# STOP C0000135 The Program Can't Start Because %hs is missing



## charzanka (Nov 16, 2017)

Hope you can help

Server 2008 r2 will not boot in normal or safe mode

BSOD: STOP C0000135 The Program Can't Start Because %hs is missing...
Startup repair will not fix (Even MS DART)
Avast AV
Dell server, RAID running on a PERC H310 card

I ran FARBAR according to this article
https://forums.techguy.org/threads/solved-windows-7-cant-start-because-hs-is-missing.1110910

Attached are the FRST.txt and SEARCH.txt contents

Thank you.

#############################################
FRST.txt 
#############################################
Scan result of Farbar Recovery Scan Tool (FRST) (x64) Version: 16-11-2017
Ran by SYSTEM on MININT-MP5MDGG (16-11-2017 14:51:14)
Running from c:\
Platform: Windows Server 2008 R2 Standard Service Pack 1 (X64) Language: English (United States)
Internet Explorer Version 11
Boot Mode: Recovery
Default: ControlSet001
*ATTENTION!:=====> If the system is bootable FRST must be run from normal or Safe mode to create a complete log.*

Tutorial for Farbar Recovery Scan Tool: http://www.geekstogo.com/forum/topic/335081-frst-tutorial-how-to-use-farbar-recovery-scan-tool/

==================== Registry (Whitelisted) ===========================

(If an entry is included in the fixlist, the registry item will be restored to default or removed. The file will not be moved.)

HKLM\...\Run: [QLogicSaveSystemInfo] => rundll32.exe qlco10010.dll,QLSaveSystemInfo
HKLM\...\Run: [MtxHotPlugService] => C:\Windows\system32\MtxHotPlugService.exe [38984 2014-09-11] ()
HKLM\...\Run: [CrashPlanTray] => C:\Program Files\CrashPlan\CrashPlanTray.exe [462816 2017-07-27] (Code 42 Software, Inc.)
HKLM-x32\...\Run: [ESInetConnect] => "D:\Shares\EagleSoft\Shared Files\esinetconnect.exe"
HKLM-x32\...\Run: [Patterson Server Status] => "D:\Shares\EagleSoft\Shared Files\EsStartup.exe"
HKLM-x32\...\Run: [avast] => C:\Program Files\AVAST Software\Avast Business\avastUI.exe [4770952 2016-10-24] (Avast Software s.r.o.)
Winlogon\Notify\GoToAssist Express Customer: C:\Program Files (x86)\GoToAssist Remote Support Customer\1544\g2ax_winlogonx64.dll (LogMeIn, Inc.)
HKLM\...\Policies\Explorer: [ShowSuperHidden] 1
Lsa: [Notification Packages] scecli rassfm
SecurityProviders: credssp.dll, pwdssp.dll
BootExecute: autocheck autochk * aswBoot.exe /A:"* " /L:"1033" /heur:80 /RA:chest /pup /archives /IA:0 /KBD:3 /wow /dir:"C:\Program Files\AVAST Software\Avast Business"
GroupPolicy: Restriction <==== ATTENTION

==================== Services (Whitelisted) ====================

(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)

S2 ADWS; C:\Windows\ADWS\Microsoft.ActiveDirectory.WebServices.exe [487424 2013-01-24] (Microsoft Corporation)
S2 avast! Administration Console; C:\Program Files\AVAST Software\Administration Console\Avast.Sbc.Service.exe [76592 2016-04-11] (avast! software a.s.)
S2 avast! Administration Console Monitor; C:\Program Files\AVAST Software\Administration Console\Avast.Sbc.Manager.exe [34000 2016-04-11] (avast! software a.s.)
S2 avast! Administration Console Website Host; C:\Program Files\AVAST Software\Administration Console\Avast.Sbc.WebsiteHost.exe [71928 2016-04-11] (avast! software a.s.)
S2 avast! Antivirus; C:\Program Files\AVAST Software\Avast Business\AvastSvc.exe [54344 2016-10-24] (Avast Software s.r.o.)
S2 avast! Net Client Service; C:\Program Files\AVAST Software\Avast Business\AvastNet.exe [209136 2016-10-24] (Avast Software s.r.o.)
S2 Concierge; C:\Program Files (x86)\PatientActivator\Concierge\Concierge.exe [114176 2014-06-19] (Futuredontics, Inc.)
S2 CrashPlanService; C:\Program Files\CrashPlan\CrashPlanService.exe [267744 2017-07-27] (Code 42 Software)
S2 Dfs; C:\Windows\system32\dfssvc.exe [377344 2010-11-20] (Microsoft Corporation)
S2 DFSR; C:\Windows\system32\DFSRs.exe [4518400 2010-11-20] (Microsoft Corporation)
S2 DHCPServer; C:\Windows\System32\dhcpssvc.dll [729088 2010-11-20] (Microsoft Corporation)
S2 DNS; C:\Windows\system32\dns.exe [700928 2017-07-08] (Microsoft Corporation)
S3 FCRegSvc; C:\Windows\system32\FCRegSvc.dll [25600 2009-07-13] (Microsoft Corporation)
S2 GoToAssist Remote Support Customer; C:\Program Files (x86)\GoToAssist Remote Support Customer\1544\g2ax_service.exe [614368 2017-10-27] (LogMeIn, Inc.)
S2 IsmServ; C:\Windows\System32\ismserv.exe [59392 2010-11-20] (Microsoft Corporation)
S2 kdc; C:\Windows\System32\lsass.exe [30720 2017-09-13] (Microsoft Corporation)
S2 MSSQL$PDATA_SQLEXPRESS; C:\Program Files (x86)\Microsoft SQL Server\MSSQL.1\MSSQL\Binn\sqlservr.exe [29293408 2010-12-10] (Microsoft Corporation)
S2 NTDS; C:\Windows\System32\lsass.exe [30720 2017-09-13] (Microsoft Corporation)
S2 NtFrs; C:\Windows\system32\ntfrs.exe [1020416 2010-11-20] (Microsoft Corporation)
S2 RevenueWell Data Sync Update Service; C:\Program Files (x86)\Revenue Well\Update service\UpdateService.exe [13824 2017-07-20] ()
S2 RevenueWell Data Transfer Service; C:\Program Files (x86)\Revenue Well\DataSync\DataTransferService.exe [60416 2017-07-20] ()
S3 RSoPProv; C:\Windows\system32\RSoPProv.exe [91648 2009-07-13] (Microsoft Corporation)
S3 sacsvr; C:\Windows\system32\sacsvr.dll [14848 2009-07-13] (Microsoft Corporation)
S2 ScanServer; C:\Windows\system32\WSDScanRepository.dll [343552 2010-11-20] (Microsoft Corporation)
S3 SrmReports; C:\Windows\system32\srmhost.exe [76288 2010-11-20] (Microsoft Corporation)
S2 SrmSvc; C:\Windows\system32\srmsvc.dll [3489792 2010-11-20] (Microsoft Corporation)
S2 WINS; C:\Windows\System32\wins.exe [287744 2011-08-08] (Microsoft Corporation)
S3 Eaglesoft Messenger Server; D:\Shares\EagleSoft\Shared Files\ESMsgServer.exe -s [X]
S3 Patterson Assistant Service; "D:\Shares\EagleSoft\Shared Files\PattersonAssistantServer.exe" [X]
S3 PattersonAppService; "D:\Shares\EagleSoft\Shared Files\PattersonAppServer.exe" [X]
S3 SQLANYs_PattersonDBServer; D:\Shares\EagleSoft\Shared Files\dbsrv10.exe -hvSQLANYs_PattersonDBServer [X]

===================== Drivers (Whitelisted) ======================

(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)

S2 aswMonFlt; C:\Windows\system32\drivers\aswMonFlt.sys [90344 2016-10-24] (Avast Software s.r.o.)
S1 aswRdr; C:\Windows\System32\Drivers\aswrdr2.sys [80376 2016-10-24] (Avast Software s.r.o.)
S0 aswRvrt; C:\Windows\System32\Drivers\aswRvrt.sys [74680 2016-10-24] ()
S1 aswSP; C:\Windows\System32\Drivers\aswSP.sys [441944 2016-10-24] (Avast Software s.r.o.)
S0 aswVmm; C:\Windows\System32\Drivers\aswVmm.sys [292840 2016-10-24] ()
S3 b06diag; C:\Windows\system32\drivers\bxdiaga.sys [90392 2014-09-11] (Broadcom Corporation)
S3 bccfg3; C:\Windows\system32\drivers\bccfg3.sys [22256 2014-09-11] (Dell Inc.)
S3 bcraid3; C:\Windows\system32\drivers\bcraid3.sys [536304 2014-09-11] (Dell Inc.)
S3 be2iscsi; C:\Windows\system32\drivers\be2iscsi.sys [191824 2014-09-11] (Emulex )
S3 bxfcoe; C:\Windows\system32\drivers\bxfcoe.sys [187600 2014-09-11] (Broadcom Corporation)
S3 bxois; C:\Windows\system32\drivers\bxois.sys [557264 2014-09-11] (Broadcom Corporation)
S0 Datascrn; C:\Windows\System32\drivers\datascrn.sys [79936 2009-07-13] (Microsoft Corporation)
S1 DfsDriver; C:\Windows\System32\drivers\dfs.sys [51776 2009-07-13] (Microsoft Corporation)
S0 DfsrRo; C:\Windows\System32\drivers\dfsrro.sys [66944 2010-11-20] (Microsoft Corporation)
S3 elxcna; C:\Windows\system32\drivers\elxcna.sys [706288 2014-09-11] (Emulex)
S3 elxfc; C:\Windows\system32\drivers\elxfc.sys [706288 2014-09-11] (Emulex)
S3 G200eR; C:\Windows\System32\DRIVERS\G200eRm.sys [248320 2014-09-11] (Matrox Graphics Inc.)
S3 ioatdma; C:\Windows\System32\Drivers\qd260x64.sys [35328 2009-06-10] (Intel Corporation)
S0 percsas2; C:\Windows\System32\drivers\percsas2.sys [53544 2012-04-14] (LSI Corporation)
S3 qlfcoe; C:\Windows\system32\drivers\qlfcoe.sys [1291048 2014-09-11] (QLogic Corporation)
S0 Quota; C:\Windows\System32\drivers\quota.sys [168016 2009-07-13] (Microsoft Corporation)
S0 sacdrv; C:\Windows\System32\DRIVERS\sacdrv.sys [96320 2009-07-13] (Microsoft Corporation)

========================== Drivers MD5 =======================

C:\Windows\system32\drivers\1394ohci.sys ==> MD5 is legit
C:\Windows\System32\drivers\ACPI.sys ==> MD5 is legit
C:\Windows\System32\DRIVERS\acpipmi.sys ==> MD5 is legit
C:\Windows\system32\drivers\adp94xx.sys ==> MD5 is legit
C:\Windows\system32\drivers\adpahci.sys ==> MD5 is legit
C:\Windows\system32\drivers\adpu320.sys ==> MD5 is legit
C:\Windows\system32\drivers\afd.sys 0DC2A9882540DEA4A55B08785E09D8FC
C:\Windows\system32\drivers\agp440.sys ==> MD5 is legit
C:\Windows\system32\drivers\aliide.sys ==> MD5 is legit
C:\Windows\system32\drivers\amdide.sys ==> MD5 is legit
C:\Windows\system32\drivers\amdk8.sys ==> MD5 is legit
C:\Windows\system32\drivers\amdppm.sys ==> MD5 is legit
C:\Windows\system32\drivers\amdsata.sys D4121AE6D0C0E7E13AA221AA57EF2D49
C:\Windows\system32\drivers\amdsbs.sys ==> MD5 is legit
C:\Windows\System32\drivers\amdxata.sys 540DAF1CEA6094886D72126FD7C33048
C:\Windows\system32\drivers\appid.sys C16B5B379A2A79702CC5FF923EAAE3FD
C:\Windows\system32\drivers\arc.sys ==> MD5 is legit
C:\Windows\system32\drivers\arcsas.sys ==> MD5 is legit
C:\Windows\system32\drivers\aswMonFlt.sys EEF272D9C3ACF67FC590FC9C09F66CEA
C:\Windows\System32\Drivers\aswrdr2.sys 28E579585FFBBCF952AFCDB902243CE0
C:\Windows\System32\Drivers\aswRvrt.sys D1FC06839A3BBA0A800B6D7C23D64540
C:\Windows\System32\Drivers\aswSP.sys 72C271BB46C1AD860094F099F3BF836C
C:\Windows\System32\Drivers\aswVmm.sys C134A327DA53CE10B90B777387EF0ED4
C:\Windows\System32\DRIVERS\asyncmac.sys ==> MD5 is legit
C:\Windows\System32\drivers\atapi.sys ==> MD5 is legit
C:\Windows\system32\drivers\bxvbda.sys 1EA46C76FED62553C6011A4F9FE5DEA0
C:\Windows\system32\drivers\bxdiaga.sys 963CE028F6FC3C70044F614B30847434
C:\Windows\System32\DRIVERS\b57nd60a.sys 24E582A892692B4996747F6AC84F7734
C:\Windows\system32\drivers\bccfg3.sys C629AAE5800BE995E5FAB52A2CDDB00D
C:\Windows\system32\drivers\bcraid3.sys F373A2FA2895DC363050AF1D4CC28463
C:\Windows\system32\drivers\be2iscsi.sys C24D6620A5229B671F4B3ECD9F8774FF
C:\Windows\System32\Drivers\Beep.sys ==> MD5 is legit
C:\Windows\System32\DRIVERS\blbdrive.sys ==> MD5 is legit
C:\Windows\System32\DRIVERS\bowser.sys ABA3984C822E4D3F889699912D85D6C5
C:\Windows\system32\drivers\BrFiltLo.sys ==> MD5 is legit
C:\Windows\system32\drivers\BrFiltUp.sys ==> MD5 is legit
C:\Windows\System32\Drivers\Brserid.sys ==> MD5 is legit
C:\Windows\System32\Drivers\BrSerWdm.sys ==> MD5 is legit
C:\Windows\System32\Drivers\BrUsbMdm.sys ==> MD5 is legit
C:\Windows\System32\Drivers\BrUsbSer.sys ==> MD5 is legit
C:\Windows\system32\drivers\bxfcoe.sys ECF70646D59E9861C9C4B851A29F140F
C:\Windows\system32\drivers\bxois.sys 85ED5935BD55EAF78349E5A08E7074F2
C:\Windows\System32\DRIVERS\cdfs.sys ==> MD5 is legit
C:\Windows\System32\DRIVERS\cdrom.sys ==> MD5 is legit
C:\Windows\System32\CLFS.sys 3963FEC1892368DD500E6ED1F5C286CE
C:\Windows\system32\drivers\CmBatt.sys ==> MD5 is legit
C:\Windows\system32\drivers\cmdide.sys ==> MD5 is legit
C:\Windows\System32\Drivers\cng.sys A98CED39AD91B445E2E442A9BD67E8B4
C:\Windows\System32\DRIVERS\compbatt.sys ==> MD5 is legit
C:\Windows\System32\DRIVERS\CompositeBus.sys ==> MD5 is legit
C:\Windows\system32\drivers\crcdisk.sys ==> MD5 is legit
C:\Windows\System32\drivers\datascrn.sys 05515E104AAE4FDB3DC66384FF745024
C:\Windows\System32\Drivers\dfsc.sys 9B38580063D281A99E68EF5813022A5F
C:\Windows\System32\drivers\dfs.sys FFFE7EF57BD8C93AB3076B340FAE0830
C:\Windows\System32\drivers\dfsrro.sys E66B02FC5250331BAAC1CAE2111D1288
C:\Windows\System32\drivers\discache.sys ==> MD5 is legit
C:\Windows\System32\drivers\disk.sys 616387BBD83372220B09DE95F4E67BBC
C:\Windows\system32\drivers\dmvsc.sys 5DB085A8A6600BE6401F2B24EECB5415
C:\Windows\System32\drivers\dxgkrnl.sys 5CEF80AE869336376F550ECAE91E424A
C:\Windows\system32\drivers\evbda.sys 345C634F1CDDFE1A0C90EB9C527F6039
C:\Windows\system32\drivers\elxcna.sys 9B8E47FBD1C0EB1FDFEA41E0A5C32BEC
C:\Windows\system32\drivers\elxfc.sys 45B1745BF46857DCFBAB0FBCC68A0AA4
C:\Windows\system32\drivers\elxstor.sys ==> MD5 is legit
C:\Windows\System32\DRIVERS\errdev.sys ==> MD5 is legit
C:\Windows\System32\Drivers\exfat.sys 7E45F8B117419ABA3BB26579F6E70324
C:\Windows\System32\Drivers\fastfat.sys 6EDFA237D25433C03F42FBFDB16BDD24
C:\Windows\system32\drivers\fdc.sys ==> MD5 is legit
C:\Windows\System32\drivers\fileinfo.sys ==> MD5 is legit
C:\Windows\System32\drivers\filetrace.sys ==> MD5 is legit
C:\Windows\system32\drivers\flpydisk.sys ==> MD5 is legit
C:\Windows\System32\drivers\fltmgr.sys ==> MD5 is legit
C:\Windows\System32\drivers\FsDepends.sys ==> MD5 is legit
C:\Windows\System32\Drivers\Fs_Rec.sys 6BD9295CC032DD3077C671FCCF579A7B
C:\Windows\System32\DRIVERS\G200eRm.sys 0E367DA9E0F19FC5A9128E2EFBEAD8D6
C:\Windows\system32\drivers\gagp30kx.sys ==> MD5 is legit
C:\Windows\system32\drivers\HDAudBus.sys ==> MD5 is legit
C:\Windows\System32\DRIVERS\HidBatt.sys ==> MD5 is legit
C:\Windows\System32\DRIVERS\hidusb.sys ==> MD5 is legit
C:\Windows\system32\drivers\HpSAMD.sys ==> MD5 is legit
C:\Windows\System32\drivers\HTTP.sys CF5C9BD985120781200D35FD445D0BD5
C:\Windows\System32\drivers\hwpolicy.sys ==> MD5 is legit
C:\Windows\system32\drivers\i8042prt.sys ==> MD5 is legit
C:\Windows\system32\drivers\iaStorV.sys AAAF44DB3BD0B9D1FB6969B23ECC8366
C:\Windows\system32\drivers\iirsp.sys ==> MD5 is legit
C:\Windows\system32\drivers\intelide.sys ==> MD5 is legit
C:\Windows\System32\DRIVERS\intelppm.sys ==> MD5 is legit
C:\Windows\System32\Drivers\qd260x64.sys FF0FB51A0ACC2E2D0D412138A05A0B59
C:\Windows\System32\DRIVERS\ipfltdrv.sys ==> MD5 is legit
C:\Windows\System32\DRIVERS\IPMIDrv.sys ==> MD5 is legit
C:\Windows\System32\drivers\ipnat.sys ==> MD5 is legit
C:\Windows\system32\drivers\isapnp.sys ==> MD5 is legit
C:\Windows\system32\drivers\msiscsi.sys 96BB922A0981BC7432C8CF52B5410FE6
C:\Windows\System32\DRIVERS\kbdclass.sys ==> MD5 is legit
C:\Windows\System32\DRIVERS\kbdhid.sys ==> MD5 is legit
C:\Windows\System32\Drivers\ksecdd.sys DFE85B031220F8E0271716BBB3C4C8FF
C:\Windows\System32\Drivers\ksecpkg.sys 70D7302DD70B979637179BFD8295C924
C:\Windows\system32\drivers\ksthunk.sys ==> MD5 is legit
C:\Windows\System32\DRIVERS\lltdio.sys ==> MD5 is legit
C:\Windows\system32\drivers\lsi_fc.sys ==> MD5 is legit
C:\Windows\system32\drivers\lsi_sas.sys ==> MD5 is legit
C:\Windows\system32\drivers\lsi_sas2.sys 78A80802A2D820D7EF1D3F58534BA68F
C:\Windows\system32\drivers\lsi_scsi.sys ==> MD5 is legit
C:\Windows\system32\drivers\luafv.sys 5416CEB2916BBE635288C4D1075B045E
C:\Windows\system32\drivers\megasas.sys ==> MD5 is legit
C:\Windows\system32\drivers\MegaSR.sys ==> MD5 is legit
C:\Windows\System32\drivers\modem.sys ==> MD5 is legit
C:\Windows\System32\DRIVERS\monitor.sys ==> MD5 is legit
C:\Windows\System32\DRIVERS\mouclass.sys ==> MD5 is legit
C:\Windows\System32\DRIVERS\mouhid.sys ==> MD5 is legit
C:\Windows\System32\drivers\mountmgr.sys 072D8646E23ECF8A3F5F0157017B4DB6
C:\Windows\system32\drivers\mpio.sys ==> MD5 is legit
C:\Windows\System32\drivers\mpsdrv.sys ==> MD5 is legit
C:\Windows\system32\drivers\mrxdav.sys 98DB1790F0A584E0A2528B92B052417F
C:\Windows\System32\DRIVERS\mrxsmb.sys 767C6DF04C5758B9F0790D400541B44F
C:\Windows\System32\DRIVERS\mrxsmb10.sys BD55F604FFABC911F8E5500186AE70E5
C:\Windows\System32\DRIVERS\mrxsmb20.sys 92EECFB046D4706A4B8D699A4069B6EC
C:\Windows\System32\drivers\msahci.sys ==> MD5 is legit
C:\Windows\system32\drivers\msdsm.sys ==> MD5 is legit
C:\Windows\System32\Drivers\Msfs.sys ==> MD5 is legit
C:\Windows\System32\drivers\mshidkmdf.sys ==> MD5 is legit
C:\Windows\System32\drivers\msisadrv.sys ==> MD5 is legit
C:\Windows\System32\Drivers\MsRPC.sys ==> MD5 is legit
C:\Windows\System32\DRIVERS\mssmbios.sys ==> MD5 is legit
C:\Windows\system32\drivers\MTConfig.sys ==> MD5 is legit
C:\Windows\System32\Drivers\mup.sys AA0C2BA3782E92BD85E2264BE418E67C
C:\Windows\System32\drivers\ndis.sys F7309F42555F8AAB7144A51A1F2585B0
C:\Windows\System32\DRIVERS\ndiscap.sys ==> MD5 is legit
C:\Windows\System32\DRIVERS\ndistapi.sys ==> MD5 is legit
C:\Windows\System32\DRIVERS\ndisuio.sys ==> MD5 is legit
C:\Windows\System32\DRIVERS\ndiswan.sys ==> MD5 is legit
C:\Windows\System32\Drivers\NDProxy.sys ==> MD5 is legit
C:\Windows\System32\DRIVERS\netbios.sys ==> MD5 is legit
C:\Windows\System32\DRIVERS\netbt.sys 734837208CAFD6E0959A7A0333C95C9D
C:\Windows\system32\drivers\nfrd960.sys ==> MD5 is legit
C:\Windows\System32\Drivers\Npfs.sys ==> MD5 is legit
C:\Windows\System32\drivers\nsiproxy.sys BE313E566EEA2A4B7F9AAC9782A567D4
C:\Windows\System32\Drivers\Ntfs.sys 1065D9AFE491706EB00AD3CBB76C9E54
C:\Windows\System32\Drivers\Null.sys ==> MD5 is legit
C:\Windows\system32\drivers\nvraid.sys 0A92CB65770442ED0DC44834632F66AD
C:\Windows\system32\drivers\nvstor.sys DAB0E87525C10052BF65F06152F37E4A
C:\Windows\system32\drivers\nv_agp.sys ==> MD5 is legit
C:\Windows\system32\drivers\ohci1394.sys ==> MD5 is legit
C:\Windows\system32\drivers\parport.sys ==> MD5 is legit
C:\Windows\System32\drivers\partmgr.sys E9766131EEADE40A27DC27D2D68FBA9C
C:\Windows\System32\drivers\pci.sys ==> MD5 is legit
C:\Windows\system32\drivers\pciide.sys ==> MD5 is legit
C:\Windows\system32\drivers\pcmcia.sys ==> MD5 is legit
C:\Windows\System32\drivers\pcw.sys ==> MD5 is legit
C:\Windows\System32\drivers\peauth.sys EA4D67448BE493D543F1730D6CD04694
C:\Windows\System32\drivers\percsas2.sys DF59ECF003ED16D650C095E9003C1A9D
C:\Windows\System32\DRIVERS\raspptp.sys ==> MD5 is legit
C:\Windows\system32\drivers\processr.sys ==> MD5 is legit
C:\Windows\System32\DRIVERS\pacer.sys ==> MD5 is legit
C:\Windows\system32\drivers\ql2300.sys 02C6C096B2CB2AC1935F4A01D4192114
C:\Windows\system32\drivers\ql40xx.sys 6187F44A6F86FC7D3FEF77CF579ECD33
C:\Windows\system32\drivers\qlfcoe.sys 5D2CACD30F8702A50CE08AC15229A614
C:\Windows\System32\drivers\quota.sys 6BA43DAA24BE55DB3741732550584D24
C:\Windows\System32\DRIVERS\rasacd.sys ==> MD5 is legit
C:\Windows\System32\DRIVERS\AgileVpn.sys ==> MD5 is legit
C:\Windows\System32\DRIVERS\rasl2tp.sys ==> MD5 is legit
C:\Windows\System32\DRIVERS\raspppoe.sys ==> MD5 is legit
C:\Windows\System32\DRIVERS\rassstp.sys ==> MD5 is legit
C:\Windows\System32\DRIVERS\rdbss.sys 71B6F78D6444CCE6F77BC42917A4E8F7
C:\Windows\System32\DRIVERS\rdpbus.sys ==> MD5 is legit
C:\Windows\System32\DRIVERS\RDPCDD.sys ==> MD5 is legit
C:\Windows\System32\drivers\rdpdr.sys ==> MD5 is legit
C:\Windows\System32\drivers\rdpencdd.sys ==> MD5 is legit
C:\Windows\System32\drivers\rdprefmp.sys ==> MD5 is legit
C:\Windows\System32\Drivers\RDPWD.sys FE571E088C2D83619D2D48D4E961BF41
C:\Windows\System32\DRIVERS\rspndr.sys ==> MD5 is legit
C:\Windows\system32\drivers\vms3cap.sys ==> MD5 is legit
C:\Windows\System32\DRIVERS\sacdrv.sys D65E5E5C59F70516E856F5350106CDAB
C:\Windows\system32\drivers\sbp2port.sys ==> MD5 is legit
C:\Windows\System32\DRIVERS\scfilter.sys ==> MD5 is legit
C:\Windows\System32\Drivers\secdrv.sys ==> MD5 is legit
C:\Windows\System32\DRIVERS\serenum.sys ==> MD5 is legit
C:\Windows\System32\DRIVERS\serial.sys ==> MD5 is legit
C:\Windows\system32\drivers\sermouse.sys ==> MD5 is legit
C:\Windows\system32\drivers\sffdisk.sys ==> MD5 is legit
C:\Windows\system32\drivers\sffp_mmc.sys ==> MD5 is legit
C:\Windows\system32\drivers\sffp_sd.sys ==> MD5 is legit
C:\Windows\system32\drivers\sfloppy.sys ==> MD5 is legit
C:\Windows\system32\drivers\SiSRaid2.sys ==> MD5 is legit
C:\Windows\system32\drivers\sisraid4.sys ==> MD5 is legit
C:\Windows\System32\DRIVERS\smb.sys ==> MD5 is legit
C:\Windows\System32\Drivers\spldr.sys ==> MD5 is legit
C:\Windows\System32\DRIVERS\srv.sys 72E6A150A8C8530B201832D1C801CDE6
C:\Windows\System32\DRIVERS\srv2.sys C4F67ABCC5033D334613F28F9E782809
C:\Windows\System32\DRIVERS\srvnet.sys C53CB62B0E57488AAE41FDA0FF8A0AB9
C:\Windows\system32\drivers\stexstor.sys ==> MD5 is legit
C:\Windows\System32\drivers\vmstorfl.sys ==> MD5 is legit
C:\Windows\system32\drivers\storvsc.sys ==> MD5 is legit
C:\Windows\system32\drivers\storvsp.sys 6B567ABA6A040F73219628C510FE7144
C:\Windows\System32\DRIVERS\swenum.sys ==> MD5 is legit
C:\Windows\System32\drivers\tcpip.sys 7FB36A0A036ADDACE0A868E4A43C1C27
C:\Windows\System32\DRIVERS\tcpip.sys 7FB36A0A036ADDACE0A868E4A43C1C27
C:\Windows\System32\drivers\tcpipreg.sys 7FE5586314EE7D6AA8483264A089E5AF
C:\Windows\System32\drivers\tdpipe.sys ==> MD5 is legit
C:\Windows\System32\drivers\tdtcp.sys 51C5ECEB1CDEE2468A1748BE550CFBC8
C:\Windows\System32\DRIVERS\tdx.sys 4DD986720F7CB7A8A5D1226793097B9A
C:\Windows\System32\DRIVERS\termdd.sys ==> MD5 is legit
C:\Windows\System32\DRIVERS\tssecsrv.sys 2CF58216424757ED29605B4F18EC443C
C:\Windows\System32\drivers\tsusbflt.sys E9981ECE8D894CEF7038FD1D040EB426
C:\Windows\system32\drivers\TsUsbGD.sys 9CC2CCAE8A84820EAECB886D477CBCB8
C:\Windows\System32\DRIVERS\tunnel.sys ==> MD5 is legit
C:\Windows\system32\drivers\uagp35.sys ==> MD5 is legit
C:\Windows\System32\DRIVERS\udfs.sys ==> MD5 is legit
C:\Windows\system32\drivers\uliagpkx.sys ==> MD5 is legit
C:\Windows\System32\DRIVERS\umbus.sys ==> MD5 is legit
C:\Windows\system32\drivers\umpass.sys ==> MD5 is legit
C:\Windows\system32\drivers\usbccgp.sys 9E68E917FB4B5C983438969643F53BEF
C:\Windows\system32\drivers\usbehci.sys 3F9D3902CE931E2A28DD8452AE915B67
C:\Windows\system32\drivers\usbhub.sys 86B65EEBC03B936DE8B26E5A18D98FA2
C:\Windows\system32\drivers\usbohci.sys 099C2931C6F73EB1B9E13C560F61B50D
C:\Windows\system32\drivers\usbprint.sys ==> MD5 is legit
C:\Windows\System32\DRIVERS\USBSTOR.SYS D029DD09E22EB24318A8FC3D8138BA43
C:\Windows\system32\drivers\usbuhci.sys 5D7651347C7D702F4A5DE53603DC024F
C:\Windows\System32\drivers\vdrvroot.sys ==> MD5 is legit
C:\Windows\System32\DRIVERS\vgapnp.sys ==> MD5 is legit
C:\Windows\System32\drivers\vga.sys ==> MD5 is legit
C:\Windows\system32\drivers\vhdmp.sys ==> MD5 is legit
C:\Windows\system32\drivers\viaide.sys ==> MD5 is legit
C:\Windows\system32\drivers\Vid.sys 1720D283BDB1EAA7F21976586FF52B95
C:\Windows\system32\drivers\vmbus.sys ==> MD5 is legit
C:\Windows\system32\drivers\VMBusHID.sys ==> MD5 is legit
C:\Windows\System32\drivers\volmgr.sys ==> MD5 is legit
C:\Windows\System32\drivers\volmgrx.sys 85C5468BC395819AE2A0C747334BA14C
C:\Windows\System32\drivers\volsnap.sys ==> MD5 is legit
C:\Windows\system32\drivers\vsmraid.sys ==> MD5 is legit
C:\Windows\system32\drivers\wacompen.sys ==> MD5 is legit
C:\Windows\System32\DRIVERS\wanarp.sys ==> MD5 is legit
C:\Windows\System32\DRIVERS\wanarp.sys ==> MD5 is legit
C:\Windows\system32\drivers\wd.sys ==> MD5 is legit
C:\Windows\System32\drivers\Wdf01000.sys E2C933EDBC389386EBE6D2BA953F43D8
C:\Windows\System32\DRIVERS\wfplwf.sys ==> MD5 is legit
C:\Windows\System32\drivers\wimmount.sys ==> MD5 is legit
C:\Windows\SysWOW64\drivers\wimmount.sys ==> MD5 is legit
C:\Windows\System32\DRIVERS\wmiacpi.sys ==> MD5 is legit
C:\Windows\system32\drivers\ws2ifsl.sys ==> MD5 is legit
C:\Windows\System32\drivers\WudfPf.sys AB886378EEB55C6C75B4F2D14B6C869F

==================== NetSvcs (Whitelisted) ===================

(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)

NETSVC: sacsvr -> C:\Windows\system32\sacsvr.dll (Microsoft Corporation)

==================== One Month Created files and folders ========

(If an entry is included in the fixlist, the file/folder will be moved.)

2017-11-16 14:51 - 2017-11-16 14:51 - 000023145 _____ C:\FRST.txt
2017-11-16 14:50 - 2017-11-16 14:51 - 000000000 ____D C:\FRST
2017-11-16 14:00 - 2017-11-16 14:00 - 000000000 ____D C:\Windows\Standalone System Sweeper
2017-11-16 11:28 - 2017-11-16 11:44 - 000000000 _____ C:\Recovery.txt
2017-11-15 17:20 - 2017-11-16 12:18 - 000000000 ____D C:\symbols
2017-11-15 14:01 - 2017-11-15 14:03 - 000000000 ____D C:\Windows\System32\config\BACKUP 2017-11-16
2017-11-14 12:26 - 2017-10-17 23:31 - 000395976 _____ (Microsoft Corporation) C:\Windows\System32\iedkcs32.dll
2017-11-14 12:26 - 2017-10-17 22:45 - 000347336 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iedkcs32.dll
2017-11-14 12:26 - 2017-10-17 18:06 - 000344064 _____ (Microsoft Corporation) C:\Windows\System32\Drivers\usbhub.sys
2017-11-14 12:26 - 2017-10-17 18:06 - 000327168 _____ (Microsoft Corporation) C:\Windows\System32\Drivers\usbport.sys
2017-11-14 12:26 - 2017-10-17 18:06 - 000099840 _____ (Microsoft Corporation) C:\Windows\System32\Drivers\usbccgp.sys
2017-11-14 12:26 - 2017-10-16 15:07 - 001680616 _____ (Microsoft Corporation) C:\Windows\System32\Drivers\ntfs.sys
2017-11-14 12:26 - 2017-10-16 14:34 - 003222528 _____ (Microsoft Corporation) C:\Windows\System32\win32k.sys
2017-11-14 12:26 - 2017-10-16 13:55 - 000339968 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msexcl40.dll
2017-11-14 12:26 - 2017-10-14 00:38 - 025731584 _____ (Microsoft Corporation) C:\Windows\System32\mshtml.dll
2017-11-14 12:26 - 2017-10-14 00:13 - 002903552 _____ (Microsoft Corporation) C:\Windows\System32\iertutil.dll
2017-11-14 12:26 - 2017-10-14 00:11 - 000576512 _____ (Microsoft Corporation) C:\Windows\System32\vbscript.dll
2017-11-14 12:26 - 2017-10-14 00:11 - 000417792 _____ (Microsoft Corporation) C:\Windows\System32\html.iec
2017-11-14 12:26 - 2017-10-14 00:09 - 005979648 _____ (Microsoft Corporation) C:\Windows\System32\jscript9.dll
2017-11-14 12:26 - 2017-10-14 00:02 - 000615936 _____ (Microsoft Corporation) C:\Windows\System32\ieui.dll
2017-11-14 12:26 - 2017-10-14 00:01 - 000816640 _____ (Microsoft Corporation) C:\Windows\System32\jscript.dll
2017-11-14 12:26 - 2017-10-13 23:55 - 000968704 _____ (Microsoft Corporation) C:\Windows\System32\MsSpellCheckingFacility.exe
2017-11-14 12:26 - 2017-10-13 23:31 - 000262144 _____ (Microsoft Corporation) C:\Windows\System32\webcheck.dll
2017-11-14 12:26 - 2017-10-13 23:30 - 015266816 _____ (Microsoft Corporation) C:\Windows\System32\ieframe.dll
2017-11-14 12:26 - 2017-10-13 23:30 - 000726528 _____ (Microsoft Corporation) C:\Windows\System32\ie4uinit.exe
2017-11-14 12:26 - 2017-10-13 23:29 - 000807936 _____ (Microsoft Corporation) C:\Windows\System32\msfeeds.dll
2017-11-14 12:26 - 2017-10-13 23:28 - 001359360 _____ (Microsoft Corporation) C:\Windows\System32\mshtmlmedia.dll
2017-11-14 12:26 - 2017-10-13 23:27 - 002134528 _____ (Microsoft Corporation) C:\Windows\System32\inetcpl.cpl
2017-11-14 12:26 - 2017-10-13 23:21 - 003241472 _____ (Microsoft Corporation) C:\Windows\System32\wininet.dll
2017-11-14 12:26 - 2017-10-13 23:14 - 020269056 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.dll
2017-11-14 12:26 - 2017-10-13 23:09 - 001544704 _____ (Microsoft Corporation) C:\Windows\System32\urlmon.dll
2017-11-14 12:26 - 2017-10-13 22:58 - 000800768 _____ (Microsoft Corporation) C:\Windows\System32\ieapfltr.dll
2017-11-14 12:26 - 2017-10-13 22:53 - 000499200 _____ (Microsoft Corporation) C:\Windows\SysWOW64\vbscript.dll
2017-11-14 12:26 - 2017-10-13 22:50 - 002293760 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iertutil.dll
2017-11-14 12:26 - 2017-10-13 22:45 - 000662016 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript.dll
2017-11-14 12:26 - 2017-10-13 22:33 - 004542464 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript9.dll
2017-11-14 12:26 - 2017-10-13 22:28 - 013680128 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieframe.dll
2017-11-14 12:26 - 2017-10-13 22:25 - 000230400 _____ (Microsoft Corporation) C:\Windows\SysWOW64\webcheck.dll
2017-11-14 12:26 - 2017-10-13 22:24 - 000694272 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msfeeds.dll
2017-11-14 12:26 - 2017-10-13 22:23 - 002058752 _____ (Microsoft Corporation) C:\Windows\SysWOW64\inetcpl.cpl
2017-11-14 12:26 - 2017-10-13 22:23 - 001155072 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtmlmedia.dll
2017-11-14 12:26 - 2017-10-13 22:10 - 002767872 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wininet.dll
2017-11-14 12:26 - 2017-10-13 22:07 - 001314304 _____ (Microsoft Corporation) C:\Windows\SysWOW64\urlmon.dll
2017-11-14 12:26 - 2017-10-11 16:58 - 000382696 _____ (Adobe Systems Incorporated) C:\Windows\System32\atmfd.dll
2017-11-14 12:26 - 2017-10-11 16:55 - 002058240 _____ (Microsoft Corporation) C:\Windows\System32\Query.dll
2017-11-14 12:26 - 2017-10-11 16:55 - 000151552 _____ (Microsoft Corporation) C:\Windows\System32\t2embed.dll
2017-11-14 12:26 - 2017-10-11 16:40 - 000308456 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\atmfd.dll
2017-11-14 12:26 - 2017-10-11 16:37 - 001363968 _____ (Microsoft Corporation) C:\Windows\SysWOW64\Query.dll
2017-11-14 12:26 - 2017-10-11 16:37 - 000111104 _____ (Microsoft Corporation) C:\Windows\SysWOW64\t2embed.dll
2017-11-14 12:26 - 2017-10-11 16:37 - 000070656 _____ (Microsoft Corporation) C:\Windows\SysWOW64\fontsub.dll
2017-11-14 12:26 - 2017-10-11 16:20 - 000113152 _____ (Microsoft Corporation) C:\Windows\System32\Drivers\luafv.sys
2017-11-14 12:26 - 2017-09-07 05:05 - 000995272 _____ (Microsoft Corporation) C:\Windows\System32\ucrtbase.dll
2017-11-14 12:26 - 2017-09-07 05:05 - 000922432 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ucrtbase.dll
2017-11-14 12:26 - 2017-09-07 05:05 - 000066400 _____ (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-crt-private-l1-1-0.dll
2017-11-14 12:26 - 2017-09-07 05:05 - 000063840 _____ (Microsoft Corporation) C:\Windows\System32\api-ms-win-crt-private-l1-1-0.dll
2017-11-14 12:26 - 2017-09-07 05:05 - 000022368 _____ (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-crt-math-l1-1-0.dll
2017-11-14 12:26 - 2017-09-07 05:05 - 000020832 _____ (Microsoft Corporation) C:\Windows\System32\api-ms-win-crt-math-l1-1-0.dll
2017-11-14 12:26 - 2017-09-07 05:05 - 000019808 _____ (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-crt-multibyte-l1-1-0.dll
2017-11-14 12:26 - 2017-09-07 05:05 - 000019808 _____ (Microsoft Corporation) C:\Windows\System32\api-ms-win-crt-multibyte-l1-1-0.dll
2017-11-14 12:26 - 2017-09-07 05:05 - 000017760 _____ (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-crt-string-l1-1-0.dll
2017-11-14 12:26 - 2017-09-07 05:05 - 000017760 _____ (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-crt-stdio-l1-1-0.dll
2017-11-14 12:26 - 2017-09-07 05:05 - 000017760 _____ (Microsoft Corporation) C:\Windows\System32\api-ms-win-crt-string-l1-1-0.dll
2017-11-14 12:26 - 2017-09-07 05:05 - 000017760 _____ (Microsoft Corporation) C:\Windows\System32\api-ms-win-crt-stdio-l1-1-0.dll
2017-11-14 12:26 - 2017-09-07 05:05 - 000016224 _____ (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-crt-runtime-l1-1-0.dll
2017-11-14 12:26 - 2017-09-07 05:05 - 000016224 _____ (Microsoft Corporation) C:\Windows\System32\api-ms-win-crt-runtime-l1-1-0.dll
2017-11-14 12:26 - 2017-09-07 05:05 - 000015712 _____ (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-crt-convert-l1-1-0.dll
2017-11-14 12:26 - 2017-09-07 05:05 - 000015712 _____ (Microsoft Corporation) C:\Windows\System32\api-ms-win-crt-convert-l1-1-0.dll
2017-11-14 12:26 - 2017-09-07 05:05 - 000014176 _____ (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-crt-time-l1-1-0.dll
2017-11-14 12:26 - 2017-09-07 05:05 - 000014176 _____ (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-localization-l1-2-0.dll
2017-11-14 12:26 - 2017-09-07 05:05 - 000014176 _____ (Microsoft Corporation) C:\Windows\System32\api-ms-win-crt-time-l1-1-0.dll
2017-11-14 12:26 - 2017-09-07 05:05 - 000014176 _____ (Microsoft Corporation) C:\Windows\System32\api-ms-win-core-localization-l1-2-0.dll
2017-11-14 12:26 - 2017-09-07 05:05 - 000013664 _____ (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-crt-filesystem-l1-1-0.dll
2017-11-14 12:26 - 2017-09-07 05:05 - 000013664 _____ (Microsoft Corporation) C:\Windows\System32\api-ms-win-crt-filesystem-l1-1-0.dll
2017-11-14 12:26 - 2017-09-07 05:05 - 000012640 _____ (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-crt-process-l1-1-0.dll
2017-11-14 12:26 - 2017-09-07 05:05 - 000012640 _____ (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-crt-heap-l1-1-0.dll
2017-11-14 12:26 - 2017-09-07 05:05 - 000012640 _____ (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-crt-conio-l1-1-0.dll
2017-11-14 12:26 - 2017-09-07 05:05 - 000012640 _____ (Microsoft Corporation) C:\Windows\System32\api-ms-win-crt-process-l1-1-0.dll
2017-11-14 12:26 - 2017-09-07 05:05 - 000012640 _____ (Microsoft Corporation) C:\Windows\System32\api-ms-win-crt-heap-l1-1-0.dll
2017-11-14 12:26 - 2017-09-07 05:05 - 000012640 _____ (Microsoft Corporation) C:\Windows\System32\api-ms-win-crt-conio-l1-1-0.dll
2017-11-14 12:26 - 2017-09-07 05:05 - 000012128 _____ (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-crt-utility-l1-1-0.dll
2017-11-14 12:26 - 2017-09-07 05:05 - 000012128 _____ (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-crt-locale-l1-1-0.dll
2017-11-14 12:26 - 2017-09-07 05:05 - 000012128 _____ (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-crt-environment-l1-1-0.dll
2017-11-14 12:26 - 2017-09-07 05:05 - 000012128 _____ (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-synch-l1-2-0.dll
2017-11-14 12:26 - 2017-09-07 05:05 - 000012128 _____ (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-processthreads-l1-1-1.dll
2017-11-14 12:26 - 2017-09-07 05:05 - 000012128 _____ (Microsoft Corporation) C:\Windows\System32\api-ms-win-crt-utility-l1-1-0.dll
2017-11-14 12:26 - 2017-09-07 05:05 - 000012128 _____ (Microsoft Corporation) C:\Windows\System32\api-ms-win-crt-locale-l1-1-0.dll
2017-11-14 12:26 - 2017-09-07 05:05 - 000012128 _____ (Microsoft Corporation) C:\Windows\System32\api-ms-win-crt-environment-l1-1-0.dll
2017-11-14 12:26 - 2017-09-07 05:05 - 000012128 _____ (Microsoft Corporation) C:\Windows\System32\api-ms-win-core-synch-l1-2-0.dll
2017-11-14 12:26 - 2017-09-07 05:05 - 000012128 _____ (Microsoft Corporation) C:\Windows\System32\api-ms-win-core-processthreads-l1-1-1.dll
2017-11-14 12:26 - 2017-09-07 05:05 - 000011616 _____ (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-xstate-l2-1-0.dll
2017-11-14 12:26 - 2017-09-07 05:05 - 000011616 _____ (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-timezone-l1-1-0.dll
2017-11-14 12:26 - 2017-09-07 05:05 - 000011616 _____ (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-file-l2-1-0.dll
2017-11-14 12:26 - 2017-09-07 05:05 - 000011616 _____ (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-file-l1-2-0.dll
2017-11-14 12:26 - 2017-09-07 05:05 - 000011616 _____ (Microsoft Corporation) C:\Windows\System32\api-ms-win-core-xstate-l2-1-0.dll
2017-11-14 12:26 - 2017-09-07 05:05 - 000011616 _____ (Microsoft Corporation) C:\Windows\System32\api-ms-win-core-timezone-l1-1-0.dll
2017-11-14 12:26 - 2017-09-07 05:05 - 000011616 _____ (Microsoft Corporation) C:\Windows\System32\api-ms-win-core-file-l2-1-0.dll
2017-11-14 12:26 - 2017-09-07 05:05 - 000011616 _____ (Microsoft Corporation) C:\Windows\System32\api-ms-win-core-file-l1-2-0.dll
2017-11-14 12:25 - 2017-10-17 18:06 - 000056320 _____ (Microsoft Corporation) C:\Windows\System32\Drivers\usbehci.sys
2017-11-14 12:25 - 2017-10-17 18:06 - 000030720 _____ (Microsoft Corporation) C:\Windows\System32\Drivers\usbuhci.sys
2017-11-14 12:25 - 2017-10-17 18:06 - 000025600 _____ (Microsoft Corporation) C:\Windows\System32\Drivers\usbohci.sys
2017-11-14 12:25 - 2017-10-17 18:06 - 000007808 _____ (Microsoft Corporation) C:\Windows\System32\Drivers\usbd.sys
2017-11-14 12:25 - 2017-10-14 00:23 - 002724864 _____ (Microsoft Corporation) C:\Windows\System32\mshtml.tlb
2017-11-14 12:25 - 2017-10-14 00:23 - 000004096 _____ (Microsoft Corporation) C:\Windows\System32\ieetwcollectorres.dll
2017-11-14 12:25 - 2017-10-14 00:12 - 000066560 _____ (Microsoft Corporation) C:\Windows\System32\iesetup.dll
2017-11-14 12:25 - 2017-10-14 00:11 - 000088064 _____ (Microsoft Corporation) C:\Windows\System32\MshtmlDac.dll
2017-11-14 12:25 - 2017-10-14 00:11 - 000048640 _____ (Microsoft Corporation) C:\Windows\System32\ieetwproxystub.dll
2017-11-14 12:25 - 2017-10-14 00:05 - 000054784 _____ (Microsoft Corporation) C:\Windows\System32\jsproxy.dll
2017-11-14 12:25 - 2017-10-14 00:04 - 000034304 _____ (Microsoft Corporation) C:\Windows\System32\iernonce.dll
2017-11-14 12:25 - 2017-10-14 00:01 - 000144384 _____ (Microsoft Corporation) C:\Windows\System32\ieUnatt.exe
2017-11-14 12:25 - 2017-10-14 00:01 - 000116224 _____ (Microsoft Corporation) C:\Windows\System32\ieetwcollector.exe
2017-11-14 12:25 - 2017-10-14 00:00 - 000814080 _____ (Microsoft Corporation) C:\Windows\System32\jscript9diag.dll
2017-11-14 12:25 - 2017-10-13 23:53 - 000489984 _____ (Microsoft Corporation) C:\Windows\System32\dxtmsft.dll
2017-11-14 12:25 - 2017-10-13 23:47 - 000087552 _____ (Microsoft Corporation) C:\Windows\System32\tdc.ocx
2017-11-14 12:25 - 2017-10-13 23:47 - 000077824 _____ (Microsoft Corporation) C:\Windows\System32\JavaScriptCollectionAgent.dll
2017-11-14 12:25 - 2017-10-13 23:46 - 000107520 _____ (Microsoft Corporation) C:\Windows\System32\inseng.dll
2017-11-14 12:25 - 2017-10-13 23:43 - 000199680 _____ (Microsoft Corporation) C:\Windows\System32\msrating.dll
2017-11-14 12:25 - 2017-10-13 23:43 - 000092160 _____ (Microsoft Corporation) C:\Windows\System32\mshtmled.dll
2017-11-14 12:25 - 2017-10-13 23:41 - 000315392 _____ (Microsoft Corporation) C:\Windows\System32\dxtrans.dll
2017-11-14 12:25 - 2017-10-13 23:40 - 000152064 _____ (Microsoft Corporation) C:\Windows\System32\occache.dll
2017-11-14 12:25 - 2017-10-13 23:03 - 002724864 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.tlb
2017-11-14 12:25 - 2017-10-13 22:53 - 000062464 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iesetup.dll
2017-11-14 12:25 - 2017-10-13 22:52 - 000341504 _____ (Microsoft Corporation) C:\Windows\SysWOW64\html.iec
2017-11-14 12:25 - 2017-10-13 22:52 - 000047616 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieetwproxystub.dll
2017-11-14 12:25 - 2017-10-13 22:51 - 000064000 _____ (Microsoft Corporation) C:\Windows\SysWOW64\MshtmlDac.dll
2017-11-14 12:25 - 2017-10-13 22:47 - 000047104 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jsproxy.dll
2017-11-14 12:25 - 2017-10-13 22:47 - 000030720 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iernonce.dll
2017-11-14 12:25 - 2017-10-13 22:46 - 000476160 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieui.dll
2017-11-14 12:25 - 2017-10-13 22:45 - 000620032 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript9diag.dll
2017-11-14 12:25 - 2017-10-13 22:45 - 000115712 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieUnatt.exe
2017-11-14 12:25 - 2017-10-13 22:38 - 000416256 _____ (Microsoft Corporation) C:\Windows\SysWOW64\dxtmsft.dll
2017-11-14 12:25 - 2017-10-13 22:35 - 000073216 _____ (Microsoft Corporation) C:\Windows\SysWOW64\tdc.ocx
2017-11-14 12:25 - 2017-10-13 22:35 - 000060416 _____ (Microsoft Corporation) C:\Windows\SysWOW64\JavaScriptCollectionAgent.dll
2017-11-14 12:25 - 2017-10-13 22:34 - 000091136 _____ (Microsoft Corporation) C:\Windows\SysWOW64\inseng.dll
2017-11-14 12:25 - 2017-10-13 22:33 - 000168960 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msrating.dll
2017-11-14 12:25 - 2017-10-13 22:32 - 000076288 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtmled.dll
2017-11-14 12:25 - 2017-10-13 22:31 - 000279040 _____ (Microsoft Corporation) C:\Windows\SysWOW64\dxtrans.dll
2017-11-14 12:25 - 2017-10-13 22:30 - 000130048 _____ (Microsoft Corporation) C:\Windows\SysWOW64\occache.dll
2017-11-14 12:25 - 2017-10-13 22:04 - 000710144 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieapfltr.dll
2017-11-14 12:25 - 2017-10-11 16:55 - 000100864 _____ (Microsoft Corporation) C:\Windows\System32\fontsub.dll
2017-11-14 12:25 - 2017-10-11 16:55 - 000046080 _____ (Adobe Systems) C:\Windows\System32\atmlib.dll
2017-11-14 12:25 - 2017-10-11 16:55 - 000041472 _____ (Microsoft Corporation) C:\Windows\System32\lpk.dll
2017-11-14 12:25 - 2017-10-11 16:55 - 000014336 _____ (Microsoft Corporation) C:\Windows\System32\dciman32.dll
2017-11-14 12:25 - 2017-10-11 16:37 - 000025600 _____ (Microsoft Corporation) C:\Windows\SysWOW64\lpk.dll
2017-11-14 12:25 - 2017-10-11 16:37 - 000010240 _____ (Microsoft Corporation) C:\Windows\SysWOW64\dciman32.dll
2017-11-14 12:25 - 2017-10-11 16:16 - 000034304 _____ (Adobe Systems) C:\Windows\SysWOW64\atmlib.dll
2017-10-27 02:36 - 2017-10-27 02:35 - 000125408 _____ (LogMeIn, Inc.) C:\Windows\System32\g2ax_credential_provider64_1544.dll
2017-10-27 02:35 - 2017-10-27 02:35 - 000000000 ____D C:\Users\Administrator.WIN-P1B3IS4RA0J\AppData\Local\LogMeInInc
2017-10-18 01:07 - 2017-10-27 02:35 - 000000000 ____D C:\Program Files (x86)\GoToAssist Remote Support Customer

==================== One Month Modified files and folders ========

(If an entry is included in the fixlist, the file/folder will be moved.)

2017-11-15 01:26 - 2014-09-12 05:28 - 000000000 ____D C:\Windows\System32\wins
2017-11-15 01:26 - 2014-09-12 05:10 - 000000000 ____D C:\Windows\System32\dhcp
2017-11-15 01:26 - 2014-09-11 19:39 - 000000000 ____D C:\Windows\NTDS
2017-11-15 01:26 - 2009-07-13 20:49 - 000021296 ____H C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0
2017-11-15 01:26 - 2009-07-13 20:49 - 000021296 ____H C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0
2017-11-15 01:07 - 2014-09-11 21:14 - 000952634 _____ C:\Windows\SysWOW64\PerfStringBackup.INI
2017-11-15 01:07 - 2009-07-13 21:10 - 000952634 _____ C:\Windows\System32\PerfStringBackup.INI
2017-11-15 01:07 - 2009-07-13 19:20 - 000000000 ____D C:\Windows\inf
2017-11-15 01:05 - 2014-09-11 21:03 - 000000000 ____D C:\Windows\System32\MRT
2017-11-15 01:02 - 2017-10-11 00:06 - 127017032 ____C (Microsoft Corporation) C:\Windows\System32\MRT-KB890830.exe
2017-11-15 01:01 - 2014-09-11 21:03 - 127017032 ____C (Microsoft Corporation) C:\Windows\System32\MRT.exe
2017-11-14 16:45 - 2017-06-16 05:16 - 000000494 _____ C:\Windows\Tasks\ShadowCopyVolume{acf86161-3a27-11e4-bc9c-806e6f6e6963}.job
2017-11-14 10:00 - 2014-12-05 13:28 - 000000494 _____ C:\Windows\Tasks\ShadowCopyVolume{c74b2dcf-7fd1-4b16-ba03-328085ecbcd0}.job
2017-10-27 02:36 - 2015-02-27 01:33 - 000001410 _____ C:\Users\Administrator.WIN-P1B3IS4RA0J\Desktop\GoToAssist Customer.lnk

Some files in TEMP:
====================
2014-09-12 11:55 - 2014-03-04 19:55 - 000081920 _____ (PracticeWorks, Inc.) C:\Users\Administrator.WIN-P1B3IS4RA0J\AppData\Local\Temp\PWUtil.exe
2014-09-12 11:55 - 2014-03-04 19:55 - 000077312 _____ (Microsoft Corporation) C:\Users\Administrator.WIN-P1B3IS4RA0J\AppData\Local\Temp\sdbinst.exe

==================== Known DLLs (Whitelisted) =========================

==================== Bamital & volsnap ======================

(There is no automatic fix for files that do not pass verification.)

C:\Windows\System32\winlogon.exe => MD5 is legit
C:\Windows\System32\wininit.exe => MD5 is legit
C:\Windows\explorer.exe => MD5 is legit
C:\Windows\SysWOW64\explorer.exe => MD5 is legit
C:\Windows\System32\svchost.exe => MD5 is legit
C:\Windows\SysWOW64\svchost.exe => MD5 is legit
C:\Windows\System32\services.exe => MD5 is legit
C:\Windows\System32\User32.dll => MD5 is legit
C:\Windows\SysWOW64\User32.dll => MD5 is legit
C:\Windows\System32\userinit.exe => MD5 is legit
C:\Windows\SysWOW64\userinit.exe => MD5 is legit
C:\Windows\System32\rpcss.dll => MD5 is legit
C:\Windows\System32\dnsapi.dll => MD5 is legit
C:\Windows\SysWOW64\dnsapi.dll => MD5 is legit
C:\Windows\System32\Drivers\volsnap.sys => MD5 is legit

==================== Association (Whitelisted) =============

==================== Restore Points =========================

Restore point date: 2017-10-26 15:45
Restore point date: 2017-10-27 09:00
Restore point date: 2017-10-27 15:45
Restore point date: 2017-10-30 09:00
Restore point date: 2017-10-30 15:45
Restore point date: 2017-10-31 09:00
Restore point date: 2017-10-31 15:45
Restore point date: 2017-11-01 09:00
Restore point date: 2017-11-01 15:45
Restore point date: 2017-11-02 09:00
Restore point date: 2017-11-02 15:45
Restore point date: 2017-11-03 09:00
Restore point date: 2017-11-03 15:45
Restore point date: 2017-11-06 10:00
Restore point date: 2017-11-06 16:45
Restore point date: 2017-11-07 10:00
Restore point date: 2017-11-07 16:45
Restore point date: 2017-11-08 10:00
Restore point date: 2017-11-08 16:45
Restore point date: 2017-11-09 10:00
Restore point date: 2017-11-09 16:45
Restore point date: 2017-11-10 10:00
Restore point date: 2017-11-10 16:45
Restore point date: 2017-11-13 10:00
Restore point date: 2017-11-13 16:45
Restore point date: 2017-11-14 10:00
Restore point date: 2017-11-14 16:45
Restore point date: 2017-11-14 16:45

==================== Memory info ===========================

Percentage of memory in use: 7%
Total physical RAM: 16338.54 MB
Available physical RAM: 15069.99 MB
Total Virtual: 16336.74 MB
Available Virtual: 15049.22 MB

==================== Drives ================================

Drive c: () (Fixed) (Total:465.15 GB) (Free:351.15 GB) NTFS
Drive d: (GRMSXFREO_EN_DVD) (CDROM) (Total:2.95 GB) (Free:0 GB) UDF
Drive e: (DATA) (Fixed) (Total:3724.87 GB) (Free:1471.08 GB) NTFS
Drive g: (System Reserved) (Fixed) (Total:0.1 GB) (Free:0.07 GB) NTFS ==>[system with boot components (obtained from drive)]
Drive x: (Boot) (Fixed) (Total:0.03 GB) (Free:0.03 GB) NTFS
Drive y: (PNY 16) (Removable) (Total:14.93 GB) (Free:12.26 GB) NTFS

==================== MBR & Partition Table ==================

========================================================
Disk: 0 (MBR Code: Windows XP) (Size: 14.9 GB) (Disk ID: 3C94AB15)
Partition 1: (Not Active) - (Size=14.9 GB) - (Type=07 NTFS)

========================================================
Disk: 1 (Size: 3725 GB) (Disk ID: 2463374F)

Partition: GPT.

========================================================
Disk: 2 (MBR Code: Windows 7 or 8) (Size: 465.3 GB) (Disk ID: 2479B4EF)
Partition 1: (Active) - (Size=100 MB) - (Type=07 NTFS)
Partition 2: (Not Active) - (Size=465.2 GB) - (Type=07 NTFS)

LastRegBack: 2017-11-08 22:40

==================== End of FRST.txt ============================

#############################################
SEARCH.txt 
#############################################

Farbar Recovery Scan Tool (x64) Version: 16-11-2017
Ran by SYSTEM (16-11-2017 14:53:25)
Running from c:\
Boot Mode: Recovery

================== Search Files: "services.exe;winsrv.*" =============

C:\Windows\winsxs\wow64_microsoft-windows-winsrv.resources_31bf3856ad364e35_6.1.7600.16385_en-us_a412dbba527dc14e\winsrv.dll.mui
[2010-11-20 23:59][2010-11-20 23:59] 000008192 _____ (Microsoft Corporation) 9848765E88322400BDC710A76ADEA841

C:\Windows\winsxs\amd64_microsoft-windows-winsrv_31bf3856ad364e35_6.1.7601.23915_none_152f1148cc11a3c4\winsrv.dll
[2017-10-10 19:50][2017-09-13 07:28] 000215552 _____ (Microsoft Corporation) 66A8A9412337B08E1735204B8ADEE58C

C:\Windows\winsxs\amd64_microsoft-windows-winsrv_31bf3856ad364e35_6.1.7601.23889_none_14e76116cc46cf90\winsrv.dll
[2017-09-12 16:05][2017-08-10 22:35] 000215552 _____ (Microsoft Corporation) 100788FE26FF7A1E530DD2A7ABE855F1

C:\Windows\winsxs\amd64_microsoft-windows-winsrv_31bf3856ad364e35_6.1.7601.23864_none_14f7ff7ccc3b18fb\winsrv.dll
[2017-08-09 03:22][2017-07-07 07:29] 000215552 _____ (Microsoft Corporation) 8925F0181AB6A43A4AF6420211FDEC47

C:\Windows\winsxs\amd64_microsoft-windows-winsrv_31bf3856ad364e35_6.1.7601.23807_none_153bdfe2cc07bd5a\winsrv.dll
[2017-06-13 13:53][2017-05-12 10:22] 000215552 _____ (Microsoft Corporation) 825C29BE302D5A4697EF19A2FFC53486

C:\Windows\winsxs\amd64_microsoft-windows-winsrv_31bf3856ad364e35_6.1.7601.23796_none_14d98e66cc51a255\winsrv.dll
[2017-05-09 14:33][2017-04-27 17:10] 000215552 _____ (Microsoft Corporation) C635B3578DBAFB1E03497C0D2F2418A5

C:\Windows\winsxs\amd64_microsoft-windows-winsrv_31bf3856ad364e35_6.1.7601.23714_none_152e0d32cc12901f\winsrv.dll
[2017-04-11 13:28][2017-03-07 20:33] 000215552 _____ (Microsoft Corporation) 1623550592C687B4F6E905FC39E8E8B0

C:\Windows\winsxs\amd64_microsoft-windows-winsrv_31bf3856ad364e35_6.1.7601.23677_none_14f02ca2cc4086a3\winsrv.dll
[2017-03-14 13:16][2017-02-09 08:32] 000215552 _____ (Microsoft Corporation) B68AD91370FA58C1296DE9086BB4BA0A

C:\Windows\winsxs\amd64_microsoft-windows-winsrv_31bf3856ad364e35_6.1.7601.23572_none_14eb294acc450ac9\winsrv.dll
[2016-12-14 04:42][2016-10-11 07:32] 000215552 _____ (Microsoft Corporation) 93E5D2B763374F484918A0909724B3EB

C:\Windows\winsxs\amd64_microsoft-windows-winsrv_31bf3856ad364e35_6.1.7601.23569_none_14fcfb3ccc36a039\winsrv.dll
[2016-11-08 14:30][2016-10-07 07:32] 000215552 _____ (Microsoft Corporation) A5794B1E3ACEF48E716F0A89C83C1AEA

C:\Windows\winsxs\amd64_microsoft-windows-winsrv_31bf3856ad364e35_6.1.7601.23543_none_150c9958cc2bd04d\winsrv.dll
[2016-10-11 20:01][2016-09-09 10:20] 000215552 _____ (Microsoft Corporation) 20EBCFD94E5F9C801354062991E7257B

C:\Windows\winsxs\amd64_microsoft-windows-winsrv_31bf3856ad364e35_6.1.7601.23539_none_151d6b00cc1e4c66\winsrv.dll
[2016-09-14 01:18][2016-09-02 07:31] 000215552 _____ (Microsoft Corporation) B96D67F1BF78F1005B9D77EA7889F2B8

C:\Windows\winsxs\amd64_microsoft-windows-winsrv_31bf3856ad364e35_6.1.7601.23418_none_153208a8cc0efe06\winsrv.dll
[2016-05-10 14:04][2016-04-08 22:58] 000215552 _____ (Microsoft Corporation) E0E4D286839FC27F56A85B4710E16B6B

C:\Windows\winsxs\amd64_microsoft-windows-winsrv_31bf3856ad364e35_6.1.7601.23392_none_14d585a6cc55485d\winsrv.dll
[2016-04-12 15:35][2016-03-17 14:58] 000215552 _____ (Microsoft Corporation) 841BF993597DCD498247684B5D3AE845

C:\Windows\winsxs\amd64_microsoft-windows-winsrv_31bf3856ad364e35_6.1.7601.23391_none_14d4855ccc562f06\winsrv.dll
[2016-04-12 15:35][2016-03-16 10:53] 000215552 _____ (Microsoft Corporation) C3A12C3277B625E5D6B8CC3586D7A16B

C:\Windows\winsxs\amd64_microsoft-windows-winsrv_31bf3856ad364e35_6.1.7601.23349_none_15129748cc266e09\winsrv.dll
[2016-03-08 16:41][2016-02-10 10:56] 000215552 _____ (Microsoft Corporation) ACCB745C5952B041B548DDD879902369

C:\Windows\winsxs\amd64_microsoft-windows-winsrv_31bf3856ad364e35_6.1.7601.23338_none_151c66eacc1f38c1\winsrv.dll
[2016-02-09 22:08][2016-01-21 22:28] 000215552 _____ (Microsoft Corporation) 2EAE95F2308236806D0BA94A8059F072

C:\Windows\winsxs\amd64_microsoft-windows-winsrv_31bf3856ad364e35_6.1.7601.23334_none_151865c2cc22d365\winsrv.dll
[2016-02-09 22:07][2016-01-16 16:32] 000215552 _____ (Microsoft Corporation) 21D831EA876E381114DACFD0A002C71A

C:\Windows\winsxs\amd64_microsoft-windows-winsrv_31bf3856ad364e35_6.1.7601.23313_none_152d0550cc13822c\winsrv.dll
[2016-01-12 15:37][2015-12-30 11:14] 000215552 _____ (Microsoft Corporation) 1B191119CA1CAABEC3D22C606577C941

C:\Windows\winsxs\amd64_microsoft-windows-winsrv_31bf3856ad364e35_6.1.7601.23250_none_14fec2dccc36a8c4\winsrv.dll
[2015-11-11 02:49][2015-10-19 17:12] 000215552 _____ (Microsoft Corporation) 5670C0D6F1D4D280A04D94CA482F6EE1

C:\Windows\winsxs\amd64_microsoft-windows-winsrv_31bf3856ad364e35_6.1.7601.23226_none_1525345ccc18ecfb\winsrv.dll
[2015-10-13 15:36][2015-10-01 10:07] 000215552 _____ (Microsoft Corporation) C3C3221BC5FF27C3747E354112671221

C:\Windows\winsxs\amd64_microsoft-windows-winsrv_31bf3856ad364e35_6.1.7601.23223_none_1522337ecc1ba0f6\winsrv.dll
[2015-10-13 15:37][2015-09-28 10:16] 000215552 _____ (Microsoft Corporation) FE2BB7D5CF4460551FF5A0079AAFA7FC

C:\Windows\winsxs\amd64_microsoft-windows-winsrv_31bf3856ad364e35_6.1.7601.23153_none_1501c1d4cc33f7a2\winsrv.dll
[2015-09-08 12:37][2015-08-04 10:12] 000215552 _____ (Microsoft Corporation) BEF290D165BE120135C21438C40E2F99

C:\Windows\winsxs\amd64_microsoft-windows-winsrv_31bf3856ad364e35_6.1.7601.23142_none_150b9176cc2cc25a\winsrv.dll
[2015-09-08 12:37][2015-07-22 14:04] 000215552 _____ (Microsoft Corporation) 93B05A374E8B264FE41553BAEA2DAC07

C:\Windows\winsxs\amd64_microsoft-windows-winsrv_31bf3856ad364e35_6.1.7601.23136_none_151a628acc210bc5\winsrv.dll
[2015-08-12 02:16][2015-07-15 10:09] 000215552 _____ (Microsoft Corporation) 9EF75B9438147AAD6A6899F76FB8B4E3

C:\Windows\winsxs\amd64_microsoft-windows-winsrv_31bf3856ad364e35_6.1.7601.23126_none_15253276cc18efd4\winsrv.dll
[2015-08-12 02:17][2015-07-14 19:20] 000215552 _____ (Microsoft Corporation) 3E19966F2F720A4DF6C1F2F0D483DC81

C:\Windows\winsxs\amd64_microsoft-windows-winsrv_31bf3856ad364e35_6.1.7601.23072_none_14eb1fcccc451906\winsrv.dll
[2015-06-10 03:41][2015-05-25 10:22] 000215552 _____ (Microsoft Corporation) 7B3C10D38F84D2D534E1565A8B17018C

C:\Windows\winsxs\amd64_microsoft-windows-winsrv_31bf3856ad364e35_6.1.7601.23049_none_15129196cc267694\winsrv.dll
[2015-06-10 03:41][2015-05-08 22:06] 000215552 _____ (Microsoft Corporation) BAF5556F265959AA29F6D06A7C1C816D

C:\Windows\winsxs\amd64_microsoft-windows-winsrv_31bf3856ad364e35_6.1.7601.23040_none_15098efccc2e9285\winsrv.dll
[2015-05-12 13:36][2015-04-27 11:17] 000215552 _____ (Microsoft Corporation) 4A7726EC105064BB6614A402F25D3913

C:\Windows\winsxs\amd64_microsoft-windows-winsrv_31bf3856ad364e35_6.1.7601.23002_none_1536cf40cc0c556f\winsrv.dll
[2015-04-14 10:40][2015-03-16 21:12] 000215552 _____ (Microsoft Corporation) C05095F6593579EA61C5E99FD264D602

C:\Windows\winsxs\amd64_microsoft-windows-winsrv_31bf3856ad364e35_6.1.7601.22653_none_1501e21acc33cfc4\winsrv.dll
[2014-09-11 20:55][2014-04-11 18:32] 000215552 _____ (Microsoft Corporation) BDADDE9AD8DD2BF67426C23A8874D776

C:\Windows\winsxs\amd64_microsoft-windows-winsrv_31bf3856ad364e35_6.1.7601.22616_none_153022a8cc10ac05\winsrv.dll
[2014-09-11 20:54][2014-03-04 03:08] 000215552 _____ (Microsoft Corporation) 9A1BEE89214174AC2862344670C42B5A

C:\Windows\winsxs\amd64_microsoft-windows-winsrv_31bf3856ad364e35_6.1.7601.22436_none_151a7f04cc20e999\winsrv.dll
[2014-09-11 20:54][2013-08-28 18:21] 000215040 _____ (Microsoft Corporation) 516D82106CAFAE156C61C5AB627A6409

C:\Windows\winsxs\amd64_microsoft-windows-winsrv_31bf3856ad364e35_6.1.7601.22411_none_152b1d6acc153304\winsrv.dll
[2014-09-11 20:48][2013-08-01 22:23] 000215040 _____ (Microsoft Corporation) 99AACC82C6B8A8E976CA59CFD3C322EF

C:\Windows\winsxs\amd64_microsoft-windows-winsrv_31bf3856ad364e35_6.1.7601.22177_none_14f039eccc407b3f\winsrv.dll
[2014-09-11 20:47][2012-11-29 21:55] 000215040 _____ (Microsoft Corporation) C2B1F6196C7FE1EA1BF827312B095D06

C:\Windows\winsxs\amd64_microsoft-windows-winsrv_31bf3856ad364e35_6.1.7601.22125_none_152448f4cc19bcdc\winsrv.dll
[2014-09-11 20:55][2012-10-04 09:43] 000215040 _____ (Microsoft Corporation) CC44EBC3E04E76AABE19EB4A16663E4A

C:\Windows\winsxs\amd64_microsoft-windows-winsrv_31bf3856ad364e35_6.1.7601.22091_none_14d49672cc561df0\winsrv.dll
[2014-09-11 21:26][2014-09-11 21:26] 000215040 _____ (Microsoft Corporation) 111AFE35DD2D423EE8E176CA7B2BBDC7

C:\Windows\winsxs\amd64_microsoft-windows-winsrv_31bf3856ad364e35_6.1.7601.21738_none_151c9c12cc1efa1b\winsrv.dll
[2014-09-11 21:25][2014-09-11 21:25] 000214528 _____ (Microsoft Corporation) 5AA1C7B5F471C4657BE38447BC397665

C:\Windows\winsxs\amd64_microsoft-windows-winsrv_31bf3856ad364e35_6.1.7601.19160_none_146a5625b32124eb\winsrv.dll
[2016-03-08 16:41][2016-02-11 10:49] 000215040 _____ (Microsoft Corporation) DE4812AB2E6926D0FF2423F3B774585A

C:\Windows\winsxs\amd64_microsoft-windows-winsrv_31bf3856ad364e35_6.1.7601.19135_none_148fc75bb3044fcb\winsrv.dll
[2016-02-09 22:08][2016-01-21 22:20] 000215040 _____ (Microsoft Corporation) 96AEEE466EA56AF34AE4AD5E55DAD164

C:\Windows\winsxs\amd64_microsoft-windows-winsrv_31bf3856ad364e35_6.1.7601.19131_none_148bc633b307ea6f\winsrv.dll
[2016-02-09 22:07][2016-01-16 11:03] 000215040 _____ (Microsoft Corporation) 5D47F5EFC5D88116D71BA72B1D1BE118

C:\Windows\winsxs\amd64_microsoft-windows-winsrv_31bf3856ad364e35_6.1.7601.19110_none_14a065c1b2f89936\winsrv.dll
[2016-01-12 15:37][2015-12-30 11:02] 000215040 _____ (Microsoft Corporation) CE14A4BBF890A7D4C898CF886D145EC9

C:\Windows\winsxs\amd64_microsoft-windows-winsrv_31bf3856ad364e35_6.1.7601.19045_none_1484f589b30c6e95\winsrv.dll
[2015-11-11 02:49][2015-10-19 17:06] 000215040 _____ (Microsoft Corporation) FF41063E45C6238CAF48CBE6D0D6FC4B

C:\Windows\winsxs\amd64_microsoft-windows-winsrv_31bf3856ad364e35_6.1.7601.19018_none_14a8662bb2f166c7\winsrv.dll
[2015-10-13 15:37][2015-09-28 19:11] 000215040 _____ (Microsoft Corporation) 4AD1C61152A0199E3D7F9A82C07AC629

C:\Windows\winsxs\amd64_microsoft-windows-winsrv_31bf3856ad364e35_6.1.7601.18939_none_1493ee7bb30084be\winsrv.dll
[2015-09-08 12:37][2015-07-22 16:03] 000215040 _____ (Microsoft Corporation) 8927015C999D55D9B4AC66000EE5343D

C:\Windows\winsxs\amd64_microsoft-windows-winsrv_31bf3856ad364e35_6.1.7601.18933_none_148decbfb305ecb4\winsrv.dll
[2015-08-12 02:16][2015-07-15 10:11] 000215040 _____ (Microsoft Corporation) E80CA72FA43BF258E72C408CEF9839BE

C:\Windows\winsxs\amd64_microsoft-windows-winsrv_31bf3856ad364e35_6.1.7601.18923_none_1498bcabb2fdd0c3\winsrv.dll
[2015-08-12 02:17][2015-07-14 19:20] 000215040 _____ (Microsoft Corporation) C5A10C9C75F8A51AD20ED0E2EC4C82A4

C:\Windows\winsxs\amd64_microsoft-windows-winsrv_31bf3856ad364e35_6.1.7601.18869_none_14737cd1b318db6a\winsrv.dll
[2015-06-10 03:41][2015-05-25 10:19] 000215040 _____ (Microsoft Corporation) 2313AF8D5A9CEB4A55400A01DD311A95

C:\Windows\winsxs\amd64_microsoft-windows-winsrv_31bf3856ad364e35_6.1.7601.18847_none_14871c15b30a70da\winsrv.dll
[2015-06-10 03:41][2015-05-08 19:27] 000215040 _____ (Microsoft Corporation) A171AC55EE4B4EE35C18EF0977017A72

C:\Windows\winsxs\amd64_microsoft-windows-winsrv_31bf3856ad364e35_6.1.7601.18839_none_1493ec95b3008797\winsrv.dll
[2015-05-12 13:36][2015-04-27 11:23] 000215040 _____ (Microsoft Corporation) D17DD01601460F5899E5C154B3FD0BFA

C:\Windows\winsxs\amd64_microsoft-windows-winsrv_31bf3856ad364e35_6.1.7601.18798_none_14520addb33218bf\winsrv.dll
[2015-04-14 10:40][2015-03-16 21:16] 000215040 _____ (Microsoft Corporation) EA32F4EA3AE06EDD122FBCD5A489E457

C:\Windows\winsxs\amd64_microsoft-windows-winsrv_31bf3856ad364e35_6.1.7601.18229_none_149eb11db2f87cbc\winsrv.dll
[2014-09-11 20:48][2013-08-01 18:14] 000215040 _____ (Microsoft Corporation) 88EDD0B34EED542745931E581AD21A32

C:\Windows\winsxs\amd64_microsoft-windows-winsrv_31bf3856ad364e35_6.1.7601.18043_none_14830bbdb30e2246\winsrv.dll
[2014-09-11 20:54][2013-01-03 21:46] 000215040 _____ (Microsoft Corporation) 0C27239FEA4DB8A2AAC9E502186B7264

C:\Windows\winsxs\amd64_microsoft-windows-winsrv_31bf3856ad364e35_6.1.7601.18015_none_14a57c15b2f40121\winsrv.dll
[2014-09-11 20:47][2012-11-29 21:45] 000215040 _____ (Microsoft Corporation) 9E479C2B605C25DA4971ABA36250FAEF

C:\Windows\winsxs\amd64_microsoft-windows-winsrv_31bf3856ad364e35_6.1.7601.17965_none_146f9457b31c5994\winsrv.dll
[2014-09-11 20:55][2012-10-04 09:45] 000215040 _____ (Microsoft Corporation) 72CC564BBC70DE268784BCE91EB8A28F

C:\Windows\winsxs\amd64_microsoft-windows-winsrv_31bf3856ad364e35_6.1.7601.17932_none_148d033db306b9bc\winsrv.dll
[2014-09-11 21:26][2014-09-11 21:26] 000215040 _____ (Microsoft Corporation) F46BBAAC1C4980F4D0DD463F190A42D3

C:\Windows\winsxs\amd64_microsoft-windows-winsrv_31bf3856ad364e35_6.1.7601.17625_none_149ace55b2fbf25b\winsrv.dll
[2014-09-11 21:25][2014-09-11 21:25] 000214528 _____ (Microsoft Corporation) 9F761CE1C6C013120B2F0DB27D48C06F

C:\Windows\winsxs\amd64_microsoft-windows-winsrv_31bf3856ad364e35_6.1.7601.17514_none_14a49c11b2f4bfec\winsrv.dll
[2010-11-20 19:24][2010-11-20 19:24] 000214016 _____ (Microsoft Corporation) E0406AEF04B088D1C49FC78D0546F689

C:\Windows\winsxs\amd64_microsoft-windows-winsrv.resources_31bf3856ad364e35_6.1.7600.16385_en-us_99be31681e1cff53\winsrv.dll.mui
[2010-11-20 23:59][2010-11-20 23:59] 000008192 _____ (Microsoft Corporation) 0E4E26AF593AC5023E55333096DDD9EA

C:\Windows\winsxs\amd64_microsoft-windows-winsrv-adm_31bf3856ad364e35_6.1.7600.16385_none_74fe9f3a6d505307\Winsrv.admx
[2009-06-10 12:42][2009-06-10 12:42] 000001342 _____ () B28573159BDEA736F3BDFF16604A4AD3

C:\Windows\winsxs\amd64_microsoft-windows-winsrv-adm.resources_31bf3856ad364e35_6.1.7600.16385_en-us_c01e7ca36d3191ee\Winsrv.adml
[2010-11-20 23:59][2010-11-20 23:59] 000001453 _____ () 76D4B8899387BCD0C081D4301E1B18DE

C:\Windows\winsxs\amd64_microsoft-windows-s..s-servicecontroller_31bf3856ad364e35_6.1.7601.23033_none_2df8898bfd178df8\services.exe
[2015-05-12 13:36][2015-04-10 20:31] 000328704 _____ (Microsoft Corporation) 43DCEC23557C32F7702C8D5BC729738F

C:\Windows\winsxs\amd64_microsoft-windows-s..s-servicecontroller_31bf3856ad364e35_6.1.7601.18829_none_2d7fe646e3ec3705\services.exe
[2015-05-12 13:36][2015-04-12 19:28] 000328704 _____ (Microsoft Corporation) 71C85477DF9347FE8E7BC55768473FCA

C:\Windows\winsxs\amd64_microsoft-windows-s..s-servicecontroller_31bf3856ad364e35_6.1.7600.16385_none_2b54b20ee6fa07b1\services.exe
[2009-07-13 15:19][2009-07-13 17:39] 000328704 _____ (Microsoft Corporation) 24ACB7E5BE595468E3B9AA488B9B4FCB

C:\Windows\SysWOW64\en-US\winsrv.dll.mui
[2010-11-20 23:59][2010-11-20 23:59] 000008192 _____ (Microsoft Corporation) 9848765E88322400BDC710A76ADEA841

C:\Windows\System32\services.exe
[2015-05-12 13:36][2015-04-12 19:28] 000328704 _____ (Microsoft Corporation) 71C85477DF9347FE8E7BC55768473FCA

C:\Windows\System32\winsrv.dll
[2017-10-10 19:50][2017-09-13 07:28] 000215552 _____ (Microsoft Corporation) 66A8A9412337B08E1735204B8ADEE58C

C:\Windows\System32\en-US\winsrv.dll.mui
[2010-11-20 23:59][2010-11-20 23:59] 000008192 _____ (Microsoft Corporation) 0E4E26AF593AC5023E55333096DDD9EA

C:\Windows\PolicyDefinitions\Winsrv.admx
[2009-06-10 12:42][2009-06-10 12:42] 000001342 _____ () B28573159BDEA736F3BDFF16604A4AD3

C:\Windows\PolicyDefinitions\en-US\Winsrv.adml
[2010-11-20 23:59][2010-11-20 23:59] 000001453 _____ () 76D4B8899387BCD0C081D4301E1B18DE

X:\Windows\winsxs\amd64_microsoft-windows-winsrv_31bf3856ad364e35_6.1.7601.17514_none_14a49c11b2f4bfec\winsrv.dll
[2010-11-20 01:50][2010-11-20 05:27] 000214016 _____ (Microsoft Corporation) E0406AEF04B088D1C49FC78D0546F689

X:\Windows\winsxs\amd64_microsoft-windows-winsrv.resources_31bf3856ad364e35_6.1.7601.17514_en-us_9bef45301b0b82ed\winsrv.dll.mui
[2010-11-20 08:03][2010-11-20 08:03] 000008192 _____ (Microsoft Corporation) 0E4E26AF593AC5023E55333096DDD9EA

X:\Windows\winsxs\amd64_microsoft-windows-s..s-servicecontroller_31bf3856ad364e35_6.1.7601.17514_none_2d85c5d6e3e88b4b\services.exe
[2010-11-20 01:19][2009-07-13 17:39] 000328704 _____ (Microsoft Corporation) 24ACB7E5BE595468E3B9AA488B9B4FCB

X:\Windows\System32\services.exe
[2010-11-20 01:19][2009-07-13 17:39] 000328704 _____ (Microsoft Corporation) 24ACB7E5BE595468E3B9AA488B9B4FCB

X:\Windows\System32\winsrv.dll
[2010-11-20 01:50][2010-11-20 05:27] 000214016 _____ (Microsoft Corporation) E0406AEF04B088D1C49FC78D0546F689

X:\Windows\System32\en-US\winsrv.dll.mui
[2010-11-20 08:03][2010-11-20 08:03] 000008192 _____ (Microsoft Corporation) 0E4E26AF593AC5023E55333096DDD9EA

====== End of Search ======


----------

