zeroaccess rootkit symptoms

- Rootkit.ZeroAcess inserted into tcp/ip stack (= Message by ComboFix) 2. [1] Contents 1 History and propagation 2 Operation 3 See also 4 References 5 External links History and propagation [ edit] When we write about ZeroAccess rootkit, it is essential to go back in 2009 and to remind when this rootkit had been discovered in the wild. Granting Both resulted in an infinite loop. RogueKiller has the ability to remove infections such as ZeroAccess, TDSS, rogue anti-spyware programs, and Ransomwares. The ZeroAccess rootkit is a dangerous threat that has been circulating for several years. It has been a few hours and it still has not completed. Once the hooks are installed, the target operating system falls under control of the rootkit, which is then able to hide . If malicious objects are found, they will show in the Scan results - Select action for found objects and offer three options. Please copy/paste that in your next reply. A hidden system folder is created where the name of the directory path. About The Author: Andrea Eldridge is CEO and co-founder of Nerds On Call, a computer repair company that specializes in on-site and online service for homes and businesses. Currently, droppers are usually packed with one from a group of complex polymorphic packers. In this example, we will be using CiscoTest123!. When this payload is downloaded it installs itself, downloads spam templates, and target email addresses and sends spam. This is normal. Exploit packs usually contain a great many different exploits targeting applications commonly found on Windows PCs such as Internet Explorer, Acrobat, Flash and Java. Description: The program FRST64.exe version 24.5.2017.0 stopped interacting with Windows and was closed. HKU\S-1-5-21-43797885-4047640243-3447395773-1001\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c98f28ea-b11a-11e4-8844-c89cdca4785c} => key removed successfully. The network communication is initiated both from the kernel driver itself and from a component injected into user memory, usually inside either the address space of explorer.exe or svchost.exe, by the driver. VirusTotal will scan the file and produce a report for you. This may take a few minutes. Searching for Missing Digital Signatures: Program finished at: 05/20/2017 07:00:38 PM, Execution time: 0 hours(s), 0 minute(s), and 54 seconds(s). The files also need to be decrypted to make any sense out of them. A common method is through the use of legitimate sites that have been compromised by the attacker (often through stolen FTP credentials or SQL injection). You currently have javascript disabled. in phones and tablets it would reside in the mail deleted folder which gets stuck on the phone or tablet! Look familiar? Therefore, I highly recommend you backup any critical personal files on your machine before we start. ), 2017-05-20 18:54 - 2017-05-20 18:55 - 00022318 _____ C:\Users\bill\Downloads\FRST.txt, 2017-05-20 18:54 - 2017-05-20 18:54 - 00000000 ____D C:\FRST, 2017-05-20 18:53 - 2017-05-20 18:53 - 02429952 _____ (Farbar) C:\Users\bill\Downloads\FRST64.exe, 2017-05-20 18:30 - 2017-05-20 18:30 - 00002504 _____ C:\Users\bill\Desktop\Rkill.txt, 2017-05-20 18:01 - 2017-05-20 18:15 - 152426840 _____ C:\Users\bill\Downloads\l8k4dykk.exe, 2017-05-20 17:59 - 2017-05-20 17:59 - 00000000 ____D C:\Users\bill\Doctor Web, 2017-05-20 17:32 - 2017-05-20 17:59 - 149014104 _____ C:\Users\bill\Downloads\cureit.exe, 2017-05-20 17:28 - 2017-05-20 17:29 - 16778594 _____ C:\Users\bill\Downloads\drweb-11.1.1-ss-android.apk, 2017-05-20 17:16 - 2017-05-20 17:16 - 00448512 _____ (OldTimer Tools) C:\Users\bill\Downloads\TFC.exe, 2017-05-20 17:00 - 2017-05-20 17:00 - 00000000 ____D C:\Users\Teresa\AppData\Local\AVG Web TuneUp, 2017-05-20 16:58 - 2017-05-20 16:58 - 00002910 _____ C:\Windows\System32\Tasks\Uninstaller_SkipUac_diablo, 2017-05-20 16:58 - 2017-05-20 16:58 - 00000000 ____D C:\Users\diablo\AppData\LocalLow\IObit, 2017-05-20 16:36 - 2017-05-20 16:36 - 00000000 ____D C:\ProgramData\{74E9F814-C737-42CC-B721-DBBC4059367A}, 2017-05-20 16:17 - 2017-05-20 16:17 - 00001049 _____ C:\Users\diablo\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Internet Explorer.lnk, 2017-05-20 16:17 - 2017-05-20 16:17 - 00001049 _____ C:\Users\bill\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Internet Explorer.lnk, 2017-05-20 15:59 - 2017-05-20 15:59 - 00000000 ____D C:\Users\bill\AppData\Local\AvgSetupLog, 2017-05-20 14:43 - 2017-05-20 14:43 - 02030536 _____ (Bleeping Computer, LLC) C:\Users\bill\Desktop\rkill.exe, 2017-05-20 14:23 - 2017-05-20 15:36 - 00280360 _____ C:\Windows\ntbtlog.txt, 2017-05-18 20:21 - 2017-05-18 20:22 - 00003168 _____ C:\Windows\System32\Tasks\SmartDefrag_AutoAnalyze, 2017-05-18 20:21 - 2017-05-18 20:21 - 00003016 _____ C:\Windows\System32\Tasks\SmartDefrag_Startup, 2017-05-18 20:21 - 2017-05-18 20:21 - 00003014 _____ C:\Windows\System32\Tasks\SmartDefrag_Update, 2017-05-18 19:53 - 2017-05-18 19:53 - 00000000 ____H C:\asc_rdflag, 2017-05-18 16:25 - 2017-05-18 16:25 - 00001180 _____ C:\Users\Public\Desktop\IObit Malware Fighter.lnk, 2017-05-18 16:25 - 2017-05-18 16:25 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\IObit Malware Fighter, 2017-05-18 16:25 - 2017-03-29 18:05 - 00026272 _____ (IObit.com) C:\Windows\system32\Drivers\IMFCameraProtect.sys, 2017-05-18 16:24 - 2017-05-18 16:24 - 00000000 ____D C:\ProgramData\{BE2ACE5C-32B7-4777-9BDF-ECF87CDAB705}, 2017-05-16 00:23 - 2017-05-16 00:23 - 00000000 ____D C:\Users\bill\AppData\Roaming\Google, 2017-05-12 21:44 - 2017-05-12 21:44 - 25741312 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.dll, 2017-05-12 21:44 - 2017-05-12 21:44 - 20278272 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.dll, 2017-05-12 21:44 - 2017-05-12 21:44 - 15250944 _____ (Microsoft Corporation) C:\Windows\system32\ieframe.dll, 2017-05-12 21:44 - 2017-05-12 21:44 - 13661184 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieframe.dll, 2017-05-12 21:44 - 2017-05-12 21:44 - 05977600 _____ (Microsoft Corporation) C:\Windows\system32\jscript9.dll, 2017-05-12 21:44 - 2017-05-12 21:44 - 05547240 _____ (Microsoft Corporation) C:\Windows\system32\ntoskrnl.exe, 2017-05-12 21:44 - 2017-05-12 21:44 - 04548608 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript9.dll, 2017-05-12 21:44 - 2017-05-12 21:44 - 04000488 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ntkrnlpa.exe, 2017-05-12 21:44 - 2017-05-12 21:44 - 03945192 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ntoskrnl.exe, 2017-05-12 21:44 - 2017-05-12 21:44 - 03241472 _____ (Microsoft Corporation) C:\Windows\system32\wininet.dll, 2017-05-12 21:44 - 2017-05-12 21:44 - 03220992 _____ (Microsoft Corporation) C:\Windows\system32\win32k.sys, 2017-05-12 21:44 - 2017-05-12 21:44 - 02899456 _____ (Microsoft Corporation) C:\Windows\system32\iertutil.dll, 2017-05-12 21:44 - 2017-05-12 21:44 - 02767872 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wininet.dll, 2017-05-12 21:44 - 2017-05-12 21:44 - 02724864 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.tlb, 2017-05-12 21:44 - 2017-05-12 21:44 - 02724864 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.tlb, 2017-05-12 21:44 - 2017-05-12 21:44 - 02290176 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iertutil.dll, 2017-05-12 21:44 - 2017-05-12 21:44 - 02132992 _____ (Microsoft Corporation) C:\Windows\system32\inetcpl.cpl, 2017-05-12 21:44 - 2017-05-12 21:44 - 02065408 _____ (Microsoft Corporation) C:\Windows\system32\ole32.dll, 2017-05-12 21:44 - 2017-05-12 21:44 - 02057216 _____ (Microsoft Corporation) C:\Windows\SysWOW64\inetcpl.cpl, 2017-05-12 21:44 - 2017-05-12 21:44 - 01895656 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\tcpip.sys, 2017-05-12 21:44 - 2017-05-12 21:44 - 01732864 _____ (Microsoft Corporation) C:\Windows\system32\ntdll.dll, 2017-05-12 21:44 - 2017-05-12 21:44 - 01544704 _____ (Microsoft Corporation) C:\Windows\system32\urlmon.dll, 2017-05-12 21:44 - 2017-05-12 21:44 - 01483776 _____ (Microsoft Corporation) C:\Windows\system32\crypt32.dll, 2017-05-12 21:44 - 2017-05-12 21:44 - 01460736 _____ (Microsoft Corporation) C:\Windows\system32\lsasrv.dll, 2017-05-12 21:44 - 2017-05-12 21:44 - 01417728 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ole32.dll, 2017-05-12 21:44 - 2017-05-12 21:44 - 01359360 _____ (Microsoft Corporation) C:\Windows\system32\mshtmlmedia.dll, 2017-05-12 21:44 - 2017-05-12 21:44 - 01314816 _____ (Microsoft Corporation) C:\Windows\SysWOW64\urlmon.dll, 2017-05-12 21:44 - 2017-05-12 21:44 - 01314112 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ntdll.dll, 2017-05-12 21:44 - 2017-05-12 21:44 - 01212928 _____ (Microsoft Corporation) C:\Windows\system32\rpcrt4.dll, 2017-05-12 21:44 - 2017-05-12 21:44 - 01176064 _____ (Microsoft Corporation) C:\Windows\SysWOW64\crypt32.dll, 2017-05-12 21:44 - 2017-05-12 21:44 - 01163264 _____ (Microsoft Corporation) C:\Windows\system32\kernel32.dll, 2017-05-12 21:44 - 2017-05-12 21:44 - 01155072 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtmlmedia.dll, 2017-05-12 21:44 - 2017-05-12 21:44 - 01133568 _____ (Microsoft Corporation) C:\Windows\system32\cdosys.dll, 2017-05-12 21:44 - 2017-05-12 21:44 - 01114112 _____ (Microsoft Corporation) C:\Windows\SysWOW64\kernel32.dll, 2017-05-12 21:44 - 2017-05-12 21:44 - 00986856 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\dxgkrnl.sys, 2017-05-12 21:44 - 2017-05-12 21:44 - 00968704 _____ (Microsoft Corporation) C:\Windows\system32\MsSpellCheckingFacility.exe, 2017-05-12 21:44 - 2017-05-12 21:44 - 00880640 _____ (Microsoft Corporation) C:\Windows\system32\advapi32.dll, 2017-05-12 21:44 - 2017-05-12 21:44 - 00876544 _____ (Microsoft Corporation) C:\Windows\system32\oleaut32.dll, 2017-05-12 21:44 - 2017-05-12 21:44 - 00817664 _____ (Microsoft Corporation) C:\Windows\system32\jscript.dll, 2017-05-12 21:44 - 2017-05-12 21:44 - 00814080 _____ (Microsoft Corporation) C:\Windows\system32\jscript9diag.dll, 2017-05-12 21:44 - 2017-05-12 21:44 - 00806912 _____ (Microsoft Corporation) C:\Windows\system32\msfeeds.dll, 2017-05-12 21:44 - 2017-05-12 21:44 - 00805376 _____ (Microsoft Corporation) C:\Windows\SysWOW64\cdosys.dll, 2017-05-12 21:44 - 2017-05-12 21:44 - 00800768 _____ (Microsoft Corporation) C:\Windows\system32\ieapfltr.dll, 2017-05-12 21:44 - 2017-05-12 21:44 - 00730624 _____ (Microsoft Corporation) C:\Windows\system32\kerberos.dll, 2017-05-12 21:44 - 2017-05-12 21:44 - 00725504 _____ (Microsoft Corporation) C:\Windows\system32\ie4uinit.exe, 2017-05-12 21:44 - 2017-05-12 21:44 - 00710144 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieapfltr.dll, 2017-05-12 21:44 - 2017-05-12 21:44 - 00706792 _____ (Microsoft Corporation) C:\Windows\system32\winload.efi, 2017-05-12 21:44 - 2017-05-12 21:44 - 00693248 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msfeeds.dll, 2017-05-12 21:44 - 2017-05-12 21:44 - 00690688 _____ (Microsoft Corporation) C:\Windows\SysWOW64\adtschema.dll, 2017-05-12 21:44 - 2017-05-12 21:44 - 00690688 _____ (Microsoft Corporation) C:\Windows\system32\adtschema.dll, 2017-05-12 21:44 - 2017-05-12 21:44 - 00666112 _____ (Microsoft Corporation) C:\Windows\SysWOW64\rpcrt4.dll, 2017-05-12 21:44 - 2017-05-12 21:44 - 00663552 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript.dll, 2017-05-12 21:44 - 2017-05-12 21:44 - 00644096 _____ (Microsoft Corporation) C:\Windows\SysWOW64\advapi32.dll, 2017-05-12 21:44 - 2017-05-12 21:44 - 00631176 _____ (Microsoft Corporation) C:\Windows\system32\winresume.efi, 2017-05-12 21:44 - 2017-05-12 21:44 - 00620032 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript9diag.dll, 2017-05-12 21:44 - 2017-05-12 21:44 - 00615936 _____ (Microsoft Corporation) C:\Windows\system32\ieui.dll, 2017-05-12 21:44 - 2017-05-12 21:44 - 00581632 _____ (Microsoft Corporation) C:\Windows\SysWOW64\oleaut32.dll, 2017-05-12 21:44 - 2017-05-12 21:44 - 00576512 _____ (Microsoft Corporation) C:\Windows\system32\vbscript.dll, 2017-05-12 21:44 - 2017-05-12 21:44 - 00553472 _____ (Microsoft Corporation) C:\Windows\SysWOW64\kerberos.dll, 2017-05-12 21:44 - 2017-05-12 21:44 - 00512000 _____ (Microsoft Corporation) C:\Windows\system32\rpcss.dll, 2017-05-12 21:44 - 2017-05-12 21:44 - 00503808 _____ (Microsoft Corporation) C:\Windows\system32\srcore.dll, 2017-05-12 21:44 - 2017-05-12 21:44 - 00499200 _____ (Microsoft Corporation) C:\Windows\SysWOW64\vbscript.dll, 2017-05-12 21:44 - 2017-05-12 21:44 - 00496128 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\afd.sys, 2017-05-12 21:44 - 2017-05-12 21:44 - 00489984 _____ (Microsoft Corporation) C:\Windows\system32\dxtmsft.dll, 2017-05-12 21:44 - 2017-05-12 21:44 - 00476160 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieui.dll, 2017-05-12 21:44 - 2017-05-12 21:44 - 00463872 _____ (Microsoft Corporation) C:\Windows\system32\certcli.dll, 2017-05-12 21:44 - 2017-05-12 21:44 - 00460800 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\srv.sys, 2017-05-12 21:44 - 2017-05-12 21:44 - 00419840 _____ (Microsoft Corporation) C:\Windows\system32\KernelBase.dll, 2017-05-12 21:44 - 2017-05-12 21:44 - 00417792 _____ (Microsoft Corporation) C:\Windows\system32\html.iec, 2017-05-12 21:44 - 2017-05-12 21:44 - 00416256 _____ (Microsoft Corporation) C:\Windows\SysWOW64\dxtmsft.dll, 2017-05-12 21:44 - 2017-05-12 21:44 - 00405504 _____ (Microsoft Corporation) C:\Windows\system32\gdi32.dll, 2017-05-12 21:44 - 2017-05-12 21:44 - 00405504 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\srv2.sys, 2017-05-12 21:44 - 2017-05-12 21:44 - 00394448 _____ (Microsoft Corporation) C:\Windows\system32\iedkcs32.dll, 2017-05-12 21:44 - 2017-05-12 21:44 - 00377576 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\netio.sys, 2017-05-12 21:44 - 2017-05-12 21:44 - 00362496 _____ (Microsoft Corporation) C:\Windows\system32\wow64win.dll, 2017-05-12 21:44 - 2017-05-12 21:44 - 00346320 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iedkcs32.dll, 2017-05-12 21:44 - 2017-05-12 21:44 - 00345600 _____ (Microsoft Corporation) C:\Windows\system32\schannel.dll, 2017-05-12 21:44 - 2017-05-12 21:44 - 00342528 _____ (Microsoft Corporation) C:\Windows\SysWOW64\certcli.dll, 2017-05-12 21:44 - 2017-05-12 21:44 - 00341504 _____ (Microsoft Corporation) C:\Windows\SysWOW64\html.iec, 2017-05-12 21:44 - 2017-05-12 21:44 - 00338432 _____ (Microsoft Corporation) C:\Windows\system32\conhost.exe, 2017-05-12 21:44 - 2017-05-12 21:44 - 00316928 _____ (Microsoft Corporation) C:\Windows\system32\msv1_0.dll, 2017-05-12 21:44 - 2017-05-12 21:44 - 00315392 _____ (Microsoft Corporation) C:\Windows\system32\dxtrans.dll, 2017-05-12 21:44 - 2017-05-12 21:44 - 00312832 _____ (Microsoft Corporation) C:\Windows\SysWOW64\gdi32.dll, 2017-05-12 21:44 - 2017-05-12 21:44 - 00312320 _____ (Microsoft Corporation) C:\Windows\system32\ncrypt.dll, 2017-05-12 21:44 - 2017-05-12 21:44 - 00296960 _____ (Microsoft Corporation) C:\Windows\system32\rstrui.exe, 2017-05-12 21:44 - 2017-05-12 21:44 - 00291328 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\mrxsmb10.sys, 2017-05-12 21:44 - 2017-05-12 21:44 - 00287976 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\FWPKCLNT.SYS, 2017-05-12 21:44 - 2017-05-12 21:44 - 00279040 _____ (Microsoft Corporation) C:\Windows\SysWOW64\dxtrans.dll, 2017-05-12 21:44 - 2017-05-12 21:44 - 00275456 _____ (Microsoft Corporation) C:\Windows\SysWOW64\KernelBase.dll, 2017-05-12 21:44 - 2017-05-12 21:44 - 00265448 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\dxgmms1.sys, 2017-05-12 21:44 - 2017-05-12 21:44 - 00262144 _____ (Microsoft Corporation) C:\Windows\system32\webcheck.dll, 2017-05-12 21:44 - 2017-05-12 21:44 - 00261120 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msv1_0.dll, 2017-05-12 21:44 - 2017-05-12 21:44 - 00254464 _____ (Microsoft Corporation) C:\Windows\SysWOW64\schannel.dll, 2017-05-12 21:44 - 2017-05-12 21:44 - 00243712 _____ (Microsoft Corporation) C:\Windows\system32\wow64.dll, 2017-05-12 21:44 - 2017-05-12 21:44 - 00230400 _____ (Microsoft Corporation) C:\Windows\SysWOW64\webcheck.dll, 2017-05-12 21:44 - 2017-05-12 21:44 - 00229376 _____ (Microsoft Corporation) C:\Windows\system32\wintrust.dll, 2017-05-12 21:44 - 2017-05-12 21:44 - 00223232 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ncrypt.dll, 2017-05-12 21:44 - 2017-05-12 21:44 - 00215552 _____ (Microsoft Corporation) C:\Windows\system32\winsrv.dll, 2017-05-12 21:44 - 2017-05-12 21:44 - 00210432 _____ (Microsoft Corporation) C:\Windows\system32\wdigest.dll, 2017-05-12 21:44 - 2017-05-12 21:44 - 00199680 _____ (Microsoft Corporation) C:\Windows\system32\msrating.dll, 2017-05-12 21:44 - 2017-05-12 21:44 - 00190976 _____ (Microsoft Corporation) C:\Windows\system32\cryptsvc.dll, 2017-05-12 21:44 - 2017-05-12 21:44 - 00190464 _____ (Microsoft Corporation) C:\Windows\system32\rpchttp.dll, 2017-05-12 21:44 - 2017-05-12 21:44 - 00179200 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wintrust.dll, 2017-05-12 21:44 - 2017-05-12 21:44 - 00172032 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wdigest.dll, 2017-05-12 21:44 - 2017-05-12 21:44 - 00168960 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msrating.dll, 2017-05-12 21:44 - 2017-05-12 21:44 - 00168960 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\srvnet.sys, 2017-05-12 21:44 - 2017-05-12 21:44 - 00159744 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\mrxsmb.sys, 2017-05-12 21:44 - 2017-05-12 21:44 - 00154856 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\ksecpkg.sys, 2017-05-12 21:44 - 2017-05-12 21:44 - 00152064 _____ (Microsoft Corporation) C:\Windows\system32\occache.dll, 2017-05-12 21:44 - 2017-05-12 21:44 - 00148480 _____ (Microsoft Corporation) C:\Windows\system32\appidpolicyconverter.exe, 2017-05-12 21:44 - 2017-05-12 21:44 - 00146432 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msaudite.dll, 2017-05-12 21:44 - 2017-05-12 21:44 - 00146432 _____ (Microsoft Corporation) C:\Windows\system32\msaudite.dll, 2017-05-12 21:44 - 2017-05-12 21:44 - 00145920 _____ (Microsoft Corporation) C:\Windows\SysWOW64\cryptsvc.dll, 2017-05-12 21:44 - 2017-05-12 21:44 - 00144384 _____ (Microsoft Corporation) C:\Windows\system32\ieUnatt.exe, 2017-05-12 21:44 - 2017-05-12 21:44 - 00144384 _____ (Microsoft Corporation) C:\Windows\system32\cdd.dll, 2017-05-12 21:44 - 2017-05-12 21:44 - 00141824 _____ (Microsoft Corporation) C:\Windows\system32\cryptnet.dll, 2017-05-12 21:44 - 2017-05-12 21:44 - 00141312 _____ (Microsoft Corporation) C:\Windows\SysWOW64\rpchttp.dll, 2017-05-12 21:44 - 2017-05-12 21:44 - 00135680 _____ (Microsoft Corporation) C:\Windows\system32\sspicli.dll, 2017-05-12 21:44 - 2017-05-12 21:44 - 00130048 _____ (Microsoft Corporation) C:\Windows\SysWOW64\occache.dll, 2017-05-12 21:44 - 2017-05-12 21:44 - 00129536 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\mrxsmb20.sys, 2017-05-12 21:44 - 2017-05-12 21:44 - 00123904 _____ (Microsoft Corporation) C:\Windows\system32\bcrypt.dll, 2017-05-12 21:44 - 2017-05-12 21:44 - 00117760 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\tdx.sys, 2017-05-12 21:44 - 2017-05-12 21:44 - 00116224 _____ (Microsoft Corporation) C:\Windows\system32\ieetwcollector.exe, 2017-05-12 21:44 - 2017-05-12 21:44 - 00115712 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieUnatt.exe, 2017-05-12 21:44 - 2017-05-12 21:44 - 00112640 _____ (Microsoft Corporation) C:\Windows\system32\smss.exe, 2017-05-12 21:44 - 2017-05-12 21:44 - 00107520 _____ (Microsoft Corporation) C:\Windows\system32\inseng.dll, 2017-05-12 21:44 - 2017-05-12 21:44 - 00106496 _____ (Microsoft Corporation) C:\Windows\SysWOW64\cryptnet.dll, 2017-05-12 21:44 - 2017-05-12 21:44 - 00096768 _____ (Microsoft Corporation) C:\Windows\SysWOW64\sspicli.dll, 2017-05-12 21:44 - 2017-05-12 21:44 - 00095464 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\ksecdd.sys, 2017-05-12 21:44 - 2017-05-12 21:44 - 00092160 _____ (Microsoft Corporation) C:\Windows\system32\mshtmled.dll, 2017-05-12 21:44 - 2017-05-12 21:44 - 00091136 _____ (Microsoft Corporation) C:\Windows\SysWOW64\inseng.dll, 2017-05-12 21:44 - 2017-05-12 21:44 - 00088064 _____ (Microsoft Corporation) C:\Windows\system32\MshtmlDac.dll, 2017-05-12 21:44 - 2017-05-12 21:44 - 00087552 _____ (Microsoft Corporation) C:\Windows\system32\tdc.ocx, 2017-05-12 21:44 - 2017-05-12 21:44 - 00086528 _____ (Microsoft Corporation) C:\Windows\system32\TSpkg.dll, 2017-05-12 21:44 - 2017-05-12 21:44 - 00082944 _____ (Microsoft Corporation) C:\Windows\SysWOW64\bcrypt.dll, 2017-05-12 21:44 - 2017-05-12 21:44 - 00077824 _____ (Microsoft Corporation) C:\Windows\system32\JavaScriptCollectionAgent.dll, 2017-05-12 21:44 - 2017-05-12 21:44 - 00076288 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtmled.dll, 2017-05-12 21:44 - 2017-05-12 21:44 - 00073216 _____ (Microsoft Corporation) C:\Windows\SysWOW64\tdc.ocx, 2017-05-12 21:44 - 2017-05-12 21:44 - 00066560 _____ (Microsoft Corporation) C:\Windows\system32\iesetup.dll, 2017-05-12 21:44 - 2017-05-12 21:44 - 00065536 _____ (Microsoft Corporation) C:\Windows\SysWOW64\TSpkg.dll, 2017-05-12 21:44 - 2017-05-12 21:44 - 00064000 _____ (Microsoft Corporation) C:\Windows\SysWOW64\MshtmlDac.dll, 2017-05-12 21:44 - 2017-05-12 21:44 - 00064000 _____ (Microsoft Corporation) C:\Windows\system32\auditpol.exe, 2017-05-12 21:44 - 2017-05-12 21:44 - 00063488 _____ (Microsoft Corporation) C:\Windows\system32\setbcdlocale.dll, 2017-05-12 21:44 - 2017-05-12 21:44 - 00062464 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iesetup.dll, 2017-05-12 21:44 - 2017-05-12 21:44 - 00062464 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\appid.sys, 2017-05-12 21:44 - 2017-05-12 21:44 - 00060416 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msobjs.dll, 2017-05-12 21:44 - 2017-05-12 21:44 - 00060416 _____ (Microsoft Corporation) C:\Windows\SysWOW64\JavaScriptCollectionAgent.dll, 2017-05-12 21:44 - 2017-05-12 21:44 - 00060416 _____ (Microsoft Corporation) C:\Windows\system32\msobjs.dll, 2017-05-12 21:44 - 2017-05-12 21:44 - 00059904 _____ (Microsoft Corporation) C:\Windows\system32\appidapi.dll, 2017-05-12 21:44 - 2017-05-12 21:44 - 00054784 _____ (Microsoft Corporation) C:\Windows\system32\jsproxy.dll, 2017-05-12 21:44 - 2017-05-12 21:44 - 00050688 _____ (Microsoft Corporation) C:\Windows\SysWOW64\appidapi.dll, 2017-05-12 21:44 - 2017-05-12 21:44 - 00050176 _____ (Microsoft Corporation) C:\Windows\SysWOW64\auditpol.exe, 2017-05-12 21:44 - 2017-05-12 21:44 - 00050176 _____ (Microsoft Corporation) C:\Windows\system32\srclient.dll, 2017-05-12 21:44 - 2017-05-12 21:44 - 00048640 _____ (Microsoft Corporation) C:\Windows\system32\ieetwproxystub.dll, 2017-05-12 21:44 - 2017-05-12 21:44 - 00047616 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieetwproxystub.dll, 2017-05-12 21:44 - 2017-05-12 21:44 - 00047104 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jsproxy.dll, 2017-05-12 21:44 - 2017-05-12 21:44 - 00044032 _____ (Microsoft Corporation) C:\Windows\system32\csrsrv.dll, 2017-05-12 21:44 - 2017-05-12 21:44 - 00043520 _____ (Microsoft Corporation) C:\Windows\system32\cryptbase.dll, 2017-05-12 21:44 - 2017-05-12 21:44 - 00043008 _____ (Microsoft Corporation) C:\Windows\SysWOW64\srclient.dll, 2017-05-12 21:44 - 2017-05-12 21:44 - 00036352 _____ (Microsoft Corporation) C:\Windows\SysWOW64\cryptbase.dll, 2017-05-12 21:44 - 2017-05-12 21:44 - 00034816 _____ (Microsoft Corporation) C:\Windows\system32\appidsvc.dll, 2017-05-12 21:44 - 2017-05-12 21:44 - 00034304 _____ (Microsoft Corporation) C:\Windows\system32\iernonce.dll, 2017-05-12 21:44 - 2017-05-12 21:44 - 00030720 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iernonce.dll, 2017-05-12 21:44 - 2017-05-12 21:44 - 00030720 _____ (Microsoft Corporation) C:\Windows\system32\lsass.exe, 2017-05-12 21:44 - 2017-05-12 21:44 - 00028672 _____ (Microsoft Corporation) C:\Windows\system32\sspisrv.dll, 2017-05-12 21:44 - 2017-05-12 21:44 - 00028160 _____ (Microsoft Corporation) C:\Windows\system32\secur32.dll, 2017-05-12 21:44 - 2017-05-12 21:44 - 00026112 _____ (Microsoft Corporation) C:\Windows\SysWOW64\oleres.dll, 2017-05-12 21:44 - 2017-05-12 21:44 - 00026112 _____ (Microsoft Corporation) C:\Windows\system32\oleres.dll, 2017-05-12 21:44 - 2017-05-12 21:44 - 00025600 _____ (Microsoft Corporation) C:\Windows\SysWOW64\setup16.exe, 2017-05-12 21:44 - 2017-05-12 21:44 - 00022016 _____ (Microsoft Corporation) C:\Windows\SysWOW64\secur32.dll, 2017-05-12 21:44 - 2017-05-12 21:44 - 00022016 _____ (Microsoft Corporation) C:\Windows\system32\credssp.dll, 2017-05-12 21:44 - 2017-05-12 21:44 - 00017920 _____ (Microsoft Corporation) C:\Windows\system32\appidcertstorecheck.exe, 2017-05-12 21:44 - 2017-05-12 21:44 - 00017408 _____ (Microsoft Corporation) C:\Windows\SysWOW64\credssp.dll, 2017-05-12 21:44 - 2017-05-12 21:44 - 00016384 _____ (Microsoft Corporation) C:\Windows\system32\ntvdm64.dll, 2017-05-12 21:44 - 2017-05-12 21:44 - 00014336 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ntvdm64.dll, 2017-05-12 21:44 - 2017-05-12 21:44 - 00013312 _____ (Microsoft Corporation) C:\Windows\system32\wow64cpu.dll, 2017-05-12 21:44 - 2017-05-12 21:44 - 00008704 _____ (Microsoft Corporation) C:\Windows\system32\comcat.dll, 2017-05-12 21:44 - 2017-05-12 21:44 - 00007680 _____ (Microsoft Corporation) C:\Windows\SysWOW64\instnm.exe, 2017-05-12 21:44 - 2017-05-12 21:44 - 00007168 _____ (Microsoft Corporation) C:\Windows\SysWOW64\comcat.dll, 2017-05-12 21:44 - 2017-05-12 21:44 - 00006656 _____ (Microsoft Corporation) C:\Windows\SysWOW64\apisetschema.dll, 2017-05-12 21:44 - 2017-05-12 21:44 - 00006656 _____ (Microsoft Corporation) C:\Windows\system32\apisetschema.dll, 2017-05-12 21:44 - 2017-05-12 21:44 - 00006144 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-security-base-l1-1-0.dll, 2017-05-12 21:44 - 2017-05-12 21:44 - 00006144 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-security-base-l1-1-0.dll, 2017-05-12 21:44 - 2017-05-12 21:44 - 00005120 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-file-l1-1-0.dll, 2017-05-12 21:44 - 2017-05-12 21:44 - 00005120 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-file-l1-1-0.dll, 2017-05-12 21:44 - 2017-05-12 21:44 - 00005120 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wow32.dll, 2017-05-12 21:44 - 2017-05-12 21:44 - 00004608 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-threadpool-l1-1-0.dll, 2017-05-12 21:44 - 2017-05-12 21:44 - 00004608 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-processthreads-l1-1-0.dll, 2017-05-12 21:44 - 2017-05-12 21:44 - 00004608 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-threadpool-l1-1-0.dll, 2017-05-12 21:44 - 2017-05-12 21:44 - 00004608 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-processthreads-l1-1-0.dll, 2017-05-12 21:44 - 2017-05-12 21:44 - 00004096 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-sysinfo-l1-1-0.dll, 2017-05-12 21:44 - 2017-05-12 21:44 - 00004096 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-synch-l1-1-0.dll, 2017-05-12 21:44 - 2017-05-12 21:44 - 00004096 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-misc-l1-1-0.dll, 2017-05-12 21:44 - 2017-05-12 21:44 - 00004096 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-localregistry-l1-1-0.dll, 2017-05-12 21:44 - 2017-05-12 21:44 - 00004096 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-localization-l1-1-0.dll, 2017-05-12 21:44 - 2017-05-12 21:44 - 00004096 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-sysinfo-l1-1-0.dll, 2017-05-12 21:44 - 2017-05-12 21:44 - 00004096 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-synch-l1-1-0.dll, 2017-05-12 21:44 - 2017-05-12 21:44 - 00004096 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-localregistry-l1-1-0.dll, 2017-05-12 21:44 - 2017-05-12 21:44 - 00004096 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-localization-l1-1-0.dll, 2017-05-12 21:44 - 2017-05-12 21:44 - 00004096 _____ (Microsoft Corporation) C:\Windows\system32\ieetwcollectorres.dll, 2017-05-12 21:44 - 2017-05-12 21:44 - 00003584 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-xstate-l1-1-0.dll, 2017-05-12 21:44 - 2017-05-12 21:44 - 00003584 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-processenvironment-l1-1-0.dll, 2017-05-12 21:44 - 2017-05-12 21:44 - 00003584 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-namedpipe-l1-1-0.dll, 2017-05-12 21:44 - 2017-05-12 21:44 - 00003584 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-memory-l1-1-0.dll, 2017-05-12 21:44 - 2017-05-12 21:44 - 00003584 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-libraryloader-l1-1-0.dll, 2017-05-12 21:44 - 2017-05-12 21:44 - 00003584 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-interlocked-l1-1-0.dll, 2017-05-12 21:44 - 2017-05-12 21:44 - 00003584 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-heap-l1-1-0.dll, 2017-05-12 21:44 - 2017-05-12 21:44 - 00003584 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-rtlsupport-l1-1-0.dll, 2017-05-12 21:44 - 2017-05-12 21:44 - 00003584 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-processenvironment-l1-1-0.dll, 2017-05-12 21:44 - 2017-05-12 21:44 - 00003584 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-namedpipe-l1-1-0.dll, 2017-05-12 21:44 - 2017-05-12 21:44 - 00003584 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-misc-l1-1-0.dll, 2017-05-12 21:44 - 2017-05-12 21:44 - 00003584 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-memory-l1-1-0.dll, 2017-05-12 21:44 - 2017-05-12 21:44 - 00003584 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-libraryloader-l1-1-0.dll, 2017-05-12 21:44 - 2017-05-12 21:44 - 00003584 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-heap-l1-1-0.dll, 2017-05-12 21:44 - 2017-05-12 21:44 - 00003072 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-util-l1-1-0.dll, 2017-05-12 21:44 - 2017-05-12 21:44 - 00003072 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-string-l1-1-0.dll, 2017-05-12 21:44 - 2017-05-12 21:44 - 00003072 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-rtlsupport-l1-1-0.dll, 2017-05-12 21:44 - 2017-05-12 21:44 - 00003072 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-profile-l1-1-0.dll, 2017-05-12 21:44 - 2017-05-12 21:44 - 00003072 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-io-l1-1-0.dll, 2017-05-12 21:44 - 2017-05-12 21:44 - 00003072 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-handle-l1-1-0.dll, 2017-05-12 21:44 - 2017-05-12 21:44 - 00003072 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-fibers-l1-1-0.dll, 2017-05-12 21:44 - 2017-05-12 21:44 - 00003072 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-errorhandling-l1-1-0.dll, 2017-05-12 21:44 - 2017-05-12 21:44 - 00003072 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-delayload-l1-1-0.dll, 2017-05-12 21:44 - 2017-05-12 21:44 - 00003072 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-debug-l1-1-0.dll, 2017-05-12 21:44 - 2017-05-12 21:44 - 00003072 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-datetime-l1-1-0.dll, 2017-05-12 21:44 - 2017-05-12 21:44 - 00003072 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-console-l1-1-0.dll, 2017-05-12 21:44 - 2017-05-12 21:44 - 00003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-xstate-l1-1-0.dll, 2017-05-12 21:44 - 2017-05-12 21:44 - 00003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-util-l1-1-0.dll, 2017-05-12 21:44 - 2017-05-12 21:44 - 00003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-string-l1-1-0.dll, 2017-05-12 21:44 - 2017-05-12 21:44 - 00003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-profile-l1-1-0.dll, 2017-05-12 21:44 - 2017-05-12 21:44 - 00003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-io-l1-1-0.dll, 2017-05-12 21:44 - 2017-05-12 21:44 - 00003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-interlocked-l1-1-0.dll, 2017-05-12 21:44 - 2017-05-12 21:44 - 00003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-handle-l1-1-0.dll, 2017-05-12 21:44 - 2017-05-12 21:44 - 00003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-fibers-l1-1-0.dll, 2017-05-12 21:44 - 2017-05-12 21:44 - 00003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-errorhandling-l1-1-0.dll, 2017-05-12 21:44 - 2017-05-12 21:44 - 00003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-delayload-l1-1-0.dll, 2017-05-12 21:44 - 2017-05-12 21:44 - 00003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-debug-l1-1-0.dll, 2017-05-12 21:44 - 2017-05-12 21:44 - 00003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-datetime-l1-1-0.dll, 2017-05-12 21:44 - 2017-05-12 21:44 - 00003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-console-l1-1-0.dll, 2017-05-12 21:44 - 2017-05-12 21:44 - 00002048 _____ (Microsoft Corporation) C:\Windows\SysWOW64\user.exe, 2017-05-06 05:10 - 2017-05-06 05:10 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Lightshot, 2017-04-22 12:04 - 2017-04-22 12:04 - 01508352 _____ (Microsoft Corporation) C:\Windows\SysWOW64\pla.dll, 2017-04-22 12:04 - 2017-04-22 12:04 - 01389056 _____ (Microsoft Corporation) C:\Windows\system32\pla.dll, 2017-04-22 12:04 - 2017-04-22 12:04 - 00300544 _____ (Microsoft Corporation) C:\Windows\system32\pdh.dll, 2017-04-22 12:04 - 2017-04-22 12:04 - 00237056 _____ (Microsoft Corporation) C:\Windows\SysWOW64\pdh.dll, 2017-04-22 12:04 - 2017-04-22 12:04 - 00205312 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\fastfat.sys, 2017-04-22 12:04 - 2017-04-22 12:04 - 00195584 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\exfat.sys, 2017-04-22 12:04 - 2017-04-22 12:04 - 00009216 _____ (Microsoft Corporation) C:\Windows\system32\plasrv.exe, 2017-04-22 12:04 - 2017-04-22 12:04 - 00002048 _____ (Microsoft Corporation) C:\Windows\SysWOW64\tzres.dll, 2017-04-22 12:04 - 2017-04-22 12:04 - 00002048 _____ (Microsoft Corporation) C:\Windows\system32\tzres.dll, ==================== One Month Modified files and folders ========, 2017-05-20 18:41 - 2012-07-27 16:36 - 00000924 _____ C:\Windows\Tasks\RockMeltUpdateTaskUserS-1-5-21-43797885-4047640243-3447395773-1001UA.job, 2017-05-20 18:36 - 2009-07-14 00:45 - 00027568 ____H C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0, 2017-05-20 18:36 - 2009-07-14 00:45 - 00027568 ____H C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0, 2017-05-20 18:31 - 2017-01-23 11:54 - 00002876 _____ C:\Windows\System32\Tasks\Driver Booster SkipUAC (bill), 2017-05-20 18:29 - 2015-09-10 19:55 - 00000351 _____ C:\prefs.js, 2017-05-20 18:28 - 2012-04-01 20:49 - 00000000 ____D C:\Users\bill, 2017-05-20 18:28 - 2009-07-14 01:08 - 00000006 ____H C:\Windows\Tasks\SA.DAT, 2017-05-20 18:27 - 2012-04-17 20:00 - 00000912 _____ C:\Windows\Tasks\GoogleUpdateTaskUserS-1-5-21-43797885-4047640243-3447395773-1000UA.job, 2017-05-20 18:27 - 2009-07-13 23:20 - 00000000 ____D C:\Windows\Resources, 2017-05-20 18:19 - 2012-04-04 13:15 - 00000000 ____D C:\Windows\SysWOW64\Macromed, 2017-05-20 18:11 - 2016-09-18 14:52 - 00192216 _____ (Malwarebytes) C:\Windows\system32\Drivers\MBAMSwissArmy.sys, 2017-05-20 18:00 - 2013-01-07 13:33 - 00000478 _____ C:\Windows\Tasks\PC Utility Kit Registration3.job, 2017-05-20 17:23 - 2013-01-07 13:43 - 00000000 ____D C:\ProgramData\IObit, 2017-05-20 17:19 - 2012-12-04 20:31 - 00000386 _____ C:\Windows\Tasks\update-sys.job, 2017-05-20 17:08 - 2012-12-04 20:31 - 00000386 _____ C:\Windows\Tasks\update-S-1-5-21-43797885-4047640243-3447395773-1001.job, 2017-05-20 17:02 - 2013-01-24 22:48 - 00000000 ____D C:\Users\Teresa\AppData\Roaming\IObit, 2017-05-20 17:00 - 2013-08-23 18:11 - 00597236 __RSH C:\Users\Teresa\ntuser.pol, 2017-05-20 17:00 - 2012-04-01 16:34 - 00000000 ____D C:\Users\Teresa, 2017-05-20 16:58 - 2017-02-24 10:51 - 00000000 ____D C:\Users\diablo\AppData\Roaming\ProductData, 2017-05-20 16:58 - 2014-02-07 22:57 - 00000000 ____D C:\Users\diablo\AppData\Roaming\IObit, 2017-05-20 16:56 - 2009-07-14 01:09 - 00000000 ____D C:\Windows\System32\Tasks\WPD, 2017-05-20 16:51 - 2016-01-12 23:42 - 00002906 _____ C:\Windows\System32\Tasks\Uninstaller_SkipUac_bill, 2017-05-20 16:41 - 2012-07-27 16:36 - 00000872 _____ C:\Windows\Tasks\RockMeltUpdateTaskUserS-1-5-21-43797885-4047640243-3447395773-1001Core.job, 2017-05-20 16:37 - 2014-07-31 15:06 - 00000000 ____D C:\ProgramData\ProductData, 2017-05-20 16:36 - 2016-01-12 23:41 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Advanced SystemCare, 2017-05-20 16:24 - 2014-05-04 22:16 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Battle.net, 2017-05-20 16:24 - 2012-11-24 21:54 - 00000000 ____D C:\ProgramData\Blizzard Entertainment, 2017-05-20 16:21 - 2012-06-17 21:06 - 00000000 ____D C:\Program Files (x86)\The Weather Channel, 2017-05-20 16:20 - 2012-05-22 23:41 - 00000000 ____D C:\Users\bill\AppData\Local\The Weather Channel, 2017-05-20 16:01 - 2012-12-16 21:56 - 00000000 __HDC C:\ProgramData\~0, 2017-05-20 16:00 - 2012-12-10 20:19 - 00000000 ____D C:\Program Files (x86)\AVG, 2017-05-20 15:52 - 2012-12-10 19:57 - 00000000 ____D C:\ProgramData\MFAData, 2017-05-20 15:36 - 2009-07-13 23:20 - 00000000 ____D C:\Windows\Help, 2017-05-20 13:36 - 2016-09-20 05:31 - 00003600 _____ C:\Windows\System32\Tasks\AVG EUpdate Task, 2017-05-19 14:27 - 2012-04-17 20:00 - 00000860 _____ C:\Windows\Tasks\GoogleUpdateTaskUserS-1-5-21-43797885-4047640243-3447395773-1000Core.job, 2017-05-18 20:21 - 2016-12-05 19:12 - 00001163 _____ C:\Users\Public\Desktop\Smart Defrag 5.lnk, 2017-05-18 20:21 - 2016-12-05 19:12 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Smart Defrag, 2017-05-18 20:07 - 2009-07-14 01:13 - 00782470 _____ C:\Windows\system32\PerfStringBackup.INI, 2017-05-18 20:07 - 2009-07-13 23:20 - 00000000 ____D C:\Windows\inf, 2017-05-18 19:53 - 2014-09-04 19:56 - 79970304 _____ C:\Windows\system32\config\software.iodefrag.bak, 2017-05-18 19:53 - 2014-09-04 19:56 - 00286720 _____ C:\Windows\system32\config\default.iodefrag.bak, 2017-05-18 19:53 - 2014-09-04 19:56 - 00135168 _____ C:\Windows\system32\config\sam.iodefrag.bak, 2017-05-18 19:53 - 2014-09-04 19:56 - 00032768 _____ C:\Windows\system32\config\security.iodefrag.bak, 2017-05-18 19:53 - 2013-12-24 18:43 - 00000000 ____D C:\Users\diablo, 2017-05-18 16:25 - 2013-01-07 13:43 - 00000000 ____D C:\Program Files (x86)\IObit, 2017-05-18 00:11 - 2013-01-07 13:33 - 00000444 _____ C:\Windows\Tasks\PC Utility Kit Update3.job, 2017-05-17 18:57 - 2013-01-07 13:33 - 00000442 _____ C:\Windows\Tasks\PC Utility Kit.job, 2017-05-15 18:29 - 2014-02-08 00:14 - 00002202 _____ C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Google Chrome.lnk, 2017-05-15 18:29 - 2014-02-08 00:14 - 00002190 _____ C:\Users\Public\Desktop\Google Chrome.lnk, 2017-05-14 22:24 - 2009-07-13 23:20 - 00000000 ____D C:\Windows\rescache, 2017-05-14 18:05 - 2009-07-14 00:45 - 00269128 _____ C:\Windows\system32\FNTCACHE.DAT, 2017-05-14 18:03 - 2009-07-13 23:20 - 00000000 ____D C:\Windows\PolicyDefinitions, 2017-05-10 22:49 - 2017-03-18 13:09 - 00004324 _____ C:\Windows\System32\Tasks\Adobe Flash Player Updater, 2017-05-10 22:49 - 2017-02-28 21:14 - 00004452 _____ C:\Windows\System32\Tasks\Adobe Flash Player PPAPI Notifier, 2017-05-10 22:49 - 2012-04-04 13:15 - 00803320 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerApp.exe, 2017-05-10 22:49 - 2012-04-04 13:15 - 00144888 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerCPLApp.cpl, 2017-05-10 22:49 - 2012-04-04 13:15 - 00000000 ____D C:\Windows\system32\Macromed, 2017-05-06 05:10 - 2012-12-04 20:31 - 00003258 _____ C:\Windows\System32\Tasks\update-S-1-5-21-43797885-4047640243-3447395773-1001, 2017-05-06 05:10 - 2012-12-04 20:31 - 00000658 _____ C:\Users\bill\AppData\Local\UserProducts.xml, 2017-04-27 17:53 - 2012-04-04 13:16 - 00003330 _____ C:\Windows\System32\Tasks\GoogleUpdateTaskMachineUA, 2017-04-27 17:53 - 2012-04-04 13:16 - 00003202 _____ C:\Windows\System32\Tasks\GoogleUpdateTaskMachineCore, 2017-04-22 12:15 - 2014-11-06 17:26 - 45596672 _____ C:\Windows\system32\config\components.iodefrag.bak, ==================== Files in the root of some directories =======, 2014-02-13 23:27 - 2016-07-11 15:40 - 0009728 _____ () C:\Users\bill\AppData\Local\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini, 2012-12-04 20:31 - 2012-12-04 20:31 - 0000003 _____ () C:\Users\bill\AppData\Local\updater.log, 2012-12-04 20:31 - 2017-05-06 05:10 - 0000658 _____ () C:\Users\bill\AppData\Local\UserProducts.xml, 2012-05-26 17:06 - 2012-05-26 17:06 - 0000000 _____ () C:\ProgramData\ca4d06f6f1583e6102664de7caa3e4bc_c, C:\$Recycle.Bin\S-1-5-18\$934f382ee646b1119c9c88b5c1e746e9, ==================== Bamital & volsnap ======================, (There is no automatic fix for files that do not pass verification.

Azelique Collagen Serum, Terminator Theme Virtual Piano, Proskin Slim Leggings, Farming Simulator 22 Server Mods, Is The National Education Association Credible, Intimidate Someone Crossword Clue,