusb3mon.exe"
mRun: [MasterKeys Pro L] "C:\Program Files (x86)\Cooler Master\MasterKeys Pro L With intelligent RGB\MasterKeys Pro L RGB HID.exe"
mRun: [OnScreen Control] C:\Program Files (x86)\LG Electronics\OnScreen Control\bin\OnScreenStartUpApp.exe
StartupFolder: C:\PROGRA~3\MICROS~1\Windows\STARTM~1\Programs\Startup\ADOBEG~1.LNK - C:\Program Files (x86)\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe
mPolicies-Explorer: NoActiveDesktop = dword:1
mPolicies-Explorer: NoActiveDesktopChanges = dword:1
mPolicies-System: ConsentPromptBehaviorAdmin = dword:5
mPolicies-System: ConsentPromptBehaviorUser = dword:3
mPolicies-System: EnableUIADesktopToggle = dword:0
mPolicies-System: SoftwareSASGeneration = dword:1
IE: E&xport to Microsoft Excel - C:\Program Files (x86)\Microsoft Office\Root\Office16\EXCEL.EXE/3000
IE: Se&nd to OneNote - C:\Program Files (x86)\Microsoft Office\Root\Office16\ONBttnIE.dll/105
IE: {2670000A-7350-4f3c-8081-5663EE0C6C49} - {48E73304-E1D6-4330-914C-F5F514E3486C} - C:\Program Files\Microsoft Office\root\VFS\ProgramFilesX86\Microsoft Office\Office16\ONBttnIE.dll
IE: {31D09BA0-12F5-4CCE-BE8A-2923E76605DA} - {31D09BA0-12F5-4CCE-BE8A-2923E76605DA} - C:\Program Files\Microsoft Office\root\VFS\ProgramFilesX86\Microsoft Office\Office16\OCHelper.dll
IE: {789FE86F-6FC4-46A1-9849-EDE0DB0C95CA} - {FFFDC614-B694-4AE6-AB38-5D6374584B52} - C:\Program Files\Microsoft Office\root\VFS\ProgramFilesX86\Microsoft Office\Office16\ONBttnIELinkedNotes.dll
DPF: {5AE58FCF-6F6A-49B2-B064-02492C66E3F4} - hxxp://catalog.update.microsoft.com/v7/site/ClientControl/en/x86/MuCatalogWebControl.cab?1464027202442
TCP: NameServer = 192.168.1.1
TCP: Interfaces\{F2F74FFE-E676-4DB8-9FFA-4E0EDFD6D63E} : DHCPNameServer = 192.168.1.1
Handler: mso-minsb-roaming.16 - {83C25742-A9F7-49FB-9138-434302C88D07} - C:\Program Files\Microsoft Office\root\VFS\ProgramFilesX86\Microsoft Office\Office16\MSOSB.DLL
Handler: mso-minsb.16 - {42089D2D-912D-4018-9087-2B87803E93FB} - C:\Program Files\Microsoft Office\root\VFS\ProgramFilesX86\Microsoft Office\Office16\MSOSB.DLL
Handler: osf-roaming.16 - {42089D2D-912D-4018-9087-2B87803E93FB} - C:\Program Files\Microsoft Office\root\VFS\ProgramFilesX86\Microsoft Office\Office16\MSOSB.DLL
Handler: osf.16 - {5504BE45-A83B-4808-900A-3A5C36E7F77A} - C:\Program Files\Microsoft Office\root\VFS\ProgramFilesX86\Microsoft Office\Office16\MSOSB.DLL
SSODL: WebCheck - <orphaned>
mASetup: {8A69D345-D564-463c-AFF1-A69D9E530F96} - "C:\Program Files (x86)\Google\Chrome\Application\58.0.3029.81\Installer\chrmstp.exe" --configure-user-settings --verbose-logging --system-level
x64-BHO: Lync Browser Helper: {31D09BA0-12F5-4CCE-BE8A-2923E76605DA} - C:\Program Files\Microsoft Office\root\Office16\OCHelper.dll
x64-BHO: Java(tm) Plug-In SSV Helper: {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre7\bin\ssv.dll
x64-BHO: avast! Online Security: {8E5E2654-AD2D-48bf-AC2D-D17F00898D06} - C:\Program Files\AVAST Software\Avast\aswWebRepIE64.dll
x64-BHO: Office Document Cache Handler: {B4F3A835-0E21-4959-BA22-42B3008E02FF} - C:\Program Files\Microsoft Office\root\Office16\URLREDIR.DLL
x64-BHO: Microsoft OneDrive for Business Browser Helper: {D0498E0A-45B7-42AE-A9AA-ABA463DBD3BF} - C:\Program Files\Microsoft Office\root\Office16\GROOVEEX.DLL
x64-BHO: Java(tm) Plug-In 2 SSV Helper: {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre7\bin\jp2ssv.dll
x64-Run: [Logitech Download Assistant] C:\Windows\System32\rundll32.exe C:\Windows\System32\LogiLDA.dll,LogiFetch
x64-Run: [ShadowPlay] "C:\Windows\System32\rundll32.exe" C:\Windows\System32\nvspcap64.dll,ShadowPlayOnSystemStart
x64-Run: [AvastUI.exe] "C:\Program Files\AVAST Software\Avast\AvLaunch.exe" /gui
x64-Run: [Launch LCore] C:\Program Files\Logitech Gaming Software\LCore.exe /minimized
x64-Run: [Malwarebytes TrayApp] C:\PROGRAM FILES\MALWAREBYTES\ANTI-MALWARE\mbamtray.exe
x64-IE: {2670000A-7350-4f3c-8081-5663EE0C6C49} - {48E73304-E1D6-4330-914C-F5F514E3486C} - C:\Program Files\Microsoft Office\root\Office16\ONBttnIE.dll
x64-IE: {31D09BA0-12F5-4CCE-BE8A-2923E76605DA} - {31D09BA0-12F5-4CCE-BE8A-2923E76605DA} - C:\Program Files\Microsoft Office\root\Office16\OCHelper.dll
x64-IE: {789FE86F-6FC4-46A1-9849-EDE0DB0C95CA} - {FFFDC614-B694-4AE6-AB38-5D6374584B52} - C:\Program Files\Microsoft Office\root\Office16\ONBttnIELinkedNotes.dll
x64-Handler: mso-minsb-roaming.16 - {83C25742-A9F7-49FB-9138-434302C88D07} - C:\Program Files\Microsoft Office\root\Office16\MSOSB.DLL
x64-Handler: mso-minsb.16 - {42089D2D-912D-4018-9087-2B87803E93FB} - C:\Program Files\Microsoft Office\root\Office16\MSOSB.DLL
x64-Handler: osf-roaming.16 - {42089D2D-912D-4018-9087-2B87803E93FB} - C:\Program Files\Microsoft Office\root\Office16\MSOSB.DLL
x64-Handler: osf.16 - {5504BE45-A83B-4808-900A-3A5C36E7F77A} - C:\Program Files\Microsoft Office\root\Office16\MSOSB.DLL
x64-SSODL: WebCheck - <orphaned>
x64-mASetup: {8A69D345-D564-463c-AFF1-A69D9E530F96} - "C:\Program Files (x86)\Google\Chrome\Application\59.0.3071.115\Installer\chrmstp.exe" --configure-user-settings --verbose-logging --system-level
.
================= FIREFOX ===================
.
FF - ProfilePath - C:\Users\April\AppData\Roaming\Mozilla\Firefox\Profiles\0s5eb2ct.default\
FF - plugin: C:\Program Files (x86)\Foxit Software\Foxit Reader\plugins\npFoxitReaderPlugin.dll
FF - plugin: C:\Program Files (x86)\Google\Update\1.3.33.5\npGoogleUpdate3.dll
FF - plugin: C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\IPT\npIntelWebAPIIPT.dll
FF - plugin: C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\IPT\npIntelWebAPIUpdater.dll
FF - plugin: C:\Program Files\Microsoft Office\root\VFS\ProgramFilesX86\Microsoft Office\Office16\NPSPWRAP.DLL
FF - plugin: C:\Program Files\Microsoft Office\root\VFS\ProgramFilesX86\Mozilla Firefox\plugins\npMeetingJoinPluginOC.dll
.
============= SERVICES / DRIVERS ===============
.
R0 iusb3hcs;Intel(R) USB 3.0 Host Controller Switch Driver;C:\Windows\System32\drivers\iusb3hcs.sys [2015-11-20 22768]
R1 aswbidsdriver;aswbidsdriver;C:\Windows\System32\drivers\aswbidsdrivera.sys [2017-3-1 320008]
R1 aswSnx;aswSnx;C:\Windows\System32\drivers\aswSnx.sys [2016-5-20 1015848]
R1 aswSP;aswSP;C:\Windows\System32\drivers\aswSP.sys [2016-5-20 585608]
R1 ESProtectionDriver;Malwarebytes Anti-Exploit;C:\Windows\System32\drivers\mbae64.sys [2017-7-26 77376]
R1 VBoxNetLwf;VirtualBox NDIS6 Bridged Networking Service;C:\Windows\System32\drivers\VBoxNetLwf.sys [2017-7-17 205952]
R2 aswMonFlt;aswMonFlt;C:\Windows\System32\drivers\aswmonflt.sys [2016-5-20 146696]
R2 aswStm;aswStm;C:\Windows\System32\drivers\aswStm.sys [2016-5-20 198768]
R2 avast! Antivirus;Avast Antivirus;C:\Program Files\AVAST Software\Avast\AvastSvc.exe [2017-7-26 263312]
R2 ClickToRunSvc;Microsoft Office Click-to-Run Service;C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe [2016-10-25 4412104]
R2 DiagTrack;Diagnostics Tracking Service;C:\Windows\System32\svchost.exe -k utcsvc [2009-7-13 27136]
R2 DraftSight API Service;DraftSight API Service;C:\Program Files\Dassault Systemes\DraftSight\bin\dsHttpApiService.exe [2017-2-21 121344]
R2 DragonUpdater;COMODO Dragon Update Service;C:\Program Files (x86)\Comodo\Dragon\dragon_updater.exe [2017-4-28 2273432]
R2 FoxitReaderService;Foxit Reader Service;C:\Program Files (x86)\Foxit Software\Foxit Reader\FoxitConnectedPDFService.exe [2017-3-15 1659592]
R2 Intel(R) Capability Licensing Service Interface;Intel(R) Capability Licensing Service Interface;C:\Program Files\Intel\iCLS Client\HeciServer.exe [2013-5-11 733696]
R2 Intel(R) ME Service;Intel(R) ME Service;C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\FWService\IntelMeFWService.exe [2016-5-23 131544]
R2 Intel(R) PROSet Monitoring Service;Intel(R) PROSet Monitoring Service;C:\Windows\System32\IPROSetMonitor.exe [2013-7-8 195336]
R2 jhi_service;Intel(R) Dynamic Application Loader Host Interface Service;C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\DAL\jhi_service.exe [2016-5-23 169432]
R2 LGCoreTemp;Logitech CPU Core Tempurature;C:\Program Files\Logitech Gaming Software\Drivers\LgCoreTemp\LgCoreTemp.sys [2015-6-21 14184]
R2 LogiRegistryService;Logitech Gaming Registry Service;C:\Program Files\Logitech Gaming Software\Drivers\APOService\LogiRegistryService.exe [2017-4-5 225400]
R2 MBAMChameleon;MBAMChameleon;C:\Windows\System32\drivers\MBAMChameleon.sys [2017-7-26 188352]
R2 MBAMService;Malwarebytes Service;C:\Program Files\Malwarebytes\Anti-Malware\MBAMService.exe [2017-7-26 4470736]
R2 NvContainerLocalSystem;NVIDIA LocalSystem Container;C:\Program Files\NVIDIA Corporation\NvContainer\nvcontainer.exe [2016-9-7 495224]
R2 NVDisplay.ContainerLocalSystem;NVIDIA Display Container LS;C:\Program Files\NVIDIA Corporation\Display.NvContainer\NVDisplay.Container.exe [2017-2-14 464440]
R2 NvTelemetryContainer;NVIDIA Telemetry Container;C:\Program Files (x86)\NVIDIA Corporation\NvTelemetry\NvTelemetryContainer.exe [2017-1-29 450168]
R3 aswbIDSAgent;aswbIDSAgent;C:\Program Files\AVAST Software\Avast\x64\aswidsagenta.exe [2017-7-26 7430992]
R3 e1dexpress;Intel(R) PRO/1000 PCI Express Network Connection Driver D;C:\Windows\System32\drivers\e1d62x64.sys [2013-5-30 495376]
R3 iusb3hub;Intel(R) USB 3.0 Hub Driver;C:\Windows\System32\drivers\iusb3hub.sys [2015-11-20 395504]
R3 iusb3xhc;Intel(R) USB 3.0 eXtensible Host Controller Driver;C:\Windows\System32\drivers\iusb3xhc.sys [2015-11-20 806128]
R3 LGBusEnum;Logitech Gaming Virtual Bus Enumerator Driver;C:\Windows\System32\drivers\LGBusEnum.sys [2017-4-5 36496]
R3 LGJoyXlCore;Logitech Translation Layer Driver (LGS);C:\Windows\System32\drivers\LGJoyXlCore.sys [2017-4-5 67736]
R3 LGVirHid;Logitech Gamepanel Virtual HID Device Driver;C:\Windows\System32\drivers\LGVirHid.sys [2017-4-5 26008]
R3 MBAMFarflt;MBAMFarflt;C:\Windows\System32\drivers\farflt.sys [2017-7-26 101784]
R3 MBAMProtection;MBAMProtection;C:\Windows\System32\drivers\mbam.sys [2016-11-24 45472]
R3 MBAMSwissArmy;MBAMSwissArmy;C:\Windows\System32\drivers\MBAMSwissArmy.sys [2016-11-24 253856]
R3 MBAMWebProtection;MBAMWebProtection;C:\Windows\System32\drivers\mwac.sys [2017-7-26 84256]
R3 nvvad_WaveExtensible;NVIDIA Virtual Audio Device (Wave Extensible) (WDM);C:\Windows\System32\drivers\nvvad64v.sys [2017-5-22 48248]
R3 nvvhci;NVVHCI Enumerator Service;C:\Windows\System32\drivers\nvvhci.sys [2017-5-22 57976]
S2 clr_optimization_v4.0.30319_32;Microsoft .NET Framework NGEN v4.0.30319_X86;C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe [2017-3-26 105096]
S2 clr_optimization_v4.0.30319_64;Microsoft .NET Framework NGEN v4.0.30319_X64;C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe [2017-3-26 125064]
S2 Origin Web Helper Service;Origin Web Helper Service;C:\Program Files (x86)\Origin\OriginWebHelperService.exe [2017-3-22 3148184]
S3 androidusb;ADB Interface Driver;C:\Windows\System32\drivers\androidusb.sys [2010-10-18 38424]
S3 aswHwid;aswHwid;C:\Windows\System32\drivers\aswHwid.sys [2016-5-20 46984]
S3 dmvsc;dmvsc;C:\Windows\System32\drivers\dmvsc.sys [2011-4-12 71168]
S3 FlexNet Licensing Service 64;FlexNet Licensing Service 64;C:\Program Files\Common Files\Macrovision Shared\FlexNet Publisher\FNPLicensingService64.exe [2017-3-21 1595400]
S3 Futuremark SystemInfo Service;Futuremark SystemInfo Service;C:\Program Files (x86)\Futuremark\SystemInfo\FMSISvc.exe [2016-5-24 342456]
S3 GalaxyClientService;GalaxyClientService;C:\Program Files (x86)\GOG Galaxy\GalaxyClientService.exe [2017-3-24 512576]
S3 GalaxyCommunication;GalaxyCommunication;C:\ProgramData\GOG.com\Galaxy\redists\GalaxyCommunication.exe [2017-3-24 7942208]
S3 IEEtwCollectorService;Internet Explorer ETW Collector Service;C:\Windows\System32\ieetwcollector.exe [2017-8-1 116224]
S3 Intel(R) Capability Licensing Service TCP IP Interface;Intel(R) Capability Licensing Service TCP IP Interface;C:\Program Files\Intel\iCLS Client\SocketHeciServer.exe [2013-5-11 822232]
S3 mt7612US;Xbox Wireless Adapter for Windows;C:\Windows\System32\drivers\mt7612US.sys [2015-12-8 376200]
S3 NvContainerNetworkService;NVIDIA NetworkService Container;C:\Program Files\NVIDIA Corporation\NvContainer\nvcontainer.exe [2016-9-7 495224]
S3 NvStreamKms;NVIDIA KMS;C:\Program Files\NVIDIA Corporation\NvStreamSrv\NvStreamKms.sys [2017-5-22 30328]
S3 Origin Client Service;Origin Client Service;C:\Program Files (x86)\Origin\OriginClientService.exe [2017-3-22 2168208]
S3 ose64;Office 64 Source Engine;C:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE [2017-7-18 260288]
S3 RdpVideoMiniport;Remote Desktop Video Miniport Driver;C:\Windows\System32\drivers\rdpvideominiport.sys [2016-9-13 19456]
S3 StorSvc;Storage Service;C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted [2009-7-13 27136]
S3 TsUsbFlt;TsUsbFlt;C:\Windows\System32\drivers\TsUsbFlt.sys [2016-9-13 56832]
S3 TsUsbGD;Remote Desktop Generic USB Device;C:\Windows\System32\drivers\TsUsbGD.sys [2016-9-13 30208]
S3 WatAdminSvc;Windows Activation Technologies Service;C:\Windows\System32\Wat\WatAdminSvc.exe [2016-5-22 1255736]
S3 xb1usb;Xbox Peripherals (legacy) Driver;C:\Windows\System32\drivers\xb1usb.sys [2016-2-21 42760]
S3 xboxgip;Xbox Game Input Protocol Driver;C:\Windows\System32\drivers\xboxgip.sys [2015-12-8 243080]
.
=============== File Associations ===============
.
ShellExec: pycharm.exe: open=C:\Program Files\JetBrains\PyCharm Community Edition 2017.1.5\bin\pycharm64.exe "%1"
.
=============== Created Last 30 ================
.
2017-08-01 15:03:53 -------- d-----w- C:\ProgramData\SWCUTemp
2017-08-01 13:26:17 -------- d-----w- C:\ProgramData\HitmanPro
2017-07-27 04:50:05 188352 ----a-w- C:\Windows\System32\drivers\MBAMChameleon.sys
2017-07-27 04:49:51 84256 ----a-w- C:\Windows\System32\drivers\mwac.sys
2017-07-27 04:49:51 101784 ----a-w- C:\Windows\System32\drivers\farflt.sys
2017-07-27 04:49:39 77376 ----a-w- C:\Windows\System32\drivers\mbae64.sys
2017-07-27 04:49:36 -------- d-----w- C:\Program Files\Malwarebytes
2017-07-27 02:25:56 -------- d-----w- C:\Users\April\VirtualBox VMs
2017-07-27 02:24:26 -------- d-----w- C:\Program Files\Oracle
2017-07-26 22:42:24 -------- d-----w- C:\Users\April\.VirtualBox
2017-07-26 21:09:40 -------- d-----w- C:\Users\April\.PyCharmCE2017.2
2017-07-18 07:47:24 572096 ----a-w- C:\Program Files\Common Files\Microsoft Shared\OFFICE16\LICLUA.EXE
2017-07-18 07:46:52 29888 ----a-w- C:\Program Files\Common Files\Microsoft Shared\OFFICE16\Office Setup Controller\pkeyconfig.companion.dll
2017-07-18 07:33:04 260288 ----a-w- C:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE
2017-07-18 02:06:46 205952 ----a-w- C:\Windows\System32\drivers\VBoxNetLwf.sys
2017-07-18 02:06:46 131144 ----a-w- C:\Windows\System32\drivers\VBoxNetAdp6.sys
.
==================== Find3M ====================
.
2017-08-01 15:02:24 45472 ----a-w- C:\Windows\System32\drivers\mbam.sys
2017-08-01 15:02:24 253856 ----a-w- C:\Windows\System32\drivers\MBAMSwissArmy.sys
2017-07-26 21:14:27 146696 ----a-w- C:\Windows\System32\drivers\aswmonflt.sys
2017-07-26 21:13:59 57728 ----a-w- C:\Windows\System32\drivers\aswbuniva.sys
2017-07-26 21:13:59 343288 ----a-w- C:\Windows\System32\drivers\aswbloga.sys
2017-07-26 21:13:59 320008 ----a-w- C:\Windows\System32\drivers\aswbidsdrivera.sys
2017-07-26 21:13:59 198976 ----a-w- C:\Windows\System32\drivers\aswbidsha.sys
2017-07-18 02:06:46 965984 ----a-w- C:\Windows\System32\drivers\VBoxDrv.sys
2017-07-18 02:06:46 149816 ----a-w- C:\Windows\System32\drivers\VBoxUSBMon.sys
2017-07-09 14:06:01 361336 ----a-w- C:\Windows\System32\drivers\aswVmm.sys
2017-07-09 14:05:48 84392 ----a-w- C:\Windows\System32\drivers\aswRvrt.sys
2017-07-09 14:05:48 46984 ----a-w- C:\Windows\System32\drivers\aswHwid.sys
2017-07-09 14:05:48 198768 ----a-w- C:\Windows\System32\drivers\aswStm.sys
2017-07-09 14:05:48 110352 ----a-w- C:\Windows\System32\drivers\aswRdr2.sys
2017-07-09 14:05:42 1015848 ----a-w- C:\Windows\System32\drivers\aswSnx.sys
2017-06-30 02:57:24 2319872 ----a-w- C:\Windows\System32\tquery.dll
2017-06-30 02:57:21 2058240 ----a-w- C:\Windows\System32\Query.dll
2017-06-30 02:57:17 99840 ----a-w- C:\Windows\System32\mssprxy.dll
2017-06-30 02:57:17 778240 ----a-w- C:\Windows\System32\mssvp.dll
2017-06-30 02:57:17 75264 ----a-w- C:\Windows\System32\msscntrs.dll
2017-06-30 02:57:17 491520 ----a-w- C:\Windows\System32\mssph.dll
2017-06-30 02:57:17 288256 ----a-w- C:\Windows\System32\mssphtb.dll
2017-06-30 02:57:17 2222080 ----a-w- C:\Windows\System32\mssrch.dll
2017-06-30 02:57:17 14336 ----a-w- C:\Windows\System32\msshooks.dll
2017-06-30 02:57:17 115200 ----a-w- C:\Windows\System32\mssitlb.dll
2017-06-30 02:40:25 591872 ----a-w- C:\Windows\System32\SearchIndexer.exe
2017-06-30 02:40:18 249856 ----a-w- C:\Windows\System32\SearchProtocolHost.exe
2017-06-30 02:39:38 113664 ----a-w- C:\Windows\System32\SearchFilterHost.exe
2017-06-30 02:39:01 1549312 ----a-w- C:\Windows\SysWow64\tquery.dll
2017-06-30 02:38:58 1363968 ----a-w- C:\Windows\SysWow64\Query.dll
2017-06-30 02:38:54 666624 ----a-w- C:\Windows\SysWow64\mssvp.dll
2017-06-30 02:38:54 59392 ----a-w- C:\Windows\SysWow64\msscntrs.dll
2017-06-30 02:38:54 34816 ----a-w- C:\Windows\SysWow64\mssprxy.dll
2017-06-30 02:38:54 337408 ----a-w- C:\Windows\SysWow64\mssph.dll
2017-06-30 02:38:54 197120 ----a-w- C:\Windows\SysWow64\mssphtb.dll
2017-06-30 02:38:54 1400320 ----a-w- C:\Windows\SysWow64\mssrch.dll
2017-06-30 02:38:54 104448 ----a-w- C:\Windows\SysWow64\mssitlb.dll
2017-06-30 02:27:15 427520 ----a-w- C:\Windows\SysWow64\SearchIndexer.exe
2017-06-30 02:27:04 164352 ----a-w- C:\Windows\SysWow64\SearchProtocolHost.exe
2017-06-30 02:26:41 86528 ----a-w- C:\Windows\SysWow64\SearchFilterHost.exe
2017-06-30 02:26:20 9728 ----a-w- C:\Windows\SysWow64\msshooks.dll
2017-06-29 06:19:09 2724864 ----a-w- C:\Windows\System32\mshtml.tlb
2017-06-29 06:18:58 4096 ----a-w- C:\Windows\System32\ieetwcollectorres.dll
2017-06-29 06:04:12 66560 ----a-w- C:\Windows\System32\iesetup.dll
2017-06-29 06:03:28 48640 ----a-w- C:\Windows\System32\ieetwproxystub.dll
2017-06-29 06:03:20 417792 ----a-w- C:\Windows\System32\html.iec
2017-06-29 06:02:52 88064 ----a-w- C:\Windows\System32\MshtmlDac.dll
2017-06-29 06:02:46 576512 ----a-w- C:\Windows\System32\vbscript.dll
2017-06-29 05:50:26 144384 ----a-w- C:\Windows\System32\ieUnatt.exe
2017-06-29 05:50:26 116224 ----a-w- C:\Windows\System32\ieetwcollector.exe
2017-06-29 05:50:10 814080 ----a-w- C:\Windows\System32\jscript9diag.dll
2017-06-29 05:44:36 5975552 ----a-w- C:\Windows\System32\jscript9.dll
2017-06-29 05:43:07 968704 ----a-w- C:\Windows\System32\MsSpellCheckingFacility.exe
2017-06-29 05:35:46 2724864 ----a-w- C:\Windows\SysWow64\mshtml.tlb
2017-06-29 05:31:50 77824 ----a-w- C:\Windows\System32\JavaScriptCollectionAgent.dll
2017-06-29 05:31:23 87552 ----a-w- C:\Windows\System32\tdc.ocx
2017-06-29 05:23:40 62464 ----a-w- C:\Windows\SysWow64\iesetup.dll
2017-06-29 05:23:38 499200 ----a-w- C:\Windows\SysWow64\vbscript.dll
2017-06-29 05:23:03 47616 ----a-w- C:\Windows\SysWow64\ieetwproxystub.dll
2017-06-29 05:22:54 341504 ----a-w- C:\Windows\SysWow64\html.iec
2017-06-29 05:22:01 64000 ----a-w- C:\Windows\SysWow64\MshtmlDac.dll
2017-06-29 05:13:38 115712 ----a-w- C:\Windows\SysWow64\ieUnatt.exe
2017-06-29 05:13:19 620032 ----a-w- C:\Windows\SysWow64\jscript9diag.dll
2017-06-29 05:08:32 1359360 ----a-w- C:\Windows\System32\mshtmlmedia.dll
2017-06-29 05:07:16 2132992 ----a-w- C:\Windows\System32\inetcpl.cpl
2017-06-29 05:01:01 60416 ----a-w- C:\Windows\SysWow64\JavaScriptCollectionAgent.dll
2017-06-29 05:00:32 73216 ----a-w- C:\Windows\SysWow64\tdc.ocx
2017-06-29 04:53:46 3240960 ----a-w- C:\Windows\System32\wininet.dll
2017-06-29 04:52:52 4549632 ----a-w- C:\Windows\SysWow64\jscript9.dll
2017-06-29 04:46:33 2057216 ----a-w- C:\Windows\SysWow64\inetcpl.cpl
2017-06-29 04:46:20 1155072 ----a-w- C:\Windows\SysWow64\mshtmlmedia.dll
2017-06-29 04:28:59 2767872 ----a-w- C:\Windows\SysWow64\wininet.dll
2017-06-22 14:58:48 3223040 ----a-w- C:\Windows\System32\win32k.sys
2017-06-15 20:23:49 753664 ----a-w- C:\Windows\System32\drivers\http.sys
2017-06-12 22:54:32 95464 ----a-w- C:\Windows\System32\drivers\ksecdd.sys
2017-06-12 22:54:32 154856 ----a-w- C:\Windows\System32\drivers\ksecpkg.sys
2017-06-12 22:54:31 370920 ----a-w- C:\Windows\System32\clfs.sys
2017-06-12 22:29:03 96768 ----a-w- C:\Windows\SysWow64\sspicli.dll
2017-06-12 22:29:03 82944 ----a-w- C:\Windows\SysWow64\bcrypt.dll
2017-06-12 22:29:03 666112 ----a-w- C:\Windows\SysWow64\rpcrt4.dll
2017-06-12 22:29:03 444928 ----a-w- C:\Windows\SysWow64\wvc.dll
2017-06-12 22:29:02 172032 ----a-w- C:\Windows\SysWow64\wdigest.dll
2017-06-12 22:29:02 1227264 ----a-w- C:\Windows\SysWow64\wdc.dll
2017-06-12 22:29:01 65536 ----a-w- C:\Windows\SysWow64\TSpkg.dll
2017-06-12 22:29:01 390144 ----a-w- C:\Windows\SysWow64\sysmon.ocx
2017-06-12 22:28:59 22016 ----a-w- C:\Windows\SysWow64\secur32.dll
2017-06-12 22:28:58 254464 ----a-w- C:\Windows\SysWow64\schannel.dll
2017-06-12 22:28:58 141312 ----a-w- C:\Windows\SysWow64\rpchttp.dll
2017-06-12 22:28:57 47104 ----a-w- C:\Windows\SysWow64\pdhui.dll
2017-06-12 22:28:54 223232 ----a-w- C:\Windows\SysWow64\ncrypt.dll
2017-06-12 22:28:53 60416 ----a-w- C:\Windows\SysWow64\msobjs.dll
2017-06-12 22:28:53 261120 ----a-w- C:\Windows\SysWow64\msv1_0.dll
2017-06-12 22:28:52 146432 ----a-w- C:\Windows\SysWow64\msaudite.dll
2017-06-12 22:28:51 554496 ----a-w- C:\Windows\SysWow64\kerberos.dll
2017-06-12 22:28:48 17408 ----a-w- C:\Windows\SysWow64\credssp.dll
2017-06-12 22:28:47 342528 ----a-w- C:\Windows\SysWow64\certcli.dll
2017-06-12 22:28:46 690688 ----a-w- C:\Windows\SysWow64\adtschema.dll
2017-06-12 22:19:20 64000 ----a-w- C:\Windows\System32\auditpol.exe
2017-06-12 22:14:07 379392 ----a-w- C:\Windows\System32\msinfo32.exe
2017-06-12 22:14:06 172544 ----a-w- C:\Windows\System32\perfmon.exe
.
============= FINISH: 10:05:23.11 ===============

Attached Files

attach.txt (6.9 KB)

on typing (into google address bar) stanislauslibrary.org, instead of getting the library, the page goes to ww38.stanislauslibrary.org, which turns into a weird search and a lot of stuff having nothing to do with search...i downloaded eset online scanner, it found no infected files...would malwarebytes do any better? other than that, if this is a rootkit problem, i really need help...

about the computer...
HP Compaq
OS edition Windows 10 Home
Version 1703
OS build 15063.483
Product build 00326-00758-63795 AAOEM
Installed RAM 8GB (7.87GB usable)
System type 64 bit OS, x64-based processor

all help gratefully appreciated...

Hello,

My parents don't know how to take care of a computer and probably click on everything they see. I imagine there's now a ton of spyware and malware on the computer (probably about 5 years worth) and I highly doubt spybot and CCleaner are going to fix it. I think it requires your help. I do not have access to a Windows Boot CD, but it's Windows 10, so I could probably burn a copy of the CD to use if needed.

DDS:

DDS (Ver_2012-11-20.01) - NTFS_AMD64
Internet Explorer: 11.0.15063.0
Run by Robert at 20:49:32 on 2017-08-11
Microsoft Windows 10 Home 10.0.15063.0.1252.1.1033.18.3839.1642 [GMT -4:00]
.
AV: Windows Defender *Disabled/Updated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
AV: Norton 360 Premier *Enabled/Updated* {30744133-1E94-7B35-F4A3-82A5AEF1CBAA}
SP: Windows Defender *Disabled/Updated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
SP: Norton 360 Premier *Enabled/Updated* {8B15A0D7-38AE-74BB-CE13-B9D7D5768117}
FW: Norton 360 Premier *Enabled* {084FC016-54FB-7A6D-DFFC-2B9050228CD1}
.
============== Running Processes ===============
.
c:\windows\system32\svchost.exe -k dcomlaunch -s PlugPlay
C:\WINDOWS\system32\fontdrvhost.exe
C:\WINDOWS\system32\svchost.exe -k DcomLaunch
C:\WINDOWS\system32\fontdrvhost.exe
c:\windows\system32\svchost.exe -k rpcss
c:\windows\system32\svchost.exe -k dcomlaunch -s LSM
C:\WINDOWS\system32\dwm.exe
c:\windows\system32\svchost.exe -k localsystemnetworkrestricted -s NcbService
c:\windows\system32\svchost.exe -k localsystemnetworkrestricted -s hidserv
c:\windows\system32\svchost.exe -k localsystemnetworkrestricted -s TabletInputService
c:\windows\system32\svchost.exe -k localservicenetworkrestricted -s TimeBrokerSvc
c:\windows\system32\svchost.exe -k localservicenetworkrestricted -s EventLog
c:\windows\system32\svchost.exe -k localservice -s nsi
C:\WINDOWS\system32\svchost.exe -k LocalSystemNetworkRestricted
C:\WINDOWS\system32\atiesrxx.exe
c:\windows\system32\svchost.exe -k netsvcs -s ProfSvc
c:\windows\system32\svchost.exe -k netsvcs -s Themes
c:\windows\system32\svchost.exe -k localservice -s EventSystem
c:\windows\system32\svchost.exe -k netsvcs -s Schedule
c:\windows\system32\svchost.exe -k netsvcs -s SENS
c:\windows\system32\svchost.exe -k localsystemnetworkrestricted -s AudioEndpointBuilder
c:\windows\system32\svchost.exe -k localservice -s FontCache
C:\WINDOWS\System32\svchost.exe -k LocalServiceNetworkRestricted
C:\WINDOWS\System32\svchost.exe -k LocalServiceNetworkRestricted
c:\windows\system32\svchost.exe -k appmodel -s StateRepository
c:\windows\system32\svchost.exe -k localservicenetworkrestricted -s Dhcp
C:\WINDOWS\system32\svchost.exe -k LocalServiceNetworkRestricted
c:\windows\system32\svchost.exe -k networkservice -s Dnscache
c:\windows\system32\svchost.exe -k netsvcs -s UserManager
c:\windows\system32\svchost.exe -k networkservice -s NlaSvc
C:\Windows\System32\WUDFHost.exe
c:\windows\system32\svchost.exe -k localservice -s netprofm
C:\WINDOWS\system32\svchost.exe -k LocalSystemNetworkRestricted
c:\windows\system32\svchost.exe -k netsvcs -s ShellHWDetection
C:\WINDOWS\system32\svchost.exe -k LocalService
c:\windows\system32\svchost.exe -k localserviceandnoimpersonation -s FDResPub
C:\WINDOWS\System32\spoolsv.exe
c:\windows\system32\svchost.exe -k localservice -s WinHttpAutoProxySvc
c:\windows\system32\svchost.exe -k netsvcs -s Winmgmt
c:\windows\system32\svchost.exe -k localservicenonetwork
c:\windows\system32\svchost.exe -k localservicenetworkrestricted -s HomeGroupProvider
c:\windows\system32\svchost.exe -k networkservice -s LanmanWorkstation
c:\windows\system32\svchost.exe -k netsvcs -s IKEEXT
c:\windows\system32\svchost.exe -k networkservicenetworkrestricted -s PolicyAgent
c:\windows\system32\svchost.exe -k apphost -s AppHostSvc
C:\Program Files\Realtek\Audio\HDA\AERTSr64.EXE
c:\windows\system32\svchost.exe -k networkservice -s CryptSvc
c:\windows\system32\svchost.exe -k localsystemnetworkrestricted -s DeviceAssociationService
C:\WINDOWS\System32\svchost.exe -k utcsvc
c:\windows\system32\svchost.exe -k localservicenonetwork -s DPS
c:\windows\system32\svchost.exe -k netsvcs -s iphlpsvc
c:\windows\system32\svchost.exe -k iissvcs
C:\Program Files\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe
c:\windows\system32\svchost.exe -k localsystemnetworkrestricted -s PcaSvc
C:\Program Files\Bonjour\mDNSResponder.exe
C:\Program Files (x86)\Microsoft Application Virtualization Client\sftvsa.exe
c:\windows\system32\svchost.exe -k netsvcs -s WpnService
c:\windows\system32\svchost.exe -k netsvcs
c:\windows\system32\svchost.exe -k localsystemnetworkrestricted -s TrkWks
C:\WINDOWS\system32\svchost.exe -k imgsvc
c:\windows\system32\svchost.exe -k localsystemnetworkrestricted -s SysMain
C:\Program Files (x86)\Norton 360\Engine\22.10.0.85\N360.exe
C:\Program Files\Microsoft Office 15\ClientX64\OfficeClickToRun.exe
c:\windows\system32\svchost.exe -k netsvcs -s LanmanServer
c:\windows\system32\svchost.exe -k localservice -s WdiServiceHost
C:\WINDOWS\system32\dashost.exe
C:\WINDOWS\system32\mqsvc.exe
c:\windows\system32\svchost.exe -k localserviceandnoimpersonation -s SSDPSRV
c:\windows\system32\svchost.exe -k appmodel -s tiledatamodelsvc
c:\windows\system32\svchost.exe -k netsvcs -s Browser
c:\windows\microsoft.net\framework64\v4.0.30319\smsvchost.exe
c:\windows\microsoft.net\framework64\v4.0.30319\smsvchost.exe
C:\Program Files (x86)\Microsoft Application Virtualization Client\sftlist.exe
c:\windows\system32\svchost.exe -k localservice -s CDPSvc
C:\Program Files (x86)\Common Files\Microsoft Shared\Virtualization Handler\CVHSVC.EXE
c:\windows\system32\svchost.exe -k netsvcs -s DoSvc
C:\Program Files (x86)\Hewlett-Packard\HP Support Solutions\HPSupportSolutionsFrameworkService.exe
c:\windows\system32\svchost.exe -k localsystemnetworkrestricted -s StorSvc
C:\Program Files (x86)\Common Files\Intuit\Update Service v4\IntuitUpdateService.exe
c:\windows\system32\svchost.exe -k localservicenetworkrestricted -s wscsvc
C:\WINDOWS\system32\atieclxx.exe
c:\windows\system32\svchost.exe -k netsvcs -s lfsvc
c:\windows\system32\sihost.exe
c:\windows\system32\svchost.exe -k unistacksvcgroup -s CDPUserSvc
C:\Program Files (x86)\Norton 360\Engine\22.10.0.85\N360.exe
C:\WINDOWS\Explorer.EXE
c:\windows\system32\svchost.exe -k unistacksvcgroup -s WpnUserService
c:\windows\system32\svchost.exe -k netsvcs -s TokenBroker
c:\windows\system32\taskhostw.exe
C:\Windows\SystemApps\ShellExperienceHost_cw5n1h2txyewy\ShellExperienceHost.exe
C:\Windows\System32\RuntimeBroker.exe
c:\windows\system32\svchost.exe -k localservice -s LicenseManager
C:\Program Files\WindowsApps\Microsoft.SkypeApp_11.19.820.0_x64__kzf8qxf38zg5c\SkypeHost.exe
C:\Program Files\Common Files\microsoft shared\ink\TabTip.exe
C:\Program Files (x86)\Common Files\Microsoft Shared\Ink\TabTip32.exe
C:\Program Files\Windows Defender\MSASCuiL.exe
C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe
C:\Program Files\iTunes\iTunesHelper.exe
C:\Users\Robert\AppData\Local\Microsoft\OneDrive\OneDrive.exe
C:\Program Files (x86)\Citrix\ICA Client\SelfServicePlugin\SelfServicePlugin.exe
C:\Program Files\Microsoft Office 15\root\office15\ONENOTEM.EXE
c:\windows\system32\svchost.exe -k netsvcs -s Appinfo
C:\Program Files\iPod\bin\iPodService.exe
C:\Program Files (x86)\Citrix\ICA Client\Receiver\Receiver.exe
C:\Program Files (x86)\Citrix\ICA Client\concentr.exe
C:\Program Files (x86)\Citrix\ICA Client\redirector.exe
C:\Program Files (x86)\Citrix\ICA Client\wfcrun32.exe
c:\windows\system32\taskhostw.exe
C:\Windows\SystemApps\Microsoft.Windows.Cortana_cw5n1h2txyewy\SearchUI.exe
c:\windows\system32\svchost.exe -k unistacksvcgroup
C:\WINDOWS\system32\SearchIndexer.exe
C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe
C:\Program Files (x86)\Citrix\ICA Client\AuthManager\AuthManSvr.exe
C:\WINDOWS\system32\ApplicationFrameHost.exe
C:\Program Files\WindowsApps\Microsoft.WindowsStore_11706.1001.26.0_x64__8wekyb3d8bbwe\WinStore.App.exe
C:\WINDOWS\system32\svchost.exe -k netsvcs -s wlidsvc
c:\windows\system32\svchost.exe -k localsystemnetworkrestricted -s DsSvc
C:\WINDOWS\System32\svchost.exe -k LocalServiceNoNetwork -s NcdAutoSetup
C:\WINDOWS\System32\svchost.exe -k LocalServiceNetworkRestricted -s lmhosts
C:\WINDOWS\System32\svchost.exe -k LocalSystemNetworkRestricted -s WdiSystemHost
C:\Windows\System32\smartscreen.exe
C:\Program Files (x86)\Mozilla Firefox\firefox.exe
C:\WINDOWS\system32\AUDIODG.EXE
C:\Windows\System32\SystemSettingsBroker.exe
c:\windows\system32\svchost.exe -k netsvcs -s BITS
C:\WINDOWS\system32\SearchProtocolHost.exe
C:\WINDOWS\system32\SearchFilterHost.exe
C:\WINDOWS\system32\wbem\wmiprvse.exe
C:\WINDOWS\System32\cscript.exe
.
============== Pseudo HJT Report ===============
.
uWindow Title = Windows Internet Explorer provided by Yahoo!
uDefault_Page_URL = hxxp://www.yahoo.com/?fr=fp-yie9
uURLSearchHooks: {81017EA9-9AA8-4A6A-9734-7AF40E7D593F} - <orphaned>
BHO: {02478D38-C3F9-4efb-9B51-7695ECA05670} - <orphaned>
BHO: Skype for Business Browser Helper: {31D09BA0-12F5-4CCE-BE8A-2923E76605DA} - C:\Program Files\Microsoft Office 15\root\office15\OCHelper.dll
BHO: Norton Identity Safety: {602ADB0E-4AFF-4217-8AA1-95DAC4DFA408} - C:\Program Files (x86)\Norton 360\Engine32\22.10.0.85\coIEPlg.dll
BHO: Norton Vulnerability Protection: {6D53EC84-6AAE-4787-AEEE-F4628F01010C} -
BHO: {9D425283-D487-4337-BAB6-AB8354A81457} - <orphaned>
BHO: Microsoft SkyDrive Pro Browser Helper: {D0498E0A-45B7-42AE-A9AA-ABA463DBD3BF} - C:\Program Files\Microsoft Office 15\root\office15\GROOVEEX.DLL
BHO: HP Network Check Helper: {E76FD755-C1BA-4DCB-9F13-99BD91223ADE} -
BHO: SingleInstance Class: {FDAD4DA1-61A2-4FD8-9C17-86F7AC245081} - C:\Program Files (x86)\Yahoo!\Companion\Installs\cpn0\YTSingleInstance.dll
TB: Norton Toolbar: {7FEBEFE3-6B19-4349-98D2-FFB09D4B49CA} - C:\Program Files (x86)\Norton 360\Engine32\22.10.0.85\coIEPlg.dll
TB: Norton Toolbar: {7FEBEFE3-6B19-4349-98D2-FFB09D4B49CA} - C:\Program Files (x86)\Norton 360\Engine32\22.10.0.85\coIEPlg.dll
uRun: [OneDrive] "C:\Users\Robert\AppData\Local\Microsoft\OneDrive\OneDrive.exe" /background
uRun: [EPSON NX420 Series] C:\WINDOWS\System32\spool\DRIVERS\x64\3\E_IATIGCA.EXE /FU "C:\WINDOWS\TEMP\E_SFD4B.tmp" /EF "HKCU"
uRun: [Steam] "C:\Program Files (x86)\Steam\steam.exe" -silent
mRun: [Adobe ARM] "C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe"
mRun: [ConnectionCenter] "C:\Program Files (x86)\Citrix\ICA Client\concentr.exe" /startup
mRun: [Redirector] "C:\Program Files (x86)\Citrix\ICA Client\redirector.exe" /startup
dRun: [EPSON NX420 Series] C:\WINDOWS\System32\spool\DRIVERS\x64\3\E_IATIGCA.EXE /FU "C:\WINDOWS\TEMP\E_S86D.tmp" /EF "HKCU"
dRunOnce: [Application Restart #1] C:\Program Files\Common Files\microsoft shared\ink\TabTip.exe /Crashed
StartupFolder: C:\Users\Robert\AppData\Roaming\MICROS~1\Windows\STARTM~1\Programs\Startup\CITRIX~1.LNK - C:\Program Files (x86)\Citrix\ICA Client\SelfServicePlugin\SelfServicePlugin.exe
StartupFolder: C:\Users\Robert\AppData\Roaming\MICROS~1\Windows\STARTM~1\Programs\Startup\SENDTO~1.LNK - C:\Program Files\Microsoft Office 15\root\office15\ONENOTEM.EXE
mPolicies-System: DSCAutomationHostEnabled = dword:2
IE: E&xport to Microsoft Excel - C:\Program Files\Microsoft Office 15\Root\Office15\EXCEL.EXE/3000
IE: Se&nd to OneNote - C:\Program Files\Microsoft Office 15\Root\Office15\ONBttnIE.dll/105
IE: {25510184-5A38-4A99-B273-DCA8EEF6CD08} - C:\Program Files (x86)\Hewlett-Packard\HP Support Framework\Resources\HPNetworkCheck\NCLauncherFromIE.exe
IE: {2670000A-7350-4f3c-8081-5663EE0C6C49} - {48E73304-E1D6-4330-914C-F5F514E3486C} - C:\Program Files\Microsoft Office 15\root\office15\ONBttnIE.dll
IE: {31D09BA0-12F5-4CCE-BE8A-2923E76605DA} - {31D09BA0-12F5-4CCE-BE8A-2923E76605DA} - C:\Program Files\Microsoft Office 15\root\office15\OCHelper.dll
IE: {789FE86F-6FC4-46A1-9849-EDE0DB0C95CA} - {FFFDC614-B694-4AE6-AB38-5D6374584B52} - C:\Program Files\Microsoft Office 15\root\office15\ONBttnIELinkedNotes.dll
DPF: {02BCC737-B171-4746-94C9-0D8A0B2C0089} - hxxp://office.microsoft.com/_layouts/ClientBin/ieawsdc32.cab
DPF: {E2883E8F-472F-4FB0-9522-AC9BF37916A7} - hxxp://platformdl.adobe.com/NOS/getPlusPlus/1.6/gp.cab
DPF: {F27237D7-93C8-44C2-AC6E-D6057B9A918F} - hxxps://jpass4.bnymellon.com/dana-cached/sc/JuniperSetupClient.cab
TCP: NameServer = 208.59.247.45 208.59.247.46 192.168.1.1
TCP: Interfaces\{424ee7c6-9434-4c0f-b75a-9e0e166af1b3} : DHCPNameServer = 208.59.247.45 208.59.247.46 192.168.1.1
TCP: Interfaces\{f4bc1c8b-1875-4436-a161-3f915667e927} : DHCPNameServer = 75.75.75.75 75.75.76.76
Filter: application/x-ica - {CFB6322E-CC85-4d1b-82C7-893888A236BC} - C:\Program Files (x86)\Citrix\ICA Client\IcaMimeFilter.dll
Filter: application/x-ica; charset=euc-jp - {CFB6322E-CC85-4d1b-82C7-893888A236BC} - C:\Program Files (x86)\Citrix\ICA Client\IcaMimeFilter.dll
Filter: application/x-ica; charset=ISO-8859-1 - {CFB6322E-CC85-4d1b-82C7-893888A236BC} - C:\Program Files (x86)\Citrix\ICA Client\IcaMimeFilter.dll
Filter: application/x-ica; charset=MS936 - {CFB6322E-CC85-4d1b-82C7-893888A236BC} - C:\Program Files (x86)\Citrix\ICA Client\IcaMimeFilter.dll
Filter: application/x-ica; charset=MS949 - {CFB6322E-CC85-4d1b-82C7-893888A236BC} - C:\Program Files (x86)\Citrix\ICA Client\IcaMimeFilter.dll
Filter: application/x-ica; charset=MS950 - {CFB6322E-CC85-4d1b-82C7-893888A236BC} - C:\Program Files (x86)\Citrix\ICA Client\IcaMimeFilter.dll
Filter: application/x-ica; charset=UTF-8 - {CFB6322E-CC85-4d1b-82C7-893888A236BC} - C:\Program Files (x86)\Citrix\ICA Client\IcaMimeFilter.dll
Filter: application/x-ica; charset=UTF8 - {CFB6322E-CC85-4d1b-82C7-893888A236BC} - C:\Program Files (x86)\Citrix\ICA Client\IcaMimeFilter.dll
Filter: application/x-ica;charset=euc-jp - {CFB6322E-CC85-4d1b-82C7-893888A236BC} - C:\Program Files (x86)\Citrix\ICA Client\IcaMimeFilter.dll
Filter: application/x-ica;charset=ISO-8859-1 - {CFB6322E-CC85-4d1b-82C7-893888A236BC} - C:\Program Files (x86)\Citrix\ICA Client\IcaMimeFilter.dll
Filter: application/x-ica;charset=MS936 - {CFB6322E-CC85-4d1b-82C7-893888A236BC} - C:\Program Files (x86)\Citrix\ICA Client\IcaMimeFilter.dll
Filter: application/x-ica;charset=MS949 - {CFB6322E-CC85-4d1b-82C7-893888A236BC} - C:\Program Files (x86)\Citrix\ICA Client\IcaMimeFilter.dll
Filter: application/x-ica;charset=MS950 - {CFB6322E-CC85-4d1b-82C7-893888A236BC} - C:\Program Files (x86)\Citrix\ICA Client\IcaMimeFilter.dll
Filter: application/x-ica;charset=UTF-8 - {CFB6322E-CC85-4d1b-82C7-893888A236BC} - C:\Program Files (x86)\Citrix\ICA Client\IcaMimeFilter.dll
Filter: application/x-ica;charset=UTF8 - {CFB6322E-CC85-4d1b-82C7-893888A236BC} - C:\Program Files (x86)\Citrix\ICA Client\IcaMimeFilter.dll
Filter: ica - {CFB6322E-CC85-4d1b-82C7-893888A236BC} - C:\Program Files (x86)\Citrix\ICA Client\IcaMimeFilter.dll
Handler: osf - {D924BDC6-C83A-4BD5-90D0-095128A113D1} - C:\Program Files\Microsoft Office 15\root\office15\msosb.dll
Handler: tbauth - {14654CA6-5711-491D-B89A-58E571679951} - C:\Windows\SysWOW64\tbauth.dll
Handler: windows.tbauth - {14654CA6-5711-491D-B89A-58E571679951} - C:\Windows\SysWOW64\tbauth.dll
SSODL: WebCheck - <orphaned>
CLSID: {603D3801-BD81-11d0-A3A5-00C04FD706EC} - C:\WINDOWS\System32\windows.storage.dll
x64-BHO: Skype for Business Browser Helper: {31D09BA0-12F5-4CCE-BE8A-2923E76605DA} - C:\Program Files\Microsoft Office 15\root\vfs\ProgramFilesX64\Microsoft Office\Office15\OCHelper.dll
x64-BHO: Norton Identity Safety: {602ADB0E-4AFF-4217-8AA1-95DAC4DFA408} - C:\Program Files (x86)\Norton 360\Engine\22.10.0.85\coIEPlg.dll
x64-BHO: Easy Photo Print: {9421DD08-935F-4701-A9CA-22DF90AC4EA6} - C:\Program Files (x86)\Epson Software\Easy Photo Print\EPTBL.dll
x64-BHO: Office Document Cache Handler: {B4F3A835-0E21-4959-BA22-42B3008E02FF} - C:\Program Files\Microsoft Office 15\root\vfs\ProgramFilesX64\Microsoft Office\Office15\URLREDIR.DLL
x64-BHO: Microsoft SkyDrive Pro Browser Helper: {D0498E0A-45B7-42AE-A9AA-ABA463DBD3BF} - C:\Program Files\Microsoft Office 15\root\vfs\ProgramFilesX64\Microsoft Office\Office15\GROOVEEX.DLL
x64-BHO: HP Network Check Helper: {E76FD755-C1BA-4DCB-9F13-99BD91223ADE} -
x64-TB: Easy Photo Print: {9421DD08-935F-4701-A9CA-22DF90AC4EA6} - C:\Program Files (x86)\Epson Software\Easy Photo Print\EPTBL.dll
x64-TB: Norton Toolbar: {7FEBEFE3-6B19-4349-98D2-FFB09D4B49CA} - C:\Program Files (x86)\Norton 360\Engine\22.10.0.85\coIEPlg.dll
x64-Run: [SecurityHealth] C:\Program Files (x86)\Windows Defender\MSASCuiL.exe
x64-Run: [RTHDVCPL] C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe -s
x64-Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"
x64-mPolicies-System: DSCAutomationHostEnabled = dword:2
x64-IE: {25510184-5A38-4A99-B273-DCA8EEF6CD08} - C:\Program Files (x86)\Hewlett-Packard\HP Support Framework\Resources\HPNetworkCheck\NCLauncherFromIE.exe
x64-IE: {2670000A-7350-4f3c-8081-5663EE0C6C49} - {48E73304-E1D6-4330-914C-F5F514E3486C} - C:\Program Files\Microsoft Office 15\root\vfs\ProgramFilesX64\Microsoft Office\Office15\ONBttnIE.dll
x64-IE: {31D09BA0-12F5-4CCE-BE8A-2923E76605DA} - {31D09BA0-12F5-4CCE-BE8A-2923E76605DA} - C:\Program Files\Microsoft Office 15\root\vfs\ProgramFilesX64\Microsoft Office\Office15\OCHelper.dll
x64-IE: {789FE86F-6FC4-46A1-9849-EDE0DB0C95CA} - {FFFDC614-B694-4AE6-AB38-5D6374584B52} - C:\Program Files\Microsoft Office 15\root\vfs\ProgramFilesX64\Microsoft Office\Office15\ONBttnIELinkedNotes.dll
x64-Filter: application/x-ica - {CFB6322E-CC85-4d1b-82C7-893888A236BC} - <orphaned>
x64-Filter: application/x-ica; charset=euc-jp - {CFB6322E-CC85-4d1b-82C7-893888A236BC} - <orphaned>
x64-Filter: application/x-ica; charset=ISO-8859-1 - {CFB6322E-CC85-4d1b-82C7-893888A236BC} - <orphaned>
x64-Filter: application/x-ica; charset=MS936 - {CFB6322E-CC85-4d1b-82C7-893888A236BC} - <orphaned>
x64-Filter: application/x-ica; charset=MS949 - {CFB6322E-CC85-4d1b-82C7-893888A236BC} - <orphaned>
x64-Filter: application/x-ica; charset=MS950 - {CFB6322E-CC85-4d1b-82C7-893888A236BC} - <orphaned>
x64-Filter: application/x-ica; charset=UTF-8 - {CFB6322E-CC85-4d1b-82C7-893888A236BC} - <orphaned>
x64-Filter: application/x-ica; charset=UTF8 - {CFB6322E-CC85-4d1b-82C7-893888A236BC} - <orphaned>
x64-Filter: application/x-ica;charset=euc-jp - {CFB6322E-CC85-4d1b-82C7-893888A236BC} - <orphaned>
x64-Filter: application/x-ica;charset=ISO-8859-1 - {CFB6322E-CC85-4d1b-82C7-893888A236BC} - <orphaned>
x64-Filter: application/x-ica;charset=MS936 - {CFB6322E-CC85-4d1b-82C7-893888A236BC} - <orphaned>
x64-Filter: application/x-ica;charset=MS949 - {CFB6322E-CC85-4d1b-82C7-893888A236BC} - <orphaned>
x64-Filter: application/x-ica;charset=MS950 - {CFB6322E-CC85-4d1b-82C7-893888A236BC} - <orphaned>
x64-Filter: application/x-ica;charset=UTF-8 - {CFB6322E-CC85-4d1b-82C7-893888A236BC} - <orphaned>
x64-Filter: application/x-ica;charset=UTF8 - {CFB6322E-CC85-4d1b-82C7-893888A236BC} - <orphaned>
x64-Filter: ica - {CFB6322E-CC85-4d1b-82C7-893888A236BC} - <orphaned>
x64-Handler: osf - {D924BDC6-C83A-4BD5-90D0-095128A113D1} - <orphaned>
x64-Handler: tbauth - {14654CA6-5711-491D-B89A-58E571679951} - C:\WINDOWS\System32\tbauth.dll
x64-Handler: windows.tbauth - {14654CA6-5711-491D-B89A-58E571679951} - C:\WINDOWS\System32\tbauth.dll
x64-SSODL: WebCheck - <orphaned>
x64-mASetup: {2C7339CF-2B09-4501-B3F3-F3508C9228ED} - /UserInstall
x64-mASetup: {89820200-ECBD-11cf-8B85-00AA005B4340} - U
x64-mASetup: {8A69D345-D564-463c-AFF1-A69D9E530F96} - "C:\Program Files (x86)\Google\Chrome\Application\60.0.3112.90\Installer\chrmstp.exe" --configure-user-settings --verbose-logging --system-level
x64-CLSID: {603D3801-BD81-11d0-A3A5-00C04FD706EC} - C:\WINDOWS\System32\windows.storage.dll
.
================= FIREFOX ===================
.
FF - ProfilePath - C:\Users\Robert\AppData\Roaming\Mozilla\Firefox\Profiles\rnmev8of.default-1448735922823\
FF - prefs.js: browser.startup.homepage - hxxps://search.norton.com?o=APN12179&prt=SSS&chn=PIF001&ver=1.0.1.5&tpr=111&guid=2a786961-0257-44a7-ee2c-ecab5c9e3ea5&doi=2017-6-12
FF - plugin: C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AIR\nppdf32.dll
FF - plugin: C:\Program Files (x86)\Citrix\ICA Client\npicaN.dll
FF - plugin: C:\Program Files (x86)\Citrix\ICA Client\npURLInterceptorPlugin.dll
FF - plugin: C:\Program Files (x86)\Google\Update\1.3.33.5\npGoogleUpdate3.dll
FF - plugin: C:\Program Files (x86)\Microsoft Silverlight\5.1.50907.0\npctrlui.dll
FF - plugin: C:\Program Files\Microsoft Office 15\root\Office15\NPSPWRAP.DLL
FF - plugin: C:\Program Files\Microsoft Office 15\root\VFS\ProgramFilesX86\Mozilla Firefox\plugins\npmeetingjoinpluginoc.dll
FF - plugin: C:\Users\Robert\AppData\Local\Citrix\Plugins\104\npappdetector.dll
FF - plugin: C:\WINDOWS\SysWoW64\Macromed\Flash\NPSWF32_23_0_0_207.dll
.
============= SERVICES / DRIVERS ===============
.
R0 intelpep;Intel(R) Power Engine Plug-in Driver;C:\WINDOWS\System32\drivers\intelpep.sys [2017-3-18 74840]
R0 iorate;Disk I/O Rate Filter Driver;C:\WINDOWS\System32\drivers\iorate.sys [2017-3-18 49568]
R0 SymEFASI;Symantec Extended File Attributes (SI);C:\WINDOWS\System32\drivers\N360x64\160A000.055\symefasi64.sys [2017-7-26 1868416]
R0 volume;Volume driver;C:\WINDOWS\System32\drivers\volume.sys [2017-3-18 16288]
R0 WindowsTrustedRT;Windows Trusted Execution Environment Class Extension;C:\WINDOWS\System32\drivers\WindowsTrustedRT.sys [2017-3-18 70232]
R0 WindowsTrustedRTProxy;Microsoft Windows Trusted Runtime Secure Service;C:\WINDOWS\System32\drivers\WindowsTrustedRTProxy.sys [2017-3-18 18520]
R0 Wof;Windows Overlay File System Filter Driver;C:\WINDOWS\System32\drivers\wof.sys [2017-3-18 208288]
R1 ahcache;Application Compatibility Cache;C:\WINDOWS\System32\drivers\ahcache.sys [2017-3-18 239616]
R1 BHDrvx64;BHDrvx64;C:\Program Files (x86)\Norton 360\NortonData\22.5.0.124\Definitions\BASHDefs\20170807.003\BHDrvx64.sys [2017-8-8 1862816]
R1 ccSet_N360;N360 Settings Manager;C:\WINDOWS\System32\drivers\N360x64\160A000.055\ccsetx64.sys [2017-7-26 187520]
R1 ctxusbm;Citrix USB Monitor Driver;C:\WINDOWS\System32\drivers\ctxusbm.sys [2016-10-17 142000]
R1 FileCrypt;FileCrypt;C:\WINDOWS\System32\drivers\filecrypt.sys [2017-3-18 54272]
R1 GpuEnergyDrv;GPU Energy Driver;C:\WINDOWS\System32\drivers\gpuenergydrv.sys [2017-3-18 8192]
R1 IDSVia64;IDSVia64;C:\Program Files (x86)\Norton 360\NortonData\22.5.0.124\Definitions\IPSDefs\20170811.001\IDSvia64.sys [2017-8-11 1056920]
R1 SymIRON;Symantec Iron Driver;C:\WINDOWS\System32\drivers\N360x64\160A000.055\ironx64.sys [2017-7-26 301288]
R1 SymNetS;Symantec Network Security WFP Driver;C:\WINDOWS\System32\drivers\N360x64\160A000.055\symnets.sys [2017-7-26 566912]
R2 AERTFilters;Andrea RT Filters Service;C:\Program Files\Realtek\Audio\HDA\AERTSr64.exe [2012-7-5 98208]
R2 AMD External Events Utility;AMD External Events Utility;C:\WINDOWS\System32\atiesrxx.exe [2015-1-13 238080]
R2 Apple Mobile Device Service;Apple Mobile Device Service;C:\Program Files\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe [2016-3-2 83768]
R2 CDPSvc;Connected Devices Platform Service;C:\WINDOWS\System32\svchost.exe -k LocalService [2017-3-18 47664]
R2 ClickToRunSvc;Microsoft Office ClickToRun Service;C:\Program Files\Microsoft Office 15\ClientX64\officeclicktorun.exe [2014-3-19 2828016]
R2 clreg;Virtual Registry for Containers;C:\WINDOWS\System32\drivers\registry.sys [2017-3-18 14336]
R2 CoreMessagingRegistrar;CoreMessaging;C:\WINDOWS\System32\svchost.exe -k LocalServiceNoNetwork [2017-3-18 47664]
R2 cvhsvc;Client Virtualization Handler;C:\Program Files (x86)\Common Files\Microsoft Shared\Virtualization Handler\CVHSVC.EXE [2015-3-18 822496]
R2 DiagTrack;Connected User Experiences and Telemetry;C:\WINDOWS\System32\svchost.exe -k utcsvc [2017-3-18 47664]
R2 DoSvc;Delivery Optimization;C:\WINDOWS\System32\svchost.exe -k netsvcs [2017-3-18 47664]
R2 DusmSvc;Data Usage;C:\WINDOWS\System32\svchost.exe -k LocalServiceNetworkRestricted [2017-3-18 47664]
R2 HPSupportSolutionsFrameworkService;HP Support Solutions Framework Service;C:\Program Files (x86)\Hewlett-Packard\HP Support Solutions\HPSupportSolutionsFrameworkService.exe [2015-9-28 321056]
R2 IntuitUpdateServiceV4;Intuit Update Service v4;C:\Program Files (x86)\Common Files\Intuit\Update Service v4\IntuitUpdateService.exe [2016-9-7 21216]
R2 N360;Norton 360;C:\Program Files (x86)\Norton 360\Engine\22.10.0.85\n360.exe [2017-7-26 326144]
R2 storqosflt;Storage QoS Filter Driver;C:\WINDOWS\System32\drivers\storqosflt.sys [2017-3-18 79872]
R2 wcifs;Windows Container Isolation;C:\WINDOWS\System32\drivers\wcifs.sys [2017-7-25 142752]
R3 DsSvc;Data Sharing Service;C:\WINDOWS\System32\svchost.exe -k LocalSystemNetworkRestricted [2017-3-18 47664]
R3 EraserUtilRebootDrv;EraserUtilRebootDrv;C:\Program Files (x86)\Common Files\Symantec Shared\EENGINE\EraserUtilRebootDrv.sys [2017-7-12 158336]
R3 ITECIRfilter;ITECIR Filter Driver;C:\WINDOWS\System32\drivers\ITECIRfilter.sys [2015-6-3 27856]
R3 lfsvc;Geolocation Service;C:\WINDOWS\System32\svchost.exe -k netsvcs [2017-3-18 47664]
R3 LicenseManager;Windows License Manager Service;C:\WINDOWS\System32\svchost.exe -k LocalService [2017-3-18 47664]
R3 NcbService;Network Connection Broker;C:\WINDOWS\System32\svchost.exe -k LocalSystemNetworkRestricted [2017-3-18 47664]
R3 NdisVirtualBus;Microsoft Virtual Network Adapter Enumerator;C:\WINDOWS\System32\drivers\NdisVirtualBus.sys [2017-3-18 20992]
R3 netr28x;Ralink 802.11n Extensible Wireless Driver;C:\WINDOWS\System32\drivers\netr28x.sys [2017-3-18 2537984]
R3 rt640x64;Realtek RT640 NT Driver;C:\WINDOWS\System32\drivers\rt640x64.sys [2017-3-18 604160]
R3 Sftfs;Sftfs;C:\WINDOWS\System32\drivers\Sftfslh.sys [2014-10-8 766632]
R3 Sftplay;Sftplay;C:\WINDOWS\System32\drivers\Sftplaylh.sys [2014-10-8 273576]
R3 Sftredir;Sftredir;C:\WINDOWS\System32\drivers\Sftredirlh.sys [2014-10-8 29352]
R3 Sftvol;Sftvol;C:\WINDOWS\System32\drivers\Sftvollh.sys [2014-10-8 23208]
R3 WUDFWpdMtp;WUDFWpdMtp;C:\WINDOWS\System32\drivers\WUDFRd.sys [2017-3-18 220672]
S0 SymELAM;Symantec ELAM Driver;C:\WINDOWS\System32\drivers\N360x64\160A000.055\symelam.sys [2017-7-26 24608]
S2 CldFlt;Windows Cloud Files Filter Driver;C:\WINDOWS\System32\drivers\cldflt.sys [2017-3-18 12288]
S2 MapsBroker;Downloaded Maps Manager;C:\WINDOWS\System32\svchost.exe -k NetworkService [2017-3-18 47664]
S3 AcpiDev;ACPI Devices driver;C:\WINDOWS\System32\drivers\AcpiDev.sys [2017-3-18 20480]
S3 ADP80XX;ADP80XX;C:\WINDOWS\System32\drivers\adp80xx.sys [2017-3-18 1135512]
S3 AJRouter;AllJoyn Router Service;C:\WINDOWS\System32\svchost.exe -k LocalServiceNetworkRestricted [2017-3-18 47664]
S3 applockerfltr;Smartlocker Filter Driver;C:\WINDOWS\System32\drivers\applockerfltr.sys [2017-3-18 17920]
S3 AppReadiness;App Readiness;C:\WINDOWS\System32\svchost.exe -k AppReadiness [2017-3-18 47664]
S3 AppXSvc;AppX Deployment Service (AppXSVC);C:\WINDOWS\System32\svchost.exe -k wsappx [2017-3-18 47664]
S3 bcmfn2;bcmfn2 Service;C:\WINDOWS\System32\drivers\bcmfn2.sys [2017-3-18 9728]
S3 BthHFSrv;Bluetooth Handsfree Service;C:\WINDOWS\System32\svchost.exe -k LocalServiceAndNoImpersonation [2017-3-18 47664]
S3 buttonconverter;Service for Portable Device Control devices;C:\WINDOWS\System32\drivers\buttonconverter.sys [2017-3-18 39424]
S3 CAD;Charge Arbitration Driver;C:\WINDOWS\System32\drivers\CAD.sys [2017-3-18 53664]
S3 CapImg;HID driver for CapImg touch screen;C:\WINDOWS\System32\drivers\capimg.sys [2017-3-18 122880]
S3 cht4iscsi;cht4iscsi;C:\WINDOWS\System32\drivers\cht4sx64.sys [2017-3-18 347032]
S3 cht4vbd;Chelsio Virtual Bus Driver;C:\WINDOWS\System32\drivers\cht4vx64.sys [2017-3-18 2104224]
S3 ClipSVC;Client License Service (ClipSVC);C:\WINDOWS\System32\svchost.exe -k wsappx [2017-3-18 47664]
S3 clwvd;HP Webcam Splitter;C:\WINDOWS\System32\drivers\clwvd.sys [2010-6-18 32880]
S3 DevQueryBroker;DevQuery Background Discovery Broker;C:\WINDOWS\System32\svchost.exe -k LocalSystemNetworkRestricted [2017-3-18 47664]
S3 diagnosticshub.standardcollector.service;Microsoft (R) Diagnostics Hub Standard Collector Service;C:\WINDOWS\System32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe [2017-3-18 86528]
S3 DmEnrollmentSvc;Device Management Enrollment Service;C:\WINDOWS\System32\svchost.exe -k netsvcs [2017-3-18 47664]
S3 dmwappushservice;dmwappushsvc;C:\WINDOWS\System32\svchost.exe -k netsvcs [2017-3-18 47664]
S3 embeddedmode;Embedded Mode;C:\WINDOWS\System32\svchost.exe -k LocalSystemNetworkRestricted [2017-3-18 47664]
S3 EntAppSvc;Enterprise App Management Service;C:\WINDOWS\System32\svchost.exe -k appmodel [2017-3-18 47664]
S3 FrameServer;Windows Camera Frame Server;C:\WINDOWS\System32\svchost.exe -k Camera [2017-3-18 47664]
S3 genericusbfn;Generic USB Function Class;C:\WINDOWS\System32\drivers\genericusbfn.sys [2017-3-18 21504]
S3 hidinterrupt;Common Driver for HID Buttons implemented with interrupts;C:\WINDOWS\System32\drivers\hidinterrupt.sys [2017-3-18 51104]
S3 HvHost;HV Host Service;C:\WINDOWS\System32\svchost.exe -k LocalSystemNetworkRestricted [2017-3-18 47664]
S3 iagpio;Intel Serial IO GPIO Controller Driver;C:\WINDOWS\System32\drivers\iagpio.sys [2017-3-18 33280]
S3 iai2c;Intel(R) Serial IO I2C Host Controller;C:\WINDOWS\System32\drivers\iai2c.sys [2017-3-18 81408]
S3 iaLPSS2i_GPIO2;Intel(R) Serial IO GPIO Driver v2;C:\WINDOWS\System32\drivers\iaLPSS2i_GPIO2.sys [2017-3-18 70656]
S3 iaLPSS2i_GPIO2_BXT_P;Intel(R) Serial IO GPIO Driver v2;C:\WINDOWS\System32\drivers\iaLPSS2i_GPIO2_BXT_P.sys [2017-3-18 85504]
S3 iaLPSS2i_I2C;Intel(R) Serial IO I2C Driver v2;C:\WINDOWS\System32\drivers\iaLPSS2i_I2C.sys [2017-3-18 165376]
S3 iaLPSS2i_I2C_BXT_P;Intel(R) Serial IO I2C Driver v2;C:\WINDOWS\System32\drivers\iaLPSS2i_I2C_BXT_P.sys [2017-3-18 168448]
S3 iaLPSSi_GPIO;Intel(R) Serial IO GPIO Controller Driver;C:\WINDOWS\System32\drivers\iaLPSSi_GPIO.sys [2017-3-18 38128]
S3 iaLPSSi_I2C;Intel(R) Serial IO I2C Controller Driver;C:\WINDOWS\System32\drivers\iaLPSSi_I2C.sys [2017-3-18 113152]
S3 iaStorAV;Intel(R) SATA RAID Controller Windows;C:\WINDOWS\System32\drivers\iaStorAV.sys [2017-3-18 673184]
S3 ibbus;Mellanox InfiniBand Bus/AL (Filter Driver);C:\WINDOWS\System32\drivers\ibbus.sys [2017-3-18 526240]
S3 icssvc;Windows Mobile Hotspot Service;C:\WINDOWS\System32\svchost.exe -k LocalServiceNetworkRestricted [2017-3-18 47664]
S3 IndirectKmd;Indirect Displays Kernel-Mode Driver;C:\WINDOWS\System32\drivers\IndirectKmd.sys [2017-3-18 36864]
S3 IpxlatCfgSvc;IP Translation Configuration Service;C:\WINDOWS\System32\svchost.exe -k LocalSystemNetworkRestricted [2017-3-18 47664]
S3 LSI_SAS2i;LSI_SAS2i;C:\WINDOWS\System32\drivers\lsi_sas2i.sys [2017-3-18 123808]
S3 LSI_SAS3i;LSI_SAS3i;C:\WINDOWS\System32\drivers\lsi_sas3i.sys [2017-3-18 103328]
S3 mausbhost;MA-USB Host Controller Driver;C:\WINDOWS\System32\drivers\mausbhost.sys [2017-3-18 405408]
S3 mausbip;MA-USB IP Filter Driver;C:\WINDOWS\System32\drivers\mausbip.sys [2017-3-18 51104]
S3 megasas2i;megasas2i;C:\WINDOWS\System32\drivers\MegaSas2i.sys [2017-3-18 64416]
S3 mlx4_bus;Mellanox ConnectX Bus Enumerator;C:\WINDOWS\System32\drivers\mlx4_bus.sys [2017-3-18 842656]
S3 NaturalAuthentication;Natural Authentication;C:\WINDOWS\System32\svchost.exe -k netsvcs [2017-3-18 47664]
S3 ndfltr;NetworkDirect Service;C:\WINDOWS\System32\drivers\ndfltr.sys [2017-3-18 108960]
S3 NetAdapterCx;Network Adapter Wdf Class Extension Library;C:\WINDOWS\System32\drivers\NetAdapterCx.sys [2017-3-18 122368]
S3 NetSetupSvc;Network Setup Service;C:\WINDOWS\System32\svchost.exe -k netsvcs [2017-3-18 47664]
S3 netvsc;netvsc;C:\WINDOWS\System32\drivers\netvsc.sys [2017-7-25 118784]
S3 NgcCtnrSvc;Microsoft Passport Container;C:\WINDOWS\System32\svchost.exe -k LocalServiceNetworkRestricted [2017-3-18 47664]
S3 NgcSvc;Microsoft Passport;C:\WINDOWS\System32\svchost.exe -k LocalSystemNetworkRestricted [2017-3-18 47664]
S3 nvdimmn;Microsoft NVDIMM-N device driver;C:\WINDOWS\System32\drivers\nvdimmn.sys [2017-3-18 80896]
S3 percsas2i;percsas2i;C:\WINDOWS\System32\drivers\percsas2i.sys [2017-3-18 58784]
S3 percsas3i;percsas3i;C:\WINDOWS\System32\drivers\percsas3i.sys [2017-3-18 61848]
S3 PhoneSvc;Phone Service;C:\WINDOWS\System32\svchost.exe -k LocalService [2017-3-18 47664]
S3 ReFS;ReFS;C:\WINDOWS\System32\drivers\refs.sys [2017-3-18 1735584]
S3 ReFSv1;ReFSv1;C:\WINDOWS\System32\drivers\refsv1.sys [2017-3-18 936864]
S3 scmbus;Microsoft Storage Class Memory Bus Driver;C:\WINDOWS\System32\drivers\scmbus.sys [2017-3-18 91040]
S3 SDFRd;SDF Reflector;C:\WINDOWS\System32\drivers\SDFRd.sys [2017-3-18 31128]
S3 SerCx2;Serial UART Support Library;C:\WINDOWS\System32\drivers\SerCx2.sys [2017-3-18 154016]
S3 SpatialGraphFilter;Holographic Spatial Graph Filter;C:\WINDOWS\System32\drivers\SpatialGraphFilter.sys [2017-3-18 40352]
S3 stornvme;Microsoft Standard NVM Express Driver;C:\WINDOWS\System32\drivers\stornvme.sys [2017-3-18 95648]
S3 storufs;Microsoft Universal Flash Storage (UFS) Driver;C:\WINDOWS\System32\drivers\storufs.sys [2017-3-18 36760]
S3 UcmCx0101;USB Connector Manager KMDF Class Extension;C:\WINDOWS\System32\drivers\UcmCx.sys [2017-3-18 104448]
S3 UcmTcpciCx0101;UCM-TCPCI KMDF Class Extension;C:\WINDOWS\System32\drivers\UcmTcpciCx.sys [2017-3-18 179200]
S3 UcmUcsi;USB Connector Manager UCSI Client;C:\WINDOWS\System32\drivers\UcmUcsi.sys [2017-8-8 51712]
S3 UdeCx;USB Device Emulation Support Library;C:\WINDOWS\System32\drivers\Udecx.sys [2017-3-18 45568]
S3 UEFI;Microsoft UEFI Driver;C:\WINDOWS\System32\drivers\uefi.sys [2017-3-18 29600]
S3 Ufx01000;USB Function Class Extension;C:\WINDOWS\System32\drivers\ufx01000.sys [2017-3-18 263584]
S3 UfxChipidea;USB Chipidea Controller;C:\WINDOWS\System32\drivers\UfxChipidea.sys [2017-3-18 98712]
S3 ufxsynopsys;USB Synopsys Controller;C:\WINDOWS\System32\drivers\ufxsynopsys.sys [2017-3-18 138656]
S3 UrsChipidea;Chipidea USB Role-Switch Driver;C:\WINDOWS\System32\drivers\urschipidea.sys [2017-3-18 29600]
S3 UrsCx01000;USB Role-Switch Support Library;C:\WINDOWS\System32\drivers\urscx01000.sys [2017-3-18 59288]
S3 UrsSynopsys;Synopsys USB Role-Switch Driver;C:\WINDOWS\System32\drivers\urssynopsys.sys [2017-3-18 28064]
S3 vhf;Virtual HID Framework (VHF) Driver;C:\WINDOWS\System32\drivers\vhf.sys [2017-3-18 35328]
S3 vmgid;Microsoft Hyper-V Guest Infrastructure Driver;C:\WINDOWS\System32\drivers\vmgid.sys [2017-3-18 10240]
S3 wcnfs;Windows Container Name Virtualization;C:\WINDOWS\System32\drivers\wcnfs.sys [2017-3-18 72192]
S3 wdiwifi;WDI Driver Framework;C:\WINDOWS\System32\drivers\WdiWiFi.sys [2017-7-25 757248]
S3 WdNisDrv;Windows Defender Antivirus Network Inspection System Driver;C:\WINDOWS\System32\drivers\WdNisDrv.sys [2017-3-18 121248]
S3 WinMad;WinMad Service;C:\WINDOWS\System32\drivers\winmad.sys [2017-3-18 32160]
S3 WinNat;Windows NAT Driver;C:\WINDOWS\System32\drivers\winnat.sys [2017-3-18 217088]
S3 WinVerbs;WinVerbs Service;C:\WINDOWS\System32\drivers\winverbs.sys [2017-3-18 64920]
S3 xboxgip;Xbox Game Input Protocol Driver;C:\WINDOWS\System32\drivers\xboxgip.sys [2017-7-25 277504]
S3 xinputhid;XINPUT HID Filter Driver;C:\WINDOWS\System32\drivers\xinputhid.sys [2017-3-18 46592]
S4 EPSON_EB_RPCV4_04;EPSON V5 Service4(04);C:\Program Files\Common Files\EPSON\EPW!3 SSRP\E_S50STB.EXE [2017-7-24 166400]
S4 EPSON_PM_RPCV4_04;EPSON V3 Service4(04);C:\Program Files\Common Files\EPSON\EPW!3 SSRP\E_S50RPB.EXE [2017-7-24 128512]
S4 NOBU;Norton Online Backup;C:\Program Files (x86)\Symantec\Norton Online Backup\NOBuAgent.exe [2010-6-1 2804568]
S4 PdiService;Portrait Displays SDK Service;C:\Program Files (x86)\Common Files\Portrait Displays\Drivers\pdisrvc.exe [2010-11-19 109168]
.
=============== File Associations ===============
.
FileExt: .txt: txtfile=C:\WINDOWS\System32\NOTEPAD.EXE %1 [UserChoice]
.
=============== Created Last 30 ================
.
2017-08-08 18:26:59 77312 ----a-w- C:\WINDOWS\SysWow64\spbcd.dll
2017-08-08 18:25:59 17366528 ----a-w- C:\WINDOWS\System32\Windows.UI.Xaml.dll
2017-07-31 22:31:50 236016 ----a-w- C:\Program Files (x86)\Mozilla Firefox\plugins\nppdf32.dll
2017-07-31 22:31:50 236016 ----a-w- C:\Program Files (x86)\Internet Explorer\Plugins\nppdf32.dll
2017-07-29 05:29:44 -------- d-----w- C:\Program Files (x86)\Steam
2017-07-26 12:34:03 810136 ----a-w- C:\WINDOWS\System32\drivers\N360x64\160A000.055\srtsp64.sys
2017-07-26 12:34:03 566912 ----a-w- C:\WINDOWS\System32\drivers\N360x64\160A000.055\symnets.sys
2017-07-26 12:34:03 49304 ----a-w- C:\WINDOWS\System32\drivers\N360x64\160A000.055\srtspx64.sys
2017-07-26 12:34:03 301288 ----a-w- C:\WINDOWS\System32\drivers\N360x64\160A000.055\ironx64.sys
2017-07-26 12:34:03 24608 ----a-w- C:\WINDOWS\System32\drivers\N360x64\160A000.055\symelam.sys
2017-07-26 12:34:03 187520 ----a-w- C:\WINDOWS\System32\drivers\N360x64\160A000.055\ccsetx64.sys
2017-07-26 12:34:03 1868416 ----a-w- C:\WINDOWS\System32\drivers\N360x64\160A000.055\symefasi64.sys
2017-07-26 12:33:42 -------- d-----w- C:\WINDOWS\System32\drivers\N360x64\160A000.055
2017-07-25 13:44:22 -------- d-----w- C:\ProgramData\Microsoft OneDrive
2017-07-25 13:42:41 -------- d-----w- C:\Users\Robert\AppData\Local\DBG
2017-07-25 04:43:44 987648 ----a-w- C:\WINDOWS\SysWow64\wpnapps.dll
2017-07-25 04:36:52 -------- d-----w- C:\WINDOWS\System32\Microsoft
2017-07-25 04:36:52 -------- d-----w- C:\WINDOWS\ServiceProfiles
2017-07-25 01:37:08 -------- d-sh--we C:\ProgramData\Documents
2017-07-25 01:37:08 -------- d-sh--w- C:\Recovery
2017-07-25 01:24:38 -------- d-----w- C:\WINDOWS\System32\wbem\Performance
2017-07-25 01:20:37 -------- d-----w- C:\WINDOWS\System32\wbem\MOF\good
2017-07-25 01:20:37 -------- d-----w- C:\WINDOWS\System32\wbem\MOF\bad
2017-07-25 01:10:49 -------- d-----w- C:\ProgramData\USOShared
2017-07-25 01:09:05 -------- d-----w- C:\Program Files (x86)\Common Files\SpeechEngines
2017-07-25 01:09:00 -------- d-----w- C:\Program Files\Common Files\SpeechEngines
2017-07-25 01:02:52 -------- d-----w- C:\Program Files\Common Files\EPSON
2017-07-25 01:02:49 2233344 ----a-w- C:\WINDOWS\SysWow64\PrintConfig.dll
2017-07-25 01:02:48 -------- d-----w- C:\ProgramData\EPSON
2017-07-25 01:02:26 0 ----a-w- C:\WINDOWS\ativpsrm.bin
2017-07-25 01:02:12 -------- d-----w- C:\ProgramData\SonicFocus
2017-07-25 01:02:06 -------- d-----w- C:\Program Files\Realtek
2017-07-25 01:02:05 -------- d-----w- C:\WINDOWS\SysWow64\RTCOM
2017-07-25 01:00:47 -------- d-----w- C:\WINDOWS\System32\wbem\MOF
2017-07-25 01:00:05 -------- d-----w- C:\WINDOWS\System32\SleepStudy
2017-07-20 12:44:40 -------- dc----w- C:\WINDOWS\Panther
2017-07-15 15:37:21 -------- d-----w- C:\Users\Robert\AppData\Roaming\Roxio Log Files
2017-07-15 12:39:48 -------- d-----w- C:\ProgramData\VTech
2017-07-15 12:33:25 934912 ----a-w- C:\ProgramData\Microsoft\Windows\Templates\VTechUninstall\QtNetwork4.dll
2017-07-15 12:33:25 434040 ----a-w- C:\ProgramData\Microsoft\Windows\Templates\VTechUninstall\UninstallWizard.exe
2017-07-15 12:33:24 7826432 ----a-w- C:\ProgramData\Microsoft\Windows\Templates\VTechUninstall\QtGui4.dll
2017-07-15 12:33:24 527240 ----a-w- C:\ProgramData\Microsoft\Windows\Templates\VTechUninstall\ProductExtend.exe
2017-07-15 12:33:24 335360 ----a-w- C:\ProgramData\Microsoft\Windows\Templates\VTechUninstall\QtXml4.dll
2017-07-15 12:33:24 268800 ----a-w- C:\ProgramData\Microsoft\Windows\Templates\VTechUninstall\QtSvg4.dll
2017-07-15 12:33:24 2150400 ----a-w- C:\ProgramData\Microsoft\Windows\Templates\VTechUninstall\QtCore4.dll
2017-07-13 20:47:44 -------- d-----w- C:\ProgramData\Gibraltar
.
==================== Find3M ====================
.
2017-08-01 02:39:54 8319392 ----a-w- C:\WINDOWS\System32\ntoskrnl.exe
2017-08-01 02:38:47 406544 ----a-w- C:\WINDOWS\SysWow64\policymanager.dll
2017-08-01 02:38:08 382368 ----a-w- C:\WINDOWS\System32\drivers\clfs.sys
2017-08-01 02:36:56 119712 ----a-w- C:\WINDOWS\System32\drivers\tdx.sys
2017-08-01 02:36:49 323488 ----a-w- C:\WINDOWS\apppatch\AcRes.dll
2017-08-01 02:36:29 750496 ----a-w- C:\WINDOWS\SysWow64\WWAHost.exe
2017-08-01 02:35:13 280472 ----a-w- C:\WINDOWS\SysWow64\WerFault.exe
2017-08-01 02:35:09 133904 ----a-w- C:\WINDOWS\SysWow64\WerFaultSecure.exe
2017-08-01 02:34:39 610584 ----a-w- C:\WINDOWS\SysWow64\wer.dll
2017-08-01 02:34:36 359552 ----a-w- C:\WINDOWS\SysWow64\Faultrep.dll
2017-08-01 02:34:32 349600 ----a-w- C:\WINDOWS\SysWow64\msv1_0.dll
2017-08-01 02:34:32 168864 ----a-w- C:\WINDOWS\SysWow64\wermgr.exe
2017-08-01 02:33:57 473240 ----a-w- C:\WINDOWS\System32\policymanager.dll
2017-08-01 02:32:37 2444704 ----a-w- C:\WINDOWS\System32\drivers\dxgkrnl.sys
2017-08-01 02:32:23 712600 ----a-w- C:\WINDOWS\System32\drivers\dxgmms2.sys
2017-08-01 02:32:04 820128 ----a-w- C:\WINDOWS\System32\WWAHost.exe
2017-08-01 02:31:56 5477088 ----a-w- C:\WINDOWS\System32\OneCoreUAPCommonProxyStub.dll
2017-08-01 02:31:49 212384 ----a-w- C:\WINDOWS\System32\browserbroker.dll
2017-08-01 02:31:01 176024 ----a-w- C:\WINDOWS\SysWow64\basecsp.dll
2017-08-01 02:30:52 315288 ----a-w- C:\WINDOWS\System32\WerFault.exe
2017-08-01 02:30:50 143736 ----a-w- C:\WINDOWS\System32\WerFaultSecure.exe
2017-08-01 02:30:25 723680 ----a-w- C:\WINDOWS\System32\wer.dll
2017-08-01 02:30:21 82336 ----a-w- C:\WINDOWS\System32\drivers\vmbkmcl.sys
2017-08-01 02:30:18 410160 ----a-w- C:\WINDOWS\System32\Faultrep.dll
2017-08-01 02:30:16 182688 ----a-w- C:\WINDOWS\System32\wermgr.exe
2017-08-01 02:30:09 411040 ----a-w- C:\WINDOWS\System32\msv1_0.dll
2017-08-01 02:26:58 204192 ----a-w- C:\WINDOWS\System32\basecsp.dll
2017-08-01 02:20:54 404480 ----a-w- C:\WINDOWS\SysWow64\werui.dll
2017-08-01 02:20:40 154624 ----a-w- C:\WINDOWS\SysWow64\DWWIN.EXE
2017-08-01 02:20:33 2956288 ----a-w- C:\WINDOWS\SysWow64\win32kfull.sys
2017-08-01 02:18:16 13841408 ----a-w- C:\WINDOWS\SysWow64\Windows.UI.Xaml.dll
2017-08-01 02:18:13 2199552 ----a-w- C:\WINDOWS\SysWow64\Windows.UI.Xaml.Resources.dll
2017-08-01 02:17:02 34816 ----a-w- C:\WINDOWS\SysWow64\tokenbinding.dll
2017-08-01 02:16:16 80896 ----a-w- C:\WINDOWS\SysWow64\Chakradiag.dll
2017-08-01 02:14:09 35840 ----a-w- C:\WINDOWS\SysWow64\sscore.dll
2017-08-01 02:13:31 127488 ----a-w- C:\WINDOWS\SysWow64\fdeploy.dll
2017-08-01 02:13:30 20504064 ----a-w- C:\WINDOWS\SysWow64\edgehtml.dll
2017-08-01 02:13:12 364032 ----a-w- C:\WINDOWS\SysWow64\msIso.dll
2017-08-01 02:12:28 229888 ----a-w- C:\WINDOWS\SysWow64\scksp.dll
2017-08-01 02:10:19 358400 ----a-w- C:\WINDOWS\SysWow64\ieproxy.dll
2017-08-01 02:09:58 394240 ----a-w- C:\WINDOWS\SysWow64\Windows.Internal.Management.dll
2017-08-01 02:08:54 267264 ----a-w- C:\WINDOWS\SysWow64\ncryptprov.dll
2017-08-01 02:07:57 2671616 ----a-w- C:\WINDOWS\SysWow64\tquery.dll
2017-08-01 02:07:54 5961728 ----a-w- C:\WINDOWS\SysWow64\Windows.Data.Pdf.dll
2017-08-01 02:06:46 798208 ----a-w- C:\WINDOWS\SysWow64\TokenBroker.dll
2017-08-01 02:04:40 6269440 ----a-w- C:\WINDOWS\SysWow64\Chakra.dll
2017-08-01 02:04:32 3656192 ----a-w- C:\WINDOWS\SysWow64\jscript9.dll
2017-08-01 01:57:22 23677952 ----a-w- C:\WINDOWS\System32\edgehtml.dll
2017-08-01 01:45:44 3670016 ----a-w- C:\WINDOWS\System32\win32kfull.sys
2017-08-01 01:45:28 462848 ----a-w- C:\WINDOWS\System32\werui.dll
2017-08-01 01:45:03 92672 ----a-w- C:\WINDOWS\System32\wercplsupport.dll
2017-08-01 01:45:02 1275392 ----a-w- C:\WINDOWS\System32\werconcpl.dll
2017-08-01 01:44:53 184320 ----a-w- C:\WINDOWS\System32\DWWIN.EXE
2017-08-01 01:44:49 77824 ----a-w- C:\WINDOWS\System32\wsqmcons.exe
2017-08-01 01:44:32 83968 ----a-w- C:\WINDOWS\System32\drivers\vmbkmclr.sys
2017-08-01 01:42:55 2199552 ----a-w- C:\WINDOWS\System32\Windows.UI.Xaml.Resources.dll
2017-08-01 01:41:48 42496 ----a-w- C:\WINDOWS\System32\tokenbinding.dll
2017-08-01 01:41:47 130560 ----a-w- C:\WINDOWS\System32\policymanagerprecheck.dll
2017-08-01 01:41:04 110592 ----a-w- C:\WINDOWS\System32\Chakradiag.dll
2017-08-01 01:40:35 290816 ----a-w- C:\WINDOWS\System32\dmenterprisediagnostics.dll
2017-08-01 01:39:04 46592 ----a-w- C:\WINDOWS\System32\sscore.dll
2017-08-01 01:38:49 143872 ----a-w- C:\WINDOWS\System32\profsvcext.dll
2017-08-01 01:38:21 153088 ----a-w- C:\WINDOWS\System32\fdeploy.dll
2017-08-01 01:37:53 433664 ----a-w- C:\WINDOWS\System32\msIso.dll
2017-08-01 01:37:29 582656 ----a-w- C:\WINDOWS\System32\SmsRouterSvc.dll
2017-08-01 01:37:09 255488 ----a-w- C:\WINDOWS\System32\scksp.dll
2017-08-01 01:35:14 692736 ----a-w- C:\WINDOWS\System32\jscript9diag.dll
2017-08-01 01:34:37 805888 ----a-w- C:\WINDOWS\System32\ieproxy.dll
2017-08-01 01:33:49 1269760 ----a-w- C:\WINDOWS\System32\enterprisecsps.dll
2017-08-01 01:33:28 315904 ----a-w- C:\WINDOWS\System32\ncryptprov.dll
2017-08-01 01:32:47 7336960 ----a-w- C:\WINDOWS\System32\Windows.Data.Pdf.dll
2017-08-01 01:32:37 176640 ----a-w- C:\WINDOWS\System32\wersvc.dll
2017-08-01 01:31:25 4445696 ----a-w- C:\WINDOWS\System32\SettingsHandlers_nt.dll
2017-08-01 01:31:03 1396736 ----a-w- C:\WINDOWS\System32\wwansvc.dll
2017-08-01 01:30:43 8209920 ----a-w- C:\WINDOWS\System32\Chakra.dll
2017-08-01 01:30:42 303104 ----a-w- C:\WINDOWS\System32\srvsvc.dll
2017-08-01 01:30:27 1052160 ----a-w- C:\WINDOWS\System32\TokenBroker.dll
2017-08-01 01:30:18 2055168 ----a-w- C:\WINDOWS\System32\win32kbase.sys
2017-08-01 01:30:09 3377664 ----a-w- C:\WINDOWS\System32\tquery.dll
2017-08-01 01:28:51 2516480 ----a-w- C:\WINDOWS\System32\diagtrack.dll
2017-08-01 01:28:43 4730368 ----a-w- C:\WINDOWS\System32\jscript9.dll
2017-08-01 01:27:25 574464 ----a-w- C:\WINDOWS\System32\configmanager2.dll
2017-08-01 01:27:05 482816 ----a-w- C:\WINDOWS\System32\dmenrollengine.dll
2017-08-01 01:26:03 323584 ----a-w- C:\WINDOWS\System32\DeviceEnroller.exe
2017-08-01 01:25:46 249344 ----a-w- C:\WINDOWS\System32\coredpus.dll
2017-08-01 01:25:41 194048 ----a-w- C:\WINDOWS\System32\mdmregistration.dll
2017-08-01 01:25:41 140800 ----a-w- C:\WINDOWS\System32\dmcsps.dll
2017-07-31 15:15:09 835576 ----a-w- C:\WINDOWS\SysWow64\FlashPlayerApp.exe
2017-07-31 15:15:09 177648 ----a-w- C:\WINDOWS\SysWow64\FlashPlayerCPLApp.cpl
2017-07-28 05:30:35 1068720 ----a-w- C:\WINDOWS\System32\Windows.UI.dll
2017-07-28 05:25:32 2399728 ----a-w- C:\WINDOWS\System32\KernelBase.dll
2017-07-28 05:24:52 119904 ----a-w- C:\WINDOWS\System32\dmcmnutils.dll
2017-07-28 05:24:42 116280 ----a-w- C:\WINDOWS\System32\bcd.dll
2017-07-28 05:24:38 2327456 ----a-w- C:\WINDOWS\System32\drivers\ntfs.sys
2017-07-28 05:23:51 723360 ----a-w- C:\WINDOWS\System32\drivers\acpi.sys
2017-07-28 05:23:45 2969888 ----a-w- C:\WINDOWS\System32\CoreUIComponents.dll
2017-07-28 05:22:50 923048 ----a-w- C:\WINDOWS\System32\CoreMessaging.dll
2017-07-28 05:20:38 279968 ----a-w- C:\WINDOWS\System32\drivers\msiscsi.sys
2017-07-28 05:17:27 660680 ----a-w- C:\WINDOWS\System32\dxgi.dll
2017-07-28 05:16:52 961952 ----a-w- C:\WINDOWS\System32\efscore.dll
.
============= FINISH: 20:51:53.03 ===============

Attached Files

attach.txt (7.0 KB)

Hi i Had virus on firefox that says your computer is locked call toll fre number to unlock I have uninstalled and reinstalled firefox also cleaned with Malwarebytes but came back twice also after a wile my computer slows down and freezes dried again Malwarebytes and it does not show any virus
Please help
Thanks so much

Here is the logs

DDS (Ver_2012-11-20.01) - NTFS_AMD64
Internet Explorer: 11.0.9600.18763 BrowserJavaVersion: 11.91.2
Run by User at 17:03:11 on 2017-08-17
Microsoft Windows 7 Professional 6.1.7601.1.1252.1.1033.18.8109.3830 [GMT -4:00]
.
AV: Microsoft Security Essentials *Enabled/Updated* {71A27EC9-3DA6-45FC-60A7-004F623C6189}
SP: Microsoft Security Essentials *Enabled/Updated* {CAC39F2D-1B9C-4A72-5A17-3B3D19BB2B34}
SP: Windows Defender *Disabled/Outdated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
.
============== Running Processes ===============
.
C:\Windows\system32\lsm.exe
C:\Windows\system32\svchost.exe -k DcomLaunch
C:\Windows\system32\svchost.exe -k RPCSS
c:\Program Files\Microsoft Security Client\MsMpEng.exe
C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted
C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted
C:\Windows\system32\svchost.exe -k LocalService
C:\Windows\system32\svchost.exe -k netsvcs
C:\Program Files\Realtek\Audio\HDA\RtkAudioService64.exe
C:\Program Files\Realtek\Audio\HDA\RAVBg64.exe
C:\Program Files\Realtek\Audio\HDA\RAVBg64.exe
C:\Windows\system32\svchost.exe -k NetworkService
C:\Windows\System32\spoolsv.exe
C:\Windows\system32\svchost.exe -k LocalServiceNoNetwork
C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe
C:\Program Files\Realtek\Audio\HDA\AERTSr64.exe
C:\Windows\System32\svchost.exe -k utcsvc
C:\Program Files\Intel\iCLS Client\HeciServer.exe
C:\Program Files (x86)\LogMeIn Hamachi\x64\LMIGuardianSvc.exe
C:\Program Files (x86)\LogMeIn\x64\RaMaint.exe
C:\Windows\system32\taskhost.exe
C:\UPS\WSTD\WSDB\MSSQL11.UPSWS2012SERVER\MSSQL\Binn\sqlservr.exe
C:\Program Files (x86)\Pervasive Software\PSQL\bin\w3dbsmgr.exe
C:\Program Files (x86)\Common Files\Intuit\QuickBooks\QBCFMonitorService.exe
C:\Program Files (x86)\Common Files\Intuit\DataProtect\QBIDPService.exe
c:\Program Files (x86)\Microsoft SQL Server\90\Shared\sqlbrowser.exe
c:\Program Files\Microsoft SQL Server\90\Shared\sqlwriter.exe
C:\Program Files (x86)\Samsung\USB Drivers\27_ssconn\conn\ss_conn_service.exe
C:\Windows\system32\svchost.exe -k imgsvc
C:\Program Files (x86)\TeamViewer\TeamViewer_Service.exe
C:\Program Files (x86)\LogMeIn Hamachi\x64\hamachi-2.exe
C:\Program Files (x86)\LogMeIn\x64\LogMeIn.exe
c:\Program Files\Microsoft Security Client\NisSrv.exe
C:\Windows\system32\svchost.exe -k bthsvcs
C:\Windows\system32\svchost.exe -k NetworkServiceNetworkRestricted
C:\Windows\Explorer.EXE
C:\Windows\system32\Dwm.exe
C:\Program Files (x86)\TeamViewer\TeamViewer.exe
C:\Windows\System32\rundll32.exe
C:\Program Files\Realtek\Audio\HDA\RtkNGUI64.exe
C:\Program Files\Realtek\Audio\HDA\RAVBg64.exe
C:\Program Files\Realtek\Audio\HDA\RAVBg64.exe
C:\Windows\System32\igfxtray.exe
C:\Windows\System32\hkcmd.exe
C:\Windows\System32\igfxpers.exe
C:\Program Files\Microsoft Security Client\msseces.exe
C:\Windows\system32\igfxsrvc.exe
C:\Program Files (x86)\LogMeIn\x64\LogMeInSystray.exe
C:\Program Files\HP\HP Officejet Pro 8610\Bin\ScanToPCActivationApp.exe
C:\Program Files (x86)\Microsoft Office\Office14\MSOSYNC.EXE
C:\Users\User\AppData\Roaming\SanDisk\Sansa Updater\SansaDispatch.exe
C:\Program Files\McAfee Security Scan\3.11.587\SSScheduler.exe
C:\Program Files (x86)\Common Files\Intuit\QuickBooks\QBUpdate\qbupdate.exe
C:\Program Files (x86)\Intuit\QuickBooks 2016\QBW32.EXE
C:\Program Files\HP\HP Officejet Pro 8610\Bin\HPNetworkCommunicatorCom.exe
C:\Program Files\WinZip\WZUpdateNotifier.exe
C:\Program Files (x86)\Intel\Intel(R) USB 3.0 eXtensible Host Controller Driver\Application\iusb3mon.exe
C:\UPS\WSTD\WSTDMessaging.exe
C:\Program Files (x86)\HP\HP Software Update\hpwuschd2.exe
C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe
C:\Program Files\WinZip\WzPreloader.exe
C:\Program Files\WinZip\FAHWindow64.exe
C:\Program Files (x86)\LogMeIn Hamachi\hamachi-2-ui.exe
C:\Windows\system32\SearchIndexer.exe
C:\Program Files\Windows Media Player\wmpnetwk.exe
C:\Program Files (x86)\TeamViewer\tv_w32.exe
C:\Program Files (x86)\TeamViewer\tv_x64.exe
C:\Windows\system32\svchost.exe -k LocalServiceAndNoImpersonation
C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\DAL\jhi_service.exe
C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\LMS\LMS.exe
C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
C:\Program Files (x86)\Common Files\Java\Java Update\jucheck.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\Program Files\Mozilla Firefox\plugin-container.exe
C:\Windows\system32\SearchProtocolHost.exe
C:\Windows\system32\SearchFilterHost.exe
C:\Windows\system32\wbem\wmiprvse.exe
C:\Windows\System32\cscript.exe
.
============== Pseudo HJT Report ===============
.
uStart Page = hxxp://google.com/
uDefault_Page_URL = hxxp://www.dell.com
mStart Page = hxxp://www.bing.com/search?FORM=INCOH1&PC=IC05&PTAG=ICO-79f4e1c8
uProxyServer = hxxp=127.0.0.1:0
uProxyOverride = <-loopback>
mWinlogon: Userinit = userinit.exe,
BHO: Groove GFS Browser Helper: {72853161-30C5-4D22-B7F9-0BBC1D38A37E} - C:\Program Files (x86)\Microsoft Office\Office14\GROOVEEX.DLL
BHO: Java(tm) Plug-In SSV Helper: {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files (x86)\Java\jre1.8.0_91\bin\ssv.dll
BHO: Office Document Cache Handler: {B4F3A835-0E21-4959-BA22-42B3008E02FF} - C:\Program Files (x86)\Microsoft Office\Office14\URLREDIR.DLL
BHO: Java(tm) Plug-In 2 SSV Helper: {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files (x86)\Java\jre1.8.0_91\bin\jp2ssv.dll
uRun: [GoogleChromeAutoLaunch_BCEA24321E5E4F1401136BBEDFB545FE] "C:\Program Files (x86)\Google\Chrome\Application\chrome.exe" --no-startup-window
uRun: [OutfoxTV] C:\Program Files\OutfoxTV\OutfoxTV\DesktopContainer.exe
uRun: [HP Officejet Pro 8610 (NET)] "C:\Program Files\HP\HP Officejet Pro 8610\Bin\ScanToPCActivationApp.exe" -deviceID "CN4APD3061:NW" -scfn "HP Officejet Pro 8610 (NET)" -AutoStart 1
uRun: [OfficeSyncProcess] "C:\Program Files (x86)\Microsoft Office\Office14\MSOSYNC.EXE"
uRun: [SansaDispatch] C:\Users\User\AppData\Roaming\SanDisk\Sansa Updater\SansaDispatch.exe
uRun: [Wondershare Helper Compact.exe] "C:\Program Files (x86)\Common Files\Wondershare\Wondershare Helper Compact\WSHelperSetup.exe"
uRun: [Chromium] "c:\users\user\appdata\local\chromium\application\chrome.exe" --auto-launch-at-startup --profile-directory="Default" --restore-last-session --restore-last-session
mRun: [USB3MON] "C:\Program Files (x86)\Intel\Intel(R) USB 3.0 eXtensible Host Controller Driver\Application\iusb3mon.exe"
mRun: [BCSSync] "C:\Program Files (x86)\Microsoft Office\Office14\BCSSync.exe" /DelayServices
mRun: [PeachtreePrefetcher.exe] "C:\PROGRA~2\SAGESO~1\PEACHT~1\PeachtreePrefetcher.exe" /configfile:peachtreeprefetcher.winstart.config
mRun: [HP Software Update] C:\Program Files (x86)\Hp\HP Software Update\HPWuSchd2.exe
mRun: [SunJavaUpdateSched] "C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe"
mRun: [Wondershare Helper Compact.exe] C:\Program Files (x86)\Common Files\Wondershare\Wondershare Helper Compact\WSHelper.exe
mRun: [WSUpdater] C:\UPS\WSTD\CF\WorldShipCF.exe
mRun: [NA1Messenger] C:\UPS\WSTD\UPSNA1Msgr.exe
mRun: [Intuit SyncManager] C:\Program Files (x86)\Common Files\Intuit\Sync\IntuitSyncManager.exe startup
mRun: [LogMeIn Hamachi Ui] "C:\Program Files (x86)\LogMeIn Hamachi\hamachi-2-ui.exe" --auto-start
StartupFolder: C:\Users\User\AppData\Roaming\MICROS~1\Windows\STARTM~1\Programs\Startup\VERIZO~1.LNK - C:\Users\User\AppData\Roaming\VERIZON\UA_ar\UA.exe
StartupFolder: C:\PROGRA~3\MICROS~1\Windows\STARTM~1\Programs\Startup\FAH.lnk - C:\Program Files\WinZip\FAHConsole.exe
StartupFolder: C:\PROGRA~3\MICROS~1\Windows\STARTM~1\Programs\Startup\INTUIT~1.LNK - C:\Program Files (x86)\Common Files\Intuit\DataProtect\IntuitDataProtect.exe
StartupFolder: C:\PROGRA~3\MICROS~1\Windows\STARTM~1\Programs\Startup\MCAFEE~1.LNK - C:\Program Files\McAfee Security Scan\3.11.587\SSScheduler.exe
StartupFolder: C:\PROGRA~3\MICROS~1\Windows\STARTM~1\Programs\Startup\QUICKB~2.LNK - C:\Program Files (x86)\Common Files\Intuit\QuickBooks\QBUpdate\qbupdate.exe
StartupFolder: C:\PROGRA~3\MICROS~1\Windows\STARTM~1\Programs\Startup\QUICKB~1.LNK - C:\Program Files (x86)\Intuit\QuickBooks 2016\QBW32.EXE
StartupFolder: C:\PROGRA~3\MICROS~1\Windows\STARTM~1\Programs\Startup\UPDATE~1.LNK - C:\Program Files\WinZip\WZUpdateNotifier.exe
StartupFolder: C:\PROGRA~3\MICROS~1\Windows\STARTM~1\Programs\Startup\UPSWOR~2.LNK - C:\UPS\WSTD\WSTDMessaging.exe
StartupFolder: C:\PROGRA~3\MICROS~1\Windows\STARTM~1\Programs\Startup\UPSWOR~1.LNK - C:\UPS\WSTD\wstdPldReminder.exe
StartupFolder: C:\PROGRA~3\MICROS~1\Windows\STARTM~1\Programs\Startup\WINZIP~1.LNK - C:\Program Files\WinZip\WzPreloader.exe
mPolicies-Explorer: NoActiveDesktop = dword:1
mPolicies-Explorer: NoActiveDesktopChanges = dword:1
mPolicies-System: ConsentPromptBehaviorAdmin = dword:5
mPolicies-System: ConsentPromptBehaviorUser = dword:3
mPolicies-System: EnableUIADesktopToggle = dword:0
IE: E&xport to Microsoft Excel - C:\PROGRA~2\MICROS~1\Office14\EXCEL.EXE/3000
IE: Se&nd to OneNote - C:\PROGRA~2\MICROS~1\Office14\ONBttnIE.dll/105
IE: {22CC3EBD-C286-43aa-B8E6-06B115F74162} - C:\Program Files (x86)\Hewlett-Packard\Smart Print\SmartPrintSetup.exe
IE: {2670000A-7350-4f3c-8081-5663EE0C6C49} - {48E73304-E1D6-4330-914C-F5F514E3486C} - C:\Program Files (x86)\Microsoft Office\Office14\ONBttnIE.dll
IE: {789FE86F-6FC4-46A1-9849-EDE0DB0C95CA} - {FFFDC614-B694-4AE6-AB38-5D6374584B52} - C:\Program Files (x86)\Microsoft Office\Office14\ONBttnIELinkedNotes.dll
DPF: {FD0B6769-6490-4A91-AA0A-B5AE0DC75AC9} - hxxps://secure.logmein.com//activex/ractrl.cab?lmi=1082
TCP: Interfaces\{B37A4D2F-0672-49A2-BFA4-9FDEC62AD564} : DHCPNameServer = 192.168.1.1
Filter: text/xml - {807573E5-5146-11D5-A672-00B0D022E945} - C:\Program Files (x86)\Common Files\Microsoft Shared\OFFICE14\MSOXMLMF.DLL
Handler: intu-help-qb9 - {C1252096-0E63-4C06-A38B-03DF9A16AA12} - C:\Program Files (x86)\Intuit\QuickBooks 2016\HelpAsyncPluggableProtocol.dll
Handler: qbwc - {FC598A64-626C-4447-85B8-53150405FD57} -
SSODL: WebCheck - <orphaned>
SEH: Groove GFS Stub Execution Hook - {B5A7F190-DDA6-4420-B3BA-52453494E6CD} - C:\Program Files (x86)\Microsoft Office\Office14\GROOVEEX.DLL
mASetup: {8A69D345-D564-463c-AFF1-A69D9E530F96} - "C:\Program Files (x86)\Google\Chrome\Application\57.0.2987.133\Installer\chrmstp.exe" --configure-user-settings --verbose-logging --system-level
x64-mStart Page = hxxp://www.bing.com/search?FORM=INCOH1&PC=IC05&PTAG=ICO-79f4e1c8
x64-BHO: Groove GFS Browser Helper: {72853161-30C5-4D22-B7F9-0BBC1D38A37E} - C:\Program Files\Microsoft Office\Office14\GROOVEEX.DLL
x64-BHO: Office Document Cache Handler: {B4F3A835-0E21-4959-BA22-42B3008E02FF} - C:\Program Files\Microsoft Office\Office14\URLREDIR.DLL
x64-Run: [RTHDVCPL] "C:\Program Files\Realtek\Audio\HDA\RtkNGUI64.exe" -s
x64-Run: [RtHDVBg] "C:\Program Files\Realtek\Audio\HDA\RAVBg64.exe" /MAXX4P1
x64-Run: [RtHDVBg_PushButton] "C:\Program Files\Realtek\Audio\HDA\RAVBg64.exe" /IM
x64-Run: [IgfxTray] "C:\Windows\System32\igfxtray.exe"
x64-Run: [HotKeysCmds] "C:\Windows\System32\hkcmd.exe"
x64-Run: [Persistence] "C:\Windows\System32\igfxpers.exe"
x64-Run: [MSC] "c:\Program Files\Microsoft Security Client\msseces.exe" -hide -runkey
x64-Run: [LogMeIn GUI] "C:\Program Files (x86)\LogMeIn\x64\LogMeInSystray.exe"
x64-IE: {22CC3EBD-C286-43aa-B8E6-06B115F74162} - C:\Program Files (x86)\Hewlett-Packard\Smart Print\SmartPrintSetup.exe
x64-IE: {2670000A-7350-4f3c-8081-5663EE0C6C49} - {48E73304-E1D6-4330-914C-F5F514E3486C} - C:\Program Files\Microsoft Office\Office14\ONBttnIE.dll
x64-IE: {789FE86F-6FC4-46A1-9849-EDE0DB0C95CA} - {FFFDC614-B694-4AE6-AB38-5D6374584B52} - C:\Program Files\Microsoft Office\Office14\ONBttnIELinkedNotes.dll
x64-Filter: text/xml - {807573E5-5146-11D5-A672-00B0D022E945} - C:\Program Files\Common Files\Microsoft Shared\OFFICE14\MSOXMLMF.DLL
x64-Handler: intu-help-qb9 - {C1252096-0E63-4C06-A38B-03DF9A16AA12} - <orphaned>
x64-Handler: qbwc - {FC598A64-626C-4447-85B8-53150405FD57} - <orphaned>
x64-Notify: igfxcui - igfxdev.dll
x64-SSODL: WebCheck - <orphaned>
x64-SEH: Groove GFS Stub Execution Hook - {B5A7F190-DDA6-4420-B3BA-52453494E6CD} - C:\Program Files\Microsoft Office\Office14\GROOVEEX.DLL
x64-mASetup: {8A69D345-D564-463c-AFF1-A69D9E530F96} - "C:\Program Files (x86)\Google\Chrome\Application\60.0.3112.101\Installer\chrmstp.exe" --configure-user-settings --verbose-logging --system-level
Hosts: 0.0.0.1 mssplus.mcafee.com
================= FIREFOX ===================
.
FF - ProfilePath - C:\Users\User\AppData\Roaming\Mozilla\Firefox\Profiles\t0ak0oll.default-1409260473120\
FF - prefs.js: browser.search.selectedEngine - Search Provided by Bing
FF - prefs.js: browser.startup.homepage - hxxp://www.google.com/
FF - plugin: C:\PROGRA~1\MICROS~1\Office14\NPAUTHZ.DLL
FF - plugin: C:\Windows\System32\Macromed\Flash\NPSWF64_26_0_0_151.dll
.
============= SERVICES / DRIVERS ===============
.
R0 iusb3hcs;Intel(R) USB 3.0 Host Controller Switch Driver;C:\Windows\System32\drivers\iusb3hcs.sys [2014-2-23 20464]
R0 MpFilter;Microsoft Malware Protection Driver;C:\Windows\System32\drivers\MpFilter.sys [2016-8-25 295000]
R2 AERTFilters;Andrea RT Filters Service;C:\Program Files\Realtek\Audio\HDA\AERTSr64.exe [2014-2-23 98208]
R2 DiagTrack;Diagnostics Tracking Service;C:\Windows\System32\svchost.exe -k utcsvc [2009-7-13 27136]
R2 Hamachi2Svc;LogMeIn Hamachi Tunneling Engine;C:\Program Files (x86)\LogMeIn Hamachi\x64\hamachi-2.exe [2017-6-29 3418024]
R2 Intel(R) Capability Licensing Service Interface;Intel(R) Capability Licensing Service Interface;C:\Program Files\Intel\iCLS Client\HeciServer.exe [2013-5-11 733696]
R2 jhi_service;Intel(R) Dynamic Application Loader Host Interface Service;C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\DAL\jhi_service.exe [2014-2-23 169432]
R2 LMIGuardianSvc;LMIGuardianSvc;C:\Program Files (x86)\LogMeIn Hamachi\x64\LMIGuardianSvc.exe [2016-5-27 419248]
R2 LMIInfo;LogMeIn Kernel Information Provider;C:\Windows\System32\drivers\LMIInfo.sys [2017-4-6 30432]
R2 LMIRfsDriver;LogMeIn Remote File System Driver;C:\Windows\System32\drivers\LMIRfsDriver.sys [2014-4-3 81088]
R2 MSSQL$UPSWS2012SERVER;SQL Server (UPSWS2012SERVER);C:\UPS\WSTD\WSDB\MSSQL11.UPSWS2012SERVER\MSSQL\Binn\sqlservr.exe [2017-7-7 163008]
R2 psqlWGE;Pervasive PSQL Workgroup Engine;C:\Program Files (x86)\Pervasive Software\PSQL\bin\w3dbsmgr.exe [2008-6-6 435496]
R2 QBVSS;QBIDPService;C:\Program Files (x86)\Common Files\Intuit\DataProtect\QBIDPService.exe [2015-10-22 1248256]
R2 RtkAudioService;Realtek Audio Service;C:\Program Files\Realtek\Audio\HDA\RtkAudioService64.exe [2014-2-23 246488]
R2 ss_conn_service;SAMSUNG Mobile Connectivity Service;C:\Program Files (x86)\Samsung\USB Drivers\27_ssconn\conn\ss_conn_service.exe [2017-7-18 752224]
R2 TeamViewer;TeamViewer 12;C:\Program Files (x86)\TeamViewer\TeamViewer_Service.exe [2015-12-29 10803440]
R3 iusb3hub;Intel(R) USB 3.0 Hub Driver;C:\Windows\System32\drivers\iusb3hub.sys [2014-2-23 368112]
R3 iusb3xhc;Intel(R) USB 3.0 eXtensible Host Controller Driver;C:\Windows\System32\drivers\iusb3xhc.sys [2014-2-23 786416]
R3 NisDrv;Microsoft Network Inspection System;C:\Windows\System32\drivers\NisDrvWFP.sys [2013-9-27 135928]
R3 NisSrv;Microsoft Network Inspection;C:\Program Files\Microsoft Security Client\NisSrv.exe [2016-11-14 361816]
R3 RSUSBSTOR;RtsUStor.Sys Realtek USB Card Reader;C:\Windows\System32\drivers\RtsUStor.sys [2014-2-23 263896]
R3 RTL8167;Realtek 8167 NT Driver;C:\Windows\System32\drivers\Rt64win7.sys [2014-2-23 849992]
S1 MpKslf43af98c;MpKslf43af98c;C:\ProgramData\Microsoft\Microsoft Antimalware\Definition Updates\{0B148B4E-55AE-405B-B3FE-F40810590201}\MpKslf43af98c.sys [2017-8-17 44928]
S2 clr_optimization_v4.0.30319_32;Microsoft .NET Framework NGEN v4.0.30319_X86;C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe [2017-3-26 105096]
S2 clr_optimization_v4.0.30319_64;Microsoft .NET Framework NGEN v4.0.30319_X64;C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe [2017-3-26 125064]
S3 dg_ssudbus;SAMSUNG Mobile USB Composite Device Driver (DEVGURU Ver.);C:\Windows\System32\drivers\ssudbus.sys [2017-5-18 131984]
S3 dmvsc;dmvsc;C:\Windows\System32\drivers\dmvsc.sys [2010-11-21 71168]
S3 IEEtwCollectorService;Internet Explorer ETW Collector Service;C:\Windows\System32\ieetwcollector.exe [2017-8-9 116224]
S3 IntcDAud;Intel(R) Display Audio;C:\Windows\System32\drivers\IntcDAud.sys [2014-2-23 452088]
S3 Intel(R) Capability Licensing Service TCP IP Interface;Intel(R) Capability Licensing Service TCP IP Interface;C:\Program Files\Intel\iCLS Client\SocketHeciServer.exe [2013-5-11 822232]
S3 MBAMSwissArmy;MBAMSwissArmy;C:\Windows\System32\drivers\MBAMSwissArmy.sys [2014-8-29 192216]
S3 McComponentHostService;McAfee Security Scan Component Host Service;C:\Program Files\McAfee Security Scan\3.11.587\McCHSvc.exe [2017-6-30 404376]
S3 nusb3hub;Renesas Electronics USB 3.0 Hub Driver;C:\Windows\System32\drivers\nusb3hub.sys [2011-2-15 80384]
S3 nusb3xhc;Renesas Electronics USB 3.0 Host Controller Driver;C:\Windows\System32\drivers\nusb3xhc.sys [2011-2-15 180736]
S3 ssudmdm;SAMSUNG Mobile USB Modem Drivers (DEVGURU Ver.);C:\Windows\System32\drivers\ssudmdm.sys [2017-5-18 166288]
S3 StorSvc;Storage Service;C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted [2009-7-13 27136]
S3 TsUsbFlt;TsUsbFlt;C:\Windows\System32\drivers\TsUsbFlt.sys [2010-11-20 59392]
S3 TsUsbGD;Remote Desktop Generic USB Device;C:\Windows\System32\drivers\TsUsbGD.sys [2010-11-20 31232]
S3 WatAdminSvc;Windows Activation Technologies Service;C:\Windows\System32\Wat\WatAdminSvc.exe [2014-3-3 1255736]
S3 WsDrvInst;Wondershare Driver Install Service;C:\Program Files (x86)\Wondershare\MobileTrans\DriverInstall.exe [2016-2-28 115856]
S4 SQLAgent$UPSWS2012SERVER;SQL Server Agent (UPSWS2012SERVER);C:\UPS\WSTD\WSDB\MSSQL11.UPSWS2012SERVER\MSSQL\Binn\SQLAGENT.EXE [2017-7-7 448704]
.
=============== Created Last 30 ================
.
2017-08-17 19:17:29 13476768 ----a-w- C:\ProgramData\Microsoft\Microsoft Antimalware\Definition Updates\{0B148B4E-55AE-405B-B3FE-F40810590201}\mpengine.dll
2017-08-17 19:16:04 13476768 ----a-w- C:\ProgramData\Microsoft\Microsoft Antimalware\Definition Updates\Backup\mpengine.dll
2017-08-11 08:29:29 1078240 ----a-w- C:\ProgramData\Microsoft\Microsoft Antimalware\Definition Updates\{98C65A73-CD58-42E3-BDC9-990909EF023D}\gapaengine.dll
2017-08-02 21:12:54 997056 ----a-w- C:\Program Files\Mozilla Firefox\ucrtbase.dll
2017-07-31 16:30:27 20208 ----a-w- C:\Windows\System32\Spool\prtprocs\x64\TeamViewer_PrintProcessor.dll
2017-07-19 20:27:28 57344 ----a-r- C:\Users\User\AppData\Roaming\Microsoft\Installer\{69258FD1-F4EE-475A-83D1-BF68C8029592}\NewShortcut11_98798AFA4B0B41FAA9B8FF8835A64952.exe
2017-07-19 20:27:28 57344 ----a-r- C:\Users\User\AppData\Roaming\Microsoft\Installer\{69258FD1-F4EE-475A-83D1-BF68C8029592}\NewShortcut1_3F3768693B314C7692F69858832BE52C.exe
2017-07-19 20:27:28 53248 ----a-r- C:\Users\User\AppData\Roaming\Microsoft\Installer\{69258FD1-F4EE-475A-83D1-BF68C8029592}\ARPPRODUCTICON.exe
2017-07-19 20:27:01 -------- d-----w- C:\Users\User\AppData\Roaming\VERIZON
.
==================== Find3M ====================
.
2017-08-16 21:21:24 192216 ----a-w- C:\Windows\System32\drivers\MBAMSwissArmy.sys
2017-08-09 07:11:08 803328 ----a-w- C:\Windows\SysWow64\FlashPlayerApp.exe
2017-08-09 07:11:08 144896 ----a-w- C:\Windows\SysWow64\FlashPlayerCPLApp.cpl
2017-08-02 19:32:34 114688 ----a-w- C:\Windows\System32\LMIRfsClientNP.dll
2017-08-02 19:32:33 109024 ----a-w- C:\Windows\System32\LMIinit.dll
2017-07-29 14:56:30 117248 ----a-w- C:\Windows\System32\drivers\tdx.sys
2017-07-21 14:26:31 282624 ----a-w- C:\Windows\SysWow64\mstext40.dll
2017-07-21 14:26:30 518144 ----a-w- C:\Windows\SysWow64\msjetoledb40.dll
2017-07-21 14:26:30 409600 ----a-w- C:\Windows\SysWow64\msexch40.dll
2017-07-21 14:26:30 290816 ----a-w- C:\Windows\SysWow64\msjtes40.dll
2017-07-14 15:29:15 486400 ----a-w- C:\Windows\System32\wer.dll
2017-07-14 15:29:15 34304 ----a-w- C:\Windows\System32\werdiagcontroller.dll
2017-07-14 15:29:14 2319872 ----a-w- C:\Windows\System32\tquery.dll
2017-07-14 15:29:10 2058240 ----a-w- C:\Windows\System32\Query.dll
2017-07-14 15:29:04 99840 ----a-w- C:\Windows\System32\mssprxy.dll
2017-07-14 15:29:04 778240 ----a-w- C:\Windows\System32\mssvp.dll
2017-07-14 15:29:04 75264 ----a-w- C:\Windows\System32\msscntrs.dll
2017-07-14 15:29:04 491520 ----a-w- C:\Windows\System32\mssph.dll
2017-07-14 15:29:04 288256 ----a-w- C:\Windows\System32\mssphtb.dll
2017-07-14 15:29:04 2222080 ----a-w- C:\Windows\System32\mssrch.dll
2017-07-14 15:29:04 14336 ----a-w- C:\Windows\System32\msshooks.dll
2017-07-14 15:29:04 115200 ----a-w- C:\Windows\System32\mssitlb.dll
2017-07-14 15:12:22 591872 ----a-w- C:\Windows\System32\SearchIndexer.exe
2017-07-14 15:12:14 249856 ----a-w- C:\Windows\System32\SearchProtocolHost.exe
2017-07-14 15:11:51 113664 ----a-w- C:\Windows\System32\SearchFilterHost.exe
2017-07-14 15:10:33 382976 ----a-w- C:\Windows\SysWow64\wer.dll
2017-07-14 15:10:32 1549824 ----a-w- C:\Windows\SysWow64\tquery.dll
2017-07-14 15:10:27 1363968 ----a-w- C:\Windows\SysWow64\Query.dll
2017-07-14 15:10:23 666624 ----a-w- C:\Windows\SysWow64\mssvp.dll
2017-07-14 15:10:23 59392 ----a-w- C:\Windows\SysWow64\msscntrs.dll
2017-07-14 15:10:23 34816 ----a-w- C:\Windows\SysWow64\mssprxy.dll
2017-07-14 15:10:23 337408 ----a-w- C:\Windows\SysWow64\mssph.dll
2017-07-14 15:10:23 197120 ----a-w- C:\Windows\SysWow64\mssphtb.dll
2017-07-14 15:10:23 1400320 ----a-w- C:\Windows\SysWow64\mssrch.dll
2017-07-14 15:10:23 104448 ----a-w- C:\Windows\SysWow64\mssitlb.dll
2017-07-14 15:00:23 427520 ----a-w- C:\Windows\SysWow64\SearchIndexer.exe
2017-07-14 15:00:11 164352 ----a-w- C:\Windows\SysWow64\SearchProtocolHost.exe
2017-07-14 14:59:33 86528 ----a-w- C:\Windows\SysWow64\SearchFilterHost.exe
2017-07-14 14:59:18 9728 ----a-w- C:\Windows\SysWow64\msshooks.dll
2017-07-14 14:57:38 50688 ----a-w- C:\Windows\System32\wermgr.exe
2017-07-14 14:50:25 54272 ----a-w- C:\Windows\SysWow64\wermgr.exe
2017-07-14 14:50:23 28672 ----a-w- C:\Windows\SysWow64\werdiagcontroller.dll
2017-07-14 07:16:17 2724864 ----a-w- C:\Windows\System32\mshtml.tlb
2017-07-14 07:15:32 4096 ----a-w- C:\Windows\System32\ieetwcollectorres.dll
2017-07-14 06:47:07 66560 ----a-w- C:\Windows\System32\iesetup.dll
2017-07-14 06:45:24 48640 ----a-w- C:\Windows\System32\ieetwproxystub.dll
2017-07-14 06:45:12 417792 ----a-w- C:\Windows\System32\html.iec
2017-07-14 06:44:09 576512 ----a-w- C:\Windows\System32\vbscript.dll
2017-07-14 06:44:07 88064 ----a-w- C:\Windows\System32\MshtmlDac.dll
2017-07-14 06:20:08 144384 ----a-w- C:\Windows\System32\ieUnatt.exe
2017-07-14 06:20:08 116224 ----a-w- C:\Windows\System32\ieetwcollector.exe
2017-07-14 06:19:36 814080 ----a-w- C:\Windows\System32\jscript9diag.dll
2017-07-14 06:08:23 968704 ----a-w- C:\Windows\System32\MsSpellCheckingFacility.exe
2017-07-14 05:49:39 77824 ----a-w- C:\Windows\System32\JavaScriptCollectionAgent.dll
2017-07-14 05:48:16 87552 ----a-w- C:\Windows\System32\tdc.ocx
2017-07-14 05:35:38 5981184 ----a-w- C:\Windows\System32\jscript9.dll
2017-07-14 05:09:44 1359360 ----a-w- C:\Windows\System32\mshtmlmedia.dll
2017-07-14 05:09:18 2132992 ----a-w- C:\Windows\System32\inetcpl.cpl
2017-07-14 04:23:17 3240960 ----a-w- C:\Windows\System32\wininet.dll
2017-07-14 03:01:05 2724864 ----a-w- C:\Windows\SysWow64\mshtml.tlb
2017-07-14 02:48:47 62464 ----a-w- C:\Windows\SysWow64\iesetup.dll
2017-07-14 02:48:43 499200 ----a-w- C:\Windows\SysWow64\vbscript.dll
2017-07-14 02:48:10 47616 ----a-w- C:\Windows\SysWow64\ieetwproxystub.dll
2017-07-14 02:48:01 341504 ----a-w- C:\Windows\SysWow64\html.iec
2017-07-14 02:47:13 64000 ----a-w- C:\Windows\SysWow64\MshtmlDac.dll
2017-07-14 02:38:44 115712 ----a-w- C:\Windows\SysWow64\ieUnatt.exe
2017-07-14 02:38:25 620032 ----a-w- C:\Windows\SysWow64\jscript9diag.dll
2017-07-14 02:26:20 60416 ----a-w- C:\Windows\SysWow64\JavaScriptCollectionAgent.dll
2017-07-14 02:25:47 73216 ----a-w- C:\Windows\SysWow64\tdc.ocx
2017-07-14 02:17:41 4546048 ----a-w- C:\Windows\SysWow64\jscript9.dll
2017-07-14 02:11:47 2057216 ----a-w- C:\Windows\SysWow64\inetcpl.cpl
2017-07-14 02:11:34 1155072 ----a-w- C:\Windows\SysWow64\mshtmlmedia.dll
2017-07-14 01:53:27 2767872 ----a-w- C:\Windows\SysWow64\wininet.dll
2017-07-08 15:34:46 370920 ----a-w- C:\Windows\System32\clfs.sys
2017-07-08 15:00:10 3224064 ----a-w- C:\Windows\System32\win32k.sys
2017-07-07 15:37:50 631176 ----a-w- C:\Windows\System32\winresume.efi
2017-07-07 15:33:37 706792 ----a-w- C:\Windows\System32\winload.efi
2017-07-07 15:33:36 363752 ----a-w- C:\Windows\System32\drivers\volmgrx.sys
2017-07-07 15:33:33 5547752 ----a-w- C:\Windows\System32\ntoskrnl.exe
2017-07-07 15:33:30 95464 ----a-w- C:\Windows\System32\drivers\ksecdd.sys
2017-07-07 15:33:30 154856 ----a-w- C:\Windows\System32\drivers\ksecpkg.sys
2017-07-07 15:31:14 1732864 ----a-w- C:\Windows\System32\ntdll.dll
2017-07-07 15:15:23 4001000 ----a-w- C:\Windows\SysWow64\ntkrnlpa.exe
2017-07-07 15:15:23 3945192 ----a-w- C:\Windows\SysWow64\ntoskrnl.exe
2017-07-07 15:13:31 1314112 ----a-w- C:\Windows\SysWow64\ntdll.dll
2017-07-07 15:10:59 60416 ----a-w- C:\Windows\SysWow64\msobjs.dll
2017-07-07 15:02:00 148480 ----a-w- C:\Windows\System32\appidpolicyconverter.exe
2017-07-07 15:01:54 62464 ----a-w- C:\Windows\System32\drivers\appid.sys
2017-07-07 15:01:54 17920 ----a-w- C:\Windows\System32\appidcertstorecheck.exe
2017-07-07 15:01:12 64000 ----a-w- C:\Windows\System32\auditpol.exe
2017-07-07 14:58:14 338432 ----a-w- C:\Windows\System32\conhost.exe
2017-07-07 14:57:23 296960 ----a-w- C:\Windows\System32\rstrui.exe
2017-07-07 14:54:44 159744 ----a-w- C:\Windows\System32\drivers\mrxsmb.sys
2017-07-07 14:54:10 291328 ----a-w- C:\Windows\System32\drivers\mrxsmb10.sys
2017-07-07 14:54:08 129536 ----a-w- C:\Windows\System32\drivers\mrxsmb20.sys
2017-07-07 14:53:26 30720 ----a-w- C:\Windows\System32\lsass.exe
2017-07-07 14:53:23 112640 ----a-w- C:\Windows\System32\smss.exe
2017-07-07 14:51:57 50176 ----a-w- C:\Windows\SysWow64\auditpol.exe
2017-07-07 14:48:27 25600 ----a-w- C:\Windows\SysWow64\setup16.exe
2017-07-07 14:48:26 7680 ----a-w- C:\Windows\SysWow64\instnm.exe
.
============= FINISH: 17:04:17.47 ===============


Also here the Malwarebytes

Malwarebytes Anti-Malware
www.malwarebytes.org

Scan Date: 8/7/2017
Scan Time: 6:46 PM
Logfile: Malwarebytes.txt
Administrator: Yes

Version: 2.2.1.1043
Malware Database: v2017.08.07.09
Rootkit Database: v2017.08.02.01
License: Free
Malware Protection: Disabled
Malicious Website Protection: Disabled
Self-protection: Disabled

OS: Windows 7 Service Pack 1
CPU: x64
File System: NTFS
User: User

Scan Type: Custom Scan
Result: Completed
Objects Scanned: 597507
Time Elapsed: 4 hr, 15 min, 47 sec

Memory: Enabled
Startup: Enabled
Filesystem: Enabled
Archives: Enabled
Rootkits: Enabled
Heuristics: Enabled
PUP: Enabled
PUM: Enabled

Processes: 0
(No malicious items detected)

Modules: 0
(No malicious items detected)

Registry Keys: 0
(No malicious items detected)

Registry Values: 0
(No malicious items detected)

Registry Data: 0
(No malicious items detected)

Folders: 11
PUP.Optional.Spigot.Generic, C:\Users\User\AppData\Local\Google\Chrome\User Data\Default\Extensions\egechnfgfhgcccjdkinlbbaahnbobpok\3.1_0, Quarantined, [760f8208bceda096769b12557b858e72],
PUP.Optional.Spigot.Generic, C:\Users\User\AppData\Local\Google\Chrome\User Data\Default\Extensions\egechnfgfhgcccjdkinlbbaahnbobpok\3.1_0\css, Quarantined, [760f8208bceda096769b12557b858e72],
PUP.Optional.Spigot.Generic, C:\Users\User\AppData\Local\Google\Chrome\User Data\Default\Extensions\egechnfgfhgcccjdkinlbbaahnbobpok\3.1_0\html, Quarantined, [760f8208bceda096769b12557b858e72],
PUP.Optional.Spigot.Generic, C:\Users\User\AppData\Local\Google\Chrome\User Data\Default\Extensions\egechnfgfhgcccjdkinlbbaahnbobpok\3.1_0\html\popup, Quarantined, [760f8208bceda096769b12557b858e72],
PUP.Optional.Spigot.Generic, C:\Users\User\AppData\Local\Google\Chrome\User Data\Default\Extensions\egechnfgfhgcccjdkinlbbaahnbobpok\3.1_0\js, Quarantined, [760f8208bceda096769b12557b858e72],
PUP.Optional.Spigot.Generic, C:\Users\User\AppData\Local\Google\Chrome\User Data\Default\Extensions\egechnfgfhgcccjdkinlbbaahnbobpok\3.1_0\js\popup, Quarantined, [760f8208bceda096769b12557b858e72],
PUP.Optional.Spigot.Generic, C:\Users\User\AppData\Local\Google\Chrome\User Data\Default\Extensions\egechnfgfhgcccjdkinlbbaahnbobpok\3.1_0\newtab, Quarantined, [760f8208bceda096769b12557b858e72],
PUP.Optional.Spigot.Generic, C:\Users\User\AppData\Local\Google\Chrome\User Data\Default\Extensions\egechnfgfhgcccjdkinlbbaahnbobpok\3.1_0\_locales, Quarantined, [760f8208bceda096769b12557b858e72],
PUP.Optional.Spigot.Generic, C:\Users\User\AppData\Local\Google\Chrome\User Data\Default\Extensions\egechnfgfhgcccjdkinlbbaahnbobpok\3.1_0\_locales\en, Quarantined, [760f8208bceda096769b12557b858e72],
PUP.Optional.Spigot.Generic, C:\Users\User\AppData\Local\Google\Chrome\User Data\Default\Extensions\egechnfgfhgcccjdkinlbbaahnbobpok\3.1_0\_metadata, Quarantined, [760f8208bceda096769b12557b858e72],
PUP.Optional.Spigot.Generic, C:\Users\User\AppData\Local\Google\Chrome\User Data\Default\Extensions\egechnfgfhgcccjdkinlbbaahnbobpok, Quarantined, [760f8208bceda096769b12557b858e72],

Files: 19
PUP.Optional.Conduit, C:\Users\User\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\57VB05R8\spstub[1].exe, Quarantined, [cabbee9cc6e33ff7dcaa9075e61ba759],
PUP.Optional.Conduit, C:\Users\User\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\57VB05R8\SPSetup[1].exe, Quarantined, [1c69a6e434755ed8e8a14db8ca37b44c],
PUP.Optional.Conduit, C:\Users\User\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\XW0IEXP0\SPSetup[1].exe, Quarantined, [a9dcddad3f6ad660c1c864a13dc427d9],
PUP.Optional.SearchProtect, C:\Users\User\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\XW0IEXP0\SearchProtectGeneric2[1].exe, Quarantined, [6b1a5f2b4c5d191d7f20b7f3a55b12ee],
PUP.Optional.BrowseFox, C:\Users\User\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\XW0IEXP0\PlurPush_ob[1].exe, Quarantined, [5332f89291184bebe621d309d13104fc],
PUP.Optional.Spigot.Generic, C:\Users\User\AppData\Local\Google\Chrome\User Data\Default\Extensions\egechnfgfhgcccjdkinlbbaahnbobpok\3.1_0\background.js, Quarantined, [760f8208bceda096769b12557b858e72],
PUP.Optional.Spigot.Generic, C:\Users\User\AppData\Local\Google\Chrome\User Data\Default\Extensions\egechnfgfhgcccjdkinlbbaahnbobpok\3.1_0\contentscript.js, Quarantined, [760f8208bceda096769b12557b858e72],
PUP.Optional.Spigot.Generic, C:\Users\User\AppData\Local\Google\Chrome\User Data\Default\Extensions\egechnfgfhgcccjdkinlbbaahnbobpok\3.1_0\icon.png, Quarantined, [760f8208bceda096769b12557b858e72],
PUP.Optional.Spigot.Generic, C:\Users\User\AppData\Local\Google\Chrome\User Data\Default\Extensions\egechnfgfhgcccjdkinlbbaahnbobpok\3.1_0\manifest.json, Quarantined, [760f8208bceda096769b12557b858e72],
PUP.Optional.Spigot.Generic, C:\Users\User\AppData\Local\Google\Chrome\User Data\Default\Extensions\egechnfgfhgcccjdkinlbbaahnbobpok\3.1_0\css\description.css, Quarantined, [760f8208bceda096769b12557b858e72],
PUP.Optional.Spigot.Generic, C:\Users\User\AppData\Local\Google\Chrome\User Data\Default\Extensions\egechnfgfhgcccjdkinlbbaahnbobpok\3.1_0\css\popup.css, Quarantined, [760f8208bceda096769b12557b858e72],
PUP.Optional.Spigot.Generic, C:\Users\User\AppData\Local\Google\Chrome\User Data\Default\Extensions\egechnfgfhgcccjdkinlbbaahnbobpok\3.1_0\html\popup\description.html, Quarantined, [760f8208bceda096769b12557b858e72],
PUP.Optional.Spigot.Generic, C:\Users\User\AppData\Local\Google\Chrome\User Data\Default\Extensions\egechnfgfhgcccjdkinlbbaahnbobpok\3.1_0\html\popup\popup.html, Quarantined, [760f8208bceda096769b12557b858e72],
PUP.Optional.Spigot.Generic, C:\Users\User\AppData\Local\Google\Chrome\User Data\Default\Extensions\egechnfgfhgcccjdkinlbbaahnbobpok\3.1_0\js\userNewTab.js, Quarantined, [760f8208bceda096769b12557b858e72],
PUP.Optional.Spigot.Generic, C:\Users\User\AppData\Local\Google\Chrome\User Data\Default\Extensions\egechnfgfhgcccjdkinlbbaahnbobpok\3.1_0\js\popup\popup.js, Quarantined, [760f8208bceda096769b12557b858e72],
PUP.Optional.Spigot.Generic, C:\Users\User\AppData\Local\Google\Chrome\User Data\Default\Extensions\egechnfgfhgcccjdkinlbbaahnbobpok\3.1_0\newtab\newtab.html, Quarantined, [760f8208bceda096769b12557b858e72],
PUP.Optional.Spigot.Generic, C:\Users\User\AppData\Local\Google\Chrome\User Data\Default\Extensions\egechnfgfhgcccjdkinlbbaahnbobpok\3.1_0\_locales\en\messages.json, Quarantined, [760f8208bceda096769b12557b858e72],
PUP.Optional.Spigot.Generic, C:\Users\User\AppData\Local\Google\Chrome\User Data\Default\Extensions\egechnfgfhgcccjdkinlbbaahnbobpok\3.1_0\_metadata\computed_hashes.json, Quarantined, [760f8208bceda096769b12557b858e72],
PUP.Optional.Spigot.Generic, C:\Users\User\AppData\Local\Google\Chrome\User Data\Default\Extensions\egechnfgfhgcccjdkinlbbaahnbobpok\3.1_0\_metadata\verified_contents.json, Quarantined, [760f8208bceda096769b12557b858e72],

Physical Sectors: 0
(No malicious items detected)


(end)

Attached Files

attach.txt (25.8 KB)

So for a long time now I've had someone remote viewing my computer a lot and making it obvious they are there. They click around on my computer, opening and closing windows, turning off the PC...they are making it blatantly obvious they're on my computer and they aren't hiding it.

They have the ability to crash the computer as well by maxing out my RAM, looking into resource monitor the process that is doing it is totally invisible.

I've tried SO many different antiviruses and malware removal tools only to find nothing. I went from windows 10 to ubuntu and they still were able to get on. I switched back to windows 10.


I little while back ESET 32 would constantly warn me of "ICMP flood attacks" coming from a computer on my network. I started using a VPN and those messages disappeared but the remote viewing did not.

I do live with my family and there is literally no chance they are doing any of this.

On my tablet, PC, and mothers computer, I found some weird Google Chrome virus that seemed to be tracking everything we were doing and sending the data to some website.

They know all of my passwords and bank info, but none of it has been touched yet. I just cannot understand what the hell they are doing. This has been going on and off for a very long time and I'm hopeless on what to do.

I've tried

• Reinstalled Windows
• Installed Ubuntu and used that, they still do it
• MalwareBytes
• ESET NOD 32
• Rogue Killer
• Adw cleaner
• Junkware removal tool
• FSS
• Temp File Cleaner
• Sophos virus removal tool
• ESET Powelikes cleaner
• DarkComet removal tool
• Disabled remote connections

Thank you for any assistance.I've tried a few other websites like this but it's generally the same thing, run a few scanners and report back. I'm curious if anyone knows any detailed knowledge about how they do this.

So like the title say i was informed by some good person here in techforum om microsoft support subforum and said my computer was infected so idk what kind of virus i got but i will put some notes down here some of i already send to my old thread

ECHO is on.

Host Name: USER-PC
OS Name: Microsoft Windows 7 Ultimate
OS Version: 6.1.7600 N/A Build 7600
OS Manufacturer: Microsoft Corporation
OS Configuration: Standalone Workstation
OS Build Type: Multiprocessor Free
Registered Owner: user
Registered Organization:
Product ID: 00426-OEM-8992662-00006
Original Install Date: 29/03/2014, 14:07:48
System Boot Time: 15/08/2017, 15:39:08
System Manufacturer: ECS
System Model: H61H2-MV
System Type: x64-based PC
Processor(s): 1 Processor(s) Installed.
[01]: Intel64 Family 6 Model 58 Stepping 9 GenuineIntel ~3000 Mhz
BIOS Version: American Megatrends Inc. 4.6.5, 29/05/2013
Windows Directory: C:\Windows
System Directory: C:\Windows\system32
Boot Device: \Device\HarddiskVolume2
System Locale: in;Indonesian
Input Locale: en-us;English (United States)
Time Zone: (UTC+07:00) Bangkok, Hanoi, Jakarta
Total Physical Memory: 4,047 MB
Available Physical Memory: 914 MB
Virtual Memory: Max Size: 16,187 MB
Virtual Memory: Available: 12,518 MB
Virtual Memory: In Use: 3,669 MB
Page File Location(s): C:\pagefile.sys
D:\pagefile.sys
E:\pagefile.sys
Domain: WORKGROUP
Logon Server: \\USER-PC
Network Card(s): 1 NIC(s) Installed.
[01]: Realtek PCIe FE Family Controller
Connection Name: Local Area Connection
DHCP Enabled: No
IP address(es)
[01]: 192.168.1.2
[02]: fe80::2c9b:f167:eef1:ef98








D e s c r i p t i o n = N V I D I A G e F o r c e G T 6 3 0

P N P D e v i c e I D = P C I \ V E N _ 1 0 D E & a m p ; D E V _ 0 F 0 0 & a m p ; S U B S Y S _ 6 1 9 9 1 9 D A & a m p ; R E V _ A 1 \ 4 & a m p ; A E B 7 6 A E & a m p ; 0 & a m p ; 0 0 0 8






Image Name PID Session Name Session# Mem Usage Status User Name CPU Time Window Title
========================= ======== ================ =========== ============ =============== ================================================== ============ ========================================================================
System Idle Process 0 Services 0 24 K Unknown NT AUTHORITY\SYSTEM 1:09:13 N/A
System 4 Services 0 972 K Unknown N/A 0:00:22 N/A
smss.exe 256 Services 0 900 K Unknown NT AUTHORITY\SYSTEM 0:00:00 N/A
csrss.exe 412 Services 0 3,408 K Unknown NT AUTHORITY\SYSTEM 0:00:00 N/A
wininit.exe 472 Services 0 3,700 K Unknown NT AUTHORITY\SYSTEM 0:00:00 N/A
csrss.exe 492 Console 1 9,152 K Running NT AUTHORITY\SYSTEM 0:00:02 N/A
services.exe 532 Services 0 6,900 K Unknown NT AUTHORITY\SYSTEM 0:00:01 N/A
lsass.exe 564 Services 0 9,292 K Unknown NT AUTHORITY\SYSTEM 0:00:02 N/A
lsm.exe 580 Services 0 3,624 K Unknown NT AUTHORITY\SYSTEM 0:00:00 N/A
winlogon.exe 588 Console 1 5,804 K Unknown NT AUTHORITY\SYSTEM 0:00:00 N/A
svchost.exe 732 Services 0 8,140 K Unknown NT AUTHORITY\SYSTEM 0:00:02 N/A
NVDisplay.Container.exe 788 Services 0 7,100 K Unknown NT AUTHORITY\SYSTEM 0:00:00 N/A
svchost.exe 840 Services 0 7,316 K Unknown NT AUTHORITY\NETWORK SERVICE 0:00:00 N/A
svchost.exe 888 Services 0 146,596 K Unknown NT AUTHORITY\SYSTEM 0:00:18 N/A
NVDisplay.Container.exe 948 Console 1 18,188 K Running NT AUTHORITY\SYSTEM 0:00:01 NvSvc
svchost.exe 984 Services 0 28,176 K Unknown NT AUTHORITY\SYSTEM 0:00:00 N/A
svchost.exe 420 Services 0 6,772 K Unknown NT AUTHORITY\SYSTEM 0:00:00 N/A
svchost.exe 1028 Services 0 6,960 K Unknown NT AUTHORITY\LOCAL SERVICE 0:00:00 N/A
svchost.exe 1152 Services 0 12,240 K Unknown NT AUTHORITY\NETWORK SERVICE 0:00:00 N/A
spoolsv.exe 1224 Services 0 12,128 K Unknown NT AUTHORITY\SYSTEM 0:00:01 N/A
svchost.exe 1256 Services 0 16,016 K Unknown NT AUTHORITY\LOCAL SERVICE 0:00:00 N/A
armsvc.exe 1596 Services 0 3,116 K Unknown NT AUTHORITY\SYSTEM 0:00:00 N/A
dwm.exe 1616 Console 1 25,576 K Running user-PC\user 0:00:55 DWM Notification Window
explorer.exe 1660 Console 1 43,496 K Running user-PC\user 0:00:08 N/A
IDMan.exe 1844 Console 1 15,300 K Running user-PC\user 0:00:00 Internet Download Manager
uTorrent.exe 1900 Console 1 29,048 K Running user-PC\user 0:00:01 æTorrent 3.5 (build 43916) [32-bit]
Discord.exe 1952 Console 1 63,760 K Running user-PC\user 0:00:56 #general - Discord
AppleMobileDeviceService. 1992 Services 0 7,684 K Unknown NT AUTHORITY\SYSTEM 0:00:00 N/A
DTShellHlp.exe 1556 Console 1 9,396 K Running user-PC\user 0:00:00 N/A
AdobeARM.exe 1388 Console 1 12,592 K Running user-PC\user 0:00:00 Adobe Reader Updater
mDNSResponder.exe 1716 Services 0 4,672 K Unknown NT AUTHORITY\SYSTEM 0:00:00 N/A
HD-LogRotatorService.exe 1308 Services 0 9,156 K Unknown NT AUTHORITY\SYSTEM 0:00:00 N/A
HiPatchService.exe 2012 Services 0 34,832 K Unknown NT AUTHORITY\SYSTEM 0:00:01 N/A
NBService.exe 2132 Services 0 6,812 K Unknown NT AUTHORITY\SYSTEM 0:00:00 N/A
PnkBstrA.exe 2244 Services 0 3,616 K Unknown NT AUTHORITY\SYSTEM 0:00:00 N/A
svchost.exe 2268 Services 0 4,592 K Unknown NT AUTHORITY\LOCAL SERVICE 0:00:00 N/A
utorrentie.exe 2432 Console 1 19,768 K Running user-PC\user 0:00:00 N/A
utorrentie.exe 2476 Console 1 17,876 K Running user-PC\user 0:00:00 N/A
svchost.exe 2768 Services 0 44,108 K Unknown NT AUTHORITY\LOCAL SERVICE 0:00:00 N/A
nvtray.exe 2936 Console 1 10,112 K Running user-PC\user 0:00:00 NotificationIconWindow
svchost.exe 3020 Services 0 23,132 K Unknown NT AUTHORITY\SYSTEM 0:00:08 N/A
Discord.exe 3320 Console 1 39,536 K Not Responding user-PC\user 0:02:05 AngleHiddenWindow
Discord.exe 4080 Console 1 162,232 K Running user-PC\user 0:03:43 MMDEVAPI Device Window
GoogleUpdate.exe 3804 Services 0 528 K Unknown NT AUTHORITY\SYSTEM 0:00:00 N/A
daemonu.exe 3884 Services 0 5,972 K Unknown user-PC\UpdatusUser 0:00:00 N/A
chrome.exe 1568 Console 1 163,708 K Running user-PC\user 0:00:41 No audio - Tech Support Forum - Google Chrome
chrome.exe 3016 Console 1 4,820 K Running user-PC\user 0:00:00 N/A
chrome.exe 3900 Console 1 5,192 K Running user-PC\user 0:00:00 N/A
chrome.exe 2740 Console 1 90,464 K Not Responding user-PC\user 0:00:22 AngleHiddenWindow
IEMonitor.exe 2156 Console 1 5,756 K Running user-PC\user 0:00:00 IDM agent for click monitoring in IE-based browsers
chrome.exe 4020 Console 1 25,508 K Unknown user-PC\user 0:00:00 N/A
chrome.exe 4032 Console 1 132,880 K Unknown user-PC\user 0:00:14 N/A
chrome.exe 1476 Console 1 188,304 K Unknown user-PC\user 0:00:14 N/A
audiodg.exe 2792 Services 0 3,760 K Unknown NT AUTHORITY\SYSTEM 0:00:00 N/A
chrome.exe 1884 Console 1 210,172 K Unknown user-PC\user 0:00:03 N/A
SeaPort.EXE 1352 Services 0 8,444 K Unknown NT AUTHORITY\SYSTEM 0:00:00 N/A
chrome.exe 3664 Console 1 482,896 K Unknown user-PC\user 0:00:17 N/A
chrome.exe 2864 Console 1 176,760 K Unknown user-PC\user 0:00:14 N/A
AppService.exe 568 Console 1 22,208 K Unknown user-PC\user 0:00:02 N/A
chrome.exe 3968 Console 1 95,780 K Unknown user-PC\user 0:00:01 N/A
chrome.exe 280 Console 1 50,164 K Unknown user-PC\user 0:00:00 N/A
WinRAR.exe 2832 Console 1 16,100 K Running user-PC\user 0:00:00 Philosopher-20170815T091422Z-001.zip - WinRAR (evaluation copy)
chrome.exe 3704 Console 1 246,652 K Unknown user-PC\user 0:00:12 N/A
WINWORD.EXE 3188 Console 1 46,448 K Running user-PC\user 0:00:03 Nametag_Peserta__OSKM_2017 - Microsoft Word
splwow64.exe 3224 Console 1 9,076 K Unknown user-PC\user 0:00:00 N/A
chrome.exe 2836 Console 1 116,068 K Unknown user-PC\user 0:00:01 N/A
chrome.exe 1748 Console 1 207,088 K Unknown user-PC\user 0:00:05 N/A
cmd.exe 3028 Console 1 2,872 K Running user-PC\user 0:00:00 tasklist /v
conhost.exe 3216 Console 1 5,280 K Running user-PC\user 0:00:00 OleMainThreadWndName
WmiPrvSE.exe 3792 Services 0 12,388 K Unknown NT AUTHORITY\NETWORK SERVICE 0:00:00 N/A
WmiPrvSE.exe 1800 Services 0 5,640 K Unknown NT AUTHORITY\LOCAL SERVICE 0:00:00 N/A
TrustedInstaller.exe 3768 Services 0 8,020 K Unknown NT AUTHORITY\SYSTEM 0:00:00 N/A
tasklist.exe 3680 Console 1 5,668 K Unknown user-PC\user 0:00:00 N/A
These Windows services are started:

Adobe Acrobat Update Service
Apple Mobile Device Service
Application Experience
Background Intelligent Transfer Service
Base Filtering Engine
BBUpdate
BlueStacks Log Rotator Service
Bonjour Service
COM+ Event System
Computer Browser
Cryptographic Services
DCOM Server Process Launcher
Desktop Window Manager Session Manager
Diagnostic Policy Service
Diagnostic Service Host
Distributed Link Tracking Client
DNS Client
Group Policy Client
Hi-Rez Studios Authenticate and Update Service
Human Interface Device Access
IKE and AuthIP IPsec Keying Modules
IP Helper
Nero BackItUp Scheduler 3
Network Connections
Network List Service
Network Location Awareness
Network Store Interface Service
NVIDIA Display Container LS
NVIDIA Update Service Daemon
Offline Files
Plug and Play
PnkBstrA
Power
Print Spooler
Program Compatibility Assistant Service
Remote Procedure Call (RPC)
RPC Endpoint Mapper
Security Accounts Manager
Server
Shell Hardware Detection
SSDP Discovery
Superfetch
System Event Notification Service
Themes
User Profile Service
Windows Audio
Windows Audio Endpoint Builder
Windows Defender
Windows Driver Foundation - User-mode Driver Framework
Windows Firewall
Windows Font Cache Service
Windows Image Acquisition (WIA)
Windows Management Instrumentation
Windows Modules Installer
Windows Update
Workstation

The command completed successfully.

ECHO is on.

and

ECHO is on.
[SC] QueryServiceConfig SUCCESS

SERVICE_NAME: MMCSS
TYPE : 20 WIN32_SHARE_PROCESS
START_TYPE : 2 AUTO_START
ERROR_CONTROL : 1 NORMAL
BINARY_PATH_NAME : C:\Windows\system32\svchost.exe -k netsvcs
LOAD_ORDER_GROUP :
TAG : 0
DISPLAY_NAME : Multimedia Class Scheduler
DEPENDENCIES :
SERVICE_START_NAME : LocalSystem

SERVICE_NAME: MMCSS
TYPE : 20 WIN32_SHARE_PROCESS
STATE : 1 STOPPED
WIN32_EXIT_CODE : 0 (0x0)
SERVICE_EXIT_CODE : 0 (0x0)
CHECKPOINT : 0x0
WAIT_HINT : 0x0
PID : 0
FLAGS :
ECHO is on.

fyi i already auto started the multimedia class scheduler so the people there siad chance my pc got infected

Hello,

I'm trying to clean up my parents computer for them. They have absolutely no idea how to take care of a computer. They have Norton Antivirus, but no sense of how to protect themselves from malware. There's probably about 4-5 years worth of malware build up on this computer. I tried posting this before, but it didn't work. I'm not sure if it was the computer or if maybe I didn't complete the post. Neither would surprise me.

Please help!!

DDS (Ver_2012-11-20.01) - NTFS_AMD64
Internet Explorer: 11.0.15063.0
Run by Robert at 20:49:32 on 2017-08-11
Microsoft Windows 10 Home 10.0.15063.0.1252.1.1033.18.3839.1642 [GMT -4:00]
.
AV: Windows Defender *Disabled/Updated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
AV: Norton 360 Premier *Enabled/Updated* {30744133-1E94-7B35-F4A3-82A5AEF1CBAA}
SP: Windows Defender *Disabled/Updated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
SP: Norton 360 Premier *Enabled/Updated* {8B15A0D7-38AE-74BB-CE13-B9D7D5768117}
FW: Norton 360 Premier *Enabled* {084FC016-54FB-7A6D-DFFC-2B9050228CD1}
.
============== Running Processes ===============
.
c:\windows\system32\svchost.exe -k dcomlaunch -s PlugPlay
C:\WINDOWS\system32\fontdrvhost.exe
C:\WINDOWS\system32\svchost.exe -k DcomLaunch
C:\WINDOWS\system32\fontdrvhost.exe
c:\windows\system32\svchost.exe -k rpcss
c:\windows\system32\svchost.exe -k dcomlaunch -s LSM
C:\WINDOWS\system32\dwm.exe
c:\windows\system32\svchost.exe -k localsystemnetworkrestricted -s NcbService
c:\windows\system32\svchost.exe -k localsystemnetworkrestricted -s hidserv
c:\windows\system32\svchost.exe -k localsystemnetworkrestricted -s TabletInputService
c:\windows\system32\svchost.exe -k localservicenetworkrestricted -s TimeBrokerSvc
c:\windows\system32\svchost.exe -k localservicenetworkrestricted -s EventLog
c:\windows\system32\svchost.exe -k localservice -s nsi
C:\WINDOWS\system32\svchost.exe -k LocalSystemNetworkRestricted
C:\WINDOWS\system32\atiesrxx.exe
c:\windows\system32\svchost.exe -k netsvcs -s ProfSvc
c:\windows\system32\svchost.exe -k netsvcs -s Themes
c:\windows\system32\svchost.exe -k localservice -s EventSystem
c:\windows\system32\svchost.exe -k netsvcs -s Schedule
c:\windows\system32\svchost.exe -k netsvcs -s SENS
c:\windows\system32\svchost.exe -k localsystemnetworkrestricted -s AudioEndpointBuilder
c:\windows\system32\svchost.exe -k localservice -s FontCache
C:\WINDOWS\System32\svchost.exe -k LocalServiceNetworkRestricted
C:\WINDOWS\System32\svchost.exe -k LocalServiceNetworkRestricted
c:\windows\system32\svchost.exe -k appmodel -s StateRepository
c:\windows\system32\svchost.exe -k localservicenetworkrestricted -s Dhcp
C:\WINDOWS\system32\svchost.exe -k LocalServiceNetworkRestricted
c:\windows\system32\svchost.exe -k networkservice -s Dnscache
c:\windows\system32\svchost.exe -k netsvcs -s UserManager
c:\windows\system32\svchost.exe -k networkservice -s NlaSvc
C:\Windows\System32\WUDFHost.exe
c:\windows\system32\svchost.exe -k localservice -s netprofm
C:\WINDOWS\system32\svchost.exe -k LocalSystemNetworkRestricted
c:\windows\system32\svchost.exe -k netsvcs -s ShellHWDetection
C:\WINDOWS\system32\svchost.exe -k LocalService
c:\windows\system32\svchost.exe -k localserviceandnoimpersonation -s FDResPub
C:\WINDOWS\System32\spoolsv.exe
c:\windows\system32\svchost.exe -k localservice -s WinHttpAutoProxySvc
c:\windows\system32\svchost.exe -k netsvcs -s Winmgmt
c:\windows\system32\svchost.exe -k localservicenonetwork
c:\windows\system32\svchost.exe -k localservicenetworkrestricted -s HomeGroupProvider
c:\windows\system32\svchost.exe -k networkservice -s LanmanWorkstation
c:\windows\system32\svchost.exe -k netsvcs -s IKEEXT
c:\windows\system32\svchost.exe -k networkservicenetworkrestricted -s PolicyAgent
c:\windows\system32\svchost.exe -k apphost -s AppHostSvc
C:\Program Files\Realtek\Audio\HDA\AERTSr64.EXE
c:\windows\system32\svchost.exe -k networkservice -s CryptSvc
c:\windows\system32\svchost.exe -k localsystemnetworkrestricted -s DeviceAssociationService
C:\WINDOWS\System32\svchost.exe -k utcsvc
c:\windows\system32\svchost.exe -k localservicenonetwork -s DPS
c:\windows\system32\svchost.exe -k netsvcs -s iphlpsvc
c:\windows\system32\svchost.exe -k iissvcs
C:\Program Files\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe
c:\windows\system32\svchost.exe -k localsystemnetworkrestricted -s PcaSvc
C:\Program Files\Bonjour\mDNSResponder.exe
C:\Program Files (x86)\Microsoft Application Virtualization Client\sftvsa.exe
c:\windows\system32\svchost.exe -k netsvcs -s WpnService
c:\windows\system32\svchost.exe -k netsvcs
c:\windows\system32\svchost.exe -k localsystemnetworkrestricted -s TrkWks
C:\WINDOWS\system32\svchost.exe -k imgsvc
c:\windows\system32\svchost.exe -k localsystemnetworkrestricted -s SysMain
C:\Program Files (x86)\Norton 360\Engine\22.10.0.85\N360.exe
C:\Program Files\Microsoft Office 15\ClientX64\OfficeClickToRun.exe
c:\windows\system32\svchost.exe -k netsvcs -s LanmanServer
c:\windows\system32\svchost.exe -k localservice -s WdiServiceHost
C:\WINDOWS\system32\dashost.exe
C:\WINDOWS\system32\mqsvc.exe
c:\windows\system32\svchost.exe -k localserviceandnoimpersonation -s SSDPSRV
c:\windows\system32\svchost.exe -k appmodel -s tiledatamodelsvc
c:\windows\system32\svchost.exe -k netsvcs -s Browser
c:\windows\microsoft.net\framework64\v4.0.30319\smsvchost.exe
c:\windows\microsoft.net\framework64\v4.0.30319\smsvchost.exe
C:\Program Files (x86)\Microsoft Application Virtualization Client\sftlist.exe
c:\windows\system32\svchost.exe -k localservice -s CDPSvc
C:\Program Files (x86)\Common Files\Microsoft Shared\Virtualization Handler\CVHSVC.EXE
c:\windows\system32\svchost.exe -k netsvcs -s DoSvc
C:\Program Files (x86)\Hewlett-Packard\HP Support Solutions\HPSupportSolutionsFrameworkService.exe
c:\windows\system32\svchost.exe -k localsystemnetworkrestricted -s StorSvc
C:\Program Files (x86)\Common Files\Intuit\Update Service v4\IntuitUpdateService.exe
c:\windows\system32\svchost.exe -k localservicenetworkrestricted -s wscsvc
C:\WINDOWS\system32\atieclxx.exe
c:\windows\system32\svchost.exe -k netsvcs -s lfsvc
c:\windows\system32\sihost.exe
c:\windows\system32\svchost.exe -k unistacksvcgroup -s CDPUserSvc
C:\Program Files (x86)\Norton 360\Engine\22.10.0.85\N360.exe
C:\WINDOWS\Explorer.EXE
c:\windows\system32\svchost.exe -k unistacksvcgroup -s WpnUserService
c:\windows\system32\svchost.exe -k netsvcs -s TokenBroker
c:\windows\system32\taskhostw.exe
C:\Windows\SystemApps\ShellExperienceHost_cw5n1h2txyewy\ShellExperienceHost.exe
C:\Windows\System32\RuntimeBroker.exe
c:\windows\system32\svchost.exe -k localservice -s LicenseManager
C:\Program Files\WindowsApps\Microsoft.SkypeApp_11.19.820.0_x64__kzf8qxf38zg5c\SkypeHost.exe
C:\Program Files\Common Files\microsoft shared\ink\TabTip.exe
C:\Program Files (x86)\Common Files\Microsoft Shared\Ink\TabTip32.exe
C:\Program Files\Windows Defender\MSASCuiL.exe
C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe
C:\Program Files\iTunes\iTunesHelper.exe
C:\Users\Robert\AppData\Local\Microsoft\OneDrive\OneDrive.exe
C:\Program Files (x86)\Citrix\ICA Client\SelfServicePlugin\SelfServicePlugin.exe
C:\Program Files\Microsoft Office 15\root\office15\ONENOTEM.EXE
c:\windows\system32\svchost.exe -k netsvcs -s Appinfo
C:\Program Files\iPod\bin\iPodService.exe
C:\Program Files (x86)\Citrix\ICA Client\Receiver\Receiver.exe
C:\Program Files (x86)\Citrix\ICA Client\concentr.exe
C:\Program Files (x86)\Citrix\ICA Client\redirector.exe
C:\Program Files (x86)\Citrix\ICA Client\wfcrun32.exe
c:\windows\system32\taskhostw.exe
C:\Windows\SystemApps\Microsoft.Windows.Cortana_cw5n1h2txyewy\SearchUI.exe
c:\windows\system32\svchost.exe -k unistacksvcgroup
C:\WINDOWS\system32\SearchIndexer.exe
C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe
C:\Program Files (x86)\Citrix\ICA Client\AuthManager\AuthManSvr.exe
C:\WINDOWS\system32\ApplicationFrameHost.exe
C:\Program Files\WindowsApps\Microsoft.WindowsStore_11706.1001.26.0_x64__8wekyb3d8bbwe\WinStore.App.exe
C:\WINDOWS\system32\svchost.exe -k netsvcs -s wlidsvc
c:\windows\system32\svchost.exe -k localsystemnetworkrestricted -s DsSvc
C:\WINDOWS\System32\svchost.exe -k LocalServiceNoNetwork -s NcdAutoSetup
C:\WINDOWS\System32\svchost.exe -k LocalServiceNetworkRestricted -s lmhosts
C:\WINDOWS\System32\svchost.exe -k LocalSystemNetworkRestricted -s WdiSystemHost
C:\Windows\System32\smartscreen.exe
C:\Program Files (x86)\Mozilla Firefox\firefox.exe
C:\WINDOWS\system32\AUDIODG.EXE
C:\Windows\System32\SystemSettingsBroker.exe
c:\windows\system32\svchost.exe -k netsvcs -s BITS
C:\WINDOWS\system32\SearchProtocolHost.exe
C:\WINDOWS\system32\SearchFilterHost.exe
C:\WINDOWS\system32\wbem\wmiprvse.exe
C:\WINDOWS\System32\cscript.exe
.
============== Pseudo HJT Report ===============
.
uWindow Title = Windows Internet Explorer provided by Yahoo!
uDefault_Page_URL = hxxp://www.yahoo.com/?fr=fp-yie9
uURLSearchHooks: {81017EA9-9AA8-4A6A-9734-7AF40E7D593F} - <orphaned>
BHO: {02478D38-C3F9-4efb-9B51-7695ECA05670} - <orphaned>
BHO: Skype for Business Browser Helper: {31D09BA0-12F5-4CCE-BE8A-2923E76605DA} - C:\Program Files\Microsoft Office 15\root\office15\OCHelper.dll
BHO: Norton Identity Safety: {602ADB0E-4AFF-4217-8AA1-95DAC4DFA408} - C:\Program Files (x86)\Norton 360\Engine32\22.10.0.85\coIEPlg.dll
BHO: Norton Vulnerability Protection: {6D53EC84-6AAE-4787-AEEE-F4628F01010C} -
BHO: {9D425283-D487-4337-BAB6-AB8354A81457} - <orphaned>
BHO: Microsoft SkyDrive Pro Browser Helper: {D0498E0A-45B7-42AE-A9AA-ABA463DBD3BF} - C:\Program Files\Microsoft Office 15\root\office15\GROOVEEX.DLL
BHO: HP Network Check Helper: {E76FD755-C1BA-4DCB-9F13-99BD91223ADE} -
BHO: SingleInstance Class: {FDAD4DA1-61A2-4FD8-9C17-86F7AC245081} - C:\Program Files (x86)\Yahoo!\Companion\Installs\cpn0\YTSingleInstance.dll
TB: Norton Toolbar: {7FEBEFE3-6B19-4349-98D2-FFB09D4B49CA} - C:\Program Files (x86)\Norton 360\Engine32\22.10.0.85\coIEPlg.dll
TB: Norton Toolbar: {7FEBEFE3-6B19-4349-98D2-FFB09D4B49CA} - C:\Program Files (x86)\Norton 360\Engine32\22.10.0.85\coIEPlg.dll
uRun: [OneDrive] "C:\Users\Robert\AppData\Local\Microsoft\OneDrive\OneDrive.exe" /background
uRun: [EPSON NX420 Series] C:\WINDOWS\System32\spool\DRIVERS\x64\3\E_IATIGCA.EXE /FU "C:\WINDOWS\TEMP\E_SFD4B.tmp" /EF "HKCU"
uRun: [Steam] "C:\Program Files (x86)\Steam\steam.exe" -silent
mRun: [Adobe ARM] "C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe"
mRun: [ConnectionCenter] "C:\Program Files (x86)\Citrix\ICA Client\concentr.exe" /startup
mRun: [Redirector] "C:\Program Files (x86)\Citrix\ICA Client\redirector.exe" /startup
dRun: [EPSON NX420 Series] C:\WINDOWS\System32\spool\DRIVERS\x64\3\E_IATIGCA.EXE /FU "C:\WINDOWS\TEMP\E_S86D.tmp" /EF "HKCU"
dRunOnce: [Application Restart #1] C:\Program Files\Common Files\microsoft shared\ink\TabTip.exe /Crashed
StartupFolder: C:\Users\Robert\AppData\Roaming\MICROS~1\Windows\STARTM~1\Programs\Startup\CITRIX~1.LNK - C:\Program Files (x86)\Citrix\ICA Client\SelfServicePlugin\SelfServicePlugin.exe
StartupFolder: C:\Users\Robert\AppData\Roaming\MICROS~1\Windows\STARTM~1\Programs\Startup\SENDTO~1.LNK - C:\Program Files\Microsoft Office 15\root\office15\ONENOTEM.EXE
mPolicies-System: DSCAutomationHostEnabled = dword:2
IE: E&xport to Microsoft Excel - C:\Program Files\Microsoft Office 15\Root\Office15\EXCEL.EXE/3000
IE: Se&nd to OneNote - C:\Program Files\Microsoft Office 15\Root\Office15\ONBttnIE.dll/105
IE: {25510184-5A38-4A99-B273-DCA8EEF6CD08} - C:\Program Files (x86)\Hewlett-Packard\HP Support Framework\Resources\HPNetworkCheck\NCLauncherFromIE.exe
IE: {2670000A-7350-4f3c-8081-5663EE0C6C49} - {48E73304-E1D6-4330-914C-F5F514E3486C} - C:\Program Files\Microsoft Office 15\root\office15\ONBttnIE.dll
IE: {31D09BA0-12F5-4CCE-BE8A-2923E76605DA} - {31D09BA0-12F5-4CCE-BE8A-2923E76605DA} - C:\Program Files\Microsoft Office 15\root\office15\OCHelper.dll
IE: {789FE86F-6FC4-46A1-9849-EDE0DB0C95CA} - {FFFDC614-B694-4AE6-AB38-5D6374584B52} - C:\Program Files\Microsoft Office 15\root\office15\ONBttnIELinkedNotes.dll
DPF: {02BCC737-B171-4746-94C9-0D8A0B2C0089} - hxxp://office.microsoft.com/_layouts/ClientBin/ieawsdc32.cab
DPF: {E2883E8F-472F-4FB0-9522-AC9BF37916A7} - hxxp://platformdl.adobe.com/NOS/getPlusPlus/1.6/gp.cab
DPF: {F27237D7-93C8-44C2-AC6E-D6057B9A918F} - hxxps://jpass4.bnymellon.com/dana-cached/sc/JuniperSetupClient.cab
TCP: NameServer = 208.59.247.45 208.59.247.46 192.168.1.1
TCP: Interfaces\{424ee7c6-9434-4c0f-b75a-9e0e166af1b3} : DHCPNameServer = 208.59.247.45 208.59.247.46 192.168.1.1
TCP: Interfaces\{f4bc1c8b-1875-4436-a161-3f915667e927} : DHCPNameServer = 75.75.75.75 75.75.76.76
Filter: application/x-ica - {CFB6322E-CC85-4d1b-82C7-893888A236BC} - C:\Program Files (x86)\Citrix\ICA Client\IcaMimeFilter.dll
Filter: application/x-ica; charset=euc-jp - {CFB6322E-CC85-4d1b-82C7-893888A236BC} - C:\Program Files (x86)\Citrix\ICA Client\IcaMimeFilter.dll
Filter: application/x-ica; charset=ISO-8859-1 - {CFB6322E-CC85-4d1b-82C7-893888A236BC} - C:\Program Files (x86)\Citrix\ICA Client\IcaMimeFilter.dll
Filter: application/x-ica; charset=MS936 - {CFB6322E-CC85-4d1b-82C7-893888A236BC} - C:\Program Files (x86)\Citrix\ICA Client\IcaMimeFilter.dll
Filter: application/x-ica; charset=MS949 - {CFB6322E-CC85-4d1b-82C7-893888A236BC} - C:\Program Files (x86)\Citrix\ICA Client\IcaMimeFilter.dll
Filter: application/x-ica; charset=MS950 - {CFB6322E-CC85-4d1b-82C7-893888A236BC} - C:\Program Files (x86)\Citrix\ICA Client\IcaMimeFilter.dll
Filter: application/x-ica; charset=UTF-8 - {CFB6322E-CC85-4d1b-82C7-893888A236BC} - C:\Program Files (x86)\Citrix\ICA Client\IcaMimeFilter.dll
Filter: application/x-ica; charset=UTF8 - {CFB6322E-CC85-4d1b-82C7-893888A236BC} - C:\Program Files (x86)\Citrix\ICA Client\IcaMimeFilter.dll
Filter: application/x-ica;charset=euc-jp - {CFB6322E-CC85-4d1b-82C7-893888A236BC} - C:\Program Files (x86)\Citrix\ICA Client\IcaMimeFilter.dll
Filter: application/x-ica;charset=ISO-8859-1 - {CFB6322E-CC85-4d1b-82C7-893888A236BC} - C:\Program Files (x86)\Citrix\ICA Client\IcaMimeFilter.dll
Filter: application/x-ica;charset=MS936 - {CFB6322E-CC85-4d1b-82C7-893888A236BC} - C:\Program Files (x86)\Citrix\ICA Client\IcaMimeFilter.dll
Filter: application/x-ica;charset=MS949 - {CFB6322E-CC85-4d1b-82C7-893888A236BC} - C:\Program Files (x86)\Citrix\ICA Client\IcaMimeFilter.dll
Filter: application/x-ica;charset=MS950 - {CFB6322E-CC85-4d1b-82C7-893888A236BC} - C:\Program Files (x86)\Citrix\ICA Client\IcaMimeFilter.dll
Filter: application/x-ica;charset=UTF-8 - {CFB6322E-CC85-4d1b-82C7-893888A236BC} - C:\Program Files (x86)\Citrix\ICA Client\IcaMimeFilter.dll
Filter: application/x-ica;charset=UTF8 - {CFB6322E-CC85-4d1b-82C7-893888A236BC} - C:\Program Files (x86)\Citrix\ICA Client\IcaMimeFilter.dll
Filter: ica - {CFB6322E-CC85-4d1b-82C7-893888A236BC} - C:\Program Files (x86)\Citrix\ICA Client\IcaMimeFilter.dll
Handler: osf - {D924BDC6-C83A-4BD5-90D0-095128A113D1} - C:\Program Files\Microsoft Office 15\root\office15\msosb.dll
Handler: tbauth - {14654CA6-5711-491D-B89A-58E571679951} - C:\Windows\SysWOW64\tbauth.dll
Handler: windows.tbauth - {14654CA6-5711-491D-B89A-58E571679951} - C:\Windows\SysWOW64\tbauth.dll
SSODL: WebCheck - <orphaned>
CLSID: {603D3801-BD81-11d0-A3A5-00C04FD706EC} - C:\WINDOWS\System32\windows.storage.dll
x64-BHO: Skype for Business Browser Helper: {31D09BA0-12F5-4CCE-BE8A-2923E76605DA} - C:\Program Files\Microsoft Office 15\root\vfs\ProgramFilesX64\Microsoft Office\Office15\OCHelper.dll
x64-BHO: Norton Identity Safety: {602ADB0E-4AFF-4217-8AA1-95DAC4DFA408} - C:\Program Files (x86)\Norton 360\Engine\22.10.0.85\coIEPlg.dll
x64-BHO: Easy Photo Print: {9421DD08-935F-4701-A9CA-22DF90AC4EA6} - C:\Program Files (x86)\Epson Software\Easy Photo Print\EPTBL.dll
x64-BHO: Office Document Cache Handler: {B4F3A835-0E21-4959-BA22-42B3008E02FF} - C:\Program Files\Microsoft Office 15\root\vfs\ProgramFilesX64\Microsoft Office\Office15\URLREDIR.DLL
x64-BHO: Microsoft SkyDrive Pro Browser Helper: {D0498E0A-45B7-42AE-A9AA-ABA463DBD3BF} - C:\Program Files\Microsoft Office 15\root\vfs\ProgramFilesX64\Microsoft Office\Office15\GROOVEEX.DLL
x64-BHO: HP Network Check Helper: {E76FD755-C1BA-4DCB-9F13-99BD91223ADE} -
x64-TB: Easy Photo Print: {9421DD08-935F-4701-A9CA-22DF90AC4EA6} - C:\Program Files (x86)\Epson Software\Easy Photo Print\EPTBL.dll
x64-TB: Norton Toolbar: {7FEBEFE3-6B19-4349-98D2-FFB09D4B49CA} - C:\Program Files (x86)\Norton 360\Engine\22.10.0.85\coIEPlg.dll
x64-Run: [SecurityHealth] C:\Program Files (x86)\Windows Defender\MSASCuiL.exe
x64-Run: [RTHDVCPL] C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe -s
x64-Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"
x64-mPolicies-System: DSCAutomationHostEnabled = dword:2
x64-IE: {25510184-5A38-4A99-B273-DCA8EEF6CD08} - C:\Program Files (x86)\Hewlett-Packard\HP Support Framework\Resources\HPNetworkCheck\NCLauncherFromIE.exe
x64-IE: {2670000A-7350-4f3c-8081-5663EE0C6C49} - {48E73304-E1D6-4330-914C-F5F514E3486C} - C:\Program Files\Microsoft Office 15\root\vfs\ProgramFilesX64\Microsoft Office\Office15\ONBttnIE.dll
x64-IE: {31D09BA0-12F5-4CCE-BE8A-2923E76605DA} - {31D09BA0-12F5-4CCE-BE8A-2923E76605DA} - C:\Program Files\Microsoft Office 15\root\vfs\ProgramFilesX64\Microsoft Office\Office15\OCHelper.dll
x64-IE: {789FE86F-6FC4-46A1-9849-EDE0DB0C95CA} - {FFFDC614-B694-4AE6-AB38-5D6374584B52} - C:\Program Files\Microsoft Office 15\root\vfs\ProgramFilesX64\Microsoft Office\Office15\ONBttnIELinkedNotes.dll
x64-Filter: application/x-ica - {CFB6322E-CC85-4d1b-82C7-893888A236BC} - <orphaned>
x64-Filter: application/x-ica; charset=euc-jp - {CFB6322E-CC85-4d1b-82C7-893888A236BC} - <orphaned>
x64-Filter: application/x-ica; charset=ISO-8859-1 - {CFB6322E-CC85-4d1b-82C7-893888A236BC} - <orphaned>
x64-Filter: application/x-ica; charset=MS936 - {CFB6322E-CC85-4d1b-82C7-893888A236BC} - <orphaned>
x64-Filter: application/x-ica; charset=MS949 - {CFB6322E-CC85-4d1b-82C7-893888A236BC} - <orphaned>
x64-Filter: application/x-ica; charset=MS950 - {CFB6322E-CC85-4d1b-82C7-893888A236BC} - <orphaned>
x64-Filter: application/x-ica; charset=UTF-8 - {CFB6322E-CC85-4d1b-82C7-893888A236BC} - <orphaned>
x64-Filter: application/x-ica; charset=UTF8 - {CFB6322E-CC85-4d1b-82C7-893888A236BC} - <orphaned>
x64-Filter: application/x-ica;charset=euc-jp - {CFB6322E-CC85-4d1b-82C7-893888A236BC} - <orphaned>
x64-Filter: application/x-ica;charset=ISO-8859-1 - {CFB6322E-CC85-4d1b-82C7-893888A236BC} - <orphaned>
x64-Filter: application/x-ica;charset=MS936 - {CFB6322E-CC85-4d1b-82C7-893888A236BC} - <orphaned>
x64-Filter: application/x-ica;charset=MS949 - {CFB6322E-CC85-4d1b-82C7-893888A236BC} - <orphaned>
x64-Filter: application/x-ica;charset=MS950 - {CFB6322E-CC85-4d1b-82C7-893888A236BC} - <orphaned>
x64-Filter: application/x-ica;charset=UTF-8 - {CFB6322E-CC85-4d1b-82C7-893888A236BC} - <orphaned>
x64-Filter: application/x-ica;charset=UTF8 - {CFB6322E-CC85-4d1b-82C7-893888A236BC} - <orphaned>
x64-Filter: ica - {CFB6322E-CC85-4d1b-82C7-893888A236BC} - <orphaned>
x64-Handler: osf - {D924BDC6-C83A-4BD5-90D0-095128A113D1} - <orphaned>
x64-Handler: tbauth - {14654CA6-5711-491D-B89A-58E571679951} - C:\WINDOWS\System32\tbauth.dll
x64-Handler: windows.tbauth - {14654CA6-5711-491D-B89A-58E571679951} - C:\WINDOWS\System32\tbauth.dll
x64-SSODL: WebCheck - <orphaned>
x64-mASetup: {2C7339CF-2B09-4501-B3F3-F3508C9228ED} - /UserInstall
x64-mASetup: {89820200-ECBD-11cf-8B85-00AA005B4340} - U
x64-mASetup: {8A69D345-D564-463c-AFF1-A69D9E530F96} - "C:\Program Files (x86)\Google\Chrome\Application\60.0.3112.90\Installer\chrmstp.exe" --configure-user-settings --verbose-logging --system-level
x64-CLSID: {603D3801-BD81-11d0-A3A5-00C04FD706EC} - C:\WINDOWS\System32\windows.storage.dll
.
================= FIREFOX ===================
.
FF - ProfilePath - C:\Users\Robert\AppData\Roaming\Mozilla\Firefox\Profiles\rnmev8of.default-1448735922823\
FF - prefs.js: browser.startup.homepage - hxxps://search.norton.com?o=APN12179&prt=SSS&chn=PIF001&ver=1.0.1.5&tpr=111&guid=2a786961-0257-44a7-ee2c-ecab5c9e3ea5&doi=2017-6-12
FF - plugin: C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AIR\nppdf32.dll
FF - plugin: C:\Program Files (x86)\Citrix\ICA Client\npicaN.dll
FF - plugin: C:\Program Files (x86)\Citrix\ICA Client\npURLInterceptorPlugin.dll
FF - plugin: C:\Program Files (x86)\Google\Update\1.3.33.5\npGoogleUpdate3.dll
FF - plugin: C:\Program Files (x86)\Microsoft Silverlight\5.1.50907.0\npctrlui.dll
FF - plugin: C:\Program Files\Microsoft Office 15\root\Office15\NPSPWRAP.DLL
FF - plugin: C:\Program Files\Microsoft Office 15\root\VFS\ProgramFilesX86\Mozilla Firefox\plugins\npmeetingjoinpluginoc.dll
FF - plugin: C:\Users\Robert\AppData\Local\Citrix\Plugins\104\npappdetector.dll
FF - plugin: C:\WINDOWS\SysWoW64\Macromed\Flash\NPSWF32_23_0_0_207.dll
.
============= SERVICES / DRIVERS ===============
.
R0 intelpep;Intel(R) Power Engine Plug-in Driver;C:\WINDOWS\System32\drivers\intelpep.sys [2017-3-18 74840]
R0 iorate;Disk I/O Rate Filter Driver;C:\WINDOWS\System32\drivers\iorate.sys [2017-3-18 49568]
R0 SymEFASI;Symantec Extended File Attributes (SI);C:\WINDOWS\System32\drivers\N360x64\160A000.055\symefasi64.sys [2017-7-26 1868416]
R0 volume;Volume driver;C:\WINDOWS\System32\drivers\volume.sys [2017-3-18 16288]
R0 WindowsTrustedRT;Windows Trusted Execution Environment Class Extension;C:\WINDOWS\System32\drivers\WindowsTrustedRT.sys [2017-3-18 70232]
R0 WindowsTrustedRTProxy;Microsoft Windows Trusted Runtime Secure Service;C:\WINDOWS\System32\drivers\WindowsTrustedRTProxy.sys [2017-3-18 18520]
R0 Wof;Windows Overlay File System Filter Driver;C:\WINDOWS\System32\drivers\wof.sys [2017-3-18 208288]
R1 ahcache;Application Compatibility Cache;C:\WINDOWS\System32\drivers\ahcache.sys [2017-3-18 239616]
R1 BHDrvx64;BHDrvx64;C:\Program Files (x86)\Norton 360\NortonData\22.5.0.124\Definitions\BASHDefs\20170807.003\BHDrvx64.sys [2017-8-8 1862816]
R1 ccSet_N360;N360 Settings Manager;C:\WINDOWS\System32\drivers\N360x64\160A000.055\ccsetx64.sys [2017-7-26 187520]
R1 ctxusbm;Citrix USB Monitor Driver;C:\WINDOWS\System32\drivers\ctxusbm.sys [2016-10-17 142000]
R1 FileCrypt;FileCrypt;C:\WINDOWS\System32\drivers\filecrypt.sys [2017-3-18 54272]
R1 GpuEnergyDrv;GPU Energy Driver;C:\WINDOWS\System32\drivers\gpuenergydrv.sys [2017-3-18 8192]
R1 IDSVia64;IDSVia64;C:\Program Files (x86)\Norton 360\NortonData\22.5.0.124\Definitions\IPSDefs\20170811.001\IDSvia64.sys [2017-8-11 1056920]
R1 SymIRON;Symantec Iron Driver;C:\WINDOWS\System32\drivers\N360x64\160A000.055\ironx64.sys [2017-7-26 301288]
R1 SymNetS;Symantec Network Security WFP Driver;C:\WINDOWS\System32\drivers\N360x64\160A000.055\symnets.sys [2017-7-26 566912]
R2 AERTFilters;Andrea RT Filters Service;C:\Program Files\Realtek\Audio\HDA\AERTSr64.exe [2012-7-5 98208]
R2 AMD External Events Utility;AMD External Events Utility;C:\WINDOWS\System32\atiesrxx.exe [2015-1-13 238080]
R2 Apple Mobile Device Service;Apple Mobile Device Service;C:\Program Files\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe [2016-3-2 83768]
R2 CDPSvc;Connected Devices Platform Service;C:\WINDOWS\System32\svchost.exe -k LocalService [2017-3-18 47664]
R2 ClickToRunSvc;Microsoft Office ClickToRun Service;C:\Program Files\Microsoft Office 15\ClientX64\officeclicktorun.exe [2014-3-19 2828016]
R2 clreg;Virtual Registry for Containers;C:\WINDOWS\System32\drivers\registry.sys [2017-3-18 14336]
R2 CoreMessagingRegistrar;CoreMessaging;C:\WINDOWS\System32\svchost.exe -k LocalServiceNoNetwork [2017-3-18 47664]
R2 cvhsvc;Client Virtualization Handler;C:\Program Files (x86)\Common Files\Microsoft Shared\Virtualization Handler\CVHSVC.EXE [2015-3-18 822496]
R2 DiagTrack;Connected User Experiences and Telemetry;C:\WINDOWS\System32\svchost.exe -k utcsvc [2017-3-18 47664]
R2 DoSvc;Delivery Optimization;C:\WINDOWS\System32\svchost.exe -k netsvcs [2017-3-18 47664]
R2 DusmSvc;Data Usage;C:\WINDOWS\System32\svchost.exe -k LocalServiceNetworkRestricted [2017-3-18 47664]
R2 HPSupportSolutionsFrameworkService;HP Support Solutions Framework Service;C:\Program Files (x86)\Hewlett-Packard\HP Support Solutions\HPSupportSolutionsFrameworkService.exe [2015-9-28 321056]
R2 IntuitUpdateServiceV4;Intuit Update Service v4;C:\Program Files (x86)\Common Files\Intuit\Update Service v4\IntuitUpdateService.exe [2016-9-7 21216]
R2 N360;Norton 360;C:\Program Files (x86)\Norton 360\Engine\22.10.0.85\n360.exe [2017-7-26 326144]
R2 storqosflt;Storage QoS Filter Driver;C:\WINDOWS\System32\drivers\storqosflt.sys [2017-3-18 79872]
R2 wcifs;Windows Container Isolation;C:\WINDOWS\System32\drivers\wcifs.sys [2017-7-25 142752]
R3 DsSvc;Data Sharing Service;C:\WINDOWS\System32\svchost.exe -k LocalSystemNetworkRestricted [2017-3-18 47664]
R3 EraserUtilRebootDrv;EraserUtilRebootDrv;C:\Program Files (x86)\Common Files\Symantec Shared\EENGINE\EraserUtilRebootDrv.sys [2017-7-12 158336]
R3 ITECIRfilter;ITECIR Filter Driver;C:\WINDOWS\System32\drivers\ITECIRfilter.sys [2015-6-3 27856]
R3 lfsvc;Geolocation Service;C:\WINDOWS\System32\svchost.exe -k netsvcs [2017-3-18 47664]
R3 LicenseManager;Windows License Manager Service;C:\WINDOWS\System32\svchost.exe -k LocalService [2017-3-18 47664]
R3 NcbService;Network Connection Broker;C:\WINDOWS\System32\svchost.exe -k LocalSystemNetworkRestricted [2017-3-18 47664]
R3 NdisVirtualBus;Microsoft Virtual Network Adapter Enumerator;C:\WINDOWS\System32\drivers\NdisVirtualBus.sys [2017-3-18 20992]
R3 netr28x;Ralink 802.11n Extensible Wireless Driver;C:\WINDOWS\System32\drivers\netr28x.sys [2017-3-18 2537984]
R3 rt640x64;Realtek RT640 NT Driver;C:\WINDOWS\System32\drivers\rt640x64.sys [2017-3-18 604160]
R3 Sftfs;Sftfs;C:\WINDOWS\System32\drivers\Sftfslh.sys [2014-10-8 766632]
R3 Sftplay;Sftplay;C:\WINDOWS\System32\drivers\Sftplaylh.sys [2014-10-8 273576]
R3 Sftredir;Sftredir;C:\WINDOWS\System32\drivers\Sftredirlh.sys [2014-10-8 29352]
R3 Sftvol;Sftvol;C:\WINDOWS\System32\drivers\Sftvollh.sys [2014-10-8 23208]
R3 WUDFWpdMtp;WUDFWpdMtp;C:\WINDOWS\System32\drivers\WUDFRd.sys [2017-3-18 220672]
S0 SymELAM;Symantec ELAM Driver;C:\WINDOWS\System32\drivers\N360x64\160A000.055\symelam.sys [2017-7-26 24608]
S2 CldFlt;Windows Cloud Files Filter Driver;C:\WINDOWS\System32\drivers\cldflt.sys [2017-3-18 12288]
S2 MapsBroker;Downloaded Maps Manager;C:\WINDOWS\System32\svchost.exe -k NetworkService [2017-3-18 47664]
S3 AcpiDev;ACPI Devices driver;C:\WINDOWS\System32\drivers\AcpiDev.sys [2017-3-18 20480]
S3 ADP80XX;ADP80XX;C:\WINDOWS\System32\drivers\adp80xx.sys [2017-3-18 1135512]
S3 AJRouter;AllJoyn Router Service;C:\WINDOWS\System32\svchost.exe -k LocalServiceNetworkRestricted [2017-3-18 47664]
S3 applockerfltr;Smartlocker Filter Driver;C:\WINDOWS\System32\drivers\applockerfltr.sys [2017-3-18 17920]
S3 AppReadiness;App Readiness;C:\WINDOWS\System32\svchost.exe -k AppReadiness [2017-3-18 47664]
S3 AppXSvc;AppX Deployment Service (AppXSVC);C:\WINDOWS\System32\svchost.exe -k wsappx [2017-3-18 47664]
S3 bcmfn2;bcmfn2 Service;C:\WINDOWS\System32\drivers\bcmfn2.sys [2017-3-18 9728]
S3 BthHFSrv;Bluetooth Handsfree Service;C:\WINDOWS\System32\svchost.exe -k LocalServiceAndNoImpersonation [2017-3-18 47664]
S3 buttonconverter;Service for Portable Device Control devices;C:\WINDOWS\System32\drivers\buttonconverter.sys [2017-3-18 39424]
S3 CAD;Charge Arbitration Driver;C:\WINDOWS\System32\drivers\CAD.sys [2017-3-18 53664]
S3 CapImg;HID driver for CapImg touch screen;C:\WINDOWS\System32\drivers\capimg.sys [2017-3-18 122880]
S3 cht4iscsi;cht4iscsi;C:\WINDOWS\System32\drivers\cht4sx64.sys [2017-3-18 347032]
S3 cht4vbd;Chelsio Virtual Bus Driver;C:\WINDOWS\System32\drivers\cht4vx64.sys [2017-3-18 2104224]
S3 ClipSVC;Client License Service (ClipSVC);C:\WINDOWS\System32\svchost.exe -k wsappx [2017-3-18 47664]
S3 clwvd;HP Webcam Splitter;C:\WINDOWS\System32\drivers\clwvd.sys [2010-6-18 32880]
S3 DevQueryBroker;DevQuery Background Discovery Broker;C:\WINDOWS\System32\svchost.exe -k LocalSystemNetworkRestricted [2017-3-18 47664]
S3 diagnosticshub.standardcollector.service;Microsoft (R) Diagnostics Hub Standard Collector Service;C:\WINDOWS\System32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe [2017-3-18 86528]
S3 DmEnrollmentSvc;Device Management Enrollment Service;C:\WINDOWS\System32\svchost.exe -k netsvcs [2017-3-18 47664]
S3 dmwappushservice;dmwappushsvc;C:\WINDOWS\System32\svchost.exe -k netsvcs [2017-3-18 47664]
S3 embeddedmode;Embedded Mode;C:\WINDOWS\System32\svchost.exe -k LocalSystemNetworkRestricted [2017-3-18 47664]
S3 EntAppSvc;Enterprise App Management Service;C:\WINDOWS\System32\svchost.exe -k appmodel [2017-3-18 47664]
S3 FrameServer;Windows Camera Frame Server;C:\WINDOWS\System32\svchost.exe -k Camera [2017-3-18 47664]
S3 genericusbfn;Generic USB Function Class;C:\WINDOWS\System32\drivers\genericusbfn.sys [2017-3-18 21504]
S3 hidinterrupt;Common Driver for HID Buttons implemented with interrupts;C:\WINDOWS\System32\drivers\hidinterrupt.sys [2017-3-18 51104]
S3 HvHost;HV Host Service;C:\WINDOWS\System32\svchost.exe -k LocalSystemNetworkRestricted [2017-3-18 47664]
S3 iagpio;Intel Serial IO GPIO Controller Driver;C:\WINDOWS\System32\drivers\iagpio.sys [2017-3-18 33280]
S3 iai2c;Intel(R) Serial IO I2C Host Controller;C:\WINDOWS\System32\drivers\iai2c.sys [2017-3-18 81408]
S3 iaLPSS2i_GPIO2;Intel(R) Serial IO GPIO Driver v2;C:\WINDOWS\System32\drivers\iaLPSS2i_GPIO2.sys [2017-3-18 70656]
S3 iaLPSS2i_GPIO2_BXT_P;Intel(R) Serial IO GPIO Driver v2;C:\WINDOWS\System32\drivers\iaLPSS2i_GPIO2_BXT_P.sys [2017-3-18 85504]
S3 iaLPSS2i_I2C;Intel(R) Serial IO I2C Driver v2;C:\WINDOWS\System32\drivers\iaLPSS2i_I2C.sys [2017-3-18 165376]
S3 iaLPSS2i_I2C_BXT_P;Intel(R) Serial IO I2C Driver v2;C:\WINDOWS\System32\drivers\iaLPSS2i_I2C_BXT_P.sys [2017-3-18 168448]
S3 iaLPSSi_GPIO;Intel(R) Serial IO GPIO Controller Driver;C:\WINDOWS\System32\drivers\iaLPSSi_GPIO.sys [2017-3-18 38128]
S3 iaLPSSi_I2C;Intel(R) Serial IO I2C Controller Driver;C:\WINDOWS\System32\drivers\iaLPSSi_I2C.sys [2017-3-18 113152]
S3 iaStorAV;Intel(R) SATA RAID Controller Windows;C:\WINDOWS\System32\drivers\iaStorAV.sys [2017-3-18 673184]
S3 ibbus;Mellanox InfiniBand Bus/AL (Filter Driver);C:\WINDOWS\System32\drivers\ibbus.sys [2017-3-18 526240]
S3 icssvc;Windows Mobile Hotspot Service;C:\WINDOWS\System32\svchost.exe -k LocalServiceNetworkRestricted [2017-3-18 47664]
S3 IndirectKmd;Indirect Displays Kernel-Mode Driver;C:\WINDOWS\System32\drivers\IndirectKmd.sys [2017-3-18 36864]
S3 IpxlatCfgSvc;IP Translation Configuration Service;C:\WINDOWS\System32\svchost.exe -k LocalSystemNetworkRestricted [2017-3-18 47664]
S3 LSI_SAS2i;LSI_SAS2i;C:\WINDOWS\System32\drivers\lsi_sas2i.sys [2017-3-18 123808]
S3 LSI_SAS3i;LSI_SAS3i;C:\WINDOWS\System32\drivers\lsi_sas3i.sys [2017-3-18 103328]
S3 mausbhost;MA-USB Host Controller Driver;C:\WINDOWS\System32\drivers\mausbhost.sys [2017-3-18 405408]
S3 mausbip;MA-USB IP Filter Driver;C:\WINDOWS\System32\drivers\mausbip.sys [2017-3-18 51104]
S3 megasas2i;megasas2i;C:\WINDOWS\System32\drivers\MegaSas2i.sys [2017-3-18 64416]
S3 mlx4_bus;Mellanox ConnectX Bus Enumerator;C:\WINDOWS\System32\drivers\mlx4_bus.sys [2017-3-18 842656]
S3 NaturalAuthentication;Natural Authentication;C:\WINDOWS\System32\svchost.exe -k netsvcs [2017-3-18 47664]
S3 ndfltr;NetworkDirect Service;C:\WINDOWS\System32\drivers\ndfltr.sys [2017-3-18 108960]
S3 NetAdapterCx;Network Adapter Wdf Class Extension Library;C:\WINDOWS\System32\drivers\NetAdapterCx.sys [2017-3-18 122368]
S3 NetSetupSvc;Network Setup Service;C:\WINDOWS\System32\svchost.exe -k netsvcs [2017-3-18 47664]
S3 netvsc;netvsc;C:\WINDOWS\System32\drivers\netvsc.sys [2017-7-25 118784]
S3 NgcCtnrSvc;Microsoft Passport Container;C:\WINDOWS\System32\svchost.exe -k LocalServiceNetworkRestricted [2017-3-18 47664]
S3 NgcSvc;Microsoft Passport;C:\WINDOWS\System32\svchost.exe -k LocalSystemNetworkRestricted [2017-3-18 47664]
S3 nvdimmn;Microsoft NVDIMM-N device driver;C:\WINDOWS\System32\drivers\nvdimmn.sys [2017-3-18 80896]
S3 percsas2i;percsas2i;C:\WINDOWS\System32\drivers\percsas2i.sys [2017-3-18 58784]
S3 percsas3i;percsas3i;C:\WINDOWS\System32\drivers\percsas3i.sys [2017-3-18 61848]
S3 PhoneSvc;Phone Service;C:\WINDOWS\System32\svchost.exe -k LocalService [2017-3-18 47664]
S3 ReFS;ReFS;C:\WINDOWS\System32\drivers\refs.sys [2017-3-18 1735584]
S3 ReFSv1;ReFSv1;C:\WINDOWS\System32\drivers\refsv1.sys [2017-3-18 936864]
S3 scmbus;Microsoft Storage Class Memory Bus Driver;C:\WINDOWS\System32\drivers\scmbus.sys [2017-3-18 91040]
S3 SDFRd;SDF Reflector;C:\WINDOWS\System32\drivers\SDFRd.sys [2017-3-18 31128]
S3 SerCx2;Serial UART Support Library;C:\WINDOWS\System32\drivers\SerCx2.sys [2017-3-18 154016]
S3 SpatialGraphFilter;Holographic Spatial Graph Filter;C:\WINDOWS\System32\drivers\SpatialGraphFilter.sys [2017-3-18 40352]
S3 stornvme;Microsoft Standard NVM Express Driver;C:\WINDOWS\System32\drivers\stornvme.sys [2017-3-18 95648]
S3 storufs;Microsoft Universal Flash Storage (UFS) Driver;C:\WINDOWS\System32\drivers\storufs.sys [2017-3-18 36760]
S3 UcmCx0101;USB Connector Manager KMDF Class Extension;C:\WINDOWS\System32\drivers\UcmCx.sys [2017-3-18 104448]
S3 UcmTcpciCx0101;UCM-TCPCI KMDF Class Extension;C:\WINDOWS\System32\drivers\UcmTcpciCx.sys [2017-3-18 179200]
S3 UcmUcsi;USB Connector Manager UCSI Client;C:\WINDOWS\System32\drivers\UcmUcsi.sys [2017-8-8 51712]
S3 UdeCx;USB Device Emulation Support Library;C:\WINDOWS\System32\drivers\Udecx.sys [2017-3-18 45568]
S3 UEFI;Microsoft UEFI Driver;C:\WINDOWS\System32\drivers\uefi.sys [2017-3-18 29600]
S3 Ufx01000;USB Function Class Extension;C:\WINDOWS\System32\drivers\ufx01000.sys [2017-3-18 263584]
S3 UfxChipidea;USB Chipidea Controller;C:\WINDOWS\System32\drivers\UfxChipidea.sys [2017-3-18 98712]
S3 ufxsynopsys;USB Synopsys Controller;C:\WINDOWS\System32\drivers\ufxsynopsys.sys [2017-3-18 138656]
S3 UrsChipidea;Chipidea USB Role-Switch Driver;C:\WINDOWS\System32\drivers\urschipidea.sys [2017-3-18 29600]
S3 UrsCx01000;USB Role-Switch Support Library;C:\WINDOWS\System32\drivers\urscx01000.sys [2017-3-18 59288]
S3 UrsSynopsys;Synopsys USB Role-Switch Driver;C:\WINDOWS\System32\drivers\urssynopsys.sys [2017-3-18 28064]
S3 vhf;Virtual HID Framework (VHF) Driver;C:\WINDOWS\System32\drivers\vhf.sys [2017-3-18 35328]
S3 vmgid;Microsoft Hyper-V Guest Infrastructure Driver;C:\WINDOWS\System32\drivers\vmgid.sys [2017-3-18 10240]
S3 wcnfs;Windows Container Name Virtualization;C:\WINDOWS\System32\drivers\wcnfs.sys [2017-3-18 72192]
S3 wdiwifi;WDI Driver Framework;C:\WINDOWS\System32\drivers\WdiWiFi.sys [2017-7-25 757248]
S3 WdNisDrv;Windows Defender Antivirus Network Inspection System Driver;C:\WINDOWS\System32\drivers\WdNisDrv.sys [2017-3-18 121248]
S3 WinMad;WinMad Service;C:\WINDOWS\System32\drivers\winmad.sys [2017-3-18 32160]
S3 WinNat;Windows NAT Driver;C:\WINDOWS\System32\drivers\winnat.sys [2017-3-18 217088]
S3 WinVerbs;WinVerbs Service;C:\WINDOWS\System32\drivers\winverbs.sys [2017-3-18 64920]
S3 xboxgip;Xbox Game Input Protocol Driver;C:\WINDOWS\System32\drivers\xboxgip.sys [2017-7-25 277504]
S3 xinputhid;XINPUT HID Filter Driver;C:\WINDOWS\System32\drivers\xinputhid.sys [2017-3-18 46592]
S4 EPSON_EB_RPCV4_04;EPSON V5 Service4(04);C:\Program Files\Common Files\EPSON\EPW!3 SSRP\E_S50STB.EXE [2017-7-24 166400]
S4 EPSON_PM_RPCV4_04;EPSON V3 Service4(04);C:\Program Files\Common Files\EPSON\EPW!3 SSRP\E_S50RPB.EXE [2017-7-24 128512]
S4 NOBU;Norton Online Backup;C:\Program Files (x86)\Symantec\Norton Online Backup\NOBuAgent.exe [2010-6-1 2804568]
S4 PdiService;Portrait Displays SDK Service;C:\Program Files (x86)\Common Files\Portrait Displays\Drivers\pdisrvc.exe [2010-11-19 109168]
.
=============== File Associations ===============
.
FileExt: .txt: txtfile=C:\WINDOWS\System32\NOTEPAD.EXE %1 [UserChoice]
.
=============== Created Last 30 ================
.
2017-08-08 18:26:59 77312 ----a-w- C:\WINDOWS\SysWow64\spbcd.dll
2017-08-08 18:25:59 17366528 ----a-w- C:\WINDOWS\System32\Windows.UI.Xaml.dll
2017-07-31 22:31:50 236016 ----a-w- C:\Program Files (x86)\Mozilla Firefox\plugins\nppdf32.dll
2017-07-31 22:31:50 236016 ----a-w- C:\Program Files (x86)\Internet Explorer\Plugins\nppdf32.dll
2017-07-29 05:29:44 -------- d-----w- C:\Program Files (x86)\Steam
2017-07-26 12:34:03 810136 ----a-w- C:\WINDOWS\System32\drivers\N360x64\160A000.055\srtsp64.sys
2017-07-26 12:34:03 566912 ----a-w- C:\WINDOWS\System32\drivers\N360x64\160A000.055\symnets.sys
2017-07-26 12:34:03 49304 ----a-w- C:\WINDOWS\System32\drivers\N360x64\160A000.055\srtspx64.sys
2017-07-26 12:34:03 301288 ----a-w- C:\WINDOWS\System32\drivers\N360x64\160A000.055\ironx64.sys
2017-07-26 12:34:03 24608 ----a-w- C:\WINDOWS\System32\drivers\N360x64\160A000.055\symelam.sys
2017-07-26 12:34:03 187520 ----a-w- C:\WINDOWS\System32\drivers\N360x64\160A000.055\ccsetx64.sys
2017-07-26 12:34:03 1868416 ----a-w- C:\WINDOWS\System32\drivers\N360x64\160A000.055\symefasi64.sys
2017-07-26 12:33:42 -------- d-----w- C:\WINDOWS\System32\drivers\N360x64\160A000.055
2017-07-25 13:44:22 -------- d-----w- C:\ProgramData\Microsoft OneDrive
2017-07-25 13:42:41 -------- d-----w- C:\Users\Robert\AppData\Local\DBG
2017-07-25 04:43:44 987648 ----a-w- C:\WINDOWS\SysWow64\wpnapps.dll
2017-07-25 04:36:52 -------- d-----w- C:\WINDOWS\System32\Microsoft
2017-07-25 04:36:52 -------- d-----w- C:\WINDOWS\ServiceProfiles
2017-07-25 01:37:08 -------- d-sh--we C:\ProgramData\Documents
2017-07-25 01:37:08 -------- d-sh--w- C:\Recovery
2017-07-25 01:24:38 -------- d-----w- C:\WINDOWS\System32\wbem\Performance
2017-07-25 01:20:37 -------- d-----w- C:\WINDOWS\System32\wbem\MOF\good
2017-07-25 01:20:37 -------- d-----w- C:\WINDOWS\System32\wbem\MOF\bad
2017-07-25 01:10:49 -------- d-----w- C:\ProgramData\USOShared
2017-07-25 01:09:05 -------- d-----w- C:\Program Files (x86)\Common Files\SpeechEngines
2017-07-25 01:09:00 -------- d-----w- C:\Program Files\Common Files\SpeechEngines
2017-07-25 01:02:52 -------- d-----w- C:\Program Files\Common Files\EPSON
2017-07-25 01:02:49 2233344 ----a-w- C:\WINDOWS\SysWow64\PrintConfig.dll
2017-07-25 01:02:48 -------- d-----w- C:\ProgramData\EPSON
2017-07-25 01:02:26 0 ----a-w- C:\WINDOWS\ativpsrm.bin
2017-07-25 01:02:12 -------- d-----w- C:\ProgramData\SonicFocus
2017-07-25 01:02:06 -------- d-----w- C:\Program Files\Realtek
2017-07-25 01:02:05 -------- d-----w- C:\WINDOWS\SysWow64\RTCOM
2017-07-25 01:00:47 -------- d-----w- C:\WINDOWS\System32\wbem\MOF
2017-07-25 01:00:05 -------- d-----w- C:\WINDOWS\System32\SleepStudy
2017-07-20 12:44:40 -------- dc----w- C:\WINDOWS\Panther
2017-07-15 15:37:21 -------- d-----w- C:\Users\Robert\AppData\Roaming\Roxio Log Files
2017-07-15 12:39:48 -------- d-----w- C:\ProgramData\VTech
2017-07-15 12:33:25 934912 ----a-w- C:\ProgramData\Microsoft\Windows\Templates\VTechUninstall\QtNetwork4.dll
2017-07-15 12:33:25 434040 ----a-w- C:\ProgramData\Microsoft\Windows\Templates\VTechUninstall\UninstallWizard.exe
2017-07-15 12:33:24 7826432 ----a-w- C:\ProgramData\Microsoft\Windows\Templates\VTechUninstall\QtGui4.dll
2017-07-15 12:33:24 527240 ----a-w- C:\ProgramData\Microsoft\Windows\Templates\VTechUninstall\ProductExtend.exe
2017-07-15 12:33:24 335360 ----a-w- C:\ProgramData\Microsoft\Windows\Templates\VTechUninstall\QtXml4.dll
2017-07-15 12:33:24 268800 ----a-w- C:\ProgramData\Microsoft\Windows\Templates\VTechUninstall\QtSvg4.dll
2017-07-15 12:33:24 2150400 ----a-w- C:\ProgramData\Microsoft\Windows\Templates\VTechUninstall\QtCore4.dll
2017-07-13 20:47:44 -------- d-----w- C:\ProgramData\Gibraltar
.
==================== Find3M ====================
.
2017-08-01 02:39:54 8319392 ----a-w- C:\WINDOWS\System32\ntoskrnl.exe
2017-08-01 02:38:47 406544 ----a-w- C:\WINDOWS\SysWow64\policymanager.dll
2017-08-01 02:38:08 382368 ----a-w- C:\WINDOWS\System32\drivers\clfs.sys
2017-08-01 02:36:56 119712 ----a-w- C:\WINDOWS\System32\drivers\tdx.sys
2017-08-01 02:36:49 323488 ----a-w- C:\WINDOWS\apppatch\AcRes.dll
2017-08-01 02:36:29 750496 ----a-w- C:\WINDOWS\SysWow64\WWAHost.exe
2017-08-01 02:35:13 280472 ----a-w- C:\WINDOWS\SysWow64\WerFault.exe
2017-08-01 02:35:09 133904 ----a-w- C:\WINDOWS\SysWow64\WerFaultSecure.exe
2017-08-01 02:34:39 610584 ----a-w- C:\WINDOWS\SysWow64\wer.dll
2017-08-01 02:34:36 359552 ----a-w- C:\WINDOWS\SysWow64\Faultrep.dll
2017-08-01 02:34:32 349600 ----a-w- C:\WINDOWS\SysWow64\msv1_0.dll
2017-08-01 02:34:32 168864 ----a-w- C:\WINDOWS\SysWow64\wermgr.exe
2017-08-01 02:33:57 473240 ----a-w- C:\WINDOWS\System32\policymanager.dll
2017-08-01 02:32:37 2444704 ----a-w- C:\WINDOWS\System32\drivers\dxgkrnl.sys
2017-08-01 02:32:23 712600 ----a-w- C:\WINDOWS\System32\drivers\dxgmms2.sys
2017-08-01 02:32:04 820128 ----a-w- C:\WINDOWS\System32\WWAHost.exe
2017-08-01 02:31:56 5477088 ----a-w- C:\WINDOWS\System32\OneCoreUAPCommonProxyStub.dll
2017-08-01 02:31:49 212384 ----a-w- C:\WINDOWS\System32\browserbroker.dll
2017-08-01 02:31:01 176024 ----a-w- C:\WINDOWS\SysWow64\basecsp.dll
2017-08-01 02:30:52 315288 ----a-w- C:\WINDOWS\System32\WerFault.exe
2017-08-01 02:30:50 143736 ----a-w- C:\WINDOWS\System32\WerFaultSecure.exe
2017-08-01 02:30:25 723680 ----a-w- C:\WINDOWS\System32\wer.dll
2017-08-01 02:30:21 82336 ----a-w- C:\WINDOWS\System32\drivers\vmbkmcl.sys
2017-08-01 02:30:18 410160 ----a-w- C:\WINDOWS\System32\Faultrep.dll
2017-08-01 02:30:16 182688 ----a-w- C:\WINDOWS\System32\wermgr.exe
2017-08-01 02:30:09 411040 ----a-w- C:\WINDOWS\System32\msv1_0.dll
2017-08-01 02:26:58 204192 ----a-w- C:\WINDOWS\System32\basecsp.dll
2017-08-01 02:20:54 404480 ----a-w- C:\WINDOWS\SysWow64\werui.dll
2017-08-01 02:20:40 154624 ----a-w- C:\WINDOWS\SysWow64\DWWIN.EXE
2017-08-01 02:20:33 2956288 ----a-w- C:\WINDOWS\SysWow64\win32kfull.sys
2017-08-01 02:18:16 13841408 ----a-w- C:\WINDOWS\SysWow64\Windows.UI.Xaml.dll
2017-08-01 02:18:13 2199552 ----a-w- C:\WINDOWS\SysWow64\Windows.UI.Xaml.Resources.dll
2017-08-01 02:17:02 34816 ----a-w- C:\WINDOWS\SysWow64\tokenbinding.dll
2017-08-01 02:16:16 80896 ----a-w- C:\WINDOWS\SysWow64\Chakradiag.dll
2017-08-01 02:14:09 35840 ----a-w- C:\WINDOWS\SysWow64\sscore.dll
2017-08-01 02:13:31 127488 ----a-w- C:\WINDOWS\SysWow64\fdeploy.dll
2017-08-01 02:13:30 20504064 ----a-w- C:\WINDOWS\SysWow64\edgehtml.dll
2017-08-01 02:13:12 364032 ----a-w- C:\WINDOWS\SysWow64\msIso.dll
2017-08-01 02:12:28 229888 ----a-w- C:\WINDOWS\SysWow64\scksp.dll
2017-08-01 02:10:19 358400 ----a-w- C:\WINDOWS\SysWow64\ieproxy.dll
2017-08-01 02:09:58 394240 ----a-w- C:\WINDOWS\SysWow64\Windows.Internal.Management.dll
2017-08-01 02:08:54 267264 ----a-w- C:\WINDOWS\SysWow64\ncryptprov.dll
2017-08-01 02:07:57 2671616 ----a-w- C:\WINDOWS\SysWow64\tquery.dll
2017-08-01 02:07:54 5961728 ----a-w- C:\WINDOWS\SysWow64\Windows.Data.Pdf.dll
2017-08-01 02:06:46 798208 ----a-w- C:\WINDOWS\SysWow64\TokenBroker.dll
2017-08-01 02:04:40 6269440 ----a-w- C:\WINDOWS\SysWow64\Chakra.dll
2017-08-01 02:04:32 3656192 ----a-w- C:\WINDOWS\SysWow64\jscript9.dll
2017-08-01 01:57:22 23677952 ----a-w- C:\WINDOWS\System32\edgehtml.dll
2017-08-01 01:45:44 3670016 ----a-w- C:\WINDOWS\System32\win32kfull.sys
2017-08-01 01:45:28 462848 ----a-w- C:\WINDOWS\System32\werui.dll
2017-08-01 01:45:03 92672 ----a-w- C:\WINDOWS\System32\wercplsupport.dll
2017-08-01 01:45:02 1275392 ----a-w- C:\WINDOWS\System32\werconcpl.dll
2017-08-01 01:44:53 184320 ----a-w- C:\WINDOWS\System32\DWWIN.EXE
2017-08-01 01:44:49 77824 ----a-w- C:\WINDOWS\System32\wsqmcons.exe
2017-08-01 01:44:32 83968 ----a-w- C:\WINDOWS\System32\drivers\vmbkmclr.sys
2017-08-01 01:42:55 2199552 ----a-w- C:\WINDOWS\System32\Windows.UI.Xaml.Resources.dll
2017-08-01 01:41:48 42496 ----a-w- C:\WINDOWS\System32\tokenbinding.dll
2017-08-01 01:41:47 130560 ----a-w- C:\WINDOWS\System32\policymanagerprecheck.dll
2017-08-01 01:41:04 110592 ----a-w- C:\WINDOWS\System32\Chakradiag.dll
2017-08-01 01:40:35 290816 ----a-w- C:\WINDOWS\System32\dmenterprisediagnostics.dll
2017-08-01 01:39:04 46592 ----a-w- C:\WINDOWS\System32\sscore.dll
2017-08-01 01:38:49 143872 ----a-w- C:\WINDOWS\System32\profsvcext.dll
2017-08-01 01:38:21 153088 ----a-w- C:\WINDOWS\System32\fdeploy.dll
2017-08-01 01:37:53 433664 ----a-w- C:\WINDOWS\System32\msIso.dll
2017-08-01 01:37:29 582656 ----a-w- C:\WINDOWS\System32\SmsRouterSvc.dll
2017-08-01 01:37:09 255488 ----a-w- C:\WINDOWS\System32\scksp.dll
2017-08-01 01:35:14 692736 ----a-w- C:\WINDOWS\System32\jscript9diag.dll
2017-08-01 01:34:37 805888 ----a-w- C:\WINDOWS\System32\ieproxy.dll
2017-08-01 01:33:49 1269760 ----a-w- C:\WINDOWS\System32\enterprisecsps.dll
2017-08-01 01:33:28 315904 ----a-w- C:\WINDOWS\System32\ncryptprov.dll
2017-08-01 01:32:47 7336960 ----a-w- C:\WINDOWS\System32\Windows.Data.Pdf.dll
2017-08-01 01:32:37 176640 ----a-w- C:\WINDOWS\System32\wersvc.dll
2017-08-01 01:31:25 4445696 ----a-w- C:\WINDOWS\System32\SettingsHandlers_nt.dll
2017-08-01 01:31:03 1396736 ----a-w- C:\WINDOWS\System32\wwansvc.dll
2017-08-01 01:30:43 8209920 ----a-w- C:\WINDOWS\System32\Chakra.dll
2017-08-01 01:30:42 303104 ----a-w- C:\WINDOWS\System32\srvsvc.dll
2017-08-01 01:30:27 1052160 ----a-w- C:\WINDOWS\System32\TokenBroker.dll
2017-08-01 01:30:18 2055168 ----a-w- C:\WINDOWS\System32\win32kbase.sys
2017-08-01 01:30:09 3377664 ----a-w- C:\WINDOWS\System32\tquery.dll
2017-08-01 01:28:51 2516480 ----a-w- C:\WINDOWS\System32\diagtrack.dll
2017-08-01 01:28:43 4730368 ----a-w- C:\WINDOWS\System32\jscript9.dll
2017-08-01 01:27:25 574464 ----a-w- C:\WINDOWS\System32\configmanager2.dll
2017-08-01 01:27:05 482816 ----a-w- C:\WINDOWS\System32\dmenrollengine.dll
2017-08-01 01:26:03 323584 ----a-w- C:\WINDOWS\System32\DeviceEnroller.exe
2017-08-01 01:25:46 249344 ----a-w- C:\WINDOWS\System32\coredpus.dll
2017-08-01 01:25:41 194048 ----a-w- C:\WINDOWS\System32\mdmregistration.dll
2017-08-01 01:25:41 140800 ----a-w- C:\WINDOWS\System32\dmcsps.dll
2017-07-31 15:15:09 835576 ----a-w- C:\WINDOWS\SysWow64\FlashPlayerApp.exe
2017-07-31 15:15:09 177648 ----a-w- C:\WINDOWS\SysWow64\FlashPlayerCPLApp.cpl
2017-07-28 05:30:35 1068720 ----a-w- C:\WINDOWS\System32\Windows.UI.dll
2017-07-28 05:25:32 2399728 ----a-w- C:\WINDOWS\System32\KernelBase.dll
2017-07-28 05:24:52 119904 ----a-w- C:\WINDOWS\System32\dmcmnutils.dll
2017-07-28 05:24:42 116280 ----a-w- C:\WINDOWS\System32\bcd.dll
2017-07-28 05:24:38 2327456 ----a-w- C:\WINDOWS\System32\drivers\ntfs.sys
2017-07-28 05:23:51 723360 ----a-w- C:\WINDOWS\System32\drivers\acpi.sys
2017-07-28 05:23:45 2969888 ----a-w- C:\WINDOWS\System32\CoreUIComponents.dll
2017-07-28 05:22:50 923048 ----a-w- C:\WINDOWS\System32\CoreMessaging.dll
2017-07-28 05:20:38 279968 ----a-w- C:\WINDOWS\System32\drivers\msiscsi.sys
2017-07-28 05:17:27 660680 ----a-w- C:\WINDOWS\System32\dxgi.dll
2017-07-28 05:16:52 961952 ----a-w- C:\WINDOWS\System32\efscore.dll
.
============= FINISH: 20:51:53.03 ===============

Attached Files

attach.txt (7.0 KB)

disclaimer: I was told to post it here after positing it in laptop hardware forum

Dear community,
First and foremost, I would like to express the fact that I'm new to this community and I am not tech savvy. I am just your random user who turn on the computer, uses it, and turns it off.
For two year, I own a Samsung Laptop - model: Samsung ATIV 9 model: NP940X3G Specs - Laptops NP940X3GI | Samsung PCs
Two weeks ago, the screen started to jitter without any known trigger. When I touch the keypad, the jittering/shacks/flickers stops. When I life my finger from the keypad, the jittering / flickers continues.
From thinking of it, I assumed the problem can be either the touch-pad or the screen. I also surmised that it might have been a driver or a anything relates to it. Problem is, all the google searches lead to nothing and I ran out of question. I'm too broke to go to a technician and I would hate to buy a new laptop just because of that (solvable?) issue.
can anyone please try to help me? I would be forever thankful. Again, sorry if I did anything wrong in this message, I'm just frustrated and out of options. Please be gentle with me.
here is a link to a vid I took, with the problem: imgingi2.

so i got infected and the virus make my multimedia classs scheduler not auto starting even tought i already put startup type to automatic. can anyone help me?

dont know if I did this right, but here are the 2 attachments you requested for virus cleaning....
1. had previous problem booting up windows 7 prof. finally did get booted
2. have run antivirus/spyware/malwarebytes etc, no evidence of aforementioned.
3. computer has acted weird: is not letting me open links, not allowing me to open sites
4. currently, have kept updated but now...says I have 8 win updates; when closing, it "downloads"; then when I check after it does this, its the same update numbers as before (looping); also when checking for updates, its giving me an error installation failed.

thanks for your help; awaiting instructions what to do next. let me know asap please, and if you need anything else.

Attached Files

	attach.txt (22.0 KB)
	dds.txt (26.2 KB)

--ORIGINAL POST-- >> http://www.techsupportforum.com/foru...g-1208537.html
Hey guys,

So this morning I turned on my PC and found that I couldn't open Firefox. I got an error saying that Firefox has stopped working. So I closed it out, and tried again... Same thing. I tried restarting my computer, still not working. So I thought I'd uninstall it, and reinstall through Internet Explorer. So I uninstalled it, opened up Internet Explorer, and got the same message. I read that I could opened the command prompt and enter in something along the lines of netsh winlock reset.... I don't remember what it was exactly, but there were 2 or 3 commands that various forums suggested. That didn't work. So I contacted Microsoft, and they suggest a system restore. I tried it about 5 times, and it just wouldn't restore. I kept getting another error saying that it was unsuccessful due to an anti-virus program or something. I use Avast, so I opened it up and turned off everything that I could. Tried the system restore again, still didn't work. Found a video on Youtube that suggested I turn off graphic rendering or something like that under the internet options. That didn't work either.

So I'm super pissed about all of this because it was working perfectly fine last night. I'm hoping someone else may have some better suggestions for me.

Thank you

--UPDATED POST--

I have gone through the checklist for the malware removal process, however I did not back up my data since I don't have anywhere to back it up to.

dds.txt:

DDS (Ver_2012-11-20.01) - NTFS_AMD64
Internet Explorer: 11.0.9600.18500
Run by Anthony at 12:21:32 on 2017-09-02
Microsoft Windows 7 Professional 6.1.7601.1.1252.1.1033.18.8076.4889 [GMT -7:00]
.
AV: Avast Antivirus *Enabled/Updated* {8EA8924E-BC81-DC44-8BB0-8BAE75D86EBF}
SP: Windows Defender *Disabled/Outdated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
SP: Avast Antivirus *Enabled/Updated* {35C973AA-9ABB-D3CA-B100-B0DC0E5F2402}
.
============== Running Processes ===============
.
C:\Windows\system32\lsm.exe
C:\Windows\system32\svchost.exe -k DcomLaunch
C:\Program Files\NVIDIA Corporation\Display.NvContainer\NVDisplay.Container.exe
C:\Windows\system32\svchost.exe -k RPCSS
C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted
C:\Program Files\NVIDIA Corporation\Display.NvContainer\NVDisplay.Container.exe
C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted
C:\Windows\system32\svchost.exe -k LocalService
C:\Windows\system32\svchost.exe -k netsvcs
C:\Windows\system32\svchost.exe -k NetworkService
C:\Program Files\AVAST Software\Avast\AvastSvc.exe
C:\Windows\System32\spoolsv.exe
C:\Windows\system32\svchost.exe -k LocalServiceNoNetwork
C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe
C:\Windows\SysWOW64\ASGT.exe
C:\Program Files\ASRock\XFast LAN\spd.exe
C:\Program Files\Intel\iCLS Client\HeciServer.exe
C:\Program Files\Intel\Intel(R) Smart Connect Technology Agent\iSCTAgent.exe
C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\DAL\jhi_service.exe
C:\Program Files\Logitech Gaming Software\Drivers\APOService\LogiRegistryService.exe
C:\Program Files (x86)\Common Files\Microsoft Shared\VS7DEBUG\mdm.exe
C:\Program Files\NVIDIA Corporation\NvContainer\nvcontainer.exe
C:\Program Files (x86)\NVIDIA Corporation\NvTelemetry\NvTelemetryContainer.exe
C:\Windows\system32\svchost.exe -k imgsvc
C:\Program Files (x86)\Belkin\F9L1101\V1\wlansrv.exe
C:\Windows\system32\taskhost.exe
C:\Windows\system32\Dwm.exe
C:\Windows\Explorer.EXE
C:\Windows\System32\igfxpers.exe
C:\Program Files\ASRock\XFast LAN\cfosspeed.exe
C:\Windows\System32\rundll32.exe
C:\Program Files\Lucidlogix Technologies\VIRTU MVP\MVPControlPanel.exe
C:\Windows\SysWOW64\HsMgr.exe
C:\Windows\system\HsMgr64.exe
C:\Program Files\File Association Helper\FAHWindow.exe
C:\Program Files (x86)\NVIDIA Corporation\NvContainer\nvcontainer.exe
C:\Windows\system32\SearchIndexer.exe
C:\Program Files\Windows Media Player\wmpnetwk.exe
C:\Windows\system32\svchost.exe -k LocalServiceAndNoImpersonation
C:\Windows\System32\svchost.exe -k LocalServicePeerNet
C:\Program Files (x86)\Belkin\F9L1101\V1\PBN.exe
C:\Program Files\AVAST Software\Avast\AvastUI.exe
C:\Program Files (x86)\Intel\Intel(R) USB 3.0 eXtensible Host Controller Driver\Application\iusb3mon.exe
C:\Program Files\NVIDIA Corporation\ShadowPlay\nvspcaps64.exe
C:\Program Files\NVIDIA Corporation\ShadowPlay\nvsphelper64.exe
C:\Program Files (x86)\NVIDIA Corporation\NVIDIA GeForce Experience\NVIDIA Share.exe
C:\Program Files\Lucidlogix Technologies\VIRTU MVP\EKAG20NT.EXE
C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorIcon.exe
C:\Program Files\AVAST Software\SZBrowser\4.58.2552.909_0\SZBrowser.exe
C:\Program Files\AVAST Software\SZBrowser\4.58.2552.909_0\SZBrowser_crashreporter.exe
C:\Program Files\AVAST Software\SZBrowser\4.58.2552.909_0\SZBrowser.exe
C:\Program Files\AVAST Software\SZBrowser\4.58.2552.909_0\SZBrowser.exe
C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorDataMgrSvc.exe
C:\Program Files (x86)\NVIDIA Corporation\NvNode\NVIDIA Web Helper.exe
C:\Program Files\AVAST Software\SZBrowser\4.58.2552.909_0\SZBrowser.exe
C:\Program Files\AVAST Software\SZBrowser\4.58.2552.909_0\SZBrowser.exe
C:\Program Files\AVAST Software\SZBrowser\4.58.2552.909_0\SZBrowser.exe
C:\Program Files\AVAST Software\SZBrowser\4.58.2552.909_0\SZBrowser.exe
C:\Program Files\AVAST Software\SZBrowser\4.58.2552.909_0\SZBrowser.exe
C:\Program Files\AVAST Software\SZBrowser\4.58.2552.909_0\SZBrowser.exe
C:\Program Files\AVAST Software\SZBrowser\4.58.2552.909_0\SZBrowser.exe
C:\Program Files (x86)\NVIDIA Corporation\NVIDIA GeForce Experience\NVIDIA Share.exe
C:\Program Files\AVAST Software\SZBrowser\4.58.2552.909_0\SZBrowser.exe
C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\FWService\IntelMeFWService.exe
C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\LMS\LMS.exe
C:\Program Files\AVAST Software\Avast\x64\aswidsagenta.exe
C:\Windows\SysWOW64\cmd.exe
C:\Program Files\AVAST Software\Avast\AvastNM.exe
C:\Windows\system32\taskeng.exe
C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\UNS\UNS.exe
C:\Windows\servicing\TrustedInstaller.exe
C:\Program Files\AVAST Software\SZBrowser\4.58.2552.909_0\SZBrowser.exe
C:\Windows\system32\SearchProtocolHost.exe
C:\Windows\system32\SearchFilterHost.exe
C:\Windows\system32\wbem\wmiprvse.exe
C:\Windows\System32\cscript.exe
.
============== Pseudo HJT Report ===============
.
uSearch Bar = Preserve
mWinlogon: Userinit = userinit.exe,
BHO: Groove GFS Browser Helper: {72853161-30C5-4D22-B7F9-0BBC1D38A37E} - C:\Program Files (x86)\Microsoft Office\Office12\GrooveShellExtensions.dll
BHO: avast! Online Security: {8E5E2654-AD2D-48bf-AC2D-D17F00898D06} - C:\Program Files\AVAST Software\Avast\aswWebRepIE.dll
uRun: [ASRockXTU] <no file>
mRun: [USB3MON] "C:\Program Files (x86)\Intel\Intel(R) USB 3.0 eXtensible Host Controller Driver\Application\iusb3mon.exe"
mRun: [IAStorIcon] C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorIconLaunch.exe "C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorIcon.exe" 60
mRun: [THX TruStudio NB Settings] "C:\Program Files (x86)\Creative\THX TruStudio\THXNBSet\THXAudNB.exe" /r
mRun: [UpdReg] C:\Windows\UpdReg.EXE
mRun: [GrooveMonitor] "C:\Program Files (x86)\Microsoft Office\Office12\GrooveMonitor.exe"
dRunOnce: [SPReview] "C:\Windows\System32\SPReview\SPReview.exe" /sp:1 /errorfwlink:"http://go.microsoft.com/fwlink/?LinkID=122915" /build:7601
StartupFolder: C:\PROGRA~3\MICROS~1\Windows\STARTM~1\Programs\Startup\BELKIN~1.LNK - C:\Program Files (x86)\Belkin\F9L1101\V1\PBN.exe
uPolicies-Explorer: NoDriveTypeAutoRun = dword:145
mPolicies-Explorer: NoActiveDesktop = dword:1
mPolicies-Explorer: NoActiveDesktopChanges = dword:1
mPolicies-System: ConsentPromptBehaviorAdmin = dword:0
mPolicies-System: ConsentPromptBehaviorUser = dword:3
mPolicies-System: EnableLUA = dword:0
mPolicies-System: EnableUIADesktopToggle = dword:0
mPolicies-System: PromptOnSecureDesktop = dword:0
mPolicies-System: SoftwareSASGeneration = dword:1
IE: {2670000A-7350-4f3c-8081-5663EE0C6C49} - {48E73304-E1D6-4330-914C-F5F514E3486C} - C:\Program Files (x86)\Microsoft Office\Office12\ONBttnIE.dll
IE: {92780B25-18CC-41C8-B9BE-3C9C571A8263} - {FF059E31-CC5A-4E2E-BF3B-96E929D65503}
TCP: NameServer = 192.168.1.1
TCP: Interfaces\{1906FD99-FD17-4D90-AAA2-4856F3F2B2D4} : DHCPNameServer = 192.168.1.1
TCP: Interfaces\{2023922C-EB20-4094-A279-49AE083C27B9} : DHCPNameServer = 192.168.1.1
TCP: Interfaces\{2023922C-EB20-4094-A279-49AE083C27B9}\2656C6B696E6E2362643 : DHCPNameServer = 192.168.2.1
TCP: Interfaces\{2023922C-EB20-4094-A279-49AE083C27B9}\351637175716473686024456E6 : DHCPNameServer = 192.168.2.1
TCP: Interfaces\{2023922C-EB20-4094-A279-49AE083C27B9}\E45445745414250363 : DHCPNameServer = 192.168.1.1
TCP: Interfaces\{2023922C-EB20-4094-A279-49AE083C27B9}\E45445745414258323D25374 : DHCPNameServer = 192.168.1.1
TCP: Interfaces\{6A43B67C-5472-4CA4-A288-F21C57389202} : DHCPNameServer = 192.168.1.1
TCP: Interfaces\{A1E11ED5-53EE-4955-A895-F886EE11497F} : DHCPNameServer = 192.168.1.1
Handler: grooveLocalGWS - {88FED34C-F0CA-4636-A375-3CB6248B04CD} - C:\Program Files (x86)\Microsoft Office\Office12\GrooveSystemServices.dll
AppInit_DLLs= C:\Windows\SysWOW64\appinit_dll.dll
SSODL: WebCheck - <orphaned>
SEH: Groove GFS Stub Execution Hook - {B5A7F190-DDA6-4420-B3BA-52453494E6CD} - C:\Program Files (x86)\Microsoft Office\Office12\GrooveShellExtensions.dll
x64-BHO: avast! Online Security: {8E5E2654-AD2D-48bf-AC2D-D17F00898D06} - C:\Program Files\AVAST Software\Avast\aswWebRepIE64.dll
x64-Run: [Nvtmru] "C:\Program Files (x86)\NVIDIA Corporation\NVIDIA Update Core\nvtmru.exe"
x64-Run: [IgfxTray] C:\Windows\System32\igfxtray.exe
x64-Run: [HotKeysCmds] C:\Windows\System32\hkcmd.exe
x64-Run: [Persistence] C:\Windows\System32\igfxpers.exe
x64-Run: [RTHDVCPL] C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe -s
x64-Run: [XFast LAN] C:\Program Files\ASRock\XFast LAN\cFosSpeed.exe
x64-Run: [THXCfg64] C:\Windows\System32\RunDLL32.exe C:\Windows\System32\THXCfg64.dll,RunDLLEntry THXCfg64
x64-Run: [VIRTU MVP] C:\Program Files\Lucidlogix Technologies\VIRTU MVP\MVPControlPanel.Exe /hide
x64-Run: [Cmaudio8788] C:\Windows\syswow64\RunDll32.exe C:\Windows\Syswow64\cmicnfgp.dll,CMICtrlWnd
x64-Run: [Cmaudio8788GX] C:\Windows\syswow64\HsMgr.exe Envoke
x64-Run: [Cmaudio8788GX64] C:\Windows\system\HsMgr64.exe Envoke
x64-Run: [FAHConsole] C:\Program Files\File Association Helper\FAHConsole.exe
x64-Run: [Launch LCore] C:\Program Files\Logitech Gaming Software\LCore.exe /minimized
x64-Run: [ShadowPlay] "C:\Windows\System32\rundll32.exe" C:\Windows\System32\nvspcap64.dll,ShadowPlayOnSystemStart
x64-Run: [Malwarebytes TrayApp] C:\PROGRAM FILES\MALWAREBYTES\ANTI-MALWARE\mbamtray.exe
x64-Run: [AvastUI.exe] "C:\Program Files\AVAST Software\Avast\AvLaunch.exe" /gui
x64-Handler: grooveLocalGWS - {88FED34C-F0CA-4636-A375-3CB6248B04CD} - <orphaned>
x64-Notify: igfxcui - igfxdev.dll
x64-SSODL: WebCheck - <orphaned>
.
================= FIREFOX ===================
.
FF - ProfilePath - C:\Users\Anthony\AppData\Roaming\Mozilla\Firefox\Profiles\0hp6lv80.default\
FF - prefs.js: browser.search.defaulturl - hxxps://search.yahoo.com/yhs/search
FF - prefs.js: browser.search.selectedEngine - Yahoo! (Avast)
FF - prefs.js: browser.startup.homepage - hxxps://www.google.com/
FF - prefs.js: keyword.URL - hxxps://search.yahoo.com/yhs/search
FF - plugin: C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AIR\nppdf32.dll
FF - plugin: C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\IPT\npIntelWebAPIIPT.dll
FF - plugin: C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\IPT\npIntelWebAPIUpdater.dll
FF - plugin: c:\Program Files (x86)\Microsoft Silverlight\5.1.50901.0\npctrlui.dll
FF - plugin: C:\Program Files (x86)\NVIDIA Corporation\3D Vision\npnv3dv.dll
FF - plugin: C:\Program Files (x86)\NVIDIA Corporation\3D Vision\npnv3dvstreaming.dll
FF - plugin: C:\Windows\SysWOW64\Macromed\Flash\NPSWF32_26_0_0_151.dll
.
============= SERVICES / DRIVERS ===============
.
R0 AsrRamDisk;AsrRamDisk;C:\Windows\System32\drivers\AsrRamDisk.sys [2014-8-28 34640]
R0 iaStorA;iaStorA;C:\Windows\System32\drivers\iaStorA.sys [2014-8-28 647736]
R0 iaStorF;iaStorF;C:\Windows\System32\drivers\iaStorF.sys [2014-8-28 28216]
R0 iusb3hcs;Intel(R) USB 3.0 Host Controller Switch Driver;C:\Windows\System32\drivers\iusb3hcs.sys [2014-8-28 16152]
R1 AsrAppCharger;AsrAppCharger;C:\Windows\System32\drivers\AsrAppCharger.sys [2014-8-28 17192]
R1 aswbidsdriver;aswbidsdriver;C:\Windows\System32\drivers\aswbidsdrivera.sys [2017-8-15 320528]
R1 aswKbd;aswKbd;C:\Windows\System32\drivers\aswKbd.sys [2016-7-11 41832]
R1 aswSnx;aswSnx;C:\Windows\System32\drivers\aswSnx.sys [2014-8-30 1016384]
R1 aswSP;aswSP;C:\Windows\System32\drivers\aswSP.sys [2014-8-30 590880]
R1 ESProtectionDriver;Malwarebytes Anti-Exploit;C:\Windows\System32\drivers\mbae64.sys [2017-6-19 77376]
R1 FNETURPX;FNETURPX;C:\Windows\System32\drivers\FNETURPX.SYS [2014-8-28 16648]
R2 ASGT;ASGT;C:\Windows\SysWOW64\ASGT.exe [2012-1-17 55296]
R2 aswMonFlt;aswMonFlt;C:\Windows\System32\drivers\aswMonFlt.sys [2014-8-30 147784]
R2 aswStm;aswStm;C:\Windows\System32\drivers\aswStm.sys [2014-8-30 199312]
R2 avast! Antivirus;Avast Antivirus;C:\Program Files\AVAST Software\Avast\AvastSvc.exe [2017-8-31 275208]
R2 IAStorDataMgrSvc;Intel(R) Rapid Storage Technology;C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorDataMgrSvc.exe [2014-8-28 14904]
R2 Intel(R) Capability Licensing Service Interface;Intel(R) Capability Licensing Service Interface;C:\Program Files\Intel\iCLS Client\HeciServer.exe [2012-6-19 634632]
R2 Intel(R) ME Service;Intel(R) ME Service;C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\FWService\IntelMeFWService.exe [2014-8-28 129856]
R2 ISCTAgent;ISCT Always Updated Agent;C:\Program Files\Intel\Intel(R) Smart Connect Technology Agent\iSCTAgent.exe [2012-2-9 133632]
R2 jhi_service;Intel(R) Dynamic Application Loader Host Interface Service;C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\DAL\Jhi_service.exe [2014-8-28 166720]
R2 LGCoreTemp;Logitech CPU Core Tempurature;C:\Program Files\Logitech Gaming Software\Drivers\LgCoreTemp\LgCoreTemp.sys [2015-6-21 14184]
R2 LogiRegistryService;Logitech Gaming Registry Service;C:\Program Files\Logitech Gaming Software\Drivers\APOService\LogiRegistryService.exe [2017-8-18 225400]
R2 NvContainerLocalSystem;NVIDIA LocalSystem Container;C:\Program Files\NVIDIA Corporation\NvContainer\nvcontainer.exe [2017-1-15 495224]
R2 NVDisplay.ContainerLocalSystem;NVIDIA Display Container LS;C:\Program Files\NVIDIA Corporation\Display.NvContainer\NVDisplay.Container.exe [2017-1-15 462968]
R2 NvTelemetryContainer;NVIDIA Telemetry Container;C:\Program Files (x86)\NVIDIA Corporation\NvTelemetry\NvTelemetryContainer.exe [2017-4-22 450168]
R2 UNS;Intel(R) Management and Security Application User Notification Service;C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\UNS\UNS.exe [2014-8-28 365344]
R2 WLANBelkinService;Belkin WLAN service;C:\Program Files (x86)\Belkin\F9L1101\V1\wlansrv.exe [2012-10-5 86016]
R3 aswbIDSAgent;aswbIDSAgent;C:\Program Files\AVAST Software\Avast\x64\aswidsagenta.exe [2017-8-31 7452288]
R3 cmudaxp;ASUS Xonar DGX Audio Interface;C:\Windows\System32\drivers\cmudaxp.sys [2014-9-13 2727936]
R3 ikbevent;Intel Upper keyboard Class Filter Driver;C:\Windows\System32\drivers\ikbevent.sys [2012-2-9 25536]
R3 imsevent;Intel Upper Mouse Class Filter Driver;C:\Windows\System32\drivers\imsevent.sys [2012-2-9 25536]
R3 ISCT;Intel(R) Smart Connect Technology Device Driver;C:\Windows\System32\drivers\ISCTD64.sys [2012-2-9 44992]
R3 iusb3hub;Intel(R) USB 3.0 Hub Driver;C:\Windows\System32\drivers\iusb3hub.sys [2014-8-28 356120]
R3 iusb3xhc;Intel(R) USB 3.0 eXtensible Host Controller Driver;C:\Windows\System32\drivers\iusb3xhc.sys [2014-8-28 788760]
R3 LGBusEnum;Logitech Gaming Virtual Bus Enumerator Driver;C:\Windows\System32\drivers\LGBusEnum.sys [2017-8-18 36496]
R3 LGJoyXlCore;Logitech Translation Layer Driver (LGS);C:\Windows\System32\drivers\LGJoyXlCore.sys [2017-8-18 67736]
R3 LGVirHid;Logitech Gamepanel Virtual HID Device Driver;C:\Windows\System32\drivers\LGVirHid.sys [2017-8-18 26008]
R3 LVUSBS64;Logitech USB Monitor Filter;C:\Windows\System32\drivers\LVUSBS64.sys [2007-5-11 50208]
R3 nvvad_WaveExtensible;NVIDIA Virtual Audio Device (Wave Extensible) (WDM);C:\Windows\System32\drivers\nvvad64v.sys [2017-7-24 48248]
R3 nvvhci;NVVHCI Enumerator Service;C:\Windows\System32\drivers\nvvhci.sys [2017-4-22 76840]
R3 RTL8167;Realtek 8167 NT Driver;C:\Windows\System32\drivers\Rt64win7.sys [2014-8-28 565352]
R3 VirtuWDDM;VirtuWDDM;C:\Windows\System32\drivers\VirtuWDDM.sys [2014-8-28 66336]
R3 WPRO_41_2001;WinPcap Packet Driver (WPRO_41_2001);C:\Windows\System32\drivers\WPRO_41_2001.sys [2014-8-28 34752]
S2 clr_optimization_v4.0.30319_32;Microsoft .NET Framework NGEN v4.0.30319_X86;C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe [2014-4-11 103608]
S2 clr_optimization_v4.0.30319_64;Microsoft .NET Framework NGEN v4.0.30319_X64;C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe [2014-4-11 124088]
S2 MBAMService;Malwarebytes Service;C:\Program Files\Malwarebytes\Anti-Malware\MBAMService.exe [2017-6-19 4470736]
S3 aswHwid;aswHwid;C:\Windows\System32\drivers\aswHwid.sys [2014-8-30 47016]
S3 BCMH43XX;N+ Wireless USB Adapter Driver;C:\Windows\System32\drivers\bcmwlhigh664.sys [2011-4-19 1254464]
S3 BEService;BattlEye Service;C:\Program Files (x86)\Common Files\BattlEye\BEService.exe [2017-8-18 1522184]
S3 CM_VENDER_CMD;CM_VENDER_CMD;C:\Program Files\Common Files\Logitech\G430Install\CMVC64.sys [2014-7-30 17104]
S3 FNETTBOH_305;FNETTBOH_305;C:\Windows\System32\drivers\FNETTBOH_305.SYS [2014-8-29 32320]
S3 IEEtwCollectorService;Internet Explorer ETW Collector Service;C:\Windows\System32\ieetwcollector.exe [2016-10-11 114688]
S3 IntcDAud;Intel(R) Display Audio;C:\Windows\System32\drivers\IntcDAud.sys [2014-8-28 342528]
S3 iumsvc;Intel(R) Update Manager;C:\Program Files (x86)\Intel\Intel(R) Update Manager\bin\iumsvc.exe [2016-8-12 177376]
S3 LADF_CaptureOnly;LADF Capture Filter Driver;C:\Windows\System32\drivers\ladfGSCamd64.sys [2014-7-30 410008]
S3 LADF_RenderOnly;LADF Render Filter Driver;C:\Windows\System32\drivers\ladfGSRamd64.sys [2014-7-30 102808]
S3 ladfGSS;Logitech USB Surround Filter Driver (LGS);C:\Windows\System32\drivers\ladfGSS.sys [2017-8-18 45192]
S3 lvpopf64;Logitech POP Suppression Filter;C:\Windows\System32\drivers\lvpopf64.sys [2007-5-11 1361952]
S3 LVUVC64;Logitech QuickCam Fusion(UVC);C:\Windows\System32\drivers\lvuvc64.sys [2007-5-11 3612704]
S3 MBAMFarflt;MBAMFarflt;C:\Windows\System32\drivers\farflt.sys [2017-6-19 113592]
S3 MBAMProtection;MBAMProtection;C:\Windows\System32\drivers\mbam.sys [2017-6-19 44960]
S3 MBAMWebProtection;MBAMWebProtection;C:\Windows\System32\drivers\mwac.sys [2017-6-19 84256]
S3 MBfilt;MBfilt;C:\Windows\System32\drivers\MBfilt64.sys [2014-8-28 32344]
S3 NvContainerNetworkService;NVIDIA NetworkService Container;C:\Program Files\NVIDIA Corporation\NvContainer\nvcontainer.exe [2017-1-15 495224]
S3 NVFLASH;NVFLASH;C:\Windows\System32\drivers\nvflash.sys [2016-11-3 15648]
S3 NvStreamKms;NVIDIA KMS;C:\Program Files\NVIDIA Corporation\NvStreamSrv\NvStreamKms.sys [2017-7-24 30328]
S3 StorSvc;Storage Service;C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted [2009-7-13 27136]
S3 TsUsbFlt;TsUsbFlt;C:\Windows\System32\drivers\TsUsbFlt.sys [2014-8-30 59392]
S3 WatAdminSvc;Windows Activation Technologies Service;C:\Windows\System32\Wat\WatAdminSvc.exe [2014-8-30 1255736]
S3 WSDScan;WSD Scan Support via UMB;C:\Windows\System32\drivers\WSDScan.sys [2009-7-13 25088]
.
=============== File Associations ===============
.
ShellExec: SZBrowser.exe: open="C:\Program Files\AVAST Software\SZBrowser\Launcher.exe" "%1"
.
=============== Created Last 30 ================
.
2017-09-02 19:09:33 -------- d-----w- C:\ProgramData\SWCUTemp
2017-09-02 19:03:15 94656 ----a-w- C:\Windows\System32\WPRO_41_2001woem.tmp
2017-08-24 19:25:59 -------- d-----w- C:\Users\Anthony\AppData\Local\Discord
2017-08-24 19:02:21 -------- d-----w- C:\Program Files\Common Files\Logitech
2017-08-19 03:26:30 -------- d-----w- C:\Users\Anthony\AppData\Local\UnrealEngine
2017-08-19 03:26:30 -------- d-----w- C:\Users\Anthony\AppData\Local\TslGame
2017-08-19 03:25:43 -------- d-----w- C:\Program Files (x86)\Common Files\BattlEye
2017-08-18 09:01:32 67736 ----a-w- C:\Windows\System32\drivers\LGJoyXlCore.sys
2017-08-18 09:01:32 36496 ----a-w- C:\Windows\System32\drivers\LGBusEnum.sys
2017-08-18 09:01:32 26008 ----a-w- C:\Windows\System32\drivers\LGVirHid.sys
2017-08-18 08:41:52 45192 ----a-w- C:\Windows\System32\drivers\ladfGSS.sys
2017-08-18 08:41:52 4379648 ----a-w- C:\Windows\System32\RenderAPO.dll
2017-08-18 08:41:52 2171656 ----a-w- C:\Windows\System32\CaptureAPO.dll
2017-08-15 19:17:31 57736 ----a-w- C:\Windows\System32\drivers\aswbuniva.sys
2017-08-15 19:17:30 343296 ----a-w- C:\Windows\System32\drivers\aswbloga.sys
2017-08-15 19:17:30 198976 ----a-w- C:\Windows\System32\drivers\aswbidsha.sys
2017-08-15 19:17:29 320528 ----a-w- C:\Windows\System32\drivers\aswbidsdrivera.sys
.
==================== Find3M ====================
.
2017-09-02 19:03:43 253856 ----a-w- C:\Windows\System32\drivers\MBAMSwissArmy.sys
2017-09-02 19:03:15 34752 ----a-w- C:\Windows\System32\drivers\WPRO_41_2001.sys
2017-08-31 17:38:54 84416 ----a-w- C:\Windows\System32\drivers\aswRvrt.sys
2017-08-31 17:38:54 47016 ----a-w- C:\Windows\System32\drivers\aswHwid.sys
2017-08-31 17:38:54 361336 ----a-w- C:\Windows\System32\drivers\aswVmm.sys
2017-08-31 17:38:54 199312 ----a-w- C:\Windows\System32\drivers\aswStm.sys
2017-08-31 17:38:54 147784 ----a-w- C:\Windows\System32\drivers\aswMonFlt.sys
2017-08-31 17:38:53 110376 ----a-w- C:\Windows\System32\drivers\aswRdr2.sys
2017-08-31 17:38:31 1016384 ----a-w- C:\Windows\System32\drivers\aswSnx.sys
2017-08-31 17:38:30 41832 ----a-w- C:\Windows\System32\drivers\aswKbd.sys
2017-08-10 04:19:24 803328 ----a-w- C:\Windows\SysWow64\FlashPlayerApp.exe
2017-08-10 04:19:23 144896 ----a-w- C:\Windows\SysWow64\FlashPlayerCPLApp.cpl
2017-07-27 05:19:39 104624 ----a-w- C:\Windows\System32\drivers\aswHdsKe.sys
2017-07-18 23:24:44 6463608 ----a-w- C:\Windows\System32\nvcpl.dll
2017-07-18 23:24:44 2479040 ----a-w- C:\Windows\System32\nvsvc64.dll
2017-07-18 23:24:42 81856 ----a-w- C:\Windows\System32\nv3dappshextr.dll
2017-07-18 23:24:42 69752 ----a-w- C:\Windows\System32\nvshext.dll
2017-07-18 23:24:42 549312 ----a-w- C:\Windows\System32\nv3dappshext.dll
2017-07-18 23:24:42 392312 ----a-w- C:\Windows\System32\nvmctray.dll
2017-07-18 23:24:42 1762936 ----a-w- C:\Windows\System32\nvsvcr.dll
2017-07-18 22:54:58 1951 ----a-w- C:\Windows\NvContainerRecovery.bat
2017-07-18 22:38:35 135800 ----a-w- C:\Windows\SysWow64\nvStreaming.exe
2017-07-14 05:15:21 77376 ----a-w- C:\Windows\System32\drivers\mbae64.sys
2017-07-13 01:37:09 8095171 ----a-w- C:\Windows\System32\nvcoproc.bin
2017-07-04 05:38:20 84256 ----a-w- C:\Windows\System32\drivers\mwac.sys
2017-07-03 19:09:15 113592 ----a-w- C:\Windows\System32\drivers\farflt.sys
2017-07-03 19:09:14 44960 ----a-w- C:\Windows\System32\drivers\mbam.sys
2017-06-21 07:07:20 1903224 ----a-w- C:\Windows\System32\nvspcap64.dll
2017-06-21 07:07:20 1489528 ----a-w- C:\Windows\SysWow64\nvspcap.dll
2017-06-21 07:07:19 1755256 ----a-w- C:\Windows\System32\nvspbridge64.dll
2017-06-21 07:07:19 1317496 ----a-w- C:\Windows\SysWow64\nvspbridge.dll
2017-06-21 07:07:19 121464 ----a-w- C:\Windows\System32\NvRtmpStreamer64.dll
2017-06-21 07:07:15 48248 ----a-w- C:\Windows\System32\drivers\nvvad64v.sys
2017-06-21 07:07:15 179320 ----a-w- C:\Windows\System32\nvaudcap64v.dll
2017-06-21 07:07:15 146552 ----a-w- C:\Windows\SysWow64\nvaudcap32v.dll
2017-06-20 20:58:22 1951 ----a-w- C:\Windows\NvTelemetryContainerRecovery.bat
2017-06-20 01:03:18 188312 ----a-w- C:\Windows\System32\drivers\MBAMChameleon.sys
.
============= FINISH: 12:22:24.94 ===============


I have also attached the attach.txt file. Also, I do not have access to a Windows install disc or boot cd. Another thing I'd like to add is that the Avast SafeZone browser seems to be working just fine for me, that is what I am using right now. I tried to reinstall Firefox, but I still have the same problem when I try to open it.

I greatly appreciate the help you guys are offering, thank you all so much.

Attached Files

attach.txt (14.4 KB)

Hello techsupportforum!
My girlfriend's PayPal has been getting hacked in the past couple days. The first time happened September 1st and there was an unauthorized money transfer done out of her account as well as her account password being changed. At the same time, she lost phone reception with Fido. She then changed her PayPal password on her PC immediately and filed a claim to PayPal regarding this, and called Fido the next morning to reactivate her phone service (apparently someone else activated my girlfriend's phone number on their sim card and because of that it stopped her service while the stranger had access to the phone number, hard to tell what happened there and how much this part weighs in all this).
Two days later, it happens again (just two hours ago). She has no service on her phone, and her PayPal e-mail had gotten changed again. I have now enabled two-step verification for her PayPal on my phone number, and she changed her password on PayPal again on this computer. The worry now is whether there's something on this computer that's giving out information, or if it totally has nothing to do with it. It's just uncanny and I don't understand how this person could be getting all this information from, so I thought I'd give this a try.

DDS (Ver_2012-11-20.01) - NTFS_AMD64
Internet Explorer: 11.0.15063.0
Run by Karen at 1:41:51 on 2017-09-03
Microsoft Windows 10 Pro 10.0.15063.0.1252.1.1033.18.8096.5646 [GMT -4:00]
.
AV: Windows Defender *Enabled/Updated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
SP: Spybot - Search and Destroy *Enabled/Updated* {4C1D9672-63FE-5C90-371E-8FDA591C5B75}
SP: Windows Defender *Enabled/Updated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
.
============== Running Processes ===============
.
c:\windows\system32\svchost.exe -k dcomlaunch -s PlugPlay
C:\WINDOWS\system32\svchost.exe -k DcomLaunch
C:\WINDOWS\system32\fontdrvhost.exe
C:\WINDOWS\system32\fontdrvhost.exe
c:\windows\system32\svchost.exe -k rpcss
c:\windows\system32\svchost.exe -k dcomlaunch -s LSM
C:\WINDOWS\system32\dwm.exe
c:\windows\system32\svchost.exe -k netsvcs -s gpsvc
c:\windows\system32\svchost.exe -k localsystemnetworkrestricted -s NcbService
c:\windows\system32\svchost.exe -k netsvcs -s Schedule
c:\windows\system32\svchost.exe -k localservicenetworkrestricted -s TimeBrokerSvc
c:\windows\system32\svchost.exe -k localservicenetworkrestricted -s EventLog
c:\windows\system32\svchost.exe -k localsystemnetworkrestricted -s hidserv
c:\windows\system32\svchost.exe -k netsvcs -s ProfSvc
c:\windows\system32\svchost.exe -k localservice -s nsi
c:\windows\system32\svchost.exe -k localservicenetworkrestricted -s Dhcp
c:\windows\system32\svchost.exe -k netsvcs -s UserManager
C:\WINDOWS\system32\svchost.exe -k LocalServiceNoNetwork
C:\Program Files\NVIDIA Corporation\Display.NvContainer\NVDisplay.Container.exe
c:\windows\system32\svchost.exe -k networkservice -s NlaSvc
c:\windows\system32\svchost.exe -k localservice -s netprofm
c:\windows\system32\svchost.exe -k netsvcs -s Themes
c:\windows\system32\svchost.exe -k localsystemnetworkrestricted -s CscService
c:\windows\system32\svchost.exe -k appmodel -s StateRepository
c:\windows\system32\svchost.exe -k localservice -s EventSystem
C:\Program Files\NVIDIA Corporation\Display.NvContainer\NVDisplay.Container.exe
c:\windows\system32\svchost.exe -k netsvcs -s SENS
c:\windows\system32\svchost.exe -k localsystemnetworkrestricted -s AudioEndpointBuilder
c:\windows\system32\svchost.exe -k localservice -s FontCache
svchost.exe
C:\WINDOWS\System32\svchost.exe -k LocalServiceNetworkRestricted
C:\WINDOWS\system32\svchost.exe -k LocalServiceNetworkRestricted
C:\WINDOWS\System32\svchost.exe -k LocalServiceNetworkRestricted
c:\windows\system32\svchost.exe -k networkservice -s Dnscache
C:\WINDOWS\system32\svchost.exe -k LocalSystemNetworkRestricted
c:\windows\system32\svchost.exe -k netsvcs -s ShellHWDetection
C:\WINDOWS\System32\spoolsv.exe
c:\windows\system32\svchost.exe -k networkservice -s LanmanWorkstation
c:\windows\system32\svchost.exe -k appmodel -s tiledatamodelsvc
c:\windows\system32\svchost.exe -k apphost -s AppHostSvc
C:\Program Files\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe
C:\Program Files (x86)\Common Files\Adobe\Adobe Desktop Common\ElevationManager\AdobeUpdateService.exe
C:\WINDOWS\system32\svchost.exe -k imgsvc
C:\WINDOWS\System32\svchost.exe -k utcsvc
c:\windows\system32\svchost.exe -k netsvcs -s Winmgmt
c:\windows\system32\svchost.exe -k iissvcs
C:\Program Files (x86)\Hi-Rez Studios\HiPatchService.exe
c:\windows\system32\svchost.exe -k networkservice -s CryptSvc
C:\WINDOWS\system32\DbxSvc.exe
c:\windows\system32\svchost.exe -k localservice -s WinHttpAutoProxySvc
C:\Program Files\Bonjour\mDNSResponder.exe
c:\windows\system32\svchost.exe -k netsvcs -s WpnService
c:\windows\system32\svchost.exe -k localsystemnetworkrestricted -s PcaSvc
c:\windows\system32\svchost.exe -k localservicenonetwork -s DPS
c:\windows\system32\svchost.exe -k localsystemnetworkrestricted -s SysMain
C:\WINDOWS\System32\svchost.exe -k HPZ12
C:\Program Files (x86)\Spybot - Search & Destroy 2\SDFSSvc.exe
C:\WINDOWS\system32\mqsvc.exe
c:\windows\system32\svchost.exe -k netsvcs -s LanmanServer
C:\Program Files (x86)\Common Files\Adobe\AdobeGCClient\AGSService.exe
c:\windows\system32\svchost.exe -k localsystemnetworkrestricted -s DeviceAssociationService
c:\windows\syswow64\svchost.exe -k hpdevmgmt -s hpqddsvc
C:\Program Files (x86)\Spybot - Search & Destroy 2\SDUpdSvc.exe
c:\windows\system32\svchost.exe -k localsystemnetworkrestricted -s TrkWks
C:\WINDOWS\System32\svchost.exe -k HPZ12
C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe
C:\WINDOWS\system32\SearchIndexer.exe
c:\windows\system32\svchost.exe -k localservicenetworkrestricted -s wscsvc
c:\windows\system32\svchost.exe -k localservice -s WdiServiceHost
C:\WINDOWS\system32\dashost.exe
c:\windows\system32\svchost.exe -k netsvcs -s iphlpsvc
C:\Program Files (x86)\Spybot - Search & Destroy 2\SDWSCSvc.exe
c:\windows\microsoft.net\framework64\v4.0.30319\smsvchost.exe
c:\windows\system32\svchost.exe -k hpservice -s HPSLPSVC
c:\windows\syswow64\svchost.exe -k hpdevmgmt -s hpqcxs08
C:\WINDOWS\system32\wbem\wmiprvse.exe
c:\windows\microsoft.net\framework64\v4.0.30319\smsvchost.exe
c:\windows\system32\svchost.exe -k localserviceandnoimpersonation -s SSDPSRV
c:\windows\system32\sihost.exe
c:\windows\system32\svchost.exe -k unistacksvcgroup -s CDPUserSvc
c:\windows\system32\svchost.exe -k unistacksvcgroup -s WpnUserService
c:\windows\system32\svchost.exe -k netsvcs -s TokenBroker
C:\Program Files\Windows Media Player\wmpnetwk.exe
C:\WINDOWS\Explorer.EXE
c:\windows\system32\taskhostw.exe
C:\Windows\SystemApps\ShellExperienceHost_cw5n1h2txyewy\ShellExperienceHost.exe
C:\Windows\SystemApps\Microsoft.Windows.Cortana_cw5n1h2txyewy\SearchUI.exe
c:\windows\system32\svchost.exe -k localserviceandnoimpersonation -s upnphost
C:\WINDOWS\system32\wbem\wmiprvse.exe
c:\windows\system32\svchost.exe -k localservicenetworkrestricted -s lmhosts
c:\windows\system32\svchost.exe -k netsvcs -s Browser
C:\Windows\System32\RuntimeBroker.exe
C:\Windows\System32\smartscreen.exe
C:\WINDOWS\system32\AUDIODG.EXE
c:\windows\system32\svchost.exe -k localservice -s CDPSvc
C:\Program Files\NVIDIA Corporation\Display\nvtray.exe
C:\Program Files (x86)\NVIDIA Corporation\Update Core\NvBackend.exe
c:\windows\system32\svchost.exe -k netsvcs
c:\windows\system32\svchost.exe -k localservicenetworkrestricted -s NgcCtnrSvc
c:\windows\system32\svchost.exe -k unistacksvcgroup
C:\Program Files\Windows Defender\MSASCuiL.exe
C:\Windows\System32\igfxpers.exe
E:\iTunesHelper.exe
C:\WINDOWS\system32\SearchProtocolHost.exe
C:\Program Files (x86)\Common Files\Adobe\AdobeGCClient\AdobeGCClient.exe
C:\Users\USER\AppData\Local\Microsoft\OneDrive\OneDrive.exe
C:\Program Files (x86)\Common Files\Apple\Internet Services\iCloudServices.exe
C:\Program Files (x86)\Common Files\Apple\Internet Services\iCloudDrive.exe
C:\Program Files (x86)\Common Files\Apple\Apple Application Support\APSDaemon.exe
C:\Program Files (x86)\Common Files\Apple\Internet Services\iCloudPhotos.exe
C:\Program Files (x86)\Common Files\Apple\Apple Application Support\secd.exe
C:\Users\USER\AppData\Roaming\Spotify\SpotifyWebHelper.exe
C:\Program Files\iPod\bin\iPodService.exe
C:\Program Files (x86)\HP\Digital Imaging\bin\hpqtra08.exe
C:\Program Files (x86)\Dropbox\Client\Dropbox.exe
C:\Program Files (x86)\Dropbox\Client\Dropbox.exe
C:\Program Files (x86)\Dropbox\Client\Dropbox.exe
C:\Program Files\McAfee Security Scan\3.11.587\SSScheduler.exe
C:\Program Files\ShareX\ShareX.exe
C:\Program Files (x86)\HP\HP Software Update\hpwuschd2.exe
C:\Program Files (x86)\ControlCenter4\BrCtrlCntr.exe
C:\Program Files (x86)\Browny02\Brother\BrStMonW.exe
C:\Program Files (x86)\Browny02\BrYNSvc.exe
C:\Program Files (x86)\Adobe\Adobe Creative Cloud\ACC\Creative Cloud.exe
C:\Program Files (x86)\ControlCenter4\BrCcUxSys.exe
C:\Program Files (x86)\Spybot - Search & Destroy 2\SDTray.exe
C:\Program Files (x86)\Common Files\Adobe\OOBE\PDApp\IPC\AdobeIPCBroker.exe
C:\WINDOWS\sysWOW64\wbem\wmiprvse.exe
C:\Program Files (x86)\Common Files\Adobe\Adobe Desktop Common\HEX\Adobe CEF Helper.exe
C:\Program Files (x86)\Common Files\Adobe\Adobe Desktop Common\ADS\Adobe Desktop Service.exe
C:\Program Files (x86)\Adobe\Adobe Creative Cloud\CoreSync\CoreSync.exe
C:\Program Files (x86)\Adobe\Adobe Creative Cloud\CCXProcess\CCXProcess.exe
C:\Program Files (x86)\Adobe\Adobe Creative Cloud\CCXProcess\libs\node.exe
C:\Program Files (x86)\Common Files\Adobe\Adobe Desktop Common\HEX\Adobe CEF Helper.exe
c:\windows\system32\svchost.exe -k localsystemnetworkrestricted -s WdiSystemHost
c:\windows\system32\svchost.exe -k netsvcs -s DoSvc
c:\windows\system32\svchost.exe -k netsvcs -s BITS
C:\WINDOWS\system32\SearchFilterHost.exe
c:\windows\system32\svchost.exe -k netsvcs -s Appinfo
C:\WINDOWS\System32\cscript.exe
.
============== Pseudo HJT Report ===============
.
mWinlogon: Userinit = C:\WINDOWS\System32\userinit.exe
BHO: Lync Browser Helper: {31D09BA0-12F5-4CCE-BE8A-2923E76605DA} - C:\Program Files (x86)\Microsoft Office\root\Office16\OCHelper.dll
BHO: Microsoft OneDrive for Business Browser Helper: {D0498E0A-45B7-42AE-A9AA-ABA463DBD3BF} - C:\Program Files (x86)\Microsoft Office\root\Office16\GROOVEEX.DLL
uRun: [OneDrive] "C:\Users\USER\AppData\Local\Microsoft\OneDrive\OneDrive.exe" /background
uRun: [iCloudServices] C:\Program Files (x86)\Common Files\Apple\Internet Services\iCloudServices.exe
uRun: [iCloudDrive] C:\Program Files (x86)\Common Files\Apple\Internet Services\iCloudDrive.exe
uRun: [iCloudPhotos] C:\Program Files (x86)\Common Files\Apple\Internet Services\iCloudPhotos.exe
uRun: [Spotify Web Helper] "C:\Users\USER\AppData\Roaming\Spotify\SpotifyWebHelper.exe"
uRun: [KakaoTalk] "C:\Program Files (x86)\Kakao\KakaoTalk\KakaoTalk.exe" -bystartup
mRun: [Dropbox] "C:\Program Files (x86)\Dropbox\Client\Dropbox.exe" /systemstartup
mRun: [HP Software Update] C:\Program Files (x86)\HP\HP Software Update\HPWuSchd2.exe
mRun: [ControlCenter4] C:\Program Files (x86)\ControlCenter4\BrCcBoot.exe /autorun
mRun: [BrStsMon00] C:\Program Files (x86)\Browny02\Brother\BrStMonW.exe /AUTORUN
mRun: [Adobe Creative Cloud] "C:\Program Files (x86)\Adobe\Adobe Creative Cloud\ACC\Creative Cloud.exe" --showwindow=false --onOSstartup=true
mRun: [SDTray] "C:\Program Files (x86)\Spybot - Search & Destroy 2\SDTray.exe"
StartupFolder: C:\Users\USER\AppData\Roaming\MICROS~1\Windows\STARTM~1\Programs\Startup\ShareX.lnk - C:\Program Files\ShareX\ShareX.exe
StartupFolder: C:\PROGRA~3\MICROS~1\Windows\STARTM~1\Programs\Startup\HPDIGI~1.LNK - C:\Program Files (x86)\HP\Digital Imaging\bin\hpqtra08.exe
StartupFolder: C:\PROGRA~3\MICROS~1\Windows\STARTM~1\Programs\Startup\MCAFEE~1.LNK - C:\Program Files\McAfee Security Scan\3.11.587\SSScheduler.exe
uPolicies-Explorer: NoDriveTypeAutoRun = dword:149
mPolicies-System: DSCAutomationHostEnabled = dword:2
IE: E&xport to Microsoft Excel - C:\Program Files (x86)\Microsoft Office\Root\Office16\EXCEL.EXE/3000
IE: Se&nd to OneNote - C:\Program Files (x86)\Microsoft Office\Root\Office16\ONBttnIE.dll/105
IE: {2670000A-7350-4f3c-8081-5663EE0C6C49} - {48E73304-E1D6-4330-914C-F5F514E3486C} - C:\Program Files (x86)\Microsoft Office\root\Office16\ONBttnIE.dll
IE: {31D09BA0-12F5-4CCE-BE8A-2923E76605DA} - {31D09BA0-12F5-4CCE-BE8A-2923E76605DA} - C:\Program Files (x86)\Microsoft Office\root\Office16\OCHelper.dll
IE: {789FE86F-6FC4-46A1-9849-EDE0DB0C95CA} - {FFFDC614-B694-4AE6-AB38-5D6374584B52} - C:\Program Files (x86)\Microsoft Office\root\Office16\ONBttnIELinkedNotes.dll
TCP: NameServer = 192.168.0.1
TCP: Interfaces\{2d9440bd-ef69-487d-8724-d2526df64fa3} : DHCPNameServer = 172.20.10.1
TCP: Interfaces\{c34af178-4d11-4447-bdad-9b7f1e24d034} : DHCPNameServer = 192.168.0.1
TCP: Interfaces\{c34af178-4d11-4447-bdad-9b7f1e24d034}\96D6028657E6762797 : DHCPNameServer = 10.227.98.41
TCP: Interfaces\{c83b642b-7028-4e63-b380-a7bb5bcb2610} : DHCPNameServer = 192.168.1.1
Handler: mso-minsb-roaming.16 - {83C25742-A9F7-49FB-9138-434302C88D07} - C:\Program Files (x86)\Microsoft Office\root\Office16\MSOSB.DLL
Handler: mso-minsb.16 - {42089D2D-912D-4018-9087-2B87803E93FB} - C:\Program Files (x86)\Microsoft Office\root\Office16\MSOSB.DLL
Handler: osf-roaming.16 - {42089D2D-912D-4018-9087-2B87803E93FB} - C:\Program Files (x86)\Microsoft Office\root\Office16\MSOSB.DLL
Handler: osf.16 - {5504BE45-A83B-4808-900A-3A5C36E7F77A} - C:\Program Files (x86)\Microsoft Office\root\Office16\MSOSB.DLL
Handler: tbauth - {14654CA6-5711-491D-B89A-58E571679951} - C:\Windows\SysWOW64\tbauth.dll
Handler: windows.tbauth - {14654CA6-5711-491D-B89A-58E571679951} - C:\Windows\SysWOW64\tbauth.dll
Notify: SDWinLogon - SDWinLogon.dll
SSODL: WebCheck - <orphaned>
CLSID: {603D3801-BD81-11d0-A3A5-00C04FD706EC} - C:\WINDOWS\System32\windows.storage.dll
x64-BHO: Lync Browser Helper: {31D09BA0-12F5-4CCE-BE8A-2923E76605DA} - C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesX64\Microsoft Office\Office16\OCHelper.dll
x64-BHO: Microsoft OneDrive for Business Browser Helper: {D0498E0A-45B7-42AE-A9AA-ABA463DBD3BF} - C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesX64\Microsoft Office\Office16\GROOVEEX.DLL
x64-Run: [SecurityHealth] C:\Program Files (x86)\Windows Defender\MSASCuiL.exe
x64-Run: [IgfxTray] "C:\WINDOWS\System32\igfxtray.exe"
x64-Run: [HotKeysCmds] "C:\WINDOWS\System32\hkcmd.exe"
x64-Run: [Persistence] "C:\WINDOWS\System32\igfxpers.exe"
x64-Run: [NvBackend] "C:\Program Files (x86)\NVIDIA Corporation\Update Core\NvBackend.exe"
x64-Run: [ShadowPlay] "C:\WINDOWS\System32\rundll32.exe" C:\WINDOWS\System32\nvspcap64.dll,ShadowPlayOnSystemStart
x64-Run: [AdobeAAMUpdater-1.0] "C:\Program Files (x86)\Common Files\Adobe\OOBE\PDApp\UWA\UpdaterStartupUtility.exe"
x64-Run: [iTunesHelper] "E:\iTunesHelper.exe"
x64-Run: [WindowsDefender] "C:\Program Files (x86)\Windows Defender\MSASCuiL.exe"
x64-mPolicies-System: DSCAutomationHostEnabled = dword:2
x64-IE: {2670000A-7350-4f3c-8081-5663EE0C6C49} - {48E73304-E1D6-4330-914C-F5F514E3486C} - C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesX64\Microsoft Office\Office16\ONBttnIE.dll
x64-IE: {31D09BA0-12F5-4CCE-BE8A-2923E76605DA} - {31D09BA0-12F5-4CCE-BE8A-2923E76605DA} - C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesX64\Microsoft Office\Office16\OCHelper.dll
x64-IE: {789FE86F-6FC4-46A1-9849-EDE0DB0C95CA} - {FFFDC614-B694-4AE6-AB38-5D6374584B52} - C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesX64\Microsoft Office\Office16\ONBttnIELinkedNotes.dll
x64-Handler: mso-minsb-roaming.16 - {83C25742-A9F7-49FB-9138-434302C88D07} - <orphaned>
x64-Handler: mso-minsb.16 - {42089D2D-912D-4018-9087-2B87803E93FB} - <orphaned>
x64-Handler: osf-roaming.16 - {42089D2D-912D-4018-9087-2B87803E93FB} - <orphaned>
x64-Handler: osf.16 - {5504BE45-A83B-4808-900A-3A5C36E7F77A} - <orphaned>
x64-Handler: tbauth - {14654CA6-5711-491D-B89A-58E571679951} - C:\WINDOWS\System32\tbauth.dll
x64-Handler: windows.tbauth - {14654CA6-5711-491D-B89A-58E571679951} - C:\WINDOWS\System32\tbauth.dll
x64-Notify: igfxcui - igfxdev.dll
x64-SSODL: WebCheck - <orphaned>
x64-mASetup: {2C7339CF-2B09-4501-B3F3-F3508C9228ED} - /UserInstall
x64-mASetup: {89820200-ECBD-11cf-8B85-00AA005B4340} - U
x64-mASetup: {8A69D345-D564-463c-AFF1-A69D9E530F96} - "C:\Program Files (x86)\Google\Chrome\Application\60.0.3112.113\Installer\chrmstp.exe" --configure-user-settings --verbose-logging --system-level
x64-CLSID: {603D3801-BD81-11d0-A3A5-00C04FD706EC} - C:\WINDOWS\System32\windows.storage.dll
Hosts: 0.0.0.1 mssplus.mcafee.com
================= FIREFOX ===================
.
FF - ProfilePath - C:\Users\USER\AppData\Roaming\Mozilla\Firefox\Profiles\cju8b3mr.default-1488517683377\
FF - prefs.js: browser.startup.homepage - hxxps://www.reddit.com/|https://www.facebook.com/
FF - plugin: C:\Program Files (x86)\Adobe\Adobe Creative Cloud\Utils\npAdobeAAMDetect32.dll
FF - plugin: C:\Program Files (x86)\Adobe\Adobe Creative Cloud\Utils\npAdobeAAMDetect64.dll
FF - plugin: C:\Program Files (x86)\Google\Update\1.3.33.5\npGoogleUpdate3.dll
FF - plugin: C:\Program Files (x86)\Microsoft Office\root\Office16\NPSPWRAP.DLL
FF - plugin: C:\Program Files (x86)\Microsoft Office\root\VFS\ProgramFilesX86\Mozilla Firefox\plugins\npMeetingJoinPluginOC.dll
FF - plugin: C:\Program Files (x86)\NVIDIA Corporation\3D Vision\npnv3dv.dll
FF - plugin: C:\Program Files (x86)\NVIDIA Corporation\3D Vision\npnv3dvstreaming.dll
FF - plugin: C:\WINDOWS\SysWOW64\Macromed\Flash\NPSWF32_26_0_0_151.dll
FF - plugin: E:\SoftnyxGame\NyxLauncherIS\npSoftnyx.dll
.
============= SERVICES / DRIVERS ===============
.
P2 HiPatchService;Hi-Rez Studios Authenticate and Update Service;C:\Program Files (x86)\Hi-Rez Studios\HiPatchService.exe [2016-6-7 9728]
R0 gpt_loader;GUID Partition table support driver;C:\WINDOWS\System32\drivers\gpt_loader.sys [2017-5-30 60752]
R0 intelpep;Intel(R) Power Engine Plug-in Driver;C:\WINDOWS\System32\drivers\intelpep.sys [2017-3-18 74840]
R0 iorate;Disk I/O Rate Filter Driver;C:\WINDOWS\System32\drivers\iorate.sys [2017-3-18 49568]
R0 mounthlp;Mounter helper driver for HFS+ volumes;C:\WINDOWS\System32\drivers\mounthlp.sys [2017-5-30 44880]
R0 volume;Volume driver;C:\WINDOWS\System32\drivers\volume.sys [2017-3-18 16288]
R0 WindowsTrustedRT;Windows Trusted Execution Environment Class Extension;C:\WINDOWS\System32\drivers\WindowsTrustedRT.sys [2017-3-18 70232]
R0 WindowsTrustedRTProxy;Microsoft Windows Trusted Runtime Secure Service;C:\WINDOWS\System32\drivers\WindowsTrustedRTProxy.sys [2017-3-18 18520]
R0 Wof;Windows Overlay File System Filter Driver;C:\WINDOWS\System32\drivers\wof.sys [2017-3-18 208288]
R1 ahcache;Application Compatibility Cache;C:\WINDOWS\System32\drivers\ahcache.sys [2017-3-18 239616]
R1 FileCrypt;FileCrypt;C:\WINDOWS\System32\drivers\filecrypt.sys [2017-3-18 54272]
R1 GpuEnergyDrv;GPU Energy Driver;C:\WINDOWS\System32\drivers\gpuenergydrv.sys [2017-3-18 8192]
R2 AdobeUpdateService;AdobeUpdateService;C:\Program Files (x86)\Common Files\Adobe\Adobe Desktop Common\ElevationManager\AdobeUpdateService.exe [2016-12-9 753240]
R2 AGSService;Adobe Genuine Software Integrity Service;C:\Program Files (x86)\Common Files\Adobe\AdobeGCClient\AGSService.exe [2016-9-26 2246256]
R2 Apple Mobile Device Service;Apple Mobile Device Service;C:\Program Files\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe [2017-4-3 83768]
R2 CDPSvc;Connected Devices Platform Service;C:\WINDOWS\System32\svchost.exe -k LocalService [2017-3-18 47664]
R2 CDPUserSvc_37b7d;CDPUserSvc_37b7d;C:\WINDOWS\System32\svchost.exe -k UnistackSvcGroup [2017-3-18 47664]
R2 ClickToRunSvc;Microsoft Office ClickToRun Service;C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeClickToRun.exe [2016-6-29 3705536]
R2 clreg;Virtual Registry for Containers;C:\WINDOWS\System32\drivers\registry.sys [2017-3-18 14336]
R2 CoreMessagingRegistrar;CoreMessaging;C:\WINDOWS\System32\svchost.exe -k LocalServiceNoNetwork [2017-3-18 47664]
R2 DbxSvc;DbxSvc;C:\WINDOWS\System32\DbxSvc.exe [2017-8-22 49992]
R2 DiagTrack;Connected User Experiences and Telemetry;C:\WINDOWS\System32\svchost.exe -k utcsvc [2017-3-18 47664]
R2 DoSvc;Delivery Optimization;C:\WINDOWS\System32\svchost.exe -k netsvcs [2017-3-18 47664]
R2 DusmSvc;Data Usage;C:\WINDOWS\System32\svchost.exe -k LocalServiceNetworkRestricted [2017-3-18 47664]
R2 HfsplusRec;HFS+ File System Recognizer;C:\WINDOWS\System32\drivers\hfsplusrec.sys [2017-5-30 15184]
R2 NVDisplay.ContainerLocalSystem;NVIDIA Display Container LS;C:\Program Files\NVIDIA Corporation\Display.NvContainer\NVDisplay.Container.exe [2017-6-21 462968]
R2 OneSyncSvc_37b7d;OneSyncSvc_37b7d;C:\WINDOWS\System32\svchost.exe -k UnistackSvcGroup [2017-3-18 47664]
R2 SDScannerService;Spybot-S&D 2 Scanner Service;C:\Program Files (x86)\Spybot - Search & Destroy 2\SDFSSvc.exe [2017-9-3 1776864]
R2 SDUpdateService;Spybot-S&D 2 Updating Service;C:\Program Files (x86)\Spybot - Search & Destroy 2\SDUpdSvc.exe [2017-9-3 2131760]
R2 SDWSCService;Spybot-S&D 2 Security Center Service;C:\Program Files (x86)\Spybot - Search & Destroy 2\SDWSCSvc.exe [2017-9-3 233936]
R2 SecurityHealthService;Windows Defender Security Center Service;C:\WINDOWS\System32\SecurityHealthService.exe [2017-7-11 336320]
R2 storqosflt;Storage QoS Filter Driver;C:\WINDOWS\System32\drivers\storqosflt.sys [2017-3-18 79872]
R2 tiledatamodelsvc;Tile Data model server;C:\WINDOWS\System32\svchost.exe -k appmodel [2017-3-18 47664]
R2 UserManager;User Manager;C:\WINDOWS\System32\svchost.exe -k netsvcs [2017-3-18 47664]
R2 wcifs;Windows Container Isolation;C:\WINDOWS\System32\drivers\wcifs.sys [2017-7-11 142752]
R2 WpnService;Windows Push Notifications System Service;C:\WINDOWS\System32\svchost.exe -k netsvcs [2017-3-18 47664]
R2 WpnUserService_37b7d;WpnUserService_37b7d;C:\WINDOWS\System32\svchost.exe -k UnistackSvcGroup [2017-3-18 47664]
R3 AppXSvc;AppX Deployment Service (AppXSVC);C:\WINDOWS\System32\svchost.exe -k wsappx [2017-3-18 47664]
R3 BrYNSvc;BrYNSvc;C:\Program Files (x86)\Browny02\BrYNSvc.exe [2016-9-18 282112]
R3 LifeCamTrueColor;LifeCamTrueColor Service;C:\WINDOWS\System32\drivers\LifeCamTrueColor.sys [2016-7-27 37928]
R3 NcbService;Network Connection Broker;C:\WINDOWS\System32\svchost.exe -k LocalSystemNetworkRestricted [2017-3-18 47664]
R3 NdisVirtualBus;Microsoft Virtual Network Adapter Enumerator;C:\WINDOWS\System32\drivers\NdisVirtualBus.sys [2017-3-18 20992]
R3 NgcCtnrSvc;Microsoft Passport Container;C:\WINDOWS\System32\svchost.exe -k LocalServiceNetworkRestricted [2017-3-18 47664]
R3 nvvad_WaveExtensible;NVIDIA Virtual Audio Device (Wave Extensible) (WDM);C:\WINDOWS\System32\drivers\nvvad64v.sys [2016-4-24 56384]
R3 PimIndexMaintenanceSvc_37b7d;PimIndexMaintenanceSvc_37b7d;C:\WINDOWS\System32\svchost.exe -k UnistackSvcGroup [2017-3-18 47664]
R3 RtlWlanu_OldIC;Realtek Wireless LAN 802.11n USB 2.0 Network Adapter;C:\WINDOWS\System32\drivers\rtwlanu_oldIC.sys [2017-3-18 3814400]
R3 StateRepository;State Repository Service;C:\WINDOWS\System32\svchost.exe -k appmodel [2017-3-18 47664]
R3 TimeBrokerSvc;Time Broker;C:\WINDOWS\System32\svchost.exe -k LocalServiceNetworkRestricted [2017-3-18 47664]
R3 TokenBroker;TokenBroker;C:\WINDOWS\System32\svchost.exe -k netsvcs [2017-3-18 47664]
R3 UnistoreSvc_37b7d;UnistoreSvc_37b7d;C:\WINDOWS\System32\svchost.exe -k UnistackSvcGroup [2017-3-18 47664]
R3 UserDataSvc_37b7d;UserDataSvc_37b7d;C:\WINDOWS\System32\svchost.exe -k UnistackSvcGroup [2017-3-18 47664]
R3 WdNisDrv;Windows Defender Antivirus Network Inspection System Driver;C:\WINDOWS\System32\drivers\WdNisDrv.sys [2017-3-18 121248]
R3 WdNisSvc;Windows Defender Antivirus Network Inspection Service;C:\Program Files\Windows Defender\NisSrv.exe [2017-3-18 342264]
S2 CldFlt;Windows Cloud Files Filter Driver;C:\WINDOWS\System32\drivers\cldflt.sys [2017-3-18 12288]
S2 dbupdate;Dropbox Update Service (dbupdate);C:\Program Files (x86)\Dropbox\Update\DropboxUpdate.exe [2016-5-3 143144]
S2 MapsBroker;Downloaded Maps Manager;C:\WINDOWS\System32\svchost.exe -k NetworkService [2017-3-18 47664]
S2 MBAMService;Malwarebytes Service;C:\Program Files\Malwarebytes\Anti-Malware\MBAMService.exe [2017-9-3 6058960]
S2 SkypeUpdate;Skype Updater;C:\Program Files (x86)\Skype\Updater\Updater.exe [2017-4-5 317400]
S3 AcpiDev;ACPI Devices driver;C:\WINDOWS\System32\drivers\AcpiDev.sys [2017-3-18 20480]
S3 ADP80XX;ADP80XX;C:\WINDOWS\System32\drivers\adp80xx.sys [2017-3-18 1135512]
S3 AJRouter;AllJoyn Router Service;C:\WINDOWS\System32\svchost.exe -k LocalServiceNetworkRestricted [2017-3-18 47664]
S3 applockerfltr;Smartlocker Filter Driver;C:\WINDOWS\System32\drivers\applockerfltr.sys [2017-3-18 17920]
S3 AppReadiness;App Readiness;C:\WINDOWS\System32\svchost.exe -k AppReadiness [2017-3-18 47664]
S3 AppvStrm;AppvStrm;C:\WINDOWS\System32\drivers\AppVStrm.sys [2017-3-18 127904]
S3 AppvVemgr;AppvVemgr;C:\WINDOWS\System32\drivers\AppvVemgr.sys [2017-3-18 161696]
S3 AppvVfs;AppvVfs;C:\WINDOWS\System32\drivers\AppvVfs.sys [2017-3-18 143776]
S3 bcmfn2;bcmfn2 Service;C:\WINDOWS\System32\drivers\bcmfn2.sys [2017-3-18 9728]
S3 BCMH43XX;Broadcom 802.11 USB Network Adapter Driver;C:\WINDOWS\System32\drivers\bcmwlhigh664.sys [2010-10-13 1244224]
S3 BthHFSrv;Bluetooth Handsfree Service;C:\WINDOWS\System32\svchost.exe -k LocalServiceAndNoImpersonation [2017-3-18 47664]
S3 buttonconverter;Service for Portable Device Control devices;C:\WINDOWS\System32\drivers\buttonconverter.sys [2017-3-18 39424]
S3 CAD;Charge Arbitration Driver;C:\WINDOWS\System32\drivers\CAD.sys [2017-3-18 53664]
S3 CapImg;HID driver for CapImg touch screen;C:\WINDOWS\System32\drivers\capimg.sys [2017-3-18 122880]
S3 cht4iscsi;cht4iscsi;C:\WINDOWS\System32\drivers\cht4sx64.sys [2017-3-18 347032]
S3 cht4vbd;Chelsio Virtual Bus Driver;C:\WINDOWS\System32\drivers\cht4vx64.sys [2017-3-18 2104224]
S3 ClipSVC;Client License Service (ClipSVC);C:\WINDOWS\System32\svchost.exe -k wsappx [2017-3-18 47664]
S3 dbupdatem;Dropbox Update Service (dbupdatem);C:\Program Files (x86)\Dropbox\Update\DropboxUpdate.exe [2016-5-3 143144]
S3 DevicesFlowUserSvc_37b7d;DevicesFlowUserSvc_37b7d;C:\WINDOWS\System32\svchost.exe -k DevicesFlow [2017-3-18 47664]
S3 DevQueryBroker;DevQuery Background Discovery Broker;C:\WINDOWS\System32\svchost.exe -k LocalSystemNetworkRestricted [2017-3-18 47664]
S3 dg_ssudbus;SAMSUNG Mobile USB Composite Device Driver (DEVGURU Ver.);C:\WINDOWS\System32\drivers\ssudbus.sys [2016-9-5 131712]
S3 diagnosticshub.standardcollector.service;Microsoft (R) Diagnostics Hub Standard Collector Service;C:\WINDOWS\System32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe [2017-3-18 86528]
S3 DmEnrollmentSvc;Device Management Enrollment Service;C:\WINDOWS\System32\svchost.exe -k netsvcs [2017-3-18 47664]
S3 dmwappushservice;dmwappushsvc;C:\WINDOWS\System32\svchost.exe -k netsvcs [2017-3-18 47664]
S3 DsSvc;Data Sharing Service;C:\WINDOWS\System32\svchost.exe -k LocalSystemNetworkRestricted [2017-3-18 47664]
S3 embeddedmode;Embedded Mode;C:\WINDOWS\System32\svchost.exe -k LocalSystemNetworkRestricted [2017-3-18 47664]
S3 EntAppSvc;Enterprise App Management Service;C:\WINDOWS\System32\svchost.exe -k appmodel [2017-3-18 47664]
S3 FrameServer;Windows Camera Frame Server;C:\WINDOWS\System32\svchost.exe -k Camera [2017-3-18 47664]
S3 genericusbfn;Generic USB Function Class;C:\WINDOWS\System32\drivers\genericusbfn.sys [2017-3-18 21504]
S3 GunBod;GunBod;C:\WINDOWS\System32\gunbod64.sys [2016-5-1 86352]
S3 Hfsplus;HFS+ File System Driver;C:\WINDOWS\System32\drivers\hfsplus.sys [2017-5-30 205136]
S3 hidinterrupt;Common Driver for HID Buttons implemented with interrupts;C:\WINDOWS\System32\drivers\hidinterrupt.sys [2017-3-18 51104]
S3 HvHost;HV Host Service;C:\WINDOWS\System32\svchost.exe -k LocalSystemNetworkRestricted [2017-3-18 47664]
S3 iagpio;Intel Serial IO GPIO Controller Driver;C:\WINDOWS\System32\drivers\iagpio.sys [2017-3-18 33280]
S3 iai2c;Intel(R) Serial IO I2C Host Controller;C:\WINDOWS\System32\drivers\iai2c.sys [2017-3-18 81408]
S3 iaLPSS2i_GPIO2;Intel(R) Serial IO GPIO Driver v2;C:\WINDOWS\System32\drivers\iaLPSS2i_GPIO2.sys [2017-3-18 70656]
S3 iaLPSS2i_GPIO2_BXT_P;Intel(R) Serial IO GPIO Driver v2;C:\WINDOWS\System32\drivers\iaLPSS2i_GPIO2_BXT_P.sys [2017-3-18 85504]
S3 iaLPSS2i_I2C;Intel(R) Serial IO I2C Driver v2;C:\WINDOWS\System32\drivers\iaLPSS2i_I2C.sys [2017-3-18 165376]
S3 iaLPSS2i_I2C_BXT_P;Intel(R) Serial IO I2C Driver v2;C:\WINDOWS\System32\drivers\iaLPSS2i_I2C_BXT_P.sys [2017-3-18 168448]
S3 iaLPSSi_GPIO;Intel(R) Serial IO GPIO Controller Driver;C:\WINDOWS\System32\drivers\iaLPSSi_GPIO.sys [2017-3-18 38128]
S3 iaLPSSi_I2C;Intel(R) Serial IO I2C Controller Driver;C:\WINDOWS\System32\drivers\iaLPSSi_I2C.sys [2017-3-18 113152]
S3 iaStorAV;Intel(R) SATA RAID Controller Windows;C:\WINDOWS\System32\drivers\iaStorAV.sys [2017-3-18 673184]
S3 ibbus;Mellanox InfiniBand Bus/AL (Filter Driver);C:\WINDOWS\System32\drivers\ibbus.sys [2017-3-18 526240]
S3 icssvc;Windows Mobile Hotspot Service;C:\WINDOWS\System32\svchost.exe -k LocalServiceNetworkRestricted [2017-3-18 47664]
S3 IndirectKmd;Indirect Displays Kernel-Mode Driver;C:\WINDOWS\System32\drivers\IndirectKmd.sys [2017-3-18 36864]
S3 IpxlatCfgSvc;IP Translation Configuration Service;C:\WINDOWS\System32\svchost.exe -k LocalSystemNetworkRestricted [2017-3-18 47664]
S3 lfsvc;Geolocation Service;C:\WINDOWS\System32\svchost.exe -k netsvcs [2017-3-18 47664]
S3 LicenseManager;Windows License Manager Service;C:\WINDOWS\System32\svchost.exe -k LocalService [2017-3-18 47664]
S3 LSI_SAS2i;LSI_SAS2i;C:\WINDOWS\System32\drivers\lsi_sas2i.sys [2017-3-18 123808]
S3 LSI_SAS3i;LSI_SAS3i;C:\WINDOWS\System32\drivers\lsi_sas3i.sys [2017-3-18 103328]
S3 ManyCam;ManyCam Virtual Webcam;C:\WINDOWS\System32\drivers\mcvidrv.sys [2016-8-24 49312]
S3 mausbhost;MA-USB Host Controller Driver;C:\WINDOWS\System32\drivers\mausbhost.sys [2017-3-18 405408]
S3 mausbip;MA-USB IP Filter Driver;C:\WINDOWS\System32\drivers\mausbip.sys [2017-3-18 51104]
S3 mcaudrv_simple;ManyCam Virtual Microphone;C:\WINDOWS\System32\drivers\mcaudrv_x64.sys [2014-12-28 35960]
S3 McComponentHostService;McAfee Security Scan Component Host Service;C:\Program Files\McAfee Security Scan\3.11.587\McCHSvc.exe [2017-6-30 404376]
S3 megasas2i;megasas2i;C:\WINDOWS\System32\drivers\MegaSas2i.sys [2017-3-18 64416]
S3 MessagingService_37b7d;MessagingService_37b7d;C:\WINDOWS\System32\svchost.exe -k UnistackSvcGroup [2017-3-18 47664]
S3 mlx4_bus;Mellanox ConnectX Bus Enumerator;C:\WINDOWS\System32\drivers\mlx4_bus.sys [2017-3-18 842656]
S3 MsSecFlt;Microsoft Security Events Component Minifilter;C:\WINDOWS\System32\drivers\mssecflt.sys [2017-3-18 230816]
S3 NaturalAuthentication;Natural Authentication;C:\WINDOWS\System32\svchost.exe -k netsvcs [2017-3-18 47664]
S3 ndfltr;NetworkDirect Service;C:\WINDOWS\System32\drivers\ndfltr.sys [2017-3-18 108960]
S3 NetAdapterCx;Network Adapter Wdf Class Extension Library;C:\WINDOWS\System32\drivers\NetAdapterCx.sys [2017-3-18 122368]
S3 NetSetupSvc;Network Setup Service;C:\WINDOWS\System32\svchost.exe -k netsvcs [2017-3-18 47664]
S3 netvsc;netvsc;C:\WINDOWS\System32\drivers\netvsc.sys [2017-6-22 118784]
S3 NgcSvc;Microsoft Passport;C:\WINDOWS\System32\svchost.exe -k LocalSystemNetworkRestricted [2017-3-18 47664]
S3 npggsvc;nProtect GameGuard Service;C:\WINDOWS\System32\GameMon.des -service --> C:\WINDOWS\System32\GameMon.des -service [?]
S3 nvdimmn;Microsoft NVDIMM-N device driver;C:\WINDOWS\System32\drivers\nvdimmn.sys [2017-3-18 80896]
S3 NvStreamKms;NvStreamKms;C:\Program Files\NVIDIA Corporation\NvStreamSrv\NvStreamKms.sys [2016-4-24 28216]
S3 percsas2i;percsas2i;C:\WINDOWS\System32\drivers\percsas2i.sys [2017-3-18 58784]
S3 percsas3i;percsas3i;C:\WINDOWS\System32\drivers\percsas3i.sys [2017-3-18 61848]
S3 PhoneSvc;Phone Service;C:\WINDOWS\System32\svchost.exe -k LocalService [2017-3-18 47664]
S3 ReFS;ReFS;C:\WINDOWS\System32\drivers\refs.sys [2017-3-18 1735584]
S3 ReFSv1;ReFSv1;C:\WINDOWS\System32\drivers\refsv1.sys [2017-3-18 936864]
S3 RetailDemo;Retail Demo Service;C:\WINDOWS\System32\svchost.exe -k rdxgroup [2017-3-18 47664]
S3 ScDeviceEnum;Smart Card Device Enumeration Service;C:\WINDOWS\System32\svchost.exe -k LocalSystemNetworkRestricted [2017-3-18 47664]
S3 scmbus;Microsoft Storage Class Memory Bus Driver;C:\WINDOWS\System32\drivers\scmbus.sys [2017-3-18 91040]
S3 SDFRd;SDF Reflector;C:\WINDOWS\System32\drivers\SDFRd.sys [2017-3-18 31128]
S3 SEMgrSvc;Payments and NFC/SE Manager;C:\WINDOWS\System32\svchost.exe -k LocalService [2017-3-18 47664]
S3 Sense;Windows Defender Advanced Threat Protection Service;C:\Program Files\Windows Defender Advanced Threat Protection\MsSense.exe [2017-3-18 3913064]
S3 SensorDataService;Sensor Data Service;C:\WINDOWS\System32\SensorDataService.exe [2017-3-18 1284608]
S3 SensorService;Sensor Service;C:\WINDOWS\System32\svchost.exe -k LocalSystemNetworkRestricted [2017-3-18 47664]
S3 SerCx2;Serial UART Support Library;C:\WINDOWS\System32\drivers\SerCx2.sys [2017-3-18 154016]
S3 smphost;Microsoft Storage Spaces SMP;C:\WINDOWS\System32\svchost.exe -k smphost [2017-3-18 47664]
S3 SmsRouter;Microsoft Windows SMS Router Service.;C:\WINDOWS\System32\svchost.exe -k LocalSystemNetworkRestricted [2017-3-18 47664]
S3 SpatialGraphFilter;Holographic Spatial Graph Filter;C:\WINDOWS\System32\drivers\SpatialGraphFilter.sys [2017-3-18 40352]
S3 spectrum;Windows Perception Service;C:\WINDOWS\System32\Spectrum.exe [2017-3-18 891904]
S3 ssudmdm;SAMSUNG Mobile USB Modem Drivers (DEVGURU Ver.);C:\WINDOWS\System32\drivers\ssudmdm.sys [2016-9-5 165504]
S3 stornvme;Microsoft Standard NVM Express Driver;C:\WINDOWS\System32\drivers\stornvme.sys [2017-3-18 95648]
S3 storufs;Microsoft Universal Flash Storage (UFS) Driver;C:\WINDOWS\System32\drivers\storufs.sys [2017-3-18 36760]
S3 TieringEngineService;Storage Tiers Management;C:\WINDOWS\System32\TieringEngineService.exe [2017-3-18 302592]
S3 UcmCx0101;USB Connector Manager KMDF Class Extension;C:\WINDOWS\System32\drivers\UcmCx.sys [2017-3-18 104448]
S3 UcmTcpciCx0101;UCM-TCPCI KMDF Class Extension;C:\WINDOWS\System32\drivers\UcmTcpciCx.sys [2017-3-18 179200]
S3 UcmUcsi;USB Connector Manager UCSI Client;C:\WINDOWS\System32\drivers\UcmUcsi.sys [2017-8-8 51712]
S3 UdeCx;USB Device Emulation Support Library;C:\WINDOWS\System32\drivers\Udecx.sys [2017-3-18 45568]
S3 UEFI;Microsoft UEFI Driver;C:\WINDOWS\System32\drivers\uefi.sys [2017-3-18 29600]
S3 Ufx01000;USB Function Class Extension;C:\WINDOWS\System32\drivers\ufx01000.sys [2017-3-18 263584]
S3 UfxChipidea;USB Chipidea Controller;C:\WINDOWS\System32\drivers\UfxChipidea.sys [2017-3-18 98712]
S3 ufxsynopsys;USB Synopsys Controller;C:\WINDOWS\System32\drivers\ufxsynopsys.sys [2017-3-18 138656]
S3 UrsChipidea;Chipidea USB Role-Switch Driver;C:\WINDOWS\System32\drivers\urschipidea.sys [2017-3-18 29600]
S3 UrsCx01000;USB Role-Switch Support Library;C:\WINDOWS\System32\drivers\urscx01000.sys [2017-3-18 59288]
S3 UrsSynopsys;Synopsys USB Role-Switch Driver;C:\WINDOWS\System32\drivers\urssynopsys.sys [2017-3-18 28064]
S3 USBAAPL64;Apple Mobile USB Driver;C:\WINDOWS\System32\drivers\usbaapl64.sys [2015-11-5 54784]
S3 UsoSvc;Update Orchestrator Service;C:\WINDOWS\System32\svchost.exe -k netsvcs [2017-3-18 47664]
S3 vhf;Virtual HID Framework (VHF) Driver;C:\WINDOWS\System32\drivers\vhf.sys [2017-3-18 35328]
S3 vmgid;Microsoft Hyper-V Guest Infrastructure Driver;C:\WINDOWS\System32\drivers\vmgid.sys [2017-3-18 10240]
S3 vmicguestinterface;Hyper-V Guest Service Interface;C:\WINDOWS\System32\svchost.exe -k LocalSystemNetworkRestricted [2017-3-18 47664]
S3 vmicvmsession;Hyper-V PowerShell Direct Service;C:\WINDOWS\System32\svchost.exe -k LocalSystemNetworkRestricted [2017-3-18 47664]
S3 w3logsvc;W3C Logging Service;C:\WINDOWS\System32\svchost.exe -k apphost [2017-3-18 47664]
S3 WalletService;WalletService;C:\WINDOWS\System32\svchost.exe -k appmodel [2017-3-18 47664]
S3 wcnfs;Windows Container Name Virtualization;C:\WINDOWS\System32\drivers\wcnfs.sys [2017-3-18 72192]
S3 WDC_SAM;WD SCSI Pass Thru driver;C:\WINDOWS\System32\drivers\wdcsam64.sys [2015-4-30 26880]
S3 wdiwifi;WDI Driver Framework;C:\WINDOWS\System32\drivers\WdiWiFi.sys [2017-7-11 757248]
S3 WEPHOSTSVC;Windows Encryption Provider Host Service;C:\WINDOWS\System32\svchost.exe -k WepHostSvcGroup [2017-3-18 47664]
S3 WFDSConMgrSvc;Wi-Fi Direct Services Connection Manager Service;C:\WINDOWS\System32\svchost.exe -k LocalServiceNetworkRestricted [2017-3-18 47664]
S3 WinMad;WinMad Service;C:\WINDOWS\System32\drivers\winmad.sys [2017-3-18 32160]
S3 WinNat;Windows NAT Driver;C:\WINDOWS\System32\drivers\winnat.sys [2017-3-18 217088]
S3 WinVerbs;WinVerbs Service;C:\WINDOWS\System32\drivers\winverbs.sys [2017-3-18 64920]
S3 wisvc;Windows Insider Service;C:\WINDOWS\System32\svchost.exe -k netsvcs [2017-3-18 47664]
S3 wlpasvc;LPA Service;C:\WINDOWS\System32\svchost.exe -k LocalService [2017-3-18 47664]
S3 workfolderssvc;Work Folders;C:\WINDOWS\System32\svchost.exe -k LocalService [2017-3-18 47664]
S3 WUDFWpdMtp;WUDFWpdMtp;C:\WINDOWS\System32\drivers\WUDFRd.sys [2017-3-18 220672]
S3 X6va035;X6va035;C:\Windows\SysWOW64\drivers\X6va035 [2016-6-7 27352]
S3 xbgm;Xbox Game Monitoring;C:\WINDOWS\System32\svchost.exe -k netsvcs [2017-3-18 47664]
S3 XblAuthManager;Xbox Live Auth Manager;C:\WINDOWS\System32\svchost.exe -k netsvcs [2017-3-18 47664]
S3 XblGameSave;Xbox Live Game Save;C:\WINDOWS\System32\svchost.exe -k netsvcs [2017-3-18 47664]
S3 xboxgip;Xbox Game Input Protocol Driver;C:\WINDOWS\System32\drivers\xboxgip.sys [2017-6-22 277504]
S3 XboxGipSvc;Xbox Accessory Management Service;C:\WINDOWS\System32\svchost.exe -k netsvcs [2017-3-18 47664]
S3 XboxNetApiSvc;Xbox Live Networking Service;C:\WINDOWS\System32\svchost.exe -k netsvcs [2017-3-18 47664]
S3 xhunter1;xhunter1;C:\Windows\xhunter1.sys [2017-6-6 38368]
S3 xinputhid;XINPUT HID Filter Driver;C:\WINDOWS\System32\drivers\xinputhid.sys [2017-3-18 46592]
S3 xspirit;xspirit;C:\Windows\xspirit.sys [2017-6-6 22912]
S4 AppVClient;Microsoft App-V Client;C:\WINDOWS\System32\AppVClient.exe [2017-7-11 846752]
S4 GfExperienceService;NVIDIA GeForce Experience Service;C:\Program Files\NVIDIA Corporation\GeForce Experience Service\GfExperienceService.exe [2016-4-24 1164856]
S4 NvNetworkService;NVIDIA Network Service;C:\Program Files (x86)\NVIDIA Corporation\NetService\NvNetworkService.exe [2016-4-24 1881144]
S4 NvStreamSvc;NVIDIA Streamer Service;C:\Program Files\NVIDIA Corporation\NvStreamSrv\NvStreamService.exe [2016-4-24 2522680]
S4 shpamsvc;Shared PC Account Manager;C:\WINDOWS\System32\svchost.exe -k netsvcs [2017-3-18 47664]
S4 tzautoupdate;Auto Time Zone Updater;C:\WINDOWS\System32\svchost.exe -k LocalService [2017-3-18 47664]
S4 UevAgentDriver;UevAgentDriver;C:\WINDOWS\System32\drivers\UevAgentDriver.sys [2017-3-18 40344]
S4 UevAgentService;User Experience Virtualization Service;C:\WINDOWS\System32\AgentService.exe [2017-3-18 1200640]
.
=============== File Associations ===============
.
FileExt: .txt: txtfile=C:\WINDOWS\System32\NOTEPAD.EXE %1 [UserChoice]
.
=============== Created Last 30 ================
.
2017-09-03 05:14:02 44928 ----a-w- C:\ProgramData\Microsoft\Windows Defender\Definition Updates\{C6F82F32-CFCA-439D-8128-E219CC0E9B8A}\MpKslaf1e0a5c.sys
2017-09-03 05:06:33 192960 ----a-w- C:\WINDOWS\System32\drivers\MBAMChameleon.sys
2017-09-03 05:06:25 94144 ----a-w- C:\WINDOWS\System32\drivers\mwac.sys
2017-09-03 05:06:22 45472 ----a-w- C:\WINDOWS\System32\drivers\mbam.sys
2017-09-03 05:06:19 253888 ----a-w- C:\WINDOWS\System32\drivers\MBAMSwissArmy.sys
2017-09-03 05:06:14 77440 ----a-w- C:\WINDOWS\System32\drivers\mbae64.sys
2017-09-03 05:06:08 13482976 ----a-w- C:\ProgramData\Microsoft\Windows Defender\Definition Updates\{C6F82F32-CFCA-439D-8128-E219CC0E9B8A}\mpengine.dll
2017-09-03 05:06:07 -------- d-----w- C:\ProgramData\Malwarebytes
2017-09-03 05:06:07 -------- d-----w- C:\Program Files\Malwarebytes
2017-09-03 05:02:42 -------- d-----w- C:\WINDOWS\Panther
2017-09-03 04:56:30 -------- d-----w- C:\FRST
2017-09-03 04:56:19 -------- d-----w- C:\AdwCleaner
2017-09-03 04:54:10 32240 ----a-w- C:\WINDOWS\System32\sdnclean64.exe
2017-09-03 04:54:09 -------- d-----w- C:\ProgramData\Spybot - Search & Destroy
2017-09-03 04:54:03 -------- d-----w- C:\Program Files (x86)\Spybot - Search & Destroy 2
2017-09-03 02:40:55 13482976 ----a-w- C:\ProgramData\Microsoft\Windows Defender\Definition Updates\Backup\mpengine.dll
2017-08-26 18:34:44 112592 ----a-w- C:\Program Files (x86)\Mozilla Firefox\AccessibleHandler.dll
2017-08-22 16:55:26 49992 ----a-w- C:\WINDOWS\System32\DbxSvc.exe
2017-08-22 16:55:26 45672 ----a-w- C:\WINDOWS\System32\drivers\dbx-dev.sys
2017-08-22 16:55:26 45640 ----a-w- C:\WINDOWS\System32\drivers\dbx-stable.sys
2017-08-22 16:55:26 45640 ----a-w- C:\WINDOWS\System32\drivers\dbx-canary.sys
2017-08-11 19:49:35 1078240 ----a-w- C:\ProgramData\Microsoft\Windows Defender\Definition Updates\{28634B13-6147-4880-9E20-0BDAF186702F}\gapaengine.dll
2017-08-09 00:28:59 97792 ----a-w- C:\WINDOWS\System32\drivers\bthhfenum.sys
.
==================== Find3M ====================
.
2017-08-18 00:34:58 544424 ------w- C:\WINDOWS\System32\MpSigStub.exe
2017-08-01 02:39:54 8319392 ----a-w- C:\WINDOWS\System32\ntoskrnl.exe
2017-08-01 02:38:47 406544 ----a-w- C:\WINDOWS\SysWow64\policymanager.dll
2017-08-01 02:38:08 382368 ----a-w- C:\WINDOWS\System32\drivers\clfs.sys
2017-08-01 02:36:56 119712 ----a-w- C:\WINDOWS\System32\drivers\tdx.sys
2017-08-01 02:36:49 323488 ----a-w- C:\WINDOWS\apppatch\AcRes.dll
2017-08-01 02:36:29 750496 ----a-w- C:\WINDOWS\SysWow64\WWAHost.exe
2017-08-01 02:35:13 280472 ----a-w- C:\WINDOWS\SysWow64\WerFault.exe
2017-08-01 02:35:09 133904 ----a-w- C:\WINDOWS\SysWow64\WerFaultSecure.exe
2017-08-01 02:34:39 610584 ----a-w- C:\WINDOWS\SysWow64\wer.dll
2017-08-01 02:34:36 359552 ----a-w- C:\WINDOWS\SysWow64\Faultrep.dll
2017-08-01 02:34:32 349600 ----a-w- C:\WINDOWS\SysWow64\msv1_0.dll
2017-08-01 02:34:32 168864 ----a-w- C:\WINDOWS\SysWow64\wermgr.exe
2017-08-01 02:33:57 473240 ----a-w- C:\WINDOWS\System32\policymanager.dll
2017-08-01 02:32:37 2444704 ----a-w- C:\WINDOWS\System32\drivers\dxgkrnl.sys
2017-08-01 02:32:23 712600 ----a-w- C:\WINDOWS\System32\drivers\dxgmms2.sys
2017-08-01 02:32:04 820128 ----a-w- C:\WINDOWS\System32\WWAHost.exe
2017-08-01 02:31:56 5477088 ----a-w- C:\WINDOWS\System32\OneCoreUAPCommonProxyStub.dll
2017-08-01 02:31:49 212384 ----a-w- C:\WINDOWS\System32\browserbroker.dll
2017-08-01 02:31:01 176024 ----a-w- C:\WINDOWS\SysWow64\basecsp.dll
2017-08-01 02:30:52 315288 ----a-w- C:\WINDOWS\System32\WerFault.exe
2017-08-01 02:30:50 143736 ----a-w- C:\WINDOWS\System32\WerFaultSecure.exe
2017-08-01 02:30:25 723680 ----a-w- C:\WINDOWS\System32\wer.dll
2017-08-01 02:30:21 82336 ----a-w- C:\WINDOWS\System32\drivers\vmbkmcl.sys
2017-08-01 02:30:18 410160 ----a-w- C:\WINDOWS\System32\Faultrep.dll
2017-08-01 02:30:16 182688 ----a-w- C:\WINDOWS\System32\wermgr.exe
2017-08-01 02:30:09 411040 ----a-w- C:\WINDOWS\System32\msv1_0.dll
2017-08-01 02:26:58 204192 ----a-w- C:\WINDOWS\System32\basecsp.dll
2017-08-01 02:20:54 404480 ----a-w- C:\WINDOWS\SysWow64\werui.dll
2017-08-01 02:20:40 154624 ----a-w- C:\WINDOWS\SysWow64\DWWIN.EXE
2017-08-01 02:20:33 2956288 ----a-w- C:\WINDOWS\SysWow64\win32kfull.sys
2017-08-01 02:18:16 13841408 ----a-w- C:\WINDOWS\SysWow64\Windows.UI.Xaml.dll
2017-08-01 02:18:13 2199552 ----a-w- C:\WINDOWS\SysWow64\Windows.UI.Xaml.Resources.dll
2017-08-01 02:17:02 34816 ----a-w- C:\WINDOWS\SysWow64\tokenbinding.dll
2017-08-01 02:16:16 80896 ----a-w- C:\WINDOWS\SysWow64\Chakradiag.dll
2017-08-01 02:14:09 35840 ----a-w- C:\WINDOWS\SysWow64\sscore.dll
2017-08-01 02:13:31 127488 ----a-w- C:\WINDOWS\SysWow64\fdeploy.dll
2017-08-01 02:13:30 20504064 ----a-w- C:\WINDOWS\SysWow64\edgehtml.dll
2017-08-01 02:13:12 364032 ----a-w- C:\WINDOWS\SysWow64\msIso.dll
2017-08-01 02:12:28 229888 ----a-w- C:\WINDOWS\SysWow64\scksp.dll
2017-08-01 02:10:19 358400 ----a-w- C:\WINDOWS\SysWow64\ieproxy.dll
2017-08-01 02:09:58 394240 ----a-w- C:\WINDOWS\SysWow64\Windows.Internal.Management.dll
2017-08-01 02:08:54 267264 ----a-w- C:\WINDOWS\SysWow64\ncryptprov.dll
2017-08-01 02:07:57 2671616 ----a-w- C:\WINDOWS\SysWow64\tquery.dll
2017-08-01 02:07:54 5961728 ----a-w- C:\WINDOWS\SysWow64\Windows.Data.Pdf.dll
2017-08-01 02:06:46 798208 ----a-w- C:\WINDOWS\SysWow64\TokenBroker.dll
2017-08-01 02:04:40 6269440 ----a-w- C:\WINDOWS\SysWow64\Chakra.dll
2017-08-01 02:04:32 3656192 ----a-w- C:\WINDOWS\SysWow64\jscript9.dll
2017-08-01 01:57:22 23677952 ----a-w- C:\WINDOWS\System32\edgehtml.dll
2017-08-01 01:45:44 3670016 ----a-w- C:\WINDOWS\System32\win32kfull.sys
2017-08-01 01:45:28 462848 ----a-w- C:\WINDOWS\System32\werui.dll
2017-08-01 01:45:03 92672 ----a-w- C:\WINDOWS\System32\wercplsupport.dll
2017-08-01 01:45:02 1275392 ----a-w- C:\WINDOWS\System32\werconcpl.dll
2017-08-01 01:44:53 184320 ----a-w- C:\WINDOWS\System32\DWWIN.EXE
2017-08-01 01:44:49 77824 ----a-w- C:\WINDOWS\System32\wsqmcons.exe
2017-08-01 01:44:32 83968 ----a-w- C:\WINDOWS\System32\drivers\vmbkmclr.sys
2017-08-01 01:42:55 2199552 ----a-w- C:\WINDOWS\System32\Windows.UI.Xaml.Resources.dll
2017-08-01 01:41:48 42496 ----a-w- C:\WINDOWS\System32\tokenbinding.dll
2017-08-01 01:41:47 130560 ----a-w- C:\WINDOWS\System32\policymanagerprecheck.dll
2017-08-01 01:41:04 110592 ----a-w- C:\WINDOWS\System32\Chakradiag.dll
2017-08-01 01:40:59 17366528 ----a-w- C:\WINDOWS\System32\Windows.UI.Xaml.dll
2017-08-01 01:40:35 290816 ----a-w- C:\WINDOWS\System32\dmenterprisediagnostics.dll
2017-08-01 01:39:04 46592 ----a-w- C:\WINDOWS\System32\sscore.dll
2017-08-01 01:38:49 143872 ----a-w- C:\WINDOWS\System32\profsvcext.dll
2017-08-01 01:38:21 153088 ----a-w- C:\WINDOWS\System32\fdeploy.dll
2017-08-01 01:37:53 433664 ----a-w- C:\WINDOWS\System32\msIso.dll
2017-08-01 01:37:29 582656 ----a-w- C:\WINDOWS\System32\SmsRouterSvc.dll
2017-08-01 01:37:09 255488 ----a-w- C:\WINDOWS\System32\scksp.dll
2017-08-01 01:35:14 692736 ----a-w- C:\WINDOWS\System32\jscript9diag.dll
2017-08-01 01:34:37 805888 ----a-w- C:\WINDOWS\System32\ieproxy.dll
2017-08-01 01:33:49 1269760 ----a-w- C:\WINDOWS\System32\enterprisecsps.dll
2017-08-01 01:33:28 315904 ----a-w- C:\WINDOWS\System32\ncryptprov.dll
2017-08-01 01:32:47 7336960 ----a-w- C:\WINDOWS\System32\Windows.Data.Pdf.dll
2017-08-01 01:32:37 176640 ----a-w- C:\WINDOWS\System32\wersvc.dll
2017-08-01 01:31:25 4445696 ----a-w- C:\WINDOWS\System32\SettingsHandlers_nt.dll
2017-08-01 01:31:03 1396736 ----a-w- C:\WINDOWS\System32\wwansvc.dll
2017-08-01 01:30:43 8209920 ----a-w- C:\WINDOWS\System32\Chakra.dll
2017-08-01 01:30:42 303104 ----a-w- C:\WINDOWS\System32\srvsvc.dll
2017-08-01 01:30:27 1052160 ----a-w- C:\WINDOWS\System32\TokenBroker.dll
2017-08-01 01:30:18 2055168 ----a-w- C:\WINDOWS\System32\win32kbase.sys
2017-08-01 01:30:09 3377664 ----a-w- C:\WINDOWS\System32\tquery.dll
2017-08-01 01:28:51 2516480 ----a-w- C:\WINDOWS\System32\diagtrack.dll
2017-08-01 01:28:43 4730368 ----a-w- C:\WINDOWS\System32\jscript9.dll
2017-08-01 01:27:25 574464 ----a-w- C:\WINDOWS\System32\configmanager2.dll
2017-08-01 01:27:05 482816 ----a-w- C:\WINDOWS\System32\dmenrollengine.dll
2017-08-01 01:26:03 323584 ----a-w- C:\WINDOWS\System32\DeviceEnroller.exe
2017-08-01 01:25:46 249344 ----a-w- C:\WINDOWS\System32\coredpus.dll
2017-08-01 01:25:41 194048 ----a-w- C:\WINDOWS\System32\mdmregistration.dll
2017-08-01 01:25:41 140800 ----a-w- C:\WINDOWS\System32\dmcsps.dll
2017-07-31 15:15:09 835576 ----a-w- C:\WINDOWS\SysWow64\FlashPlayerApp.exe
2017-07-31 15:15:09 177648 ----a-w- C:\WINDOWS\SysWow64\FlashPlayerCPLApp.cpl
2017-07-28 05:30:35 1068720 ----a-w- C:\WINDOWS\System32\Windows.UI.dll
2017-07-28 05:25:32 2399728 ----a-w- C:\WINDOWS\System32\KernelBase.dll
2017-07-28 05:24:52 119904 ----a-w- C:\WINDOWS\System32\dmcmnutils.dll
2017-07-28 05:24:42 116280 ----a-w- C:\WINDOWS\System32\bcd.dll
2017-07-28 05:24:38 2327456 ----a-w- C:\WINDOWS\System32\drivers\ntfs.sys
2017-07-28 05:23:51 723360 ----a-w- C:\WINDOWS\System32\drivers\acpi.sys
2017-07-28 05:23:45 2969888 ----a-w- C:\WINDOWS\System32\CoreUIComponents.dll
2017-07-28 05:22:50 923048 ----a-w- C:\WINDOWS\System32\CoreMessaging.dll
2017-07-28 05:20:38 279968 ----a-w- C:\WINDOWS\System32\drivers\msiscsi.sys
.
============= FINISH: 1:42:10.21 ===============

edit: I'm not sure how to disable emoticons from my post, they are being auto-embedded lol.

Attached Files

attach.txt (9.7 KB)

Thanks in advance!

The following happened to my mother on her laptop. Mom is not a techie, and apparently everything happened as soon as she started up her laptop and opened Skype. According to her, she was using it for maybe 20 seconds before everything happened.

What I personally did witness was that my mother's Win10 laptop had a repeating audio message, “Microsoft alert,” separated by beeps. Firefox was open, but two tabs were minimized. Both were sex sites. She didn't start Firefox, and was surprised when I showed her that the audio was coming from one of the two minimized FF tabs. I closed one via the task bar, and since the other had an "unresponsive script" popup, I closed it via the task manager.

I disabled wifi on the laptop and restarted Firefox. It went back to one of the sex sites, despite the Fact that the Firefox homepage was the default. Thought that was strange.

I deleted all cookies, the cache, active logins, basically everything except the history and bookmarks. Closed FF.

Ran the following antimalware (all came up clean):

Panda (full scan, and was running resident at time of incident)
HitmanPro (default and Early Warning Scan)
Microsoft Malicious Software Removal Tool
MBAM (full scan)
McAfee Stinger (default scan?)

Checked her FF history. Mom was browsing some legitimate health sites, and then these are the following URLs in order as per Firefox:

hxxp://longdistancemovingfinder.club/pop/?a=784545&s1=363574

hxxp://www.camgirlsowned.com/en/chat/KendraSing/?utm_source=popcashusgen&utm_term=363574

hxxp://sexylittlegirls.press/?a=784545&s1=363574

hxxp://www.camgirlsowned.com/en/chat-html5/KendraSing

hxxp://sexylittlegirls.press/under/sort/ff/?n=KDg2NikgNDAwLTA2NDY=&a=784545&s1=363574

hxxp://sexylittlegirls.press/under/sort/ff/0

hxxp://sexylittlegirls.press/under/sort/ff/01
hxxp://sexylittlegirls.press/under/sort/ff/012
hxxp://sexylittlegirls.press/under/sort/ff/0123
hxxp://sexylittlegirls.press/under/sort/ff/01234
hxxp://sexylittlegirls.press/under/sort/ff/012345
...

[There were HUNDREDS of entries at the above domain, I'm guessing many browser redirects. The final one is below.]

hxxp://sexylittlegirls.press/under/sort/ff/0123456789101112131415161718192021222324252627282930313233343536373839404142434445464748495051525354555657585960616263646566676869707172737475767778798081828384858687888990919293949596979899100101102103104105106107108109110111112113114115116117118119120121122123124125126127128129130131132133134135136137138139140141142143144145146147148149150151152153154155156157158159160161162163164165166167168169170171172173174175176177178179180181182183184185186187188189190191192193194195196197198199200201202203204205206207208209210211212213214215216217218219220221222223224225226227228229230231232233234235236237238239240241242243244245246247248249250251252253254255256257258259260261262263264265266267268269270271272273274275276277278279280281282283284285286287288289290291292293294295296297298299300301302303304305306307308309310311312313314315316317318319320321322323324325326327328329330331332333334335336337338339340341342343344345346347348349350351352353354355356357358359360361362363364365366367368369370371372373374375376377378379380381382383384385386387388389390391392393394395396397398399400401402403404405406407408409410411412413414415416417418419420421422423424425426427428429430431432433434435436437438439440441442443444445446447448449450451452453454455456457458459460461462463464465466467468469470471472473474475476477478479480481482483484485486487488489490491492493494495496497498499500501502503504505506507508509510511512513514515516517518519520521522523524525526527528529530531532533534535536537538539540541542543544545546547548549550551552553554555556557558559560561562563564565566567568569570571572573574575576577578579580581582583584585586587588589590591592593594595596597598599600601602603604605606607608609610611612613614615616617618619620621622623624625626627628629630631632633634635636637638639640641642643644645646647648649650651652653654655656657658659660661662663664665666667668669670671672673674675676677678679680681682683684685686687688


I do not currently have access to a Windows install disc or a boot CD.


DDS (Ver_2012-11-20.01) - NTFS_AMD64
Internet Explorer: 11.0.15063.0
Run by Zofia at 3:51:18 on 2017-09-04
Microsoft Windows 10 Home 10.0.15063.0.1252.1.1033.18.8095.4745 [GMT -4:00]
.
AV: Windows Defender *Disabled/Updated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
AV: Malwarebytes *Disabled/Updated* {23007AD3-69FE-687C-2629-D584AFFAF72B}
AV: Panda Protection *Enabled/Updated* {46AEFD02-ACA3-E038-1FA5-4A15EFD361E0}
SP: Malwarebytes *Disabled/Updated* {98619B37-4FC4-67F2-1C99-EEF6D47DBD96}
SP: Windows Defender *Disabled/Updated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
SP: Panda Protection *Enabled/Updated* {FDCF1CE6-8A99-EFB6-2515-716794542B5D}
FW: Panda Firewall *Disabled* {7E957C27-E6CC-E160-34FA-E3201100269B}
.
============== Running Processes ===============
.
c:\windows\system32\svchost.exe -k dcomlaunch -s PlugPlay
C:\WINDOWS\system32\svchost.exe -k DcomLaunch
C:\WINDOWS\system32\fontdrvhost.exe
c:\windows\system32\svchost.exe -k rpcss
c:\windows\system32\svchost.exe -k dcomlaunch -s LSM
C:\WINDOWS\system32\svchost.exe -k LocalSystemNetworkRestricted
c:\windows\system32\svchost.exe -k localsystemnetworkrestricted -s NcbService
c:\windows\system32\svchost.exe -k localservicenetworkrestricted -s TimeBrokerSvc
C:\Windows\System32\WUDFHost.exe
c:\windows\system32\svchost.exe -k localservicenetworkrestricted -s EventLog
c:\windows\system32\svchost.exe -k netsvcs -s ProfSvc
c:\windows\system32\svchost.exe -k netsvcs -s Themes
c:\windows\system32\svchost.exe -k localservice -s EventSystem
c:\windows\system32\svchost.exe -k appmodel -s StateRepository
c:\windows\system32\svchost.exe -k netsvcs -s SENS
C:\WINDOWS\system32\igfxCUIService.exe
c:\windows\system32\svchost.exe -k netsvcs -s Schedule
c:\windows\system32\svchost.exe -k localsystemnetworkrestricted -s AudioEndpointBuilder
c:\windows\system32\svchost.exe -k localservice -s FontCache
c:\windows\system32\svchost.exe -k netsvcs -s Winmgmt
C:\WINDOWS\System32\svchost.exe -k LocalServiceNetworkRestricted
c:\windows\system32\svchost.exe -k netsvcs -s UserManager
c:\windows\system32\svchost.exe -k localservice -s nsi
C:\WINDOWS\System32\svchost.exe -k LocalServiceNetworkRestricted
c:\windows\system32\svchost.exe -k networkservice -s Dnscache
C:\WINDOWS\system32\svchost.exe -k LocalServiceNetworkRestricted
c:\windows\system32\svchost.exe -k localservicenetworkrestricted -s Dhcp
C:\Windows\System32\WUDFHost.exe
c:\windows\system32\svchost.exe -k localsystemnetworkrestricted -s SensorService
c:\windows\system32\svchost.exe -k networkservice -s NlaSvc
C:\WINDOWS\system32\svchost.exe -k LocalSystemNetworkRestricted
C:\Program Files (x86)\ASUS\ATK Package\ATK Hotkey\AsLdrSrv.exe
C:\Program Files (x86)\ASUS\ATK Package\ATKGFNEX\GFNEXSrv.exe
c:\windows\system32\svchost.exe -k netsvcs -s ShellHWDetection
c:\windows\system32\svchost.exe -k localservice -s netprofm
C:\WINDOWS\System32\spoolsv.exe
C:\WINDOWS\system32\WLANExt.exe
c:\windows\system32\svchost.exe -k localservicenonetwork
c:\windows\system32\svchost.exe -k networkservice -s LanmanWorkstation
c:\windows\system32\svchost.exe -k networkservice -s CryptSvc
c:\windows\system32\svchost.exe -k netsvcs -s CertPropSvc
C:\WINDOWS\System32\svchost.exe -k utcsvc
c:\windows\system32\svchost.exe -k localsystemnetworkrestricted -s DeviceAssociationService
c:\windows\system32\svchost.exe -k netsvcs -s IKEEXT
c:\windows\system32\svchost.exe -k localservice -s WinHttpAutoProxySvc
C:\Program Files\Intel\WiFi\bin\EvtEng.exe
C:\WINDOWS\SysWOW64\esif_uf.exe
C:\Windows\system32\CxAudMsg64.exe
C:\WINDOWS\system32\ibtsiva.exe
c:\windows\system32\svchost.exe -k localservicenonetwork -s DPS
C:\Program Files (x86)\Panda Security\Panda Devices Agent\AgentSvc.exe
c:\windows\system32\svchost.exe -k netsvcs -s LanmanServer
C:\Program Files\Panda Security URL Filtering\Panda_URL_Filteringb.exe
c:\windows\system32\svchost.exe -k localsystemnetworkrestricted -s PcaSvc
C:\Program Files (x86)\Panda Security\Panda Security Protection\PSUAService.exe
C:\WINDOWS\SysWOW64\SAsrv.exe
C:\Program Files\Common Files\Intel\WirelessCommon\RegSrvc.exe
c:\windows\system32\svchost.exe -k localsystemnetworkrestricted -s SysMain
c:\windows\system32\svchost.exe -k appmodel -s tiledatamodelsvc
c:\windows\system32\svchost.exe -k localsystemnetworkrestricted -s TrkWks
c:\windows\system32\svchost.exe -k netsvcs -s WpnService
C:\Program Files\Intel\WiFi\bin\ZeroConfigService.exe
c:\windows\system32\svchost.exe -k localservice -s WdiServiceHost
C:\Program Files (x86)\Panda Security\Panda Security Protection\PSANHost.exe
C:\WINDOWS\system32\dashost.exe
c:\windows\system32\svchost.exe -k netsvcs -s iphlpsvc
C:\WINDOWS\system32\wbem\unsecapp.exe
C:\WINDOWS\system32\wbem\wmiprvse.exe
c:\windows\system32\svchost.exe -k localservicenetworkrestricted -s wscsvc
c:\windows\system32\svchost.exe -k networkservicenetworkrestricted -s PolicyAgent
C:\WINDOWS\system32\SearchIndexer.exe
C:\WINDOWS\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe
c:\windows\system32\svchost.exe -k netsvcs -s TokenBroker
c:\windows\system32\svchost.exe -k netsvcs -s Appinfo
c:\windows\system32\svchost.exe -k localservice -s CDPSvc
c:\windows\system32\svchost.exe -k localservice -s LicenseManager
c:\windows\system32\svchost.exe -k netsvcs
c:\windows\system32\svchost.exe -k localserviceandnoimpersonation -s SSDPSRV
C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\DAL\jhi_service.exe
c:\windows\system32\svchost.exe -k localsystemnetworkrestricted -s StorSvc
c:\windows\system32\svchost.exe -k netsvcs -s lfsvc
c:\windows\system32\svchost.exe -k localsystemnetworkrestricted -s DsSvc
c:\windows\system32\svchost.exe -k localsystemnetworkrestricted -s hidserv
C:\Program Files (x86)\Google\Chrome Remote Desktop\61.0.3163.20\remoting_host.exe
C:\Program Files (x86)\Google\Chrome Remote Desktop\61.0.3163.20\remoting_host.exe
c:\windows\system32\svchost.exe -k localservicenetworkrestricted -s RmSvc
C:\WINDOWS\system32\dashost.exe
C:\WINDOWS\SysWow64\IntelCpHeciSvc.exe
C:\WINDOWS\System32\svchost.exe -k netsvcs -s NetSetupSvc
c:\windows\system32\svchost.exe -k localservice -s SstpSvc
c:\windows\system32\svchost.exe -k netsvcs -s RasMan
C:\WINDOWS\System32\fontdrvhost.exe
C:\WINDOWS\System32\dwm.exe
C:\Program Files (x86)\ASUS\ATK Package\ATK Hotkey\HControl.exe
C:\WINDOWS\TEMP\DPTF\esif_assist_64.exe
c:\windows\system32\sihost.exe
c:\windows\system32\svchost.exe -k unistacksvcgroup -s CDPUserSvc
c:\windows\system32\svchost.exe -k unistacksvcgroup -s WpnUserService
C:\Program Files (x86)\ASUS\USBChargerPlus\USBChargerPlus.exe
C:\Program Files (x86)\ASUS\Splendid\ACMON.exe
c:\windows\system32\taskhostw.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files (x86)\ASUS\ATK Package\ATK Media\DMedia.exe
C:\Program Files (x86)\ASUS\ATK Package\ATKOSD2\ATKOSD2.exe
C:\WINDOWS\system32\igfxEM.exe
C:\WINDOWS\system32\igfxHK.exe
C:\WINDOWS\system32\igfxTray.exe
C:\Windows\SystemApps\ShellExperienceHost_cw5n1h2txyewy\ShellExperienceHost.exe
C:\Windows\System32\RuntimeBroker.exe
C:\Program Files (x86)\ASUS\ASUS Smart Gesture\AsTPCenter\x64\AsusTPLoader.exe
C:\Program Files (x86)\ASUS\ASUS Smart Gesture\AsTPCenter\x64\AsusTPHelper.exe
C:\Program Files\Windows Defender\MSASCuiL.exe
C:\Program Files\CONEXANT\cAudioFilterAgent\CAudioFilterAgent64.exe
C:\Program Files\WindowsApps\Microsoft.SkypeApp_11.19.856.0_x64__kzf8qxf38zg5c\SkypeHost.exe
C:\Users\Zofia\AppData\Local\Microsoft\OneDrive\OneDrive.exe
C:\Program Files (x86)\Panda Security\Panda Security Protection\PSUAMain.exe
C:\Program Files\Conexant\SAII\SmartAudio.exe
c:\windows\system32\svchost.exe -k unistacksvcgroup
c:\windows\system32\svchost.exe -k netsvcs -s BITS
C:\WINDOWS\system32\ApplicationFrameHost.exe
C:\Program Files\WindowsApps\Microsoft.Windows.Photos_2017.35071.13510.0_x64__8wekyb3d8bbwe\Microsoft.Photos.exe
C:\Program Files (x86)\Microsoft Office\Office15\FirstRun.exe
C:\WINDOWS\system32\svchost.exe -k netsvcs -s wlidsvc
C:\Windows\SystemApps\Microsoft.Windows.Cortana_cw5n1h2txyewy\SearchUI.exe
C:\Program Files (x86)\ASUS\ASUS Smart Gesture\AsTPCenter\x64\AsusTPCenter.exe
C:\WINDOWS\System32\svchost.exe -k LocalServiceNetworkRestricted -s lmhosts
C:\WINDOWS\System32\svchost.exe -k LocalSystemNetworkRestricted -s WdiSystemHost
C:\Windows\System32\smartscreen.exe
C:\WINDOWS\system32\AUDIODG.EXE
C:\WINDOWS\system32\wbem\wmiprvse.exe
C:\WINDOWS\System32\cscript.exe
.
============== Pseudo HJT Report ===============
.
uLocal Page = %11%\blank.htm
BHO: Panda Safe Web: {B821BF60-5C2D-41EB-92DC-3E4CCD3A22E4} - C:\Program Files (x86)\pandasecuritytb\pandasecurityDx.dll
TB: Panda Safe Web: {B821BF60-5C2D-41EB-92DC-3E4CCD3A22E4} - C:\Program Files (x86)\pandasecuritytb\pandasecurityDx.dll
uRun: [OneDrive] "C:\Users\Zofia\AppData\Local\Microsoft\OneDrive\OneDrive.exe" /background
mRun: [PSUAMain] "C:\Program Files (x86)\Panda Security\Panda Security Protection\PSUAMain.exe" /LaunchSysTray
mPolicies-System: DSCAutomationHostEnabled = dword:2
mPolicies-System: MaxGPOScriptWait = dword:600
TCP: NameServer = 75.75.75.75 75.75.76.76
TCP: Interfaces\{6d194bdc-7062-450c-bb32-ca539b8d4183} : DHCPNameServer = 75.75.75.75 75.75.76.76
Handler: tbauth - {14654CA6-5711-491D-B89A-58E571679951} - C:\Windows\SysWOW64\tbauth.dll
Handler: windows.tbauth - {14654CA6-5711-491D-B89A-58E571679951} - C:\Windows\SysWOW64\tbauth.dll
SSODL: WebCheck - <orphaned>
LSA: Security Packages = ""
CLSID: {603D3801-BD81-11d0-A3A5-00C04FD706EC} - C:\WINDOWS\System32\windows.storage.dll
x64-BHO: Panda Safe Web: {B821BF60-5C2D-41EB-92DC-3E4CCD3A22E4} - C:\Program Files (x86)\pandasecuritytb\pandasecurityDx64.dll
x64-TB: Panda Safe Web: {B821BF60-5C2D-41EB-92DC-3E4CCD3A22E4} - C:\Program Files (x86)\pandasecuritytb\pandasecurityDx64.dll
x64-Run: [SecurityHealth] C:\Program Files (x86)\Windows Defender\MSASCuiL.exe
x64-Run: [cAudioFilterAgent] C:\Program Files\Conexant\cAudioFilterAgent\cAudioFilterAgent64.exe
x64-Run: [SmartAudio] C:\Program Files\CONEXANT\SAII\SACpl.exe /c /delay:30
x64-RunOnce: [RealProtect] "C:\Program Files\McAfee\Real Protect\RealProtect.exe" --run
x64-mPolicies-System: DSCAutomationHostEnabled = dword:2
x64-mPolicies-System: MaxGPOScriptWait = dword:600
x64-Handler: tbauth - {14654CA6-5711-491D-B89A-58E571679951} - C:\WINDOWS\System32\tbauth.dll
x64-Handler: windows.tbauth - {14654CA6-5711-491D-B89A-58E571679951} - C:\WINDOWS\System32\tbauth.dll
x64-SSODL: WebCheck - <orphaned>
x64-mASetup: {2C7339CF-2B09-4501-B3F3-F3508C9228ED} - /UserInstall
x64-mASetup: {89820200-ECBD-11cf-8B85-00AA005B4340} - U
x64-mASetup: {8A69D345-D564-463c-AFF1-A69D9E530F96} - "C:\Program Files (x86)\Google\Chrome\Application\60.0.3112.113\Installer\chrmstp.exe" --configure-user-settings --verbose-logging --system-level
x64-CLSID: {603D3801-BD81-11d0-A3A5-00C04FD706EC} - C:\WINDOWS\System32\windows.storage.dll
.
================= FIREFOX ===================
.
FF - ProfilePath - C:\Users\Zofia\AppData\Roaming\Mozilla\Firefox\Profiles\qpfff3pq.default\
FF - prefs.js: browser.startup.homepage - hxxps://www.google.com/
FF - plugin: C:\Program Files (x86)\Google\Update\1.3.33.5\npGoogleUpdate3.dll
FF - plugin: C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\IPT\npIntelWebAPIIPT.dll
FF - plugin: C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\IPT\npIntelWebAPIUpdater.dll
.
============= SERVICES / DRIVERS ===============
.
R0 iaStorA;iaStorA;C:\WINDOWS\System32\drivers\iaStorA.sys [2015-9-14 1455552]
R0 IntelHSWPcc;IntelHSWPcc;C:\WINDOWS\System32\drivers\IntelPcc.sys [2015-9-14 88256]
R0 intelpep;Intel(R) Power Engine Plug-in Driver;C:\WINDOWS\System32\drivers\intelpep.sys [2017-3-18 74840]
R0 iorate;Disk I/O Rate Filter Driver;C:\WINDOWS\System32\drivers\iorate.sys [2017-3-18 49568]
R0 volume;Volume driver;C:\WINDOWS\System32\drivers\volume.sys [2017-3-18 16288]
R0 WindowsTrustedRT;Windows Trusted Execution Environment Class Extension;C:\WINDOWS\System32\drivers\WindowsTrustedRT.sys [2017-3-18 70232]
R0 WindowsTrustedRTProxy;Microsoft Windows Trusted Runtime Secure Service;C:\WINDOWS\System32\drivers\WindowsTrustedRTProxy.sys [2017-3-18 18520]
R0 Wof;Windows Overlay File System Filter Driver;C:\WINDOWS\System32\drivers\wof.sys [2017-3-18 208288]
R1 ahcache;Application Compatibility Cache;C:\WINDOWS\System32\drivers\ahcache.sys [2017-3-18 239616]
R1 ATKWMIACPIIO;ATKWMIACPI Driver;C:\Program Files (x86)\ASUS\ATK Package\ATK WMIACPI\atkwmiacpi64.sys [2013-7-2 19768]
R1 FileCrypt;FileCrypt;C:\WINDOWS\System32\drivers\filecrypt.sys [2017-3-18 54272]
R1 GpuEnergyDrv;GPU Energy Driver;C:\WINDOWS\System32\drivers\gpuenergydrv.sys [2017-3-18 8192]
R1 NNSALPC;NNSALPC;C:\WINDOWS\System32\drivers\nnsalpc.sys [2015-12-10 107488]
R1 NNSHTTP;NNSHTTP;C:\WINDOWS\System32\drivers\nnshttp.sys [2015-12-10 211376]
R1 NNSHTTPS;NNSHTTPS;C:\WINDOWS\System32\drivers\nnshttps.sys [2017-2-8 121312]
R1 NNSIDS;NNSIDS;C:\WINDOWS\System32\drivers\nnsids.sys [2015-12-10 125872]
R1 NNSNAHSL;Network Activity Hook Server LightWeight Filter Driver;C:\WINDOWS\System32\drivers\NNSNAHSL.sys [2016-7-6 80152]
R1 NNSPICC;NNSPICC;C:\WINDOWS\System32\drivers\nnspicc.sys [2015-12-10 116656]
R1 NNSPIHSW;NNSPIHSW;C:\WINDOWS\System32\drivers\nnspihsw.sys [2015-12-10 91104]
R1 NNSPOP3;NNSPOP3;C:\WINDOWS\System32\drivers\nnspop3.sys [2016-7-5 135088]
R1 NNSPROT;NNSPROT;C:\WINDOWS\System32\drivers\nnsprot.sys [2015-12-10 335792]
R1 NNSPRV;NNSPRV;C:\WINDOWS\System32\drivers\nnsprv.sys [2015-12-10 197600]
R1 NNSSMTP;NNSSMTP;C:\WINDOWS\System32\drivers\nnssmtp.sys [2016-7-5 123312]
R1 NNSSTRM;NNSSTRM;C:\WINDOWS\System32\drivers\nnsstrm.sys [2015-12-10 278960]
R1 NNSTLSC;NNSTLSC;C:\WINDOWS\System32\drivers\nnstlsc.sys [2015-12-10 125360]
R1 PSINKNC;PSINKNC;C:\WINDOWS\System32\drivers\PSINKNC.sys [2016-1-29 205584]
R2 ASMMAP64;ASMMAP64;C:\Program Files (x86)\ASUS\ATK Package\ATKGFNEX\ASMMAP64.sys [2009-7-2 15416]
R2 CDPSvc;Connected Devices Platform Service;C:\WINDOWS\System32\svchost.exe -k LocalService [2017-3-18 47664]
R2 CDPUserSvc_8b69a57;Connected Devices Platform User Service_8b69a57;C:\WINDOWS\System32\svchost.exe -k UnistackSvcGroup [2017-3-18 47664]
R2 chromoting;Chrome Remote Desktop Service;C:\Program Files (x86)\Google\Chrome Remote Desktop\61.0.3163.20\remoting_host.exe [2017-7-31 71512]
R2 clreg;Virtual Registry for Containers;C:\WINDOWS\System32\drivers\registry.sys [2017-3-18 14336]
R2 CoreMessagingRegistrar;CoreMessaging;C:\WINDOWS\System32\svchost.exe -k LocalServiceNoNetwork [2017-3-18 47664]
R2 CxAudMsg;Conexant Audio Message Service;C:\WINDOWS\System32\CxAudMsg64.exe [2015-10-29 207576]
R2 DiagTrack;Connected User Experiences and Telemetry;C:\WINDOWS\System32\svchost.exe -k utcsvc [2017-3-18 47664]
R2 DusmSvc;Data Usage;C:\WINDOWS\System32\svchost.exe -k LocalServiceNetworkRestricted [2017-3-18 47664]
R2 esifsvc;ESIF Upper Framework Service;C:\Windows\SysWOW64\esif_uf.exe [2015-10-29 1385640]
R2 ibtsiva;Intel Bluetooth Service;C:\WINDOWS\System32\ibtsiva --> C:\WINDOWS\System32\ibtsiva [?]
R2 igfxCUIService2.0.0.0;Intel(R) HD Graphics Control Panel Service;C:\WINDOWS\System32\igfxCUIService.exe [2016-11-30 373728]
R2 jhi_service;Intel(R) Dynamic Application Loader Host Interface Service;C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\DAL\jhi_service.exe [2015-6-24 223008]
R2 NanoServiceMain;Panda Protection Service;C:\Program Files (x86)\Panda Security\Panda Security Protection\PSANHost.exe [2017-2-14 110384]
R2 OneSyncSvc_8b69a57;Sync Host_8b69a57;C:\WINDOWS\System32\svchost.exe -k UnistackSvcGroup [2017-3-18 47664]
R2 panda_url_filtering;panda_url_filtering Service;C:\Program Files\Panda Security URL Filtering\Panda_URL_Filteringb.exe -- --> C:\Program Files\Panda Security URL Filtering\Panda_URL_Filteringb.exe -- [?]
R2 PandaAgent;Panda Devices Agent;C:\Program Files (x86)\Panda Security\Panda Devices Agent\AgentSvc.exe [2016-7-19 86104]
R2 PSINAflt;PSINAflt;C:\WINDOWS\System32\drivers\PSINAflt.sys [2017-6-16 177424]
R2 PSINFile;PSINFile;C:\WINDOWS\System32\drivers\PSINFile.sys [2017-6-16 129296]
R2 PSINProc;PSINProc;C:\WINDOWS\System32\drivers\PSINProc.sys [2017-6-16 131344]
R2 PSINProt;PSINProt;C:\WINDOWS\System32\drivers\PSINProt.sys [2017-6-16 144656]
R2 PSINReg;PSINReg;C:\WINDOWS\System32\drivers\PSINReg.sys [2017-6-16 114960]
R2 PSUAService;Panda Product Service;C:\Program Files (x86)\Panda Security\Panda Security Protection\PSUAService.exe [2017-4-25 47096]
R2 SAService;Conexant SmartAudio service;C:\WINDOWS\System32\SAsrv.exe --> C:\WINDOWS\System32\SAsrv.exe [?]
R2 SecurityHealthService;Windows Defender Security Center Service;C:\WINDOWS\System32\SecurityHealthService.exe [2017-7-11 336320]
R2 storqosflt;Storage QoS Filter Driver;C:\WINDOWS\System32\drivers\storqosflt.sys [2017-3-18 79872]
R2 tiledatamodelsvc;Tile Data model server;C:\WINDOWS\System32\svchost.exe -k appmodel [2017-3-18 47664]
R2 UserManager;User Manager;C:\WINDOWS\System32\svchost.exe -k netsvcs [2017-3-18 47664]
R2 wcifs;Windows Container Isolation;C:\WINDOWS\System32\drivers\wcifs.sys [2017-7-11 142752]
R2 WpnService;Windows Push Notifications System Service;C:\WINDOWS\System32\svchost.exe -k netsvcs [2017-3-18 47664]
R2 WpnUserService_8b69a57;Windows Push Notifications User Service_8b69a57;C:\WINDOWS\System32\svchost.exe -k UnistackSvcGroup [2017-3-18 47664]
R2 ZeroConfigService;Intel(R) PROSet/Wireless Zero Configuration Service;C:\Program Files\Intel\WiFi\bin\ZeroConfigService.exe [2016-11-29 3732896]
R3 acpials;ALS Sensor Filter;C:\WINDOWS\System32\drivers\acpials.sys [2017-3-18 12288]
R3 AiCharger;ASUS Charger Driver;C:\WINDOWS\System32\drivers\AiCharger.sys [2015-5-25 21816]
R3 AsusTP;ASUS Input Touchpad Device;C:\WINDOWS\System32\drivers\AsusTP.sys [2017-3-9 128024]
R3 CAD;Charge Arbitration Driver;C:\WINDOWS\System32\drivers\CAD.sys [2017-3-18 53664]
R3 dptf_cpu;dptf_cpu;C:\WINDOWS\System32\drivers\dptf_cpu.sys [2015-10-29 43000]
R3 dptf_pch;dptf_pch;C:\WINDOWS\System32\drivers\dptf_pch.sys [2015-10-29 41976]
R3 DsSvc;Data Sharing Service;C:\WINDOWS\System32\svchost.exe -k LocalSystemNetworkRestricted [2017-3-18 47664]
R3 esif_lf;esif_lf;C:\WINDOWS\System32\drivers\esif_lf.sys [2015-10-29 251384]
R3 HIDSwitch;ASUS Wireless Radio Control;C:\WINDOWS\System32\drivers\AsHIDSwitch64.sys [2015-5-13 19976]
R3 ibtusb;Intel(R) Wireless Bluetooth(R);C:\WINDOWS\System32\drivers\ibtusb.sys [2016-10-15 250624]
R3 lfsvc;Geolocation Service;C:\WINDOWS\System32\svchost.exe -k netsvcs [2017-3-18 47664]
R3 LicenseManager;Windows License Manager Service;C:\WINDOWS\System32\svchost.exe -k LocalService [2017-3-18 47664]
R3 NcbService;Network Connection Broker;C:\WINDOWS\System32\svchost.exe -k LocalSystemNetworkRestricted [2017-3-18 47664]
R3 NdisVirtualBus;Microsoft Virtual Network Adapter Enumerator;C:\WINDOWS\System32\drivers\NdisVirtualBus.sys [2017-3-18 20992]
R3 NetSetupSvc;Network Setup Service;C:\WINDOWS\System32\svchost.exe -k netsvcs [2017-3-18 47664]
R3 Netwtw04;Intel(R) Wireless Adapter Driver for Windows 10 - 64 Bit;C:\WINDOWS\System32\drivers\Netwtw04.sys [2016-12-19 7918840]
R3 panda_url_filteringd;panda_url_filteringd driver;C:\Program Files\Panda Security URL Filtering\Panda_URL_Filteringd.sys [2014-3-19 51288]
R3 PimIndexMaintenanceSvc_8b69a57;Contact Data_8b69a57;C:\WINDOWS\System32\svchost.exe -k UnistackSvcGroup [2017-3-18 47664]
R3 SensorsAlsDriver;UMDF Reflector service for SensorsAlsDriver;C:\WINDOWS\System32\drivers\WUDFRd.sys [2017-3-18 220672]
R3 SensorService;Sensor Service;C:\WINDOWS\System32\svchost.exe -k LocalSystemNetworkRestricted [2017-3-18 47664]
R3 StateRepository;State Repository Service;C:\WINDOWS\System32\svchost.exe -k appmodel [2017-3-18 47664]
R3 TimeBrokerSvc;Time Broker;C:\WINDOWS\System32\svchost.exe -k LocalServiceNetworkRestricted [2017-3-18 47664]
R3 TokenBroker;TokenBroker;C:\WINDOWS\System32\svchost.exe -k netsvcs [2017-3-18 47664]
R3 UEFI;Microsoft UEFI Driver;C:\WINDOWS\System32\drivers\uefi.sys [2017-3-18 29600]
R3 UnistoreSvc_8b69a57;User Data Storage_8b69a57;C:\WINDOWS\System32\svchost.exe -k UnistackSvcGroup [2017-3-18 47664]
R3 UserDataSvc_8b69a57;User Data Access_8b69a57;C:\WINDOWS\System32\svchost.exe -k UnistackSvcGroup [2017-3-18 47664]
R3 wdiwifi;WDI Driver Framework;C:\WINDOWS\System32\drivers\WdiWiFi.sys [2017-7-11 757248]
R3 WUDFWpdMtp;WUDFWpdMtp;C:\WINDOWS\System32\drivers\WUDFRd.sys [2017-3-18 220672]
S2 CldFlt;Windows Cloud Files Filter Driver;C:\WINDOWS\System32\drivers\cldflt.sys [2017-3-18 12288]
S2 DoSvc;Delivery Optimization;C:\WINDOWS\System32\svchost.exe -k netsvcs [2017-3-18 47664]
S2 MapsBroker;Downloaded Maps Manager;C:\WINDOWS\System32\svchost.exe -k NetworkService [2017-3-18 47664]
S2 SkypeUpdate;Skype Updater;C:\Program Files (x86)\Skype\Updater\Updater.exe [2017-6-1 317400]
S3 AcpiDev;ACPI Devices driver;C:\WINDOWS\System32\drivers\AcpiDev.sys [2017-3-18 20480]
S3 ADP80XX;ADP80XX;C:\WINDOWS\System32\drivers\adp80xx.sys [2017-3-18 1135512]
S3 AJRouter;AllJoyn Router Service;C:\WINDOWS\System32\svchost.exe -k LocalServiceNetworkRestricted [2017-3-18 47664]
S3 applockerfltr;Smartlocker Filter Driver;C:\WINDOWS\System32\drivers\applockerfltr.sys [2017-3-18 17920]
S3 AppReadiness;App Readiness;C:\WINDOWS\System32\svchost.exe -k AppReadiness [2017-3-18 47664]
S3 AppXSvc;AppX Deployment Service (AppXSVC);C:\WINDOWS\System32\svchost.exe -k wsappx [2017-3-18 47664]
S3 bcmfn2;bcmfn2 Service;C:\WINDOWS\System32\drivers\bcmfn2.sys [2017-3-18 9728]
S3 BthHFSrv;Bluetooth Handsfree Service;C:\WINDOWS\System32\svchost.exe -k LocalServiceAndNoImpersonation [2017-3-18 47664]
S3 buttonconverter;Service for Portable Device Control devices;C:\WINDOWS\System32\drivers\buttonconverter.sys [2017-3-18 39424]
S3 CapImg;HID driver for CapImg touch screen;C:\WINDOWS\System32\drivers\capimg.sys [2017-3-18 122880]
S3 cht4iscsi;cht4iscsi;C:\WINDOWS\System32\drivers\cht4sx64.sys [2017-3-18 347032]
S3 cht4vbd;Chelsio Virtual Bus Driver;C:\WINDOWS\System32\drivers\cht4vx64.sys [2017-3-18 2104224]
S3 ClipSVC;Client License Service (ClipSVC);C:\WINDOWS\System32\svchost.exe -k wsappx [2017-3-18 47664]
S3 DevicesFlowUserSvc_8b69a57;DevicesFlow_8b69a57;C:\WINDOWS\System32\svchost.exe -k DevicesFlow [2017-3-18 47664]
S3 DevQueryBroker;DevQuery Background Discovery Broker;C:\WINDOWS\System32\svchost.exe -k LocalSystemNetworkRestricted [2017-3-18 47664]
S3 dg_ssudbus;SAMSUNG Mobile USB Composite Device Driver (DEVGURU Ver.);C:\WINDOWS\System32\drivers\ssudbus.sys [2017-5-18 131984]
S3 diagnosticshub.standardcollector.service;Microsoft (R) Diagnostics Hub Standard Collector Service;C:\WINDOWS\System32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe [2017-3-18 86528]
S3 DmEnrollmentSvc;Device Management Enrollment Service;C:\WINDOWS\System32\svchost.exe -k netsvcs [2017-3-18 47664]
S3 dmwappushservice;dmwappushsvc;C:\WINDOWS\System32\svchost.exe -k netsvcs [2017-3-18 47664]
S3 embeddedmode;Embedded Mode;C:\WINDOWS\System32\svchost.exe -k LocalSystemNetworkRestricted [2017-3-18 47664]
S3 EntAppSvc;Enterprise App Management Service;C:\WINDOWS\System32\svchost.exe -k appmodel [2017-3-18 47664]
S3 FrameServer;Windows Camera Frame Server;C:\WINDOWS\System32\svchost.exe -k Camera [2017-3-18 47664]
S3 genericusbfn;Generic USB Function Class;C:\WINDOWS\System32\drivers\genericusbfn.sys [2017-3-18 21504]
S3 hidinterrupt;Common Driver for HID Buttons implemented with interrupts;C:\WINDOWS\System32\drivers\hidinterrupt.sys [2017-3-18 51104]
S3 HvHost;HV Host Service;C:\WINDOWS\System32\svchost.exe -k LocalSystemNetworkRestricted [2017-3-18 47664]
S3 iagpio;Intel Serial IO GPIO Controller Driver;C:\WINDOWS\System32\drivers\iagpio.sys [2017-3-18 33280]
S3 iai2c;Intel(R) Serial IO I2C Host Controller;C:\WINDOWS\System32\drivers\iai2c.sys [2017-3-18 81408]
S3 iaLPSS2i_GPIO2;Intel(R) Serial IO GPIO Driver v2;C:\WINDOWS\System32\drivers\iaLPSS2i_GPIO2.sys [2017-3-18 70656]
S3 iaLPSS2i_GPIO2_BXT_P;Intel(R) Serial IO GPIO Driver v2;C:\WINDOWS\System32\drivers\iaLPSS2i_GPIO2_BXT_P.sys [2017-3-18 85504]
S3 iaLPSS2i_I2C;Intel(R) Serial IO I2C Driver v2;C:\WINDOWS\System32\drivers\iaLPSS2i_I2C.sys [2017-3-18 165376]
S3 iaLPSS2i_I2C_BXT_P;Intel(R) Serial IO I2C Driver v2;C:\WINDOWS\System32\drivers\iaLPSS2i_I2C_BXT_P.sys [2017-3-18 168448]
S3 iaLPSSi_GPIO;Intel(R) Serial IO GPIO Controller Driver;C:\WINDOWS\System32\drivers\iaLPSSi_GPIO.sys [2017-3-18 38128]
S3 iaLPSSi_I2C;Intel(R) Serial IO I2C Controller Driver;C:\WINDOWS\System32\drivers\iaLPSSi_I2C.sys [2017-3-18 113152]
S3 iaStorAV;Intel(R) SATA RAID Controller Windows;C:\WINDOWS\System32\drivers\iaStorAV.sys [2017-3-18 673184]
S3 ibbus;Mellanox InfiniBand Bus/AL (Filter Driver);C:\WINDOWS\System32\drivers\ibbus.sys [2017-3-18 526240]
S3 icssvc;Windows Mobile Hotspot Service;C:\WINDOWS\System32\svchost.exe -k LocalServiceNetworkRestricted [2017-3-18 47664]
S3 IndirectKmd;Indirect Displays Kernel-Mode Driver;C:\WINDOWS\System32\drivers\IndirectKmd.sys [2017-3-18 36864]
S3 IntcDAud;Intel(R) Display Audio;C:\WINDOWS\System32\drivers\IntcDAud.sys [2016-5-12 481768]
S3 Intel(R) Capability Licensing Service TCP IP Interface;Intel(R) Capability Licensing Service TCP IP Interface;C:\Program Files\Intel\iCLS Client\SocketHeciServer.exe [2015-5-22 881152]
S3 IpxlatCfgSvc;IP Translation Configuration Service;C:\WINDOWS\System32\svchost.exe -k LocalSystemNetworkRestricted [2017-3-18 47664]
S3 LSI_SAS2i;LSI_SAS2i;C:\WINDOWS\System32\drivers\lsi_sas2i.sys [2017-3-18 123808]
S3 LSI_SAS3i;LSI_SAS3i;C:\WINDOWS\System32\drivers\lsi_sas3i.sys [2017-3-18 103328]
S3 mausbhost;MA-USB Host Controller Driver;C:\WINDOWS\System32\drivers\mausbhost.sys [2017-3-18 405408]
S3 mausbip;MA-USB IP Filter Driver;C:\WINDOWS\System32\drivers\mausbip.sys [2017-3-18 51104]
S3 MBAMService;Malwarebytes Service;C:\Program Files\Malwarebytes\Anti-Malware\MBAMService.exe [2017-9-3 6058960]
S3 megasas2i;megasas2i;C:\WINDOWS\System32\drivers\MegaSas2i.sys [2017-3-18 64416]
S3 MessagingService_8b69a57;MessagingService_8b69a57;C:\WINDOWS\System32\svchost.exe -k UnistackSvcGroup [2017-3-18 47664]
S3 mlx4_bus;Mellanox ConnectX Bus Enumerator;C:\WINDOWS\System32\drivers\mlx4_bus.sys [2017-3-18 842656]
S3 MyWiFiDHCPDNS;Wireless PAN DHCP Server;C:\Program Files\Intel\WiFi\bin\PanDhcpDns.exe [2016-11-29 268704]
S3 NaturalAuthentication;Natural Authentication;C:\WINDOWS\System32\svchost.exe -k netsvcs [2017-3-18 47664]
S3 ndfltr;NetworkDirect Service;C:\WINDOWS\System32\drivers\ndfltr.sys [2017-3-18 108960]
S3 NetAdapterCx;Network Adapter Wdf Class Extension Library;C:\WINDOWS\System32\drivers\NetAdapterCx.sys [2017-3-18 122368]
S3 netvsc;netvsc;C:\WINDOWS\System32\drivers\netvsc.sys [2017-7-11 118784]
S3 NgcCtnrSvc;Microsoft Passport Container;C:\WINDOWS\System32\svchost.exe -k LocalServiceNetworkRestricted [2017-3-18 47664]
S3 NgcSvc;Microsoft Passport;C:\WINDOWS\System32\svchost.exe -k LocalSystemNetworkRestricted [2017-3-18 47664]
S3 nvdimmn;Microsoft NVDIMM-N device driver;C:\WINDOWS\System32\drivers\nvdimmn.sys [2017-3-18 80896]
S3 percsas2i;percsas2i;C:\WINDOWS\System32\drivers\percsas2i.sys [2017-3-18 58784]
S3 percsas3i;percsas3i;C:\WINDOWS\System32\drivers\percsas3i.sys [2017-3-18 61848]
S3 PhoneSvc;Phone Service;C:\WINDOWS\System32\svchost.exe -k LocalService [2017-3-18 47664]
S3 ReFS;ReFS;C:\WINDOWS\System32\drivers\refs.sys [2017-3-18 1735584]
S3 ReFSv1;ReFSv1;C:\WINDOWS\System32\drivers\refsv1.sys [2017-3-18 936864]
S3 RetailDemo;Retail Demo Service;C:\WINDOWS\System32\svchost.exe -k rdxgroup [2017-3-18 47664]
S3 ScDeviceEnum;Smart Card Device Enumeration Service;C:\WINDOWS\System32\svchost.exe -k LocalSystemNetworkRestricted [2017-3-18 47664]
S3 scmbus;Microsoft Storage Class Memory Bus Driver;C:\WINDOWS\System32\drivers\scmbus.sys [2017-3-18 91040]
S3 SDFRd;SDF Reflector;C:\WINDOWS\System32\drivers\SDFRd.sys [2017-3-18 31128]
S3 SEMgrSvc;Payments and NFC/SE Manager;C:\WINDOWS\System32\svchost.exe -k LocalService [2017-3-18 47664]
S3 SensorDataService;Sensor Data Service;C:\WINDOWS\System32\SensorDataService.exe [2017-3-18 1284608]
S3 SerCx2;Serial UART Support Library;C:\WINDOWS\System32\drivers\SerCx2.sys [2017-3-18 154016]
S3 smphost;Microsoft Storage Spaces SMP;C:\WINDOWS\System32\svchost.exe -k smphost [2017-3-18 47664]
S3 SmsRouter;Microsoft Windows SMS Router Service.;C:\WINDOWS\System32\svchost.exe -k LocalSystemNetworkRestricted [2017-3-18 47664]
S3 SpatialGraphFilter;Holographic Spatial Graph Filter;C:\WINDOWS\System32\drivers\SpatialGraphFilter.sys [2017-3-18 40352]
S3 spectrum;Windows Perception Service;C:\WINDOWS\System32\Spectrum.exe [2017-3-18 891904]
S3 stornvme;Microsoft Standard NVM Express Driver;C:\WINDOWS\System32\drivers\stornvme.sys [2017-3-18 95648]
S3 storufs;Microsoft Universal Flash Storage (UFS) Driver;C:\WINDOWS\System32\drivers\storufs.sys [2017-3-18 36760]
S3 TieringEngineService;Storage Tiers Management;C:\WINDOWS\System32\TieringEngineService.exe [2017-3-18 302592]
S3 UcmCx0101;USB Connector Manager KMDF Class Extension;C:\WINDOWS\System32\drivers\UcmCx.sys [2017-3-18 104448]
S3 UcmTcpciCx0101;UCM-TCPCI KMDF Class Extension;C:\WINDOWS\System32\drivers\UcmTcpciCx.sys [2017-3-18 179200]
S3 UcmUcsi;USB Connector Manager UCSI Client;C:\WINDOWS\System32\drivers\UcmUcsi.sys [2017-8-9 51712]
S3 UdeCx;USB Device Emulation Support Library;C:\WINDOWS\System32\drivers\Udecx.sys [2017-3-18 45568]
S3 Ufx01000;USB Function Class Extension;C:\WINDOWS\System32\drivers\ufx01000.sys [2017-3-18 263584]
S3 UfxChipidea;USB Chipidea Controller;C:\WINDOWS\System32\drivers\UfxChipidea.sys [2017-3-18 98712]
S3 ufxsynopsys;USB Synopsys Controller;C:\WINDOWS\System32\drivers\ufxsynopsys.sys [2017-3-18 138656]
S3 UrsChipidea;Chipidea USB Role-Switch Driver;C:\WINDOWS\System32\drivers\urschipidea.sys [2017-3-18 29600]
S3 UrsCx01000;USB Role-Switch Support Library;C:\WINDOWS\System32\drivers\urscx01000.sys [2017-3-18 59288]
S3 UrsSynopsys;Synopsys USB Role-Switch Driver;C:\WINDOWS\System32\drivers\urssynopsys.sys [2017-3-18 28064]
S3 UsoSvc;Update Orchestrator Service;C:\WINDOWS\System32\svchost.exe -k netsvcs [2017-3-18 47664]
S3 vhf;Virtual HID Framework (VHF) Driver;C:\WINDOWS\System32\drivers\vhf.sys [2017-3-18 35328]
S3 vmgid;Microsoft Hyper-V Guest Infrastructure Driver;C:\WINDOWS\System32\drivers\vmgid.sys [2017-3-18 10240]
S3 vmicguestinterface;Hyper-V Guest Service Interface;C:\WINDOWS\System32\svchost.exe -k LocalSystemNetworkRestricted [2017-3-18 47664]
S3 vmicvmsession;Hyper-V PowerShell Direct Service;C:\WINDOWS\System32\svchost.exe -k LocalSystemNetworkRestricted [2017-3-18 47664]
S3 WalletService;WalletService;C:\WINDOWS\System32\svchost.exe -k appmodel [2017-3-18 47664]
S3 wcnfs;Windows Container Name Virtualization;C:\WINDOWS\System32\drivers\wcnfs.sys [2017-3-18 72192]
S3 WdNisDrv;Windows Defender Antivirus Network Inspection System Driver;C:\WINDOWS\System32\drivers\WdNisDrv.sys [2017-3-18 121248]
S3 WdNisSvc;Windows Defender Antivirus Network Inspection Service;C:\Program Files\Windows Defender\NisSrv.exe [2017-3-18 342264]
S3 WEPHOSTSVC;Windows Encryption Provider Host Service;C:\WINDOWS\System32\svchost.exe -k WepHostSvcGroup [2017-3-18 47664]
S3 WFDSConMgrSvc;Wi-Fi Direct Services Connection Manager Service;C:\WINDOWS\System32\svchost.exe -k LocalServiceNetworkRestricted [2017-3-18 47664]
S3 WinMad;WinMad Service;C:\WINDOWS\System32\drivers\winmad.sys [2017-3-18 32160]
S3 WinNat;Windows NAT Driver;C:\WINDOWS\System32\drivers\winnat.sys [2017-3-18 217088]
S3 WinVerbs;WinVerbs Service;C:\WINDOWS\System32\drivers\winverbs.sys [2017-3-18 64920]
S3 wisvc;Windows Insider Service;C:\WINDOWS\System32\svchost.exe -k netsvcs [2017-3-18 47664]
S3 wlpasvc;LPA Service;C:\WINDOWS\System32\svchost.exe -k LocalService [2017-3-18 47664]
S3 workfolderssvc;Work Folders;C:\WINDOWS\System32\svchost.exe -k LocalService [2017-3-18 47664]
S3 xbgm;Xbox Game Monitoring;C:\WINDOWS\System32\svchost.exe -k netsvcs [2017-3-18 47664]
S3 XblAuthManager;Xbox Live Auth Manager;C:\WINDOWS\System32\svchost.exe -k netsvcs [2017-3-18 47664]
S3 XblGameSave;Xbox Live Game Save;C:\WINDOWS\System32\svchost.exe -k netsvcs [2017-3-18 47664]
S3 xboxgip;Xbox Game Input Protocol Driver;C:\WINDOWS\System32\drivers\xboxgip.sys [2017-7-11 277504]
S3 XboxGipSvc;Xbox Accessory Management Service;C:\WINDOWS\System32\svchost.exe -k netsvcs [2017-3-18 47664]
S3 XboxNetApiSvc;Xbox Live Networking Service;C:\WINDOWS\System32\svchost.exe -k netsvcs [2017-3-18 47664]
S3 xinputhid;XINPUT HID Filter Driver;C:\WINDOWS\System32\drivers\xinputhid.sys [2017-3-18 46592]
S4 shpamsvc;Shared PC Account Manager;C:\WINDOWS\System32\svchost.exe -k netsvcs [2017-3-18 47664]
S4 tzautoupdate;Auto Time Zone Updater;C:\WINDOWS\System32\svchost.exe -k LocalService [2017-3-18 47664]
.
=============== File Associations ===============
.
FileExt: .txt: txtfile=C:\WINDOWS\System32\NOTEPAD.EXE %1 [UserChoice]
.
=============== Created Last 30 ================
.
2017-09-03 21:41:38 -------- d-----w- C:\Program Files\McAfee
2017-09-03 21:41:31 -------- d-----w- C:\Program Files\stinger
2017-09-03 21:31:53 94144 ----a-w- C:\WINDOWS\System32\drivers\mwac.sys
2017-09-03 21:31:53 192960 ----a-w- C:\WINDOWS\System32\drivers\MBAMChameleon.sys
2017-09-03 21:31:48 45472 ----a-w- C:\WINDOWS\System32\drivers\mbam.sys
2017-09-03 21:31:45 253888 ----a-w- C:\WINDOWS\System32\drivers\MBAMSwissArmy.sys
2017-09-03 21:31:42 77440 ----a-w- C:\WINDOWS\System32\drivers\mbae64.sys
2017-09-03 21:31:33 -------- d-----w- C:\ProgramData\Malwarebytes
2017-09-03 21:31:33 -------- d-----w- C:\Program Files\Malwarebytes
2017-09-03 21:31:14 -------- d-----w- C:\Users\Zofia\AppData\Local\Programs
2017-08-26 16:17:55 323528 ----a-w- C:\Program Files (x86)\Mozilla Firefox\tobedeleted\mozD6F4.tmp
2017-08-26 16:17:55 112592 ----a-w- C:\Program Files (x86)\Mozilla Firefox\AccessibleHandler.dll
2017-08-09 23:25:59 7931392 ----a-w- C:\WINDOWS\System32\twinui.dll
2017-08-08 00:56:04 -------- d-----w- C:\ProgramData\ASUS Smart Gesture
.
==================== Find3M ====================
.
2017-09-04 06:51:04 165 ----a-w- C:\Users\Zofia\AppData\Roaming\sp_data.sys
2017-08-30 23:29:08 180 ----a-w- C:\WINDOWS\System32\{A6D608F0-0BDE-491A-97AE-5C4B05D86E01}.bat
2017-08-01 02:39:54 8319392 ----a-w- C:\WINDOWS\System32\ntoskrnl.exe
2017-08-01 02:38:47 406544 ----a-w- C:\WINDOWS\SysWow64\policymanager.dll
2017-08-01 02:38:08 382368 ----a-w- C:\WINDOWS\System32\drivers\clfs.sys
2017-08-01 02:36:56 119712 ----a-w- C:\WINDOWS\System32\drivers\tdx.sys
2017-08-01 02:36:49 323488 ----a-w- C:\WINDOWS\apppatch\AcRes.dll
2017-08-01 02:36:29 750496 ----a-w- C:\WINDOWS\SysWow64\WWAHost.exe
2017-08-01 02:35:13 280472 ----a-w- C:\WINDOWS\SysWow64\WerFault.exe
2017-08-01 02:35:09 133904 ----a-w- C:\WINDOWS\SysWow64\WerFaultSecure.exe
2017-08-01 02:34:39 610584 ----a-w- C:\WINDOWS\SysWow64\wer.dll
2017-08-01 02:34:36 359552 ----a-w- C:\WINDOWS\SysWow64\Faultrep.dll
2017-08-01 02:34:32 349600 ----a-w- C:\WINDOWS\SysWow64\msv1_0.dll
2017-08-01 02:34:32 168864 ----a-w- C:\WINDOWS\SysWow64\wermgr.exe
2017-08-01 02:33:57 473240 ----a-w- C:\WINDOWS\System32\policymanager.dll
2017-08-01 02:32:37 2444704 ----a-w- C:\WINDOWS\System32\drivers\dxgkrnl.sys
2017-08-01 02:32:23 712600 ----a-w- C:\WINDOWS\System32\drivers\dxgmms2.sys
2017-08-01 02:32:04 820128 ----a-w- C:\WINDOWS\System32\WWAHost.exe
2017-08-01 02:31:56 5477088 ----a-w- C:\WINDOWS\System32\OneCoreUAPCommonProxyStub.dll
2017-08-01 02:31:49 212384 ----a-w- C:\WINDOWS\System32\browserbroker.dll
2017-08-01 02:31:01 176024 ----a-w- C:\WINDOWS\SysWow64\basecsp.dll
2017-08-01 02:30:52 315288 ----a-w- C:\WINDOWS\System32\WerFault.exe
2017-08-01 02:30:50 143736 ----a-w- C:\WINDOWS\System32\WerFaultSecure.exe
2017-08-01 02:30:25 723680 ----a-w- C:\WINDOWS\System32\wer.dll
2017-08-01 02:30:21 82336 ----a-w- C:\WINDOWS\System32\drivers\vmbkmcl.sys
2017-08-01 02:30:18 410160 ----a-w- C:\WINDOWS\System32\Faultrep.dll
2017-08-01 02:30:16 182688 ----a-w- C:\WINDOWS\System32\wermgr.exe
2017-08-01 02:30:09 411040 ----a-w- C:\WINDOWS\System32\msv1_0.dll
2017-08-01 02:26:58 204192 ----a-w- C:\WINDOWS\System32\basecsp.dll
2017-08-01 02:20:54 404480 ----a-w- C:\WINDOWS\SysWow64\werui.dll
2017-08-01 02:20:40 154624 ----a-w- C:\WINDOWS\SysWow64\DWWIN.EXE
2017-08-01 02:20:33 2956288 ----a-w- C:\WINDOWS\SysWow64\win32kfull.sys
2017-08-01 02:18:16 13841408 ----a-w- C:\WINDOWS\SysWow64\Windows.UI.Xaml.dll
2017-08-01 02:18:13 2199552 ----a-w- C:\WINDOWS\SysWow64\Windows.UI.Xaml.Resources.dll
2017-08-01 02:17:02 34816 ----a-w- C:\WINDOWS\SysWow64\tokenbinding.dll
2017-08-01 02:16:16 80896 ----a-w- C:\WINDOWS\SysWow64\Chakradiag.dll
2017-08-01 02:14:09 35840 ----a-w- C:\WINDOWS\SysWow64\sscore.dll
2017-08-01 02:13:31 127488 ----a-w- C:\WINDOWS\SysWow64\fdeploy.dll
2017-08-01 02:13:30 20504064 ----a-w- C:\WINDOWS\SysWow64\edgehtml.dll
2017-08-01 02:13:12 364032 ----a-w- C:\WINDOWS\SysWow64\msIso.dll
2017-08-01 02:12:28 229888 ----a-w- C:\WINDOWS\SysWow64\scksp.dll
2017-08-01 02:10:19 358400 ----a-w- C:\WINDOWS\SysWow64\ieproxy.dll
2017-08-01 02:09:58 394240 ----a-w- C:\WINDOWS\SysWow64\Windows.Internal.Management.dll
2017-08-01 02:08:54 267264 ----a-w- C:\WINDOWS\SysWow64\ncryptprov.dll
2017-08-01 02:07:57 2671616 ----a-w- C:\WINDOWS\SysWow64\tquery.dll
2017-08-01 02:07:54 5961728 ----a-w- C:\WINDOWS\SysWow64\Windows.Data.Pdf.dll
2017-08-01 02:06:46 798208 ----a-w- C:\WINDOWS\SysWow64\TokenBroker.dll
2017-08-01 02:04:40 6269440 ----a-w- C:\WINDOWS\SysWow64\Chakra.dll
2017-08-01 02:04:32 3656192 ----a-w- C:\WINDOWS\SysWow64\jscript9.dll
2017-08-01 01:57:22 23677952 ----a-w- C:\WINDOWS\System32\edgehtml.dll
2017-08-01 01:45:44 3670016 ----a-w- C:\WINDOWS\System32\win32kfull.sys
2017-08-01 01:45:28 462848 ----a-w- C:\WINDOWS\System32\werui.dll
2017-08-01 01:45:03 92672 ----a-w- C:\WINDOWS\System32\wercplsupport.dll
2017-08-01 01:45:02 1275392 ----a-w- C:\WINDOWS\System32\werconcpl.dll
2017-08-01 01:44:53 184320 ----a-w- C:\WINDOWS\System32\DWWIN.EXE
2017-08-01 01:44:49 77824 ----a-w- C:\WINDOWS\System32\wsqmcons.exe
2017-08-01 01:44:32 83968 ----a-w- C:\WINDOWS\System32\drivers\vmbkmclr.sys
2017-08-01 01:42:55 2199552 ----a-w- C:\WINDOWS\System32\Windows.UI.Xaml.Resources.dll
2017-08-01 01:41:48 42496 ----a-w- C:\WINDOWS\System32\tokenbinding.dll
2017-08-01 01:41:47 130560 ----a-w- C:\WINDOWS\System32\policymanagerprecheck.dll
2017-08-01 01:41:04 110592 ----a-w- C:\WINDOWS\System32\Chakradiag.dll
2017-08-01 01:40:59 17366528 ----a-w- C:\WINDOWS\System32\Windows.UI.Xaml.dll
2017-08-01 01:40:35 290816 ----a-w- C:\WINDOWS\System32\dmenterprisediagnostics.dll
2017-08-01 01:39:04 46592 ----a-w- C:\WINDOWS\System32\sscore.dll
2017-08-01 01:38:49 143872 ----a-w- C:\WINDOWS\System32\profsvcext.dll
2017-08-01 01:38:21 153088 ----a-w- C:\WINDOWS\System32\fdeploy.dll
2017-08-01 01:37:53 433664 ----a-w- C:\WINDOWS\System32\msIso.dll
2017-08-01 01:37:29 582656 ----a-w- C:\WINDOWS\System32\SmsRouterSvc.dll
2017-08-01 01:37:09 255488 ----a-w- C:\WINDOWS\System32\scksp.dll
2017-08-01 01:35:14 692736 ----a-w- C:\WINDOWS\System32\jscript9diag.dll
2017-08-01 01:34:37 805888 ----a-w- C:\WINDOWS\System32\ieproxy.dll
2017-08-01 01:33:49 1269760 ----a-w- C:\WINDOWS\System32\enterprisecsps.dll
2017-08-01 01:33:28 315904 ----a-w- C:\WINDOWS\System32\ncryptprov.dll
2017-08-01 01:32:47 7336960 ----a-w- C:\WINDOWS\System32\Windows.Data.Pdf.dll
2017-08-01 01:32:37 176640 ----a-w- C:\WINDOWS\System32\wersvc.dll
2017-08-01 01:31:25 4445696 ----a-w- C:\WINDOWS\System32\SettingsHandlers_nt.dll
2017-08-01 01:31:03 1396736 ----a-w- C:\WINDOWS\System32\wwansvc.dll
2017-08-01 01:30:43 8209920 ----a-w- C:\WINDOWS\System32\Chakra.dll
2017-08-01 01:30:42 303104 ----a-w- C:\WINDOWS\System32\srvsvc.dll
2017-08-01 01:30:27 1052160 ----a-w- C:\WINDOWS\System32\TokenBroker.dll
2017-08-01 01:30:18 2055168 ----a-w- C:\WINDOWS\System32\win32kbase.sys
2017-08-01 01:30:09 3377664 ----a-w- C:\WINDOWS\System32\tquery.dll
2017-08-01 01:28:51 2516480 ----a-w- C:\WINDOWS\System32\diagtrack.dll
2017-08-01 01:28:43 4730368 ----a-w- C:\WINDOWS\System32\jscript9.dll
2017-08-01 01:27:25 574464 ----a-w- C:\WINDOWS\System32\configmanager2.dll
2017-08-01 01:27:05 482816 ----a-w- C:\WINDOWS\System32\dmenrollengine.dll
2017-08-01 01:26:03 323584 ----a-w- C:\WINDOWS\System32\DeviceEnroller.exe
2017-08-01 01:25:46 249344 ----a-w- C:\WINDOWS\System32\coredpus.dll
2017-08-01 01:25:41 194048 ----a-w- C:\WINDOWS\System32\mdmregistration.dll
2017-08-01 01:25:41 140800 ----a-w- C:\WINDOWS\System32\dmcsps.dll
2017-07-31 15:15:09 835576 ----a-w- C:\WINDOWS\SysWow64\FlashPlayerApp.exe
2017-07-31 15:15:09 177648 ----a-w- C:\WINDOWS\SysWow64\FlashPlayerCPLApp.cpl
2017-07-30 01:42:08 200 ----a-w- C:\WINDOWS\System32\{EC94D02F-D200-4428-9531-05AF7F9799CB}.bat
2017-07-30 01:42:08 0 ----a-w- C:\WINDOWS\System32\GfxValDisplayLog.bin
2017-07-28 05:30:35 1068720 ----a-w- C:\WINDOWS\System32\Windows.UI.dll
2017-07-28 05:25:32 2399728 ----a-w- C:\WINDOWS\System32\KernelBase.dll
2017-07-28 05:24:52 119904 ----a-w- C:\WINDOWS\System32\dmcmnutils.dll
2017-07-28 05:24:42 116280 ----a-w- C:\WINDOWS\System32\bcd.dll
2017-07-28 05:24:38 2327456 ----a-w- C:\WINDOWS\System32\drivers\ntfs.sys
2017-07-28 05:23:51 723360 ----a-w- C:\WINDOWS\System32\drivers\acpi.sys
.
============= FINISH: 3:51:29.35 ===============
dds.txt
Displaying dds.txt.

Attached Files

attach.txt (1.9 KB)

I have internet issues with my laptop. I am using wifi connection and it says (in right corner of desktop) that I have internet connection. There is no exclamation mark with internet issues. However when I use some app which needs internet (IE, Google Chrome, battle.net etc.) there is no connection. Google chrome says that my internet connection is blocked by firewall or antivirus software. I already tried to restart router, turn off firewall or antivirus software, backut firewall to default settings, check exceptions for firewall etc. however it did not help. There are some bright moments when internet works for few hour but usually do not. Funny thing is that only youtube works pretty well.

I have HP ProBook 4720s with Windows 10 Education installed. I do not have instalation disc because I was updating my last operatin systen Windows 7 via instalator, which I downloaded thru my university profile.

I already tried some virus/mallware scanners/cleaners but it did not fix the problem.
Thank you very much for any help.


DDS (Ver_2012-11-20.01) - NTFS_AMD64
Internet Explorer: 11.0.15063.0
Run by Roman at 21:25:36 on 2017-09-06
#Option Extended Search is enabled.
Microsoft Windows 10 Education 10.0.15063.0.1250.420.1029.18.3951.2114 [GMT 2:00]
.
AV: Windows Defender *Enabled/Updated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
AV: Avast Antivirus *Disabled/Updated* {17AD7D40-BA12-9C46-7131-94903A54AD8B}
SP: Windows Defender *Enabled/Updated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
SP: Avast Antivirus *Disabled/Updated* {ACCC9CA4-9C28-93C8-4B81-AFE241D3E736}
.
============== Running Processes ===============
.
c:\windows\system32\svchost.exe -k dcomlaunch -s PlugPlay
C:\WINDOWS\system32\fontdrvhost.exe
C:\WINDOWS\system32\svchost.exe -k DcomLaunch
C:\WINDOWS\system32\fontdrvhost.exe
c:\windows\system32\svchost.exe -k rpcss
c:\windows\system32\svchost.exe -k dcomlaunch -s LSM
C:\WINDOWS\system32\dwm.exe
c:\windows\system32\svchost.exe -k netsvcs -s gpsvc
c:\windows\system32\svchost.exe -k localsystemnetworkrestricted -s NcbService
C:\WINDOWS\system32\svchost.exe -k LocalServiceNoNetwork
c:\windows\system32\svchost.exe -k localservicenetworkrestricted -s TimeBrokerSvc
c:\windows\system32\svchost.exe -k netsvcs -s Schedule
c:\windows\system32\svchost.exe -k netsvcs -s ProfSvc
c:\windows\system32\svchost.exe -k localservicenetworkrestricted -s EventLog
c:\windows\system32\svchost.exe -k localsystemnetworkrestricted -s hidserv
c:\windows\system32\svchost.exe -k localservice -s nsi
c:\windows\system32\svchost.exe -k netsvcs -s UserManager
c:\windows\system32\svchost.exe -k appmodel -s StateRepository
c:\windows\system32\svchost.exe -k localservicenetworkrestricted -s Dhcp
c:\windows\system32\svchost.exe -k localsystemnetworkrestricted -s TabletInputService
c:\windows\system32\svchost.exe -k networkservice -s NlaSvc
C:\WINDOWS\system32\atiesrxx.exe
c:\windows\system32\svchost.exe -k localservice -s netprofm
C:\WINDOWS\system32\atieclxx.exe
c:\windows\system32\svchost.exe -k netsvcs -s Themes
c:\windows\system32\svchost.exe -k localservice -s EventSystem
c:\windows\system32\svchost.exe -k localsystemnetworkrestricted -s CscService
c:\windows\system32\svchost.exe -k netsvcs -s SENS
c:\windows\system32\svchost.exe -k localsystemnetworkrestricted -s AudioEndpointBuilder
c:\windows\system32\svchost.exe -k localservice -s FontCache
C:\WINDOWS\System32\svchost.exe -k LocalServiceNetworkRestricted
c:\windows\system32\svchost.exe -k networkservice -s Dnscache
C:\WINDOWS\System32\svchost.exe -k LocalServiceNetworkRestricted
C:\WINDOWS\system32\svchost.exe -k LocalServiceNetworkRestricted
C:\WINDOWS\system32\svchost.exe -k LocalSystemNetworkRestricted
c:\windows\system32\svchost.exe -k netsvcs -s ShellHWDetection
C:\WINDOWS\system32\WLANExt.exe
c:\windows\system32\svchost.exe -k localservice -s WinHttpAutoProxySvc
C:\WINDOWS\System32\spoolsv.exe
c:\windows\system32\svchost.exe -k networkservice -s LanmanWorkstation
C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe
C:\Program Files (x86)\Autodesk\Autodesk Desktop App\AdAppMgrSvc.exe
c:\windows\system32\svchost.exe -k apphost -s AppHostSvc
C:\Program Files\Bonjour\mDNSResponder.exe
c:\windows\system32\svchost.exe -k networkservice -s CryptSvc
c:\windows\system32\svchost.exe -k localsystemnetworkrestricted -s DeviceAssociationService
C:\WINDOWS\System32\svchost.exe -k utcsvc
c:\windows\system32\svchost.exe -k localservicenonetwork -s DPS
C:\Program Files (x86)\Hewlett-Packard\Shared\HPDrvMntSvc.exe
C:\Program Files (x86)\Hewlett-Packard\HP HotKey Support\hpHotkeyMonitor.exe
c:\windows\system32\svchost.exe -k netsvcs -s IKEEXT
c:\windows\system32\svchost.exe -k netsvcs -s Winmgmt
C:\Program Files\Autodesk\Inventor 2016\Moldflow\bin\mitsijm.exe
c:\windows\system32\svchost.exe -k netsvcs -s LanmanServer
c:\windows\system32\svchost.exe -k iissvcs
C:\WINDOWS\system32\mqsvc.exe
c:\windows\system32\svchost.exe -k localsystemnetworkrestricted -s PcaSvc
C:\WINDOWS\system32\svchost.exe -k imgsvc
c:\windows\system32\svchost.exe -k localsystemnetworkrestricted -s SysMain
C:\Program Files (x86)\TeamViewer\TeamViewer_Service.exe
c:\windows\system32\svchost.exe -k localsystemnetworkrestricted -s TrkWks
C:\WINDOWS\system32\SearchIndexer.exe
c:\windows\system32\svchost.exe -k netsvcs -s WpnService
C:\WINDOWS\system32\atwtusb.exe
c:\windows\system32\svchost.exe -k netsvcs -s iphlpsvc
c:\windows\system32\svchost.exe -k localservice -s WdiServiceHost
C:\WINDOWS\system32\dashost.exe
c:\windows\system32\svchost.exe -k localsystemnetworkrestricted -s WdiSystemHost
c:\windows\microsoft.net\framework64\v4.0.30319\smsvchost.exe
c:\windows\system32\svchost.exe -k localserviceandnoimpersonation -s SSDPSRV
c:\windows\microsoft.net\framework64\v4.0.30319\smsvchost.exe
C:\WINDOWS\system32\atwtusb.exe
c:\windows\system32\svchost.exe -k localserviceandnoimpersonation -s upnphost
c:\windows\system32\svchost.exe -k localservicenetworkrestricted -s lmhosts
c:\windows\system32\svchost.exe -k appmodel -s tiledatamodelsvc
svchost.exe
C:\WINDOWS\system32\AUDIODG.EXE
C:\WINDOWS\system32\wbem\unsecapp.exe
C:\WINDOWS\system32\wbem\wmiprvse.exe
C:\Program Files (x86)\Hewlett-Packard\Shared\hpqwmiex.exe
c:\windows\system32\svchost.exe -k localservicenetworkrestricted -s wscsvc
c:\windows\system32\sihost.exe
c:\windows\system32\svchost.exe -k unistacksvcgroup -s CDPUserSvc
c:\windows\system32\svchost.exe -k unistacksvcgroup -s WpnUserService
c:\windows\system32\taskhostw.exe
c:\windows\system32\svchost.exe -k netsvcs -s TokenBroker
C:\WINDOWS\Explorer.EXE
c:\windows\system32\svchost.exe -k netsvcs -s wlidsvc
c:\windows\system32\svchost.exe -k localsystemnetworkrestricted -s Netman
C:\Windows\SystemApps\ShellExperienceHost_cw5n1h2txyewy\ShellExperienceHost.exe
c:\windows\system32\svchost.exe -k localservice -s CDPSvc
C:\Windows\SystemApps\Microsoft.Windows.Cortana_cw5n1h2txyewy\SearchUI.exe
C:\Windows\System32\RuntimeBroker.exe
C:\WINDOWS\system32\backgroundTaskHost.exe
C:\Program Files\Common Files\microsoft shared\ink\TabTip.exe
C:\Program Files (x86)\Common Files\Microsoft Shared\Ink\TabTip32.exe
C:\Windows\System32\smartscreen.exe
c:\windows\system32\svchost.exe -k localservice -s LicenseManager
C:\WINDOWS\system32\backgroundTaskHost.exe
C:\WINDOWS\system32\backgroundTaskHost.exe
C:\Program Files\WindowsApps\Microsoft.SkypeApp_11.19.856.0_x64__kzf8qxf38zg5c\SkypeHost.exe
C:\Program Files\WindowsApps\Microsoft.ZuneVideo_10.17072.13111.0_x64__8wekyb3d8bbwe\Video.UI.exe
C:\Program Files\WindowsApps\Microsoft.ZuneMusic_10.17062.14111.0_x64__8wekyb3d8bbwe\Music.UI.exe
svchost.exe
C:\Program Files\Windows Defender\MSASCuiL.exe
C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
c:\windows\system32\svchost.exe -k netsvcs -s Appinfo
C:\WINDOWS\System32\svchost.exe -k WerSvcGroup
C:\Windows\System32\AtwtusbIcon.exe
C:\Program Files (x86)\Common Files\Apple\Internet Services\iCloudServices.exe
C:\Users\Roman\AppData\Local\Microsoft\OneDrive\OneDrive.exe
C:\Program Files\Synaptics\SynTP\SynTPHelper.exe
C:\Program Files (x86)\Hewlett-Packard\HP HotKey Support\QLBController.exe
C:\Program Files (x86)\Autodesk\Autodesk Desktop App\AutodeskDesktopApp.exe
C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\MOM.exe
C:\Program Files (x86)\Autodesk\Autodesk Desktop App\acwebbrowser\acwebbrowser.exe
C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\CCC.exe
c:\windows\system32\svchost.exe -k netsvcs -s DoSvc
C:\Program Files (x86)\Autodesk\Autodesk Desktop App\acwebbrowser\acwebbrowser.exe
C:\Program Files (x86)\Autodesk\Autodesk Desktop App\acwebbrowser\acwebbrowser.exe
c:\windows\system32\svchost.exe -k unistacksvcgroup
c:\windows\system32\svchost.exe -k netsvcs -s lfsvc
C:\Program Files\Common Files\Microsoft Shared\Ink\InputPersonalization.exe
C:\WINDOWS\system32\wbem\wmiprvse.exe
C:\WINDOWS\System32\svchost.exe -k NetworkService
C:\WINDOWS\System32\cscript.exe
.
============== Pseudo HJT Report ===============
.
uRun: [Spotify Web Helper] "C:\Users\Roman\AppData\Roaming\Spotify\SpotifyWebHelper.exe"
uRun: [iCloudServices] "C:\Program Files (x86)\Common Files\Apple\Internet Services\iCloudServices.exe"
uRun: [OneDrive] "C:\Users\Roman\AppData\Local\Microsoft\OneDrive\OneDrive.exe" /background
mRun: [StartCCC] "C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\amd64\CLIStart.exe" MSRun
mRun: [QLBController] C:\Program Files (x86)\Hewlett-Packard\HP HotKey Support\QLBController.exe /start
mRun: [SwitchBoard] C:\Program Files (x86)\Common Files\Adobe\SwitchBoard\SwitchBoard.exe
mRun: [ADSKAppManager] "C:\Program Files (x86)\Autodesk\Autodesk Desktop App\AutodeskDesktopApp.exe" -tray
mPolicies-System: DSCAutomationHostEnabled = dword:2
mPolicies-System: SoftwareSASGeneration = dword:1
IE: E&xportovat do aplikace Microsoft Excel - C:\Program Files\Microsoft Office\Office14\EXCEL.EXE/3000
IE: E&xportovat do Microsoft Excelu - C:\PROGRA~1\MICROS~2\Office16\EXCEL.EXE/3000
TCP: NameServer = 213.46.172.37 213.46.172.36
TCP: Interfaces\{330c9b77-4883-454a-9585-dd32fdfaa62c} : DHCPNameServer = 192.168.42.129
TCP: Interfaces\{90817f72-1c6c-4540-aba7-9578bf384d0b} : DHCPNameServer = 213.46.172.37 213.46.172.36
TCP: Interfaces\{ad22bc16-0356-4b98-b74e-7225a024b057} : DHCPNameServer = 213.46.172.37 213.46.172.36
Filter: text/xml - {807583E5-5146-11D5-A672-00B0D022E945} - C:\Program Files (x86)\Common Files\Microsoft Shared\OFFICE16\MSOXMLMF.DLL
Handler: mso-minsb.16 - {3459B272-CC19-4448-86C9-DDC3B4B2FAD3} - C:\Program Files (x86)\Microsoft Office\Office16\MSOSB.DLL
Handler: osf.16 - {5504BE45-A83B-4808-900A-3A5C36E7F77A} - C:\Program Files (x86)\Microsoft Office\Office16\MSOSB.DLL
Handler: tbauth - {14654CA6-5711-491D-B89A-58E571679951} - C:\Windows\SysWOW64\tbauth.dll
Handler: windows.tbauth - {14654CA6-5711-491D-B89A-58E571679951} - C:\Windows\SysWOW64\tbauth.dll
SSODL: WebCheck - <orphaned>
CLSID: {603D3801-BD81-11d0-A3A5-00C04FD706EC} - C:\WINDOWS\System32\windows.storage.dll
x64-Run: [SecurityHealth] C:\Program Files (x86)\Windows Defender\MSASCuiL.exe
x64-Run: [SynTPEnh] C:\Program Files (x86)\Synaptics\SynTP\SynTPEnh.exe
x64-Run: [SysTrayApp] C:\Program Files\IDT\WDM\sttray64.exe
x64-Run: [AtwtusbIcon] AtwtusbIcon.exe
x64-mPolicies-System: DSCAutomationHostEnabled = dword:2
x64-mPolicies-System: SoftwareSASGeneration = dword:1
x64-Filter: text/xml - {807583E5-5146-11D5-A672-00B0D022E945} - C:\Program Files\Common Files\Microsoft Shared\OFFICE16\MSOXMLMF.DLL
x64-Handler: mso-minsb.16 - {3459B272-CC19-4448-86C9-DDC3B4B2FAD3} - C:\Program Files\Microsoft Office\Office16\MSOSB.DLL
x64-Handler: osf.16 - {5504BE45-A83B-4808-900A-3A5C36E7F77A} - C:\Program Files\Microsoft Office\Office16\MSOSB.DLL
x64-Handler: tbauth - {14654CA6-5711-491D-B89A-58E571679951} - C:\WINDOWS\System32\tbauth.dll
x64-Handler: windows.tbauth - {14654CA6-5711-491D-B89A-58E571679951} - C:\WINDOWS\System32\tbauth.dll
x64-SSODL: WebCheck - <orphaned>
x64-mASetup: {2C7339CF-2B09-4501-B3F3-F3508C9228ED} - /UserInstall
x64-mASetup: {89820200-ECBD-11cf-8B85-00AA005B4340} - U
x64-mASetup: {8A69D345-D564-463c-AFF1-A69D9E530F96} - "C:\Program Files (x86)\Google\Chrome\Application\60.0.3112.113\Installer\chrmstp.exe" --configure-user-settings --verbose-logging --system-level
x64-CLSID: {603D3801-BD81-11d0-A3A5-00C04FD706EC} - C:\WINDOWS\System32\windows.storage.dll
.
============= SERVICES / DRIVERS ===============
.
R?2 MapsBroker;Správce stažených map;C:\WINDOWS\System32\svchost.exe -k NetworkService [2017-3-18 47664]
R?2 OneSyncSvc_4843a;Hostitel synchronizace_4843a;C:\WINDOWS\System32\svchost.exe -k UnistackSvcGroup [2017-3-18 47664]
R0 intelpep;Ovladač modulu Intel(R) Power Engine Plug-in;C:\WINDOWS\System32\drivers\intelpep.sys [2017-3-18 74840]
R0 iorate;Ovladač filtru rychlosti vstupně-výstupních operací disku;C:\WINDOWS\System32\drivers\iorate.sys [2017-3-18 49568]
R0 volume;Ovladač svazku;C:\WINDOWS\System32\drivers\volume.sys [2017-3-18 16288]
R0 WindowsTrustedRT;Windows Trusted Execution Environment Class Extension;C:\WINDOWS\System32\drivers\WindowsTrustedRT.sys [2017-3-18 70232]
R0 WindowsTrustedRTProxy;Služba zabezpečení důvěryhodného modulu runtime Microsoft Windows;C:\WINDOWS\System32\drivers\WindowsTrustedRTProxy.sys [2017-3-18 18520]
R0 Wof;Windows Overlay File System Filter Driver;C:\WINDOWS\System32\drivers\wof.sys [2017-3-18 208288]
R1 ahcache;Application Compatibility Cache;C:\WINDOWS\System32\drivers\ahcache.sys [2017-3-18 239616]
R1 aswbidsdriver;aswbidsdriver;C:\WINDOWS\System32\drivers\aswbidsdrivera.sys [2017-2-9 320008]
R1 aswKbd;aswKbd;C:\WINDOWS\System32\drivers\aswKbd.sys [2016-3-22 41800]
R1 aswSnx;aswSnx;C:\WINDOWS\System32\drivers\aswsnx.sys [2016-2-4 1015880]
R1 aswSP;aswSP;C:\WINDOWS\System32\drivers\aswSP.sys [2016-2-4 585608]
R1 FileCrypt;FileCrypt;C:\WINDOWS\System32\drivers\filecrypt.sys [2017-3-18 54272]
R1 GpuEnergyDrv;GPU Energy Driver;C:\WINDOWS\System32\drivers\gpuenergydrv.sys [2017-3-18 8192]
R1 MpKslb9708cc2;MpKslb9708cc2;C:\ProgramData\Microsoft\Windows Defender\Definition Updates\{D903610B-55EB-484E-8191-679A4B4E8D61}\MpKslb9708cc2.sys [2017-9-6 44928]
R2 AdAppMgrSvc;Autodesk Application Manager Service;C:\Program Files (x86)\Autodesk\Autodesk Desktop App\AdAppMgrSvc.exe [2016-5-8 1231376]
R2 AMD External Events Utility;AMD External Events Utility;C:\WINDOWS\System32\atiesrxx.exe [2015-12-16 255472]
R2 aswMonFlt;aswMonFlt;C:\WINDOWS\System32\drivers\aswmonflt.sys [2017-8-12 146704]
R2 aswStm;aswStm;C:\WINDOWS\System32\drivers\aswStm.sys [2016-2-4 198768]
R2 avast! Antivirus;Avast Antivirus;C:\Program Files\AVAST Software\Avast\AvastSvc.exe [2016-9-29 197128]
R2 CDPSvc;Služba platformy připojených zařízení;C:\WINDOWS\System32\svchost.exe -k LocalService [2017-3-18 47664]
R2 CDPUserSvc_4843a;Uživatelská služba platformy připojených zařízení_4843a;C:\WINDOWS\System32\svchost.exe -k UnistackSvcGroup [2017-3-18 47664]
R2 clreg;Virtual Registry for Containers;C:\WINDOWS\System32\drivers\registry.sys [2017-3-18 14336]
R2 CoreMessagingRegistrar;CoreMessaging;C:\WINDOWS\System32\svchost.exe -k LocalServiceNoNetwork [2017-3-18 47664]
R2 DiagTrack;Propojená uživatelská prostředí a telemetrie;C:\WINDOWS\System32\svchost.exe -k utcsvc [2017-3-18 47664]
R2 DoSvc;Optimalizace doručení;C:\WINDOWS\System32\svchost.exe -k netsvcs [2017-3-18 47664]
R2 DusmSvc;Využití dat;C:\WINDOWS\System32\svchost.exe -k LocalServiceNetworkRestricted [2017-3-18 47664]
R2 HPDrvMntSvc.exe;HP Quick Synchronization Service;C:\Program Files (x86)\Hewlett-Packard\Shared\HPDrvMntSvc.exe [2010-9-27 92216]
R2 hpHotkeyMonitor;HP Hotkey Monitor;C:\Program Files (x86)\Hewlett-Packard\HP HotKey Support\hpHotkeyMonitor.exe [2010-10-1 280120]
R2 mitsijm2016;Správce úloh aplikace Autodesk Simulation Moldflow MITSI 2016;C:\Program Files\Autodesk\Inventor 2016\Moldflow\bin\mitsijm.exe [2014-9-30 968480]
R2 SecurityHealthService;Centrum zabezpečení v programu Windows Defender;C:\WINDOWS\System32\SecurityHealthService.exe [2017-7-11 336320]
R2 storqosflt;Ovladač filtru technologie QoS pro úložiště;C:\WINDOWS\System32\drivers\storqosflt.sys [2017-3-18 79872]
R2 TeamViewer;TeamViewer 12;C:\Program Files (x86)\TeamViewer\TeamViewer_Service.exe [2016-2-4 10216688]
R2 tiledatamodelsvc;Server datového modelu dlaždic;C:\WINDOWS\System32\svchost.exe -k appmodel [2017-3-18 47664]
R2 UserManager;Správce uživatelů;C:\WINDOWS\System32\svchost.exe -k netsvcs [2017-3-18 47664]
R2 wcifs;Windows Container Isolation;C:\WINDOWS\System32\drivers\wcifs.sys [2017-7-11 142752]
R2 WpnService;Systémová služba nabízených oznámení Windows;C:\WINDOWS\System32\svchost.exe -k netsvcs [2017-3-18 47664]
R2 WpnUserService_4843a;Uživatelská služba nabízených oznámení Windows_4843a;C:\WINDOWS\System32\svchost.exe -k UnistackSvcGroup [2017-3-18 47664]
R2 WTService;WTService;C:\WINDOWS\System32\atwtusb.exe -s --> C:\WINDOWS\System32\atwtusb.exe -s [?]
R3 AppXSvc;AppX Deployment Service (AppXSVC);C:\WINDOWS\System32\svchost.exe -k wsappx [2017-3-18 47664]
R3 AtiHDAudioService;AMD Function Driver for HD Audio Service;C:\WINDOWS\System32\drivers\AtihdWT6.sys [2015-5-28 102912]
R3 CAD;Ovladač arbitrace nabití;C:\WINDOWS\System32\drivers\CAD.sys [2017-3-18 53664]
R3 ClipSVC;Služba pro klientské licence (ClipSVC);C:\WINDOWS\System32\svchost.exe -k wsappx [2017-3-18 47664]
R3 HECIx64;Intel(R) Management Engine Interface;C:\WINDOWS\System32\drivers\HECIx64.sys [2009-9-17 56344]
R3 lfsvc;Služba sledování zeměpisné polohy;C:\WINDOWS\System32\svchost.exe -k netsvcs [2017-3-18 47664]
R3 LicenseManager;Služba správce licencí Windows;C:\WINDOWS\System32\svchost.exe -k LocalService [2017-3-18 47664]
R3 NcbService;Zprostředkovatel síťového připojení;C:\WINDOWS\System32\svchost.exe -k LocalSystemNetworkRestricted [2017-3-18 47664]
R3 NdisVirtualBus;Enumerátor virtuálního síťového adaptéru Microsoft;C:\WINDOWS\System32\drivers\NdisVirtualBus.sys [2017-3-18 20992]
R3 rt640x64;Ovladač Realtek RT640 NT;C:\WINDOWS\System32\drivers\rt640x64.sys [2017-3-18 604160]
R3 rtsuvc;HP Webcam [2 MP Fixed];C:\WINDOWS\System32\drivers\rtsuvc.sys [2016-2-4 8204904]
R3 StateRepository;Služba State Repository;C:\WINDOWS\System32\svchost.exe -k appmodel [2017-3-18 47664]
R3 TimeBrokerSvc;Zprostředkovatel času;C:\WINDOWS\System32\svchost.exe -k LocalServiceNetworkRestricted [2017-3-18 47664]
R3 TokenBroker;TokenBroker;C:\WINDOWS\System32\svchost.exe -k netsvcs [2017-3-18 47664]
R3 UrsCx01000;USB Role-Switch Support Library;C:\WINDOWS\System32\drivers\urscx01000.sys [2017-3-18 59288]
R3 UrsChipidea;Chipidea – ovladač USB pro přepínání rolí;C:\WINDOWS\System32\drivers\urschipidea.sys [2017-3-18 29600]
R3 WdNisDrv;Systémový ovladač kontroly sítě antivirového programu Windows Defender;C:\WINDOWS\System32\drivers\WdNisDrv.sys [2017-3-18 121248]
R3 WdNisSvc;Služba kontroly sítě antivirového programu Windows Defender;C:\Program Files\Windows Defender\NisSrv.exe [2017-3-18 342264]
S2 Autodesk Content Service;Autodesk Content Service;C:\Program Files\Autodesk\Content Service\Connect.Service.ContentService.exe [2015-2-5 31160]
S2 CldFlt;Windows Cloud Files Filter Driver;C:\WINDOWS\System32\drivers\cldflt.sys [2017-3-18 12288]
S2 SkypeUpdate;Skype Updater;C:\Program Files (x86)\Skype\Updater\Updater.exe [2017-6-1 317400]
S3 AcpiDev;Ovladač zařízení ACPI;C:\WINDOWS\System32\drivers\AcpiDev.sys [2017-3-18 20480]
S3 ADP80XX;ADP80XX;C:\WINDOWS\System32\drivers\adp80xx.sys [2017-3-18 1135512]
S3 AJRouter;Služba směrovače AllJoyn;C:\WINDOWS\System32\svchost.exe -k LocalServiceNetworkRestricted [2017-3-18 47664]
S3 applockerfltr;Smartlocker Filter Driver;C:\WINDOWS\System32\drivers\applockerfltr.sys [2017-3-18 17920]
S3 AppReadiness;Připravenost aplikací;C:\WINDOWS\System32\svchost.exe -k AppReadiness [2017-3-18 47664]
S3 AppvStrm;AppvStrm;C:\WINDOWS\System32\drivers\AppVStrm.sys [2017-3-18 127904]
S3 AppvVemgr;AppvVemgr;C:\WINDOWS\System32\drivers\AppvVemgr.sys [2017-3-18 161696]
S3 AppvVfs;AppvVfs;C:\WINDOWS\System32\drivers\AppvVfs.sys [2017-3-18 143776]
S3 aswHwid;aswHwid;C:\WINDOWS\System32\drivers\aswHwid.sys [2016-2-4 46984]
S3 bcmfn2;bcmfn2 Service;C:\WINDOWS\System32\drivers\bcmfn2.sys [2017-3-18 9728]
S3 BthHFSrv;Služba Bluetooth Handsfree;C:\WINDOWS\System32\svchost.exe -k LocalServiceAndNoImpersonation [2017-3-18 47664]
S3 buttonconverter;Služba pro zařízení pro ovládání přenosných zařízení;C:\WINDOWS\System32\drivers\buttonconverter.sys [2017-3-18 39424]
S3 CapImg;Ovladač HID pro dotykovou obrazovku CapImg;C:\WINDOWS\System32\drivers\capimg.sys [2017-3-18 122880]
S3 DevicesFlowUserSvc_4843a;Tok zařízení_4843a;C:\WINDOWS\System32\svchost.exe -k DevicesFlow [2017-3-18 47664]
S3 DevQueryBroker;DevQuery Background Discovery Broker;C:\WINDOWS\System32\svchost.exe -k LocalSystemNetworkRestricted [2017-3-18 47664]
S3 diagnosticshub.standardcollector.service;Standardní služba sběru dat pro Centrum diagnostiky Microsoft (R);C:\WINDOWS\System32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe [2017-3-18 86528]
S3 DmEnrollmentSvc;Služba zápisu při správě zařízení;C:\WINDOWS\System32\svchost.exe -k netsvcs [2017-3-18 47664]
S3 dmwappushservice;dmwappushsvc;C:\WINDOWS\System32\svchost.exe -k netsvcs [2017-3-18 47664]
S3 DsSvc;Služba sdílení dat;C:\WINDOWS\System32\svchost.exe -k LocalSystemNetworkRestricted [2017-3-18 47664]
S3 dtlitescsibus;DAEMON Tools Lite Virtual SCSI Bus;C:\WINDOWS\System32\drivers\dtlitescsibus.sys [2016-2-4 30264]
S3 dtliteusbbus;DAEMON Tools Lite Virtual USB Bus;C:\WINDOWS\System32\drivers\dtliteusbbus.sys [2016-2-4 47672]
S3 embeddedmode;Vložený režim;C:\WINDOWS\System32\svchost.exe -k LocalSystemNetworkRestricted [2017-3-18 47664]
S3 EntAppSvc;Služba Správa aplikací pro rozlehlé sítě;C:\WINDOWS\System32\svchost.exe -k appmodel [2017-3-18 47664]
S3 FlexNet Licensing Service 64;FlexNet Licensing Service 64;C:\Program Files\Common Files\Macrovision Shared\FlexNet Publisher\FNPLicensingService64.exe [2016-2-7 1369856]
S3 FrameServer;Windows Camera Frame Server;C:\WINDOWS\System32\svchost.exe -k Camera [2017-3-18 47664]
S3 genericusbfn;Obecná funkční třída USB;C:\WINDOWS\System32\drivers\genericusbfn.sys [2017-3-18 21504]
S3 hidinterrupt;Společný ovladač pro tlačítka standardu HID implementovaná s přerušeními;C:\WINDOWS\System32\drivers\hidinterrupt.sys [2017-3-18 51104]
S3 HvHost;Hostitelská služba HV;C:\WINDOWS\System32\svchost.exe -k LocalSystemNetworkRestricted [2017-3-18 47664]
S3 cht4iscsi;cht4iscsi;C:\WINDOWS\System32\drivers\cht4sx64.sys [2017-3-18 347032]
S3 cht4vbd;Chelsio Virtual Bus Driver;C:\WINDOWS\System32\drivers\cht4vx64.sys [2017-3-18 2104224]
S3 iagpio;Ovladač řadiče Intel(R) Serial IO GPIO;C:\WINDOWS\System32\drivers\iagpio.sys [2017-3-18 33280]
S3 iai2c;Hostitelský řadič Intel(R) Serial IO I2C;C:\WINDOWS\System32\drivers\iai2c.sys [2017-3-18 81408]
S3 iaLPSS2i_GPIO2;Ovladač řadiče Intel(R) Serial IO GPIO verze 2;C:\WINDOWS\System32\drivers\iaLPSS2i_GPIO2.sys [2017-3-18 70656]
S3 iaLPSS2i_GPIO2_BXT_P;Ovladač řadiče Intel(R) Serial IO GPIO verze 2;C:\WINDOWS\System32\drivers\iaLPSS2i_GPIO2_BXT_P.sys [2017-3-18 85504]
S3 iaLPSS2i_I2C;Ovladač řadiče Intel(R) Serial IO I2C v2;C:\WINDOWS\System32\drivers\iaLPSS2i_I2C.sys [2017-3-18 165376]
S3 iaLPSS2i_I2C_BXT_P;Ovladač řadiče Intel(R) Serial IO I2C v2;C:\WINDOWS\System32\drivers\iaLPSS2i_I2C_BXT_P.sys [2017-3-18 168448]
S3 iaLPSSi_GPIO;Intel(R) Serial IO GPIO Controller Driver;C:\WINDOWS\System32\drivers\iaLPSSi_GPIO.sys [2017-3-18 38128]
S3 iaLPSSi_I2C;Ovladač řadiče Intel(R) Serial IO I2C;C:\WINDOWS\System32\drivers\iaLPSSi_I2C.sys [2017-3-18 113152]
S3 iaStorAV;Řadič Intel(R) SATA diskového pole RAID – Windows;C:\WINDOWS\System32\drivers\iaStorAV.sys [2017-3-18 673184]
S3 ibbus;Mellanox InfiniBand Bus/AL (Filter Driver);C:\WINDOWS\System32\drivers\ibbus.sys [2017-3-18 526240]
S3 icssvc;Služba mobilní hotspot systému Windows;C:\WINDOWS\System32\svchost.exe -k LocalServiceNetworkRestricted [2017-3-18 47664]
S3 IndirectKmd;Ovladač Indirect Displays v režimu jádra;C:\WINDOWS\System32\drivers\IndirectKmd.sys [2017-3-18 36864]
S3 ioFakMap;MiniHid Driver Service for ioFakeDrv Interface layer;C:\WINDOWS\System32\drivers\ioFakMap.sys [2016-6-16 13624]
S3 IpxlatCfgSvc;Služba konfigurace překladu adres IP;C:\WINDOWS\System32\svchost.exe -k LocalSystemNetworkRestricted [2017-3-18 47664]
S3 LSI_SAS2i;LSI_SAS2i;C:\WINDOWS\System32\drivers\lsi_sas2i.sys [2017-3-18 123808]
S3 LSI_SAS3i;LSI_SAS3i;C:\WINDOWS\System32\drivers\lsi_sas3i.sys [2017-3-18 103328]
S3 mausbhost;Ovladač hostitelského řadiče MA-USB;C:\WINDOWS\System32\drivers\mausbhost.sys [2017-3-18 405408]
S3 mausbip;Ovladač filtru IP typu MA-USB;C:\WINDOWS\System32\drivers\mausbip.sys [2017-3-18 51104]
S3 megasas2i;megasas2i;C:\WINDOWS\System32\drivers\MegaSas2i.sys [2017-3-18 64416]
S3 MessagingService_4843a;Služba zasílání zpráv_4843a;C:\WINDOWS\System32\svchost.exe -k UnistackSvcGroup [2017-3-18 47664]
S3 mlx4_bus;Mellanox ConnectX Bus Enumerator;C:\WINDOWS\System32\drivers\mlx4_bus.sys [2017-3-18 842656]
S3 MsSecFlt;Minifiltr součástí pro události zabezpečení od Microsoftu;C:\WINDOWS\System32\drivers\mssecflt.sys [2017-3-18 230816]
S3 NaturalAuthentication;Přirozené ověřování;C:\WINDOWS\System32\svchost.exe -k netsvcs [2017-3-18 47664]
S3 ndfltr;NetworkDirect Service;C:\WINDOWS\System32\drivers\ndfltr.sys [2017-3-18 108960]
S3 NetAdapterCx;Network Adapter Wdf Class Extension Library;C:\WINDOWS\System32\drivers\NetAdapterCx.sys [2017-3-18 122368]
S3 NetSetupSvc;Služba instalace sítě;C:\WINDOWS\System32\svchost.exe -k netsvcs [2017-3-18 47664]
S3 netvsc;netvsc;C:\WINDOWS\System32\drivers\netvsc.sys [2017-7-11 118784]
S3 NgcCtnrSvc;Microsoft Passport Container;C:\WINDOWS\System32\svchost.exe -k LocalServiceNetworkRestricted [2017-3-18 47664]
S3 NgcSvc;Microsoft Passport;C:\WINDOWS\System32\svchost.exe -k LocalSystemNetworkRestricted [2017-3-18 47664]
S3 nvdimmn;Ovladač zařízení Microsoft NVDIMM-N;C:\WINDOWS\System32\drivers\nvdimmn.sys [2017-3-18 80896]
S3 ose64;Office 64 Source Engine;C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE [2015-7-31 242864]
S3 percsas2i;percsas2i;C:\WINDOWS\System32\drivers\percsas2i.sys [2017-3-18 58784]
S3 percsas3i;percsas3i;C:\WINDOWS\System32\drivers\percsas3i.sys [2017-3-18 61848]
S3 PhoneSvc;Telefonní služba;C:\WINDOWS\System32\svchost.exe -k LocalService [2017-3-18 47664]
S3 PimIndexMaintenanceSvc_4843a;Data kontaktů_4843a;C:\WINDOWS\System32\svchost.exe -k UnistackSvcGroup [2017-3-18 47664]
S3 ReFS;ReFS;C:\WINDOWS\System32\drivers\refs.sys [2017-3-18 1735584]
S3 ReFSv1;ReFSv1;C:\WINDOWS\System32\drivers\refsv1.sys [2017-3-18 936864]
S3 RetailDemo;Služba ukázkového režimu pro prodejny;C:\WINDOWS\System32\svchost.exe -k rdxgroup [2017-3-18 47664]
S3 RSUSBSTOR;RtsUStor.Sys Realtek USB Card Reader;C:\WINDOWS\System32\drivers\RtsUStor.sys [2016-2-4 232480]
S3 ScDeviceEnum;Služba výčtu zařízení čipové karty;C:\WINDOWS\System32\svchost.exe -k LocalSystemNetworkRestricted [2017-3-18 47664]
S3 scmbus;Ovladač Microsoftu pro sběrnici SCM (Storage Class Memory);C:\WINDOWS\System32\drivers\scmbus.sys [2017-3-18 91040]
S3 SDFRd;Reflektor SDF;C:\WINDOWS\System32\drivers\SDFRd.sys [2017-3-18 31128]
S3 SEMgrSvc;Správce plateb a NFC/SE;C:\WINDOWS\System32\svchost.exe -k LocalService [2017-3-18 47664]
S3 Sense;Služba Rozšířená ochrana před internetovými útoky v programu Windows Defender;C:\Program Files\Windows Defender Advanced Threat Protection\MsSense.exe [2017-3-18 3913064]
S3 SensorDataService;Služba dat ze senzorů;C:\WINDOWS\System32\SensorDataService.exe [2017-3-18 1284608]
S3 SensorService;Senzorová služba;C:\WINDOWS\System32\svchost.exe -k LocalSystemNetworkRestricted [2017-3-18 47664]
S3 SerCx2;Serial UART Support Library;C:\WINDOWS\System32\drivers\SerCx2.sys [2017-3-18 154016]
S3 smphost;Prostory úložiště SMP společnosti Microsoft;C:\WINDOWS\System32\svchost.exe -k smphost [2017-3-18 47664]
S3 SmsRouter;Služba směrovače SMS systému Microsoft Windows;C:\WINDOWS\System32\svchost.exe -k LocalSystemNetworkRestricted [2017-3-18 47664]
S3 spectrum;Windows Perception Service;C:\WINDOWS\System32\Spectrum.exe [2017-3-18 891904]
S3 stornvme;Ovladač Microsoft Standard NVM Express ;C:\WINDOWS\System32\drivers\stornvme.sys [2017-3-18 95648]
S3 storufs;Ovladač Microsoft Universal Flash Storage (UFS);C:\WINDOWS\System32\drivers\storufs.sys [2017-3-18 36760]
S3 SwitchBoard;SwitchBoard;C:\Program Files (x86)\Common Files\Adobe\SwitchBoard\SwitchBoard.exe [2010-2-19 517096]
S3 TieringEngineService;Správa vrstev úložiště;C:\WINDOWS\System32\TieringEngineService.exe [2017-3-18 302592]
S3 UcmCx0101;USB Connector Manager KMDF Class Extension;C:\WINDOWS\System32\drivers\UcmCx.sys [2017-3-18 104448]
S3 UcmTcpciCx0101;UCM-TCPCI KMDF Class Extension;C:\WINDOWS\System32\drivers\UcmTcpciCx.sys [2017-3-18 179200]
S3 UcmUcsi;Klient UCSI Správce konektoru USB;C:\WINDOWS\System32\drivers\UcmUcsi.sys [2017-8-12 51712]
S3 UdeCx;USB Device Emulation Support Library;C:\WINDOWS\System32\drivers\Udecx.sys [2017-3-18 45568]
S3 UEFI;Ovladač Microsoft UEFI;C:\WINDOWS\System32\drivers\uefi.sys [2017-3-18 29600]
S3 Ufx01000;USB Function Class Extension;C:\WINDOWS\System32\drivers\ufx01000.sys [2017-3-18 263584]
S3 UfxChipidea;Řadič USB – Chipidea;C:\WINDOWS\System32\drivers\UfxChipidea.sys [2017-3-18 98712]
S3 ufxsynopsys;Řadič USB – Synopsys;C:\WINDOWS\System32\drivers\ufxsynopsys.sys [2017-3-18 138656]
S3 UnistoreSvc_4843a;Úložiště uživatelských dat_4843a;C:\WINDOWS\System32\svchost.exe -k UnistackSvcGroup [2017-3-18 47664]
S3 UrsSynopsys;Synopsys – ovladač USB pro přepínání rolí;C:\WINDOWS\System32\drivers\urssynopsys.sys [2017-3-18 28064]
S3 UserDataSvc_4843a;Přístup k uživatelským datům_4843a;C:\WINDOWS\System32\svchost.exe -k UnistackSvcGroup [2017-3-18 47664]
S3 UsoSvc;Update Orchestrator Service;C:\WINDOWS\System32\svchost.exe -k netsvcs [2017-3-18 47664]
S3 vhf;Ovladač VHF (Virtual HID Framework);C:\WINDOWS\System32\drivers\vhf.sys [2017-3-18 35328]
S3 vmgid;Ovladač infrastruktury hosta Microsoft Hyper-V;C:\WINDOWS\System32\drivers\vmgid.sys [2017-3-18 10240]
S3 vmicguestinterface;Rozhraní služby hosta technologie Hyper-V;C:\WINDOWS\System32\svchost.exe -k LocalSystemNetworkRestricted [2017-3-18 47664]
S3 vmicvmsession;Přímá služba PowerShell pro Hyper-V;C:\WINDOWS\System32\svchost.exe -k LocalSystemNetworkRestricted [2017-3-18 47664]
S3 vmicheartbeat;Služba prezenčního signálu technologie Hyper-V;C:\WINDOWS\System32\svchost.exe -k ICService [2017-3-18 47664]
S3 w3logsvc;Služba protokolování W3C;C:\WINDOWS\System32\svchost.exe -k apphost [2017-3-18 47664]
S3 WalletService;WalletService;C:\WINDOWS\System32\svchost.exe -k appmodel [2017-3-18 47664]
S3 wcnfs;Windows Container Name Virtualization;C:\WINDOWS\System32\drivers\wcnfs.sys [2017-3-18 72192]
S3 wdiwifi;WDI Driver Framework;C:\WINDOWS\System32\drivers\WdiWiFi.sys [2017-7-11 757248]
S3 WEPHOSTSVC;Hostitelská služba zprostředkovatele šifrování Windows;C:\WINDOWS\System32\svchost.exe -k WepHostSvcGroup [2017-3-18 47664]
S3 WFDSConMgrSvc;Služba Správce připojení služeb Wi-Fi Direct;C:\WINDOWS\System32\svchost.exe -k LocalServiceNetworkRestricted [2017-3-18 47664]
S3 WinMad;WinMad Service;C:\WINDOWS\System32\drivers\winmad.sys [2017-3-18 32160]
S3 WinNat;Ovladač Windows NAT;C:\WINDOWS\System32\drivers\winnat.sys [2017-3-18 217088]
S3 WinVerbs;WinVerbs Service;C:\WINDOWS\System32\drivers\winverbs.sys [2017-3-18 64920]
S3 wisvc;Služba Windows Insider;C:\WINDOWS\System32\svchost.exe -k netsvcs [2017-3-18 47664]
S3 wlpasvc;Služba LPA;C:\WINDOWS\System32\svchost.exe -k LocalService [2017-3-18 47664]
S3 workfolderssvc;Pracovní složky;C:\WINDOWS\System32\svchost.exe -k LocalService [2017-3-18 47664]
S3 WUDFWpdMtp;WUDFWpdMtp;C:\WINDOWS\System32\drivers\WUDFRd.sys [2017-3-18 220672]
S3 xbgm;Xbox Game Monitoring;C:\WINDOWS\System32\svchost.exe -k netsvcs [2017-3-18 47664]
S3 XblAuthManager;Xbox Live Auth Manager;C:\WINDOWS\System32\svchost.exe -k netsvcs [2017-3-18 47664]
S3 XblGameSave;Uložení hry Xbox Live;C:\WINDOWS\System32\svchost.exe -k netsvcs [2017-3-18 47664]
S3 xboxgip;Xbox Game Input Protocol Driver;C:\WINDOWS\System32\drivers\xboxgip.sys [2017-7-11 277504]
S3 XboxGipSvc;Xbox Accessory Management Service;C:\WINDOWS\System32\svchost.exe -k netsvcs [2017-3-18 47664]
S3 XboxNetApiSvc;Síťová služba Xbox Live;C:\WINDOWS\System32\svchost.exe -k netsvcs [2017-3-18 47664]
S3 xinputhid;XINPUT HID Filter Driver;C:\WINDOWS\System32\drivers\xinputhid.sys [2017-3-18 46592]
S4 AppVClient;Microsoft App-V Client;C:\WINDOWS\System32\AppVClient.exe [2017-7-11 846752]
S4 shpamsvc;Shared PC Account Manager;C:\WINDOWS\System32\svchost.exe -k netsvcs [2017-3-18 47664]
S4 tzautoupdate;Automatický aktualizátor časových pásem;C:\WINDOWS\System32\svchost.exe -k LocalService [2017-3-18 47664]
S4 UevAgentDriver;UevAgentDriver;C:\WINDOWS\System32\drivers\UevAgentDriver.sys [2017-3-18 40344]
S4 UevAgentService;User Experience Virtualization Service;C:\WINDOWS\System32\AgentService.exe [2017-3-18 1200640]
.
=============== File Associations ===============
.
FileExt: .scr: AutoCADScriptFile - HKCR\Unknown\Shell=C:\WINDOWS\System32\OpenWith.exe "%1" [default=openas]
FileExt: .txt: txtfile=C:\WINDOWS\System32\NOTEPAD.EXE %1 [UserChoice]
ShellExec: SZBrowser.exe: open="C:\Program Files\AVAST Software\SZBrowser\Launcher.exe" "%1"
.
=============== Created Last 60 ================
.
2017-09-06 19:22:42 1078240 ----a-w- C:\ProgramData\Microsoft\Windows Defender\Definition Updates\{0DC2DA9B-7004-3EDA-8DA0-279EBDA0A8EB}\GapaEngine.dll
2017-09-06 18:26:41 44928 ----a-w- C:\ProgramData\Microsoft\Windows Defender\Definition Updates\{D903610B-55EB-484E-8191-679A4B4E8D61}\MpKslb9708cc2.sys
2017-09-06 08:30:25 44928 ----a-w- C:\ProgramData\Microsoft\Windows Defender\Definition Updates\{D903610B-55EB-484E-8191-679A4B4E8D61}\MpKsl98088899.sys
2017-09-06 08:05:10 -------- d-----w- C:\AdwCleaner
2017-09-06 07:05:26 -------- d-----w- C:\ProgramData\Malwarebytes
2017-09-06 07:05:13 -------- d-----w- C:\ProgramData\Malwarebytes' Anti-Malware (portable)
2017-09-06 07:05:08 192216 ----a-w- C:\WINDOWS\System32\drivers\MBAMSwissArmy.sys
2017-09-06 07:04:34 109272 ----a-w- C:\WINDOWS\System32\drivers\mbamchameleon.sys
2017-09-06 06:54:18 44928 ----a-w- C:\ProgramData\Microsoft\Windows Defender\Definition Updates\{D903610B-55EB-484E-8191-679A4B4E8D61}\MpKsla5845ede.sys
2017-09-06 06:42:11 -------- d--h--w- C:\$SysReset
2017-09-06 06:41:30 -------- d-----w- C:\Users\Roman\AppData\Local\Recovery
2017-09-05 12:03:56 44928 ----a-w- C:\ProgramData\Microsoft\Windows Defender\Definition Updates\{D903610B-55EB-484E-8191-679A4B4E8D61}\MpKslb8378e72.sys
2017-09-05 12:02:00 13482976 ----a-w- C:\ProgramData\Microsoft\Windows Defender\Definition Updates\{D903610B-55EB-484E-8191-679A4B4E8D61}\mpengine.dll
2017-09-05 09:23:03 13482976 ----a-w- C:\ProgramData\Microsoft\Windows Defender\Definition Updates\Backup\mpengine.dll
2017-08-12 21:52:22 -------- d-----w- C:\Users\Roman\AppData\Local\DBG
2017-08-12 21:51:45 -------- d-----w- C:\ProgramData\Microsoft OneDrive
2017-08-12 19:49:04 18432 ----a-w- C:\WINDOWS\SysWow64\IpNatHlpClient.dll
2017-08-12 19:49:01 750496 ----a-w- C:\WINDOWS\SysWow64\WWAHost.exe
2017-08-12 19:49:01 636416 ----a-w- C:\WINDOWS\SysWow64\WpcWebFilter.dll
2017-08-12 19:49:01 5820984 ----a-w- C:\WINDOWS\SysWow64\windows.storage.dll
2017-08-12 19:49:01 5721600 ----a-w- C:\WINDOWS\SysWow64\BingMaps.dll
2017-08-12 19:49:01 406544 ----a-w- C:\WINDOWS\SysWow64\policymanager.dll
2017-08-12 19:49:01 394240 ----a-w- C:\WINDOWS\SysWow64\Windows.Internal.Management.dll
2017-08-12 19:49:01 387928 ----a-w- C:\WINDOWS\System32\wmpps.dll
2017-08-12 19:49:01 368128 ----a-w- C:\WINDOWS\SysWow64\InstallAgentUserBroker.exe
2017-08-12 19:49:01 337920 ----a-w- C:\WINDOWS\SysWow64\InstallAgent.exe
2017-08-12 19:30:56 5484544 ----a-w- C:\WINDOWS\SysWow64\NlsData0009.dll
2017-08-12 19:30:56 2629120 ----a-w- C:\WINDOWS\SysWow64\NlsLexicons0009.dll
2017-08-12 19:30:55 6348288 ----a-w- C:\WINDOWS\System32\NlsData0009.dll
2017-08-12 19:30:55 5739008 ----a-w- C:\WINDOWS\System32\prm0009.dll
2017-08-12 19:30:55 2629120 ----a-w- C:\WINDOWS\System32\NlsLexicons0009.dll
2017-08-12 19:30:50 -------- d-----w- C:\WINDOWS\System32\wbem\Performance
2017-08-12 19:30:09 -------- d-----w- C:\WINDOWS\System32\Microsoft
2017-08-12 19:30:09 -------- d-----w- C:\WINDOWS\ServiceProfiles
2017-08-12 19:28:00 -------- d-----w- C:\WINDOWS\SysWow64\XPSViewer
2017-08-12 19:27:58 -------- d-----w- C:\WINDOWS\SysWow64\BestPractices
2017-08-12 19:27:58 -------- d-----w- C:\WINDOWS\System32\msmq
2017-08-12 19:27:58 -------- d-----w- C:\WINDOWS\System32\BestPractices
2017-08-12 19:27:54 -------- d-----w- C:\inetpub
2017-08-12 19:26:49 -------- d-----w- C:\WINDOWS\System32\wbem\MOF\good
2017-08-12 19:26:49 -------- d-----w- C:\WINDOWS\System32\wbem\MOF\bad
2017-08-12 19:25:59 778936 ----a-w- C:\WINDOWS\SysWow64\PresentationNative_v0300.dll
2017-08-12 19:25:59 35480 ----a-w- C:\WINDOWS\SysWow64\TsWpfWrp.exe
2017-08-12 19:25:59 103120 ----a-w- C:\WINDOWS\SysWow64\PresentationCFFRasterizerNative_v0300.dll
2017-08-12 19:25:45 35480 ----a-w- C:\WINDOWS\System32\TsWpfWrp.exe
2017-08-12 19:25:45 124624 ----a-w- C:\WINDOWS\System32\PresentationCFFRasterizerNative_v0300.dll
2017-08-12 19:25:45 1166520 ----a-w- C:\WINDOWS\System32\PresentationNative_v0300.dll
2017-08-12 19:11:09 -------- d-----w- C:\Program Files (x86)\Common Files\SpeechEngines
2017-08-12 19:11:03 -------- d-----w- C:\Program Files\Common Files\SpeechEngines
2017-08-12 19:10:54 -------- d-----w- C:\ProgramData\USOShared
2017-08-12 19:04:43 -------- d---a-w- C:\Program Files\ATI Technologies
2017-08-12 19:04:19 -------- d---a-w- C:\Program Files (x86)\ATI Technologies
2017-08-12 19:04:01 -------- d-----w- C:\ProgramData\Package Cache
2017-08-12 19:03:44 -------- d-----w- C:\Program Files\Synaptics
2017-08-12 19:03:28 0 ----a-w- C:\WINDOWS\ativpsrm.bin
2017-08-12 19:03:20 -------- d-----w- C:\Program Files\Common Files\ATI Technologies
2017-08-12 19:03:16 2233344 ----a-w- C:\WINDOWS\SysWow64\PrintConfig.dll
2017-08-12 19:03:02 -------- d-----w- C:\Program Files\AMD
2017-08-12 19:00:54 -------- d-----w- C:\WINDOWS\System32\wbem\MOF
2017-08-12 18:59:47 -------- d-----w- C:\WINDOWS\System32\SleepStudy
2017-08-12 12:29:54 146704 ----a-w- C:\WINDOWS\System32\drivers\aswmonflt.sys
2017-08-11 17:40:33 -------- dc----w- C:\WINDOWS\Panther
2017-08-01 19:52:52 -------- d-----w- C:\Users\Roman\AppData\Local\Apple Computer
2017-08-01 19:45:57 -------- d-----w- C:\Users\Roman\AppData\Local\Apple
2017-08-01 19:45:46 -------- d---a-w- C:\Program Files\Bonjour
2017-08-01 19:45:46 -------- d---a-w- C:\Program Files (x86)\Bonjour
2017-07-11 10:58:14 -------- d-----w- C:\Users\Roman\AppData\Local\UNP
.
==================== Find6M ====================
.
2017-08-20 17:32:29 544424 ------w- C:\WINDOWS\System32\MpSigStub.exe
2017-08-12 19:49:01 323488 ----a-w- C:\WINDOWS\apppatch\AcRes.dll
2017-08-12 19:27:49 96256 ----a-w- C:\WINDOWS\SysWow64\mqoa.tlb
2017-08-12 19:26:56 1380352 ----a-w- C:\WINDOWS\System32\mqqm.dll
2017-08-12 19:26:48 562176 ----a-w- C:\WINDOWS\SysWow64\mqutil.dll
2017-08-12 19:26:43 51712 ----a-w- C:\WINDOWS\System32\mqbkup.exe
2017-08-12 19:26:43 26112 ----a-w- C:\WINDOWS\System32\mqsvc.exe
2017-08-12 12:29:03 1015880 ----a-w- C:\WINDOWS\System32\drivers\aswsnx.sys
2017-08-01 19:23:40 61304 ----a-w- C:\WINDOWS\System32\drivers\lpsport.sys
2017-08-01 19:19:04 57728 ----a-w- C:\WINDOWS\System32\drivers\aswbuniva.sys
2017-08-01 19:19:04 343288 ----a-w- C:\WINDOWS\System32\drivers\aswbloga.sys
2017-08-01 19:19:03 320008 ----a-w- C:\WINDOWS\System32\drivers\aswbidsdrivera.sys
2017-08-01 19:19:03 198976 ----a-w- C:\WINDOWS\System32\drivers\aswbidsha.sys
2017-07-31 15:15:09 835576 ----a-w- C:\WINDOWS\SysWow64\FlashPlayerApp.exe
2017-07-31 15:15:09 177648 ----a-w- C:\WINDOWS\SysWow64\FlashPlayerCPLApp.cpl
2017-07-04 15:55:38 361336 ----a-w- C:\WINDOWS\System32\drivers\aswVmm.sys
2017-07-04 15:53:41 198768 ----a-w- C:\WINDOWS\System32\drivers\aswStm.sys
2017-07-04 15:53:39 84392 ----a-w- C:\WINDOWS\System32\drivers\aswRvrt.sys
2017-07-04 15:53:39 46984 ----a-w- C:\WINDOWS\System32\drivers\aswHwid.sys
2017-07-04 15:53:37 110352 ----a-w- C:\WINDOWS\System32\drivers\aswRdr2.sys
2017-07-04 15:52:22 41800 ----a-w- C:\WINDOWS\System32\drivers\aswKbd.sys
2017-05-19 22:39:52 87904 ----a-w- C:\WINDOWS\System32\UNPUXWorker.exe
2017-03-28 05:37:39 31232 ------w- C:\WINDOWS\System32\DdcWnsListener.dll
2017-03-20 04:41:48 6472704 ----a-w- C:\WINDOWS\System32\prm0005.dll
2017-03-19 02:35:24 7168 ----a-w- C:\WINDOWS\SysWow64\drivers\cs-CZ\ndiscap.sys.mui
2017-03-19 02:35:18 3584 ----a-w- C:\WINDOWS\SysWow64\drivers\cs-CZ\wfplwfs.sys.mui
2017-03-19 02:35:16 15872 ----a-w- C:\WINDOWS\SysWow64\drivers\cs-CZ\NdisImPlatform.sys.mui
2017-03-18 21:01:14 207872 ----a-w- C:\WINDOWS\SysWow64\msclmd.dll
2017-03-18 21:01:13 230400 ----a-w- C:\WINDOWS\System32\msclmd.dll
2017-03-18 20:59:55 874 ----a-w- C:\WINDOWS\System32\manage-bde.wsf
2017-03-18 20:58:59 9728 ----a-w- C:\WINDOWS\SysWow64\nddeapi.dll
2017-03-18 20:57:58 97280 ----a-w- C:\WINDOWS\System32\WaaSAssessment.dll
2017-03-18 20:56:58 928712 ----a-w- C:\WINDOWS\SysWow64\mfreadwrite.dll
2017-03-18 11:40:24 118272 ----a-w- C:\WINDOWS\SysWow64\poqexec.exe
2017-03-18 11:40:23 140288 ----a-w- C:\WINDOWS\System32\poqexec.exe
2017-03-18 11:40:22 247200 ----a-w- C:\WINDOWS\System32\wdscore.dll
2017-03-18 11:40:21 846744 ----a-w- C:\WINDOWS\System32\SmiEngine.dll
2017-03-18 11:40:21 762784 ----a-w- C:\WINDOWS\System32\NetSetupEngine.dll
2017-03-18 11:40:21 206848 ----a-w- C:\WINDOWS\System32\PkgMgr.exe
2017-03-18 11:40:21 143776 ----a-w- C:\WINDOWS\System32\NetSetupApi.dll
2017-03-18 11:40:21 133024 ----a-w- C:\WINDOWS\System32\SSShim.dll
2017-03-18 11:40:21 111616 ----a-w- C:\WINDOWS\System32\NetDriverInstall.dll
2017-03-18 05:41:24 4096 ----a-w- C:\WINDOWS\System32\wbem\en\Microsoft.AppV.AppVClientWmi.resources.dll
2017-03-18 05:40:28 276400 ----a-w- C:\WINDOWS\System32\wmpeffects.dll
2017-03-18 05:09:30 8192 ----a-w- C:\WINDOWS\SysWow64\drivers\en-US\fwpkclnt.sys.mui
2017-03-18 05:00:38 7168 ----a-w- C:\WINDOWS\System32\msdxm.ocx
2017-03-18 05:00:38 7168 ----a-w- C:\WINDOWS\System32\dxmasf.dll
2017-03-18 04:59:56 11264 ----a-w- C:\WINDOWS\System32\spwmp.dll
2017-03-18 04:59:52 2560 ----a-w- C:\WINDOWS\System32\wmerror.dll
2017-03-18 04:58:28 4096 ----a-w- C:\WINDOWS\SysWow64\wbem\en\Microsoft.AppV.AppVClientWmi.resources.dll
2017-03-18 04:58:00 214528 ----a-w- C:\WINDOWS\System32\wmpdxm.dll
2017-03-18 04:57:26 249016 ----a-w- C:\WINDOWS\SysWow64\wmpeffects.dll
2017-03-18 04:57:26 153976 ----a-w- C:\WINDOWS\SysWow64\wmpps.dll
2017-03-18 04:56:26 9261568 ----a-w- C:\WINDOWS\System32\wmploc.DLL
2017-03-18 04:56:24 123904 ----a-w- C:\WINDOWS\System32\wmpshell.dll
2017-03-18 04:55:42 566272 ----a-w- C:\WINDOWS\System32\quickassist.exe
2017-03-18 04:54:52 231424 ----a-w- C:\WINDOWS\System32\unregmp2.exe
2017-03-18 04:44:58 5632 ----a-w- C:\WINDOWS\SysWow64\msdxm.ocx
2017-03-18 04:44:58 5632 ----a-w- C:\WINDOWS\SysWow64\dxmasf.dll
2017-03-18 04:44:14 9216 ----a-w- C:\WINDOWS\SysWow64\spwmp.dll
2017-03-18 04:44:10 2560 ----a-w- C:\WINDOWS\SysWow64\wmerror.dll
2017-03-18 04:42:36 172032 ----a-w- C:\WINDOWS\SysWow64\wmpdxm.dll
2017-03-18 04:41:12 100352 ----a-w- C:\WINDOWS\SysWow64\wmpshell.dll
2017-03-18 04:41:10 9261568 ----a-w- C:\WINDOWS\SysWow64\wmploc.DLL
2017-03-18 04:40:32 458752 ----a-w- C:\WINDOWS\SysWow64\quickassist.exe
2017-03-18 04:39:50 190976 ----a-w- C:\WINDOWS\SysWow64\unregmp2.exe
2017-03-18 03:00:30 44032 ----a-w- C:\WINDOWS\System32\msdxm.tlb
2017-03-18 03:00:30 18944 ----a-w- C:\WINDOWS\System32\amcompat.tlb
2017-03-18 02:52:46 44032 ----a-w- C:\WINDOWS\SysWow64\msdxm.tlb
2017-03-18 02:52:46 18944 ----a-w- C:\WINDOWS\SysWow64\amcompat.tlb
.
============= FINISH: 21:28:50,40 ===============

Attached Files

attach.txt (7.4 KB)

Hi,
my PC turns slow now and then (Slow = 30s-1min to open prgs, ...).
Panda Protection finds C:\Windows\TEMP\installPacket.exe the trojan Trj/CI.A
It is "deleted", but it keeps coming back every restart. I also checked with Malwarebytes Anti-Malware 2.2.1.1043 with Database Version v2017.09.09.05 and AdwCleaner 7.0.2.1 and JRT 8.1.4 and finally Malewarebytes Anti-Rootkit 1.9.3.1001. But nothing is found, except the above described trojan will be detected by Panda Protection on every restart.
I am using Windows 7 Ultimate SP1 64bit.
I do not have another Windows Installation disc/image or whatever.

DDS (Ver_2012-11-20.01) - NTFS_AMD64
Internet Explorer: 11.0.9600.18763
Run by Dr. Babak Bayani at 13:07:16 on 2017-09-10
Microsoft Windows 7 Ultimate 6.1.7601.1.1252.41.1033.18.32701.28442 [GMT 2:00]
.
AV: Panda Protection *Enabled/Updated* {CF440CD9-5435-10B1-04E0-7768B6F10320}
SP: Windows Defender *Enabled/Updated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
SP: Panda Protection *Enabled/Updated* {7425ED3D-720F-1F3F-3E50-4C1ACD76499D}
.
============== Running Processes ===============
.
C:\Windows\system32\lsm.exe
C:\Windows\system32\svchost.exe -k DcomLaunch
C:\Windows\system32\svchost.exe -k RPCSS
C:\Windows\system32\atiesrxx.exe
C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted
C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted
C:\Windows\system32\svchost.exe -k LocalService
C:\Windows\system32\svchost.exe -k netsvcs
C:\Program Files (x86)\Creative\Shared Files\CTAudSvc.exe
C:\Windows\system32\svchost.exe -k GPSvcGroup
C:\Windows\system32\svchost.exe -k NetworkService
C:\Windows\System32\spoolsv.exe
C:\Windows\system32\svchost.exe -k LocalServiceNoNetwork
C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe
C:\Windows\system32\Dwm.exe
C:\Program Files (x86)\Common Files\Adobe\AdobeGCClient\AGSService.exe
C:\Windows\Explorer.EXE
C:\Program Files\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe
C:\Program Files (x86)\AOMEI Backupper\ABService.exe
C:\Program Files\Bonjour\mDNSResponder.exe
C:\Windows\System32\svchost.exe -k utcsvc
C:\Program Files (x86)\DisplayFusion\DisplayFusionService.exe
C:\Program Files (x86)\Panda Security\Panda Security Protection\PSANHost.exe
C:\Windows\System32\svchost.exe -k HPZ12
C:\Program Files (x86)\Panda Security\Panda Devices Agent\AgentSvc.exe
C:\Windows\System32\svchost.exe -k HPZ12
C:\Program Files (x86)\Panda Security\Panda Security Protection\PSUAService.exe
C:\Windows\system32\svchost.exe -k imgsvc
C:\Program Files (x86)\Twonky\TwonkyServer\twonkyproxy.exe
C:\Program Files (x86)\Twonky\TwonkyServer\twonkystarter.exe
C:\Program Files (x86)\Twonky\TwonkyServer\TwonkyServer.exe
C:\Program Files\iPod\bin\iPodService.exe
C:\Windows\System32\svchost.exe -k secsvcs
C:\Windows\system32\svchost.exe -k NetworkServiceNetworkRestricted
C:\Program Files (x86)\Panda Security\Panda Security Protection\PSUAMain.exe
C:\Program Files\CCleaner\CCleaner64.exe
C:\Windows\system32\SearchIndexer.exe
C:\Program Files\Windows Media Player\wmpnetwk.exe
C:\Windows\system32\svchost.exe -k LocalServiceAndNoImpersonation
C:\Windows\System32\svchost.exe -k LocalServicePeerNet
C:\Program Files (x86)\DisplayFusion\DisplayFusionHookAppWIN6032.exe
C:\Program Files (x86)\DisplayFusion\DisplayFusionHookAppWIN6064.exe
C:\Users\Dr. Babak Bayani\Desktop\mbar-1.09.3.1001.exe
C:\Windows\SysWOW64\cmd.exe
C:\Users\Dr. Babak Bayani\Desktop\mbar\mbar.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\Windows\system32\wbem\wmiprvse.exe
C:\Windows\system32\SearchProtocolHost.exe
C:\Windows\system32\SearchFilterHost.exe
C:\Windows\system32\wbem\wmiprvse.exe
C:\Windows\System32\cscript.exe
.
============== Pseudo HJT Report ===============
.
uStart Page = hxxp://www.google.com/
uSearch Bar = hxxp://www.google.com
mSearch Bar = hxxp://www.google.com
mSearch Page = hxxp://www.google.com
mWinlogon: Userinit = C:\Windows\SysWOW64\userinit.exe,
BHO: Adobe PDF Link Helper: {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll
BHO: Skype for Business Browser Helper: {31D09BA0-12F5-4CCE-BE8A-2923E76605DA} - C:\Program Files (x86)\Microsoft Office\Office15\OCHelper.dll
BHO: ExplorerBHO Class: {449D0D6E-2412-4E61-B68F-1CB625CD9E52} - C:\Program Files\Classic Shell\ClassicExplorer32.dll
BHO: Adobe Acrobat Create PDF Toolbar Helper: {AE7CD045-E861-484f-8273-0445EE161910} - C:\Program Files (x86)\Common Files\Adobe\Acrobat\WCIEActiveX\AcroIEFavClient.dll
BHO: {B4F3A835-0E21-4959-BA22-42B3008E02FF} - <orphaned>
BHO: Adobe Acrobat Create PDF from Selection: {F4971EE7-DAA0-4053-9964-665D8EE6A077} - C:\Program Files (x86)\Common Files\Adobe\Acrobat\WCIEActiveX\AcroIEFavClient.dll
TB: Classic Explorer Bar: {553891B7-A0D5-4526-BE18-D3CE461D6310} - C:\Program Files\Classic Shell\ClassicExplorer32.dll
TB: Adobe Acrobat Create PDF Toolbar: {47833539-D0C5-4125-9FA8-0819E2EAAC93} - C:\Program Files (x86)\Common Files\Adobe\Acrobat\WCIEActiveX\AcroIEFavClient.dll
EB: <No Name>: {555D4D79-4BD2-4094-A395-CFC534424A05} - LocalServer32 - <no file>
EB: <No Name>: {555D4D79-4BD2-4094-A395-CFC534424A05} - LocalServer32 - <no file>
uRun: [DisplayFusion] "C:\Program Files (x86)\DisplayFusion\DisplayFusion.exe"
uRun: [CCleaner Monitoring] "C:\Program Files\CCleaner\CCleaner64.exe" /MONITOR
uRunOnce: [Uninstall C:\Users\Dr. Babak Bayani\AppData\Local\Microsoft\OneDrive\17.3.4604.0120\amd64] C:\Windows\System32\cmd.exe /q /c rmdir /s /q "C:\Users\Dr. Babak Bayani\AppData\Local\Microsoft\OneDrive\17.3.4604.0120\amd64"
uRunOnce: [Uninstall C:\Users\Dr. Babak Bayani\AppData\Local\Microsoft\OneDrive\17.3.4604.0120] C:\Windows\System32\cmd.exe /q /c rmdir /s /q "C:\Users\Dr. Babak Bayani\AppData\Local\Microsoft\OneDrive\17.3.4604.0120"
mRun: [Adobe ARM] "C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe"
mRun: [Acrobat Assistant 8.0] "C:\Program Files (x86)\Adobe\Acrobat 11.0\Acrobat\Acrotray.exe"
mRun: [SunJavaUpdateSched] "C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe"
mRun: [PSUAMain] "C:\Program Files (x86)\Panda Security\Panda Security Protection\PSUAMain.exe" /LaunchSysTray
mRun: [ABNotify] C:\Program Files (x86)\AOMEI Backupper\ABNotify.exe -auto
dRunOnce: [SPReview] "C:\Windows\System32\SPReview\SPReview.exe" /sp:1 /errorfwlink:"http://go.microsoft.com/fwlink/?LinkID=122915" /build:7601
StartupFolder: C:\PROGRA~3\MICROS~1\Windows\STARTM~1\Programs\Startup\TWONKY~1.LNK - C:\Program Files (x86)\Twonky\TwonkyServer\twonkytray.exe
uPolicies-Explorer: NoDriveTypeAutoRun = dword:145
mPolicies-Explorer: NoActiveDesktop = dword:1
mPolicies-Explorer: NoActiveDesktopChanges = dword:1
mPolicies-System: ConsentPromptBehaviorAdmin = dword:5
mPolicies-System: ConsentPromptBehaviorUser = dword:3
mPolicies-System: EnableUIADesktopToggle = dword:0
mPolicies-Windows\System: EnableSmartScreen = dword:0
IE: E&xport to Microsoft Excel - C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE/3000
IE: Se&nd to OneNote - C:\Program Files\Microsoft Office\Root\Office16\ONBttnIE.dll/105
IE: {2670000A-7350-4f3c-8081-5663EE0C6C49} - {48E73304-E1D6-4330-914C-F5F514E3486C} - C:\Program Files (x86)\Microsoft Office\Office15\ONBttnIE.dll
IE: {31D09BA0-12F5-4CCE-BE8A-2923E76605DA} - {31D09BA0-12F5-4CCE-BE8A-2923E76605DA} - C:\Program Files (x86)\Microsoft Office\Office15\OCHelper.dll
IE: {789FE86F-6FC4-46A1-9849-EDE0DB0C95CA} - {FFFDC614-B694-4AE6-AB38-5D6374584B52} - C:\Program Files (x86)\Microsoft Office\Office15\ONBttnIELinkedNotes.dll
TCP: NameServer = 192.168.0.1
TCP: Interfaces\{400F314E-EA26-4D61-8E8F-8B059881EDD8} : DHCPNameServer = 192.168.0.1
TCP: Interfaces\{555C7476-98D1-4FF5-B2D7-9FBC8A6DDF98} : DHCPNameServer = 172.20.10.1
TCP: Interfaces\{B7354D65-591E-4ABE-934B-5DDB0D1DBE04} : DHCPNameServer = 192.168.42.129
TCP: Interfaces\{F0959A58-1F86-4959-A4CF-CC7800F9FF6E} : DHCPNameServer = 192.168.42.129
Filter: text/xml - {807583E5-5146-11D5-A672-00B0D022E945} - C:\Program Files (x86)\Common Files\Microsoft Shared\OFFICE15\MSOXMLMF.DLL
Handler: osf - {D924BDC6-C83A-4BD5-90D0-095128A113D1} - C:\Program Files (x86)\Microsoft Office\Office15\MSOSB.DLL
Handler: WSAllMyTubechrome - <Clsid value has no data>
SSODL: WebCheck - <orphaned>
x64-mSearch Page = hxxp://www.google.com
x64-mDefault_Search_URL = hxxp://www.google.com
x64-mWinlogon: Userinit = C:\Windows\SysWOW64\userinit.exe,
x64-BHO: Skype for Business Browser Helper: {31D09BA0-12F5-4CCE-BE8A-2923E76605DA} - C:\Program Files\Microsoft Office\Office15\OCHelper.dll
x64-BHO: ExplorerBHO Class: {449D0D6E-2412-4E61-B68F-1CB625CD9E52} - C:\Program Files\Classic Shell\ClassicExplorer64.dll
x64-BHO: Java(tm) Plug-In SSV Helper: {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.8.0_144\bin\ssv.dll
x64-BHO: Office Document Cache Handler: {B4F3A835-0E21-4959-BA22-42B3008E02FF} - C:\Program Files\Microsoft Office\Office15\URLREDIR.DLL
x64-BHO: Microsoft SkyDrive Pro Browser Helper: {D0498E0A-45B7-42AE-A9AA-ABA463DBD3BF} - C:\Program Files\Microsoft Office\Office15\GROOVEEX.DLL
x64-BHO: Java(tm) Plug-In 2 SSV Helper: {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre1.8.0_144\bin\jp2ssv.dll
x64-TB: Classic Explorer Bar: {553891B7-A0D5-4526-BE18-D3CE461D6310} - C:\Program Files\Classic Shell\ClassicExplorer64.dll
x64-Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"
x64-IE: {2670000A-7350-4f3c-8081-5663EE0C6C49} - {48E73304-E1D6-4330-914C-F5F514E3486C} - C:\Program Files\Microsoft Office\Office15\ONBttnIE.dll
x64-IE: {31D09BA0-12F5-4CCE-BE8A-2923E76605DA} - {31D09BA0-12F5-4CCE-BE8A-2923E76605DA} - C:\Program Files\Microsoft Office\Office15\OCHelper.dll
x64-IE: {789FE86F-6FC4-46A1-9849-EDE0DB0C95CA} - {FFFDC614-B694-4AE6-AB38-5D6374584B52} - C:\Program Files\Microsoft Office\Office15\ONBttnIELinkedNotes.dll
x64-Filter: text/xml - {807583E5-5146-11D5-A672-00B0D022E945} - C:\Program Files\Common Files\Microsoft Shared\OFFICE15\MSOXMLMF.DLL
x64-Handler: osf - {D924BDC6-C83A-4BD5-90D0-095128A113D1} - C:\Program Files\Microsoft Office\Office15\MSOSB.DLL
x64-Handler: WSAllMyTubechrome - <Clsid value has no data>
x64-SSODL: WebCheck - <orphaned>
.
================= FIREFOX ===================
.
FF - ProfilePath - C:\Users\Dr. Babak Bayani\AppData\Roaming\Mozilla\Firefox\Profiles\mjhvzsl1.default-1447857174978\
FF - prefs.js: browser.startup.homepage - hxxps://www.google.ch/?gws_rd=ssl
FF - plugin: C:\Program Files (x86)\VLC Player\VLC\npvlc.dll
FF - plugin: C:\Program Files\Java\jre1.8.0_144\bin\dtplugin\npdeployJava1.dll
FF - plugin: C:\Program Files\Java\jre1.8.0_144\bin\plugin2\npjp2.dll
FF - plugin: C:\Program Files\Microsoft Silverlight\5.1.50907.0\npctrl.dll
FF - plugin: C:\Program Files\Microsoft Silverlight\5.1.50907.0\npctrlui.dll
FF - plugin: C:\Windows\System32\Macromed\Flash\NPSWF64_26_0_0_131.dll
.
============= SERVICES / DRIVERS ===============
.
R0 ambakdrv;ambakdrv;C:\Windows\System32\ambakdrv.sys [2017-7-7 31192]
R1 dtsoftbus01;DAEMON Tools Virtual Bus Driver;C:\Windows\System32\drivers\dtsoftbus01.sys [2014-11-18 283064]
R1 NNSALPC;NNSAlpc;C:\Windows\System32\drivers\NNSAlpc.sys [2017-4-6 105472]
R1 NNSHTTP;NNSHttp;C:\Windows\System32\drivers\NNSHttp.sys [2017-4-6 211008]
R1 NNSHTTPS;NNSHttps;C:\Windows\System32\drivers\NNSHttps.sys [2017-4-6 119880]
R1 NNSIDS;NNSids;C:\Windows\System32\drivers\NNSIds.sys [2017-4-6 124488]
R1 NNSNAHSL;NNSNAHSL;C:\Windows\System32\drivers\NNSNAHSL.sys [2017-3-15 92536]
R1 NNSPICC;NNSPicc;C:\Windows\System32\drivers\NNSpicc.sys [2017-4-6 116784]
R1 NNSPIHSW;NNSPihsw;C:\Windows\System32\drivers\NNSPihsw.sys [2017-4-6 83824]
R1 NNSPOP3;NNSPop3;C:\Windows\System32\drivers\NNSPop3.sys [2017-4-6 134288]
R1 NNSPROT;NNSProt;C:\Windows\System32\drivers\NNSProt.sys [2017-4-6 336168]
R1 NNSPRV;NNSPrv;C:\Windows\System32\drivers\NNSPrv.sys [2017-4-6 225464]
R1 NNSSMTP;NNSSmtp;C:\Windows\System32\drivers\NNSSmtp.sys [2017-4-6 121952]
R1 NNSSTRM;NNSStrm;C:\Windows\System32\drivers\NNSStrm.sys [2017-4-6 279536]
R1 NNSTLSC;NNSTlsc;C:\Windows\System32\drivers\NNStlsc.sys [2017-4-6 123976]
R1 PSINKNC;PSINKnc;C:\Windows\System32\drivers\PSINKNC.sys [2017-7-19 206424]
R2 AGSService;Adobe Genuine Software Integrity Service;C:\Program Files (x86)\Common Files\Adobe\AdobeGCClient\AGSService.exe [2015-9-4 2246256]
R2 AMD External Events Utility;AMD External Events Utility;C:\Windows\System32\atiesrxx.exe [2014-11-21 244736]
R2 ammntdrv;ammntdrv;C:\Windows\System32\ammntdrv.sys [2017-7-7 152024]
R2 amwrtdrv;amwrtdrv;C:\Windows\System32\amwrtdrv.sys [2017-7-7 18392]
R2 Apple Mobile Device Service;Apple Mobile Device Service;C:\Program Files\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe [2017-4-3 83768]
R2 Backupper Service;AOMEI Backupper Scheduler Service;C:\Program Files (x86)\AOMEI Backupper\ABService.exe [2017-7-8 52856]
R2 DiagTrack;Diagnostics Tracking Service;C:\Windows\System32\svchost.exe -k utcsvc [2009-7-14 27136]
R2 DisplayFusionService;DisplayFusionService;C:\Program Files (x86)\DisplayFusion\DisplayFusionService.exe [2015-2-26 5103640]
R2 NanoServiceMain;Panda Protection Service;C:\Program Files (x86)\Panda Security\Panda Security Protection\PSANHost.exe [2017-7-19 109024]
R2 PandaAgent;Panda Devices Agent;C:\Program Files (x86)\Panda Security\Panda Devices Agent\AgentSvc.exe [2016-7-19 86104]
R2 PSINAflt;PSINAflt;C:\Windows\System32\drivers\PSINAflt.sys [2017-7-19 178264]
R2 PSINFile;PSINFile;C:\Windows\System32\drivers\PSINFile.sys [2017-7-19 139352]
R2 PSINProc;PSINProc;C:\Windows\System32\drivers\PSINProc.sys [2017-7-19 132696]
R2 PSINProt;PSINProt;C:\Windows\System32\drivers\PSINProt.sys [2017-7-19 146008]
R2 PSINReg;PSINReg;C:\Windows\System32\drivers\PSINReg.sys [2017-7-19 116312]
R2 PSUAService;Panda Product Service;C:\Program Files (x86)\Panda Security\Panda Security Protection\PSUAService.exe [2017-7-19 48784]
R2 SSPORT;SSPORT;C:\Windows\System32\drivers\SSPORT.sys [2013-4-10 11576]
R2 TwonkyProxy;TwonkyProxy;C:\Program Files (x86)\Twonky\TwonkyServer\twonkyproxy.exe -start --> C:\Program Files (x86)\Twonky\TwonkyServer\twonkyproxy.exe -start [?]
R2 TwonkyServer;TwonkyServer;C:\Program Files (x86)\Twonky\TwonkyServer\twonkystarter.exe -serviceversion 0 --> C:\Program Files (x86)\Twonky\TwonkyServer\twonkystarter.exe -serviceversion 0 [?]
R3 anvsnddrv;AnvSoft Virtual Sound Device;C:\Windows\System32\drivers\anvsnddrv.sys [2016-5-11 33872]
R3 AtiHDAudioService;AMD Function Driver for HD Audio Service;C:\Windows\System32\drivers\AtihdW76.sys [2016-4-1 104976]
R3 mbamchameleon;mbamchameleon;C:\Windows\System32\drivers\mbamchameleon.sys [2015-11-18 109272]
R3 MBAMSwissArmy;MBAMSwissArmy;C:\Windows\System32\drivers\MBAMSwissArmy.sys [2015-11-18 192216]
R3 PSKMAD;PSKMAD;C:\Windows\System32\drivers\PSKMAD.sys [2017-9-10 72280]
R3 RTL8167;Realtek 8167 NT Driver;C:\Windows\System32\drivers\Rt64win7.sys [2014-11-17 941784]
S2 clr_optimization_v4.0.30319_32;Microsoft .NET Framework NGEN v4.0.30319_X86;C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe [2017-4-21 107656]
S2 clr_optimization_v4.0.30319_64;Microsoft .NET Framework NGEN v4.0.30319_X64;C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe [2017-4-21 128648]
S2 SkypeUpdate;Skype Updater;C:\Program Files (x86)\Skype\Updater\Updater.exe [2016-7-25 324224]
S3 ampa;ampa;C:\Windows\System32\ampa.sys [2017-7-8 38320]
S3 Creative Audio Engine Licensing Service;Creative Audio Engine Licensing Service;C:\Program Files (x86)\Common Files\Creative Labs Shared\Service\CTAELicensing.exe [2014-11-16 79360]
S3 dg_ssudbus;SAMSUNG Mobile USB Composite Device Driver (DEVGURU Ver.);C:\Windows\System32\drivers\ssudbus.sys [2014-1-22 108800]
S3 epmntdrv;epmntdrv;C:\Windows\System32\epmntdrv.sys [2017-7-8 24056]
S3 EuGdiDrv;EuGdiDrv;C:\Windows\System32\EuGdiDrv.sys [2017-7-8 10848]
S3 hxctlflt;hxctlflt;C:\Windows\System32\drivers\hxctlflt.sys [2009-2-8 111104]
S3 IEEtwCollectorService;Internet Explorer ETW Collector Service;C:\Windows\System32\ieetwcollector.exe [2017-8-8 116224]
S3 Netaapl;Apple Mobile Device Ethernet Service;C:\Windows\System32\drivers\netaapl64.sys [2014-8-15 23040]
S3 ose64;Office 64 Source Engine;C:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE [2015-7-5 243376]
S3 RdpVideoMiniport;Remote Desktop Video Miniport Driver;C:\Windows\System32\drivers\rdpvideominiport.sys [2014-11-18 19456]
S3 ssudmdm;SAMSUNG Mobile USB Modem Drivers (DEVGURU Ver.);C:\Windows\System32\drivers\ssudmdm.sys [2014-1-22 206080]
S3 USBAAPL64;Apple Mobile USB Driver;C:\Windows\System32\drivers\usbaapl64.sys [2015-6-10 54784]
S3 WatAdminSvc;Windows-Aktivierungstechnologieservice;C:\Windows\System32\Wat\WatAdminSvc.exe [2014-11-18 1255736]
S3 WsAudioDevice_383S(1);WsAudioDevice_383S(1);C:\Windows\System32\drivers\WsAudioDevice_383S(1).sys [2015-8-31 29288]
S4 WsAppService;Wondershare Application Framework Service;C:\Program Files (x86)\Wondershare\WAF\WsAppService.exe [2015-8-31 339968]
SUnknown TsUsbFlt;TsUsbFlt; [x]
SUnknown tsusbhub;tsusbhub; [x]
.
=============== Created Last 30 ================
.
2017-09-10 09:19:46 72280 ----a-w- C:\Windows\System32\drivers\PSKMAD.sys
2017-09-10 08:44:32 -------- d-----w- C:\ProgramData\Malwarebytes' Anti-Malware (portable)
2017-09-09 10:55:02 75888 ----a-w- C:\ProgramData\Microsoft\Windows Defender\Definition Updates\{6BA8532D-ED2E-47FE-8BE9-7CC1DD47CAF6}\offreg.3976.dll
2017-09-08 16:52:09 13482976 ----a-w- C:\ProgramData\Microsoft\Windows Defender\Definition Updates\{6BA8532D-ED2E-47FE-8BE9-7CC1DD47CAF6}\mpengine.dll
2017-08-28 19:37:17 96720 ----a-w- C:\Program Files\Mozilla Firefox\gmp-clearkey\0.1\clearkey.dll
2017-08-28 19:37:17 893880 ----a-w- C:\Program Files\Mozilla Firefox\uninstall\helper.exe
2017-08-28 19:37:16 63440 ----a-w- C:\Program Files\Mozilla Firefox\pingsender.exe
2017-08-28 19:37:15 127440 ----a-w- C:\Program Files\Mozilla Firefox\AccessibleHandler.dll
2017-08-26 17:32:23 -------- d-----w- C:\ProgramData\TwonkyServer
2017-08-26 16:51:51 973312 ----a-w- C:\Windows\SysWow64\DXPTaskRingtone.dll
2017-08-26 16:51:51 757248 ----a-w- C:\Windows\System32\win32spl.dll
2017-08-26 16:51:51 497664 ----a-w- C:\Windows\SysWow64\win32spl.dll
2017-08-26 16:51:51 1143296 ----a-w- C:\Windows\System32\DXPTaskRingtone.dll
2017-08-26 16:44:05 -------- d-----w- C:\Windows\SysWow64\GroupPolicy
2017-08-26 16:44:05 -------- d-----w- C:\Users\Dr. Babak Bayani\AppData\Roaming\Panda Security
2017-08-26 16:43:57 -------- d-----w- C:\Program Files (x86)\Panda Security
2017-08-26 16:43:10 -------- d-----w- C:\ProgramData\Panda Security
2017-08-26 16:42:22 13482976 ----a-w- C:\ProgramData\Microsoft\Windows Defender\Definition Updates\Backup\mpengine.dll
2017-08-21 19:29:01 87888 ----a-w- C:\Program Files\Mozilla Firefox\vcruntime140.dll
2017-08-21 19:29:01 65522640 ----a-w- C:\Program Files\Mozilla Firefox\xul.dll
2017-08-21 19:29:01 358864 ----a-w- C:\Program Files\Mozilla Firefox\updater.exe
2017-08-21 19:29:00 997056 ----a-w- C:\Program Files\Mozilla Firefox\ucrtbase.dll
2017-08-21 19:29:00 185808 ----a-w- C:\Program Files\Mozilla Firefox\softokn3.dll
2017-08-21 19:28:59 36304 ----a-w- C:\Program Files\Mozilla Firefox\plugin-hang-ui.exe
2017-08-21 19:28:59 18896 ----a-w- C:\Program Files\Mozilla Firefox\qipcap64.dll
2017-08-21 19:28:59 101328 ----a-w- C:\Program Files\Mozilla Firefox\plugin-container.exe
2017-08-20 08:28:44 -------- d-----w- C:\ProgramData\Medtronic
2017-08-20 08:26:03 110144 ----a-w- C:\Windows\SysWow64\WindowsAccessBridge-64.dll
2017-08-20 08:23:48 110144 ----a-w- C:\Windows\System32\WindowsAccessBridge-64.dll
2017-08-15 12:03:56 244480 ----a-w- C:\Program Files\Common Files\Microsoft Shared\OFFICE15\1033\OSFINTL.DLL
.
==================== Find3M ====================
.
2017-09-10 10:55:07 192216 ----a-w- C:\Windows\System32\drivers\MBAMSwissArmy.sys
2017-09-10 10:54:26 109272 ----a-w- C:\Windows\System32\drivers\mbamchameleon.sys
2017-07-29 14:56:30 117248 ----a-w- C:\Windows\System32\drivers\tdx.sys
2017-07-21 14:26:31 282624 ----a-w- C:\Windows\SysWow64\mstext40.dll
2017-07-21 14:26:30 518144 ----a-w- C:\Windows\SysWow64\msjetoledb40.dll
2017-07-21 14:26:30 409600 ----a-w- C:\Windows\SysWow64\msexch40.dll
2017-07-21 14:26:30 290816 ----a-w- C:\Windows\SysWow64\msjtes40.dll
2017-07-19 03:35:54 146008 ----a-w- C:\Windows\System32\drivers\PSINProt.sys
2017-07-19 03:34:16 132696 ----a-w- C:\Windows\System32\drivers\PSINProc.sys
2017-07-19 03:32:41 116312 ----a-w- C:\Windows\System32\drivers\PSINReg.sys
2017-07-19 03:31:03 139352 ----a-w- C:\Windows\System32\drivers\PSINFile.sys
2017-07-19 03:28:29 178264 ----a-w- C:\Windows\System32\drivers\PSINAflt.sys
2017-07-19 03:26:46 206424 ----a-w- C:\Windows\System32\drivers\PSINKNC.sys
2017-07-16 07:58:56 47472 ----a-w- C:\ProgramData\agent.1500191935.bdinstall.bin
2017-07-15 16:48:07 1024 ---h--w- C:\AMTAG.BIN
2017-07-15 09:55:26 803328 ----a-w- C:\Windows\SysWow64\FlashPlayerApp.exe
2017-07-15 09:55:26 144896 ----a-w- C:\Windows\SysWow64\FlashPlayerCPLApp.cpl
2017-07-14 15:29:15 486400 ----a-w- C:\Windows\System32\wer.dll
2017-07-14 15:29:15 34304 ----a-w- C:\Windows\System32\werdiagcontroller.dll
2017-07-14 15:29:14 2319872 ----a-w- C:\Windows\System32\tquery.dll
2017-07-14 15:29:10 2058240 ----a-w- C:\Windows\System32\Query.dll
2017-07-14 15:29:04 99840 ----a-w- C:\Windows\System32\mssprxy.dll
2017-07-14 15:29:04 778240 ----a-w- C:\Windows\System32\mssvp.dll
2017-07-14 15:29:04 75264 ----a-w- C:\Windows\System32\msscntrs.dll
2017-07-14 15:29:04 491520 ----a-w- C:\Windows\System32\mssph.dll
2017-07-14 15:29:04 288256 ----a-w- C:\Windows\System32\mssphtb.dll
2017-07-14 15:29:04 2222080 ----a-w- C:\Windows\System32\mssrch.dll
2017-07-14 15:29:04 14336 ----a-w- C:\Windows\System32\msshooks.dll
2017-07-14 15:29:04 115200 ----a-w- C:\Windows\System32\mssitlb.dll
2017-07-14 15:12:22 591872 ----a-w- C:\Windows\System32\SearchIndexer.exe
2017-07-14 15:12:14 249856 ----a-w- C:\Windows\System32\SearchProtocolHost.exe
2017-07-14 15:11:51 113664 ----a-w- C:\Windows\System32\SearchFilterHost.exe
2017-07-14 15:10:33 382976 ----a-w- C:\Windows\SysWow64\wer.dll
2017-07-14 15:10:32 1549824 ----a-w- C:\Windows\SysWow64\tquery.dll
2017-07-14 15:10:27 1363968 ----a-w- C:\Windows\SysWow64\Query.dll
2017-07-14 15:10:23 666624 ----a-w- C:\Windows\SysWow64\mssvp.dll
2017-07-14 15:10:23 59392 ----a-w- C:\Windows\SysWow64\msscntrs.dll
2017-07-14 15:10:23 34816 ----a-w- C:\Windows\SysWow64\mssprxy.dll
2017-07-14 15:10:23 337408 ----a-w- C:\Windows\SysWow64\mssph.dll
2017-07-14 15:10:23 197120 ----a-w- C:\Windows\SysWow64\mssphtb.dll
2017-07-14 15:10:23 1400320 ----a-w- C:\Windows\SysWow64\mssrch.dll
2017-07-14 15:10:23 104448 ----a-w- C:\Windows\SysWow64\mssitlb.dll
2017-07-14 15:00:23 427520 ----a-w- C:\Windows\SysWow64\SearchIndexer.exe
2017-07-14 15:00:11 164352 ----a-w- C:\Windows\SysWow64\SearchProtocolHost.exe
2017-07-14 14:59:33 86528 ----a-w- C:\Windows\SysWow64\SearchFilterHost.exe
2017-07-14 14:59:18 9728 ----a-w- C:\Windows\SysWow64\msshooks.dll
2017-07-14 14:57:38 50688 ----a-w- C:\Windows\System32\wermgr.exe
2017-07-14 14:50:25 54272 ----a-w- C:\Windows\SysWow64\wermgr.exe
2017-07-14 14:50:23 28672 ----a-w- C:\Windows\SysWow64\werdiagcontroller.dll
2017-07-14 07:16:17 2724864 ----a-w- C:\Windows\System32\mshtml.tlb
2017-07-14 07:15:32 4096 ----a-w- C:\Windows\System32\ieetwcollectorres.dll
2017-07-14 06:47:07 66560 ----a-w- C:\Windows\System32\iesetup.dll
2017-07-14 06:45:24 48640 ----a-w- C:\Windows\System32\ieetwproxystub.dll
2017-07-14 06:45:12 417792 ----a-w- C:\Windows\System32\html.iec
2017-07-14 06:44:09 576512 ----a-w- C:\Windows\System32\vbscript.dll
2017-07-14 06:44:07 88064 ----a-w- C:\Windows\System32\MshtmlDac.dll
2017-07-14 06:20:08 144384 ----a-w- C:\Windows\System32\ieUnatt.exe
2017-07-14 06:20:08 116224 ----a-w- C:\Windows\System32\ieetwcollector.exe
2017-07-14 06:19:36 814080 ----a-w- C:\Windows\System32\jscript9diag.dll
2017-07-14 06:08:23 968704 ----a-w- C:\Windows\System32\MsSpellCheckingFacility.exe
2017-07-14 05:49:39 77824 ----a-w- C:\Windows\System32\JavaScriptCollectionAgent.dll
2017-07-14 05:48:16 87552 ----a-w- C:\Windows\System32\tdc.ocx
2017-07-14 05:35:38 5981184 ----a-w- C:\Windows\System32\jscript9.dll
2017-07-14 05:09:44 1359360 ----a-w- C:\Windows\System32\mshtmlmedia.dll
2017-07-14 05:09:18 2132992 ----a-w- C:\Windows\System32\inetcpl.cpl
2017-07-14 04:23:17 3240960 ----a-w- C:\Windows\System32\wininet.dll
2017-07-14 03:01:05 2724864 ----a-w- C:\Windows\SysWow64\mshtml.tlb
2017-07-14 02:48:47 62464 ----a-w- C:\Windows\SysWow64\iesetup.dll
2017-07-14 02:48:43 499200 ----a-w- C:\Windows\SysWow64\vbscript.dll
2017-07-14 02:48:10 47616 ----a-w- C:\Windows\SysWow64\ieetwproxystub.dll
2017-07-14 02:48:01 341504 ----a-w- C:\Windows\SysWow64\html.iec
2017-07-14 02:47:13 64000 ----a-w- C:\Windows\SysWow64\MshtmlDac.dll
2017-07-14 02:38:44 115712 ----a-w- C:\Windows\SysWow64\ieUnatt.exe
2017-07-14 02:38:25 620032 ----a-w- C:\Windows\SysWow64\jscript9diag.dll
2017-07-14 02:26:20 60416 ----a-w- C:\Windows\SysWow64\JavaScriptCollectionAgent.dll
2017-07-14 02:25:47 73216 ----a-w- C:\Windows\SysWow64\tdc.ocx
2017-07-14 02:17:41 4546048 ----a-w- C:\Windows\SysWow64\jscript9.dll
2017-07-14 02:11:47 2057216 ----a-w- C:\Windows\SysWow64\inetcpl.cpl
2017-07-14 02:11:34 1155072 ----a-w- C:\Windows\SysWow64\mshtmlmedia.dll
2017-07-14 01:53:27 2767872 ----a-w- C:\Windows\SysWow64\wininet.dll
2017-07-08 15:34:46 370920 ----a-w- C:\Windows\System32\clfs.sys
2017-07-08 15:00:10 3224064 ----a-w- C:\Windows\System32\win32k.sys
2017-07-08 13:21:32 1024 ---ha-w- C:\SYSTAG.BIN
2017-07-07 15:37:50 631176 ----a-w- C:\Windows\System32\winresume.efi
2017-07-07 15:33:37 706792 ----a-w- C:\Windows\System32\winload.efi
2017-07-07 15:33:36 363752 ----a-w- C:\Windows\System32\drivers\volmgrx.sys
2017-07-07 15:33:33 5547752 ----a-w- C:\Windows\System32\ntoskrnl.exe
2017-07-07 15:33:30 95464 ----a-w- C:\Windows\System32\drivers\ksecdd.sys
2017-07-07 15:33:30 154856 ----a-w- C:\Windows\System32\drivers\ksecpkg.sys
2017-07-07 15:31:14 1732864 ----a-w- C:\Windows\System32\ntdll.dll
2017-07-07 15:15:23 4001000 ----a-w- C:\Windows\SysWow64\ntkrnlpa.exe
2017-07-07 15:15:23 3945192 ----a-w- C:\Windows\SysWow64\ntoskrnl.exe
2017-07-07 15:13:31 1314112 ----a-w- C:\Windows\SysWow64\ntdll.dll
2017-07-07 15:10:59 60416 ----a-w- C:\Windows\SysWow64\msobjs.dll
2017-07-07 15:02:00 148480 ----a-w- C:\Windows\System32\appidpolicyconverter.exe
2017-07-07 15:01:54 62464 ----a-w- C:\Windows\System32\drivers\appid.sys
2017-07-07 15:01:54 17920 ----a-w- C:\Windows\System32\appidcertstorecheck.exe
2017-07-07 15:01:12 64000 ----a-w- C:\Windows\System32\auditpol.exe
2017-07-07 14:58:14 338432 ----a-w- C:\Windows\System32\conhost.exe
2017-07-07 14:57:23 296960 ----a-w- C:\Windows\System32\rstrui.exe
.
============= FINISH: 13:08:07.33 ===============

Attached Files

attach.txt (12.7 KB)

I was told to post this in the Spyware/Trojan page. I keep being directed to this composition page. I trust this is part of the page I was told to post. I am both pasting and attaching the two separate logs I just completed last night.

Here is my problem:

A couple of months ago I lost the ability to open Mozilla Firefox. My personal profile was missing or inaccessible. It doesn't even recognize my default personal profile number or code. When I went to my C drive and opened some folders, I received a message that my personal profile folder was actually EMPTY. My internet experiences in IE 11 have been pretty choppy the last few months.

A week or so ago, I finally consulted another help firm, and it ran a very extensive scan. I will summarize the help site's conclusions. As part of a small Wi-Fi network that includes my desktop computer and a laptop in another part of my house, it seems that unwanted "others" are also part of my network. AND, I have something called "Clampi" on my network, a specialized form of "network malware" that personal anti-malware such as Norton, Malwarebytes, Superantispyware, and Spyware Blaster have not picked up, because I was told Scampi is network malware.

I was told that my desktop computer and laptop are not themselves infected, but that the network we use, is. I'm being advised to purchase-at a hefty fee-network anti-malware, and that Mozilla might start working, again, once I have it installed. I often can't even open certain Norton Security news alerts and most of my downloaded files in my Documents and Download files (unless they are photos or pictures or art) because the Mozilla icon is attached to them and I get a message saying that my Mozilla default identity isn't working or Mozilla can't be located. And yet, I have it on my system

Frankly, I don't know what to think. Apparently, this "Clampi" began its rounds across the world a couple of months ago, about the time my Mozilla couldn't be opened. If there is a less expensive alternative to this nightmare, I would be open to it. I don't even know if the help site is correct in its diagnosis. They did an extensive diagnostic job on line for me, though. I also found that my Malwarebytes program couldn't be opened for a while. But, as soon as I have contacted the Malwarebytes Help Desk for assistance on that matter, it seemed to resolve itself. Someone listening in, maybe?

We don't run a business on our home computers, although we have done some financial communication and transactions. So far, they don't seem to have been compromised. You'd think they would be, by now. Perhaps the sites we utilize have strong safety features.

Anyway, here is the dds file and the attach file. I don't know how to zip it up before attaching it. Thanks for your help.


COPY/PASTE DDS:
DDS (Ver_2012-11-20.01) - NTFS_AMD64
Internet Explorer: 11.0.15063.0
Run by samar_000 at 17:00:29 on 2017-09-10
Microsoft Windows 10 Home 10.0.15063.0.1252.1.1033.18.8130.4559 [GMT -4:00]
.
AV: Windows Defender *Disabled/Updated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
AV: Norton Internet Security *Enabled/Updated* {30744133-1E94-7B35-F4A3-82A5AEF1CBAA}
AV: Malwarebytes *Enabled/Updated* {23007AD3-69FE-687C-2629-D584AFFAF72B}
SP: Malwarebytes *Enabled/Updated* {98619B37-4FC4-67F2-1C99-EEF6D47DBD96}
SP: Windows Defender *Disabled/Updated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
SP: Norton Internet Security *Enabled/Updated* {8B15A0D7-38AE-74BB-CE13-B9D7D5768117}
FW: Norton Internet Security *Enabled* {084FC016-54FB-7A6D-DFFC-2B9050228CD1}
.
============== Running Processes ===============
.
c:\windows\system32\svchost.exe -k dcomlaunch -s PlugPlay
C:\WINDOWS\system32\fontdrvhost.exe
C:\WINDOWS\system32\svchost.exe -k DcomLaunch
c:\windows\system32\svchost.exe -k rpcss
c:\windows\system32\svchost.exe -k dcomlaunch -s LSM
C:\WINDOWS\system32\svchost.exe -k LocalSystemNetworkRestricted
C:\WINDOWS\system32\svchost.exe -k LocalServiceNoNetwork
c:\windows\system32\svchost.exe -k localservice -s bthserv
c:\windows\system32\svchost.exe -k localsystemnetworkrestricted -s NcbService
c:\windows\system32\svchost.exe -k netsvcs -s Schedule
c:\windows\system32\svchost.exe -k localservicenetworkrestricted -s TimeBrokerSvc
c:\windows\system32\svchost.exe -k localsystemnetworkrestricted -s hidserv
c:\windows\system32\svchost.exe -k netsvcs -s ProfSvc
c:\windows\system32\svchost.exe -k localservicenetworkrestricted -s EventLog
c:\windows\system32\svchost.exe -k netsvcs -s UserManager
C:\Windows\System32\WUDFHost.exe
c:\windows\system32\svchost.exe -k localservice -s nsi
c:\windows\system32\svchost.exe -k netsvcs -s Themes
c:\windows\system32\svchost.exe -k localservice -s EventSystem
c:\windows\system32\svchost.exe -k localservicenetworkrestricted -s Dhcp
c:\windows\system32\svchost.exe -k netsvcs -s SENS
c:\windows\system32\svchost.exe -k localsystemnetworkrestricted -s AudioEndpointBuilder
c:\windows\system32\svchost.exe -k localservice -s FontCache
c:\windows\system32\svchost.exe -k networkservice -s NlaSvc
c:\windows\system32\svchost.exe -k localservice -s netprofm
C:\WINDOWS\System32\svchost.exe -k LocalServiceNetworkRestricted
c:\windows\system32\svchost.exe -k netsvcs -s Appinfo
c:\windows\system32\svchost.exe -k appmodel -s StateRepository
c:\windows\system32\svchost.exe -k networkservice -s Dnscache
C:\WINDOWS\system32\svchost.exe -k LocalServiceNetworkRestricted
C:\WINDOWS\System32\svchost.exe -k LocalServiceNetworkRestricted
c:\windows\system32\svchost.exe -k localsystemnetworkrestricted -s DeviceAssociationService
C:\WINDOWS\system32\svchost.exe -k LocalSystemNetworkRestricted
c:\windows\system32\svchost.exe -k netsvcs -s ShellHWDetection
c:\windows\system32\svchost.exe -k localservice -s WinHttpAutoProxySvc
C:\WINDOWS\system32\WLANExt.exe
C:\WINDOWS\System32\spoolsv.exe
c:\windows\system32\svchost.exe -k networkservice -s LanmanWorkstation
c:\windows\system32\svchost.exe -k networkservicenetworkrestricted -s PolicyAgent
c:\windows\system32\svchost.exe -k netsvcs -s IKEEXT
c:\windows\system32\svchost.exe -k netsvcs -s LanmanServer
C:\Program Files (x86)\APC\PowerChute Personal Edition\mainserv.exe
C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe
c:\windows\system32\svchost.exe -k networkservice -s CryptSvc
C:\Windows\SysWOW64\AsHookDevice.exe
C:\Program Files (x86)\ASUS\WebStorage Sync Agent\1.1.18.159\AsusWSWinService.exe
C:\Program Files\SUPERAntiSpyware\SASCORE64.EXE
C:\Program Files\Microsoft Office 15\ClientX64\OfficeClickToRun.exe
C:\WINDOWS\System32\svchost.exe -k utcsvc
c:\windows\system32\svchost.exe -k localservicenonetwork -s DPS
C:\Program Files\Intel\iCLS Client\HeciServer.exe
C:\Program Files\NVIDIA Corporation\GeForce Experience Service\GfExperienceService.exe
C:\Windows\system32\IProsetMonitor.exe
c:\windows\system32\svchost.exe -k netsvcs -s Winmgmt
C:\WINDOWS\system32\lxeccoms.exe
C:\Windows\system32\mfevtps.exe
c:\windows\system32\svchost.exe -k netsvcs -s iphlpsvc
C:\WINDOWS\system32\svchost.exe -k imgsvc
C:\Program Files\Malwarebytes\Anti-Malware\mbamservice.exe
c:\windows\system32\svchost.exe -k localsystemnetworkrestricted -s SysMain
C:\Program Files\NVIDIA Corporation\NvStreamSrv\NvStreamService.exe
C:\Program Files (x86)\NVIDIA Corporation\NetService\NvNetworkService.exe
C:\Program Files\Common Files\McAfee\SystemCore\mfefire.exe
c:\windows\system32\svchost.exe -k netsvcs -s WpnService
c:\windows\system32\svchost.exe -k localservice -s WdiServiceHost
c:\windows\system32\svchost.exe -k appmodel -s tiledatamodelsvc
C:\Program Files\CyberLink\Shared files\RichVideo64.exe
C:\Program Files\NVIDIA Corporation\Display.NvContainer\NVDisplay.Container.exe
C:\Program Files\TrueKey\McAfee.TrueKey.Service.exe
c:\windows\system32\svchost.exe -k localsystemnetworkrestricted -s TrkWks
C:\Program Files\TrueKey\McTkSchedulerService.exe
c:\windows\system32\svchost.exe -k localsystemnetworkrestricted -s PcaSvc
C:\Windows\System32\WUDFHost.exe
C:\Program Files (x86)\APC\PowerChute Personal Edition\dataserv.exe
C:\WINDOWS\system32\dashost.exe
c:\windows\system32\svchost.exe -k netsvcs -s Browser
c:\windows\system32\svchost.exe -k localserviceandnoimpersonation -s SSDPSRV
c:\windows\system32\svchost.exe -k localservice -s CDPSvc
C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\DAL\jhi_service.exe
c:\windows\system32\svchost.exe -k netsvcs -s TokenBroker
c:\windows\system32\svchost.exe -k localservice -s LicenseManager
C:\WINDOWS\system32\wbem\wmiprvse.exe
C:\Program Files (x86)\ASUS\AXSP\1.00.19\atkexComSvc.exe
C:\Program Files (x86)\Common Files\MAGIX Services\Database\bin\FABS.exe
C:\Program Files\Intel\Intel(R) Rapid Storage Technology\IAStorDataMgrSvc.exe
c:\windows\system32\svchost.exe -k netsvcs
c:\windows\system32\svchost.exe -k localsystemnetworkrestricted -s SensorService
c:\windows\system32\svchost.exe -k netsvcs -s lfsvc
C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\LMS\LMS.exe
c:\windows\system32\svchost.exe -k localservicenetworkrestricted -s wscsvc
c:\windows\system32\svchost.exe -k localsystemnetworkrestricted -s Netman
c:\windows\system32\svchost.exe -k localsystemnetworkrestricted -s StorSvc
C:\Program Files (x86)\Norton Internet Security\Engine\22.10.1.10\NIS.exe
C:\WINDOWS\system32\SearchIndexer.exe
c:\windows\system32\svchost.exe -k localsystemnetworkrestricted -s DsSvc
c:\windows\system32\svchost.exe -k netsvcs -s seclogon
C:\WINDOWS\System32\fontdrvhost.exe
C:\WINDOWS\System32\dwm.exe
C:\Program Files\NVIDIA Corporation\Display\nvxdsync.exe
C:\WINDOWS\System32\svchost.exe -k LocalServiceNetworkRestricted -s lmhosts
C:\Program Files (x86)\Norton Internet Security\Engine\22.10.1.10\NIS.exe
c:\windows\system32\sihost.exe
c:\windows\system32\svchost.exe -k unistacksvcgroup -s CDPUserSvc
c:\windows\system32\svchost.exe -k unistacksvcgroup -s WpnUserService
C:\Program Files (x86)\ASUS\ASUS Manager\Ai Charger II\Ai_ChargerII_TrayIcon(ASUS_Manager).exe
C:\Program Files (x86)\ASUS\ASUS Manager\AsHKService.exe
C:\Program Files (x86)\ASUS\ASUS Manager\Lighting\ASUS_Manager_Lighting.exe
C:\Program Files\ASUS\Built-in UPS\Built-in UPS.exe
C:\Program Files (x86)\ASUS\ASUS Manager\NFC Express Desktops\DT_NFCExpressDesktops.exe
C:\Program Files (x86)\ASUS\ASUS Manager\Application Update\ASUSUpdateChecker.exe
C:\Program Files (x86)\InstallShield Installation Information\{9AF45D7C-34F1-4BA0-B799-825C8C04494C}\AiChargerDT.exe
C:\Program Files (x86)\ASUS\ASUS Manager\NFC Express Desktops\DTNFCServer.exe
C:\Program Files (x86)\ASUS\ASUS Manager\Power Manager\Power Manager_background.exe
c:\windows\system32\taskhostw.exe
C:\WINDOWS\Explorer.EXE
C:\Windows\SystemApps\Microsoft.Windows.Cortana_cw5n1h2txyewy\SearchUI.exe
C:\Windows\SystemApps\ShellExperienceHost_cw5n1h2txyewy\ShellExperienceHost.exe
C:\Windows\System32\RuntimeBroker.exe
C:\Program Files\NVIDIA Corporation\Display\nvtray.exe
C:\Program Files (x86)\NVIDIA Corporation\Update Core\NvBackend.exe
C:\Program Files\WindowsApps\Microsoft.SkypeApp_11.19.856.0_x64__kzf8qxf38zg5c\SkypeHost.exe
C:\WINDOWS\system32\SettingSyncHost.exe
C:\Program Files\Windows Defender\MSASCuiL.exe
C:\Program Files\Realtek\Audio\HDA\RtkNGUI64.exe
C:\Program Files\Realtek\Audio\HDA\RAVBg64.exe
C:\Program Files (x86)\Lexmark Pro800-Pro900 Series\lxecmon.exe
C:\Program Files (x86)\Lexmark Pro800-Pro900 Series\ezprint.exe
C:\Program Files\Malwarebytes\Anti-Malware\mbamtray.exe
C:\Program Files\SUPERAntiSpyware\SUPERANTISPYWARE.EXE
C:\Users\samar_000\AppData\Local\Microsoft\OneDrive\OneDrive.exe
C:\Program Files\Microsoft Office 15\root\office15\onenotem.exe
C:\Program Files (x86)\CyberLink\PowerDVD10\PDVD10Serv.exe
C:\WINDOWS\system32\wbem\unsecapp.exe
C:\Program Files (x86)\APC\PowerChute Personal Edition\apcsystray.exe
C:\Program Files\Intel\Intel(R) Rapid Storage Technology\IAStorIcon.exe
c:\windows\system32\svchost.exe -k unistacksvcgroup
C:\Users\samar_000\AppData\Roaming\AVAST Software\Browser Cleanup\BCUSched.exe
C:\WINDOWS\system32\wbem\unsecapp.exe
C:\WINDOWS\system32\wbem\wmiprvse.exe
C:\WINDOWS\system32\ApplicationFrameHost.exe
C:\Windows\System32\SystemSettingsBroker.exe
c:\windows\system32\svchost.exe -k localservicenetworkrestricted -s RmSvc
c:\windows\system32\svchost.exe -k localservice -s SstpSvc
c:\windows\system32\svchost.exe -k netsvcs -s RasMan
C:\WINDOWS\system32\svchost.exe -k netsvcs -s gpsvc
C:\Windows\System32\smartscreen.exe
C:\WINDOWS\system32\svchost.exe -k netsvcs -s wlidsvc
C:\WINDOWS\system32\AUDIODG.EXE
c:\windows\system32\taskhostw.exe
C:\WINDOWS\System32\svchost.exe -k LocalSystemNetworkRestricted -s WdiSystemHost
C:\WINDOWS\System32\cscript.exe
.
============== Pseudo HJT Report ===============
.
BHO: True Key Helper: {0F4B8786-5502-4803-8EBC-F652A1153BB6} - C:\Program Files\Intel Security\True Key\MSIE\truekey_ie.dll
BHO: Skype for Business Browser Helper: {31D09BA0-12F5-4CCE-BE8A-2923E76605DA} - C:\Program Files\Microsoft Office 15\root\office15\ochelper.dll
BHO: Norton Identity Safety: {602ADB0E-4AFF-4217-8AA1-95DAC4DFA408} - C:\Program Files (x86)\Norton Internet Security\Engine32\22.10.1.10\coIEPlg.dll
BHO: Norton Vulnerability Protection: {6D53EC84-6AAE-4787-AEEE-F4628F01010C} -
BHO: Microsoft SkyDrive Pro Browser Helper: {D0498E0A-45B7-42AE-A9AA-ABA463DBD3BF} - C:\Program Files\Microsoft Office 15\root\office15\grooveex.dll
TB: Norton Toolbar: {7FEBEFE3-6B19-4349-98D2-FFB09D4B49CA} - C:\Program Files (x86)\Norton Internet Security\Engine32\22.10.1.10\coIEPlg.dll
TB: True Key: {4BAAC1B8-0800-42C9-8FA6-08B211F356B8} - C:\Program Files\Intel Security\True Key\MSIE\truekey_ie.dll
uRun: [SUPERAntiSpyware] C:\Program Files\SUPERAntiSpyware\SUPERAntiSpyware.exe
uRun: [OneDrive] "C:\Users\samar_000\AppData\Local\Microsoft\OneDrive\OneDrive.exe" /background
mRun: [ASUSPRP] "C:\Program Files (x86)\ASUS\APRP\APRP.EXE"
mRun: [ASUSWebStorage] C:\Program Files (x86)\ASUS\WebStorage Sync Agent\1.1.18.159\AsusWSPanel.exe /S
mRun: [RemoteControl10] "C:\Program Files (x86)\CyberLink\PowerDVD10\PDVD10Serv.exe"
mRun: [Display] C:\Program Files (x86)\APC\PowerChute Personal Edition\DataCollectionLauncher.exe
StartupFolder: C:\Users\SAMAR_~1\AppData\Roaming\MICROS~1\Windows\STARTM~1\Programs\Startup\SENDTO~1.LNK - C:\Program Files\Microsoft Office 15\root\office15\onenotem.exe
StartupFolder: C:\PROGRA~3\MICROS~1\Windows\STARTM~1\Programs\Startup\APCUPS~1.LNK - C:\Program Files (x86)\APC\PowerChute Personal Edition\Display.exe
mPolicies-System: DSCAutomationHostEnabled = dword:2
IE: E&xport to Microsoft Excel - C:\Program Files\Microsoft Office 15\Root\Office15\EXCEL.EXE/3000
IE: Se&nd to OneNote - C:\Program Files\Microsoft Office 15\Root\Office15\ONBttnIE.dll/105
IE: {2670000A-7350-4f3c-8081-5663EE0C6C49} - {48E73304-E1D6-4330-914C-F5F514E3486C} - C:\Program Files\Microsoft Office 15\root\office15\onbttnie.dll
IE: {31D09BA0-12F5-4CCE-BE8A-2923E76605DA} - {31D09BA0-12F5-4CCE-BE8A-2923E76605DA} - C:\Program Files\Microsoft Office 15\root\office15\ochelper.dll
IE: {789FE86F-6FC4-46A1-9849-EDE0DB0C95CA} - {FFFDC614-B694-4AE6-AB38-5D6374584B52} - C:\Program Files\Microsoft Office 15\root\office15\ONBttnIELinkedNotes.dll
.
INFO: HKCU has more than 50 listed domains.
If you wish to scan all of them, select the 'Force scan all domains' option.
.
TCP: NameServer = 209.18.47.61 209.18.47.62
TCP: Interfaces\{7283d1fa-c566-4c0d-87d9-74e4a31ebd94} : DHCPNameServer = 209.18.47.61 209.18.47.62
Handler: osf - {D924BDC6-C83A-4BD5-90D0-095128A113D1} - C:\Program Files\Microsoft Office 15\root\office15\msosb.dll
Handler: tbauth - {14654CA6-5711-491D-B89A-58E571679951} - C:\Windows\SysWOW64\tbauth.dll
Handler: windows.tbauth - {14654CA6-5711-491D-B89A-58E571679951} - C:\Windows\SysWOW64\tbauth.dll
Handler: wlpg - {E43EF6CD-A37A-4A9B-9E6F-83F89B8E6324} - C:\Program Files (x86)\Windows Live\Photo Gallery\AlbumDownloadProtocolHandler.dll
SSODL: WebCheck - <orphaned>
LSA: Notification Packages = scecli C:\Program Files\TrueKey\McAfeeTrueKeyPasswordFilter "C:\Program Files\TrueKey\McAfeeTrueKeyPasswordFilter"
LSA: Security Packages = ""
CLSID: {603D3801-BD81-11d0-A3A5-00C04FD706EC} - C:\WINDOWS\System32\windows.storage.dll
x64-BHO: True Key Helper: {0F4B8786-5502-4803-8EBC-F652A1153BB6} - C:\Program Files\Intel Security\True Key\MSIE\truekey_ie64.dll
x64-BHO: Skype for Business Browser Helper: {31D09BA0-12F5-4CCE-BE8A-2923E76605DA} - C:\Program Files\Microsoft Office 15\root\vfs\ProgramFilesX64\Microsoft Office\Office15\ochelper.dll
x64-BHO: Norton Identity Safety: {602ADB0E-4AFF-4217-8AA1-95DAC4DFA408} - C:\Program Files (x86)\Norton Internet Security\Engine\22.10.1.10\coIEPlg.dll
x64-BHO: Microsoft SkyDrive Pro Browser Helper: {D0498E0A-45B7-42AE-A9AA-ABA463DBD3BF} - C:\Program Files\Microsoft Office 15\root\vfs\ProgramFilesX64\Microsoft Office\Office15\grooveex.dll
x64-TB: Norton Toolbar: {7FEBEFE3-6B19-4349-98D2-FFB09D4B49CA} - C:\Program Files (x86)\Norton Internet Security\Engine\22.10.1.10\coIEPlg.dll
x64-TB: True Key: {4BAAC1B8-0800-42C9-8FA6-08B211F356B8} - C:\Program Files\Intel Security\True Key\MSIE\truekey_ie64.dll
x64-Run: [SecurityHealth] C:\Program Files (x86)\Windows Defender\MSASCuiL.exe
x64-Run: [RTHDVCPL] "C:\Program Files\Realtek\Audio\HDA\RtkNGUI64.exe" -s
x64-Run: [RtHDVBg] "C:\Program Files\Realtek\Audio\HDA\RAVBg64.exe" /MAXX4
x64-Run: [IAStorIcon] "C:\Program Files\Intel\Intel(R) Rapid Storage Technology\IAStorIconLaunch.exe" "C:\Program Files\Intel\Intel(R) Rapid Storage Technology\IAStorIcon.exe" 60
x64-Run: [lxecmon.exe] "C:\Program Files (x86)\Lexmark Pro800-Pro900 Series\lxecmon.exe"
x64-Run: [EzPrint] "C:\Program Files (x86)\Lexmark Pro800-Pro900 Series\ezprint.exe"
x64-Run: [NvBackend] "C:\Program Files (x86)\NVIDIA Corporation\Update Core\NvBackend.exe"
x64-Run: [ShadowPlay] C:\WINDOWS\System32\rundll32.exe C:\WINDOWS\System32\nvspcap64.dll,ShadowPlayOnSystemStart
x64-Run: [Malwarebytes TrayApp] C:\PROGRAM FILES\MALWAREBYTES\ANTI-MALWARE\mbamtray.exe
x64-mPolicies-System: DSCAutomationHostEnabled = dword:2
x64-IE: {2670000A-7350-4f3c-8081-5663EE0C6C49} - {48E73304-E1D6-4330-914C-F5F514E3486C} - C:\Program Files\Microsoft Office 15\root\vfs\ProgramFilesX64\Microsoft Office\Office15\onbttnie.dll
x64-IE: {31D09BA0-12F5-4CCE-BE8A-2923E76605DA} - {31D09BA0-12F5-4CCE-BE8A-2923E76605DA} - C:\Program Files\Microsoft Office 15\root\vfs\ProgramFilesX64\Microsoft Office\Office15\ochelper.dll
x64-IE: {789FE86F-6FC4-46A1-9849-EDE0DB0C95CA} - {FFFDC614-B694-4AE6-AB38-5D6374584B52} - C:\Program Files\Microsoft Office 15\root\vfs\ProgramFilesX64\Microsoft Office\Office15\ONBttnIELinkedNotes.dll
x64-Handler: osf - {D924BDC6-C83A-4BD5-90D0-095128A113D1} - <orphaned>
x64-Handler: tbauth - {14654CA6-5711-491D-B89A-58E571679951} - C:\WINDOWS\System32\tbauth.dll
x64-Handler: windows.tbauth - {14654CA6-5711-491D-B89A-58E571679951} - C:\WINDOWS\System32\tbauth.dll
x64-Handler: wlpg - {E43EF6CD-A37A-4A9B-9E6F-83F89B8E6324} - <orphaned>
x64-SSODL: WebCheck - <orphaned>
x64-mASetup: {2C7339CF-2B09-4501-B3F3-F3508C9228ED} - /UserInstall
x64-mASetup: {89820200-ECBD-11cf-8B85-00AA005B4340} - U
x64-mASetup: {8A69D345-D564-463c-AFF1-A69D9E530F96} - "C:\Program Files (x86)\Google\Chrome\Application\60.0.3112.113\Installer\chrmstp.exe" --configure-user-settings --verbose-logging --system-level
x64-CLSID: {603D3801-BD81-11d0-A3A5-00C04FD706EC} - C:\WINDOWS\System32\windows.storage.dll
.
================= FIREFOX ===================
.
FF - ProfilePath -
.
============= SERVICES / DRIVERS ===============
.
R0 amdkmpfd;AMD PCI Root Bus Lower Filter;C:\WINDOWS\System32\drivers\amdkmpfd.sys [2015-6-4 73976]
R0 iaStorA;iaStorA;C:\WINDOWS\System32\drivers\iaStorA.sys [2013-11-11 644968]
R0 intelpep;Intel(R) Power Engine Plug-in Driver;C:\WINDOWS\System32\drivers\intelpep.sys [2017-3-18 74840]
R0 iorate;Disk I/O Rate Filter Driver;C:\WINDOWS\System32\drivers\iorate.sys [2017-3-18 49568]
R0 MBAMChameleon;MBAMChameleon;C:\WINDOWS\System32\drivers\MBAMChameleon.sys [2017-1-26 188352]
R0 mfehidk;McAfee Inc. mfehidk;C:\WINDOWS\System32\drivers\mfehidk.sys [2013-7-24 786296]
R0 mfewfpk;McAfee Inc. mfewfpk;C:\WINDOWS\System32\drivers\mfewfpk.sys [2013-7-24 348552]
R0 SymEFASI;Symantec Extended File Attributes (SI);C:\WINDOWS\System32\drivers\NISx64\160A010.00A\symefasi64.sys [2017-9-1 1868416]
R0 volume;Volume driver;C:\WINDOWS\System32\drivers\volume.sys [2017-3-18 16288]
R0 WindowsTrustedRT;Windows Trusted Execution Environment Class Extension;C:\WINDOWS\System32\drivers\WindowsTrustedRT.sys [2017-3-18 70232]
R0 WindowsTrustedRTProxy;Microsoft Windows Trusted Runtime Secure Service;C:\WINDOWS\System32\drivers\WindowsTrustedRTProxy.sys [2017-3-18 18520]
R0 Wof;Windows Overlay File System Filter Driver;C:\WINDOWS\System32\drivers\wof.sys [2017-3-18 208288]
R1 ahcache;Application Compatibility Cache;C:\WINDOWS\System32\drivers\ahcache.sys [2017-3-18 239616]
R1 BHDrvx64;BHDrvx64;C:\Program Files (x86)\Norton Internet Security\NortonData\22.5.0.124\Definitions\BASHDefs\20170906.001\BHDrvx64.sys [2017-9-9 1862816]
R1 ccSet_NIS;NIS Settings Manager;C:\WINDOWS\System32\drivers\NISx64\160A010.00A\ccsetx64.sys [2017-9-1 187520]
R1 ESProtectionDriver;Malwarebytes Anti-Exploit;C:\WINDOWS\System32\drivers\mbae64.sys [2017-1-26 77376]
R1 FileCrypt;FileCrypt;C:\WINDOWS\System32\drivers\filecrypt.sys [2017-3-18 54272]
R1 GpuEnergyDrv;GPU Energy Driver;C:\WINDOWS\System32\drivers\gpuenergydrv.sys [2017-3-18 8192]
R1 IDSVia64;IDSVia64;C:\Program Files (x86)\Norton Internet Security\NortonData\22.5.0.124\Definitions\IPSDefs\20170909.001\IDSvia64.sys [2017-9-9 1056920]
R1 SASDIFSV;SASDIFSV;C:\Program Files\SUPERAntiSpyware\sasdifsv64.sys [2011-7-22 14928]
R1 SASKUTIL;SASKUTIL;C:\Program Files\SUPERAntiSpyware\saskutil64.sys [2011-7-12 12368]
R1 SymIRON;Symantec Iron Driver;C:\WINDOWS\System32\drivers\NISx64\160A010.00A\ironx64.sys [2017-9-1 301288]
R1 SymNetS;Symantec Network Security WFP Driver;C:\WINDOWS\System32\drivers\NISx64\160A010.00A\symnets.sys [2017-9-1 566912]
R2 !SASCORE;SAS Core Service;C:\Program Files\SUPERAntiSpyware\SASCORE64.EXE [2014-7-22 173472]
R2 APC Data Service;APC Data Service;C:\Program Files (x86)\APC\PowerChute Personal Edition\dataserv.exe [2012-1-24 21880]
R2 asComSvc;ASUS Com Service;C:\Program Files (x86)\ASUS\AXSP\1.00.19\atkexComSvc.exe [2014-2-28 920736]
R2 Asus WebStorage Windows Service;Asus WebStorage Windows Service;C:\Program Files (x86)\ASUS\WebStorage Sync Agent\1.1.18.159\AsusWSWinService.exe [2012-12-19 72192]
R2 CDPSvc;Connected Devices Platform Service;C:\WINDOWS\System32\svchost.exe -k LocalService [2017-3-18 47664]
R2 CDPUserSvc_1dab56a4;Connected Devices Platform User Service_1dab56a4;C:\WINDOWS\System32\svchost.exe -k UnistackSvcGroup [2017-3-18 47664]
R2 ClickToRunSvc;Microsoft Office ClickToRun Service;C:\Program Files\Microsoft Office 15\ClientX64\officeclicktorun.exe [2014-11-16 3042544]
R2 clreg;Virtual Registry for Containers;C:\WINDOWS\System32\drivers\registry.sys [2017-3-18 14336]
R2 CoreMessagingRegistrar;CoreMessaging;C:\WINDOWS\System32\svchost.exe -k LocalServiceNoNetwork [2017-3-18 47664]
R2 Device Handle Service;Device Handle Service;C:\Windows\SysWOW64\AsHookDevice.exe [2014-2-28 207160]
R2 DiagTrack;Connected User Experiences and Telemetry;C:\WINDOWS\System32\svchost.exe -k utcsvc [2017-3-18 47664]
R2 DusmSvc;Data Usage;C:\WINDOWS\System32\svchost.exe -k LocalServiceNetworkRestricted [2017-3-18 47664]
R2 Fabs;FABS - Helping agent for MAGIX media database;C:\Program Files (x86)\Common Files\MAGIX Services\Database\bin\FABS.exe [2012-1-23 1858048]
R2 GfExperienceService;NVIDIA GeForce Experience Service;C:\Program Files\NVIDIA Corporation\GeForce Experience Service\GfExperienceService.exe [2015-10-16 1156384]
R2 IAStorDataMgrSvc;Intel(R) Rapid Storage Technology;C:\Program Files\Intel\Intel(R) Rapid Storage Technology\IAStorDataMgrSvc.exe [2013-8-7 15720]
R2 Intel(R) Capability Licensing Service Interface;Intel(R) Capability Licensing Service Interface;C:\Program Files\Intel\iCLS Client\HeciServer.exe [2013-5-11 733696]
R2 Intel(R) PROSet Monitoring Service;Intel(R) PROSet Monitoring Service;C:\WINDOWS\System32\IPROSetMonitor.exe [2013-7-9 195336]
R2 jhi_service;Intel(R) Dynamic Application Loader Host Interface Service;C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\DAL\jhi_service.exe [2014-2-28 169432]
R2 lxec_device;lxec_device;C:\WINDOWS\System32\lxeccoms.exe -service --> C:\WINDOWS\System32\lxeccoms.exe -service [?]
R2 MBAMService;Malwarebytes Service;C:\Program Files\Malwarebytes\Anti-Malware\MBAMService.exe [2017-1-26 4470736]
R2 mfefire;McAfee Firewall Core Service;C:\Program Files\Common Files\mcafee\systemcore\mfefire.exe [2013-11-11 219752]
R2 mfevtp;McAfee Validation Trust Protection Service;C:\WINDOWS\System32\mfevtps.exe [2013-11-11 189912]
R2 NIS;Norton Internet Security;C:\Program Files (x86)\Norton Internet Security\Engine\22.10.1.10\nis.exe [2017-9-1 326144]
R2 NVDisplay.ContainerLocalSystem;NVIDIA Display Container LS;C:\Program Files\NVIDIA Corporation\Display.NvContainer\NVDisplay.Container.exe [2017-3-3 458176]
R2 NvNetworkService;NVIDIA Network Service;C:\Program Files (x86)\NVIDIA Corporation\NetService\NvNetworkService.exe [2015-10-16 1873696]
R2 NvStreamSvc;NVIDIA Streamer Service;C:\Program Files\NVIDIA Corporation\NvStreamSrv\NvStreamService.exe [2015-10-16 5568288]
R2 OneSyncSvc_1dab56a4;Sync Host_1dab56a4;C:\WINDOWS\System32\svchost.exe -k UnistackSvcGroup [2017-3-18 47664]
R2 RichVideo64;Cyberlink RichVideo64 Service(CRVS);C:\Program Files\CyberLink\Shared files\RichVideo64.exe [2013-11-11 390632]
R2 SecurityHealthService;Windows Defender Security Center Service;C:\WINDOWS\System32\SecurityHealthService.exe [2017-7-13 336320]
R2 storqosflt;Storage QoS Filter Driver;C:\WINDOWS\System32\drivers\storqosflt.sys [2017-3-18 79872]
R2 tiledatamodelsvc;Tile Data model server;C:\WINDOWS\System32\svchost.exe -k appmodel [2017-3-18 47664]
R2 TrueKey;Intel Security True Key;C:\Program Files\TrueKey\McAfee.TrueKey.Service.exe [2017-7-6 1001920]
R2 TrueKeyScheduler;Intel Security True Key Scheduler;C:\Program Files\TrueKey\McTkSchedulerService.exe [2016-5-2 16928]
R2 UserManager;User Manager;C:\WINDOWS\System32\svchost.exe -k netsvcs [2017-3-18 47664]
R2 wcifs;Windows Container Isolation;C:\WINDOWS\System32\drivers\wcifs.sys [2017-7-13 142752]
R2 WpnService;Windows Push Notifications System Service;C:\WINDOWS\System32\svchost.exe -k netsvcs [2017-3-18 47664]
R2 WpnUserService_1dab56a4;Windows Push Notifications User Service_1dab56a4;C:\WINDOWS\System32\svchost.exe -k UnistackSvcGroup [2017-3-18 47664]
R3 AmUStor;AM USB Stroage Driver;C:\WINDOWS\System32\drivers\AmUStor.sys [2013-7-5 98984]
R3 BthLEEnum;Bluetooth Low Energy Driver;C:\WINDOWS\System32\drivers\Microsoft.Bluetooth.Legacy.LEEnumerator.sys [2017-8-10 97280]
R3 CAD;Charge Arbitration Driver;C:\WINDOWS\System32\drivers\CAD.sys [2017-3-18 53664]
R3 DsSvc;Data Sharing Service;C:\WINDOWS\System32\svchost.exe -k LocalSystemNetworkRestricted [2017-3-18 47664]
R3 EraserUtilRebootDrv;EraserUtilRebootDrv;C:\Program Files (x86)\Common Files\Symantec Shared\EENGINE\EraserUtilRebootDrv.sys [2017-7-1 158336]
R3 lfsvc;Geolocation Service;C:\WINDOWS\System32\svchost.exe -k netsvcs [2017-3-18 47664]
R3 LicenseManager;Windows License Manager Service;C:\WINDOWS\System32\svchost.exe -k LocalService [2017-3-18 47664]
R3 MBAMFarflt;MBAMFarflt;C:\WINDOWS\System32\drivers\farflt.sys [2017-1-27 101784]
R3 MBAMProtection;MBAMProtection;C:\WINDOWS\System32\drivers\mbam.sys [2017-1-26 45472]
R3 MBAMSwissArmy;MBAMSwissArmy;C:\WINDOWS\System32\drivers\MBAMSwissArmy.sys [2017-1-26 253856]
R3 MBAMWebProtection;MBAMWebProtection;C:\WINDOWS\System32\drivers\mwac.sys [2017-1-26 93600]
R3 mfeavfk;McAfee Inc. mfeavfk;C:\WINDOWS\System32\drivers\mfeavfk.sys [2013-7-24 313544]
R3 mfefirek;McAfee Inc. mfefirek;C:\WINDOWS\System32\drivers\mfefirek.sys [2013-7-24 523792]
R3 NcbService;Network Connection Broker;C:\WINDOWS\System32\svchost.exe -k LocalSystemNetworkRestricted [2017-3-18 47664]
R3 NdisVirtualBus;Microsoft Virtual Network Adapter Enumerator;C:\WINDOWS\System32\drivers\NdisVirtualBus.sys [2017-3-18 20992]
R3 nvvad_WaveExtensible;NVIDIA Virtual Audio Device (Wave Extensible) (WDM);C:\WINDOWS\System32\drivers\nvvad64v.sys [2015-10-16 50472]
R3 PimIndexMaintenanceSvc_1dab56a4;Contact Data_1dab56a4;C:\WINDOWS\System32\svchost.exe -k UnistackSvcGroup [2017-3-18 47664]
R3 RtkBtFilter;Realtek Bluetooth Filter Driver;C:\WINDOWS\System32\drivers\RtkBtfilter.sys [2016-2-25 607488]
R3 RTWlanE;Realtek Wireless LAN 802.11n PCI-E Network Adapter;C:\WINDOWS\System32\drivers\rtwlane.sys [2017-5-3 6804480]
R3 SensorService;Sensor Service;C:\WINDOWS\System32\svchost.exe -k LocalSystemNetworkRestricted [2017-3-18 47664]
R3 StateRepository;State Repository Service;C:\WINDOWS\System32\svchost.exe -k appmodel [2017-3-18 47664]
R3 TimeBrokerSvc;Time Broker;C:\WINDOWS\System32\svchost.exe -k LocalServiceNetworkRestricted [2017-3-18 47664]
R3 TokenBroker;TokenBroker;C:\WINDOWS\System32\svchost.exe -k netsvcs [2017-3-18 47664]
R3 UEFI;Microsoft UEFI Driver;C:\WINDOWS\System32\drivers\uefi.sys [2017-3-18 29600]
R3 UnistoreSvc_1dab56a4;User Data Storage_1dab56a4;C:\WINDOWS\System32\svchost.exe -k UnistackSvcGroup [2017-3-18 47664]
R3 UserDataSvc_1dab56a4;User Data Access_1dab56a4;C:\WINDOWS\System32\svchost.exe -k UnistackSvcGroup [2017-3-18 47664]
R3 wdiwifi;WDI Driver Framework;C:\WINDOWS\System32\drivers\WdiWiFi.sys [2017-7-13 757248]
S0 mfeelamk;McAfee Inc. mfeelamk;C:\WINDOWS\System32\drivers\mfeelamk.sys [2013-7-24 70600]
S0 SymELAM;Symantec ELAM Driver;C:\WINDOWS\System32\drivers\NISx64\160A010.00A\symelam.sys [2017-9-1 24608]
S2 CldFlt;Windows Cloud Files Filter Driver;C:\WINDOWS\System32\drivers\cldflt.sys [2017-3-18 12288]
S2 DoSvc;Delivery Optimization;C:\WINDOWS\System32\svchost.exe -k netsvcs [2017-3-18 47664]
S2 MapsBroker;Downloaded Maps Manager;C:\WINDOWS\System32\svchost.exe -k NetworkService [2017-3-18 47664]
S3 AcpiDev;ACPI Devices driver;C:\WINDOWS\System32\drivers\AcpiDev.sys [2017-3-18 20480]
S3 ADP80XX;ADP80XX;C:\WINDOWS\System32\drivers\adp80xx.sys [2017-3-18 1135512]
S3 AJRouter;AllJoyn Router Service;C:\WINDOWS\System32\svchost.exe -k LocalServiceNetworkRestricted [2017-3-18 47664]
S3 applockerfltr;Smartlocker Filter Driver;C:\WINDOWS\System32\drivers\applockerfltr.sys [2017-3-18 17920]
S3 AppReadiness;App Readiness;C:\WINDOWS\System32\svchost.exe -k AppReadiness [2017-3-18 47664]
S3 AppXSvc;AppX Deployment Service (AppXSVC);C:\WINDOWS\System32\svchost.exe -k wsappx [2017-3-18 47664]
S3 bcmfn2;bcmfn2 Service;C:\WINDOWS\System32\drivers\bcmfn2.sys [2017-3-18 9728]
S3 BthHFSrv;Bluetooth Handsfree Service;C:\WINDOWS\System32\svchost.exe -k LocalServiceAndNoImpersonation [2017-3-18 47664]
S3 buttonconverter;Service for Portable Device Control devices;C:\WINDOWS\System32\drivers\buttonconverter.sys [2017-3-18 39424]
S3 CapImg;HID driver for CapImg touch screen;C:\WINDOWS\System32\drivers\capimg.sys [2017-3-18 122880]
S3 cfwids;McAfee Inc. cfwids;C:\WINDOWS\System32\drivers\cfwids.sys [2013-7-24 72128]
S3 cht4iscsi;cht4iscsi;C:\WINDOWS\System32\drivers\cht4sx64.sys [2017-3-18 347032]
S3 cht4vbd;Chelsio Virtual Bus Driver;C:\WINDOWS\System32\drivers\cht4vx64.sys [2017-3-18 2104224]
S3 ClipSVC;Client License Service (ClipSVC);C:\WINDOWS\System32\svchost.exe -k wsappx [2017-3-18 47664]
S3 DevicesFlowUserSvc_1dab56a4;DevicesFlow_1dab56a4;C:\WINDOWS\System32\svchost.exe -k DevicesFlow [2017-3-18 47664]
S3 DevQueryBroker;DevQuery Background Discovery Broker;C:\WINDOWS\System32\svchost.exe -k LocalSystemNetworkRestricted [2017-3-18 47664]
S3 diagnosticshub.standardcollector.service;Microsoft (R) Diagnostics Hub Standard Collector Service;C:\WINDOWS\System32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe [2017-3-18 86528]
S3 DmEnrollmentSvc;Device Management Enrollment Service;C:\WINDOWS\System32\svchost.exe -k netsvcs [2017-3-18 47664]
S3 dmwappushservice;dmwappushsvc;C:\WINDOWS\System32\svchost.exe -k netsvcs [2017-3-18 47664]
S3 embeddedmode;Embedded Mode;C:\WINDOWS\System32\svchost.exe -k LocalSystemNetworkRestricted [2017-3-18 47664]
S3 EntAppSvc;Enterprise App Management Service;C:\WINDOWS\System32\svchost.exe -k appmodel [2017-3-18 47664]
S3 FirebirdServerMAGIXInstance;Firebird Server - MAGIX Instance;C:\Program Files (x86)\Common Files\MAGIX Services\Database\bin\fbserver.exe [2011-4-26 2702848]
S3 FrameServer;Windows Camera Frame Server;C:\WINDOWS\System32\svchost.exe -k Camera [2017-3-18 47664]
S3 genericusbfn;Generic USB Function Class;C:\WINDOWS\System32\drivers\genericusbfn.sys [2017-3-18 21504]
S3 hidinterrupt;Common Driver for HID Buttons implemented with interrupts;C:\WINDOWS\System32\drivers\hidinterrupt.sys [2017-3-18 51104]
S3 HvHost;HV Host Service;C:\WINDOWS\System32\svchost.exe -k LocalSystemNetworkRestricted [2017-3-18 47664]
S3 iagpio;Intel Serial IO GPIO Controller Driver;C:\WINDOWS\System32\drivers\iagpio.sys [2017-3-18 33280]
S3 iai2c;Intel(R) Serial IO I2C Host Controller;C:\WINDOWS\System32\drivers\iai2c.sys [2017-3-18 81408]
S3 iaLPSS2i_GPIO2;Intel(R) Serial IO GPIO Driver v2;C:\WINDOWS\System32\drivers\iaLPSS2i_GPIO2.sys [2017-3-18 70656]
S3 iaLPSS2i_GPIO2_BXT_P;Intel(R) Serial IO GPIO Driver v2;C:\WINDOWS\System32\drivers\iaLPSS2i_GPIO2_BXT_P.sys [2017-3-18 85504]
S3 iaLPSS2i_I2C;Intel(R) Serial IO I2C Driver v2;C:\WINDOWS\System32\drivers\iaLPSS2i_I2C.sys [2017-3-18 165376]
S3 iaLPSS2i_I2C_BXT_P;Intel(R) Serial IO I2C Driver v2;C:\WINDOWS\System32\drivers\iaLPSS2i_I2C_BXT_P.sys [2017-3-18 168448]
S3 iaLPSSi_GPIO;Intel(R) Serial IO GPIO Controller Driver;C:\WINDOWS\System32\drivers\iaLPSSi_GPIO.sys [2017-3-18 38128]
S3 iaLPSSi_I2C;Intel(R) Serial IO I2C Controller Driver;C:\WINDOWS\System32\drivers\iaLPSSi_I2C.sys [2017-3-18 113152]
S3 iaStorAV;Intel(R) SATA RAID Controller Windows;C:\WINDOWS\System32\drivers\iaStorAV.sys [2017-3-18 673184]
S3 ibbus;Mellanox InfiniBand Bus/AL (Filter Driver);C:\WINDOWS\System32\drivers\ibbus.sys [2017-3-18 526240]
S3 icssvc;Windows Mobile Hotspot Service;C:\WINDOWS\System32\svchost.exe -k LocalServiceNetworkRestricted [2017-3-18 47664]
S3 IndirectKmd;Indirect Displays Kernel-Mode Driver;C:\WINDOWS\System32\drivers\IndirectKmd.sys [2017-3-18 36864]
S3 Intel(R) Capability Licensing Service TCP IP Interface;Intel(R) Capability Licensing Service TCP IP Interface;C:\Program Files\Intel\iCLS Client\SocketHeciServer.exe [2013-5-11 822232]
S3 IpxlatCfgSvc;IP Translation Configuration Service;C:\WINDOWS\System32\svchost.exe -k LocalSystemNetworkRestricted [2017-3-18 47664]
S3 LSI_SAS2i;LSI_SAS2i;C:\WINDOWS\System32\drivers\lsi_sas2i.sys [2017-3-18 123808]
S3 LSI_SAS3i;LSI_SAS3i;C:\WINDOWS\System32\drivers\lsi_sas3i.sys [2017-3-18 103328]
S3 mausbhost;MA-USB Host Controller Driver;C:\WINDOWS\System32\drivers\mausbhost.sys [2017-3-18 405408]
S3 mausbip;MA-USB IP Filter Driver;C:\WINDOWS\System32\drivers\mausbip.sys [2017-3-18 51104]
S3 megasas2i;megasas2i;C:\WINDOWS\System32\drivers\MegaSas2i.sys [2017-3-18 64416]
S3 MessagingService_1dab56a4;MessagingService_1dab56a4;C:\WINDOWS\System32\svchost.exe -k UnistackSvcGroup [2017-3-18 47664]
S3 mlx4_bus;Mellanox ConnectX Bus Enumerator;C:\WINDOWS\System32\drivers\mlx4_bus.sys [2017-3-18 842656]
S3 NaturalAuthentication;Natural Authentication;C:\WINDOWS\System32\svchost.exe -k netsvcs [2017-3-18 47664]
S3 ndfltr;NetworkDirect Service;C:\WINDOWS\System32\drivers\ndfltr.sys [2017-3-18 108960]
S3 NetAdapterCx;Network Adapter Wdf Class Extension Library;C:\WINDOWS\System32\drivers\NetAdapterCx.sys [2017-3-18 122368]
S3 NetSetupSvc;Network Setup Service;C:\WINDOWS\System32\svchost.exe -k netsvcs [2017-3-18 47664]
S3 netvsc;netvsc;C:\WINDOWS\System32\drivers\netvsc.sys [2017-6-15 118784]
S3 NgcCtnrSvc;Microsoft Passport Container;C:\WINDOWS\System32\svchost.exe -k LocalServiceNetworkRestricted [2017-3-18 47664]
S3 NgcSvc;Microsoft Passport;C:\WINDOWS\System32\svchost.exe -k LocalSystemNetworkRestricted [2017-3-18 47664]
S3 nvdimmn;Microsoft NVDIMM-N device driver;C:\WINDOWS\System32\drivers\nvdimmn.sys [2017-3-18 80896]
S3 percsas2i;percsas2i;C:\WINDOWS\System32\drivers\percsas2i.sys [2017-3-18 58784]
S3 percsas3i;percsas3i;C:\WINDOWS\System32\drivers\percsas3i.sys [2017-3-18 61848]
S3 PhoneSvc;Phone Service;C:\WINDOWS\System32\svchost.exe -k LocalService [2017-3-18 47664]
S3 ReFS;ReFS;C:\WINDOWS\System32\drivers\refs.sys [2017-3-18 1735584]
S3 ReFSv1;ReFSv1;C:\WINDOWS\System32\drivers\refsv1.sys [2017-3-18 936864]
S3 RetailDemo;Retail Demo Service;C:\WINDOWS\System32\svchost.exe -k rdxgroup [2017-3-18 47664]
S3 ScDeviceEnum;Smart Card Device Enumeration Service;C:\WINDOWS\System32\svchost.exe -k LocalSystemNetworkRestricted [2017-3-18 47664]
S3 scmbus;Microsoft Storage Class Memory Bus Driver;C:\WINDOWS\System32\drivers\scmbus.sys [2017-3-18 91040]
S3 SDFRd;SDF Reflector;C:\WINDOWS\System32\drivers\SDFRd.sys [2017-3-18 31128]
S3 SEMgrSvc;Payments and NFC/SE Manager;C:\WINDOWS\System32\svchost.exe -k LocalService [2017-3-18 47664]
S3 SensorDataService;Sensor Data Service;C:\WINDOWS\System32\SensorDataService.exe [2017-3-18 1284608]
S3 SerCx2;Serial UART Support Library;C:\WINDOWS\System32\drivers\SerCx2.sys [2017-3-18 154016]
S3 smphost;Microsoft Storage Spaces SMP;C:\WINDOWS\System32\svchost.exe -k smphost [2017-3-18 47664]
S3 SmsRouter;Microsoft Windows SMS Router Service.;C:\WINDOWS\System32\svchost.exe -k LocalSystemNetworkRestricted [2017-3-18 47664]
S3 SpatialGraphFilter;Holographic Spatial Graph Filter;C:\WINDOWS\System32\drivers\SpatialGraphFilter.sys [2017-3-18 40352]
S3 spectrum;Windows Perception Service;C:\WINDOWS\System32\Spectrum.exe [2017-3-18 891904]
S3 stornvme;Microsoft Standard NVM Express Driver;C:\WINDOWS\System32\drivers\stornvme.sys [2017-3-18 95648]
S3 storufs;Microsoft Universal Flash Storage (UFS) Driver;C:\WINDOWS\System32\drivers\storufs.sys [2017-3-18 36760]
S3 TieringEngineService;Storage Tiers Management;C:\WINDOWS\System32\TieringEngineService.exe [2017-3-18 302592]
S3 TrueKeyServiceHelper;Intel Security True Key Helper Service;C:\Program Files\TrueKey\McAfee.TrueKey.ServiceHelper.exe [2017-7-6 87760]
S3 UcmCx0101;USB Connector Manager KMDF Class Extension;C:\WINDOWS\System32\drivers\UcmCx.sys [2017-3-18 104448]
S3 UcmTcpciCx0101;UCM-TCPCI KMDF Class Extension;C:\WINDOWS\System32\drivers\UcmTcpciCx.sys [2017-3-18 179200]
S3 UcmUcsi;USB Connector Manager UCSI Client;C:\WINDOWS\System32\drivers\UcmUcsi.sys [2017-8-10 51712]
S3 UdeCx;USB Device Emulation Support Library;C:\WINDOWS\System32\drivers\Udecx.sys [2017-3-18 45568]
S3 Ufx01000;USB Function Class Extension;C:\WINDOWS\System32\drivers\ufx01000.sys [2017-3-18 263584]
S3 UfxChipidea;USB Chipidea Controller;C:\WINDOWS\System32\drivers\UfxChipidea.sys [2017-3-18 98712]
S3 ufxsynopsys;USB Synopsys Controller;C:\WINDOWS\System32\drivers\ufxsynopsys.sys [2017-3-18 138656]
S3 UrsChipidea;Chipidea USB Role-Switch Driver;C:\WINDOWS\System32\drivers\urschipidea.sys [2017-3-18 29600]
S3 UrsCx01000;USB Role-Switch Support Library;C:\WINDOWS\System32\drivers\urscx01000.sys [2017-3-18 59288]
S3 UrsSynopsys;Synopsys USB Role-Switch Driver;C:\WINDOWS\System32\drivers\urssynopsys.sys [2017-3-18 28064]
S3 UsoSvc;Update Orchestrator Service;C:\WINDOWS\System32\svchost.exe -k netsvcs [2017-3-18 47664]
S3 vhf;Virtual HID Framework (VHF) Driver;C:\WINDOWS\System32\drivers\vhf.sys [2017-3-18 35328]
S3 vmgid;Microsoft Hyper-V Guest Infrastructure Driver;C:\WINDOWS\System32\drivers\vmgid.sys [2017-3-18 10240]
S3 vmicguestinterface;Hyper-V Guest Service Interface;C:\WINDOWS\System32\svchost.exe -k LocalSystemNetworkRestricted [2017-3-18 47664]
S3 vmicvmsession;Hyper-V PowerShell Direct Service;C:\WINDOWS\System32\svchost.exe -k LocalSystemNetworkRestricted [2017-3-18 47664]
S3 WalletService;WalletService;C:\WINDOWS\System32\svchost.exe -k appmodel [2017-3-18 47664]
S3 wcnfs;Windows Container Name Virtualization;C:\WINDOWS\System32\drivers\wcnfs.sys [2017-3-18 72192]
S3 WdNisDrv;Windows Defender Antivirus Network Inspection System Driver;C:\WINDOWS\System32\drivers\WdNisDrv.sys [2017-3-18 121248]
S3 WdNisSvc;Windows Defender Antivirus Network Inspection Service;C:\Program Files\Windows Defender\NisSrv.exe [2017-3-18 342264]
S3 WEPHOSTSVC;Windows Encryption Provider Host Service;C:\WINDOWS\System32\svchost.exe -k WepHostSvcGroup [2017-3-18 47664]
S3 WFDSConMgrSvc;Wi-Fi Direct Services Connection Manager Service;C:\WINDOWS\System32\svchost.exe -k LocalServiceNetworkRestricted [2017-3-18 47664]
S3 WinMad;WinMad Service;C:\WINDOWS\System32\drivers\winmad.sys [2017-3-18 32160]
S3 WinNat;Windows NAT Driver;C:\WINDOWS\System32\drivers\winnat.sys [2017-3-18 217088]
S3 WinVerbs;WinVerbs Service;C:\WINDOWS\System32\drivers\winverbs.sys [2017-3-18 64920]
S3 wisvc;Windows Insider Service;C:\WINDOWS\System32\svchost.exe -k netsvcs [2017-3-18 47664]
S3 wlpasvc;LPA Service;C:\WINDOWS\System32\svchost.exe -k LocalService [2017-3-18 47664]
S3 workfolderssvc;Work Folders;C:\WINDOWS\System32\svchost.exe -k LocalService [2017-3-18 47664]
S3 xbgm;Xbox Game Monitoring;C:\WINDOWS\System32\svchost.exe -k netsvcs [2017-3-18 47664]
S3 XblAuthManager;Xbox Live Auth Manager;C:\WINDOWS\System32\svchost.exe -k netsvcs [2017-3-18 47664]
S3 XblGameSave;Xbox Live Game Save;C:\WINDOWS\System32\svchost.exe -k netsvcs [2017-3-18 47664]
S3 xboxgip;Xbox Game Input Protocol Driver;C:\WINDOWS\System32\drivers\xboxgip.sys [2017-6-15 277504]
S3 XboxGipSvc;Xbox Accessory Management Service;C:\WINDOWS\System32\svchost.exe -k netsvcs [2017-3-18 47664]
S3 XboxNetApiSvc;Xbox Live Networking Service;C:\WINDOWS\System32\svchost.exe -k netsvcs [2017-3-18 47664]
S3 xinputhid;XINPUT HID Filter Driver;C:\WINDOWS\System32\drivers\xinputhid.sys [2017-3-18 46592]
S4 shpamsvc;Shared PC Account Manager;C:\WINDOWS\System32\svchost.exe -k netsvcs [2017-3-18 47664]
S4 tzautoupdate;Auto Time Zone Updater;C:\WINDOWS\System32\svchost.exe -k LocalService [2017-3-18 47664]
.
=============== File Associations ===============
.
FileExt: .txt: txtfile=C:\WINDOWS\System32\NOTEPAD.EXE %1 [UserChoice]
.
=============== Created Last 30 ================
.
2017-09-01 04:18:27 566912 ----a-w- C:\WINDOWS\System32\drivers\NISx64\160A010.00A\symnets.sys
2017-09-01 04:18:27 49304 ----a-w- C:\WINDOWS\System32\drivers\NISx64\160A010.00A\srtspx64.sys
2017-09-01 04:18:27 24608 ----a-w- C:\WINDOWS\System32\drivers\NISx64\160A010.00A\symelam.sys
2017-09-01 04:18:27 1868416 ----a-w- C:\WINDOWS\System32\drivers\NISx64\160A010.00A\symefasi64.sys
2017-09-01 04:18:26 810136 ----a-w- C:\WINDOWS\System32\drivers\NISx64\160A010.00A\srtsp64.sys
2017-09-01 04:18:25 301288 ----a-w- C:\WINDOWS\System32\drivers\NISx64\160A010.00A\ironx64.sys
2017-09-01 04:18:25 187520 ----a-w- C:\WINDOWS\System32\drivers\NISx64\160A010.00A\ccsetx64.sys
2017-09-01 04:17:54 -------- d-----w- C:\WINDOWS\System32\drivers\NISx64\160A010.00A
.
==================== Find3M ====================
.
2017-09-10 19:57:16 93600 ----a-w- C:\WINDOWS\System32\drivers\mwac.sys
2017-08-28 07:24:16 101784 ----a-w- C:\WINDOWS\System32\drivers\farflt.sys
2017-08-28 07:24:15 45472 ----a-w- C:\WINDOWS\System32\drivers\mbam.sys
2017-08-28 07:24:14 253856 ----a-w- C:\WINDOWS\System32\drivers\MBAMSwissArmy.sys
2017-08-01 02:39:54 8319392 ----a-w- C:\WINDOWS\System32\ntoskrnl.exe
2017-08-01 02:38:47 406544 ----a-w- C:\WINDOWS\SysWow64\policymanager.dll
2017-08-01 02:38:08 382368 ----a-w- C:\WINDOWS\System32\drivers\clfs.sys
2017-08-01 02:36:56 119712 ----a-w- C:\WINDOWS\System32\drivers\tdx.sys
2017-08-01 02:36:49 323488 ----a-w- C:\WINDOWS\apppatch\AcRes.dll
2017-08-01 02:36:29 750496 ----a-w- C:\WINDOWS\SysWow64\WWAHost.exe
2017-08-01 02:35:13 280472 ----a-w- C:\WINDOWS\SysWow64\WerFault.exe
2017-08-01 02:35:09 133904 ----a-w- C:\WINDOWS\SysWow64\WerFaultSecure.exe
2017-08-01 02:34:39 610584 ----a-w- C:\WINDOWS\SysWow64\wer.dll
2017-08-01 02:34:36 359552 ----a-w- C:\WINDOWS\SysWow64\Faultrep.dll
2017-08-01 02:34:32 349600 ----a-w- C:\WINDOWS\SysWow64\msv1_0.dll
2017-08-01 02:34:32 168864 ----a-w- C:\WINDOWS\SysWow64\wermgr.exe
2017-08-01 02:33:57 473240 ----a-w- C:\WINDOWS\System32\policymanager.dll
2017-08-01 02:32:37 2444704 ----a-w- C:\WINDOWS\System32\drivers\dxgkrnl.sys
2017-08-01 02:32:23 712600 ----a-w- C:\WINDOWS\System32\drivers\dxgmms2.sys
2017-08-01 02:32:04 820128 ----a-w- C:\WINDOWS\System32\WWAHost.exe
2017-08-01 02:31:56 5477088 ----a-w- C:\WINDOWS\System32\OneCoreUAPCommonProxyStub.dll
2017-08-01 02:31:49 212384 ----a-w- C:\WINDOWS\System32\browserbroker.dll
2017-08-01 02:31:01 176024 ----a-w- C:\WINDOWS\SysWow64\basecsp.dll
2017-08-01 02:30:52 315288 ----a-w- C:\WINDOWS\System32\WerFault.exe
2017-08-01 02:30:50 143736 ----a-w- C:\WINDOWS\System32\WerFaultSecure.exe
2017-08-01 02:30:25 723680 ----a-w- C:\WINDOWS\System32\wer.dll
2017-08-01 02:30:21 82336 ----a-w- C:\WINDOWS\System32\drivers\vmbkmcl.sys
2017-08-01 02:30:18 410160 ----a-w- C:\WINDOWS\System32\Faultrep.dll
2017-08-01 02:30:16 182688 ----a-w- C:\WINDOWS\System32\wermgr.exe
2017-08-01 02:30:09 411040 ----a-w- C:\WINDOWS\System32\msv1_0.dll
2017-08-01 02:26:58 204192 ----a-w- C:\WINDOWS\System32\basecsp.dll
2017-08-01 02:20:54 404480 ----a-w- C:\WINDOWS\SysWow64\werui.dll
2017-08-01 02:20:40 154624 ----a-w- C:\WINDOWS\SysWow64\DWWIN.EXE
2017-08-01 02:20:33 2956288 ----a-w- C:\WINDOWS\SysWow64\win32kfull.sys
2017-08-01 02:18:16 13841408 ----a-w- C:\WINDOWS\SysWow64\Windows.UI.Xaml.dll
2017-08-01 02:18:13 2199552 ----a-w- C:\WINDOWS\SysWow64\Windows.UI.Xaml.Resources.dll
2017-08-01 02:17:02 34816 ----a-w- C:\WINDOWS\SysWow64\tokenbinding.dll
2017-08-01 02:16:16 80896 ----a-w- C:\WINDOWS\SysWow64\Chakradiag.dll
2017-08-01 02:14:09 35840 ----a-w- C:\WINDOWS\SysWow64\sscore.dll
2017-08-01 02:13:31 127488 ----a-w- C:\WINDOWS\SysWow64\fdeploy.dll
2017-08-01 02:13:30 20504064 ----a-w- C:\WINDOWS\SysWow64\edgehtml.dll
2017-08-01 02:13:12 364032 ----a-w- C:\WINDOWS\SysWow64\msIso.dll
2017-08-01 02:12:28 229888 ----a-w- C:\WINDOWS\SysWow64\scksp.dll
2017-08-01 02:10:19 358400 ----a-w- C:\WINDOWS\SysWow64\ieproxy.dll
2017-08-01 02:09:58 394240 ----a-w- C:\WINDOWS\SysWow64\Windows.Internal.Management.dll
2017-08-01 02:08:54 267264 ----a-w- C:\WINDOWS\SysWow64\ncryptprov.dll
2017-08-01 02:07:57 2671616 ----a-w- C:\WINDOWS\SysWow64\tquery.dll
2017-08-01 02:07:54 5961728 ----a-w- C:\WINDOWS\SysWow64\Windows.Data.Pdf.dll
2017-08-01 02:06:46 798208 ----a-w- C:\WINDOWS\SysWow64\TokenBroker.dll
2017-08-01 02:04:40 6269440 ----a-w- C:\WINDOWS\SysWow64\Chakra.dll
2017-08-01 02:04:32 3656192 ----a-w- C:\WINDOWS\SysWow64\jscript9.dll
2017-08-01 01:57:22 23677952 ----a-w- C:\WINDOWS\System32\edgehtml.dll
2017-08-01 01:45:44 3670016 ----a-w- C:\WINDOWS\System32\win32kfull.sys
2017-08-01 01:45:28 462848 ----a-w- C:\WINDOWS\System32\werui.dll
2017-08-01 01:45:03 92672 ----a-w- C:\WINDOWS\System32\wercplsupport.dll
2017-08-01 01:45:02 1275392 ----a-w- C:\WINDOWS\System32\werconcpl.dll
2017-08-01 01:44:53 184320 ----a-w- C:\WINDOWS\System32\DWWIN.EXE
2017-08-01 01:44:49 77824 ----a-w- C:\WINDOWS\System32\wsqmcons.exe
2017-08-01 01:44:32 83968 ----a-w- C:\WINDOWS\System32\drivers\vmbkmclr.sys
2017-08-01 01:42:55 2199552 ----a-w- C:\WINDOWS\System32\Windows.UI.Xaml.Resources.dll
2017-08-01 01:41:48 42496 ----a-w- C:\WINDOWS\System32\tokenbinding.dll
2017-08-01 01:41:47 130560 ----a-w- C:\WINDOWS\System32\policymanagerprecheck.dll
2017-08-01 01:41:36 180736 ----a-w- C:\WINDOWS\System32\drivers\rfcomm.sys
2017-08-01 01:41:04 110592 ----a-w- C:\WINDOWS\System32\Chakradiag.dll
2017-08-01 01:40:59 17366528 ----a-w- C:\WINDOWS\System32\Windows.UI.Xaml.dll
2017-08-01 01:40:35 290816 ----a-w- C:\WINDOWS\System32\dmenterprisediagnostics.dll
2017-08-01 01:39:04 46592 ----a-w- C:\WINDOWS\System32\sscore.dll
2017-08-01 01:38:49 143872 ----a-w- C:\WINDOWS\System32\profsvcext.dll
2017-08-01 01:38:21 153088 ----a-w- C:\WINDOWS\System32\fdeploy.dll
2017-08-01 01:37:53 433664 ----a-w- C:\WINDOWS\System32\msIso.dll
2017-08-01 01:37:29 582656 ----a-w- C:\WINDOWS\System32\SmsRouterSvc.dll
2017-08-01 01:37:09 255488 ----a-w- C:\WINDOWS\System32\scksp.dll
2017-08-01 01:35:14 692736 ----a-w- C:\WINDOWS\System32\jscript9diag.dll
2017-08-01 01:34:37 805888 ----a-w- C:\WINDOWS\System32\ieproxy.dll
2017-08-01 01:33:49 1269760 ----a-w- C:\WINDOWS\System32\enterprisecsps.dll
2017-08-01 01:33:28 315904 ----a-w- C:\WINDOWS\System32\ncryptprov.dll
2017-08-01 01:32:47 7336960 ----a-w- C:\WINDOWS\System32\Windows.Data.Pdf.dll
2017-08-01 01:32:37 176640 ----a-w- C:\WINDOWS\System32\wersvc.dll
2017-08-01 01:31:25 4445696 ----a-w- C:\WINDOWS\System32\SettingsHandlers_nt.dll
2017-08-01 01:31:03 1396736 ----a-w- C:\WINDOWS\System32\wwansvc.dll
2017-08-01 01:30:43 8209920 ----a-w- C:\WINDOWS\System32\Chakra.dll
2017-08-01 01:30:42 303104 ----a-w- C:\WINDOWS\System32\srvsvc.dll
2017-08-01 01:30:27 1052160 ----a-w- C:\WINDOWS\System32\TokenBroker.dll
2017-08-01 01:30:18 2055168 ----a-w- C:\WINDOWS\System32\win32kbase.sys
2017-08-01 01:30:09 3377664 ----a-w- C:\WINDOWS\System32\tquery.dll
2017-08-01 01:28:51 2516480 ----a-w- C:\WINDOWS\System32\diagtrack.dll
2017-08-01 01:28:43 4730368 ----a-w- C:\WINDOWS\System32\jscript9.dll
2017-08-01 01:27:25 574464 ----a-w- C:\WINDOWS\System32\configmanager2.dll
2017-08-01 01:27:05 482816 ----a-w- C:\WINDOWS\System32\dmenrollengine.dll
2017-08-01 01:26:03 323584 ----a-w- C:\WINDOWS\System32\DeviceEnroller.exe
2017-08-01 01:25:46 249344 ----a-w- C:\WINDOWS\System32\coredpus.dll
2017-08-01 01:25:41 194048 ----a-w- C:\WINDOWS\System32\mdmregistration.dll
2017-08-01 01:25:41 140800 ----a-w- C:\WINDOWS\System32\dmcsps.dll
2017-07-31 15:15:09 835576 ----a-w- C:\WINDOWS\SysWow64\FlashPlayerApp.exe
2017-07-31 15:15:09 177648 ----a-w- C:\WINDOWS\SysWow64\FlashPlayerCPLApp.cpl
2017-07-28 05:30:35 1068720 ----a-w- C:\WINDOWS\System32\Windows.UI.dll
2017-07-28 05:25:32 2399728 ----a-w- C:\WINDOWS\System32\KernelBase.dll
2017-07-28 05:24:52 119904 ----a-w- C:\WINDOWS\System32\dmcmnutils.dll
2017-07-28 05:24:42 116280 ----a-w- C:\WINDOWS\System32\bcd.dll
2017-07-28 05:24:38 2327456 ----a-w- C:\WINDOWS\System32\drivers\ntfs.sys
.
============= FINISH: 17:01:27.74 ===============

Attached Files

attach.txt (5.8 KB)