Ayuda por favor .vbs

Hola @Nayriel

El foro te pone ciertas limitaciones por ser usuario nuevo.

Pasa por algún tema que sea de tu interés, coloca un par de me gusta, y luego podrás pegar el resto de los reportes.

No damos soporte por MP.

Cuando pegues el resto de los reportes podremos continuar.

Salu2

Hola sé que no dais soporte por mensaje privado, yo me registré aquí hace años, pero hace meses cuando intenté iniciar sesión parecía que no existía, y he vuelto. He dado me gustas, muchos, a temas que me interesan, pero no me ha dejado escribir hasta ahora. No sé si lo que hice ayer con todos los programas hoy sigue vigente, he visto que automáticamente ahora, malware ha hecho un análisis, de todos modos tengo los reportes de ayer.

@SanMar Este es el último reporte, y amiga el pc sigue bloqueándose el protector de pantalla, y constántemente va perdiendo 1gb de memoria del disco duro ssd, tenía 174, y cuando lo del virus pasó a 169, anoche 168, y ahora 167 Gracias

Malwarebytes
www.malwarebytes.com

-Detalles del registro-
Fecha del análisis: 12/10/19
Hora del análisis: 7:12
Archivo de registro: e422223c-ecae-11e9-a24a-e0d55e541887.json

-Información del software-
Versión: 3.8.3.2965
Versión de los componentes: 1.0.629
Versión del paquete de actualización: 1.0.12869
Licencia: Prueba

-Información del sistema-
SO: Windows 10 (Build 18362.418)
CPU: x64
Sistema de archivos: NTFS
Usuario: DESKTOP-N7K9G5B\Pl\u00c3\u00a1cido

-Resumen del análisis-
Tipo de análisis: Análisis personalizado
Análisis iniciado por:: Manual
Resultado: Completado
Objetos analizados: 688057
Amenazas detectadas: 5
Amenazas en cuarentena: 5
Tiempo transcurrido: 15 min, 58 seg

-Opciones de análisis-
Memoria: Activado
Inicio: Activado
Sistema de archivos: Activado
Archivo: Activado
Rootkits: Desactivado
Heurística: Activado
PUP: Detectar
PUM: Detectar

-Detalles del análisis-
Proceso: 0
(No hay elementos maliciosos detectados)

Módulo: 0
(No hay elementos maliciosos detectados)

Clave del registro: 0
(No hay elementos maliciosos detectados)

Valor del registro: 0
(No hay elementos maliciosos detectados)

Datos del registro: 0
(No hay elementos maliciosos detectados)

Secuencia de datos: 0
(No hay elementos maliciosos detectados)

Carpeta: 0
(No hay elementos maliciosos detectados)

Archivo: 5
PUP.Optional.VisicomToolbar, C:\ADWCLEANER\QUARANTINE\V1\20191012.062734\2\PANDASECURITYTB\PANDASECURITYTB64.DLL#8CAD895E6B194F20, En cuarentena, [2439], [635897],1.0.12869
PUP.Optional.VisicomToolbar, C:\PROGRAM FILES (X86)\PANDA SECURITY\PANDA SECURITY PROTECTION\TOOLS\PANDASECURITYTB.EXE, En cuarentena, [2439], [635897],1.0.12869
PUP.Optional.InstallCore.Generic, C:\USERS\PLáCIDO\DOCUMENTS\MICROSOFT_OFFICE_PICTURE_MANAGER_DOWNLOADER_0057202151.EXE, En cuarentena, [6026], [573207],1.0.12869
PUP.Optional.InstallCore.Generic, C:\USERS\PLáCIDO\DOCUMENTS\MICROSOFT_OFFICE_PICTURE_MANAGER_DOWNLOADER_0189574280.EXE, En cuarentena, [6026], [573207],1.0.12869
Adware.InstallCore, G:\ATUBE_CATCHER_2923376455.EXE, En cuarentena, [461], [745639],1.0.12869

Sector físico: 0
(No hay elementos maliciosos detectados)

WMI: 0
(No hay elementos maliciosos detectados)


(end)

Hola @Nayriel

Puedes pegar mas de un reporte por mensaje, te autorrespondes mucho y el foro te bloqueara, y así no avanzamos.

Sigues colocando reportes de AdwCleaner, (no te pedí que lo volvieras a ejecutar, faltan los demás pasos, ejecutar ZPHCleaner.

Salu2

Yo no sé si me autorrespondo, disculpa pero soy nuevo, hace años que no usaba esto y ya no me acuerdo mucho. Te puse ayer reportes, y hoy los que faltaban. Lo he hecho ya todo, he ejecutado ZPHCleaner recuerda que te pregunté si podía decir que si instalé el server de internet. Y no sabía que se podía poner más de un reporte en un mensaje, disculpa… No pretendo molestar, estoy preocupado, y te estoy muy agradecido, pero parece que te he molestado… Y no no he vuelto a ejecutar, por qué piensas eso? Ayer ejecuté todo, y sólo pude poner unos pocos reportes, y hoy he puesto el resto, lo que ha hecho solo o automático es el programa malware, se inicia con windows. Yo no he vuelto a ejecutar, lo hice ayer, y está ejecutado también (ayer) el ZPHCleaner. No soy de mandar muchos mensajes, pero estoy preocupado, disculpa… Intentaré poner todos los reportes que tengo, en uno solo

Reportes de Adwcleaner retirados por repetidos.

ZHPCleaner

~ ZHPCleaner v2019.10.7.148 by Nicolas Coolman (2019/10/07)
~ Run by Plácido (Administrator)  (12/10/2019 06:33:32)
~ Web: https://www.nicolascoolman.com
~ Blog: https://nicolascoolman.eu/
~ Facebook : https://www.facebook.com/nicolascoolman1
~ State version : Version OK
~ Type : Scanner
~ Report : C:\Users\Plácido\Desktop\ZHPCleaner (S).txt
~ Quarantine : C:\Users\Plácido\AppData\Roaming\ZHP\ZHPCleaner_Reg.txt
~ System Restore Point : 
~ UAC : Activate
~ Boot Mode : Normal (Normal boot)
Windows 10 Pro, 64-bit  (Build 18362)


---\\  Alternate Data Stream (ADS). (0)
~ No malintencionados o innecesarios artículos encontrados.


---\\  Servicios (0)
~ No malintencionados o innecesarios artículos encontrados.


---\\  Navegadores de Internet (0)
~ No malintencionados o innecesarios artículos encontrados.


---\\  Hosts carpeta (1)
~ El archivo hosts es legítimo (22)


---\\  Tareas automáticas programadas. (0)
~ No malintencionados o innecesarios artículos encontrados.


---\\  Explorador ( Archivos, Carpetas ) (13)
ENCONTRADOS carpeta: C:\Users\Plácido\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\µTorrent.lnk  [Bad : C:\Users\Plácido\AppData\Roaming\uTorrent\uTorrent.exe](.BitTorrent Inc..)  =>BitTorrent (P2P)
ENCONTRADOS carpeta: C:\Users\Plácido\AppData\Roaming\uTorrent\uTorrent.exe [BitTorrent Inc. - µTorrent]  =>BitTorrent (P2P)
ENCONTRADOS carpeta: C:\Users\Plácido\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\µTorrent.lnk    =>BitTorrent (P2P)
ENCONTRADOS carpeta: C:\ProgramData\panda_url_filtering\catalog.list    =>SUP.Optional.StartSearch
ENCONTRADOS carpeta: C:\ProgramData\panda_url_filtering\white.list    =>SUP.Optional.StartSearch
ENCONTRADOS carpeta: C:\ProgramData\panda_url_filtering\white.list.old    =>SUP.Optional.StartSearch
ENCONTRADOS carpeta: C:\ProgramData\panda_url_filtering\white.zip    =>SUP.Optional.StartSearch
ENCONTRADOS archivo: C:\ProgramData\panda_url_filtering\data  =>SUP.Optional.StartSearch
ENCONTRADOS archivo: C:\ProgramData\panda_url_filtering  =>SUP.Optional.StartSearch
ENCONTRADOS carpeta: C:\Users\Plácido\AppData\Roaming\Search The Web\{3BD44F0E-0596-4008-AEE0-45D47E3A8F0E}.ico    =>PUP.Optional.IMBooster
ENCONTRADOS archivo: C:\Users\Plácido\AppData\Roaming\Search The Web  =>PUP.Optional.IMBooster
ENCONTRADOS archivo: C:\Users\Plácido\AppData\Local\eSupport.com  =>PUP.Optional.eSupport
ENCONTRADOS archivo: C:\Program Files (x86)\QuickTime  =>Riskware.QuickTime


---\\  Registro ( Claves, Valores, Datos) (16)
ENCONTRADOS clave: HKCU\Software\undefined [AdditionalScan 148]  =>.SUP.Downloader
ENCONTRADOS clave: HKLM\SOFTWARE\Wow6432Node\pandasecuritytb [AdditionalScan 318]  =>.SUP.VisicomMedia
ENCONTRADOS clave: HKLM\SOFTWARE\pandasecuritytb [AdditionalScan 449]  =>.SUP.VisicomMedia
ENCONTRADOS clave: HKEY_USERS\S-1-5-21-3329500403-3007259016-2968960673-1001\SOFTWARE\eSupport.com []  =>PUP.Optional.eSupport
ENCONTRADOS clave: HKCU\Software\eSupport.com []  =>PUP.Optional.eSupport
ENCONTRADOS clave: HKCU\Software\Microsoft\Windows\CurrentVersion\Uninstall\uTorrent [BitTorrent Inc.]  =>BitTorrent (P2P)
ENCONTRADOS clave: [X64] HKLM\SOFTWARE\pandasecuritytb []  =>.SUP.VisicomMedia
ENCONTRADOS clave: [X64] HKLM\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{62155D33-3CE2-401E-8967-5A270628A3D5} [C:\Program Files (x86)\pandasecuritytb (Not File)]  =>.SUP.VisicomMedia
ENCONTRADOS clave: [X64] HKLM\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{B821BF60-5C2D-41EB-92DC-3E4CCD3A22E4} [C:\Program Files (x86)\pandasecuritytb (Not File)]  =>.SUP.VisicomMedia
ENCONTRADOS clave: [X64] HKLM\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{CC2DE09D-AF76-42f2-80E9-E5FFE623B971} [C:\Program Files (x86)\pandasecuritytb (Not File)]  =>.SUP.VisicomMedia
ENCONTRADOS clave: [X64] HKLM\SOFTWARE\Wow6432Node\pandasecuritytb []  =>.SUP.VisicomMedia
ENCONTRADOS clave: [X64] HKLM\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{62155D33-3CE2-401E-8967-5A270628A3D5} [C:\Program Files (x86)\pandasecuritytb (Not File)]  =>.SUP.VisicomMedia
ENCONTRADOS clave: [X64] HKLM\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{B821BF60-5C2D-41EB-92DC-3E4CCD3A22E4} [C:\Program Files (x86)\pandasecuritytb (Not File)]  =>.SUP.VisicomMedia
ENCONTRADOS clave: [X64] HKLM\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{BB2DE08D-AF76-42f2-80E9-E5EEE624A973} [C:\Program Files (x86)\pandasecuritytb (Not File)]  =>.SUP.VisicomMedia
ENCONTRADOS clave: [X64] HKLM\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{CC2DE09D-AF76-42f2-80E9-E5FFE623B971} [C:\Program Files (x86)\pandasecuritytb (Not File)]  =>.SUP.VisicomMedia
ENCONTRADOS clave: [X64] HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\pandasecuritytb [Panda Security and Visicom Media Inc.]  =>.SUP.VisicomMedia


---\\  Resumen de elementos en su estación de trabajo (7)
https://nicolascoolman.eu/2017/01/27/repaquetage-et-infection/  =>BitTorrent (P2P)
https://nicolascoolman.eu/2017/09/11/sup-startsearch/  =>SUP.Optional.StartSearch
https://nicolascoolman.eu/2017/09/08/adware-imbooster/  =>PUP.Optional.IMBooster
https://nicolascoolman.eu/2017/01/27/repaquetage-et-infection/  =>PUP.Optional.eSupport
https://nicolascoolman.eu/2017/01/15/riskware-quicktime/  =>Riskware.QuickTime
https://nicolascoolman.eu/2017/12/22/sup-downloader/  =>.SUP.Downloader
https://nicolascoolman.eu/2017/03/18/superfluous-visicommedia/  =>.SUP.VisicomMedia


---\\ Resultado de la reparación.
~ ninguna reparación hecha
~ Google Chrome OK
~ Mozilla Firefox OK
~ Internet Explorer OK


---\\ STATISTIQUES
~ Items escaneado : 108706
~ Items encontrado : 39
~ artículos cancelados : 0
~ Items opciones : 6/13
~ Ahorro de espacio (bytes) : 0


~ End of search in 00h22mn21s

---\\  Reporte (0)
ZHPCleaner-[S]-12102019-06_55_53.txt
~ ZHPCleaner v2019.10.7.148 by Nicolas Coolman (2019/10/07)
~ Run by Plácido (Administrator)  (12/10/2019 06:59:28)
~ Web: https://www.nicolascoolman.com
~ Blog: https://nicolascoolman.eu/
~ Facebook : https://www.facebook.com/nicolascoolman1
~ State version : Version OK
~ Type : Reparar
~ Report : C:\Users\Plácido\Desktop\ZHPCleaner (R).txt
~ Quarantine : C:\Users\Plácido\AppData\Roaming\ZHP\ZHPCleaner_Reg.txt
~ System Restore Point : OK
~ UAC : Activate
~ Boot Mode : Normal (Normal boot)
Windows 10 Pro, 64-bit  (Build 18362)


---\\  Alternate Data Stream (ADS). (0)
~ No malintencionados o innecesarios artículos encontrados.


---\\  Servicios (0)
~ No malintencionados o innecesarios artículos encontrados.


---\\  Navegadores de Internet (0)
~ No malintencionados o innecesarios artículos encontrados.


---\\  Hosts carpeta (1)
~ El archivo hosts es legítimo (22)


---\\  Tareas automáticas programadas. (0)
~ No malintencionados o innecesarios artículos encontrados.


---\\  Explorador ( Archivos, Carpetas ) (5)
MOVIDO carpeta: C:\Users\Plácido\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\µTorrent.lnk  [Bad : C:\Users\Plácido\AppData\Roaming\uTorrent\uTorrent.exe](.BitTorrent Inc..)  =>BitTorrent (P2P)
MOVIDO archivo: C:\ProgramData\panda_url_filtering  =>SUP.Optional.StartSearch
MOVIDO archivo: C:\Users\Plácido\AppData\Roaming\Search The Web  =>PUP.Optional.IMBooster
MOVIDO archivo: C:\Users\Plácido\AppData\Local\eSupport.com  =>PUP.Optional.eSupport
MOVIDO archivo: C:\Program Files (x86)\QuickTime  =>Riskware.QuickTime


---\\  Registro ( Claves, Valores, Datos) (16)
BORRADOS clave*: HKCU\Software\undefined [AdditionalScan 148]  =>.SUP.Downloader
BORRADOS clave*: HKLM\SOFTWARE\Wow6432Node\pandasecuritytb [AdditionalScan 318]  =>.SUP.VisicomMedia
BORRADOS clave*: HKLM\SOFTWARE\pandasecuritytb [AdditionalScan 449]  =>.SUP.VisicomMedia
BORRADOS clave*: HKEY_USERS\S-1-5-21-3329500403-3007259016-2968960673-1001\SOFTWARE\eSupport.com []  =>PUP.Optional.eSupport
BORRADOS clave**: HKCU\Software\eSupport.com []  =>PUP.Optional.eSupport
BORRADOS clave*: HKCU\Software\Microsoft\Windows\CurrentVersion\Uninstall\uTorrent [BitTorrent Inc.]  =>BitTorrent (P2P)
BORRADOS clave**: [X64] HKLM\SOFTWARE\pandasecuritytb []  =>.SUP.VisicomMedia
BORRADOS clave*: [X64] HKLM\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{62155D33-3CE2-401E-8967-5A270628A3D5} [C:\Program Files (x86)\pandasecuritytb (Not File)]  =>.SUP.VisicomMedia
BORRADOS clave*: [X64] HKLM\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{B821BF60-5C2D-41EB-92DC-3E4CCD3A22E4} [C:\Program Files (x86)\pandasecuritytb (Not File)]  =>.SUP.VisicomMedia
BORRADOS clave*: [X64] HKLM\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{CC2DE09D-AF76-42f2-80E9-E5FFE623B971} [C:\Program Files (x86)\pandasecuritytb (Not File)]  =>.SUP.VisicomMedia
BORRADOS clave**: [X64] HKLM\SOFTWARE\Wow6432Node\pandasecuritytb []  =>.SUP.VisicomMedia
BORRADOS clave*: [X64] HKLM\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{62155D33-3CE2-401E-8967-5A270628A3D5} [C:\Program Files (x86)\pandasecuritytb (Not File)]  =>.SUP.VisicomMedia
BORRADOS clave*: [X64] HKLM\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{B821BF60-5C2D-41EB-92DC-3E4CCD3A22E4} [C:\Program Files (x86)\pandasecuritytb (Not File)]  =>.SUP.VisicomMedia
BORRADOS clave*: [X64] HKLM\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{BB2DE08D-AF76-42f2-80E9-E5EEE624A973} [C:\Program Files (x86)\pandasecuritytb (Not File)]  =>.SUP.VisicomMedia
BORRADOS clave*: [X64] HKLM\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{CC2DE09D-AF76-42f2-80E9-E5FFE623B971} [C:\Program Files (x86)\pandasecuritytb (Not File)]  =>.SUP.VisicomMedia
BORRADOS clave*: [X64] HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\pandasecuritytb [Panda Security and Visicom Media Inc.]  =>.SUP.VisicomMedia


---\\  Resumen de elementos en su estación de trabajo (7)
https://nicolascoolman.eu/2017/01/27/repaquetage-et-infection/  =>BitTorrent (P2P)
https://nicolascoolman.eu/2017/09/11/sup-startsearch/  =>SUP.Optional.StartSearch
https://nicolascoolman.eu/2017/09/08/adware-imbooster/  =>PUP.Optional.IMBooster
https://nicolascoolman.eu/2017/01/27/repaquetage-et-infection/  =>PUP.Optional.eSupport
https://nicolascoolman.eu/2017/01/15/riskware-quicktime/  =>Riskware.QuickTime
https://nicolascoolman.eu/2017/12/22/sup-downloader/  =>.SUP.Downloader
https://nicolascoolman.eu/2017/03/18/superfluous-visicommedia/  =>.SUP.VisicomMedia


---\\ Limpieza adicional. (7)
~ Clave de registro Tracing borrados (7)
~ Quitar los antiguos informes de ZHPCleaner. (0)


---\\ Resultado de la reparación.
~ Reparación llevada a cabo con éxito
~ Google Chrome OK
~ Mozilla Firefox OK
~ Internet Explorer OK


---\\ STATISTIQUES
~ Items escaneado : 2257
~ Items encontrado : 0
~ artículos cancelados : 0
~ Items opciones : 6/13
~ Ahorro de espacio (bytes) : 0


~ End of clean in 00h00mn35s

---\\  Reporte (2)
ZHPCleaner-[S]-12102019-06_55_53.txt
ZHPCleaner-[R]-12102019-07_00_03.txt









~ ZHPCleaner v2019.10.7.148 by Nicolas Coolman (2019/10/07)
~ Run by Plácido (Administrator)  (12/10/2019 06:59:28)
~ Web: https://www.nicolascoolman.com
~ Blog: https://nicolascoolman.eu/
~ Facebook : https://www.facebook.com/nicolascoolman1
~ State version : Version OK
~ Certificate ZHPCleaner: Legal
~ Type : Reparar
~ Report : C:\Users\Plácido\Desktop\ZHPCleaner (R).txt
~ Quarantine : C:\Users\Plácido\AppData\Roaming\ZHP\ZHPCleaner_Reg.txt
~ UAC : Activate
~ Boot Mode : Normal (Normal boot)
Windows 10 Pro, 64-bit  (Build 18362)

---\  Alternate Data Stream (ADS). (0)
~ No malintencionados o innecesarios artículos encontrados. (ADS)

---\  Servicios (0)
~ No malintencionados o innecesarios artículos encontrados. (Servicio)

---\  Navegadores de Internet (0)
~ No malintencionados o innecesarios artículos encontrados. (Navegador)

---\  Hosts carpeta (1)
~ El archivo hosts es legítimo (22)

---\  Tareas automáticas programadas. (0)
~ No malintencionados o innecesarios artículos encontrados. (Tarea)

---\  Explorador ( Archivos, Carpetas ) (5)
MOVIDO carpeta: C:\Users\Plácido\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\µTorrent.lnk  [Bad : C:\Users\Plácido\AppData\Roaming\uTorrent\uTorrent.exe](.BitTorrent Inc..)  =>BitTorrent (P2P)
MOVIDO archivo: C:\ProgramData\panda_url_filtering  =>SUP.Optional.StartSearch
MOVIDO archivo: C:\Users\Plácido\AppData\Roaming\Search The Web  =>PUP.Optional.IMBooster
MOVIDO archivo: C:\Users\Plácido\AppData\Local\eSupport.com  =>PUP.Optional.eSupport
MOVIDO archivo: C:\Program Files (x86)\QuickTime  =>Riskware.QuickTime

---\  Registro ( Claves, Valores, Datos) (16)
BORRADOS clave*: HKCU\Software\undefined [AdditionalScan 148]  =>.SUP.Downloader
BORRADOS clave*: HKLM\SOFTWARE\Wow6432Node\pandasecuritytb [AdditionalScan 318]  =>.SUP.VisicomMedia
BORRADOS clave*: HKLM\SOFTWARE\pandasecuritytb [AdditionalScan 449]  =>.SUP.VisicomMedia
BORRADOS clave*: HKEY_USERS\S-1-5-21-3329500403-3007259016-2968960673-1001\SOFTWARE\eSupport.com []  =>PUP.Optional.eSupport
BORRADOS clave**: HKCU\Software\eSupport.com []  =>PUP.Optional.eSupport
BORRADOS clave*: HKCU\Software\Microsoft\Windows\CurrentVersion\Uninstall\uTorrent [BitTorrent Inc.]  =>BitTorrent (P2P)
BORRADOS clave**: [X64] HKLM\SOFTWARE\pandasecuritytb []  =>.SUP.VisicomMedia
BORRADOS clave*: [X64] HKLM\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{62155D33-3CE2-401E-8967-5A270628A3D5} [C:\Program Files (x86)\pandasecuritytb (Not File)]  =>.SUP.VisicomMedia
BORRADOS clave*: [X64] HKLM\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{B821BF60-5C2D-41EB-92DC-3E4CCD3A22E4} [C:\Program Files (x86)\pandasecuritytb (Not File)]  =>.SUP.VisicomMedia
BORRADOS clave*: [X64] HKLM\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{CC2DE09D-AF76-42f2-80E9-E5FFE623B971} [C:\Program Files (x86)\pandasecuritytb (Not File)]  =>.SUP.VisicomMedia
BORRADOS clave**: [X64] HKLM\SOFTWARE\Wow6432Node\pandasecuritytb []  =>.SUP.VisicomMedia
BORRADOS clave*: [X64] HKLM\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{62155D33-3CE2-401E-8967-5A270628A3D5} [C:\Program Files (x86)\pandasecuritytb (Not File)]  =>.SUP.VisicomMedia
BORRADOS clave*: [X64] HKLM\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{B821BF60-5C2D-41EB-92DC-3E4CCD3A22E4} [C:\Program Files (x86)\pandasecuritytb (Not File)]  =>.SUP.VisicomMedia
BORRADOS clave*: [X64] HKLM\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{BB2DE08D-AF76-42f2-80E9-E5EEE624A973} [C:\Program Files (x86)\pandasecuritytb (Not File)]  =>.SUP.VisicomMedia
BORRADOS clave*: [X64] HKLM\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{CC2DE09D-AF76-42f2-80E9-E5FFE623B971} [C:\Program Files (x86)\pandasecuritytb (Not File)]  =>.SUP.VisicomMedia
BORRADOS clave*: [X64] HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\pandasecuritytb [Panda Security and Visicom Media Inc.]  =>.SUP.VisicomMedia

---\  Resumen de elementos en su estación de trabajo (7)
https://nicolascoolman.eu/2017/01/27/repaquetage-et-infection/  =>BitTorrent (P2P)
https://nicolascoolman.eu/2017/09/11/sup-startsearch/  =>SUP.Optional.StartSearch
https://nicolascoolman.eu/2017/09/08/adware-imbooster/  =>PUP.Optional.IMBooster
https://nicolascoolman.eu/2017/01/27/repaquetage-et-infection/  =>PUP.Optional.eSupport
https://nicolascoolman.eu/2017/01/15/riskware-quicktime/  =>Riskware.QuickTime
https://nicolascoolman.eu/2017/12/22/sup-downloader/  =>.SUP.Downloader
https://nicolascoolman.eu/2017/03/18/superfluous-visicommedia/  =>.SUP.VisicomMedia

---\ Limpieza adicional. (7)
~ Clave de registro Tracing borrados (7)
~ Quitar los antiguos informes de ZHPCleaner. (0)

---\ Resultado de la reparación.
~ Reparación llevada a cabo con éxito
~ Google Chrome OK
~ Mozilla Firefox OK
~ Internet Explorer OK

---\ STATISTIQUES
~ Items escaneado : 2257
~ Items encontrado : 0
~ artículos cancelados : 0
~ Items opciones : 6/13
~ Ahorro de espacio (bytes) : 0
~ End of clean in 00h00mn35s

---\  Reporte (2)
ZHPCleaner-[S]-12102019-06_55_53.txt
ZHPCleaner-[R]-12102019-07_00_03.txt

Reporte de Malwarebytes retirado por repetido.

Hola @Nayriel

No me enojo ni me ofendo, solo trato de ayudarte, entiendo tu preocupación, pero al final del tema ya lo resolveremos debes tener paciencia, no se resuelve con magia.

Con mucha atención realiza lo siguiente:

Análisis del PC con Eset Online Scaner : Manual de Uso lee las instrucciones para salvar el reporte.

Análisis del PC con Kasperky Virus Removal Tool: Manual de Uso

  • Este no da reporte cuando te encuentres, si es que lo hace con alguna infección, tomas una imagen y la subes.

Como subir imágenes al Foro ?

En ambos online elimina todo lo que detecte (si es que lo hace) enviándolo a cuarentena.

Salu2

He tardado en responder porque en cuanto me dijiste tu último mensaje, me puse a pasar el ESET, y he estado esperando para que terminase y poner el reporte, pero no me va a dar tiempo. Va muy para el principio (lo sé por la barra de proceso). Entonces mañana te pongo el reporte del ESET y te mando captura del Kasperky Gracias. Saludos

Hola @Nayriel

Perfecto cuando terminas los pegas, pueden demorar mucho tiempo dependiendo de el tamaño de tu disco y la cantidad de archivos.

Salu2

Hola @SanMar te pongo el informe del eset, ahora me pongo con el Kapersky Unos comentarios que quería decirte. Cuando se infectó con virus, ese mismo día (sin saber que tenía ya el virus, pero sí sé que clickeé esa extensión .vbs) enchufé mi mp4 para meter música, y lo he usado y no hace nada raro, al menos de momento, y también enchufé un pendrive en el ordenador para meter capítulos de una serie ¿Estarán infectados también? Es que tengo miedo de introducir el pendrive usb en mi televisor vaya que lo infecte. Y otra cosa, cuando los programas que me has recomendado terminan,aparecen programas con los que nunca he tenido problemas, los “limpiadores” sacan nombres de programas como virus o para borrar (salen marcados en los análisis), te menciono cuales para que tengas en cuenta cuando reparemos el ordenador, por favor para no perderlos o no borrarlos. He visto que aparece atube, camtasia, juegos, steam.exe es necesario para jugar, wavepad, extensiones de firefox y chrome de descargar vídeos, y sobre todo el bluestacks que es un emulador que uso whatsapp, instagram y otras apps que lo uso mucho y que no se pierda configuración del chrome, por favor. Por si cuando me des más indicaciones de qué borrar, por favor que no afecte a esos. MUCHAS GRACIAS. Te pongo el reporte y me pongo con el Kapersky

ESET:

13/10/2019 17:58:55
Archivos explorados: 508993
Archivos infectados: 8
Amenazas eliminadas: 8
Tiempo total de exploración 02:44:26
Estado de la exploración: Finalizado


C:\Program Files (x86)\Adobe\Adobe Photoshop CC 2018 (32 Bit)\amtlib.dll	Win32/HackTool.Crack.FE aplicación potencialmente no segura	desinfectado por eliminación
C:\ProgramData\Panda Security\Panda Security Protection\Download\0x04011000\PSP_UPG_4151_18.01.xx_18.06.00_0.exe	Win32/Visicom.C aplicación potencialmente no deseada,una variante de Win32/Toolbar.Visicom.A aplicación potencialmente no deseada,una variante de Win32/Toolbar.Visicom.B aplicación potencialmente no deseada,una variante de Win64/Toolbar.Visicom.A aplicación potencialmente no deseada,una variante de Win32/Toolbar.Visicom.C aplicación potencialmente no deseada,JS/Visicom.A aplicación potencialmente no deseada,una variante de Win32/Visicom.A aplicación potencialmente no deseada,una variante de Win64/NetFilter.A aplicación potencialmente no segura,una variante de Win32/NetFilter.A aplicación potencialmente no segura	desinfectado por eliminación
C:\Users\Plácido\AppData\Local\Google\Chrome\User Data\Default\Extensions\aiimdkdngfcipjohbjenkahhlhccpdbc\31.2.9_0\js\contentScripts\contentScript.js	JS/Chromex.Agent.AP troyano	desinfectado por eliminación
C:\Users\Plácido\AppData\Roaming\uTorrent\updates\3.5.5_45311.exe	Win32/OpenCandy.J aplicación potencialmente no segura	eliminado
C:\Users\Plácido\AppData\Roaming\uTorrent\uTorrent.exe	Win32/OpenCandy.J aplicación potencialmente no segura	eliminado
G:\Accesorios de programas\JDownloader 2\Install JDownloader2.2018 RIKITECH.exe	una variante de Win32/Appwork.A aplicación potencialmente no deseada	desinfectado por eliminación
G:\Documentos\Programas Válidos Buenos\WavePad-Sound-Editor---5.33-+-Key.rar	una variante de Win32/Toolbar.Conduit.H aplicación potencialmente no deseada	eliminado
G:\Emuladores Juegos\Casttle of Ilusion By Z18.rar	una variante de Win32/HackTool.Crack.BQ aplicación potencialmente no segura	eliminado

Esto ha salido al final del Kapersky. ¿Qué hago? ¿Lo puedo borrar? ¿Le doy a “Continue”? Gracias.

Saludos

Hola @SanMar Disculpa que ponga otro mensaje seguido, al final le di a “continue” para que lo borrase y me decía que tenía que reiniciar el equipo, le dije que sí pero de repente se ha puesto otra vez a escanear y no podía usar nada del pc Me salían una ventana tras otra con símbolo rojo, de que no encontraba no se qué fichero, y sobre todo del Panda (y lo tengo desactivado).

El espacio de disco duro se ha recuperado, casi todo, de 174 que tenía, está entre 172 y 173, osea que falta 1 gb, pero lo que me ha asustado es que no me dejaba abrir nada, salían ventanas de error y he reiniciado con el botón de la torre y ya funciona, pero entro en “almacenamiento” y constántemente se va llenando, y borro todo lo que sé que se puede borrar y eso no aumenta, no sé dónde aumenta.

Que pregunté en mi anterior mensaje si lo borraba y daba a continuar, porque en tus indicaciones sobre el Kaspersky dices que se elimine si detecta algo enviándolo a cuarentena, y el ESET lo envía, pero el Kaspersky sólo lo elimina definitivamente creo.

Y por cierto mi adobe photoshop CC 2018 no funciona al pasar el eset, ya me ocurrió hace meses cuando pasé el ESET. ¿Qué puedo hacer? Me interesa esa versión, y no tengo el programa en otro sitio, lo tenía sólo instalado de la tienda donde lo compré. Gracias. Saludos

Hola @Nayriel

Sobre las unidades USB, por el momento no los utilices, ya los analizaremos.

Todos los programas que mencionan los reportes y aunque tu no hayas tenido problemas, son parches piratas como el de Adobe, Crack, Toolbar indeseables o Herramientas potencialmente no deseadas, si quieres un equipo limpio no es recomendable su uso.

Ahora si cuando terminemos con la desinfección los vuelves a instalar, sera bajo tu responsabilidad y elección, aquí no los recomendamos para nada.

Ya fueron borrados por ser considerados maliciosos por las herramientas de limpieza.

Varias de las extensiones de Chrome que instalaste son infecciosas/maliciosas.

Como te comente, esos como tu dices, son parte de tu problema por instalar piratería.

Ya encontraremos el porque aun falta.

Porque te elimina el Crack/Hacktool, no lo tienes legal lo tienes pirateado.


Realiza lo siguiente:

1.- Desactiva temporalmente tu antivirus y cualquier programa de seguridad.

2.- Descarga Farbar Recovery Scan Tool. en el escritorio, seleccionando la versión adecuada para la arquitectura (32 o 64bits) de su equipo. >> Como saber si mi Windows es de 32 o 64 bits.?

  • Ejecuta FRST.exe.
  • En el mensaje de la ventana del Disclaimer, pulsamos Yes
  • En la ventana principal pulsamos en el botón Scan y esperamos a que concluya el proceso.
  • Se abrirán dos(2) archivos(Logs), Frst.txt y Addition.txt, estos quedaran grabados en el escritorio.

Guía: Como Ejecutar FRST

3.- En tu próxima respuesta, pega los reportes generados.

Guía : ¿Como Pegar reportes en el Foro?

Esperamos esos reporte.

Salu2

Hola @SanMar voy a hacer todo lo que me dices en tu último mensaje Lo del wavepad no es un crack, es un key comprado. Las extensiones de google, las tenía de hace años y sin problemas, y son recomendadas por google, o al menos eso pone antes de añadirlas, supuestamente son oficiales. El atube es un programa gratuito al igual que utorrent. De todos modos confío en ti y tú eres la profesional. Acabo de descargar “Farbar Recovery” y google chrome lo detecta como peligroso, y es algo fiable, puede ser que con los otros programas pase lo mismo, vamos hasta este que acabo de descargar pone “potencialmente peligroso” aún así lo he descargado y voy a hacerlo, ahora te comento, o edito este mensaje para no mandar más mensajes. MUCHAS GRACIAS. Saludos

Es demasiado largo este reporte, lo pondré en varios FRST.exe:

Scan result of Farbar Recovery Scan Tool (FRST) (x64) Version: 12-10-2019 02
Ran by Plácido (administrator) on DESKTOP-N7K9G5B (Gigabyte Technology Co., Ltd. B250M-DS3H) (14-10-2019 20:38:59)
Running from C:\Users\Plácido\Downloads
Loaded Profiles: Plácido (Available Profiles: Plácido)
Platform: Windows 10 Pro Version 1903 18362.418 (X64) Language: Español (España, internacional)
Default browser: Chrome
Boot Mode: Normal
Tutorial for Farbar Recovery Scan Tool: http://www.geekstogo.com/forum/topic/335081-frst-tutorial-how-to-use-farbar-recovery-scan-tool/

==================== Processes (Whitelisted) =================

(If an entry is included in the fixlist, the process will be closed. The file will not be moved.)

(Adobe Inc. -> Adobe Systems) C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe
(Adobe Systems Incorporated -> Adobe Systems, Incorporated) C:\Program Files (x86)\Common Files\Adobe\AdobeGCClient\AGMService.exe
(Bluestack Systems, Inc. -> Bluestack System Inc. ) G:\Accesorios de programas\BlueStacks\BstkSVC.exe
(BlueStack Systems, Inc. -> BlueStack Systems, Inc.) G:\Accesorios de programas\BlueStacks\HD-Agent.exe
(BlueStack Systems, Inc. -> BlueStack Systems, Inc.) G:\Accesorios de programas\BlueStacks\HD-Player.exe
(BlueStack Systems, Inc. -> BlueStack Systems, Inc.) G:\Documentos\BlueStacks\Client\Bluestacks.exe
(BlueStack Systems, Inc. -> BlueStack Systems, Inc.) G:\Documentos\BlueStacks\Client\Bluestacks.exe
(Google Inc -> Google LLC) G:\Accesorios de programas\Google\Update\1.3.35.302\GoogleCrashHandler.exe
(Google Inc -> Google LLC) G:\Accesorios de programas\Google\Update\1.3.35.302\GoogleCrashHandler64.exe
(Google LLC -> Google LLC) G:\Accesorios de programas\Google\Chrome\Application\chrome.exe
(Google LLC -> Google LLC) G:\Accesorios de programas\Google\Chrome\Application\chrome.exe
(Google LLC -> Google LLC) G:\Accesorios de programas\Google\Chrome\Application\chrome.exe
(Google LLC -> Google LLC) G:\Accesorios de programas\Google\Chrome\Application\chrome.exe
(Google LLC -> Google LLC) G:\Accesorios de programas\Google\Chrome\Application\chrome.exe
(Google LLC -> Google LLC) G:\Accesorios de programas\Google\Chrome\Application\chrome.exe
(Google LLC -> Google LLC) G:\Accesorios de programas\Google\Chrome\Application\chrome.exe
(Google LLC -> Google LLC) G:\Accesorios de programas\Google\Chrome\Application\chrome.exe
(Google LLC -> Google LLC) G:\Accesorios de programas\Google\Chrome\Application\chrome.exe
(Google LLC -> Google LLC) G:\Accesorios de programas\Google\Chrome\Application\chrome.exe
(Google LLC -> Google LLC) G:\Accesorios de programas\Google\Chrome\Application\chrome.exe
(Google LLC -> Google LLC) G:\Accesorios de programas\Google\Chrome\Application\chrome.exe
(Google LLC -> Google LLC) G:\Accesorios de programas\Google\Chrome\Application\chrome.exe
(Google LLC -> Google LLC) G:\Accesorios de programas\Google\Chrome\Application\chrome.exe
(Google LLC -> Google LLC) G:\Accesorios de programas\Google\Chrome\Application\chrome.exe
(hxxp://www.emule-project.net) [File not signed] G:\Administraciones\eMule\emule.exe
(Intel Corporation - Embedded Subsystems and IP Blocks Group -> Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\LMS\LMS.exe
(Intel(R) Embedded Subsystems and IP Blocks Group -> Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\DAL\jhi_service.exe
(Intel(R) Extreme Tuning Utility -> Intel(R) Corporation) C:\Program Files (x86)\Intel\Intel(R) Extreme Tuning Utility\XtuService.exe
(Intel(R) pGFX -> Intel Corporation) C:\Windows\System32\DriverStore\FileRepository\igdlh64.inf_amd64_24de78387e6208e4\igfxCUIService.exe
(Intel(R) pGFX -> Intel Corporation) C:\Windows\System32\DriverStore\FileRepository\igdlh64.inf_amd64_24de78387e6208e4\igfxEM.exe
(Intel(R) pGFX -> Intel Corporation) C:\Windows\System32\DriverStore\FileRepository\igdlh64.inf_amd64_24de78387e6208e4\IntelCpHDCPSvc.exe
(Intel(R) pGFX -> Intel Corporation) C:\Windows\System32\DriverStore\FileRepository\igdlh64.inf_amd64_24de78387e6208e4\IntelCpHeciSvc.exe
(Intel(R) Rapid Storage Technology -> Intel Corporation) C:\Program Files\Intel\Intel(R) Rapid Storage Technology\IAStorDataMgrSvc.exe
(Intel(R) Rapid Storage Technology -> Intel Corporation) C:\Program Files\Intel\Intel(R) Rapid Storage Technology\IAStorIcon.exe
(Intel(R) Rapid Storage Technology -> Intel Corporation) C:\Windows\System32\DriverStore\FileRepository\iaahcic.inf_amd64_724e05bd98458fe4\RstMwService.exe
(MEDIATEK INC. -> Mediatek Inc.) [File not signed] G:\Accesorios de programas\MediatekWiFi\Common\RaUI.exe
(MEDIATEK INC. -> Mediatek Inc.) G:\Accesorios de programas\MediatekWiFi\Common\RaRegistry.exe
(MEDIATEK INC. -> Mediatek Inc.) G:\Accesorios de programas\MediatekWiFi\Common\RaRegistry64.exe
(Microsoft Corporation -> Microsoft Corporation) C:\Program Files\Common Files\microsoft shared\OfficeSoftwareProtectionPlatform\OSPPSVC.EXE
(Microsoft Corporation -> Microsoft Corporation) C:\Windows\Microsoft.NET\Framework64\v3.0\WPF\PresentationFontCache.exe
(Microsoft Corporation -> Microsoft Corporation) C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdge.exe
(Microsoft Corporation) C:\Program Files\WindowsApps\Microsoft.Windows.Photos_2019.19071.17920.0_x64__8wekyb3d8bbwe\Microsoft.Photos.exe
(Microsoft Corporation) C:\Program Files\WindowsApps\Microsoft.WindowsCalculator_10.1908.0.0_x64__8wekyb3d8bbwe\Calculator.exe
(Microsoft Corporation) C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.12026.20218.0_x64__8wekyb3d8bbwe\HxOutlook.exe
(Microsoft Corporation) C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.12026.20218.0_x64__8wekyb3d8bbwe\HxTsr.exe
(Microsoft Corporation) C:\Program Files\WindowsApps\Microsoft.WindowsStore_11910.1001.4.0_x64__8wekyb3d8bbwe\WinStore.App.exe
(Microsoft Corporation) C:\Program Files\WindowsApps\Microsoft.YourPhone_1.19091.313.0_x64__8wekyb3d8bbwe\YourPhone.exe
(Microsoft Corporation) C:\Program Files\WindowsApps\Microsoft.ZuneMusic_10.19072.14111.0_x64__8wekyb3d8bbwe\Music.UI.exe
(Microsoft Corporation) C:\Program Files\WindowsApps\Microsoft.ZuneVideo_10.19072.12011.0_x64__8wekyb3d8bbwe\Video.UI.exe
(Microsoft Windows -> Microsoft Corporation) C:\Windows\ImmersiveControlPanel\SystemSettings.exe
(Microsoft Windows -> Microsoft Corporation) C:\Windows\System32\browser_broker.exe
(Microsoft Windows -> Microsoft Corporation) C:\Windows\System32\dllhost.exe
(Microsoft Windows -> Microsoft Corporation) C:\Windows\System32\dllhost.exe
(Microsoft Windows -> Microsoft Corporation) C:\Windows\System32\LocationNotificationWindows.exe
(Microsoft Windows -> Microsoft Corporation) C:\Windows\System32\MicrosoftEdgeCP.exe
(Microsoft Windows -> Microsoft Corporation) C:\Windows\System32\MicrosoftEdgeCP.exe
(Microsoft Windows -> Microsoft Corporation) C:\Windows\System32\MicrosoftEdgeCP.exe
(Microsoft Windows -> Microsoft Corporation) C:\Windows\System32\MicrosoftEdgeCP.exe
(Microsoft Windows -> Microsoft Corporation) C:\Windows\System32\MicrosoftEdgeCP.exe
(Microsoft Windows -> Microsoft Corporation) C:\Windows\System32\MicrosoftEdgeCP.exe
(Microsoft Windows -> Microsoft Corporation) C:\Windows\System32\MicrosoftEdgeSH.exe
(Microsoft Windows -> Microsoft Corporation) C:\Windows\System32\rundll32.exe
(Microsoft Windows -> Microsoft Corporation) C:\Windows\System32\SecurityHealthHost.exe
(Microsoft Windows -> Microsoft Corporation) C:\Windows\System32\smartscreen.exe
(Microsoft Windows -> Microsoft Corporation) C:\Windows\SysWOW64\dllhost.exe
(Microsoft Windows Publisher -> Microsoft Corporation) C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.1909.6-0\MsMpEng.exe
(Microsoft Windows Publisher -> Microsoft Corporation) C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.1909.6-0\NisSrv.exe
(Panda Security S.L. -> Panda Security, S.L.) C:\Program Files (x86)\Panda Security\Panda Devices Agent\AgentSvc.exe
(Panda Security S.L. -> Panda Security, S.L.) C:\Program Files (x86)\Panda Security\Panda Security Protection\PSANHost.exe
(Panda Security S.L. -> Panda Security, S.L.) C:\Program Files (x86)\Panda Security\Panda Security Protection\PSUAMain.exe
(Panda Security S.L. -> Panda Security, S.L.) C:\Program Files (x86)\Panda Security\Panda Security Protection\PSUAService.exe
(Ralink Technology Corporation -> Ralink Technology, Corp.) C:\Program Files (x86)\Ralink\RT2870 Flash Install Wireless LAN Card\AutoInstSvc\RaAutoInstSrv.exe
(Realtek Semiconductor Corp. -> Realtek Semiconductor) C:\Program Files\Realtek\Audio\HDA\RtkNGUI64.exe
(Skype) C:\Program Files\WindowsApps\Microsoft.SkypeApp_14.53.85.0_x64__kzf8qxf38zg5c\SkypeApp.exe
(Skype) C:\Program Files\WindowsApps\Microsoft.SkypeApp_14.53.85.0_x64__kzf8qxf38zg5c\SkypeBackgroundHost.exe
(Visicom Media Inc. -> Visicom Media Inc.) C:\Program Files\Panda Security URL Filtering\Panda_URL_Filteringb.exe

==================== Registry (Whitelisted) ===========================

(If an entry is included in the fixlist, the registry item will be restored to default or removed. The file will not be moved.)

HKLM\...\Run: [RTHDVCPL] => C:\Program Files\Realtek\Audio\HDA\RtkNGUI64.exe [9235936 2017-08-10] (Realtek Semiconductor Corp. -> Realtek Semiconductor)
HKLM\...\Run: [AdobeAAMUpdater-1.0] => C:\Program Files (x86)\Common Files\Adobe\OOBE\PDApp\UWA\UpdaterStartupUtility.exe [509936 2018-04-11] (Adobe Systems Incorporated -> Adobe Systems Incorporated)
HKLM\...\Run: [AdobeGCInvoker-1.0] => C:\Program Files (x86)\Common Files\Adobe\AdobeGCClient\AGCInvokerUtility.exe [316392 2018-05-11] (Adobe Systems Incorporated -> Adobe Systems, Incorporated)
HKLM\...\Run: [IAStorIcon] => C:\Program Files\Intel\Intel(R) Rapid Storage Technology\IAStorIcon.exe [321112 2019-07-19] (Intel(R) Rapid Storage Technology -> Intel Corporation)
HKLM\...\Run: [WindowsDefender] => "%ProgramFiles%\Windows Defender\MSASCuiL.exe"
HKLM-x32\...\Run: [PSUAMain] => C:\Program Files (x86)\Panda Security\Panda Security Protection\PSUAMain.exe [153296 2018-05-30] (Panda Security S.L. -> Panda Security, S.L.)
HKU\S-1-5-19\...\RunOnce: [WAB Migrate] => C:\Program Files\Windows Mail\wab.exe [518656 2019-03-19] (Microsoft Windows -> Microsoft Corporation)
HKU\S-1-5-20\...\RunOnce: [WAB Migrate] => C:\Program Files\Windows Mail\wab.exe [518656 2019-03-19] (Microsoft Windows -> Microsoft Corporation)
HKU\S-1-5-21-3329500403-3007259016-2968960673-1001\...\Run: [Skype for Desktop] => C:\Program Files (x86)\Microsoft\Skype for Desktop\Skype.exe [83524968 2019-09-12] (Skype Software Sarl -> Skype Technologies S.A.)
HKU\S-1-5-21-3329500403-3007259016-2968960673-1001\...\Run: [Spotify] => C:\Users\Plácido\AppData\Roaming\Spotify\Spotify.exe [25591712 2019-07-28] (Spotify AB -> Spotify Ltd)
HKU\S-1-5-21-3329500403-3007259016-2968960673-1001\...\Run: [uTorrent] => G:\Documentos\utorrent descargas\uTorrent\uTorrent.exe [2086896 2019-10-14] (BitTorrent Inc -> BitTorrent Inc.)
HKU\S-1-5-21-3329500403-3007259016-2968960673-1001\...\MountPoints2: {691cb571-c34e-11e8-b972-0015830cbfeb} - "E:\AutoInst.exe" 
HKU\S-1-5-21-3329500403-3007259016-2968960673-1001\Control Panel\Desktop\\SCRNSAVE.EXE -> C:\WINDOWS\system32\Bubbles.scr [807936 2019-03-19] (Microsoft Windows -> Microsoft Corporation)
HKLM\Software\Microsoft\Active Setup\Installed Components: [{8A69D345-D564-463c-AFF1-A69D9E530F96}] -> C:\Program Files (x86)\Google\Chrome\Application\77.0.3865.120\Installer\chrmstp.exe [2019-10-10] (Google LLC -> Google LLC)
HKLM\Software\...\Authentication\Credential Providers: [{67187239-0780-4d9b-895B-7F0968AA474E}] -> C:\Program Files (x86)\CyberLink\YouCam7\CLCredProv\x64\CLCredProv.dll
HKLM\Software\...\Authentication\Credential Provider Filters: [{67187239-0780-4d9b-895B-7F0968AA474E}] -> C:\Program Files (x86)\CyberLink\YouCam7\CLCredProv\x64\CLCredProv.dll
Startup: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\Mediatek Wireless Utility.lnk [2019-10-14]
ShortcutTarget: Mediatek Wireless Utility.lnk -> C:\Program Files (x86)\MediatekWiFi\Common\RaUI.exe (MEDIATEK INC. -> Mediatek Inc.) [File not signed]
GroupPolicyScripts: Restriction <==== ATTENTION

==================== Scheduled Tasks (Whitelisted) =============

(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)

Task: {12F9C877-E7A1-4A39-8F61-9592092E0768} - no filepath
Task: {3E03A7A9-E551-4326-A579-E60E781B6E3B} - System32\Tasks\Microsoft\Windows\Windows Defender\Windows Defender Verification => C:\ProgramData\Microsoft\Windows Defender\platform\4.18.1909.6-0\MpCmdRun.exe [468120 2019-10-12] (Microsoft Windows Publisher -> Microsoft Corporation)
Task: {445BA5C8-AAA9-4D57-A6F3-07D6375ED1CE} - no filepath
Task: {4CFC5926-B51C-4445-9ED1-6C7FF9708C1A} - System32\Tasks\Microsoft\Office\Office 15 Subscription Heartbeat => C:\Program Files\Common Files\Microsoft Shared\Office16\OLicenseHeartbeat.exe
Task: {52872355-9499-47DE-87A8-69E17B030D88} - no filepath
Task: {56A13532-9245-4871-ADB5-D7AEB37C7459} - System32\Tasks\AdobeGCInvoker-1.0-DESKTOP-N7K9G5B-Plácido => C:\Program Files (x86)\Common Files\Adobe\AdobeGCClient\AGCInvokerUtility.exe [316392 2018-05-11] (Adobe Systems Incorporated -> Adobe Systems, Incorporated)
Task: {57E02D6A-62D4-4F32-8E51-F968AFFA1F63} - System32\Tasks\Microsoft\Windows\Windows Defender\Windows Defender Cache Maintenance => C:\ProgramData\Microsoft\Windows Defender\platform\4.18.1909.6-0\MpCmdRun.exe [468120 2019-10-12] (Microsoft Windows Publisher -> Microsoft Corporation)
Task: {5A763740-BCFA-42DE-B9F0-842F7EAA6A19} - System32\Tasks\AdobeAAMUpdater-1.0-DESKTOP-N7K9G5B-Plácido => C:\Program Files (x86)\Common Files\Adobe\OOBE\PDApp\UWA\UpdaterStartupUtility.exe [509936 2018-04-11] (Adobe Systems Incorporated -> Adobe Systems Incorporated)
Task: {666306BF-0B08-422C-B5FD-8608658949A6} - no filepath
Task: {6D0050D9-A639-45E8-8271-60D906CAE5CB} - System32\Tasks\Microsoft\Windows\Windows Defender\Windows Defender Scheduled Scan => C:\ProgramData\Microsoft\Windows Defender\platform\4.18.1909.6-0\MpCmdRun.exe [468120 2019-10-12] (Microsoft Windows Publisher -> Microsoft Corporation)
Task: {78981CEB-232F-4071-95CE-B595E99AB518} - System32\Tasks\Microsoft\Office\OfficeTelemetryAgentFallBack2016 => C:\Program Files\Microsoft Office\Office16\msoia.exe [416432 2015-07-31] (Microsoft Corporation -> Microsoft Corporation)
Task: {86FB0705-3C7E-47AA-BD9F-9356A038D4F8} - System32\Tasks\Microsoft\Office\OfficeTelemetryAgentLogOn2016 => C:\Program Files\Microsoft Office\Office16\msoia.exe [416432 2015-07-31] (Microsoft Corporation -> Microsoft Corporation)
Task: {9D2E8FF6-491F-4D31-BD31-6D1123783C0D} - no filepath
Task: {BB688CF7-566A-49B6-92F3-8BF1E3C1AC9E} - no filepath
Task: {C3B07E3E-BB3B-4DF4-8E07-1044C266043A} - System32\Tasks\Adobe Flash Player NPAPI Notifier => C:\WINDOWS\SysWOW64\Macromed\Flash\FlashUtil32_32_0_0_270_Plugin.exe [1457720 2019-10-09] (Adobe Inc. -> Adobe)
Task: {CB6B6D3D-2195-47EF-9632-EDFB37A75B97} - System32\Tasks\NCH Software\WavePadReminder => C:\Program Files (x86)\NCH Software\WavePad\WavePad.exe [2513432 2013-05-23] (NCH Software -> NCH Software)
Task: {D6F50705-FDAD-4B92-AC10-287E97EA97D4} - System32\Tasks\GoogleUpdateTaskMachineCore => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe [153168 2018-04-09] (Google Inc -> Google Inc.)
Task: {DD3229EF-C0E2-420B-A9EA-AF3490742A22} - System32\Tasks\BlueStacksHelper => G:\Documentos\BlueStacks\Client\Helper\BlueStacksHelper.exe [745480 2019-04-16] (BlueStack Systems, Inc. -> BlueStack Systems, Inc.)
Task: {DE5826C4-E741-4D23-AE94-C756706C4CD2} - System32\Tasks\Microsoft\Windows\Windows Defender\Windows Defender Cleanup => C:\ProgramData\Microsoft\Windows Defender\platform\4.18.1909.6-0\MpCmdRun.exe [468120 2019-10-12] (Microsoft Windows Publisher -> Microsoft Corporation)
Task: {F11BC5B6-E719-495E-B45F-FE37C849C41C} - System32\Tasks\GoogleUpdateTaskMachineUA => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe [153168 2018-04-09] (Google Inc -> Google Inc.)
Task: {F774DB56-6877-4FA7-A19E-FFF70C4E1998} - System32\Tasks\Adobe Flash Player Updater => C:\WINDOWS\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe [335416 2019-10-09] (Adobe Inc. -> Adobe)
Task: {FCFE95B9-F36D-434D-A27D-8C8785CDA6FC} - no filepath
Task: {FD3B7713-74A6-4CCD-9244-A9299C78D842} - System32\Tasks\Adobe Acrobat Update Task => C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe [1236048 2019-07-24] (Adobe Inc. -> Adobe Systems)

(If an entry is included in the fixlist, the task (.job) file will be moved. The file which is running by the task will not be moved.)


==================== Internet (Whitelisted) ====================

(If an item is included in the fixlist, if it is a registry item it will be removed or restored to default.)

Tcpip\Parameters: [DhcpNameServer] 212.231.6.7 46.6.113.34
Tcpip\..\Interfaces\{141ee060-3f50-4e73-a54f-c6af2fde9949}: [DhcpNameServer] 192.168.1.1
Tcpip\..\Interfaces\{37961053-d478-4a23-80b2-e9ea816f9cf0}: [DhcpNameServer] 212.231.6.7 46.6.113.34
Tcpip\..\Interfaces\{471e5350-522d-4c0c-b125-87d217d43943}: [DhcpNameServer] 192.168.1.1

Internet Explorer:
==================
SearchScopes: HKU\S-1-5-21-3329500403-3007259016-2968960673-1001 -> DefaultScope {3BD44F0E-0596-4008-AEE0-45D47E3A8F0E} URL = 
BHO: Office Document Cache Handler -> {B4F3A835-0E21-4959-BA22-42B3008E02FF} -> C:\Program Files\Microsoft Office\Office14\URLREDIR.DLL [2013-03-06] (Microsoft Corporation -> Microsoft Corporation)
BHO: Microsoft OneDrive for Business Browser Helper -> {D0498E0A-45B7-42AE-A9AA-ABA463DBD3BF} -> C:\Program Files\Microsoft Office\Office16\GROOVEEX.DLL [2018-07-20] (Microsoft Corporation -> Microsoft Corporation)
BHO-x32: Office Document Cache Handler -> {B4F3A835-0E21-4959-BA22-42B3008E02FF} -> C:\Program Files (x86)\Microsoft Office\Office14\URLREDIR.DLL [2013-03-06] (Microsoft Corporation -> Microsoft Corporation)
Toolbar: HKLM - Panda Safe Web - {B821BF60-5C2D-41EB-92DC-3E4CCD3A22E4} -  No File
Toolbar: HKLM-x32 - Panda Safe Web - {B821BF60-5C2D-41EB-92DC-3E4CCD3A22E4} -  No File
Handler-x32: mso-minsb.16 - {3459B272-CC19-4448-86C9-DDC3B4B2FAD3} - C:\Program Files (x86)\Microsoft Office\Office16\MSOSB.DLL [2019-06-12] (Microsoft Corporation -> Microsoft Corporation)
Handler-x32: osf.16 - {5504BE45-A83B-4808-900A-3A5C36E7F77A} - C:\Program Files (x86)\Microsoft Office\Office16\MSOSB.DLL [2019-06-12] (Microsoft Corporation -> Microsoft Corporation)

Edge: 
======
DownloadDir: C:\Users\Plácido\Downloads
Edge HomeButtonPage: HKU\S-1-5-21-3329500403-3007259016-2968960673-1001 -> about:tabs
Edge Extension: (Video Downloader professional) -> EdgeExtension_Link64GmbHVideoDownloaderProfessionalforEdge_r8gm29f18mcyc => C:\Program Files\WindowsApps\Link64GmbH.VideoDownloaderProfessionalforEdge_1.0.12.0_neutral__r8gm29f18mcyc [2019-10-12]
Edge Extension: (Traductor para Microsoft Edge) -> MicrosoftTranslate_MicrosoftTranslatorforMicrosoftEdge_8wekyb3d8bbwe => C:\Program Files\WindowsApps\Microsoft.TranslatorforMicrosoftEdge_0.91.51.0_neutral__8wekyb3d8bbwe [2019-10-12]

FireFox:
========
FF DefaultProfile: mhctkuun.default-1558752664449
FF ProfilePath: C:\Users\Plácido\AppData\Roaming\Mozilla\Firefox\Profiles\2z3cpg4t.default-release-1 [2019-10-14]
FF ProfilePath: C:\Users\Plácido\AppData\Roaming\Mozilla\Firefox\Profiles\6kvw1d1t.default-release [2019-10-14]
FF ProfilePath: C:\Users\Plácido\AppData\Roaming\Mozilla\Firefox\Profiles\mhctkuun.default-1558752664449 [2019-10-14]
FF Extension: (ETP Search Volume Study) - C:\Users\Plácido\AppData\Roaming\Mozilla\Firefox\Profiles\mhctkuun.default-1558752664449\Extensions\[email protected] [2019-07-27]
FF Extension: (Video DownloadHelper) - C:\Users\Plácido\AppData\Roaming\Mozilla\Firefox\Profiles\mhctkuun.default-1558752664449\Extensions\{b9db16a4-6edc-47ec-a1f4-b86292ed211d}.xpi [2019-07-27]
FF ProfilePath: C:\Users\Plácido\AppData\Roaming\Mozilla\Firefox\Profiles\uswp4nov.default-release-2 [2019-10-14]
FF Plugin: @adobe.com/FlashPlayer -> C:\WINDOWS\system32\Macromed\Flash\NPSWF64_32_0_0_270.dll [2019-10-09] (Adobe Inc. -> )
FF Plugin: @microsoft.com/OfficeAuthz,version=14.0 -> C:\PROGRA~1\MICROS~1\Office14\NPAUTHZ.DLL [2010-01-09] (Microsoft Corporation -> Microsoft Corporation)
FF Plugin: adobe.com/AdobeAAMDetect -> C:\Program Files (x86)\Adobe\Adobe Creative Cloud\Utils\npAdobeAAMDetect64.dll [2018-04-24] (Adobe Systems Incorporated -> Adobe Systems)
FF Plugin-x32: @adobe.com/FlashPlayer -> C:\WINDOWS\SysWOW64\Macromed\Flash\NPSWF32_32_0_0_270.dll [2019-10-09] (Adobe Inc. -> )
FF Plugin-x32: @microsoft.com/OfficeAuthz,version=14.0 -> C:\PROGRA~2\MICROS~1\Office14\NPAUTHZ.DLL [2010-01-09] (Microsoft Corporation -> Microsoft Corporation)
FF Plugin-x32: @microsoft.com/SharePoint,version=14.0 -> C:\PROGRA~2\MICROS~1\Office16\NPSPWRAP.DLL [2015-07-31] (Microsoft Corporation -> Microsoft Corporation)
FF Plugin-x32: @Nero.com/KM -> C:\PROGRA~2\COMMON~1\Nero\BROWSE~1\NPBROW~1.DLL [No File]
FF Plugin-x32: @tools.google.com/Google Update;version=3 -> C:\Program Files (x86)\Google\Update\1.3.35.302\npGoogleUpdate3.dll [2019-10-07] (Google Inc -> Google LLC)
FF Plugin-x32: @tools.google.com/Google Update;version=9 -> C:\Program Files (x86)\Google\Update\1.3.35.302\npGoogleUpdate3.dll [2019-10-07] (Google Inc -> Google LLC)
FF Plugin-x32: @videolan.org/vlc,version=2.2.6 -> C:\Program Files (x86)\VideoLAN\VLC\npvlc.dll [No File]
FF Plugin-x32: @videolan.org/vlc,version=3.0.3 -> C:\Program Files (x86)\VideoLAN\VLC\npvlc.dll [No File]
FF Plugin-x32: @videolan.org/vlc,version=3.0.4 -> C:\Program Files (x86)\VideoLAN\VLC\npvlc.dll [No File]
FF Plugin-x32: @videolan.org/vlc,version=3.0.6 -> C:\Program Files (x86)\VideoLAN\VLC\npvlc.dll [No File]
FF Plugin-x32: @videolan.org/vlc,version=3.0.7.1 -> G:\Accesorios de programas\VLC\npvlc.dll [2019-06-11] (VideoLAN -> VideoLAN)
FF Plugin-x32: Adobe Reader -> C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AIR\nppdf32.dll [2019-07-31] (Adobe Inc. -> Adobe Systems Inc.)
FF Plugin-x32: adobe.com/AdobeAAMDetect -> C:\Program Files (x86)\Adobe\Adobe Creative Cloud\Utils\npAdobeAAMDetect32.dll [2018-04-24] (Adobe Systems Incorporated -> Adobe Systems)

Chrome: 
=======
CHR DefaultProfile: Default
CHR HomePage: Default -> hxxp://www.roxette.se/
CHR StartupUrls: Default -> "hxxp://www.roxette.se/","hxxp://www.outlook.com/"
CHR NewTab: Default ->  Not-active:"chrome-extension://jpfpebmajhhopeonhlcgidhclcccjcik/newtab.html"
CHR DefaultSearchURL: Default -> hxxps://pandasecurity.mystart.com/results.php?pr=vmn&id=pandasafeweb&v=1_0_chromeextension_unknown__&searchfeed=web&hsimp=yhs-panda1&ent=ch_ss&q={searchTerms}
CHR DefaultSearchKeyword: Default -> safeWeb
CHR Profile: C:\Users\Plácido\AppData\Local\Google\Chrome\User Data\Default [2019-10-14]
CHR Extension: (Theme Creator) - C:\Users\Plácido\AppData\Local\Google\Chrome\User Data\Default\Extensions\akpelnjfckgfiplcikojhomllgombffc [2018-04-11]
CHR Extension: (YouTube) - C:\Users\Plácido\AppData\Local\Google\Chrome\User Data\Default\Extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo [2018-04-09]
CHR Extension: (Adblock Plus - bloqueador de anuncios gratis) - C:\Users\Plácido\AppData\Local\Google\Chrome\User Data\Default\Extensions\cfhdojbkjhnklbpkdaibdccddilifddb [2019-09-29]
CHR Extension: (Panda Safe Web) - C:\Users\Plácido\AppData\Local\Google\Chrome\User Data\Default\Extensions\fagakgcelolinfnkfgekcnedpaklfcok [2018-04-09]
CHR Extension: (Video Downloader PLUS) - C:\Users\Plácido\AppData\Local\Google\Chrome\User Data\Default\Extensions\fhplmmllnpjjlncfjpbbpjadoeijkogc [2019-09-14]
CHR Extension: (ThemeBeta.com) - C:\Users\Plácido\AppData\Local\Google\Chrome\User Data\Default\Extensions\gngjhkokplaiepmkoaihjmiejoclglom [2018-07-31]
CHR Extension: (Speed ​​Dial 2 Nueva pestaña) - C:\Users\Plácido\AppData\Local\Google\Chrome\User Data\Default\Extensions\jpfpebmajhhopeonhlcgidhclcccjcik [2019-10-11]
CHR Extension: (Sistema de pagos de Chrome Web Store) - C:\Users\Plácido\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda [2019-10-04]
CHR Extension: (Gmail) - C:\Users\Plácido\AppData\Local\Google\Chrome\User Data\Default\Extensions\pjkljhegncpnkpknbcohdijeoejaedia [2019-04-24]
CHR Extension: (Chrome Media Router) - C:\Users\Plácido\AppData\Local\Google\Chrome\User Data\Default\Extensions\pkedcjkdefgpdelpbcmbmeomcjbeemfm [2019-09-25]
CHR Profile: C:\Users\Plácido\AppData\Local\Google\Chrome\User Data\System Profile [2019-10-12]
CHR HKLM\...\Chrome\Extension: [fagakgcelolinfnkfgekcnedpaklfcok] - hxxps://clients2.google.com/service/update2/crx
CHR HKLM-x32\...\Chrome\Extension: [fagakgcelolinfnkfgekcnedpaklfcok] - hxxps://clients2.google.com/service/update2/crx

==================== Services (Whitelisted) ====================

(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)

R2 AGMService; C:\Program Files (x86)\Common Files\Adobe\AdobeGCClient\AGMService.exe [2321384 2018-05-11] (Adobe Systems Incorporated -> Adobe Systems, Incorporated)
S3 Intel(R) Capability Licensing Service TCP IP Interface; C:\Program Files\Intel\iCLS Client\SocketHeciServer.exe [630048 2016-10-13] (Intel(R) Trust Services -> Intel(R) Corporation)
R2 jhi_service; C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\DAL\jhi_service.exe [196200 2017-01-15] (Intel(R) Embedded Subsystems and IP Blocks Group -> Intel Corporation)
R2 MediatekRegistryWriter; C:\Program Files (x86)\MediatekWiFi\Common\RaRegistry.exe [405136 2014-12-04] (MEDIATEK INC. -> Mediatek Inc.)
R2 MediatekRegistryWriter64; C:\Program Files (x86)\MediatekWiFi\Common\RaRegistry64.exe [454288 2014-12-04] (MEDIATEK INC. -> Mediatek Inc.)
R2 NanoServiceMain; C:\Program Files (x86)\Panda Security\Panda Security Protection\PSANHost.exe [109024 2017-11-08] (Panda Security S.L. -> Panda Security, S.L.)
S3 Panda VPN Service; C:\Program Files (x86)\Panda Security\Panda Security Protection\Hydra.Sdk.Windows.Service.exe [320848 2017-11-20] (AnchorFree Inc -> )
R2 PandaAgent; C:\Program Files (x86)\Panda Security\Panda Devices Agent\AgentSvc.exe [84176 2019-02-19] (Panda Security S.L. -> Panda Security, S.L.)
R2 panda_url_filtering; C:\Program Files\Panda Security URL Filtering\Panda_URL_Filteringb.exe [246256 2016-11-22] (Visicom Media Inc. -> Visicom Media Inc.)
R2 PSUAService; C:\Program Files (x86)\Panda Security\Panda Security Protection\PSUAService.exe [48784 2018-05-30] (Panda Security S.L. -> Panda Security, S.L.)
R2 RaAutoInstSrv_RT2870; C:\Program Files (x86)\Ralink\RT2870 Flash Install Wireless LAN Card\AutoInstSvc\RaAutoInstSrv.exe [116000 2013-12-31] (Ralink Technology Corporation -> Ralink Technology, Corp.)
R2 RstMwService; C:\WINDOWS\System32\DriverStore\FileRepository\iaahcic.inf_amd64_724e05bd98458fe4\RstMwService.exe [2158592 2019-07-19] (Intel(R) Rapid Storage Technology -> Intel Corporation)
S3 Sense; C:\Program Files\Windows Defender Advanced Threat Protection\MsSense.exe [5796168 2019-09-08] (Microsoft Windows Publisher -> Microsoft Corporation)
R3 WdNisSvc; C:\ProgramData\Microsoft\Windows Defender\platform\4.18.1909.6-0\NisSrv.exe [3004048 2019-10-12] (Microsoft Windows Publisher -> Microsoft Corporation)
R2 WinDefend; C:\ProgramData\Microsoft\Windows Defender\platform\4.18.1909.6-0\MsMpEng.exe [103384 2019-10-12] (Microsoft Windows Publisher -> Microsoft Corporation)
R2 XTU3SERVICE; C:\Program Files (x86)\Intel\Intel(R) Extreme Tuning Utility\XtuService.exe [18264 2017-09-27] (Intel(R) Extreme Tuning Utility -> Intel(R) Corporation)

===================== Drivers (Whitelisted) ======================

(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)

R3 aftap0901; C:\WINDOWS\System32\drivers\aftap0901.sys [48624 2017-11-16] (AnchorFree Inc -> The OpenVPN Project)
R3 BlueStacksDrv; C:\Program Files\BlueStacks\BstkDrv.sys [313112 2019-09-04] (Bluestack Systems, Inc. -> Bluestack System Inc. )
R3 clwvd7; C:\WINDOWS\System32\drivers\clwvd7.sys [42968 2015-03-24] (CyberLink Corp. -> CyberLink Corporation)
S3 dtproscsibus; C:\WINDOWS\System32\drivers\dtproscsibus.sys [30264 2019-03-27] (Disc Soft Ltd -> Disc Soft Ltd)
S3 gdrv; C:\Windows\gdrv.sys [26192 2018-04-09] (Giga-Byte Technology -> Windows (R) Server 2003 DDK provider)
R1 HWiNFO32; C:\Windows\SysWOW64\drivers\HWiNFO64A.SYS [27552 2018-11-17] (Martin Malik - REALiX -> REALiX(tm))
R0 iaStorAC; C:\WINDOWS\System32\drivers\iaStorAC.sys [1036288 2019-07-19] (Intel(R) Rapid Storage Technology -> Intel Corporation)
R2 iocbios2; C:\Program Files (x86)\Intel\Intel(R) Extreme Tuning Utility\Drivers\IocDriver\64bit\iocbios2.sys [38424 2017-09-15] (Intel Corporation -> Intel Corporation)
R3 LifeCamTrueColor; C:\WINDOWS\system32\DRIVERS\LifeCamTrueColor.sys [37928 2016-07-27] (Microsoft Corporation -> Microsoft Corporation)
R3 netr28ux; C:\WINDOWS\system32\DRIVERS\netr28ux.sys [2249528 2016-08-12] (MEDIATEK INC. -> MediaTek Inc.)
R1 NNSALPC; C:\WINDOWS\system32\DRIVERS\NNSALPC.sys [108000 2017-11-06] (Panda Security S.L. -> Panda Security, S.L.)
R1 NNSHTTP; C:\WINDOWS\system32\DRIVERS\NNSHTTP.sys [211936 2017-11-06] (Panda Security S.L. -> Panda Security, S.L.)
R1 NNSHTTPS; C:\WINDOWS\system32\DRIVERS\NNSHTTPS.sys [121312 2017-11-06] (Panda Security S.L. -> Panda Security, S.L.)
R1 NNSIDS; C:\WINDOWS\system32\DRIVERS\NNSIDS.sys [126432 2017-11-06] (Panda Security S.L. -> Panda Security, S.L.)
R1 NNSNAHSL; C:\WINDOWS\system32\DRIVERS\NNSNAHSL.sys [99512 2017-09-26] (Panda Security S.L. -> Panda Security, S.L.)
R1 NNSPICC; C:\WINDOWS\system32\DRIVERS\NNSPICC.sys [118240 2017-11-06] (Panda Security S.L. -> Panda Security, S.L.)
R1 NNSPIHSW; C:\WINDOWS\system32\DRIVERS\NNSPIHSW.sys [91616 2017-11-06] (Panda Security S.L. -> Panda Security, S.L.)
R1 NNSPOP3; C:\WINDOWS\system32\DRIVERS\NNSPOP3.sys [135648 2017-11-06] (Panda Security S.L. -> Panda Security, S.L.)
R1 NNSPROT; C:\WINDOWS\system32\DRIVERS\NNSPROT.sys [336352 2017-11-06] (Panda Security S.L. -> Panda Security, S.L.)
R1 NNSPRV; C:\WINDOWS\system32\DRIVERS\NNSPRV.sys [249312 2017-11-06] (Panda Security S.L. -> Panda Security, S.L.)
R1 NNSSMTP; C:\WINDOWS\system32\DRIVERS\NNSSMTP.sys [123360 2017-11-06] (Panda Security S.L. -> Panda Security, S.L.)
R1 NNSSTRM; C:\WINDOWS\system32\DRIVERS\NNSSTRM.sys [281056 2017-11-06] (Panda Security S.L. -> Panda Security, S.L.)
R1 NNSTLSC; C:\WINDOWS\system32\DRIVERS\NNSTLSC.sys [125920 2017-11-06] (Panda Security S.L. -> Panda Security, S.L.)
R2 PSINAflt; C:\WINDOWS\system32\DRIVERS\PSINAflt.sys [191448 2017-11-09] (Panda Security S.L. -> Panda Security, S.L.)
R2 PSINFile; C:\WINDOWS\System32\DRIVERS\PSINFile.sys [153992 2018-01-23] (Panda Security S.L. -> Panda Security, S.L.)
R1 PSINKNC; C:\WINDOWS\system32\DRIVERS\PSINKNC.sys [207248 2018-01-30] (Panda Security S.L. -> Panda Security, S.L.)
R2 PSINProc; C:\WINDOWS\System32\DRIVERS\PSINProc.sys [146912 2017-10-17] (Panda Security S.L. -> Panda Security, S.L.)
R2 PSINProt; C:\WINDOWS\system32\DRIVERS\PSINProt.sys [159200 2017-10-17] (Panda Security S.L. -> Panda Security, S.L.)
R2 PSINReg; C:\WINDOWS\system32\DRIVERS\PSINReg.sys [129504 2017-10-17] (Panda Security S.L. -> Panda Security, S.L.)
U3 PSKMAD; C:\WINDOWS\System32\DRIVERS\PSKMAD.sys [72648 2017-05-22] (Panda Security S.L. -> Panda Security, S.L.)
R3 rt640x64; C:\WINDOWS\System32\drivers\rt640x64.sys [943112 2016-09-20] (Realtek Semiconductor Corp. -> Realtek )
R3 ScpVBus; C:\WINDOWS\System32\drivers\ScpVBus.sys [39168 2013-05-19] (Bruce James -> Scarlet.Crush Productions)
R2 speedfan; C:\WINDOWS\SysWOW64\speedfan.sys [28664 2012-12-29] (SOKNO S.R.L. -> Almico Software)
S0 WdBoot; C:\WINDOWS\System32\drivers\wd\WdBoot.sys [46688 2019-10-12] (Microsoft Windows Early Launch Anti-malware Publisher -> Microsoft Corporation)
R0 WdFilter; C:\WINDOWS\System32\drivers\wd\WdFilter.sys [350136 2019-10-12] (Microsoft Windows -> Microsoft Corporation)
R3 WdNisDrv; C:\WINDOWS\System32\drivers\wd\WdNisDrv.sys [54200 2019-10-12] (Microsoft Windows -> Microsoft Corporation)

==================== NetSvcs (Whitelisted) ===================

(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)

2 FRST.exe:

==================== One month (created) ========

(If an entry is included in the fixlist, the file/folder will be moved.)

2019-10-14 20:38 - 2019-10-14 20:39 - 000032788 _____ C:\Users\Plácido\Downloads\FRST.txt
2019-10-14 20:38 - 2019-10-14 20:39 - 000000000 ____D C:\FRST
2019-10-14 20:24 - 2019-10-14 20:25 - 001616384 _____ (Farbar) C:\Users\Plácido\Downloads\FRST64.exe
2019-10-14 15:54 - 2019-10-14 15:54 - 000000000 ____D C:\WINDOWS\Panther
2019-10-14 02:00 - 2019-10-14 02:00 - 000000000 ____D C:\WINDOWS\pss
2019-10-13 21:23 - 2019-10-14 02:29 - 000001375 _____ C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Adobe Photoshop CC 2018 (32 Bit).lnk
2019-10-13 21:23 - 2019-10-13 21:23 - 000003642 _____ C:\WINDOWS\system32\Tasks\AdobeAAMUpdater-1.0-DESKTOP-N7K9G5B-Plácido
2019-10-13 21:23 - 2019-10-13 21:23 - 000000000 ____D C:\ProgramData\regid.1986-12.com.adobe
2019-10-13 18:08 - 2019-10-14 01:32 - 000000000 ____D C:\KVRT_Data
2019-10-13 17:59 - 2019-10-13 17:59 - 000004092 _____ C:\Users\Plácido\Documents\eset.txt
2019-10-13 06:28 - 2019-10-13 06:29 - 169406760 _____ (AO Kaspersky Lab) C:\Users\Plácido\Downloads\KVRT.exe
2019-10-13 06:22 - 2019-10-13 06:22 - 000000771 _____ C:\Users\Plácido\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\ESET Online Scanner.lnk
2019-10-13 06:22 - 2019-10-13 06:22 - 000000672 _____ C:\Users\Plácido\Desktop\ESET Online Scanner.lnk
2019-10-13 06:22 - 2019-10-13 06:22 - 000000000 ____D C:\Users\Plácido\AppData\Local\ESET
2019-10-13 06:21 - 2019-10-13 06:21 - 008166712 _____ (ESET spol. s r.o.) C:\Users\Plácido\Downloads\ESETOnlineScanner_ESL.exe
2019-10-12 07:31 - 2019-10-12 07:31 - 000000000 ____D C:\ProgramData\panda_url_filtering
2019-10-12 07:30 - 2019-10-12 07:30 - 000002285 _____ C:\Users\Plácido\Desktop\MBAM.txt
2019-10-12 07:00 - 2019-10-12 07:03 - 000010599 _____ C:\Users\Plácido\Desktop\ZHPCleaner (R).txt
2019-10-12 06:55 - 2019-10-12 06:55 - 000006053 _____ C:\Users\Plácido\Desktop\ZHPCleaner (S).txt
2019-10-12 06:30 - 2019-10-12 07:00 - 000000000 ____D C:\Users\Plácido\AppData\Roaming\ZHP
2019-10-12 06:30 - 2019-10-12 06:30 - 000000877 _____ C:\Users\Plácido\Desktop\ZHPCleaner.lnk
2019-10-12 06:30 - 2019-10-12 06:30 - 000000000 ____D C:\Users\Plácido\AppData\Local\ZHP
2019-10-12 06:09 - 2019-10-12 06:10 - 020889016 _____ (Piriform Software Ltd) C:\Users\Plácido\Downloads\ccsetup561.exe
2019-10-12 06:08 - 2019-10-12 06:08 - 003335552 _____ (Nicolas Coolman) C:\Users\Plácido\Downloads\ZHPCleaner.exe
2019-10-12 06:07 - 2019-10-12 06:07 - 007636680 _____ (Malwarebytes) C:\Users\Plácido\Downloads\adwcleaner_7.4.1.exe
2019-10-12 06:04 - 2019-10-12 06:04 - 066606040 _____ (Malwarebytes ) C:\Users\Plácido\Downloads\mb3-setup-consumer-3.8.3.2965-1.0.629-1.0.12857.exe
2019-10-12 06:01 - 2019-10-12 06:01 - 000000000 ____D C:\ProgramData\Doctor Web
2019-10-12 05:38 - 2019-10-12 05:38 - 000000000 ____D C:\Users\Plácido\AppData\Local\mbam
2019-10-12 05:37 - 2019-10-12 05:37 - 000000000 ____D C:\Users\Plácido\AppData\Local\mbamtray
2019-10-12 05:27 - 2019-10-12 06:27 - 000000000 ____D C:\AdwCleaner
2019-10-11 01:08 - 2008-08-18 19:18 - 000077824 _____ (Fox Magic Software) C:\WINDOWS\SysWOW64\fmcodec.DLL
2019-10-09 03:56 - 2019-10-09 03:56 - 025900544 _____ (Microsoft Corporation) C:\WINDOWS\system32\edgehtml.dll
2019-10-09 03:56 - 2019-10-09 03:56 - 025443840 _____ (Microsoft Corporation) C:\WINDOWS\system32\Hydrogen.dll
2019-10-09 03:56 - 2019-10-09 03:56 - 022628352 _____ (Microsoft Corporation) C:\WINDOWS\system32\mshtml.dll
2019-10-09 03:56 - 2019-10-09 03:56 - 019849216 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\edgehtml.dll
2019-10-09 03:56 - 2019-10-09 03:56 - 019811840 _____ (Microsoft Corporation) C:\WINDOWS\system32\HologramWorld.dll
2019-10-09 03:56 - 2019-10-09 03:56 - 018019840 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\mshtml.dll
2019-10-09 03:56 - 2019-10-09 03:56 - 017787392 _____ (Microsoft Corporation) C:\WINDOWS\system32\Windows.UI.Xaml.dll
2019-10-09 03:56 - 2019-10-09 03:56 - 014816256 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\Windows.UI.Xaml.dll
2019-10-09 03:56 - 2019-10-09 03:56 - 009928504 _____ (Microsoft Corporation) C:\WINDOWS\system32\ntoskrnl.exe
2019-10-09 03:56 - 2019-10-09 03:56 - 008010752 _____ (Microsoft Corporation) C:\WINDOWS\system32\mstscax.dll
2019-10-09 03:56 - 2019-10-09 03:56 - 007754240 _____ (Microsoft Corporation) C:\WINDOWS\system32\Chakra.dll
2019-10-09 03:56 - 2019-10-09 03:56 - 007600664 _____ (Microsoft Corporation) C:\WINDOWS\system32\Windows.Media.Protection.PlayReady.dll
2019-10-09 03:56 - 2019-10-09 03:56 - 007195648 _____ (Microsoft Corporation) C:\WINDOWS\system32\ieframe.dll
2019-10-09 03:56 - 2019-10-09 03:56 - 007015936 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\mstscax.dll
2019-10-09 03:56 - 2019-10-09 03:56 - 006517640 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\Windows.Media.Protection.PlayReady.dll
2019-10-09 03:56 - 2019-10-09 03:56 - 006232064 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\ieframe.dll
2019-10-09 03:56 - 2019-10-09 03:56 - 005915648 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\Chakra.dll
2019-10-09 03:56 - 2019-10-09 03:56 - 005041664 _____ (Microsoft Corporation) C:\WINDOWS\system32\wininet.dll
2019-10-09 03:56 - 2019-10-09 03:56 - 004562688 _____ (Microsoft Corporation) C:\WINDOWS\system32\sppsvc.exe
2019-10-09 03:56 - 2019-10-09 03:56 - 004538880 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\wininet.dll
2019-10-09 03:56 - 2019-10-09 03:56 - 004129616 _____ (Microsoft Corporation) C:\WINDOWS\system32\mfcore.dll
2019-10-09 03:56 - 2019-10-09 03:56 - 004012544 _____ (Microsoft Corporation) C:\WINDOWS\system32\EdgeContent.dll
2019-10-09 03:56 - 2019-10-09 03:56 - 003947008 _____ (Microsoft Corporation) C:\WINDOWS\system32\tellib.dll
2019-10-09 03:56 - 2019-10-09 03:56 - 003771392 _____ (Microsoft Corporation) C:\WINDOWS\system32\diagtrack.dll
2019-10-09 03:56 - 2019-10-09 03:56 - 003701760 _____ (Microsoft Corporation) C:\WINDOWS\system32\AppXDeploymentServer.dll
2019-10-09 03:56 - 2019-10-09 03:56 - 003525592 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\mfcore.dll
2019-10-09 03:56 - 2019-10-09 03:56 - 003365376 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\xpsrchvw.exe
2019-10-09 03:56 - 2019-10-09 03:56 - 002861568 _____ (Microsoft Corporation) C:\WINDOWS\system32\xpsservices.dll
2019-10-09 03:56 - 2019-10-09 03:56 - 002762504 _____ (Microsoft Corporation) C:\WINDOWS\system32\KernelBase.dll
2019-10-09 03:56 - 2019-10-09 03:56 - 002755584 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\mshtml.tlb
2019-10-09 03:56 - 2019-10-09 03:56 - 002755584 _____ (Microsoft Corporation) C:\WINDOWS\system32\mshtml.tlb
2019-10-09 03:56 - 2019-10-09 03:56 - 002723328 _____ (Microsoft Corporation) C:\WINDOWS\system32\win32kbase.sys
2019-10-09 03:56 - 2019-10-09 03:56 - 002703360 _____ (Microsoft Corporation) C:\WINDOWS\system32\WebRuntimeManager.dll
2019-10-09 03:56 - 2019-10-09 03:56 - 002494440 _____ (Microsoft Corporation) C:\WINDOWS\system32\msmpeg2vdec.dll
2019-10-09 03:56 - 2019-10-09 03:56 - 002456064 _____ (Microsoft Corporation) C:\WINDOWS\system32\InstallService.dll
2019-10-09 03:56 - 2019-10-09 03:56 - 002448712 _____ (Microsoft Corporation) C:\WINDOWS\system32\msxml6.dll
2019-10-09 03:56 - 2019-10-09 03:56 - 002422592 _____ (Microsoft Corporation) C:\WINDOWS\system32\WMVCORE.DLL
2019-10-09 03:56 - 2019-10-09 03:56 - 002314648 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\msmpeg2vdec.dll
2019-10-09 03:56 - 2019-10-09 03:56 - 002284032 _____ (Microsoft Corporation) C:\WINDOWS\system32\AppXDeploymentExtensions.onecore.dll
2019-10-09 03:56 - 2019-10-09 03:56 - 002236144 _____ (Microsoft Corporation) C:\WINDOWS\system32\mfasfsrcsnk.dll
2019-10-09 03:56 - 2019-10-09 03:56 - 002138472 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\WMVCORE.DLL
2019-10-09 03:56 - 2019-10-09 03:56 - 002114048 _____ (Microsoft Corporation) C:\WINDOWS\system32\Windows.CloudStore.dll
2019-10-09 03:56 - 2019-10-09 03:56 - 002095104 _____ (Microsoft Corporation) C:\WINDOWS\system32\ExplorerFrame.dll
2019-10-09 03:56 - 2019-10-09 03:56 - 002081976 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\KernelBase.dll
2019-10-09 03:56 - 2019-10-09 03:56 - 002000168 _____ (Microsoft Corporation) C:\WINDOWS\system32\ntdll.dll
2019-10-09 03:56 - 2019-10-09 03:56 - 001952360 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\msxml6.dll
2019-10-09 03:56 - 2019-10-09 03:56 - 001847808 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\xpsservices.dll
2019-10-09 03:56 - 2019-10-09 03:56 - 001830200 _____ (Microsoft Corporation) C:\WINDOWS\system32\rdpserverbase.dll
2019-10-09 03:56 - 2019-10-09 03:56 - 001748480 _____ (Microsoft Corporation) C:\WINDOWS\system32\AppXDeploymentExtensions.desktop.dll
2019-10-09 03:56 - 2019-10-09 03:56 - 001743672 _____ (Microsoft Corporation) C:\WINDOWS\system32\sppobjs.dll
2019-10-09 03:56 - 2019-10-09 03:56 - 001730560 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\InstallService.dll
2019-10-09 03:56 - 2019-10-09 03:56 - 001721144 _____ (Microsoft Corporation) C:\WINDOWS\system32\appraiser.dll
2019-10-09 03:56 - 2019-10-09 03:56 - 001687040 _____ (Microsoft Corporation) C:\WINDOWS\system32\XpsPrint.dll
2019-10-09 03:56 - 2019-10-09 03:56 - 001664928 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\user32.dll
2019-10-09 03:56 - 2019-10-09 03:56 - 001656392 _____ (Microsoft Corporation) C:\WINDOWS\system32\user32.dll
2019-10-09 03:56 - 2019-10-09 03:56 - 001610752 _____ (Microsoft Corporation) C:\WINDOWS\system32\HologramCompositor.dll
2019-10-09 03:56 - 2019-10-09 03:56 - 001563648 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\ExplorerFrame.dll
2019-10-09 03:56 - 2019-10-09 03:56 - 001562424 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\rdpserverbase.dll
2019-10-09 03:56 - 2019-10-09 03:56 - 001439744 _____ (Microsoft Corporation) C:\WINDOWS\system32\usocoreworker.exe
2019-10-09 03:56 - 2019-10-09 03:56 - 001394488 _____ (Microsoft Corporation) C:\WINDOWS\system32\hvix64.exe
2019-10-09 03:56 - 2019-10-09 03:56 - 001319936 _____ (Microsoft Corporation) C:\WINDOWS\system32\webplatstorageserver.dll
2019-10-09 03:56 - 2019-10-09 03:56 - 001283072 _____ (Microsoft Corporation) C:\WINDOWS\system32\werconcpl.dll
2019-10-09 03:56 - 2019-10-09 03:56 - 001273392 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\mfasfsrcsnk.dll
2019-10-09 03:56 - 2019-10-09 03:56 - 001217904 _____ (Microsoft Corporation) C:\WINDOWS\system32\ClipUp.exe
2019-10-09 03:56 - 2019-10-09 03:56 - 001214976 _____ (Microsoft Corporation) C:\WINDOWS\system32\reseteng.dll
2019-10-09 03:56 - 2019-10-09 03:56 - 001152016 _____ (Microsoft Corporation) C:\WINDOWS\system32\mfmpeg2srcsnk.dll
2019-10-09 03:56 - 2019-10-09 03:56 - 001149712 _____ (Microsoft Corporation) C:\WINDOWS\system32\ApplyTrustOffline.exe
2019-10-09 03:56 - 2019-10-09 03:56 - 001098712 _____ (Microsoft Corporation) C:\WINDOWS\system32\DolbyDecMFT.dll
2019-10-09 03:56 - 2019-10-09 03:56 - 001084432 _____ (Microsoft Corporation) C:\WINDOWS\system32\ReAgent.dll
2019-10-09 03:56 - 2019-10-09 03:56 - 001072952 _____ (Microsoft Corporation) C:\WINDOWS\system32\hvax64.exe
2019-10-09 03:56 - 2019-10-09 03:56 - 001066496 _____ (Microsoft Corporation) C:\WINDOWS\system32\MusUpdateHandlers.dll
2019-10-09 03:56 - 2019-10-09 03:56 - 001012792 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\mfmpeg2srcsnk.dll
2019-10-09 03:56 - 2019-10-09 03:56 - 000952416 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\DolbyDecMFT.dll
2019-10-09 03:56 - 2019-10-09 03:56 - 000923136 _____ (Microsoft Corporation) C:\WINDOWS\system32\EdgeManager.dll
2019-10-09 03:56 - 2019-10-09 03:56 - 000904208 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\ReAgent.dll
2019-10-09 03:56 - 2019-10-09 03:56 - 000890472 _____ (Microsoft Corporation) C:\WINDOWS\system32\ci.dll
2019-10-09 03:56 - 2019-10-09 03:56 - 000882688 _____ (Microsoft Corporation) C:\WINDOWS\system32\CPFilters.dll
2019-10-09 03:56 - 2019-10-09 03:56 - 000880088 _____ (Microsoft Corporation) C:\WINDOWS\system32\wer.dll
2019-10-09 03:56 - 2019-10-09 03:56 - 000856576 _____ C:\WINDOWS\system32\MBR2GPT.EXE
2019-10-09 03:56 - 2019-10-09 03:56 - 000844800 _____ (Microsoft Corporation) C:\WINDOWS\system32\winlogon.exe
2019-10-09 03:56 - 2019-10-09 03:56 - 000843776 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\webplatstorageserver.dll
2019-10-09 03:56 - 2019-10-09 03:56 - 000842752 _____ (Microsoft Corporation) C:\WINDOWS\system32\jscript.dll
2019-10-09 03:56 - 2019-10-09 03:56 - 000829536 _____ (Microsoft Corporation) C:\WINDOWS\system32\BioIso.exe
2019-10-09 03:56 - 2019-10-09 03:56 - 000818688 _____ (Microsoft Corporation) C:\WINDOWS\system32\LogonController.dll
2019-10-09 03:56 - 2019-10-09 03:56 - 000814080 _____ (Microsoft Corporation) C:\WINDOWS\system32\comdlg32.dll
2019-10-09 03:56 - 2019-10-09 03:56 - 000774672 _____ (Microsoft Corporation) C:\WINDOWS\system32\securekernel.exe
2019-10-09 03:56 - 2019-10-09 03:56 - 000758584 _____ (Microsoft Corporation) C:\WINDOWS\system32\wimgapi.dll
2019-10-09 03:56 - 2019-10-09 03:56 - 000717312 _____ (Microsoft Corporation) C:\WINDOWS\system32\mousocoreworker.exe
2019-10-09 03:56 - 2019-10-09 03:56 - 000701952 _____ (Microsoft Corporation) C:\WINDOWS\system32\Windows.UI.FileExplorer.dll
2019-10-09 03:56 - 2019-10-09 03:56 - 000691712 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\comdlg32.dll
2019-10-09 03:56 - 2019-10-09 03:56 - 000690176 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\jscript.dll
2019-10-09 03:56 - 2019-10-09 03:56 - 000689152 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\CPFilters.dll
2019-10-09 03:56 - 2019-10-09 03:56 - 000679880 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\wer.dll
2019-10-09 03:56 - 2019-10-09 03:56 - 000669496 _____ (Microsoft Corporation) C:\WINDOWS\system32\computecore.dll
2019-10-09 03:56 - 2019-10-09 03:56 - 000667136 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\EdgeManager.dll
2019-10-09 03:56 - 2019-10-09 03:56 - 000598024 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\wimgapi.dll
2019-10-09 03:56 - 2019-10-09 03:56 - 000596992 _____ (Microsoft Corporation) C:\WINDOWS\system32\MusNotification.exe
2019-10-09 03:56 - 2019-10-09 03:56 - 000595456 _____ (Microsoft Corporation) C:\WINDOWS\system32\vbscript.dll
2019-10-09 03:56 - 2019-10-09 03:56 - 000578560 _____ (Microsoft Corporation) C:\WINDOWS\system32\SppExtComObj.Exe
2019-10-09 03:56 - 2019-10-09 03:56 - 000537600 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\mf.dll
2019-10-09 03:56 - 2019-10-09 03:56 - 000533504 _____ (Microsoft Corporation) C:\WINDOWS\system32\schannel.dll
2019-10-09 03:56 - 2019-10-09 03:56 - 000531968 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\vbscript.dll
2019-10-09 03:56 - 2019-10-09 03:56 - 000530432 _____ (Microsoft Corporation) C:\WINDOWS\system32\sppcext.dll
2019-10-09 03:56 - 2019-10-09 03:56 - 000520192 _____ (Microsoft Corporation) C:\WINDOWS\system32\usosvc.dll
2019-10-09 03:56 - 2019-10-09 03:56 - 000516544 _____ (Microsoft Corporation) C:\WINDOWS\system32\mf.dll
2019-10-09 03:56 - 2019-10-09 03:56 - 000516408 _____ (Microsoft Corporation) C:\WINDOWS\system32\wimserv.exe
2019-10-09 03:56 - 2019-10-09 03:56 - 000515896 _____ (Microsoft Corporation) C:\WINDOWS\system32\WerFault.exe
2019-10-09 03:56 - 2019-10-09 03:56 - 000513536 _____ (Microsoft Corporation) C:\WINDOWS\system32\MusNotificationUx.exe
2019-10-09 03:56 - 2019-10-09 03:56 - 000496640 _____ (Microsoft Corporation) C:\WINDOWS\system32\werui.dll
2019-10-09 03:56 - 2019-10-09 03:56 - 000487424 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\Windows.UI.FileExplorer.dll
2019-10-09 03:56 - 2019-10-09 03:56 - 000466416 _____ (Microsoft Corporation) C:\WINDOWS\system32\Faultrep.dll
2019-10-09 03:56 - 2019-10-09 03:56 - 000462848 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\schannel.dll
2019-10-09 03:56 - 2019-10-09 03:56 - 000462136 _____ (Microsoft Corporation) C:\WINDOWS\system32\msv1_0.dll
2019-10-09 03:56 - 2019-10-09 03:56 - 000456504 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\rdbss.sys
2019-10-09 03:56 - 2019-10-09 03:56 - 000452408 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\WerFault.exe
2019-10-09 03:56 - 2019-10-09 03:56 - 000436536 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\pci.sys
2019-10-09 03:56 - 2019-10-09 03:56 - 000429568 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\werui.dll
2019-10-09 03:56 - 2019-10-09 03:56 - 000422008 _____ (Microsoft Corporation) C:\WINDOWS\system32\SgrmEnclave_secure.dll
2019-10-09 03:56 - 2019-10-09 03:56 - 000412152 _____ (Microsoft Corporation) C:\WINDOWS\system32\MusNotifyIcon.exe
2019-10-09 03:56 - 2019-10-09 03:56 - 000404392 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\Faultrep.dll
2019-10-09 03:56 - 2019-10-09 03:56 - 000380216 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\msv1_0.dll
2019-10-09 03:56 - 2019-10-09 03:56 - 000355840 _____ (Microsoft Corporation) C:\WINDOWS\system32\WaaSMedicSvc.dll
2019-10-09 03:56 - 2019-10-09 03:56 - 000353792 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\msrd3x40.dll
2019-10-09 03:56 - 2019-10-09 03:56 - 000324408 _____ (Microsoft Corporation) C:\WINDOWS\system32\acmigration.dll
2019-10-09 03:56 - 2019-10-09 03:56 - 000300184 _____ (Microsoft Corporation) C:\WINDOWS\system32\skci.dll
2019-10-09 03:56 - 2019-10-09 03:56 - 000261632 _____ (Microsoft Corporation) C:\WINDOWS\system32\WaaSMedicCapsule.dll
2019-10-09 03:56 - 2019-10-09 03:56 - 000247856 _____ (Microsoft Corporation) C:\WINDOWS\system32\weretw.dll
2019-10-09 03:56 - 2019-10-09 03:56 - 000241152 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\msltus40.dll
2019-10-09 03:56 - 2019-10-09 03:56 - 000231936 _____ (Microsoft Corporation) C:\WINDOWS\system32\InstallServiceTasks.dll
2019-10-09 03:56 - 2019-10-09 03:56 - 000227840 _____ (Microsoft Corporation) C:\WINDOWS\system32\IndexedDbLegacy.dll
2019-10-09 03:56 - 2019-10-09 03:56 - 000225080 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\wof.sys
2019-10-09 03:56 - 2019-10-09 03:56 - 000224768 _____ (Microsoft Corporation) C:\WINDOWS\system32\DWWIN.EXE
2019-10-09 03:56 - 2019-10-09 03:56 - 000224256 _____ (Microsoft Corporation) C:\WINDOWS\system32\wersvc.dll
2019-10-09 03:56 - 2019-10-09 03:56 - 000220472 _____ (Microsoft Corporation) C:\WINDOWS\system32\wermgr.exe
2019-10-09 03:56 - 2019-10-09 03:56 - 000202040 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\appid.sys
2019-10-09 03:56 - 2019-10-09 03:56 - 000201728 _____ (Microsoft Corporation) C:\WINDOWS\system32\AppXApplicabilityBlob.dll
2019-10-09 03:56 - 2019-10-09 03:56 - 000199480 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\wermgr.exe
2019-10-09 03:56 - 2019-10-09 03:56 - 000197632 _____ (Microsoft Corporation) C:\WINDOWS\system32\Win32CompatibilityAppraiserCSP.dll
2019-10-09 03:56 - 2019-10-09 03:56 - 000193592 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\weretw.dll
2019-10-09 03:56 - 2019-10-09 03:56 - 000186880 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\DWWIN.EXE
2019-10-09 03:56 - 2019-10-09 03:56 - 000179712 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\InstallServiceTasks.dll
2019-10-09 03:56 - 2019-10-09 03:56 - 000175616 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\IndexedDbLegacy.dll
2019-10-09 03:56 - 2019-10-09 03:56 - 000165832 _____ (Microsoft Corporation) C:\WINDOWS\system32\WerFaultSecure.exe
2019-10-09 03:56 - 2019-10-09 03:56 - 000158720 _____ (Microsoft Corporation) C:\WINDOWS\system32\umpo.dll
2019-10-09 03:56 - 2019-10-09 03:56 - 000155136 _____ (Microsoft Corporation) C:\WINDOWS\system32\Chakradiag.dll
2019-10-09 03:56 - 2019-10-09 03:56 - 000150328 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\WerFaultSecure.exe
2019-10-09 03:56 - 2019-10-09 03:56 - 000139776 _____ (Microsoft Corporation) C:\WINDOWS\system32\Chakrathunk.dll
2019-10-09 03:56 - 2019-10-09 03:56 - 000122880 _____ (Microsoft Corporation) C:\WINDOWS\system32\wercplsupport.dll
2019-10-09 03:56 - 2019-10-09 03:56 - 000121856 _____ (Microsoft Corporation) C:\WINDOWS\system32\updatecsp.dll
2019-10-09 03:56 - 2019-10-09 03:56 - 000117248 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\Chakradiag.dll
2019-10-09 03:56 - 2019-10-09 03:56 - 000117048 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\bindflt.sys
2019-10-09 03:56 - 2019-10-09 03:56 - 000108032 _____ (Microsoft Corporation) C:\WINDOWS\system32\TpmTasks.dll
2019-10-09 03:56 - 2019-10-09 03:56 - 000105472 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\Chakrathunk.dll
2019-10-09 03:56 - 2019-10-09 03:56 - 000092160 _____ (Microsoft Corporation) C:\WINDOWS\system32\wsqmcons.exe
2019-10-09 03:56 - 2019-10-09 03:56 - 000090624 _____ (Microsoft Corporation) C:\WINDOWS\system32\tsgqec.dll
2019-10-09 03:56 - 2019-10-09 03:56 - 000089088 _____ (Microsoft Corporation) C:\WINDOWS\system32\WaaSMedicAgent.exe
2019-10-09 03:56 - 2019-10-09 03:56 - 000077824 _____ (Microsoft Corporation) C:\WINDOWS\system32\CustomInstallExec.exe
2019-10-09 03:56 - 2019-10-09 03:56 - 000070144 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\tsgqec.dll
2019-10-09 03:56 - 2019-10-09 03:56 - 000065536 _____ (Microsoft Corporation) C:\WINDOWS\system32\iemigplugin.dll
2019-10-09 03:56 - 2019-10-09 03:56 - 000063488 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\iemigplugin.dll
2019-10-09 03:56 - 2019-10-09 03:56 - 000052736 _____ (Microsoft Corporation) C:\WINDOWS\system32\jsproxy.dll
2019-10-09 03:56 - 2019-10-09 03:56 - 000045056 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\jsproxy.dll
2019-10-09 03:56 - 2019-10-09 03:56 - 000044544 _____ (Microsoft Corporation) C:\WINDOWS\system32\werdiagcontroller.dll
2019-10-09 03:56 - 2019-10-09 03:56 - 000039304 _____ (Microsoft Corporation) C:\WINDOWS\system32\NtlmShared.dll
2019-10-09 03:56 - 2019-10-09 03:56 - 000038912 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\werdiagcontroller.dll
2019-10-09 03:56 - 2019-10-09 03:56 - 000037176 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\wimmount.sys
2019-10-09 03:56 - 2019-10-09 03:56 - 000033048 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\NtlmShared.dll
2019-10-09 03:56 - 2019-10-09 03:56 - 000028672 _____ (Microsoft Corporation) C:\WINDOWS\system32\WaaSMedicPS.dll
2019-10-09 03:56 - 2019-10-09 03:56 - 000017920 _____ (Microsoft Corporation) C:\WINDOWS\system32\bindflt.dll
2019-10-09 03:56 - 2019-10-09 03:56 - 000013824 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\KBDJPN.DLL
2019-10-09 03:56 - 2019-10-09 03:56 - 000007680 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\kbd106.dll
2019-10-09 03:56 - 2019-10-09 03:56 - 000002560 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\msxml6r.dll
2019-10-09 03:56 - 2019-10-09 03:56 - 000002560 _____ (Microsoft Corporation) C:\WINDOWS\system32\msxml6r.dll
2019-10-09 03:51 - 2019-09-20 06:36 - 000492544 _____ (Microsoft Corporation) C:\WINDOWS\system32\poqexec.exe
2019-10-09 03:51 - 2019-09-20 06:14 - 000390656 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\poqexec.exe
2019-10-04 16:11 - 2019-10-04 16:11 - 000701440 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\Windows.Mirage.Internal.dll
2019-10-04 16:11 - 2019-10-04 16:11 - 000346624 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\secproc.dll
2019-09-30 21:25 - 2019-09-30 21:25 - 007905000 _____ (Microsoft Corporation) C:\WINDOWS\system32\windows.storage.dll
2019-09-30 21:25 - 2019-09-30 21:25 - 007848192 _____ (Microsoft Corporation) C:\WINDOWS\system32\OneCoreUAPCommonProxyStub.dll
2019-09-30 21:25 - 2019-09-30 21:25 - 007263992 _____ (Microsoft Corporation) C:\WINDOWS\system32\shell32.dll
2019-09-30 21:25 - 2019-09-30 21:25 - 006425600 _____ (Microsoft Corporation) C:\WINDOWS\system32\twinui.dll
2019-09-30 21:25 - 2019-09-30 21:25 - 006227624 _____ (Microsoft Corporation) C:\WINDOWS\system32\StartTileData.dll
2019-09-30 21:25 - 2019-09-30 21:25 - 006164480 _____ (Microsoft Corporation) C:\WINDOWS\system32\twinui.pcshell.dll
2019-09-30 21:25 - 2019-09-30 21:25 - 006084048 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\windows.storage.dll
2019-09-30 21:25 - 2019-09-30 21:25 - 005865272 _____ (Microsoft Corporation) C:\WINDOWS\system32\spwizimg.dll
2019-09-30 21:25 - 2019-09-30 21:25 - 005764872 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\shell32.dll
2019-09-30 21:25 - 2019-09-30 21:25 - 005105152 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\twinui.dll
2019-09-30 21:25 - 2019-09-30 21:25 - 004612520 _____ (Microsoft Corporation) C:\WINDOWS\explorer.exe
2019-09-30 21:25 - 2019-09-30 21:25 - 004481536 _____ (Microsoft Corporation) C:\WINDOWS\system32\DHolographicDisplay.dll
2019-09-30 21:25 - 2019-09-30 21:25 - 004046336 _____ (Microsoft Corporation) C:\WINDOWS\system32\SRH.dll
2019-09-30 21:25 - 2019-09-30 21:25 - 003964056 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\explorer.exe
2019-09-30 21:25 - 2019-09-30 21:25 - 003742032 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\OneCoreUAPCommonProxyStub.dll
2019-09-30 21:25 - 2019-09-30 21:25 - 003727360 _____ (Microsoft Corporation) C:\WINDOWS\system32\win32kfull.sys
2019-09-30 21:25 - 2019-09-30 21:25 - 003590968 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\dxgkrnl.sys
2019-09-30 21:25 - 2019-09-30 21:25 - 003553280 _____ (Microsoft Corporation) C:\WINDOWS\system32\dwmcore.dll
2019-09-30 21:25 - 2019-09-30 21:25 - 003386880 _____ (Microsoft Corporation) C:\WINDOWS\system32\NetworkMobileSettings.dll
2019-09-30 21:25 - 2019-09-30 21:25 - 003184128 _____ (Microsoft Corporation) C:\WINDOWS\system32\CertEnroll.dll
2019-09-30 21:25 - 2019-09-30 21:25 - 003105280 _____ (Microsoft Corporation) C:\WINDOWS\system32\wuaueng.dll
2019-09-30 21:25 - 2019-09-30 21:25 - 002821120 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\CertEnroll.dll
2019-09-30 21:25 - 2019-09-30 21:25 - 002799616 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\win32kfull.sys
2019-09-30 21:25 - 2019-09-30 21:25 - 002772032 _____ (Microsoft Corporation) C:\WINDOWS\system32\iertutil.dll
2019-09-30 21:25 - 2019-09-30 21:25 - 002590208 _____ C:\WINDOWS\system32\dwmscene.dll
2019-09-30 21:25 - 2019-09-30 21:25 - 002552120 _____ (Microsoft Corporation) C:\WINDOWS\system32\UpdateAgent.dll
2019-09-30 21:25 - 2019-09-30 21:25 - 002466304 _____ (Microsoft Corporation) C:\WINDOWS\system32\d3d11.dll
2019-09-30 21:25 - 2019-09-30 21:25 - 002258856 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\iertutil.dll
2019-09-30 21:25 - 2019-09-30 21:25 - 002190864 _____ (Microsoft Corporation) C:\WINDOWS\system32\AppVEntSubsystems64.dll
2019-09-30 21:25 - 2019-09-30 21:25 - 002160640 _____ (Microsoft Corporation) C:\WINDOWS\system32\pnidui.dll
2019-09-30 21:25 - 2019-09-30 21:25 - 002132280 _____ (Microsoft Corporation) C:\WINDOWS\system32\wsp_fs.dll
2019-09-30 21:25 - 2019-09-30 21:25 - 002120704 _____ (Microsoft Corporation) C:\WINDOWS\system32\WpcDesktopMonSvc.dll
2019-09-30 21:25 - 2019-09-30 21:25 - 002120272 _____ (Microsoft Corporation) C:\WINDOWS\system32\AudioEng.dll
2019-09-30 21:25 - 2019-09-30 21:25 - 002069504 _____ (Microsoft Corporation) C:\WINDOWS\system32\ISM.dll
2019-09-30 21:25 - 2019-09-30 21:25 - 001957008 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\d3d11.dll
2019-09-30 21:25 - 2019-09-30 21:25 - 001942528 _____ (Microsoft Corporation) C:\WINDOWS\system32\audiosrv.dll
2019-09-30 21:25 - 2019-09-30 21:25 - 001940952 _____ (Microsoft Corporation) C:\WINDOWS\system32\dcomp.dll
2019-09-30 21:25 - 2019-09-30 21:25 - 001913296 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\AudioEng.dll
2019-09-30 21:25 - 2019-09-30 21:25 - 001857024 _____ (Microsoft Corporation) C:\WINDOWS\system32\urlmon.dll
2019-09-30 21:25 - 2019-09-30 21:25 - 001845408 _____ (Microsoft Corporation) C:\WINDOWS\system32\d3d9.dll
2019-09-30 21:25 - 2019-09-30 21:25 - 001835008 _____ (Microsoft Corporation) C:\WINDOWS\system32\enterprisecsps.dll
2019-09-30 21:25 - 2019-09-30 21:25 - 001819136 _____ (Microsoft Corporation) C:\WINDOWS\system32\CoreShell.dll
2019-09-30 21:25 - 2019-09-30 21:25 - 001788728 _____ (Microsoft Corporation) C:\WINDOWS\system32\wsp_health.dll
2019-09-30 21:25 - 2019-09-30 21:25 - 001757096 _____ (Microsoft Corporation) C:\WINDOWS\system32\winload.efi
2019-09-30 21:25 - 2019-09-30 21:25 - 001716752 _____ (Microsoft Corporation) C:\WINDOWS\system32\AppVEntVirtualization.dll
2019-09-30 21:25 - 2019-09-30 21:25 - 001692160 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\urlmon.dll
2019-09-30 21:25 - 2019-09-30 21:25 - 001664376 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\ntdll.dll
2019-09-30 21:25 - 2019-09-30 21:25 - 001657856 _____ (Microsoft Corporation) C:\WINDOWS\system32\lsasrv.dll
2019-09-30 21:25 - 2019-09-30 21:25 - 001616784 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\d3d9.dll
2019-09-30 21:25 - 2019-09-30 21:25 - 001616608 _____ (Microsoft Corporation) C:\WINDOWS\system32\ttdrecordcpu.dll
2019-09-30 21:25 - 2019-09-30 21:25 - 001611792 _____ (Microsoft Corporation) C:\WINDOWS\system32\AppVIntegration.dll
2019-09-30 21:25 - 2019-09-30 21:25 - 001607680 _____ (Microsoft Corporation) C:\WINDOWS\system32\wpncore.dll
2019-09-30 21:25 - 2019-09-30 21:25 - 001543168 _____ (Microsoft Corporation) C:\WINDOWS\system32\WindowManagement.dll
2019-09-30 21:25 - 2019-09-30 21:25 - 001512320 _____ (Microsoft Corporation) C:\WINDOWS\system32\winload.exe
2019-09-30 21:25 - 2019-09-30 21:25 - 001510752 _____ (Microsoft Corporation) C:\WINDOWS\system32\msvproc.dll
2019-09-30 21:25 - 2019-09-30 21:25 - 001505320 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\wsp_fs.dll
2019-09-30 21:25 - 2019-09-30 21:25 - 001501712 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\AppVEntSubsystems32.dll
2019-09-30 21:25 - 2019-09-30 21:25 - 001482040 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\ndis.sys
2019-09-30 21:25 - 2019-09-30 21:25 - 001473488 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\dcomp.dll
2019-09-30 21:25 - 2019-09-30 21:25 - 001413704 _____ (Microsoft Corporation) C:\WINDOWS\system32\AudioSes.dll
2019-09-30 21:25 - 2019-09-30 21:25 - 001412096 _____ (Microsoft Corporation) C:\WINDOWS\system32\SystemSettings.Handlers.dll
2019-09-30 21:25 - 2019-09-30 21:25 - 001386000 _____ (Microsoft Corporation) C:\WINDOWS\system32\AppVEntSubsystemController.dll
2019-09-30 21:25 - 2019-09-30 21:25 - 001383856 _____ (Microsoft Corporation) C:\WINDOWS\system32\Windows.UI.dll
2019-09-30 21:25 - 2019-09-30 21:25 - 001372160 _____ (Microsoft Corporation) C:\WINDOWS\system32\NotificationController.dll
2019-09-30 21:25 - 2019-09-30 21:25 - 001366128 _____ (Microsoft Corporation) C:\WINDOWS\system32\winresume.efi
2019-09-30 21:25 - 2019-09-30 21:25 - 001334064 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\ttdrecordcpu.dll
2019-09-30 21:25 - 2019-09-30 21:25 - 001297936 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\wsp_health.dll
2019-09-30 21:25 - 2019-09-30 21:25 - 001263616 _____ (Microsoft Corporation) C:\WINDOWS\system32\opengl32.dll
2019-09-30 21:25 - 2019-09-30 21:25 - 001261800 _____ (Microsoft Corporation) C:\WINDOWS\system32\msctf.dll
2019-09-30 21:25 - 2019-09-30 21:25 - 001244944 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\msvproc.dll
2019-09-30 21:25 - 2019-09-30 21:25 - 001182240 _____ (Microsoft Corporation) C:\WINDOWS\system32\winresume.exe
2019-09-30 21:25 - 2019-09-30 21:25 - 001178816 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\ucrtbase.dll
2019-09-30 21:25 - 2019-09-30 21:25 - 001154656 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\AudioSes.dll
2019-09-30 21:25 - 2019-09-30 21:25 - 001150240 _____ (Microsoft Corporation) C:\WINDOWS\system32\InputHost.dll
2019-09-30 21:25 - 2019-09-30 21:25 - 001091584 _____ (Microsoft Corporation) C:\WINDOWS\system32\TpmCoreProvisioning.dll
2019-09-30 21:25 - 2019-09-30 21:25 - 001080320 _____ (Microsoft Corporation) C:\WINDOWS\system32\clusapi.dll
2019-09-30 21:25 - 2019-09-30 21:25 - 001062912 _____ (Microsoft Corporation) C:\WINDOWS\system32\MPSSVC.dll
2019-09-30 21:25 - 2019-09-30 21:25 - 001054872 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\msctf.dll
2019-09-30 21:25 - 2019-09-30 21:25 - 001047968 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\Windows.UI.dll
2019-09-30 21:25 - 2019-09-30 21:25 - 001043984 _____ (Microsoft Corporation) C:\WINDOWS\system32\AppVPolicy.dll
2019-09-30 21:25 - 2019-09-30 21:25 - 001036800 _____ (Microsoft Corporation) C:\WINDOWS\system32\wcmsvc.dll
2019-09-30 21:25 - 2019-09-30 21:25 - 001029432 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\ClipSp.sys
2019-09-30 21:25 - 2019-09-30 21:25 - 001023128 _____ (Microsoft Corporation) C:\WINDOWS\system32\ucrtbase.dll
2019-09-30 21:25 - 2019-09-30 21:25 - 001009152 _____ (Microsoft Corporation) C:\WINDOWS\system32\kerberos.dll
2019-09-30 21:25 - 2019-09-30 21:25 - 000984376 _____ (Microsoft Corporation) C:\WINDOWS\system32\winhttp.dll
2019-09-30 21:25 - 2019-09-30 21:25 - 000975872 _____ (Microsoft Corporation) C:\WINDOWS\system32\uDWM.dll
2019-09-30 21:25 - 2019-09-30 21:25 - 000960512 _____ (Microsoft Corporation) C:\WINDOWS\system32\assignedaccessmanagersvc.dll
2019-09-30 21:25 - 2019-09-30 21:25 - 000957240 _____ (Microsoft Corporation) C:\WINDOWS\system32\AppVManifest.dll
2019-09-30 21:25 - 2019-09-30 21:25 - 000950784 _____ (Microsoft Corporation) C:\WINDOWS\system32\rasapi32.dll
2019-09-30 21:25 - 2019-09-30 21:25 - 000944664 _____ (Microsoft Corporation) C:\WINDOWS\system32\dxgi.dll
2019-09-30 21:25 - 2019-09-30 21:25 - 000939008 _____ (Microsoft Corporation) C:\WINDOWS\system32\fveapi.dll
2019-09-30 21:25 - 2019-09-30 21:25 - 000931840 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\WdiWiFi.sys
2019-09-30 21:25 - 2019-09-30 21:25 - 000923136 _____ (Microsoft Corporation) C:\WINDOWS\system32\Windows.Internal.Management.dll
2019-09-30 21:25 - 2019-09-30 21:25 - 000904704 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\opengl32.dll
2019-09-30 21:25 - 2019-09-30 21:25 - 000893952 _____ (Microsoft Corporation) C:\WINDOWS\system32\RecoveryDrive.exe
2019-09-30 21:25 - 2019-09-30 21:25 - 000875008 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\rasapi32.dll
2019-09-30 21:25 - 2019-09-30 21:25 - 000874296 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\dxgmms2.sys
2019-09-30 21:25 - 2019-09-30 21:25 - 000858112 _____ (Microsoft Corporation) C:\WINDOWS\system32\schedsvc.dll
2019-09-30 21:25 - 2019-09-30 21:25 - 000841216 _____ (Microsoft Corporation) C:\WINDOWS\system32\wuapi.dll
2019-09-30 21:25 - 2019-09-30 21:25 - 000839680 _____ (Microsoft Corporation) C:\WINDOWS\system32\d3d9on12.dll
2019-09-30 21:25 - 2019-09-30 21:25 - 000836608 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\TpmCoreProvisioning.dll
2019-09-30 21:25 - 2019-09-30 21:25 - 000833312 _____ (Microsoft Corporation) C:\WINDOWS\system32\pkeyhelper.dll
2019-09-30 21:25 - 2019-09-30 21:25 - 000827408 _____ (Microsoft Corporation) C:\WINDOWS\system32\AppVOrchestration.dll
2019-09-30 21:25 - 2019-09-30 21:25 - 000816648 _____ (Microsoft Corporation) C:\WINDOWS\system32\AppVEntStreamingManager.dll
2019-09-30 21:25 - 2019-09-30 21:25 - 000802816 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\clusapi.dll
2019-09-30 21:25 - 2019-09-30 21:25 - 000792296 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\InputHost.dll
2019-09-30 21:25 - 2019-09-30 21:25 - 000784384 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\kerberos.dll
2019-09-30 21:25 - 2019-09-30 21:25 - 000783480 _____ (Microsoft Corporation) C:\WINDOWS\system32\tcblaunch.exe
2019-09-30 21:25 - 2019-09-30 21:25 - 000775768 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\dxgi.dll
2019-09-30 21:25 - 2019-09-30 21:25 - 000772656 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\winhttp.dll
2019-09-30 21:25 - 2019-09-30 21:25 - 000765440 _____ (Microsoft Corporation) C:\WINDOWS\system32\spoolsv.exe
2019-09-30 21:25 - 2019-09-30 21:25 - 000759488 _____ (Microsoft Corporation) C:\WINDOWS\system32\taskschd.dll
2019-09-30 21:25 - 2019-09-30 21:25 - 000750080 _____ (Microsoft Corporation) C:\WINDOWS\system32\Windows.Storage.Search.dll
2019-09-30 21:25 - 2019-09-30 21:25 - 000749568 _____ (Microsoft Corporation) C:\WINDOWS\system32\ActivationManager.dll
2019-09-30 21:25 - 2019-09-30 21:25 - 000742912 _____ (Microsoft Corporation) C:\WINDOWS\system32\RDXService.dll
2019-09-30 21:25 - 2019-09-30 21:25 - 000741392 _____ (Microsoft Corporation) C:\WINDOWS\system32\AppVReporting.dll
2019-09-30 21:25 - 2019-09-30 21:25 - 000735232 _____ (Microsoft Corporation) C:\WINDOWS\system32\AudioEndpointBuilder.dll
2019-09-30 21:25 - 2019-09-30 21:25 - 000732176 _____ (Microsoft Corporation) C:\WINDOWS\system32\SettingsHandlers_StorageSense.dll
2019-09-30 21:25 - 2019-09-30 21:25 - 000722944 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\fveapi.dll
2019-09-30 21:25 - 2019-09-30 21:25 - 000702464 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\nwifi.sys
2019-09-30 21:25 - 2019-09-30 21:25 - 000674072 _____ (Microsoft Corporation) C:\WINDOWS\system32\services.exe
2019-09-30 21:25 - 2019-09-30 21:25 - 000673080 _____ (Microsoft Corporation) C:\WINDOWS\system32\comctl32.dll
2019-09-30 21:25 - 2019-09-30 21:25 - 000666128 _____ (Microsoft Corporation) C:\WINDOWS\system32\AppVCatalog.dll
2019-09-30 21:25 - 2019-09-30 21:25 - 000659456 _____ (Microsoft Corporation) C:\WINDOWS\system32\AssignedAccessManager.dll
2019-09-30 21:25 - 2019-09-30 21:25 - 000656960 _____ (Microsoft Corporation) C:\WINDOWS\system32\d3d11on12.dll
2019-09-30 21:25 - 2019-09-30 21:25 - 000652800 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\wuapi.dll
2019-09-30 21:25 - 2019-09-30 21:25 - 000649016 _____ (Microsoft Corporation) C:\WINDOWS\system32\AppVPublishing.dll
2019-09-30 21:25 - 2019-09-30 21:25 - 000647168 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\Windows.Internal.Management.dll
2019-09-30 21:25 - 2019-09-30 21:25 - 000639400 _____ (Microsoft Corporation) C:\WINDOWS\system32\msvcp_win.dll
2019-09-30 21:25 - 2019-09-30 21:25 - 000629248 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\Windows.Storage.Search.dll
2019-09-30 21:25 - 2019-09-30 21:25 - 000623104 _____ (Microsoft Corporation) C:\WINDOWS\system32\resutils.dll
2019-09-30 21:25 - 2019-09-30 21:25 - 000617784 _____ (Microsoft Corporation) C:\WINDOWS\system32\hal.dll
2019-09-30 21:25 - 2019-09-30 21:25 - 000612864 _____ (Microsoft Corporation) C:\WINDOWS\system32\dmenrollengine.dll
2019-09-30 21:25 - 2019-09-30 21:25 - 000606208 _____ (Microsoft Corporation) C:\WINDOWS\system32\uxtheme.dll
2019-09-30 21:25 - 2019-09-30 21:25 - 000599552 _____ (Microsoft Corporation) C:\WINDOWS\system32\SmsRouterSvc.dll
2019-09-30 21:25 - 2019-09-30 21:25 - 000599040 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\ActivationManager.dll
2019-09-30 21:25 - 2019-09-30 21:25 - 000598016 _____ (Microsoft Corporation) C:\WINDOWS\system32\webio.dll
2019-09-30 21:25 - 2019-09-30 21:25 - 000589384 _____ (Microsoft Corporation) C:\WINDOWS\system32\audiodg.exe
2019-09-30 21:25 - 2019-09-30 21:25 - 000587776 _____ (Microsoft Corporation) C:\WINDOWS\system32\SettingsHandlers_PCDisplay.dll
2019-09-30 21:25 - 2019-09-30 21:25 - 000576512 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\csc.sys
2019-09-30 21:25 - 2019-09-30 21:25 - 000568336 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\comctl32.dll
2019-09-30 21:25 - 2019-09-30 21:25 - 000563200 _____ (Microsoft Corporation) C:\WINDOWS\system32\wpnprv.dll
2019-09-30 21:25 - 2019-09-30 21:25 - 000558592 _____ (Microsoft Corporation) C:\WINDOWS\system32\SettingsHandlers_Notifications.dll
2019-09-30 21:25 - 2019-09-30 21:25 - 000551952 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\Vid.sys
2019-09-30 21:25 - 2019-09-30 21:25 - 000551936 _____ (Microsoft Corporation) C:\WINDOWS\system32\FirewallAPI.dll
2019-09-30 21:25 - 2019-09-30 21:25 - 000551424 _____ (Microsoft Corporation) C:\WINDOWS\system32\DeviceEnroller.exe
2019-09-30 21:25 - 2019-09-30 21:25 - 000550400 _____ (Microsoft Corporation) C:\WINDOWS\system32\win32k.sys
2019-09-30 21:25 - 2019-09-30 21:25 - 000546816 _____ (Microsoft Corporation) C:\WINDOWS\system32\dxdiagn.dll
2019-09-30 21:25 - 2019-09-30 21:25 - 000541696 _____ (Microsoft Corporation) C:\WINDOWS\system32\ResourceMapper.dll
2019-09-30 21:25 - 2019-09-30 21:25 - 000541480 _____ (Microsoft Corporation) C:\WINDOWS\system32\policymanager.dll
2019-09-30 21:25 - 2019-09-30 21:25 - 000539648 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\d3d9on12.dll
2019-09-30 21:25 - 2019-09-30 21:25 - 000524800 _____ (Microsoft Corporation) C:\WINDOWS\system32\bdesvc.dll
2019-09-30 21:25 - 2019-09-30 21:25 - 000518656 _____ (Microsoft Corporation) C:\WINDOWS\system32\ncsi.dll
2019-09-30 21:25 - 2019-09-30 21:25 - 000510464 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\dmenrollengine.dll
2019-09-30 21:25 - 2019-09-30 21:25 - 000507704 _____ (Microsoft Corporation) C:\WINDOWS\system32\spwizeng.dll
2019-09-30 21:25 - 2019-09-30 21:25 - 000507152 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\taskschd.dll
2019-09-30 21:25 - 2019-09-30 21:25 - 000502784 _____ C:\WINDOWS\system32\AssignedAccessCsp.dll
2019-09-30 21:25 - 2019-09-30 21:25 - 000501232 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\msvcp_win.dll
2019-09-30 21:25 - 2019-09-30 21:25 - 000500736 _____ (Microsoft Corporation) C:\WINDOWS\system32\inetcpl.cpl
2019-09-30 21:25 - 2019-09-30 21:25 - 000499200 _____ (Microsoft Corporation) C:\WINDOWS\system32\rdpshell.exe
2019-09-30 21:25 - 2019-09-30 21:25 - 000495120 _____ (Microsoft Corporation) C:\WINDOWS\system32\TransportDSA.dll
2019-09-30 21:25 - 2019-09-30 21:25 - 000487576 _____ (Microsoft Corporation) C:\WINDOWS\system32\ucrtbase_enclave.dll
2019-09-30 21:25 - 2019-09-30 21:25 - 000483328 _____ (Microsoft Corporation) C:\WINDOWS\system32\SessEnv.dll
2019-09-30 21:25 - 2019-09-30 21:25 - 000476672 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\uxtheme.dll
2019-09-30 21:25 - 2019-09-30 21:25 - 000476672 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\resutils.dll
2019-09-30 21:25 - 2019-09-30 21:25 - 000469504 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\webio.dll
2019-09-30 21:25 - 2019-09-30 21:25 - 000463272 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\policymanager.dll
2019-09-30 21:25 - 2019-09-30 21:25 - 000457216 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\cldflt.sys
2019-09-30 21:25 - 2019-09-30 21:25 - 000450560 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\dxdiagn.dll
2019-09-30 21:25 - 2019-09-30 21:25 - 000450360 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\d3d11on12.dll
2019-09-30 21:25 - 2019-09-30 21:25 - 000449888 _____ (Microsoft Corporation) C:\WINDOWS\system32\MMDevAPI.dll
2019-09-30 21:25 - 2019-09-30 21:25 - 000448000 _____ (Microsoft Corporation) C:\WINDOWS\system32\SettingsEnvironment.Desktop.dll
2019-09-30 21:25 - 2019-09-30 21:25 - 000442704 _____ (Microsoft Corporation) C:\WINDOWS\system32\ws2_32.dll
2019-09-30 21:25 - 2019-09-30 21:25 - 000441144 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\dxgmms1.sys
2019-09-30 21:25 - 2019-09-30 21:25 - 000421376 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\inetcpl.cpl
2019-09-30 21:25 - 2019-09-30 21:25 - 000417280 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\SessEnv.dll
2019-09-30 21:25 - 2019-09-30 21:25 - 000415808 _____ (Microsoft Corporation) C:\WINDOWS\system32\AUDIOKSE.dll
2019-09-30 21:25 - 2019-09-30 21:25 - 000401408 _____ (Microsoft Corporation) C:\WINDOWS\system32\fveapibase.dll
2019-09-30 21:25 - 2019-09-30 21:25 - 000398728 _____ (Microsoft Corporation) C:\WINDOWS\system32\wininit.exe
2019-09-30 21:25 - 2019-09-30 21:25 - 000394256 _____ (Microsoft Corporation) C:\WINDOWS\system32\AppVScripting.dll
2019-09-30 21:25 - 2019-09-30 21:25 - 000392704 _____ (Microsoft Corporation) C:\WINDOWS\system32\NotificationControllerPS.dll
2019-09-30 21:25 - 2019-09-30 21:25 - 000387832 _____ (Microsoft Corporation) C:\WINDOWS\system32\wmpps.dll
2019-09-30 21:25 - 2019-09-30 21:25 - 000383984 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\MMDevAPI.dll
2019-09-30 21:25 - 2019-09-30 21:25 - 000382976 _____ (Microsoft Corporation) C:\WINDOWS\system32\nlasvc.dll
2019-09-30 21:25 - 2019-09-30 21:25 - 000379840 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\ws2_32.dll
2019-09-30 21:25 - 2019-09-30 21:25 - 000376832 _____ (Microsoft Corporation) C:\WINDOWS\system32\rdpinit.exe
2019-09-30 21:25 - 2019-09-30 21:25 - 000375720 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\AUDIOKSE.dll
2019-09-30 21:25 - 2019-09-30 21:25 - 000369664 _____ (Microsoft Corporation) C:\WINDOWS\system32\dxdiag.exe
2019-09-30 21:25 - 2019-09-30 21:25 - 000363624 _____ (Microsoft Corporation) C:\WINDOWS\system32\wintrust.dll
2019-09-30 21:25 - 2019-09-30 21:25 - 000359424 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\MbbCx.sys
2019-09-30 21:25 - 2019-09-30 21:25 - 000355000 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\intelpep.sys
2019-09-30 21:25 - 2019-09-30 21:25 - 000342896 _____ (Microsoft Corporation) C:\WINDOWS\system32\ttdwriter.dll
2019-09-30 21:25 - 2019-09-30 21:25 - 000338432 _____ (Microsoft Corporation) C:\WINDOWS\system32\AppxAllUserStore.dll
2019-09-30 21:25 - 2019-09-30 21:25 - 000334936 _____ (Microsoft Corporation) C:\WINDOWS\system32\wow64.dll
2019-09-30 21:25 - 2019-09-30 21:25 - 000334336 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\fveapibase.dll
2019-09-30 21:25 - 2019-09-30 21:25 - 000327168 _____ (Microsoft Corporation) C:\WINDOWS\system32\VAN.dll
2019-09-30 21:25 - 2019-09-30 21:25 - 000327168 _____ (Microsoft Corporation) C:\WINDOWS\system32\ComposableShellProxyStub.dll
2019-09-30 21:25 - 2019-09-30 21:25 - 000324096 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\win32k.sys
2019-09-30 21:25 - 2019-09-30 21:25 - 000315904 _____ (Microsoft Corporation) C:\WINDOWS\system32\dmenterprisediagnostics.dll
2019-09-30 21:25 - 2019-09-30 21:25 - 000315392 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\dxdiag.exe
2019-09-30 21:25 - 2019-09-30 21:25 - 000293344 _____ (Microsoft Corporation) C:\WINDOWS\system32\cfgmgr32.dll
2019-09-30 21:25 - 2019-09-30 21:25 - 000288256 _____ (Microsoft Corporation) C:\WINDOWS\system32\mdmregistration.dll
2019-09-30 21:25 - 2019-09-30 21:25 - 000285696 _____ (Microsoft Corporation) C:\WINDOWS\system32\directxdatabaseupdater.exe
2019-09-30 21:25 - 2019-09-30 21:25 - 000285256 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\wintrust.dll
2019-09-30 21:25 - 2019-09-30 21:25 - 000284160 _____ (Microsoft Corporation) C:\WINDOWS\system32\container.dll
2019-09-30 21:25 - 2019-09-30 21:25 - 000283688 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\ttdwriter.dll
2019-09-30 21:25 - 2019-09-30 21:25 - 000282112 _____ (Microsoft Corporation) C:\WINDOWS\system32\Windows.UI.AppDefaults.dll
2019-09-30 21:25 - 2019-09-30 21:25 - 000279040 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\AppxAllUserStore.dll
2019-09-30 21:25 - 2019-09-30 21:25 - 000278080 _____ (Microsoft Corporation) C:\WINDOWS\system32\LsaIso.exe
2019-09-30 21:25 - 2019-09-30 21:25 - 000275968 _____ (Microsoft Corporation) C:\WINDOWS\system32\SystemEventsBrokerServer.dll
2019-09-30 21:25 - 2019-09-30 21:25 - 000275456 _____ (Microsoft Corporation) C:\WINDOWS\system32\SettingsHandlers_CapabilityAccess.dll
2019-09-30 21:25 - 2019-09-30 21:25 - 000268800 _____ (Microsoft Corporation) C:\WINDOWS\system32\ubpm.dll
2019-09-30 21:25 - 2019-09-30 21:25 - 000268288 _____ (Microsoft Corporation) C:\WINDOWS\system32\dot3svc.dll
2019-09-30 21:25 - 2019-09-30 21:25 - 000265216 _____ (Microsoft Corporation) C:\WINDOWS\system32\cdd.dll
2019-09-30 21:25 - 2019-09-30 21:25 - 000258064 _____ (Microsoft Corporation) C:\WINDOWS\system32\AppVFileSystemMetadata.dll
2019-09-30 21:25 - 2019-09-30 21:25 - 000256000 _____ (Microsoft Corporation) C:\WINDOWS\system32\UpdateDeploymentProvider.dll
2019-09-30 21:25 - 2019-09-30 21:25 - 000252416 _____ (Microsoft Corporation) C:\WINDOWS\system32\wpnservice.dll
2019-09-30 21:25 - 2019-09-30 21:25 - 000250880 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\winnat.sys
2019-09-30 21:25 - 2019-09-30 21:25 - 000248832 _____ (Microsoft Corporation) C:\WINDOWS\system32\ManageCI.dll
2019-09-30 21:25 - 2019-09-30 21:25 - 000245248 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\glu32.dll
2019-09-30 21:25 - 2019-09-30 21:25 - 000244736 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\ndproxy.sys
2019-09-30 21:25 - 2019-09-30 21:25 - 000243712 _____ (Microsoft Corporation) C:\WINDOWS\system32\SettingsHandlers_Gpu.dll
2019-09-30 21:25 - 2019-09-30 21:25 - 000241152 _____ (Microsoft Corporation) C:\WINDOWS\system32\policymanagerprecheck.dll
2019-09-30 21:25 - 2019-09-30 21:25 - 000239104 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\mdmregistration.dll
2019-09-30 21:25 - 2019-09-30 21:25 - 000236544 _____ (Microsoft Corporation) C:\WINDOWS\system32\wcmcsp.dll
2019-09-30 21:25 - 2019-09-30 21:25 - 000236520 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\cfgmgr32.dll
2019-09-30 21:25 - 2019-09-30 21:25 - 000236032 _____ (Microsoft Corporation) C:\WINDOWS\system32\tetheringservice.dll
2019-09-30 21:25 - 2019-09-30 21:25 - 000235008 _____ (Microsoft Corporation) C:\WINDOWS\system32\fwpolicyiomgr.dll
2019-09-30 21:25 - 2019-09-30 21:25 - 000231440 _____ (Microsoft Corporation) C:\WINDOWS\system32\AppVShNotify.exe
2019-09-30 21:25 - 2019-09-30 21:25 - 000228880 _____ (Microsoft Corporation) C:\WINDOWS\system32\AppVStreamMap.dll
2019-09-30 21:25 - 2019-09-30 21:25 - 000223032 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\intelppm.sys
2019-09-30 21:25 - 2019-09-30 21:25 - 000221696 _____ (Microsoft Corporation) C:\WINDOWS\system32\dxgiadaptercache.exe
2019-09-30 21:25 - 2019-09-30 21:25 - 000210744 _____ (Microsoft Corporation) C:\WINDOWS\system32\tcbloader.dll
2019-09-30 21:25 - 2019-09-30 21:25 - 000208384 _____ (Microsoft Corporation) C:\WINDOWS\system32\wuuhosdeployment.dll
2019-09-30 21:25 - 2019-09-30 21:25 - 000208184 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\processr.sys
2019-09-30 21:25 - 2019-09-30 21:25 - 000206336 _____ (Microsoft Corporation) C:\WINDOWS\system32\dpapisrv.dll
2019-09-30 21:25 - 2019-09-30 21:25 - 000202768 _____ (Microsoft Corporation) C:\WINDOWS\system32\AppVStreamingUX.dll
2019-09-30 21:25 - 2019-09-30 21:25 - 000201016 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\amdppm.sys
2019-09-30 21:25 - 2019-09-30 21:25 - 000199480 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\amdk8.sys
2019-09-30 21:25 - 2019-09-30 21:25 - 000195584 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\container.dll
2019-09-30 21:25 - 2019-09-30 21:25 - 000181776 _____ (Microsoft Corporation) C:\WINDOWS\system32\AppVDllSurrogate.exe
2019-09-30 21:25 - 2019-09-30 21:25 - 000179512 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\ksecpkg.sys
2019-09-30 21:25 - 2019-09-30 21:25 - 000178176 _____ (Microsoft Corporation) C:\WINDOWS\system32\prntvpt.dll
2019-09-30 21:25 - 2019-09-30 21:25 - 000176440 _____ (Microsoft Corporation) C:\WINDOWS\system32\uxlib.dll
2019-09-30 21:25 - 2019-09-30 21:25 - 000176152 _____ (Microsoft Corporation) C:\WINDOWS\system32\imm32.dll
2019-09-30 21:25 - 2019-09-30 21:25 - 000174080 _____ (Microsoft Corporation) C:\WINDOWS\system32\sud.dll
2019-09-30 21:25 - 2019-09-30 21:25 - 000173568 _____ (Microsoft Corporation) C:\WINDOWS\system32\drvinst.exe
2019-09-30 21:25 - 2019-09-30 21:25 - 000173072 _____ (Microsoft Corporation) C:\WINDOWS\system32\AppVNice.exe
2019-09-30 21:25 - 2019-09-30 21:25 - 000169472 _____ (Microsoft Corporation) C:\WINDOWS\system32\SpatialAudioLicenseSrv.exe
2019-09-30 21:25 - 2019-09-30 21:25 - 000163328 _____ (Microsoft Corporation) C:\WINDOWS\system32\glu32.dll
2019-09-30 21:25 - 2019-09-30 21:25 - 000162304 _____ (Microsoft Corporation) C:\WINDOWS\system32\fwbase.dll
2019-09-30 21:25 - 2019-09-30 21:25 - 000159112 _____ (Microsoft Corporation) C:\WINDOWS\system32\devobj.dll
2019-09-30 21:25 - 2019-09-30 21:25 - 000158208 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\mrxdav.sys
2019-09-30 21:25 - 2019-09-30 21:25 - 000157184 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\ComposableShellProxyStub.dll
2019-09-30 21:25 - 2019-09-30 21:25 - 000155648 _____ (Microsoft Corporation) C:\WINDOWS\system32\SettingsHandlers_AppExecutionAlias.dll
2019-09-30 21:25 - 2019-09-30 21:25 - 000152408 _____ (Microsoft Corporation) C:\WINDOWS\system32\KerbClientShared.dll
2019-09-30 21:25 - 2019-09-30 21:25 - 000151568 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\vmbus.sys
2019-09-30 21:25 - 2019-09-30 21:25 - 000151552 _____ (Microsoft Corporation) C:\WINDOWS\system32\SettingsHandlers_BackgroundApps.dll
2019-09-30 21:25 - 2019-09-30 21:25 - 000145208 _____ (Microsoft Corporation) C:\WINDOWS\system32\CscMig.dll
2019-09-30 21:25 - 2019-09-30 21:25 - 000143872 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\SpatialAudioLicenseSrv.exe
2019-09-30 21:25 - 2019-09-30 21:25 - 000143808 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\imm32.dll
2019-09-30 21:25 - 2019-09-30 21:25 - 000140800 _____ (Microsoft Corporation) C:\WINDOWS\system32\mdmmigrator.dll
2019-09-30 21:25 - 2019-09-30 21:25 - 000140496 _____ (Microsoft Corporation) C:\WINDOWS\system32\userenv.dll
2019-09-30 21:25 - 2019-09-30 21:25 - 000139776 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\sud.dll
2019-09-30 21:25 - 2019-09-30 21:25 - 000139264 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\prntvpt.dll
2019-09-30 21:25 - 2019-09-30 21:25 - 000137864 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\devobj.dll
2019-09-30 21:25 - 2019-09-30 21:25 - 000137728 _____ (Microsoft Corporation) C:\WINDOWS\system32\dwmredir.dll
2019-09-30 21:25 - 2019-09-30 21:25 - 000133632 _____ (Microsoft Corporation) C:\WINDOWS\system32\appvetwclientres.dll
2019-09-30 21:25 - 2019-09-30 21:25 - 000132608 _____ (Microsoft Corporation) C:\WINDOWS\system32\SettingsHandlers_ForceSync.dll
2019-09-30 21:25 - 2019-09-30 21:25 - 000132408 _____ (Microsoft Corporation) C:\WINDOWS\system32\offlinelsa.dll
2019-09-30 21:25 - 2019-09-30 21:25 - 000132096 _____ (Microsoft Corporation) C:\WINDOWS\splwow64.exe
2019-09-30 21:25 - 2019-09-30 21:25 - 000130048 _____ (Microsoft Corporation) C:\WINDOWS\system32\CloudDomainJoinAUG.dll
2019-09-30 21:25 - 2019-09-30 21:25 - 000127064 _____ (Microsoft Corporation) C:\WINDOWS\system32\win32u.dll
2019-09-30 21:25 - 2019-09-30 21:25 - 000125232 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\KerbClientShared.dll
2019-09-30 21:25 - 2019-09-30 21:25 - 000123904 _____ (Microsoft Corporation) C:\WINDOWS\system32\ApplicationControlCSP.dll
2019-09-30 21:25 - 2019-09-30 21:25 - 000119840 _____ (Microsoft Corporation) C:\WINDOWS\system32\OpenWith.exe
2019-09-30 21:25 - 2019-09-30 21:25 - 000116904 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\userenv.dll
2019-09-30 21:25 - 2019-09-30 21:25 - 000116224 _____ (Microsoft Corporation) C:\WINDOWS\system32\EaseOfAccessDialog.exe
2019-09-30 21:25 - 2019-09-30 21:25 - 000110080 _____ C:\WINDOWS\system32\ResBParser.dll
2019-09-30 21:25 - 2019-09-30 21:25 - 000107008 _____ (Microsoft Corporation) C:\WINDOWS\system32\CoreShellExtFramework.dll
2019-09-30 21:25 - 2019-09-30 21:25 - 000105832 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\OpenWith.exe
2019-09-30 21:25 - 2019-09-30 21:25 - 000105272 _____ (Microsoft Corporation) C:\WINDOWS\system32\icfupgd.dll
2019-09-30 21:25 - 2019-09-30 21:25 - 000103936 _____ (Microsoft Corporation) C:\WINDOWS\system32\dot3msm.dll
2019-09-30 21:25 - 2019-09-30 21:25 - 000100664 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\vmbkmcl.sys
2019-09-30 21:25 - 2019-09-30 21:25 - 000098816 _____ (Microsoft Corporation) C:\WINDOWS\system32\sethc.exe
2019-09-30 21:25 - 2019-09-30 21:25 - 000094208 _____ (Microsoft Corporation) C:\WINDOWS\system32\mcbuilder.exe
2019-09-30 21:25 - 2019-09-30 21:25 - 000093712 _____ (Microsoft Corporation) C:\WINDOWS\system32\hvloader.dll
2019-09-30 21:25 - 2019-09-30 21:25 - 000093184 _____ (Microsoft Corporation) C:\WINDOWS\system32\nlaapi.dll
2019-09-30 21:25 - 2019-09-30 21:25 - 000092672 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\wanarp.sys
2019-09-30 21:25 - 2019-09-30 21:25 - 000092624 _____ (Microsoft Corporation) C:\WINDOWS\system32\taskhostw.exe
2019-09-30 21:25 - 2019-09-30 21:25 - 000092160 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\EaseOfAccessDialog.exe
2019-09-30 21:25 - 2019-09-30 21:25 - 000092160 _____ (Microsoft Corporation) C:\WINDOWS\system32\dot3api.dll
2019-09-30 21:25 - 2019-09-30 21:25 - 000089544 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\win32u.dll
2019-09-30 21:25 - 2019-09-30 21:25 - 000088352 _____ (Microsoft Corporation) C:\WINDOWS\system32\remoteaudioendpoint.dll
2019-09-30 21:25 - 2019-09-30 21:25 - 000084496 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\hvservice.sys
2019-09-30 21:25 - 2019-09-30 21:25 - 000083456 _____ (Microsoft Corporation) C:\WINDOWS\system32\wpdbusenum.dll
2019-09-30 21:25 - 2019-09-30 21:25 - 000082432 _____ (Microsoft Corporation) C:\WINDOWS\system32\rdvvmtransport.dll
2019-09-30 21:25 - 2019-09-30 21:25 - 000080896 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\mcbuilder.exe
2019-09-30 21:25 - 2019-09-30 21:25 - 000079376 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\uaspstor.sys
2019-09-30 21:25 - 2019-09-30 21:25 - 000077824 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\sethc.exe
2019-09-30 21:25 - 2019-09-30 21:25 - 000075264 _____ (Microsoft Corporation) C:\WINDOWS\system32\tetheringclient.dll
2019-09-30 21:25 - 2019-09-30 21:25 - 000073024 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\remoteaudioendpoint.dll
2019-09-30 21:25 - 2019-09-30 21:25 - 000071680 _____ (Microsoft Corporation) C:\WINDOWS\system32\dwm.exe
2019-09-30 21:25 - 2019-09-30 21:25 - 000070144 _____ (Microsoft Corporation) C:\WINDOWS\system32\wups.dll
2019-09-30 21:25 - 2019-09-30 21:25 - 000066832 _____ (Microsoft Corporation) C:\WINDOWS\system32\iumcrypt.dll
2019-09-30 21:25 - 2019-09-30 21:25 - 000066048 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\rdvvmtransport.dll
2019-09-30 21:25 - 2019-09-30 21:25 - 000064512 _____ (Microsoft Corporation) C:\WINDOWS\system32\CertEnrollCtrl.exe
2019-09-30 21:25 - 2019-09-30 21:25 - 000064000 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\hidspi.sys
2019-09-30 21:25 - 2019-09-30 21:25 - 000060416 _____ (Microsoft Corporation) C:\WINDOWS\system32\AssignedAccessRuntime.dll
2019-09-30 21:25 - 2019-09-30 21:25 - 000059904 _____ (Microsoft Corporation) C:\WINDOWS\system32\devrtl.dll
2019-09-30 21:25 - 2019-09-30 21:25 - 000057856 _____ (Microsoft Corporation) C:\WINDOWS\system32\wups2.dll
2019-09-30 21:25 - 2019-09-30 21:25 - 000057344 _____ (Microsoft Corporation) C:\WINDOWS\system32\audioresourceregistrar.dll
2019-09-30 21:25 - 2019-09-30 21:25 - 000056832 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\devrtl.dll
2019-09-30 21:25 - 2019-09-30 21:25 - 000056832 _____ (Microsoft Corporation) C:\WINDOWS\system32\pnppolicy.dll
2019-09-30 21:25 - 2019-09-30 21:25 - 000053760 _____ (Microsoft Corporation) C:\WINDOWS\system32\BdeUISrv.exe
2019-09-30 21:25 - 2019-09-30 21:25 - 000053248 _____ C:\WINDOWS\system32\Drivers\UsbPmApi.sys
2019-09-30 21:25 - 2019-09-30 21:25 - 000052752 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\vmstorfl.sys
2019-09-30 21:25 - 2019-09-30 21:25 - 000052224 _____ (Microsoft Corporation) C:\WINDOWS\system32\tetheringconfigsp.dll
2019-09-30 21:25 - 2019-09-30 21:25 - 000051200 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\CertEnrollCtrl.exe
2019-09-30 21:25 - 2019-09-30 21:25 - 000049152 _____ (Microsoft Corporation) C:\WINDOWS\system32\enrollmentapi.dll
2019-09-30 21:25 - 2019-09-30 21:25 - 000047616 _____ C:\WINDOWS\system32\UsbPmApi.dll
2019-09-30 21:25 - 2019-09-30 21:25 - 000047104 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\AssignedAccessRuntime.dll
2019-09-30 21:25 - 2019-09-30 21:25 - 000047000 _____ (Microsoft Corporation) C:\WINDOWS\system32\wuauclt.exe
2019-09-30 21:25 - 2019-09-30 21:25 - 000045568 _____ (Microsoft Corporation) C:\WINDOWS\system32\cellulardatacapabilityhandler.dll
2019-09-30 21:25 - 2019-09-30 21:25 - 000043536 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\storvsc.sys
2019-09-30 21:25 - 2019-09-30 21:25 - 000043520 _____ (Microsoft Corporation) C:\WINDOWS\system32\LaunchWinApp.exe
2019-09-30 21:25 - 2019-09-30 21:25 - 000043008 _____ (Microsoft Corporation) C:\WINDOWS\system32\WiredNetworkCSP.dll
2019-09-30 21:25 - 2019-09-30 21:25 - 000037904 _____ (Microsoft Corporation) C:\WINDOWS\system32\SyncAppvPublishingServer.exe
2019-09-30 21:25 - 2019-09-30 21:25 - 000036864 _____ (Microsoft Corporation) C:\WINDOWS\system32\IcsEntitlementHost.exe
2019-09-30 21:25 - 2019-09-30 21:25 - 000036352 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\enrollmentapi.dll
2019-09-30 21:25 - 2019-09-30 21:25 - 000033280 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\LaunchWinApp.exe
2019-09-30 21:25 - 2019-09-30 21:25 - 000032256 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\wups.dll
2019-09-30 21:25 - 2019-09-30 21:25 - 000028936 _____ (Microsoft Corporation) C:\WINDOWS\system32\vmbuspipe.dll
2019-09-30 21:25 - 2019-09-30 21:25 - 000028672 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\ndistapi.sys
2019-09-30 21:25 - 2019-09-30 21:25 - 000027648 _____ (Microsoft Corporation) C:\WINDOWS\system32\Win32_DeviceGuard.dll
2019-09-30 21:25 - 2019-09-30 21:25 - 000024576 _____ (Microsoft Corporation) C:\WINDOWS\system32\wfapigp.dll
2019-09-30 21:25 - 2019-09-30 21:25 - 000024064 _____ (Microsoft Corporation) C:\WINDOWS\system32\CSystemEventsBrokerClient.dll
2019-09-30 21:25 - 2019-09-30 21:25 - 000021816 _____ (Microsoft Corporation) C:\WINDOWS\system32\ScriptRunner.exe
2019-09-30 21:25 - 2019-09-30 21:25 - 000021544 _____ (Microsoft Corporation) C:\WINDOWS\system32\kdhvcom.dll
2019-09-30 21:25 - 2019-09-30 21:25 - 000020944 _____ (Microsoft Corporation) C:\WINDOWS\system32\wow64cpu.dll
2019-09-30 21:25 - 2019-09-30 21:25 - 000019456 _____ (Microsoft Corporation) C:\WINDOWS\system32\wmsgapi.dll
2019-09-30 21:25 - 2019-09-30 21:25 - 000016696 _____ (Microsoft Corporation) C:\WINDOWS\system32\spwizres.dll
2019-09-30 21:25 - 2019-09-30 21:25 - 000014336 _____ (Microsoft Corporation) C:\WINDOWS\system32\d3d8thk.dll
2019-09-30 21:25 - 2019-09-30 21:25 - 000013824 _____ (Microsoft Corporation) C:\WINDOWS\system32\appvetwstreamingux.dll
2019-09-30 21:25 - 2019-09-30 21:25 - 000012800 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\d3d8thk.dll
2019-09-30 21:25 - 2019-09-30 21:25 - 000012288 _____ (Microsoft Corporation) C:\WINDOWS\system32\TSErrRedir.dll
2019-09-30 21:25 - 2019-09-30 21:25 - 000012288 _____ (Microsoft Corporation) C:\WINDOWS\system32\pacjsworker.exe
2019-09-30 21:25 - 2019-09-30 21:25 - 000011576 _____ (Microsoft Corporation) C:\WINDOWS\system32\uxlibres.dll
2019-09-30 21:25 - 2019-09-30 21:25 - 000003584 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\TpmCertResources.dll
2019-09-30 21:25 - 2019-09-30 21:25 - 000003584 _____ (Microsoft Corporation) C:\WINDOWS\system32\TpmCertResources.dll
2019-09-30 21:25 - 2019-09-30 21:25 - 000002560 _____ (Microsoft Corporation) C:\WINDOWS\system32\tier2punctuations.dll
2019-09-30 21:25 - 2019-09-30 21:25 - 000000315 _____ C:\WINDOWS\system32\DrtmAuth9.bin
2019-09-30 21:25 - 2019-09-30 21:25 - 000000315 _____ C:\WINDOWS\system32\DrtmAuth8.bin
2019-09-30 21:25 - 2019-09-30 21:25 - 000000315 _____ C:\WINDOWS\system32\DrtmAuth7.bin
2019-09-30 21:25 - 2019-09-30 21:25 - 000000315 _____ C:\WINDOWS\system32\DrtmAuth6.bin
2019-09-30 21:25 - 2019-09-30 21:25 - 000000315 _____ C:\WINDOWS\system32\DrtmAuth5.bin
2019-09-30 21:25 - 2019-09-30 21:25 - 000000315 _____ C:\WINDOWS\system32\DrtmAuth4.bin
2019-09-30 21:25 - 2019-09-30 21:25 - 000000315 _____ C:\WINDOWS\system32\DrtmAuth3.bin
2019-09-30 21:25 - 2019-09-30 21:25 - 000000315 _____ C:\WINDOWS\system32\DrtmAuth2.bin
2019-09-30 21:25 - 2019-09-30 21:25 - 000000315 _____ C:\WINDOWS\system32\DrtmAuth12.bin
2019-09-30 21:25 - 2019-09-30 21:25 - 000000315 _____ C:\WINDOWS\system32\DrtmAuth11.bin
2019-09-30 21:25 - 2019-09-30 21:25 - 000000315 _____ C:\WINDOWS\system32\DrtmAuth10.bin
2019-09-30 21:25 - 2019-09-30 21:25 - 000000315 _____ C:\WINDOWS\system32\DrtmAuth1.bin
2019-09-30 01:01 - 2019-09-30 01:01 - 000097485 _____ C:\Users\Plácido\Documents\DxDiag.txt
2019-09-18 19:48 - 2019-09-18 19:48 - 000003053 _____ C:\Users\Plácido\AppData\Local\recently-used.xbel

==================== One month (modified) ========

(If an entry is included in the fixlist, the file/folder will be moved.)

2019-10-14 20:38 - 2019-07-21 17:17 - 000000000 ____D C:\Users\Plácido\AppData\LocalLow\uTorrent
2019-10-14 20:38 - 2019-07-21 07:03 - 000000000 ___DC C:\Users\Plácido\AppData\Local\BitTorrentHelper
2019-10-14 20:36 - 2019-07-28 04:41 - 000000878 _____ C:\Users\Plácido\AppData\Roaming\Microsoft\Windows\Start Menu\µTorrent.lnk
2019-10-14 20:32 - 2018-05-17 03:00 - 000000000 ___DC C:\Users\Plácido\AppData\Local\D3DSCache
2019-10-14 20:29 - 2019-09-02 22:22 - 000000000 ____D C:\WINDOWS\system32\Tasks\NCH Software
2019-10-14 20:29 - 2019-03-19 06:52 - 000000000 ____D C:\ProgramData\regid.1991-06.com.microsoft
2019-10-14 20:21 - 2019-09-02 22:16 - 000000000 ____D C:\WINDOWS\system32\SleepStudy
2019-10-14 18:37 - 2018-04-09 19:21 - 000000000 ____D C:\Program Files\Panda Security URL Filtering
2019-10-14 15:59 - 2019-09-02 22:25 - 001775178 _____ C:\WINDOWS\system32\PerfStringBackup.INI
2019-10-14 15:59 - 2019-03-19 13:59 - 000788448 _____ C:\WINDOWS\system32\perfh00A.dat
2019-10-14 15:59 - 2019-03-19 13:59 - 000155738 _____ C:\WINDOWS\system32\perfc00A.dat
2019-10-14 15:59 - 2019-03-19 06:50 - 000000000 ____D C:\WINDOWS\INF
2019-10-14 15:54 - 2019-09-02 22:22 - 000000006 ____H C:\WINDOWS\Tasks\SA.DAT
2019-10-14 15:54 - 2018-04-09 13:39 - 000000000 __SHD C:\Users\Plácido\IntelGraphicsProfiles
2019-10-14 06:04 - 2019-03-19 06:37 - 000524288 _____ C:\WINDOWS\system32\config\BBI
2019-10-14 02:41 - 2019-03-19 06:52 - 000000000 ___HD C:\Program Files\WindowsApps
2019-10-14 02:41 - 2019-03-19 06:52 - 000000000 ____D C:\WINDOWS\AppReadiness
2019-10-14 02:40 - 2018-04-10 02:11 - 000000000 ___DC C:\Users\Plácido\AppData\Local\Packages
2019-10-14 02:38 - 2019-05-14 08:14 - 000001363 _____ C:\Users\Plácido\Desktop\Adobe Photoshop CC 2018.lnk
2019-10-14 02:29 - 2019-05-14 08:08 - 000000000 ____D C:\Users\Plácido\Documents\Adobe
2019-10-14 02:23 - 2019-03-19 06:52 - 000000000 ___HD C:\WINDOWS\ELAMBKUP
2019-10-14 02:11 - 2019-09-02 21:54 - 000000000 ____D C:\Users\Plácido
2019-10-14 01:41 - 2018-04-09 19:04 - 000000000 ____D C:\Users\Plácido\AppData\Local\VirtualStore
2019-10-13 21:23 - 2018-04-09 19:17 - 000000000 ____D C:\ProgramData\Adobe
2019-10-13 21:23 - 2018-04-09 19:04 - 000000000 ____D C:\Users\Plácido\AppData\Roaming\Adobe
2019-10-13 08:10 - 2019-03-19 06:37 - 000000000 ____D C:\WINDOWS\CbsTemp
2019-10-12 06:27 - 2019-05-17 03:20 - 000000000 ____D C:\ProgramData\Nero
2019-10-12 06:27 - 2018-11-17 05:14 - 000000000 ____D C:\Users\Plácido\AppData\Roaming\IObit
2019-10-12 06:27 - 2018-11-17 05:14 - 000000000 ____D C:\ProgramData\IObit
2019-10-12 06:20 - 2018-06-15 11:17 - 000000000 ___DC C:\Users\Plácido\AppData\Local\CrashDumps
2019-10-12 06:14 - 2018-04-11 22:36 - 000000000 ____D C:\WINDOWS\system32\Drivers\wd
2019-10-12 06:02 - 2018-04-10 00:16 - 127230528 ____C (Microsoft Corporation) C:\WINDOWS\system32\MRT.exe
2019-10-12 01:55 - 2019-05-28 03:11 - 000000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\aTube Catcher
2019-10-12 01:55 - 2019-03-19 14:01 - 000000000 __SHD C:\WINDOWS\BitLockerDiscoveryVolumeContents
2019-10-12 01:55 - 2019-03-19 14:01 - 000000000 ____D C:\Program Files\Windows Portable Devices
2019-10-12 01:55 - 2019-03-19 14:01 - 000000000 ____D C:\Program Files\Windows Photo Viewer
2019-10-12 01:55 - 2019-03-19 14:01 - 000000000 ____D C:\Program Files\Windows Multimedia Platform
2019-10-12 01:55 - 2019-03-19 14:01 - 000000000 ____D C:\Program Files\Windows Defender Advanced Threat Protection
2019-10-12 01:55 - 2019-03-19 14:01 - 000000000 ____D C:\Program Files (x86)\Windows Portable Devices
2019-10-12 01:55 - 2019-03-19 14:01 - 000000000 ____D C:\Program Files (x86)\Windows Photo Viewer
2019-10-12 01:55 - 2019-03-19 14:01 - 000000000 ____D C:\Program Files (x86)\Windows Multimedia Platform
2019-10-12 01:55 - 2019-03-19 06:52 - 000000000 ___RD C:\WINDOWS\PrintDialog
2019-10-12 01:55 - 2019-03-19 06:52 - 000000000 ___RD C:\WINDOWS\ImmersiveControlPanel
2019-10-12 01:55 - 2019-03-19 06:52 - 000000000 ____D C:\WINDOWS\PolicyDefinitions
2019-10-12 01:55 - 2019-03-19 06:52 - 000000000 ____D C:\WINDOWS\IME
2019-10-12 01:55 - 2019-03-19 06:52 - 000000000 ____D C:\WINDOWS\DiagTrack
2019-10-12 01:55 - 2019-03-19 06:52 - 000000000 ____D C:\WINDOWS\Containers
2019-10-12 01:55 - 2019-03-19 06:52 - 000000000 ____D C:\WINDOWS\bcastdvr
2019-10-12 01:55 - 2019-03-19 06:52 - 000000000 ____D C:\Program Files\Common Files\System
2019-10-12 01:55 - 2019-03-19 06:37 - 000000000 ____D C:\WINDOWS\servicing
2019-10-12 01:55 - 2018-09-28 21:30 - 000000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Mediatek Wireless
2019-10-12 01:55 - 2018-04-09 19:18 - 000000000 ___DC C:\Program Files (x86)\Microsoft Office
2019-10-12 01:54 - 2019-03-19 14:01 - 000000000 ___SD C:\WINDOWS\system32\AppV
2019-10-12 01:54 - 2019-03-19 14:00 - 000000000 ____D C:\WINDOWS\system32\OpenSSH
2019-10-12 01:54 - 2019-03-19 13:59 - 000000000 ____D C:\WINDOWS\SysWOW64\es
2019-10-12 01:54 - 2019-03-19 13:59 - 000000000 ____D C:\WINDOWS\system32\es
2019-10-12 01:54 - 2019-03-19 06:52 - 000000000 ___SD C:\WINDOWS\SysWOW64\F12
2019-10-12 01:54 - 2019-03-19 06:52 - 000000000 ___SD C:\WINDOWS\SysWOW64\DiagSvcs
2019-10-12 01:54 - 2019-03-19 06:52 - 000000000 ___SD C:\WINDOWS\system32\UNP
2019-10-12 01:54 - 2019-03-19 06:52 - 000000000 ___SD C:\WINDOWS\system32\F12
2019-10-12 01:54 - 2019-03-19 06:52 - 000000000 ___SD C:\WINDOWS\system32\dsc
2019-10-12 01:54 - 2019-03-19 06:52 - 000000000 ___SD C:\WINDOWS\system32\DiagSvcs
2019-10-12 01:54 - 2019-03-19 06:52 - 000000000 ____D C:\WINDOWS\TextInput
2019-10-12 01:54 - 2019-03-19 06:52 - 000000000 ____D C:\WINDOWS\SysWOW64\setup
2019-10-12 01:54 - 2019-03-19 06:52 - 000000000 ____D C:\WINDOWS\SysWOW64\PerceptionSimulation
2019-10-12 01:54 - 2019-03-19 06:52 - 000000000 ____D C:\WINDOWS\SysWOW64\oobe
2019-10-12 01:54 - 2019-03-19 06:52 - 000000000 ____D C:\WINDOWS\SysWOW64\migwiz
2019-10-12 01:54 - 2019-03-19 06:52 - 000000000 ____D C:\WINDOWS\SysWOW64\InstallShield
2019-10-12 01:54 - 2019-03-19 06:52 - 000000000 ____D C:\WINDOWS\SysWOW64\downlevel
2019-10-12 01:54 - 2019-03-19 06:52 - 000000000 ____D C:\WINDOWS\SysWOW64\Dism
2019-10-12 01:54 - 2019-03-19 06:52 - 000000000 ____D C:\WINDOWS\SysWOW64\Com
2019-10-12 01:54 - 2019-03-19 06:52 - 000000000 ____D C:\WINDOWS\SysWOW64\AdvancedInstallers
2019-10-12 01:54 - 2019-03-19 06:52 - 000000000 ____D C:\WINDOWS\SystemResources
2019-10-12 01:54 - 2019-03-19 06:52 - 000000000 ____D C:\WINDOWS\system32\WinMetadata
2019-10-12 01:54 - 2019-03-19 06:52 - 000000000 ____D C:\WINDOWS\system32\SystemResetPlatform
2019-10-12 01:54 - 2019-03-19 06:52 - 000000000 ____D C:\WINDOWS\system32\Sysprep
2019-10-12 01:54 - 2019-03-19 06:52 - 000000000 ____D C:\WINDOWS\system32\ShellExperiences
2019-10-12 01:54 - 2019-03-19 06:52 - 000000000 ____D C:\WINDOWS\system32\setup
2019-10-12 01:54 - 2019-03-19 06:52 - 000000000 ____D C:\WINDOWS\system32\PerceptionSimulation
2019-10-12 01:54 - 2019-03-19 06:52 - 000000000 ____D C:\WINDOWS\system32\oobe
2019-10-12 01:54 - 2019-03-19 06:52 - 000000000 ____D C:\WINDOWS\system32\migwiz
2019-10-12 01:54 - 2019-03-19 06:52 - 000000000 ____D C:\WINDOWS\system32\downlevel
2019-10-12 01:54 - 2019-03-19 06:52 - 000000000 ____D C:\WINDOWS\system32\Dism
2019-10-12 01:54 - 2019-03-19 06:52 - 000000000 ____D C:\WINDOWS\system32\DDFs
2019-10-12 01:54 - 2019-03-19 06:52 - 000000000 ____D C:\WINDOWS\system32\Com
2019-10-12 01:54 - 2019-03-19 06:52 - 000000000 ____D C:\WINDOWS\system32\appraiser
2019-10-12 01:54 - 2019-03-19 06:52 - 000000000 ____D C:\WINDOWS\system32\AdvancedInstallers
2019-10-12 01:54 - 2019-03-19 06:52 - 000000000 ____D C:\WINDOWS\ShellExperiences
2019-10-12 01:54 - 2019-03-19 06:52 - 000000000 ____D C:\WINDOWS\ShellComponents
2019-10-12 01:50 - 2019-03-19 06:52 - 000000000 ____D C:\WINDOWS\registration
2019-10-11 22:50 - 2018-04-09 13:39 - 000000000 ____D C:\ProgramData\Intel
2019-10-11 01:08 - 2019-05-28 03:11 - 000000930 _____ C:\Users\Public\Desktop\aTube Catcher.lnk
2019-10-11 01:08 - 2019-05-28 03:11 - 000000930 _____ C:\ProgramData\Desktop\aTube Catcher.lnk
2019-10-10 22:16 - 2018-04-09 19:10 - 000002299 _____ C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Google Chrome.lnk
2019-10-10 22:16 - 2018-04-09 19:10 - 000002258 _____ C:\Users\Public\Desktop\Google Chrome.lnk
2019-10-10 22:16 - 2018-04-09 19:10 - 000002258 _____ C:\ProgramData\Desktop\Google Chrome.lnk
2019-10-09 22:44 - 2019-09-02 22:22 - 000004622 _____ C:\WINDOWS\system32\Tasks\Adobe Flash Player NPAPI Notifier
2019-10-09 22:44 - 2019-03-19 06:52 - 000000000 ____D C:\WINDOWS\SysWOW64\Macromed
2019-10-09 22:44 - 2019-03-19 06:52 - 000000000 ____D C:\WINDOWS\system32\Macromed
2019-10-09 04:00 - 2018-04-10 00:16 - 000000000 ____D C:\WINDOWS\system32\MRT
2019-10-09 04:00 - 2017-03-18 23:03 - 000000167 _____ C:\WINDOWS\win.ini
2019-10-08 22:48 - 2018-05-02 20:10 - 000000000 ____D C:\Users\Plácido\AppData\Local\PlaceholderTileLogoFolder
2019-10-07 21:09 - 2019-09-02 22:22 - 000003622 _____ C:\WINDOWS\system32\Tasks\GoogleUpdateTaskMachineUA
2019-10-07 21:09 - 2019-09-02 22:22 - 000003498 _____ C:\WINDOWS\system32\Tasks\GoogleUpdateTaskMachineCore
2019-10-02 18:08 - 2019-05-18 06:13 - 000000000 ____D C:\Users\Plácido\AppData\Roaming\Apple Computer
2019-09-30 21:31 - 2018-05-16 05:36 - 000000000 __RDC C:\Users\Plácido\3D Objects
2019-09-30 21:31 - 2018-04-09 19:04 - 000000000 __RHD C:\Users\Public\AccountPictures
2019-09-30 21:29 - 2019-09-02 22:16 - 000495048 _____ C:\WINDOWS\system32\FNTCACHE.DAT
2019-09-30 08:27 - 2019-03-19 06:52 - 000000000 ____D C:\WINDOWS\ServiceState
2019-09-30 06:05 - 2018-04-29 04:15 - 000000000 ____D C:\Users\Plácido\AppData\Roaming\vlc
2019-09-30 05:13 - 2019-03-19 06:52 - 000000000 ____D C:\WINDOWS\LiveKernelReports
2019-09-18 19:50 - 2018-07-22 04:27 - 000000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Skype
2019-09-18 19:49 - 2018-04-09 22:51 - 000001383 _____ C:\Users\Public\Desktop\Skype.lnk
2019-09-18 19:49 - 2018-04-09 22:51 - 000001383 _____ C:\ProgramData\Desktop\Skype.lnk
2019-09-18 19:48 - 2018-12-13 16:44 - 000000000 ___DC C:\Users\Plácido\AppData\Local\babl-0.1
2019-09-18 19:35 - 2018-04-09 22:27 - 000000000 ____D C:\Users\Plácido\AppData\LocalLow\Mozilla
2019-09-17 20:47 - 2019-03-19 06:52 - 000000000 ____D C:\WINDOWS\system32\NDF

==================== Files in the root of some directories ================

2019-06-14 03:51 - 2019-06-14 03:51 - 000000034 _____ () C:\Users\Plácido\AppData\Roaming\pcouffin.log
2019-06-14 03:51 - 2019-06-14 03:51 - 000001041 _____ () C:\Users\Plácido\AppData\Roaming\vso_ts_preview.xml
2019-03-14 20:53 - 2019-03-14 20:53 - 000535552 ____C (Dirección General de la Policía) C:\Users\Plácido\AppData\Local\DNIeService.exe
2019-09-18 19:48 - 2019-09-18 19:48 - 000003053 _____ () C:\Users\Plácido\AppData\Local\recently-used.xbel
2018-11-27 01:53 - 2018-11-27 02:06 - 000007604 ____C () C:\Users\Plácido\AppData\Local\Resmon.ResmonCfg
2018-04-09 21:29 - 2016-11-23 15:37 - 000000570 ____C () C:\Users\Plácido\AppData\Local\TroubleshooterConfig.json

==================== SigCheck ===============================

(There is no automatic fix for files that do not pass verification.)

==================== End of FRST.txt ============================
Additional scan result of Farbar Recovery Scan Tool (x64) Version: 12-10-2019 02
Ran by Plácido (14-10-2019 20:40:04)
Running from C:\Users\Plácido\Downloads
Windows 10 Pro Version 1903 18362.418 (X64) (2019-09-02 20:22:52)
Boot Mode: Normal
==========================================================


==================== Accounts: =============================

Administrador (S-1-5-21-3329500403-3007259016-2968960673-500 - Administrator - Disabled)
DefaultAccount (S-1-5-21-3329500403-3007259016-2968960673-503 - Limited - Disabled)
Invitado (S-1-5-21-3329500403-3007259016-2968960673-501 - Limited - Disabled)
Plácido (S-1-5-21-3329500403-3007259016-2968960673-1001 - Administrator - Enabled) => C:\Users\Plácido
WDAGUtilityAccount (S-1-5-21-3329500403-3007259016-2968960673-504 - Limited - Disabled)

==================== Security Center ========================

(If an entry is included in the fixlist, it will be removed.)

AV: Windows Defender (Enabled - Up to date) {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
AV: Panda Dome (Disabled - Up to date) {CF440CD9-5435-10B1-04E0-7768B6F10320}
AS: Windows Defender (Disabled - Up to date) {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
AS: Panda Dome (Enabled - Up to date) {7425ED3D-720F-1F3F-3E50-4C1ACD76499D}

==================== Installed Programs ======================

(Only the adware programs with "Hidden" flag could be added to the fixlist to unhide them. The adware programs should be uninstalled manually.)

µTorrent (HKU\S-1-5-21-3329500403-3007259016-2968960673-1001\...\uTorrent) (Version: 3.5.5.45341 - BitTorrent Inc.)
Adobe Acrobat Reader DC (HKLM-x32\...\{AC76BA86-7AD7-1033-7B44-AC0F074E4100}) (Version: 19.012.20040 - Adobe Systems Incorporated)
Adobe Creative Cloud (HKLM-x32\...\Adobe Creative Cloud) (Version: 4.5.0.331 - Adobe Systems Incorporated)
Adobe Flash Player 32 NPAPI (HKLM-x32\...\Adobe Flash Player NPAPI) (Version: 32.0.0.270 - Adobe)
Adobe Photoshop CC 2018 (32 Bit) (HKLM-x32\...\PHSP_19_0_32) (Version: 19.0 - Adobe Systems Incorporated)
AMCap (HKLM-x32\...\AMCap) (Version: 9.22 - Noël Danjou)
aTube Catcher versión 3.8 (HKLM-x32\...\{D43B360E-722D-421B-BC77-20B9E0F8B6CD}_is1) (Version: 3.8 - DsNET Corp)
AVS Audio Editor 7.2 (HKLM-x32\...\AVS Audio Editor_is1) (Version: 7.2.1.487 - Online Media Technologies Ltd.)
BlueStacks App Player (HKLM\...\BlueStacks) (Version: 4.120.5.1101 - BlueStack Systems, Inc.)
Camtasia Studio 8 (HKLM-x32\...\{72144B9D-58C4-4C09-A5CF-C6A914B912E8}) (Version: 8.0.0.878 - TechSmith Corporation)
CyberLink YouCam 7 (HKLM-x32\...\{0078CD4D-B146-4D77-8CF0-268B36C1A3EC}) (Version: 7.0.0611.0 - CyberLink Corp.)
Dragon Ball FighterZ (HKLM-x32\...\Dragon Ball FighterZ_is1) (Version:  - )
Eines de correcció del Microsoft Office 2016: català (HKLM-x32\...\{90160000-001F-0403-0000-0000000FF1CE}) (Version: 16.0.4266.1001 - Microsoft Corporation) Hidden
eMule (HKLM-x32\...\eMule) (Version:  - )
Ferramentas de verificación de Microsoft Office 2016 - Galego (HKLM-x32\...\{90160000-001F-0456-0000-0000000FF1CE}) (Version: 16.0.4266.1001 - Microsoft Corporation) Hidden
FIFA 14 Ultimate Edition MULTI-14 1.2.0 (HKLM-x32\...\FIFA 14 Ultimate Edition MULTI-14 1.2.0) (Version:  - )
FormatFactory 4.8.0.0 (HKLM-x32\...\FormatFactory) (Version: 4.8.0.0 - Free Time)
GIMP 2.10.10 (HKLM\...\GIMP-2_is1) (Version: 2.10.10 - The GIMP Team)
Google Chrome (HKLM-x32\...\Google Chrome) (Version: 77.0.3865.120 - Google LLC)
Google Update Helper (HKLM-x32\...\{60EC980A-BDA2-4CB6-A427-B07A5498B4CA}) (Version: 1.3.35.301 - Google LLC) Hidden
Google Update Helper (HKLM-x32\...\{A92DAB39-4E2C-4304-9AB6-BC44E68B55E2}) (Version: 1.3.21.115 - Google Inc.) Hidden
Herramientas de corrección de Microsoft Office 2016: español (HKLM-x32\...\{90160000-001F-0C0A-0000-0000000FF1CE}) (Version: 16.0.4266.1001 - Microsoft Corporation) Hidden
Instalable DNIe (HKLM\...\{D2CE0562-13E0-4FC9-85F2-CA3D0392310E}) (Version: 14.0.1 - Cuerpo Nacional de Policía)
Intel(R) Management Engine Components (HKLM\...\{1CEAC85D-2590-4760-800F-8DE5E91F3700}) (Version: 11.6.0.1050 - Intel Corporation)
Intel(R) Processor Graphics (HKLM-x32\...\{F0E3AD40-2BBD-4360-9C76-B9AC9A5886EA}) (Version: 25.20.100.6373 - Intel Corporation)
Intel(R) Rapid Storage Technology (HKLM\...\{409CB30E-E457-4008-9B1A-ED1B9EA21140}) (Version: 17.5.2.1024 - Intel Corporation)
Intel® Optane™ Pinning Explorer Extensions (HKLM\...\{C1A5573E-1508-49E1-BA6A-34E2EB15E9BF}) (Version: 17.5.2.1024 - Intel Corporation)
JDownloader 2 (HKLM\...\jdownloader2) (Version: 2.0 - AppWork GmbH)
Mediatek RT2870 Wireless LAN Card (HKLM-x32\...\{28DA7D8B-F9A4-4F18-8AA0-551B1E084D0D}) (Version: 5.1.28.0 - MediatekWiFi)
Microsoft Office Professional Plus 2016 (HKLM-x32\...\Office16.PROPLUS) (Version: 16.0.4266.1001 - Microsoft Corporation)
Microsoft SharePoint Designer 2010 (HKLM\...\Office14.SharePointDesigner) (Version: 14.0.7015.1000 - Microsoft Corporation)
Microsoft Visual C++ 2005 Redistributable (HKLM-x32\...\{710f4c1c-cc18-4c49-8cbf-51240c89a1a2}) (Version: 8.0.61001 - Microsoft Corporation)
Microsoft Visual C++ 2005 Redistributable (HKLM-x32\...\{837b34e3-7c30-493c-8f6a-2b0f04e2912c}) (Version: 8.0.59193 - Microsoft Corporation)
Microsoft Visual C++ 2005 Redistributable (x64) (HKLM\...\{ad8a2fa1-06e7-4b0d-927d-6e54b3d31028}) (Version: 8.0.61000 - Microsoft Corporation)
Microsoft Visual C++ 2010  x64 Redistributable - 10.0.40219 (HKLM\...\{1D8E6291-B0D5-35EC-8441-6616F567A0F7}) (Version: 10.0.40219 - Microsoft Corporation)
Microsoft Visual C++ 2010  x86 Redistributable - 10.0.40219 (HKLM-x32\...\{F0C3E5D1-1ADE-321E-8167-68EF0DE699A5}) (Version: 10.0.40219 - Microsoft Corporation)
Microsoft Visual C++ 2012 Redistributable (x86) - 11.0.61030 (HKLM-x32\...\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}) (Version: 11.0.61030.0 - Microsoft Corporation)
Microsoft Visual C++ 2013 Redistributable (x86) - 12.0.21005 (HKLM-x32\...\{ce085a78-074e-4823-8dc1-8a721b94b76d}) (Version: 12.0.21005.1 - Microsoft Corporation)
Microsoft Visual C++ 2015 Redistributable (x86) - 14.0.24215 (HKLM-x32\...\{e2803110-78b3-4664-a479-3611a381656a}) (Version: 14.0.24215.1 - Microsoft Corporation)
Microsoft Visual Studio 2010 Tools for Office Runtime (x64) (HKLM\...\Microsoft Visual Studio 2010 Tools for Office Runtime (x64)) (Version: 10.0.50903 - Microsoft Corporation)
Microsoft XNA Framework Redistributable 4.0 (HKLM-x32\...\{2BFC7AA0-544C-4E3A-8796-67F3BE655BE9}) (Version: 4.0.20823.0 - Microsoft Corporation)
Mozilla Firefox 68.0.1 (x64 es-ES) (HKLM\...\Mozilla Firefox 68.0.1 (x64 es-ES)) (Version: 68.0.1 - Mozilla)
Mozilla Maintenance Service (HKLM\...\MozillaMaintenanceService) (Version: 68.0.1 - Mozilla)
Nero 12 (HKLM-x32\...\{560FC78C-A4B2-461D-9B47-820C1EEF87B8}) (Version: 12.0.02000 - Nero AG)
Panda Devices Agent (HKLM-x32\...\{DB0164A2-ADE9-4FEE-B080-D506BDD6427F}) (Version: 1.08.09 - Panda Security) Hidden
Panda Devices Agent (HKLM-x32\...\Panda Devices Agent) (Version: 1.03.09 - Panda Security) Hidden
Panda Dome (HKLM\...\{DC22166B-6F26-4E2E-BFDE-CC3578246940}) (Version: 9.14.00 - Panda Security) Hidden
Panda Dome (HKLM-x32\...\Panda Universal Agent Endpoint) (Version: 18.6.0 - Panda Security)
Paquete de idioma de Microsoft Visual Studio 2010 Tools para Office Runtime (x64) - ESN (HKLM\...\Microsoft Visual Studio 2010 Tools for Office Runtime (x64) Language Pack - ESN) (Version: 10.0.50903 - Microsoft Corporation)
Prerequisite installer (HKLM-x32\...\{3AAB08A3-F129-4BD5-B409-AE674F93759D}) (Version: 12.0.0002 - Nero AG) Hidden
Realtek Ethernet Controller Driver (HKLM-x32\...\{8833FFB6-5B0C-4764-81AA-06DFEED9A476}) (Version: 10.10.714.2016 - Realtek)
Realtek High Definition Audio Driver (HKLM-x32\...\{F132AF7F-7BCA-4EDE-8A7C-958108FE7DBC}) (Version: 6.0.1.8228 - Realtek Semiconductor Corp.)
Revisores de Texto do Microsoft Office 2016 – Português (Brasil) (HKLM-x32\...\{90160000-001F-0416-0000-0000000FF1CE}) (Version: 16.0.4266.1001 - Microsoft Corporation) Hidden
RT2870 Flash Install (HKLM-x32\...\Ralink Wireless LAN Card Setup_is1) (Version:  - )
Service Pack 2 for Microsoft Office 2010 (KB2687455) 64-Bit Edition (HKLM\...\{90140000-0017-0000-1000-0000000FF1CE}_Office14.SharePointDesigner_{98223B6C-F59E-4928-B553-43605D52ED19}) (Version:  - Microsoft)
Skype versión 8.52 (HKLM-x32\...\Skype_is1) (Version: 8.52 - Skype Technologies S.A.)
Software para dispositivos de chipset Intel® (HKLM-x32\...\{49bc1e38-39b4-4728-9e75-cbe67ba9a329}) (Version: 10.1.1.42 - Intel(R) Corporation) Hidden
Spotify (HKU\S-1-5-21-3329500403-3007259016-2968960673-1001\...\Spotify) (Version: 1.1.10.540.gfcf0430f - Spotify AB)
Steam (HKLM-x32\...\{048298C9-A4D3-490B-9FF9-AB023A9238F3}) (Version: 1.0.0.0 - Valve Corporation)
TP-LINK TL-WN721N_TL-WN722N Driver (HKLM-x32\...\{86A7EED0-02D0-4D91-8183-8D2F23F5E6AE}) (Version: 1.3.1 - TP-LINK)
Update for Skype for Business 2016 (KB4484102) 32-Bit Edition (HKLM-x32\...\{90160000-0011-0000-0000-0000000FF1CE}_Office16.PROPLUS_{45B1F5CF-EE6B-4C5D-9602-A2B797B741F5}) (Version:  - Microsoft)
Update for Skype for Business 2016 (KB4484102) 32-Bit Edition (HKLM-x32\...\{90160000-002A-0000-1000-0000000FF1CE}_Office16.PROPLUS_{45B1F5CF-EE6B-4C5D-9602-A2B797B741F5}) (Version:  - Microsoft)
Update for Skype for Business 2016 (KB4484102) 32-Bit Edition (HKLM-x32\...\{90160000-012B-0C0A-0000-0000000FF1CE}_Office16.PROPLUS_{45B1F5CF-EE6B-4C5D-9602-A2B797B741F5}) (Version:  - Microsoft)
Update for Windows 10 for x64-based Systems (KB4023057) (HKLM\...\{F814D094-197F-43C8-87FA-3210BB780486}) (Version: 2.53.0.0 - Microsoft Corporation)
VdhCoApp 1.2.4 (HKLM\...\weh-iss-net.downloadhelper.coapp_is1) (Version:  - DownloadHelper)
VLC media player (HKLM-x32\...\VLC media player) (Version: 3.0.7.1 - VideoLAN)
Vulkan Run Time Libraries 1.0.65.1 (HKLM\...\VulkanRT1.0.65.1) (Version: 1.0.65.1 - LunarG, Inc.) Hidden
Vulkan Run Time Libraries 1.0.65.1 (HKLM\...\VulkanRT1.0.65.1-3) (Version: 1.0.65.1 - LunarG, Inc.) Hidden
WavePad, editor de audio (HKLM-x32\...\WavePad) (Version:  - NCH Software)
Welcome App (Start-up experience) (HKLM-x32\...\{828175FA-7307-4DBF-95AD-9CEE086B6F45}) (Version: 12.0.14000 - Nero AG) Hidden
Windows Driver Package - Dirección General de la Policía (UMPass) SmartCard  (10/30/2018 1.0.2.7) (HKLM\...\EC0850ACBB539AD49EB5503A072981871981EB01) (Version: 10/30/2018 1.0.2.7 - Dirección General de la Policía)
Windows Setup Remediations (x64) (KB4023057) (HKLM\...\{5534e02f-0f5d-40dd-ba92-bea38d22384d}.sdb) (Version:  - )
WinRAR 5.61 (32-bit) (HKLM-x32\...\WinRAR archiver) (Version: 5.61.0 - win.rar GmbH)

Packages:
=========
Autodesk SketchBook -> C:\Program Files\WindowsApps\89006A2E.AutodeskSketchBook_5.0.2.0_x64__tf1gferkr813w [2019-05-27] (Autodesk Inc.)
Bubble Witch 3 Saga -> C:\Program Files\WindowsApps\king.com.BubbleWitch3Saga_6.1.4.0_x86__kgqvnymyfvs32 [2019-09-23] (king.com)
Correo y Calendario -> C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.12026.20218.0_x64__8wekyb3d8bbwe [2019-10-12] (Microsoft Corporation) [MS Ad]
Microsoft Advertising SDK for XAML -> C:\Program Files\WindowsApps\Microsoft.Advertising.Xaml_10.1811.1.0_x64__8wekyb3d8bbwe [2019-10-12] (Microsoft Corporation) [MS Ad]
Microsoft Advertising SDK for XAML -> C:\Program Files\WindowsApps\Microsoft.Advertising.Xaml_10.1811.1.0_x86__8wekyb3d8bbwe [2019-10-12] (Microsoft Corporation) [MS Ad]
Microsoft Solitaire Collection -> C:\Program Files\WindowsApps\Microsoft.MicrosoftSolitaireCollection_4.4.10022.0_x64__8wekyb3d8bbwe [2019-10-12] (Microsoft Studios) [MS Ad]
MSN El Tiempo -> C:\Program Files\WindowsApps\Microsoft.BingWeather_4.32.12463.0_x64__8wekyb3d8bbwe [2019-10-12] (Microsoft Corporation) [MS Ad]
One Calendar -> C:\Program Files\WindowsApps\64885BlueEdge.OneCalendar_2019.210.3.0_x64__8kea50m9krsh2 [2019-10-12] (Code Spark)
Pantalla inalámbrica Microsoft -> C:\Program Files\WindowsApps\Microsoft.SurfaceWirelessDisplayAdapter_3.4.137.1000_x64__8wekyb3d8bbwe [2019-09-30] (Microsoft Corporation)
Video Downloader Professional for Edge -> C:\Program Files\WindowsApps\Link64GmbH.VideoDownloaderProfessionalforEdge_1.0.12.0_neutral__r8gm29f18mcyc [2019-10-12] (Link64 GmbH)

==================== Custom CLSID (Whitelisted): ==========================

(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)

HKU\S-1-5-21-3329500403-3007259016-2968960673-1001\...\ChromeHTML: ->  <==== ATTENTION
CustomCLSID: HKU\S-1-5-21-3329500403-3007259016-2968960673-1001_Classes\CLSID\{e8c77137-e224-5791-b6e9-ff0305797a13}\InprocServer32 -> C:\Program Files (x86)\Adobe\Adobe Creative Cloud\Utils\npAdobeAAMDetect64.dll (Adobe Systems Incorporated -> Adobe Systems)
ShellIconOverlayIdentifiers: [   AccExtIco1] -> {AB9CF9F8-8A96-4F9D-BF21-CE85714C3A47} => C:\Program Files (x86)\Common Files\Adobe\CoreSyncExtension\CoreSync_x64.dll [2018-02-27] (Adobe Systems Incorporated -> )
ShellIconOverlayIdentifiers: [   AccExtIco2] -> {853B7E05-C47D-4985-909A-D0DC5C6D7303} => C:\Program Files (x86)\Common Files\Adobe\CoreSyncExtension\CoreSync_x64.dll [2018-02-27] (Adobe Systems Incorporated -> )
ShellIconOverlayIdentifiers: [   AccExtIco3] -> {42D38F2E-98E9-4382-B546-E24E4D6D04BB} => C:\Program Files (x86)\Common Files\Adobe\CoreSyncExtension\CoreSync_x64.dll [2018-02-27] (Adobe Systems Incorporated -> )
ShellIconOverlayIdentifiers: [  OptaneIconOverlay] -> {A3AF6F6C-8BED-3D93-8B5D-33427B5D38E9} => C:\Program Files\Intel\OptaneShellExtensions\OptaneShellExt.dll [2019-07-08] (Intel(R) Rapid Storage Technology -> )
ShellIconOverlayIdentifiers: [ OneDrive1] -> {BBACC218-34EA-4666-9D7A-C78F2274A524} =>  -> No File
ShellIconOverlayIdentifiers: [ OneDrive2] -> {5AB7172C-9C11-405C-8DD5-AF20F3606282} =>  -> No File
ShellIconOverlayIdentifiers: [ OneDrive3] -> {A78ED123-AB77-406B-9962-2A5D9D2F7F30} =>  -> No File
ShellIconOverlayIdentifiers: [ OneDrive4] -> {F241C880-6982-4CE5-8CF7-7085BA96DA5A} =>  -> No File
ShellIconOverlayIdentifiers: [ OneDrive5] -> {A0396A93-DC06-4AEF-BEE9-95FFCCAEF20E} =>  -> No File
ShellIconOverlayIdentifiers: [ OneDrive6] -> {9AA2F32D-362A-42D9-9328-24A483E2CCC3} =>  -> No File
ShellIconOverlayIdentifiers: [ OneDrive7] -> {C5FF006E-2AE9-408C-B85B-2DFDD5449D9C} =>  -> No File
ShellIconOverlayIdentifiers-x32: [ OneDrive1] -> {BBACC218-34EA-4666-9D7A-C78F2274A524} =>  -> No File
ShellIconOverlayIdentifiers-x32: [ OneDrive2] -> {5AB7172C-9C11-405C-8DD5-AF20F3606282} =>  -> No File
ShellIconOverlayIdentifiers-x32: [ OneDrive3] -> {A78ED123-AB77-406B-9962-2A5D9D2F7F30} =>  -> No File
ShellIconOverlayIdentifiers-x32: [ OneDrive4] -> {F241C880-6982-4CE5-8CF7-7085BA96DA5A} =>  -> No File
ShellIconOverlayIdentifiers-x32: [ OneDrive5] -> {A0396A93-DC06-4AEF-BEE9-95FFCCAEF20E} =>  -> No File
ShellIconOverlayIdentifiers-x32: [ OneDrive6] -> {9AA2F32D-362A-42D9-9328-24A483E2CCC3} =>  -> No File
ShellIconOverlayIdentifiers-x32: [ OneDrive7] -> {C5FF006E-2AE9-408C-B85B-2DFDD5449D9C} =>  -> No File
ContextMenuHandlers1: [ FileSyncEx] -> {CB3D0F55-BC2C-4C1A-85ED-23ED75B5106B} =>  -> No File
ContextMenuHandlers1: [7-Zip] -> {23170F69-40C1-278A-1000-000100020000} =>  -> No File
ContextMenuHandlers1: [AccExt] -> {2A118EB5-5797-4F5E-8B3D-F4ECBA3C98E4} => C:\Program Files (x86)\Common Files\Adobe\CoreSyncExtension\CoreSync_x64.dll [2018-02-27] (Adobe Systems Incorporated -> )
ContextMenuHandlers1: [ANotepad++64] -> {B298D29A-A6ED-11DE-BA8C-A68E55D89593} =>  -> No File
ContextMenuHandlers1: [BriefcaseMenu] -> {85BBD920-42A0-1069-A2E4-08002B30309D} =>  -> No File
ContextMenuHandlers1: [FormatFactoryShell] -> {A3888923-CFD3-4A6B-89BF-08E6B95716E8} => G:\Documentos\FormatFactory\ShellEx64_106.dll [2019-07-02] (Free Time) [File not signed]
ContextMenuHandlers1: [ShellConverter] -> {30A4E07E-068A-4d91-8F05-691283A1336B} => C:\Program Files (x86)\Common Files\AVSMedia\ActiveX\AVSShellConverter64.dll [2013-06-04] (Online Media Technologies Ltd. -> Online Media Technologies Ltd.) [File not signed]
ContextMenuHandlers1: [UAContextMenu] -> {A9B8E64D-3F7E-4D32-8FC9-E391DEE67D75} => C:\Program Files (x86)\Panda Security\Panda Security Protection\PSUAShell.dll [2018-05-30] (Panda Security S.L. -> Panda Security, S.L.)
ContextMenuHandlers1: [WinRAR] -> {B41DB860-64E4-11D2-9906-E49FADC173CA} => C:\Program Files (x86)\WinRAR\rarext64.dll [2018-09-30] (win.rar GmbH -> Alexander Roshal)
ContextMenuHandlers1-x32: [WinRAR32] -> {B41DB860-8EE4-11D2-9906-E49FADC173CA} => C:\Program Files (x86)\WinRAR\rarext.dll [2018-09-30] (win.rar GmbH -> Alexander Roshal)
ContextMenuHandlers3: [OptaneContextMenu] -> {AD7EBB13-617D-3270-8FA8-46583499C4FB} => C:\Program Files\Intel\OptaneShellExtensions\OptaneShellExt.dll [2019-07-08] (Intel(R) Rapid Storage Technology -> )
ContextMenuHandlers3: [{4A7C4306-57E0-4C0C-83A9-78C1528F618C}] -> {4A7C4306-57E0-4C0C-83A9-78C1528F618C} =>  -> No File
ContextMenuHandlers4: [ FileSyncEx] -> {CB3D0F55-BC2C-4C1A-85ED-23ED75B5106B} =>  -> No File
ContextMenuHandlers4: [7-Zip] -> {23170F69-40C1-278A-1000-000100020000} =>  -> No File
ContextMenuHandlers4: [FormatFactoryShell] -> {A3888923-CFD3-4A6B-89BF-08E6B95716E8} => G:\Documentos\FormatFactory\ShellEx64_106.dll [2019-07-02] (Free Time) [File not signed]
ContextMenuHandlers5: [igfxcui] -> {3AB1675A-CCFF-11D2-8B20-00A0C93CB1F4} =>  -> No File
ContextMenuHandlers5: [igfxDTCM] -> {9B5F5829-A529-4B12-814A-E81BCB8D93FC} => C:\WINDOWS\System32\DriverStore\FileRepository\igdlh64.inf_amd64_24de78387e6208e4\igfxDTCM.dll [2018-11-21] (Microsoft Windows Hardware Compatibility Publisher -> Intel Corporation)
ContextMenuHandlers5: [UAContextMenu] -> {A9B8E64D-3F7E-4D32-8FC9-E391DEE67D75} => C:\Program Files (x86)\Panda Security\Panda Security Protection\PSUAShell.dll [2018-05-30] (Panda Security S.L. -> Panda Security, S.L.)
ContextMenuHandlers6: [AccExt] -> {2A118EB5-5797-4F5E-8B3D-F4ECBA3C98E4} => C:\Program Files (x86)\Common Files\Adobe\CoreSyncExtension\CoreSync_x64.dll [2018-02-27] (Adobe Systems Incorporated -> )
ContextMenuHandlers6: [BriefcaseMenu] -> {85BBD920-42A0-1069-A2E4-08002B30309D} =>  -> No File
ContextMenuHandlers6: [UAContextMenu] -> {A9B8E64D-3F7E-4D32-8FC9-E391DEE67D75} => C:\Program Files (x86)\Panda Security\Panda Security Protection\PSUAShell.dll [2018-05-30] (Panda Security S.L. -> Panda Security, S.L.)
ContextMenuHandlers6: [WinRAR] -> {B41DB860-64E4-11D2-9906-E49FADC173CA} => C:\Program Files (x86)\WinRAR\rarext64.dll [2018-09-30] (win.rar GmbH -> Alexander Roshal)
ContextMenuHandlers6-x32: [WinRAR32] -> {B41DB860-8EE4-11D2-9906-E49FADC173CA} => C:\Program Files (x86)\WinRAR\rarext.dll [2018-09-30] (win.rar GmbH -> Alexander Roshal)

==================== Codecs (Whitelisted) ==================

(If an entry is included in the fixlist, the registry item will be restored to default or removed. The file will not be moved.)

HKLM\...\Drivers32: [VIDC.FMVC] => C:\Windows\SysWOW64\fmcodec.dll [77824 2008-08-18] (Fox Magic Software) [File not signed]

==================== Shortcuts & WMI ========================

(The entries could be listed to be restored or removed.)


Shortcut: C:\Users\Plácido\Favorites\NCH Software Download Site.lnk -> hxxp://www.nch.com.au/index.htm

==================== Loaded Modules (Whitelisted) ==============

2019-09-04 17:56 - 2019-08-01 08:16 - 099684864 _____ () [File not signed] G:\Documentos\BlueStacks\CefData\libcef.dll
2019-07-28 20:01 - 2009-05-01 11:51 - 001069056 _____ (Cisco Systems, Inc.) [File not signed] C:\Program Files (x86)\MediatekWiFi\Common\CiscoEapFast.dll
2019-07-02 11:29 - 2019-07-02 11:29 - 000301568 _____ (Free Time) [File not signed] G:\Documentos\FormatFactory\ShellEx64_106.dll
2010-04-07 15:01 - 2010-04-07 15:01 - 000114688 _____ (hxxp://www.emule-project.net) [File not signed] G:\Administraciones\eMule\lang\es_ES_T.dll
2019-09-02 21:56 - 2019-09-02 21:56 - 000113664 _____ (Microsoft Corporation) [File not signed] C:\WINDOWS\WinSxS\amd64_microsoft.vc80.atl_1fc8b3b9a1e18e3b_8.0.50727.6195_none_8a1dd9552ed7f8d8\ATL80.DLL
2018-04-09 18:38 - 2013-06-04 12:26 - 000150888 ____C (Online Media Technologies Ltd. -> Online Media Technologies Ltd.) [File not signed] C:\Program Files (x86)\Common Files\AVSMedia\ActiveX\AVSShellConverter64.dll
2019-09-04 17:56 - 2019-08-01 08:16 - 000564736 _____ (The Chromium Authors) [File not signed] G:\Documentos\BlueStacks\CefData\chrome_elf.dll
2018-09-28 21:30 - 2012-05-10 22:01 - 001503744 _____ (The OpenSSL Project, hxxp://www.openssl.org/) [File not signed] C:\WINDOWS\SYSTEM32\libeay32.dll

==================== Alternate Data Streams (Whitelisted) =========

(If an entry is included in the fixlist, only the ADS will be removed.)


==================== Safe Mode (Whitelisted) ===================

(If an entry is included in the fixlist, it will be removed from the registry. The "AlternateShell" will be restored.)

HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\MBAMService => ""="Service"
HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\MBAMService => ""="Service"

==================== Association (Whitelisted) ===============

(If an entry is included in the fixlist, the registry item will be restored to default or removed.)


==================== Internet Explorer trusted/restricted ===============

(If an entry is included in the fixlist, it will be removed from the registry.)


==================== Hosts content: ===============================

(If needed Hosts: directive could be included in the fixlist to reset Hosts.)

2017-03-18 23:03 - 2019-10-12 06:02 - 000000962 _____ C:\WINDOWS\system32\drivers\etc\hosts


2018-10-27 16:44 - 2019-02-28 17:44 - 000000444 _____ C:\WINDOWS\system32\drivers\etc\hosts.ics

172.17.118.1 DESKTOP-N7K9G5B.mshome.net # 2024 2 2 27 15 44 19 289

==================== Other Areas ============================

(Currently there is no automatic fix for this section.)

HKLM\System\CurrentControlSet\Control\Session Manager\Environment\\Path -> C:\Program Files (x86)\Intel\iCLS Client\;C:\Program Files\Intel\iCLS Client\;%SystemRoot%\system32;%SystemRoot%;%SystemRoot%\System32\Wbem;%SYSTEMROOT%\System32\WindowsPowerShell\v1.0\;C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\DAL;C:\Program Files\Intel\Intel(R) Management Engine Components\DAL;C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\IPT;C:\Program Files\Intel\Intel(R) Management Engine Components\IPT;%SYSTEMROOT%\System32\OpenSSH\
HKU\S-1-5-21-3329500403-3007259016-2968960673-1001\Control Panel\Desktop\\Wallpaper -> G:\Imágenes\Fotos descargadas\FONDO ORDENADOR sunlight-landscape-forest-waterfall-water-nature--wallherecom.jpg
DNS Servers: 212.231.6.7 - 46.6.113.34
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System => (ConsentPromptBehaviorAdmin: 5) (ConsentPromptBehaviorUser: 3) (EnableLUA: 1)
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer => (SmartScreenEnabled: Off)
Windows Firewall is enabled.

==================== MSCONFIG/TASK MANAGER disabled items ==

If an entry is included in the fixlist, it will be removed.

HKLM\...\StartupApproved\Run32: => "YouCam Service7"
HKU\S-1-5-21-3329500403-3007259016-2968960673-1001\...\StartupApproved\StartupFolder: => "MultiSkypeLauncher.lnk"
HKU\S-1-5-21-3329500403-3007259016-2968960673-1001\...\StartupApproved\Run: => "BlueStacks Agent"
HKU\S-1-5-21-3329500403-3007259016-2968960673-1001\...\StartupApproved\Run: => "OneDrive"
HKU\S-1-5-21-3329500403-3007259016-2968960673-1001\...\StartupApproved\Run: => "Spotify"
HKU\S-1-5-21-3329500403-3007259016-2968960673-1001\...\StartupApproved\Run: => "Skype for Desktop"
HKU\S-1-5-21-3329500403-3007259016-2968960673-1001\...\StartupApproved\Run: => "uTorrent"
HKU\S-1-5-21-3329500403-3007259016-2968960673-1001\...\StartupApproved\Run: => "IDMan"
HKU\S-1-5-21-3329500403-3007259016-2968960673-1001\...\StartupApproved\Run: => "Steam"
HKU\S-1-5-21-3329500403-3007259016-2968960673-1001\...\StartupApproved\Run: => "DAEMON Tools Pro Agent"

==================== FirewallRules (Whitelisted) ===============

(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)

FirewallRules: [{37BC75D2-A890-4658-8A2A-803C9A768811}] => (Allow) G:\Juego red STEAM\bin\cef\cef.win7x64\steamwebhelper.exe (Valve -> Valve Corporation)
FirewallRules: [{F0189C0D-83B7-488F-934C-7B143EC67014}] => (Allow) G:\Juego red STEAM\bin\cef\cef.win7x64\steamwebhelper.exe (Valve -> Valve Corporation)
FirewallRules: [UDP Query User{C7F4F66A-CA2C-4132-98D2-2303E6559A5C}G:\accesorios de programas\google\chrome\application\chrome.exe] => (Allow) G:\accesorios de programas\google\chrome\application\chrome.exe (Google LLC -> Google LLC)
FirewallRules: [TCP Query User{84193BCD-A48B-482F-A686-482C792ED869}G:\accesorios de programas\google\chrome\application\chrome.exe] => (Allow) G:\accesorios de programas\google\chrome\application\chrome.exe (Google LLC -> Google LLC)
FirewallRules: [{1C2E32BC-82CF-471D-8BFB-79D2EAE5AF0E}] => (Allow) C:\Program Files\Mozilla Firefox\firefox.exe (Mozilla Corporation -> Mozilla Corporation)
FirewallRules: [{C11107D4-F26D-4B62-A879-6AF33EACBFD6}] => (Allow) C:\Program Files\Mozilla Firefox\firefox.exe (Mozilla Corporation -> Mozilla Corporation)
FirewallRules: [UDP Query User{2F431F12-F968-4C02-8B16-211A48970A64}G:\documentos\utorrent descargas\utorrent\utorrent.exe] => (Allow) G:\documentos\utorrent descargas\utorrent\utorrent.exe (BitTorrent Inc -> BitTorrent Inc.)
FirewallRules: [TCP Query User{C14F2889-601A-400E-9FC5-D51B853316FC}G:\documentos\utorrent descargas\utorrent\utorrent.exe] => (Allow) G:\documentos\utorrent descargas\utorrent\utorrent.exe (BitTorrent Inc -> BitTorrent Inc.)
FirewallRules: [{5DED669D-5098-4411-8365-CC4650160376}] => (Allow) G:\Documentos\FormatFactory\FFModules\Encoder\Doc\EBookCodec.exe (Free Time Co., Ltd. -> Free Time Co., Ltd.)
FirewallRules: [{FC5A9F3A-C926-43EC-A619-8EF68DC4FBA8}] => (Allow) G:\Documentos\FormatFactory\FormatFactory.exe (暇光软件科技(上海)有限公司 -> Free Time Co., Ltd.)
FirewallRules: [{08D9B187-0EC5-4A81-8E7F-37A5CC4ECE7B}] => (Allow) G:\Documentos\FormatFactory\FFModules\Encoder\Doc\EBookCodec.exe (Free Time Co., Ltd. -> Free Time Co., Ltd.)
FirewallRules: [{99C5ECC8-BD8B-46AC-AD8E-7CE69758A0E1}] => (Allow) G:\Documentos\FormatFactory\FormatFactory.exe (暇光软件科技(上海)有限公司 -> Free Time Co., Ltd.)
FirewallRules: [UDP Query User{18097840-8497-4F8B-B282-26B3BF709ED6}G:\documentos\spotify\spotify.exe] => (Allow) G:\documentos\spotify\spotify.exe (Spotify AB -> Spotify Ltd)
FirewallRules: [TCP Query User{B93D37D6-AA8A-4014-BF43-14A6B72AC71F}G:\documentos\spotify\spotify.exe] => (Allow) G:\documentos\spotify\spotify.exe (Spotify AB -> Spotify Ltd)
FirewallRules: [{E6BA8A6D-D637-4F86-B5C2-24BEEE51618F}] => (Allow) G:\Documentos\FormatFactory\FFModules\Encoder\Doc\EBookCodec.exe (Free Time Co., Ltd. -> Free Time Co., Ltd.)
FirewallRules: [{49480385-5E40-469C-B86C-2B1AB0220DB7}] => (Allow) G:\Documentos\FormatFactory\FormatFactory.exe (暇光软件科技(上海)有限公司 -> Free Time Co., Ltd.)
FirewallRules: [{1A5C7819-0EA1-4611-A21B-0E945EBEBD09}] => (Allow) G:\Documentos\FormatFactory\FFModules\Encoder\Doc\EBookCodec.exe (Free Time Co., Ltd. -> Free Time Co., Ltd.)
FirewallRules: [{2D351F44-E3D9-4ECD-B7AC-5E69A1391DF5}] => (Allow) G:\Documentos\FormatFactory\FormatFactory.exe (暇光软件科技(上海)有限公司 -> Free Time Co., Ltd.)
FirewallRules: [UDP Query User{8A6E55A7-E773-4DCB-8B38-22226B73B3CD}C:\users\plácido\appdata\roaming\spotify\spotify.exe] => (Allow) C:\users\plácido\appdata\roaming\spotify\spotify.exe (Spotify AB -> Spotify Ltd)
FirewallRules: [TCP Query User{AEAA81B0-7F98-433A-B5FB-B669CA811EAD}C:\users\plácido\appdata\roaming\spotify\spotify.exe] => (Allow) C:\users\plácido\appdata\roaming\spotify\spotify.exe (Spotify AB -> Spotify Ltd)
FirewallRules: [{1D842C69-8748-4C3B-AD2D-0B83F233D749}] => (Allow) G:\Nero Burning 12\KM\KwikMedia.exe (Nero AG -> Nero AG)
FirewallRules: [{2B7FAA85-39EE-4DB3-B903-9379E060557A}] => (Allow) G:\Nero Burning 12\KM\KwikMedia.exe (Nero AG -> Nero AG)
FirewallRules: [{366C874C-1582-40EB-8F58-323FC841801C}] => (Allow) G:\Juego red STEAM\Steam.exe (Valve -> Valve Corporation)
FirewallRules: [{FCE30C12-7386-4D6C-87D4-FF9EA2C2902D}] => (Allow) G:\Juego red STEAM\Steam.exe (Valve -> Valve Corporation)
FirewallRules: [UDP Query User{99F41AC9-5B80-4AA7-8A38-4F39C91EFD59}G:\administraciones\emule\emule.exe] => (Allow) G:\administraciones\emule\emule.exe (hxxp://www.emule-project.net) [File not signed]
FirewallRules: [TCP Query User{CDECC90A-768E-4EE4-8DDE-5C61D98D8F34}G:\administraciones\emule\emule.exe] => (Allow) G:\administraciones\emule\emule.exe (hxxp://www.emule-project.net) [File not signed]
FirewallRules: [DNS Server Forward Rule - UDP - C598FD1F-C9B7-433E-8580-1FE9CBE98D3F - 0] => (Allow) LPort=53
FirewallRules: [DNS Server Forward Rule - TCP - C598FD1F-C9B7-433E-8580-1FE9CBE98D3F - 0] => (Allow) LPort=53
FirewallRules: [DNS Server Forward Rule - UDP - F46702C7-4F49-4F5B-AE44-7AFFC82CCBFF - 0] => (Allow) LPort=53
FirewallRules: [DNS Server Forward Rule - TCP - F46702C7-4F49-4F5B-AE44-7AFFC82CCBFF - 0] => (Allow) LPort=53
FirewallRules: [{79652676-FBE1-403C-8168-CF13994C99AB}] => (Allow) C:\Program Files\BlueStacks\HD-Player.exe (BlueStack Systems, Inc. -> BlueStack Systems, Inc.)
FirewallRules: [{AABC32B4-A624-4C8D-8266-6FCE758DF355}] => (Allow) C:\Program Files (x86)\Microsoft\Skype for Desktop\Skype.exe (Skype Software Sarl -> Skype Technologies S.A.)
FirewallRules: [{3142138C-9856-4FD4-A0C1-D21C635A989B}] => (Allow) C:\Program Files (x86)\Microsoft\Skype for Desktop\Skype.exe (Skype Software Sarl -> Skype Technologies S.A.)
FirewallRules: [TCP Query User{9A7F0F25-2883-4449-AC9A-9C7B9E33FF71}G:\accesorios de programas\google\chrome\application\chrome.exe] => (Allow) G:\accesorios de programas\google\chrome\application\chrome.exe (Google LLC -> Google LLC)
FirewallRules: [UDP Query User{A909C0AD-5B11-4CEE-BE24-6D6CCEF5D52B}G:\accesorios de programas\google\chrome\application\chrome.exe] => (Allow) G:\accesorios de programas\google\chrome\application\chrome.exe (Google LLC -> Google LLC)
FirewallRules: [{2F5E0A6C-EB51-40DF-8A2B-B4278F758975}] => (Allow) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe (Google LLC -> Google LLC)
FirewallRules: [{5BE6AFBA-2100-4DF8-B5CA-92A52E172141}] => (Allow) C:\Users\Plácido\AppData\Roaming\uTorrent\uTorrent.exe (BitTorrent Inc -> BitTorrent Inc.)
FirewallRules: [{34140311-0BD8-4EFB-A723-6E5781D28563}] => (Allow) C:\Users\Plácido\AppData\Roaming\uTorrent\uTorrent.exe (BitTorrent Inc -> BitTorrent Inc.)

==================== Restore Points =========================

13-10-2019 22:05:26 Punto de control programado

==================== Faulty Device Manager Devices =============


==================== Event log errors: =========================

Application errors:
==================
Error: (10/14/2019 08:35:04 PM) (Source: ESENT) (EventID: 455) (User: )
Description: svchost (14176,R,98) TILEREPOSITORYS-1-5-18: Error -1023 (0xfffffc01) al abrir un archivo de registro C:\WINDOWS\system32\config\systemprofile\AppData\Local\TileDataLayer\Database\EDB.log.

Error: (10/14/2019 08:29:38 PM) (Source: ESENT) (EventID: 455) (User: )
Description: svchost (5184,R,98) TILEREPOSITORYS-1-5-18: Error -1023 (0xfffffc01) al abrir un archivo de registro C:\WINDOWS\system32\config\systemprofile\AppData\Local\TileDataLayer\Database\EDB.log.

Error: (10/14/2019 08:22:47 PM) (Source: SecurityCenter) (EventID: 17) (User: )
Description: Security Center no pudo validar al autor de la llamada con el error %1.

Error: (10/14/2019 07:59:47 PM) (Source: ESENT) (EventID: 455) (User: )
Description: svchost (7812,R,98) TILEREPOSITORYS-1-5-18: Error -1023 (0xfffffc01) al abrir un archivo de registro C:\WINDOWS\system32\config\systemprofile\AppData\Local\TileDataLayer\Database\EDB.log.

Error: (10/14/2019 07:29:38 PM) (Source: ESENT) (EventID: 455) (User: )
Description: svchost (12840,R,98) TILEREPOSITORYS-1-5-18: Error -1023 (0xfffffc01) al abrir un archivo de registro C:\WINDOWS\system32\config\systemprofile\AppData\Local\TileDataLayer\Database\EDB.log.

Error: (10/14/2019 06:59:47 PM) (Source: ESENT) (EventID: 455) (User: )
Description: svchost (8044,R,98) TILEREPOSITORYS-1-5-18: Error -1023 (0xfffffc01) al abrir un archivo de registro C:\WINDOWS\system32\config\systemprofile\AppData\Local\TileDataLayer\Database\EDB.log.

Error: (10/14/2019 06:29:38 PM) (Source: ESENT) (EventID: 455) (User: )
Description: svchost (11328,R,98) TILEREPOSITORYS-1-5-18: Error -1023 (0xfffffc01) al abrir un archivo de registro C:\WINDOWS\system32\config\systemprofile\AppData\Local\TileDataLayer\Database\EDB.log.

Error: (10/14/2019 05:59:47 PM) (Source: ESENT) (EventID: 455) (User: )
Description: svchost (2788,R,98) TILEREPOSITORYS-1-5-18: Error -1023 (0xfffffc01) al abrir un archivo de registro C:\WINDOWS\system32\config\systemprofile\AppData\Local\TileDataLayer\Database\EDB.log.


System errors:
=============
Error: (10/14/2019 06:04:52 AM) (Source: Service Control Manager) (EventID: 7016) (User: )
Description: El servicio RT2870 AutoInstall Service informó de un estado actual 0 no válido.

Error: (10/14/2019 02:23:49 AM) (Source: Service Control Manager) (EventID: 7016) (User: )
Description: El servicio RT2870 AutoInstall Service informó de un estado actual 0 no válido.

Error: (10/14/2019 02:11:08 AM) (Source: Service Control Manager) (EventID: 7016) (User: )
Description: El servicio RT2870 AutoInstall Service informó de un estado actual 0 no válido.

Error: (10/14/2019 01:35:26 AM) (Source: EventLog) (EventID: 6008) (User: )
Description: El cierre anterior del sistema a las 1:30:00 del ‎14/‎10/‎2019 resultó inesperado.

Error: (10/14/2019 01:33:05 AM) (Source: DCOM) (EventID: 10005) (User: DESKTOP-N7K9G5B)
Description: Error de DCOM "5" al intentar iniciar el servicio BITS con argumentos "No disponible" para ejecutar el servidor:
{4991D34B-80A1-4291-83B6-3328366B9097}

Error: (10/14/2019 01:33:05 AM) (Source: Service Control Manager) (EventID: 7000) (User: )
Description: El servicio Servicio de transferencia inteligente en segundo plano (BITS) no pudo iniciarse debido al siguiente error: 
Acceso denegado.

Error: (10/13/2019 09:13:01 PM) (Source: volsnap) (EventID: 36) (User: )
Description: Se anularon las instantáneas del volumen C: porque el almacenamiento de instantáneas no pudo crecer debido a un límite impuesto por el usuario.

Error: (10/13/2019 06:24:53 AM) (Source: Service Control Manager) (EventID: 7000) (User: )
Description: El servicio eapihdrv no pudo iniciarse debido al siguiente error: 
Se ha bloqueado la descarga de este controlador


Windows Defender:
===================================
Date: 2019-10-13 21:48:32.321
Description: 
El examen de Antivirus de Windows Defender se detuvo antes de completarse.
Id. de examen: {DB6C8874-CCB1-4BB3-A0F4-CC1B78C8C50F}
Tipo de examen: Antimalware
Parámetros de examen: Examen rápido
Usuario: NT AUTHORITY\SYSTEM

Date: 2019-10-12 06:34:21.263
Description: 
Antivirus de Windows Defender detectó malware u otro software potencialmente no deseado.
Para más información, consulta lo siguiente:
https://go.microsoft.com/fwlink/?linkid=37020&name=HackTool:Win64/AutoKMS&threatid=2147723334&enterprise=0
Nombre: HackTool:Win64/AutoKMS
Id.: 2147723334
Gravedad: Alta
Categoría: Herramienta
Ruta de acceso: file:_C:\Windows\SECOH-QAD.dll; file:_C:\Windows\SECOH-QAD.exe
Origen de detección: Equipo local
Tipo de detección: Concreto
Origen de detección: Protección en tiempo real
Usuario: DESKTOP-N7K9G5B\Plácido
Nombre de proceso: C:\Users\Plácido\Downloads\ZHPCleaner.exe
Versión de inteligencia de seguridad: AV: 1.303.1506.0, AS: 1.303.1506.0, NIS: 1.303.1506.0
Versión de motor: AM: 1.1.16400.2, NIS: 1.1.16400.2

Date: 2019-10-12 06:34:21.241
Description: 
Antivirus de Windows Defender detectó malware u otro software potencialmente no deseado.
Para más información, consulta lo siguiente:
https://go.microsoft.com/fwlink/?linkid=37020&name=HackTool:Win64/AutoKMS&threatid=2147723334&enterprise=0
Nombre: HackTool:Win64/AutoKMS
Id.: 2147723334
Gravedad: Alta
Categoría: Herramienta
Ruta de acceso: file:_C:\Windows\SECOH-QAD.dll
Origen de detección: Equipo local
Tipo de detección: Concreto
Origen de detección: Protección en tiempo real
Usuario: DESKTOP-N7K9G5B\Plácido
Nombre de proceso: C:\Users\Plácido\Downloads\ZHPCleaner.exe
Versión de inteligencia de seguridad: AV: 1.303.1506.0, AS: 1.303.1506.0, NIS: 1.303.1506.0
Versión de motor: AM: 1.1.16400.2, NIS: 1.1.16400.2

Date: 2019-10-13 21:42:44.421
Description: 
Antivirus de Windows Defender encontró un error al intentar eliminar un elemento de la cuarentena.
Para más información, consulta lo siguiente:
https://go.microsoft.com/fwlink/?linkid=37020&name=HackTool:MSIL/AutoKMS&threatid=2147711767&enterprise=0
Nombre: HackTool:MSIL/AutoKMS
Id.: 2147711767
Gravedad: Alta
Categoría: Herramienta
Usuario: NT AUTHORITY\SYSTEM
Código de error: 0x8050800c
Descripción del error: Problema inesperado. Instale todas las actualizaciones disponibles e intente iniciar el programa de nuevo. Para obtener más información sobre cómo instalar actualizaciones, consulte Ayuda y soporte técnico. 
Versión de inteligencia de seguridad: AV: 1.303.1598.0, AS: 1.303.1598.0
Versión de motor: 1.1.16400.2

CodeIntegrity:
===================================

Date: 2019-10-14 02:12:33.169
Description: 
Code Integrity determined that a process (\Device\HarddiskVolume2\Windows\System32\MicrosoftEdgeCP.exe) attempted to load \Device\HarddiskVolume2\Program Files\Malwarebytes\Anti-Malware\mbae64.dll that did not meet the Store signing level requirements.

Date: 2019-10-14 01:36:47.579
Description: 
Code Integrity determined that a process (\Device\HarddiskVolume2\Windows\System32\MicrosoftEdgeCP.exe) attempted to load \Device\HarddiskVolume2\Program Files\Malwarebytes\Anti-Malware\mbae64.dll that did not meet the Store signing level requirements.

Date: 2019-10-13 20:53:45.840
Description: 
Code Integrity determined that a process (\Device\HarddiskVolume2\Windows\System32\MicrosoftEdgeCP.exe) attempted to load \Device\HarddiskVolume2\Program Files\Malwarebytes\Anti-Malware\mbae64.dll that did not meet the Store signing level requirements.

Date: 2019-10-13 20:51:17.978
Description: 
Code Integrity determined that a process (\Device\HarddiskVolume2\Windows\System32\MicrosoftEdgeCP.exe) attempted to load \Device\HarddiskVolume2\Program Files\Malwarebytes\Anti-Malware\mbae64.dll that did not meet the Store signing level requirements.

Date: 2019-10-13 20:51:02.824
Description: 
Code Integrity determined that a process (\Device\HarddiskVolume2\Windows\System32\MicrosoftEdgeCP.exe) attempted to load \Device\HarddiskVolume2\Program Files\Malwarebytes\Anti-Malware\mbae64.dll that did not meet the Store signing level requirements.

Date: 2019-10-13 18:48:01.391
Description: 
Code Integrity determined that a process (\Device\HarddiskVolume2\Windows\System32\MicrosoftEdgeCP.exe) attempted to load \Device\HarddiskVolume2\Program Files\Malwarebytes\Anti-Malware\mbae64.dll that did not meet the Store signing level requirements.

Date: 2019-10-13 18:47:59.923
Description: 
Code Integrity determined that a process (\Device\HarddiskVolume2\Windows\System32\MicrosoftEdgeCP.exe) attempted to load \Device\HarddiskVolume2\Program Files\Malwarebytes\Anti-Malware\mbae64.dll that did not meet the Store signing level requirements.

Date: 2019-10-13 18:47:05.250
Description: 
Code Integrity determined that a process (\Device\HarddiskVolume2\Windows\System32\MicrosoftEdgeCP.exe) attempted to load \Device\HarddiskVolume2\Program Files\Malwarebytes\Anti-Malware\mbae64.dll that did not meet the Store signing level requirements.

==================== Memory info =========================== 

BIOS: American Megatrends Inc. F8 10/30/2017
Motherboard: Gigabyte Technology Co., Ltd. B250M-DS3H-CF
Processor: Intel(R) Core(TM) i7-7700 CPU @ 3.60GHz
Percentage of memory in use: 47%
Total physical RAM: 12175.75 MB
Available physical RAM: 6388.13 MB
Total Virtual: 13275.75 MB
Available Virtual: 6764.56 MB

==================== Drives ================================

Drive c: () (Fixed) (Total:222.57 GB) (Free:173.59 GB) NTFS
Drive g: (Nuevo vol) (Fixed) (Total:931.51 GB) (Free:816.41 GB) NTFS

\\?\Volume{81e7347d-0000-0000-0000-100000000000}\ (Reservado para el sistema) (Fixed) (Total:0.49 GB) (Free:0.46 GB) NTFS
\\?\Volume{81e7347d-0000-0000-0000-80c337000000}\ () (Fixed) (Total:0.51 GB) (Free:0.08 GB) NTFS

==================== MBR & Partition Table ==================

========================================================
Disk: 0 (MBR Code: Windows 7/8/10) (Size: 223.6 GB) (Disk ID: 81E7347D)
Partition 1: (Active) - (Size=500 MB) - (Type=07 NTFS)
Partition 2: (Not Active) - (Size=222.6 GB) - (Type=07 NTFS)
Partition 3: (Not Active) - (Size=526 MB) - (Type=27)

========================================================
Disk: 1 (MBR Code: Windows 7/8/10) (Size: 931.5 GB) (Disk ID: 50EBB8DB)
Partition 1: (Not Active) - (Size=931.5 GB) - (Type=07 NTFS)

==================== End of Addition.txt ============================

Hola @Nayriel

Pero tiene incluido una Toolbar con Adware, por eso es detectada y eliminada por Eset.

G:\Documentos\Programas Válidos Buenos\WavePad-Sound-Editor—5.33-±Key.rar una variante de Win32/Toolbar.Conduit.H aplicación potencialmente no deseada eliminado

Una de ellas al menos fue detectada cargada con un Troyano por ello te la elimina:

C:\Users\Plácido\AppData\Local\Google\Chrome\User Data\Default\Extensions\aiimdkdngfcipjohbjenkahhlhccpdbc\31.2.9_0\js\contentScripts\contentScript.js JS/Chromex.Agent.AP troyano desinfectado por eliminació

Atube, si es un Falso Positivo, en cuanto terminemos puedes volver a descargarlo, y luego ponerlo en las excepciones de tu Antivirus o Malwarebytes.

No es lo mismo, sabemos que suele ser detectado de esa manera, lo conocemos y usamos a diario, y por ello indicamos su uso desactivando el AV.


Ejecutaste FRST desde un lugar incorrecto:

  • Running from C:\Users\Plácido\ Downloads

Corta el ejecutable y pegalo en tu escritorio <<< Esto es Muy Importante.


Luego sigue estos pasos:

1.- Muy Importante >>> Realizar una copia de Seguridad de su Registro.

  • Descarga DelFix en el escritorio de Windows.
  • Clic Derecho, “Ejecutar como Administrador”.
  • En la ventana principal, marca solamente la casilla “Create Registry Backup”.
  • Clic en Run.

Al terminar se abrirá un reporte llamado DelFix.txt, guárdelo por si fuera necesario y cierre la herramienta…

2.- Desactiva Temporalmente tu antivirus.

3.- Abre un nuevo archivo Notepad/Bloc de Notas y copia y pega este contenido:


Start
CloseProcesses:
CreateRestorePoint:
HKU\S-1-5-21-3329500403-3007259016-2968960673-1001\...\MountPoints2: {691cb571-c34e-11e8-b972-0015830cbfeb} - "E:\AutoInst.exe" 
GroupPolicyScripts: Restriction <==== ATTENTION
Task: {12F9C877Task: {445BA5C8-AAA9-4D57-A6F3-07D6375ED1CE} - no filepath
Task: {445BA5C8-AAA9-4D57-A6F3-07D6375ED1CE} - no filepath
Task: {52872355-9499-47DE-87A8-69E17B030D88} - no filepath
Task: {666306BF-0B08-422C-B5FD-8608658949A6} - no filepath
Task: {9D2E8FF6-491F-4D31-BD31-6D1123783C0D} - no filepath
Task: {BB688CF7-566A-49B6-92F3-8BF1E3C1AC9E} - no filepath
Task: {FCFE95B9-F36D-434D-A27D-8C8785CDA6FC} - no filepath
SearchScopes: HKU\S-1-5-21-3329500403-3007259016-2968960673-1001 -> DefaultScope {3BD44F0E-0596-4008-AEE0-45D47E3A8F0E} URL = 
Toolbar: HKLM - Panda Safe Web - {B821BF60-5C2D-41EB-92DC-3E4CCD3A22E4} -  No File
Toolbar: HKLM-x32 - Panda Safe Web - {B821BF60-5C2D-41EB-92DC-3E4CCD3A22E4} -  No File
FF Plugin-x32: @Nero.com/KM -> C:\PROGRA~2\COMMON~1\Nero\BROWSE~1\NPBROW~1.DLL [No File]
FF Plugin-x32: @videolan.org/vlc,version=2.2.6 -> C:\Program Files (x86)\VideoLAN\VLC\npvlc.dll [No File]
FF Plugin-x32: @videolan.org/vlc,version=3.0.3 -> C:\Program Files (x86)\VideoLAN\VLC\npvlc.dll [No File]
FF Plugin-x32: @videolan.org/vlc,version=3.0.4 -> C:\Program Files (x86)\VideoLAN\VLC\npvlc.dll [No File]
FF Plugin-x32: @videolan.org/vlc,version=3.0.6 -> C:\Program Files (x86)\VideoLAN\VLC\npvlc.dll [No File]
hxxps://pandasecurity.mystart.com/results.php?pr=vmn&id=pandasafeweb&v=1_0_chromeextension_unknown__&searchfeed=web&hsimp=yhs-panda1&ent=ch_ss&q={searchTerms}
CHR HKLM\...\Chrome\Extension: [fagakgcelolinfnkfgekcnedpaklfcok] - hxxps://clients2.google.com/service/update2/crx
CHR HKLM-x32\...\Chrome\Extension: [fagakgcelolinfnkfgekcnedpaklfcok] - hxxps://clients2.google.com/service/update2/crx
HKU\S-1-5-21-3329500403-3007259016-2968960673-1001\...\ChromeHTML: ->  <==== ATTENTION
C:\ProgramData\Intel\Wireless\196e1d4
ShellIconOverlayIdentifiers: [OneDrive1] -> {BBACC218-34EA-4666-9D7A-C78F2274A524} =>  -> No File
ShellIconOverlayIdentifiers: [OneDrive2] -> {5AB7172C-9C11-405C-8DD5-AF20F3606282} =>  -> No File
ShellIconOverlayIdentifiers: [OneDrive3] -> {A78ED123-AB77-406B-9962-2A5D9D2F7F30} =>  -> No File
ShellIconOverlayIdentifiers: [OneDrive4] -> {F241C880-6982-4CE5-8CF7-7085BA96DA5A} =>  -> No File
ShellIconOverlayIdentifiers: [OneDrive5] -> {A0396A93-DC06-4AEF-BEE9-95FFCCAEF20E} =>  -> No File
ShellIconOverlayIdentifiers: [OneDrive6] -> {9AA2F32D-362A-42D9-9328-24A483E2CCC3} =>  -> No File
ShellIconOverlayIdentifiers: [OneDrive7] -> {C5FF006E-2AE9-408C-B85B-2DFDD5449D9C} =>  -> No File
ShellIconOverlayIdentifiers-x32: [OneDrive1] -> {BBACC218-34EA-4666-9D7A-C78F2274A524} =>  -> No File
ShellIconOverlayIdentifiers-x32: [OneDrive2] -> {5AB7172C-9C11-405C-8DD5-AF20F3606282} =>  -> No File
ShellIconOverlayIdentifiers-x32: [OneDrive3] -> {A78ED123-AB77-406B-9962-2A5D9D2F7F30} =>  -> No File
ShellIconOverlayIdentifiers-x32: [OneDrive4] -> {F241C880-6982-4CE5-8CF7-7085BA96DA5A} =>  -> No File
ShellIconOverlayIdentifiers-x32: [OneDrive5] -> {A0396A93-DC06-4AEF-BEE9-95FFCCAEF20E} =>  -> No File
ShellIconOverlayIdentifiers-x32: [OneDrive6] -> {9AA2F32D-362A-42D9-9328-24A483E2CCC3} =>  -> No File
ShellIconOverlayIdentifiers-x32: [OneDrive7] -> {C5FF006E-2AE9-408C-B85B-2DFDD5449D9C} =>  -> No File
ContextMenuHandlers1: [ FileSyncEx] -> {CB3D0F55-BC2C-4C1A-85ED-23ED75B5106B} =>  -> No File
ContextMenuHandlers1: [ANotepad++64] -> {B298D29A-A6ED-11DE-BA8C-A68E55D89593} =>  -> No File
ContextMenuHandlers1: [BriefcaseMenu] -> {85BBD920-42A0-1069-A2E4-08002B30309D} =>  -> No File
ContextMenuHandlers3: [{4A7C4306-57E0-4C0C-83A9-78C1528F618C}] -> {4A7C4306-57E0-4C0C-83A9-78C1528F618C} =>  -> No File
ContextMenuHandlers4: [ FileSyncEx] -> {CB3D0F55-BC2C-4C1A-85ED-23ED75B5106B} =>  -> No File
ContextMenuHandlers4: [7-Zip] -> {23170F69-40C1-278A-1000-000100020000} =>  -> No File
ContextMenuHandlers5: [igfxcui] -> {3AB1675A-CCFF-11D2-8B20-00A0C93CB1F4} =>  -> No File
ContextMenuHandlers6: [BriefcaseMenu] -> {85BBD920-42A0-1069-A2E4-08002B30309D} =>  -> No File
HKLM\...\Drivers32: [VIDC.FMVC] => C:\Windows\SysWOW64\fmcodec.dll [77824 2008-08-18] (Fox Magic Software) [File not signed]

CMD: ipconfig /flushdns
CMD: ipconfig /renew
CMD: bitsadmin /reset /allusers
CMD: netsh winsock reset
CMD: netsh advfirewall reset
CMD: netsh advfirewall set allprofiles state ON
CMD: netsh int ipv4 reset
CMD: netsh int ipv6 reset
RemoveProxy:
EmptyTemp:
Hosts:
END
  • Lo guardas bajo el nombre de fixlist.txt en el escritorio <<< Esto es muy importante.

Nota: Es necesario que el ejecutable Frst.exe y fixlist.txt se encuentren en la misma ubicación (escritorio) o si no la herramienta no trabajara.

  • Ejecutas Frst.exe.
  • Presionas el botón Fix y aguardas a que termine.
  • La Herramienta guardara el reporte en tu escritorio (Fixlog.txt).
  • Lo pegas en tu próxima respuesta.

Nos comentas .

Salu2.

Hola @SanMar Ya he puesto FRST en el escritorio, ¿Vuelvo a escanear con él y a poner los reportes aquí? ¿O hago lo de DelFix y luego el FRST? (Ya que como lo ejecuté desde el sitio que no era, por eso al ponerlo en escritorio no sé si tengo que volver a scan, o ya hago delfix primero y luego frst) Gracias. Saludos

Hola @Nayriel

Solo tienes que leer y hacer los pasos que te deje:

  • 1.- Cambiar de lugar el FRST.
  • 2.- Descargar y ejecutar Delfix.
  • 3.- Crear el Fixlist y seguir los pasos.

Ni una coma de mas.

Salu2

A ver que lo he leído, y te aseguro que soy de los que lee y relee, y no suelo ser torpe, pero como me has dicho que el FRST lo he ejecutado de una ubicación incorrecta, pues la duda era si tenía que volver a ejecutarlo como anteriormente para que surtiera efecto o yo qué se, y luego el delfix. Creo que no soy de los muy torpes ni de los que molestan mucho. Bueno, voy a hacerlo. No pondré ni una coma de más…

Hola @Nayriel

Me refería a los pasos ya que esta es una parte sensible.

No era necesario volver a ejecutarlo, solo cortarlo y pegarlo en el escritorio ya que el reporte sirve igual.

Esperamos el ultimo reporte.

Salu2