Jump to content


 


Register a free account to unlock additional features at BleepingComputer.com
Welcome to BleepingComputer, a free community where people like yourself come together to discuss and learn how to use their computers. Using the site is easy and fun. As a guest, you can browse and view the various discussions in the forums, but can not create a new topic or reply to an existing one unless you are logged in. Other benefits of registering an account are subscribing to topics and forums, creating a blog, and having no ads shown anywhere on the site.


Click here to Register a free account now! or read our Welcome Guide to learn how to use this site.

Photo

MPC Cleaner


  • Please log in to reply
3 replies to this topic

#1 Dexterthefourth

Dexterthefourth

  • Members
  • 2 posts
  • OFFLINE
  •  

Posted 18 May 2016 - 10:35 AM

After being infected by this program and bunch of others with that, i tried fighting it but i cant win so i give up and ask you for help. 

Used windows defender, then adwcleaner, then eset online but i still have this MPC cleaner folder and my chrome (even after reinstalling) is still corrupted - cant set is as a default browser and sudden advertisements redirects. also an error occurs on boot "cant find script file C:Windows\run.vbs

adwcleaner log # AdwCleaner v5.117 - Logfile created 18/05/2016 at 17:30:50

# Updated 15/05/2016 by Xplode
# Database : 2016-05-15.2 [Server]
# Operating system : Windows 10 Pro  (X64)
# Username : Dexter - DESKTOP-CP1LG1D
# Running from : C:\Users\Dexter\Desktop\adwcleaner_5.117.exe
# Option : Scan
 
***** [ Services ] *****
 
Service Found : MPCProtectService
Service Found : MPCKpt
 
***** [ Folders ] *****
 
Folder Found : C:\Program Files (x86)\MPC Cleaner
 
***** [ Files ] *****
 
File Found : C:\WINDOWS\SysNative\drivers\MPCKpt.sys
 
***** [ DLL ] *****
 
 
***** [ WMI ] *****
 
 
***** [ Shortcuts ] *****
 
 
***** [ Scheduled tasks ] *****
 
 
***** [ Registry ] *****
 
Key Found : HKLM\SOFTWARE\MPC
 
***** [ Web browsers ] *****
 
 
*************************
 
C:\AdwCleaner\AdwCleaner[C1].txt - [6767 bytes] - [19/01/2016 22:00:56]
C:\AdwCleaner\AdwCleaner[C2].txt - [1736 bytes] - [18/05/2016 15:51:47]
C:\AdwCleaner\AdwCleaner[C3].txt - [1731 bytes] - [18/05/2016 17:19:01]
C:\AdwCleaner\AdwCleaner[S1].txt - [7875 bytes] - [19/01/2016 21:48:41]
C:\AdwCleaner\AdwCleaner[S2].txt - [2330 bytes] - [19/01/2016 22:22:35]
C:\AdwCleaner\AdwCleaner[S3].txt - [1622 bytes] - [18/05/2016 17:07:27]
C:\AdwCleaner\AdwCleaner[S4].txt - [1513 bytes] - [18/05/2016 17:20:55]
C:\AdwCleaner\AdwCleaner[S5].txt - [1586 bytes] - [18/05/2016 17:28:11]
C:\AdwCleaner\AdwCleaner[S6].txt - [1410 bytes] - [18/05/2016 17:30:50]
 
########## EOF - C:\AdwCleaner\AdwCleaner[S6].txt - [1483 bytes] ##########
 
 
EDIT: forgot to add that i used unlockers which did nothin

Edited by Dexterthefourth, 18 May 2016 - 10:39 AM.


BC AdBot (Login to Remove)

 


#2 olgun52

olgun52

  • Malware Response Team
  • 3,807 posts
  • OFFLINE
  •  
  • Gender:Male
  • Local time:12:32 AM

Posted 18 May 2016 - 10:52 AM

Hello Dexterthefourth and Welcome to the BleepingComputer. :welcome:  
 My name is Yılmaz and I'll help you with the cleanup of malware from your computer.

Before we move on, please read the following points carefully.
  • Please complete all steps in the specified order.
  • Even if tools don't find malware, I want you to post the logfiles anyway.
  • Please copy and paste the logfiles directly into your posts. Please do not attach them unless you are instructed to do so.
  • Read the instructions carefully. If you have problems, stop what you  were doing and describe the problems you encountered as precisely as  you can.
  • Don't install or uninstall software during the cleanup unless you are told to do so.
  • Ensure your external and/or USB drives are inserted during always the scan.
  • If you can't answer for the next few days, please let me know. If  you haven't answered within 5 days, I am assuming that you don't need  help anymore and your topic will be closed.
  • If you have illegal/cracked software, cracks, keygens, etc. on the system, please remove or uninstall them now!
  • I can not guarantee that we will find and be able to remove all  malware. The cleaning process is not instant. Please continue to review  my answers until I tell you that your computer is clean
  • Please reply to this thread. Do not start a new topic
  • As my first language is not English, please do not use slang or idioms. It could be hard for me to understand.
  • Please open as administrator  the computer. How is open as administrator  the computer?
  • Disable your AntiVirus and AntiSpyware applications, as they will  interfere with our tools and the removal. If you are unsure how to do  this, please refer to get help here
Thanks
 
Please do the following.
 
Please download Farbar Recovery Scan Tool and save it to your desktop.

Note: You need to run the version compatibale with your system. If you are not sure which version applies to your system download both of them and try to run them. Only one of them will run on your system, that will be the right version.
  • Double-click to run it. When the tool opens click Yes to disclaimer.
  • Make sure the following option is checked: addition.png
  • Press Scan button.
  • It will make a log (FRST.txt) in the same directory the tool is run. Please copy and paste it to your reply.
  • The first time the tool is run, it makes also another log (Addition.txt). Please attach it to your reply.
Sincerely  . :hello:

Best regards
 
paypal.gif
If you wish to show appreciation and support me personally fighting against malware, then you can consider a donation. Thank you. :thumbup2:
Malware fix forum
If I don't reply within 24 hours please PM me!

 


 


#3 Dexterthefourth

Dexterthefourth
  • Topic Starter

  • Members
  • 2 posts
  • OFFLINE
  •  

Posted 18 May 2016 - 11:00 AM

I dont know how to run frst in english but i'll post logs anyway

 

Rezultaty skanowania Farbar Recovery Scan Tool (FRST) (x64) Wersja:18-05-2016
Uruchomiony przez Dexter (administrator)  DESKTOP-CP1LG1D (18-05-2016 17:54:53)
Uruchomiony z C:\Users\Dexter\Downloads
Załadowane profile: Dexter (Dostępne profile: Dexter)
Platform: Windows 10 Pro Wersja 1511 (X64) Język: Polski (Polska)
Internet Explorer Wersja 11 (Domyślna przeglądarka: Chrome)
Tryb startu: Normal
 
==================== Procesy (filtrowane) =================
 
(Załączenie wejścia w fixlist spowoduje zamknięcie procesu. Powiązany plik nie zostanie przeniesiony.)
 
(ESET) C:\Program Files\ESET\ESET Smart Security\ekrn.exe
(AMD) C:\Windows\System32\atiesrxx.exe
(AMD) C:\Windows\System32\atieclxx.exe
(Microsoft Corporation) C:\Program Files (x86)\Skype\Toolbars\AutoUpdate\SkypeC2CAutoUpdateSvc.exe
(Microsoft Corporation) C:\Program Files (x86)\Skype\Toolbars\PNRSvc\SkypeC2CPNRSvc.exe
(MSI) C:\Program Files (x86)\MSI\Command Center\MSIControlService.exe
(MSI) C:\Program Files (x86)\MSI\Command Center\DDR\MSIDDRService.exe
(VIA Technologies, Inc.) C:\Windows\System32\ViakaraokeSrv.exe
() C:\Program Files\WindowsApps\Microsoft.Messaging_2.15.20002.0_x86__8wekyb3d8bbwe\SkypeHost.exe
(Google Inc.) C:\Program Files (x86)\Google\Update\1.3.30.3\GoogleCrashHandler.exe
(Google Inc.) C:\Program Files (x86)\Google\Update\1.3.30.3\GoogleCrashHandler64.exe
(Microsoft Corporation) C:\Windows\System32\SettingSyncHost.exe
(ESET) C:\Program Files\ESET\ESET Smart Security\egui.exe
(Realtek Semiconductor) C:\Program Files\Realtek\Audio\HDA\RtkNGUI64.exe
(Advanced Micro Devices, Inc.) C:\Program Files\AMD\CNext\CNext\cnext.exe
(Nota Inc.) C:\Program Files (x86)\Gyazo\GyStation.exe
(Hammer & Chisel, Inc.) C:\Users\Dexter\AppData\Local\Discord\app-0.0.290\Discord.exe
(Hammer & Chisel, Inc.) C:\Users\Dexter\AppData\Local\Discord\app-0.0.290\Discord.exe
(Spotify Ltd) C:\Users\Dexter\AppData\Roaming\Spotify\SpotifyWebHelper.exe
(Hammer & Chisel, Inc.) C:\Users\Dexter\AppData\Local\Discord\app-0.0.290\Discord.exe
(Spotify Ltd) C:\Users\Dexter\AppData\Roaming\Spotify\Spotify.exe
(Spotify Ltd) C:\Users\Dexter\AppData\Roaming\Spotify\SpotifyCrashService.exe
(Spotify Ltd) C:\Users\Dexter\AppData\Roaming\Spotify\Spotify.exe
(Spotify Ltd) C:\Users\Dexter\AppData\Roaming\Spotify\Spotify.exe
(Microsoft Corporation) C:\Program Files (x86)\Microsoft Office\Office14\MSOSYNC.EXE
(Oracle Corporation) C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe
() C:\Program Files\Genesis GX57\GenesisGX57.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
() C:\Users\Dexter\Desktop\ADWCLE~1.EXE
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
 
 
==================== Rejestr (filtrowane) ===========================
 
(Załączenie wejścia w fixlist spowoduje usunięcie obiektu z rejestru lub przywrócenie jego domyślnej postaci. Powiązany plik nie zostanie przeniesiony.)
 
HKLM\...\Run: [HDAudDeck] => C:\Program Files (x86)\VIA\VIAudioi\VDeck\VDeck.exe [4708016 2015-08-23] (VIA)
HKLM\...\Run: [RTHDVCPL] => C:\Program Files\Realtek\Audio\HDA\RtkNGUI64.exe [8484056 2015-06-12] (Realtek Semiconductor)
HKLM\...\Run: [StartCN] => C:\Program Files\AMD\CNext\CNext\cnext.exe [4926664 2016-02-26] (Advanced Micro Devices, Inc.)
HKLM-x32\...\Run: [Raptr] => C:\Program Files (x86)\Raptr\raptrstub.exe [56080 2015-10-01] (Raptr, Inc)
HKLM-x32\...\Run: [BCSSync] => C:\Program Files (x86)\Microsoft Office\Office14\BCSSync.exe [91520 2010-01-21] (Microsoft Corporation)
HKLM-x32\...\Run: [SunJavaUpdateSched] => C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe [594992 2016-01-29] (Oracle Corporation)
HKLM-x32\...\Run: [QuickTime Task] => C:\Program Files (x86)\QuickTime\qttask.exe [282624 2007-02-16] (Apple Computer, Inc.)
HKLM-x32\...\Run: [Command Center] => C:\Program Files (x86)\MSI\Command Center\StartCommandCenter.exe [834512 2016-03-29] (MSI)
HKLM\...\Winlogon: [Userinit] wscript C:\WINDOWS\run.vbs,
HKU\S-1-5-21-1233566895-3163107042-3464413089-1001\...\Run: [Gyazo] => C:\Program Files (x86)\Gyazo\GyStation.exe [3586848 2016-02-17] (Nota Inc.)
HKU\S-1-5-21-1233566895-3163107042-3464413089-1001\...\Run: [Microsoft Updater] => C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe [53248 2015-10-23] (Microsoft Corporation)
HKU\S-1-5-21-1233566895-3163107042-3464413089-1001\...\Run: [Discord] => C:\Users\Dexter\AppData\Local\Discord\app-0.0.290\Discord.exe [57924280 2016-05-06] (Hammer & Chisel, Inc.)
HKU\S-1-5-21-1233566895-3163107042-3464413089-1001\...\Run: [Overwolf] => C:\Program Files (x86)\Overwolf\Overwolf.exe [45296 2016-05-08] (Overwolf LTD)
HKU\S-1-5-21-1233566895-3163107042-3464413089-1001\...\Run: [Spotify Web Helper] => C:\Users\Dexter\AppData\Roaming\Spotify\SpotifyWebHelper.exe [1525360 2016-04-26] (Spotify Ltd)
HKU\S-1-5-21-1233566895-3163107042-3464413089-1001\...\Run: [Spotify] => C:\Users\Dexter\AppData\Roaming\Spotify\Spotify.exe [6890608 2016-04-26] (Spotify Ltd)
HKU\S-1-5-21-1233566895-3163107042-3464413089-1001\...\Run: [Skype] => C:\Program Files (x86)\Skype\Phone\Skype.exe [51656320 2016-04-08] (Skype Technologies S.A.)
HKU\S-1-5-21-1233566895-3163107042-3464413089-1001\...\Run: [GalaxyClient] => [X]
HKU\S-1-5-21-1233566895-3163107042-3464413089-1001\...\Run: [OfficeSyncProcess] => C:\Program Files (x86)\Microsoft Office\Office14\MSOSYNC.EXE [717696 2010-01-16] (Microsoft Corporation)
 
==================== Internet (filtrowane) ====================
 
(Załączenie wejścia w fixlist, w przypadku gdy jest to obiekt rejestru, spowoduje usunięcie go z rejestru lub przywrócenie jego domyślnej postaci.)
 
AutoConfigURL: [S-1-5-21-1233566895-3163107042-3464413089-1001] => hxxp://unstops.biz/wpad.dat?3eee531f2ec1e08b62f6484abdfab4f510272121
Hosts: W pliku Hosts jest więcej niż jedno wejście. Sprawdź sekcję Hosts w Addition.txt
Tcpip\Parameters: [DhcpNameServer] 192.168.0.1
Tcpip\..\Interfaces\{0292f9e3-1b29-42e6-ac80-6d1a4f628591}: [DhcpNameServer] 192.168.42.129
Tcpip\..\Interfaces\{21775c6d-e92c-4f48-8371-f9169f6e24d8}: [DhcpNameServer] 8.8.8.8 8.8.4.4
Tcpip\..\Interfaces\{8c200f8f-116b-4763-88d9-18aa82539153}: [DhcpNameServer] 192.168.0.1
Tcpip\..\Interfaces\{fc397418-33fa-4bc1-91fb-5303669cf711}: [DhcpNameServer] 192.168.42.129
Tcpip\..\Interfaces\{fd924cb4-0261-4418-967e-9f089f9b987a}: [DhcpNameServer] 8.8.8.8 8.8.4.4
ManualProxies: 0hxxp://unstops.biz/wpad.dat?3eee531f2ec1e08b62f6484abdfab4f510272121
 
Internet Explorer:
==================
BHO: Groove GFS Browser Helper -> {72853161-30C5-4D22-B7F9-0BBC1D38A37E} -> C:\Program Files\Microsoft Office\Office14\GROOVEEX.DLL [2010-01-21] (Microsoft Corporation)
BHO: Skype Click to Call for Internet Explorer -> {AE805869-2E5C-4ED4-8F7B-F1F7851A4497} -> C:\Program Files (x86)\Skype\Toolbars\Internet Explorer x64\skypeieplugin.dll [2016-04-29] (Microsoft Corporation)
BHO: Brak nazwy -> {B4F3A835-0E21-4959-BA22-42B3008E02FF} -> Brak pliku
BHO-x32: Groove GFS Browser Helper -> {72853161-30C5-4D22-B7F9-0BBC1D38A37E} -> C:\Program Files (x86)\Microsoft Office\Office14\GROOVEEX.DLL [2010-01-21] (Microsoft Corporation)
BHO-x32: Java™ Plug-In SSV Helper -> {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} -> C:\Program Files (x86)\Java\jre1.8.0_73\bin\ssv.dll [2016-03-18] (Oracle Corporation)
BHO-x32: Skype Click to Call for Internet Explorer -> {AE805869-2E5C-4ED4-8F7B-F1F7851A4497} -> C:\Program Files (x86)\Skype\Toolbars\Internet Explorer\SkypeIEPlugin.dll [2016-04-29] (Microsoft Corporation)
BHO-x32: Office Document Cache Handler -> {B4F3A835-0E21-4959-BA22-42B3008E02FF} -> C:\Program Files (x86)\Microsoft Office\Office14\URLREDIR.DLL [2010-01-16] (Microsoft Corporation)
BHO-x32: Java™ Plug-In 2 SSV Helper -> {DBC80044-A445-435b-BC74-9C25C1C588A9} -> C:\Program Files (x86)\Java\jre1.8.0_73\bin\jp2ssv.dll [2016-03-18] (Oracle Corporation)
Handler: skypec2c - {91774881-D725-4E58-B298-07617B9B86A8} - C:\Program Files (x86)\Skype\Toolbars\Internet Explorer x64\skypeieplugin.dll [2016-04-29] (Microsoft Corporation)
Handler-x32: skypec2c - {91774881-D725-4E58-B298-07617B9B86A8} - C:\Program Files (x86)\Skype\Toolbars\Internet Explorer\SkypeIEPlugin.dll [2016-04-29] (Microsoft Corporation)
 
FireFox:
========
FF Plugin: @microsoft.com/OfficeAuthz,version=14.0 -> C:\PROGRA~1\MICROS~2\Office14\NPAUTHZ.DLL [2010-01-09] (Microsoft Corporation)
FF Plugin-x32: @java.com/DTPlugin,version=11.73.2 -> C:\Program Files (x86)\Java\jre1.8.0_73\bin\dtplugin\npDeployJava1.dll [2016-03-18] (Oracle Corporation)
FF Plugin-x32: @java.com/JavaPlugin,version=11.73.2 -> C:\Program Files (x86)\Java\jre1.8.0_73\bin\plugin2\npjp2.dll [2016-03-18] (Oracle Corporation)
FF Plugin-x32: @microsoft.com/OfficeAuthz,version=14.0 -> C:\PROGRA~2\MICROS~1\Office14\NPAUTHZ.DLL [2010-01-09] (Microsoft Corporation)
FF Plugin-x32: @microsoft.com/WLPG,version=16.4.3528.0331 -> C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll [2014-03-31] (Microsoft Corporation)
FF Plugin-x32: @tools.google.com/Google Update;version=3 -> C:\Program Files (x86)\Google\Update\1.3.30.3\npGoogleUpdate3.dll [2016-05-18] (Google Inc.)
FF Plugin-x32: @tools.google.com/Google Update;version=9 -> C:\Program Files (x86)\Google\Update\1.3.30.3\npGoogleUpdate3.dll [2016-05-18] (Google Inc.)
 
Chrome: 
=======
CHR Profile: C:\Users\Dexter\AppData\Local\Google\Chrome\User Data\Default
CHR Extension: (Prezentacje Google) - C:\Users\Dexter\AppData\Local\Google\Chrome\User Data\Default\Extensions\aapocclcgogkmnckokdopfmhonfmgoek [2016-05-18]
CHR Extension: (BetterTTV) - C:\Users\Dexter\AppData\Local\Google\Chrome\User Data\Default\Extensions\ajopnjidmegmdimjlfnijceegpefgped [2016-05-18]
CHR Extension: (Dokumenty Google) - C:\Users\Dexter\AppData\Local\Google\Chrome\User Data\Default\Extensions\aohghmighlieiainnegkcijnfilokake [2016-05-18]
CHR Extension: (FrankerFaceZ) - C:\Users\Dexter\AppData\Local\Google\Chrome\User Data\Default\Extensions\fadndhdgpmmaapbmfcknlfgcflmmmieb [2016-05-18]
CHR Extension: (Arkusze Google) - C:\Users\Dexter\AppData\Local\Google\Chrome\User Data\Default\Extensions\felcaaldnbdncclmgdcncolpebgiejap [2016-05-18]
CHR Extension: (Dokumenty Google offline) - C:\Users\Dexter\AppData\Local\Google\Chrome\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi [2016-05-18]
CHR Extension: (AdBlock) - C:\Users\Dexter\AppData\Local\Google\Chrome\User Data\Default\Extensions\gighmmpiobklfepjocnamgkkbiglidom [2016-05-18]
CHR HKLM-x32\...\Chrome\Extension: [lifbcibllhkdhoafpjfnlhfpfgnpldfl] - C:\Program Files (x86)\Skype\Toolbars\ChromeExtension\skype_chrome_extension.crx [2016-04-29]
 
==================== Usługi (filtrowane) ========================
 
(Załączenie wejścia w fixlist spowoduje jego usunięcie z rejestru. Powiązany plik nie zostanie przeniesiony, o ile nie zostanie załączony z osobna.)
 
R2 c2cautoupdatesvc; C:\Program Files (x86)\Skype\Toolbars\AutoUpdate\SkypeC2CAutoUpdateSvc.exe [1433216 2016-04-29] (Microsoft Corporation)
R2 c2cpnrsvc; C:\Program Files (x86)\Skype\Toolbars\PNRSvc\SkypeC2CPNRSvc.exe [1773696 2016-04-29] (Microsoft Corporation)
R2 ekrn; C:\Program Files\ESET\ESET Smart Security\ekrn.exe [2520928 2016-03-03] (ESET)
S3 GalaxyClientService; C:\Program Files (x86)\GalaxyClient\GalaxyClientService.exe [227896 2016-03-25] (GOG.com)
S3 GalaxyCommunication; C:\ProgramData\GOG.com\Galaxy\redists\GalaxyCommunication.exe [5971000 2016-03-25] (GOG.com)
S3 MSIClock_CC; C:\Program Files (x86)\MSI\Command Center\ClockGen\MSIClockService.exe [4172240 2016-03-25] (MSI)
S3 MSICOMM_CC; C:\Program Files (x86)\MSI\Command Center\MSICommService.exe [2200872 2016-02-01] (MSI)
S3 MSICPU_CC; C:\Program Files (x86)\MSI\Command Center\CPU\MSICPUService.exe [4162512 2016-02-04] (MSI)
R2 MSICTL_CC; C:\Program Files (x86)\MSI\Command Center\MSIControlService.exe [2014160 2016-03-04] (MSI)
R2 MSIDDR_CC; C:\Program Files (x86)\MSI\Command Center\DDR\MSIDDRService.exe [2317264 2016-03-25] (MSI)
S3 MSISMB_CC; C:\Program Files (x86)\MSI\Command Center\SMBus\MSISMBService.exe [2073040 2016-02-04] (MSI)
S3 MSISuperIO_CC; C:\Program Files (x86)\MSI\Command Center\SuperIO\MSISuperIOService.exe [596944 2016-02-01] (MSI)
S3 Origin Client Service; C:\Program Files (x86)\Origin\OriginClientService.exe [2120712 2016-04-27] (Electronic Arts)
S3 OverwolfUpdater; C:\Program Files (x86)\Overwolf\OverwolfUpdater.exe [1286896 2016-05-08] (Overwolf LTD)
S3 TunngleService; C:\Program Files (x86)\Tunngle\TnglCtrl.exe [805840 2015-09-26] (Tunngle.net GmbH) [Brak podpisu cyfrowego]
R2 VIAKaraokeService; C:\Windows\system32\viakaraokesrv.exe [36504 2015-08-23] (VIA Technologies, Inc.)
S3 WdNisSvc; C:\Program Files\Windows Defender\NisSrv.exe [364464 2015-10-30] (Microsoft Corporation)
S3 WinDefend; C:\Program Files\Windows Defender\MsMpEng.exe [24864 2015-10-30] (Microsoft Corporation)
S2 AMD FUEL Service; "C:\Program Files\ATI Technologies\ATI.ACE\Fuel\Fuel.Service.exe" /launchService [X]
S2 ckgCommunityService; "C:\Program Files (x86)\Ckigtsakile\ckgCommunityService.exe" {79740E79-A383-47A7-B513-3DF6563D007F} {A16B1AF7-982D-40C3-B5C1-633E1A6A6678} [X]
S2 MPCProtectService; "C:\Program Files (x86)\MPC Cleaner\MPCProtectService.exe" [X]
 
===================== Sterowniki (filtrowane) ==========================
 
(Załączenie wejścia w fixlist spowoduje jego usunięcie z rejestru. Powiązany plik nie zostanie przeniesiony, o ile nie zostanie załączony z osobna.)
 
S0 amdkmafd; C:\Windows\System32\drivers\amdkmafd.sys [23240 2016-02-26] (Advanced Micro Devices, Inc.)
R2 AODDriver4.3; C:\Program Files\ATI Technologies\ATI.ACE\Fuel\amd64\AODDriver2.sys [59616 2014-02-11] (Advanced Micro Devices)
R3 AtiHDAudioService; C:\Windows\system32\drivers\AtihdWT6.sys [102912 2015-07-22] (Advanced Micro Devices)
S3 dg_ssudbus; C:\Windows\system32\DRIVERS\ssudbus.sys [129152 2016-04-25] (Samsung Electronics Co., Ltd.)
S3 dot4; C:\Windows\system32\DRIVERS\Dot4.sys [151968 2015-10-20] (Windows ® Win 7 DDK provider)
S3 Dot4Print; C:\Windows\System32\drivers\Dot4Prt.sys [27040 2015-10-20] (Windows ® Win 7 DDK provider)
R1 eamonm; C:\Windows\System32\DRIVERS\eamonm.sys [264552 2016-04-14] (ESET)
S0 eelam; C:\Windows\System32\DRIVERS\eelam.sys [14976 2016-04-14] (ESET)
R1 ehdrv; C:\Windows\system32\DRIVERS\ehdrv.sys [186784 2016-04-14] (ESET)
R2 ekbdflt; C:\Windows\system32\DRIVERS\ekbdflt.sys [142976 2016-04-14] (ESET)
R1 epfw; C:\Windows\system32\DRIVERS\epfw.sys [198096 2016-04-14] (ESET)
R1 EpfwLWF; C:\Windows\system32\DRIVERS\EpfwLWF.sys [53384 2016-04-14] (ESET)
R0 epfwwfp; C:\Windows\System32\DRIVERS\epfwwfp.sys [84800 2016-04-14] (ESET)
R3 iaLPSS2_GPIO2; C:\Windows\System32\drivers\iaLPSS2_GPIO2.sys [83768 2016-01-23] (Windows ® Win 7 DDK provider)
R3 iaLPSS2_UART2; C:\Windows\System32\drivers\iaLPSS2_UART2.sys [281400 2016-01-23] (Intel Corporation)
S4 IObitUnlocker; C:\Program Files (x86)\IObit\IObit Unlocker\IObitUnlocker.sys [36568 2013-09-30] (IObit)
R3 MEIx64; C:\Windows\System32\drivers\TeeDriverW8x64.sys [204032 2016-01-19] (Intel Corporation)
R1 MPCKpt; C:\Windows\System32\DRIVERS\MPCKpt.sys [60136 2016-05-18] (DotC United Inc)
S3 MTsensor; C:\Windows\system32\DRIVERS\ASACPI.sys [17280 2015-08-16] ()
R3 NTIOLib_MSIDDR_CC; C:\Program Files (x86)\MSI\Command Center\DDR\NTIOLib_X64.sys [13368 2012-11-26] (MSI)
R3 rt640x64; C:\Windows\System32\drivers\rt640x64.sys [589824 2015-10-30] (Realtek                                            )
S3 ssudmdm; C:\Windows\system32\DRIVERS\ssudmdm.sys [221824 2016-04-25] (Samsung Electronics Co., Ltd.)
S3 tap0901t; C:\Windows\System32\drivers\tap0901t.sys [31232 2009-09-16] (Tunngle.net)
S3 usbrndis6; C:\Windows\System32\drivers\usb80236.sys [23040 2015-10-30] (Microsoft Corporation)
S3 WdBoot; C:\Windows\system32\drivers\WdBoot.sys [44568 2015-10-30] (Microsoft Corporation)
S3 WdFilter; C:\Windows\system32\drivers\WdFilter.sys [293216 2015-10-30] (Microsoft Corporation)
S3 WdNisDrv; C:\Windows\System32\Drivers\WdNisDrv.sys [118112 2015-10-30] (Microsoft Corporation)
 
==================== NetSvcs (filtrowane) ===================
 
(Załączenie wejścia w fixlist spowoduje jego usunięcie z rejestru. Powiązany plik nie zostanie przeniesiony, o ile nie zostanie załączony z osobna.)
 
 
==================== Jeden miesiąc - utworzone pliki i foldery ========
 
(Załączenie wejścia w fixlist spowoduje przeniesienie pliku/folderu.)
 
2016-05-18 17:54 - 2016-05-18 17:55 - 00017091 _____ C:\Users\Dexter\Downloads\FRST.txt
2016-05-18 17:52 - 2016-05-18 17:54 - 00000000 ____D C:\FRST
2016-05-18 17:52 - 2016-05-18 17:52 - 02382336 _____ (Farbar) C:\Users\Dexter\Downloads\FRST64.exe
2016-05-18 17:21 - 2016-05-18 17:21 - 05659526 _____ (Swearware) C:\Users\Dexter\Downloads\ComboFix.exe
2016-05-18 17:19 - 2016-05-18 17:19 - 00060136 ____N (DotC United Inc) C:\WINDOWS\system32\Drivers\MPCKpt.sys
2016-05-18 17:06 - 2016-05-18 17:51 - 00000000 ____D C:\Users\Dexter\AppData\Local\Google
2016-05-18 16:59 - 2016-05-18 16:59 - 00002354 _____ C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Google Chrome.lnk
2016-05-18 16:59 - 2016-05-18 16:59 - 00002342 _____ C:\Users\Public\Desktop\Google Chrome.lnk
2016-05-18 16:58 - 2016-05-18 16:59 - 00987728 _____ (Google Inc.) C:\Users\Dexter\Downloads\ChromeSetup.exe
2016-05-18 16:43 - 2016-05-18 16:43 - 00001257 _____ C:\Users\Public\Desktop\IObit Unlocker.lnk
2016-05-18 16:43 - 2016-05-18 16:43 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\IObit Unlocker
2016-05-18 16:43 - 2016-05-18 16:43 - 00000000 ____D C:\ProgramData\IObit
2016-05-18 16:43 - 2016-05-18 16:43 - 00000000 ____D C:\Program Files (x86)\IObit
2016-05-18 16:42 - 2016-05-18 16:42 - 02451912 _____ (IObit ) C:\Users\Dexter\Downloads\unlocker-setup.exe
2016-05-18 16:30 - 2016-05-18 16:30 - 00000214 _____ C:\WINDOWS\Tasks\CreateExplorerShellUnelevatedTask.job
2016-05-18 16:29 - 2016-05-18 16:30 - 00176256 _____ C:\WINDOWS\ntbtlog.txt
2016-05-18 15:34 - 2016-05-18 15:34 - 03651136 _____ C:\Users\Dexter\Desktop\adwcleaner_5.117.exe
2016-05-18 15:34 - 2016-05-18 15:34 - 00002100 _____ C:\Users\Public\Desktop\ESET Ochrona bankowości internetowej.lnk
2016-05-18 15:34 - 2016-05-18 15:34 - 00000000 ____D C:\Users\Dexter\AppData\Local\ESET
2016-05-18 15:34 - 2016-05-18 15:34 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\ESET
2016-05-18 15:34 - 2016-05-18 15:34 - 00000000 ____D C:\ProgramData\ESET
2016-05-18 15:34 - 2016-05-18 15:34 - 00000000 ____D C:\Program Files\ESET
2016-05-18 15:31 - 2016-05-18 15:32 - 03017376 _____ (ESET) C:\Users\Dexter\Desktop\eset_smart_security_live_installer.exe
2016-05-18 15:25 - 2016-05-18 15:40 - 00000000 ____D C:\Users\Dexter\AppData\Local\app
2016-05-18 15:24 - 2016-05-18 15:55 - 00000000 ____D C:\Program Files (x86)\MPC Cleaner
2016-05-18 15:24 - 2016-05-18 15:24 - 00008944 _____ C:\WINDOWS\System32\Tasks\Ckigtsakile Community
2016-05-18 15:24 - 2016-05-18 15:24 - 00000000 ____D C:\Users\Public\Thunder Network
2016-05-18 15:24 - 2016-05-18 15:24 - 00000000 ____D C:\ProgramData\Thunder Network
2016-05-18 15:22 - 2016-05-18 15:21 - 00001006 _____ C:\WINDOWS\system32\Drivers\etc\hp.bak
2016-05-17 21:41 - 2016-05-17 22:11 - 00000000 ____D C:\Users\Dexter\Desktop\asd
2016-05-17 20:11 - 2016-05-17 20:11 - 00007874 _____ C:\Users\Dexter\AppData\Local\recently-used.xbel
2016-05-17 11:13 - 2016-05-17 11:13 - 00137492 _____ C:\Users\Dexter\Desktop\ćw1.pdf
2016-05-17 11:04 - 2016-05-17 11:04 - 00283570 _____ C:\Users\Dexter\Desktop\ćw2remake.pdf
2016-05-17 10:51 - 2016-05-17 10:51 - 01214862 _____ C:\Users\Dexter\Downloads\Stale, staliwa i żeliwa.pdf
2016-05-16 21:57 - 2016-05-16 21:57 - 00271008 _____ C:\Users\Dexter\Desktop\kompozyt1.pdf
2016-05-15 22:19 - 2016-05-15 22:19 - 00073916 _____ C:\Users\Dexter\Downloads\laser.cmbl
2016-05-15 20:30 - 2016-05-15 20:30 - 00027273 _____ C:\Users\Dexter\Downloads\spieki.odt
2016-05-15 19:36 - 2016-05-15 19:37 - 00000000 ____D C:\Users\Dexter\Desktop\Zdj
2016-05-11 21:49 - 2016-05-11 21:49 - 00000000 ____D C:\Users\Dexter\AppData\Roaming\Steam
2016-05-11 21:47 - 2016-05-11 21:47 - 10766364 _____ C:\Users\Dexter\Downloads\sltrupd101htfx.rar
2016-05-11 14:01 - 2016-05-17 20:18 - 00000000 ____D C:\Users\Dexter\Desktop\Twitch
2016-05-10 21:47 - 2016-04-30 08:31 - 03591168 _____ (Microsoft Corporation) C:\WINDOWS\system32\win32kfull.sys
2016-05-10 21:47 - 2016-04-23 08:12 - 01401024 _____ (Microsoft Corporation) C:\WINDOWS\system32\appraiser.dll
2016-05-10 21:47 - 2016-04-23 08:12 - 01184960 _____ (Microsoft Corporation) C:\WINDOWS\system32\aeinv.dll
2016-05-10 21:47 - 2016-04-23 08:12 - 00713920 _____ (Microsoft Corporation) C:\WINDOWS\system32\generaltel.dll
2016-05-10 21:47 - 2016-04-23 08:12 - 00514752 _____ (Microsoft Corporation) C:\WINDOWS\system32\devinv.dll
2016-05-10 21:47 - 2016-04-23 08:12 - 00190144 _____ (Microsoft Corporation) C:\WINDOWS\system32\DeviceCensus.exe
2016-05-10 21:47 - 2016-04-23 08:12 - 00046784 _____ (Microsoft Corporation) C:\WINDOWS\system32\CompatTelRunner.exe
2016-05-10 21:47 - 2016-04-23 07:28 - 01557768 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\KernelBase.dll
2016-05-10 21:47 - 2016-04-23 07:28 - 01542816 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\ntdll.dll
2016-05-10 21:47 - 2016-04-23 07:24 - 07474528 _____ (Microsoft Corporation) C:\WINDOWS\system32\ntoskrnl.exe
2016-05-10 21:47 - 2016-04-23 07:24 - 01997328 _____ (Microsoft Corporation) C:\WINDOWS\system32\KernelBase.dll
2016-05-10 21:47 - 2016-04-23 07:24 - 01819208 _____ (Microsoft Corporation) C:\WINDOWS\system32\ntdll.dll
2016-05-10 21:47 - 2016-04-23 07:12 - 00925064 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\mfplat.dll
2016-05-10 21:47 - 2016-04-23 07:11 - 01092464 _____ (Microsoft Corporation) C:\WINDOWS\system32\mfplat.dll
2016-05-10 21:47 - 2016-04-23 07:11 - 00498960 _____ (Microsoft Corporation) C:\WINDOWS\system32\MFCaptureEngine.dll
2016-05-10 21:47 - 2016-04-23 07:10 - 03673424 _____ (Microsoft Corporation) C:\WINDOWS\system32\iertutil.dll
2016-05-10 21:47 - 2016-04-23 07:10 - 02919832 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\iertutil.dll
2016-05-10 21:47 - 2016-04-23 07:09 - 22561256 _____ (Microsoft Corporation) C:\WINDOWS\system32\shell32.dll
2016-05-10 21:47 - 2016-04-23 07:09 - 21123320 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\shell32.dll
2016-05-10 21:47 - 2016-04-23 07:09 - 05240960 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\windows.storage.dll
2016-05-10 21:47 - 2016-04-23 07:09 - 04074160 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\explorer.exe
2016-05-10 21:47 - 2016-04-23 07:08 - 06605504 _____ (Microsoft Corporation) C:\WINDOWS\system32\windows.storage.dll
2016-05-10 21:47 - 2016-04-23 07:08 - 04515256 _____ (Microsoft Corporation) C:\WINDOWS\explorer.exe
2016-05-10 21:47 - 2016-04-23 07:01 - 01996640 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\dxgkrnl.sys
2016-05-10 21:47 - 2016-04-23 07:01 - 00650304 _____ (Microsoft Corporation) C:\WINDOWS\system32\dxgi.dll
2016-05-10 21:47 - 2016-04-23 07:01 - 00522176 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\dxgi.dll
2016-05-10 21:47 - 2016-04-23 06:39 - 00089088 _____ (Microsoft Corporation) C:\WINDOWS\system32\MapsCSP.dll
2016-05-10 21:47 - 2016-04-23 06:32 - 00028672 _____ (Microsoft Corporation) C:\WINDOWS\system32\mapsupdatetask.dll
2016-05-10 21:47 - 2016-04-23 06:31 - 13018112 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\Windows.UI.Xaml.dll
2016-05-10 21:47 - 2016-04-23 06:31 - 00074752 _____ (Microsoft Corporation) C:\WINDOWS\system32\MosStorage.dll
2016-05-10 21:47 - 2016-04-23 06:30 - 22379008 _____ (Microsoft Corporation) C:\WINDOWS\system32\edgehtml.dll
2016-05-10 21:47 - 2016-04-23 06:30 - 00120320 _____ (Microsoft Corporation) C:\WINDOWS\system32\MapsBtSvc.dll
2016-05-10 21:47 - 2016-04-23 06:29 - 00072704 _____ (Microsoft Corporation) C:\WINDOWS\system32\moshost.dll
2016-05-10 21:47 - 2016-04-23 06:28 - 16984576 _____ (Microsoft Corporation) C:\WINDOWS\system32\Windows.UI.Xaml.dll
2016-05-10 21:47 - 2016-04-23 06:26 - 00269824 _____ (Microsoft Corporation) C:\WINDOWS\system32\moshostcore.dll
2016-05-10 21:47 - 2016-04-23 06:26 - 00059904 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\MosStorage.dll
2016-05-10 21:47 - 2016-04-23 06:25 - 00087040 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\MapsBtSvc.dll
2016-05-10 21:47 - 2016-04-23 06:23 - 11545088 _____ (Microsoft Corporation) C:\WINDOWS\system32\twinui.dll
2016-05-10 21:47 - 2016-04-23 06:22 - 09918976 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\twinui.dll
2016-05-10 21:47 - 2016-04-23 06:22 - 00460800 _____ (Microsoft Corporation) C:\WINDOWS\system32\MapConfiguration.dll
2016-05-10 21:47 - 2016-04-23 06:20 - 19344384 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\mshtml.dll
2016-05-10 21:47 - 2016-04-23 06:20 - 18676224 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\edgehtml.dll
2016-05-10 21:47 - 2016-04-23 06:20 - 00606720 _____ (Microsoft Corporation) C:\WINDOWS\system32\wcmsvc.dll
2016-05-10 21:47 - 2016-04-23 06:19 - 07977472 _____ (Microsoft Corporation) C:\WINDOWS\system32\mos.dll
2016-05-10 21:47 - 2016-04-23 06:19 - 01056256 _____ (Microsoft Corporation) C:\WINDOWS\system32\JpMapControl.dll
2016-05-10 21:47 - 2016-04-23 06:19 - 00970752 _____ (Microsoft Corporation) C:\WINDOWS\system32\kerberos.dll
2016-05-10 21:47 - 2016-04-23 06:19 - 00853504 _____ (Microsoft Corporation) C:\WINDOWS\system32\MapsStore.dll
2016-05-10 21:47 - 2016-04-23 06:19 - 00440320 _____ (Microsoft Corporation) C:\WINDOWS\system32\CredProvDataModel.dll
2016-05-10 21:47 - 2016-04-23 06:18 - 24604672 _____ (Microsoft Corporation) C:\WINDOWS\system32\mshtml.dll
2016-05-10 21:47 - 2016-04-23 06:18 - 00988160 _____ (Microsoft Corporation) C:\WINDOWS\system32\NMAA.dll
2016-05-10 21:47 - 2016-04-23 06:18 - 00939520 _____ (Microsoft Corporation) C:\WINDOWS\system32\MapControlCore.dll
2016-05-10 21:47 - 2016-04-23 06:18 - 00870400 _____ (Microsoft Corporation) C:\WINDOWS\system32\modernexecserver.dll
2016-05-10 21:47 - 2016-04-23 06:18 - 00585728 _____ (Microsoft Corporation) C:\WINDOWS\system32\winlogon.exe
2016-05-10 21:47 - 2016-04-23 06:18 - 00349696 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\MapConfiguration.dll
2016-05-10 21:47 - 2016-04-23 06:17 - 00529920 _____ (Microsoft Corporation) C:\WINDOWS\system32\LogonController.dll
2016-05-10 21:47 - 2016-04-23 06:16 - 01319424 _____ (Microsoft Corporation) C:\WINDOWS\system32\wifinetworkmanager.dll
2016-05-10 21:47 - 2016-04-23 06:16 - 00800768 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\JpMapControl.dll
2016-05-10 21:47 - 2016-04-23 06:15 - 00792064 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\kerberos.dll
2016-05-10 21:47 - 2016-04-23 06:15 - 00784896 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\NMAA.dll
2016-05-10 21:47 - 2016-04-23 06:15 - 00673280 _____ (Microsoft Corporation) C:\WINDOWS\system32\Windows.UI.dll
2016-05-10 21:47 - 2016-04-23 06:15 - 00348672 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\CredProvDataModel.dll
2016-05-10 21:47 - 2016-04-23 06:14 - 13383168 _____ (Microsoft Corporation) C:\WINDOWS\system32\ieframe.dll
2016-05-10 21:47 - 2016-04-23 06:14 - 00870912 _____ (Microsoft Corporation) C:\WINDOWS\system32\MPSSVC.dll
2016-05-10 21:47 - 2016-04-23 06:14 - 00821760 _____ (Microsoft Corporation) C:\WINDOWS\system32\TokenBroker.dll
2016-05-10 21:47 - 2016-04-23 06:14 - 00711680 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\MapControlCore.dll
2016-05-10 21:47 - 2016-04-23 06:13 - 07200256 _____ (Microsoft Corporation) C:\WINDOWS\system32\BingMaps.dll
2016-05-10 21:47 - 2016-04-23 06:13 - 06295552 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\mos.dll
2016-05-10 21:47 - 2016-04-23 06:10 - 12125696 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\ieframe.dll
2016-05-10 21:47 - 2016-04-23 06:10 - 00639488 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\TokenBroker.dll
2016-05-10 21:47 - 2016-04-23 06:09 - 03666432 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\jscript9.dll
2016-05-10 21:47 - 2016-04-23 06:09 - 02582016 _____ (Microsoft Corporation) C:\WINDOWS\system32\MFMediaEngine.dll
2016-05-10 21:47 - 2016-04-23 06:08 - 05324288 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\Windows.Data.Pdf.dll
2016-05-10 21:47 - 2016-04-23 06:08 - 02061824 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\MFMediaEngine.dll
2016-05-10 21:47 - 2016-04-23 06:07 - 05205504 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\BingMaps.dll
2016-05-10 21:47 - 2016-04-23 06:07 - 02598912 _____ (Microsoft Corporation) C:\WINDOWS\system32\NetworkMobileSettings.dll
2016-05-10 21:47 - 2016-04-23 06:07 - 01500160 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\urlmon.dll
2016-05-10 21:47 - 2016-04-23 06:06 - 06974464 _____ (Microsoft Corporation) C:\WINDOWS\system32\Windows.Data.Pdf.dll
2016-05-10 21:47 - 2016-04-23 06:05 - 05502976 _____ (Microsoft Corporation) C:\WINDOWS\system32\d2d1.dll
2016-05-10 21:47 - 2016-04-23 06:05 - 02166784 _____ (Microsoft Corporation) C:\WINDOWS\system32\AppXDeploymentServer.dll
2016-05-10 21:47 - 2016-04-23 06:05 - 02066432 _____ (Microsoft Corporation) C:\WINDOWS\system32\AppXDeploymentExtensions.dll
2016-05-10 21:47 - 2016-04-23 06:05 - 01946112 _____ (Microsoft Corporation) C:\WINDOWS\system32\dwmcore.dll
2016-05-10 21:47 - 2016-04-23 06:05 - 01626624 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\dwmcore.dll
2016-05-10 21:47 - 2016-04-23 06:04 - 04759040 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\d2d1.dll
2016-05-10 21:47 - 2016-04-23 06:04 - 01731072 _____ (Microsoft Corporation) C:\WINDOWS\system32\urlmon.dll
2016-05-10 21:47 - 2016-04-23 06:03 - 05660160 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\Chakra.dll
2016-05-10 21:47 - 2016-04-23 06:03 - 04894208 _____ (Microsoft Corporation) C:\WINDOWS\system32\jscript9.dll
2016-05-10 21:47 - 2016-04-23 06:03 - 02280960 _____ (Microsoft Corporation) C:\WINDOWS\system32\wuaueng.dll
2016-05-10 21:47 - 2016-04-23 06:03 - 02000896 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\twinui.appcore.dll
2016-05-10 21:47 - 2016-04-23 06:03 - 00754176 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\SettingSyncCore.dll
2016-05-10 21:47 - 2016-04-23 06:02 - 07832576 _____ (Microsoft Corporation) C:\WINDOWS\system32\Chakra.dll
2016-05-10 21:47 - 2016-04-23 06:02 - 02444288 _____ (Microsoft Corporation) C:\WINDOWS\system32\twinui.appcore.dll
2016-05-10 21:47 - 2016-04-23 06:00 - 00984576 _____ (Microsoft Corporation) C:\WINDOWS\system32\SettingSyncCore.dll
2016-05-10 21:46 - 2016-05-06 06:53 - 00095072 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\sdport.sys
2016-05-10 21:46 - 2016-05-06 06:05 - 00241664 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\cryptngc.dll
2016-05-10 21:46 - 2016-05-06 06:03 - 00649216 _____ (Microsoft Corporation) C:\WINDOWS\system32\ngcsvc.dll
2016-05-10 21:46 - 2016-05-06 05:53 - 00351232 _____ (Microsoft Corporation) C:\WINDOWS\system32\NgcCtnr.dll
2016-05-10 21:46 - 2016-05-06 05:49 - 00289792 _____ (Microsoft Corporation) C:\WINDOWS\system32\NgcCtnrSvc.dll
2016-05-10 21:46 - 2016-05-06 05:44 - 00582656 _____ (Microsoft Corporation) C:\WINDOWS\system32\ngccredprov.dll
2016-05-10 21:46 - 2016-05-06 05:43 - 00320000 _____ (Microsoft Corporation) C:\WINDOWS\system32\cryptngc.dll
2016-05-10 21:46 - 2016-05-06 05:23 - 00076288 _____ (Microsoft Corporation) C:\WINDOWS\system32\ngcpopkeysrv.dll
2016-05-10 21:46 - 2016-04-30 08:42 - 01387520 _____ (Microsoft Corporation) C:\WINDOWS\system32\win32kbase.sys
2016-05-10 21:46 - 2016-04-23 08:12 - 00294592 _____ (Microsoft Corporation) C:\WINDOWS\system32\invagent.dll
2016-05-10 21:46 - 2016-04-23 08:12 - 00092352 _____ (Microsoft Corporation) C:\WINDOWS\system32\acmigration.dll
2016-05-10 21:46 - 2016-04-23 07:26 - 00707608 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\rpcrt4.dll
2016-05-10 21:46 - 2016-04-23 07:24 - 00754664 _____ (Microsoft Corporation) C:\WINDOWS\system32\CoreMessaging.dll
2016-05-10 21:46 - 2016-04-23 07:24 - 00638816 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\fvevol.sys
2016-05-10 21:46 - 2016-04-23 07:24 - 00335712 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\fastfat.sys
2016-05-10 21:46 - 2016-04-23 07:24 - 00099680 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\pdc.sys
2016-05-10 21:46 - 2016-04-23 07:22 - 01161120 _____ (Microsoft Corporation) C:\WINDOWS\system32\rpcrt4.dll
2016-05-10 21:46 - 2016-04-23 07:18 - 00026408 _____ (Microsoft Corporation) C:\WINDOWS\system32\wuauclt.exe
2016-05-10 21:46 - 2016-04-23 07:13 - 00502104 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\NetSetupEngine.dll
2016-05-10 21:46 - 2016-04-23 07:13 - 00306832 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\wlanapi.dll
2016-05-10 21:46 - 2016-04-23 07:13 - 00084832 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\NetSetupApi.dll
2016-05-10 21:46 - 2016-04-23 07:12 - 00451928 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\MFCaptureEngine.dll
2016-05-10 21:46 - 2016-04-23 07:12 - 00413536 _____ (Microsoft Corporation) C:\WINDOWS\system32\wifitask.exe
2016-05-10 21:46 - 2016-04-23 07:11 - 00696672 _____ (Microsoft Corporation) C:\WINDOWS\system32\NetSetupEngine.dll
2016-05-10 21:46 - 2016-04-23 07:11 - 00390496 _____ (Microsoft Corporation) C:\WINDOWS\system32\wlanapi.dll
2016-05-10 21:46 - 2016-04-23 07:11 - 00131424 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\ufxsynopsys.sys
2016-05-10 21:46 - 2016-04-23 07:11 - 00115040 _____ (Microsoft Corporation) C:\WINDOWS\system32\NetSetupApi.dll
2016-05-10 21:46 - 2016-04-23 07:10 - 00330072 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\pci.sys
2016-05-10 21:46 - 2016-04-23 07:09 - 00569744 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\SHCore.dll
2016-05-10 21:46 - 2016-04-23 07:09 - 00565600 _____ (Microsoft Corporation) C:\WINDOWS\system32\SettingSyncHost.exe
2016-05-10 21:46 - 2016-04-23 07:09 - 00465760 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\SettingSyncHost.exe
2016-05-10 21:46 - 2016-04-23 07:09 - 00303216 _____ (Microsoft Corporation) C:\WINDOWS\system32\LockAppHost.exe
2016-05-10 21:46 - 2016-04-23 07:09 - 00255168 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\LockAppHost.exe
2016-05-10 21:46 - 2016-04-23 07:08 - 00725776 _____ (Microsoft Corporation) C:\WINDOWS\system32\SHCore.dll
2016-05-10 21:46 - 2016-04-23 07:07 - 01848072 _____ (Microsoft Corporation) C:\WINDOWS\system32\crypt32.dll
2016-05-10 21:46 - 2016-04-23 07:07 - 01536088 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\crypt32.dll
2016-05-10 21:46 - 2016-04-23 07:07 - 00204048 _____ (Microsoft Corporation) C:\WINDOWS\system32\rsaenh.dll
2016-05-10 21:46 - 2016-04-23 07:07 - 00183904 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\rsaenh.dll
2016-05-10 21:46 - 2016-04-23 07:06 - 00291360 _____ (Microsoft Corporation) C:\WINDOWS\system32\wininit.exe
2016-05-10 21:46 - 2016-04-23 07:02 - 00188256 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\AppxAllUserStore.dll
2016-05-10 21:46 - 2016-04-23 07:01 - 00619296 _____ (Microsoft Corporation) C:\WINDOWS\system32\d3d10level9.dll
2016-05-10 21:46 - 2016-04-23 07:01 - 00577368 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\dxgmms2.sys
2016-05-10 21:46 - 2016-04-23 07:01 - 00513368 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\d3d10level9.dll
2016-05-10 21:46 - 2016-04-23 07:01 - 00393568 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\dxgmms1.sys
2016-05-10 21:46 - 2016-04-23 07:01 - 00217440 _____ (Microsoft Corporation) C:\WINDOWS\system32\AppxAllUserStore.dll
2016-05-10 21:46 - 2016-04-23 07:00 - 01776768 _____ (Microsoft Corporation) C:\WINDOWS\system32\WindowsCodecs.dll
2016-05-10 21:46 - 2016-04-23 07:00 - 01594920 _____ (Microsoft Corporation) C:\WINDOWS\system32\gdi32.dll
2016-05-10 21:46 - 2016-04-23 07:00 - 01522152 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\WindowsCodecs.dll
2016-05-10 21:46 - 2016-04-23 07:00 - 01399224 _____ (Microsoft Corporation) C:\WINDOWS\system32\user32.dll
2016-05-10 21:46 - 2016-04-23 07:00 - 01372304 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\gdi32.dll
2016-05-10 21:46 - 2016-04-23 07:00 - 01337240 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\user32.dll
2016-05-10 21:46 - 2016-04-23 07:00 - 00550656 _____ (Microsoft Corporation) C:\WINDOWS\system32\directmanipulation.dll
2016-05-10 21:46 - 2016-04-23 07:00 - 00453472 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\directmanipulation.dll
2016-05-10 21:46 - 2016-04-23 07:00 - 00058208 _____ (Microsoft Corporation) C:\WINDOWS\system32\dwminit.dll
2016-05-10 21:46 - 2016-04-23 06:56 - 00534872 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\USBHUB3.SYS
2016-05-10 21:46 - 2016-04-23 06:35 - 00066560 _____ (Microsoft Corporation) C:\WINDOWS\system32\MosHostClient.dll
2016-05-10 21:46 - 2016-04-23 06:34 - 00067072 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\usbser.sys
2016-05-10 21:46 - 2016-04-23 06:34 - 00059392 _____ (Microsoft Corporation) C:\WINDOWS\system32\hmkd.dll
2016-05-10 21:46 - 2016-04-23 06:34 - 00048128 _____ (Microsoft Corporation) C:\WINDOWS\system32\wups.dll
2016-05-10 21:46 - 2016-04-23 06:33 - 00089600 _____ (Microsoft Corporation) C:\WINDOWS\system32\NFCProvisioningPlugin.dll
2016-05-10 21:46 - 2016-04-23 06:33 - 00063488 _____ (Microsoft Corporation) C:\WINDOWS\system32\wshbth.dll
2016-05-10 21:46 - 2016-04-23 06:33 - 00063488 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\UcmCx.sys
2016-05-10 21:46 - 2016-04-23 06:33 - 00038400 _____ (Microsoft Corporation) C:\WINDOWS\system32\ByteCodeGenerator.exe
2016-05-10 21:46 - 2016-04-23 06:32 - 00134656 _____ (Microsoft Corporation) C:\WINDOWS\system32\wificonnapi.dll
2016-05-10 21:46 - 2016-04-23 06:32 - 00069632 _____ (Microsoft Corporation) C:\WINDOWS\system32\EnterpriseDesktopAppMgmtCSP.dll
2016-05-10 21:46 - 2016-04-23 06:30 - 00050176 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\MosHostClient.dll
2016-05-10 21:46 - 2016-04-23 06:29 - 00192000 _____ (Microsoft Corporation) C:\WINDOWS\system32\provisioningcsp.dll
2016-05-10 21:46 - 2016-04-23 06:29 - 00151040 _____ (Microsoft Corporation) C:\WINDOWS\system32\VEStoreEventHandlers.dll
2016-05-10 21:46 - 2016-04-23 06:29 - 00087552 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\filecrypt.sys
2016-05-10 21:46 - 2016-04-23 06:29 - 00087040 _____ (Microsoft Corporation) C:\WINDOWS\system32\MDMAppInstaller.exe
2016-05-10 21:46 - 2016-04-23 06:29 - 00047104 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\hmkd.dll
2016-05-10 21:46 - 2016-04-23 06:29 - 00031232 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\ByteCodeGenerator.exe
2016-05-10 21:46 - 2016-04-23 06:29 - 00023552 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\wups.dll
2016-05-10 21:46 - 2016-04-23 06:28 - 00130560 _____ (Microsoft Corporation) C:\WINDOWS\system32\CloudDomainJoinDataModelServer.dll
2016-05-10 21:46 - 2016-04-23 06:28 - 00127488 _____ (Microsoft Corporation) C:\WINDOWS\system32\VEDataLayerHelpers.dll
2016-05-10 21:46 - 2016-04-23 06:28 - 00104448 _____ (Microsoft Corporation) C:\WINDOWS\system32\BluetoothApis.dll
2016-05-10 21:46 - 2016-04-23 06:28 - 00086528 _____ (Microsoft Corporation) C:\WINDOWS\system32\AppCapture.dll
2016-05-10 21:46 - 2016-04-23 06:28 - 00051712 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\wshbth.dll
2016-05-10 21:46 - 2016-04-23 06:27 - 00155136 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\hidclass.sys
2016-05-10 21:46 - 2016-04-23 06:27 - 00039424 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\wfdprov.dll
2016-05-10 21:46 - 2016-04-23 06:26 - 00086528 _____ (Microsoft Corporation) C:\WINDOWS\system32\wpdbusenum.dll
2016-05-10 21:46 - 2016-04-23 06:25 - 00630784 _____ (Microsoft Corporation) C:\WINDOWS\system32\PhoneProviders.dll
2016-05-10 21:46 - 2016-04-23 06:25 - 00617984 _____ (Microsoft Corporation) C:\WINDOWS\system32\StorSvc.dll
2016-05-10 21:46 - 2016-04-23 06:25 - 00210432 _____ (Microsoft Corporation) C:\WINDOWS\system32\wcmcsp.dll
2016-05-10 21:46 - 2016-04-23 06:25 - 00207360 _____ (Microsoft Corporation) C:\WINDOWS\system32\NetSetupSvc.dll
2016-05-10 21:46 - 2016-04-23 06:24 - 00764928 _____ (Microsoft Corporation) C:\WINDOWS\system32\Chakradiag.dll
2016-05-10 21:46 - 2016-04-23 06:24 - 00689152 _____ (Microsoft Corporation) C:\WINDOWS\system32\ieproxy.dll
2016-05-10 21:46 - 2016-04-23 06:24 - 00292864 _____ (Microsoft Corporation) C:\WINDOWS\system32\provengine.dll
2016-05-10 21:46 - 2016-04-23 06:24 - 00287232 _____ (Microsoft Corporation) C:\WINDOWS\system32\provhandlers.dll
2016-05-10 21:46 - 2016-04-23 06:24 - 00181248 _____ (Microsoft Corporation) C:\WINDOWS\system32\shacct.dll
2016-05-10 21:46 - 2016-04-23 06:24 - 00166400 _____ (Microsoft Corporation) C:\WINDOWS\system32\SubscriptionMgr.dll
2016-05-10 21:46 - 2016-04-23 06:24 - 00084480 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\VEDataLayerHelpers.dll
2016-05-10 21:46 - 2016-04-23 06:23 - 00414720 _____ (Microsoft Corporation) C:\WINDOWS\system32\bcastdvr.exe
2016-05-10 21:46 - 2016-04-23 06:23 - 00279040 _____ (Microsoft Corporation) C:\WINDOWS\system32\ListSvc.dll
2016-05-10 21:46 - 2016-04-23 06:23 - 00179712 _____ (Microsoft Corporation) C:\WINDOWS\system32\BrowserSettingSync.dll
2016-05-10 21:46 - 2016-04-23 06:23 - 00080896 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\BluetoothApis.dll
2016-05-10 21:46 - 2016-04-23 06:22 - 00285696 _____ (Microsoft Corporation) C:\WINDOWS\system32\VEEventDispatcher.dll
2016-05-10 21:46 - 2016-04-23 06:21 - 00479232 _____ (Microsoft Corporation) C:\WINDOWS\system32\schannel.dll
2016-05-10 21:46 - 2016-04-23 06:21 - 00314880 _____ (Microsoft Corporation) C:\WINDOWS\system32\RDXTaskFactory.dll
2016-05-10 21:46 - 2016-04-23 06:20 - 00497152 _____ (Microsoft Corporation) C:\WINDOWS\system32\tileobjserver.dll
2016-05-10 21:46 - 2016-04-23 06:20 - 00484352 _____ (Microsoft Corporation) C:\WINDOWS\system32\DataSenseHandlers.dll
2016-05-10 21:46 - 2016-04-23 06:20 - 00356864 _____ (Microsoft Corporation) C:\WINDOWS\system32\ActivationManager.dll
2016-05-10 21:46 - 2016-04-23 06:20 - 00307200 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\ieproxy.dll
2016-05-10 21:46 - 2016-04-23 06:20 - 00137728 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\shacct.dll
2016-05-10 21:46 - 2016-04-23 06:19 - 00395264 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\wlansec.dll
2016-05-10 21:46 - 2016-04-23 06:19 - 00140800 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\BrowserSettingSync.dll
2016-05-10 21:46 - 2016-04-23 06:18 - 00988672 _____ (Microsoft Corporation) C:\WINDOWS\system32\SharedStartModel.dll
2016-05-10 21:46 - 2016-04-23 06:18 - 00804352 _____ (Microsoft Corporation) C:\WINDOWS\system32\jscript.dll
2016-05-10 21:46 - 2016-04-23 06:18 - 00605184 _____ (Microsoft Corporation) C:\WINDOWS\system32\vbscript.dll
2016-05-10 21:46 - 2016-04-23 06:18 - 00515072 _____ (Microsoft Corporation) C:\WINDOWS\system32\OneDriveSettingSyncProvider.dll
2016-05-10 21:46 - 2016-04-23 06:18 - 00471552 _____ (Microsoft Corporation) C:\WINDOWS\system32\NetSetupShim.dll
2016-05-10 21:46 - 2016-04-23 06:18 - 00436736 _____ (Microsoft Corporation) C:\WINDOWS\system32\AppXDeploymentClient.dll
2016-05-10 21:46 - 2016-04-23 06:18 - 00219648 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\VEEventDispatcher.dll
2016-05-10 21:46 - 2016-04-23 06:17 - 01213440 _____ (Microsoft Corporation) C:\WINDOWS\system32\wwansvc.dll
2016-05-10 21:46 - 2016-04-23 06:17 - 00388608 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\schannel.dll
2016-05-10 21:46 - 2016-04-23 06:17 - 00337920 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\wlanmsm.dll
2016-05-10 21:46 - 2016-04-23 06:16 - 00848896 _____ (Microsoft Corporation) C:\WINDOWS\system32\wuapi.dll
2016-05-10 21:46 - 2016-04-23 06:15 - 01073152 _____ (Microsoft Corporation) C:\WINDOWS\system32\RDXService.dll
2016-05-10 21:46 - 2016-04-23 06:15 - 00865792 _____ (Microsoft Corporation) C:\WINDOWS\system32\AzureSettingSyncProvider.dll
2016-05-10 21:46 - 2016-04-23 06:15 - 00400896 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\OneDriveSettingSyncProvider.dll
2016-05-10 21:46 - 2016-04-23 06:14 - 00647680 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\jscript.dll
2016-05-10 21:46 - 2016-04-23 06:14 - 00503296 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\vbscript.dll
2016-05-10 21:46 - 2016-04-23 06:14 - 00354304 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\NetSetupShim.dll
2016-05-10 21:46 - 2016-04-23 06:14 - 00342528 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\AppXDeploymentClient.dll
2016-05-10 21:46 - 2016-04-23 06:13 - 00705536 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\wuapi.dll
2016-05-10 21:46 - 2016-04-23 06:13 - 00489984 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\Windows.UI.dll
2016-05-10 21:46 - 2016-04-23 06:13 - 00434688 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\LogonController.dll
2016-05-10 21:46 - 2016-04-23 06:12 - 00667648 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\AzureSettingSyncProvider.dll
2016-05-10 21:46 - 2016-04-23 06:07 - 00848896 _____ (Microsoft Corporation) C:\WINDOWS\system32\samsrv.dll
2016-05-10 21:46 - 2016-04-23 06:05 - 00613376 _____ (Microsoft Corporation) C:\WINDOWS\system32\SettingSync.dll
2016-05-10 21:46 - 2016-04-23 06:05 - 00111616 _____ (Microsoft Corporation) C:\WINDOWS\system32\updatepolicy.dll
2016-05-10 21:46 - 2016-04-23 06:05 - 00103936 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\updatepolicy.dll
2016-05-10 21:46 - 2016-04-23 06:03 - 02193408 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\actxprxy.dll
2016-05-10 21:46 - 2016-04-23 06:03 - 00503296 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\SettingSync.dll
2016-05-10 21:46 - 2016-04-23 06:01 - 04775424 _____ (Microsoft Corporation) C:\WINDOWS\system32\actxprxy.dll
2016-05-10 21:46 - 2016-04-23 06:00 - 01390080 _____ (Microsoft Corporation) C:\WINDOWS\system32\Windows.UI.Shell.dll
2016-05-10 21:46 - 2016-04-23 05:45 - 00461824 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\CoreMessaging.dll
2016-05-10 21:46 - 2016-04-23 04:10 - 00215040 _____ (Microsoft Corporation) C:\WINDOWS\system32\aepic.dll
2016-05-10 21:46 - 2016-04-23 04:10 - 00002186 _____ C:\WINDOWS\system32\AppxProvisioning.xml
2016-05-10 21:46 - 2016-04-19 00:30 - 00002186 _____ C:\WINDOWS\SysWOW64\AppxProvisioning.xml
2016-05-10 19:57 - 2016-05-10 19:57 - 00214988 _____ C:\WINDOWS\Minidump\051016-10453-01.dmp
2016-05-10 19:53 - 2016-05-10 19:53 - 00221468 _____ C:\WINDOWS\Minidump\051016-6015-01.dmp
2016-05-10 18:15 - 2016-05-10 18:15 - 00000765 _____ C:\Users\Dexter\Desktop\Stellaris.lnk
2016-05-10 18:15 - 2016-05-10 18:15 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Stellaris
2016-05-10 18:13 - 2016-05-10 18:13 - 00000000 ____D C:\Games
2016-05-10 17:42 - 2016-05-10 17:42 - 02870984 _____ (ESET) C:\Users\Dexter\Downloads\esetsmartinstaller_plk.exe
2016-05-09 20:22 - 2016-05-09 20:53 - 00000000 ____D C:\Users\Dexter\Desktop\1
2016-05-08 23:32 - 2016-05-08 23:32 - 00271643 _____ C:\Users\Dexter\Downloads\miska.pdf
2016-05-08 23:31 - 2016-05-08 23:31 - 00271643 _____ C:\Users\Dexter\Desktop\miska.pdf
2016-05-08 22:24 - 2016-05-08 22:24 - 00074213 _____ C:\Users\Dexter\Downloads\metoda studenta najmniejsze kwadraty.pdf
2016-05-08 19:33 - 2016-05-08 19:33 - 02843136 _____ C:\Users\Dexter\Downloads\ODLEWNICTWO.ppt
2016-05-08 19:09 - 2016-05-08 19:09 - 25429021 _____ C:\Users\Dexter\Downloads\LPS2016_win.zip
2016-05-08 19:09 - 2016-05-08 19:09 - 00000000 ____D C:\Users\Dexter\AppData\LocalLow\The21
2016-05-08 19:02 - 2016-05-08 19:02 - 00000292 _____ C:\Users\Dexter\Downloads\kek.txt
2016-05-08 18:29 - 2016-05-08 18:29 - 00143833 _____ C:\Users\Dexter\Downloads\ld_w11.pdf
2016-05-08 15:31 - 2016-05-08 15:31 - 00280530 _____ C:\Users\Dexter\Desktop\skan.jpeg
2016-05-08 12:43 - 2016-05-08 12:43 - 00092239 _____ C:\Users\Dexter\Desktop\Projekt miski olejowej w silniku.pdf
2016-05-08 12:02 - 2016-05-08 12:02 - 00104960 _____ C:\Users\Dexter\Downloads\MKiE- wstęp-15-16.ppt
2016-05-06 15:49 - 2016-05-06 15:49 - 00289648 _____ C:\Users\Dexter\Downloads\BD0.2.7Windows (2).zip
2016-05-05 16:21 - 2016-05-05 16:22 - 00000000 ____D C:\Users\Dexter\Documents\Overwatch
2016-05-05 16:21 - 2016-05-05 16:21 - 00000848 _____ C:\Users\Public\Desktop\Overwatch.lnk
2016-05-05 15:35 - 2016-05-05 15:35 - 00000000 ____D C:\Program Files (x86)\ESET
2016-04-28 15:57 - 2016-04-28 15:57 - 00000000 ____D C:\Users\Dexter\Documents\WB Games
2016-04-28 15:19 - 2016-05-18 15:40 - 00000913 _____ C:\Users\Dexter\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Start Tor Browser.lnk
2016-04-28 15:19 - 2016-05-18 15:40 - 00000865 _____ C:\Users\Dexter\Desktop\Start Tor Browser.lnk
2016-04-28 15:18 - 2016-05-18 15:40 - 00000000 ____D C:\Users\Dexter\Desktop\Tor Browser
2016-04-28 15:10 - 2016-04-28 15:10 - 00001247 _____ C:\Users\Dexter\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\AMD Radeon Settings.lnk
2016-04-28 15:08 - 2016-04-28 15:08 - 00004296 _____ C:\WINDOWS\System32\Tasks\AMD Updater
2016-04-28 15:08 - 2016-04-28 15:08 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\AMD Settings
2016-04-26 14:52 - 2016-04-26 14:52 - 00450216 _____ C:\Users\Dexter\Desktop\Spieki, ceramika kompozyty.pdf
2016-04-25 23:01 - 2016-04-25 23:01 - 03105404 _____ C:\Users\Dexter\Downloads\Biuletyn_2_2013.pdf
2016-04-25 20:01 - 2016-04-25 20:01 - 00936350 _____ C:\Users\Dexter\Downloads\Dozor_Techniczny_2014-3_Czystosc_wody_kotlowej_a_uszkodzenia_rur_w_rejonach_przewezen_na_lukach_oraz_odcinkach_pochylych.pdf
2016-04-24 20:53 - 2016-04-24 20:53 - 00000000 ____D C:\Users\Dexter\AppData\LocalLow\Temp
2016-04-24 19:08 - 2016-04-24 19:08 - 00000000 ___RD C:\Users\Dexter\Documents\Notes
2016-04-24 18:36 - 2016-04-24 18:36 - 00000000 ____D C:\Users\Dexter\AppData\Roaming\Notepad++
2016-04-24 18:36 - 2016-04-24 18:36 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Notepad++
2016-04-24 18:36 - 2016-04-24 18:36 - 00000000 ____D C:\Program Files (x86)\Notepad++
2016-04-24 18:30 - 2016-04-24 18:30 - 00000000 ____D C:\Users\Dexter\Desktop\c++
2016-04-24 18:20 - 2016-04-24 19:07 - 00000000 ____D C:\Users\Dexter\AppData\Roaming\CodeBlocks
2016-04-24 18:19 - 2016-04-24 18:20 - 00000000 ____D C:\Users\Dexter\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\CodeBlocks
2016-04-24 18:19 - 2016-04-24 18:20 - 00000000 ____D C:\Program Files (x86)\CodeBlocks
2016-04-24 18:19 - 2016-04-24 18:19 - 00001164 _____ C:\Users\Dexter\Desktop\CodeBlocks.lnk
2016-04-24 18:19 - 2016-04-24 18:19 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\CodeBlocks
2016-04-24 14:06 - 2016-04-24 14:06 - 00289648 _____ C:\Users\Dexter\Downloads\BD0.2.7Windows (1).zip
2016-04-24 12:46 - 2016-04-24 15:43 - 00019920 _____ C:\Users\Dexter\Downloads\mikrowele.cmbl
2016-04-24 11:33 - 2016-04-24 11:33 - 00000803 _____ C:\Users\Dexter\Desktop\lol.launcher — skrót .lnk
2016-04-23 18:48 - 2016-04-23 18:49 - 00000000 ____D C:\Users\Dexter\Documents\Mirrors Edge Catalyst Closed Beta
2016-04-23 17:38 - 2016-04-23 17:38 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Mirror's Edge™ Catalyst Closed Beta
2016-04-22 17:03 - 2016-04-22 17:17 - 00000000 ____D C:\Program Files (x86)\Origin Games
2016-04-22 17:02 - 2016-04-23 18:55 - 00000000 ____D C:\Users\Dexter\AppData\Roaming\Origin
2016-04-22 17:02 - 2016-04-22 18:24 - 00000000 ____D C:\Users\Dexter\AppData\Local\Origin
2016-04-22 17:01 - 2016-04-28 00:32 - 00000000 ____D C:\ProgramData\Origin
2016-04-22 17:01 - 2016-04-27 17:42 - 00000000 ____D C:\Program Files (x86)\Origin
2016-04-22 17:01 - 2016-04-23 18:48 - 00000000 ____D C:\ProgramData\Electronic Arts
2016-04-22 17:01 - 2016-04-22 17:01 - 00001052 _____ C:\Users\Public\Desktop\Origin.lnk
2016-04-22 17:01 - 2016-04-22 17:01 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Origin
2016-04-22 17:00 - 2016-04-22 17:00 - 31334856 _____ (Electronic Arts, Inc.) C:\Users\Dexter\Downloads\OriginThinSetup.exe
2016-04-21 21:46 - 2016-04-21 21:46 - 00067888 _____ C:\Users\Dexter\Downloads\Etykieta_Zwrot_14-dni_Sosnowiec.pdf
2016-04-21 17:49 - 2016-04-21 17:49 - 00013709 _____ C:\Users\Dexter\Downloads\cewki.ods
2016-04-20 18:21 - 2016-04-20 18:24 - 180152493 _____ C:\Users\Dexter\Downloads\Wydyma_zbiór_-2016-04-20.zip
2016-04-18 22:36 - 2016-04-18 22:36 - 00278037 _____ C:\Users\Dexter\Downloads\03100030481Cwiczenalaboratoryjnezmechaniki-cw4-.pdf
2016-04-18 22:34 - 2016-04-18 22:34 - 00361983 _____ C:\Users\Dexter\Downloads\03100030052Cwiczenalaboratoryjnezmechaniki-cw3-.pdf
 
==================== Jeden miesiąc - zmodyfikowane pliki i foldery ========
 
(Załączenie wejścia w fixlist spowoduje przeniesienie pliku/folderu.)
 
2016-05-18 17:30 - 2016-01-19 21:48 - 00000000 ____D C:\AdwCleaner
2016-05-18 17:24 - 2015-10-30 21:19 - 00817060 _____ C:\WINDOWS\system32\perfh015.dat
2016-05-18 17:24 - 2015-10-30 21:19 - 00157764 _____ C:\WINDOWS\system32\perfc015.dat
2016-05-18 17:24 - 2015-10-30 09:21 - 00000000 ____D C:\WINDOWS\INF
2016-05-18 17:24 - 2015-08-16 14:56 - 01845594 _____ C:\WINDOWS\system32\PerfStringBackup.INI
2016-05-18 17:20 - 2015-08-19 23:21 - 00000000 ____D C:\Users\Dexter\AppData\Roaming\Spotify
2016-05-18 17:20 - 2015-08-19 23:21 - 00000000 ____D C:\Users\Dexter\AppData\Local\Spotify
2016-05-18 17:19 - 2016-03-15 21:31 - 00000006 ____H C:\WINDOWS\Tasks\SA.DAT
2016-05-18 17:19 - 2015-10-30 08:28 - 00524288 ___SH C:\WINDOWS\system32\config\BBI
2016-05-18 17:19 - 2015-08-16 14:54 - 00001084 _____ C:\WINDOWS\Tasks\GoogleUpdateTaskMachineCore.job
2016-05-18 17:10 - 2015-08-16 14:54 - 00001088 _____ C:\WINDOWS\Tasks\GoogleUpdateTaskMachineUA.job
2016-05-18 17:05 - 2015-08-16 14:54 - 00004146 _____ C:\WINDOWS\System32\Tasks\GoogleUpdateTaskMachineUA
2016-05-18 17:05 - 2015-08-16 14:54 - 00003914 _____ C:\WINDOWS\System32\Tasks\GoogleUpdateTaskMachineCore
2016-05-18 16:59 - 2015-08-16 14:54 - 00000000 ____D C:\Program Files (x86)\Google
2016-05-18 16:58 - 2015-11-02 23:23 - 00000000 ____D C:\Users\Dexter\AppData\Local\Microsoft Help
2016-05-18 15:34 - 2015-10-30 09:24 - 00000000 ___HD C:\WINDOWS\ELAMBKUP
2016-05-18 15:26 - 2015-10-30 09:24 - 00000000 ___HD C:\Program Files\WindowsApps
2016-05-18 15:26 - 2015-10-30 09:24 - 00000000 ____D C:\WINDOWS\AppReadiness
2016-05-17 20:19 - 2015-12-12 12:00 - 00000000 ____D C:\Users\Dexter\Desktop\POLIBUDA
2016-05-17 20:11 - 2016-01-15 23:10 - 00000000 ____D C:\Users\Dexter\AppData\Local\gtk-2.0
2016-05-17 20:11 - 2016-01-15 23:03 - 00000000 ____D C:\Users\Dexter\.gimp-2.8
2016-05-15 19:49 - 2015-10-30 09:24 - 00000000 ____D C:\WINDOWS\system32\NDF
2016-05-15 10:11 - 2015-10-30 09:24 - 00000000 ____D C:\WINDOWS\rescache
2016-05-14 19:59 - 2015-10-30 09:11 - 00000000 ____D C:\WINDOWS\CbsTemp
2016-05-14 16:59 - 2015-08-16 16:13 - 00000000 ____D C:\Users\Dexter\AppData\Local\ElevatedDiagnostics
2016-05-13 17:06 - 2016-03-15 21:24 - 00000000 ____D C:\Users\Dexter
2016-05-12 23:37 - 2015-08-18 15:23 - 00000000 ____D C:\Users\Dexter\AppData\Local\Battle.net
2016-05-12 14:59 - 2015-08-16 14:51 - 00000000 __RHD C:\Users\Public\AccountPictures
2016-05-11 23:02 - 2015-10-30 21:23 - 00000000 ____D C:\Program Files\Windows Journal
2016-05-11 23:02 - 2015-10-30 09:24 - 00015703 _____ C:\WINDOWS\system32\OEMDefaultAssociations.xml
2016-05-11 23:02 - 2015-10-30 09:24 - 00000000 ____D C:\WINDOWS\system32\oobe
2016-05-11 23:02 - 2015-10-30 09:24 - 00000000 ____D C:\WINDOWS\system32\appraiser
2016-05-11 23:02 - 2015-10-30 09:24 - 00000000 ____D C:\WINDOWS\Provisioning
2016-05-11 23:02 - 2015-10-30 09:24 - 00000000 ____D C:\WINDOWS\bcastdvr
2016-05-11 21:57 - 2015-10-30 09:26 - 00829944 _____ (Adobe Systems Incorporated) C:\WINDOWS\SysWOW64\FlashPlayerApp.exe
2016-05-11 21:57 - 2015-10-30 09:26 - 00176632 _____ (Adobe Systems Incorporated) C:\WINDOWS\SysWOW64\FlashPlayerCPLApp.cpl
2016-05-11 16:43 - 2015-08-17 10:53 - 00000000 ____D C:\WINDOWS\system32\MRT
2016-05-11 16:40 - 2015-08-17 10:53 - 139319312 _____ (Microsoft Corporation) C:\WINDOWS\system32\MRT.exe
2016-05-11 15:31 - 2015-11-17 21:30 - 00000000 ____D C:\Program Files (x86)\Overwolf
2016-05-11 14:02 - 2015-12-26 22:47 - 00000000 ____D C:\Users\Dexter\Desktop\RANDOM C
2016-05-10 19:55 - 2016-03-26 13:40 - 00000000 ____D C:\WINDOWS\Minidump
2016-05-10 19:03 - 2015-08-17 15:14 - 00000000 ____D C:\Users\Dexter\Documents\Paradox Interactive
2016-05-10 18:13 - 2015-08-26 21:10 - 00000000 ____D C:\Users\Dexter\AppData\Roaming\uTorrent
2016-05-10 17:15 - 2015-08-16 16:26 - 00000000 ____D C:\Users\Dexter\AppData\Roaming\TS3Client
2016-05-09 09:20 - 2015-11-10 20:12 - 00000000 ____D C:\Users\Dexter\AppData\Roaming\discord
2016-05-08 15:31 - 2015-10-20 08:43 - 00000000 ___RD C:\Users\Dexter\Documents\Scanned Documents
2016-05-07 21:10 - 2016-01-21 23:01 - 00000000 ___RD C:\Program Files (x86)\Skype
2016-05-06 15:50 - 2016-02-24 17:37 - 00000000 ____D C:\Users\Dexter\AppData\Roaming\BetterDiscord
2016-05-06 15:44 - 2015-11-10 20:12 - 00002242 _____ C:\Users\Dexter\Desktop\Discord.lnk
2016-05-06 15:44 - 2015-11-10 20:12 - 00000000 ____D C:\Users\Dexter\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Hammer & Chisel, Inc
2016-05-06 15:44 - 2015-11-10 20:12 - 00000000 ____D C:\Users\Dexter\AppData\Local\SquirrelTemp
2016-05-06 15:44 - 2015-11-10 20:12 - 00000000 ____D C:\Users\Dexter\AppData\Local\Discord
2016-05-05 20:47 - 2015-08-16 14:58 - 00000000 ____D C:\WINDOWS\AutoKMS
2016-05-05 15:36 - 2015-08-18 16:01 - 00000000 ____D C:\Gamez
2016-05-05 15:33 - 2015-08-16 14:58 - 00003804 _____ C:\WINDOWS\System32\Tasks\AutoKMS
2016-05-05 15:31 - 2016-03-15 21:23 - 00000000 ____D C:\Program Files\AMD
2016-05-03 19:06 - 2015-08-16 14:51 - 00000000 ____D C:\Users\Dexter\AppData\Local\Packages
2016-04-28 15:10 - 2015-08-16 14:54 - 00000000 ____D C:\AMD
2016-04-28 15:08 - 2016-03-15 21:23 - 00000000 ____D C:\Program Files (x86)\ATI Technologies
2016-04-28 15:08 - 2015-08-16 16:19 - 00000000 ____D C:\Users\Dexter\AppData\Local\AMD
2016-04-28 15:08 - 2015-08-16 15:01 - 00000000 ____D C:\Program Files (x86)\AMD
2016-04-26 02:03 - 2016-01-21 23:01 - 00000000 ____D C:\Users\Dexter\AppData\Roaming\Skype
2016-04-26 01:20 - 2016-01-21 23:01 - 00000000 ____D C:\ProgramData\Skype
2016-04-25 00:35 - 2015-09-02 15:57 - 00221824 _____ (Samsung Electronics Co., Ltd.) C:\WINDOWS\system32\Drivers\ssudmdm.sys
2016-04-25 00:35 - 2015-09-02 15:56 - 00129152 _____ (Samsung Electronics Co., Ltd.) C:\WINDOWS\system32\Drivers\ssudbus.sys
2016-04-23 18:49 - 2015-10-30 09:24 - 00000000 ____D C:\WINDOWS\LiveKernelReports
2016-04-23 17:38 - 2016-03-15 21:23 - 00000000 ____D C:\ProgramData\Package Cache
2016-04-22 09:57 - 2015-08-17 10:55 - 00453288 ____N (Microsoft Corporation) C:\WINDOWS\system32\MpSigStub.exe
 
==================== Pliki w katalogu głównym wybranych folderów =======
 
2016-05-17 20:11 - 2016-05-17 20:11 - 0007874 _____ () C:\Users\Dexter\AppData\Local\recently-used.xbel
2015-10-16 19:39 - 2015-12-13 20:36 - 0007605 _____ () C:\Users\Dexter\AppData\Local\Resmon.ResmonCfg
2016-04-03 03:52 - 2016-04-03 03:52 - 0000000 ____H () C:\ProgramData\DP45977C.lfl
 
Niektóre pliki w TEMP:
====================
C:\Users\Dexter\AppData\Local\Temp\2Y5zIXaRWr.exe
C:\Users\Dexter\AppData\Local\Temp\drm_dialogs.dll
C:\Users\Dexter\AppData\Local\Temp\drm_dyndata_7340014.dll
C:\Users\Dexter\AppData\Local\Temp\jre-8u73-windows-au.exe
C:\Users\Dexter\AppData\Local\Temp\libeay32.dll
C:\Users\Dexter\AppData\Local\Temp\msvcr120.dll
C:\Users\Dexter\AppData\Local\Temp\sfamcc00001.dll
C:\Users\Dexter\AppData\Local\Temp\sqlite3.dll
C:\Users\Dexter\AppData\Local\Temp\xmlUpdater.exe
 
 
==================== Bamital & volsnap =================
 
(Brak automatycznej naprawy dla plików które nie przeszły weryfikacji.)
 
C:\WINDOWS\system32\winlogon.exe => Plik podpisany cyfrowo
C:\WINDOWS\system32\wininit.exe => Plik podpisany cyfrowo
C:\WINDOWS\explorer.exe => Plik podpisany cyfrowo
C:\WINDOWS\SysWOW64\explorer.exe => Plik podpisany cyfrowo
C:\WINDOWS\system32\svchost.exe => Plik podpisany cyfrowo
C:\WINDOWS\SysWOW64\svchost.exe => Plik podpisany cyfrowo
C:\WINDOWS\system32\services.exe => Plik podpisany cyfrowo
C:\WINDOWS\system32\User32.dll => Plik podpisany cyfrowo
C:\WINDOWS\SysWOW64\User32.dll => Plik podpisany cyfrowo
C:\WINDOWS\system32\userinit.exe => Plik podpisany cyfrowo
C:\WINDOWS\SysWOW64\userinit.exe => Plik podpisany cyfrowo
C:\WINDOWS\system32\rpcss.dll => Plik podpisany cyfrowo
C:\WINDOWS\system32\dnsapi.dll => Plik podpisany cyfrowo
C:\WINDOWS\SysWOW64\dnsapi.dll => Plik podpisany cyfrowo
C:\WINDOWS\system32\Drivers\volsnap.sys => Plik podpisany cyfrowo
 
 
LastRegBack: 2016-05-15 10:07
 
==================== Koniec  FRST.txt ============================
 
 

Attached Files



#4 olgun52

olgun52

  • Malware Response Team
  • 3,807 posts
  • OFFLINE
  •  
  • Gender:Male
  • Local time:12:32 AM

Posted 19 May 2016 - 05:17 PM

Hi there,

Zapora systemu Windows [funkcja włączona]

Please do disable.
===============================

UWAGA: Przywracanie systemu jest wyłączone

Please do enable,
How to Enable and Disable System Restore
https://support.microsoft.com/en-us/kb/264887
===================================================================================

Please uninstall:

Gyazo
hohosearch
IObit Unlocker

And PC restart now.

===========================================

 FRST Script:
 Please download this attached Attached File  Fixlist.txt   3.18KB   3 downloads and save it in the same directory as FRST

  • Close any open browsers or any other programs that are open
  • Start FRST with Administrator privileges.
  • Press the Fix button.
  • When finished, a log file (Fixlog.txt) pops up and is saved to the same location the tool was run from.
    Please copy and paste its contents in your next reply.

Please download AdwCleaner by Xplode and save to your Desktop.

  • Double click on AdwCleaner.exe to run the tool.
    Vista/Windows 7/8 users right-click and select Run As Administrator
  • Click on the Scan button.
  • AdwCleaner will begin...be patient as the scan may take some time to complete.
  • After the scan has finished, click on the Report button...a logfile (AdwCleaner[R0].txt) will open in Notepad for review.
  • The contents of the log file may be confusing. Unless you see a program name that you know should not be removed, don't worry about it. If you see an entry you want to keep, let me know about it.
  • Copy and paste the contents of that logfile in your next reply.
  • A copy of all logfiles are saved in the C:\AdwCleaner folder which was created when running the tool.

If you agree with everything listed to be removed in the folders section...........
Double click on AdwCleaner.exe to run the tool again.

  • Click on the Scan button.
  • AdwCleaner will begin to scan your computer like it did before.
  • After the scan has finished...
  • This time click on the Clean button.
  • Press OK when asked to close all programs and follow the onscreen prompts.
  • Press OK again to allow AdwCleaner to restart the computer and complete the removal process.
  • After rebooting, a logfile report (AdwCleaner[s0].txt) will open automatically.
  • Copy and paste the contents of that logfile in your next reply.
  • A copy of that logfile will also be saved in the C:\AdwCleaner folder.

Next >>
Please download Junkware Removal Tool to your desktop.

  • Shut down your protection software now to avoid potential conflicts.
  • Run the tool by double-clicking it. If you are using Windows Vista or Seven, right-mouse click it and select Run as Administrator.
  • The tool will open and start scanning your system.
  • Please be patient as this can take a while to complete depending on your system's specifications.
  • On completion, a log (JRT.txt) is saved to your desktop and will automatically open.
  • Post the contents of JRT.txt into your next message.

Best regards
 
paypal.gif
If you wish to show appreciation and support me personally fighting against malware, then you can consider a donation. Thank you. :thumbup2:
Malware fix forum
If I don't reply within 24 hours please PM me!

 


 





0 user(s) are reading this topic

0 members, 0 guests, 0 anonymous users